diff --git a/.deadcode-out b/.deadcode-out
index 45ad117ccd..b70be3e800 100644
--- a/.deadcode-out
+++ b/.deadcode-out
@@ -58,7 +58,6 @@ forgejo.org/models/user
 	IsErrUserSettingIsNotExist
 	GetUserAllSettings
 	DeleteUserSetting
-	GetFederatedUser
 
 forgejo.org/modules/activitypub
 	NewContext
@@ -88,7 +87,6 @@ forgejo.org/modules/eventsource
 	Event.String
 
 forgejo.org/modules/forgefed
-	NewForgeFollow
 	NewForgeUndoLike
 	ForgeUndoLike.UnmarshalJSON
 	ForgeUndoLike.Validate
@@ -134,6 +132,9 @@ forgejo.org/modules/json
 	StdJSON.Indent
 
 forgejo.org/modules/log
+	eventWriterBuffer.Close
+	eventWriterBuffer.Write
+	eventWriterBuffer.GetString
 	NewEventWriterBuffer
 
 forgejo.org/modules/markup
@@ -224,9 +225,6 @@ forgejo.org/routers/web/org
 forgejo.org/services/context
 	GetPrivateContext
 
-forgejo.org/services/federation
-	FollowRemoteActor
-
 forgejo.org/services/notify
 	UnregisterNotifier
 
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 0db96fc73a..46b85ad93d 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,5 +1,5 @@
 {
-  "name": "Gitea DevContainer",
+  "name": "forgejo-dev",
   "image": "mcr.microsoft.com/devcontainers/go:1.26-trixie",
   "features": {
     // installs nodejs into container
diff --git a/.forgejo/renovate.json b/.forgejo/renovate.json
index 34c5c1f958..758ae282a8 100644
--- a/.forgejo/renovate.json
+++ b/.forgejo/renovate.json
@@ -9,7 +9,7 @@
   "baseBranchPatterns": [
     "$default",
     "/^v11\\.\\d+/forgejo$/",
-    "/^v14\\.\\d+/forgejo$/"
+    "/^v15\\.\\d+/forgejo$/"
   ],
   "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths", "npmDedupe"],
   "prConcurrentLimit": 10,
@@ -138,6 +138,13 @@
       ],
       "automerge": true
     },
+    {
+      "description": "Run end-to-end tests for some dependencies",
+      "matchPackageNames": [
+        "code.forgejo.org/forgejo/runner/**"
+      ],
+      "addLabels": ["run-end-to-end-tests"]
+    },
     {
       "description": "Disable indirect updates for stable branches",
       "matchBaseBranches": ["/^v\\d+\\.\\d+\\/forgejo$/"],
@@ -152,6 +159,12 @@
       "matchUpdateTypes": ["major"],
       "enabled": false
     },
+    {
+      "description": "Disable updates for old stable branches but still allow security updates",
+      "matchBaseBranches": ["v11.0/forgejo", "v14.0/forgejo"],
+      "matchUpdateTypes": ["minor", "patch", "digest"],
+      "enabled": false
+    },
     {
       "description": "Require approval for stable branches (must be last rule to override all others)",
       "matchBaseBranches": ["/^v\\d+\\.\\d+\\/forgejo$/"],
diff --git a/.forgejo/workflows/backport.yml b/.forgejo/workflows/backport.yml
index 56956c4641..4854eb225e 100644
--- a/.forgejo/workflows/backport.yml
+++ b/.forgejo/workflows/backport.yml
@@ -47,7 +47,7 @@ jobs:
           cat <<'EOF'
           ${{ toJSON(github) }}
           EOF
-      - uses: https://data.forgejo.org/actions/git-backporting@v4.8.7
+      - uses: https://data.forgejo.org/actions/git-backporting@v4.9.1
         with:
           target-branch-pattern: "^backport/(?<target>(v.*))$"
           strategy: ort
diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml
index 1bec8b7dfa..3d024f5f9e 100644
--- a/.forgejo/workflows/build-release-integration.yml
+++ b/.forgejo/workflows/build-release-integration.yml
@@ -2,7 +2,7 @@ name: Integration tests for the release process
 enable-email-notifications: true
 
 env:
-  FORGEJO_VERSION: 11.0.11 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
+  FORGEJO_VERSION: 11.0.14 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
 
 on:
   push:
@@ -32,7 +32,7 @@ jobs:
       - uses: https://data.forgejo.org/actions/checkout@v6
 
       - id: forgejo
-        uses: https://data.forgejo.org/actions/setup-forgejo@v3.1.8
+        uses: https://data.forgejo.org/actions/setup-forgejo@v3.1.11
         with:
           user: root
           password: admin1234
diff --git a/.forgejo/workflows/release-notes-assistant-milestones.yml b/.forgejo/workflows/release-notes-assistant-milestones.yml
index 8d7df5f18d..f075406335 100644
--- a/.forgejo/workflows/release-notes-assistant-milestones.yml
+++ b/.forgejo/workflows/release-notes-assistant-milestones.yml
@@ -6,7 +6,7 @@ on:
 
 env:
   RNA_WORKDIR: /srv/rna
-  RNA_VERSION: v1.6.1 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
+  RNA_VERSION: v1.7.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
 
 jobs:
   release-notes:
diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml
index 34d73624ec..e85f11b7f8 100644
--- a/.forgejo/workflows/release-notes-assistant.yml
+++ b/.forgejo/workflows/release-notes-assistant.yml
@@ -8,7 +8,7 @@ on:
       - labeled
 
 env:
-  RNA_VERSION: v1.6.1 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
+  RNA_VERSION: v1.7.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
 
 jobs:
   release-notes:
diff --git a/.golangci.yml b/.golangci.yml
index 59beb8b5fb..5fa6c13860 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -224,9 +224,6 @@ linters:
       - path: models/dbfs/dbfile.go
         linters:
           - nilnil
-      - path: models/forgefed/federationhost_repository.go
-        linters:
-          - nilnil
       - path: models/forgejo_migrations_legacy/v32.go
         linters:
           - nilnil
@@ -284,9 +281,6 @@ linters:
       - path: models/repo/repo.go
         linters:
           - nilnil
-      - path: models/user/user_repository.go
-        linters:
-          - nilnil
       - path: modules/git/commit.go
         linters:
           - nilnil
@@ -365,9 +359,6 @@ linters:
       - path: routers/api/packages/conan/auth.go
         linters:
           - nilnil
-      - path: services/federation/signature_service.go
-        linters:
-          - nilnil
       - path: services/issue/commit.go
         linters:
           - nilnil
diff --git a/.mockery.yml b/.mockery.yml
new file mode 100644
index 0000000000..2e9427cd77
--- /dev/null
+++ b/.mockery.yml
@@ -0,0 +1,17 @@
+formatter: gofmt
+template: testify
+packages:
+  forgejo.org/modules/nosql:
+    config:
+      filename: mocks.go # make mocks public so that external packages can use
+  forgejo.org/services/auth/method:
+  forgejo.org/services/authz:
+    config:
+      filename: authorization_reducer_mock.go # make mocks public so that external packages can use
+  code.forgejo.org/go-chi/cache:
+    interfaces:
+      Cache:
+        config:
+          pkgname: cache
+          dir: modules/cache
+          filename: mocks.go # make mocks public, not `_test.go`, so that external packages can mock caching
diff --git a/.node-version b/.node-version
index 045200741c..eefb690f4a 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-24.14.1
\ No newline at end of file
+24.15.0
\ No newline at end of file
diff --git a/.release-notes-assistant.yaml b/.release-notes-assistant.yaml
index fe65dc3241..f942778fe7 100644
--- a/.release-notes-assistant.yaml
+++ b/.release-notes-assistant.yaml
@@ -7,6 +7,7 @@ branch-from-version: 'v%[1]d.%[2]d/forgejo'
 tag-from-version: 'v%[1]d.%[2]d.%[3]d'
 supported-release-count: 3
 branch-known:
+# replace with v15 when v11 becomes EOL
   - 'v11.0/forgejo'
 cleanup-line: 'sed -Ee "s/^(feat|fix):\s*//g" -e "s/^\[WIP\] //" -e "s/^WIP: //" -e "s;\[(UI|BUG|FEAT|v.*?/forgejo)\]\s*;;g"'
 render-header: |
diff --git a/.semgrep/config/logic.yaml b/.semgrep/config/logic.yaml
new file mode 100644
index 0000000000..85c43f5531
--- /dev/null
+++ b/.semgrep/config/logic.yaml
@@ -0,0 +1,11 @@
+rules:
+  - id: forgejo-logic-suspicious-OwnerID-check
+    pattern: |-
+      $X.OwnerID > 0
+    languages:
+      - go
+    severity: ERROR
+    message: >
+      Many resources like comments or runners cannot only be owned by regular users, which have positive IDs, but also
+      by predefined system users like Ghost or Forgejo Actions that have negative IDs. In those cases, ownership checks
+      should only exclude 0: `OwnerID != 0`.
diff --git a/.semgrep/tests/logic.go b/.semgrep/tests/logic.go
new file mode 100644
index 0000000000..32a2777ff6
--- /dev/null
+++ b/.semgrep/tests/logic.go
@@ -0,0 +1,35 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import "xorm.io/builder"
+
+type FindRunJobOptions struct {
+	RepoID  int64
+	OwnerID int64
+}
+
+func (opts FindRunJobOptions) Bad() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+	// ruleid:forgejo-logic-suspicious-OwnerID-check
+	if opts.OwnerID > 0 {
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
+	}
+	return cond
+}
+
+func (opts FindRunJobOptions) Good() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+	// ok:forgejo-logic-suspicious-OwnerID-check
+	if opts.OwnerID != 0 {
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
+	}
+	return cond
+}
diff --git a/Makefile b/Makefile
index d1a1e90dec..80779cfecc 100644
--- a/Makefile
+++ b/Makefile
@@ -45,10 +45,10 @@ SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.2 # renova
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
 GO_LICENSES_PACKAGE ?= github.com/google/go-licenses/v2@v2.0.1 # renovate: datasource=go
 GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1 # renovate: datasource=go
-DEADCODE_PACKAGE ?= golang.org/x/tools/cmd/deadcode@v0.43.0 # renovate: datasource=go
+DEADCODE_PACKAGE ?= golang.org/x/tools/cmd/deadcode@v0.45.0 # renovate: datasource=go
 ERRORTYPE_PACKAGE ?= fillmore-labs.com/errortype@v0.0.11 # renovate: datasource=go
-GOMOCK_PACKAGE ?= go.uber.org/mock/mockgen@v0.6.0 # renovate: datasource=go
-RENOVATE_NPM_PACKAGE ?= renovate@43.86.1 # renovate: datasource=docker packageName=data.forgejo.org/renovate/renovate
+RENOVATE_NPM_PACKAGE ?= renovate@43.170.20 # renovate: datasource=docker packageName=data.forgejo.org/renovate/renovate
+MOCKERY_PACKAGE ?= github.com/vektra/mockery/v3@v3.7.0 # renovate: datasource=go
 
 # https://github.com/disposable-email-domains/disposable-email-domains/commits/main/
 DISPOSABLE_EMAILS_SHA ?= 0c27e671231d27cf66370034d7f6818037416989 # renovate: ...
@@ -245,7 +245,7 @@ help:
 	@echo " - generate-license                 update license files"
 	@echo " - generate-gitignore               update gitignore files"
 	@echo " - generate-manpage                 generate manpage"
-	@echo " - generate-gomock                  generate gomock files"
+	@echo " - generate-mockery                 generate mockery files"
 	@echo " - generate-forgejo-api             generate the forgejo API from spec"
 	@echo " - forgejo-api-validate             check if the forgejo API matches the specs"
 	@echo " - generate-swagger                 generate the swagger spec from code comments"
@@ -562,12 +562,12 @@ test: test-frontend test-backend
 .PHONY: test-backend
 test-backend: | compute-go-test-packages
 	@echo "Running go test with $(GOTESTFLAGS) -tags '$(TEST_TAGS)'..."
-	@TZ=UTC $(GOTEST) $(GOTESTFLAGS) -tags='$(TEST_TAGS)' $(GO_TEST_PACKAGES)
+	@TZ=UTC GITEA_ROOT="$(CURDIR)" $(GOTEST) $(GOTESTFLAGS) -tags='$(TEST_TAGS)' $(GO_TEST_PACKAGES)
 
 .PHONY: test-remote-cacher
 test-remote-cacher:
 	@echo "Running go test with $(GOTESTFLAGS) -tags '$(TEST_TAGS)'..."
-	@$(GOTEST) $(GOTESTFLAGS) -tags='$(TEST_TAGS)' $(GO_TEST_REMOTE_CACHER_PACKAGES)
+	GITEA_ROOT="$(CURDIR)" $(GOTEST) $(GOTESTFLAGS) -tags='$(TEST_TAGS)' $(GO_TEST_REMOTE_CACHER_PACKAGES)
 
 .PHONY: test-frontend
 test-frontend: node_modules
@@ -592,7 +592,7 @@ test-check:
 .PHONY: test\#%
 test\#%: | compute-go-test-packages
 	@echo "Running go test with $(GOTESTFLAGS) -tags '$(TEST_TAGS)'..."
-	@TZ=UTC $(GOTEST) $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -run $(subst .,/,$*) $(GO_TEST_PACKAGES)
+	@TZ=UTC GITEA_ROOT="$(CURDIR)" $(GOTEST) $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -run $(subst .,/,$*) $(GO_TEST_PACKAGES)
 
 coverage-merge:
 	rm -fr coverage/merged ; mkdir -p coverage/merged
@@ -968,8 +968,8 @@ deps-tools:
 	$(GO) install $(XGO_PACKAGE)
 	$(GO) install $(GO_LICENSES_PACKAGE)
 	$(GO) install $(GOVULNCHECK_PACKAGE)
-	$(GO) install $(GOMOCK_PACKAGE)
 	$(GO) install $(ERRORTYPE_PACKAGE)
+	$(GO) install $(MOCKERY_PACKAGE)
 
 node_modules: package-lock.json
 	npm install --no-save
@@ -1024,9 +1024,9 @@ generate-license:
 generate-gitignore:
 	$(GO) run build/generate-gitignores.go
 
-.PHONY: generate-gomock
-generate-gomock:
-	$(GO) run $(GOMOCK_PACKAGE) -package mock -destination ./modules/queue/mock/redisuniversalclient.go forgejo.org/modules/nosql RedisClient
+.PHONY: generate-mockery
+generate-mockery:
+	$(GO) run $(MOCKERY_PACKAGE)
 
 .PHONY: generate-images
 generate-images: | node_modules
diff --git a/assets/go-licenses.json b/assets/go-licenses.json
index dd1d033d1a..7f1498042c 100644
--- a/assets/go-licenses.json
+++ b/assets/go-licenses.json
@@ -389,6 +389,11 @@
     "path": "github.com/blevesearch/zapx/v16/LICENSE",
     "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License."
   },
+  {
+    "name": "github.com/blevesearch/zapx/v17",
+    "path": "github.com/blevesearch/zapx/v17/LICENSE",
+    "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License."
+  },
   {
     "name": "github.com/bmatcuk/doublestar/v4",
     "path": "github.com/bmatcuk/doublestar/v4/LICENSE",
@@ -459,11 +464,6 @@
     "path": "github.com/davecgh/go-spew/spew/LICENSE",
     "licenseText": "ISC License\n\nCopyright (c) 2012-2016 Dave Collins \u003cdave@davec.name\u003e\n\nPermission to use, copy, modify, and/or distribute this software for any\npurpose with or without fee is hereby granted, provided that the above\ncopyright notice and this permission notice appear in all copies.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES\nWITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR\nANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES\nWHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN\nACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF\nOR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\n"
   },
-  {
-    "name": "github.com/dgryski/go-rendezvous",
-    "path": "github.com/dgryski/go-rendezvous/LICENSE",
-    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2017-2020 Damian Gryski \u003cdamian@gryski.com\u003e\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
-  },
   {
     "name": "github.com/djherbis/buffer",
     "path": "github.com/djherbis/buffer/LICENSE.txt",
@@ -549,6 +549,11 @@
     "path": "github.com/fxamacker/cbor/v2/LICENSE",
     "licenseText": "MIT License\n\nCopyright (c) 2019-present Faye Amacker\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."
   },
+  {
+    "name": "github.com/gdgvda/cron",
+    "path": "github.com/gdgvda/cron/LICENSE",
+    "licenseText": "Copyright (C) 2012 Rob Figueiredo\nAll Rights Reserved.\n\nMIT LICENSE\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n"
+  },
   {
     "name": "github.com/gliderlabs/ssh",
     "path": "github.com/gliderlabs/ssh/LICENSE",
@@ -604,21 +609,6 @@
     "path": "github.com/go-fed/httpsig/LICENSE",
     "licenseText": "BSD 3-Clause License\n\nCopyright (c) 2018, go-fed\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n  this list of conditions and the following disclaimer in the documentation\n  and/or other materials provided with the distribution.\n\n* Neither the name of the copyright holder nor the names of its\n  contributors may be used to endorse or promote products derived from\n  this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
   },
-  {
-    "name": "github.com/go-git/gcfg",
-    "path": "github.com/go-git/gcfg/LICENSE",
-    "licenseText": "Copyright (c) 2012 Péter Surányi. Portions Copyright (c) 2009 The Go\nAuthors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
-  },
-  {
-    "name": "github.com/go-git/go-billy/v5",
-    "path": "github.com/go-git/go-billy/v5/LICENSE",
-    "licenseText": "                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"{}\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright 2017 Sourced Technologies S.L.\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n"
-  },
-  {
-    "name": "github.com/go-git/go-git/v5",
-    "path": "github.com/go-git/go-git/v5/LICENSE",
-    "licenseText": "                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"{}\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright 2018 Sourced Technologies, S.L.\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n"
-  },
   {
     "name": "github.com/go-ini/ini",
     "path": "github.com/go-ini/ini/LICENSE",
@@ -804,11 +794,6 @@
     "path": "github.com/jackc/puddle/v2/LICENSE",
     "licenseText": "Copyright (c) 2018 Jack Christensen\n\nMIT License\n\nPermission is hereby granted, free of charge, to any person obtaining\na copy of this software and associated documentation files (the\n\"Software\"), to deal in the Software without restriction, including\nwithout limitation the rights to use, copy, modify, merge, publish,\ndistribute, sublicense, and/or sell copies of the Software, and to\npermit persons to whom the Software is furnished to do so, subject to\nthe following conditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\nNONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE\nLIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION\nWITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n"
   },
-  {
-    "name": "github.com/jbenet/go-context/io",
-    "path": "github.com/jbenet/go-context/io/LICENSE",
-    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2014 Juan Batiz-Benet\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
-  },
   {
     "name": "github.com/jhillyerd/enmime/v2",
     "path": "github.com/jhillyerd/enmime/v2/LICENSE",
@@ -869,11 +854,6 @@
     "path": "github.com/klauspost/pgzip/LICENSE",
     "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2014 Klaus Post\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n"
   },
-  {
-    "name": "github.com/lib/pq",
-    "path": "github.com/lib/pq/LICENSE",
-    "licenseText": "MIT License\n\nCopyright (c) 2011-2013, 'pq' Contributors. Portions Copyright (c) 2011 Blake Mizerany\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
-  },
   {
     "name": "github.com/libdns/libdns",
     "path": "github.com/libdns/libdns/LICENSE",
@@ -974,6 +954,11 @@
     "path": "github.com/modern-go/reflect2/LICENSE",
     "licenseText": "                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n"
   },
+  {
+    "name": "github.com/mschoch/smat",
+    "path": "github.com/mschoch/smat/LICENSE",
+    "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License."
+  },
   {
     "name": "github.com/munnerz/goautoneg",
     "path": "github.com/munnerz/goautoneg/LICENSE",
@@ -1184,6 +1169,11 @@
     "path": "github.com/zeebo/blake3/LICENSE",
     "licenseText": "This work is released into the public domain with CC0 1.0.\n\n-------------------------------------------------------------------------------\n\nCreative Commons Legal Code\n\nCC0 1.0 Universal\n\n    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE\n    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN\n    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS\n    INFORMATION ON AN \"AS-IS\" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES\n    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS\n    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM\n    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED\n    HEREUNDER.\n\nStatement of Purpose\n\nThe laws of most jurisdictions throughout the world automatically confer\nexclusive Copyright and Related Rights (defined below) upon the creator\nand subsequent owner(s) (each and all, an \"owner\") of an original work of\nauthorship and/or a database (each, a \"Work\").\n\nCertain owners wish to permanently relinquish those rights to a Work for\nthe purpose of contributing to a commons of creative, cultural and\nscientific works (\"Commons\") that the public can reliably and without fear\nof later claims of infringement build upon, modify, incorporate in other\nworks, reuse and redistribute as freely as possible in any form whatsoever\nand for any purposes, including without limitation commercial purposes.\nThese owners may contribute to the Commons to promote the ideal of a free\nculture and the further production of creative, cultural and scientific\nworks, or to gain reputation or greater distribution for their Work in\npart through the use and efforts of others.\n\nFor these and/or other purposes and motivations, and without any\nexpectation of additional consideration or compensation, the person\nassociating CC0 with a Work (the \"Affirmer\"), to the extent that he or she\nis an owner of Copyright and Related Rights in the Work, voluntarily\nelects to apply CC0 to the Work and publicly distribute the Work under its\nterms, with knowledge of his or her Copyright and Related Rights in the\nWork and the meaning and intended legal effect of CC0 on those rights.\n\n1. Copyright and Related Rights. A Work made available under CC0 may be\nprotected by copyright and related or neighboring rights (\"Copyright and\nRelated Rights\"). Copyright and Related Rights include, but are not\nlimited to, the following:\n\n  i. the right to reproduce, adapt, distribute, perform, display,\n     communicate, and translate a Work;\n ii. moral rights retained by the original author(s) and/or performer(s);\niii. publicity and privacy rights pertaining to a person's image or\n     likeness depicted in a Work;\n iv. rights protecting against unfair competition in regards to a Work,\n     subject to the limitations in paragraph 4(a), below;\n  v. rights protecting the extraction, dissemination, use and reuse of data\n     in a Work;\n vi. database rights (such as those arising under Directive 96/9/EC of the\n     European Parliament and of the Council of 11 March 1996 on the legal\n     protection of databases, and under any national implementation\n     thereof, including any amended or successor version of such\n     directive); and\nvii. other similar, equivalent or corresponding rights throughout the\n     world based on applicable law or treaty, and any national\n     implementations thereof.\n\n2. Waiver. To the greatest extent permitted by, but not in contravention\nof, applicable law, Affirmer hereby overtly, fully, permanently,\nirrevocably and unconditionally waives, abandons, and surrenders all of\nAffirmer's Copyright and Related Rights and associated claims and causes\nof action, whether now known or unknown (including existing as well as\nfuture claims and causes of action), in the Work (i) in all territories\nworldwide, (ii) for the maximum duration provided by applicable law or\ntreaty (including future time extensions), (iii) in any current or future\nmedium and for any number of copies, and (iv) for any purpose whatsoever,\nincluding without limitation commercial, advertising or promotional\npurposes (the \"Waiver\"). Affirmer makes the Waiver for the benefit of each\nmember of the public at large and to the detriment of Affirmer's heirs and\nsuccessors, fully intending that such Waiver shall not be subject to\nrevocation, rescission, cancellation, termination, or any other legal or\nequitable action to disrupt the quiet enjoyment of the Work by the public\nas contemplated by Affirmer's express Statement of Purpose.\n\n3. Public License Fallback. Should any part of the Waiver for any reason\nbe judged legally invalid or ineffective under applicable law, then the\nWaiver shall be preserved to the maximum extent permitted taking into\naccount Affirmer's express Statement of Purpose. In addition, to the\nextent the Waiver is so judged Affirmer hereby grants to each affected\nperson a royalty-free, non transferable, non sublicensable, non exclusive,\nirrevocable and unconditional license to exercise Affirmer's Copyright and\nRelated Rights in the Work (i) in all territories worldwide, (ii) for the\nmaximum duration provided by applicable law or treaty (including future\ntime extensions), (iii) in any current or future medium and for any number\nof copies, and (iv) for any purpose whatsoever, including without\nlimitation commercial, advertising or promotional purposes (the\n\"License\"). The License shall be deemed effective as of the date CC0 was\napplied by Affirmer to the Work. Should any part of the License for any\nreason be judged legally invalid or ineffective under applicable law, such\npartial invalidity or ineffectiveness shall not invalidate the remainder\nof the License, and in such case Affirmer hereby affirms that he or she\nwill not (i) exercise any of his or her remaining Copyright and Related\nRights in the Work or (ii) assert any associated claims and causes of\naction with respect to the Work, in either case contrary to Affirmer's\nexpress Statement of Purpose.\n\n4. Limitations and Disclaimers.\n\n a. No trademark or patent rights held by Affirmer are waived, abandoned,\n    surrendered, licensed or otherwise affected by this document.\n b. Affirmer offers the Work as-is and makes no representations or\n    warranties of any kind concerning the Work, express, implied,\n    statutory or otherwise, including without limitation warranties of\n    title, merchantability, fitness for a particular purpose, non\n    infringement, or the absence of latent or other defects, accuracy, or\n    the present or absence of errors, whether or not discoverable, all to\n    the greatest extent permissible under applicable law.\n c. Affirmer disclaims responsibility for clearing rights of other persons\n    that may apply to the Work or any use thereof, including without\n    limitation any person's Copyright and Related Rights in the Work.\n    Further, Affirmer disclaims responsibility for obtaining any necessary\n    consents, permissions or other rights required for any use of the\n    Work.\n d. Affirmer understands and acknowledges that Creative Commons is not a\n    party to this document and has no duty or obligation with respect to\n    this CC0 or use of the Work.\n"
   },
+  {
+    "name": "github.com/zeebo/xxh3",
+    "path": "github.com/zeebo/xxh3/LICENSE",
+    "licenseText": "BSD 2-Clause License\n\nCopyright (c) 2012-2014, Yann Collet\nCopyright (c) 2019, Jeff Wendling\nAll rights reserved.\n\nxxHash Library\n\nRedistribution and use in source and binary forms, with or without modification,\nare permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice, this\n  list of conditions and the following disclaimer in the documentation and/or\n  other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
   {
     "name": "gitlab.com/gitlab-org/api/client-go",
     "path": "gitlab.com/gitlab-org/api/client-go/LICENSE",
@@ -1207,7 +1197,7 @@
   {
     "name": "go.uber.org/zap",
     "path": "go.uber.org/zap/LICENSE",
-    "licenseText": "Copyright (c) 2016-2017 Uber Technologies, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
+    "licenseText": "Copyright (c) 2016-2024 Uber Technologies, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
   },
   {
     "name": "go.uber.org/zap/exp/zapslog",
@@ -1289,11 +1279,6 @@
     "path": "gopkg.in/ini.v1/LICENSE",
     "licenseText": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that You\nchanged the files; and\nYou must retain, in the Source form of any Derivative Works that You distribute,\nall copyright, patent, trademark, and attribution notices from the Source form\nof the Work, excluding those notices that do not pertain to any part of the\nDerivative Works; and\nIf the Work includes a \"NOTICE\" text file as part of its distribution, then any\nDerivative Works that You distribute must include a readable copy of the\nattribution notices contained within such NOTICE file, excluding those notices\nthat do not pertain to any part of the Derivative Works, in at least one of the\nfollowing places: within a NOTICE text file distributed as part of the\nDerivative Works; within the Source form or documentation, if provided along\nwith the Derivative Works; or, within a display generated by the Derivative\nWorks, if and wherever such third-party notices normally appear. The contents of\nthe NOTICE file are for informational purposes only and do not modify the\nLicense. You may add Your own attribution notices within Derivative Works that\nYou distribute, alongside or as an addendum to the NOTICE text from the Work,\nprovided that such additional attribution notices cannot be construed as\nmodifying the License.\nYou may add Your own copyright statement to Your modifications and may provide\nadditional or different license terms and conditions for use, reproduction, or\ndistribution of Your modifications, or for any such Derivative Works as a whole,\nprovided Your use, reproduction, and distribution of the Work otherwise complies\nwith the conditions stated in this License.\n\n5. Submission of Contributions.\n\nUnless You explicitly state otherwise, any Contribution intentionally submitted\nfor inclusion in the Work by You to the Licensor shall be under the terms and\nconditions of this License, without any additional terms or conditions.\nNotwithstanding the above, nothing herein shall supersede or modify the terms of\nany separate license agreement you may have executed with Licensor regarding\nsuch Contributions.\n\n6. Trademarks.\n\nThis License does not grant permission to use the trade names, trademarks,\nservice marks, or product names of the Licensor, except as required for\nreasonable and customary use in describing the origin of the Work and\nreproducing the content of the NOTICE file.\n\n7. Disclaimer of Warranty.\n\nUnless required by applicable law or agreed to in writing, Licensor provides the\nWork (and each Contributor provides its Contributions) on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,\nincluding, without limitation, any warranties or conditions of TITLE,\nNON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are\nsolely responsible for determining the appropriateness of using or\nredistributing the Work and assume any risks associated with Your exercise of\npermissions under this License.\n\n8. Limitation of Liability.\n\nIn no event and under no legal theory, whether in tort (including negligence),\ncontract, or otherwise, unless required by applicable law (such as deliberate\nand grossly negligent acts) or agreed to in writing, shall any Contributor be\nliable to You for damages, including any direct, indirect, special, incidental,\nor consequential damages of any character arising as a result of this License or\nout of the use or inability to use the Work (including but not limited to\ndamages for loss of goodwill, work stoppage, computer failure or malfunction, or\nany and all other commercial damages or losses), even if such Contributor has\nbeen advised of the possibility of such damages.\n\n9. Accepting Warranty or Additional Liability.\n\nWhile redistributing the Work or Derivative Works thereof, You may choose to\noffer, and charge a fee for, acceptance of support, warranty, indemnity, or\nother liability obligations and/or rights consistent with this License. However,\nin accepting such obligations, You may act only on Your own behalf and on Your\nsole responsibility, not on behalf of any other Contributor, and only if You\nagree to indemnify, defend, and hold each Contributor harmless for any liability\nincurred by, or claims asserted against, such Contributor by reason of your\naccepting any such warranty or additional liability.\n\nEND OF TERMS AND CONDITIONS\n\nAPPENDIX: How to apply the Apache License to your work\n\nTo apply the Apache License to your work, attach the following boilerplate\nnotice, with the fields enclosed by brackets \"[]\" replaced with your own\nidentifying information. (Don't include the brackets!) The text should be\nenclosed in the appropriate comment syntax for the file format. We also\nrecommend that a file or class name and description of purpose be included on\nthe same \"printed page\" as the copyright notice for easier identification within\nthird-party archives.\n\n   Copyright 2014 Unknwon\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n     http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n"
   },
-  {
-    "name": "gopkg.in/warnings.v0",
-    "path": "gopkg.in/warnings.v0/LICENSE",
-    "licenseText": "Copyright (c) 2016 Péter Surányi.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
-  },
   {
     "name": "gopkg.in/yaml.v2",
     "path": "gopkg.in/yaml.v2/LICENSE",
diff --git a/build/lint-locale-usage/allowed-masked-usage.txt b/build/lint-locale-usage/allowed-masked-usage.txt
index ca899c7d38..205d3c3cca 100644
--- a/build/lint-locale-usage/allowed-masked-usage.txt
+++ b/build/lint-locale-usage/allowed-masked-usage.txt
@@ -6,32 +6,12 @@ translation_meta.test
 # this also gets instantiated as a Messenger once
 repo.migrate.migrating_failed.error
 
-# models/system/notice.go: func (n *Notice) TrStr() string
-admin.notices.type_1
-admin.notices.type_2
-
 # modules/setting/ui.go
 themes.names.
 
 # services/context/context.go
 relativetime.
 
-# templates/repo/issue/view_content.tmpl: indirection via $closeTranslationKey
-repo.issues.close
-repo.pulls.close
-
-# templates/repo/issue/view_content/comments.tmpl: indirection via $refTr
-repo.issues.ref_closing_from
-repo.issues.ref_issue_from
-repo.issues.ref_pull_from
-repo.issues.ref_reopening_from
-
-# templates/repo/issue/view_content/comments.tmpl: ctx.Locale.Tr (printf "projects.type-%d.display_name" .OldProject.Type)
-projects.
-projects.type-1.display_name
-projects.type-2.display_name
-projects.type-3.display_name
-
 # templates/repo/settings/webhook/link_menu.tmpl, templates/webhook/new.tmpl: repo.settings.web_hook_name_
 # tests/integration/repo_archive_text_test.go
 repo.settings.
diff --git a/build/lint-locale-usage/bin/handle-go.go b/build/lint-locale-usage/bin/handle-go.go
index ffa6b13165..5b68543e9d 100644
--- a/build/lint-locale-usage/bin/handle-go.go
+++ b/build/lint-locale-usage/bin/handle-go.go
@@ -37,144 +37,172 @@ func HandleGoFile(handler llu.Handler, fname string, src any) error {
 	}
 
 	ast.Inspect(node, func(n ast.Node) bool {
-		// search for function calls of the form `anything.Tr(any-string-lit, ...)`
+		return HandleGoNode(handler, fset, fname, n)
+	})
 
-		switch n2 := n.(type) {
-		case *ast.CallExpr:
-			if len(n2.Args) == 0 {
-				return true
+	return nil
+}
+
+func HandleGoNode(handler llu.Handler, fset *token.FileSet, fname string, n ast.Node) bool {
+	// search for function calls of the form `anything.Tr(any-string-lit, ...)`
+
+	switch n2 := n.(type) {
+	case *ast.CallExpr:
+		if len(n2.Args) == 0 {
+			return true
+		}
+		funSel, ok := n2.Fun.(*ast.SelectorExpr)
+		if !ok {
+			return true
+		}
+
+		ltf, ok := handler.LocaleTrFunctions[funSel.Sel.Name]
+		if !ok {
+			return true
+		}
+
+		var gotUnexpectedInvoke *int
+
+		for _, argNum := range ltf {
+			if len(n2.Args) <= int(argNum) {
+				argc := len(n2.Args)
+				gotUnexpectedInvoke = &argc
+			} else {
+				handler.HandleGoTrArgument(fset, n2.Args[int(argNum)], "")
 			}
-			funSel, ok := n2.Fun.(*ast.SelectorExpr)
-			if !ok {
+		}
+
+		if gotUnexpectedInvoke != nil {
+			handler.OnUnexpectedInvoke(fset, funSel.Sel.NamePos, funSel.Sel.Name, *gotUnexpectedInvoke)
+		}
+
+	case *ast.CompositeLit:
+		if strings.HasSuffix(fname, "models/unit/unit.go") {
+			lluUnit.HandleCompositeUnit(handler, fset, n2)
+		} else if strings.Contains(fname, "models/asymkey/") {
+			lluAsymKey.HandleCompositeErrorReason(handler, fset, n2)
+		}
+
+	case *ast.FuncDecl:
+		if matchInsPrefix := handler.HandleGoCommentGroup(fset, n2.Doc, "llu:returnsTrKeyWeak"); matchInsPrefix != nil {
+			results := n2.Type.Results.List
+			if len(results) != 1 {
+				handler.OnWarning(fset, n2.Type.Func, fmt.Sprintf("function %s has unexpected return type; expected single return value", n2.Name.Name))
 				return true
 			}
 
-			ltf, ok := handler.LocaleTrFunctions[funSel.Sel.Name]
-			if !ok {
-				return true
-			}
-
-			var gotUnexpectedInvoke *int
-
-			for _, argNum := range ltf {
-				if len(n2.Args) <= int(argNum) {
-					argc := len(n2.Args)
-					gotUnexpectedInvoke = &argc
-				} else {
-					handler.HandleGoTrArgument(fset, n2.Args[int(argNum)], "")
+			ast.Inspect(n2.Body, func(n ast.Node) bool {
+				// search for return stmts
+				// TODO: what about nested functions?
+				if ret, ok := n.(*ast.ReturnStmt); ok {
+					for _, res := range ret.Results {
+						ast.Inspect(res, func(n ast.Node) bool {
+							if expr, ok := n.(ast.Expr); ok {
+								handler.HandleGoTrArgument(fset, expr, *matchInsPrefix)
+							}
+							return true
+						})
+					}
+					return false
 				}
+				return true
+			})
+		}
+
+		if matchInsPrefix := handler.HandleGoCommentGroup(fset, n2.Doc, "llu:returnsTrKey"); matchInsPrefix != nil {
+			results := n2.Type.Results.List
+			if len(results) != 1 {
+				handler.OnWarning(fset, n2.Type.Func, fmt.Sprintf("function %s has unexpected return type; expected single return value", n2.Name.Name))
+				return true
 			}
 
-			if gotUnexpectedInvoke != nil {
-				handler.OnUnexpectedInvoke(fset, funSel.Sel.NamePos, funSel.Sel.Name, *gotUnexpectedInvoke)
-			}
-
-		case *ast.CompositeLit:
-			if strings.HasSuffix(fname, "models/unit/unit.go") {
-				lluUnit.HandleCompositeUnit(handler, fset, n2)
-			} else if strings.Contains(fname, "models/asymkey/") {
-				lluAsymKey.HandleCompositeErrorReason(handler, fset, n2)
-			}
-
-		case *ast.FuncDecl:
-			matchInsPrefix := handler.HandleGoCommentGroup(fset, n2.Doc, "llu:returnsTrKey")
-			if matchInsPrefix != nil {
-				results := n2.Type.Results.List
-				if len(results) != 1 {
-					handler.OnWarning(fset, n2.Type.Func, fmt.Sprintf("function %s has unexpected return type; expected single return value", n2.Name.Name))
-					return true
+			ast.Inspect(n2.Body, func(n ast.Node) bool {
+				// search for return stmts
+				if ret, ok := n.(*ast.ReturnStmt); ok {
+					for _, res := range ret.Results {
+						handler.HandleGoTrArgument(fset, res, *matchInsPrefix)
+					}
+					return false
+				} else if _, ok := n.(*ast.FuncDecl); ok {
+					ast.Inspect(n, func(n2 ast.Node) bool {
+						return HandleGoNode(handler, fset, fname, n2)
+					})
+					// don't search inside nested functions for return stmts
+					return false
 				}
+				return true
+			})
+		}
 
-				ast.Inspect(n2.Body, func(n ast.Node) bool {
-					// search for return stmts
-					// TODO: what about nested functions?
-					if ret, ok := n.(*ast.ReturnStmt); ok {
-						for _, res := range ret.Results {
-							ast.Inspect(res, func(n ast.Node) bool {
-								if expr, ok := n.(ast.Expr); ok {
-									handler.HandleGoTrArgument(fset, expr, *matchInsPrefix)
-								}
-								return true
-							})
-						}
+		if strings.HasSuffix(fname, "services/migrations/migrate.go") {
+			lluMigrate.HandleMessengerInFunc(handler, fset, n2)
+		}
+		return true
+	case *ast.GenDecl:
+		switch n2.Tok {
+		case token.CONST, token.VAR:
+			matchInsPrefix := handler.HandleGoCommentGroup(fset, n2.Doc, " llu:TrKeys")
+			if matchInsPrefix == nil {
+				return true
+			}
+			for _, spec := range n2.Specs {
+				// interpret all contained strings as message IDs
+				ast.Inspect(spec, func(n ast.Node) bool {
+					if argLit, ok := n.(*ast.BasicLit); ok {
+						handler.HandleGoTrBasicLit(fset, argLit, *matchInsPrefix)
 						return false
 					}
 					return true
 				})
 			}
 
-			if strings.HasSuffix(fname, "services/migrations/migrate.go") {
-				lluMigrate.HandleMessengerInFunc(handler, fset, n2)
-			}
-			return true
-		case *ast.GenDecl:
-			switch n2.Tok {
-			case token.CONST, token.VAR:
-				matchInsPrefix := handler.HandleGoCommentGroup(fset, n2.Doc, " llu:TrKeys")
-				if matchInsPrefix == nil {
-					return true
-				}
-				for _, spec := range n2.Specs {
-					// interpret all contained strings as message IDs
-					ast.Inspect(spec, func(n ast.Node) bool {
-						if argLit, ok := n.(*ast.BasicLit); ok {
-							handler.HandleGoTrBasicLit(fset, argLit, *matchInsPrefix)
-							return false
-						}
-						return true
-					})
-				}
+		case token.TYPE:
+			// modules/web/middleware/binding.go:Validate uses the convention that structs
+			// entries can have tags.
+			// In particular, `locale:$msgid` should be handled; any fields with `form:-` shouldn't.
+			// Problem: we don't know which structs are forms, actually.
 
-			case token.TYPE:
-				// modules/web/middleware/binding.go:Validate uses the convention that structs
-				// entries can have tags.
-				// In particular, `locale:$msgid` should be handled; any fields with `form:-` shouldn't.
-				// Problem: we don't know which structs are forms, actually.
-
-				for _, spec := range n2.Specs {
-					tspec := spec.(*ast.TypeSpec)
-					structNode, ok := tspec.Type.(*ast.StructType)
-					if !ok || !(strings.HasSuffix(tspec.Name.Name, "Form") ||
-						(tspec.Doc != nil &&
-							slices.ContainsFunc(tspec.Doc.List, func(c *ast.Comment) bool {
-								return c.Text == "// swagger:model"
-							}))) {
+			for _, spec := range n2.Specs {
+				tspec := spec.(*ast.TypeSpec)
+				structNode, ok := tspec.Type.(*ast.StructType)
+				if !ok || !(strings.HasSuffix(tspec.Name.Name, "Form") ||
+					(tspec.Doc != nil &&
+						slices.ContainsFunc(tspec.Doc.List, func(c *ast.Comment) bool {
+							return c.Text == "// swagger:model"
+						}))) {
+					continue
+				}
+				for _, field := range structNode.Fields.List {
+					if field.Names == nil {
 						continue
 					}
-					for _, field := range structNode.Fields.List {
-						if field.Names == nil {
-							continue
-						}
-						if len(field.Names) != 1 {
-							handler.OnWarning(fset, field.Type.Pos(), "unsupported multiple field names")
-							continue
-						}
-						msgidPos := field.Names[0].NamePos
-						msgid := "form." + field.Names[0].Name
-						if field.Tag != nil && field.Tag.Kind == token.STRING {
-							rawTag, err := strconv.Unquote(field.Tag.Value)
-							if err != nil {
-								handler.OnWarning(fset, field.Tag.ValuePos, "invalid tag value encountered")
-								continue
-							}
-							tag := reflect.StructTag(rawTag)
-							if tag.Get("form") == "-" {
-								continue
-							}
-							tmp := tag.Get("locale")
-							if len(tmp) != 0 {
-								msgidPos = field.Tag.ValuePos
-								msgid = tmp
-							}
-						}
-						handler.OnMsgid(fset, msgidPos, msgid, true)
+					if len(field.Names) != 1 {
+						handler.OnWarning(fset, field.Type.Pos(), "unsupported multiple field names")
+						continue
 					}
+					msgidPos := field.Names[0].NamePos
+					msgid := "form." + field.Names[0].Name
+					if field.Tag != nil && field.Tag.Kind == token.STRING {
+						rawTag, err := strconv.Unquote(field.Tag.Value)
+						if err != nil {
+							handler.OnWarning(fset, field.Tag.ValuePos, "invalid tag value encountered")
+							continue
+						}
+						tag := reflect.StructTag(rawTag)
+						if tag.Get("form") == "-" {
+							continue
+						}
+						tmp := tag.Get("locale")
+						if len(tmp) != 0 {
+							msgidPos = field.Tag.ValuePos
+							msgid = tmp
+						}
+					}
+					handler.OnMsgid(fset, msgidPos, msgid, true)
 				}
 			}
 		}
+	}
 
-		return true
-	})
-
-	return nil
+	return true
 }
diff --git a/build/lint-locale-usage/bin/lint-locale-usage.go b/build/lint-locale-usage/bin/lint-locale-usage.go
index 311e632461..f04b14f3b2 100644
--- a/build/lint-locale-usage/bin/lint-locale-usage.go
+++ b/build/lint-locale-usage/bin/lint-locale-usage.go
@@ -13,6 +13,7 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 
@@ -44,12 +45,57 @@ type StringTrie interface {
 
 type StringTrieMap map[string]StringTrie
 
+func printfPatternToRegex(key string) (string, bool) {
+	parts := strings.Split(key, "%")
+	if len(parts) < 2 {
+		return key, false
+	}
+	var pattern strings.Builder
+	pattern.WriteString("^")
+	pattern.WriteString(parts[0])
+	skip := false
+	for _, part := range parts[1:] {
+		if skip {
+			skip = false
+			continue
+		}
+		if len(part) == 0 {
+			// "%%"
+			pattern.WriteString("%")
+			continue
+		}
+		switch part[0] {
+		case 'd':
+			pattern.WriteString("[0-9]+")
+		default:
+			pattern.WriteString("[A-Za-z0-9]*")
+		}
+		pattern.WriteString(part[1:])
+	}
+	pattern.WriteString("$")
+	return pattern.String(), true
+}
+
 func (m StringTrieMap) Matches(key []string) bool {
 	if len(key) == 0 || m == nil {
 		return true
 	}
 	value, ok := m[key[0]]
 	if !ok {
+		for altKey, value := range m {
+			// TODO: cache mapping $printfFormatString -> $regexpCompileOutput
+			pattern, found := printfPatternToRegex(altKey)
+			if !found {
+				continue
+			}
+			matched, err := regexp.MatchString(pattern, key[0])
+			if err != nil {
+				panic(fmt.Sprintf("unable to compile regexp '%s': %s", pattern, err.Error()))
+			}
+			if matched && (value == nil || value.Matches(key[1:])) {
+				return true
+			}
+		}
 		return false
 	}
 	if value == nil {
@@ -101,7 +147,7 @@ func ParseAllowedMaskedUsages(fname string, usedMsgids container.Set[string], al
 		if line == "" || strings.HasPrefix(line, "#") {
 			continue
 		}
-		if linePrefix, found := strings.CutSuffix(line, "."); found {
+		if linePrefix, found := strings.CutSuffix(line, "."); found || strings.Contains(line, "%") {
 			allowedMaskedPrefixes.Insert(strings.Split(linePrefix, "."))
 		} else {
 			if !chkMsgid(line) {
@@ -145,9 +191,14 @@ func Usage() {
 
 	fmt.Fprintf(outp, "\nSpecial Go doc comments:\n")
 	for _, i := range []string{
+		"//llu:returnsTrKeyWeak",
+		"\tcan be used in front of functions to indicate",
+		"\tthat the function returns message IDs (allows nesting inside complicated function calls)",
+		"\tWARNING: this currently doesn't support nested functions properly",
+		"",
 		"//llu:returnsTrKey",
 		"\tcan be used in front of functions to indicate",
-		"\tthat the function returns message IDs",
+		"\tthat the function returns message IDs (doesn't allow nesting inside complicated function calls)",
 		"\tWARNING: this currently doesn't support nested functions properly",
 		"",
 		"//llu:returnsTrKeySuffix prefix.",
@@ -260,6 +311,10 @@ func main() {
 	}
 
 	handler := llu.Handler{
+		OnMsgidPattern: func(fset *token.FileSet, pos token.Pos, msgidPattern string) {
+			msgidPatternSplit := strings.Split(msgidPattern, ".")
+			allowedMaskedPrefixes.Insert(msgidPatternSplit)
+		},
 		OnMsgidPrefix: func(fset *token.FileSet, pos token.Pos, msgidPrefix string, truncated bool) {
 			msgidPrefixSplit := strings.Split(msgidPrefix, ".")
 			if !truncated {
@@ -270,6 +325,10 @@ func main() {
 			}
 		},
 		OnMsgid: func(fset *token.FileSet, pos token.Pos, msgid string, weak bool) {
+			if strings.Contains(msgid, "%") {
+				fmt.Printf("%s:\tunexpected msgid pattern: %s\n", fset.Position(pos).String(), msgid)
+				return
+			}
 			if !msgids.Contains(msgid) {
 				if weak && allowWeakMissingMsgids {
 					return
diff --git a/build/lint-locale-usage/handle-go.go b/build/lint-locale-usage/handle-go.go
index 44229e52f7..a8e478a6ef 100644
--- a/build/lint-locale-usage/handle-go.go
+++ b/build/lint-locale-usage/handle-go.go
@@ -34,12 +34,14 @@ func (handler Handler) HandleGoTrBasicLit(fset *token.FileSet, argLit *ast.Basic
 }
 
 func (handler Handler) HandleGoTrArgument(fset *token.FileSet, n ast.Expr, prefix string) {
-	if argLit, ok := n.(*ast.BasicLit); ok {
-		handler.HandleGoTrBasicLit(fset, argLit, prefix)
-	} else if argBinExpr, ok := n.(*ast.BinaryExpr); ok {
-		if argBinExpr.Op != token.ADD {
+	switch n := n.(type) {
+	case *ast.BasicLit:
+		handler.HandleGoTrBasicLit(fset, n, prefix)
+
+	case *ast.BinaryExpr:
+		if n.Op != token.ADD {
 			// pass
-		} else if argLit, ok := argBinExpr.X.(*ast.BasicLit); ok && argLit.Kind == token.STRING {
+		} else if argLit, ok := n.X.(*ast.BasicLit); ok && argLit.Kind == token.STRING {
 			// extract string content
 			arg, err := strconv.Unquote(argLit.Value)
 			if err != nil {
@@ -53,6 +55,39 @@ func (handler Handler) HandleGoTrArgument(fset *token.FileSet, n ast.Expr, prefi
 			}
 			handler.OnMsgidPrefix(fset, argLit.ValuePos, prep, trunc)
 		}
+
+	case *ast.CallExpr:
+		if selExpr, ok := n.Fun.(*ast.SelectorExpr); ok {
+			if xIdent, xok := selExpr.X.(*ast.Ident); !xok || xIdent.Name != "fmt" {
+				return
+			}
+			if selExpr.Sel.Name != "Sprintf" {
+				handler.OnWarning(fset, selExpr.Sel.NamePos, fmt.Sprintf("unexpected formatting function encountered: %s", selExpr.Sel.Name))
+				return
+			}
+			if len(n.Args) == 0 {
+				handler.OnWarning(fset, selExpr.Sel.NamePos, fmt.Sprintf("unexpected formatting function invocation (no arguments) of '%s'", selExpr.Sel.Name))
+				return
+			}
+
+			if argLit, ok := n.Args[0].(*ast.BasicLit); ok && argLit.Kind == token.STRING {
+				// extract string content
+				arg, err := strconv.Unquote(argLit.Value)
+				if err != nil {
+					return
+				}
+				if strings.Contains(arg, " ") {
+					handler.OnWarning(fset, argLit.ValuePos, fmt.Sprintf(
+						"formatting function invocation of '%s' with weird msgid format string: %s",
+						selExpr.Sel.Name,
+						arg,
+					))
+					return
+				}
+				// found interesting strings
+				handler.OnMsgidPattern(fset, argLit.ValuePos, prefix+arg)
+			}
+		}
 	}
 }
 
diff --git a/build/lint-locale-usage/handle-tmpl.go b/build/lint-locale-usage/handle-tmpl.go
index 7fbda8ffd5..e37c1eb486 100644
--- a/build/lint-locale-usage/handle-tmpl.go
+++ b/build/lint-locale-usage/handle-tmpl.go
@@ -150,16 +150,12 @@ func (handler Handler) handleTemplateMsgid(fset *token.FileSet, node tmplParser.
 			handler.OnMsgid(fset, stringPos, msgidPrefix, false)
 		} else {
 			if nodeIdent.Ident == "printf" {
-				parts := strings.SplitN(msgidPrefix, "%", 2)
-				if len(parts) != 2 {
-					handler.OnWarning(
-						fset,
-						stringPos,
-						fmt.Sprintf("unsupported invocation of locate function (format string doesn't match \"prefix%%smth\" pattern): %s", nodeString.String()),
-					)
+				// found interesting strings
+				if !(strings.HasSuffix(msgidPrefix, ".%s") && strings.Count(msgidPrefix, "%") == 1) {
+					handler.OnMsgidPattern(fset, stringPos, msgidPrefix)
 					return
 				}
-				msgidPrefix = parts[0]
+				msgidPrefix = strings.TrimSuffix(msgidPrefix, "%s")
 			}
 
 			msgidPrefixFin, truncated := PrepareMsgidPrefix(msgidPrefix)
diff --git a/build/lint-locale-usage/handler.go b/build/lint-locale-usage/handler.go
index 6673ac3a4d..ef517cd040 100644
--- a/build/lint-locale-usage/handler.go
+++ b/build/lint-locale-usage/handler.go
@@ -47,6 +47,7 @@ func InitLocaleTrFunctions() map[string][]uint {
 type Handler struct {
 	OnMsgid            func(fset *token.FileSet, pos token.Pos, msgid string, weak bool)
 	OnMsgidPrefix      func(fset *token.FileSet, pos token.Pos, msgidPrefix string, truncated bool)
+	OnMsgidPattern     func(fset *token.FileSet, pos token.Pos, msgidPattern string)
 	OnUnexpectedInvoke func(fset *token.FileSet, pos token.Pos, funcname string, argc int)
 	OnWarning          func(fset *token.FileSet, pos token.Pos, msg string)
 	LocaleTrFunctions  map[string][]uint
diff --git a/cmd/admin.go b/cmd/admin.go
index 60b25eb971..fe212cc388 100644
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -47,7 +47,6 @@ func subcmdRegenerate() *cli.Command {
 		Name:  "regenerate",
 		Usage: "Regenerate specific files",
 		Commands: []*cli.Command{
-			microcmdRegenHooks,
 			microcmdRegenKeys,
 		},
 	}
diff --git a/cmd/admin_regenerate.go b/cmd/admin_regenerate.go
index 4d14df317d..4620a7106d 100644
--- a/cmd/admin_regenerate.go
+++ b/cmd/admin_regenerate.go
@@ -7,36 +7,15 @@ import (
 	"context"
 
 	asymkey_model "forgejo.org/models/asymkey"
-	"forgejo.org/modules/graceful"
-	repo_service "forgejo.org/services/repository"
 
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	microcmdRegenHooks = &cli.Command{
-		Name:   "hooks",
-		Usage:  "Regenerate git-hooks",
-		Before: noDanglingArgs,
-		Action: runRegenerateHooks,
-	}
-
-	microcmdRegenKeys = &cli.Command{
-		Name:   "keys",
-		Usage:  "Regenerate authorized_keys file",
-		Before: noDanglingArgs,
-		Action: runRegenerateKeys,
-	}
-)
-
-func runRegenerateHooks(ctx context.Context, c *cli.Command) error {
-	ctx, cancel := installSignals(ctx)
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-	return repo_service.SyncRepositoryHooks(graceful.GetManager().ShutdownContext())
+var microcmdRegenKeys = &cli.Command{
+	Name:   "keys",
+	Usage:  "Regenerate authorized_keys file",
+	Before: noDanglingArgs,
+	Action: runRegenerateKeys,
 }
 
 func runRegenerateKeys(ctx context.Context, c *cli.Command) error {
diff --git a/cmd/admin_user.go b/cmd/admin_user.go
index f4f6fb49af..ea62bd3a45 100644
--- a/cmd/admin_user.go
+++ b/cmd/admin_user.go
@@ -17,6 +17,7 @@ func subcmdUser() *cli.Command {
 			microcmdUserChangePassword(),
 			microcmdUserDelete(),
 			microcmdUserGenerateAccessToken(),
+			microcmdUserCreateAuthorizedIntegration(),
 			microcmdUserMustChangePassword(),
 			microcmdUserResetMFA(),
 		},
diff --git a/cmd/admin_user_generate_authorized_integration.go b/cmd/admin_user_generate_authorized_integration.go
new file mode 100644
index 0000000000..05d7bcc07a
--- /dev/null
+++ b/cmd/admin_user_generate_authorized_integration.go
@@ -0,0 +1,269 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/db"
+	"forgejo.org/models/repo"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/json"
+	"forgejo.org/services/authz"
+
+	"github.com/urfave/cli/v3"
+)
+
+func microcmdUserCreateAuthorizedIntegration() *cli.Command {
+	return &cli.Command{
+		Name: "create-authorized-integration",
+		Description: `Creates an authorized integration. Authorized integrations allow Forgejo to
+receive JWTs from external sources, validate their claims against
+user-defined rules, and grant access to Forgejo's API on behalf of a user.
+
+The issuer may be set to "urn:forgejo:authorized-integrations:actions"
+to support JWTs from the local instance's Forgejo Actions, utilizing the
+enable-openid-connect flag in a workflow.`,
+
+		// `--claim-in sub=v1,v2,v3` needs to be parsed as a single parameter so that we can comma-split the value into
+		// an array.  To accomplish this, we disable urfave 's slice flag separator, which would cause this to be
+		// treated as "sub=v1", "v2=?", and "v3=?", resulting in an error of missing values.
+		DisableSliceFlagSeparator: true,
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "username",
+				Aliases:  []string{"u"},
+				Usage:    "Username",
+				Required: true,
+			},
+			&cli.StringFlag{
+				Name:     "name",
+				Usage:    "Name of the authorized integration for later identification",
+				Required: true,
+			},
+			&cli.StringFlag{
+				Name:  "description",
+				Usage: "Optional description for the authorized integration",
+			},
+
+			// JWT validation:
+			&cli.StringFlag{
+				Name:     "issuer",
+				Usage:    `JWT issuer ('iss' claim), example: https://forgejo.example.org/api/actions`,
+				Required: true,
+			},
+			&cli.StringMapFlag{
+				Name:  "claim-eq",
+				Value: map[string]string{},
+				Usage: `Zero-or-more claim equality checks, formatted as claim=value, example: "actor=someuser"`,
+			},
+			&cli.StringMapFlag{
+				Name:  "claim-in",
+				Value: map[string]string{},
+				Usage: `Zero-or-more claim equality in list checks, formatted as claim=value1,value2,... example: "actor=user1,user2"`,
+			},
+			&cli.StringMapFlag{
+				Name:  "claim-glob",
+				Value: map[string]string{},
+				Usage: `Zero-or-more claim glob checks, formatted as claim=value, example: "sub=repo:forgejo/*:pull_request"`,
+			},
+			&cli.StringMapFlag{
+				Name:  "claim-glob-in",
+				Value: map[string]string{},
+				Usage: `Zero-or-more claim glob in list checks, formatted as claim=va*ue1,va*ue2,... example: "sub=repo:*/*:pull_request,repo:*/*:refs:*"`,
+			},
+			// nested claim support omitted for now -- pretty complex for a CLI
+
+			// Permissions available on successful auth:
+			&cli.StringSliceFlag{
+				Name:  "scope",
+				Value: []string{"all"},
+				Usage: `One-or-more scopes to apply to access token, examples: "all", "read:issue", "write:repository"`,
+			},
+			&cli.StringSliceFlag{
+				Name:  "repo",
+				Value: []string{"all"},
+				Usage: `Zero-or-more specific repositories that can be accessed, or "all" to allow access to all repositories, example: "owner1/repo1"`,
+			},
+		},
+		Before: noDanglingArgs,
+		Action: runCreateAuthorizedIntegration,
+	}
+}
+
+func runCreateAuthorizedIntegration(ctx context.Context, c *cli.Command) error {
+	if !c.IsSet("username") {
+		return errors.New("you must provide a username to generate a token for")
+	}
+
+	ctx, cancel := installSignals(ctx)
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	user, err := user_model.GetUserByName(ctx, c.String("username"))
+	if err != nil {
+		return err
+	}
+
+	ai := &auth_model.AuthorizedIntegration{
+		UserID:      user.ID,
+		Name:        c.String("name"),
+		Description: c.String("description"),
+	}
+
+	var rules []auth_model.ClaimRule
+	ai.Issuer = c.String("issuer")
+	for claim, value := range c.StringMap("claim-eq") {
+		rules = append(rules, auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimEqual,
+			Value:      value,
+		})
+	}
+	for claim, value := range c.StringMap("claim-in") {
+		values := []string{}
+		for s := range strings.SplitSeq(value, ",") {
+			values = append(values, strings.TrimSpace(s))
+		}
+		rules = append(rules, auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimIn,
+			Values:     values,
+		})
+	}
+	for claim, value := range c.StringMap("claim-glob") {
+		rules = append(rules, auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimGlob,
+			Value:      value,
+		})
+	}
+	for claim, value := range c.StringMap("claim-glob-in") {
+		values := []string{}
+		for s := range strings.SplitSeq(value, ",") {
+			values = append(values, strings.TrimSpace(s))
+		}
+		rules = append(rules, auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimGlobIn,
+			Values:     values,
+		})
+	}
+	ai.ClaimRules = &auth_model.ClaimRules{Rules: rules}
+
+	scopes := strings.Join(c.StringSlice("scope"), ",")
+	accessTokenScope, err := auth_model.AccessTokenScope(scopes).Normalize()
+	if err != nil {
+		return fmt.Errorf("invalid access token scope provided: %w", err)
+	}
+	ai.Scope = accessTokenScope
+
+	allRepos := false
+	repos := []*repo.Repository{}
+	for _, repoName := range c.StringSlice("repo") {
+		if repoName == "all" {
+			allRepos = true
+		} else {
+			split := strings.Split(repoName, "/")
+			if len(split) != 2 {
+				return fmt.Errorf("invalid repo name: %q", split)
+			}
+			owner := split[0]
+			name := split[1]
+			repo, err := repo.GetRepositoryByOwnerAndName(ctx, owner, name)
+			if err != nil {
+				return err
+			}
+			repos = append(repos, repo)
+		}
+	}
+	ai.ResourceAllRepos = allRepos
+
+	rr := make([]*auth_model.AuthorizedIntegResourceRepo, len(repos))
+	for i := range repos {
+		rr[i] = &auth_model.AuthorizedIntegResourceRepo{RepoID: repos[i].ID}
+	}
+	if err := authz.ValidateAuthorizedIntegration(ai, rr); err != nil {
+		return err
+	}
+
+	err = db.WithTx(ctx, func(ctx context.Context) error {
+		if err := auth_model.InsertAuthorizedIntegration(ctx, ai); err != nil {
+			return err
+		}
+		if !allRepos {
+			if err := auth_model.InsertAuthorizedIntegrationResourceRepos(ctx, ai.ID, rr); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	type ClaimRuleDescription struct {
+		Description string                     `json:"description"`
+		Claim       string                     `json:"claim"`
+		Comparison  auth_model.ClaimComparison `json:"compare"`
+		Value       string                     `json:"value,omitempty"`
+		Values      []string                   `json:"values,omitempty"`
+	}
+	output := struct {
+		Message     string                 `json:"message"`
+		Name        string                 `json:"name"`
+		Description string                 `json:"description,omitempty"`
+		Issuer      string                 `json:"issuer"`
+		Audience    string                 `json:"audience"`
+		ClaimRules  []ClaimRuleDescription `json:"claim_rules"`
+	}{
+		Message:     "Authorized integration was successfully created.",
+		Name:        ai.Name,
+		Description: ai.Description,
+		Issuer:      ai.Issuer,
+		Audience:    ai.Audience,
+	}
+	for _, cr := range ai.ClaimRules.Rules {
+		var description string
+		switch cr.Comparison {
+		case auth_model.ClaimEqual:
+			description = fmt.Sprintf("%q = %q", cr.Claim, cr.Value)
+		case auth_model.ClaimIn:
+			description = fmt.Sprintf("%q in %q", cr.Claim, cr.Values)
+		case auth_model.ClaimGlob:
+			description = fmt.Sprintf("%q matches %q", cr.Claim, cr.Value)
+		case auth_model.ClaimGlobIn:
+			description = fmt.Sprintf("%q matches in %q", cr.Claim, cr.Values)
+		}
+		output.ClaimRules = append(output.ClaimRules, ClaimRuleDescription{
+			Description: description,
+			Claim:       cr.Claim,
+			Comparison:  cr.Comparison,
+			Value:       cr.Value,
+			Values:      cr.Values,
+		})
+	}
+
+	raw, err := json.Marshal(output)
+	if err != nil {
+		return err
+	}
+	var indent bytes.Buffer
+	if err := json.Indent(&indent, raw, "", "  "); err != nil {
+		return err
+	}
+	os.Stdout.Write(indent.Bytes())
+
+	return nil
+}
diff --git a/cmd/dump.go b/cmd/dump.go
index 25459c7731..9fe326dfbb 100644
--- a/cmd/dump.go
+++ b/cmd/dump.go
@@ -112,7 +112,10 @@ func getArchiverByType(outType string) (archives.ArchiverAsync, error) {
 	var archiver archives.ArchiverAsync
 	switch outType {
 	case "zip":
-		archiver = archives.Zip{}
+		archiver = archives.Zip{
+			Compression:          8,
+			SelectiveCompression: false,
+		}
 	case "tar":
 		archiver = archives.Tar{}
 	case "tar.sz":
diff --git a/cmd/main_test.go b/cmd/main_test.go
index 1ec3471343..ca6a56f4af 100644
--- a/cmd/main_test.go
+++ b/cmd/main_test.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -62,7 +63,12 @@ func runTestApp(app *cli.Command, args ...string) (runResult, error) {
 }
 
 func TestCliCmd(t *testing.T) {
-	defaultWorkPath := filepath.Dir(setting.AppPath)
+	path, err := os.Executable()
+	if err != nil {
+		panic(err)
+	}
+
+	defaultWorkPath := filepath.Dir(path)
 	defaultCustomPath := filepath.Join(defaultWorkPath, "custom")
 	defaultCustomConf := filepath.Join(defaultCustomPath, "conf/app.ini")
 
diff --git a/cmd/serv.go b/cmd/serv.go
index 0e0551d297..3a92b0e5fb 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -290,10 +290,9 @@ func runServ(ctx context.Context, c *cli.Command) error {
 			Op:     lfsVerb,
 			UserID: results.UserID,
 		}
-		token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 
 		// Sign and get the complete encoded token as a string using the secret
-		tokenString, err := token.SignedString(setting.LFS.JWTSecretBytes)
+		tokenString, err := setting.LFS.SigningKey.JWT(claims)
 		if err != nil {
 			return fail(ctx, "Failed to sign JWT Token", "Failed to sign JWT token: %v", err)
 		}
diff --git a/cmd/web.go b/cmd/web.go
index 683b19c82a..4a2a1de1fe 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -164,8 +164,6 @@ func serveInstall(_ context.Context, ctx *cli.Command) error {
 }
 
 func serveInstalled(_ context.Context, ctx *cli.Command) error {
-	setting.InitCfgProvider(setting.CustomConf)
-	setting.LoadCommonSettings()
 	setting.MustInstalled()
 
 	showWebStartupMessage("Prepare to run web server")
diff --git a/contrib/systemd/forgejo.service b/contrib/systemd/forgejo.service
index ee019e11ea..36dc2a3a5b 100644
--- a/contrib/systemd/forgejo.service
+++ b/contrib/systemd/forgejo.service
@@ -52,7 +52,7 @@ After=network.target
 # Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that
 # LimitNOFILE=524288:524288
 RestartSec=2s
-Type=simple
+Type=notify
 User=git
 Group=git
 WorkingDirectory=/var/lib/forgejo/
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index b0f6bd3d44..40dd7d56db 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -313,6 +313,9 @@ RUN_USER = ; git
 ;LFS_START_SERVER = false
 ;;
 ;;
+;; see JWT_* under [oauth2]
+;LFS_JWT_SIGNING_ALGORITHM = HS256
+;LFS_JWT_SIGNING_PRIVATE_KEY_FILE = jwt/lfs_private.pem
 ;; LFS authentication secret, change this yourself
 ;LFS_JWT_SECRET =
 ;;
@@ -544,6 +547,7 @@ ENABLED = true
 ;; Private key file path used to sign OAuth2 tokens. The path is relative to APP_DATA_PATH.
 ;; This setting is only needed if JWT_SIGNING_ALGORITHM is set to RS256, RS384, RS512, ES256, ES384 or ES512.
 ;; The file must contain a RSA or ECDSA private key in the PKCS8 format. If no key exists a 4096 bit key will be created for you.
+;; XXX jwt/ is a misnomer, it should rather be oauth2/, because we use many JWTs
 ;JWT_SIGNING_PRIVATE_KEY_FILE = jwt/private.pem
 ;;
 ;; OAuth2 authentication secret for access and refresh tokens, change this yourself to a unique string. CLI generate option is helpful in this case. https://forgejo.org/docs/latest/admin/command-line/#generate-secret
@@ -2790,7 +2794,7 @@ LEVEL = Info
 ;; server and database workload due to more complex database queries and more frequent server task querying; this
 ;; feature can be disabled to reduce performance impact
 ;CONCURRENCY_GROUP_QUEUE_ENABLED = true
-;; Algorithm used to sign ID tokens. Valid values: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, EdDSA.
+;; Algorithm used to sign ID tokens. Valid values: RS256, RS384, RS512, ES256, ES384, ES512, EdDSA.
 ;; RS256 will ensure compatibility with all relying parties.
 ;; If a different algorithm is chosen, verify that relying parties of interest support the signing algorithm.
 ;ID_TOKEN_SIGNING_ALGORITHM = RS256
@@ -2819,3 +2823,30 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; storage type
 ;STORAGE_TYPE = local
+
+;; Authorized integrations are a capability for users to define external systems which can generate JWTs that Forgejo
+;; will trust in order to perform API access on behalf of that user. While validating a JWT from an external system,
+;; Forgejo makes outgoing HTTP requests to the JWT issuer.
+; [authorized_integration]
+;; Timeout for HTTP requests to remote servers. Default is 10 seconds.
+;REQUEST_TIMEOUT = 10s
+;
+;; Allowed domains for authorized integrations. Default is blank which means all domains will be allowed (except local
+;; networks, see ALLOW_LOCALNETWORKS).
+;; Multiple domains can be separated by commas.
+;; Wildcards are supported: "github.com, *.github.com"
+;ALLOWED_DOMAINS =
+;
+;; Blocklist for authorized integrations, default is blank.
+;; Multiple domains can be separated by commas.
+;; Wildcards are supported: "github.com, *.github.com"
+;BLOCKED_DOMAINS =
+;
+;; Allow private addresses defined by RFC 1918, RFC 1122, RFC 4632 and RFC 4291.
+;; Default is false.
+;; If a domain is allowed by ALLOWED_DOMAINS, this option will be ignored.
+;ALLOW_LOCALNETWORKS = false
+;
+;; Remote requests are cached after being received for the cache time-to-live (TTL). Default is 10 minutes.
+;; Caching uses the configured adapter in the [cache] config section.
+;CACHE_TTL = 10m
diff --git a/flake.lock b/flake.lock
index 4ff76cf2ca..c6670e17b9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1762977756,
-        "narHash": "sha256-4PqRErxfe+2toFJFgcRKZ0UI9NSIOJa+7RXVtBhy4KE=",
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c5ae371f1a6a7fd27823bc500d9390b38c05fa55",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
         "type": "github"
       },
       "original": {
diff --git a/go.mod b/go.mod
index ed789efabb..bffbfa66cb 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module forgejo.org
 
-go 1.25.0
+go 1.26.0
 
 toolchain go1.26.3
 
@@ -11,27 +11,27 @@ require (
 	code.forgejo.org/forgejo/go-rpmutils v1.0.0
 	code.forgejo.org/forgejo/levelqueue v1.0.0
 	code.forgejo.org/forgejo/reply v1.0.2
-	code.forgejo.org/forgejo/runner/v12 v12.8.0
+	code.forgejo.org/forgejo/runner/v12 v12.10.1
 	code.forgejo.org/go-chi/binding v1.0.1
 	code.forgejo.org/go-chi/cache v1.0.1
 	code.forgejo.org/go-chi/captcha v1.0.2
-	code.forgejo.org/go-chi/session v1.0.3
+	code.forgejo.org/go-chi/session v1.0.4
 	code.gitea.io/sdk/gitea v0.21.0
-	code.superseriousbusiness.org/exif-terminator v0.11.1
+	code.superseriousbusiness.org/exif-terminator v0.11.2
 	code.superseriousbusiness.org/go-jpeg-image-structure/v2 v2.3.0
 	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
-	connectrpc.com/connect v1.19.1
+	connectrpc.com/connect v1.19.2
 	github.com/42wim/httpsig v1.2.3
 	github.com/42wim/sshsig v0.0.0-20250502153856-5100632e8920
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358
 	github.com/ProtonMail/go-crypto v1.4.1
-	github.com/PuerkitoBio/goquery v1.11.0
+	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0
 	github.com/alecthomas/chroma/v2 v2.23.1
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/blevesearch/bleve/v2 v2.5.7
+	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/buildkite/terminal-to-html/v3 v3.16.8
-	github.com/caddyserver/certmagic v0.24.0
+	github.com/caddyserver/certmagic v0.25.3
 	github.com/chi-middleware/proxy v1.1.1
 	github.com/djherbis/buffer v1.2.0
 	github.com/djherbis/nio/v3 v3.0.1
@@ -41,45 +41,46 @@ require (
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.4
 	github.com/emersion/go-imap v1.2.1
 	github.com/felixge/fgprof v0.9.5
-	github.com/fsnotify/fsnotify v1.9.0
+	github.com/fsnotify/fsnotify v1.10.1
+	github.com/gdgvda/cron v0.7.0
 	github.com/gliderlabs/ssh v0.3.8
-	github.com/go-ap/activitypub v0.0.0-20231114162308-e219254dc5c9
+	github.com/go-ap/activitypub v0.0.0-20260208110334-902f6cf8c2cc
 	github.com/go-ap/jsonld v0.0.0-20251216162253-e38fa664ea77
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-chi/cors v1.2.2
 	github.com/go-co-op/gocron v1.37.0
-	github.com/go-enry/go-enry/v2 v2.9.5
+	github.com/go-enry/go-enry/v2 v2.9.6
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/go-openapi/spec v0.22.3
-	github.com/go-sql-driver/mysql v1.9.3
-	github.com/go-webauthn/webauthn v0.16.1
+	github.com/go-sql-driver/mysql v1.10.0
+	github.com/go-webauthn/webauthn v0.16.5
 	github.com/gobwas/glob v0.2.3
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0
 	github.com/google/go-github/v81 v81.0.0
-	github.com/google/pprof v0.0.0-20251114195745-4902fdda35c8
+	github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
 	github.com/hashicorp/go-version v1.8.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/huandu/xstrings v1.5.0
-	github.com/inbucket/html2text v0.9.0
+	github.com/inbucket/html2text v1.0.0
 	github.com/jackc/pgx/v5 v5.9.2
 	github.com/jhillyerd/enmime/v2 v2.2.0
 	github.com/json-iterator/go v1.1.12
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.18.4
-	github.com/klauspost/cpuid/v2 v2.2.11
+	github.com/klauspost/compress v1.18.6
+	github.com/klauspost/cpuid/v2 v2.3.0
 	github.com/markbates/goth v1.82.0
-	github.com/mattn/go-isatty v0.0.20
-	github.com/mattn/go-sqlite3 v1.14.42
-	github.com/meilisearch/meilisearch-go v0.36.0
+	github.com/mattn/go-isatty v0.0.21
+	github.com/mattn/go-sqlite3 v1.14.44
+	github.com/meilisearch/meilisearch-go v0.36.2
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/minio/minio-go/v7 v7.0.99
+	github.com/minio/minio-go/v7 v7.1.0
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/olivere/elastic/v7 v7.0.32
@@ -87,28 +88,26 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pquerna/otp v1.5.0
 	github.com/prometheus/client_golang v1.21.1
-	github.com/redis/go-redis/v9 v9.17.3
-	github.com/robfig/cron/v3 v3.0.1
+	github.com/redis/go-redis/v9 v9.19.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/sergi/go-diff v1.4.0
 	github.com/stretchr/testify v1.11.1
 	github.com/syndtr/goleveldb v1.0.0
 	github.com/ulikunitz/xz v0.5.15
-	github.com/urfave/cli/v3 v3.7.0
+	github.com/urfave/cli/v3 v3.8.0
 	github.com/valyala/fastjson v1.6.10
 	github.com/yohcop/openid-go v1.0.1
-	github.com/yuin/goldmark v1.7.17
+	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	gitlab.com/gitlab-org/api/client-go v0.143.2
-	go.uber.org/mock v0.6.0
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/crypto v0.50.0
-	golang.org/x/image v0.39.0
-	golang.org/x/net v0.53.0
+	golang.org/x/crypto v0.51.0
+	golang.org/x/image v0.40.0
+	golang.org/x/net v0.54.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.43.0
-	golang.org/x/text v0.36.0
+	golang.org/x/sys v0.44.0
+	golang.org/x/text v0.37.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 	gopkg.in/ini.v1 v1.67.0
@@ -120,46 +119,46 @@ require (
 require (
 	cloud.google.com/go/compute/metadata v0.6.0 // indirect
 	code.superseriousbusiness.org/go-png-image-structure/v2 v2.3.0 // indirect
-	filippo.io/edwards25519 v1.1.1 // indirect
+	filippo.io/edwards25519 v1.2.0 // indirect
 	git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078 // indirect
-	github.com/RoaringBitmap/roaring/v2 v2.4.5 // indirect
+	github.com/RoaringBitmap/roaring/v2 v2.14.5 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.22.0 // indirect
-	github.com/blevesearch/bleve_index_api v1.2.11 // indirect
-	github.com/blevesearch/geo v0.2.4 // indirect
-	github.com/blevesearch/go-faiss v1.0.26 // indirect
+	github.com/bits-and-blooms/bitset v1.24.2 // indirect
+	github.com/blevesearch/bleve_index_api v1.3.11 // indirect
+	github.com/blevesearch/geo v0.2.5 // indirect
+	github.com/blevesearch/go-faiss v1.1.0 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
-	github.com/blevesearch/mmap-go v1.0.4 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.3.13 // indirect
+	github.com/blevesearch/mmap-go v1.2.0 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.4.7 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
-	github.com/blevesearch/vellum v1.1.0 // indirect
-	github.com/blevesearch/zapx/v11 v11.4.2 // indirect
-	github.com/blevesearch/zapx/v12 v12.4.2 // indirect
-	github.com/blevesearch/zapx/v13 v13.4.2 // indirect
-	github.com/blevesearch/zapx/v14 v14.4.2 // indirect
-	github.com/blevesearch/zapx/v15 v15.4.2 // indirect
-	github.com/blevesearch/zapx/v16 v16.2.8 // indirect
+	github.com/blevesearch/vellum v1.2.0 // indirect
+	github.com/blevesearch/zapx/v11 v11.4.3 // indirect
+	github.com/blevesearch/zapx/v12 v12.4.3 // indirect
+	github.com/blevesearch/zapx/v13 v13.4.3 // indirect
+	github.com/blevesearch/zapx/v14 v14.4.3 // indirect
+	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
+	github.com/blevesearch/zapx/v16 v16.3.4 // indirect
+	github.com/blevesearch/zapx/v17 v17.1.2 // indirect
 	github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
 	github.com/bradfitz/gomemcache v0.0.0-20250403215159-8d39553ac7cf // indirect
-	github.com/caddyserver/zerossl v0.1.3 // indirect
+	github.com/caddyserver/zerossl v0.1.5 // indirect
 	github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dsoprea/go-iptc v0.0.0-20200609062250-162ae6b44feb // indirect
 	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
@@ -167,15 +166,12 @@ require (
 	github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 // indirect
 	github.com/emersion/go-sasl v0.0.0-20231106173351-e73c9f7bad43 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/go-ap/errors v0.0.0-20231003111023-183eef4b31b7 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/go-ap/errors v0.0.0-20260208110149-e1b309365966 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-fed/httpsig v1.1.0 // indirect
-	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.8.0 // indirect
-	github.com/go-git/go-git/v5 v5.18.0 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-openapi/jsonpointer v0.22.4 // indirect
 	github.com/go-openapi/jsonreference v0.21.4 // indirect
@@ -187,11 +183,11 @@ require (
 	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
 	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.2.2 // indirect
+	github.com/go-webauthn/x v0.2.3 // indirect
 	github.com/go-xmlfmt/xmlfmt v0.0.0-20191208150333-d5b6f63a941b // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
@@ -204,19 +200,17 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lib/pq v1.11.2 // indirect
-	github.com/libdns/libdns v1.0.0 // indirect
+	github.com/libdns/libdns v1.1.1 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/markbates/going v1.0.3 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-runewidth v0.0.17 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
-	github.com/mholt/acmez/v3 v3.1.2 // indirect
-	github.com/miekg/dns v1.1.63 // indirect
+	github.com/mholt/acmez/v3 v3.1.6 // indirect
+	github.com/miekg/dns v1.1.72 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
@@ -231,6 +225,7 @@ require (
 	github.com/olekukonko/ll v0.0.9 // indirect
 	github.com/olekukonko/tablewriter v1.0.7 // indirect
 	github.com/onsi/ginkgo v1.16.5 // indirect
+	github.com/onsi/gomega v1.34.1 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -240,28 +235,28 @@ require (
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rhysd/actionlint v1.7.10 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/sorairolake/lzip-go v0.3.8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/tinylib/msgp v1.6.1 // indirect
+	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/zeebo/assert v1.3.0 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
+	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/mod v0.34.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
-	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -274,4 +269,4 @@ replace github.com/gliderlabs/ssh => code.forgejo.org/forgejo/ssh v0.0.0-2024121
 
 replace git.sr.ht/~mariusor/go-xsd-duration => code.forgejo.org/forgejo/go-xsd-duration v0.0.0-20220703122237-02e73435a078
 
-replace xorm.io/xorm v1.3.9 => code.forgejo.org/xorm/xorm v1.3.9-forgejo.11
+replace xorm.io/xorm v1.3.9 => code.forgejo.org/xorm/xorm v1.3.9-forgejo.12
diff --git a/go.sum b/go.sum
index 219d66fdb6..8595a4a6b5 100644
--- a/go.sum
+++ b/go.sum
@@ -30,8 +30,8 @@ code.forgejo.org/forgejo/levelqueue v1.0.0 h1:9krYpU6BM+j/1Ntj6m+VCAIu0UNnne1/Uf
 code.forgejo.org/forgejo/levelqueue v1.0.0/go.mod h1:fmG6zhVuqim2rxSFOoasgXO8V2W/k9U31VVYqLIRLhQ=
 code.forgejo.org/forgejo/reply v1.0.2 h1:dMhQCHV6/O3L5CLWNTol+dNzDAuyCK88z4J/lCdgFuQ=
 code.forgejo.org/forgejo/reply v1.0.2/go.mod h1:RyZUfzQLc+fuLIGjTSQWDAJWPiL4WtKXB/FifT5fM7U=
-code.forgejo.org/forgejo/runner/v12 v12.8.0 h1:/MqOseYbsGaQ2qzepaZr3VyuqpESvSP/ZnC2aKfmU3g=
-code.forgejo.org/forgejo/runner/v12 v12.8.0/go.mod h1:sgDAYfO4NJI1kUzGuD7klHuoFLQzWmZPw0erg7QlbJU=
+code.forgejo.org/forgejo/runner/v12 v12.10.1 h1:qRKjWItVDc2lEMl3jGlKyFpqgX4xHeOdEyl/irO/Nk8=
+code.forgejo.org/forgejo/runner/v12 v12.10.1/go.mod h1:A51GyZJlril5cIpVMvOn3NqE8upOE6ePjwC6s31kRHk=
 code.forgejo.org/forgejo/ssh v0.0.0-20241211213324-5fc306ca0616 h1:kEZL84+02jY9RxXM4zHBWZ3Fml0B09cmP1LGkDsCfIA=
 code.forgejo.org/forgejo/ssh v0.0.0-20241211213324-5fc306ca0616/go.mod h1:zpHEXBstFnQYtGnB8k8kQLol82umzn/2/snG7alWVD8=
 code.forgejo.org/go-chi/binding v1.0.1 h1:coKNI+X1NzRN7X85LlrpvBRqk0TXpJ+ja28vusQWEuY=
@@ -40,25 +40,27 @@ code.forgejo.org/go-chi/cache v1.0.1 h1:w6IsDcPbeEnEYZn7M2HJe3/3/Ehtcw/72VjcVK7+
 code.forgejo.org/go-chi/cache v1.0.1/go.mod h1:K3aQSyRIN4xiuqV1kanfQ6O4ToDpzDpY3bNOyGjFe3U=
 code.forgejo.org/go-chi/captcha v1.0.2 h1:vyHDPXkpjDv8bLO9NqtWzZayzstD/WpJ5xwEkAaqZGQ=
 code.forgejo.org/go-chi/captcha v1.0.2/go.mod h1:lxiPLcJ76UCZHoH31/Wbum4GUi2NgjfFZLrJkKv1lLE=
-code.forgejo.org/go-chi/session v1.0.3 h1:ByJ9c/UC0AU57hxiGl53TXh+NdBOBwK/bhZ9jyadEwE=
-code.forgejo.org/go-chi/session v1.0.3/go.mod h1:xzGtFrV/agCJoZCUhFDlqAr1he6BrAdqlaprKOB1W90=
-code.forgejo.org/xorm/xorm v1.3.9-forgejo.11 h1:EXJVQ4feAFMkpFwtHAHuXkK6TLNYqabR7QTzqL8uObY=
-code.forgejo.org/xorm/xorm v1.3.9-forgejo.11/go.mod h1:C18NeM/SazG/q4eqpWnoNks7GeCyRUNQIe2onniRViU=
+code.forgejo.org/go-chi/session v1.0.4 h1:WQ1NaVxcCpxYwCliEGypKclZnOCjh3p1fk8XciJc62U=
+code.forgejo.org/go-chi/session v1.0.4/go.mod h1:+sSTiomM5C8AUPtxZyTENIbcTz22kcVottKO0lnmDRk=
+code.forgejo.org/xorm/xorm v1.3.9-forgejo.12 h1:EodlU2MGu/EeAdUpEOe+X4cU/qlnJol1ucJ0sHUCM1o=
+code.forgejo.org/xorm/xorm v1.3.9-forgejo.12/go.mod h1:ozQINrM8b7uYFMBB/w19nUTTLcda3RKTQ8HspocVKdg=
 code.gitea.io/sdk/gitea v0.21.0 h1:69n6oz6kEVHRo1+APQQyizkhrZrLsTLXey9142pfkD4=
 code.gitea.io/sdk/gitea v0.21.0/go.mod h1:tnBjVhuKJCn8ibdyyhvUyxrR1Ca2KHEoTWoukNhXQPA=
-code.superseriousbusiness.org/exif-terminator v0.11.1 h1:qnujLH4/Yk/CFtFMmtjozbdV6Ry5G3Q/E/mLlWm/gQI=
-code.superseriousbusiness.org/exif-terminator v0.11.1/go.mod h1:/Z+3DHSrefCzzN5ePkGjVYKFErRimoeUf694Gz8Pn/Y=
+code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
+code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
+code.superseriousbusiness.org/exif-terminator v0.11.2 h1:nkTdaghZb6I0oGYFhTLSALhA2ShgkPnYAJryE5IE9+0=
+code.superseriousbusiness.org/exif-terminator v0.11.2/go.mod h1:/Z+3DHSrefCzzN5ePkGjVYKFErRimoeUf694Gz8Pn/Y=
 code.superseriousbusiness.org/go-jpeg-image-structure/v2 v2.3.0 h1:r9uq8StaSHYKJ8DklR9Xy+E9c40G1Z8yj5TRGi8L6+4=
 code.superseriousbusiness.org/go-jpeg-image-structure/v2 v2.3.0/go.mod h1:IK1OlR6APjVB3E9tuYGvf0qXMrwP+TrzcHS5rf4wffQ=
 code.superseriousbusiness.org/go-png-image-structure/v2 v2.3.0 h1:I512jiIeXDC4//2BeSPrRM2ZS4wpBKUaPeTPxakMNGA=
 code.superseriousbusiness.org/go-png-image-structure/v2 v2.3.0/go.mod h1:SNHomXNW88o1pFfLHpD4KsCZLfcr4z5dm+xcX5SV10A=
 codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570 h1:TXbikPqa7YRtfU9vS6QJBg77pUvbEb6StRdZO8t1bEY=
 codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570/go.mod h1:IIAjsijsd8q1isWX8MACefDEgTQslQ4stk2AeeTt3kM=
-connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14=
-connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
+connectrpc.com/connect v1.19.2 h1:McQ83FGdzL+t60peksi0gXC7MQ/iLKgLduAnThbM0mo=
+connectrpc.com/connect v1.19.2/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-filippo.io/edwards25519 v1.1.1 h1:YpjwWWlNmGIDyXOn8zLzqiD+9TyIlPhGFG96P39uBpw=
-filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGqTOXqu2aRi/XEQxDCBwM8yJtE6s=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
 github.com/42wim/httpsig v1.2.3 h1:xb0YyWhkYj57SPtfSttIobJUPJZB9as1nsfo7KWVcEs=
@@ -73,10 +75,10 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
-github.com/PuerkitoBio/goquery v1.11.0 h1:jZ7pwMQXIITcUXNH83LLk+txlaEy6NVOfTuP43xxfqw=
-github.com/PuerkitoBio/goquery v1.11.0/go.mod h1:wQHgxUOU3JGuj3oD/QFfxUdlzW6xPHfqyHre6VMY4DQ=
-github.com/RoaringBitmap/roaring/v2 v2.4.5 h1:uGrrMreGjvAtTBobc0g5IrW1D5ldxDQYe2JW2gggRdg=
-github.com/RoaringBitmap/roaring/v2 v2.4.5/go.mod h1:FiJcsfkGje/nZBZgCu0ZxCPOKD/hVXDS2dXi7/eUFE0=
+github.com/PuerkitoBio/goquery v1.12.0 h1:pAcL4g3WRXekcB9AU/y1mbKez2dbY2AajVhtkO8RIBo=
+github.com/PuerkitoBio/goquery v1.12.0/go.mod h1:802ej+gV2y7bbIhOIoPY5sT183ZW0YFofScC4q/hIpQ=
+github.com/RoaringBitmap/roaring/v2 v2.14.5 h1:ckd0o545JqDPeVJDgeFoaM21eBixUnlWfYgjE5VnyWw=
+github.com/RoaringBitmap/roaring/v2 v2.14.5/go.mod h1:eq4wdNXxtJIS/oikeCzdX1rBzek7ANzbth041hrU8Q4=
 github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
 github.com/STARRY-S/zip v0.2.3/go.mod h1:lqJ9JdeRipyOQJrYSOtpNAiaesFO6zVDsE8GIGFaoSk=
 github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0 h1:tgjwQrDH5m6jIYB7kac5IQZmfUzQNseac/e3H4VoCNE=
@@ -101,47 +103,48 @@ github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuP
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bits-and-blooms/bitset v1.12.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/bits-and-blooms/bitset v1.22.0 h1:Tquv9S8+SGaS3EhyA+up3FXzmkhxPGjQQCkcs2uw7w4=
-github.com/bits-and-blooms/bitset v1.22.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
+github.com/bits-and-blooms/bitset v1.24.2 h1:M7/NzVbsytmtfHbumG+K2bremQPMJuqv1JD3vOaFxp0=
+github.com/bits-and-blooms/bitset v1.24.2/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
-github.com/blevesearch/bleve/v2 v2.5.7 h1:2d9YrL5zrX5EBBW++GOaEKjE+NPWeZGaX77IM26m1Z8=
-github.com/blevesearch/bleve/v2 v2.5.7/go.mod h1:yj0NlS7ocGC4VOSAedqDDMktdh2935v2CSWOCDMHdSA=
-github.com/blevesearch/bleve_index_api v1.2.11 h1:bXQ54kVuwP8hdrXUSOnvTQfgK0KI1+f9A0ITJT8tX1s=
-github.com/blevesearch/bleve_index_api v1.2.11/go.mod h1:rKQDl4u51uwafZxFrPD1R7xFOwKnzZW7s/LSeK4lgo0=
-github.com/blevesearch/geo v0.2.4 h1:ECIGQhw+QALCZaDcogRTNSJYQXRtC8/m8IKiA706cqk=
-github.com/blevesearch/geo v0.2.4/go.mod h1:K56Q33AzXt2YExVHGObtmRSFYZKYGv0JEN5mdacJJR8=
-github.com/blevesearch/go-faiss v1.0.26 h1:4dRLolFgjPyjkaXwff4NfbZFdE/dfywbzDqporeQvXI=
-github.com/blevesearch/go-faiss v1.0.26/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
+github.com/blevesearch/bleve/v2 v2.6.0 h1:Cyd3dd4q5tCbOV8MnKUVRUDYMHOir9xn12NZzXVSEd4=
+github.com/blevesearch/bleve/v2 v2.6.0/go.mod h1:gLmI8lWgHgrIYf7UpUX7JISI1CaqC6VScu46mHThuAY=
+github.com/blevesearch/bleve_index_api v1.3.11 h1:x29vbV8OjWfLcrDVd7Lr1q+BkLNS0JWNEig0MCVnKH4=
+github.com/blevesearch/bleve_index_api v1.3.11/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
+github.com/blevesearch/geo v0.2.5 h1:yJg9FX1oRwLnjXSXF+ECHfXFTF4diF02Ca/qUGVjJhE=
+github.com/blevesearch/geo v0.2.5/go.mod h1:Jhq7WE2K6mJTx1xS44M2pUO6Io+wjCSHh1+co3YOgH4=
+github.com/blevesearch/go-faiss v1.1.0 h1:xM7Jc0ZUCv5lssG9Ohj3Jv0SdTpxcUABU1dDt9XVsc4=
+github.com/blevesearch/go-faiss v1.1.0/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
 github.com/blevesearch/go-porterstemmer v1.0.3/go.mod h1:angGc5Ht+k2xhJdZi511LtmxuEf0OVpvUUNrwmM1P7M=
 github.com/blevesearch/gtreap v0.1.1 h1:2JWigFrzDMR+42WGIN/V2p0cUvn4UP3C4Q5nmaZGW8Y=
 github.com/blevesearch/gtreap v0.1.1/go.mod h1:QaQyDRAT51sotthUWAH4Sj08awFSSWzgYICSZ3w0tYk=
-github.com/blevesearch/mmap-go v1.0.4 h1:OVhDhT5B/M1HNPpYPBKIEJaD0F3Si+CrEKULGCDPWmc=
-github.com/blevesearch/mmap-go v1.0.4/go.mod h1:EWmEAOmdAS9z/pi/+Toxu99DnsbhG1TIxUoRmJw/pSs=
-github.com/blevesearch/scorch_segment_api/v2 v2.3.13 h1:ZPjv/4VwWvHJZKeMSgScCapOy8+DdmsmRyLmSB88UoY=
-github.com/blevesearch/scorch_segment_api/v2 v2.3.13/go.mod h1:ENk2LClTehOuMS8XzN3UxBEErYmtwkE7MAArFTXs9Vc=
+github.com/blevesearch/mmap-go v1.2.0 h1:l33nNKPFcBjJUMwem6sAYJPUzhUCABoK9FxZDGiFNBI=
+github.com/blevesearch/mmap-go v1.2.0/go.mod h1:Vd6+20GBhEdwJnU1Xohgt88XCD/CTWcqbCNxkZpyBo0=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7 h1:GlMzW08hcsM3DnLUxhyF/1PcDal1qtvvIuytuph5djw=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7/go.mod h1://IJ7tG3QCf0cWW/aVSXqy77tc1AvLu3fcJLYEvOAFs=
 github.com/blevesearch/segment v0.9.1 h1:+dThDy+Lvgj5JMxhmOVlgFfkUtZV2kw49xax4+jTfSU=
 github.com/blevesearch/segment v0.9.1/go.mod h1:zN21iLm7+GnBHWTao9I+Au/7MBiL8pPFtJBJTsk6kQw=
 github.com/blevesearch/snowballstem v0.9.0 h1:lMQ189YspGP6sXvZQ4WZ+MLawfV8wOmPoD/iWeNXm8s=
 github.com/blevesearch/snowballstem v0.9.0/go.mod h1:PivSj3JMc8WuaFkTSRDW2SlrulNWPl4ABg1tC/hlgLs=
 github.com/blevesearch/upsidedown_store_api v1.0.2 h1:U53Q6YoWEARVLd1OYNc9kvhBMGZzVrdmaozG2MfoB+A=
 github.com/blevesearch/upsidedown_store_api v1.0.2/go.mod h1:M01mh3Gpfy56Ps/UXHjEO/knbqyQ1Oamg8If49gRwrQ=
-github.com/blevesearch/vellum v1.1.0 h1:CinkGyIsgVlYf8Y2LUQHvdelgXr6PYuvoDIajq6yR9w=
-github.com/blevesearch/vellum v1.1.0/go.mod h1:QgwWryE8ThtNPxtgWJof5ndPfx0/YMBh+W2weHKPw8Y=
-github.com/blevesearch/zapx/v11 v11.4.2 h1:l46SV+b0gFN+Rw3wUI1YdMWdSAVhskYuvxlcgpQFljs=
-github.com/blevesearch/zapx/v11 v11.4.2/go.mod h1:4gdeyy9oGa/lLa6D34R9daXNUvfMPZqUYjPwiLmekwc=
-github.com/blevesearch/zapx/v12 v12.4.2 h1:fzRbhllQmEMUuAQ7zBuMvKRlcPA5ESTgWlDEoB9uQNE=
-github.com/blevesearch/zapx/v12 v12.4.2/go.mod h1:TdFmr7afSz1hFh/SIBCCZvcLfzYvievIH6aEISCte58=
-github.com/blevesearch/zapx/v13 v13.4.2 h1:46PIZCO/ZuKZYgxI8Y7lOJqX3Irkc3N8W82QTK3MVks=
-github.com/blevesearch/zapx/v13 v13.4.2/go.mod h1:knK8z2NdQHlb5ot/uj8wuvOq5PhDGjNYQQy0QDnopZk=
-github.com/blevesearch/zapx/v14 v14.4.2 h1:2SGHakVKd+TrtEqpfeq8X+So5PShQ5nW6GNxT7fWYz0=
-github.com/blevesearch/zapx/v14 v14.4.2/go.mod h1:rz0XNb/OZSMjNorufDGSpFpjoFKhXmppH9Hi7a877D8=
-github.com/blevesearch/zapx/v15 v15.4.2 h1:sWxpDE0QQOTjyxYbAVjt3+0ieu8NCE0fDRaFxEsp31k=
-github.com/blevesearch/zapx/v15 v15.4.2/go.mod h1:1pssev/59FsuWcgSnTa0OeEpOzmhtmr/0/11H0Z8+Nw=
-github.com/blevesearch/zapx/v16 v16.2.8 h1:SlnzF0YGtSlrsOE3oE7EgEX6BIepGpeqxs1IjMbHLQI=
-github.com/blevesearch/zapx/v16 v16.2.8/go.mod h1:murSoCJPCk25MqURrcJaBQ1RekuqSCSfMjXH4rHyA14=
+github.com/blevesearch/vellum v1.2.0 h1:xkDiOEsHc2t3Cp0NsNZZ36pvc130sCzcGKOPMzXe+e0=
+github.com/blevesearch/vellum v1.2.0/go.mod h1:uEcfBJz7mAOf0Kvq6qoEKQQkLODBF46SINYNkZNae4k=
+github.com/blevesearch/zapx/v11 v11.4.3 h1:PTZOO5loKpHC/x/GzmPZNa9cw7GZIQxd5qRjwij9tHY=
+github.com/blevesearch/zapx/v11 v11.4.3/go.mod h1:4gdeyy9oGa/lLa6D34R9daXNUvfMPZqUYjPwiLmekwc=
+github.com/blevesearch/zapx/v12 v12.4.3 h1:eElXvAaAX4m04t//CGBQAtHNPA+Q6A1hHZVrN3LSFYo=
+github.com/blevesearch/zapx/v12 v12.4.3/go.mod h1:TdFmr7afSz1hFh/SIBCCZvcLfzYvievIH6aEISCte58=
+github.com/blevesearch/zapx/v13 v13.4.3 h1:qsdhRhaSpVnqDFlRiH9vG5+KJ+dE7KAW9WyZz/KXAiE=
+github.com/blevesearch/zapx/v13 v13.4.3/go.mod h1:knK8z2NdQHlb5ot/uj8wuvOq5PhDGjNYQQy0QDnopZk=
+github.com/blevesearch/zapx/v14 v14.4.3 h1:GY4Hecx0C6UTmiNC2pKdeA2rOKiLR5/rwpU9WR51dgM=
+github.com/blevesearch/zapx/v14 v14.4.3/go.mod h1:rz0XNb/OZSMjNorufDGSpFpjoFKhXmppH9Hi7a877D8=
+github.com/blevesearch/zapx/v15 v15.4.3 h1:iJiMJOHrz216jyO6lS0m9RTCEkprUnzvqAI2lc/0/CU=
+github.com/blevesearch/zapx/v15 v15.4.3/go.mod h1:1pssev/59FsuWcgSnTa0OeEpOzmhtmr/0/11H0Z8+Nw=
+github.com/blevesearch/zapx/v16 v16.3.4 h1:hDAqA8qusZTNbPEL7//w5P65UZ2de6yhSeUaTbp0Po0=
+github.com/blevesearch/zapx/v16 v16.3.4/go.mod h1:zqkPPqs9GS9FzVWzCO3Wf1X044yWAV17+4zb+FTiEHg=
+github.com/blevesearch/zapx/v17 v17.1.2 h1:avbOk2igaASNoiy0BE/jPgcxAnRI2PGeydeP4hg7Ikk=
+github.com/blevesearch/zapx/v17 v17.1.2/go.mod h1:WQObxKrqUX7cd0G1GMvDfc/bmZzQvoy7APOPimx7DiI=
 github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE=
 github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
@@ -161,10 +164,10 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/buildkite/terminal-to-html/v3 v3.16.8 h1:QN/daUob6cmK8GcdKnwn9+YTlPr1vNj+oeAIiJK6fPc=
 github.com/buildkite/terminal-to-html/v3 v3.16.8/go.mod h1:+k1KVKROZocrTLsEQ9PEf9A+8+X8uaVV5iO1ZIOwKYM=
-github.com/caddyserver/certmagic v0.24.0 h1:EfXTWpxHAUKgDfOj6MHImJN8Jm4AMFfMT6ITuKhrDF0=
-github.com/caddyserver/certmagic v0.24.0/go.mod h1:xPT7dC1DuHHnS2yuEQCEyks+b89sUkMENh8dJF+InLE=
-github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
-github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
+github.com/caddyserver/certmagic v0.25.3 h1:mGf5ba8F7xA4c5jfDZZbK2buY1VEkbnwpMDixaju94A=
+github.com/caddyserver/certmagic v0.25.3/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
+github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
+github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a/go.mod h1:2GxOXOlEPAMFPfp014mK1SWq8G8BN8o7/dfYqJrVGn8=
@@ -191,8 +194,6 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davidmz/go-pageant v1.0.2 h1:bPblRCh5jGU+Uptpz6LgMZGD5hJoOt7otgT454WvHn0=
 github.com/davidmz/go-pageant v1.0.2/go.mod h1:P2EDDnMqIwG5Rrp05dTRITj9z2zpGcD9efWSkTNKLIE=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/djherbis/buffer v1.1.0/go.mod h1:VwN8VdFkMY0DCALdY8o00d3IZ6Amz/UNVMWcSaJT44o=
 github.com/djherbis/buffer v1.2.0 h1:PH5Dd2ss0C7CRRhQCZ2u7MssF+No9ide8Ye71nPHcrQ=
 github.com/djherbis/buffer v1.2.0/go.mod h1:fjnebbZjCUpPinBRD+TDwXSOeNQ7fPQWLfGQqiAiUyE=
@@ -249,15 +250,16 @@ github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/go-ap/activitypub v0.0.0-20231114162308-e219254dc5c9 h1:j2TrkUG/NATGi/EQS+MvEoF79CxiRUmT16ErFroNcKI=
-github.com/go-ap/activitypub v0.0.0-20231114162308-e219254dc5c9/go.mod h1:cJ9Ye0ZNSMN7RzZDBRY3E+8M3Bpf/R1JX22Ir9yX6WI=
-github.com/go-ap/errors v0.0.0-20231003111023-183eef4b31b7 h1:I2nuhyVI/48VXoRCCZR2hYBgnSXa+EuDJf/VyX06TC0=
-github.com/go-ap/errors v0.0.0-20231003111023-183eef4b31b7/go.mod h1:5x8a6P/dhmMGFxWLcyYlyOuJ2lRNaHGhRv+yu8BaTSI=
-github.com/go-ap/jsonld v0.0.0-20221030091449-f2a191312c73/go.mod h1:jyveZeGw5LaADntW+UEsMjl3IlIwk+DxlYNsbofQkGA=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gdgvda/cron v0.7.0 h1:LFPZUTbCb5ZpzYxavbQDDbjd6nwTwkiNUWyulOdlY2I=
+github.com/gdgvda/cron v0.7.0/go.mod h1:caBF+mzTZGtQqFE05T1m6u9OmCASY3EK51XAICf3wio=
+github.com/go-ap/activitypub v0.0.0-20260208110334-902f6cf8c2cc h1:yLe7YJhK+XNjNV4SqDxAjpWAgft+KU+XwKZS4AKEUV0=
+github.com/go-ap/activitypub v0.0.0-20260208110334-902f6cf8c2cc/go.mod h1:jUs8eczo1EAT4ByRpZ4mQmNvjarw9eNf7Nm5udpMRhY=
+github.com/go-ap/errors v0.0.0-20260208110149-e1b309365966 h1:tV+3kZgqFMKVUf+JPKBV400ISM8440+6y/SQCS0WZwQ=
+github.com/go-ap/errors v0.0.0-20260208110149-e1b309365966/go.mod h1:zkp58Q5yXpCxZbh3d0GDvwqiYclfVuHEHjc9SZKAj6I=
 github.com/go-ap/jsonld v0.0.0-20251216162253-e38fa664ea77 h1:yHAmoR6avNy84PlLmjHt1z9flAp2Qs2ens5QDE/CNWk=
 github.com/go-ap/jsonld v0.0.0-20251216162253-e38fa664ea77/go.mod h1:4h93IBxgfnE/DEleMLgJ/XCeu/RtQ+MUh3ucANseeXA=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
@@ -269,8 +271,8 @@ github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-co-op/gocron v1.37.0 h1:ZYDJGtQ4OMhTLKOKMIch+/CY70Brbb1dGdooLEhh7b0=
 github.com/go-co-op/gocron v1.37.0/go.mod h1:3L/n6BkO7ABj+TrfSVXLRzsP26zmikL4ISkLQ0O8iNY=
-github.com/go-enry/go-enry/v2 v2.9.5 h1:HPhAQQHYwJgihL2PxBZiUMFWiROsGwOBdB6/D8zCUhY=
-github.com/go-enry/go-enry/v2 v2.9.5/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
+github.com/go-enry/go-enry/v2 v2.9.6 h1:np63eOtMV56zfYDHnFVgpEVOk8fr2kmylcMnAZUDbSs=
+github.com/go-enry/go-enry/v2 v2.9.6/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
 github.com/go-enry/go-oniguruma v1.2.1/go.mod h1:bWDhYP+S6xZQgiRL7wlTScFYBe023B6ilRZbCAD5Hf4=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
@@ -280,16 +282,12 @@ github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxI
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-fed/httpsig v1.1.0 h1:9M+hb0jkEICD8/cAiNqEB66R87tTINszBRTjwjQzWcI=
 github.com/go-fed/httpsig v1.1.0/go.mod h1:RCMrTZvN1bJYtofsG4rd5NaO5obxQ5xBkdiS7xsT7bM=
-github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
-github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
-github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
-github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM=
-github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-ldap/ldap/v3 v3.4.12 h1:1b81mv7MagXZ7+1r7cLTWmyuTqVqdwbtJSjC0DAp9s4=
 github.com/go-ldap/ldap/v3 v3.4.12/go.mod h1:+SPAGcTtOfmGsCb3h1RFiq4xpp4N636G75OEace8lNo=
 github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
@@ -318,17 +316,17 @@ github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxE
 github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
 github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
 github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
+github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.16.1 h1:x5/SSki5/aIfogaRukqvbg/RXa3Sgxy/9vU7UfFPHKU=
-github.com/go-webauthn/webauthn v0.16.1/go.mod h1:RBS+rtQJMkE5VfMQ4diDA2VNrEL8OeUhp4Srz37FHbQ=
-github.com/go-webauthn/x v0.2.2 h1:zIiipvMbr48CXi5RG0XdBJR94kd8I5LfzHPb/q+YYmk=
-github.com/go-webauthn/x v0.2.2/go.mod h1:IpJ5qyWB9NRhLX3C7gIfjTU7RZLXEP6kzFkoVSE7Fz4=
+github.com/go-webauthn/webauthn v0.16.5 h1:x+vADHlaiIjta23kGhtwyCIlB5mayKx6SBlpwQ5NF9A=
+github.com/go-webauthn/webauthn v0.16.5/go.mod h1:mQC6L0lZ5Kiu35G70zeB2WnrW4+vbHjR8Koq4HdVaMg=
+github.com/go-webauthn/x v0.2.3 h1:8oArS+Rc1SWFLXhE17KZNx258Z4kUSyaDgsSncCO5RA=
+github.com/go-webauthn/x v0.2.3/go.mod h1:tM04GF3V6VYq79AZMl7vbj4q6pz9r7L2criWRzbWhPk=
 github.com/go-xmlfmt/xmlfmt v0.0.0-20191208150333-d5b6f63a941b h1:khEcpUM4yFcxg4/FHQWkvVRmgijNXRfzkIDHh23ggEo=
 github.com/go-xmlfmt/xmlfmt v0.0.0-20191208150333-d5b6f63a941b/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
@@ -369,8 +367,8 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
-github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
+github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
@@ -400,8 +398,8 @@ github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OI
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20251114195745-4902fdda35c8 h1:3DsUAV+VNEQa2CUVLxCY3f87278uWfIDhJnbdvDjvmE=
-github.com/google/pprof v0.0.0-20251114195745-4902fdda35c8/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -441,8 +439,8 @@ github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20230524184225-eabc099b10ab/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
-github.com/inbucket/html2text v0.9.0 h1:ULJmVcBEMAcmLE+/rN815KG1Fx6+a4HhbUxiDiN+qks=
-github.com/inbucket/html2text v0.9.0/go.mod h1:QDaumzl+/OzlSVbNohhmg+yAy5pKjUjzCKW2BMvztKE=
+github.com/inbucket/html2text v1.0.0 h1:N5kza++4uBBDJ2Z3KUnTRyPNoBcW+YfOgNiNmNB+sgs=
+github.com/inbucket/html2text v1.0.0/go.mod h1:5TrhXQKGU+LXurODaSm55Y9eXoPBRnYiOz4x2XfUoJU=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
@@ -451,8 +449,6 @@ github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
 github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -479,12 +475,12 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
-github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -501,10 +497,12 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
-github.com/lib/pq v1.11.2 h1:x6gxUeu39V0BHZiugWe8LXZYZ+Utk7hSJGThs8sdzfs=
-github.com/lib/pq v1.11.2/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
-github.com/libdns/libdns v1.0.0 h1:IvYaz07JNz6jUQ4h/fv2R4sVnRnm77J/aOuC9B+TQTA=
-github.com/libdns/libdns v1.0.0/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
+github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
+github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
+github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
+github.com/letsencrypt/pebble/v2 v2.10.0/go.mod h1:Sk8cmUIPcIdv2nINo+9PB4L+ZBhzY+F9A1a/h/xmWiQ=
+github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
+github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
@@ -514,32 +512,32 @@ github.com/markbates/goth v1.82.0 h1:8j/c34AjBSTNzO7zTsOyP5IYCQCMBTRBHAbBt/PI0bQ
 github.com/markbates/goth v1.82.0/go.mod h1:/DRlcq0pyqkKToyZjsL2KgiA1zbF1HIjE7u2uC79rUk=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
+github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.17 h1:78v8ZlW0bP43XfmAfPsdXcoNCelfMHsDmd/pkENfrjQ=
 github.com/mattn/go-runewidth v0.0.17/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
-github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
-github.com/meilisearch/meilisearch-go v0.36.0 h1:N1etykTektXt5KPcSbhBO0d5Xx5NaKj4pJWEM7WA5dI=
-github.com/meilisearch/meilisearch-go v0.36.0/go.mod h1:HBfHzKMxcSbTOvqdfuRA/yf6Vk9IivcwKocWRuW7W78=
-github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
-github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
+github.com/mattn/go-sqlite3 v1.14.44 h1:3VSe+xafpbzsLbdr2AWlAZk9yRHiBhTBakioXaCKTF8=
+github.com/mattn/go-sqlite3 v1.14.44/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/meilisearch/meilisearch-go v0.36.2 h1:MYaMPCpdLh2aYPt+zK+19mLoA4dfBY3S1L7T0FADCjU=
+github.com/meilisearch/meilisearch-go v0.36.2/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
+github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
+github.com/mholt/acmez/v3 v3.1.6/go.mod h1:5nTPosTGosLxF3+LU4ygbgMRFDhbAVpqMI4+a4aHLBY=
 github.com/mholt/archives v0.1.5 h1:Fh2hl1j7VEhc6DZs2DLMgiBNChUux154a1G+2esNvzQ=
 github.com/mholt/archives v0.1.5/go.mod h1:3TPMmBLPsgszL+1As5zECTuKwKvIfj6YcwWPpeTAXF4=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
-github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
-github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/mikelolasagasti/xz v1.0.1 h1:Q2F2jX0RYJUG3+WsM+FJknv+6eVjsjXNDV0KJXZzkD0=
 github.com/mikelolasagasti/xz v1.0.1/go.mod h1:muAirjiOUxPRXwm9HdDtB3uoRPrGnL85XHtokL9Hcgc=
 github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.99 h1:2vH/byrwUkIpFQFOilvTfaUpvAX3fEFhEzO+DR3DlCE=
-github.com/minio/minio-go/v7 v7.0.99/go.mod h1:EtGNKtlX20iL2yaYnxEigaIvj0G0GwSDnifnG8ClIdw=
+github.com/minio/minio-go/v7 v7.1.0 h1:QEt5IStDpxgGjEdtOgpiZ5QhmSl3ax7qy61vi2SwHO8=
+github.com/minio/minio-go/v7 v7.1.0/go.mod h1:Dm7WS1AgLmBa0NcQD6SeJnJf+K/EUW3GR7Ks6olB3OA=
 github.com/minio/minlz v1.0.1 h1:OUZUzXcib8diiX+JYxyRLIdomyZYzHct6EShOKtQY2A=
 github.com/minio/minlz v1.0.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -608,8 +606,8 @@ github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/redis/go-redis/v9 v9.17.3 h1:fN29NdNrE17KttK5Ndf20buqfDZwGNgoUr9qjl1DQx4=
-github.com/redis/go-redis/v9 v9.17.3/go.mod h1:u410H11HMLoB+TP67dz8rL9s6QW2j76l0//kSOd3370=
+github.com/redis/go-redis/v9 v9.19.0 h1:XPVaaPSnG6RhYf7p+rmSa9zZfeVAnWsH5h3lxthOm/k=
+github.com/redis/go-redis/v9 v9.19.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rhysd/actionlint v1.7.10 h1:FL3XIEs72G4/++168vlv5FKOWMSWvWIQw1kBCadyOcM=
@@ -657,14 +655,13 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/syndtr/goleveldb v1.0.0 h1:fBdIW9lB4Iz0n9khmH8w27SJ3QEJ7+IgjPEwGSZiFdE=
 github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ=
-github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
-github.com/tinylib/msgp v1.6.1/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
+github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
+github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/urfave/cli/v3 v3.7.0 h1:AGSnbUyjtLiM+WJUb4dzXKldl/gL+F8OwmRDtVr6g2U=
-github.com/urfave/cli/v3 v3.7.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
-github.com/valyala/fastjson v1.6.4/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
+github.com/urfave/cli/v3 v3.8.0 h1:XqKPrm0q4P0q5JpoclYoCAv0/MIvH/jZ2umzuf8pNTI=
+github.com/urfave/cli/v3 v3.8.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=
 github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -676,8 +673,8 @@ github.com/yohcop/openid-go v1.0.1/go.mod h1:b/AvD03P0KHj4yuihb+VtLD6bYYgsy0zqBz
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.17 h1:p36OVWwRb246iHxA/U4p8OPEpOTESm4n+g+8t0EE5uA=
-github.com/yuin/goldmark v1.7.17/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
+github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
@@ -686,6 +683,8 @@ github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
 github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 gitlab.com/gitlab-org/api/client-go v0.143.2 h1:tfmUW8u+G/DGKOB/FDR0c06f0RVUAEe0ym8WpLoiHXI=
 gitlab.com/gitlab-org/api/client-go v0.143.2/go.mod h1:gJn5yLx9vYGXr73Yv0ueHWCVl+fL8iUOgJFxC7qV+iM=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
@@ -703,8 +702,8 @@ go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
-go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
+go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
@@ -724,8 +723,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -738,8 +737,8 @@ golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
+golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -761,8 +760,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -793,8 +792,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -851,8 +850,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -862,8 +861,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -877,8 +876,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
@@ -912,8 +911,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -974,8 +973,6 @@ gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
-gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -985,7 +982,6 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
@@ -995,14 +991,14 @@ honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
-modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
+modernc.org/libc v1.72.0 h1:IEu559v9a0XWjw0DPoVKtXpO2qt5NVLAnFaBbjq+n8c=
+modernc.org/libc v1.72.0/go.mod h1:tTU8DL8A+XLVkEY3x5E/tO7s2Q/q42EtnNWda/L5QhQ=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
 modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/sqlite v1.48.2 h1:5CnW4uP8joZtA0LedVqLbZV5GD7F/0x91AXeSyjoh5c=
-modernc.org/sqlite v1.48.2/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/sqlite v1.50.0 h1:eMowQSWLK0MeiQTdmz3lqoF5dqclujdlIKeJA11+7oM=
+modernc.org/sqlite v1.50.0/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
 mvdan.cc/xurls/v2 v2.6.0 h1:3NTZpeTxYVWNSokW3MKeyVkz/j7uYXYiMtXRUfmjbgI=
 mvdan.cc/xurls/v2 v2.6.0/go.mod h1:bCvEZ1XvdA6wDnxY7jPPjEmigDtvtvPXAD/Exa9IMSk=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/models/actions/artifact.go b/models/actions/artifact.go
index 492e3f6cea..20b96f829c 100644
--- a/models/actions/artifact.go
+++ b/models/actions/artifact.go
@@ -9,6 +9,7 @@ package actions
 import (
 	"context"
 	"errors"
+	"fmt"
 	"time"
 
 	"forgejo.org/models/db"
@@ -88,6 +89,13 @@ func CreateArtifact(ctx context.Context, t *ActionTask, artifactName, artifactPa
 	return artifact, nil
 }
 
+// IsV4 reports whether the artifact was uploaded via the v4 backend.
+// The v4 backend stores the whole artifact as a single zip file;
+// v1-v3 stores each file as a separate row.
+func (a *ActionArtifact) IsV4() bool {
+	return a.ArtifactName+".zip" == a.ArtifactPath && a.ContentEncoding == "application/zip"
+}
+
 func getArtifactByNameAndPath(ctx context.Context, runID int64, name, fpath string) (*ActionArtifact, error) {
 	var art ActionArtifact
 	has, err := db.GetEngine(ctx).Where("run_id = ? AND artifact_name = ? AND artifact_path = ?", runID, name, fpath).Get(&art)
@@ -150,11 +158,32 @@ type ActionArtifactMeta struct {
 	Status       ArtifactStatus
 }
 
+// AggregatedArtifact is the aggregated view of a logical artifact
+// (one or more rows sharing the same run_id + artifact_name), used by the
+// public API to represent a single artifact to clients.
+type AggregatedArtifact struct {
+	ID           int64              `xorm:"id"`
+	RunID        int64              `xorm:"run_id"`
+	RepoID       int64              `xorm:"-"`
+	ArtifactName string             `xorm:"artifact_name"`
+	FileSize     int64              `xorm:"file_size"`
+	Status       ArtifactStatus     `xorm:"status"`
+	CreatedUnix  timeutil.TimeStamp `xorm:"created_unix"`
+	UpdatedUnix  timeutil.TimeStamp `xorm:"updated_unix"`
+	ExpiredUnix  timeutil.TimeStamp `xorm:"expired_unix"`
+}
+
+// APIDownloadURL returns the download URL for this artifact under the given
+// repository API URL prefix (e.g. "https://host/api/v1/repos/owner/name").
+func (a *AggregatedArtifact) APIDownloadURL(repoAPIURL string) string {
+	return fmt.Sprintf("%s/actions/artifacts/%d/zip", repoAPIURL, a.ID)
+}
+
 // ListUploadedArtifactsMeta returns all uploaded artifacts meta of a run
 func ListUploadedArtifactsMeta(ctx context.Context, runID int64) ([]*ActionArtifactMeta, error) {
 	arts := make([]*ActionArtifactMeta, 0, 10)
 	return arts, db.GetEngine(ctx).Table("action_artifact").
-		Where("run_id=? AND (status=? OR status=?)", runID, ArtifactStatusUploadConfirmed, ArtifactStatusExpired).
+		Where(builder.Eq{"run_id": runID}.And(builder.In("status", ArtifactStatusUploadConfirmed, ArtifactStatusExpired))).
 		GroupBy("artifact_name").
 		Select("artifact_name, sum(file_size) as file_size, max(status) as status").
 		Find(&arts)
@@ -192,3 +221,94 @@ func SetArtifactDeleted(ctx context.Context, artifactID int64) error {
 	_, err := db.GetEngine(ctx).ID(artifactID).Cols("status").Update(&ActionArtifact{Status: int64(ArtifactStatusDeleted)})
 	return err
 }
+
+// SetArtifactsOfRunDeleted marks all artifacts of the given run as deleted.
+func SetArtifactsOfRunDeleted(ctx context.Context, runID int64) error {
+	_, err := db.GetEngine(ctx).
+		Where("run_id=?", runID).
+		Cols("status").
+		Update(&ActionArtifact{Status: int64(ArtifactStatusPendingDeletion)})
+	return err
+}
+
+// aggregatedArtifactConds returns the common WHERE clause used by aggregated
+// artifact queries: restrict to visible statuses and apply the caller's filters.
+// The Status field on opts is ignored — visibility is fixed to UploadConfirmed/Expired.
+func aggregatedArtifactConds(opts FindArtifactsOptions) builder.Cond {
+	opts.Status = 0
+	return opts.ToConds().And(builder.In("status", ArtifactStatusUploadConfirmed, ArtifactStatusExpired))
+}
+
+const aggregatedArtifactSelect = "min(id) as id, run_id, artifact_name, sum(file_size) as file_size, max(status) as status, min(created_unix) as created_unix, max(updated_unix) as updated_unix, max(expired_unix) as expired_unix"
+
+// ListAggregatedArtifacts returns paginated aggregated artifacts.
+// Each result represents one logical artifact: a (run_id, artifact_name) group,
+// with ID = MIN(id), FileSize = SUM(file_size), Status = MAX(status), and
+// timestamps aggregated accordingly. Status filter in opts is ignored; results
+// are always restricted to UploadConfirmed and Expired statuses.
+func ListAggregatedArtifacts(ctx context.Context, opts FindArtifactsOptions) ([]*AggregatedArtifact, int64, error) {
+	cond := aggregatedArtifactConds(opts)
+
+	var countKeys []struct {
+		ID int64 `xorm:"id"`
+	}
+	if err := db.GetEngine(ctx).Table("action_artifact").
+		Where(cond).
+		GroupBy("run_id, artifact_name").
+		Select("min(id) as id").
+		Find(&countKeys); err != nil {
+		return nil, 0, err
+	}
+	total := int64(len(countKeys))
+
+	sess := db.GetEngine(ctx).Table("action_artifact").
+		Where(cond).
+		GroupBy("run_id, artifact_name").
+		Select(aggregatedArtifactSelect).
+		OrderBy("id DESC")
+
+	capacity := 10
+	if opts.PageSize > 0 {
+		sess = sess.Limit(opts.PageSize, (opts.Page-1)*opts.PageSize)
+		capacity = opts.PageSize
+	}
+
+	arts := make([]*AggregatedArtifact, 0, capacity)
+	return arts, total, sess.Find(&arts)
+}
+
+// GetAggregatedArtifactByID returns the aggregated artifact by its canonical ID
+// (MIN(id) of the group), scoped to the given repository. Returns util.ErrNotExist
+// when the ID does not exist, is not canonical for its group, or does not belong to repoID.
+// The repoID scoping is performed in the query so callers don't need a follow-up check.
+func GetAggregatedArtifactByID(ctx context.Context, repoID, artifactID int64) (*AggregatedArtifact, error) {
+	var art ActionArtifact
+	has, err := db.GetEngine(ctx).Where(builder.Eq{"id": artifactID, "repo_id": repoID}).Get(&art)
+	if err != nil {
+		return nil, err
+	}
+	if !has {
+		return nil, util.ErrNotExist
+	}
+
+	cond := aggregatedArtifactConds(FindArtifactsOptions{
+		RunID:        art.RunID,
+		ArtifactName: art.ArtifactName,
+	})
+
+	meta := new(AggregatedArtifact)
+	has, err = db.GetEngine(ctx).Table("action_artifact").
+		Where(cond).
+		GroupBy("run_id, artifact_name").
+		Select(aggregatedArtifactSelect).
+		Get(meta)
+	if err != nil {
+		return nil, err
+	}
+	if !has || meta.ID != artifactID {
+		return nil, util.ErrNotExist
+	}
+
+	meta.RepoID = art.RepoID
+	return meta, nil
+}
diff --git a/models/actions/run.go b/models/actions/run.go
index 1808420f0c..09eddc3269 100644
--- a/models/actions/run.go
+++ b/models/actions/run.go
@@ -257,19 +257,33 @@ func (run *ActionRun) IsDispatchedRun() bool {
 	return run.TriggerEvent == "workflow_dispatch"
 }
 
-// IsRunnable indicates whether this ActionRun can generally be run.
-func (run *ActionRun) IsRunnable() bool {
+// IsValid indicates whether this ActionRun is valid and can be run.
+func (run *ActionRun) IsValid() bool {
 	return run.PreExecutionErrorCode == 0 && run.PreExecutionError == ""
 }
 
 // CanBeRerun indicates whether this ActionRun can be rerun.
 func (run *ActionRun) CanBeRerun() bool {
-	if !run.IsRunnable() {
+	if !run.IsValid() {
 		return false
 	}
 	return run.Status.IsDone()
 }
 
+func (run *ActionRun) PrepareNextAttempt() error {
+	if run.Status != StatusUnknown && !run.Status.IsDone() {
+		return fmt.Errorf("cannot prepare next attempt because run %d is active: %s", run.ID, run.Status.String())
+	}
+
+	run.PreviousDuration = run.Duration()
+
+	run.Status = StatusWaiting
+	run.Started = 0
+	run.Stopped = 0
+
+	return nil
+}
+
 func actionsCountOpenCacheKey(repoID int64) string {
 	return fmt.Sprintf("Actions:CountOpenActionRuns:%d", repoID)
 }
@@ -598,4 +612,11 @@ func ComputeRunStatus(ctx context.Context, runID int64) (run *ActionRun, columns
 	return run, columns, nil
 }
 
+// DeleteRun removes the given run. It is the caller's responsibility to handle the run's dependencies like artifacts or
+// jobs. Nothing happens if the run does not exist.
+func DeleteRun(ctx context.Context, runID int64) error {
+	_, err := db.GetEngine(ctx).Delete(&ActionRun{ID: runID})
+	return err
+}
+
 type ActionRunIndex db.ResourceIndex
diff --git a/models/actions/run_job.go b/models/actions/run_job.go
index 5d3a8aad80..e64b62805c 100644
--- a/models/actions/run_job.go
+++ b/models/actions/run_job.go
@@ -141,12 +141,16 @@ func (job *ActionRunJob) PrepareNextAttempt(initialStatus Status) error {
 }
 
 // CanBeRerun answers whether this ActionRunJob can be rerun. Returns true if it is done and the Run it belongs to
-// is runnable. Returns false in all other cases, including when Run is nil.
-func (job *ActionRunJob) CanBeRerun() bool {
-	if job.Run == nil || !job.Run.IsRunnable() {
-		return false
+// is valid. Returns false in all other cases.
+func (job *ActionRunJob) CanBeRerun(ctx context.Context) (bool, error) {
+	if err := job.LoadRun(ctx); err != nil {
+		return false, fmt.Errorf("cannot load run %d of job %d: %w", job.RunID, job.ID, err)
 	}
-	return job.Status.IsDone()
+
+	if !job.Run.IsValid() {
+		return false, nil
+	}
+	return job.Status.IsDone(), nil
 }
 
 func GetRunJobByID(ctx context.Context, id int64) (*ActionRunJob, error) {
@@ -361,3 +365,10 @@ func (job *ActionRunJob) AllNeedsExist(allExistingJobIDs container.Set[string])
 
 	return unknownJobIDs, len(unknownJobIDs) == 0
 }
+
+// DeleteJob removes the given job. Removing all associated tasks is up to the caller. If the given job does not exist,
+// nothing happens.
+func DeleteJob(ctx context.Context, jobID int64) error {
+	_, err := db.GetEngine(ctx).Delete(&ActionRunJob{ID: jobID})
+	return err
+}
diff --git a/models/actions/run_job_list.go b/models/actions/run_job_list.go
index 207da30334..40a182082f 100644
--- a/models/actions/run_job_list.go
+++ b/models/actions/run_job_list.go
@@ -74,7 +74,7 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 	if opts.RepoID > 0 {
 		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
 	}
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.CommitSHA != "" {
diff --git a/models/actions/run_job_test.go b/models/actions/run_job_test.go
index 6753fb0315..d9275a81ec 100644
--- a/models/actions/run_job_test.go
+++ b/models/actions/run_job_test.go
@@ -428,9 +428,10 @@ func TestAllNeedsExist(t *testing.T) {
 
 func TestActionRunJob_CanBeRerun(t *testing.T) {
 	testCases := []struct {
-		name       string
-		job        ActionRunJob
-		canBeRerun bool
+		name          string
+		job           ActionRunJob
+		canBeRerun    bool
+		expectedError string
 	}{
 		{
 			name:       "job with unknown status",
@@ -468,9 +469,9 @@ func TestActionRunJob_CanBeRerun(t *testing.T) {
 			canBeRerun: false,
 		},
 		{
-			name:       "ActionRun is nil",
-			job:        ActionRunJob{Run: nil, Status: StatusSuccess},
-			canBeRerun: false,
+			name:          "ActionRun is nil",
+			job:           ActionRunJob{ID: 12, Run: nil, Status: StatusSuccess},
+			expectedError: "cannot load run 0 of job 12",
 		},
 		{
 			name:       "with busy run but completed job",
@@ -489,7 +490,15 @@ func TestActionRunJob_CanBeRerun(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			assert.Equal(t, testCase.canBeRerun, testCase.job.CanBeRerun())
+			result, err := testCase.job.CanBeRerun(t.Context())
+
+			if testCase.expectedError == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, testCase.expectedError)
+			}
+
+			assert.Equal(t, testCase.canBeRerun, result)
 		})
 	}
 }
diff --git a/models/actions/run_list.go b/models/actions/run_list.go
index b296e2f477..11fa8441a5 100644
--- a/models/actions/run_list.go
+++ b/models/actions/run_list.go
@@ -85,7 +85,7 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.RepoID > 0 {
 		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
 	}
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.WorkflowID != "" {
diff --git a/models/actions/run_test.go b/models/actions/run_test.go
index f8b2c9fb2d..c87765ed72 100644
--- a/models/actions/run_test.go
+++ b/models/actions/run_test.go
@@ -93,27 +93,27 @@ func TestIsManualRun(t *testing.T) {
 	assert.False(t, pushRun.IsDispatchedRun())
 }
 
-func TestActionRun_IsRunnable(t *testing.T) {
+func TestActionRun_IsValid(t *testing.T) {
 	testCases := []struct {
-		name       string
-		run        ActionRun
-		isRunnable bool
+		name    string
+		run     ActionRun
+		isValid bool
 	}{
 		{
-			name:       "valid run",
-			run:        ActionRun{},
-			isRunnable: true,
+			name:    "valid run",
+			run:     ActionRun{},
+			isValid: true,
 		},
 		{
-			name:       "with pre-execution error",
-			run:        ActionRun{PreExecutionErrorCode: ErrorCodeIncompleteRunsOnMissingOutput},
-			isRunnable: false,
+			name:    "with pre-execution error",
+			run:     ActionRun{PreExecutionErrorCode: ErrorCodeIncompleteRunsOnMissingOutput},
+			isValid: false,
 		},
 	}
 
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			assert.Equal(t, testCase.isRunnable, testCase.run.IsRunnable())
+			assert.Equal(t, testCase.isValid, testCase.run.IsValid())
 		})
 	}
 }
diff --git a/models/actions/runner.go b/models/actions/runner.go
index 8061ccf37e..f324adec52 100644
--- a/models/actions/runner.go
+++ b/models/actions/runner.go
@@ -152,6 +152,7 @@ func (r *ActionRunner) Editable(ownerID, repoID int64) bool {
 
 // LoadAttributes loads the attributes of the runner
 func (r *ActionRunner) LoadAttributes(ctx context.Context) error {
+	// nosemgrep: forgejo-logic-suspicious-OwnerID-check (system users are not stored in the database)
 	if r.OwnerID > 0 {
 		var user user_model.User
 		has, err := db.GetEngine(ctx).ID(r.OwnerID).Get(&user)
@@ -214,7 +215,7 @@ func (opts FindRunnerOptions) ToConds() builder.Cond {
 			c = c.Or(builder.Eq{"repo_id": 0, "owner_id": 0})
 		}
 		cond = cond.And(c)
-	} else if opts.OwnerID > 0 { // OwnerID is ignored if RepoID is set
+	} else if opts.OwnerID != 0 { // OwnerID is ignored if RepoID is set
 		c := builder.NewCond().And(builder.Eq{"owner_id": opts.OwnerID})
 		if opts.WithVisible {
 			c = c.Or(builder.Eq{"repo_id": 0, "owner_id": 0})
@@ -395,6 +396,13 @@ func FixRunnersWithoutBelongingRepo(ctx context.Context) (int64, error) {
 	return res.RowsAffected()
 }
 
+// DeleteEphemeralRunner removes the ephemeral runner with the given ID. If the runner with the given ID is not an
+// ephemeral runner, nothing happens.
+func DeleteEphemeralRunner(ctx context.Context, id int64) error {
+	_, err := db.GetEngine(ctx).Where(builder.Eq{"id": id, "ephemeral": true}).Delete(&ActionRunner{})
+	return err
+}
+
 func DeleteOfflineRunners(ctx context.Context, olderThan timeutil.TimeStamp, globalOnly bool) error {
 	log.Info("Doing: DeleteOfflineRunners")
 
diff --git a/models/actions/runner_list.go b/models/actions/runner_list.go
index 6a64c46596..4186ee60be 100644
--- a/models/actions/runner_list.go
+++ b/models/actions/runner_list.go
@@ -28,6 +28,7 @@ func (runners RunnerList) LoadOwners(ctx context.Context) error {
 		return err
 	}
 	for _, runner := range runners {
+		// nosemgrep: forgejo-logic-suspicious-OwnerID-check (system users are not stored in the database)
 		if runner.OwnerID > 0 && runner.Owner == nil {
 			runner.Owner = users[runner.OwnerID]
 		}
diff --git a/models/actions/runner_test.go b/models/actions/runner_test.go
index acca9b1761..31e9706851 100644
--- a/models/actions/runner_test.go
+++ b/models/actions/runner_test.go
@@ -479,3 +479,62 @@ func TestRunner_FindRunnerOptionsToConds(t *testing.T) {
 		})
 	}
 }
+
+func TestDeleteEphemeralRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	persistentRunnerOne := &ActionRunner{
+		ID:        606526,
+		UUID:      "d53a1222-ae7a-4430-97f8-8fcb6efd04c9",
+		Name:      "persistent-runner-one",
+		OwnerID:   2,
+		RepoID:    0,
+		Ephemeral: false,
+		TokenHash: "J9YDsQL",
+	}
+	persistentRunnerTwo := &ActionRunner{
+		ID:        606527,
+		UUID:      "3dc23067-b2fd-4daf-b428-dddad80d7f37",
+		Name:      "persistent-runner-two",
+		OwnerID:   2,
+		RepoID:    0,
+		Ephemeral: false,
+		TokenHash: "jvIylZtHsS",
+	}
+	ephemeralRunnerOne := &ActionRunner{
+		ID:        606528,
+		UUID:      "2d9bc0a1-7019-4ed3-ba67-6415415ac2a9",
+		Name:      "ephemeral-runner-one",
+		OwnerID:   2,
+		RepoID:    0,
+		Ephemeral: true,
+		TokenHash: "t9C8L0kM3W",
+	}
+	ephemeralRunnerTwo := &ActionRunner{
+		ID:        606529,
+		UUID:      "da7a03f8-ab39-4c54-9ec9-2bd312fe3be1",
+		Name:      "ephemeral-runner-two",
+		OwnerID:   2,
+		RepoID:    0,
+		Ephemeral: true,
+		TokenHash: "g9oTOFM",
+	}
+
+	require.NoError(t, CreateRunner(t.Context(), persistentRunnerOne))
+	require.NoError(t, CreateRunner(t.Context(), persistentRunnerTwo))
+	require.NoError(t, CreateRunner(t.Context(), ephemeralRunnerOne))
+	require.NoError(t, CreateRunner(t.Context(), ephemeralRunnerTwo))
+
+	unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: persistentRunnerOne.ID})
+	unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: persistentRunnerTwo.ID})
+	unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: ephemeralRunnerOne.ID})
+	unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: ephemeralRunnerTwo.ID})
+
+	require.NoError(t, DeleteEphemeralRunner(t.Context(), persistentRunnerOne.ID))
+	require.NoError(t, DeleteEphemeralRunner(t.Context(), ephemeralRunnerOne.ID))
+
+	unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: persistentRunnerOne.ID})
+	unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: persistentRunnerTwo.ID})
+	unittest.AssertNotExistsBean(t, &ActionRunner{ID: ephemeralRunnerOne.ID})
+	unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: ephemeralRunnerTwo.ID})
+}
diff --git a/models/actions/schedule.go b/models/actions/schedule.go
index 8c410b9d38..bd6755621b 100644
--- a/models/actions/schedule.go
+++ b/models/actions/schedule.go
@@ -116,7 +116,7 @@ func (opts FindScheduleOptions) ToConds() builder.Cond {
 	if opts.RepoID > 0 {
 		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
 	}
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 
diff --git a/models/actions/schedule_spec.go b/models/actions/schedule_spec.go
index bcaee8bd6f..864fb5e2db 100644
--- a/models/actions/schedule_spec.go
+++ b/models/actions/schedule_spec.go
@@ -13,7 +13,7 @@ import (
 	"forgejo.org/modules/optional"
 	"forgejo.org/modules/timeutil"
 
-	"github.com/robfig/cron/v3"
+	"github.com/gdgvda/cron"
 )
 
 // ActionScheduleSpec represents a schedule spec of a workflow file
@@ -53,16 +53,14 @@ func NewActionScheduleSpec(cron string, tz optional.Option[string], referenceTim
 // Parse parses the spec and returns a cron.Schedule
 // Unlike the default cron parser, Parse uses UTC timezone as the default if none is specified.
 func (s *ActionScheduleSpec) Parse() (cron.Schedule, error) {
-	parser := cron.NewParser(cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow | cron.Descriptor)
-	schedule, err := parser.Parse(s.Spec)
+	parser, err := cron.NewDefaultParser(cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow | cron.Descriptor)
 	if err != nil {
 		return nil, err
 	}
 
-	specSchedule, ok := schedule.(*cron.SpecSchedule)
-	// If it's not a spec schedule, like "@every 5m", timezone is not relevant
-	if !ok {
-		return schedule, nil
+	schedule, err := parser.Parse(s.Spec)
+	if err != nil {
+		return nil, err
 	}
 
 	// If `timezone` is not defined in the workflow, but the spec includes a timezone, use it.
@@ -81,8 +79,7 @@ func (s *ActionScheduleSpec) Parse() (cron.Schedule, error) {
 		location = time.UTC
 	}
 
-	specSchedule.Location = location
-	return specSchedule, nil
+	return schedule.WithLocation(location), nil
 }
 
 func init() {
diff --git a/models/actions/schedule_spec_test.go b/models/actions/schedule_spec_test.go
index eb3a83d0a6..6b9db9f39a 100644
--- a/models/actions/schedule_spec_test.go
+++ b/models/actions/schedule_spec_test.go
@@ -13,6 +13,44 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestActionScheduleSpec_NewActionScheduleSpec(t *testing.T) {
+	tests := []struct {
+		name        string
+		refTime     time.Time
+		cronPattern string
+		timeZone    string
+		want        string
+		wantErr     assert.ErrorAssertionFunc
+	}{
+		{
+			name:        "without timezone",
+			refTime:     time.Date(2026, 4, 6, 11, 56, 0, 0, time.UTC),
+			cronPattern: "58 14 * * *",
+			want:        "2026-04-06T14:58:00Z",
+			wantErr:     assert.NoError,
+		},
+		{
+			name:        "with separate timezone",
+			refTime:     time.Date(2026, 4, 6, 11, 56, 0, 0, time.UTC),
+			cronPattern: "58 14 * * *",
+			timeZone:    "Europe/Tallinn", // +03 (EEST)
+			want:        "2026-04-06T11:58:00Z",
+			wantErr:     assert.NoError,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			s, err := NewActionScheduleSpec(test.cronPattern, optional.FromNonDefault(test.timeZone), test.refTime)
+			test.wantErr(t, err)
+
+			if err == nil {
+				assert.Equal(t, test.want, s.Next.AsTime().UTC().Format(time.RFC3339))
+			}
+		})
+	}
+}
+
 func TestActionScheduleSpec_Parse(t *testing.T) {
 	// Mock the local timezone is not UTC
 	local := time.Local
@@ -88,24 +126,24 @@ func TestActionScheduleSpec_Parse(t *testing.T) {
 			// skipping the execution on that day because any time between 2 and 3 o'clock never happened. Forgejo uses
 			// option B because the code it inherited already did that and was exposed to users.
 			name:     "skips execution during DST jump forwards",
-			refTime:  time.Date(2025, 3, 30, 1, 5, 0, 0, time.UTC),
-			spec:     "10 2 * * *", // The clock jumps at 2 o'clock to 3 o'clock.
+			refTime:  time.Date(2025, 3, 30, 0, 55, 0, 0, time.UTC), // 01:55 local time
+			spec:     "10 2 * * *",                                  // The clock jumps at 2 o'clock to 3 o'clock.
 			timeZone: "Europe/Berlin",
 			want:     "2025-03-31T00:10:00Z",
 			wantErr:  assert.NoError,
 		},
 		{
 			name:     "executes a first time before DST jump backwards",
-			refTime:  time.Date(2025, 10, 26, 0, 5, 0, 0, time.UTC),
-			spec:     "10 2 * * *", // The clock jumps at 3 o'clock to 2 o'clock.
+			refTime:  time.Date(2025, 10, 26, 0, 5, 0, 0, time.UTC), // 02:05 local time
+			spec:     "10 2 * * *",                                  // The clock jumps at 3 o'clock to 2 o'clock.
 			timeZone: "Europe/Berlin",
 			want:     "2025-10-26T00:10:00Z",
 			wantErr:  assert.NoError,
 		},
 		{
 			name:     "executes a second time after DST jump backwards",
-			refTime:  time.Date(2025, 10, 26, 1, 5, 0, 0, time.UTC),
-			spec:     "10 2 * * *", // The clock jumps at 3 o'clock to 2 o'clock.
+			refTime:  time.Date(2025, 10, 26, 1, 5, 0, 0, time.UTC), // 02:05 local time
+			spec:     "10 2 * * *",                                  // The clock jumps at 3 o'clock to 2 o'clock.
 			timeZone: "Europe/Berlin",
 			want:     "2025-10-26T01:10:00Z",
 			wantErr:  assert.NoError,
diff --git a/models/actions/task.go b/models/actions/task.go
index ed2cab60e8..d056c786c4 100644
--- a/models/actions/task.go
+++ b/models/actions/task.go
@@ -192,6 +192,15 @@ func HasTaskForRunner(ctx context.Context, runnerID int64) (bool, error) {
 	return db.GetEngine(ctx).Where("runner_id = ?", runnerID).Exist(&ActionTask{})
 }
 
+func GetTasksOfJob(ctx context.Context, jobID int64) ([]*ActionTask, error) {
+	var tasks []*ActionTask
+	err := db.GetEngine(ctx).Where("job_id=?", jobID).Find(&tasks)
+	if err != nil {
+		return nil, fmt.Errorf("cannot fetch tasks of job %d: %w", jobID, err)
+	}
+	return tasks, nil
+}
+
 func GetTaskByJobAttempt(ctx context.Context, jobID, attempt int64) (*ActionTask, error) {
 	var task ActionTask
 	has, err := db.GetEngine(ctx).Where("job_id=?", jobID).Where("attempt=?", attempt).Get(&task)
@@ -497,6 +506,27 @@ func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
 	return err
 }
 
+// DeleteTask removes the given task including all its steps and outputs. Removing logs and ephemeral runners is the
+// caller's responsibility.
+func DeleteTask(ctx context.Context, taskID int64) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		var err error
+		_, err = db.GetEngine(ctx).Delete(&ActionTaskStep{TaskID: taskID})
+		if err != nil {
+			return fmt.Errorf("unable to delete steps of task %d: %w", taskID, err)
+		}
+		_, err = db.GetEngine(ctx).Delete(&ActionTaskOutput{TaskID: taskID})
+		if err != nil {
+			return fmt.Errorf("unable to delete outputs of task %d: %w", taskID, err)
+		}
+		_, err = db.GetEngine(ctx).Delete(&ActionTask{ID: taskID})
+		if err != nil {
+			return fmt.Errorf("unable to delete task %d: %w", taskID, err)
+		}
+		return nil
+	})
+}
+
 func FindOldTasksToExpire(ctx context.Context, olderThan timeutil.TimeStamp, limit int) ([]*ActionTask, error) {
 	e := db.GetEngine(ctx)
 
diff --git a/models/actions/task_list.go b/models/actions/task_list.go
index f85e17b41b..4c0e060497 100644
--- a/models/actions/task_list.go
+++ b/models/actions/task_list.go
@@ -65,7 +65,7 @@ func (opts FindTaskOptions) ToConds() builder.Cond {
 	if opts.RepoID > 0 {
 		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
 	}
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.CommitSHA != "" {
diff --git a/models/activities/federated_user_activity.go b/models/activities/federated_user_activity.go
index 1ff3a855d0..a9f509e8f7 100644
--- a/models/activities/federated_user_activity.go
+++ b/models/activities/federated_user_activity.go
@@ -82,7 +82,7 @@ func GetFollowingFeeds(ctx context.Context, actorID int64, opts GetFollowingFeed
 	sess = db.SetSessionPagination(sess, &opts)
 
 	actions := make([]*FederatedUserActivity, 0, opts.PageSize)
-	count, err := sess.FindAndCount(&actions)
+	count, err := sess.Desc("`federated_user_activity`.created").FindAndCount(&actions)
 	if err != nil {
 		return nil, 0, fmt.Errorf("FindAndCount: %w", err)
 	}
diff --git a/models/asymkey/gpg_key.go b/models/asymkey/gpg_key.go
index cae717011e..620e0ef0ae 100644
--- a/models/asymkey/gpg_key.go
+++ b/models/asymkey/gpg_key.go
@@ -81,7 +81,7 @@ func (opts FindGPGKeyOptions) ToConds() builder.Cond {
 		cond = cond.And(builder.Eq{"primary_key_id": ""})
 	}
 
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.KeyID != "" {
diff --git a/models/asymkey/gpg_key_test.go b/models/asymkey/gpg_key_test.go
index d265f438eb..2da3bbe6e0 100644
--- a/models/asymkey/gpg_key_test.go
+++ b/models/asymkey/gpg_key_test.go
@@ -11,7 +11,6 @@ import (
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/timeutil"
-	"forgejo.org/modules/util"
 
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
 	"github.com/stretchr/testify/assert"
@@ -458,7 +457,7 @@ epiDVQ==
 func TestTryGetKeyIDFromSignature(t *testing.T) {
 	assert.Empty(t, tryGetKeyIDFromSignature(&packet.Signature{}))
 	assert.Equal(t, "038D1A3EADDBEA9C", tryGetKeyIDFromSignature(&packet.Signature{
-		IssuerKeyId: util.ToPointer(uint64(0x38D1A3EADDBEA9C)),
+		IssuerKeyId: new(uint64(0x38D1A3EADDBEA9C)),
 	}))
 	assert.Equal(t, "038D1A3EADDBEA9C", tryGetKeyIDFromSignature(&packet.Signature{
 		IssuerFingerprint: []uint8{0xb, 0x23, 0x24, 0xc7, 0xe6, 0xfe, 0x4f, 0x3a, 0x6, 0x26, 0xc1, 0x21, 0x3, 0x8d, 0x1a, 0x3e, 0xad, 0xdb, 0xea, 0x9c},
diff --git a/models/asymkey/lint-locale-usage/llu.go b/models/asymkey/lint-locale-usage/llu.go
index 256b5ca12b..2d6a02ff44 100644
--- a/models/asymkey/lint-locale-usage/llu.go
+++ b/models/asymkey/lint-locale-usage/llu.go
@@ -20,14 +20,32 @@ func HandleCompositeErrorReason(handler llu.Handler, fset *token.FileSet, n *ast
 	}
 
 	// fields are normally named
+	var reason ast.Expr
+	verified := false
 	for _, i := range n.Elts {
 		if kve, ok := i.(*ast.KeyValueExpr); ok {
 			ident, ok = kve.Key.(*ast.Ident)
-			if ok && ident.Name == "Reason" {
-				handler.HandleGoTrArgument(fset, kve.Value, "")
+			if !ok {
+				continue
+			}
+			switch ident.Name {
+			case "Reason":
+				reason = kve.Value
+			case "Verified":
+				if valueIdent, ok := kve.Value.(*ast.Ident); ok {
+					switch valueIdent.Name {
+					case "true":
+						verified = true
+					case "false":
+						verified = false
+					}
+				}
 			}
 		} else {
 			handler.OnWarning(fset, i.Pos(), "unable to parse ObjectVerification field assignment")
 		}
 	}
+	if !verified && reason != nil {
+		handler.HandleGoTrArgument(fset, reason, "")
+	}
 }
diff --git a/models/asymkey/ssh_key.go b/models/asymkey/ssh_key.go
index 7f76009e7f..ea05195b5d 100644
--- a/models/asymkey/ssh_key.go
+++ b/models/asymkey/ssh_key.go
@@ -190,7 +190,7 @@ type FindPublicKeyOptions struct {
 
 func (opts FindPublicKeyOptions) ToConds() builder.Cond {
 	cond := builder.NewCond()
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.Fingerprint != "" {
diff --git a/models/auth/TestGetRepositoriesAccessibleWithIntegration/authorized_integ_resource_repo.yml b/models/auth/TestGetRepositoriesAccessibleWithIntegration/authorized_integ_resource_repo.yml
new file mode 100644
index 0000000000..5e0ccf1130
--- /dev/null
+++ b/models/auth/TestGetRepositoriesAccessibleWithIntegration/authorized_integ_resource_repo.yml
@@ -0,0 +1,9 @@
+- integ_id: 1
+  repo_id: 1
+  created_unix: 1772158384
+- integ_id: 1
+  repo_id: 2
+  created_unix: 1772158384
+- integ_id: 1
+  repo_id: 3
+  created_unix: 1772158384
diff --git a/models/auth/TestGetRepositoriesAccessibleWithIntegration/authorized_integration.yml b/models/auth/TestGetRepositoriesAccessibleWithIntegration/authorized_integration.yml
new file mode 100644
index 0000000000..18e5e68054
--- /dev/null
+++ b/models/auth/TestGetRepositoriesAccessibleWithIntegration/authorized_integration.yml
@@ -0,0 +1,9 @@
+- id: 1
+  user_id: 2
+  scope: all
+  resource_all_repos: false
+  issuer: https://example.org/
+  audience: https://forgejo.example.org/-/user/integration/abcdef123
+  claim_rules: "{}"
+  created_unix: 1777153359
+  updated_unix: 1777153359
diff --git a/models/auth/access_token_resource.go b/models/auth/access_token_resource.go
index bf98c52b69..85978dd131 100644
--- a/models/auth/access_token_resource.go
+++ b/models/auth/access_token_resource.go
@@ -24,6 +24,10 @@ func init() {
 	db.RegisterModel(new(AccessTokenResourceRepo))
 }
 
+func (atr *AccessTokenResourceRepo) GetTargetRepoID() int64 {
+	return atr.RepoID
+}
+
 func GetRepositoriesAccessibleWithToken(ctx context.Context, accessTokenID int64) ([]*AccessTokenResourceRepo, error) {
 	var resources []*AccessTokenResourceRepo
 	err := db.GetEngine(ctx).
diff --git a/models/auth/authorized_integration.go b/models/auth/authorized_integration.go
new file mode 100644
index 0000000000..61f0725efb
--- /dev/null
+++ b/models/auth/authorized_integration.go
@@ -0,0 +1,189 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"forgejo.org/models/db"
+	"forgejo.org/modules/timeutil"
+	"forgejo.org/modules/util"
+
+	gouuid "github.com/google/uuid"
+	"xorm.io/builder"
+)
+
+// An Authorized Integration allow users to define external systems which can generate JSON Web Tokens (JWTs) that
+// Forgejo will trust in order to perform API access on behalf of a user defined by the UserID field.
+//
+// When a JWT is received by Forgejo, the issuer (iss) and audience (aud) claims are used to lookup an authorized
+// integration with an exact match.  Together these fields serve as a unique key for the authorized issuer.  Duplicates
+// cannot be permitted because we would not know which user to authenticate the JWT as.
+type AuthorizedIntegration struct {
+	ID int64 `xorm:"pk autoincr"`
+
+	UserID           int64            `xorm:"NOT NULL REFERENCES(user, id)"`
+	Scope            AccessTokenScope `xorm:"NOT NULL"`
+	ResourceAllRepos bool             `xorm:"NOT NULL"` // flag for whether AuthorizedIntegrationResourceRepo instances will limit the resources this access token can access (false) or won't limit them (true).
+
+	Name        string // short name for lists of authorized integrations
+	Description string `xorm:"LONGTEXT"` // long description, optional to document relevant details of the integration
+
+	// Exact-match `iss` claim of the JWT
+	Issuer string `xorm:"NOT NULL UNIQUE(s)"`
+	// Exact-match `aud` claim of the JWT
+	Audience   string      `xorm:"NOT NULL UNIQUE(s)"`
+	ClaimRules *ClaimRules `xorm:"NOT NULL JSON"`
+
+	CreatedUnix timeutil.TimeStamp `xorm:"NOT NULL created"`
+	UpdatedUnix timeutil.TimeStamp `xorm:"NOT NULL updated"`
+}
+
+func init() {
+	db.RegisterModel(new(AuthorizedIntegration))
+}
+
+// An [AuthorizedIntegration] can validate the claims in a JWT against a set of rules defined by this structure.
+//
+// JWTs can contain any number of claims, which are represented as a JSON object.  A small number of common claims are
+// described in RFC7519 (sec 4.1) which defines JWTs, but most claims are entirely arbitrarily defined by the JWT
+// issuer.
+//
+// For example, eg. a claim may be {"sub": "repo:coolguy/forgejo-runner-testrepo:pull_request"} indicating that an OIDC
+// token was received from an Actions execution in a specific repo on a specific event.
+//
+// Validating the claims from a JWT issuer is a critical part of creating a secure [AuthorizedIssuer].  For example,
+// assume that we receive a JWT from a public hosting platform like Codeberg.  We will validate that it is a claim
+// created by the correct Issuer, Codeberg -- but anyone can do that through Forgejo Actions.  We will validate that it
+// has the correct audience -- but that's an *input* to Forgejo Actions, so anyone can create a claim on Codeberg with
+// an arbitrary audience.  The rest of the claims contain the critical information about who ran a Forgejo Action, on
+// which repository, and in response to which events, and those must be validated to ensure that an authorized issuer is
+// correctly authorized.
+//
+// Following that an example, a minimum claim rule that would be required for securely using Forgejo Actions would be
+// something like:
+//
+//	{
+//	  "rules": [{
+//	     "claim": "sub",
+//	     "comparison": "eq",
+//	     "value": "repo:forgejo/website:pull_request"
+//	  }]
+//	}
+//
+// This defines a single rule which says that the `sub` claim must be exactly equal to
+// "repo:forgejo/website:pull_request".  Forgejo Actions would generate this subject when an Action is running on the
+// repo forgejo/website in response to the pull_request event.
+//
+// Some JWT claims are JSON objects.  The [ClaimNested] comparison operator can be used to define rules that inspect the
+// object within a claim.  For example, AWS STS generates a claim "https://sts.amazonaws.com/": {...} with values inside
+// an object, like "aws_account".  A nested claim can inspect those values:
+//
+//	{
+//	  "rules":[{
+//	    "claim": "https://sts.amazonaws.com/",
+//	    "compare": "nest",
+//	    "nested": {"rules":[
+//	      {"claim": "aws_account", "compare": "eq", "value": "1234567890"},
+//	      {"claim": "lambda_source_function_arn", "compare": "eq", "value": "arn:aws:lambda:ca-central-1:1234567890:function:forgejo-oidc-accepting-test"}
+//	    ]}
+//	  }
+//
+// ]}
+//
+// This defines a rule that looks into the "https://sts..." claim and verifies the "aws_account" and
+// "lambda_source_function_arn" keys match specific known values.
+type ClaimRules struct {
+	Rules []ClaimRule `json:"rules"`
+}
+
+// Defines a single rule that will check the value of one JWT claim.
+type ClaimRule struct {
+	// The target claim, eg. "sub"
+	Claim string `json:"claim"`
+	// Comparison rule to use on this claim
+	Comparison ClaimComparison `json:"compare"`
+
+	// For Comparison of ClaimEqual or ClaimGlob, the specific value or glob to match against
+	Value string `json:"value,omitempty"`
+
+	// For Comparison of ClaimIn or ClaimGlobIn, an array of values to match against
+	Values []string `json:"values,omitempty"`
+
+	// For ClaimNested, the rules to apply to the nested object
+	Nested *ClaimRules `json:"nested,omitempty"`
+}
+
+type ClaimComparison string
+
+const (
+	ClaimEqual  ClaimComparison = "eq"      // exactly equal claim
+	ClaimIn     ClaimComparison = "in"      // exactly equal any of the options in a list
+	ClaimGlob   ClaimComparison = "glob"    // glob match complete claim string
+	ClaimGlobIn ClaimComparison = "glob-in" // glob match any of the options in a list
+	ClaimNested ClaimComparison = "nest"    // recurse into a claim that is an map[string]any with it's own data fields
+)
+
+func GetAuthorizedIntegration(ctx context.Context, issuer, audience string) (*AuthorizedIntegration, error) {
+	var ai AuthorizedIntegration
+	found, err := db.GetEngine(ctx).Where("issuer = ? AND audience = ?", issuer, audience).Get(&ai)
+	if err != nil {
+		return nil, err
+	} else if !found {
+		return nil, util.ErrNotExist
+	}
+	return &ai, nil
+}
+
+func InsertAuthorizedIntegration(ctx context.Context, ai *AuthorizedIntegration) error {
+	if ai.Audience != "" {
+		return errors.New("audience cannot be provided, and must be generated by NewAuthorizedIntegration")
+	} else if err := ai.generateAudience(); err != nil {
+		return err
+	}
+	_, err := db.GetEngine(ctx).Insert(ai)
+	return err
+}
+
+// Bump the UpdatedUnix field of this authorized integration to now, tracking when it was last used for authentication.
+// To reduce database write workload, this is only tracked by one-minute intervals -- the UPDATE statement conditionally
+// avoids writes.
+func (ai *AuthorizedIntegration) UpdateLastUsed(ctx context.Context) error {
+	newTime := timeutil.TimeStampNow()
+	cnt, err := db.GetEngine(ctx).
+		Table(&AuthorizedIntegration{}).
+		Where(builder.Eq{"id": ai.ID}).
+		Where(builder.Lt{"updated_unix": newTime.AddDuration(-1 * time.Minute)}).
+		NoAutoTime().
+		Update(map[string]any{"updated_unix": newTime})
+	if cnt == 1 {
+		ai.UpdatedUnix = newTime
+	}
+	return err
+}
+
+// Generates the `aud` claim that the remote JWT generator must use to match this authorized integration.  The `aud`
+// claim is an arbitrary value in a JWT claim, but Forgejo is faced with a few hard and soft requirements:
+//
+//   - Hard requirement: each authorized integration must have a unique `aud`, as it is used to find the DB record that
+//     authenticates a request.
+//   - If authentication is failing, being able to inspect the `aud` claim can be useful to identify the intent.
+//   - Inspection should have a stable meaning -- eg. if it included the username, and the user was renamed, the `aud`
+//     value which can't be changed would continue to reference the old username causing confusion when inspecting it.
+//   - Forgejo & GitHub Actions uses a URL $ACTIONS_ID_TOKEN_REQUEST_URL&audience=... to generate a JWT for the running
+//     action, so it should only consist of safe characters for URL encoding.
+//   - It should be relatively short, as it's encoded into the JWT and increases its size.
+//
+// Meeting these requirements decently well is a combination of the owner's ID, a guid, and a "u:" prefix that makes the
+// fact that it's an `aud` claim value a little bit identifiable.
+func (ai *AuthorizedIntegration) generateAudience() error {
+	if ai.UserID == 0 {
+		return errors.New("UserID must be initialized")
+	}
+	ai.Audience = fmt.Sprintf("u:%d:%s", ai.UserID, gouuid.New().String())
+	return nil
+}
diff --git a/models/auth/authorized_integration_resource_repo.go b/models/auth/authorized_integration_resource_repo.go
new file mode 100644
index 0000000000..77445b60ae
--- /dev/null
+++ b/models/auth/authorized_integration_resource_repo.go
@@ -0,0 +1,56 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package auth
+
+import (
+	"context"
+
+	"forgejo.org/models/db"
+	"forgejo.org/modules/timeutil"
+)
+
+// Represents a many-to-many join table which indicates specific repositories (RepoID) that can be accessed by an
+// authorized integration (IntegID).  An authorized integrations's ResourceAllRepos field must be false for records in
+// this table to become active.
+//
+// Model name is shortend (from AuthorizedIntegrationResourceRepo) to accomodate recreate-tables + MySQL, where the
+// "tmp_recreate_" + foreign key index name would exceed the max identifier length.
+type AuthorizedIntegResourceRepo struct {
+	ID      int64 `xorm:"pk autoincr"`
+	IntegID int64 `xorm:"NOT NULL REFERENCES(authorized_integration, id)"` // field name shortened (AuthorizationIntegrationID) for max identifier length
+	RepoID  int64 `xorm:"NOT NULL REFERENCES(repository, id)"`
+
+	CreatedUnix timeutil.TimeStamp `xorm:"created NOT NULL"`
+}
+
+func init() {
+	db.RegisterModel(new(AuthorizedIntegResourceRepo))
+}
+
+func (air *AuthorizedIntegResourceRepo) GetTargetRepoID() int64 {
+	return air.RepoID
+}
+
+func GetRepositoriesAccessibleWithIntegration(ctx context.Context, aiID int64) ([]*AuthorizedIntegResourceRepo, error) {
+	var resources []*AuthorizedIntegResourceRepo
+	err := db.GetEngine(ctx).
+		Where("integ_id = ?", aiID).
+		Find(&resources)
+	if err != nil {
+		return nil, err
+	}
+	return resources, nil
+}
+
+func InsertAuthorizedIntegrationResourceRepos(ctx context.Context, aiID int64, resources []*AuthorizedIntegResourceRepo) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		for _, resourceRepo := range resources {
+			resourceRepo.IntegID = aiID
+			if err := db.Insert(ctx, resourceRepo); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
diff --git a/models/auth/authorized_integration_resource_repo_test.go b/models/auth/authorized_integration_resource_repo_test.go
new file mode 100644
index 0000000000..15c5b4854f
--- /dev/null
+++ b/models/auth/authorized_integration_resource_repo_test.go
@@ -0,0 +1,91 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package auth_test
+
+import (
+	"testing"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetRepositoriesAccessibleWithIntegration(t *testing.T) {
+	defer unittest.OverrideFixtures("models/auth/TestGetRepositoriesAccessibleWithIntegration")()
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	t.Run("No Resources", func(t *testing.T) {
+		resources, err := auth_model.GetRepositoriesAccessibleWithIntegration(t.Context(), 999)
+		require.NoError(t, err)
+		assert.Empty(t, resources)
+	})
+
+	t.Run("Has Resources", func(t *testing.T) {
+		resources, err := auth_model.GetRepositoriesAccessibleWithIntegration(t.Context(), 1)
+		require.NoError(t, err)
+		require.Len(t, resources, 3)
+
+		// Verify all expected repo IDs are present
+		repoIDs := make([]int64, len(resources))
+		for i, res := range resources {
+			repoIDs[i] = res.RepoID
+		}
+		assert.Contains(t, repoIDs, int64(1))
+		assert.Contains(t, repoIDs, int64(2))
+		assert.Contains(t, repoIDs, int64(3))
+	})
+}
+
+func TestInsertAuthorizedIntegration(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	ai1 := makeAuthorizedIntegration(t)
+	ai2 := makeAuthorizedIntegration(t)
+	ai3 := makeAuthorizedIntegration(t)
+
+	t.Run("blank insert", func(t *testing.T) {
+		err := auth_model.InsertAuthorizedIntegrationResourceRepos(t.Context(), ai1.ID, nil)
+		require.NoError(t, err)
+	})
+
+	t.Run("multiple insert", func(t *testing.T) {
+		resRepo1 := &auth_model.AuthorizedIntegResourceRepo{
+			IntegID: ai2.ID,
+			RepoID:  1,
+		}
+		resRepo3 := &auth_model.AuthorizedIntegResourceRepo{
+			IntegID: ai2.ID,
+			RepoID:  3,
+		}
+		err := auth_model.InsertAuthorizedIntegrationResourceRepos(t.Context(), ai2.ID,
+			[]*auth_model.AuthorizedIntegResourceRepo{resRepo1, resRepo3})
+		require.NoError(t, err)
+
+		unittest.AssertCount(t, &auth_model.AuthorizedIntegResourceRepo{IntegID: ai2.ID}, 2)
+	})
+
+	t.Run("in tx", func(t *testing.T) {
+		// Pre-condition: count is 0.
+		unittest.AssertCount(t, &auth_model.AuthorizedIntegResourceRepo{IntegID: ai3.ID}, 0)
+
+		// Verify that InsertAuthorizedIntegrationResourceRepos performs inserts in a TX by having a second one with an invalid
+		// RepoID, causing a foreign key violation
+		resRepo1 := &auth_model.AuthorizedIntegResourceRepo{
+			IntegID: ai3.ID,
+			RepoID:  1,
+		}
+		resRepo3 := &auth_model.AuthorizedIntegResourceRepo{
+			IntegID: ai3.ID,
+			RepoID:  30000, // invalid
+		}
+		err := auth_model.InsertAuthorizedIntegrationResourceRepos(t.Context(), ai3.ID,
+			[]*auth_model.AuthorizedIntegResourceRepo{resRepo1, resRepo3})
+		require.ErrorContains(t, err, "foreign key")
+
+		// Count remains 0; the first record was not inserted.
+		unittest.AssertCount(t, &auth_model.AuthorizedIntegResourceRepo{IntegID: ai3.ID}, 0)
+	})
+}
diff --git a/models/auth/authorized_integration_test.go b/models/auth/authorized_integration_test.go
new file mode 100644
index 0000000000..d705f1a144
--- /dev/null
+++ b/models/auth/authorized_integration_test.go
@@ -0,0 +1,106 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package auth_test
+
+import (
+	"testing"
+	"time"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/db"
+	"forgejo.org/models/unittest"
+	"forgejo.org/modules/timeutil"
+	"forgejo.org/modules/util"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func makeAuthorizedIntegration(t *testing.T) *auth_model.AuthorizedIntegration {
+	t.Helper()
+	ai := &auth_model.AuthorizedIntegration{
+		UserID:           2,
+		Scope:            auth_model.AccessTokenScopeAll,
+		ResourceAllRepos: true,
+		Issuer:           "https://example.org/",
+		ClaimRules:       &auth_model.ClaimRules{},
+	}
+	require.NoError(t, auth_model.InsertAuthorizedIntegration(t.Context(), ai))
+	return ai
+}
+
+func TestGetAuthorizedIntegration(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ai := makeAuthorizedIntegration(t)
+
+	get, err := auth_model.GetAuthorizedIntegration(t.Context(), "abc", "123")
+	require.ErrorIs(t, err, util.ErrNotExist)
+	assert.Nil(t, get)
+
+	get, err = auth_model.GetAuthorizedIntegration(t.Context(), ai.Issuer, ai.Audience)
+	require.NoError(t, err)
+	require.NotNil(t, get)
+	assert.Equal(t, ai.ID, get.ID)
+}
+
+func TestAuthorizedIntegrationUpdateLastUsed(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	ai := makeAuthorizedIntegration(t)
+	ai.UpdatedUnix = 0
+	cnt, err := db.GetEngine(t.Context()).ID(ai.ID).Cols("updated_unix").NoAutoTime().Update(ai)
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, cnt)
+
+	timeutil.MockSet(time.Unix(1777130023, 0))
+	defer timeutil.MockUnset()
+
+	assert.EqualValues(t, 0, ai.UpdatedUnix)
+	require.NoError(t, ai.UpdateLastUsed(t.Context()))
+	assert.EqualValues(t, 1777130023, ai.UpdatedUnix) // object field updated
+	assert.EqualValues(t, 1777130023, unittest.AssertExistsAndLoadBean(t, &auth_model.AuthorizedIntegration{ID: ai.ID}).UpdatedUnix)
+
+	// nearly immediate redo should have same timestamp due to the 1 minute deduplication:
+	timeutil.MockSet(time.Unix(1777130025, 0))
+	require.NoError(t, ai.UpdateLastUsed(t.Context()))
+	assert.EqualValues(t, 1777130023, ai.UpdatedUnix)                                                                                // object field not updated
+	assert.EqualValues(t, 1777130023, unittest.AssertExistsAndLoadBean(t, &auth_model.AuthorizedIntegration{ID: ai.ID}).UpdatedUnix) // database field not updated
+
+	// but if it's a little while later..
+	timeutil.MockSet(time.Unix(1777131139, 0))
+	require.NoError(t, ai.UpdateLastUsed(t.Context()))
+	assert.EqualValues(t, 1777131139, ai.UpdatedUnix)                                                                                // object field updated
+	assert.EqualValues(t, 1777131139, unittest.AssertExistsAndLoadBean(t, &auth_model.AuthorizedIntegration{ID: ai.ID}).UpdatedUnix) // database field updated
+}
+
+func TestNewAuthorizedIntegration(t *testing.T) {
+	ai := &auth_model.AuthorizedIntegration{
+		UserID:           2,
+		Scope:            auth_model.AccessTokenScopeAll,
+		ResourceAllRepos: true,
+		Issuer:           "https://example.org/",
+		ClaimRules:       &auth_model.ClaimRules{},
+	}
+	require.NoError(t, auth_model.InsertAuthorizedIntegration(t.Context(), ai))
+	assert.Contains(t, ai.Audience, "u:2:")
+
+	ai = &auth_model.AuthorizedIntegration{
+		UserID:           2,
+		Scope:            auth_model.AccessTokenScopeAll,
+		ResourceAllRepos: true,
+		Issuer:           "https://example.org/",
+		Audience:         "I made my own audience",
+		ClaimRules:       &auth_model.ClaimRules{},
+	}
+	require.ErrorContains(t, auth_model.InsertAuthorizedIntegration(t.Context(), ai), "audience cannot be provided")
+
+	ai = &auth_model.AuthorizedIntegration{
+		// Forgot to set UserID
+		Scope:            auth_model.AccessTokenScopeAll,
+		ResourceAllRepos: true,
+		Issuer:           "https://example.org/",
+		ClaimRules:       &auth_model.ClaimRules{},
+	}
+	require.ErrorContains(t, auth_model.InsertAuthorizedIntegration(t.Context(), ai), "UserID must be initialized")
+}
diff --git a/models/auth/source.go b/models/auth/source.go
index db566c7039..fd016e02da 100644
--- a/models/auth/source.go
+++ b/models/auth/source.go
@@ -91,7 +91,7 @@ var registeredConfigs = map[Type]func() Config{}
 
 // RegisterTypeConfig register a config for a provided type
 func RegisterTypeConfig(typ Type, exemplar Config) {
-	if reflect.TypeOf(exemplar).Kind() == reflect.Ptr {
+	if reflect.TypeOf(exemplar).Kind() == reflect.Pointer {
 		// Pointer:
 		registeredConfigs[typ] = func() Config {
 			return reflect.New(reflect.ValueOf(exemplar).Elem().Type()).Interface().(Config)
diff --git a/models/forgefed/error.go b/models/forgefed/error.go
new file mode 100644
index 0000000000..f8b5ef852e
--- /dev/null
+++ b/models/forgefed/error.go
@@ -0,0 +1,22 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package forgefed
+
+import (
+	"fmt"
+)
+
+type ErrFederationHostNotFound struct {
+	SearchKey   string
+	SearchValue string
+}
+
+func (err ErrFederationHostNotFound) Error() string {
+	return fmt.Sprintf("ErrFederationHostNotFound: search key: %s, search value: %s", err.SearchKey, err.SearchValue)
+}
+
+func IsErrFederationHostNotFound(err error) bool {
+	_, ok := err.(ErrFederationHostNotFound)
+	return ok
+}
diff --git a/models/forgefed/federationhost_repository.go b/models/forgefed/federationhost_repository.go
index a44b502ba1..0b3329313e 100644
--- a/models/forgefed/federationhost_repository.go
+++ b/models/forgefed/federationhost_repository.go
@@ -16,6 +16,31 @@ func init() {
 	db.RegisterModel(new(FederationHost))
 }
 
+func CountFederationHosts(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Count(FederationHost{})
+}
+
+func FindFederationHosts(ctx context.Context, opts db.ListOptions) (hosts []*FederationHost, err error) {
+	sess := db.GetEngine(ctx)
+
+	if opts.PageSize > 0 {
+		sess = db.SetSessionPagination(sess, &opts)
+	}
+
+	err = sess.Find(&hosts)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, host := range hosts {
+		if res, err := validation.IsValid(host); !res {
+			return nil, err
+		}
+	}
+
+	return hosts, nil
+}
+
 func GetFederationHost(ctx context.Context, ID int64) (*FederationHost, error) {
 	log.Trace("GetFederationHost: %v", ID)
 	host := new(FederationHost)
@@ -32,13 +57,13 @@ func GetFederationHost(ctx context.Context, ID int64) (*FederationHost, error) {
 	return host, nil
 }
 
-func findFederationHostFromDB(ctx context.Context, searchKey, searchValue string) (*FederationHost, error) {
+func findFederationHostFromDB(ctx context.Context, searchKey string, searchValue ...any) (*FederationHost, error) {
 	host := new(FederationHost)
-	has, err := db.GetEngine(ctx).Where(searchKey, searchValue).Get(host)
+	has, err := db.GetEngine(ctx).Where(searchKey, searchValue...).Get(host)
 	if err != nil {
 		return nil, err
 	} else if !has {
-		return nil, nil
+		return nil, ErrFederationHostNotFound{SearchKey: searchKey, SearchValue: fmt.Sprintf("%v", searchValue)}
 	}
 	if res, err := validation.IsValid(host); !res {
 		return nil, err
@@ -47,17 +72,7 @@ func findFederationHostFromDB(ctx context.Context, searchKey, searchValue string
 }
 
 func FindFederationHostByFqdnAndPort(ctx context.Context, fqdn string, port uint16) (*FederationHost, error) {
-	host := new(FederationHost)
-	has, err := db.GetEngine(ctx).Where("host_fqdn=? AND host_port=?", fqdn, port).Get(host)
-	if err != nil {
-		return nil, err
-	} else if !has {
-		return nil, nil
-	}
-	if res, err := validation.IsValid(host); !res {
-		return nil, err
-	}
-	return host, nil
+	return findFederationHostFromDB(ctx, "host_fqdn=? AND host_port=?", fqdn, port)
 }
 
 func FindFederationHostByKeyID(ctx context.Context, keyID string) (*FederationHost, error) {
diff --git a/models/forgejo_migrations/v16a_add_authorized_integration.go b/models/forgejo_migrations/v16a_add_authorized_integration.go
new file mode 100644
index 0000000000..4cfd5219f4
--- /dev/null
+++ b/models/forgejo_migrations/v16a_add_authorized_integration.go
@@ -0,0 +1,45 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package forgejo_migrations
+
+import (
+	"forgejo.org/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+func init() {
+	registerMigration(&Migration{
+		Description: "add authorized_integration tables",
+		Upgrade:     addAuthorizedIntegrationTables,
+	})
+}
+
+func addAuthorizedIntegrationTables(x *xorm.Engine) error {
+	type ClaimRules struct{}
+	type AuthorizedIntegration struct {
+		ID               int64              `xorm:"pk autoincr"`
+		UserID           int64              `xorm:"NOT NULL REFERENCES(user, id)"`
+		Scope            string             `xorm:"NOT NULL"`
+		ResourceAllRepos bool               `xorm:"NOT NULL"`
+		Issuer           string             `xorm:"NOT NULL UNIQUE(s)"`
+		Audience         string             `xorm:"NOT NULL UNIQUE(s)"`
+		ClaimRules       *ClaimRules        `xorm:"NOT NULL JSON"`
+		CreatedUnix      timeutil.TimeStamp `xorm:"NOT NULL created"`
+		UpdatedUnix      timeutil.TimeStamp `xorm:"NOT NULL updated"`
+	}
+	type AuthorizedIntegResourceRepo struct {
+		ID          int64              `xorm:"pk autoincr"`
+		IntegID     int64              `xorm:"NOT NULL REFERENCES(authorized_integration, id)"`
+		RepoID      int64              `xorm:"NOT NULL REFERENCES(repository, id)"`
+		CreatedUnix timeutil.TimeStamp `xorm:"created NOT NULL"`
+	}
+
+	_, err := x.SyncWithOptions(
+		xorm.SyncOptions{IgnoreDropIndices: true},
+		new(AuthorizedIntegration),
+		new(AuthorizedIntegResourceRepo),
+	)
+	return err
+}
diff --git a/models/forgejo_migrations/v16a_add_oidcsubjectformat_actions_unit_config.go b/models/forgejo_migrations/v16a_add_oidcsubjectformat_actions_unit_config.go
new file mode 100644
index 0000000000..efe737ad5a
--- /dev/null
+++ b/models/forgejo_migrations/v16a_add_oidcsubjectformat_actions_unit_config.go
@@ -0,0 +1,68 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package forgejo_migrations
+
+import (
+	"context"
+	"fmt"
+
+	"forgejo.org/models/db"
+	"forgejo.org/modules/json"
+	"forgejo.org/modules/optional"
+
+	"xorm.io/builder"
+	"xorm.io/xorm"
+)
+
+func init() {
+	registerMigration(&Migration{
+		Description: "add OIDCSubjectFormat=legacy-forgejo-v15 to all existing repositories with actions enabled",
+		Upgrade:     setOIDCSubjectFormatLegacy15,
+	})
+}
+
+func setOIDCSubjectFormatLegacy15(x *xorm.Engine) error {
+	type Type int
+	const TypeActions Type = 10 // 10 Actions
+	type ActionsConfig struct {
+		DisabledWorkflows []string `json:",omitempty"`
+		OIDCSubjectFormat string
+	}
+	type RepoUnit struct { //revive:disable-line:exported
+		ID     int64                   `xorm:"pk"`
+		Type   Type                    `xorm:"INDEX(s)"`
+		Config optional.Option[string] `xorm:"TEXT"`
+	}
+
+	return db.Iterate(
+		db.DefaultContext,
+		builder.Eq{"type": TypeActions},
+		func(ctx context.Context, unit *RepoUnit) error {
+			has, config := unit.Config.Get()
+			if !has {
+				config = "{}"
+			}
+			var actionsConfig ActionsConfig
+			if err := json.Unmarshal([]byte(config), &actionsConfig); err != nil {
+				return fmt.Errorf("failed to parse Actions config %q: %w", config, err)
+			}
+
+			actionsConfig.OIDCSubjectFormat = "legacy-forgejo-v15"
+
+			configBytes, err := json.Marshal(actionsConfig)
+			if err != nil {
+				return fmt.Errorf("failed to convert Actions config to JSON: %w", err)
+			}
+			r, err := db.GetEngine(ctx).
+				ID(unit.ID).
+				Cols("config").
+				Update(&RepoUnit{Config: optional.Some(string(configBytes))})
+			if err != nil {
+				return err
+			} else if r != 1 {
+				return fmt.Errorf("UPDATE expected to affect 1 row, but was %d", r)
+			}
+			return nil
+		})
+}
diff --git a/models/forgejo_migrations/v16a_add_oidcsubjectformat_actions_unit_config_test.go b/models/forgejo_migrations/v16a_add_oidcsubjectformat_actions_unit_config_test.go
new file mode 100644
index 0000000000..865c0e394b
--- /dev/null
+++ b/models/forgejo_migrations/v16a_add_oidcsubjectformat_actions_unit_config_test.go
@@ -0,0 +1,61 @@
+// Copyright 2026 The Forgejo Authors.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package forgejo_migrations
+
+import (
+	"testing"
+
+	"forgejo.org/models/db"
+	migration_tests "forgejo.org/models/gitea_migrations/test"
+	"forgejo.org/modules/timeutil"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"xorm.io/xorm/convert"
+)
+
+func Test_setOIDCSubjectFormatLegacy15(t *testing.T) {
+	type Type int
+	type UnitAccessMode int
+	type RepoUnit struct { //revive:disable-line:exported
+		ID                 int64
+		RepoID             int64              `xorm:"INDEX(s)"`
+		Type               Type               `xorm:"INDEX(s)"`
+		Config             convert.Conversion `xorm:"TEXT"`
+		CreatedUnix        timeutil.TimeStamp `xorm:"INDEX CREATED"`
+		DefaultPermissions UnitAccessMode     `xorm:"NOT NULL DEFAULT 0"`
+	}
+	x, deferable := migration_tests.PrepareTestEnv(t, 0, new(RepoUnit))
+	defer deferable()
+	if x == nil || t.Failed() {
+		return
+	}
+
+	require.NoError(t, setOIDCSubjectFormatLegacy15(x))
+
+	var records []map[string]string
+	require.NoError(t,
+		db.GetEngine(t.Context()).
+			Table("repo_unit").
+			Select("`id`, `repo_id`, `config`").
+			OrderBy("`id`").
+			Find(&records))
+	assert.Equal(t, []map[string]string{
+		{
+			"config":  "{\"OIDCSubjectFormat\":\"legacy-forgejo-v15\"}",
+			"id":      "1",
+			"repo_id": "4",
+		},
+		{
+			"config":  "{\"DisabledWorkflows\":[\"renovate.yml\"],\"OIDCSubjectFormat\":\"legacy-forgejo-v15\"}",
+			"id":      "2",
+			"repo_id": "5",
+		},
+		{
+			"config":  "",
+			"id":      "3",
+			"repo_id": "6",
+		},
+	}, records)
+}
diff --git a/models/forgejo_migrations/v16b_authorized_integration_name_description.go b/models/forgejo_migrations/v16b_authorized_integration_name_description.go
new file mode 100644
index 0000000000..3f5450310f
--- /dev/null
+++ b/models/forgejo_migrations/v16b_authorized_integration_name_description.go
@@ -0,0 +1,60 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package forgejo_migrations
+
+import (
+	"context"
+	"fmt"
+
+	"forgejo.org/models/db"
+	"forgejo.org/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+func init() {
+	registerMigration(&Migration{
+		Description: "add name & description to authorized_integration",
+		Upgrade:     addAuthorizedIntegrationNameDescription,
+	})
+}
+
+func addAuthorizedIntegrationNameDescription(x *xorm.Engine) error {
+	type AuthorizedIntegration struct {
+		// New fields:
+		Name        string
+		Description string `xorm:"LONGTEXT"`
+
+		// Existing fields, used for UPDATE in migration:
+		ID          int64              `xorm:"pk autoincr"`
+		Issuer      string             `xorm:"NOT NULL UNIQUE(s)"`
+		Audience    string             `xorm:"NOT NULL UNIQUE(s)"`
+		CreatedUnix timeutil.TimeStamp `xorm:"NOT NULL created"`
+		// don't include `UpdatedUnix`, so the updated timestamp isn't bumped when Name is set in migration
+	}
+
+	_, err := x.SyncWithOptions(
+		xorm.SyncOptions{IgnoreDropIndices: true},
+		new(AuthorizedIntegration),
+	)
+	if err != nil {
+		return err
+	}
+
+	// As v16a has creating this table, v16b will likely have no records for any users.  But for developers working on
+	// v16, populate "Name" with a quick computed value:
+	return db.Iterate(db.DefaultContext, nil, func(ctx context.Context, ai *AuthorizedIntegration) error {
+		ai.Name = fmt.Sprintf("%s created %s", ai.Issuer, ai.CreatedUnix.FormatDate())
+		r, err := db.GetEngine(ctx).
+			ID(ai.ID).
+			Cols("name").
+			Update(ai)
+		if err != nil {
+			return err
+		} else if r != 1 {
+			return fmt.Errorf("UPDATE expected to affect 1 row, but was %d", r)
+		}
+		return nil
+	})
+}
diff --git a/models/gitea_migrations/fixtures/Test_setOIDCSubjectFormatLegacy15/repo_unit.yml b/models/gitea_migrations/fixtures/Test_setOIDCSubjectFormatLegacy15/repo_unit.yml
new file mode 100644
index 0000000000..bcd732bc1e
--- /dev/null
+++ b/models/gitea_migrations/fixtures/Test_setOIDCSubjectFormatLegacy15/repo_unit.yml
@@ -0,0 +1,14 @@
+- id: 1
+  repo_id: 4
+  type: 10 # actions
+  # config - null
+  created_unix: 1773518296
+- id: 2
+  repo_id: 5
+  type: 10 # actions
+  config: '{"DisabledWorkflows":["renovate.yml"]}'
+  created_unix: 1773518296
+- id: 3
+  repo_id: 6
+  type: 1 # code
+  created_unix: 1773518296
diff --git a/models/issues/comment.go b/models/issues/comment.go
index bfad3935fb..e0ea1e111d 100644
--- a/models/issues/comment.go
+++ b/models/issues/comment.go
@@ -6,11 +6,14 @@
 package issues
 
 import (
+	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"html/template"
 	"slices"
 	"strconv"
+	"strings"
 	"unicode/utf8"
 
 	"forgejo.org/models/db"
@@ -19,7 +22,9 @@ import (
 	project_model "forgejo.org/models/project"
 	repo_model "forgejo.org/models/repo"
 	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/cache"
 	"forgejo.org/modules/container"
+	"forgejo.org/modules/git"
 	"forgejo.org/modules/gitrepo"
 	"forgejo.org/modules/json"
 	"forgejo.org/modules/log"
@@ -321,6 +326,8 @@ type Comment struct {
 	CommitsNum  int64                               `xorm:"-"`
 	IsForcePush bool                                `xorm:"-"`
 
+	reverseLineBlame *git.ReverseLineBlame `xorm:"-"`
+
 	// If you add new fields that might be used to store abusive content (mainly string fields),
 	// please also add them in the CommentData struct and the corresponding constructor.
 }
@@ -744,6 +751,89 @@ func (c *Comment) UnsignedLine() uint64 {
 	return uint64(c.Line)
 }
 
+func (c *Comment) ResolveCurrentLine(ctx context.Context, repo *repo_model.Repository, currentHead string) (*git.ReverseLineBlame, error) {
+	if c.reverseLineBlame != nil {
+		return c.reverseLineBlame, nil
+	}
+
+	// When a PR is viewed, the requirement to perform `git blame --reverse...` on every comment is a bit of a
+	// performance risk. To minimize this risk, cache the results relative to the requested head, so it only needs to be
+	// recalculated when head changes (or on cache eviction).
+	//
+	// Some performance testing was done which showed that a hot cache is much faster than the blame reverse
+	// operation -- 500-1000x runtime difference:
+	//
+	// - cache miss (Forgejo repo)      took 7,690,574 ns
+	// - cache miss (~1000 commit repo) took 1,671,223 ns
+	// - cache hit (in-memory adapter)  took     3,710 ns
+	// - cache hit (redis adapter)      took    77,311 ns
+	resolveJSON, err := cache.GetString(fmt.Sprintf("comment.Resolve;ID=%d;HEAD=%s", c.ID, currentHead), func() (string, error) {
+		gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
+		if err != nil {
+			return "", fmt.Errorf("failed to open repo: %w", err)
+		}
+		defer closer.Close()
+
+		var reverseBlame *git.ReverseLineBlame
+		if c.Line > 0 {
+			var err error
+			reverseBlame, err = gitRepo.ReverseLineBlame(c.CommitSHA, c.TreePath, c.UnsignedLine(), currentHead)
+			if err != nil {
+				return "", fmt.Errorf("failed to perform `git blame --reverse` to resolve current line for comment (id=%d): %w", c.ID, err)
+			}
+		} else {
+			// For comments on removed lines, perform a `git diff` between the last commit that the line of code was
+			// known to exist (which is recorded as CommitSHA) and the requested head. Then inspect the diff to verify
+			// that the removed line of code is present in the diff.
+			buffer := bytes.Buffer{}
+			err := git.GetRepoRawDiffForFile(gitRepo, c.CommitSHA, currentHead, git.RawDiffNormal, c.TreePath, &buffer)
+			if err != nil {
+				return "", fmt.Errorf("failed to get diff: %w", err)
+			}
+
+			diff := buffer.String()
+			adjustedLine, err := git.FindAdjustedLineNumber(c.Patch, int64(c.UnsignedLine()), strings.NewReader(diff))
+			if err != nil && errors.Is(err, git.ErrLineNotFound) {
+				// Line not found in the diff. Don't treat this as an error, because that would break the caching --
+				// instead, return a blame where CommitID != headCommitID, which will be an indicator to callers (for
+				// both resolution methods) that the line of code is outdated in the diff.
+				reverseBlame = &git.ReverseLineBlame{
+					CommitID:   "", // not currentHead
+					LineNumber: c.UnsignedLine(),
+					FilePath:   c.TreePath,
+				}
+			} else if err != nil {
+				return "", fmt.Errorf("failed in finding adjusted line number: %w", err)
+			} else {
+				reverseBlame = &git.ReverseLineBlame{
+					CommitID:   currentHead,
+					LineNumber: uint64(adjustedLine.Left),
+					FilePath:   c.TreePath,
+				}
+			}
+		}
+
+		data, err := json.Marshal(reverseBlame)
+		if err != nil {
+			return "", err
+		}
+
+		return string(data), nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var reverseBlame *git.ReverseLineBlame
+	err = json.Unmarshal([]byte(resolveJSON), &reverseBlame)
+	if err != nil {
+		return nil, err
+	}
+
+	c.reverseLineBlame = reverseBlame
+	return c.reverseLineBlame, nil
+}
+
 // CodeCommentLink returns the url to a comment in code
 func (c *Comment) CodeCommentLink(ctx context.Context) string {
 	err := c.LoadIssue(ctx)
diff --git a/models/issues/comment_code.go b/models/issues/comment_code.go
index 800d1e830e..cc46541743 100644
--- a/models/issues/comment_code.go
+++ b/models/issues/comment_code.go
@@ -7,7 +7,10 @@ import (
 	"context"
 
 	"forgejo.org/models/db"
+	repo_model "forgejo.org/models/repo"
 	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/git"
+	"forgejo.org/modules/log"
 	"forgejo.org/modules/markup"
 	"forgejo.org/modules/markup/markdown"
 
@@ -23,33 +26,62 @@ type CodeConversationsAtLine map[int64][]CodeConversation
 // CodeConversationsAtLineAndTreePath contains the conversations for a given TreePath and line
 type CodeConversationsAtLineAndTreePath map[string]CodeConversationsAtLine
 
-func newCodeConversationsAtLineAndTreePath(comments []*Comment) CodeConversationsAtLineAndTreePath {
+func newCodeConversationsAtLineAndTreePath(ctx context.Context, comments []*Comment, repo *repo_model.Repository, headCommitID string) (CodeConversationsAtLineAndTreePath, error) {
 	tree := make(CodeConversationsAtLineAndTreePath)
 	for _, comment := range comments {
-		tree.insertComment(comment)
+		blame, err := comment.ResolveCurrentLine(ctx, repo, headCommitID)
+		if err != nil {
+			// ResolveCurrentLine can fail in at least one known situation -- where a comment is left on a line in a
+			// file that is being deleted. The blame would be for the commit that deleted the file, and a reverse git
+			// blame won't work because the file is missing in the target sha.
+			log.Warn("ResolveCurrentLine failed: %s", err.Error())
+			// handle gracefully -- insertComment will use the original values which may be usable
+			blame = nil
+		} else if blame.CommitID != headCommitID {
+			// Commit was made on a line that can't be reverse-blamed to the currently viewing head. This can happen
+			// because:
+			//  - line of code was removed between the commit it was tagged on, and the head commit
+			//  - force push on the repo caused there to be no git relationship between blame.CommitID->headCommitID
+			// We won't insert this comment into the comment tree because we don't know where to place it; it may appear
+			// when the user views a different commit in the PR, and it will always appear on the "Conversations" tab.
+			continue
+		}
+		tree.insertComment(comment, blame)
 	}
-	return tree
+	return tree, nil
 }
 
-func (tree CodeConversationsAtLineAndTreePath) insertComment(comment *Comment) {
+func (tree CodeConversationsAtLineAndTreePath) insertComment(comment *Comment, blame *git.ReverseLineBlame) {
+	treePath := comment.TreePath
+	line := comment.Line
+	if blame != nil {
+		treePath = blame.FilePath
+		line = int64(blame.LineNumber)
+		if comment.Line < 0 {
+			line *= -1
+		}
+	}
+
 	// attempt to append comment to existing conversations (i.e. list of comments belonging to the same review)
-	for i, conversation := range tree[comment.TreePath][comment.Line] {
+	for i, conversation := range tree[treePath][line] {
 		if conversation[0].ReviewID == comment.ReviewID {
-			tree[comment.TreePath][comment.Line][i] = append(conversation, comment)
+			tree[treePath][line][i] = append(conversation, comment)
 			return
 		}
 	}
 
 	// no previous conversation was found at this line, create it
-	if tree[comment.TreePath] == nil {
-		tree[comment.TreePath] = make(map[int64][]CodeConversation)
+	if tree[treePath] == nil {
+		tree[treePath] = make(map[int64][]CodeConversation)
 	}
 
-	tree[comment.TreePath][comment.Line] = append(tree[comment.TreePath][comment.Line], CodeConversation{comment})
+	tree[treePath][line] = append(tree[treePath][line], CodeConversation{comment})
 }
 
-// FetchCodeConversations will return a 2d-map: ["Path"]["Line"] = List of CodeConversation (one per review) for this line
-func FetchCodeConversations(ctx context.Context, issue *Issue, doer *user_model.User, showOutdatedComments bool) (CodeConversationsAtLineAndTreePath, error) {
+// FetchCodeConversations will return a 2d-map: ["Path"]["Line"] = List of CodeConversation (one per review) for this
+// line. headCommitID will be used to reverse-blame the comment into the correct path & line for the current context
+// that is being viewed.
+func FetchCodeConversations(ctx context.Context, issue *Issue, doer *user_model.User, showOutdatedComments bool, headCommitID string) (CodeConversationsAtLineAndTreePath, error) {
 	opts := FindCommentsOptions{
 		Type:    CommentTypeCode,
 		IssueID: issue.ID,
@@ -59,7 +91,7 @@ func FetchCodeConversations(ctx context.Context, issue *Issue, doer *user_model.
 		return nil, err
 	}
 
-	return newCodeConversationsAtLineAndTreePath(comments), nil
+	return newCodeConversationsAtLineAndTreePath(ctx, comments, issue.Repo, headCommitID)
 }
 
 // CodeComments represents comments on code by using this structure: FILENAME -> LINE (+ == proposed; - == previous) -> COMMENTS
diff --git a/models/issues/comment_test.go b/models/issues/comment_test.go
index da87b8ec2f..ea59d4f215 100644
--- a/models/issues/comment_test.go
+++ b/models/issues/comment_test.go
@@ -63,7 +63,7 @@ func TestFetchCodeConversations(t *testing.T) {
 		unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: 4}),
 		user, true))
 
-	res, err := issues_model.FetchCodeConversations(db.DefaultContext, issue, user, false)
+	res, err := issues_model.FetchCodeConversations(db.DefaultContext, issue, user, false, "")
 	require.NoError(t, err)
 	require.Contains(t, res, "README.md")
 	require.Contains(t, res["README.md"], int64(4))
@@ -77,7 +77,7 @@ func TestFetchCodeConversations(t *testing.T) {
 	assert.NotNil(t, r.User)
 
 	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
-	res, err = issues_model.FetchCodeConversations(db.DefaultContext, issue, user2, false)
+	res, err = issues_model.FetchCodeConversations(db.DefaultContext, issue, user2, false, "")
 	require.NoError(t, err)
 	assert.Len(t, res, 1)
 }
diff --git a/models/issues/pull_list.go b/models/issues/pull_list.go
index 38325e181f..10e39c6a49 100644
--- a/models/issues/pull_list.go
+++ b/models/issues/pull_list.go
@@ -27,6 +27,8 @@ type PullRequestsOptions struct {
 	Labels      []int64
 	MilestoneID int64
 	PosterID    int64
+	BaseBranch  string
+	HeadBranch  string
 }
 
 func listPullRequestStatement(ctx context.Context, baseRepoID int64, opts *PullRequestsOptions) *xorm.Session {
@@ -51,6 +53,14 @@ func listPullRequestStatement(ctx context.Context, baseRepoID int64, opts *PullR
 		sess.And("issue.poster_id=?", opts.PosterID)
 	}
 
+	if opts.BaseBranch != "" {
+		sess.And("pull_request.base_branch=?", opts.BaseBranch)
+	}
+
+	if opts.HeadBranch != "" {
+		sess.And("pull_request.head_branch=?", opts.HeadBranch)
+	}
+
 	return sess
 }
 
diff --git a/models/project/project.go b/models/project/project.go
index 3a36613b49..be1b9d59c6 100644
--- a/models/project/project.go
+++ b/models/project/project.go
@@ -136,6 +136,7 @@ func ProjectLinkForRepo(repo *repo_model.Repository, projectID int64) string { /
 
 // Link returns the project's relative URL.
 func (p *Project) Link(ctx context.Context) string {
+	// nosemgrep: forgejo-logic-suspicious-OwnerID-check (system users are not stored in the database)
 	if p.OwnerID > 0 {
 		err := p.LoadOwner(ctx)
 		if err != nil {
@@ -183,7 +184,7 @@ func init() {
 
 // GetCardConfig retrieves the types of configurations project column cards could have
 //
-//llu:returnsTrKey
+//llu:returnsTrKeyWeak
 func GetCardConfig() []CardConfig {
 	return []CardConfig{
 		{CardTypeTextOnly, "repo.projects.card_type.text_only"},
@@ -224,7 +225,7 @@ func (opts SearchOptions) ToConds() builder.Cond {
 	if opts.Type > 0 {
 		cond = cond.And(builder.Eq{"type": opts.Type})
 	}
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 
diff --git a/models/project/template.go b/models/project/template.go
index 278cf5b781..3d55cd27f2 100644
--- a/models/project/template.go
+++ b/models/project/template.go
@@ -27,7 +27,7 @@ const (
 
 // GetTemplateConfigs retrieves the template configs of configurations project columns could have
 //
-//llu:returnsTrKey
+//llu:returnsTrKeyWeak
 func GetTemplateConfigs() []TemplateConfig {
 	return []TemplateConfig{
 		{TemplateTypeNone, "repo.projects.type.none"},
diff --git a/models/repo/repo.go b/models/repo/repo.go
index 0c45f483e4..1bd779b5a0 100644
--- a/models/repo/repo.go
+++ b/models/repo/repo.go
@@ -893,6 +893,7 @@ type CountRepositoryOptions struct {
 func CountRepositories(ctx context.Context, opts CountRepositoryOptions) (int64, error) {
 	sess := db.GetEngine(ctx).Where("id > 0")
 
+	// nosemgrep: forgejo-logic-suspicious-OwnerID-check (repositories cannot be owned by system users)
 	if opts.OwnerID > 0 {
 		sess.And("owner_id = ?", opts.OwnerID)
 	}
diff --git a/models/repo/repo_unit.go b/models/repo/repo_unit.go
index 3db6dc95e8..2cde375775 100644
--- a/models/repo/repo_unit.go
+++ b/models/repo/repo_unit.go
@@ -220,8 +220,42 @@ func (cfg *PullRequestsConfig) GetDefaultUpdateStyle() UpdateStyle {
 	return UpdateStyleMerge
 }
 
+// Represents the current format for `sub` claim generation when using `enable-openid-connect: true` on an Action.
+//
+// We try to follow GitHub's format for the `sub` claim because it should allow third-party integrations, which may have
+// existing knowledge and code that works with GitHub's OIDC tokens, to reuse that knowledge and code in the future to
+// implement Forgejo support.  As GitHub's format changes, we may implement those format changes to maintain that
+// familarity.  Forgejo isn't required to do so, though -- if future changes from GitHub don't make sense for Forgejo,
+// or vice-versa, this format matching effort may be discarded.
+type OIDCSubjectFormat string
+
+var (
+	// Default is the current, most preferred method of generating an `sub` JWT claim for an Actions JWT token.  It is
+	// an empty string which allows [ActionsConfig] to always default to the current preferred default value for new
+	// repositories.  At present, it is a `sub` claim that contains information about the repository owner and
+	// repository where the action occurred, their immutable identifiers (ID numbers), and the event that triggered the
+	// Action.
+	//
+	// Immutable identifiers have been added since OIDCSubjectFormatLegacyForgejo15.  The intent of adding them is to
+	// protect resource servers which may be requiring a specific subject claim from having that claim be impersonated
+	// when a user or repository are renamed or deleted.  For example, if a JWT from my-org/my-repo is trusted, but then
+	// my-org is deleted and a new user takes ownership of the name my-org, they should not be granted the same trust.
+	//
+	// Example: repo:my-org-123456/my-repo-456789:ref:refs/heads/main
+	OIDCSubjectFormatDefault OIDCSubjectFormat // defaults to ""
+
+	// The `sub` JWT claim generation that was shipped in Forgejo 15.  Contains information about the repository owner
+	// and repository where the action occurred and the event that triggered the Action.
+	//
+	// Example: repo:my-org/my-repo:ref:refs/heads/main
+	OIDCSubjectFormatLegacyForgejo15 OIDCSubjectFormat = "legacy-forgejo-v15"
+)
+
 type ActionsConfig struct {
 	DisabledWorkflows []string
+
+	// Format of the OIDC 'sub' claim that will be used when `enable-openid-connect` is true in an Action.
+	OIDCSubjectFormat OIDCSubjectFormat `json:",omitempty"`
 }
 
 func (cfg *ActionsConfig) EnableWorkflow(file string) {
diff --git a/models/system/notice.go b/models/system/notice.go
index b1fdd2e4f2..7801686889 100644
--- a/models/system/notice.go
+++ b/models/system/notice.go
@@ -38,6 +38,8 @@ func init() {
 }
 
 // TrStr returns a translation format string.
+//
+//llu:returnsTrKey
 func (n *Notice) TrStr() string {
 	return fmt.Sprintf("admin.notices.type_%d", n.Type)
 }
diff --git a/models/unittest/testdb.go b/models/unittest/testdb.go
index 8e212bc0a3..c926a85df6 100644
--- a/models/unittest/testdb.go
+++ b/models/unittest/testdb.go
@@ -47,10 +47,29 @@ func fatalTestError(fmtStr string, args ...any) {
 
 // InitSettings initializes config provider and load common settings for tests
 func InitSettings() {
-	if setting.CustomConf == "" {
-		setting.CustomConf = filepath.Join(setting.CustomPath, "conf/app-unittest-tmp.ini")
-		_ = os.Remove(setting.CustomConf)
+	InitCustomSettings("unittest.ini")
+}
+
+func InitCustomSettings(confFileName string) {
+	root := base.SetupGiteaRoot()
+	if root == "" {
+		fatalTestError("Environment variable $GITEA_ROOT not set")
 	}
+	setting.AppPath = filepath.Join(root, "gitea")
+	if setting.CustomConf == "" {
+		templateFile := confFileName + ".tmpl"
+		content, err := os.ReadFile(filepath.Join(root, "tests", templateFile))
+		if err != nil {
+			log.Fatalf("couldn't read config template: %s", templateFile)
+		}
+		err = os.WriteFile(filepath.Join(root, "tests", confFileName), content, 0o644)
+		if err != nil {
+			log.Fatalf("couldn't write config: %s", confFileName)
+		}
+		setting.CustomConf = filepath.Join(root, "tests", confFileName)
+	}
+	os.Setenv("GITEA_CONF", setting.CustomConf)
+
 	setting.InitCfgProvider(setting.CustomConf)
 	setting.LoadCommonSettings()
 
@@ -72,9 +91,10 @@ func InitSettings() {
 
 // TestOptions represents test options
 type TestOptions struct {
-	FixtureFiles []string
-	SetUp        func() error // SetUp will be executed before all tests in this package
-	TearDown     func() error // TearDown will be executed after all tests in this package
+	FixtureFiles    []string
+	SetUp           func() error // SetUp will be executed before all tests in this package
+	TearDown        func() error // TearDown will be executed after all tests in this package
+	IniFileOverride string
 }
 
 // MainTest a reusable TestMain(..) function for unit tests that need to use a
@@ -97,7 +117,11 @@ func MainTest(m *testing.M, testOpts ...*TestOptions) {
 
 	giteaRoot = searchDir
 	setting.CustomPath = filepath.Join(giteaRoot, "custom")
-	InitSettings()
+	if len(testOpts) == 0 || testOpts[0].IniFileOverride == "" {
+		InitSettings()
+	} else {
+		InitCustomSettings(testOpts[0].IniFileOverride)
+	}
 
 	fixturesDir = filepath.Join(giteaRoot, "models", "fixtures")
 	var opts FixturesOptions
diff --git a/models/unittest/unit_tests.go b/models/unittest/unit_tests.go
index 2fa49e443a..411777cb17 100644
--- a/models/unittest/unit_tests.go
+++ b/models/unittest/unit_tests.go
@@ -67,7 +67,7 @@ func BeanExists(t testing.TB, bean any, conditions ...any) bool {
 }
 
 // AssertExistsAndLoadBean assert that a bean exists and load it from the test database
-func AssertExistsAndLoadBean[T any](t testing.TB, bean T, conditions ...any) T {
+func AssertExistsAndLoadBean[T any](t require.TestingT, bean T, conditions ...any) T {
 	exists, err := LoadBeanIfExists(bean, conditions...)
 	require.NoError(t, err)
 	assert.True(t, exists,
diff --git a/models/user/error.go b/models/user/error.go
index 264b3fdcd2..7f23758768 100644
--- a/models/user/error.go
+++ b/models/user/error.go
@@ -105,3 +105,16 @@ func IsErrUserIsNotLocal(err error) bool {
 	_, ok := err.(ErrUserIsNotLocal)
 	return ok
 }
+
+type ErrFederatedUserNotExists struct {
+	Identifier string
+}
+
+func (err ErrFederatedUserNotExists) Error() string {
+	return fmt.Sprintf("No cached federated user found for identifier %s", err.Identifier)
+}
+
+func IsErrFederatedUserNotExists(err error) bool {
+	_, ok := err.(ErrFederatedUserNotExists)
+	return ok
+}
diff --git a/models/user/federated_user.go b/models/user/federated_user.go
index d2a9c34c9e..8199a9cd22 100644
--- a/models/user/federated_user.go
+++ b/models/user/federated_user.go
@@ -5,6 +5,7 @@ package user
 
 import (
 	"database/sql"
+	"fmt"
 
 	"forgejo.org/modules/validation"
 )
@@ -42,3 +43,18 @@ func (federatedUser FederatedUser) Validate() []string {
 	result = append(result, validation.ValidateNotEmpty(federatedUser.InboxPath, "InboxPath")...)
 	return result
 }
+
+func (federatedUser *FederatedUser) LogString() string {
+	if federatedUser == nil {
+		return "<FederatedUser nil>"
+	}
+
+	return fmt.Sprintf(
+		"<FederatedUser ID: %d, UserID: %d, ExternalID: %s, NormalizedOriginalURL: %s, InboxPath: %s>",
+		federatedUser.ID,
+		federatedUser.UserID,
+		federatedUser.ExternalID,
+		federatedUser.NormalizedOriginalURL,
+		federatedUser.InboxPath,
+	)
+}
diff --git a/models/user/moderation.go b/models/user/moderation.go
index 765414acc0..fe8eef1806 100644
--- a/models/user/moderation.go
+++ b/models/user/moderation.go
@@ -89,8 +89,8 @@ var userDataColumnNames = sync.OnceValue(func() []string {
 	mapper := new(names.GonicMapper)
 	udType := reflect.TypeFor[UserData]()
 	columnNames := make([]string, 0, udType.NumField())
-	for i := 0; i < udType.NumField(); i++ {
-		columnNames = append(columnNames, mapper.Obj2Table(udType.Field(i).Name))
+	for field := range udType.Fields() {
+		columnNames = append(columnNames, mapper.Obj2Table(field.Name))
 	}
 	return columnNames
 })
diff --git a/models/user/user_repository.go b/models/user/user_repository.go
index 9692bd7304..506d1cfb15 100644
--- a/models/user/user_repository.go
+++ b/models/user/user_repository.go
@@ -65,7 +65,7 @@ func FindFederatedUser(ctx context.Context, externalID string, federationHostID
 	if err != nil {
 		return nil, nil, err
 	} else if !has {
-		return nil, nil, nil
+		return nil, nil, ErrFederatedUserNotExists{Identifier: externalID}
 	}
 	has, err = db.GetEngine(ctx).ID(federatedUser.UserID).Get(user)
 	if err != nil {
@@ -83,14 +83,55 @@ func FindFederatedUser(ctx context.Context, externalID string, federationHostID
 	return user, federatedUser, nil
 }
 
-func GetFederatedUser(ctx context.Context, externalID string, federationHostID int64) (*User, *FederatedUser, error) {
-	user, federatedUser, err := FindFederatedUser(ctx, externalID, federationHostID)
-	if err != nil {
-		return nil, nil, err
-	} else if federatedUser == nil {
-		return nil, nil, fmt.Errorf("FederatedUser not found (given externalId: %v, federationHostId: %v)", externalID, federationHostID)
+func CountFederatedUsers(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Count(FederatedUser{})
+}
+
+func FindFederatedUsers(ctx context.Context, opts db.ListOptions) (users []*FederatedUser, err error) {
+	sess := db.GetEngine(ctx)
+
+	if opts.PageSize > 0 {
+		sess = db.SetSessionPagination(sess, &opts)
 	}
-	return user, federatedUser, nil
+
+	err = sess.Find(&users)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, user := range users {
+		if res, err := validation.IsValid(user); !res {
+			return nil, err
+		}
+	}
+
+	return users, err
+}
+
+func CountFederatedUsersByHostID(ctx context.Context, federationHostID int64) (int64, error) {
+	return db.GetEngine(ctx).Where("federation_host_id = ?", federationHostID).Count(FederatedUser{})
+}
+
+func FindFederatedUsersByHostID(ctx context.Context, federationHostID int64, opts db.ListOptions) ([]*FederatedUser, error) {
+	var users []*FederatedUser
+	sess := db.GetEngine(ctx).Where("federation_host_id = ?", federationHostID)
+
+	if opts.PageSize > 0 {
+		sess = db.SetSessionPagination(sess, &opts)
+	}
+
+	err := sess.Find(&users)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, user := range users {
+		if res, err := validation.IsValid(user); !res {
+			return nil, err
+		}
+	}
+
+	return users, nil
 }
 
 func GetFederatedUserByUserID(ctx context.Context, userID int64) (*User, *FederatedUser, error) {
@@ -126,7 +167,7 @@ func FindFederatedUserByKeyID(ctx context.Context, keyID string) (*User, *Federa
 	if err != nil {
 		return nil, nil, err
 	} else if !has {
-		return nil, nil, nil
+		return nil, nil, ErrFederatedUserNotExists{Identifier: keyID}
 	}
 	has, err = db.GetEngine(ctx).ID(federatedUser.UserID).Get(user)
 	if err != nil {
diff --git a/modules/actions/task_state.go b/modules/actions/task_state.go
index 77bfc747ee..889a0b0364 100644
--- a/modules/actions/task_state.go
+++ b/modules/actions/task_state.go
@@ -111,6 +111,8 @@ func fullStepsOfEmptySteps(task *actions_model.ActionTask) []*actions_model.Acti
 		preStep.Status = task.Status
 		if preStep.Status.IsSuccess() {
 			postStep.Status = actions_model.StatusSuccess
+		} else if preStep.Status.IsSkipped() {
+			postStep.Status = actions_model.StatusSkipped
 		} else {
 			postStep.Status = actions_model.StatusCancelled
 		}
diff --git a/modules/actions/task_state_test.go b/modules/actions/task_state_test.go
index e18de4573f..084de1c709 100644
--- a/modules/actions/task_state_test.go
+++ b/modules/actions/task_state_test.go
@@ -156,6 +156,21 @@ func TestFullSteps(t *testing.T) {
 				{Name: postStepName, Status: actions_model.StatusSuccess, LogIndex: 90, LogLength: 10, Started: 10090, Stopped: 10100},
 			},
 		},
+		{
+			// situation occurs with a reusable workflow's outer job which has no steps
+			name: "skipped task w/ zero steps",
+			task: &actions_model.ActionTask{
+				Steps:     []*actions_model.ActionTaskStep{},
+				Status:    actions_model.StatusSkipped,
+				Started:   0,
+				Stopped:   0,
+				LogLength: 0,
+			},
+			want: []*actions_model.ActionTaskStep{
+				{Name: preStepName, Status: actions_model.StatusSkipped, LogIndex: 0, LogLength: 0, Started: 0, Stopped: 0},
+				{Name: postStepName, Status: actions_model.StatusSkipped, LogIndex: 0, LogLength: 0, Started: 0, Stopped: 0},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/modules/base/tool.go b/modules/base/tool.go
index ada73df7da..1cc053ba58 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -103,7 +103,7 @@ func Int64sToStrings(ints []int64) []string {
 func EntryIcon(entry *git.TreeEntry) string {
 	switch {
 	case entry.IsLink():
-		te, _, err := entry.FollowLink()
+		te, err := entry.FollowLink()
 		if err != nil {
 			log.Debug(err.Error())
 			return "file-symlink-file"
diff --git a/modules/cache/mocks.go b/modules/cache/mocks.go
new file mode 100644
index 0000000000..8bfec19d6b
--- /dev/null
+++ b/modules/cache/mocks.go
@@ -0,0 +1,497 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package cache
+
+import (
+	"code.forgejo.org/go-chi/cache"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewMockCache creates a new instance of MockCache. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockCache(t interface {
+	mock.TestingT
+	Cleanup(func())
+},
+) *MockCache {
+	mock := &MockCache{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// MockCache is an autogenerated mock type for the Cache type
+type MockCache struct {
+	mock.Mock
+}
+
+type MockCache_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockCache) EXPECT() *MockCache_Expecter {
+	return &MockCache_Expecter{mock: &_m.Mock}
+}
+
+// Decr provides a mock function for the type MockCache
+func (_mock *MockCache) Decr(key string) error {
+	ret := _mock.Called(key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Decr")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(string) error); ok {
+		r0 = returnFunc(key)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCache_Decr_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Decr'
+type MockCache_Decr_Call struct {
+	*mock.Call
+}
+
+// Decr is a helper method to define mock.On call
+//   - key string
+func (_e *MockCache_Expecter) Decr(key any) *MockCache_Decr_Call {
+	return &MockCache_Decr_Call{Call: _e.mock.On("Decr", key)}
+}
+
+func (_c *MockCache_Decr_Call) Run(run func(key string)) *MockCache_Decr_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 string
+		if args[0] != nil {
+			arg0 = args[0].(string)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCache_Decr_Call) Return(err error) *MockCache_Decr_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCache_Decr_Call) RunAndReturn(run func(key string) error) *MockCache_Decr_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Delete provides a mock function for the type MockCache
+func (_mock *MockCache) Delete(key string) error {
+	ret := _mock.Called(key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Delete")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(string) error); ok {
+		r0 = returnFunc(key)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCache_Delete_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Delete'
+type MockCache_Delete_Call struct {
+	*mock.Call
+}
+
+// Delete is a helper method to define mock.On call
+//   - key string
+func (_e *MockCache_Expecter) Delete(key any) *MockCache_Delete_Call {
+	return &MockCache_Delete_Call{Call: _e.mock.On("Delete", key)}
+}
+
+func (_c *MockCache_Delete_Call) Run(run func(key string)) *MockCache_Delete_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 string
+		if args[0] != nil {
+			arg0 = args[0].(string)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCache_Delete_Call) Return(err error) *MockCache_Delete_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCache_Delete_Call) RunAndReturn(run func(key string) error) *MockCache_Delete_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Flush provides a mock function for the type MockCache
+func (_mock *MockCache) Flush() error {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Flush")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func() error); ok {
+		r0 = returnFunc()
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCache_Flush_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Flush'
+type MockCache_Flush_Call struct {
+	*mock.Call
+}
+
+// Flush is a helper method to define mock.On call
+func (_e *MockCache_Expecter) Flush() *MockCache_Flush_Call {
+	return &MockCache_Flush_Call{Call: _e.mock.On("Flush")}
+}
+
+func (_c *MockCache_Flush_Call) Run(run func()) *MockCache_Flush_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockCache_Flush_Call) Return(err error) *MockCache_Flush_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCache_Flush_Call) RunAndReturn(run func() error) *MockCache_Flush_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Get provides a mock function for the type MockCache
+func (_mock *MockCache) Get(key string) any {
+	ret := _mock.Called(key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Get")
+	}
+
+	var r0 any
+	if returnFunc, ok := ret.Get(0).(func(string) any); ok {
+		r0 = returnFunc(key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(any)
+		}
+	}
+	return r0
+}
+
+// MockCache_Get_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Get'
+type MockCache_Get_Call struct {
+	*mock.Call
+}
+
+// Get is a helper method to define mock.On call
+//   - key string
+func (_e *MockCache_Expecter) Get(key any) *MockCache_Get_Call {
+	return &MockCache_Get_Call{Call: _e.mock.On("Get", key)}
+}
+
+func (_c *MockCache_Get_Call) Run(run func(key string)) *MockCache_Get_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 string
+		if args[0] != nil {
+			arg0 = args[0].(string)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCache_Get_Call) Return(v any) *MockCache_Get_Call {
+	_c.Call.Return(v)
+	return _c
+}
+
+func (_c *MockCache_Get_Call) RunAndReturn(run func(key string) any) *MockCache_Get_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Incr provides a mock function for the type MockCache
+func (_mock *MockCache) Incr(key string) error {
+	ret := _mock.Called(key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Incr")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(string) error); ok {
+		r0 = returnFunc(key)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCache_Incr_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Incr'
+type MockCache_Incr_Call struct {
+	*mock.Call
+}
+
+// Incr is a helper method to define mock.On call
+//   - key string
+func (_e *MockCache_Expecter) Incr(key any) *MockCache_Incr_Call {
+	return &MockCache_Incr_Call{Call: _e.mock.On("Incr", key)}
+}
+
+func (_c *MockCache_Incr_Call) Run(run func(key string)) *MockCache_Incr_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 string
+		if args[0] != nil {
+			arg0 = args[0].(string)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCache_Incr_Call) Return(err error) *MockCache_Incr_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCache_Incr_Call) RunAndReturn(run func(key string) error) *MockCache_Incr_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// IsExist provides a mock function for the type MockCache
+func (_mock *MockCache) IsExist(key string) bool {
+	ret := _mock.Called(key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for IsExist")
+	}
+
+	var r0 bool
+	if returnFunc, ok := ret.Get(0).(func(string) bool); ok {
+		r0 = returnFunc(key)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+	return r0
+}
+
+// MockCache_IsExist_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'IsExist'
+type MockCache_IsExist_Call struct {
+	*mock.Call
+}
+
+// IsExist is a helper method to define mock.On call
+//   - key string
+func (_e *MockCache_Expecter) IsExist(key any) *MockCache_IsExist_Call {
+	return &MockCache_IsExist_Call{Call: _e.mock.On("IsExist", key)}
+}
+
+func (_c *MockCache_IsExist_Call) Run(run func(key string)) *MockCache_IsExist_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 string
+		if args[0] != nil {
+			arg0 = args[0].(string)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCache_IsExist_Call) Return(b bool) *MockCache_IsExist_Call {
+	_c.Call.Return(b)
+	return _c
+}
+
+func (_c *MockCache_IsExist_Call) RunAndReturn(run func(key string) bool) *MockCache_IsExist_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Ping provides a mock function for the type MockCache
+func (_mock *MockCache) Ping() error {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Ping")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func() error); ok {
+		r0 = returnFunc()
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCache_Ping_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Ping'
+type MockCache_Ping_Call struct {
+	*mock.Call
+}
+
+// Ping is a helper method to define mock.On call
+func (_e *MockCache_Expecter) Ping() *MockCache_Ping_Call {
+	return &MockCache_Ping_Call{Call: _e.mock.On("Ping")}
+}
+
+func (_c *MockCache_Ping_Call) Run(run func()) *MockCache_Ping_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockCache_Ping_Call) Return(err error) *MockCache_Ping_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCache_Ping_Call) RunAndReturn(run func() error) *MockCache_Ping_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Put provides a mock function for the type MockCache
+func (_mock *MockCache) Put(key string, val any, timeout int64) error {
+	ret := _mock.Called(key, val, timeout)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Put")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(string, any, int64) error); ok {
+		r0 = returnFunc(key, val, timeout)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCache_Put_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Put'
+type MockCache_Put_Call struct {
+	*mock.Call
+}
+
+// Put is a helper method to define mock.On call
+//   - key string
+//   - val any
+//   - timeout int64
+func (_e *MockCache_Expecter) Put(key, val, timeout any) *MockCache_Put_Call {
+	return &MockCache_Put_Call{Call: _e.mock.On("Put", key, val, timeout)}
+}
+
+func (_c *MockCache_Put_Call) Run(run func(key string, val any, timeout int64)) *MockCache_Put_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 string
+		if args[0] != nil {
+			arg0 = args[0].(string)
+		}
+		var arg1 any
+		if args[1] != nil {
+			arg1 = args[1].(any)
+		}
+		var arg2 int64
+		if args[2] != nil {
+			arg2 = args[2].(int64)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCache_Put_Call) Return(err error) *MockCache_Put_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCache_Put_Call) RunAndReturn(run func(key string, val any, timeout int64) error) *MockCache_Put_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// StartAndGC provides a mock function for the type MockCache
+func (_mock *MockCache) StartAndGC(opt cache.Options) error {
+	ret := _mock.Called(opt)
+
+	if len(ret) == 0 {
+		panic("no return value specified for StartAndGC")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(cache.Options) error); ok {
+		r0 = returnFunc(opt)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCache_StartAndGC_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'StartAndGC'
+type MockCache_StartAndGC_Call struct {
+	*mock.Call
+}
+
+// StartAndGC is a helper method to define mock.On call
+//   - opt cache.Options
+func (_e *MockCache_Expecter) StartAndGC(opt any) *MockCache_StartAndGC_Call {
+	return &MockCache_StartAndGC_Call{Call: _e.mock.On("StartAndGC", opt)}
+}
+
+func (_c *MockCache_StartAndGC_Call) Run(run func(opt cache.Options)) *MockCache_StartAndGC_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 cache.Options
+		if args[0] != nil {
+			arg0 = args[0].(cache.Options)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCache_StartAndGC_Call) Return(err error) *MockCache_StartAndGC_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCache_StartAndGC_Call) RunAndReturn(run func(opt cache.Options) error) *MockCache_StartAndGC_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/modules/forgefed/activity_follow.go b/modules/forgefed/activity_follow.go
index 5cb45ca885..928321a00a 100644
--- a/modules/forgefed/activity_follow.go
+++ b/modules/forgefed/activity_follow.go
@@ -48,8 +48,8 @@ func (follow *ForgeFollow) UnmarshalJSON(data []byte) error {
 
 func (follow ForgeFollow) Validate() []string {
 	var result []string
-	result = append(result, validation.ValidateNotEmpty(string(follow.Type), "type")...)
-	result = append(result, validation.ValidateOneOf(string(follow.Type), []any{"Follow"}, "type")...)
+	result = append(result, validation.ValidateNotEmpty(follow.Type, "type")...)
+	result = append(result, validation.ValidateOneOf(follow.Type, []any{ap.FollowType}, "type")...)
 	result = append(result, validation.ValidateIDExists(follow.Actor, "actor")...)
 	result = append(result, validation.ValidateIDExists(follow.Object, "object")...)
 
diff --git a/modules/forgefed/activity_follow_test.go b/modules/forgefed/activity_follow_test.go
index 18fbef33aa..e0142a39f2 100644
--- a/modules/forgefed/activity_follow_test.go
+++ b/modules/forgefed/activity_follow_test.go
@@ -15,7 +15,7 @@ import (
 
 func Test_NewForgeFollowValidation(t *testing.T) {
 	sut := forgefed.ForgeFollow{}
-	sut.Type = "Follow"
+	sut.Type = ap.FollowType
 	sut.Actor = ap.IRI("example.org/alice")
 	sut.Object = ap.IRI("example.org/bob")
 
diff --git a/modules/forgefed/activity_like.go b/modules/forgefed/activity_like.go
index e52d0a9af6..7849aec568 100644
--- a/modules/forgefed/activity_like.go
+++ b/modules/forgefed/activity_like.go
@@ -44,8 +44,8 @@ func (like ForgeLike) IsNewer(compareTo time.Time) bool {
 
 func (like ForgeLike) Validate() []string {
 	var result []string
-	result = append(result, validation.ValidateNotEmpty(string(like.Type), "type")...)
-	result = append(result, validation.ValidateOneOf(string(like.Type), []any{"Like"}, "type")...)
+	result = append(result, validation.ValidateNotEmpty(like.Type, "type")...)
+	result = append(result, validation.ValidateOneOf(like.Type, []any{ap.LikeType}, "type")...)
 
 	if like.Actor == nil {
 		result = append(result, "Actor should not be nil.")
diff --git a/modules/forgefed/activity_like_test.go b/modules/forgefed/activity_like_test.go
index c0b565f4db..dc2d8efdc7 100644
--- a/modules/forgefed/activity_like_test.go
+++ b/modules/forgefed/activity_like_test.go
@@ -51,7 +51,7 @@ func Test_LikeMarshalJSON(t *testing.T) {
 			item: forgefed.ForgeLike{
 				Activity: ap.Activity{
 					Actor:  ap.IRI("https://repo.prod.meissa.de/api/v1/activitypub/user-id/1"),
-					Type:   "Like",
+					Type:   ap.LikeType,
 					Object: ap.IRI("https://codeberg.org/api/v1/activitypub/repository-id/1"),
 				},
 			},
@@ -80,7 +80,7 @@ func Test_LikeUnmarshalJSON(t *testing.T) {
 			item: []byte(`{"type":"Like","actor":"https://repo.prod.meissa.de/api/activitypub/user-id/1","object":"https://codeberg.org/api/activitypub/repository-id/1"}`),
 			want: &forgefed.ForgeLike{
 				Activity: ap.Activity{
-					Type:   "Like",
+					Type:   ap.LikeType,
 					Actor:  ap.IRI("https://repo.prod.meissa.de/api/activitypub/user-id/1"),
 					Object: ap.IRI("https://codeberg.org/api/activitypub/repository-id/1"),
 				},
@@ -124,7 +124,7 @@ func Test_ForgeLikeValidation(t *testing.T) {
 	validate := sut.Validate()
 	assert.Len(t, validate, 2)
 	assert.Equal(t,
-		"Field type contains the value , which is not in allowed subset [Like]",
+		"Field type contains the value <nil>, which is not in allowed subset [Like]",
 		validate[1])
 
 	sut.UnmarshalJSON([]byte(`{"type":"bad-type",
diff --git a/modules/forgefed/activity_undo_like.go b/modules/forgefed/activity_undo_like.go
index 8b7df582ad..eaf32ab09f 100644
--- a/modules/forgefed/activity_undo_like.go
+++ b/modules/forgefed/activity_undo_like.go
@@ -42,8 +42,8 @@ func (undo *ForgeUndoLike) UnmarshalJSON(data []byte) error {
 
 func (undo ForgeUndoLike) Validate() []string {
 	var result []string
-	result = append(result, validation.ValidateNotEmpty(string(undo.Type), "type")...)
-	result = append(result, validation.ValidateOneOf(string(undo.Type), []any{"Undo"}, "type")...)
+	result = append(result, validation.ValidateNotEmpty(undo.Type, "type")...)
+	result = append(result, validation.ValidateOneOf(undo.Type, []any{ap.UndoType}, "type")...)
 
 	if undo.Actor == nil {
 		result = append(result, "Actor should not be nil.")
@@ -61,8 +61,8 @@ func (undo ForgeUndoLike) Validate() []string {
 	} else if activity, ok := undo.Object.(*ap.Activity); !ok {
 		result = append(result, "object is not of type Activity")
 	} else {
-		result = append(result, validation.ValidateNotEmpty(string(activity.Type), "type")...)
-		result = append(result, validation.ValidateOneOf(string(activity.Type), []any{"Like"}, "type")...)
+		result = append(result, validation.ValidateNotEmpty(activity.Type, "type")...)
+		result = append(result, validation.ValidateOneOf(activity.Type, []any{ap.LikeType}, "type")...)
 
 		if activity.Actor == nil {
 			result = append(result, "Object.Actor should not be nil.")
diff --git a/modules/forgefed/activity_undo_like_test.go b/modules/forgefed/activity_undo_like_test.go
index 18db688c48..cbb309afc5 100644
--- a/modules/forgefed/activity_undo_like_test.go
+++ b/modules/forgefed/activity_undo_like_test.go
@@ -64,7 +64,7 @@ func Test_UndoLikeMarshalJSON(t *testing.T) {
 				Activity: ap.Activity{
 					StartTime: startTime,
 					Actor:     ap.IRI("https://repo.prod.meissa.de/api/v1/activitypub/user-id/1"),
-					Type:      "Undo",
+					Type:      ap.UndoType,
 					Object:    like,
 				},
 			},
@@ -117,7 +117,7 @@ func Test_UndoLikeUnmarshalJSON(t *testing.T) {
 				Activity: ap.Activity{
 					StartTime: startTime,
 					Actor:     ap.IRI("https://repo.prod.meissa.de/api/v1/activitypub/user-id/1"),
-					Type:      "Undo",
+					Type:      ap.UndoType,
 					Object:    like,
 				},
 			},
diff --git a/modules/forgefed/activity_user_activity.go b/modules/forgefed/activity_user_activity.go
index 82353245c9..69e7bc3ead 100644
--- a/modules/forgefed/activity_user_activity.go
+++ b/modules/forgefed/activity_user_activity.go
@@ -60,8 +60,8 @@ func NewForgeUserActivity(doer *user_model.User, actionID int64, content string)
 
 func (userActivity ForgeUserActivity) Validate() []string {
 	var result []string
-	result = append(result, validation.ValidateNotEmpty(string(userActivity.Type), "type")...)
-	result = append(result, validation.ValidateOneOf(string(userActivity.Type), []any{"Create"}, "type")...)
+	result = append(result, validation.ValidateNotEmpty(userActivity.Type, "type")...)
+	result = append(result, validation.ValidateOneOf(userActivity.Type, []any{ap.CreateType}, "type")...)
 	result = append(result, validation.ValidateIDExists(userActivity.Actor, "actor")...)
 
 	if len(userActivity.To) == 0 {
diff --git a/modules/forgefed/activity_user_activity_test.go b/modules/forgefed/activity_user_activity_test.go
index 49137c7ab4..106f0ac73c 100644
--- a/modules/forgefed/activity_user_activity_test.go
+++ b/modules/forgefed/activity_user_activity_test.go
@@ -15,17 +15,14 @@ import (
 
 func Test_ForgeUserActivityValidation(t *testing.T) {
 	note := forgefed.ForgeUserActivityNote{}
-	note.Type = "Note"
+	note.Type = ap.NoteType
 	note.Content = ap.NaturalLanguageValues{
-		{
-			Ref:   ap.NilLangRef,
-			Value: ap.Content("Any Content!"),
-		},
+		ap.NilLangRef: ap.Content("Any Content!"),
 	}
 	note.URL = ap.IRI("example.org/user-id/57")
 
 	sut := forgefed.ForgeUserActivity{}
-	sut.Type = "Create"
+	sut.Type = ap.CreateType
 	sut.Actor = ap.IRI("example.org/user-id/23")
 	sut.CC = ap.ItemCollection{
 		ap.IRI("example.org/registration/public#2nd"),
diff --git a/modules/forgefed/actor_person.go b/modules/forgefed/actor_person.go
index 72768f4815..aee7d3c37f 100644
--- a/modules/forgefed/actor_person.go
+++ b/modules/forgefed/actor_person.go
@@ -20,6 +20,8 @@ type PersonID struct {
 const (
 	personIDapiPathV1       = "api/v1/activitypub/user-id"
 	personIDapiPathV1Latest = "api/activitypub/user-id"
+	actorIDapiPathV1        = "api/v1/activitypub"
+	actorIDapiPathLatest    = "api/activitypub"
 )
 
 // Factory function for PersonID. Created struct is asserted to be valid
@@ -88,8 +90,11 @@ func (id PersonID) Validate() []string {
 	result = append(result, validation.ValidateOneOf(id.Source, []any{"forgejo", "gitea", "mastodon", "gotosocial"}, "Source")...)
 	if id.Source == "forgejo" {
 		result = append(result, validation.ValidateNotEmpty(id.Path, "path")...)
-		if strings.ToLower(id.Path) != personIDapiPathV1 && strings.ToLower(id.Path) != personIDapiPathV1Latest {
-			result = append(result, fmt.Sprintf("path: %q has to be a person specific api path", id.Path))
+		lowerPath := strings.ToLower(id.Path)
+		if lowerPath != personIDapiPathV1 && lowerPath != personIDapiPathV1Latest {
+			if lowerPath != actorIDapiPathV1 && lowerPath != actorIDapiPathLatest || id.ID != "actor" {
+				result = append(result, fmt.Sprintf("path: %q has to be a person specific api path", id.Path))
+			}
 		}
 	}
 
@@ -115,8 +120,8 @@ func (s *ForgePerson) UnmarshalJSON(data []byte) error {
 
 func (s ForgePerson) Validate() []string {
 	var result []string
-	result = append(result, validation.ValidateNotEmpty(string(s.Type), "Type")...)
-	result = append(result, validation.ValidateOneOf(string(s.Type), []any{string(ap.PersonType)}, "Type")...)
+	result = append(result, validation.ValidateNotEmpty(s.Type, "Type")...)
+	result = append(result, validation.ValidateOneOf(s.Type, []any{ap.PersonType}, "Type")...)
 	result = append(result, validation.ValidateNotEmpty(s.PreferredUsername.String(), "PreferredUsername")...)
 
 	return result
diff --git a/modules/forgefed/actor_person_test.go b/modules/forgefed/actor_person_test.go
index 82bd9fabc3..72ff976688 100644
--- a/modules/forgefed/actor_person_test.go
+++ b/modules/forgefed/actor_person_test.go
@@ -159,6 +159,48 @@ func TestPersonIdValidation(t *testing.T) {
 	result, err = validation.IsValid(sut)
 	assert.False(t, result)
 	require.EqualError(t, err, "Validation Error: forgefed.PersonID: Field Source contains the value forgejox, which is not in allowed subset [forgejo gitea mastodon gotosocial]")
+
+	sut = forgefed.PersonID{}
+	sut.ID = "actor"
+	sut.Source = "forgejo"
+	sut.HostSchema = "https"
+	sut.Path = "api/v1/activitypub"
+	sut.Host = "example.com"
+	sut.HostPort = 443
+	sut.IsPortSupplemented = true
+	sut.UnvalidatedInput = "https://example.com/api/v1/activitypub/actor"
+
+	result, err = validation.IsValid(sut)
+	assert.True(t, result)
+	require.NoError(t, err)
+
+	sut = forgefed.PersonID{}
+	sut.ID = "actor"
+	sut.Source = "forgejo"
+	sut.HostSchema = "https"
+	sut.Path = "api/activitypub"
+	sut.Host = "example.com"
+	sut.HostPort = 443
+	sut.IsPortSupplemented = true
+	sut.UnvalidatedInput = "https://example.com/api/activitypub/actor"
+
+	result, err = validation.IsValid(sut)
+	assert.True(t, result)
+	require.NoError(t, err)
+
+	sut = forgefed.PersonID{}
+	sut.ID = "1"
+	sut.Source = "forgejo"
+	sut.HostSchema = "https"
+	sut.Path = "api/v1/activitypub"
+	sut.Host = "example.com"
+	sut.HostPort = 443
+	sut.IsPortSupplemented = true
+	sut.UnvalidatedInput = "https://example.com/api/v1/activitypub/1"
+
+	result, err = validation.IsValid(sut)
+	assert.False(t, result)
+	require.EqualError(t, err, "Validation Error: forgefed.PersonID: path: \"api/v1/activitypub\" has to be a person specific api path")
 }
 
 func TestWebfingerId(t *testing.T) {
@@ -194,9 +236,9 @@ func TestShouldThrowErrorOnInvalidInput(t *testing.T) {
 
 func Test_PersonMarshalJSON(t *testing.T) {
 	sut := forgefed.ForgePerson{}
-	sut.Type = "Person"
+	sut.Type = ap.PersonType
 	sut.PreferredUsername = ap.NaturalLanguageValuesNew()
-	sut.PreferredUsername.Set("en", ap.Content("MaxMuster"))
+	sut.PreferredUsername.Set(ap.English, ap.Content("MaxMuster"))
 	result, _ := sut.MarshalJSON()
 	assert.JSONEq(t, `{"type":"Person","preferredUsername":"MaxMuster"}`, string(result), "Expected string is not equal")
 }
@@ -204,9 +246,9 @@ func Test_PersonMarshalJSON(t *testing.T) {
 func Test_PersonUnmarshalJSON(t *testing.T) {
 	expected := &forgefed.ForgePerson{
 		Actor: ap.Actor{
-			Type: "Person",
+			Type: ap.PersonType,
 			PreferredUsername: ap.NaturalLanguageValues{
-				ap.LangRefValue{Ref: "en", Value: []byte("MaxMuster")},
+				ap.English: []byte("MaxMuster"),
 			},
 		},
 	}
diff --git a/modules/forgefed/inbox.go b/modules/forgefed/inbox.go
new file mode 100644
index 0000000000..c02aedd38c
--- /dev/null
+++ b/modules/forgefed/inbox.go
@@ -0,0 +1,15 @@
+// Copyright 2024, 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package forgefed
+
+import (
+	ap "github.com/go-ap/activitypub"
+)
+
+// ForgeFollow activity data type
+// swagger:model
+type ForgeInbox struct {
+	// swagger:ignore
+	ap.InboxStream
+}
diff --git a/modules/forgefed/object_user_activity_note.go b/modules/forgefed/object_user_activity_note.go
index 758c25aef8..b8e09ecf94 100644
--- a/modules/forgefed/object_user_activity_note.go
+++ b/modules/forgefed/object_user_activity_note.go
@@ -35,10 +35,7 @@ func newNote(doer *user_model.User, content, id string, published time.Time) (Fo
 	note.Type = ap.NoteType
 	note.AttributedTo = ap.IRI(doer.APActorID())
 	note.Content = ap.NaturalLanguageValues{
-		{
-			Ref:   ap.NilLangRef,
-			Value: ap.Content(content),
-		},
+		ap.NilLangRef: ap.Content(content),
 	}
 	note.ID = ap.IRI(id)
 	note.Published = published
@@ -59,8 +56,8 @@ func newNote(doer *user_model.User, content, id string, published time.Time) (Fo
 
 func (note ForgeUserActivityNote) Validate() []string {
 	var result []string
-	result = append(result, validation.ValidateNotEmpty(string(note.Type), "type")...)
-	result = append(result, validation.ValidateOneOf(string(note.Type), []any{"Note"}, "type")...)
+	result = append(result, validation.ValidateNotEmpty(note.Type, "type")...)
+	result = append(result, validation.ValidateOneOf(note.Type, []any{ap.NoteType}, "type")...)
 	result = append(result, validation.ValidateNotEmpty(note.Content.String(), "content")...)
 	result = append(result, validation.ValidateIDExists(note.URL, "url")...)
 
diff --git a/modules/forgefed/object_user_activity_note_test.go b/modules/forgefed/object_user_activity_note_test.go
index 4f790033bc..e559ce84f7 100644
--- a/modules/forgefed/object_user_activity_note_test.go
+++ b/modules/forgefed/object_user_activity_note_test.go
@@ -15,12 +15,9 @@ import (
 
 func Test_UserActivityNoteValidation(t *testing.T) {
 	sut := forgefed.ForgeUserActivityNote{}
-	sut.Type = "Note"
+	sut.Type = ap.NoteType
 	sut.Content = ap.NaturalLanguageValues{
-		{
-			Ref:   ap.NilLangRef,
-			Value: ap.Content("Any Content!"),
-		},
+		ap.NilLangRef: ap.Content("Any Content!"),
 	}
 	sut.URL = ap.IRI("example.org/user-id/57")
 
diff --git a/modules/generate/generate.go b/modules/generate/generate.go
index 2df808fe9e..0dd5d071de 100644
--- a/modules/generate/generate.go
+++ b/modules/generate/generate.go
@@ -37,7 +37,7 @@ func DecodeJwtSecret(src string) ([]byte, error) {
 	encoding := base64.RawURLEncoding
 	decoded := make([]byte, encoding.DecodedLen(len(src))+3)
 	if n, err := encoding.Decode(decoded, []byte(src)); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("JwtSecret decode failed: %v", err)
 	} else if n != defaultJwtSecretLen {
 		return nil, fmt.Errorf("invalid base64 decoded length: %d, expects: %d", n, defaultJwtSecretLen)
 	}
diff --git a/modules/git/blame.go b/modules/git/blame.go
index 868edab2b8..881ef04302 100644
--- a/modules/git/blame.go
+++ b/modules/git/blame.go
@@ -207,5 +207,5 @@ func tryCreateBlameIgnoreRevsFile(commit *Commit) *string {
 		return nil
 	}
 
-	return util.ToPointer(f.Name())
+	return new(f.Name())
 }
diff --git a/modules/git/diff.go b/modules/git/diff.go
index 507dc5b2f5..c954a933ba 100644
--- a/modules/git/diff.go
+++ b/modules/git/diff.go
@@ -7,6 +7,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -277,6 +278,76 @@ func CutDiffAroundLine(originalDiff io.Reader, line int64, old bool, numbersOfLi
 	return strings.Join(newHunk, "\n"), nil
 }
 
+var ErrLineNotFound = errors.New("line not found in diff")
+
+type LinePlacement struct {
+	Left  int64
+	Right int64
+}
+
+// Find the line of code where an old line of code from an old patch is, if present, in a new patch. Given a cutDiff
+// (from CutDiffAroundLine) and the line of code that it was cut from, and, given a single-file diff from the commit
+// where that patch came into a new head, this routine will read through the diff and identify the new line number. It
+// will only return successful if the line is exactly the same as the original line, but just placed in a new location
+// due to added or removed lines in the diff before the target line of code.
+func FindAdjustedLineNumber(cutDiff string, originalLine int64, fullDiff io.Reader) (LinePlacement, error) {
+	cutDiffSplit := strings.Split(cutDiff, "\n")
+	if len(cutDiffSplit) == 0 {
+		return LinePlacement{}, errors.New("cutDiff has no contents")
+	}
+	endOfCutDiff := cutDiffSplit[len(cutDiffSplit)-1]
+
+	scanner := bufio.NewScanner(fullDiff)
+	inHunk := false // used to skip header lines before the first hunk
+	leftLine := int64(-1)
+	rightLine := int64(-1)
+
+	for scanner.Scan() {
+		lineText := scanner.Text()
+		if strings.HasPrefix(lineText, "@@") {
+			// A map with named groups of our regex to recognize them later more easily
+			submatches := hunkRegex.FindStringSubmatch(lineText)
+			groups := make(map[string]string)
+			for i, name := range hunkRegex.SubexpNames() {
+				if i != 0 && name != "" {
+					groups[name] = submatches[i]
+				}
+			}
+			beginLeft, _ := strconv.ParseInt(groups["beginOld"], 10, 64)
+			beginRight, _ := strconv.ParseInt(groups["beginNew"], 10, 64)
+			leftLine = beginLeft
+			rightLine = beginRight
+			inHunk = true
+		} else if inHunk {
+			if leftLine == originalLine {
+				if lineText != endOfCutDiff {
+					return LinePlacement{}, fmt.Errorf(
+						"line was adjusted from index %d to %d, but contents changed from %q to %q: %w",
+						originalLine, leftLine, endOfCutDiff, lineText, ErrLineNotFound)
+				}
+				return LinePlacement{Left: leftLine, Right: rightLine}, nil
+			}
+			switch lineText[0] {
+			case '+':
+				rightLine++
+			case '-':
+				leftLine++
+			case '\\':
+				// Should be the end-of-file with "\ No newline at end of file" -- nothing to do here.
+				break
+			default:
+				rightLine++
+				leftLine++
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return LinePlacement{}, err
+	}
+
+	return LinePlacement{}, fmt.Errorf("line is no longer in diff: %w", ErrLineNotFound)
+}
+
 // GetAffectedFiles returns the affected files between two commits
 func GetAffectedFiles(repo *Repository, oldCommitID, newCommitID string, env []string) ([]string, error) {
 	objectFormat, err := repo.GetObjectFormat()
diff --git a/modules/git/diff_test.go b/modules/git/diff_test.go
index 34e0695fea..e4b7ce6ace 100644
--- a/modules/git/diff_test.go
+++ b/modules/git/diff_test.go
@@ -167,3 +167,215 @@ func TestParseDiffHunkString(t *testing.T) {
 	assert.Equal(t, 19, rightLine)
 	assert.Equal(t, 5, rightHunk)
 }
+
+func TestFindAdjustedLineNumber(t *testing.T) {
+	commentCutDiff := `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50`
+
+	t.Run("no additional changes", func(t *testing.T) {
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..b21df3f 100644
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50
+ Line 51
+ Line 52
+ Line 53`
+		lineNumber, err := FindAdjustedLineNumber(commentCutDiff, 50, strings.NewReader(diff))
+		require.NoError(t, err)
+		assert.Equal(t, LinePlacement{Left: 50, Right: 50}, lineNumber)
+	})
+
+	t.Run("removed lines before location", func(t *testing.T) {
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..c85b903 100644
+--- a/file1.md
++++ b/file1.md
+@@ -1,13 +1,3 @@
+-Line 1
+-Line 2
+-Line 3
+-Line 4
+-Line 5
+-Line 6
+-Line 7
+-Line 8
+-Line 9
+-Line 10
+ Line 11
+ Line 12
+ Line 13
+@@ -47,7 +37,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50
+ Line 51
+ Line 52
+ Line 53`
+		lineNumber, err := FindAdjustedLineNumber(commentCutDiff, 50, strings.NewReader(diff))
+		require.NoError(t, err)
+		assert.Equal(t, LinePlacement{Left: 50, Right: 40}, lineNumber)
+	})
+
+	t.Run("added lines before location", func(t *testing.T) {
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..24b1aa6 100644
+--- a/file1.md
++++ b/file1.md
+@@ -8,6 +8,11 @@ Line 7
+ Line 8
+ Line 9
+ Line 10
++Line 10.1
++Line 10.2
++Line 10.3
++Line 10.4
++Line 10.5
+ Line 11
+ Line 12
+ Line 13
+@@ -47,7 +52,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50
+ Line 51
+ Line 52
+ Line 53`
+		lineNumber, err := FindAdjustedLineNumber(commentCutDiff, 50, strings.NewReader(diff))
+		require.NoError(t, err)
+		assert.Equal(t, LinePlacement{Left: 50, Right: 55}, lineNumber)
+	})
+
+	t.Run("added and removed in lines before location", func(t *testing.T) {
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..d0cb63f 100644
+--- a/file1.md
++++ b/file1.md
+@@ -5,9 +5,11 @@ Line 4
+ Line 5
+ Line 6
+ Line 7
+-Line 8
+-Line 9
+-Line 10
++Line 10.1
++Line 10.2
++Line 10.3
++Line 10.4
++Line 10.5
+ Line 11
+ Line 12
+ Line 13
+@@ -47,7 +49,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50
+ Line 51
+ Line 52
+ Line 53`
+		lineNumber, err := FindAdjustedLineNumber(commentCutDiff, 50, strings.NewReader(diff))
+		require.NoError(t, err)
+		assert.Equal(t, LinePlacement{Left: 50, Right: 52}, lineNumber)
+	})
+
+	t.Run("changes above in the same hunk", func(t *testing.T) {
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..f35a466 100644
+--- a/file1.md
++++ b/file1.md
+@@ -42,12 +42,6 @@ Line 41
+ Line 42
+ Line 43
+ Line 44
+-Line 45
+-Line 46
+-Line 47
+-Line 48
+-Line 49
+-Line 50
+ Line 51
+ Line 52
+ Line 53`
+		lineNumber, err := FindAdjustedLineNumber(commentCutDiff, 50, strings.NewReader(diff))
+		require.NoError(t, err)
+		assert.Equal(t, LinePlacement{Left: 50, Right: 45}, lineNumber)
+	})
+
+	t.Run("first line in diff", func(t *testing.T) {
+		commentCutDiff := `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -1,4 +1,3 @@
+-Line 1`
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..a490028 100644
+--- a/file1.md
++++ b/file1.md
+@@ -1,4 +1,3 @@
+-Line 1
+ Line 2
+ Line 3
+ Line 4`
+		lineNumber, err := FindAdjustedLineNumber(commentCutDiff, 1, strings.NewReader(diff))
+		require.NoError(t, err)
+		assert.Equal(t, LinePlacement{Left: 1, Right: 1}, lineNumber)
+	})
+
+	t.Run("adjusted line not found", func(t *testing.T) {
+		// "Line 50" is present here but it's no longer "-Line 50", so it should not be identified as present
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..09dd95a 100644
+--- a/file1.md
++++ b/file1.md
+@@ -42,10 +42,6 @@ Line 41
+ Line 42
+ Line 43
+ Line 44
+-Line 45
+-Line 46
+-Line 47
+-Line 48
+ Line 49
+ Line 50
+ Line 51`
+		_, err := FindAdjustedLineNumber(commentCutDiff, 50, strings.NewReader(diff))
+		require.ErrorIs(t, err, ErrLineNotFound)
+	})
+
+	t.Run("adjusted line hunk not present - not changed anymore", func(t *testing.T) {
+		diff := `diff --git a/file1.md b/file1.md
+index 2d203fb..d0cb63f 100644
+--- a/file1.md
++++ b/file1.md
+@@ -5,9 +5,11 @@ Line 4
+ Line 5
+ Line 6
+ Line 7
+-Line 8
+-Line 9
+-Line 10
++Line 10.1
++Line 10.2
++Line 10.3
++Line 10.4
++Line 10.5
+ Line 11
+ Line 12
+ Line 13`
+		_, err := FindAdjustedLineNumber(commentCutDiff, 50, strings.NewReader(diff))
+		require.ErrorIs(t, err, ErrLineNotFound)
+	})
+}
diff --git a/modules/git/git.go b/modules/git/git.go
index 650fd3b5af..ea3e2a1320 100644
--- a/modules/git/git.go
+++ b/modules/git/git.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"regexp"
 	"runtime"
@@ -200,6 +201,11 @@ func InitFull(ctx context.Context) (err error) {
 	_, err = exec.LookPath("ssh")
 	HasSSHExecutable = err == nil
 
+	err = InitDelegateHooks(HomeDir())
+	if err != nil {
+		return err
+	}
+
 	return syncGitConfig()
 }
 
@@ -229,6 +235,10 @@ func syncGitConfig() (err error) {
 		}
 	}
 
+	if err := configSet("core.hooksPath", path.Join(HomeDir(), "hooks")); err != nil {
+		return err
+	}
+
 	// Set git some configurations - these must be set to these values for forgejo to work correctly
 	if err := configSet("core.quotePath", "false"); err != nil {
 		return err
diff --git a/modules/repository/hooks.go b/modules/git/hook_generate.go
similarity index 60%
rename from modules/repository/hooks.go
rename to modules/git/hook_generate.go
index 0f5e3afc34..2af2487ab3 100644
--- a/modules/repository/hooks.go
+++ b/modules/git/hook_generate.go
@@ -1,7 +1,7 @@
 // Copyright 2020 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-package repository
+package git
 
 import (
 	"fmt"
@@ -21,14 +21,25 @@ func getHookTemplates() (hookNames, hookTpls, giteaHookTpls []string) {
 data=$(cat)
 exitcodes=""
 hookname=$(basename $0)
-GIT_DIR=${GIT_DIR:-$(dirname $0)/..}
 
-for hook in ${GIT_DIR}/hooks/${hookname}.d/*; do
+for hook in $(dirname $0)/${hookname}.d/*; do
   test -x "${hook}" && test -f "${hook}" || continue
   echo "${data}" | "${hook}"
   exitcodes="${exitcodes} $?"
 done
 
+# Custom hooks
+custom_hooks_dir="./hooks/${hookname}.d"
+if [ -d "${custom_hooks_dir}" ]; then
+  for hook in ${custom_hooks_dir}/*; do
+    if [ $(basename "${hook}") != "gitea" ]; then
+      test -x "${hook}" && test -f "${hook}" || continue
+      echo "${data}" | "${hook}"
+      exitcodes="${exitcodes} $?"
+    fi
+  done
+fi
+
 for i in ${exitcodes}; do
   [ ${i} -eq 0 ] || exit ${i}
 done
@@ -39,14 +50,25 @@ done
 # AUTO GENERATED BY GITEA, DO NOT MODIFY
 exitcodes=""
 hookname=$(basename $0)
-GIT_DIR=${GIT_DIR:-$(dirname $0/..)}
 
-for hook in ${GIT_DIR}/hooks/${hookname}.d/*; do
+for hook in $(dirname $0)/${hookname}.d/*; do
   test -x "${hook}" && test -f "${hook}" || continue
   "${hook}" $1 $2 $3
   exitcodes="${exitcodes} $?"
 done
 
+# Custom hooks
+custom_hooks_dir="./hooks/${hookname}.d"
+if [ -d "${custom_hooks_dir}" ]; then
+  for hook in ${custom_hooks_dir}/*; do
+    if [ $(basename "${hook}") != "gitea" ]; then
+      test -x "${hook}" && test -f "${hook}" || continue
+      "${hook}" $1 $2 $3
+      exitcodes="${exitcodes} $?"
+    fi
+  done
+fi
+
 for i in ${exitcodes}; do
   [ ${i} -eq 0 ] || exit ${i}
 done
@@ -58,14 +80,24 @@ done
 data=$(cat)
 exitcodes=""
 hookname=$(basename $0)
-GIT_DIR=${GIT_DIR:-$(dirname $0)/..}
 
-for hook in ${GIT_DIR}/hooks/${hookname}.d/*; do
+for hook in $(dirname $0)/${hookname}.d/*; do
   test -x "${hook}" && test -f "${hook}" || continue
   echo "${data}" | "${hook}"
   exitcodes="${exitcodes} $?"
 done
 
+# Custom hooks
+custom_hooks_dir="./hooks/${hookname}.d"
+if [ -d "${custom_hooks_dir}" ]; then
+  for hook in ${custom_hooks_dir}/*; do
+    if [ $(basename "${hook}") != "gitea" ]; then
+      test -x "${hook}" && test -f "${hook}" || continue
+      echo "${data}" | "${hook}"
+      exitcodes="${exitcodes} $?"
+    fi
+  done
+fi
 for i in ${exitcodes}; do
   [ ${i} -eq 0 ] || exit ${i}
 done
@@ -104,10 +136,9 @@ done
 	return hookNames, hookTpls, giteaHookTpls
 }
 
-// CreateDelegateHooks creates all the hooks scripts for the repo
-func CreateDelegateHooks(repoPath string) (err error) {
+func InitDelegateHooks(path string) (err error) {
 	hookNames, hookTpls, giteaHookTpls := getHookTemplates()
-	hookDir := filepath.Join(repoPath, "hooks")
+	hookDir := filepath.Join(path, "hooks")
 
 	for i, hookName := range hookNames {
 		oldHookPath := filepath.Join(hookDir, hookName)
@@ -144,14 +175,6 @@ func CreateDelegateHooks(repoPath string) (err error) {
 	return nil
 }
 
-func checkExecutable(filename string) bool {
-	fileInfo, err := os.Stat(filename)
-	if err != nil {
-		return false
-	}
-	return (fileInfo.Mode() & 0o100) > 0
-}
-
 func ensureExecutable(filename string) error {
 	fileInfo, err := os.Stat(filename)
 	if err != nil {
@@ -163,66 +186,3 @@ func ensureExecutable(filename string) error {
 	mode := fileInfo.Mode() | 0o100
 	return os.Chmod(filename, mode)
 }
-
-// CheckDelegateHooks checks the hooks scripts for the repo
-func CheckDelegateHooks(repoPath string) ([]string, error) {
-	hookNames, hookTpls, giteaHookTpls := getHookTemplates()
-
-	hookDir := filepath.Join(repoPath, "hooks")
-	results := make([]string, 0, 10)
-
-	for i, hookName := range hookNames {
-		oldHookPath := filepath.Join(hookDir, hookName)
-		newHookPath := filepath.Join(hookDir, hookName+".d", "gitea")
-
-		cont := false
-		isExist, err := util.IsExist(oldHookPath)
-		if err != nil {
-			results = append(results, fmt.Sprintf("unable to check if %s exists. Error: %v", oldHookPath, err))
-		}
-		if err == nil && !isExist {
-			results = append(results, fmt.Sprintf("old hook file %s does not exist", oldHookPath))
-			cont = true
-		}
-		isExist, err = util.IsExist(oldHookPath + ".d")
-		if err != nil {
-			results = append(results, fmt.Sprintf("unable to check if %s exists. Error: %v", oldHookPath+".d", err))
-		}
-		if err == nil && !isExist {
-			results = append(results, fmt.Sprintf("hooks directory %s does not exist", oldHookPath+".d"))
-			cont = true
-		}
-		isExist, err = util.IsExist(newHookPath)
-		if err != nil {
-			results = append(results, fmt.Sprintf("unable to check if %s exists. Error: %v", newHookPath, err))
-		}
-		if err == nil && !isExist {
-			results = append(results, fmt.Sprintf("new hook file %s does not exist", newHookPath))
-			cont = true
-		}
-		if cont {
-			continue
-		}
-		contents, err := os.ReadFile(oldHookPath)
-		if err != nil {
-			return results, err
-		}
-		if string(contents) != hookTpls[i] {
-			results = append(results, fmt.Sprintf("old hook file %s is out of date", oldHookPath))
-		}
-		if !checkExecutable(oldHookPath) {
-			results = append(results, fmt.Sprintf("old hook file %s is not executable", oldHookPath))
-		}
-		contents, err = os.ReadFile(newHookPath)
-		if err != nil {
-			return results, err
-		}
-		if string(contents) != giteaHookTpls[i] {
-			results = append(results, fmt.Sprintf("new hook file %s is out of date", newHookPath))
-		}
-		if !checkExecutable(newHookPath) {
-			results = append(results, fmt.Sprintf("new hook file %s is not executable", newHookPath))
-		}
-	}
-	return results, nil
-}
diff --git a/modules/git/repo_blame.go b/modules/git/repo_blame.go
index 50f4c572d5..d760898ac6 100644
--- a/modules/git/repo_blame.go
+++ b/modules/git/repo_blame.go
@@ -65,3 +65,97 @@ func (repo *Repository) LineBlame(revision, file string, line uint64) (*Commit,
 
 	return commit, originalLineNo, nil
 }
+
+type ReverseLineBlame struct {
+	CommitID   string
+	LineNumber uint64
+	FilePath   string
+}
+
+// Reverses the effect of [LineBlame]. If a file was modified at originalLine number in originalRevision,
+// ReverseLineBlame will identify the last commit up-to-and-including currentRevision where that line exists, including
+// its new path and line number. If the returned commit is not the same as currentRevision, then it indicates that
+// content can no longer be located in currentRevision, and the returned commit is the last commit that had it.
+func (repo *Repository) ReverseLineBlame(originalRevision, file string, originalLine uint64, currentRevision string) (*ReverseLineBlame, error) {
+	if originalRevision == currentRevision {
+		// Would cause an error to run the reverse, "fatal: More than one commit to dig up from, (N) and (N)"
+		return &ReverseLineBlame{
+			CommitID:   originalRevision,
+			LineNumber: originalLine,
+			FilePath:   file,
+		}, nil
+	}
+
+	res, _, gitErr := NewCommand(repo.Ctx, "blame").
+		AddOptionValues("--reverse").
+		AddDynamicArguments(fmt.Sprintf("%s..%s", originalRevision, currentRevision)).
+		AddOptionFormat("-L %d,%d", originalLine, originalLine).
+		AddOptionValues("-p").
+		AddDashesAndList(file).RunStdString(&RunOpts{Dir: repo.Path})
+	if gitErr != nil {
+		return nil, gitErr
+	}
+
+	// Example output:
+	//
+	// 74be0e8aa338d1374ab7ca0a25a4f594955a69c2 16 9 1
+	// author FirstName LastName
+	// author-mail <author@example.org>
+	// author-time 1775492007
+	// author-tz -0600
+	// committer FirstName LastName
+	// committer-mail <author@example.org>
+	// committer-time 1775492007
+	// committer-tz -0600
+	// summary restore file-in-base to orig, now not present in diff
+	// filename README.md
+	//
+	// Header (https://git-scm.com/docs/git-blame#_the_porcelain_format):
+	// - 40-byte SHA-1 of the commit the line is attributed to;
+	// - the line number of the line in the original file; [note: opposite in reverse]
+	// - the line number of the line in the final file; [note: opposite in reverse]
+	// - on a line that starts a group of lines from a different commit than the previous one, the number of lines in
+	//   this group. On subsequent lines this field is absent.
+
+	lines := strings.Split(res, "\n")
+
+	header := lines[0]
+	headerValues := strings.Split(header, " ")
+	if len(headerValues) < 2 {
+		return nil, fmt.Errorf("failed to parse blame --reverse header: %q", header)
+	}
+
+	objectFormat, err := repo.GetObjectFormat()
+	if err != nil {
+		return nil, err
+	}
+	objectIDLen := objectFormat.FullLength()
+	objectID := headerValues[0]
+	if len(objectID) != objectIDLen {
+		return nil, fmt.Errorf("output of blame is invalid, cannot contain commit ID: %s", objectID)
+	}
+	commit, err := repo.GetCommit(objectID)
+	if err != nil {
+		return nil, fmt.Errorf("GetCommit: %w", err)
+	}
+
+	currentLineStr := headerValues[1]
+	currentLineNo, err := strconv.ParseUint(currentLineStr, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("strconv.ParseUint: %w", err)
+	}
+
+	var filename string
+	for _, otherLine := range lines {
+		if strings.HasPrefix(otherLine, "filename ") {
+			filename = otherLine[len("filename "):]
+			break
+		}
+	}
+
+	return &ReverseLineBlame{
+		CommitID:   commit.ID.String(),
+		LineNumber: currentLineNo,
+		FilePath:   filename,
+	}, nil
+}
diff --git a/modules/git/repo_blame_test.go b/modules/git/repo_blame_test.go
index 4ddd5d9c3f..5803d082f0 100644
--- a/modules/git/repo_blame_test.go
+++ b/modules/git/repo_blame_test.go
@@ -89,11 +89,23 @@ func TestLineBlame(t *testing.T) {
 			assert.Equal(t, firstCommit, commit.ID.String())
 			assert.EqualValues(t, 1, lineno)
 
+			rev, err := gitRepo.ReverseLineBlame(commit.ID.String(), "ANSWER", lineno, secondCommit)
+			require.NoError(t, err)
+			assert.Equal(t, secondCommit, rev.CommitID)
+			assert.Equal(t, "ANSWER", rev.FilePath)
+			assert.EqualValues(t, 10, rev.LineNumber)
+
 			for i := range uint64(9) {
 				commit, lineno, err = gitRepo.LineBlame("HEAD", "ANSWER", i+1)
 				require.NoError(t, err)
 				assert.Equal(t, secondCommit, commit.ID.String())
 				assert.Equal(t, i+1, lineno)
+
+				rev, err := gitRepo.ReverseLineBlame(commit.ID.String(), "ANSWER", lineno, secondCommit)
+				require.NoError(t, err)
+				assert.Equal(t, secondCommit, rev.CommitID)
+				assert.Equal(t, "ANSWER", rev.FilePath)
+				assert.Equal(t, i+1, rev.LineNumber)
 			}
 		}
 
@@ -108,3 +120,66 @@ func TestLineBlame(t *testing.T) {
 		})
 	})
 }
+
+func TestReverseLineBlame(t *testing.T) {
+	t.Run("single commit", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		require.NoError(t, InitRepository(t.Context(), tmpDir, false, Sha1ObjectFormat.Name()))
+
+		gitRepo, err := OpenRepository(t.Context(), tmpDir)
+		require.NoError(t, err)
+		defer gitRepo.Close()
+
+		require.NoError(t, os.WriteFile(path.Join(tmpDir, "file1.md"), []byte("abba\n"), 0o666))
+		require.NoError(t, AddChanges(tmpDir, true))
+		require.NoError(t, CommitChanges(tmpDir, CommitChangesOptions{Message: "abba spelt backwards"}))
+
+		commit, err := gitRepo.GetRefCommitID("HEAD")
+		require.NoError(t, err)
+
+		blameCommit, lineno, err := gitRepo.LineBlame("HEAD", "file1.md", 1)
+		require.NoError(t, err)
+		assert.Equal(t, commit, blameCommit.ID.String())
+		assert.EqualValues(t, 1, lineno)
+
+		rev, err := gitRepo.ReverseLineBlame(commit, "file1.md", lineno, commit)
+		require.NoError(t, err)
+		assert.Equal(t, commit, rev.CommitID)
+		assert.Equal(t, "file1.md", rev.FilePath)
+		assert.EqualValues(t, 1, rev.LineNumber)
+	})
+
+	t.Run("move file", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		require.NoError(t, InitRepository(t.Context(), tmpDir, false, Sha1ObjectFormat.Name()))
+
+		gitRepo, err := OpenRepository(t.Context(), tmpDir)
+		require.NoError(t, err)
+		defer gitRepo.Close()
+
+		require.NoError(t, os.WriteFile(path.Join(tmpDir, "file1.md"), []byte("abba\n"), 0o666))
+		require.NoError(t, AddChanges(tmpDir, true))
+		require.NoError(t, CommitChanges(tmpDir, CommitChangesOptions{Message: "abba spelt backwards"}))
+
+		firstCommit, err := gitRepo.GetRefCommitID("HEAD")
+		require.NoError(t, err)
+
+		require.NoError(t, os.Rename(path.Join(tmpDir, "file1.md"), path.Join(tmpDir, "file2.md")))
+		require.NoError(t, AddChanges(tmpDir, true))
+		require.NoError(t, CommitChanges(tmpDir, CommitChangesOptions{Message: "move file"}))
+
+		secondCommit, err := gitRepo.GetRefCommitID("HEAD")
+		require.NoError(t, err)
+
+		blameCommit, lineno, err := gitRepo.LineBlame("HEAD", "file2.md", 1)
+		require.NoError(t, err)
+		assert.Equal(t, firstCommit, blameCommit.ID.String())
+		assert.EqualValues(t, 1, lineno)
+
+		rev, err := gitRepo.ReverseLineBlame(firstCommit, "file1.md", lineno, secondCommit)
+		require.NoError(t, err)
+		assert.Equal(t, secondCommit, rev.CommitID)
+		assert.Equal(t, "file2.md", rev.FilePath)
+		assert.EqualValues(t, 1, rev.LineNumber)
+	})
+}
diff --git a/modules/git/repo_commit.go b/modules/git/repo_commit.go
index 0ebdb0f8a0..99ffac7afb 100644
--- a/modules/git/repo_commit.go
+++ b/modules/git/repo_commit.go
@@ -217,10 +217,15 @@ type CommitsByFileAndRangeOptions struct {
 	File     string
 	Not      string
 	Page     int
+	PageSize int
 }
 
 // CommitsByFileAndRange return the commits according revision file and the page
 func (repo *Repository) CommitsByFileAndRange(opts CommitsByFileAndRangeOptions) ([]*Commit, error) {
+	if opts.PageSize <= 0 {
+		opts.PageSize = setting.Git.CommitsRangeSize
+	}
+
 	skip := (opts.Page - 1) * setting.Git.CommitsRangeSize
 
 	stdoutReader, stdoutWriter := io.Pipe()
@@ -231,7 +236,7 @@ func (repo *Repository) CommitsByFileAndRange(opts CommitsByFileAndRangeOptions)
 	go func() {
 		stderr := strings.Builder{}
 		gitCmd := NewCommand(repo.Ctx, "rev-list").
-			AddOptionFormat("--max-count=%d", setting.Git.CommitsRangeSize).
+			AddOptionFormat("--max-count=%d", opts.PageSize).
 			AddOptionFormat("--skip=%d", skip)
 		gitCmd.AddDynamicArguments(opts.Revision)
 
diff --git a/modules/git/repo_commit_test.go b/modules/git/repo_commit_test.go
index 99cde92300..401848a975 100644
--- a/modules/git/repo_commit_test.go
+++ b/modules/git/repo_commit_test.go
@@ -200,6 +200,44 @@ func TestCommitsByFileAndRange(t *testing.T) {
 	}
 }
 
+func TestCommitsByFileAndRangeWithPageSize(t *testing.T) {
+	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
+	bareRepo1, err := openRepositoryWithDefaultContext(bareRepo1Path)
+	require.NoError(t, err)
+	defer bareRepo1.Close()
+	defer test.MockVariableValue(&setting.Git.CommitsRangeSize, 2)()
+
+	testCases := []struct {
+		File                string
+		Page                int
+		PageSize            int
+		ExpectedCommitCount int
+	}{
+		{"file1.txt", 1, 1, 1},
+		{"file2.txt", 1, 1, 1},
+		{"file*.txt", 1, 2, 2},
+		{"file*.txt", 1, 1, 1},
+		{"foo", 1, 2, 2},
+		{"foo", 1, 1, 1},
+		{"foo", 2, 1, 1},
+		{"foo", 3, 0, 0},
+		{"foo", 3, 2, 0},
+		{"f*", 1, 2, 2},
+		{"f*", 2, 2, 2},
+		{"f*", 3, 1, 1},
+	}
+	for _, testCase := range testCases {
+		commits, err := bareRepo1.CommitsByFileAndRange(CommitsByFileAndRangeOptions{
+			Revision: "master",
+			File:     testCase.File,
+			Page:     testCase.Page,
+			PageSize: testCase.PageSize,
+		})
+		require.NoError(t, err)
+		assert.Len(t, commits, testCase.ExpectedCommitCount, "file: '%s', page: %d", testCase.File, testCase.Page)
+	}
+}
+
 func TestGetCommitsFromIDs(t *testing.T) {
 	bareRepo1, err := openRepositoryWithDefaultContext(filepath.Join(testReposDir, "repo1_bare"))
 	require.NoError(t, err)
diff --git a/modules/git/tag.go b/modules/git/tag.go
index edbe54b853..3af062a51a 100644
--- a/modules/git/tag.go
+++ b/modules/git/tag.go
@@ -50,20 +50,20 @@ l:
 		switch {
 		case eol > 0:
 			line := data[nextline : nextline+eol]
-			spacepos := bytes.IndexByte(line, ' ')
-			reftype := line[:spacepos]
+			before, after, _ := bytes.Cut(line, []byte{' '})
+			reftype := before
 			switch string(reftype) {
 			case "object":
-				id, err := NewIDFromString(string(line[spacepos+1:]))
+				id, err := NewIDFromString(string(after))
 				if err != nil {
 					return nil, err
 				}
 				tag.Object = id
 			case "type":
 				// A commit can have one or more parents
-				tag.Type = string(line[spacepos+1:])
+				tag.Type = string(after)
 			case "tagger":
-				tag.Tagger = parseSignatureFromCommitLine(util.UnsafeBytesToString(line[spacepos+1:]))
+				tag.Tagger = parseSignatureFromCommitLine(util.UnsafeBytesToString(after))
 			}
 			nextline += eol + 1
 		case eol == 0:
diff --git a/modules/git/tree_entry.go b/modules/git/tree_entry.go
index 5e3bb8ac21..0b3564178b 100644
--- a/modules/git/tree_entry.go
+++ b/modules/git/tree_entry.go
@@ -5,6 +5,7 @@
 package git
 
 import (
+	"fmt"
 	"io"
 	"sort"
 	"strings"
@@ -136,11 +137,11 @@ func (te *TreeEntry) LinkTarget() (string, error) {
 }
 
 // FollowLink returns the entry pointed to by a symlink
-func (te *TreeEntry) FollowLink() (*TreeEntry, string, error) {
+func (te *TreeEntry) FollowLink() (*TreeEntry, error) {
 	// read the link
 	lnk, err := te.LinkTarget()
 	if err != nil {
-		return nil, "", err
+		return nil, err
 	}
 
 	t := te.ptree
@@ -151,35 +152,33 @@ func (te *TreeEntry) FollowLink() (*TreeEntry, string, error) {
 	}
 
 	if t == nil {
-		return nil, "", ErrBadLink{te.Name(), "points outside of repo"}
+		return nil, ErrBadLink{te.Name(), "points outside of repo"}
 	}
 
 	target, err := t.GetTreeEntryByPath(lnk)
 	if err != nil {
 		if IsErrNotExist(err) {
-			return nil, "", ErrBadLink{te.Name(), "broken link"}
+			return nil, ErrBadLink{te.Name(), "broken link"}
 		}
-		return nil, "", err
+		return nil, err
 	}
-	return target, lnk, nil
+	return target, nil
 }
 
 // FollowLinks returns the entry ultimately pointed to by a symlink
-func (te *TreeEntry) FollowLinks() (*TreeEntry, string, error) {
+func (te *TreeEntry) FollowLinks() (*TreeEntry, error) {
 	if !te.IsLink() {
-		return nil, "", ErrBadLink{te.Name(), "not a symlink"}
+		return nil, ErrBadLink{te.Name(), "not a symlink"}
 	}
 	entry := te
-	entryLink := ""
 	for range 999 {
 		if entry.IsLink() {
-			next, link, err := entry.FollowLink()
-			entryLink = link
+			next, err := entry.FollowLink()
 			if err != nil {
-				return nil, "", err
+				return nil, err
 			}
 			if next.ID == entry.ID {
-				return nil, "", ErrBadLink{
+				return nil, ErrBadLink{
 					entry.Name(),
 					"recursive link",
 				}
@@ -190,12 +189,12 @@ func (te *TreeEntry) FollowLinks() (*TreeEntry, string, error) {
 		}
 	}
 	if entry.IsLink() {
-		return nil, "", ErrBadLink{
+		return nil, ErrBadLink{
 			te.Name(),
 			"too many levels of symbolic links",
 		}
 	}
-	return entry, entryLink, nil
+	return entry, nil
 }
 
 // returns the Tree pointed to by this TreeEntry, or nil if this is not a tree
@@ -208,6 +207,42 @@ func (te *TreeEntry) Tree() *Tree {
 	return t
 }
 
+// returns the calulcated path within the tree of this TreeEntry, or an error if it can be determined
+func (te *TreeEntry) Path() (string, error) {
+	targetPath := te.Name()
+	parentTree := te.ptree
+	if parentTree == nil {
+		return "", fmt.Errorf("couldn't find the parent tree of the entry")
+	}
+
+	prevID := parentTree.ID
+	parentTree = parentTree.ptree
+	for parentTree != nil {
+		entries, err := parentTree.ListEntries()
+		if err != nil {
+			return "", fmt.Errorf("couldn't list entries: %v", err)
+		}
+
+		var matchingEntry *TreeEntry
+		for _, entry := range entries {
+			if entry.ID == prevID {
+				matchingEntry = entry
+				break
+			}
+		}
+
+		if matchingEntry == nil {
+			return "", fmt.Errorf("this shouldn't happen: couldn't find entry (ID: %s) in tree (ID: %s)", prevID, parentTree.ID)
+		}
+
+		targetPath = matchingEntry.name + "/" + targetPath
+		prevID = parentTree.ID
+		parentTree = parentTree.ptree
+	}
+
+	return targetPath, nil
+}
+
 // GetSubJumpablePathName return the full path of subdirectory jumpable ( contains only one directory )
 func (te *TreeEntry) GetSubJumpablePathName() string {
 	if te.IsSubmodule() || !te.IsDir() {
diff --git a/modules/git/tree_entry_test.go b/modules/git/tree_entry_test.go
new file mode 100644
index 0000000000..325d3686f0
--- /dev/null
+++ b/modules/git/tree_entry_test.go
@@ -0,0 +1,46 @@
+// Copyright 2015 The Gogs Authors. All rights reserved.
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTreeEntry_Path(t *testing.T) {
+	repo, err := openRepositoryWithDefaultContext(filepath.Join(testReposDir, "templates_repo"))
+	require.NoError(t, err)
+	defer repo.Close()
+
+	tests := []struct {
+		name string // description of this test case
+		path string
+	}{
+		{
+			name: "Top level dir",
+			path: ".forgejo",
+		},
+		{
+			name: "File in subdir",
+			path: ".forgejo/default_merge_message/MERGE_TEMPLATE.md",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tree, err := repo.GetTree("HEAD^{tree}")
+			require.NoError(t, err)
+
+			te, err := tree.GetTreeEntryByPath(tt.path)
+			require.NoError(t, err)
+
+			got, gotErr := te.Path()
+			require.NoError(t, gotErr, "Path() failed: %v", gotErr)
+			assert.Equal(t, tt.path, got, "Path() = %v, want %v", got, tt.path)
+		})
+	}
+}
diff --git a/modules/jwtx/signingkey.go b/modules/jwtx/signingkey.go
index 2aef70440d..f82f694d19 100644
--- a/modules/jwtx/signingkey.go
+++ b/modules/jwtx/signingkey.go
@@ -25,6 +25,20 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 )
 
+// The ...KeyCfg types are only used for handover from setting to signingkey
+// see comment in setting/security.go
+
+type SigningKeyCfg struct {
+	Algorithm      string
+	SecretBytes    *[]byte
+	PrivateKeyPath *string
+}
+
+type KeyCfg struct {
+	Signing *SigningKeyCfg
+	// more later
+}
+
 // ErrInvalidAlgorithmType represents an invalid algorithm error.
 type ErrInvalidAlgorithmType struct {
 	Algorithm string
@@ -239,8 +253,8 @@ func (key ecdsaSigningKey) ToJWK() (map[string]string, error) {
 		"alg": key.SigningMethod().Alg(),
 		"kid": key.id,
 		"crv": pubKey.Params().Name,
-		"x":   base64.RawURLEncoding.EncodeToString(pubKey.X.Bytes()),
-		"y":   base64.RawURLEncoding.EncodeToString(pubKey.Y.Bytes()),
+		"x":   base64.RawURLEncoding.EncodeToString(pubKey.X.Bytes()), //nolint:staticcheck // no easy replacement. JWTX specification mandates marshalling to x, even if unsafe.
+		"y":   base64.RawURLEncoding.EncodeToString(pubKey.Y.Bytes()), //nolint:staticcheck // no easy replacement. JWTX specification mandates marshalling to y, even if unsafe.
 	}, nil
 }
 
@@ -399,50 +413,39 @@ func loadOrCreateAsymmetricKey(keyPath, algorithm string) (any, error) {
 	return loadAsymmetricKey(keyPath)
 }
 
-// InitSigningKey creates a signing key from settings or creates a random key.
-func InitSigningKey(getGeneralTokenSigningSecret func() []byte, keyPath, algorithm string) (SigningKey, error) {
+// InitSigningKey creates a signing key from SigningKeyCfg
+// cfgP is set to nil to mark that is has been processed
+func InitSigningKey(cfgP **SigningKeyCfg) (SigningKey, error) {
+	cfg := *cfgP
+	*cfgP = nil
 	var err error
 	var key SigningKey
 
-	key, err = InitSymmetricSigningKey(getGeneralTokenSigningSecret, algorithm)
-	if err != nil {
-		key, err = InitAsymmetricSigningKey(keyPath, algorithm)
-		if err != nil {
-			return nil, err
-		}
+	if IsValidSymmetricAlgorithm(cfg.Algorithm) {
+		key, err = CreateSigningKey(cfg.Algorithm, *cfg.SecretBytes)
+	} else if IsValidAsymmetricAlgorithm(cfg.Algorithm) {
+		key, err = InitAsymmetricSigningKey(*cfg.PrivateKeyPath, cfg.Algorithm)
+	} else {
+		// should never happen, setting.loadSigningKeyCfg() ensures
+		err = ErrInvalidAlgorithmType{Algorithm: cfg.Algorithm}
 	}
 
-	return key, nil
+	return key, err
 }
 
+var (
+	ValidSymmetricAlgorighms  = []string{"HS256", "HS384", "HS512"}
+	ValidAsymmetricAlgorithms = []string{"RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"}
+)
+
 // IsValidSymmetricAlgorithm checks if the passed in algorithm is a supported symettric algorithm.
 func IsValidSymmetricAlgorithm(algorithm string) bool {
-	validAlgs := []string{"HS256", "HS384", "HS512"}
-
-	return slices.Contains(validAlgs, algorithm)
-}
-
-// InitSymmetricSigningKey creates a symmetric signing key from settings.
-func InitSymmetricSigningKey(getGeneralTokenSigningSecret func() []byte, algorithm string) (SigningKey, error) {
-	var err error
-
-	if !IsValidSymmetricAlgorithm(algorithm) {
-		return nil, fmt.Errorf("invalid algorithm: %s", algorithm)
-	}
-
-	signingKey, err := CreateSigningKey(algorithm, getGeneralTokenSigningSecret())
-	if err != nil {
-		return nil, err
-	}
-
-	return signingKey, nil
+	return slices.Contains(ValidSymmetricAlgorighms, algorithm)
 }
 
 // IsValidAsymmetricAlgorithm checks if the passed in algorithm is a supported asymmetric algorithm.
 func IsValidAsymmetricAlgorithm(algorithm string) bool {
-	validAlgs := []string{"RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"}
-
-	return slices.Contains(validAlgs, algorithm)
+	return slices.Contains(ValidAsymmetricAlgorithms, algorithm)
 }
 
 // InitAsymmetricSigningKey creates an asymmetric signing key from settings or creates a random key.
@@ -466,3 +469,97 @@ func InitAsymmetricSigningKey(keyPath, algorithm string) (SigningKey, error) {
 
 	return signingKey, nil
 }
+
+func requiredJWKStr(jwk map[string]any, key string) (string, error) {
+	vAny, ok := jwk[key]
+	if !ok {
+		return "", fmt.Errorf("JWK missing required field %q", key)
+	}
+	vStr, ok := vAny.(string)
+	if !ok {
+		return "", fmt.Errorf("JWK field %q must be string, but was %T", key, vAny)
+	}
+	return vStr, nil
+}
+
+// Reconstructs public key from a JWKS entry (such as those produced by [SigningKey.ToJWK]), parsing the JWK output and
+// returning a key object.  The key object produced must be usable for [jwt.SigningMethod] interface's [Verify] method,
+// for the related signing method -- an [rsa.PublicKey] object, an [ed25519.PublicKey] object, or [ecdsa.PublicKey]
+// object, with the currently supported asymmetric algorithms.
+func ParseJWKToPublicKey(jwk map[string]any) (any, error) {
+	kty := jwk["kty"]
+
+	switch kty {
+	case "RSA":
+		eStr, err := requiredJWKStr(jwk, "e")
+		if err != nil {
+			return nil, err
+		}
+		nStr, err := requiredJWKStr(jwk, "n")
+		if err != nil {
+			return nil, err
+		}
+		eBytes, err := base64.RawURLEncoding.DecodeString(eStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid RSA JWK 'e' field: %w", err)
+		}
+		nBytes, err := base64.RawURLEncoding.DecodeString(nStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid RSA JWK 'n' field: %w", err)
+		}
+		pubKey := &rsa.PublicKey{
+			E: int(new(big.Int).SetBytes(eBytes).Int64()),
+			N: new(big.Int).SetBytes(nBytes),
+		}
+		return pubKey, nil
+	case "OKP":
+		if jwk["crv"] != "Ed25519" {
+			return nil, fmt.Errorf("OKP curve %d is not supported; only Ed25519", jwk["crv"])
+		}
+		xStr, err := requiredJWKStr(jwk, "x")
+		if err != nil {
+			return nil, err
+		}
+		xBytes, err := base64.RawURLEncoding.DecodeString(xStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid EdDSA JWK 'x' field: %w", err)
+		}
+		return ed25519.PublicKey(xBytes), nil
+	case "EC":
+		xStr, err := requiredJWKStr(jwk, "x")
+		if err != nil {
+			return nil, err
+		}
+		yStr, err := requiredJWKStr(jwk, "y")
+		if err != nil {
+			return nil, err
+		}
+		var curve elliptic.Curve
+		switch jwk["crv"] {
+		case "P-256":
+			curve = elliptic.P256()
+		case "P-384":
+			curve = elliptic.P384()
+		case "P-521":
+			curve = elliptic.P521()
+		default:
+			return nil, fmt.Errorf("unsupported ECDSA curve in JWK: %s", jwk["crv"])
+		}
+		xBytes, err := base64.RawURLEncoding.DecodeString(xStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid ECDSA JWK 'x' field: %w", err)
+		}
+		yBytes, err := base64.RawURLEncoding.DecodeString(yStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid ECDSA JWK 'y' field: %w", err)
+		}
+		pubKey := &ecdsa.PublicKey{
+			Curve: curve,
+			X:     new(big.Int).SetBytes(xBytes),
+			Y:     new(big.Int).SetBytes(yBytes),
+		}
+		return pubKey, nil
+	default:
+		return nil, fmt.Errorf("unsupported key type in JWK: %s", kty)
+	}
+}
diff --git a/modules/jwtx/signingkey_test.go b/modules/jwtx/signingkey_test.go
index eb30473cad..96f6613b84 100644
--- a/modules/jwtx/signingkey_test.go
+++ b/modules/jwtx/signingkey_test.go
@@ -18,6 +18,36 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func testSignVerify(t *testing.T, signKey, verifyKey SigningKey) {
+	t.Helper()
+	// test sign and verify
+	claimsIn := jwt.RegisteredClaims{
+		Issuer: "abc",
+		ID:     "0815",
+	}
+	token, err := signKey.JWT(claimsIn)
+	require.NoError(t, err)
+	require.NotEmpty(t, token)
+
+	var claimsOut jwt.RegisteredClaims
+	parsed, err := jwt.ParseWithClaims(token, &claimsOut, func(valToken *jwt.Token) (any, error) {
+		assert.NotNil(t, valToken.Method)
+		assert.Equal(t, signKey.SigningMethod().Alg(), valToken.Method.Alg())
+		assert.Equal(t, verifyKey.SigningMethod().Alg(), valToken.Method.Alg())
+		kid, ok := valToken.Header["kid"]
+		assert.True(t, ok)
+		assert.NotNil(t, kid)
+
+		return verifyKey.VerifyKey(), nil
+	})
+	require.NoError(t, err)
+	assert.NotNil(t, parsed)
+	assert.Equal(t, claimsIn, claimsOut)
+	assert.Equal(t, &claimsIn, parsed.Claims)
+}
+
+// creates private key
+// loads it back from the file
 func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 	loadKey := func(t *testing.T, keyPath, algorithm string) any {
 		t.Helper()
@@ -35,6 +65,21 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 
 		return parsedKey
 	}
+	useKey := func(t *testing.T, keyPath, algorithm string) {
+		t.Helper()
+		// duplicates loadKey() to some extent, but uses SigningKey
+		cfg := &SigningKeyCfg{
+			Algorithm:      algorithm,
+			PrivateKeyPath: &keyPath,
+		}
+
+		key, err := InitSigningKey(&cfg)
+		require.NoError(t, err)
+		assert.NotNil(t, key)
+		assert.Nil(t, cfg)
+
+		testSignVerify(t, key, key)
+	}
 	t.Run("RSA-2048", func(t *testing.T) {
 		keyPath := filepath.Join(t.TempDir(), "jwt-rsa-2048.priv")
 		algorithm := "RS256"
@@ -43,6 +88,9 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 
 		rsaPrivateKey := parsedKey.(*rsa.PrivateKey)
 		assert.Equal(t, 2048, rsaPrivateKey.N.BitLen())
+		t.Run("Use", func(t *testing.T) {
+			useKey(t, keyPath, algorithm)
+		})
 
 		t.Run("Load key with differ specified algorithm", func(t *testing.T) {
 			algorithm = "EdDSA"
@@ -61,6 +109,9 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 
 		rsaPrivateKey := parsedKey.(*rsa.PrivateKey)
 		assert.Equal(t, 3072, rsaPrivateKey.N.BitLen())
+		t.Run("Use", func(t *testing.T) {
+			useKey(t, keyPath, algorithm)
+		})
 	})
 
 	t.Run("RSA-4096", func(t *testing.T) {
@@ -71,6 +122,9 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 
 		rsaPrivateKey := parsedKey.(*rsa.PrivateKey)
 		assert.Equal(t, 4096, rsaPrivateKey.N.BitLen())
+		t.Run("Use", func(t *testing.T) {
+			useKey(t, keyPath, algorithm)
+		})
 	})
 
 	t.Run("ECDSA-256", func(t *testing.T) {
@@ -81,6 +135,9 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 
 		ecdsaPrivateKey := parsedKey.(*ecdsa.PrivateKey)
 		assert.Equal(t, 256, ecdsaPrivateKey.Params().BitSize)
+		t.Run("Use", func(t *testing.T) {
+			useKey(t, keyPath, algorithm)
+		})
 	})
 
 	t.Run("ECDSA-384", func(t *testing.T) {
@@ -91,6 +148,9 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 
 		ecdsaPrivateKey := parsedKey.(*ecdsa.PrivateKey)
 		assert.Equal(t, 384, ecdsaPrivateKey.Params().BitSize)
+		t.Run("Use", func(t *testing.T) {
+			useKey(t, keyPath, algorithm)
+		})
 	})
 
 	t.Run("ECDSA-512", func(t *testing.T) {
@@ -101,6 +161,9 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 
 		ecdsaPrivateKey := parsedKey.(*ecdsa.PrivateKey)
 		assert.Equal(t, 521, ecdsaPrivateKey.Params().BitSize)
+		t.Run("Use", func(t *testing.T) {
+			useKey(t, keyPath, algorithm)
+		})
 	})
 
 	t.Run("EdDSA", func(t *testing.T) {
@@ -110,47 +173,12 @@ func TestLoadOrCreateAsymmetricKey(t *testing.T) {
 		parsedKey := loadKey(t, keyPath, algorithm)
 
 		assert.NotNil(t, parsedKey.(ed25519.PrivateKey))
+		t.Run("Use", func(t *testing.T) {
+			useKey(t, keyPath, algorithm)
+		})
 	})
 }
 
-type testClaims struct {
-	Foo string `json:"Foo"`
-	jwt.RegisteredClaims
-}
-
-func TestJWTHasKid(t *testing.T) {
-	keyPath := filepath.Join(t.TempDir(), "jwt-rsa-2048.priv")
-	algorithm := "RS256"
-	key, err := InitAsymmetricSigningKey(keyPath, algorithm)
-	require.NoError(t, err)
-
-	claimsIn := testClaims{
-		Foo:              "bar",
-		RegisteredClaims: jwt.RegisteredClaims{},
-	}
-	token, err := key.JWT(&claimsIn)
-	require.NoError(t, err)
-
-	var claimsOut testClaims
-	parsed, err := jwt.ParseWithClaims(token, &claimsOut, func(valToken *jwt.Token) (any, error) {
-		assert.NotNil(t, valToken.Method)
-		assert.Equal(t, key.SigningMethod().Alg(), valToken.Method.Alg())
-		kid, ok := valToken.Header["kid"]
-		assert.True(t, ok)
-		assert.NotNil(t, kid)
-
-		return key.VerifyKey(), nil
-	})
-	require.NoError(t, err)
-	assert.NotNil(t, parsed)
-	assert.Equal(t, "bar", parsed.Claims.(*testClaims).Foo)
-	assert.Equal(t, "bar", claimsOut.Foo)
-	// dup to keyFunc above
-	kid, ok := parsed.Header["kid"]
-	assert.True(t, ok)
-	assert.NotNil(t, kid)
-}
-
 func TestCannotCreatePrivateKey(t *testing.T) {
 	_, err := InitAsymmetricSigningKey("/dev/directory-does-not-exist-and-you-should-not-have-permission-to-create/privatekey.pem", "RS256")
 	require.Error(t, err)
diff --git a/modules/log/event_writer_buffer.go b/modules/log/event_writer_buffer.go
index 28857c2189..a7557618a8 100644
--- a/modules/log/event_writer_buffer.go
+++ b/modules/log/event_writer_buffer.go
@@ -5,18 +5,44 @@ package log
 
 import (
 	"bytes"
+	"sync"
 )
 
-type EventWriterBuffer struct {
-	*EventWriterBaseImpl
-	Buffer *bytes.Buffer
+type EventWriterBuffer interface {
+	EventWriter
+	GetString() string
 }
 
-var _ EventWriter = (*EventWriterBuffer)(nil)
+type eventWriterBuffer struct {
+	*EventWriterBaseImpl
+	buffer *bytes.Buffer
+	mu     sync.RWMutex
+}
 
-func NewEventWriterBuffer(name string, mode WriterMode) *EventWriterBuffer {
-	w := &EventWriterBuffer{EventWriterBaseImpl: NewEventWriterBase(name, "buffer", mode)}
-	w.Buffer = new(bytes.Buffer)
-	w.OutputWriteCloser = nopCloser{w.Buffer}
+var _ EventWriterBuffer = (*eventWriterBuffer)(nil)
+
+func (*eventWriterBuffer) Close() error {
+	return nil
+}
+
+func (o *eventWriterBuffer) Write(p []byte) (n int, err error) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	return o.buffer.Write(p)
+}
+
+func (o *eventWriterBuffer) GetString() string {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	b := o.buffer.Bytes()
+	s := make([]byte, len(b))
+	copy(s, b)
+	return string(s)
+}
+
+func NewEventWriterBuffer(name string, mode WriterMode) EventWriter {
+	w := &eventWriterBuffer{EventWriterBaseImpl: NewEventWriterBase(name, "buffer", mode)}
+	w.buffer = new(bytes.Buffer)
+	w.OutputWriteCloser = w
 	return w
 }
diff --git a/modules/log/event_writer_buffer_test.go b/modules/log/event_writer_buffer_test.go
index d1e37c3673..ac0759ad0b 100644
--- a/modules/log/event_writer_buffer_test.go
+++ b/modules/log/event_writer_buffer_test.go
@@ -29,7 +29,7 @@ func TestBufferLogger(t *testing.T) {
 		MsgSimpleText: expected,
 	})
 	logger.Close()
-	assert.Contains(t, bufferWriter.Buffer.String(), expected)
+	assert.Contains(t, bufferWriter.(log.EventWriterBuffer).GetString(), expected)
 }
 
 func TestBufferLoggerWithExclusion(t *testing.T) {
@@ -41,7 +41,7 @@ func TestBufferLoggerWithExclusion(t *testing.T) {
 		Level:     level,
 		Prefix:    prefix,
 		Exclusion: message,
-	})
+	}).(log.EventWriterBuffer)
 
 	logger := log.NewLoggerWithWriters(t.Context(), "test", bufferWriter)
 
@@ -50,7 +50,7 @@ func TestBufferLoggerWithExclusion(t *testing.T) {
 		MsgSimpleText: message,
 	})
 	logger.Close()
-	assert.NotContains(t, bufferWriter.Buffer.String(), message)
+	assert.NotContains(t, bufferWriter.GetString(), message)
 }
 
 func TestBufferLoggerWithExpressionAndExclusion(t *testing.T) {
@@ -64,7 +64,7 @@ func TestBufferLoggerWithExpressionAndExclusion(t *testing.T) {
 		Prefix:     prefix,
 		Expression: expression,
 		Exclusion:  exclusion,
-	})
+	}).(log.EventWriterBuffer)
 
 	logger := log.NewLoggerWithWriters(t.Context(), "test", bufferWriter)
 
@@ -74,6 +74,6 @@ func TestBufferLoggerWithExpressionAndExclusion(t *testing.T) {
 	logger.SendLogEvent(&log.Event{Level: log.INFO, MsgSimpleText: "none"})
 	logger.Close()
 
-	assert.Contains(t, bufferWriter.Buffer.String(), "foo expression")
-	assert.NotContains(t, bufferWriter.Buffer.String(), "bar")
+	assert.Contains(t, bufferWriter.GetString(), "foo expression")
+	assert.NotContains(t, bufferWriter.GetString(), "bar")
 }
diff --git a/modules/log/logger_impl_test.go b/modules/log/logger_impl_test.go
index 59276a83f4..1d77ae0c25 100644
--- a/modules/log/logger_impl_test.go
+++ b/modules/log/logger_impl_test.go
@@ -23,5 +23,5 @@ func TestLog(t *testing.T) {
 	testGeneric(logger, "I'm the generic value!")
 	logger.Close()
 
-	assert.Contains(t, bufferWriter.Buffer.String(), ".../logger_impl_test.go:13:testGeneric() [I] Just testing the logging of a generic function I'm the generic value!")
+	assert.Contains(t, bufferWriter.(EventWriterBuffer).GetString(), ".../logger_impl_test.go:13:testGeneric() [I] Just testing the logging of a generic function I'm the generic value!")
 }
diff --git a/modules/markup/html.go b/modules/markup/html.go
index 77b5dc8029..5bca4c4596 100644
--- a/modules/markup/html.go
+++ b/modules/markup/html.go
@@ -694,8 +694,8 @@ func shortLinkProcessor(ctx *RenderContext, node *html.Node) {
 			} else {
 				// There is an equal; optional argument.
 
-				sep := strings.IndexByte(v, '=')
-				key, val := v[:sep], html.UnescapeString(v[sep+1:])
+				before, after, _ := strings.Cut(v, "=")
+				key, val := before, html.UnescapeString(after)
 
 				// When parsing HTML, x/net/html will change all quotes which are
 				// not used for syntax into UTF-8 quotes. So checking val[0] won't
diff --git a/modules/markup/markdown/goldmark.go b/modules/markup/markdown/goldmark.go
index 1ea3375ab5..aec710fd46 100644
--- a/modules/markup/markdown/goldmark.go
+++ b/modules/markup/markdown/goldmark.go
@@ -90,6 +90,8 @@ func (g *ASTTransformer) Transform(node *ast.Document, reader text.Reader, pc pa
 			}
 		case *ast.RawHTML:
 			g.transformRawHTML(ctx, v, reader)
+		case *ast.FencedCodeBlock:
+			g.transformCodeblockLanguage(v, reader)
 		}
 		return ast.WalkContinue, nil
 	})
diff --git a/modules/markup/markdown/markdown_test.go b/modules/markup/markdown/markdown_test.go
index 61ded3cedc..3aee7a372d 100644
--- a/modules/markup/markdown/markdown_test.go
+++ b/modules/markup/markdown/markdown_test.go
@@ -1488,3 +1488,61 @@ func TestCallout(t *testing.T) {
 <p>Bad stuff is brewing here</p>
 </blockquote>`)
 }
+
+func TestCodeblockLanguageTransformation(t *testing.T) {
+	test := func(input, expected string) {
+		buffer, err := markdown.RenderString(&markup.RenderContext{Ctx: git.DefaultContext}, input)
+		require.NoError(t, err)
+		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(string(buffer)))
+	}
+
+	// No transformation
+	test(
+		"```rust\n"+
+			"fn main() {}\n"+
+			"```",
+		`<pre class="code-block"><code class="chroma language-rust display"><span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{}</span><span class="w">
+</span></code></pre>`)
+
+	// Comma stripped
+	test(
+		"```rust,ignore\n"+
+			"fn main() {}\n"+
+			"```",
+		`<pre class="code-block"><code class="chroma language-rust display"><span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{}</span><span class="w">
+</span></code></pre>`)
+
+	// Pandoc stripping
+	// https://pandoc.org/MANUAL.html#extension-fenced_code_attributes
+	test(
+		"```haskell {.numberLines}\n"+
+			"qsort []     = []\n"+
+			"qsort (x:xs) = qsort (filter (< x) xs) ++ [x] ++\n"+
+			"               qsort (filter (>= x) xs)\n"+
+			"```",
+		`<pre class="code-block"><code class="chroma language-haskell display"><span class="nf">qsort</span> <span class="kt">[]</span>     <span class="ow">=</span> <span class="kt">[]</span>
+<span class="nf">qsort</span> <span class="p">(</span><span class="n">x</span><span class="kt">:</span><span class="n">xs</span><span class="p">)</span> <span class="ow">=</span> <span class="n">qsort</span> <span class="p">(</span><span class="n">filter</span> <span class="p">(</span><span class="o">&lt;</span> <span class="n">x</span><span class="p">)</span> <span class="n">xs</span><span class="p">)</span> <span class="o">++</span> <span class="p">[</span><span class="n">x</span><span class="p">]</span> <span class="o">++</span>
+               <span class="n">qsort</span> <span class="p">(</span><span class="n">filter</span> <span class="p">(</span><span class="o">&gt;=</span> <span class="n">x</span><span class="p">)</span> <span class="n">xs</span><span class="p">)</span>
+</code></pre>`)
+
+	// Pandoc language extracting
+	// https://pandoc.org/MANUAL.html#extension-fenced_code_attributes
+	test(
+		"```   { #mycode .numberLines .haskell startFrom=\"100\" }   \n"+
+			"qsort []     = []\n"+
+			"qsort (x:xs) = qsort (filter (< x) xs) ++ [x] ++\n"+
+			"               qsort (filter (>= x) xs)\n"+
+			"```",
+		`<pre class="code-block"><code class="chroma language-haskell display"><span class="nf">qsort</span> <span class="kt">[]</span>     <span class="ow">=</span> <span class="kt">[]</span>
+<span class="nf">qsort</span> <span class="p">(</span><span class="n">x</span><span class="kt">:</span><span class="n">xs</span><span class="p">)</span> <span class="ow">=</span> <span class="n">qsort</span> <span class="p">(</span><span class="n">filter</span> <span class="p">(</span><span class="o">&lt;</span> <span class="n">x</span><span class="p">)</span> <span class="n">xs</span><span class="p">)</span> <span class="o">++</span> <span class="p">[</span><span class="n">x</span><span class="p">]</span> <span class="o">++</span>
+               <span class="n">qsort</span> <span class="p">(</span><span class="n">filter</span> <span class="p">(</span><span class="o">&gt;=</span> <span class="n">x</span><span class="p">)</span> <span class="n">xs</span><span class="p">)</span>
+</code></pre>`)
+
+	// No language identifier
+	test(
+		"```\n"+
+			"fn main() {}\n"+
+			"```",
+		`<pre class="code-block"><code class="chroma language-text display">fn main() {}
+</code></pre>`)
+}
diff --git a/modules/markup/markdown/transform_codeblock_lang.go b/modules/markup/markdown/transform_codeblock_lang.go
new file mode 100644
index 0000000000..f730265b15
--- /dev/null
+++ b/modules/markup/markdown/transform_codeblock_lang.go
@@ -0,0 +1,57 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package markdown
+
+import (
+	"bytes"
+
+	"github.com/alecthomas/chroma/v2/lexers"
+	"github.com/yuin/goldmark/ast"
+	"github.com/yuin/goldmark/text"
+)
+
+func (g *ASTTransformer) transformCodeblockLanguage(v *ast.FencedCodeBlock, reader text.Reader) {
+	if v.Info == nil {
+		return
+	}
+	src := reader.Source()
+	info := v.Info.Segment.Value(src)
+
+	// Parse Pandoc style attributes
+	// https://pandoc.org/MANUAL.html#extension-fenced_code_attributes
+	//
+	// For example,
+	// ```{.haskell .numberLines}
+	// ...
+	// ```
+	// Should have a language of "haskell", not "{.haskell .numberLines}"
+	if trimmed := bytes.TrimSpace(info); bytes.HasPrefix(trimmed, []byte{'{'}) && bytes.HasSuffix(trimmed, []byte{'}'}) {
+		attributes := trimmed[1 : len(trimmed)-1]
+		for attribute := range bytes.SplitSeq(attributes, []byte{' '}) {
+			if class, found := bytes.CutPrefix(attribute, []byte{'.'}); found {
+				if lexer := lexers.Get(string(class)); lexer != nil {
+					lang := class
+					langInx := bytes.Index(info, lang)
+					start := v.Info.Segment.Start + langInx
+					end := start + len(lang)
+					v.Info = ast.NewTextSegment(text.NewSegment(start, end))
+					return
+				}
+			}
+		}
+		return
+	}
+
+	// Strip language after commas
+	//
+	// For example,
+	// ```rust,ignore
+	// ...
+	// ```
+	// Should have a language of "rust", not "rust,ignore"
+	if i := bytes.IndexByte(info, ','); i != -1 {
+		start := v.Info.Segment.Start
+		v.Info = ast.NewTextSegment(text.NewSegment(start, start+i))
+	}
+}
diff --git a/modules/markup/orgmode/orgmode.go b/modules/markup/orgmode/orgmode.go
index b9d7b21db0..dd92ca90d0 100644
--- a/modules/markup/orgmode/orgmode.go
+++ b/modules/markup/orgmode/orgmode.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"html"
 	"io"
+	"strconv"
 	"strings"
 
 	"forgejo.org/modules/highlight"
@@ -159,6 +160,16 @@ func (r *Writer) resolveLink(node org.Node) string {
 		switch l.Kind() {
 		case "image", "video":
 			base = r.Ctx.Links.ResolveMediaLink(r.Ctx.IsWiki)
+		case "regular":
+			// Convert line search syntax to line links
+			target, search, found := strings.Cut(link, "::")
+			if found {
+				if _, err := strconv.Atoi(search); err == nil {
+					link = target + "#L" + search
+				} else {
+					link = target
+				}
+			}
 		}
 
 		link = util.URLJoin(base, link)
diff --git a/modules/markup/orgmode/orgmode_test.go b/modules/markup/orgmode/orgmode_test.go
index 723d78e745..2cd4eada22 100644
--- a/modules/markup/orgmode/orgmode_test.go
+++ b/modules/markup/orgmode/orgmode_test.go
@@ -89,6 +89,43 @@ func TestRender_BaseLinks(t *testing.T) {
 		`<p><a href="http://localhost:3000/gogits/gogs/src/branch/main/deep/nested/folder/src">./src/</a></p>`)
 }
 
+func TestRender_SearchSuffix(t *testing.T) {
+	setting.AppURL = AppURL
+	setting.AppSubURL = AppSubURL
+
+	test := func(input, expected string) {
+		buffer, err := RenderString(&markup.RenderContext{
+			Ctx: git.DefaultContext,
+			Links: markup.Links{
+				Base:       setting.AppSubURL,
+				BranchPath: "branch/main",
+			},
+		}, input)
+		require.NoError(t, err)
+		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
+	}
+
+	// `::N` line search becomes an `#L<n>` anchor.
+	test("[[./file.el::35][line 35]]",
+		`<p><a href="http://localhost:3000/gogits/gogs/src/branch/main/file.el#L35">line 35</a></p>`)
+	test("[[file:./file.el::35][line 35]]",
+		`<p><a href="http://localhost:3000/gogits/gogs/src/branch/main/file.el#L35">line 35</a></p>`)
+
+	// Other search types are ignored.
+	test("[[./file.org::*Heading][heading]]",
+		`<p><a href="http://localhost:3000/gogits/gogs/src/branch/main/file.org">heading</a></p>`)
+	test("[[./file.org::#custom-id][heading]]",
+		`<p><a href="http://localhost:3000/gogits/gogs/src/branch/main/file.org">heading</a></p>`)
+	test("[[./file.el::/regex/][regex]]",
+		`<p><a href="http://localhost:3000/gogits/gogs/src/branch/main/file.el">regex</a></p>`)
+	test("[[file:./file.el::][no search]]",
+		`<p><a href="http://localhost:3000/gogits/gogs/src/branch/main/file.el">no search</a></p>`)
+
+	// Absolute URLs that happen to contain `::` are unchanged.
+	test("[[https://example.com/foo::35][ext]]",
+		`<p><a href="https://example.com/foo::35">ext</a></p>`)
+}
+
 func TestRender_Media(t *testing.T) {
 	setting.AppURL = AppURL
 	setting.AppSubURL = AppSubURL
diff --git a/modules/nosql/manager.go b/modules/nosql/manager.go
index 7eea069e09..748afe7587 100644
--- a/modules/nosql/manager.go
+++ b/modules/nosql/manager.go
@@ -30,6 +30,8 @@ type Manager struct {
 // RedisClient is a subset of redis.UniversalClient, it exposes less methods
 // to avoid generating machine code for unused methods. New method definitions
 // should be copied from the definitions in the Redis library github.com/redis/go-redis.
+//
+//mockery:generate: true
 type RedisClient interface {
 	// redis.GenericCmdable
 	Del(ctx context.Context, keys ...string) *redis.IntCmd
diff --git a/modules/nosql/mocks.go b/modules/nosql/mocks.go
new file mode 100644
index 0000000000..39d0d1fea3
--- /dev/null
+++ b/modules/nosql/mocks.go
@@ -0,0 +1,1240 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package nosql
+
+import (
+	"context"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewMockRedisClient creates a new instance of MockRedisClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockRedisClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+},
+) *MockRedisClient {
+	mock := &MockRedisClient{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// MockRedisClient is an autogenerated mock type for the RedisClient type
+type MockRedisClient struct {
+	mock.Mock
+}
+
+type MockRedisClient_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockRedisClient) EXPECT() *MockRedisClient_Expecter {
+	return &MockRedisClient_Expecter{mock: &_m.Mock}
+}
+
+// Close provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Close() error {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Close")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func() error); ok {
+		r0 = returnFunc()
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockRedisClient_Close_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Close'
+type MockRedisClient_Close_Call struct {
+	*mock.Call
+}
+
+// Close is a helper method to define mock.On call
+func (_e *MockRedisClient_Expecter) Close() *MockRedisClient_Close_Call {
+	return &MockRedisClient_Close_Call{Call: _e.mock.On("Close")}
+}
+
+func (_c *MockRedisClient_Close_Call) Run(run func()) *MockRedisClient_Close_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Close_Call) Return(err error) *MockRedisClient_Close_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockRedisClient_Close_Call) RunAndReturn(run func() error) *MockRedisClient_Close_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// DBSize provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) DBSize(ctx context.Context) *redis.IntCmd {
+	ret := _mock.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for DBSize")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_DBSize_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DBSize'
+type MockRedisClient_DBSize_Call struct {
+	*mock.Call
+}
+
+// DBSize is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRedisClient_Expecter) DBSize(ctx any) *MockRedisClient_DBSize_Call {
+	return &MockRedisClient_DBSize_Call{Call: _e.mock.On("DBSize", ctx)}
+}
+
+func (_c *MockRedisClient_DBSize_Call) Run(run func(ctx context.Context)) *MockRedisClient_DBSize_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_DBSize_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_DBSize_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_DBSize_Call) RunAndReturn(run func(ctx context.Context) *redis.IntCmd) *MockRedisClient_DBSize_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Decr provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Decr(ctx context.Context, key string) *redis.IntCmd {
+	ret := _mock.Called(ctx, key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Decr")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_Decr_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Decr'
+type MockRedisClient_Decr_Call struct {
+	*mock.Call
+}
+
+// Decr is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+func (_e *MockRedisClient_Expecter) Decr(ctx, key any) *MockRedisClient_Decr_Call {
+	return &MockRedisClient_Decr_Call{Call: _e.mock.On("Decr", ctx, key)}
+}
+
+func (_c *MockRedisClient_Decr_Call) Run(run func(ctx context.Context, key string)) *MockRedisClient_Decr_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Decr_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_Decr_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_Decr_Call) RunAndReturn(run func(ctx context.Context, key string) *redis.IntCmd) *MockRedisClient_Decr_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Del provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Del(ctx context.Context, keys ...string) *redis.IntCmd {
+	var tmpRet mock.Arguments
+	if len(keys) > 0 {
+		tmpRet = _mock.Called(ctx, keys)
+	} else {
+		tmpRet = _mock.Called(ctx)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for Del")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, ...string) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, keys...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_Del_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Del'
+type MockRedisClient_Del_Call struct {
+	*mock.Call
+}
+
+// Del is a helper method to define mock.On call
+//   - ctx context.Context
+//   - keys ...string
+func (_e *MockRedisClient_Expecter) Del(ctx any, keys ...any) *MockRedisClient_Del_Call {
+	return &MockRedisClient_Del_Call{Call: _e.mock.On("Del",
+		append([]any{ctx}, keys...)...)}
+}
+
+func (_c *MockRedisClient_Del_Call) Run(run func(ctx context.Context, keys ...string)) *MockRedisClient_Del_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 []string
+		var variadicArgs []string
+		if len(args) > 1 {
+			variadicArgs = args[1].([]string)
+		}
+		arg1 = variadicArgs
+		run(
+			arg0,
+			arg1...,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Del_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_Del_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_Del_Call) RunAndReturn(run func(ctx context.Context, keys ...string) *redis.IntCmd) *MockRedisClient_Del_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Exists provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Exists(ctx context.Context, keys ...string) *redis.IntCmd {
+	var tmpRet mock.Arguments
+	if len(keys) > 0 {
+		tmpRet = _mock.Called(ctx, keys)
+	} else {
+		tmpRet = _mock.Called(ctx)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for Exists")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, ...string) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, keys...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_Exists_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Exists'
+type MockRedisClient_Exists_Call struct {
+	*mock.Call
+}
+
+// Exists is a helper method to define mock.On call
+//   - ctx context.Context
+//   - keys ...string
+func (_e *MockRedisClient_Expecter) Exists(ctx any, keys ...any) *MockRedisClient_Exists_Call {
+	return &MockRedisClient_Exists_Call{Call: _e.mock.On("Exists",
+		append([]any{ctx}, keys...)...)}
+}
+
+func (_c *MockRedisClient_Exists_Call) Run(run func(ctx context.Context, keys ...string)) *MockRedisClient_Exists_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 []string
+		var variadicArgs []string
+		if len(args) > 1 {
+			variadicArgs = args[1].([]string)
+		}
+		arg1 = variadicArgs
+		run(
+			arg0,
+			arg1...,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Exists_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_Exists_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_Exists_Call) RunAndReturn(run func(ctx context.Context, keys ...string) *redis.IntCmd) *MockRedisClient_Exists_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// FlushDB provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) FlushDB(ctx context.Context) *redis.StatusCmd {
+	ret := _mock.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for FlushDB")
+	}
+
+	var r0 *redis.StatusCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context) *redis.StatusCmd); ok {
+		r0 = returnFunc(ctx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.StatusCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_FlushDB_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'FlushDB'
+type MockRedisClient_FlushDB_Call struct {
+	*mock.Call
+}
+
+// FlushDB is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRedisClient_Expecter) FlushDB(ctx any) *MockRedisClient_FlushDB_Call {
+	return &MockRedisClient_FlushDB_Call{Call: _e.mock.On("FlushDB", ctx)}
+}
+
+func (_c *MockRedisClient_FlushDB_Call) Run(run func(ctx context.Context)) *MockRedisClient_FlushDB_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_FlushDB_Call) Return(statusCmd *redis.StatusCmd) *MockRedisClient_FlushDB_Call {
+	_c.Call.Return(statusCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_FlushDB_Call) RunAndReturn(run func(ctx context.Context) *redis.StatusCmd) *MockRedisClient_FlushDB_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Get provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Get(ctx context.Context, key string) *redis.StringCmd {
+	ret := _mock.Called(ctx, key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Get")
+	}
+
+	var r0 *redis.StringCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) *redis.StringCmd); ok {
+		r0 = returnFunc(ctx, key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.StringCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_Get_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Get'
+type MockRedisClient_Get_Call struct {
+	*mock.Call
+}
+
+// Get is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+func (_e *MockRedisClient_Expecter) Get(ctx, key any) *MockRedisClient_Get_Call {
+	return &MockRedisClient_Get_Call{Call: _e.mock.On("Get", ctx, key)}
+}
+
+func (_c *MockRedisClient_Get_Call) Run(run func(ctx context.Context, key string)) *MockRedisClient_Get_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Get_Call) Return(stringCmd *redis.StringCmd) *MockRedisClient_Get_Call {
+	_c.Call.Return(stringCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_Get_Call) RunAndReturn(run func(ctx context.Context, key string) *redis.StringCmd) *MockRedisClient_Get_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// HDel provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) HDel(ctx context.Context, key string, fields ...string) *redis.IntCmd {
+	var tmpRet mock.Arguments
+	if len(fields) > 0 {
+		tmpRet = _mock.Called(ctx, key, fields)
+	} else {
+		tmpRet = _mock.Called(ctx, key)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for HDel")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, ...string) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key, fields...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_HDel_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'HDel'
+type MockRedisClient_HDel_Call struct {
+	*mock.Call
+}
+
+// HDel is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+//   - fields ...string
+func (_e *MockRedisClient_Expecter) HDel(ctx, key any, fields ...any) *MockRedisClient_HDel_Call {
+	return &MockRedisClient_HDel_Call{Call: _e.mock.On("HDel",
+		append([]any{ctx, key}, fields...)...)}
+}
+
+func (_c *MockRedisClient_HDel_Call) Run(run func(ctx context.Context, key string, fields ...string)) *MockRedisClient_HDel_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 []string
+		var variadicArgs []string
+		if len(args) > 2 {
+			variadicArgs = args[2].([]string)
+		}
+		arg2 = variadicArgs
+		run(
+			arg0,
+			arg1,
+			arg2...,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_HDel_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_HDel_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_HDel_Call) RunAndReturn(run func(ctx context.Context, key string, fields ...string) *redis.IntCmd) *MockRedisClient_HDel_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// HKeys provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) HKeys(ctx context.Context, key string) *redis.StringSliceCmd {
+	ret := _mock.Called(ctx, key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for HKeys")
+	}
+
+	var r0 *redis.StringSliceCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) *redis.StringSliceCmd); ok {
+		r0 = returnFunc(ctx, key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.StringSliceCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_HKeys_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'HKeys'
+type MockRedisClient_HKeys_Call struct {
+	*mock.Call
+}
+
+// HKeys is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+func (_e *MockRedisClient_Expecter) HKeys(ctx, key any) *MockRedisClient_HKeys_Call {
+	return &MockRedisClient_HKeys_Call{Call: _e.mock.On("HKeys", ctx, key)}
+}
+
+func (_c *MockRedisClient_HKeys_Call) Run(run func(ctx context.Context, key string)) *MockRedisClient_HKeys_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_HKeys_Call) Return(stringSliceCmd *redis.StringSliceCmd) *MockRedisClient_HKeys_Call {
+	_c.Call.Return(stringSliceCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_HKeys_Call) RunAndReturn(run func(ctx context.Context, key string) *redis.StringSliceCmd) *MockRedisClient_HKeys_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// HSet provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) HSet(ctx context.Context, key string, values ...any) *redis.IntCmd {
+	var tmpRet mock.Arguments
+	if len(values) > 0 {
+		tmpRet = _mock.Called(ctx, key, values)
+	} else {
+		tmpRet = _mock.Called(ctx, key)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for HSet")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, ...any) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key, values...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_HSet_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'HSet'
+type MockRedisClient_HSet_Call struct {
+	*mock.Call
+}
+
+// HSet is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+//   - values ...any
+func (_e *MockRedisClient_Expecter) HSet(ctx, key any, values ...any) *MockRedisClient_HSet_Call {
+	return &MockRedisClient_HSet_Call{Call: _e.mock.On("HSet",
+		append([]any{ctx, key}, values...)...)}
+}
+
+func (_c *MockRedisClient_HSet_Call) Run(run func(ctx context.Context, key string, values ...any)) *MockRedisClient_HSet_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 []any
+		var variadicArgs []any
+		if len(args) > 2 {
+			variadicArgs = args[2].([]any)
+		}
+		arg2 = variadicArgs
+		run(
+			arg0,
+			arg1,
+			arg2...,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_HSet_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_HSet_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_HSet_Call) RunAndReturn(run func(ctx context.Context, key string, values ...any) *redis.IntCmd) *MockRedisClient_HSet_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Incr provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Incr(ctx context.Context, key string) *redis.IntCmd {
+	ret := _mock.Called(ctx, key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Incr")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_Incr_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Incr'
+type MockRedisClient_Incr_Call struct {
+	*mock.Call
+}
+
+// Incr is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+func (_e *MockRedisClient_Expecter) Incr(ctx, key any) *MockRedisClient_Incr_Call {
+	return &MockRedisClient_Incr_Call{Call: _e.mock.On("Incr", ctx, key)}
+}
+
+func (_c *MockRedisClient_Incr_Call) Run(run func(ctx context.Context, key string)) *MockRedisClient_Incr_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Incr_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_Incr_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_Incr_Call) RunAndReturn(run func(ctx context.Context, key string) *redis.IntCmd) *MockRedisClient_Incr_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// LLen provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) LLen(ctx context.Context, key string) *redis.IntCmd {
+	ret := _mock.Called(ctx, key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for LLen")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_LLen_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'LLen'
+type MockRedisClient_LLen_Call struct {
+	*mock.Call
+}
+
+// LLen is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+func (_e *MockRedisClient_Expecter) LLen(ctx, key any) *MockRedisClient_LLen_Call {
+	return &MockRedisClient_LLen_Call{Call: _e.mock.On("LLen", ctx, key)}
+}
+
+func (_c *MockRedisClient_LLen_Call) Run(run func(ctx context.Context, key string)) *MockRedisClient_LLen_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_LLen_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_LLen_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_LLen_Call) RunAndReturn(run func(ctx context.Context, key string) *redis.IntCmd) *MockRedisClient_LLen_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// LPop provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) LPop(ctx context.Context, key string) *redis.StringCmd {
+	ret := _mock.Called(ctx, key)
+
+	if len(ret) == 0 {
+		panic("no return value specified for LPop")
+	}
+
+	var r0 *redis.StringCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) *redis.StringCmd); ok {
+		r0 = returnFunc(ctx, key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.StringCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_LPop_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'LPop'
+type MockRedisClient_LPop_Call struct {
+	*mock.Call
+}
+
+// LPop is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+func (_e *MockRedisClient_Expecter) LPop(ctx, key any) *MockRedisClient_LPop_Call {
+	return &MockRedisClient_LPop_Call{Call: _e.mock.On("LPop", ctx, key)}
+}
+
+func (_c *MockRedisClient_LPop_Call) Run(run func(ctx context.Context, key string)) *MockRedisClient_LPop_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_LPop_Call) Return(stringCmd *redis.StringCmd) *MockRedisClient_LPop_Call {
+	_c.Call.Return(stringCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_LPop_Call) RunAndReturn(run func(ctx context.Context, key string) *redis.StringCmd) *MockRedisClient_LPop_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Ping provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Ping(ctx context.Context) *redis.StatusCmd {
+	ret := _mock.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Ping")
+	}
+
+	var r0 *redis.StatusCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context) *redis.StatusCmd); ok {
+		r0 = returnFunc(ctx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.StatusCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_Ping_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Ping'
+type MockRedisClient_Ping_Call struct {
+	*mock.Call
+}
+
+// Ping is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRedisClient_Expecter) Ping(ctx any) *MockRedisClient_Ping_Call {
+	return &MockRedisClient_Ping_Call{Call: _e.mock.On("Ping", ctx)}
+}
+
+func (_c *MockRedisClient_Ping_Call) Run(run func(ctx context.Context)) *MockRedisClient_Ping_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Ping_Call) Return(statusCmd *redis.StatusCmd) *MockRedisClient_Ping_Call {
+	_c.Call.Return(statusCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_Ping_Call) RunAndReturn(run func(ctx context.Context) *redis.StatusCmd) *MockRedisClient_Ping_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// RPush provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) RPush(ctx context.Context, key string, values ...any) *redis.IntCmd {
+	var tmpRet mock.Arguments
+	if len(values) > 0 {
+		tmpRet = _mock.Called(ctx, key, values)
+	} else {
+		tmpRet = _mock.Called(ctx, key)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for RPush")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, ...any) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key, values...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_RPush_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RPush'
+type MockRedisClient_RPush_Call struct {
+	*mock.Call
+}
+
+// RPush is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+//   - values ...any
+func (_e *MockRedisClient_Expecter) RPush(ctx, key any, values ...any) *MockRedisClient_RPush_Call {
+	return &MockRedisClient_RPush_Call{Call: _e.mock.On("RPush",
+		append([]any{ctx, key}, values...)...)}
+}
+
+func (_c *MockRedisClient_RPush_Call) Run(run func(ctx context.Context, key string, values ...any)) *MockRedisClient_RPush_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 []any
+		var variadicArgs []any
+		if len(args) > 2 {
+			variadicArgs = args[2].([]any)
+		}
+		arg2 = variadicArgs
+		run(
+			arg0,
+			arg1,
+			arg2...,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_RPush_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_RPush_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_RPush_Call) RunAndReturn(run func(ctx context.Context, key string, values ...any) *redis.IntCmd) *MockRedisClient_RPush_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SAdd provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) SAdd(ctx context.Context, key string, members ...any) *redis.IntCmd {
+	var tmpRet mock.Arguments
+	if len(members) > 0 {
+		tmpRet = _mock.Called(ctx, key, members)
+	} else {
+		tmpRet = _mock.Called(ctx, key)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for SAdd")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, ...any) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key, members...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_SAdd_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SAdd'
+type MockRedisClient_SAdd_Call struct {
+	*mock.Call
+}
+
+// SAdd is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+//   - members ...any
+func (_e *MockRedisClient_Expecter) SAdd(ctx, key any, members ...any) *MockRedisClient_SAdd_Call {
+	return &MockRedisClient_SAdd_Call{Call: _e.mock.On("SAdd",
+		append([]any{ctx, key}, members...)...)}
+}
+
+func (_c *MockRedisClient_SAdd_Call) Run(run func(ctx context.Context, key string, members ...any)) *MockRedisClient_SAdd_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 []any
+		var variadicArgs []any
+		if len(args) > 2 {
+			variadicArgs = args[2].([]any)
+		}
+		arg2 = variadicArgs
+		run(
+			arg0,
+			arg1,
+			arg2...,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_SAdd_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_SAdd_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_SAdd_Call) RunAndReturn(run func(ctx context.Context, key string, members ...any) *redis.IntCmd) *MockRedisClient_SAdd_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SIsMember provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) SIsMember(ctx context.Context, key string, member any) *redis.BoolCmd {
+	ret := _mock.Called(ctx, key, member)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SIsMember")
+	}
+
+	var r0 *redis.BoolCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, any) *redis.BoolCmd); ok {
+		r0 = returnFunc(ctx, key, member)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.BoolCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_SIsMember_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SIsMember'
+type MockRedisClient_SIsMember_Call struct {
+	*mock.Call
+}
+
+// SIsMember is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+//   - member any
+func (_e *MockRedisClient_Expecter) SIsMember(ctx, key, member any) *MockRedisClient_SIsMember_Call {
+	return &MockRedisClient_SIsMember_Call{Call: _e.mock.On("SIsMember", ctx, key, member)}
+}
+
+func (_c *MockRedisClient_SIsMember_Call) Run(run func(ctx context.Context, key string, member any)) *MockRedisClient_SIsMember_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 any
+		if args[2] != nil {
+			arg2 = args[2].(any)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_SIsMember_Call) Return(boolCmd *redis.BoolCmd) *MockRedisClient_SIsMember_Call {
+	_c.Call.Return(boolCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_SIsMember_Call) RunAndReturn(run func(ctx context.Context, key string, member any) *redis.BoolCmd) *MockRedisClient_SIsMember_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SRem provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) SRem(ctx context.Context, key string, members ...any) *redis.IntCmd {
+	var tmpRet mock.Arguments
+	if len(members) > 0 {
+		tmpRet = _mock.Called(ctx, key, members)
+	} else {
+		tmpRet = _mock.Called(ctx, key)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for SRem")
+	}
+
+	var r0 *redis.IntCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, ...any) *redis.IntCmd); ok {
+		r0 = returnFunc(ctx, key, members...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.IntCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_SRem_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SRem'
+type MockRedisClient_SRem_Call struct {
+	*mock.Call
+}
+
+// SRem is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+//   - members ...any
+func (_e *MockRedisClient_Expecter) SRem(ctx, key any, members ...any) *MockRedisClient_SRem_Call {
+	return &MockRedisClient_SRem_Call{Call: _e.mock.On("SRem",
+		append([]any{ctx, key}, members...)...)}
+}
+
+func (_c *MockRedisClient_SRem_Call) Run(run func(ctx context.Context, key string, members ...any)) *MockRedisClient_SRem_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 []any
+		var variadicArgs []any
+		if len(args) > 2 {
+			variadicArgs = args[2].([]any)
+		}
+		arg2 = variadicArgs
+		run(
+			arg0,
+			arg1,
+			arg2...,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_SRem_Call) Return(intCmd *redis.IntCmd) *MockRedisClient_SRem_Call {
+	_c.Call.Return(intCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_SRem_Call) RunAndReturn(run func(ctx context.Context, key string, members ...any) *redis.IntCmd) *MockRedisClient_SRem_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Set provides a mock function for the type MockRedisClient
+func (_mock *MockRedisClient) Set(ctx context.Context, key string, value any, expiration time.Duration) *redis.StatusCmd {
+	ret := _mock.Called(ctx, key, value, expiration)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Set")
+	}
+
+	var r0 *redis.StatusCmd
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, any, time.Duration) *redis.StatusCmd); ok {
+		r0 = returnFunc(ctx, key, value, expiration)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*redis.StatusCmd)
+		}
+	}
+	return r0
+}
+
+// MockRedisClient_Set_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Set'
+type MockRedisClient_Set_Call struct {
+	*mock.Call
+}
+
+// Set is a helper method to define mock.On call
+//   - ctx context.Context
+//   - key string
+//   - value any
+//   - expiration time.Duration
+func (_e *MockRedisClient_Expecter) Set(ctx, key, value, expiration any) *MockRedisClient_Set_Call {
+	return &MockRedisClient_Set_Call{Call: _e.mock.On("Set", ctx, key, value, expiration)}
+}
+
+func (_c *MockRedisClient_Set_Call) Run(run func(ctx context.Context, key string, value any, expiration time.Duration)) *MockRedisClient_Set_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 any
+		if args[2] != nil {
+			arg2 = args[2].(any)
+		}
+		var arg3 time.Duration
+		if args[3] != nil {
+			arg3 = args[3].(time.Duration)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+			arg3,
+		)
+	})
+	return _c
+}
+
+func (_c *MockRedisClient_Set_Call) Return(statusCmd *redis.StatusCmd) *MockRedisClient_Set_Call {
+	_c.Call.Return(statusCmd)
+	return _c
+}
+
+func (_c *MockRedisClient_Set_Call) RunAndReturn(run func(ctx context.Context, key string, value any, expiration time.Duration) *redis.StatusCmd) *MockRedisClient_Set_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/modules/packages/pypi/metadata.go b/modules/packages/pypi/metadata.go
index 125728c4f1..0aa90aeca5 100644
--- a/modules/packages/pypi/metadata.go
+++ b/modules/packages/pypi/metadata.go
@@ -13,3 +13,26 @@ type Metadata struct {
 	License         string `json:"license,omitempty"`
 	RequiresPython  string `json:"requires_python,omitempty"`
 }
+
+type FileHashesJSON struct {
+	SHA256 string `json:"sha256"`
+}
+
+type FileJSON struct {
+	Filename       string         `json:"filename"`
+	URL            string         `json:"url"`
+	Hashes         FileHashesJSON `json:"hashes"`
+	RequiresPython string         `json:"requires-python"`
+	Size           int64          `json:"size"`
+}
+
+type PackageMetaJSON struct {
+	APIVersion string `json:"api-version"`
+}
+
+type PackageJSON struct {
+	Name     string          `json:"name"`
+	Meta     PackageMetaJSON `json:"meta"`
+	Versions []string        `json:"versions"`
+	Files    []FileJSON      `json:"files"`
+}
diff --git a/modules/private/serv.go b/modules/private/serv.go
index ac5be3b767..1e04b2ce29 100644
--- a/modules/private/serv.go
+++ b/modules/private/serv.go
@@ -49,12 +49,12 @@ type ServCommandResults struct {
 // ServCommand preps for a serv call
 func ServCommand(ctx context.Context, keyID int64, ownerName, repoName string, mode perm.AccessMode, verbs ...string) (*ServCommandResults, ResponseExtra) {
 	var reqURL strings.Builder
-	reqURL.WriteString(setting.LocalURL + fmt.Sprintf("api/internal/serv/command/%d/%s/%s?mode=%d",
+	fmt.Fprintf(&reqURL, "%sapi/internal/serv/command/%d/%s/%s?mode=%d",
+		setting.LocalURL,
 		keyID,
 		url.PathEscape(ownerName),
 		url.PathEscape(repoName),
-		mode,
-	))
+		mode)
 	for _, verb := range verbs {
 		if verb != "" {
 			fmt.Fprintf(&reqURL, "&verb=%s", url.QueryEscape(verb))
diff --git a/modules/queue/base_redis_test.go b/modules/queue/base_redis_test.go
index bf3ad5b97b..297a49229a 100644
--- a/modules/queue/base_redis_test.go
+++ b/modules/queue/base_redis_test.go
@@ -7,18 +7,17 @@ import (
 	"context"
 	"testing"
 
-	"forgejo.org/modules/queue/mock"
+	"forgejo.org/modules/nosql"
+	queue_mock "forgejo.org/modules/queue/mock"
 	"forgejo.org/modules/setting"
 
 	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/suite"
-	"go.uber.org/mock/gomock"
 )
 
 type baseRedisUnitTestSuite struct {
 	suite.Suite
-
-	mockController *gomock.Controller
 }
 
 func TestBaseRedis(t *testing.T) {
@@ -26,7 +25,6 @@ func TestBaseRedis(t *testing.T) {
 }
 
 func (suite *baseRedisUnitTestSuite) SetupSuite() {
-	suite.mockController = gomock.NewController(suite.T())
 }
 
 func (suite *baseRedisUnitTestSuite) TestBasic() {
@@ -71,39 +69,47 @@ func (suite *baseRedisUnitTestSuite) TestBasic() {
 			}
 
 			// Configure expectations.
-			mockRedisStore := mock.NewInMemoryMockRedis()
-			redisClient := mock.NewMockRedisClient(suite.mockController)
+			mockRedisStore := queue_mock.NewInMemoryMockRedis()
+			redisClient := nosql.NewMockRedisClient(suite.T())
 
 			redisClient.EXPECT().
-				Ping(gomock.Any()).
-				Times(1).
-				Return(&redis.StatusCmd{})
+				Ping(mock.Anything).
+				Return(&redis.StatusCmd{}).
+				Times(1)
 			redisClient.EXPECT().
-				LLen(gomock.Any(), testCase.QueueName).
-				Times(1).
-				DoAndReturn(mockRedisStore.LLen)
+				LLen(mock.Anything, testCase.QueueName).
+				RunAndReturn(mockRedisStore.LLen).
+				Times(1)
 			redisClient.EXPECT().
-				LPop(gomock.Any(), testCase.QueueName).
-				Times(1).
-				DoAndReturn(mockRedisStore.LPop)
+				LPop(mock.Anything, testCase.QueueName).
+				RunAndReturn(mockRedisStore.LPop).
+				Times(1)
 			redisClient.EXPECT().
-				RPush(gomock.Any(), testCase.QueueName, gomock.Any()).
-				Times(1).
-				DoAndReturn(mockRedisStore.RPush)
+				RPush(mock.Anything, testCase.QueueName, mock.Anything).
+				RunAndReturn(func(ctx context.Context, key string, values ...any) *redis.IntCmd {
+					return mockRedisStore.RPush(ctx, key, values[0].([]byte))
+				}).
+				Times(1)
 
 			if testCase.Unique {
 				redisClient.EXPECT().
-					SAdd(gomock.Any(), testCase.QueueName+"_unique", gomock.Any()).
-					Times(1).
-					DoAndReturn(mockRedisStore.SAdd)
+					SAdd(mock.Anything, testCase.QueueName+"_unique", mock.Anything).
+					RunAndReturn(func(ctx context.Context, key string, members ...any) *redis.IntCmd {
+						return mockRedisStore.SAdd(ctx, key, members[0].([]byte))
+					}).
+					Times(1)
 				redisClient.EXPECT().
-					SRem(gomock.Any(), testCase.QueueName+"_unique", gomock.Any()).
-					Times(1).
-					DoAndReturn(mockRedisStore.SRem)
+					SRem(mock.Anything, testCase.QueueName+"_unique", mock.Anything).
+					RunAndReturn(func(ctx context.Context, key string, members ...any) *redis.IntCmd {
+						return mockRedisStore.SRem(ctx, key, members[0].([]byte))
+					}).
+					Times(1)
 				redisClient.EXPECT().
-					SIsMember(gomock.Any(), testCase.QueueName+"_unique", gomock.Any()).
-					Times(2).
-					DoAndReturn(mockRedisStore.SIsMember)
+					SIsMember(mock.Anything, testCase.QueueName+"_unique", mock.Anything).
+					RunAndReturn(func(ctx context.Context, key string, member any) *redis.BoolCmd {
+						return mockRedisStore.SIsMember(ctx, key, member.([]byte))
+					}).
+					Times(2)
 			}
 
 			client, err := newBaseRedisGeneric(
diff --git a/modules/queue/mock/redisuniversalclient.go b/modules/queue/mock/redisuniversalclient.go
deleted file mode 100644
index a19e639ac1..0000000000
--- a/modules/queue/mock/redisuniversalclient.go
+++ /dev/null
@@ -1,344 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: forgejo.org/modules/nosql (interfaces: RedisClient)
-//
-// Generated by this command:
-//
-//	mockgen -package mock -destination ./modules/queue/mock/redisuniversalclient.go forgejo.org/modules/nosql RedisClient
-//
-
-// Package mock is a generated GoMock package.
-package mock
-
-import (
-	context "context"
-	reflect "reflect"
-	time "time"
-
-	redis "github.com/redis/go-redis/v9"
-	gomock "go.uber.org/mock/gomock"
-)
-
-// MockRedisClient is a mock of RedisClient interface.
-type MockRedisClient struct {
-	ctrl     *gomock.Controller
-	recorder *MockRedisClientMockRecorder
-	isgomock struct{}
-}
-
-// MockRedisClientMockRecorder is the mock recorder for MockRedisClient.
-type MockRedisClientMockRecorder struct {
-	mock *MockRedisClient
-}
-
-// NewMockRedisClient creates a new mock instance.
-func NewMockRedisClient(ctrl *gomock.Controller) *MockRedisClient {
-	mock := &MockRedisClient{ctrl: ctrl}
-	mock.recorder = &MockRedisClientMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockRedisClient) EXPECT() *MockRedisClientMockRecorder {
-	return m.recorder
-}
-
-// Close mocks base method.
-func (m *MockRedisClient) Close() error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Close")
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Close indicates an expected call of Close.
-func (mr *MockRedisClientMockRecorder) Close() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockRedisClient)(nil).Close))
-}
-
-// DBSize mocks base method.
-func (m *MockRedisClient) DBSize(ctx context.Context) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DBSize", ctx)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// DBSize indicates an expected call of DBSize.
-func (mr *MockRedisClientMockRecorder) DBSize(ctx any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBSize", reflect.TypeOf((*MockRedisClient)(nil).DBSize), ctx)
-}
-
-// Decr mocks base method.
-func (m *MockRedisClient) Decr(ctx context.Context, key string) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Decr", ctx, key)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// Decr indicates an expected call of Decr.
-func (mr *MockRedisClientMockRecorder) Decr(ctx, key any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Decr", reflect.TypeOf((*MockRedisClient)(nil).Decr), ctx, key)
-}
-
-// Del mocks base method.
-func (m *MockRedisClient) Del(ctx context.Context, keys ...string) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	varargs := []any{ctx}
-	for _, a := range keys {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "Del", varargs...)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// Del indicates an expected call of Del.
-func (mr *MockRedisClientMockRecorder) Del(ctx any, keys ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{ctx}, keys...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Del", reflect.TypeOf((*MockRedisClient)(nil).Del), varargs...)
-}
-
-// Exists mocks base method.
-func (m *MockRedisClient) Exists(ctx context.Context, keys ...string) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	varargs := []any{ctx}
-	for _, a := range keys {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "Exists", varargs...)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// Exists indicates an expected call of Exists.
-func (mr *MockRedisClientMockRecorder) Exists(ctx any, keys ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{ctx}, keys...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Exists", reflect.TypeOf((*MockRedisClient)(nil).Exists), varargs...)
-}
-
-// FlushDB mocks base method.
-func (m *MockRedisClient) FlushDB(ctx context.Context) *redis.StatusCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "FlushDB", ctx)
-	ret0, _ := ret[0].(*redis.StatusCmd)
-	return ret0
-}
-
-// FlushDB indicates an expected call of FlushDB.
-func (mr *MockRedisClientMockRecorder) FlushDB(ctx any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FlushDB", reflect.TypeOf((*MockRedisClient)(nil).FlushDB), ctx)
-}
-
-// Get mocks base method.
-func (m *MockRedisClient) Get(ctx context.Context, key string) *redis.StringCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Get", ctx, key)
-	ret0, _ := ret[0].(*redis.StringCmd)
-	return ret0
-}
-
-// Get indicates an expected call of Get.
-func (mr *MockRedisClientMockRecorder) Get(ctx, key any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get", reflect.TypeOf((*MockRedisClient)(nil).Get), ctx, key)
-}
-
-// HDel mocks base method.
-func (m *MockRedisClient) HDel(ctx context.Context, key string, fields ...string) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	varargs := []any{ctx, key}
-	for _, a := range fields {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "HDel", varargs...)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// HDel indicates an expected call of HDel.
-func (mr *MockRedisClientMockRecorder) HDel(ctx, key any, fields ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{ctx, key}, fields...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HDel", reflect.TypeOf((*MockRedisClient)(nil).HDel), varargs...)
-}
-
-// HKeys mocks base method.
-func (m *MockRedisClient) HKeys(ctx context.Context, key string) *redis.StringSliceCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "HKeys", ctx, key)
-	ret0, _ := ret[0].(*redis.StringSliceCmd)
-	return ret0
-}
-
-// HKeys indicates an expected call of HKeys.
-func (mr *MockRedisClientMockRecorder) HKeys(ctx, key any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HKeys", reflect.TypeOf((*MockRedisClient)(nil).HKeys), ctx, key)
-}
-
-// HSet mocks base method.
-func (m *MockRedisClient) HSet(ctx context.Context, key string, values ...any) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	varargs := []any{ctx, key}
-	for _, a := range values {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "HSet", varargs...)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// HSet indicates an expected call of HSet.
-func (mr *MockRedisClientMockRecorder) HSet(ctx, key any, values ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{ctx, key}, values...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HSet", reflect.TypeOf((*MockRedisClient)(nil).HSet), varargs...)
-}
-
-// Incr mocks base method.
-func (m *MockRedisClient) Incr(ctx context.Context, key string) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Incr", ctx, key)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// Incr indicates an expected call of Incr.
-func (mr *MockRedisClientMockRecorder) Incr(ctx, key any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Incr", reflect.TypeOf((*MockRedisClient)(nil).Incr), ctx, key)
-}
-
-// LLen mocks base method.
-func (m *MockRedisClient) LLen(ctx context.Context, key string) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LLen", ctx, key)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// LLen indicates an expected call of LLen.
-func (mr *MockRedisClientMockRecorder) LLen(ctx, key any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LLen", reflect.TypeOf((*MockRedisClient)(nil).LLen), ctx, key)
-}
-
-// LPop mocks base method.
-func (m *MockRedisClient) LPop(ctx context.Context, key string) *redis.StringCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LPop", ctx, key)
-	ret0, _ := ret[0].(*redis.StringCmd)
-	return ret0
-}
-
-// LPop indicates an expected call of LPop.
-func (mr *MockRedisClientMockRecorder) LPop(ctx, key any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LPop", reflect.TypeOf((*MockRedisClient)(nil).LPop), ctx, key)
-}
-
-// Ping mocks base method.
-func (m *MockRedisClient) Ping(ctx context.Context) *redis.StatusCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Ping", ctx)
-	ret0, _ := ret[0].(*redis.StatusCmd)
-	return ret0
-}
-
-// Ping indicates an expected call of Ping.
-func (mr *MockRedisClientMockRecorder) Ping(ctx any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Ping", reflect.TypeOf((*MockRedisClient)(nil).Ping), ctx)
-}
-
-// RPush mocks base method.
-func (m *MockRedisClient) RPush(ctx context.Context, key string, values ...any) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	varargs := []any{ctx, key}
-	for _, a := range values {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "RPush", varargs...)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// RPush indicates an expected call of RPush.
-func (mr *MockRedisClientMockRecorder) RPush(ctx, key any, values ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{ctx, key}, values...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RPush", reflect.TypeOf((*MockRedisClient)(nil).RPush), varargs...)
-}
-
-// SAdd mocks base method.
-func (m *MockRedisClient) SAdd(ctx context.Context, key string, members ...any) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	varargs := []any{ctx, key}
-	for _, a := range members {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "SAdd", varargs...)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// SAdd indicates an expected call of SAdd.
-func (mr *MockRedisClientMockRecorder) SAdd(ctx, key any, members ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{ctx, key}, members...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SAdd", reflect.TypeOf((*MockRedisClient)(nil).SAdd), varargs...)
-}
-
-// SIsMember mocks base method.
-func (m *MockRedisClient) SIsMember(ctx context.Context, key string, member any) *redis.BoolCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SIsMember", ctx, key, member)
-	ret0, _ := ret[0].(*redis.BoolCmd)
-	return ret0
-}
-
-// SIsMember indicates an expected call of SIsMember.
-func (mr *MockRedisClientMockRecorder) SIsMember(ctx, key, member any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SIsMember", reflect.TypeOf((*MockRedisClient)(nil).SIsMember), ctx, key, member)
-}
-
-// SRem mocks base method.
-func (m *MockRedisClient) SRem(ctx context.Context, key string, members ...any) *redis.IntCmd {
-	m.ctrl.T.Helper()
-	varargs := []any{ctx, key}
-	for _, a := range members {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "SRem", varargs...)
-	ret0, _ := ret[0].(*redis.IntCmd)
-	return ret0
-}
-
-// SRem indicates an expected call of SRem.
-func (mr *MockRedisClientMockRecorder) SRem(ctx, key any, members ...any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{ctx, key}, members...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SRem", reflect.TypeOf((*MockRedisClient)(nil).SRem), varargs...)
-}
-
-// Set mocks base method.
-func (m *MockRedisClient) Set(ctx context.Context, key string, value any, expiration time.Duration) *redis.StatusCmd {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Set", ctx, key, value, expiration)
-	ret0, _ := ret[0].(*redis.StatusCmd)
-	return ret0
-}
-
-// Set indicates an expected call of Set.
-func (mr *MockRedisClientMockRecorder) Set(ctx, key, value, expiration any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Set", reflect.TypeOf((*MockRedisClient)(nil).Set), ctx, key, value, expiration)
-}
diff --git a/modules/repository/init.go b/modules/repository/init.go
index 66a65599a8..16d366c6f0 100644
--- a/modules/repository/init.go
+++ b/modules/repository/init.go
@@ -138,8 +138,6 @@ func CheckInitRepository(ctx context.Context, owner, name, objectFormatName stri
 	// Init git bare new repository.
 	if err = git.InitRepository(ctx, repoPath, true, objectFormatName); err != nil {
 		return fmt.Errorf("git.InitRepository: %w", err)
-	} else if err = CreateDelegateHooks(repoPath); err != nil {
-		return fmt.Errorf("createDelegateHooks: %w", err)
 	}
 	return nil
 }
diff --git a/modules/setting/actions.go b/modules/setting/actions.go
index 2e0554195f..930e0d0bed 100644
--- a/modules/setting/actions.go
+++ b/modules/setting/actions.go
@@ -5,7 +5,6 @@ package setting
 
 import (
 	"fmt"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -28,17 +27,15 @@ var (
 		SkipWorkflowStrings          []string          `ini:"SKIP_WORKFLOW_STRINGS"`
 		LimitDispatchInputs          int64             `ini:"LIMIT_DISPATCH_INPUTS"`
 		ConcurrencyGroupQueueEnabled bool              `ini:"CONCURRENCY_GROUP_QUEUE_ENABLED"`
-		IDTokenSigningAlgorithm      idTokenAlgorithm  `ini:"ID_TOKEN_SIGNING_ALGORITHM"`
-		IDTokenSigningPrivateKeyFile string            `ini:"ID_TOKEN_SIGNING_PRIVATE_KEY_FILE"`
 		IDTokenExpirationTime        int64             `ini:"ID_TOKEN_EXPIRATION_TIME"`
+
+		KeyCfg *jwtx.KeyCfg
 	}{
 		Enabled:                      true,
 		DefaultActionsURL:            defaultActionsURLForgejo,
 		SkipWorkflowStrings:          []string{"[skip ci]", "[ci skip]", "[no ci]", "[skip actions]", "[actions skip]"},
 		LimitDispatchInputs:          100,
 		ConcurrencyGroupQueueEnabled: true,
-		IDTokenSigningAlgorithm:      "RS256",
-		IDTokenSigningPrivateKeyFile: "actions_id_token/private.pem",
 		IDTokenExpirationTime:        3600,
 	}
 )
@@ -76,15 +73,9 @@ func (c logCompression) IsZstd() bool {
 	return c == "" || strings.ToLower(string(c)) == "zstd"
 }
 
-type idTokenAlgorithm string
-
-func (c idTokenAlgorithm) IsValid() bool {
-	// Empty string implies RS256
-	return jwtx.IsValidAsymmetricAlgorithm(string(c)) || string(c) == ""
-}
-
 func loadActionsFrom(rootCfg ConfigProvider) error {
-	sec := rootCfg.Section("actions")
+	secName := "actions"
+	sec := rootCfg.Section(secName)
 	err := sec.MapTo(&Actions)
 	if err != nil {
 		return fmt.Errorf("failed to map Actions settings: %v", err)
@@ -120,13 +111,9 @@ func loadActionsFrom(rootCfg ConfigProvider) error {
 		return fmt.Errorf("invalid [actions] LOG_COMPRESSION: %q", Actions.LogCompression)
 	}
 
-	if !Actions.IDTokenSigningAlgorithm.IsValid() {
-		return fmt.Errorf("invalid [actions] ID_TOKEN_SIGNING_ALGORITHM: %q", Actions.IDTokenSigningAlgorithm)
+	Actions.KeyCfg, err = loadKeyCfg(rootCfg, secName, "ID_TOKEN_", "RS256", "actions_id_token/private.pem", onlyAsymmetric())
+	if err != nil {
+		return err
 	}
-
-	if !filepath.IsAbs(Actions.IDTokenSigningPrivateKeyFile) {
-		Actions.IDTokenSigningPrivateKeyFile = filepath.Join(AppDataPath, Actions.IDTokenSigningPrivateKeyFile)
-	}
-
 	return nil
 }
diff --git a/modules/setting/actions_test.go b/modules/setting/actions_test.go
index 7d32131d32..1bbd4d0251 100644
--- a/modules/setting/actions_test.go
+++ b/modules/setting/actions_test.go
@@ -4,7 +4,6 @@
 package setting
 
 import (
-	"fmt"
 	"path/filepath"
 	"testing"
 
@@ -176,8 +175,8 @@ func Test_getIDTokenSettingsForActions(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, loadActionsFrom(cfg))
 
-	assert.EqualValues(t, "RS256", Actions.IDTokenSigningAlgorithm)
-	assert.Equal(t, "/home/app/data/actions_id_token/private.pem", Actions.IDTokenSigningPrivateKeyFile)
+	assert.Equal(t, "RS256", Actions.KeyCfg.Signing.Algorithm)
+	assert.Equal(t, "/home/app/data/actions_id_token/private.pem", *Actions.KeyCfg.Signing.PrivateKeyPath)
 	assert.EqualValues(t, 3600, Actions.IDTokenExpirationTime)
 
 	iniStr = `
@@ -190,8 +189,8 @@ func Test_getIDTokenSettingsForActions(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, loadActionsFrom(cfg))
 
-	assert.EqualValues(t, "ES256", Actions.IDTokenSigningAlgorithm)
-	assert.Equal(t, "/test/test.pem", Actions.IDTokenSigningPrivateKeyFile)
+	assert.Equal(t, "ES256", Actions.KeyCfg.Signing.Algorithm)
+	assert.Equal(t, "/test/test.pem", *Actions.KeyCfg.Signing.PrivateKeyPath)
 	assert.EqualValues(t, 120, Actions.IDTokenExpirationTime)
 
 	iniStr = `
@@ -204,8 +203,8 @@ func Test_getIDTokenSettingsForActions(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, loadActionsFrom(cfg))
 
-	assert.EqualValues(t, "EdDSA", Actions.IDTokenSigningAlgorithm)
-	assert.Equal(t, "/home/app/data/test/test.pem", Actions.IDTokenSigningPrivateKeyFile)
+	assert.Equal(t, "EdDSA", Actions.KeyCfg.Signing.Algorithm)
+	assert.Equal(t, "/home/app/data/test/test.pem", *Actions.KeyCfg.Signing.PrivateKeyPath)
 	assert.EqualValues(t, 123, Actions.IDTokenExpirationTime)
 
 	iniStr = `
@@ -215,6 +214,23 @@ func Test_getIDTokenSettingsForActions(t *testing.T) {
 	cfg, err = NewConfigProviderFromData(iniStr)
 	require.NoError(t, err)
 	err = loadActionsFrom(cfg)
-	require.ErrorContains(t, err,
-		fmt.Sprintf("invalid [actions] ID_TOKEN_SIGNING_ALGORITHM: %q", Actions.IDTokenSigningAlgorithm))
+	require.ErrorContains(t, err, "[actions] Unexpected algorithm: ID_TOKEN_SIGNING_ALGORITHM = HS256, needs to be one of [RS256 RS384 RS512 ES256 ES384 ES512 EdDSA]")
+
+	iniStr = `
+  [actions]
+	ID_TOKEN_SECRET = ABC
+	`
+	cfg, err = NewConfigProviderFromData(iniStr)
+	require.NoError(t, err)
+	err = loadActionsFrom(cfg)
+	require.ErrorContains(t, err, "[actions] Invalid config key: ID_TOKEN_SECRET - must be removed")
+
+	iniStr = `
+  [actions]
+	ID_TOKEN_SECRET_URI = ABC
+	`
+	cfg, err = NewConfigProviderFromData(iniStr)
+	require.NoError(t, err)
+	err = loadActionsFrom(cfg)
+	require.ErrorContains(t, err, "[actions] Invalid config key: ID_TOKEN_SECRET_URI - must be removed")
 }
diff --git a/modules/setting/authorized_integration.go b/modules/setting/authorized_integration.go
new file mode 100644
index 0000000000..0a84f44afe
--- /dev/null
+++ b/modules/setting/authorized_integration.go
@@ -0,0 +1,23 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package setting
+
+import "time"
+
+var AuthorizedIntegration = struct {
+	AllowedDomains     string
+	BlockedDomains     string
+	AllowLocalNetworks bool
+	RequestTimeout     time.Duration
+	CacheTTL           time.Duration
+}{}
+
+func loadAuthorizedIntegrationFrom(rootCfg ConfigProvider) {
+	sec := rootCfg.Section("authorized_integration")
+	AuthorizedIntegration.AllowedDomains = sec.Key("ALLOWED_DOMAINS").MustString("")
+	AuthorizedIntegration.BlockedDomains = sec.Key("BLOCKED_DOMAINS").MustString("")
+	AuthorizedIntegration.AllowLocalNetworks = sec.Key("ALLOW_LOCALNETWORKS").MustBool(false)
+	AuthorizedIntegration.RequestTimeout = sec.Key("REQUEST_TIMEOUT").MustDuration(10 * time.Second)
+	AuthorizedIntegration.CacheTTL = sec.Key("CACHE_TTL").MustDuration(10 * time.Minute)
+}
diff --git a/modules/setting/lfs.go b/modules/setting/lfs.go
index 452bfae737..a97ed8d40f 100644
--- a/modules/setting/lfs.go
+++ b/modules/setting/lfs.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"time"
 
-	"forgejo.org/modules/generate"
+	"forgejo.org/modules/jwtx"
 )
 
 // LFS represents the server-side configuration for Git LFS.
@@ -16,13 +16,13 @@ import (
 // Could be refactored in the future while keeping backwards compatibility.
 var LFS = struct {
 	StartServer    bool          `ini:"LFS_START_SERVER"`
-	JWTSecretBytes []byte        `ini:"-"`
 	HTTPAuthExpiry time.Duration `ini:"LFS_HTTP_AUTH_EXPIRY"`
 	MaxFileSize    int64         `ini:"LFS_MAX_FILE_SIZE"`
 	LocksPagingNum int           `ini:"LFS_LOCKS_PAGING_NUM"`
 	MaxBatchSize   int           `ini:"LFS_MAX_BATCH_SIZE"`
 
-	Storage *Storage
+	SigningKey jwtx.SigningKey
+	Storage    *Storage
 }{}
 
 // LFSClient represents configuration for Gitea's LFS clients, for example: mirroring upstream Git LFS
@@ -77,21 +77,12 @@ func loadLFSFrom(rootCfg ConfigProvider) error {
 		return nil
 	}
 
-	jwtSecretBase64 := loadSecret(rootCfg.Section("server"), "LFS_JWT_SECRET_URI", "LFS_JWT_SECRET")
-	LFS.JWTSecretBytes, err = generate.DecodeJwtSecret(jwtSecretBase64)
+	keyCfg, err := loadKeyCfg(rootCfg, "server", "LFS_JWT_", "HS256", "lfs/private.pem")
+	if err == nil {
+		LFS.SigningKey, err = jwtx.InitSigningKey(&keyCfg.Signing)
+	}
 	if err != nil {
-		LFS.JWTSecretBytes, jwtSecretBase64 = generate.NewJwtSecret()
-
-		// Save secret
-		saveCfg, err := rootCfg.PrepareSaving()
-		if err != nil {
-			return fmt.Errorf("error saving JWT Secret for custom config: %v", err)
-		}
-		rootCfg.Section("server").Key("LFS_JWT_SECRET").SetValue(jwtSecretBase64)
-		saveCfg.Section("server").Key("LFS_JWT_SECRET").SetValue(jwtSecretBase64)
-		if err := saveCfg.Save(); err != nil {
-			return fmt.Errorf("error saving JWT Secret for custom config: %v", err)
-		}
+		return fmt.Errorf("lfs key initialization failed: %v", err)
 	}
 
 	return nil
diff --git a/modules/setting/oauth2.go b/modules/setting/oauth2.go
index 9e95e1c6a9..8598b7b24d 100644
--- a/modules/setting/oauth2.go
+++ b/modules/setting/oauth2.go
@@ -5,10 +5,10 @@ package setting
 
 import (
 	"math"
-	"path/filepath"
 	"sync/atomic"
 
 	"forgejo.org/modules/generate"
+	"forgejo.org/modules/jwtx"
 	"forgejo.org/modules/log"
 )
 
@@ -96,18 +96,15 @@ var OAuth2 = struct {
 	AccessTokenExpirationTime   int64
 	RefreshTokenExpirationTime  int64
 	InvalidateRefreshTokens     bool
-	JWTSigningAlgorithm         string `ini:"JWT_SIGNING_ALGORITHM"`
-	JWTSigningPrivateKeyFile    string `ini:"JWT_SIGNING_PRIVATE_KEY_FILE"`
 	MaxTokenLength              int
 	DefaultApplications         []string
 	EnableAdditionalGrantScopes bool
+	KeyCfg                      *jwtx.KeyCfg
 }{
 	Enabled:                     true,
 	AccessTokenExpirationTime:   3600,
 	RefreshTokenExpirationTime:  730,
 	InvalidateRefreshTokens:     true,
-	JWTSigningAlgorithm:         "RS256",
-	JWTSigningPrivateKeyFile:    "jwt/private.pem",
 	MaxTokenLength:              math.MaxInt16,
 	DefaultApplications:         []string{"git-credential-oauth", "git-credential-manager", "tea"},
 	EnableAdditionalGrantScopes: false,
@@ -126,30 +123,26 @@ func loadOAuth2From(rootCfg ConfigProvider) {
 		OAuth2.Enabled = sec.Key("ENABLE").MustBool(OAuth2.Enabled)
 	}
 
-	if !filepath.IsAbs(OAuth2.JWTSigningPrivateKeyFile) {
-		OAuth2.JWTSigningPrivateKeyFile = filepath.Join(AppDataPath, OAuth2.JWTSigningPrivateKeyFile)
-	}
-
 	// FIXME: at the moment, no matter oauth2 is enabled or not, it must generate a "oauth2 JWT_SECRET"
 	// Because this secret is also used as GeneralTokenSigningSecret (as a quick not-that-breaking fix for some legacy problems).
 	// Including: CSRF token, account validation token, etc ...
 	// In main branch, the signing token should be refactored (eg: one unique for LFS/OAuth2/etc ...)
-	jwtSecretBase64 := loadSecret(sec, "JWT_SECRET_URI", "JWT_SECRET")
 	if InstallLock {
-		jwtSecretBytes, err := generate.DecodeJwtSecret(jwtSecretBase64)
+		signingKey, err := loadSymmeticSigningKeyCfg(rootCfg, sec, "JWT_")
 		if err != nil {
-			jwtSecretBytes, jwtSecretBase64 = generate.NewJwtSecret()
-			saveCfg, err := rootCfg.PrepareSaving()
-			if err != nil {
-				log.Fatal("save oauth2.JWT_SECRET failed: %v", err)
-			}
-			rootCfg.Section("oauth2").Key("JWT_SECRET").SetValue(jwtSecretBase64)
-			saveCfg.Section("oauth2").Key("JWT_SECRET").SetValue(jwtSecretBase64)
-			if err := saveCfg.Save(); err != nil {
-				log.Fatal("save oauth2.JWT_SECRET failed: %v", err)
-			}
+			log.Fatal("%v", err)
 		}
-		generalSigningSecret.Store(&jwtSecretBytes)
+		generalSigningSecret.Store(signingKey)
+	}
+
+	if !OAuth2.Enabled {
+		return
+	}
+
+	var err error
+	OAuth2.KeyCfg, err = loadKeyCfg(rootCfg, "oauth2", "JWT_", "RS256", "jwt/private.pem")
+	if err != nil {
+		log.Fatal("oauth2 key initialization failed: %v", err)
 	}
 }
 
diff --git a/modules/setting/security.go b/modules/setting/security.go
index e00a6af0ee..586989101d 100644
--- a/modules/setting/security.go
+++ b/modules/setting/security.go
@@ -4,12 +4,15 @@
 package setting
 
 import (
+	"fmt"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"forgejo.org/modules/auth/password/hash"
 	"forgejo.org/modules/generate"
+	"forgejo.org/modules/jwtx"
 	"forgejo.org/modules/keying"
 	"forgejo.org/modules/log"
 )
@@ -39,6 +42,31 @@ var (
 	DisableQueryAuthToken              bool
 )
 
+/*
+ * key loading is a two-stage process to avoid complications for unit tests:
+ *
+ * For symmetric keys, we want to add a random key to the configuration. We would
+ * not want to change the configuration after loading has completed to maintain
+ * isolation. So from this perspective, we would want to initialize keys only
+ * during setting.load...From()
+ *
+ * For asymmetric keys, we want to create a random private key _file_.
+ * Doing so during the setting load phase, however, creates key files for unit
+ * tests, because they usually complete the full settings load phase, but do not
+ * initialize modules which they do not need. Depending on the test case, it
+ * might not provide a writable AppDataPath, or it would leave private key files
+ * in the source tree. All of this can be avoided with
+ * specifically adjusting the ini loaded for unit tests, but adds considerable
+ * friction.
+ *
+ * So to avoid all this, we split key loading in two phases:
+ * - settings parse the config and save missing symmetric keys
+ * - module init takes the parsed config, creates missing asymmetric keys and
+ *   creates the actual signingkey objects
+ *
+ * jwtx.SigningKeyCfg and jwtx.KeyCfg are used for handover
+ */
+
 // loadSecret load the secret from ini by uriKey or verbatimKey, only one of them could be set
 // If the secret is loaded from uriKey (file), the file should be non-empty, to guarantee the behavior stable and clear.
 func loadSecret(sec ConfigSection, uriKey, verbatimKey string) string {
@@ -53,16 +81,29 @@ func loadSecret(sec ConfigSection, uriKey, verbatimKey string) string {
 	if uri == "" {
 		return verbatim
 	}
+	verbatim, err := loadSecretFromURI(uri)
+	if err == nil {
+		return verbatim
+	}
+	log.Fatal("%s: %w", uriKey, err)
+	// unreached
+	return ""
+}
 
+func loadSecretFromURI(uri string) (string, error) {
 	tempURI, err := url.Parse(uri)
 	if err != nil {
-		log.Fatal("Failed to parse %s (%s): %v", uriKey, uri, err)
+		return "", fmt.Errorf("Failed to parse %s: %v", uri, err)
 	}
 	switch tempURI.Scheme {
 	case "file":
-		buf, err := os.ReadFile(tempURI.RequestURI())
+		path := tempURI.RequestURI()
+		if !filepath.IsAbs(path) {
+			path = filepath.Join(AppDataPath, path)
+		}
+		buf, err := os.ReadFile(path)
 		if err != nil {
-			log.Fatal("Failed to read %s (%s): %v", uriKey, tempURI.RequestURI(), err)
+			return "", fmt.Errorf("Failed to read %s: %v", path, err)
 		}
 		val := strings.TrimSpace(string(buf))
 		if val == "" {
@@ -70,17 +111,135 @@ func loadSecret(sec ConfigSection, uriKey, verbatimKey string) string {
 			// For example: if INTERNAL_TOKEN_URI=file:///empty-file,
 			// Then if the token is re-generated during installation and saved to INTERNAL_TOKEN
 			// Then INTERNAL_TOKEN and INTERNAL_TOKEN_URI both exist, that's a fatal error (they shouldn't)
-			log.Fatal("Failed to read %s (%s): the file is empty", uriKey, tempURI.RequestURI())
+			return "", fmt.Errorf("Failed to read %s: the file is empty", path)
 		}
-		return val
+		return val, nil
 
 	// only file URIs are allowed
 	default:
-		log.Fatal("Unsupported URI-Scheme %q (%q = %q)", tempURI.Scheme, uriKey, uri)
-		return ""
+		return "", fmt.Errorf("Unsupported URI-Scheme %q in %q", tempURI.Scheme, uri)
 	}
 }
 
+// createSymmeticSigningKey creates a new symmetric signing key and saves it to
+// the setting named cfgSecret (usually [PFX_]SECRET) in section cfgSection
+func createSymmeticSigningKeyCfg(rootCfg ConfigProvider, cfgSection, cfgSecret string) (*[]byte, error) {
+	jwtSecretBytes, jwtSecretBase64 := generate.NewJwtSecret()
+	saveCfg, err := rootCfg.PrepareSaving()
+	if err == nil {
+		rootCfg.Section(cfgSection).Key(cfgSecret).SetValue(jwtSecretBase64)
+		saveCfg.Section(cfgSection).Key(cfgSecret).SetValue(jwtSecretBase64)
+		err = saveCfg.Save()
+	}
+	if err != nil {
+		return nil, fmt.Errorf("save %s.%s failed: %v", cfgSection, cfgSecret, err)
+	}
+	return &jwtSecretBytes, nil
+}
+
+// loadSymmeticSigningKey loads a signing key and creates it unless present
+// loads from [pfx]SECRET_URI
+// loads from or saves to [pfx]SECRET
+// in section sec
+func loadSymmeticSigningKeyCfg(rootCfg ConfigProvider, sec ConfigSection, pfx string) (*[]byte, error) {
+	cfgSecretURI := pfx + "SECRET_URI"
+	cfgSecret := pfx + "SECRET"
+
+	secretBase64 := loadSecret(sec, cfgSecretURI, cfgSecret)
+	secret, err := generate.DecodeJwtSecret(secretBase64)
+	if err == nil {
+		return &secret, nil
+	}
+
+	log.Info("[%s] %s or %s failed loading: %v - creating new key", sec.Name(), cfgSecret, cfgSecretURI, err)
+	return createSymmeticSigningKeyCfg(rootCfg, sec.Name(), cfgSecret)
+}
+
+// loadAsymmeticSigningKey loads a signing key from [pfx]SIGNING_PRIVATE_KEY_FILE
+// or creates it if it does not exist
+func loadAsymmeticSigningKeyPath(sec ConfigSection, pfx, defaultFile string) *string {
+	cfgFile := pfx + "SIGNING_PRIVATE_KEY_FILE"
+	keyPath := sec.Key(cfgFile).MustString(defaultFile)
+	if !filepath.IsAbs(keyPath) {
+		keyPath = filepath.Join(AppDataPath, keyPath)
+	}
+	return &keyPath
+}
+
+type checkKeyCfg func(rootCfg ConfigProvider, cfgSection, pfx string) error
+
+func onlyAsymmetric() checkKeyCfg {
+	return func(rootCfg ConfigProvider, cfgSection, pfx string) error {
+		sec := rootCfg.Section(cfgSection)
+		cfgAlg := pfx + "SIGNING_ALGORITHM"
+
+		if sec.HasKey(cfgAlg) {
+			alg := sec.Key(cfgAlg).String()
+			if !jwtx.IsValidAsymmetricAlgorithm(alg) {
+				return fmt.Errorf("Unexpected algorithm: %s = %s, needs to be one of %v",
+					cfgAlg, alg, jwtx.ValidAsymmetricAlgorithms)
+			}
+		}
+
+		noCfg := []string{
+			pfx + "SECRET_URI",
+			pfx + "SECRET",
+		}
+
+		for _, cfg := range noCfg {
+			if sec.HasKey(cfg) {
+				return fmt.Errorf("Invalid config key: %s - must be removed", cfg)
+			}
+		}
+
+		return nil
+	}
+}
+
+// loadSigningKey() loads a or creates signing key based on settings in section cfgSection
+// [pfx]SIGNING_ALGORITHM determines the algorithm
+// [pfx]SECRET is a literal secret for symmetric algorithms
+// [pfx]SECRET_URI is the uri of a secret for symmetric algorithms
+// [pfx]SIGNING_PRIVATE_KEY_FILE is a file with a private key for asymmetric algorithms
+//
+// [pfx]SECRET might get written to literally in the config if needed but not present
+
+func loadSigningKeyCfg(rootCfg ConfigProvider, cfgSection, pfx, defaultAlg, defaultPrivateKeyFile string, checks ...checkKeyCfg) (*jwtx.SigningKeyCfg, error) {
+	for _, check := range checks {
+		err := check(rootCfg, cfgSection, pfx)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	sec := rootCfg.Section(cfgSection)
+	cfgAlg := pfx + "SIGNING_ALGORITHM"
+
+	algorithm := sec.Key(cfgAlg).MustString(defaultAlg)
+
+	cfg := jwtx.SigningKeyCfg{Algorithm: algorithm}
+	var err error
+
+	if jwtx.IsValidSymmetricAlgorithm(algorithm) {
+		cfg.SecretBytes, err = loadSymmeticSigningKeyCfg(rootCfg, sec, pfx)
+	} else if jwtx.IsValidAsymmetricAlgorithm(algorithm) {
+		cfg.PrivateKeyPath = loadAsymmeticSigningKeyPath(sec, pfx, defaultPrivateKeyFile)
+	} else {
+		err = fmt.Errorf("invalid algorithm: %s = %s", cfgAlg, algorithm)
+	}
+
+	return &cfg, err
+}
+
+func loadKeyCfg(rootCfg ConfigProvider, cfgSection, pfx, defaultAlg, defaultPrivateKeyFile string, checks ...checkKeyCfg) (*jwtx.KeyCfg, error) {
+	signing, err := loadSigningKeyCfg(rootCfg, cfgSection, pfx, defaultAlg, defaultPrivateKeyFile, checks...)
+	if err != nil {
+		err = fmt.Errorf("[%s] %v", cfgSection, err)
+		return nil, err
+	}
+	return &jwtx.KeyCfg{Signing: signing}, nil
+}
+
 // generateSaveInternalToken generates and saves the internal token to app.ini
 func generateSaveInternalToken(rootCfg ConfigProvider) {
 	token, err := generate.NewInternalToken()
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index fac6e54fb1..bd3dec1f84 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -119,8 +119,8 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 
 	mustCurrentRunUserMatch(cfg) // it depends on the SSH config, only non-builtin SSH server requires this check
 
-	loadOAuth2From(cfg)
 	loadSecurityFrom(cfg)
+	loadOAuth2From(cfg)
 	if err := loadAttachmentFrom(cfg); err != nil {
 		return err
 	}
@@ -226,6 +226,7 @@ func LoadSettings() {
 	loadProjectFrom(CfgProvider)
 	loadMimeTypeMapFrom(CfgProvider)
 	loadF3From(CfgProvider)
+	loadAuthorizedIntegrationFrom(CfgProvider)
 }
 
 // LoadSettingsForInstall initializes the settings for install
diff --git a/modules/setting/ui.go b/modules/setting/ui.go
index 61378e0596..abe902dfc6 100644
--- a/modules/setting/ui.go
+++ b/modules/setting/ui.go
@@ -55,10 +55,12 @@ var UI = struct {
 	} `ini:"ui.csv"`
 
 	Admin struct {
-		UserPagingNum   int
-		RepoPagingNum   int
-		NoticePagingNum int
-		OrgPagingNum    int
+		UserPagingNum           int
+		RepoPagingNum           int
+		NoticePagingNum         int
+		OrgPagingNum            int
+		FederationHostPagingNum int
+		FederationUserPagingNum int
 	} `ini:"ui.admin"`
 	User struct {
 		RepoPagingNum int
@@ -114,15 +116,19 @@ var UI = struct {
 		MaxRows:     2500,
 	},
 	Admin: struct {
-		UserPagingNum   int
-		RepoPagingNum   int
-		NoticePagingNum int
-		OrgPagingNum    int
+		UserPagingNum           int
+		RepoPagingNum           int
+		NoticePagingNum         int
+		OrgPagingNum            int
+		FederationHostPagingNum int
+		FederationUserPagingNum int
 	}{
-		UserPagingNum:   50,
-		RepoPagingNum:   50,
-		NoticePagingNum: 25,
-		OrgPagingNum:    50,
+		UserPagingNum:           50,
+		RepoPagingNum:           50,
+		NoticePagingNum:         25,
+		OrgPagingNum:            50,
+		FederationHostPagingNum: 50,
+		FederationUserPagingNum: 50,
 	},
 	User: struct {
 		RepoPagingNum int
diff --git a/modules/storage/storage.go b/modules/storage/storage.go
index db081e0768..fe9222060f 100644
--- a/modules/storage/storage.go
+++ b/modules/storage/storage.go
@@ -164,6 +164,7 @@ func initLFS() (err error) {
 		LFS = DiscardStorage("LFS isn't enabled")
 		return nil
 	}
+
 	log.Info("Initialising LFS storage with type: %s", setting.LFS.Storage.Type)
 	LFS, err = NewStorage(setting.LFS.Storage.Type, setting.LFS.Storage)
 	return err
diff --git a/modules/structs/action.go b/modules/structs/action.go
index cb6d76f3e3..82c530cdf9 100644
--- a/modules/structs/action.go
+++ b/modules/structs/action.go
@@ -12,6 +12,8 @@ import (
 type ActionRunJob struct {
 	// Identifier of this job.
 	ID int64 `json:"id"`
+	// Identifier of the workflow run this job belongs to.
+	RunID int64 `json:"run_id"`
 	// How many times the job has been attempted including the current attempt.
 	Attempt int64 `json:"attempt"`
 	// Opaque identifier that uniquely identifies a single attempt of a job.
@@ -88,3 +90,26 @@ type ListActionRunResponse struct {
 	Entries    []*ActionRun `json:"workflow_runs"`
 	TotalCount int64        `json:"total_count"`
 }
+
+// ActionArtifact represents an artifact of a workflow run
+// swagger:model
+type ActionArtifact struct {
+	// the artifact's ID
+	ID int64 `json:"id"`
+	// the artifact's name
+	Name string `json:"name"`
+	// the total size of the artifact in bytes
+	SizeInBytes int64 `json:"size_in_bytes"`
+	// the URL to download the artifact zip archive
+	ArchiveDownloadURL string `json:"archive_download_url"`
+	// whether the artifact has expired
+	Expired bool `json:"expired"`
+	// the ID of the workflow run that produced this artifact
+	RunID int64 `json:"run_id"`
+	// swagger:strfmt date-time
+	CreatedAt time.Time `json:"created_at"`
+	// swagger:strfmt date-time
+	UpdatedAt time.Time `json:"updated_at"`
+	// swagger:strfmt date-time
+	ExpiresAt time.Time `json:"expires_at"`
+}
diff --git a/modules/templates/helper.go b/modules/templates/helper.go
index a6235c37ba..44f5da24cb 100644
--- a/modules/templates/helper.go
+++ b/modules/templates/helper.go
@@ -52,16 +52,17 @@ func NewFuncMap() template.FuncMap {
 
 		// -----------------------------------------------------------------
 		// html/template related functions
-		"dict":         dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
-		"Eval":         Eval,
-		"TrustHTML":    TrustHTML,
-		"HTMLFormat":   HTMLFormat,
-		"HTMLEscape":   HTMLEscape,
-		"QueryEscape":  QueryEscape,
-		"JSEscape":     JSEscapeSafe,
-		"SanitizeHTML": SanitizeHTML,
-		"URLJoin":      util.URLJoin,
-		"DotEscape":    DotEscape,
+		"dict":               dict, // it's lowercase because this name has been widely used. Our other functions should have uppercase names.
+		"Eval":               Eval,
+		"TrustHTML":          TrustHTML,
+		"HTMLFormat":         HTMLFormat,
+		"HTMLEscape":         HTMLEscape,
+		"QueryEscape":        QueryEscape,
+		"JSEscape":           JSEscapeSafe,
+		"SanitizeHTML":       SanitizeHTML,
+		"SanitizeHTMLStrict": SanitizeHTMLStrict,
+		"URLJoin":            util.URLJoin,
+		"DotEscape":          DotEscape,
 
 		"PathEscape":         url.PathEscape,
 		"PathEscapeSegments": util.PathEscapeSegments,
@@ -257,6 +258,10 @@ func SanitizeHTML(s string) template.HTML {
 	return template.HTML(markup.Sanitize(s))
 }
 
+func SanitizeHTMLStrict(s string) template.HTML {
+	return template.HTML(markup.SanitizeDescription(s))
+}
+
 func HTMLEscape(s any) template.HTML {
 	switch v := s.(type) {
 	case string:
diff --git a/modules/test/distant_federation_server_mock.go b/modules/test/distant_federation_server_mock.go
index ea8a69e9b4..abbc82c196 100644
--- a/modules/test/distant_federation_server_mock.go
+++ b/modules/test/distant_federation_server_mock.go
@@ -4,29 +4,38 @@
 package test
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 
 	"forgejo.org/modules/util"
+
+	ap "github.com/go-ap/activitypub"
+	"github.com/go-ap/jsonld"
+	"github.com/google/uuid"
 )
 
+type ApActorMock struct {
+	PrivKey string
+	PubKey  string
+}
+
 type FederationServerMockPerson struct {
 	ID      int64
 	Name    string
 	PubKey  string
 	PrivKey string
 }
+
 type FederationServerMockRepository struct {
 	ID int64
 }
-type ApActorMock struct {
-	PrivKey string
-	PubKey  string
-}
+
 type FederationServerMock struct {
 	ApActor      ApActorMock
 	Persons      []FederationServerMockPerson
@@ -34,6 +43,35 @@ type FederationServerMock struct {
 	LastPost     string
 }
 
+func NewApActorMock() ApActorMock {
+	priv, pub, _ := util.GenerateKeyPair(1024)
+	return ApActorMock{
+		PrivKey: priv,
+		PubKey:  pub,
+	}
+}
+
+func (u *ApActorMock) KeyID(host string) string {
+	return fmt.Sprintf("%s/api/v1/activitypub/actor#main-key", host)
+}
+
+func (u *ApActorMock) marshal(host string) string {
+	baseID := fmt.Sprintf("http://%s/api/v1/activitypub/actor", host)
+
+	return fmt.Sprintf(
+		`{ "@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],`+
+			`"id": "%[1]s",`+
+			`"type": "Application",`+
+			`"preferredUsername": "ghost",`+
+			`"publicKey": {`+
+			` "id": "%[1]s#main-key",`+
+			` "owner": "%[1]s",`+
+			` "publicKeyPem": %[2]q }}`,
+		baseID,
+		u.PubKey,
+	)
+}
+
 func NewFederationServerMockPerson(id int64, name string) FederationServerMockPerson {
 	priv, pub, _ := util.GenerateKeyPair(3072)
 	return FederationServerMockPerson{
@@ -48,24 +86,6 @@ func (p *FederationServerMockPerson) KeyID(host string) string {
 	return fmt.Sprintf("%[1]v/api/v1/activitypub/user-id/%[2]v#main-key", host, p.ID)
 }
 
-func NewFederationServerMockRepository(id int64) FederationServerMockRepository {
-	return FederationServerMockRepository{
-		ID: id,
-	}
-}
-
-func NewApActorMock() ApActorMock {
-	priv, pub, _ := util.GenerateKeyPair(1024)
-	return ApActorMock{
-		PrivKey: priv,
-		PubKey:  pub,
-	}
-}
-
-func (u *ApActorMock) KeyID(host string) string {
-	return fmt.Sprintf("%[1]v/api/v1/activitypub/actor#main-key", host)
-}
-
 func (p FederationServerMockPerson) marshal(host string) string {
 	return fmt.Sprintf(`{"@context":["https://www.w3.org/ns/activitystreams","https://w3id.org/security/v1"],`+
 		`"id":"http://%[1]v/api/v1/activitypub/user-id/%[2]v",`+
@@ -80,6 +100,12 @@ func (p FederationServerMockPerson) marshal(host string) string {
 		`"publicKeyPem":%[4]q}}`, host, p.ID, p.Name, p.PubKey)
 }
 
+func NewFederationServerMockRepository(id int64) FederationServerMockRepository {
+	return FederationServerMockRepository{
+		ID: id,
+	}
+}
+
 func NewFederationServerMock() *FederationServerMock {
 	return &FederationServerMock{
 		ApActor: NewApActorMock(),
@@ -103,6 +129,26 @@ func (mock *FederationServerMock) recordLastPost(t *testing.T, req *http.Request
 	mock.LastPost = strings.ReplaceAll(buf.String(), req.Host, "DISTANT_FEDERATION_HOST")
 }
 
+func (mock *FederationServerMock) FollowActorUnsigned(host string, localID int64, uri, inboxURL url.URL) error {
+	apID := fmt.Sprintf("%s/api/v1/activitypub/user-id/%d", host, localID)
+
+	activity := ap.Follow{}
+	activity.Type = ap.FollowType
+	activity.ID = ap.IRI(apID + "/follows/" + uuid.New().String())
+	activity.Actor = ap.IRI(apID)
+	activity.Object = ap.IRI(uri.String())
+
+	payload, err := jsonld.WithContext(jsonld.IRI(ap.ActivityBaseURI)).Marshal(activity)
+	if err != nil {
+		return err
+	}
+
+	reader := bytes.NewReader(payload)
+	_, err = http.Post(inboxURL.String(), "application/activity+json", reader)
+
+	return err
+}
+
 func (mock *FederationServerMock) DistantServer(t *testing.T) *httptest.Server {
 	federatedRoutes := http.NewServeMux()
 
@@ -122,6 +168,10 @@ func (mock *FederationServerMock) DistantServer(t *testing.T) *httptest.Server {
 		})
 
 	for _, person := range mock.Persons {
+		federatedRoutes.HandleFunc(fmt.Sprintf("/api/v1/activitypub/user-id/alias%v", person.ID),
+			func(res http.ResponseWriter, req *http.Request) {
+				fmt.Fprint(res, person.marshal(req.Host))
+			})
 		federatedRoutes.HandleFunc(fmt.Sprintf("/api/v1/activitypub/user-id/%v", person.ID),
 			func(res http.ResponseWriter, req *http.Request) {
 				// curl -H "Accept: application/json" https://federated-repo.prod.meissa.de/api/v1/activitypub/user-id/2
@@ -139,10 +189,18 @@ func (mock *FederationServerMock) DistantServer(t *testing.T) *httptest.Server {
 				mock.recordLastPost(t, req)
 			})
 	}
+
+	federatedRoutes.HandleFunc("GET /api/v1/activitypub/actor",
+		func(res http.ResponseWriter, req *http.Request) {
+			fmt.Fprint(res, mock.ApActor.marshal(req.Host))
+		})
+
 	federatedRoutes.HandleFunc("/",
 		func(res http.ResponseWriter, req *http.Request) {
 			t.Errorf("Unhandled %v request: %q", req.Method, req.URL.EscapedPath())
 		})
+
 	federatedSrv := httptest.NewServer(federatedRoutes)
+
 	return federatedSrv
 }
diff --git a/modules/util/util.go b/modules/util/util.go
index f21936fb5f..996a566830 100644
--- a/modules/util/util.go
+++ b/modules/util/util.go
@@ -215,11 +215,6 @@ func ToFloat64(number any) (float64, error) {
 	return value, nil
 }
 
-// ToPointer returns the pointer of a copy of any given value
-func ToPointer[T any](val T) *T {
-	return &val
-}
-
 // Iif is an "inline-if", it returns "trueVal" if "condition" is true, otherwise "falseVal"
 func Iif[T any](condition bool, trueVal, falseVal T) T {
 	if condition {
diff --git a/modules/util/util_test.go b/modules/util/util_test.go
index 24fca75e7b..fae4f6673d 100644
--- a/modules/util/util_test.go
+++ b/modules/util/util_test.go
@@ -5,10 +5,10 @@
 package util_test
 
 import (
-	"bytes"
 	"crypto/rand"
 	"strings"
 	"testing"
+	"testing/cryptotest"
 
 	"forgejo.org/modules/test"
 	"forgejo.org/modules/util"
@@ -211,42 +211,25 @@ func TestToTitleCase(t *testing.T) {
 	assert.Equal(t, `Foo Bar Baz`, util.ToTitleCase(`FOO BAR BAZ`))
 }
 
-func TestToPointer(t *testing.T) {
-	assert.Equal(t, "abc", *util.ToPointer("abc"))
-	assert.Equal(t, 123, *util.ToPointer(123))
-	abc := "abc"
-	assert.NotSame(t, &abc, util.ToPointer(abc))
-	val123 := 123
-	assert.NotSame(t, &val123, util.ToPointer(val123))
-}
-
 func TestReserveLineBreakForTextarea(t *testing.T) {
 	assert.Equal(t, "test\ndata", util.ReserveLineBreakForTextarea("test\r\ndata"))
 	assert.Equal(t, "test\ndata\n", util.ReserveLineBreakForTextarea("test\r\ndata\r\n"))
 }
 
 const (
-	testPublicKey  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOhB7/zzhC+HXDdGOdLwJln5NYwm6UNXx3chmQSVTG4\n"
+	testPublicKey  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHX8yEKexoMqBPPwG4pGAhhjo5CyiHLiJZ7p3jg0aJZM\n"
 	testPrivateKey = `-----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtz
-c2gtZWQyNTUxOQAAACADoQe/884Qvh1w3RjnS8CZZ+TWMJulDV8d3IZkElUxuAAA
-AIggISIjICEiIwAAAAtzc2gtZWQyNTUxOQAAACADoQe/884Qvh1w3RjnS8CZZ+TW
-MJulDV8d3IZkElUxuAAAAEAAAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0e
-HwOhB7/zzhC+HXDdGOdLwJln5NYwm6UNXx3chmQSVTG4AAAAAAECAwQF
+c2gtZWQyNTUxOQAAACB1/MhCnsaDKgTz8BuKRgIYY6OQsohy4iWe6d44NGiWTAAA
+AIhNLlZvTS5WbwAAAAtzc2gtZWQyNTUxOQAAACB1/MhCnsaDKgTz8BuKRgIYY6OQ
+sohy4iWe6d44NGiWTAAAAEDZh37ObTaKrBpvQZ7GJ8drG/sfo3xBoR6kat1qSNiU
+dHX8yEKexoMqBPPwG4pGAhhjo5CyiHLiJZ7p3jg0aJZMAAAAAAECAwQF
 -----END OPENSSH PRIVATE KEY-----` + "\n"
 )
 
 func TestGeneratingEd25519Keypair(t *testing.T) {
 	defer test.MockProtect(&rand.Reader)()
-
-	// Only 32 bytes needs to be provided to generate a ed25519 keypair.
-	// And another 32 bytes are required, which is included as random value
-	// in the OpenSSH format.
-	b := make([]byte, 64)
-	for i := range 64 {
-		b[i] = byte(i)
-	}
-	rand.Reader = bytes.NewReader(b)
+	cryptotest.SetGlobalRandom(t, 0)
 
 	publicKey, privateKey, err := util.GenerateSSHKeypair()
 	require.NoError(t, err)
diff --git a/modules/validation/validatable.go b/modules/validation/validatable.go
index 1751e727f3..6c58a9148e 100644
--- a/modules/validation/validatable.go
+++ b/modules/validation/validatable.go
@@ -70,6 +70,8 @@ func ValidateNotEmpty(value any, name string) []string {
 		if v == 0 {
 			isValid = false
 		}
+	case ap.Typer:
+		isValid = len(value.(ap.Typer).AsTypes()) > 0
 	default:
 		isValid = false
 	}
diff --git a/options/locale/locale_ar.ini b/options/locale/locale_ar.ini
index 5e9808d2f0..587ec0490c 100644
--- a/options/locale/locale_ar.ini
+++ b/options/locale/locale_ar.ini
@@ -1,9 +1,7 @@
 [common]
 language = لغة
 passcode = رمز المرور
-webauthn_error_timeout = طال وقت الوصول قبل أن يُقرأ مفتاحك. من فضلك أعد تحميل الصفحة وحاول مجدداً.
 cancel = ألغِ
-webauthn_sign_in = اضغط الزر على مفتاحك الأمني إذا لم يكن لدى مفتاح الأمن الخاص بك أي زر، إعادة تشغيله.
 captcha = كابتشا
 create_new = أنشئ…
 preview = عاين
@@ -22,7 +20,6 @@ mirrors = المرايا
 explore = إكتشف
 return_to_forgejo = العودة إلى فورجيو
 write = اكتب
-webauthn_error_unknown = حدث خطأ غير معروف. من فضلك حاول مجدداً.
 twofa = المصادقة الثنائية
 version = الإصدار
 copy_success = تم النسخ!
@@ -30,14 +27,12 @@ help = مساعدة
 loading = جارٍ التحميل…
 copy_type_unsupported = هذا النوع من الملفات لا يمكن نسخه
 pin = ثبّت
-webauthn_error_empty = يلزم أن تضع اسم لهذا المفتاح.
 confirm_delete_selected = تأكيد حذف جميع العناصر المحددة؟
 name = الاسم
 artifacts = الآثار
 sign_in_or = أو
 show_log_seconds = إظهار الثواني
 show_full_screen = املأ الشاشة
-webauthn_use_twofa = استخدم رمز المصادقة الموجود على هاتفك
 unpin = ألغِ التثبيت
 edit = حرر
 concept_code_repository = المستودع
@@ -60,12 +55,10 @@ admin_panel = إدارة الموقع
 copy_error = فشل النسخ
 new_mirror = مرآة جديدة
 re_type = تأكيد كلمة المرور
-webauthn_unsupported_browser = متصفحك لا يدعم ويب آوثن حالياً.
 copy = انسخ
 enabled = مُفَعَّل
 rerun = أعِد التشغيل
 milestones = أهداف
-webauthn_error_insecure = ويب آوثن يدعم فقط الاتصالات الآمنة. للاختبار على HTTP، يمكنك استخدام "localhost" أو "127.0.0.1"
 show_timestamps = إظهار الطوابع الزمنية
 rss_feed = موجز RSS
 never = أبدًا
@@ -79,7 +72,6 @@ sources = المصادر
 notifications = التنبيهات
 pull_requests = طلبات السحب
 repository = مستودع
-webauthn_error = تعذر قراءة مفتاحك الأمني.
 add_all = أضف الكل
 new_fork = اشتقاق جديد لمستودع
 new_project_column = عمود جديد
@@ -89,17 +81,13 @@ organization = منظمة
 save = احفظ
 sign_in_with_provider = سجل الدخول بـ %s
 ok = وافق
-webauthn_error_unable_to_process = الخادم لا يمكنه معالجة طلبك.
 register = سجل
 mirror = مرآة
 username = إسم المستخدم
 access_token = رمز الوصول
 download_logs = تنزيل السجلات
-webauthn_insert_key = أدخل مفتاحك الأمني
 password = كلمة المرور
-webauthn_error_duplicated = المفتاح الأمني غير مسموح له هذا الطلب. يرجى التأكد من أن المفتاح غير مسجل بالفعل.
 template = قالب
-webauthn_press_button = من فضلك اضغط الزر على مفتاحك الأمني…
 unknown = مجهول
 signed_in_as = مسجل كـ
 sign_up = سجل
@@ -722,12 +710,9 @@ issues.blocked_by_user = لا يمكنك أن ترسل مسألة في هذا ا
 mirror_sync = متزامن
 settings.archive.mirrors_unavailable = المرايا ليست متاحة إذا تم أرشفة المستودع.
 pulls.blocked_by_user = لا يمكنك أن ترسل طلب سحب في هذا المستودع لأنك محظور من قبل مالك المستودع.
-migrate.migrating_milestones = ترحيل الأهداف
-migrate_items_milestones = أهداف
 repo_size = حجم المستودع
 object_format = تنسيق الكائنات
 use_template = استخدم هذا القالب
-migrate_items_merge_requests = طلبات الدمج
 repo_name = اسم المستودع
 template = القالب
 projects.modify = عدّل المشروع
@@ -745,23 +730,19 @@ template.git_hooks = خطاطيف Git
 template_description = المستودع القالب هو مستودع يستخدمه المستخدمون لتوليد مستودعات جديدة لها الإعدادات والملفات وهيكلة المجلدات نفسها.
 projects.edit = عدّل المشروع
 template.avatar = الصورة الرمزية
-migrate_items_wiki = الموسوعة
 repo_desc = الوصف
 template_select = اختر قالبا
 repo_name_helper = الأسماء الحسنة للمستودعات تستخدم كلمات مفتاحية قصيرة وسهلة التذكر وفريدة.
 default_branch = الفرع الافتراضي
 all_branches = كل الفروع
-migrate_items_issues = البلاغات
 projects.deletion_desc = حذف مشروع يحذف كل المسائل المرتبطة به. أتريد الاستمرار؟
 repo_desc_helper = أدخل وصفاً قصيراً (اختياري)
 create_repo = إنشاء مستودع
-migrate_items_releases = الإصدارات
 already_forked = لقد اشتققت %s بالفعل
 license_helper = اختر ملف ترخيص.
 tree_path_not_found.tag = المسار %[1]s غير موجود في الوسم %[2]s
 object_format_helper = صيغة كائنات المستودع. لا يمكن تغييرها بعد ذلك. SHA1 هي الأكثر توافقية.
 forks = الاشتقاقات
-migrate_items_pullrequests = طلبات السحب
 fork_to_different_account = اشتق إلى حساب مختلف
 tree_path_not_found.branch = المسار %[1]s غير موجود في الفرع %[2]s
 projects.edit_success = حدِّث المشروع "%s".
@@ -885,7 +866,6 @@ release.publish = انشر الإصدار
 issues.lock_duplicate = لا يمكن إقفال مسألة مقفلة.
 issues.filter_type.assigned_to_you = كُلِّفت بها
 issues.save = احفظ
-migrate_items_labels = تصنيفات
 issues.add_assignee_at = `كلّفه <b>%s</b> بها %s`
 milestones.filter_sort.least_complete = الأقل اكتمالا
 branch.create_branch = أنشئ الفرع %s
@@ -1507,7 +1487,6 @@ transfer.accept = قبول النقل
 blame.ignore_revs.failed = فشل تجاهل المراجعات في <a href="%s">.git-blame-ignore-revs</a>.
 form.name_pattern_not_allowed = النمط ”%s“ غير مسموح به في اسم المستودع.
 migrate_options_lfs_endpoint.description = سيحاول الترحيل استخدام مسار Git البعيد (remote) لـ <a target="_blank" rel="noopener noreferrer" href="%s">تحديد خادم LFS</a>. يمكنك أيضًا تحديد نقطة نهاية مخصصة إذا كانت بيانات LFS للمستودع مخزنة في مكان آخر.
-migrate_items = عناصر الترحيل
 adopt_preexisting_content = إنشاء مستودع من %s
 migrate_repo = ترحيل المستودع
 mirror_password_placeholder = (لم يتم تعديله)
@@ -1526,16 +1505,12 @@ form.reach_limit_of_creation_1 = لقد وصل المالك بالفعل إلى
 form.name_reserved = تم حجز اسم المستودع ”%s“.
 mirror_address_url_invalid = عنوان URL المقدم غير صالح. تأكد من تحرير مكونات عنوان URL بشكل صحيح.
 migrate.migrate = الترحيل من %s
-migrate.migrating_topics = ترحيل المواضيع
-migrate.cancel_migrating_title = إلغاء الترحيل
 generated_from = تم توليده من
 star_guest_user = قم بتسجيل الدخول لإعطاء نجمة لهذا المستودع.
 subscribe.pull.guest.tooltip = سجّل الدخول للاشتراك في طلب السحب هذا.
 unwatch = إلغاء المشاهدة
 quick_guide = دليل سريع
 empty_message = لا يحتوي هذا المستودع على أي محتوى.
-migrate.migrating_labels = ترحيل الوسوم
-migrate.migrating_releases = ترحيل الإصدارات
 watch_guest_user = سجّل الدخول لمشاهدة هذا المستودع.
 star = نجمة
 cite_this_repo = الاستشهاد بهذا المستودع
@@ -1549,8 +1524,6 @@ more_operations = المزيد من العمليات
 push_exist_repo = دفع مستودع موجود من موجّه الأوامر
 broken_message = لا يمكن قراءة بيانات Git التي يستند إليها هذا المستودع. اتصل بمسؤول هذا المثيل أو احذف هذا المستودع.
 watch = شاهد
-migrate.migrating_git = ترحيل بيانات Git
-migrate.cancel_migrating_confirm = تريد إلغاء عملية الترحيل هذه؟
 migrate.permission_denied_blocked = لا يمكنك الاستيراد من مضيفين غير مسموح بهم، يُرجى الطلب من المسؤول التحقق من إعدادات ALLOWED_DOMAINS/ALLOW_LOCALNETWORKS/BLOCKED_DOMAINS.
 migrate.migrating = الترحيل من <b>%s</b> …
 migrate.migrating_failed.error = أخفق الترحيل: %s
@@ -1565,8 +1538,6 @@ create_new_repo_command = إنشاء مستودع جديد على موجّه ا
 fork = اشتقاق
 migrate.migrating_failed_no_addr = أخفق الترحيل.
 unstar = إزالة النجمة
-migrate.migrating_issues = ترحيل البلاغات
-migrate.migrating_pulls = ترحيل طلبات السحب
 code = الكود
 migrate.invalid_lfs_endpoint = نقطة نهاية LFS غير صالحة.
 migrate.migrating_failed = فشل الترحيل من <b>%s</b>.
@@ -1581,19 +1552,15 @@ find_tag = البحث عن علامة
 commit_graph = الرسم البياني للإيداع
 editor.edit_this_file = عدل الملف
 editor.signoff_desc = أضف مقطورة موقّعة من قِبل المُجرّد في نهاية رسالة سجل الدخول.
-n_release_one = %s إصدار
 symbolic_link = رابط رمزي
 editor.cannot_edit_lfs_files = لا يمكن تحرير ملفات LFS في واجهة الويب.
 editor.this_file_locked = الملف مقفل
-n_commit_few = %s إيداعات
 editor.file_delete_success = تم حذف الملف "%s".
 editor.edit_file = عدّل الملف
 commit.contained_in_default_branch = هذا الإيداع جزء من الفرع الافتراضي
 line = سطر
 lines = أسطر
 normal_view = عرض عادي
-n_branch_one = %s فرع
-n_commit_one = %s إيداع
 view_git_blame = عرض مسؤول تعديل git
 editor.add_tmpl.filename = اسم الملف
 editor.name_your_file = اسم ملفك…
@@ -1605,10 +1572,6 @@ no_eol.tooltip = هذا الملف لا يحتوي على نهاية لخط ال
 stored_lfs = مخزن مع Git LFS
 commit.contained_in = هذا الإيداع موجود في:
 file_view_rendered = عرض المُخرج النهائي
-n_branch_few = %s فروع
-n_tag_one = %s علامة
-n_tag_few = ‪%s علامات
-n_release_few = %s إصدارات
 file.title = %s عند %s
 vendored = مضمن
 file_follow = متابعة الروابط الرمزية
@@ -1850,7 +1813,6 @@ dashboard.sync_repo_tags = زامن الوسوم من بيانات جِت إلى
 self_check = فحص ذاتي
 self_check.database_collation_case_insensitive = تستخدم قاعدة البيانات تجميع %s ، وهو تجميع غير حساس. على الرغم من أن فورجيو يمكن أن يعمل معها قد تكون هناك حالات نادرة لا تعمل كما هو متوقع.
 monitor.process.cancel_desc = قد يسبب إلغاء العملية فقدانًا للبيانات
-monitor.queue.type = النوع
 monitor.process.cancel_notices = أتريد إلغاء: <strong>%s</strong>؟
 dashboard.operations = عمليات الصيانة
 repositories = المستودعات
@@ -1861,7 +1823,6 @@ monitor.desc = الوصف
 monitor.start = وقت البدء
 dashboard.system_status = حالة النظام
 dashboard.delete_generated_repository_avatars = احذف الصورة الرمزية المولّدة للمستودع
-monitor.queue.name = الاسم
 monitor.process.cancel = ألغِ العملية
 monitor.last_execution_result = النتيجة
 users = حسابات المستخدمين
@@ -1870,14 +1831,11 @@ dashboard.operation_name = اسم العملية
 notices.type_1 = المستودع
 notices.desc = الوصف
 notices.type = النوع
-monitor.queue.settings.submit = حدّث الإعدادات
-monitor.queue.settings.changed = تم تحديث الإعدادات
 auths.security_protocol = بروتوكول الأمان
 auths.port = المنفذ
 auths.attribute_username_placeholder = اتركه فارغاً لاستخدام اسم المستخدم المُدخل في فورجيو.
 auths.host = المضيف
 auths.domain = النطاق
-users.list_status_filter.is_restricted = مقيَّد
 users.reserved = محجوز
 systemhooks.add_webhook = إضافة خطاف ويب النظام
 repos.owner = المالك
@@ -1905,7 +1863,6 @@ auths.type = النوع
 users.purge_help = حذف مستخدم بالقوة وكل مستودعاته ومنظماته وحزمه. كل تعليقاته والمسائل التي أنشأها ستُحذف أيضا.
 users.admin = المدير
 emails.email_manage_panel = إدارة بريد المستخدم
-users.list_status_filter.not_restricted = غير مقيد
 users.name = اسم المستخدم
 packages.repository = المستودع
 orgs.teams = الفِرق
@@ -1923,18 +1880,14 @@ packages.package_manage_panel = إدارة الحزم
 auths.auth_name = اسم الاستيثاق
 users.details = تفاصيل المستخدم
 orgs.name = الاسم
-users.list_status_filter.is_active = مفعّل
 users.repos = المستودعات
 defaulthooks.update_webhook = تحديث خطاف الويب المبدئي
 users.allow_git_hook = يستطيع عمل خطاطيف جت
 users.password_helper = اترك كلمة المرور فارغة لإبقائها بلا تغيير.
 dashboard.update_checker = فاحص التحديث
-users.list_status_filter.not_active = معطّل
 users.update_profile = حدّث حساب المستخدم
-users.list_status_filter.not_admin = غير مدير
 systemhooks = خطاطيف ويب النظام
 users.never_login = لم يلج قَط
-users.list_status_filter.is_admin = مدير
 users.allow_create_organization = يستطيع إنشاء منظمات
 users.restricted = مقيَّد
 users.delete_account = احذف حساب المستخدم
@@ -2083,23 +2036,9 @@ relevant_repositories = يتم اظهار المستودعات المتعلقة
 code_last_indexed_at = فُهرس آخر مرة %s
 
 [actions]
-variables.none = لا توجد متغيرات بعد.
-variables.deletion = أزل المتغير
-variables.creation = أضف متغيرا
-variables.management = إدارة المتغيرات
-variables = المتغيرات
-variables.deletion.description = إزالة المتغيرات عملية نهائية لا يمكن التراجع عنها. أتريد الاستمرار؟
 runs.empty_commit_message = (رسالة إيداع فارغة)
-variables.edit = عدّل المتغير
-variables.update.success = عُدِّل المتغير.
-variables.update.failed = فشل تعديل المتغير.
-variables.deletion.failed = فشل حذف المتغير.
-variables.creation.failed = فشل إضافة المتغير.
-variables.creation.success = تم إضافة المتغير "%s".
-variables.deletion.success = تم حذف المتغير.
 variables.id_not_exist = المتغير ذو المعرّف %d ليس موجودا.
 unit.desc = أدر الإجراءات
-variables.description = تمرر المتغيرات إلى إجراءات معينة ولا يمكن قراءتها بطريقة أخرى.
 
 [modal]
 no = لا
diff --git a/options/locale/locale_bg.ini b/options/locale/locale_bg.ini
index 762f50afa6..7e931f061d 100644
--- a/options/locale/locale_bg.ini
+++ b/options/locale/locale_bg.ini
@@ -111,8 +111,6 @@ toggle_menu = Превключване на менюто
 confirm_delete_artifact = Сигурни ли сте, че искате да изтриете артефакта „%s“?
 more_items = Още елементи
 twofa_scratch = Резервен код за двуфакторно удостоверяване
-webauthn_use_twofa = Използвайте двуфакторен код от телефона си
-webauthn_error_insecure = WebAuthn поддържа само сигурни връзки. За тестване през HTTP можете да използвате произход „localhost“ или „127.0.0.1“
 error413 = Изчерпали сте квотата си.
 go_back = Връщане
 invalid_data = Невалидни данни: %v
@@ -123,19 +121,9 @@ show_full_screen = Показване на цял екран
 show_timestamps = Показване на времеви отпечатъци
 rerun = Повторно изпълнение
 copy_type_unsupported = Този тип файл не може да бъде копиран
-webauthn_error_unknown = Възникна неизвестна грешка. Моля, опитайте отново.
-webauthn_error_unable_to_process = Сървърът не можа да обработи заявката ви.
-webauthn_error_empty = Трябва да зададете име за този ключ.
-webauthn_error_timeout = Времето за изчакване изтече преди ключът ви да бъде прочетен. Моля, презаредете страницата и опитайте отново.
 return_to_forgejo = Връщане към Forgejo
 unknown = Неизвестно
 confirm_delete_selected = Потвърждавате ли изтриването на всички избрани елементи?
-webauthn_insert_key = Поставете вашия ключ за сигурност
-webauthn_press_button = Моля, натиснете бутона на вашия ключ за сигурност…
-webauthn_sign_in = Натиснете бутона на вашия ключ за сигурност. Ако ключът ви за сигурност няма бутон, поставете го отново.
-webauthn_error = Неуспешно прочитане на вашия ключ за сигурност.
-webauthn_unsupported_browser = Вашият браузър в момента не поддържа WebAuthn.
-webauthn_error_duplicated = Ключът за сигурност не е разрешен за тази заявка. Моля, уверете се, че ключът не е вече регистриран.
 tracked_time_summary = Обобщение на проследеното време въз основа на филтрите в списъка със задачи
 active_stopwatch = Активен тракер за време
 access_token = Токен за достъп
@@ -545,7 +533,6 @@ forks = Разклонения
 editor.or = или
 issues.new_label_desc_placeholder = Описание
 watch_guest_user = Влезте, за да наблюдавате това хранилище.
-migrate_items_milestones = Етапи
 unstar = Премахване на звездата
 owner = Притежател
 issues.num_comments_1 = %d коментар
@@ -623,7 +610,6 @@ readme_helper_desc = Това е мястото, където можете да
 repo_gitignore_helper = Изберете .gitignore шаблони
 auto_init = Да се инициализира хранилище
 template.issue_labels = Етикети за задачите
-migrate_items_labels = Етикети
 issues.label_templates.title = Зареждане на предв. зададен набор от етикети
 issues.label_templates.helper = Изберете предв. зададен набор от етикети
 projects.template.desc = Шаблон
@@ -657,8 +643,6 @@ milestones.new = Нов етап
 milestones.cancel = Отказ
 settings.http_method = HTTP метод
 clone_helper = Нуждаете се от помощ за клониране? Посетете <a target="_blank" rel="noopener noreferrer" href="%s">Помощ</a>.
-migrate_items_pullrequests = Заявки за сливане
-migrate_items_wiki = Уики
 quick_guide = Бързо ръководство
 clone_this_repo = Клонирайте това хранилище
 push_exist_repo = Изтласкване на съществуващо хранилище от командния ред
@@ -724,7 +708,6 @@ wiki.desc = Пишете и споделяйте документация със
 wiki.default_commit_message = Напишете бележка относно това обновяване на страницата (опционално).
 release.releases = Издания
 wiki.last_commit_info = %s редактира тази страница %s
-migrate_items_releases = Издания
 release = Издание
 releases = Издания
 settings.desc = Настройките са мястото, където можете да управлявате настройките за хранилището
@@ -904,8 +887,6 @@ download_tar = Изтегляне на TAR.GZ
 desc.public = Публично
 desc.archived = Архивирано
 desc.internal = Вътрешно
-migrate_items_merge_requests = Заявки за сливане
-migrate_items_issues = Задачи
 fork_guest_user = Влезте, за да разклоните това хранилище.
 actions = Действия
 more_operations = Още операции
@@ -1189,16 +1170,10 @@ activity.git_stats_pushed_1 = е изтласкал
 activity.git_stats_push_to_branch = към %s и
 contributors.contribution_type.commits = Подавания
 stars = Звезди
-n_commit_few = %s подавания
-n_branch_one = %s клон
-n_branch_few = %s клона
-n_tag_one = %s маркер
-n_tag_few = %s маркера
 commit_graph = Граф с подавания
 commits.renamed_from = Преименувано от %s
 commits.view_path = Преглед на този момент в историята
 commits.search_branch = Този клон
-n_commit_one = %s подаване
 release.ahead.commits = <strong>%d</strong> подавания
 release.stable = Стабилно
 commits.gpg_key_id = ID на GPG ключ
@@ -1321,8 +1296,6 @@ issues.review.option.show_outdated_comments = Показване на остар
 issues.content_history.delete_from_history_confirm = Да се изтрие ли от историята?
 project = Проекти
 issues.content_history.delete_from_history = Изтриване от историята
-n_release_few = %s издания
-n_release_one = %s издание
 editor.cannot_edit_non_text_files = Двоични файлове не могат да се редактират през уеб интерфейса.
 settings.mirror_settings.push_mirror.copy_public_key = Копиране на публичния ключ
 activity.published_tag_label = Маркер
@@ -1451,7 +1424,6 @@ file_follow = Последване на символната връзка
 commitstatus.failure = Неуспех
 issues.filter_label_exclude = Използвайте <kbd>Alt</kbd> + <kbd>Click</kbd>, за да изключите етикети
 migrate.migrating_failed = Мигрирането от <b>%s</b> е неуспешно.
-migrate.migrating_issues = Мигриране на задачи
 mirror_from = огледално на
 fork_from_self = Не можете да разклоните хранилище, което притежавате.
 commit_graph.hide_pr_refs = Скриване на заявките за сливане
@@ -1468,12 +1440,9 @@ form.reach_limit_of_creation_1 = Притежателят вече е дости
 editor.patching = Прилагане на кръпка:
 editor.fail_to_apply_patch = Неуспешно прилагане на кръпка „%s“
 commits.no_commits = Няма общи подавания. „%s“ и „%s“ имат напълно различни истории.
-migrate.migrating_pulls = Мигриране на заявки за сливане
-migrate.migrating_topics = Мигриране на теми
 projects.desc = Управлявайте задачи и заявки за сливане в проектни табла.
 issues.choose.invalid_templates = %v невалидни шаблона са намерени
 pulls.edit.already_changed = Неуспешно запазване на промените в заявката за сливане. Изглежда съдържанието вече е променено от друг потребител. Моля, презаредете страницата и опитайте да редактирате отново, за да избегнете презаписването на техните промени
-migrate.migrating_git = Мигриране на Git данни
 commits.newer = По-нови
 issues.choose.blank_about = Създаване на задача от стандартен шаблон.
 issues.filter_no_results = Няма резултати
@@ -1483,8 +1452,6 @@ transfer.no_permission_to_accept = Нямате разрешение да при
 transfer.no_permission_to_reject = Нямате разрешение да отхвърлите това прехвърляне.
 editor.file_changed_while_editing = Съдържанието на файла е променено, откакто сте го отворили. <a target="_blank" rel="noopener noreferrer" href="%s">Щракнете тук</a>, за да го видите, или <strong>Подайте промените отново</strong>, за да ги презапишете.
 sync_fork.button = Синхронизиране
-migrate.migrating_labels = Мигриране на етикети
-migrate.migrating_releases = Мигриране на издания
 editor.push_rejected_no_message = Промяната беше отхвърлена от сървъра без съобщение. Моля, проверете Git куките.
 issues.choose.open_external_link = Отваряне
 comments.edit.already_changed = Неуспешно запазване на промените в коментара. Изглежда съдържанието вече е променено от друг потребител. Моля, презаредете страницата и опитайте да редактирате отново, за да избегнете презаписването на техните промени
@@ -1511,7 +1478,6 @@ editor.commit_id_not_matching = Файлът е променен, докато 
 editor.user_no_push_to_branch = Потребителят не може да изтласква в клона
 archive.pull.noreview = Това хранилище е архивирано. Не можете да рецензирате заявки за сливане.
 migrate.migrating_failed.error = Неуспешно мигриране: %s
-migrate.migrating_milestones = Мигриране на етапи
 migrate.failed = Мигрирането е неуспешно: %v
 pulls.nothing_to_compare_and_allow_empty_pr = Тези клонове са равни. Тази заявка за сливане ще бъде празна.
 pulls.has_pull_request = `Вече съществува заявка за сливане между тези клонове: <a href="%[1]s">%[2]s#%[3]d</a>`
@@ -1552,7 +1518,6 @@ issues.time_spent_from_all_authors = `Общо изразходвано врем
 issues.attachment.download = `Щракнете, за да изтеглите „%s“`
 issues.attachment.open_tab = `Щракнете, за да видите „%s“ в нов раздел`
 pulls.update_branch = Обновяване на клона чрез сливане
-migrate_items = Елементи за мигриране
 commit.load_referencing_branches_and_tags = Зареждане на клонове и маркери, препращащи към това подаване
 pulls.files_conflicted = Тази заявка за сливане има промени, които са в конфликт с целевия клон.
 pulls.still_in_progress = Все още е в процес на работа?
@@ -1574,8 +1539,6 @@ editor.cannot_edit_lfs_files = LFS файлове не могат да се ре
 commits.ssh_key_fingerprint = Отпечатък на SSH ключ
 issues.comment_on_locked = Не можете да коментирате заключена задача.
 commit.revert = Връщане
-migrate.cancel_migrating_title = Отказ от миграцията
-migrate.cancel_migrating_confirm = Искате ли да откажете тази миграция?
 issues.choose.invalid_config = Конфигурацията на задачите съдържа грешки:
 unit_disabled = Администраторът на сайта е изключил тази секция на хранилището.
 issues.blocked_by_user = Не можете да създавате задачи в това хранилище, защото сте блокирани от притежателя на хранилището.
@@ -2185,7 +2148,6 @@ auths.port = Порт
 auths.type = Тип
 config.ssh_config = SSH конфигурация
 monitor.stats = Статистика
-monitor.queue = Опашка: %s
 config = Конфигурация
 config.mailer_user = Потребител
 config.enable_captcha = Включване на CAPTCHA
@@ -2195,7 +2157,6 @@ config.git_config = Git конфигурация
 config.mailer_protocol = Протокол
 users.bot = Бот
 config.db_path = Път
-monitor.queues = Опашки
 config.server_config = Сървърна конфигурация
 packages.size = Размер
 settings = Админ. настройки
@@ -2220,7 +2181,6 @@ packages.total_size = Общ размер: %s
 dashboard.new_version_hint = Forgejo %s вече е наличен, вие изпълнявате %s. Проверете <a target="_blank" rel="noreferrer" href="%s">блога</a> за повече подробности.
 total = Общо: %d
 config.db_type = Тип
-monitor.queue.type = Тип
 notices.type = Тип
 users.prohibit_login = Замразен акаунт
 
@@ -2461,20 +2421,7 @@ relevant_repositories = Показани са само подходящи хра
 relevant_repositories_tooltip = Хранилищата, които са разклонения или нямат тема, икона или описание, са скрити.
 
 [actions]
-variables = Променливи
-variables.none = Все още няма променливи.
-variables.creation.failed = Неуспешно добавяне на променлива.
-variables.update.failed = Неуспешно редактиране на променлива.
-variables.creation.success = Променливата „%s“ е добавена.
-variables.deletion.success = Променливата е премахната.
-variables.edit = Редактиране на променливата
-variables.deletion = Премахване на променливата
-variables.update.success = Променливата е редактирана.
-variables.creation = Добавяне на променлива
-variables.deletion.failed = Неуспешно премахване на променлива.
 runs.no_workflows.help_no_write_access = За да научите повече за Forgejo Actions, вижте <a target="_blank" rel="noopener noreferrer" href="%s">документацията</a>.
-variables.management = Управление на променливи
-variables.not_found = Променливата не е открита.
 variables.id_not_exist = Променлива с идентификатор %d не съществува.
 unit.desc = Управление на интегрирани CI/CD pipelines с Forgejo Actions.
 
@@ -2540,8 +2487,6 @@ type_tooltip = Тип търсене
 runner_kind = Търсене на изпълнители…
 
 [markup]
-filepreview.lines = Редове от %[1]d до %[2]d в %[3]s
-filepreview.line = Ред %[1]d в %[2]s
 
 [munits.data]
 
diff --git a/options/locale/locale_ca.ini b/options/locale/locale_ca.ini
index 5877fb4754..fc77e81569 100644
--- a/options/locale/locale_ca.ini
+++ b/options/locale/locale_ca.ini
@@ -37,17 +37,6 @@ captcha = CAPTCHA
 twofa = Autenticació de doble factor
 twofa_scratch = Codi de rascar de doble-factor
 passcode = Codi de pas
-webauthn_insert_key = Inseriu la vostra clau de seguretat
-webauthn_sign_in = Premeu el botó a la vostra clau de seguretat. Si no en té, torneu-la a inserir.
-webauthn_press_button = Si us plau, premeu el botó a la vostra clau de seguretat…
-webauthn_use_twofa = Utilitza un codi de doble factor des del teu mòbil
-webauthn_error = No s'ha pogut llegir la clau de seguretat.
-webauthn_unsupported_browser = El teu navegador no suprta WebAuthn.
-webauthn_error_unknown = Hi ha hagut un error desconegut. Si us plau torneu-ho a intentar.
-webauthn_error_insecure = WebAuthn només suporta connexions segures. Per provar sobre HTTP, podeu utilitzar l'origen "localhost" o "127.0.0.1"
-webauthn_error_unable_to_process = El servidor no ha pogut processar la vostra sol·licitud.
-webauthn_error_duplicated = La clau de seguretat no és permesa per aquesta sol·licitud. Si us plau, assegureu-vos que la clau encara no ha estat registrada.
-webauthn_error_empty = S'ha d'anomenar aquesta clau.
 repository = Repositori
 organization = Organització
 mirror = Mirall
@@ -85,7 +74,6 @@ disabled = Deshabilitat
 filter.public = Públic
 filter.private = Privat
 show_full_screen = Mostra a pantalla completa
-webauthn_error_timeout = Temps d'espera finalitzar abans que la seva clau pogués ser llegida. Siusplau recarregueu la pàgina i torneu-ho a intentar.
 remove_label_str = Esborra l'element "%s"
 error413 = Ha exhaurit la quota.
 cancel = Canceŀlar
@@ -1130,11 +1118,6 @@ template.webhooks = Webhooks
 template.topics = Temes
 template.avatar = Avatar
 need_auth = Autorització
-migrate_items_wiki = Wiki
-migrate_items_milestones = Fites
-migrate_items_labels = Etiquetes
-migrate_items_issues = Problemes
-migrate_items_releases = Publicacions
 unwatch = Deixa de seguir
 watch = Segueix
 unstar = Treu l'estrella
@@ -1652,7 +1635,6 @@ form.string_too_long = El text introduït té més de %d caràcters.
 migrate_options = Opcions de migració
 migrate_options_mirror_helper = Aquest repositori serà un mirall
 migrate_options_lfs_endpoint.description.local = També s'accepta un camí al servidor local.
-migrate_items = Elements de migració
 open_with_editor = Obre amb %s
 mirror_prune_desc = Elimina les referències de seguiment remot obsoletes
 mirror_sync_on_commit = Sincronitza quan es pugin commits
@@ -1679,7 +1661,6 @@ migrate_options_lfs = Migra els fitxers LFS
 migrate_options_lfs_endpoint.label = Punt final LFS
 migrate_options_lfs_endpoint.description = En migrar, s'intentarà utilitzar el vostre remot git per a <a target="_blank" rel="noopener noreferrer" href="%s">determinar el servidor LFS</a>. També podeu especificar un punt final personalitzat si les dades LFS del repositori són en un altre lloc.
 migrate_options_lfs_endpoint.placeholder = Si ho deixeu en blanc, el punt final derivarà de l'URL de clonació
-migrate_items_pullrequests = Pull requests
 generated_from = generat des de
 editor.update = Actualitzar %s
 diff.whitespace_ignore_at_eol = Ignorar els canvis en els espais en blanc al final de la línia
@@ -1807,15 +1788,6 @@ migrate.migrating = S'està migrant des de <b>%s</b> …
 migrate.migrating_failed = La migració des de <b>%s</b> ha fallat.
 migrate.migrating_failed.error = No s'ha pogut migrar: %s
 migrate.migrating_failed_no_addr = La migració ha fallat.
-migrate.migrating_git = Migrant dades Git
-migrate.migrating_topics = Migrant tòpics
-migrate.migrating_milestones = Migrant fites
-migrate.migrating_labels = Migrant etiquetes
-migrate.migrating_releases = Migrant publicacions
-migrate.migrating_issues = Migrant problemes
-migrate.migrating_pulls = Migrant «pull requests»
-migrate.cancel_migrating_title = Cancel·la la migració
-migrate.cancel_migrating_confirm = Voleu cancel·lar aquesta migració?
 mirror_from = mirall de
 forked_from = bifurcat des de
 fork_from_self = No podeu bifurcar un repositori que us pertany.
@@ -1833,18 +1805,9 @@ repo_gitignore_helper_desc = Escolliu de quins fitxers no s'ha de fer seguiment
 readme_helper_desc = Aquí podeu escriure una descripció completa del vostre projecte.
 mirror_interval = Interval de rèplica (les unitats de temps vàlides són "h", "m", "s"). 0 per desactivar la sincronització periòdica. (Interval mínim: %s)
 mirror_use_ssh.helper = Si seleccioneu aquesta opció, Forgejo replicarà el repositori mitjançant Git per SSH i us crearà una parella de claus. Heu d'assegurar-vos que la clau pública generada estigui autoritzada per publicar al repositori de destí. No podreu fer servir autenticació basada en contrasenyes.
-n_commit_one = %s commit
-n_commit_few = %s commits
-n_branch_one = Branca %s
-n_branch_few = Branques %s
-n_tag_one = Etiqueta %s
-n_tag_few = Etiquetes %s
-migrate_items_merge_requests = Sol·licituds de fusió
 migrate.github_token_desc = Podeu posar un o més testimonis separats amb comes per fer que la migració sigui més ràpida, evitant així el límit de taxa de l'API de GitHub. ATENCIÓ: Abusar aquesta funció pot anar en contra de la política de servei del proveïdor i pot comportar el bloqueig del/s vostre/s compte/s.
 migrate.clone_local_path = o el camí a un servidor local
 migrate.permission_denied_blocked = No podeu importar des d'amfitrions rebutjats, si us plau, demaneu a l'administrador que comprovi les configuracions ALLOWED_DOMAINS/ALLOW_LOCALNETWORKS/BLOCKED_DOMAINS.
-n_release_one = Publicació %s
-n_release_few = Publicacions %s
 file.title = %s a %s
 file_view_rendered = Veure renderitzat
 file_view_raw = Veure cru
@@ -2609,10 +2572,8 @@ settings.web_hook_name_larksuite_only = Lark Suite
 settings.web_hook_name_wechatwork = WeCom (Wechat Work)
 settings.lfs_pointers.found = S'ha trobat %d punters de blob - %d associats, %d no associats (%d no són a l'emmagatzematge)
 settings.lfs_pointers.associateAccessible = Associar %d OIDs accessibles
-
 settings.matrix.access_token_helper = Es recomana muntar un compte de Matrix dedicat per això. El testimoni d'accés el podeu trobar al client web Element (en una pestanya privada/d'incògnit) > User menu (cantó superior esquerre) > All settings > Help & About > Advanced > Access Token (sota de l'URL del homeserver). Tanqueu la pestanya privada/d'incògnit (tancar la sessió invalidaria el testimoni).
 settings.matrix.room_id_helper = L'ID de sala el podeu trobar al client web Element > Room Settings > Advanced > Internal room ID. Per exemple: %s.
-
 diff.parent = pare
 
 [user]
@@ -2665,9 +2626,6 @@ normal_file = Fitxer normal
 directory = Directori
 
 [markup]
-filepreview.truncated = La vista prèvia s'ha truncat
-filepreview.line = Línia %[1]d a %[2]s
-filepreview.lines = Línies %[1]d a %[2]d en %[3]s
 
 [translation_meta]
 test = Aquest és un text de prova. No es mostra a l'interfície d'usuari de Forgejo, però s'utilitza amb finalitats de prova. Pots introduir "d'acord" per a estalviar temps (o alguna frase divertida al teu gust) i arribar a la dolça fita del 100% :)
@@ -2785,7 +2743,6 @@ dashboard.delete_missing_repos = Suprimir tots els repositoris que no tinguin el
 dashboard.delete_missing_repos.started = S'ha iniciat la tasca per suprimir tots els repositoris que no tinguin els fitxers de Git.
 dashboard.update_mirrors = Actualitzar les rèpliques
 dashboard.archive_cleanup = Suprimir els arxius de repositori antics
-dashboard.memory_allocate_times = Assignacions de memòria
 orgs.name = Nom
 orgs.teams = Equips
 repos.name = Nom
@@ -2795,9 +2752,7 @@ auths.name = Nom
 config.db_name = Nom
 config.mailer_name = Nom
 monitor.name = Nom
-monitor.queue.name = Nom
 notices.type = Tipus
-monitor.queue.type = Tipus
 config.db_type = Tipus
 auths.type = Tipus
 packages.type = Tipus
@@ -2823,7 +2778,6 @@ users.activated = Activat
 emails.activated = Activat
 emails.filter_sort.email = Correu electrònic
 users.admin = Administrador
-users.list_status_filter.is_admin = Administrador
 notices.desc = Descripció
 packages.name = Nom
 packages.version = Versió
@@ -2857,9 +2811,6 @@ dashboard.operations = Operacions de manteniment
 dashboard.system_status = Estat del sistema
 dashboard.operation_name = Nom d'operació
 dashboard.clean_unbind_oauth = Neteja les connexions OAuth desenllaçades
-
-notices = Notificacions del sistema
-dashboard.operation_switch = Intercanvia
 dashboard.operation_run = Executar
 dashboard.clean_unbind_oauth_success = S'han eliminat totes les connexions OAuth desenllaçades.
 dashboard.task.started = Tasca iniciada: %[1]s
@@ -2869,13 +2820,12 @@ dashboard.task.error = Error en la tasca: %[1]s: %[3]s
 dashboard.task.finished = Tasca: %[1] iniciada per %[2s] ha finalitzat
 dashboard.task.unknown = Tasca desconeguda: %[1]s
 dashboard.cron.started = Cron iniciat: %[1]s
-dashboard.cron.process = Cron: %[1]s
 dashboard.cron.cancelled = Cron: %[1]s cancel·lat: %[3]s
 dashboard.cron.error = Error amb Cron: %s: %[3]s
 dashboard.sync_repo_branches = La sincronització ha ignorat branques de les dades Git a la base de dades
 dashboard.check_repo_stats = Comprovar totes les estadístiques del repositori
 dashboard.deleted_branches_cleanup = Netejar branques eliminades
-dashboard.update_migration_poster_id = Actualitza les ID de l'autor de migració
+dashboard.update_migration_poster_id =Actualitza les ID de l'autor de migració
 dashboard.git_gc_repos = Recull la brossa de tots els repositoris
 dashboard.resync_all_sshkeys = Actualitzar el fitxer ".ssh/authorized_keys" amb les claus SSH de Forgejo.
 dashboard.resync_all_sshprincipals = Actualitzar el fitxer ".ssh/authorized_principals" amb els principals SSH de Forgejo.
@@ -2885,30 +2835,6 @@ dashboard.sync_external_users = Sincronitzar dades d'usuari externes
 dashboard.cleanup_hook_task_table = Netejar la taula hook_task
 dashboard.cleanup_packages = Netejar paquets caducats
 dashboard.cleanup_actions = Netejar registres i artefactes d'accions caducats
-dashboard.server_uptime = Temps de funcionament del servidor
-dashboard.current_goroutine = Goroutines actuals
-dashboard.current_memory_usage = Ús de memòria actual
-dashboard.total_memory_allocated = Total de memòria adjudicada
-dashboard.memory_obtained = Memòria rebuda
-dashboard.pointer_lookup_times = Temps de consulta dels punters
-dashboard.memory_free_times = Alliberaments de memòria
-dashboard.current_heap_usage = Ús del heap actual
-dashboard.heap_memory_obtained = Memòria de heap rebuda
-dashboard.heap_memory_idle = Memòria del heap en repòs
-dashboard.heap_memory_in_use = Memòria del heap en ús
-dashboard.heap_memory_released = Memòria del heap alliberada
-dashboard.heap_objects = Objectes del heap
-dashboard.bootstrap_stack_usage = Ús de l'arrancada de la pila (stack)
-dashboard.stack_memory_obtained = Memòria de la pila (stack) rebuda
-dashboard.mspan_structures_usage = Ús de les estructures MSpan
-dashboard.mspan_structures_obtained = Estructures MSpan rebudes
-dashboard.mcache_structures_usage = Ús de les estructures MCache
-dashboard.mcache_structures_obtained = Estructures MCache rebudes
-dashboard.gc_metadata_obtained = Metadades del GC rebudes
-dashboard.next_gc_recycle = Proper cicle de GC
-dashboard.last_gc_time = Temps des del darrer GC
-dashboard.total_gc_pause = Pausa total de GC
-dashboard.last_gc_pause = Darrera pausa de GC
 dashboard.delete_old_actions = Eliminar totes les activitats antigues de la base de dades
 dashboard.delete_old_actions.started = Eliminar totes les activitats antigues des que s'ha iniciat la base de dades.
 dashboard.delete_old_system_notices = Eliminar totes les notificacions de sistema antigues de la base de dades
@@ -2918,6 +2844,8 @@ dashboard.stop_endless_tasks = Aturar tasques d'accions infinites
 dashboard.cancel_abandoned_jobs = Cancel·lar feines d'accions abandonades
 dashboard.sync_branch.started = S'ha iniciat la sincronització de branca
 dashboard.sync_tag.started = S'ha iniciat la sincronització d'etiquetes
+dashboard.cron.process = Cron: %[1]s
+notices = Notificacions del sistema
 dashboard.rebuild_issue_indexer = Reconstruir l'indexador d'incidències
 users.user_manage_panel = Gestionar comptes d'usuari
 users.new_account = Crear compte d'usuari
@@ -2925,7 +2853,6 @@ users.restricted = Restringit
 users.reserved = Reservat
 users.bot = Bot
 users.remote = Remot
-users.2fa = A2F
 users.repos = Repos
 users.created = Creats
 users.last_login = Darrer inici de sessió
@@ -2964,18 +2891,6 @@ users.purge = Purgar usuari
 users.purge_help = Elimina forçosament l'usuari i tots els seus repositoris, organitzacions i paquets. També s'eliminaran tots els seus comentaris i incidències.
 users.still_own_packages = Aquest usuari encara té un o més paquets. Elimineu-los abans.
 users.deletion_success = S'ha eliminat l'usuari.
-users.reset_2fa = Restableix l'A2F
-users.list_status_filter.menu_text = Filtrar
-users.list_status_filter.reset = Restaurar
-users.list_status_filter.is_active = Actiu
-users.list_status_filter.not_active = Inactiu
-users.list_status_filter.not_admin = No administrador
-users.list_status_filter.is_restricted = Restringit
-users.list_status_filter.not_restricted = No restringit
-users.list_status_filter.is_prohibit_login = Inici de sessió prohibit
-users.list_status_filter.not_prohibit_login = Inici de sessió permès
-users.list_status_filter.is_2fa_enabled = A2F activada
-users.list_status_filter.not_2fa_enabled = A2F desactivada
 users.details = Detalls d'usuari
 emails.email_manage_panel = Gestionar correus d'usuari
 emails.primary = Principal
@@ -3019,10 +2934,6 @@ auths.updated = Actualitzat
 auths.auth_type = Tipus d'autenticació
 auths.auth_name = Nom d'autenticació
 auths.security_protocol = Protocol de seguretat
-auths.bind_dn = DN bind
-auths.bind_password = Contrasenya bind
-auths.user_base = Base de cerca d'usuari
-auths.user_dn = DN d'usuari
 auths.attribute_username = Atribut de nom d'usuari
 auths.attribute_username_placeholder = Deixeu-ho buit per usar el nom d'usuari de Forgejo.
 auths.attribute_name = Atribut de nom
@@ -3030,9 +2941,6 @@ auths.attribute_surname = Atribut de cognom
 auths.attribute_mail = Atribut de correu electrònic
 auths.attribute_ssh_public_key = Atribut de clau pública SSH
 auths.attribute_avatar = Atribut d'avatar
-auths.attributes_in_bind = Recupera els atributs del context bind DN
-auths.default_domain_name = Nom de domini per defecte usat per l'adreça de correu
-auths.allow_deactivate_all = Permet que un resultat de cerca buit desactivi tots els usuaris
 auths.use_paged_search = Usar cerca en pàgines
 auths.search_page_size = Mida de pàgina
 auths.filter = Filtre d'usuari
@@ -3040,11 +2948,6 @@ auths.admin_filter = Filtre d'administrador
 auths.restricted_filter = Filtre restringit
 auths.restricted_filter_helper = Deixeu-ho buit per no marcar cap usuari com a restringit. Useu un asterisc ("*") per marcar tots els usuaris que no coincideixin amb el Filtre d'administrador com a restringits.
 auths.verify_group_membership = Verificar l'adhesió de grup a LDAP (deixeu el filtre buit per ignorar-ho)
-auths.group_search_base = DN base de cerca de grup
-auths.group_attribute_list_users = Atribut de grup amb la llista d'usuaris
-auths.user_attribute_in_group = Atribut d'usuari llistat en el grup
-auths.map_group_to_team = Assigna els grups LDAP a equips d'organització (deixeu-ho buit per saltar-ho)
-auths.map_group_to_team_removal = Elimina els usuaris dels equips sincronitzats si no pertanyen al grup LDAP corresponent
 auths.enable_ldap_groups = Activar grups LDAP
 auths.smtp_auth = Tipus d'autenticació SMTP
 auths.smtphost = Amfitrió SMTP
@@ -3054,9 +2957,6 @@ auths.allowed_domains_helper = Deixeu-ho buit per permetre tots els dominis. Sep
 auths.skip_tls_verify = Salta't la verificació TLS
 auths.force_smtps = Força l'SMTPS
 auths.force_smtps_helper = L'SMTPS sempre usa el port 465. Indiqueu això per forçar l'SMTPS en un altre port. (Sinó s'usarà l'STARTTLS en altres ports, sempre que l'amfitrió ho suporti.)
-auths.helo_hostname = Hostname HELO
-auths.helo_hostname_helper = Hostname enviat amb HELO. Deixeu-ho en blanc per enviar el hostname actual.
-auths.disable_helo = Deshabilita HELO
 auths.pam_service_name = Nom de servei PAM
 auths.pam_email_domain = Domini de correu PAM (opcional)
 auths.oauth2_provider = Proveïdor OAuth2
@@ -3069,26 +2969,6 @@ auths.oauth2_tokenURL = URL de testimoni (token)
 auths.oauth2_authURL = URL d'autorització
 auths.oauth2_profileURL = URL de perfil
 auths.oauth2_emailURL = URL de correu
-auths.skip_local_two_fa = Salta l'A2F local
-auths.skip_local_two_fa_helper = No marcar aquesta opció farà que els usuaris que tenen l'A2F definida igualment hauran de passar l'A2F per iniciar sessió
-auths.oauth2_tenant = Tenant
-auths.oauth2_scopes = Àmbits addicionals
-auths.oauth2_required_claim_value_helper = Assigneu aquest valor per restringir l'inici de sessió des d'aquesta font als usuaris que declarin aquest nom i valor
-auths.oauth2_map_group_to_team_removal = Elimina els usuaris dels equips sincronitzats si no pertanyen al grup corresponent.
-auths.tips = Consells
-auths.tips.gmail_settings = Configuracions de Gmail:
-auths.tips.oauth2.general = Autenticació OAuth2
-auths.tips.oauth2.general.tip = Quan registreu una nova autenticació OAuth2, l'URL de crida/redirecció serà:
-auths.tip.oauth2_provider = Proveïdor OAuth2
-auths.tip.bitbucket = Registreu un nou consumidor OAuth2 a %s i afegiu els permisos "Compte" - "Lectura"
-auths.tip.nextcloud = Registreu un nou consumidor OAuth en la vostra instància amb el menú "Configuració -> Seguretat -> Client OAuth 2.0"
-auths.tip.dropbox = Crea una nova aplicació a %s
-auths.tip.facebook = Registreu una nova aplicació a %s i afegiu el producte "Facebook Login"
-auths.tip.github = Registra una aplicació OAuth nova a %s
-auths.tip.gitlab_new = Registra una aplicació nova a %s
-auths.tip.google_plus = Obté les credencials del client OAuth2 amb la consola del Google API a %s
-auths.tip.openid_connect = Usa l'URL d'OpenID Connect Discovery (<server>/.well-known/openid-configuration) per a especificar els endpoints
-auths.tip.mastodon = Introduïu l'URL a una instància diferent de Mastodon amb la que voleu autenticar-vos (o bé useu la instància per defecte)
 auths.edit = Editar font d'autenticació
 auths.activated = S'ha activat aquesta font d'autenticació
 auths.new_success = S'ha afegit l'autenticació "%s".
@@ -3100,27 +2980,43 @@ auths.delete_auth_desc = Eliminar una font d'autenticació fa que els usuaris qu
 auths.still_in_used = Aquesta font d'autenticació encara s'utilitza. Convertiu o elimineu els usuaris que en fan ús abans.
 auths.deletion_success = S'ha eliminat la font d'autenticació.
 auths.login_source_exist = La font d'autenticació "%s" ja existeix.
-auths.unable_to_initialize_openid = No s'ha pogut inicialitzar el proveïdor d'OpenID Connect: %s
-auths.invalid_openIdConnectAutoDiscoveryURL = URL d'Auto Discovery invàlida (ha de ser una URL vàlida començant amb http:// o https://)
 config.server_config = Configuració de servidor
 config.app_name = Títol de la instància
 config.app_slogan = Eslògan de la instància
 config.app_ver = Versió de Forgejo
 config.app_url = URL base
 config.custom_conf = Camí al fitxer de configuració
-config.custom_file_root_path = Camí arrel dels fitxers personalitzada
 config.domain = Domini del servidor
 config.offline_mode = Mode local
-config.disable_router_log = Desactiva els registres de l'encaminador
-config.run_user = Executa com a usuari
-config.run_mode = Mode d'execució
 config.git_version = Versió de Git
-config.app_data_path = Camí a les dades d'aplicació
+config.ssh_config = Configuració SSH
+config.run_user = Executa com a usuari
+auths.tips.oauth2.general = Autenticació OAuth2
+auths.tips.oauth2.general.tip = Quan registreu una nova autenticació OAuth2, l'URL de crida/redirecció serà:
+auths.tip.oauth2_provider = Proveïdor OAuth2
+auths.tip.bitbucket = Registreu un nou consumidor OAuth2 a %s i afegiu els permisos "Compte" - "Lectura"
+auths.tip.nextcloud = Registreu un nou consumidor OAuth en la vostra instància amb el menú "Configuració -> Seguretat -> Client OAuth 2.0"
+auths.tip.dropbox = Crea una nova aplicació a %s
+auths.tip.facebook = Registreu una nova aplicació a %s i afegiu el producte "Facebook Login"
 config.repo_root_path = Camí arrel del repositori
+auths.bind_dn = DN bind
+auths.bind_password = Contrasenya bind
+auths.user_base = Base de cerca d'usuari
+auths.user_dn = DN d'usuari
+auths.attributes_in_bind = Recupera els atributs del context bind DN
+auths.default_domain_name = Nom de domini per defecte usat per l'adreça de correu
+auths.allow_deactivate_all = Permet que un resultat de cerca buit desactivi tots els usuaris
+auths.oauth2_required_claim_value_helper = Assigneu aquest valor per restringir l'inici de sessió des d'aquesta font als usuaris que declarin aquest nom i valor
+auths.tip.mastodon = Introduïu l'URL a una instància diferent de Mastodon amb la que voleu autenticar-vos (o bé useu la instància per defecte)
+auths.unable_to_initialize_openid = No s'ha pogut inicialitzar el proveïdor d'OpenID Connect: %s
+auths.invalid_openIdConnectAutoDiscoveryURL = URL d'Auto Discovery invàlida (ha de ser una URL vàlida començant amb http:// o https://)
+config.custom_file_root_path = Camí arrel dels fitxers personalitzada
+config.disable_router_log = Desactiva els registres de l'encaminador
+config.run_mode = Mode d'execució
+config.app_data_path = Camí a les dades d'aplicació
 config.log_file_root_path = Camí de registres
 config.script_type = Tipus d'script
 config.reverse_auth_user = Usuari d'autenticació al servidor intermediari revers
-config.ssh_config = Configuració SSH
 config.ssh_start_builtin_server = Usa el servidor integrat
 config.ssh_domain = Domini del servidor SSH
 config.ssh_listen_port = Port d'escolta
@@ -3175,9 +3071,9 @@ config.send_test_mail_submit = Envia
 config.test_mail_failed = No s'ha pogut enviar el correu de prova a "%s": %v
 config.test_mail_sent = S'ha enviat un correu de prova a "%s".
 config.cache_config = 
-config.cache_adapter = Adaptador de la memòria cau
-config.cache_interval = Interval de la memòria cau
-config.cache_conn = Connexió de la memòria cau
+config.cache_adapter =Adaptador de la memòria cau
+config.cache_interval =Interval de la memòria cau
+config.cache_conn =Connexió de la memòria cau
 config.cache_item_ttl = TTL dels ítems de la memòria cau
 config.cache_test = Prova la memòria cau
 config.cache_test_failed = No s'ha pogut examinar la memòria cau: %v.
@@ -3193,25 +3089,31 @@ config.https_only = Només HTTPS
 config.picture_config = Configuració d'imatge i avatar
 config.disable_gravatar = Deshabilita Gravatar
 config.enable_federated_avatar = Habilita els avatars federats
-
+dashboard.operation_switch = Intercanvia
+users.2fa = A2F
+users.reset_2fa = Restableix l'A2F
+auths.group_search_base = DN base de cerca de grup
+auths.group_attribute_list_users = Atribut de grup amb la llista d'usuaris
+auths.user_attribute_in_group = Atribut d'usuari llistat en el grup
+auths.map_group_to_team = Assigna els grups LDAP a equips d'organització (deixeu-ho buit per saltar-ho)
+auths.map_group_to_team_removal = Elimina els usuaris dels equips sincronitzats si no pertanyen al grup LDAP corresponent
+auths.helo_hostname = Hostname HELO
+auths.helo_hostname_helper = Hostname enviat amb HELO. Deixeu-ho en blanc per enviar el hostname actual.
+auths.disable_helo = Deshabilita HELO
+auths.skip_local_two_fa = Salta l'A2F local
+auths.skip_local_two_fa_helper = No marcar aquesta opció farà que els usuaris que tenen l'A2F definida igualment hauran de passar l'A2F per iniciar sessió
+auths.oauth2_tenant = Tenant
+auths.oauth2_scopes = Àmbits addicionals
+auths.oauth2_map_group_to_team_removal = Elimina els usuaris dels equips sincronitzats si no pertanyen al grup corresponent.
+auths.tips = Consells
+auths.tips.gmail_settings = Configuracions de Gmail:
+auths.tip.github = Registra una aplicació OAuth nova a %s
+auths.tip.gitlab_new = Registra una aplicació nova a %s
+auths.tip.google_plus = Obté les credencials del client OAuth2 amb la consola del Google API a %s
+auths.tip.openid_connect = Usa l'URL d'OpenID Connect Discovery (<server>/.well-known/openid-configuration) per a especificar els endpoints
 dashboard.update_checker = Comprovador d'actualització
 
 [actions]
-variables = Variables
-variables.management = Gestionar variables
-variables.creation = Afegir variables
-variables.none = Encara no hi ha variables.
-variables.deletion = Eliminar variable
-variables.deletion.description = Eliminar una variable és permanent i no es pot desfer. Continua?
-variables.description = Les variables es passaran a certes accions i no es poden llegir altrament.
-variables.edit = Editar variable
-variables.not_found = No s'ha trobat la variable.
-variables.deletion.failed = No s'ha pogut eliminar la variable.
-variables.deletion.success = S'ha canviar el nom de la variable.
-variables.creation.failed = No s'ha pogut afegir la variable.
-variables.creation.success = S'ha afegit la variable "%s".
-variables.update.failed = No s'ha pogut editar la variable.
-variables.update.success = S'ha editat la variable.
 runs.no_workflows.help_write_access = No sabeu com començar amb Forgejo Actions? Feu un cop d'ull als <a target="_blank" rel="noopener noreferrer" href="%s">primers passos a la documentació d'usuari</a> per escriure el vostre primer flux de treball, llavors <a target="_blank" rel="noopener noreferrer" href="%s">configureu un runner Forgejo</a> per a executar els vostres treballs.
 runs.no_workflows.help_no_write_access = Per saber-ne més sobre Forgejo Actions, vegeu <a target="_blank" rel="noopener noreferrer" href="%s">la documentació</a>.
 
diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 6904af13d0..95457b6dcb 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -37,18 +37,6 @@ twofa=Dvoufázové ověření
 twofa_scratch=Dvoufaktorový kód
 passcode=Přístupový kód
 
-webauthn_insert_key=Vložte svůj bezpečnostní klíč
-webauthn_sign_in=Stiskněte tlačítko na svém bezpečnostním klíči. Pokud bezpečnostní klíč nemá žádné tlačítko, vložte jej znovu.
-webauthn_press_button=Stiskněte tlačítko na bezpečnostním klíči…
-webauthn_use_twofa=Použít dvoufaktorový kód z vašeho telefonu
-webauthn_error=Nepodařilo se přečíst váš bezpečnostní klíč.
-webauthn_unsupported_browser=Váš prohlížeč momentálně nepodporuje WebAuthn.
-webauthn_error_unknown=Došlo k neznámé chybě. Opakujte akci.
-webauthn_error_insecure=WebAuthn podporuje pouze zabezpečená připojení. Pro testování přes HTTP můžete použít výchozí „localhost“ nebo „127.0.0.1“
-webauthn_error_unable_to_process=Server nemohl zpracovat váš požadavek.
-webauthn_error_duplicated=Bezpečnostní klíč není pro tento požadavek povolen. Ujistěte se prosím, zda klíč již není registrován.
-webauthn_error_empty=Musíte nastavit název tohoto klíče.
-webauthn_error_timeout=Požadavek vypršel dříve, než se podařilo přečíst váš klíč. Znovu načtěte tuto stránku a akci opakujte.
 repository=Repozitář
 organization=Organizace
 mirror=Zrcadlo
@@ -1154,14 +1142,6 @@ migrate_options_lfs_endpoint.label=Endpoint LFS
 migrate_options_lfs_endpoint.description=Migrace se pokusí použít váš vzdálený Git pro <a target="_blank" rel="noopener noreferrer" href="%s">určení LFS serveru</a>. Můžete také zadat vlastní koncový bod, pokud jsou data LFS repozitáře uložena někde jinde.
 migrate_options_lfs_endpoint.description.local=Podporována je také cesta k lokálnímu serveru.
 migrate_options_lfs_endpoint.placeholder=Ponecháte-li prázdné, koncový bod bude odvozen z adresy URL klonu
-migrate_items=Položky pro migrování
-migrate_items_wiki=Wiki
-migrate_items_milestones=Milníky
-migrate_items_labels=Štítky
-migrate_items_issues=Problémy
-migrate_items_pullrequests=Žádosti o sloučení
-migrate_items_merge_requests=Sloučit žádosti
-migrate_items_releases=Vydání
 migrate_repo=Migrovat repozitář
 migrate.clone_address=Migrovat / klonovat z URL
 migrate.clone_address_desc=HTTP(S) nebo URL Git „clone“ existujícího repozitáře
@@ -1180,16 +1160,6 @@ migrate.migrating=Probíhá migrace z <b>%s</b> …
 migrate.migrating_failed=Migrace z <b>%s</b> se nezdařila.
 migrate.migrating_failed.error=Nepodařilo se migrovat: %s
 migrate.migrating_failed_no_addr=Migrace se nezdařila.
-migrate.migrating_git=Migrace dat z Gitu
-migrate.migrating_topics=Migrace témat
-migrate.migrating_milestones=Migrace milníků
-migrate.migrating_labels=Migrace štítků
-migrate.migrating_releases=Migrace vydání
-migrate.migrating_issues=Migrace problémů
-migrate.migrating_pulls=Migrace žádostí o sloučení
-migrate.cancel_migrating_title=Zrušit migraci
-migrate.cancel_migrating_confirm=Chcete zrušit tuto migraci?
-
 mirror_from=zrcadlo
 forked_from=forknuto z
 generated_from=generováno z
@@ -2647,12 +2617,6 @@ pulls.ready_for_review = Připraveni na posouzení?
 settings.rename_branch_failed_protected = Nepodařilo se přejmenovat větev %s, jelikož se jedná o chráněnou větev.
 editor.push_out_of_date = Push je nejspíše zastaralý.
 stars = Oblíbení
-n_commit_one = %s revize
-n_commit_few = %s revizí
-n_branch_one = %s větev
-n_tag_one = %s značka
-n_tag_few = %s značek
-n_branch_few = %s větví
 settings.event_pull_request_enforcement = Vynucení
 settings.enforce_on_admins = Vynutit toto pravidlo pro správce repozitáře
 settings.enforce_on_admins_desc = Správci repozitáře nemohou obejít toto pravidlo.
@@ -2676,8 +2640,6 @@ settings.transfer.button = Převést vlastnictví
 settings.transfer.modal.title = Převést vlastnictví
 wiki.search = Hledat na wiki
 wiki.no_search_results = Žádné výsledky
-n_release_one = %s vydání
-n_release_few = %s vydání
 settings.federation_settings = Nastavení federace
 settings.federation_apapiurl = Adresa URL federace tohoto repozitáře. Zkopírujte a vložte tuto adresu do nastavení federace jiného repozitáře jako adresu sledovaného repozitáře.
 settings.federation_not_enabled = Na vaší instanci není dostupná federace.
@@ -2961,34 +2923,6 @@ dashboard.reinit_missing_repos=Znovu inicializovat všechny chybějící repozit
 dashboard.sync_external_users=Synchronizovat externí uživatelská data
 dashboard.cleanup_hook_task_table=Vyčistit tabulku hook_task
 dashboard.cleanup_packages=Vyčistit prošlé balíčky
-dashboard.server_uptime=Doba provozu serveru
-dashboard.current_goroutine=Aktuální goroutines
-dashboard.current_memory_usage=Aktuální využití paměti
-dashboard.total_memory_allocated=Celková přidělená paměť
-dashboard.memory_obtained=Získaná paměť
-dashboard.pointer_lookup_times=Časy vyhledávání ukazatelů
-dashboard.memory_allocate_times=Alokace paměti
-dashboard.memory_free_times=Uvolnění paměti
-dashboard.current_heap_usage=Aktuální využití paměti zásobníku
-dashboard.heap_memory_obtained=Získaná paměť zásobníku
-dashboard.heap_memory_idle=Nečinná paměť zásobníku
-dashboard.heap_memory_in_use=Používaná paměť zásobníku
-dashboard.heap_memory_released=Uvolněná paměť zásobníku
-dashboard.heap_objects=Objekty zásobníku
-dashboard.bootstrap_stack_usage=Využití zásobníku prvotního zavedení
-dashboard.stack_memory_obtained=Celková získaná pamět zásobníku
-dashboard.mspan_structures_usage=Užití struktur MSpan
-dashboard.mspan_structures_obtained=Získané struktury MSpan
-dashboard.mcache_structures_usage=Využití struktur MCache
-dashboard.mcache_structures_obtained=Získané struktury MCache
-dashboard.profiling_bucket_hash_table_obtained=Získaná profilovací bucket hash tabulka
-dashboard.gc_metadata_obtained=Získaná metadata GC
-dashboard.other_system_allocation_obtained=Získaná alokace ostatních systémových prostředků
-dashboard.next_gc_recycle=Příští recyklace GC
-dashboard.last_gc_time=Doba od posledního GC
-dashboard.total_gc_pause=Celková pauza GC
-dashboard.last_gc_pause=Poslední pauza GC
-dashboard.gc_times=Časy GC
 dashboard.delete_old_actions=Odstranit všechny staré aktivity z databáze
 dashboard.delete_old_actions.started=Spuštěno odstraňování všech starých aktivit z databáze.
 dashboard.update_checker=Kontrola aktualizací
@@ -3045,18 +2979,6 @@ users.purge_help=Vynuceně odstranit uživatele a všechny repositáře, organiz
 users.still_own_packages=Tento uživatel stále vlastní jeden nebo více balíčků, nejprve odstraňte tyto balíčky.
 users.deletion_success=Uživatelský účet byl smazán.
 users.reset_2fa=Resetovat 2FA
-users.list_status_filter.menu_text=Filtr
-users.list_status_filter.reset=Obnovit
-users.list_status_filter.is_active=Aktivní
-users.list_status_filter.not_active=Neaktivní
-users.list_status_filter.is_admin=Administrátor
-users.list_status_filter.not_admin=Není administrátor
-users.list_status_filter.is_restricted=Omezeno
-users.list_status_filter.not_restricted=Není omezen
-users.list_status_filter.is_prohibit_login=Zakázat přihlášení
-users.list_status_filter.not_prohibit_login=Povolit přihlášení
-users.list_status_filter.is_2fa_enabled=2FA povoleno
-users.list_status_filter.not_2fa_enabled=2FA zakázáno
 users.details=Podrobnosti o uživateli
 
 emails.email_manage_panel=Správa uživatelských e-mailů
@@ -3370,24 +3292,6 @@ monitor.process.cancel_desc=Zrušení procesu může způsobit ztrátu dat
 monitor.process.cancel_notices=Zrušit: <strong>%s</strong>?
 monitor.process.children=Potomek
 
-monitor.queues=Fronty
-monitor.queue=Fronta: %s
-monitor.queue.name=Název
-monitor.queue.type=Typ
-monitor.queue.exemplar=Typ vzoru
-monitor.queue.numberworkers=Počet workerů
-monitor.queue.maxnumberworkers=Maximální počet workerů
-monitor.queue.numberinqueue=Číslo ve frontě
-monitor.queue.review_add=Posoudit / přidat workery
-monitor.queue.settings.title=Nastavení poolu
-monitor.queue.settings.maxnumberworkers=Maximální počet workerů
-monitor.queue.settings.maxnumberworkers.placeholder=V současné době %[1]d
-monitor.queue.settings.maxnumberworkers.error=Maximální počet workerů musí být číslo
-monitor.queue.settings.submit=Upravit nastavení
-monitor.queue.settings.changed=Nastavení upravena
-monitor.queue.settings.remove_all_items=Odstranit vše
-monitor.queue.settings.remove_all_items_done=Všechny položky ve frontě byly odstraněny.
-
 notices.system_notice_list=Systémová oznámení
 notices.view_detail_header=Podrobnosti oznámení
 notices.operations=Operace
@@ -3403,7 +3307,6 @@ notices.desc=Popis
 notices.op=Op.
 notices.delete_success=Systémové upozornění bylo smazáno.
 dashboard.sync_repo_branches = Synchronizovat vynechané větve z dat Gitu do databáze
-monitor.queue.activeworkers = Aktivní workery
 defaulthooks.desc = Webhooky automaticky vytvářejí žádosti HTTP POST na server, kde se spustí určité události Forgejo. Webhooky zde definované jsou výchozí a budou zkopírovány do všech nových repozitářů. Více informací zjistíte v <a target="_blank" rel="noopener" href="%s">návodu webhooků</a>.
 systemhooks.desc = Webhooky automaticky vytvářejí žádosti HTTP POST na server, kde se spustí určité události Forgejo. Webhooky zde definované budou aktivní u všech repozitářů v systému, zvažte tedy prosím všechny vlivy na výkon, které může tato funkce způsobit. Více informací zjistíte v <a target="_blank" rel="noopener" href="%s">návodu webhooků</a>.
 assets = Assety kódu
@@ -3418,8 +3321,6 @@ self_check.database_fix_mysql=Pro uživatele MySQL/MariaDB můžete použít př
 self_check = Vlastní kontrola
 self_check.database_collation_case_insensitive=Databáze používá collation %s, což je collation nerozlišující velká a malá písmena. Ačkoli s ní Forgejo může pracovat, mohou se vyskytnout vzácné případy, kdy nebude fungovat podle očekávání.
 auths.oauth2_map_group_to_team = Zmapovat zabrané skupiny u týmů organizací (volitelné - vyžaduje název claimu výše)
-monitor.queue.settings.desc = Pooly dynamicky rostou podle blokování fronty jejich workerů.
-
 auths.tips.gmail_settings = Nastavení služby Gmail:
 config_summary = Souhrn
 config.open_with_editor_app_help = Editory v nabídce „Otevřít pomocí“ v nabídce klonování. Ponechte prázdné pro použití výchozího editoru (zobrazíte jej rozšířením).
@@ -3542,21 +3443,7 @@ workflow.enable_success=Workflow „%s“ byl úspěšně aktivován.
 workflow.disabled=Workflow je zakázán.
 
 
-variables=Proměnné
-variables.management=Správa proměnných
-variables.creation=Přidat proměnnou
-variables.none=Zatím zde nejsou žádné proměnné.
-variables.deletion=Odstranit proměnnou
-variables.deletion.description=Odstranění proměnné je trvalé a nelze jej vrátit zpět. Pokračovat?
-variables.description=Proměnné budou předány určitým akcím a nelze je přečíst jinak.
 variables.id_not_exist = Proměnná s id %d neexistuje.
-variables.edit=Upravit proměnnou
-variables.deletion.failed=Nepodařilo se odstranit proměnnou.
-variables.deletion.success=Proměnná byla odstraněna.
-variables.creation.failed=Přidání proměnné se nezdařilo.
-variables.creation.success=Proměnná „%s“ byla přidána.
-variables.update.failed=Úprava proměnné se nezdařila.
-variables.update.success=Proměnná byla upravena.
 need_approval_desc = Potřebovat schválení pro spouštění workflowů pro žádosti o sloučení forků.
 workflow.dispatch.use_from = Použít workflow z
 workflow.dispatch.run = Spustit workflow
@@ -3568,7 +3455,6 @@ workflow.dispatch.success = Žádost o spuštění workflow byla úspěšně ode
 runs.expire_log_message = Protokoly byly smazány, protože byly příliš staré.
 runs.no_workflows.help_no_write_access = Pro více informací o Forgejo Actions se podívejte do <a target="_blank" rel="noopener noreferrer" href="%s">dokumentace</a>.
 runs.no_workflows.help_write_access = Nevíte, jak začít s Forgejo Actions? Podívejte se na <a target="_blank" rel="noopener noreferrer" href="%s">rychlý začátek v uživatelské dokumentaci</a> pro vytvoření vašeho prvního workflow. Poté <a target="_blank" rel="noopener noreferrer" href="%s">nastavte runner Forgejo</a> pro provádění vašich úloh.
-variables.not_found = Nepodařilo se najít proměnnou.
 
 [projects]
 type-1.display_name=Samostatný projekt
@@ -3614,9 +3500,6 @@ regexp = RegExp
 regexp_tooltip = Interpretovat hledaný výraz jako regulární výraz
 
 [markup]
-filepreview.lines = Řádky %[1]d až %[2]d v souboru %[3]s
-filepreview.line = Řádek %[1]d v souboru %[2]s
-filepreview.truncated = Náhled byl zkrácen
 
 [munits.data]
 
diff --git a/options/locale/locale_da.ini b/options/locale/locale_da.ini
index 869fd0b734..6efa9bcec3 100644
--- a/options/locale/locale_da.ini
+++ b/options/locale/locale_da.ini
@@ -35,14 +35,6 @@ re_type = Bekræft adgangskode
 captcha = CAPTCHA
 twofa = To-faktor autentificering
 twofa_scratch = To-faktor skrabekode
-webauthn_sign_in = Tryk på knappen på din sikkerhedsnøgle. Hvis din sikkerhedsnøgle ikke har nogen knap, skal du indsætte den igen.
-webauthn_use_twofa = Brug en tofaktorkode fra din telefon
-webauthn_error = Kunne ikke læse din sikkerhedsnøgle.
-webauthn_unsupported_browser = Din browser understøtter i øjeblikket ikke WebAuthn.
-webauthn_error_unknown = Der opstod en ukendt fejl. Prøv venligst igen.
-webauthn_error_unable_to_process = Serveren kunne ikke behandle din anmodning.
-webauthn_error_duplicated = Sikkerhedsnøglen er ikke tilladt for denne anmodning. Sørg for, at nøglen ikke allerede er registreret.
-webauthn_error_empty = Du skal angive et navn for denne nøgle.
 organization = Organisation
 mirror = Mirror
 new_mirror = Ny mirror
@@ -112,11 +104,7 @@ show_timestamps = Vis tidsstempler
 show_log_seconds = Vis sekunder
 tracked_time_summary = Opsummering af sporet tid baseret på filtre af problemliste
 signed_in_as = Logget ind som
-webauthn_error_insecure = WebAuthn understøtter kun sikre forbindelser. Til test over HTTP kan du bruge oprindelsen "localhost" eller "127.0.0.1"
 invalid_data = Ugyldige data: %v
-webauthn_insert_key = Indsæt din sikkerhedsnøgle
-webauthn_press_button = Tryk venligst på knappen på din sikkerhedsnøgle…
-webauthn_error_timeout = Timeout nået, før din nøgle kunne læses. Genindlæs denne side og prøv igen.
 enabled = Aktiveret
 locked = Låst
 copy_hash = Kopiér hash
@@ -1134,14 +1122,6 @@ migrate_options_mirror_helper = Dette depot vil være et spejl
 migrate_options_lfs = Migrer LFS-filer
 migrate_options_lfs_endpoint.label = LFS endepunkt
 migrate_options_lfs_endpoint.description.local = En lokal serversti understøttes også.
-migrate_items = Migration Elementer
-migrate_items_wiki = Wiki
-migrate_items_milestones = Milepæle
-migrate_items_labels = Etiketter
-migrate_items_issues = Problemmer
-migrate_items_pullrequests = Pull-anmodninger
-migrate_items_merge_requests = Flet anmodninger
-migrate_items_releases = Udgivelser
 migrate_repo = Migrer depot
 migrate.clone_address_desc = HTTP(S) eller Git "klone" URL'en for et eksisterende depot
 migrate.clone_local_path = eller en lokal serversti
@@ -1157,14 +1137,6 @@ migrate.migrating = Migrerer fra <b>%s</b> …
 migrate.migrating_failed = Migrering fra <b>%s</b> mislykkedes.
 migrate.migrating_failed.error = Kunne ikke migrere: %s
 migrate.migrating_failed_no_addr = Migration mislykkedes.
-migrate.migrating_git = Migrering af Git-data
-migrate.migrating_topics = Migrering af emner
-migrate.migrating_milestones = Migrerende milepæle
-migrate.migrating_labels = Migrering af etiketter
-migrate.migrating_releases = Migrering af udgivelser
-migrate.migrating_issues = Migrering af problemer
-migrate.migrating_pulls = Migrering af pull-anmodninger
-migrate.cancel_migrating_title = Annuller migrering
 mirror_from = spejl af
 forked_from = forked fra
 generated_from = genereret fra
@@ -1175,7 +1147,6 @@ migrate_options_lfs_endpoint.description = Migration vil forsøge at bruge din f
 form.name_pattern_not_allowed = Mønsteret "%s" er ikke tilladt i et depotnavn.
 migrate_options_lfs_endpoint.placeholder = Hvis det efterlades tomt, vil endepunktet blive afledt fra klonens URL
 migrate.clone_address = Migrer / Klon fra URL
-migrate.cancel_migrating_confirm = Vil du annullere denne migrering?
 more_operations = Flere operationer
 new_from_template = Brug en skabelon
 new_from_template_description = Du kan vælge en eksisterende depotskabelon på denne instans og anvende dens indstillinger.
@@ -1269,15 +1240,10 @@ packages = Pakker
 actions = Handlinger
 labels = Etiketter
 milestones = Milepæle
-n_commit_few = %s commits
-n_branch_one = %s gren
-n_branch_few = %s grene
 org_labels_desc_manage = Styr
 commits = Commits
 commit = Commit
 org_labels_desc = Etiketter på organisationsniveau, der kan bruges med <strong>alle depoter</strong> under denne organisation
-n_commit_one = %s commit
-n_release_few = %s udgivelser
 released_this = udgivet dette
 file.title = %s ved %s
 file_raw = Rå
@@ -1287,9 +1253,6 @@ editor.fail_to_update_file_summary = Fejlmeddelelse:
 editor.push_rejected_summary = Fuldstændig afvisningsmeddelelse:
 editor.add_subdir = Tilføj en mappe…
 editor.unable_to_upload_files = Kunne ikke uploade filer til "%s" med fejl: %v
-n_tag_one = %s tag
-n_tag_few = %s tags
-n_release_one = %s udgivelse
 file_history = Historie
 file_view_source = Se kilde
 file_view_rendered = Vis gengivet
@@ -2879,7 +2842,6 @@ config.db_name = Navn
 users.full_name = Fulde navn
 users.activated = Aktiveret
 repos.name = Navn
-monitor.queue.name = Navn
 repos.private = Privat
 config.default_enable_timetracking = Aktiver tidsregistrering som standard
 config.enable_timetracking = Aktiver tidsregistrering
@@ -2888,11 +2850,6 @@ config.allow_dots_in_usernames = Tillad brugere at bruge prikker i deres brugern
 auths.oauth2_icon_url = Icon URL
 users.edit = Redigere
 users.auth_source = Godkendelseskilde
-monitor.queue.settings.maxnumberworkers.placeholder = I øjeblikket %[1]d
-monitor.queue.settings.submit = Opdater indstillinger
-monitor.queue.settings.changed = Indstillinger opdateret
-monitor.queue.settings.remove_all_items = Slet alle
-monitor.queue.settings.remove_all_items_done = Alle varer i køen er blevet fjernet.
 notices.system_notice_list = Systemmeddelelser
 dashboard.delete_repo_archives = Slet alle depoters arkiver (ZIP, TAR.GZ osv..)
 organizations = Organisationer
@@ -2923,8 +2880,6 @@ dashboard.clean_unbind_oauth = Rens ubundne OAuth-forbindelser
 dashboard.delete_inactive_accounts.started = Slet alle uaktiverede konti opgave startet.
 dashboard.delete_missing_repos = Slet alle depoter, der mangler deres Git-filer
 dashboard.update_migration_poster_id = Opdater migrationsplakat-id'er
-dashboard.memory_obtained = Hukommelse opnået
-dashboard.pointer_lookup_times = Pointer-opslagstider
 hooks = Webhooks
 dashboard.cron.finished = Cron: %[1]s er færdig
 dashboard.delete_inactive_accounts = Slet alle uaktiverede konti
@@ -2933,10 +2888,6 @@ notices = Systemmeddelelser
 config_summary = Oversigt
 dashboard.system_status = System status
 dashboard.update_mirrors = Opdater spejle
-dashboard.server_uptime = Server oppetid
-dashboard.current_goroutine = Nuværende goroutiner
-dashboard.current_memory_usage = Aktuel hukommelsesbrug
-dashboard.total_memory_allocated = Samlet hukommelse tildelt
 integrations = Integrationer
 dashboard.operations = Vedligeholdelses operationer
 dashboard.repo_health_check = Sundhedstjek alle depoter
@@ -2972,16 +2923,6 @@ users.update_profile = Opdater brugerkonto
 users.still_has_org = Denne bruger er medlem af en organisation. Fjern først brugeren fra enhver organisation.
 users.purge_help = Tvangsslet brugeren og eventuelle depoter, organisationer og pakker, der ejes af brugeren. Alle kommentarer og problemer indsendt af denne bruger vil også blive slettet.
 users.is_admin = Administrator konto
-dashboard.mspan_structures_obtained = Mspan strukturer opnået
-dashboard.mcache_structures_usage = MCache strukturer brug
-dashboard.mspan_structures_usage = MSpan strukturer brug
-dashboard.mcache_structures_obtained = MCache-strukturer opnået
-dashboard.profiling_bucket_hash_table_obtained = Profilering bucket hash tabel opnået
-dashboard.gc_metadata_obtained = GC-metadata opnået
-dashboard.other_system_allocation_obtained = Anden systemallokering opnået
-dashboard.next_gc_recycle = Næste GC genbrug
-dashboard.total_gc_pause = Total GC-pause
-dashboard.last_gc_time = Tid siden sidste GC
 dashboard.delete_old_system_notices = Slet alle gamle systemmeddelelser fra databasen
 dashboard.gc_lfs = Affaldssamler LFS-metaobjekter
 dashboard.start_schedule_tasks = Start planlæg handlingsopgaver
@@ -2993,12 +2934,6 @@ users.created = Oprettet
 users.max_repo_creation = Maksimalt antal depoter
 users.prohibit_login = Suspenderet konto
 users.is_restricted = Begrænset konto
-dashboard.memory_allocate_times = Hukommelsestildelinger
-dashboard.memory_free_times = Hukommelses frigørelse
-dashboard.current_heap_usage = Nuværende heap-brug
-dashboard.heap_memory_obtained = Heap-hukommelse opnået
-dashboard.heap_objects = Heap genstande
-dashboard.bootstrap_stack_usage = Brug af bootstrap-stak
 dashboard.update_checker = Opdateringskontrol
 dashboard.delete_old_actions.started = Slet alle gamle aktiviteter fra den påbegyndte database.
 dashboard.stop_zombie_tasks = Stop zombiehandlingsopgaver
@@ -3012,19 +2947,10 @@ users.organization_creation.description = Tillad oprettelse af nye organisatione
 users.delete_account = Slet brugerkonto
 users.cannot_delete_self = Du kan ikke slette dig selv
 users.still_own_repo = Denne bruger ejer stadig et eller flere arkiver. Slet eller overfør disse depoter først.
-users.list_status_filter.is_admin = Admin
 users.block.description = Bloker denne bruger i at interagere med denne tjeneste via deres konto, og forbyd at logge ind.
 users.restricted.description = Tillad kun interaktion med de depoter og organisationer, hvor denne bruger er tilføjet som en samarbejdspartner. Dette forhindrer adgang til offentlige arkiver i denne instans.
-users.list_status_filter.menu_text = Filter
-dashboard.heap_memory_idle = Heap hukommelse inaktiv
-dashboard.heap_memory_in_use = Heap hukommelse i brug
-dashboard.heap_memory_released = Heap-hukommelse frigivet
-dashboard.stack_memory_obtained = Stakhukommelse opnået
-dashboard.last_gc_pause = Sidste GC-pause
-dashboard.gc_times = GC times
 dashboard.delete_old_actions = Slet alle gamle aktiviteter fra databasen
 users.allow_create_organization = Kan skabe organisationer
-users.list_status_filter.not_admin = Ikke admin
 users.allow_import_local = Kan importere lokale depoter
 users.send_register_notify = Giv besked om tilmelding via e-mail
 users.local = Lokal
@@ -3039,9 +2965,6 @@ users.max_repo_creation_desc = (Indtast -1 for at bruge den globale standardgræ
 users.is_activated = Aktiveret konto
 users.edit_account = Rediger brugerkonto
 packages.version = Version
-users.list_status_filter.reset = Nulstil
-users.list_status_filter.is_active = Aktiv
-users.list_status_filter.not_active = Inaktiv
 users.purge = Udrens bruger
 users.user_manage_panel = Administrer brugerkonti
 users.new_account = Opret brugerkonto
@@ -3055,25 +2978,19 @@ emails.not_updated = Kunne ikke opdatere den anmodede e-mailadresse: %v
 packages.package_manage_panel = Administrer pakker
 packages.total_size = Samlet størrelse: %s
 packages.unreferenced_size = Ikke-referencestørrelse: %s
-users.list_status_filter.is_2fa_enabled = 2FA aktiveret
-users.list_status_filter.not_2fa_enabled = 2FA deaktiveret
 emails.filter_sort.email_reverse = E-mail (omvendt)
 emails.filter_sort.name_reverse = Brugernavn (omvendt)
 emails.delete = Slet e-mail
 emails.delete_desc = Er du sikker på, at du vil slette denne e-mailadresse?
 emails.deletion_success = E-mailadressen er blevet slettet.
-users.list_status_filter.is_restricted = Begrænset
 emails.duplicate_active = Denne e-mailadresse er allerede aktiv for en anden bruger.
 emails.change_email_header = Opdater e-mail-egenskaber
 emails.change_email_text = Er du sikker på, at du vil opdatere denne e-mailadresse?
 repos.issues = Problemer
 repos.size = Størrelse
 repos.lfs_size = LFS størrelse
-users.list_status_filter.not_restricted = Ikke begrænset
 users.details = Brugeroplysninger
 emails.email_manage_panel = Administrer bruger-e-mails
-users.list_status_filter.is_prohibit_login = Forbyd login
-users.list_status_filter.not_prohibit_login = Tillad login
 emails.delete_primary_email_error = Du kan ikke slette den primære e-mail.
 orgs.org_manage_panel = Administrer organisationer
 repos.repo_manage_panel = Administrer depoter
@@ -3138,8 +3055,6 @@ self_check.database_collation_case_insensitive = Databasen bruger en sortering %
 config.git_max_diff_line_characters = Maks. diff-tegn pr. linje
 config.access_log_template = Skabelon til adgangslog
 monitor.process.children = Børn
-monitor.queues = Køer
-monitor.queue.settings.desc = Puljer vokser dynamisk som reaktion på deres blokering af arbejderkø.
 auths.auth_manage_panel = Administrer godkendelseskilder
 auths.auth_type = Godkendelsestype
 auths.map_group_to_team_removal = Fjern brugere fra synkroniserede teams, hvis brugeren ikke tilhører den tilsvarende LDAP-gruppe
@@ -3166,8 +3081,6 @@ monitor.stacktrace = Stakspor
 monitor.execute_time = Udførelsestid
 monitor.last_execution_result = Resultat
 monitor.process.cancel_notices = Annuller: <strong>%s</strong>?
-monitor.queue.type = Type
-monitor.queue.exemplar = Eksempler type
 auths.auth_name = Godkendelsesnavn
 auths.attribute_username = Brugernavn attribut
 auths.attribute_username_placeholder = Lad stå tomt for at bruge brugernavnet indtastet i Forgejo.
@@ -3210,13 +3123,11 @@ config.cache_test_slow = Cachetest lykkedes, men svaret er langsomt: %s.
 config.gc_interval_time = GC interval tid
 config.git_max_diff_files = Max diff filer vist
 config.git_gc_args = GC argumenter
-monitor.queue.settings.maxnumberworkers.error = Max antal arbejdere skal være et tal
 notices.inverse_selection = Omvendt valg
 notices.delete_selected = Slet valgte
 auths.allowed_domains_helper = Lad være tomt for at tillade alle domæner. Adskil flere domæner med et komma (",").
 auths.skip_local_two_fa = Spring over lokal 2FA
 auths.oauth2_required_claim_value_helper = Indstil denne værdi for at begrænse login fra denne kilde til brugere med et krav med dette navn og denne værdi
-monitor.queue.settings.maxnumberworkers = Max antal arbejdere
 notices.delete_all = Slet alle meddelelser
 auths.smtp_auth = SMTP-godkendelsestype
 config.default_visibility_organization = Standardsynlighed for nye organisationer
@@ -3315,7 +3226,6 @@ auths.attributes_in_bind = Hent attributter i bind DN-kontekst
 config.app_name = Instans titel
 config.app_slogan = instans slogan
 config.cache_interval = Cache interval
-monitor.queue.settings.title = Pool indstillinger
 notices.type = Type
 notices.type_2 = Opgave
 config.db_schema = Skematisk
@@ -3334,12 +3244,6 @@ monitor.execute_times = Udførelser
 monitor.download_diagnosis_report = Hent diagnoserapport
 monitor.process.cancel = Annuller processen
 monitor.process.cancel_desc = Annullering af en proces kan medføre tab af data
-monitor.queue = Kø: %s
-monitor.queue.numberworkers = Antal arbejdere
-monitor.queue.activeworkers = Aktive arbejdere
-monitor.queue.maxnumberworkers = Max antal arbejdere
-monitor.queue.numberinqueue = Nummer i kø
-monitor.queue.review_add = Gennemgå / tilføj arbejdere
 config.git_pull_timeout = Pull Operation timeout
 config.git_clone_timeout = Klone Operation timeout
 config.git_gc_timeout = GC Operation timeout
@@ -3373,15 +3277,9 @@ owner.settings.cleanuprules.keep.count.n = %d versioner pr. pakke
 
 [actions]
 unit.desc = Administrer integrerede CI/CD-pipelines med Forgejo Actions.
-variables.not_found = Variablen kunne ikke findes.
 workflow.enable = Aktiver arbejdsgang
 workflow.enable_success = Arbejdsgangen "%s" blev aktiveret.
-variables.none = Der er ingen variabler endnu.
-variables.edit = Rediger variabel
-variables.deletion.success = Variablen er blevet fjernet.
-variables.creation.failed = Kunne ikke tilføje variabel.
 runs.no_workflows.help_write_access = Ved du ikke, hvordan du starter med Forgejo Actions? Tjek <a target="_blank" rel="noopener noreferrer" href="%s">hurtigstarten i brugerdokumentationen</a> for at skrive dit første workflow, og <a target="_blank" rel="noopener noreferrer" href="%s">opsæt en Forgejo-løber</a> til at udføre dine opgaver.
-variables.update.success = Variablen er blevet redigeret.
 workflow.disable_success = Arbejdsgangen "%s" blev deaktiveret.
 workflow.disable = Deaktiver arbejdsgang
 workflow.dispatch.use_from = Brug arbejdsgangen fra
@@ -3391,20 +3289,11 @@ workflow.dispatch.warn_input_limit = Viser kun de første %d input.
 workflow.dispatch.success = Kørsel af arbejdsgang blev anmodet om.
 workflow.dispatch.input_required = Kræv værdi for input "%s".
 workflow.dispatch.invalid_input_type = Ugyldig inputtype "%s".
-variables.creation = Tilføj variabel
 need_approval_desc = Har brug for godkendelse for at køre arbejdsgange for fork pull-anmodning.
 runs.empty_commit_message = (tom commit besked)
 runs.expire_log_message = Logfiler er blevet renset, fordi de var for gamle.
-variables = Variabler
-variables.management = Administrer variabler
-variables.creation.success = Variablen "%s" er blevet tilføjet.
-variables.update.failed = Variablen kunne ikke redigeres.
 runs.no_workflows.help_no_write_access = For at lære om Forgejo Actions, se <a target="_blank" rel="noopener noreferrer" href="%s">dokumentationen</a>.
-variables.deletion = Fjern variabel
 variables.id_not_exist = Variabel med ID %d findes ikke.
-variables.deletion.description = Fjernelse af en variabel er permanent og kan ikke fortrydes. Vil du fortsætte?
-variables.description = Variabler vil blive videregivet til visse handlinger og kan ikke læses på anden vis.
-variables.deletion.failed = Variablen kunne ikke fjernes.
 workflow.dispatch.run = Kør arbejdsgang
 runs.no_runs = Workflowet har ingen kørsler endnu.
 
@@ -3490,9 +3379,6 @@ deleted.display_name = Slettet projekt
 type-1.display_name = Individuelt projekt
 
 [markup]
-filepreview.line = Linje %[1]d i %[2]s
-filepreview.lines = Linjer %[1]d til %[2]d i %[3]s
-filepreview.truncated = Forhåndsvisningen er blevet afkortet
 
 [git.filemode]
 symbolic_link = Symbolsk link
diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 541aa82833..4a356b1f6e 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -36,18 +36,6 @@ twofa=Zwei-Faktor-Authentifizierung
 twofa_scratch=Zwei-Faktor-Einmalpasswort
 passcode=PIN
 
-webauthn_insert_key=Hardware-Sicherheitsschlüssel einstecken
-webauthn_sign_in=Drücke den Knopf auf deinem Sicherheitsschlüssel. Wenn dein Sicherheitsschlüssel keinen Knopf hat, stecke ihn erneut ein.
-webauthn_press_button=Drücke den Knopf auf deinem Sicherheitsschlüssel …
-webauthn_use_twofa=Zwei-Faktor-Authentifizierung via Handy verwenden
-webauthn_error=Dein Sicherheitsschlüssel konnte nicht gelesen werden.
-webauthn_unsupported_browser=Dein Browser unterstützt derzeit kein WebAuthn.
-webauthn_error_unknown=Ein unbekannter Fehler ist aufgetreten. Bitte versuche es erneut.
-webauthn_error_insecure=WebAuthn unterstützt nur sichere Verbindungen. Zum Testen über HTTP kannst du „localhost“ oder „127.0.0.1“ als Host verwenden
-webauthn_error_unable_to_process=Der Server konnte deine Anfrage nicht bearbeiten.
-webauthn_error_duplicated=Für diese Anfrage ist der Sicherheitsschlüssel nicht erlaubt. Bitte stell sicher, dass er nicht bereits registriert ist.
-webauthn_error_empty=Du musst einen Namen für diesen Schlüssel festlegen.
-webauthn_error_timeout=Das Zeitlimit wurde erreicht, bevor dein Schlüssel gelesen werden konnte. Bitte lade die Seite erneut.
 repository=Repository
 organization=Organisation
 mirror=Spiegel
@@ -1153,14 +1141,6 @@ migrate_options_lfs_endpoint.label=LFS-Endpunkt
 migrate_options_lfs_endpoint.description=Migration wird versuchen, über den entfernten Git-Server <a target="_blank" rel="noopener noreferrer" href="%s">den LFS-Server zu bestimmen</a>. Du kannst auch einen eigenen Endpunkt angeben, wenn die LFS-Dateien woanders gespeichert werden.
 migrate_options_lfs_endpoint.description.local=Ein lokaler Serverpfad wird ebenfalls unterstützt.
 migrate_options_lfs_endpoint.placeholder=Wenn leer gelassen, wird der Endpunkt von der Klon-URL abgeleitet
-migrate_items=Migrationselemente
-migrate_items_wiki=Wiki
-migrate_items_milestones=Meilensteine
-migrate_items_labels=Labels
-migrate_items_issues=Issues
-migrate_items_pullrequests=Pull-Requests
-migrate_items_merge_requests=Merge-Requests
-migrate_items_releases=Releases
 migrate_repo=Repository migrieren
 migrate.clone_address=Migrations-/Klon-URL
 migrate.clone_address_desc=Die HTTP(S)- oder „git clone“-URL eines bereits existierenden Repositorys
@@ -1179,16 +1159,6 @@ migrate.migrating=Migriere von <b>%s</b> …
 migrate.migrating_failed=Migrieren von <b>%s</b> fehlgeschlagen.
 migrate.migrating_failed.error=Migration fehlgeschlagen: %s
 migrate.migrating_failed_no_addr=Migration fehlgeschlagen.
-migrate.migrating_git=Git-Daten werden migriert
-migrate.migrating_topics=Themen werden migriert
-migrate.migrating_milestones=Meilensteine werden migriert
-migrate.migrating_labels=Labels werden migriert
-migrate.migrating_releases=Releases werden migriert
-migrate.migrating_issues=Issues werden migriert
-migrate.migrating_pulls=Pull-Requests werden migriert
-migrate.cancel_migrating_title=Migration abbrechen
-migrate.cancel_migrating_confirm=Möchtest du diese Migration abbrechen?
-
 mirror_from=Spiegel von
 forked_from=geforkt von
 generated_from=erzeugt von
@@ -2647,13 +2617,7 @@ pulls.ready_for_review = Bereit zur Sichtung?
 settings.rename_branch_failed_protected = Branch %s kann nicht umbenannt werden, weil er ein geschützter Branch ist.
 editor.commit_id_not_matching = Die Datei wurde geändert, während du sie bearbeitet hast. Committe in einen neuen Branch, dann führe einen Merge durch.
 editor.push_out_of_date = Der Push scheint veraltet zu sein.
-n_commit_few = %s Commits
-n_branch_one = %s Branch
-n_branch_few = %s Branches
-n_tag_one = %s Tag
-n_tag_few = %s Tags
 stars = Favorisierungen
-n_commit_one = %s Commit
 issues.num_participants_one = %d Beteiligter
 settings.enforce_on_admins_desc = Repositoryadministratoren können diese Regel nicht umgehen.
 settings.enforce_on_admins = Erzwinge diese Regel für alle Repositoryadministratoren
@@ -2677,8 +2641,6 @@ settings.transfer.button = Besitz übertragen
 settings.transfer.modal.title = Besitz übertragen
 wiki.no_search_results = Keine Ergebnisse
 wiki.search = Wiki durchsuchen
-n_release_one = %s freigegeben
-n_release_few = %s Veröffentlichungen
 form.string_too_long = Die Zeichenkette ist länger als %d Zeichen.
 settings.federation_settings = Föderationseinstellungen
 settings.federation_following_repos = URLs folgender Repositorys. Durch „;“ getrennt, keine Leerzeichen.
@@ -2962,34 +2924,6 @@ dashboard.sync_external_users=Externe Benutzerdaten synchronisieren
 dashboard.cleanup_hook_task_table=Hook-Task-Tabelle bereinigen
 dashboard.cleanup_packages=Veraltete Pakete bereinigen
 dashboard.cleanup_actions=Abgelaufene Logs und Artefakte von Actions bereinigen
-dashboard.server_uptime=Server-Uptime
-dashboard.current_goroutine=Aktuelle Goroutinen
-dashboard.current_memory_usage=Aktuelle Speichernutzung
-dashboard.total_memory_allocated=Zugeteilter Gesamtspeicher
-dashboard.memory_obtained=Erhaltener Speicher
-dashboard.pointer_lookup_times=Anzahl Zeigerlookups
-dashboard.memory_allocate_times=Speicheranforderungen
-dashboard.memory_free_times=Speicherfreigaben
-dashboard.current_heap_usage=Aktuelle Heap-Auslastung
-dashboard.heap_memory_obtained=Erhaltener Heap-Arbeitsspeicher
-dashboard.heap_memory_idle=Unbenutzter Heap-Arbeitsspeicher
-dashboard.heap_memory_in_use=Benutzter-Heap-Arbeitsspeicher
-dashboard.heap_memory_released=Freigegebener Heap-Arbeitsspeicher
-dashboard.heap_objects=Heap-Objekte
-dashboard.bootstrap_stack_usage=Bootstrap-Stack-Auslastung
-dashboard.stack_memory_obtained=Erhaltener Stack-Arbeitsspeicher
-dashboard.mspan_structures_usage=MSpan-Structures-Auslastung
-dashboard.mspan_structures_obtained=Erhaltene MSpan-Structures
-dashboard.mcache_structures_usage=MCache-Structures-Auslastung
-dashboard.mcache_structures_obtained=Erhaltene MCache-Structures
-dashboard.profiling_bucket_hash_table_obtained=Erhaltene Analysesatz-Hashtabellen
-dashboard.gc_metadata_obtained=Erhaltene GC-Metadaten
-dashboard.other_system_allocation_obtained=Andere erhaltene System-Allokationen
-dashboard.next_gc_recycle=Nächster GC-Zyklus
-dashboard.last_gc_time=Seit letztem GC-Zyklus
-dashboard.total_gc_pause=Gesamte GC-Pause
-dashboard.last_gc_pause=Letzte GC-Pause
-dashboard.gc_times=GC-Zeiten
 dashboard.delete_old_actions=Alle alten Aktivitäten aus der Datenbank löschen
 dashboard.delete_old_actions.started=Löschen aller alten Aktivitäten aus der Datenbank gestartet.
 dashboard.update_checker=Update-Checker
@@ -3046,18 +2980,6 @@ users.purge_help=Das Löschen des Benutzers inklusive all seiner Repositorys, Or
 users.still_own_packages=Dieser Benutzer besitzt noch ein oder mehrere Pakete, lösche diese Pakete zuerst.
 users.deletion_success=Das Konto wurde gelöscht.
 users.reset_2fa=2FA zurücksetzen
-users.list_status_filter.menu_text=Filter
-users.list_status_filter.reset=Zurücksetzen
-users.list_status_filter.is_active=Aktiv
-users.list_status_filter.not_active=Inaktiv
-users.list_status_filter.is_admin=Administrator
-users.list_status_filter.not_admin=Nicht-Administrator
-users.list_status_filter.is_restricted=Eingeschränkt
-users.list_status_filter.not_restricted=Unbegrenzt
-users.list_status_filter.is_prohibit_login=Anmelden verbieten
-users.list_status_filter.not_prohibit_login=Anmelden erlaubt
-users.list_status_filter.is_2fa_enabled=2FA aktiviert
-users.list_status_filter.not_2fa_enabled=2FA deaktiviert
 users.details=Benutzerdetails
 
 emails.email_manage_panel=Benutzer-E-Mails verwalten
@@ -3375,26 +3297,6 @@ monitor.process.cancel_desc=Abbrechen eines Prozesses kann Datenverlust verursac
 monitor.process.cancel_notices=Abbrechen: <strong>%s</strong>?
 monitor.process.children=Subprozesse
 
-monitor.queues=Warteschlangen
-monitor.queue=Warteschlange: %s
-monitor.queue.name=Name
-monitor.queue.type=Typ
-monitor.queue.exemplar=Beispieltyp
-monitor.queue.numberworkers=Anzahl der Worker
-monitor.queue.activeworkers=Aktive Worker
-monitor.queue.maxnumberworkers=Maximale Anzahl der Worker
-monitor.queue.numberinqueue=Anzahl in der Warteschlange
-monitor.queue.review_add=Worker hinzufügen/prüfen
-monitor.queue.settings.title=Pool-Einstellungen
-monitor.queue.settings.desc=Pools wachsen dynamisch basierend auf der Blockierung der Arbeitswarteschlange.
-monitor.queue.settings.maxnumberworkers=Maximale Anzahl an Workern
-monitor.queue.settings.maxnumberworkers.placeholder=Derzeit %[1]d
-monitor.queue.settings.maxnumberworkers.error=Die Anzahl der Worker muss eine Zahl sein
-monitor.queue.settings.submit=Einstellungen aktualisieren
-monitor.queue.settings.changed=Einstellungen aktualisiert
-monitor.queue.settings.remove_all_items=Alle entfernen
-monitor.queue.settings.remove_all_items_done=Alle Elemente in der Warteschlange wurden entfernt.
-
 notices.system_notice_list=Systemmitteilungen
 notices.view_detail_header=Meldungsdetails ansehen
 notices.operations=Operationen
@@ -3542,20 +3444,6 @@ workflow.disabled=Workflow ist deaktiviert.
 
 need_approval_desc=Um Workflows für den Pull-Request eines Forks auszuführen, ist eine Genehmigung erforderlich.
 
-variables=Variablen
-variables.management=Variablen verwalten
-variables.creation=Variable hinzufügen
-variables.none=Es gibt noch keine Variablen.
-variables.deletion=Variable entfernen
-variables.deletion.description=Das Entfernen einer Variable ist dauerhaft und kann nicht rückgängig gemacht werden. Fortfahren?
-variables.description=Variablen werden an bestimmte Aktionen übergeben und können nicht anderweitig gelesen werden.
-variables.edit=Variable bearbeiten
-variables.deletion.failed=Fehler beim Entfernen der Variable.
-variables.deletion.success=Die Variable wurde entfernt.
-variables.creation.failed=Fehler beim Hinzufügen der Variable.
-variables.creation.success=Die Variable „%s“ wurde hinzugefügt.
-variables.update.failed=Fehler beim Bearbeiten der Variable.
-variables.update.success=Die Variable wurde bearbeitet.
 runs.empty_commit_message = (leere Commit-Nachricht)
 variables.id_not_exist = Variable mit ID %d existiert nicht.
 workflow.dispatch.use_from = Workflow benutzen von
@@ -3568,7 +3456,6 @@ workflow.dispatch.success = Ausführung des Workflows wurde erfolgreich angefrag
 runs.expire_log_message = Logs wurden gelöscht, weil sie zu alt waren.
 runs.no_workflows.help_write_access = Keine Ahnung, wie man mit Forgejo Actions anfangen soll? Schau im <a target="_blank" rel="noopener noreferrer" href="%s">Schnellstart in der Benutzerdokumentation</a> vorbei, um deinen ersten Workflow zu schreiben, dann <a target="_blank" rel="noopener noreferrer" href="%s">setze einen Forgejo-Runner auf</a>, um deine Jobs auszuführen.
 runs.no_workflows.help_no_write_access = Um mehr über Forgejo Actions zu erfahren, siehe <a target="_blank" rel="noopener noreferrer" href="%s">die Dokumentation</a>.
-variables.not_found = Die Variable wurde nicht gefunden.
 
 [projects]
 type-1.display_name=Individuelles Projekt
@@ -3614,9 +3501,6 @@ regexp = RegExp
 regexp_tooltip = Suchbegriff als regulären Ausdruck interpretieren
 
 [markup]
-filepreview.line = Zeile %[1]d in %[2]s
-filepreview.truncated = Vorschau wurde gekürzt
-filepreview.lines = Zeilen %[1]d bis %[2]d in %[3]s
 
 [munits.data]
 
diff --git a/options/locale/locale_el-GR.ini b/options/locale/locale_el-GR.ini
index 682af86f78..4ad57c7bb5 100644
--- a/options/locale/locale_el-GR.ini
+++ b/options/locale/locale_el-GR.ini
@@ -37,18 +37,6 @@ twofa=Πιστοποίηση δύο παραγόντων
 twofa_scratch=Κωδικός μίας χρήσης (για πιστοποίηση δύο παραγόντων / 2FA)
 passcode=Κωδικός
 
-webauthn_insert_key=Εισάγετε το κλειδί ασφαλείας σας
-webauthn_sign_in=Πατήστε το κουμπί στο κλειδί ασφαλείας σας. Αν το κλειδί ασφαλείας σας δεν έχει κουμπί, αποσυνδέστε το και συνδέστε το ξανά.
-webauthn_press_button=Παρακαλώ πατήστε το κουμπί στο κλειδί ασφαλείας…
-webauthn_use_twofa=Χρησιμοποιήστε έναν κωδικό δύο παραγόντων από το τηλέφωνό σας
-webauthn_error=Δεν ήταν δυνατή η επικοινωνία με το κλειδί ασφαλείας σας.
-webauthn_unsupported_browser=Το πρόγραμμα περιήγησής σας δεν υποστηρίζει επί του παρόντος WebAuthn.
-webauthn_error_unknown=Παρουσιάστηκε ένα άγνωστο σφάλμα. Παρακαλώ προσπαθήστε ξανά.
-webauthn_error_insecure=Το WebAuthn υποστηρίζει μόνο ασφαλές συνδέσεις. Αν θέλετε να διεξάγετε δοκιμές μέσω HTTP, μπορείτε να χρησιμοποιήσετε την προέλευση «localhost» ή «127.0.0.1»
-webauthn_error_unable_to_process=Ο διακομιστής δεν μπόρεσε να επεξεργαστεί το αίτημά σας.
-webauthn_error_duplicated=Το κλειδί ασφαλείας δεν επιτρέπεται για αυτό το αίτημα. Βεβαιωθείτε ότι το κλειδί δεν έχει ήδη καταχωρηθεί.
-webauthn_error_empty=Πρέπει να ορίσετε ένα όνομα για αυτό το κλειδί.
-webauthn_error_timeout=Το χρονικό όριο έφτασε πριν το κλειδί να διαβαστεί. Παρακαλώ ανανεώστε τη σελίδα και προσπαθήστε ξανά.
 repository=Αποθετήριο
 organization=Οργανισμός
 mirror=Αντίγραφο
@@ -1154,14 +1142,6 @@ migrate_options_lfs_endpoint.label=Άκρο LFS
 migrate_options_lfs_endpoint.description=Η μεταφορά θα προσπαθήσει να χρησιμοποιήσει το Git remote για να <a target="_blank" rel="noopener noreferrer" href="%s">καθορίσει τον διακομιστή LFS</a>. Μπορείτε επίσης να καθορίσετε ένα δικό σας endpoint αν τα δεδομένα LFS του αποθετηρίου αποθηκεύονται κάπου αλλού.
 migrate_options_lfs_endpoint.description.local=Μια διαδρομή στο τοπικό διακομιστή επίσης υποστηρίζεται.
 migrate_options_lfs_endpoint.placeholder=Αν αφεθεί κενό, το άκρο θα προκύψει από το URL του κλώνου
-migrate_items=Αντικείμενα μεταφοράς
-migrate_items_wiki=Wiki
-migrate_items_milestones=Ορόσημα
-migrate_items_labels=Σήματα
-migrate_items_issues=Ζητήματα
-migrate_items_pullrequests=Pull requests
-migrate_items_merge_requests=Merge requests
-migrate_items_releases=Κυκλοφορίες
 migrate_repo=Μεταφορά αποθετηρίου
 migrate.clone_address=Μεταφορά / Κλωνοποίηση από το URL
 migrate.clone_address_desc=Το HTTP(S) ή το Git URL «κλωνοποίησης» ενός υπάρχοντος αποθετηρίου
@@ -1180,16 +1160,6 @@ migrate.migrating=Γίνεται μεταφορά από το <b>%s</b>…
 migrate.migrating_failed=Η μεταφορά από το <b>%s</b> απέτυχε.
 migrate.migrating_failed.error=Αποτυχία μεταφοράς: %s
 migrate.migrating_failed_no_addr=Η μεταφορά απέτυχε.
-migrate.migrating_git=Τα δεδομένα Git μεταφέρονται
-migrate.migrating_topics=Τα θέματα μεταφέρονται
-migrate.migrating_milestones=Τα ορόσημα μεταφέρονται
-migrate.migrating_labels=Τα σήματα μεταφέρονται
-migrate.migrating_releases=Οι κυκλοφορίες μεταφέρονται
-migrate.migrating_issues=Τα ζητήματα μεταφέρονται
-migrate.migrating_pulls=Μεταφέρονται τα pull requests
-migrate.cancel_migrating_title=Ακύρωση μεταφοράς
-migrate.cancel_migrating_confirm=Θέλετε να ακυρώσετε αυτή τη μεταφορά;
-
 mirror_from=είδωλο του
 forked_from=forked από
 generated_from=παραγμένο από
@@ -2634,14 +2604,8 @@ activity.navbar.pulse = Παλμός
 settings.add_collaborator_blocked_them = Δεν είναι δυνατή η προσθήκη του χρήστη ως συνεργάτη, καθώς έχει αποκλείσει τον κάτοχο του αποθετηρίου.
 settings.wiki_rename_branch_main_notices_2 = Θα αλλάξει το όνομα του εσωτερικού κλάδου για το wiki του αποθετηρίου %s. Οι υπάρχουσες υποβολές θα πρέπει να ενημερωθούν.
 settings.add_collaborator_blocked_our = Δεν είναι δυνατή η προσθήκη του χρήστη ως συνεργάτη, καθώς ο κάτοχος του αποθετηρίου τον έχει αποκλείσει.
-n_branch_few = %s κλάδοι
-n_tag_one = %s ετικέτα
-n_tag_few = %s ετικέτες
-n_commit_one = %s υποβολή
 stars = Αστέρια
-n_branch_one = %s κλάδος
 commits.search_branch = Αυτός ο κλάδος
-n_commit_few = %s υποβολές
 settings.sourcehut_builds.secrets = Μυστικά
 settings.add_webhook.invalid_path = Η τοποθεσία του αρχείου δεν μπορεί να περιέχει κενά, «.» ή «..». Δεν μπορεί να αρχίζει ή να τελειώνει με μία κάθετο.
 commits.browse_further = Περιήγηση περισσοτέρων
@@ -2690,8 +2654,6 @@ settings.transfer.button = Παραχώρηση ιδιοκτησίας
 settings.matrix.room_id_helper = Το ID δωματίου μπορείτε να το βρείτε στο πρόγραμμα Element > Room Settings > Advanced > Internal room ID. Παράδειγμα: %s.
 wiki.search = Αναζήτηση wiki
 wiki.no_search_results = Κανένα αποτέλεσμα
-n_release_one = %s κυκλοφορία
-n_release_few = %s κυκλοφορίες
 release.hide_archive_links_helper = Απόκρυψη των αρχείων πηγαίου κώδικα που δημιουργούνται αυτόματα για αυτή την δημιοσίευση. Αυτή η ρύθμιση είναι χρήσιμη αν ανεβάζετε τα δικά σας αρχεία.
 release.type_attachment = Συνημμένο
 activity.published_prerelease_label = Προδημοσίευση
@@ -2961,34 +2923,6 @@ dashboard.sync_external_users=Συγχρονισμός δεδομένων εξω
 dashboard.cleanup_hook_task_table=Εκκαθάριση πίνακα hook_task
 dashboard.cleanup_packages=Εκκαθάριση ληγμένων πακέτων
 dashboard.cleanup_actions=Καθαρισμός ληγμένων καταγραφών και συνημμένων από τις δράσεις
-dashboard.server_uptime=Uptime διακομιστή
-dashboard.current_goroutine=Τρέχουσες goroutines
-dashboard.current_memory_usage=Τρέχουσα χρήση μνήμης
-dashboard.total_memory_allocated=Συνολική χρησιμοποιούμενη μνήμη
-dashboard.memory_obtained=Μνήμη που λαμβάνεται
-dashboard.pointer_lookup_times=Πλήθος αναζητήσεων δείκτη
-dashboard.memory_allocate_times=Κατανομές μνήμης
-dashboard.memory_free_times=Ελευθερώσεις μνήμης
-dashboard.current_heap_usage=Τρέχουσα χρήση heap
-dashboard.heap_memory_obtained=Μνήμη heap που λαμβάνεται
-dashboard.heap_memory_idle=Αδρανής μνήμη heap
-dashboard.heap_memory_in_use=Μνήμη heap σε χρήση
-dashboard.heap_memory_released=Μνήμη heap που απελευθερώθηκε
-dashboard.heap_objects=Αντικείμενα στο heap
-dashboard.bootstrap_stack_usage=Χρήση στοίβας bootstrap
-dashboard.stack_memory_obtained=Μνήμη στοίβας που λαμβάνεται
-dashboard.mspan_structures_usage=Χρήση δομών MSpan
-dashboard.mspan_structures_obtained=Δομές MSpan που έχουν ληφθεί
-dashboard.mcache_structures_usage=Χρήση δομών MCache
-dashboard.mcache_structures_obtained=Δομές MCache που έχουν ληφθεί
-dashboard.profiling_bucket_hash_table_obtained=Profiling bucket hash table που έχει ληφθεί
-dashboard.gc_metadata_obtained=Μεταδεδομένα GC που έχουν ληφθεί
-dashboard.other_system_allocation_obtained=Άλλες κατανομές συστήματος που έχουν ληφθεί
-dashboard.next_gc_recycle=Επόμενη ανακύκλωση GC
-dashboard.last_gc_time=Χρόνος από την τελευταία φορά που έγινε GC
-dashboard.total_gc_pause=Σύνολο παύσης GC
-dashboard.last_gc_pause=Τελευταία παύση GC
-dashboard.gc_times=Χρόνοι GC
 dashboard.delete_old_actions=Διαγραφή όλων των παλιών δραστηριοτήτων από τη βάση δεδομένων
 dashboard.delete_old_actions.started=Ξεκίνησε η διαγραφή όλων των παλιών δραστηριοτήτων από τη βάση δεδομένων.
 dashboard.update_checker=Ελεγκτής ενημερώσεων
@@ -3045,18 +2979,6 @@ users.purge_help=Εξαναγκαστική διαγραφή χρήστη καθ
 users.still_own_packages=Αυτός ο χρήστης εξακολουθεί να κατέχει ένα ή περισσότερα πακέτα, διαγράψτε αυτά τα πακέτα πρώτα.
 users.deletion_success=Ο λογαριασμός χρήστη έχει διαγραφεί.
 users.reset_2fa=Επαναφορά 2FA
-users.list_status_filter.menu_text=Φίλτρο
-users.list_status_filter.reset=Επαναφορά
-users.list_status_filter.is_active=Ενεργό
-users.list_status_filter.not_active=Ανενεργό
-users.list_status_filter.is_admin=Διαχειριστής
-users.list_status_filter.not_admin=Χωρίς δικαιώματα διαχειριστή
-users.list_status_filter.is_restricted=Περιορισμένος
-users.list_status_filter.not_restricted=Χωρίς περιορισμούς
-users.list_status_filter.is_prohibit_login=Απαγορευμένη σύνδεση
-users.list_status_filter.not_prohibit_login=Επιτρέπεται η σύνδεση
-users.list_status_filter.is_2fa_enabled=Με ενεργοποιημένο 2FA
-users.list_status_filter.not_2fa_enabled=Χωρίς 2FA
 users.details=Λεπτομέρειες χρήστη
 
 emails.email_manage_panel=Διαχείριση email χρηστών
@@ -3376,26 +3298,6 @@ monitor.process.cancel_desc=Η ακύρωση μιας διαδικασίας μ
 monitor.process.cancel_notices=Ακύρωση: <strong>%s</strong>;
 monitor.process.children=Θυγατρικές
 
-monitor.queues=Ουρές
-monitor.queue=Ουρά: %s
-monitor.queue.name=Όνομα
-monitor.queue.type=Τύπος
-monitor.queue.exemplar=Τύπος Υποδείγματος
-monitor.queue.numberworkers=Αριθμός εργατών
-monitor.queue.activeworkers=Ενεργοί εργάτες
-monitor.queue.maxnumberworkers=Μέγιστος αριθμός εργατών
-monitor.queue.numberinqueue=Πλήθος ουράς
-monitor.queue.review_add=Εξέταση / προσθήκη εργατών
-monitor.queue.settings.title=Ρυθμίσεις δεξαμενής
-monitor.queue.settings.desc=Οι δεξαμενές αυξάνονται δυναμικά όταν υπάρχει φραγή της ουράς των εργατών τους.
-monitor.queue.settings.maxnumberworkers=Μέγιστος Αριθμός Εργατών
-monitor.queue.settings.maxnumberworkers.placeholder=Αυτή τη στιγμή %[1]d
-monitor.queue.settings.maxnumberworkers.error=Ο μέγιστος αριθμός εργατών πρέπει να είναι αριθμός
-monitor.queue.settings.submit=Ενημέρωση ρυθμίσεων
-monitor.queue.settings.changed=Οι ρυθμίσεις ενημερώθηκαν
-monitor.queue.settings.remove_all_items=Αφαίρεση όλων
-monitor.queue.settings.remove_all_items_done=Όλα τα αντικείμενα στην ουρά αφαιρέθηκαν.
-
 notices.system_notice_list=Ειδοποιήσεις συστήματος
 notices.view_detail_header=Προβολή λεπτομερειών ειδοποίησης
 notices.operations=Λειτουργίες
@@ -3542,20 +3444,6 @@ workflow.disabled=Η ροή εργασιών είναι απενεργοποιη
 
 need_approval_desc=Πρέπει να εγκριθεί η εκτέλεση ροών εργασίας για pull request από fork.
 
-variables=Μεταβλητές
-variables.management=Διαχείριση μεταβλητών
-variables.creation=Προσθήκη μεταβλητή
-variables.none=Δεν υπάρχουν ακόμα μεταβλητές.
-variables.deletion=Αφαίρεση μεταβλητής
-variables.deletion.description=Η αφαίρεση μιας μεταβλητής είναι μόνιμη και δεν μπορεί να αναιρεθεί. Συνέχεια;
-variables.description=Η μεταβλητές θα δίνονται σε ορισμένες δράσεις και δεν μπορούν να διαβαστούν αλλιώς.
-variables.edit=Επεξεργασία Μεταβλητής
-variables.deletion.failed=Αποτυχία αφαίρεσης της μεταβλητής.
-variables.deletion.success=Η μεταβλητή έχει αφαιρεθεί.
-variables.creation.failed=Αποτυχία προσθήκης μεταβλητής.
-variables.creation.success=Η μεταβλητή «%s» προστέθηκε.
-variables.update.failed=Αποτυχία επεξεργασίας μεταβλητής.
-variables.update.success=Η μεταβλητή έχει τροποποιηθεί.
 variables.id_not_exist = Η μεταβλητή με id %d δεν υπάρχει.
 workflow.dispatch.trigger_found = Αυτή η ροή εργασίας έχει ένα «event trigger» <c>workflow_dispatch</c>.
 workflow.dispatch.success = Η εκτέλεση της ροής εργασίας αιτήθηκε επιτυχώς.
@@ -3567,7 +3455,6 @@ workflow.dispatch.invalid_input_type = Μη έγκυρο είδος εισόδο
 runs.no_workflows.help_write_access = Δεν γνωρίζεται πώς να ξεκινήσετε με τις Δράσεις Forgejo; Δείτε την <a target="_blank" rel="noopener noreferrer" href="%s"> γρήγορη εκκίνηση στην τεκμηρίωση χρήστη</a> για να γράψετε την πρώτη σας ροή εργασίας, στη συνέχεια <a target="_blank" rel="noopener noreferrer" href="%s"> ορίστε έναν εκτελεστή Forgejo</a> για να εκτελέσετε τις εργασίες σας.
 runs.no_workflows.help_no_write_access = Για να μάθετε για τις Δράσεις Forgejo, δείτε <a target="_blank" rel="noopener noreferrer" href="%s"> την τεκμηρίωση</a>.
 workflow.dispatch.warn_input_limit = Προβολή μόνο των πρώτων %d εισόδων.
-variables.not_found = Αποτυχία εύρεσης της μεταβλητής.
 
 [projects]
 type-1.display_name=Ατομικό έργο
@@ -3615,9 +3502,6 @@ regexp_tooltip = Ερμηνεία του όρου αναζήτησης ως κα
 [munits.data]
 
 [markup]
-filepreview.line = Γραμμή %[1]d στο αρχείο %[2]s
-filepreview.lines = Γραμμές %[1]d έως %[2]d στο αρχείο %[3]s
-filepreview.truncated = Η προεπισκόπηση έχει περικοπεί
 
 [translation_meta]
 test = ok
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 2df0b3a728..a74cf843e9 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -38,19 +38,6 @@ twofa = Two-factor authentication
 twofa_scratch = Two-factor scratch code
 passcode = Passcode
 
-webauthn_insert_key = Insert your security key
-webauthn_sign_in = Press the button on your security key. If your security key has no button, re-insert it.
-webauthn_press_button = Please press the button on your security key…
-webauthn_use_twofa = Use a two-factor code from your phone
-webauthn_error = Could not read your security key.
-webauthn_unsupported_browser = Your browser does not currently support WebAuthn.
-webauthn_error_unknown = An unknown error occurred. Please retry.
-webauthn_error_insecure = WebAuthn only supports secure connections. For testing over HTTP, you can use the origin "localhost" or "127.0.0.1"
-webauthn_error_unable_to_process = The server could not process your request.
-webauthn_error_duplicated = The security key is not permitted for this request. Please make sure that the key is not already registered.
-webauthn_error_empty = You must set a name for this key.
-webauthn_error_timeout = Timeout reached before your key could be read. Please reload this page and retry.
-
 repository = Repository
 new_fork = New repository fork
 new_project_column = New column
@@ -1208,14 +1195,6 @@ migrate_options_lfs_endpoint.label = LFS endpoint
 migrate_options_lfs_endpoint.description = Migration will attempt to use your Git remote to <a target="_blank" rel="noopener noreferrer" href="%s">determine the LFS server</a>. You can also specify a custom endpoint if the repository LFS data is stored somewhere else.
 migrate_options_lfs_endpoint.description.local = A local server path is supported too.
 migrate_options_lfs_endpoint.placeholder = If left blank, the endpoint will be derived from the clone URL
-migrate_items = Migration items
-migrate_items_wiki = Wiki
-migrate_items_milestones = Milestones
-migrate_items_labels = Labels
-migrate_items_issues = Issues
-migrate_items_pullrequests = Pull requests
-migrate_items_merge_requests = Merge requests
-migrate_items_releases = Releases
 migrate_repo = Migrate repository
 migrate.repo_desc_helper = Leave empty to import existing description
 migrate.clone_address = Migrate / Clone from URL
@@ -1235,16 +1214,6 @@ migrate.migrating = Migrating from <b>%s</b> …
 migrate.migrating_failed = Migrating from <b>%s</b> failed.
 migrate.migrating_failed.error = Failed to migrate: %s
 migrate.migrating_failed_no_addr = Migration failed.
-migrate.migrating_git = Migrating Git data
-migrate.migrating_topics = Migrating topics
-migrate.migrating_milestones = Migrating milestones
-migrate.migrating_labels = Migrating labels
-migrate.migrating_releases = Migrating releases
-migrate.migrating_issues = Migrating issues
-migrate.migrating_pulls = Migrating pull requests
-migrate.cancel_migrating_title = Cancel migration
-migrate.cancel_migrating_confirm = Do you want to cancel this migration?
-
 mirror_from = mirror of
 forked_from = forked from
 generated_from = generated from
@@ -1289,15 +1258,6 @@ milestones = Milestones
 org_labels_desc = Organization level labels that can be used with <strong>all repositories</strong> under this organization
 org_labels_desc_manage = manage
 
-n_commit_one=%s commit
-n_commit_few=%s commits
-n_branch_one=%s branch
-n_branch_few=%s branches
-n_tag_one=%s tag
-n_tag_few=%s tags
-n_release_one = %s release
-n_release_few = %s releases
-
 released_this = released this
 file.title = %s at %s
 file_raw = Raw
@@ -2980,34 +2940,6 @@ dashboard.sync_external_users = Synchronize external user data
 dashboard.cleanup_hook_task_table = Clean up hook_task table
 dashboard.cleanup_packages = Clean up expired packages
 dashboard.cleanup_actions = Clean up expired logs and artifacts from actions
-dashboard.server_uptime = Server uptime
-dashboard.current_goroutine = Current goroutines
-dashboard.current_memory_usage = Current memory usage
-dashboard.total_memory_allocated = Total memory allocated
-dashboard.memory_obtained = Memory obtained
-dashboard.pointer_lookup_times = Pointer lookup times
-dashboard.memory_allocate_times = Memory allocations
-dashboard.memory_free_times = Memory frees
-dashboard.current_heap_usage = Current heap usage
-dashboard.heap_memory_obtained = Heap memory obtained
-dashboard.heap_memory_idle = Heap memory idle
-dashboard.heap_memory_in_use = Heap memory in use
-dashboard.heap_memory_released = Heap memory released
-dashboard.heap_objects = Heap objects
-dashboard.bootstrap_stack_usage = Bootstrap stack usage
-dashboard.stack_memory_obtained = Stack memory obtained
-dashboard.mspan_structures_usage = MSpan structures usage
-dashboard.mspan_structures_obtained = MSpan structures obtained
-dashboard.mcache_structures_usage = MCache structures usage
-dashboard.mcache_structures_obtained = MCache structures obtained
-dashboard.profiling_bucket_hash_table_obtained = Profiling bucket hash table obtained
-dashboard.gc_metadata_obtained = GC metadata obtained
-dashboard.other_system_allocation_obtained = Other system allocation obtained
-dashboard.next_gc_recycle = Next GC recycle
-dashboard.last_gc_time = Time since last GC
-dashboard.total_gc_pause = Total GC pause
-dashboard.last_gc_pause = Last GC pause
-dashboard.gc_times = GC times
 dashboard.delete_old_actions = Delete all old activities from database
 dashboard.delete_old_actions.started = Delete all old activities from database started.
 dashboard.update_checker = Update checker
@@ -3071,18 +3003,6 @@ users.purge_help = Forcibly delete user and any repositories, organizations, and
 users.still_own_packages = This user still owns one or more packages, delete these packages first.
 users.deletion_success = The user account has been deleted.
 users.reset_2fa = Reset 2FA
-users.list_status_filter.menu_text = Filter
-users.list_status_filter.reset = Reset
-users.list_status_filter.is_active = Active
-users.list_status_filter.not_active = Inactive
-users.list_status_filter.is_admin = Admin
-users.list_status_filter.not_admin = Not admin
-users.list_status_filter.is_restricted = Restricted
-users.list_status_filter.not_restricted = Not restricted
-users.list_status_filter.is_prohibit_login = Prohibit login
-users.list_status_filter.not_prohibit_login = Allow login
-users.list_status_filter.is_2fa_enabled = 2FA enabled
-users.list_status_filter.not_2fa_enabled = 2FA disabled
 users.details = User details
 
 emails.email_manage_panel = Manage user emails
@@ -3133,13 +3053,13 @@ packages.published = Published
 
 defaulthooks = Default webhooks
 defaulthooks.desc = Webhooks automatically make HTTP POST requests to a server when certain Forgejo events trigger. Webhooks defined here are defaults and will be copied into all new repositories. Read more in the <a target="_blank" rel="noopener" href="%s">webhooks guide</a>.
-defaulthooks.add_webhook = Add Default Webhook
-defaulthooks.update_webhook = Update Default Webhook
+defaulthooks.add_webhook = Add default webhook
+defaulthooks.update_webhook = Update default webhook
 
 systemhooks = System webhooks
 systemhooks.desc = Webhooks automatically make HTTP POST requests to a server when certain Forgejo events trigger. Webhooks defined here will act on all repositories on the system, so please consider any performance implications this may have. Read more in the <a target="_blank" rel="noopener" href="%s">webhooks guide</a>.
-systemhooks.add_webhook = Add System Webhook
-systemhooks.update_webhook = Update System Webhook
+systemhooks.add_webhook = Add system webhook
+systemhooks.update_webhook = Update system webhook
 
 auths.auth_manage_panel = Manage authentication sources
 auths.new = Add authentication source
@@ -3402,26 +3322,6 @@ monitor.process.cancel = Cancel process
 monitor.process.cancel_desc = Canceling a process may cause data loss
 monitor.process.cancel_notices = Cancel: <strong>%s</strong>?
 
-monitor.queues = Queues
-monitor.queue = Queue: %s
-monitor.queue.name = Name
-monitor.queue.type = Type
-monitor.queue.exemplar = Exemplar Type
-monitor.queue.numberworkers = Number of workers
-monitor.queue.activeworkers = Active workers
-monitor.queue.maxnumberworkers = Max Number of workers
-monitor.queue.numberinqueue = Number in queue
-monitor.queue.review_add = Review / add workers
-monitor.queue.settings.title = Pool settings
-monitor.queue.settings.desc = Pools dynamically grow in response to their worker queue blocking.
-monitor.queue.settings.maxnumberworkers = Max Number of workers
-monitor.queue.settings.maxnumberworkers.placeholder = Currently %[1]d
-monitor.queue.settings.maxnumberworkers.error = Max number of workers must be a number
-monitor.queue.settings.submit = Update settings
-monitor.queue.settings.changed = Settings updated
-monitor.queue.settings.remove_all_items = Remove all
-monitor.queue.settings.remove_all_items_done = All items in the queue have been removed.
-
 notices.system_notice_list = System notices
 notices.view_detail_header = Notice details
 notices.operations = Operations
@@ -3437,7 +3337,7 @@ notices.desc = Description
 notices.op = Op.
 notices.delete_success = The system notices have been deleted.
 
-self_check.no_problem_found = No problem found yet.
+self_check.no_problem_found = No problems found yet.
 self_check.database_collation_mismatch = Expect database to use collation: %s
 self_check.database_collation_case_insensitive = Database is using a collation %s, which is an insensitive collation. Although Forgejo could work with it, there might be some rare cases which don't work as expected.
 self_check.database_inconsistent_collation_columns = Database is using collation %s, but these columns are using mismatched collations. It might cause some unexpected problems.
@@ -3547,22 +3447,6 @@ workflow.dispatch.warn_input_limit = Only displaying the first %d inputs.
 
 need_approval_desc = Need approval to run workflows for fork pull request.
 
-variables = Variables
-variables.management = Manage variables
-variables.creation = Add variable
-variables.none = There are no variables yet.
-variables.deletion = Remove variable
-variables.deletion.description = Removing a variable is permanent and cannot be undone. Continue?
-variables.description = Variables will be passed to certain actions and cannot be read otherwise.
-variables.edit = Edit Variable
-variables.not_found = Failed to find the variable.
-variables.deletion.failed = Failed to remove variable.
-variables.deletion.success = The variable has been removed.
-variables.creation.failed = Failed to add variable.
-variables.creation.success = The variable "%s" has been added.
-variables.update.failed = Failed to edit variable.
-variables.update.success = The variable has been edited.
-
 [projects]
 deleted.display_name = Deleted project
 type-1.display_name = Individual project
@@ -3578,9 +3462,6 @@ symbolic_link = Symbolic link
 submodule = Submodule
 
 [markup]
-filepreview.line = Line %[1]d in %[2]s
-filepreview.lines = Lines %[1]d to %[2]d in %[3]s
-filepreview.truncated = Preview has been truncated
 
 [translation_meta]
 test = This is a test string. It is not displayed in Forgejo UI but is used for testing purposes. Feel free to enter "ok" to save time (or a fun fact of your choice) to hit that sweet 100% completion mark :)
diff --git a/options/locale/locale_eo.ini b/options/locale/locale_eo.ini
index d610b7b1d9..be27ad3749 100644
--- a/options/locale/locale_eo.ini
+++ b/options/locale/locale_eo.ini
@@ -2,8 +2,6 @@
 tracked_time_summary = Resumo de trakita tempo bazita sur filtriloj de temolisto
 language = Lingvo
 passcode = Paskodo
-webauthn_error_timeout = Tempo elĉerpiĝis antaŭ legiĝo de via ŝlosilo. Bonvolu reenlegi la retpaĝon kaj reprovi.
-webauthn_sign_in = Premu la butonon sur via sekurŝlosilo. Se mankas butono, elprenu kaj reenmetu vian sekurŝlosilon.
 captcha = Testo de homeco
 create_new = Krei…
 licenses = Permesiloj
@@ -11,13 +9,10 @@ sign_in = Saluti
 user_profile_and_more = Profilo kaj agordoj…
 explore = Esplori
 return_to_forgejo = Reiri al Forgejo
-webauthn_error_unknown = Eraris pro nekonata kialo. Bonvolu reprovi.
 twofa = Duobla aŭtentikigo
 version = Versio
 help = Helpo
-webauthn_error_empty = Vi devas agordi nomon por la ŝlosilo.
 sign_in_or = aŭ
-webauthn_use_twofa = Uzi dumanieran salutkodon de via poŝtelefono
 page = Paĝo
 link_account = Ligi konton
 your_profile = Profilo
@@ -26,23 +21,16 @@ settings = Agordoj
 logo = Emblemo
 toc = Enhavotabelo
 admin_panel = Retejadministrado
-webauthn_unsupported_browser = Via retfoliumilo ne jam subtenas la salutmanieron WebAuthn.
-webauthn_error_insecure = La salutmaniero WebAuthn sole subtenas sekurajn konektiĝojn. Testante HTTP’e, oni uzu la retadreson «localhost» aŭ «127.0.0.1»
 new_project = Novan projekton
 notifications = Sciigoj
 repository = Deponejo
-webauthn_error = Ne povis legi vian sekurŝlosilon.
 active_stopwatch = Aktiva tempotrakilo
 organization = Organizaĵo
 sign_in_with_provider = Saluti per %s
-webauthn_error_unable_to_process = La servilo ne povis trakti vian peton.
 register = Registriĝi
 username = Uzantonomo
-webauthn_insert_key = Enmetu vian sekurŝlosilon
 password = Pasvorto
-webauthn_error_duplicated = La sekurŝlosilo ne rajtas fari tiun ĉi peton. Bonvolu certigi ke la ŝlosilo estas ne jam registrita.
 template = Ŝablono
-webauthn_press_button = Bonvolu premi la butonon sur via sekurŝlosilo…
 signed_in_as = Salutinta kiel
 sign_up = Registriĝi
 enable_javascript = Ĉi tiu retejo bezonas JavaSkripton.
@@ -879,8 +867,6 @@ form.name_pattern_not_allowed = La ŝablono "%s" ne estas permesata en uzantnomo
 editor.add_file = Aldoni dosieron
 settings.tags = Etikedoj
 archive.title_date = Ĉi tiu deponejo arĥiviĝis je %s. Vi povas vidi kaj elŝuti dosierojn, sed ne povas puŝi nek raporti problemojn nek tirpeti.
-migrate_items_pullrequests = Tirpetoj
-migrate.migrating_pulls = Migrante tirpetojn
 unwatch = Malspuri
 watch = Spuri
 star = Stelumi
@@ -919,14 +905,12 @@ settings.default_branch_desc = Elekti implicutan deponejan branĉon por tirpetoj
 archive.title = Ĉi tiu deponejo estas arĥivigita. Vi povas vidi kaj elŝuti dosierojn, sed ne povas puŝi nek raporti problemojn nek tirpeti.
 activity.active_prs_count_n = <strong>%d</strong> aktivaj tirpetoj
 settings.archive.text = Arĥivigi la deponejon igus ĝin sole legebla. Ĝi kaŝiĝos de la labortablo. Neniu (ne eĉ vi!) povos fari enmetojn, raportojn, kaj tirpetojn.
-migrate_items_releases = Eldonoj
 commits.commits = Enmetoj
 rss.must_be_on_branch = Vi devas esti en branĉo por havi RSS-fluon.
 repo_name = Deponejonomo
 size_format = %[1]s: %[2]s; %[3]s: %[4]s
 template = Ŝablono
 template_select = Elektu ŝablonon
-
 editor.name_your_file = Nomu vian dosieron…
 editor.or = aŭ
 editor.add_tmpl.filename = dosiernomo
@@ -966,14 +950,8 @@ runner_kind = Serĉi rulantojn…
 pull_kind = Serĉi tirpetojn…
 
 [markup]
-filepreview.truncated = La superrigardo estas mallongigita
-filepreview.line = Linio %[1]d en %[2]s
-filepreview.lines = Linioj %[1]d ĝis %[2]d en %[3]s
 
 [actions]
-variables.creation.success = La variablo "%s" estas aldonita.
-variables.update.failed = Ne eblas redakti la variablon.
-variables.update.success = La variablo estas redaktita.
 
 [projects]
 deleted.display_name = Forigita projekto
diff --git a/options/locale/locale_es-ES.ini b/options/locale/locale_es-ES.ini
index 264a010805..b0a9f6ce09 100644
--- a/options/locale/locale_es-ES.ini
+++ b/options/locale/locale_es-ES.ini
@@ -36,18 +36,6 @@ twofa=Autenticación de doble factor
 twofa_scratch=Código de respaldo
 passcode=Código de acceso
 
-webauthn_insert_key=Introduzca su clave de seguridad
-webauthn_sign_in=Presione el botón en su clave de seguridad. Si su clave de seguridad no tiene ningún botón, vuelva a insertarla.
-webauthn_press_button=Por favor, presione el botón en su clave de seguridad…
-webauthn_use_twofa=Utilice un código de doble factor desde su teléfono móvil
-webauthn_error=No se pudo leer su llave de seguridad.
-webauthn_unsupported_browser=Actualmente su navegador no soporta WebAuthn.
-webauthn_error_unknown=Ha ocurrido un error desconocido. Por favor, inténtelo de nuevo.
-webauthn_error_insecure=WebAuthn sólo soporta conexiones seguras. Para probar sobre HTTP, puede utilizar el origen "localhost" o "127.0.0.1"
-webauthn_error_unable_to_process=El servidor no pudo procesar su solicitud.
-webauthn_error_duplicated=La clave de seguridad no está permitida para esta solicitud. Por favor, asegúrese de que la clave no está ya registrada.
-webauthn_error_empty=Debe establecer un nombre para esta clave.
-webauthn_error_timeout=Tiempo de espera máximo alcanzado antes de que su clave pudiese ser leída. Por favor, cargue la página y vuelva a intentarlo.
 repository=Repositorio
 organization=Organización
 mirror=Réplica
@@ -1153,14 +1141,6 @@ migrate_options_lfs_endpoint.label=Destino LFS
 migrate_options_lfs_endpoint.description=Migración intentará usar su mando Git para <a target="_blank" rel="noopener noreferrer" href="%s">determinar el servidor LFS</a>. También puede especificar un punto final personalizado si los datos LFS del repositorio se almacenan en otro lugar.
 migrate_options_lfs_endpoint.description.local=También se admite una ruta del servidor local.
 migrate_options_lfs_endpoint.placeholder=Si se deja en blanco, el punto final se derivará de la URL de clonación
-migrate_items=Objetos de migración
-migrate_items_wiki=Wiki
-migrate_items_milestones=Hitos
-migrate_items_labels=Etiquetas
-migrate_items_issues=Incidencias
-migrate_items_pullrequests=Solicitudes de extracción
-migrate_items_merge_requests=Solicitudes de fusión
-migrate_items_releases=Lanzamientos
 migrate_repo=Migrar repositorio
 migrate.clone_address=Migrar / Clonar desde URL
 migrate.clone_address_desc=La URL HTTP(S) o de Git "clone" de un repositorio existente
@@ -1179,16 +1159,6 @@ migrate.migrating=Migrando desde <b>%s</b>…
 migrate.migrating_failed=La migración desde <b>%s</b> ha fallado.
 migrate.migrating_failed.error=Error al migrar: %s
 migrate.migrating_failed_no_addr=Migración fallida.
-migrate.migrating_git=Migrando datos de Git
-migrate.migrating_topics=Migrando temas
-migrate.migrating_milestones=Migrando hitos
-migrate.migrating_labels=Migrando etiquetas
-migrate.migrating_releases=Migrar versiones
-migrate.migrating_issues=Migrando incidencias
-migrate.migrating_pulls=Migrando solicitudes de incorporación de cambios
-migrate.cancel_migrating_title=Cancelar la migración
-migrate.cancel_migrating_confirm=¿Quiere cancelar esta migración?
-
 mirror_from=réplica de
 forked_from=bifurcado de
 generated_from=generado desde
@@ -2583,24 +2553,16 @@ error.csv.invalid_field_count=No se puede procesar este archivo porque tiene un
 rss.must_be_on_branch = Debes estar en una rama para tener un feed RSS.
 desc.sha256 = SHA256
 issues.num_participants_one = %d participante
-n_commit_few = %s commits
-n_branch_few = %s ramas
-n_tag_one = %s etiqueta
-n_tag_few = %s etiquetas
 file_follow = Seguir enlace simbólico
 vendored = Vendored
 open_with_editor = Abrir con %s
-n_branch_one = %s rama
 issues.archived_label_description = (Archivado) %s
-n_commit_one = %s commit
 generated = Generado
 pulls.nothing_to_compare_have_tag = Las ramas/etiquetas seleccionadas son iguales.
 commits.search_branch = Esta rama
 commits.renamed_from = Renombrado de %s
 form.string_too_long = El texto introducido tiene más de %d caracteres.
 object_format = Formato de objetos
-n_release_one = %s lanzamiento
-n_release_few = %s versiones
 stars = Estrellas
 editor.invalid_commit_mail = Correo no válido para crear un commit.
 project = Proyectos
@@ -2768,7 +2730,6 @@ settings.enforce_on_admins = Aplicar esta regla para los administradores del rep
 settings.matrix.access_token_helper = Se recomienda configurar una cuenta de Matrix dedicada para esto. El token de acceso puede ser obtenido desde el cliente web Element (en una pestaña privada/incógnito) > Menú de usuario (arriba izquierda) > Todos los ajustes > Ayuda & Acerca de > Avanzado > Token de acceso (a la derecha, debajo de URL del servidor). Cierra la pestaña privada/incógnito (desconectarse invalidaría el token).
 settings.archive.mirrors_unavailable = Los espejos no están disponibles en repos archivados.
 release.summary_card_alt = Tarjeta de resumen de una release titulada "%s" en el repositorio %s
-
 settings.matrix.room_id_helper = El ID de Sala puede ser obtenido desde el cliente web Element > Ajustes de Sala > Avanzado > ID de sala interna. Ejemplo: %s.
 
 [graphs]
@@ -2962,34 +2923,6 @@ dashboard.sync_external_users=Sincronizar datos de usuario externo
 dashboard.cleanup_hook_task_table=Limpiar la tabla hook_task
 dashboard.cleanup_packages=Limpiar paquetes caducados
 dashboard.cleanup_actions=Acciones de limpieza de registros expirados y artefactos
-dashboard.server_uptime=Tiempo de actividad del servidor
-dashboard.current_goroutine=Gorutinas actuales
-dashboard.current_memory_usage=Uso actual de memoria
-dashboard.total_memory_allocated=Total de Memoria Reservada
-dashboard.memory_obtained=Memoria obtenida
-dashboard.pointer_lookup_times=Tiempos de búsqueda de punteros
-dashboard.memory_allocate_times=Asignaciones de memoria
-dashboard.memory_free_times=Liberaciones de memoria
-dashboard.current_heap_usage=Uso actual de Heap
-dashboard.heap_memory_obtained=Memoria de Heap obtenida
-dashboard.heap_memory_idle=Memoria de Heap inactiva
-dashboard.heap_memory_in_use=Memoria de Heap en uso
-dashboard.heap_memory_released=Memoria de Heap liberada
-dashboard.heap_objects=Objetos en el Heap
-dashboard.bootstrap_stack_usage=Uso de la pila de Bootstrap
-dashboard.stack_memory_obtained=Memoria de pila obtenida
-dashboard.mspan_structures_usage=Uso de estructuras MSpan
-dashboard.mspan_structures_obtained=Estructuras MSpan obtenidas
-dashboard.mcache_structures_usage=Uso de estructuras MCache
-dashboard.mcache_structures_obtained=Estructuras MCache obtenidas
-dashboard.profiling_bucket_hash_table_obtained=Profiling bucket hash table obtenido
-dashboard.gc_metadata_obtained=Metadatos obtenidos del recolector de basura
-dashboard.other_system_allocation_obtained=Otros recursos asignados del sistema
-dashboard.next_gc_recycle=Siguiente reciclaje del recolector de basura
-dashboard.last_gc_time=Tiempo desde la última recolección de basura
-dashboard.total_gc_pause=Pausa total por el recolector de basura
-dashboard.last_gc_pause=Última pausa por el recolector de basura
-dashboard.gc_times=Ejecuciones del recolector de basura
 dashboard.delete_old_actions=Eliminar todas las actividades antiguas de la base de datos
 dashboard.delete_old_actions.started=Eliminar todas las actividades antiguas de la base de datos iniciadas.
 dashboard.update_checker=Buscador de actualizaciones
@@ -3046,18 +2979,6 @@ users.purge_help=Borrar forzosamente el usuario y cualquier repositorio, organiz
 users.still_own_packages=Este usuario todavía posee uno o más paquetes, elimina estos paquetes primero.
 users.deletion_success=La cuenta de usuario ha sido eliminada.
 users.reset_2fa=Reiniciar 2FA
-users.list_status_filter.menu_text=Filtro
-users.list_status_filter.reset=Reiniciar
-users.list_status_filter.is_active=Activo
-users.list_status_filter.not_active=Inactivo
-users.list_status_filter.is_admin=Administrador
-users.list_status_filter.not_admin=No admin
-users.list_status_filter.is_restricted=Restringido
-users.list_status_filter.not_restricted=No restringido
-users.list_status_filter.is_prohibit_login=Prohibido el inicio de sesión
-users.list_status_filter.not_prohibit_login=Permitir el inicio de sesión
-users.list_status_filter.is_2fa_enabled=2FA habilitado
-users.list_status_filter.not_2fa_enabled=2FA deshabilitado
 users.details=Detalles del usuario
 
 emails.email_manage_panel=Administrar direcciones de correo electrónico del usuario
@@ -3375,26 +3296,6 @@ monitor.process.cancel_desc=Cancelar un proceso puede ocasionar una pérdida de
 monitor.process.cancel_notices=Cancelar: <strong>%s</strong>?
 monitor.process.children=Hijos
 
-monitor.queues=Colas
-monitor.queue=Cola: %s
-monitor.queue.name=Nombre
-monitor.queue.type=Tipo
-monitor.queue.exemplar=Ejemplo
-monitor.queue.numberworkers=Número de trabajadores
-monitor.queue.activeworkers=Trabajadores activos
-monitor.queue.maxnumberworkers=Nº máx de trabajadores
-monitor.queue.numberinqueue=Número en cola
-monitor.queue.review_add=Revisar / Añadir trabajadores
-monitor.queue.settings.title=Ajustes del grupo
-monitor.queue.settings.desc=Los grupos de trabajadores crecen dinámicamente en respuesta al bloqueo de cola de sus trabajadores.
-monitor.queue.settings.maxnumberworkers=Número máximo de trabajadores
-monitor.queue.settings.maxnumberworkers.placeholder=Actualmente %[1]d
-monitor.queue.settings.maxnumberworkers.error=El número máximo de trabajadores debe ser un número
-monitor.queue.settings.submit=Actualizar ajustes
-monitor.queue.settings.changed=Ajustes actualizados
-monitor.queue.settings.remove_all_items=Eliminar todo
-monitor.queue.settings.remove_all_items_done=Todos los elementos en la cola han sido eliminados.
-
 notices.system_notice_list=Notificaciones del sistema
 notices.view_detail_header=Detalles de notificación
 notices.operations=Operaciones
@@ -3440,10 +3341,9 @@ self_check.database_collation_mismatch = Se espera que la base de datos use inte
 self_check.database_collation_case_insensitive = La base de datos está usando intercalación %s, que es una intercalación insensible. Aunque Forgejo podría funcionar, puede darse algún caso extraño en el que no funcione como se espera.
 self_check.database_inconsistent_collation_columns = La base de datos está usando intercalación %s, pero estas columnas están usando intercalaciones desparejadas. Esto puede causar algunos problemas inesperados.
 self_check.database_fix_mysql = Para usuarios de MySQL/MariaDB, podrían usar el comando "forgejo doctor convert" para arreglar los problemas de intercalación, o también podrían arreglarlos utilizando consultas SQL manuales, como "ALTER ... COLLATE ...".
-
-
 config.cache_test_failed = Incorrecto al probar la caché: %v.
 
+
 [action]
 create_repo=creó el repositorio <a href="%s">%s</a>
 rename_repo=repositorio renombrado de <code>%[1]s</code> a <a href="%[2]s">%[3]s</a>
@@ -3543,20 +3443,6 @@ workflow.disabled=El flujo de trabajo está deshabilitado.
 
 need_approval_desc=Necesita aprobación para ejecutar flujos de trabajo para el pull request del fork.
 
-variables=Variables
-variables.management=Gestión de variables
-variables.creation=Añadir variable
-variables.none=Aún no hay variables.
-variables.deletion=Eliminar variable
-variables.deletion.description=Eliminar una variable es permanente y no se puede deshacer. ¿Continuar?
-variables.description=Las variables se pasarán a ciertas acciones y no se podrán leer de otro modo.
-variables.edit=Editar variable
-variables.deletion.failed=No se pudo eliminar la variable.
-variables.deletion.success=La variable ha sido eliminada.
-variables.creation.failed=No se pudo agregar la variable.
-variables.creation.success=La variable "%s" ha sido añadida.
-variables.update.failed=Error al editar la variable.
-variables.update.success=La variable ha sido editada.
 variables.id_not_exist = Variable con id %d no existe.
 runs.empty_commit_message = (mensaje de commit vacío)
 runs.expire_log_message = Los registros han sido eliminados porque eran demasiado antiguos.
@@ -3564,7 +3450,6 @@ workflow.dispatch.run = Correr flujo de trabajo
 workflow.dispatch.use_from = Usar el flujo de trabajo de
 workflow.dispatch.invalid_input_type = Tipo de entrada inválida "%s".
 workflow.dispatch.success = La ejecución del flujo de trabajo se ha solicitado correctamente.
-variables.not_found = No se ha encontrado la variable.
 workflow.dispatch.input_required = Se requiere valor para la entrada "%s".
 workflow.dispatch.trigger_found = Este flujo de trabajo tiene un disparador de eventos <c>workflow_dispatch</c>.
 workflow.dispatch.warn_input_limit = Sólo se muestran las primeras %d entradas.
@@ -3615,9 +3500,6 @@ regexp_tooltip = Interpretar los términos de búsqueda como una expresión regu
 regexp = Expresión Regular
 
 [markup]
-filepreview.lines = Líneas %[1]d a %[2]d en %[3]s
-filepreview.line = Línea %[1]d en %[2]s
-filepreview.truncated = La vista previa se ha truncado
 
 [repo.permissions]
 pulls.read = <b>Lectura:</b> Leer y crear pull requests.
diff --git a/options/locale/locale_et.ini b/options/locale/locale_et.ini
index 092cb47ecf..6b3374ce4c 100644
--- a/options/locale/locale_et.ini
+++ b/options/locale/locale_et.ini
@@ -26,8 +26,6 @@ enable_javascript = See veebileht eeldab JavaScripti kasutamise lubamist.
 toc = Sisukord
 licenses = Litsentsid
 username = Kasutajanimi
-webauthn_error_unable_to_process = Server ei saanud sinu päringut töödelda.
-webauthn_error_duplicated = Turvavõti ei ole selle päringu puhul lubatud. Palun veendu, et võti ei ole juba registreeritud.
 return_to_forgejo = Tagasi Forgejo'sse
 toggle_menu = Lülita menüü sisse/välja
 more_items = Rohkem objekte
@@ -38,16 +36,6 @@ re_type = Kinnita salasõna
 twofa = Kahefaktoriline autentimine
 twofa_scratch = Kahefaktoriline kriipsukood
 passcode = Salakood
-webauthn_insert_key = Sisesta oma turvavõti
-webauthn_sign_in = Vajuta turvavõtme nuppu. Kui sinu turvavõtmel ei ole nuppu, sisesta see uuesti.
-webauthn_press_button = Palun vajuta turvavõtme nuppu…
-webauthn_use_twofa = Sisesta oma telefonist kahefaktorilise autentimise kood
-webauthn_error = Sinu turvavõtit ei saanud lugeda.
-webauthn_unsupported_browser = Sinu veebibrauser ei toeta praegu WebAuthn-liidestust.
-webauthn_error_unknown = Tekkis tundmatu viga. Palun proovi uuesti.
-webauthn_error_insecure = WebAuthn toetab ainult turvalisi ühendusi. HTTP kaudu testimiseks võid kasutada lähteaadressina „localhost“ või „127.0.0.1“
-webauthn_error_empty = Palun lisa sellele võtmele täisnimi.
-webauthn_error_timeout = Päring aegus enne võtme lugemist. Palun laadi see lehekülg uuesti ja proovi uuesti.
 repository = Hoidla
 organization = Organisatsioon
 new_fork = Uus lähekoodihoidla haru
@@ -141,7 +129,6 @@ copy_path = Kopeeri asukoht
 captcha = Robotilõks
 unpin = Lõpeta esiletõstmine
 powered_by = Siin on kasutusel %s
-
 collaborative = Koostöö
 
 [search]
@@ -470,8 +457,6 @@ default_branch_label = vaikimisi
 code.desc = Ligipääs lähtekoodile, failidele, sissekannetele ja alamharudele.
 filter_branch_and_tag = Filtreeri alamharu või sildi alusel
 branches = Alamharud
-n_branch_one = %s alamharu
-n_branch_few = %s alamharu
 commit_graph.select = Vali alamharud
 commit.contained_in_default_branch = See sissekanne on vaikimisi alamharu osa
 editor.new_branch_name_desc = Alamharu uus nimi…
@@ -558,11 +543,6 @@ template.git_content = Giti sisu (vaikimisi alamharu)
 mirror_denied_combination = Salasõnapõhist ja avaliku võtme põhist autentimist ei saa samal ajal kasutada.
 
 [actions]
-variables = Muutujad
-variables.deletion = Eemalda muutuja
-variables.creation = Lisa muutuja
-variables.none = Muutujaid veel pole.
-variables.management = Halda muutujaid
 
 [admin]
 users.password_helper = Kui sa ei taha salasõna muuta, siis jäta väli tühjaks.
diff --git a/options/locale/locale_eu.ini b/options/locale/locale_eu.ini
index cb4fe075f7..af0a54e418 100644
--- a/options/locale/locale_eu.ini
+++ b/options/locale/locale_eu.ini
@@ -33,18 +33,6 @@ captcha = CAPTCHA
 twofa = Bi faktoreko autentifikazioa
 twofa_scratch = Bi faktoreko marradura-kodea
 passcode = Pasakodea
-webauthn_insert_key = Sartu zure segurtasun-gakoa
-webauthn_sign_in = Sakatu botoia zure segurtasun-gakoan. Zure segurtasun-gakoak ez badu botoirik, sartu berriro.
-webauthn_press_button = Mesedez, sakatu botoia zure segurtasun-gakoan…
-webauthn_use_twofa = Erabili zure telefonoko bi faktoreko kodea
-webauthn_error = Ezin izan da irakurri zure segurtasun-gakoa.
-webauthn_unsupported_browser = Zure nabigatzaileak ez du WebAuthn onartzen.
-webauthn_error_unknown = Akats ezezagun bat gertatu da. Mesedez, saiatu berriro.
-webauthn_error_insecure = WebAuthnek konexio seguruak baino ez ditu onartzen. HTTP bidez probatzeko, "localhost" edo "127.0.0.1" jatorria erabil daiteke
-webauthn_error_unable_to_process = Zerbitzariak ezin izan du zure eskaera prozesatu.
-webauthn_error_duplicated = Segurtasun-gakorik ez da onartzen eskaera honetarako. Mesedez, ziurtatu giltza ea dagoela erregistratuta.
-webauthn_error_empty = Gako honetarako izen bat jarri behar duzu.
-webauthn_error_timeout = Zure gakoa irakurri aurretik denbora-muga gainditu da. Kargatu berriro orrialde hau eta saiatu berriro.
 repository = Biltegia
 new_fork = Biltegi-adar berria
 new_project_column = Zutabe berria
diff --git a/options/locale/locale_fa-IR.ini b/options/locale/locale_fa-IR.ini
index 3472ab5c1e..bf358b8a8d 100644
--- a/options/locale/locale_fa-IR.ini
+++ b/options/locale/locale_fa-IR.ini
@@ -98,10 +98,6 @@ name=نام
 logo = نشان
 sign_in_with_provider = ورود با %s
 enable_javascript = این وب‌گاه به جاوا اسکریپت نیاز دارد.
-webauthn_press_button = لطفاً دکمۀ روی کلید امنیتی را فشار دهید…
-webauthn_unsupported_browser = مرورگر شما در حال حاضر از WebAuthn پشتیبانی نمی‌کند.
-webauthn_error_unknown = خطایی ناشناخته رخ داد. لطفاً دوباره سعی کنید.
-webauthn_error_unable_to_process = کارساز نتوانست درخواست شما را پردازش کند.
 new_project_column = ستون جدید
 retry = سعی دوباره
 rerun = اجرای دوباره
@@ -113,17 +109,10 @@ locked = قفل شده
 copy_hash = رونوشت هش
 unknown = نامشخص
 copy_type_unsupported = این نوع از فایل نمی‌تواند رونوشت شود
-webauthn_insert_key = کلید امنیتی خود را وارد کنید
-webauthn_sign_in = دکمۀ روی کلید امنیتی را فشار دهید. اگر کلید امنیتی شما دکمه‌ای ندارد، آن را دوباره وارد کنید.
-webauthn_use_twofa = از یک کد دومرحله‌ای از تلفنتان استفاده کنید
-webauthn_error = کلید امنیتی شما نتوانست خوانده شود.
 more_items = موارد بیشتر
-webauthn_error_duplicated = کلید امنیتی برای این درخواست مجاز نیست. لطفاً مطمئن شوید که این کلید در حال حاضر ثبت نشده است.
-webauthn_error_timeout = مهلت زمانی قبل از اینکه کلید شما خوانده شود تمام شد. لطفاً این صفحه را تازه‌سازی کرده و مجدد تلاش کنید.
 new_org.link = سازمان جدید
 new_org.title = سازمان جدید
 new_migrate.link = مهاجرت جدید
-webauthn_error_empty = شما باید یک نام برای این کلید انتخاب کنید.
 new_repo.title = مخزن جدید
 new_migrate.title = مهاجرت جدید
 new_repo.link = مخزن جدید
@@ -155,7 +144,6 @@ filter.not_archived = بایگانی نشده
 copy_content = رونوشت درون‌مایه
 invalid_data = داده نامعتبر: %v
 copy_generic = رونوشت در بریده‌دان
-webauthn_error_insecure = احرازوب فقط از روش‌های ایمن ممکن است. برای آزمودن بر روی اچ‌تی‌تی‌پی می‌توانید از «میزبان‌محلی» یا «۱۲۷.۰.۰.۱» استفاده کنید.
 show_log_seconds = نمایش ثانیه‌ها
 confirm_delete_selected = تایید می‌کنید که همه موارد گزینش شده حذف شوند؟
 filter.clear = پاک‌کردن پالایه‌ها
@@ -883,14 +871,6 @@ migrate_options_lfs=مهاجرت فایلهای LFS
 migrate_options_lfs_endpoint.label=نشانهای پایانی LFS
 migrate_options_lfs_endpoint.description=Migration سعی خواهد کرد از کنترل از راه دور Git شما برای <a target="_blank" rel="noopener noreferrer" href="%s">تعیین سرور LFS</a> استفاده کند. همچنین اگر داده های LFS مخزن در جای دیگری ذخیره شده باشد، می توانید یک نقطه پایانی سفارشی را مشخص کنید.
 migrate_options_lfs_endpoint.description.local=مسیر سرور محلی نیز پشتیبانی می شود.
-migrate_items=مولفه های مهاجرت
-migrate_items_wiki=دانشنامه
-migrate_items_milestones=نقاط عطف
-migrate_items_labels=برچسب‌ها
-migrate_items_issues=مسائل
-migrate_items_pullrequests=تقاضاهای واکشی
-migrate_items_merge_requests=تقاضاهای واکشی
-migrate_items_releases=انتشارها
 migrate_repo=انتقال مخزن
 migrate.clone_address=انتقال / همسان‌سازی از نشانی
 migrate.clone_address_desc=HTTP(S) or Git 'همسان‌سازی' نشانی‌های موجود در این مخزن
@@ -906,14 +886,6 @@ migrate.migrate=مهاجرت از %s
 migrate.migrating=مهاجرت از <b>%s</b> ...
 migrate.migrating_failed=مهاجرت از <b>%s</b> ناموفق بود.
 migrate.migrating_failed_no_addr=مهاجرت ناموفق بود.
-migrate.migrating_git=انتقال داده های Git
-migrate.migrating_topics=موضوعات مهاجرت
-migrate.migrating_milestones=نقاط عطف مهاجرت
-migrate.migrating_labels=برچسب های مهاجرت
-migrate.migrating_releases=انتشارات مهاجرت
-migrate.migrating_issues=مشکلات مهاجرت
-migrate.migrating_pulls=مهاجرت درخواست های pull
-
 mirror_from=قرینه از
 forked_from=انشعاب شده از
 generated_from=ساخته شده از
@@ -2116,34 +2088,6 @@ dashboard.resync_all_hooks=همگام سازی مجدد hook های pre-receive
 dashboard.reinit_missing_repos=تمامی مخازنی که سوابقشان وجود دارند مجدداً گیت آنها مفقود شده است مجدداً مقدمات آنها فراهم شود
 dashboard.sync_external_users=همگام سازی اطلاعات کاربر خارجی
 dashboard.cleanup_hook_task_table=جدول hook_task تمیز کردن
-dashboard.server_uptime=فعالیت بی‌وقفه سرور
-dashboard.current_goroutine=Goroutine های فعلی
-dashboard.current_memory_usage=میزان مصرف فعلی از حافظه
-dashboard.total_memory_allocated=کل حافظه اختصاص داده شده
-dashboard.memory_obtained=حافظه به دست آمده
-dashboard.pointer_lookup_times=اشاره‌گر زمان‌های جستجو
-dashboard.memory_allocate_times=تخصیص یافتن حافظه
-dashboard.memory_free_times=آزادسازی حافظه
-dashboard.current_heap_usage=میزان مصرف توده فعلی
-dashboard.heap_memory_obtained=حافظه به دست آمده برای توده
-dashboard.heap_memory_idle=بیکار بوده حافظه توده
-dashboard.heap_memory_in_use=حافظه توده در حال استفاده
-dashboard.heap_memory_released=حافظه توده آزاد شد
-dashboard.heap_objects=شی توده یا Heap
-dashboard.bootstrap_stack_usage=میزان استفاده از پشته توسط راهنداز
-dashboard.stack_memory_obtained=حافظه پشته به دست آمده
-dashboard.mspan_structures_usage=میزان استفاده‌ی ساختار های MSpan
-dashboard.mspan_structures_obtained=ساختار های MSpan به دست آمده
-dashboard.mcache_structures_usage=میزان استفاده از ساختار های MCache
-dashboard.mcache_structures_obtained=ساختار های MCache به دست آمده
-dashboard.profiling_bucket_hash_table_obtained=Profiling Bucket Hash Table به دست آمده
-dashboard.gc_metadata_obtained=متادیتاهای بدست امده از GC
-dashboard.other_system_allocation_obtained=تخصیص های حافظه در سایر قسمت های سیستم
-dashboard.next_gc_recycle=بازیافت GC بعدی
-dashboard.last_gc_time=زمان از آخرین GC
-dashboard.total_gc_pause=کل زمان مکث GC
-dashboard.last_gc_pause=واپسین مکث در GC
-dashboard.gc_times=زمان های GC
 dashboard.delete_old_actions=تمام اقدامات قدیمی را از پایگاه داده حذف کنید
 dashboard.delete_old_actions.started=حذف تمام اقدامات قدیمی از پایگاه داده شروع شده است.
 
@@ -2183,19 +2127,6 @@ users.still_own_repo=این کاربر هنوز صاحب یک یا چند مخز
 users.still_has_org=این کاربر عضو یک سازمان است. ابتدا کاربر را از هر سازمان متعلق حذف کنید.
 users.deletion_success=حساب کاربری حذف شد.
 users.reset_2fa=2FA را بازنشانی کنید
-users.list_status_filter.menu_text=فیلتر
-users.list_status_filter.reset=شروع دوباره
-users.list_status_filter.is_active=فعال
-users.list_status_filter.not_active=غیرفعال
-users.list_status_filter.is_admin=ادمین
-users.list_status_filter.not_admin=غیرادمین
-users.list_status_filter.is_restricted=محصور
-users.list_status_filter.not_restricted=محدود نشده است
-users.list_status_filter.is_prohibit_login=ورود را ممنوع شود
-users.list_status_filter.not_prohibit_login=اجازه ورود
-users.list_status_filter.is_2fa_enabled=2FA فعال است
-users.list_status_filter.not_2fa_enabled=2FA غیرفعال است
-
 emails.email_manage_panel=مدیریت ایمیل کاربر
 emails.primary=اولیه
 emails.activated=فعال شده
@@ -2463,20 +2394,6 @@ monitor.process.cancel_desc=لغو کردن یک فرآیند ممکن است ب
 monitor.process.cancel_notices=لغو: <strong>%s</strong>؟
 monitor.process.children=فرزندان
 
-monitor.queues=صف ها
-monitor.queue=صف: %s
-monitor.queue.name=نام
-monitor.queue.type=نوع
-monitor.queue.exemplar=نوع نمونه
-monitor.queue.numberworkers=تعداد کارگران
-monitor.queue.maxnumberworkers=بیشینه تعداد کارگران
-monitor.queue.settings.title=تنظیمات استخر
-monitor.queue.settings.maxnumberworkers=بیشینه تعداد کارگران
-monitor.queue.settings.maxnumberworkers.placeholder=در حال حاضر %[1]v
-monitor.queue.settings.maxnumberworkers.error=حداکثر تعداد کارگران باید یک عدد باشد
-monitor.queue.settings.submit=بالا بردن ساماندهی
-monitor.queue.settings.changed=تنظیمات تازه شد
-
 notices.system_notice_list=هشدارهای سامانه
 notices.view_detail_header=مشاهده جزئیات اخطار
 notices.select_all=انتخاب همه
@@ -2564,19 +2481,6 @@ owner.settings.cleanuprules.enabled=فعال شده
 [secrets]
 
 [actions]
-variables.edit = تغییر متغیر
-variables.deletion.success = متغیر حذف شد.
-variables.deletion = حذف متغیر
-variables.creation.success = متغیر "%s" ایجاد شد.
-variables = متغیرها
-variables.management = مدیریت متغیرها
-variables.update.failed = عدم موفقیت در تغییر متغیر
-variables.update.success = تغییر متغیر با موفقیت انجام شد.
-variables.creation = افزودن متغیر
-variables.none = هیچ متغیری هنوز وجود ندارد.
-
-
-
 
 [projects]
 type-1.display_name = پروژه ی مستقل
diff --git a/options/locale/locale_fi-FI.ini b/options/locale/locale_fi-FI.ini
index ff0b5597e5..5e89ce5b5d 100644
--- a/options/locale/locale_fi-FI.ini
+++ b/options/locale/locale_fi-FI.ini
@@ -33,18 +33,6 @@ twofa=Kaksivaiheinen todennus
 twofa_scratch=Kaksivaiheinen kertakäyttöinen koodi
 passcode=Pääsykoodi
 
-webauthn_insert_key=Aseta turva-avaimesi
-webauthn_sign_in=Paina turva-avaimesi painiketta. Jos turva-avaimessasi ei ole painiketta, irrota se ja aseta uudelleen.
-webauthn_press_button=Paina turva-avaimesi painiketta…
-webauthn_use_twofa=Käytä kaksivaihesta todennusta puhelimestasi
-webauthn_error=Turva-avainta ei voitu lukea.
-webauthn_unsupported_browser=Selaimesi ei tällä hetkellä tue WebAuthnia.
-webauthn_error_unknown=Tuntematon virhe. Yritä uudelleen.
-webauthn_error_insecure=WebAuthn tukee vain turvallisia yhteyksiä. Testaamista varten HTTP-välityksellä voit käyttää alkuperää "localhost" tai "127.0.0.1"
-webauthn_error_unable_to_process=Palvelin ei pystynyt käsittelemään pyyntöä.
-webauthn_error_duplicated=Turva-avainta ei ole sallittu tässä pyynnössä. Varmista, ettei avainta ole jo rekisteröity.
-webauthn_error_empty=Sinun täytyy asettaa nimi tälle avaimelle.
-webauthn_error_timeout=Aikakatkaisu ennen kuin avaintasi voitiin lukea. Lataa tämä sivu uudelleen ja yritä uudelleen.
 repository=Tietovarasto
 organization=Organisaatio
 mirror=Peili
@@ -1070,13 +1058,6 @@ template.issue_labels=Ongelmanimilaput
 
 
 
-migrate_items=Migraation kohteet
-migrate_items_wiki=Wiki
-migrate_items_milestones=Merkkipaalut
-migrate_items_labels=Nimilaput
-migrate_items_issues=Ongelmat
-migrate_items_pullrequests=Vetopyynnöt
-migrate_items_releases=Julkaisut
 migrate_repo=Suorita tietovaraston migraatio
 migrate.clone_address=Migraatio/kloonaus URL-osoitteesta
 migrate.github_token_desc=Voit lisätä tähän yhden tai useamman tunnuksen pilkuilla erotettuna nopeuttaaksesi migraatiota kiertämällä GitHub API:n nopeusrajoituksen. Varoitus: Tämän ominaisuuden väärinkäyttö voi rikkoa palveluntarjoajan käytäntöä ja johtaa tiliesi sulkemiseen.
@@ -1085,8 +1066,6 @@ migrate.failed=Migraatio epäonnistui: %v
 migrate.migrate_items_options=Lisäkohteiden migraatiota varten vaaditaan pääsypoletti
 migrate.migrating=Suoritetaan migraatio lähteestä <b>%s</b> …
 migrate.migrating_failed=Migraatio lähteestä <b>%s</b> epäonnistui.
-migrate.migrating_git=Suoritetaan Git-datan migraatiota
-
 mirror_from=peili kohteelle
 forked_from=forkattu tietovarastosta
 unwatch=Lopeta tarkkailu
@@ -1680,7 +1659,6 @@ fork_to_different_account = Forkkaa toiselle tilille
 release.compare = Vertaa
 release.ahead.commits = <strong>%d</strong> kommittia
 all_branches = Kaikki haarat
-n_tag_few = %s tagia
 settings.event_fork_desc = Tietovarasto forkattu.
 actions = Toiminnat
 fork_guest_user = Kirjaudu sisään forkataksesi tämän tietovaraston.
@@ -1689,19 +1667,16 @@ visibility_fork_helper = (Tämän muuttaminen vaikuttaa kaikkien forkkien näkyv
 fork = Forkkaa
 activity.git_stats_commit_n = %d kommittia
 commits.search_branch = Tämä haara
-n_branch_few = %s haaraa
 pulls.show_all_commits = Näytä kaikki kommitit
 commit_graph.select = Valitse haarat
 activity.navbar.recent_commits = Viimeaikaiset kommitit
 settings.branches.add_new_rule = Lisää uusi sääntö
-n_commit_few = %s kommittia
 issues.force_push_compare = Vertaa
 commits.desc = Selaa lähdekoodin muutoshistoriaa.
 clone_helper = Tarvitseko apua kloonauksen kanssa? Siirry <a target="_blank" rel="noopener noreferrer" href="%s">tukisivulle</a>.
 settings.mirror_settings.push_mirror.copy_public_key = Kopioi julkinen avain
 object_format = Objektimuoto
 editor.fail_to_update_file_summary = Virheviesti:
-n_branch_one = %s haara
 issues.content_history.delete_from_history_confirm = Poistetaanko historiasta?
 editor.new_patch = Uusi paikkaus
 pulls.merged_success = Vetopyyntö yhdistetty onnistuneesti ja suljettu
@@ -1751,8 +1726,6 @@ issues.dependency.add_error_dep_exists = Riippuvuus on jo olemassa.
 wiki.page_content = Sivun sisältö
 wiki.page_title = Sivun otsikko
 activity.navbar.contributors = Avustajat
-n_release_few = %s julkaisua
-n_release_one = %s julkaisu
 symbolic_link = Symbolinen linkki
 mirror_last_synced = Viimeksi synkronoitu
 find_file.go_to_file = Löydä tiedosto
@@ -1875,7 +1848,6 @@ issues.filter_label_select_no_label = Ei nimilappua
 projects.column.set_default = Aseta oletukseksi
 projects.edit_success = Projekti "%s" on päivitetty.
 desc.sha256 = SHA256
-n_commit_one = %s kommitti
 transfer.accept = Hyväksy siirto
 transfer.reject = Hylkää siirto
 default_branch_label = oletus
@@ -1932,7 +1904,6 @@ milestones.deletion = Poista merkkipaalu
 more_operations = Lisää toimintoja
 settings.branches.switch_default_branch = Vaihda oletushaara
 tag.confirm_create_tag = Luo tagi
-n_tag_one = %s tagi
 branch.renamed = Haaran %s uudeksi nimeksi asetettiin %s.
 release.tag_name_protected = Tagin nimi on suojattu.
 pulls.merge_conflict_summary = Virheviesti
@@ -1985,7 +1956,6 @@ milestones.filter_sort.earliest_due_data = Lähin eräpäivä
 issues.filter_type.reviewed_by_you = Katselmoitu toimestasi
 settings.units.overview = Yleisnäkymä
 settings.remove_team_success = Tiimin pääsy tietovarastoon on poistettu.
-migrate.cancel_migrating_confirm = Haluatko perua tämän migraation?
 settings.units.units = Yksiköt
 settings.update_settings_no_unit = Tietovaraston tulisi sallia edes jonkinlainen vuorovaikutus.
 settings.units.add_more = Ota lisää käyttöön
@@ -2059,7 +2029,6 @@ release.title_empty = Nimi ei voi olla tyhjä.
 archive.title = Tämä tietovarasto on arkistoitu. Voit tarkastella sen tiedostoja ja kloonata sen, mutta et voi tehdä muutoksia sen tilaan, kuten tehdä työntöjä tai luoda uusia ongelmia, vetopyyntöjä tai kommentteja.
 reactions_more = ja %d lisää
 mirror_address = Kloonaa URL-osoitteesta
-migrate_items_merge_requests = Yhdistämispyynnöt
 stars_remove_warning = Tämä poistaa kaikki tähdet tästä tietovarastosta.
 settings.webhook_deletion_desc = Webkoukun poistaminen poistaa sen asetukset ja toimitushistorian. Jatketaanko?
 settings.discord_icon_url.exceeds_max_length = Kuvakkeen URL-osoite voi sisältää enintään 2048 merkkiä
@@ -2228,8 +2197,6 @@ issues.dismiss_review_warning = Haluatko hylätä katselmoinnin?
 commit.operations = Toimenpiteet
 commits.view_single_diff = Näytä tässä kommitissa tähän tiedostoon kohdistuneet muutokset
 issues.choose.ignore_invalid_templates = Virheelliset mallipohjat on jätetty huomiotta
-migrate.migrating_milestones = Suoritetaan merkkipaalujen migraatiota
-migrate.migrating_issues = Suoritetaan ongelmien migraatiota
 migrate.clone_local_path = tai paikallisen palvelimen polku
 pulls.filter_changes_by_commit = Suodata kommitin perusteella
 pulls.show_changes_since_your_last_review = Näytä viimeisimmän katselmointisi jälkeiset muutokset
@@ -2244,7 +2211,6 @@ migrate.invalid_lfs_endpoint = LFS-päätepiste ei ole kelvollinen.
 issues.new.clear_projects = Tyhjennä projektit
 mirror_denied_combination = Julkiseen avaimeen ja salasanaan pohjautuvaa todennusta ei voi käyttää yhdessä.
 template.git_content = Git-sisältö (Oletushaara)
-migrate.migrating_releases = Suoritetaan julkaisujen migraatiota
 unit_disabled = Sivuston ylläpitäjä on poistanut käytöstä tämän tietovarasto-osion.
 issues.filter_sort.relevance = Asiaankuuluvuus
 pulls.reopen_to_merge = Avaa tämä vetopyyntö uudelleen suorittaaksesi yhdistämisen.
@@ -2256,9 +2222,6 @@ issues.dismiss_review = Hylkää katselmointi
 editor.file_changed_while_editing = Tiedoston sisältö on muuttunut sen avaamisen jälkeen. <a target="_blank" rel="noopener noreferrer" href="%s">Napsauta tästä</a> nähdäksesi muutokset tai <strong>kommitoi muutokset uudelleen</strong> korvataksesi muutokset.
 sync_fork.button = Synkronoi
 migrated_from = Suoritettu migraatio lähteestä <a href="%[1]s">%[2]s</a>
-migrate.migrating_topics = Suoritetaan aiheiden migraatiota
-migrate.migrating_pulls = Suoritetaan vetopyyntöjen migraatiota
-migrate.cancel_migrating_title = Peruuta migraatio
 file_follow = Seuraa symbolista linkkiä
 commit.load_referencing_branches_and_tags = Lataa haarat ja tagit, jotka viittaavat tähän kommittiin
 editor.commit_id_not_matching = Tiedosto muuttui sillä aikaa, kun muokkasit sitä. Kommitoi uuteen haaraan ja yhdistä sen jälkeen.
@@ -2282,7 +2245,6 @@ projects.column.deletion_desc = Projektin sarakkeen poistaminen siirtää kaikki
 issues.del_time = Poista tämä aikaloki
 migrated_from_fake = Suoritettu migraatio lähteestä %[1]s
 migrate.migrate = Tee migraatio lähteestä %s
-migrate.migrating_labels = Suoritetaan nimilappujen migraatiota
 file_view_rendered = Näytä renderöitynä
 editor.invalid_commit_mail = Virheellinen sähköposti kommitin luomista varten.
 sync_fork.branch_behind_one = Tämä haara on %[1]d kommitin jäljessä %[2]s
@@ -2742,33 +2704,6 @@ dashboard.operation_switch=Vaihda
 dashboard.operation_run=Suorita
 dashboard.delete_inactive_accounts=Poista kaikki aktivoimattomat tilit
 dashboard.delete_repo_archives=Poista kaikki tietovarastojen arkistot (ZIP, TAR.GZ, jne.)
-dashboard.server_uptime=Palvelimen uptime
-dashboard.current_goroutine=Nykyiset goroutinet
-dashboard.current_memory_usage=Nykyinen muistinkäyttö
-dashboard.total_memory_allocated=Yhteensä muistia varattu
-dashboard.memory_obtained=Muistia saatu
-dashboard.pointer_lookup_times=Osoittimen hakuajat
-dashboard.current_heap_usage=Nykyinen heapin käyttö
-dashboard.heap_memory_obtained=Heap-muisti saatu
-dashboard.heap_memory_idle=Heap-muisti tyhjäkäynnillä
-dashboard.heap_memory_in_use=Heap-muisti käytössä
-dashboard.heap_memory_released=Heap-muisti vapautettu
-dashboard.heap_objects=Heap-objektit
-dashboard.bootstrap_stack_usage=Bootstrap-pinon käyttö
-dashboard.stack_memory_obtained=Pinonmuisti saatu
-dashboard.mspan_structures_usage=MSpan-rakenteiden käyttö
-dashboard.mspan_structures_obtained=MSpan-rakenteet saatu
-dashboard.mcache_structures_usage=MCache-rakenteiden käyttö
-dashboard.mcache_structures_obtained=MCache-rakenteet saatu
-dashboard.profiling_bucket_hash_table_obtained=Profilointiämpäritiivistetaulukko saatu
-dashboard.gc_metadata_obtained=Roskienkeruumetatiedot saatu
-dashboard.other_system_allocation_obtained=Muu järjestestelmän varaus saatu
-dashboard.next_gc_recycle=Seuraava roskienkeruukierrätys
-dashboard.last_gc_time=Aika edellisestä roskienkeruusta
-dashboard.total_gc_pause=Yhteensä roskienkeruutauko
-dashboard.last_gc_pause=Viimeinen roskienkeruutauko
-dashboard.gc_times=Roskienkeruuajat
-
 users.user_manage_panel=Käyttäjätilien hallinta
 users.new_account=Luo käyttäjätili
 users.name=Käyttäjänimi
@@ -2796,19 +2731,6 @@ users.allow_git_hook=Voi luoda Git-koukkuja
 users.allow_create_organization=Voi luoda organisaatioita
 users.update_profile=Päivitä käyttäjätili
 users.delete_account=Poista käyttäjätili
-users.list_status_filter.menu_text=Suodata
-users.list_status_filter.reset=Tyhjennä
-users.list_status_filter.is_active=Aktiivinen
-users.list_status_filter.not_active=Ei-aktiivinen
-users.list_status_filter.is_admin=Ylläpitäjä
-users.list_status_filter.not_admin=Ei ylläpitäjä
-users.list_status_filter.is_restricted=Rajoitettu
-users.list_status_filter.not_restricted=Ei rajoitettu
-users.list_status_filter.is_prohibit_login=Kirjautuminen estetty
-users.list_status_filter.not_prohibit_login=Kirjautuminen sallittu
-users.list_status_filter.is_2fa_enabled=2FA käytössä
-users.list_status_filter.not_2fa_enabled=2FA ei käytössä
-
 emails.email_manage_panel=Käyttäjien sähköpostien hallinta
 emails.primary=Ensisijainen
 emails.activated=Aktivoitu
@@ -2963,12 +2885,6 @@ monitor.desc=Kuvaus
 monitor.start=Alkamisaika
 monitor.execute_time=Suoritusaika
 
-monitor.queues=Jonot
-monitor.queue=Jono: %s
-monitor.queue.name=Nimi
-monitor.queue.type=Tyyppi
-monitor.queue.settings.submit=Päivitä asetukset
-
 notices.system_notice_list=Järjestelmän ilmoitukset
 notices.select_all=Valitse kaikki
 notices.deselect_all=Poista kaikki valinnat
@@ -2998,7 +2914,6 @@ users.new_success = Käyttäjätili "%s" on luotu.
 config.disable_register = Poista itserekisteröinti käytöstä
 config.enable_openid_signin = Ota OpenID-kirjautuminen käyttöön
 config.enable_openid_signup = Ota OpenID-itserekisteröinti käyttöön
-monitor.queue.settings.changed = Asetukset päivitetty
 config.db_schema = Skeema
 settings = Ylläpitäjän asetukset
 emails.delete = Poista sähköpostiosoite
@@ -3021,7 +2936,6 @@ auths.oauth2_provider = OAuth2-palveluntarjoaja
 auths.tips.gmail_settings = Gmail-asetukset:
 config.mailer_sendmail_path = Sendmail-polku
 config_settings = Asetukset
-monitor.queue.settings.remove_all_items = Poista kaikki
 config.skip_tls_verify = Ohita TLS-vahvistus
 dashboard.new_version_hint = Forgejo %s on nyt saatavilla. Käytössäsi on %s. Lue lisätietoja <a target="_blank" rel="noreferrer" href="%s">blogista</a>.
 defaulthooks.add_webhook = Lisää oletusarvoinen webkoukku
@@ -3123,7 +3037,6 @@ dashboard.update_checker = Päivitysten tarkistaja
 auths.allowed_domains_helper = Jätä tyhjäksi salliaksesi kaikki verkkotunnukset. Erota useat verkkotunnukset pilkulla (",").
 auths.activated = Tämä todennuslähde on aktivoitu
 auths.login_source_of_type_exist = Tätä tyyppiä oleva todennuslähde on jo olemassa.
-dashboard.memory_allocate_times = Muistiallokaatiot
 users.send_register_notify = Ilmoita rekisteröitymisestä sähköpostitse
 config.offline_mode = Paikallinen tila
 config.cache_item_ttl = Välimuistitietueen TTL
@@ -3154,14 +3067,12 @@ monitor.process.cancel_notices = Perutaanko: <strong>%s</strong>?
 config.enable_federated_avatar = Ota federoidut profiilikuvat käyttöön
 notices.operations = Toimenpiteet
 config.xorm_log_sql = Lokita SQL
-monitor.queue.settings.remove_all_items_done = Kaikki jonossa olleet tietueet on poistettu.
 config.logger_name_fmt = Lokittaja: %s
 config.git_max_diff_line_characters = Diff-merkkejä enintään riviä kohden
 config.git_max_diff_files = Diff-tiedostoja enintään näytettäväksi
 config.access_log_mode = Pääsylokin tila
 config.picture_config = Kuvan ja avatarin asetukset
 notices.delete_success = Järjestelmäilmoitukset on poistettu.
-monitor.queue.settings.maxnumberworkers.placeholder = Tällä hetkellä %[1]d
 auths.force_smtps_helper = SMTPS:ää käytetään aina portissa 465. Aseta tämä pakottaaksesi SMTPS toisiin portteihin. (Muuten STARTTLS:ää käytetään toisiin portteihin, jos palvelin tukee sitä.)
 dashboard.resync_all_sshprincipals = Päivitä ".ssh/authorized_principals"-tiedosto Forgejon SSH-prinsipaaleilla.
 auths.verify_group_membership = Vahvista ryhmäjäsenyys LDAP:issa (jätä suodatin tyhjäksi ohittaaksesi)
@@ -3251,24 +3162,10 @@ creation.value_placeholder = Syötä mitä tahansa sisältöä. Tyhjätila aluss
 
 [actions]
 runs.empty_commit_message = (tyhjä kommittiviesti)
-variables.deletion = Poista muuttuja
 workflow.dispatch.input_required = Arvo syötteelle "%s" vaadittu.
-variables.description = Muuttujat asetetaan tietyille toiminnoille eikä niitä voida lukea muutoin.
-variables.none = Ei muuttujia vielä.
-variables.deletion.description = Muuttujan poistaminen on lopullista, eikä sitä voi perua. Jatketaanko?
 workflow.dispatch.invalid_input_type = Syötetyyppi "%s" ei kelpaa.
 workflow.dispatch.warn_input_limit = Näytetään vain ensimmäiset %d syötettä.
-variables = Muuttujat
-variables.management = Hallitse muuttujia
-variables.creation = Lisää muuttuja
 runs.expire_log_message = Lokitiedostot on tyhjätty vanhenemisen vuoksi.
-variables.deletion.success = Muuttuja poistettu.
-variables.edit = Muokkaa muuttujaa
-variables.creation.success = Muuttuja "%s" lisätty.
-variables.deletion.failed = Muuttujan poisto epäonnistui.
-variables.creation.failed = Muuttujan lisäys epäonnistui.
-variables.update.failed = Muuttujan muokkaus epäonnistui.
-variables.update.success = Muuttuja muokattu.
 variables.id_not_exist = Muuttujaa tunnisteella %d ei ole olemassa.
 workflow.dispatch.run = Suorita työnkulku
 workflow.enable = Ota työnkulku käyttöön
@@ -3279,7 +3176,6 @@ workflow.disable_success = Työnkulku "%s" on poistettu käytöstä.
 unit.desc = Hallitse integroituja CI-/CD-putkia Forgejo Actionsia hyödyntäen.
 runs.no_workflows.help_no_write_access = Lisätietoja Forgejo Actionsista on saatavilla <a target="_blank" rel="noopener noreferrer" href="%s">dokumentaatiosta</a>.
 runs.no_runs = Työnkululla ei ole vielä suorituksia.
-variables.not_found = Muuttujaa ei löytynyt.
 runs.no_workflows.help_write_access = Etkö tiedä, miten aloittaa Forgejo Actionsin käyttö? Lue <a target="_blank" rel="noopener noreferrer" href="%s">pikaopas</a> kirjoittaaksesi ensimmäisen työnkulun, sen jälkeen <a target="_blank" rel="noopener noreferrer" href="%s">määritä Forgejo-ajaja</a> suorittamaan asettamiasi töitä.
 workflow.dispatch.success = Työnkulun suoritusta pyydettiin onnistuneesti.
 workflow.dispatch.trigger_found = Tällä työnkululla on <c>workflow_dispatch</c>-tapahtumaliipaisin.
@@ -3340,7 +3236,6 @@ projects.read = <b>Lue:</b> Pääsy tietovaraston projektitauluille.
 wiki.write = <b>Kirjoita:</b> Luo, päivitä ja poista integroidun wikin sivuja.
 
 [markup]
-filepreview.truncated = Esikatselu on typistetty
 
 [translation_meta]
 test = Tämä on testimerkkijono. Sitä ei näytetä Forgejo-käyttöliittymässä, mutta sitä käytetään testaustarkoituksiin. Voit vapaasti kirjoittaa "selvä" säästääksesi aikaa (tai käyttää hauskaa faktaa) ja saavuttaaksesi sen makean 100 %:n valmistumisrajan :)
\ No newline at end of file
diff --git a/options/locale/locale_fil.ini b/options/locale/locale_fil.ini
index ba2da26e59..68a6efddee 100644
--- a/options/locale/locale_fil.ini
+++ b/options/locale/locale_fil.ini
@@ -43,9 +43,6 @@ sign_up = Magrehistro
 link_account = Mag-link ng account
 template = Template
 tracked_time_summary = Buod ng mga nakasubaybay na oras base sa filter ng listahan ng isyu
-webauthn_sign_in = Pindutin ang button ng iyong security key. Kung walang button ang iyong security key, ilagay muli.
-webauthn_error_insecure = Sinusuportahan lamang ng WebAuthn ang mga secure na koneksyon. Para sa pagsubok sa HTTP, pwede mo gamitin ang origin na "localhost" o "127.0.0.1"
-webauthn_error_timeout = Naabot ang timeout bago mabasa ang iyong key. Mangyaring i-reload ang page na ito at subukan muli.
 view = Itignan
 disabled = Naka-disable
 copy_url = Kopyahin ang URL
@@ -64,15 +61,6 @@ re_type = Kumpirmahin ang password
 captcha = CAPTCHA
 twofa = Authentikasyong two-factor
 passcode = Passcode
-webauthn_insert_key = Ilagay ang iyong security key
-webauthn_press_button = Pindutin ang button ng iyong security key…
-webauthn_use_twofa = Gumamit ng two-factor code galing sa iyong telepono
-webauthn_error = Hindi mabasa ang iyong security key.
-webauthn_unsupported_browser = Kasalukuyang hindi sinusuportahan ng iyong browser ang WebAuthn.
-webauthn_error_unknown = May nangyaring hindi alam na error. Magyaring subukan muli.
-webauthn_error_unable_to_process = Hindi maproseso ng server ang iyong hiling.
-webauthn_error_duplicated = Hindi pinapayagan ang security key na ito para sa hiling na ito. Mangyaring siguraduhin na ang key na ito ay hindi ito nakarehistro na.
-webauthn_error_empty = Kailangan mong maglapat ng pangalan para sa key na ito.
 repository = Repositoryo
 organization = Organisasyon
 mirror = Salamin
@@ -1091,7 +1079,6 @@ delete_preexisting = Burahin ang mga dating umiiral na file
 delete_preexisting_content = Burahin ang mga file sa %s
 tree_path_not_found_commit = Hindi umiiral ang path na %[1]s sa commit %[2]s
 tree_path_not_found_branch = Hindi umiiral ang daanang %[1]s sa branch %[2]s
-migrate_items_pullrequests = Mga hiling sa paghila
 archive.title = Naka-archive ang repositoryong ito. Maaari mong itignan ang mga file at i-clone ito, pero hindi ka makakagawa ng anumang pagbabago sa estado ito, tulad ng pagtulak at paggawa ng mga isyu, pull request o mga komento.
 archive.title_date = Naka-archive ang repositoryo na ito noong %s. Maaari mong itignan ang mga file at i-clone ito, pero hindi ka makakagawa ng anumang pagbabago sa estado nito, tulad ng pagtulak o paggawa ng mga bagong isyu, mga pull request, o komento.
 pulls = Mga hiling sa paghila
@@ -1143,13 +1130,7 @@ form.name_pattern_not_allowed = Hindi pinapayagan ang pattern na "%s" sa pangala
 migrate_options_lfs = I-migrate ang mga LFS file
 migrate_options_lfs_endpoint.label = Endpoint ng LFS
 migrate_options_lfs_endpoint.placeholder = Kung iwanang blangko, ang endpoint ay magmumula sa clone URL
-migrate_items_milestones = Mga milestone
-migrate_items_labels = Mga label
-migrate_items_issues = Mga isyu
-migrate_items_merge_requests = Mga merge request
 migrate.clone_address = Magmigrate / Mag-clone mula sa URL
-migrate_items = Mga item sa pagmigrate
-migrate_items_releases = Mga paglabas
 migrate_repo = I-migrate ang repositoryo
 size_format = %[1]s: %[2]s, %[3]s: %[4]s
 template.git_hooks_tooltip = Kasalukuyang hindi mo mababago o matatanggal ang mga hook ng Git kapag nadagdag. Piliin lang ito kapag pinagkakatiwalaan mo ang template na repositoryo.
@@ -1157,7 +1138,6 @@ template.webhooks = Mga webhook
 template.topics = Mga paksa
 template.issue_labels = Mga label ng isyu
 template.one_item = Kailangang pumili ng kahit isang template item
-migrate_items_wiki = Wiki
 migrate.clone_local_path = o isang lokal na path ng server
 adopt_preexisting_success = Pinagtibay ang mga file at ginawa ang repositoryo mula sa %s
 delete_preexisting_success = Burahin ang mga hindi pinatibay na file sa %s
@@ -1168,12 +1148,6 @@ migrate.invalid_local_path = Hindi wasto ang lokal na path. Hindi ito umiiral o
 migrate.invalid_lfs_endpoint = Hindi wasto ang LFS endpoint.
 migrate.migrating_failed = Nabigo ang pag-migrate mula sa <b>%s</b>.
 migrate.migrating_failed_no_addr = Nabigo ang pagmigrate.
-migrate.migrating_topics = Nililipat ang mga paksa
-migrate.migrating_milestones = Nililipat ang mga milestone
-migrate.migrating_releases = Nililipat ang mga paglabas
-migrate.migrating_pulls = Nililipat ang mga pull request
-migrate.cancel_migrating_title = Kanselahin ang pag-migrate
-migrate.cancel_migrating_confirm = Gusto mo bang kanselahin ang migration na ito?
 mirror_from = mirror ng
 forked_from = na-fork mula sa
 generated_from = na-generate mula sa
@@ -1227,7 +1201,6 @@ from_comment = (komento)
 editor.add_file = Magdagdag ng file
 editor.upload_file = Mag-upload ng file
 editor.cannot_edit_lfs_files = Hindi mababago ang mga LFS file sa web interface.
-migrate.migrating_issues = Nililipat ang mga isyu
 fork_from_self = Hindi ka makaka-fork ng repositoryo na minamay-ari mo.
 broken_message = Ang Git data na pinagbabatayan sa repositoryo na ito ay hindi mabasa. Makipag-ugnayan sa tagapangasiwa ng instansya na ito o burahin ang repositoryo na ito.
 file_history = Kasaysayan
@@ -1235,7 +1208,6 @@ invisible_runes_header = `Nalalaman ng file na ito ng mga hindi nakikitang Unico
 file_too_large = Masyadong malaki ang file para ipakita.
 invisible_runes_description = `Ang file na ito ay naglalaman ng mga hindi nakikitang Unicode character na hindi nakikilala ng mga tao ngunit maaaring maproseso ng ibang paraan ng isang computer. Kung sa tingin mo ay sinasadya ito, maaari mong ligtas na hindi pansinin ang babala na ito. Gamitin ang I-escape na button para ipakita sila.`
 commit.contained_in_default_branch = Ang commit na ito ay bahagi ng default na branch
-migrate.migrating_labels = Nililipat ang mga label
 filter_branch_and_tag = I-filter ang branch o tag
 clear_ref = `Burahin ang kasalukuyang sanggunian`
 actions = Mga Aksyon
@@ -1248,12 +1220,6 @@ commits = Mga Commit
 file_permalink = Permalink
 migrate.migrating_failed.error = Nabigong magmigrate: %s
 unwatch = I-unwatch
-n_commit_one = %s commit
-n_commit_few = %s mga commit
-n_branch_one = %s branch
-n_branch_few = %s mga branch
-n_tag_one = %s tag
-n_tag_few = %s mga tag
 editor.cannot_edit_non_text_files = Hindi mababago ang mga binary file sa web interface.
 migrated_from = Na-migrate mula sa <a href="%[1]s">%[2]s</a>
 migrated_from_fake = Na-migrate mula sa %[1]s
@@ -1272,7 +1238,6 @@ unescape_control_characters = I-unescape
 invisible_runes_line = `Ang linya na ito ay may mga hindi nakikitang Unicode character`
 ambiguous_runes_line = `Ang linya na ito ay may mga hindi tiyak na Unicode character`
 tag = Tag
-migrate.migrating_git = Nililipat ang Git data
 vendored = Naka-vendor
 editor.delete = Burahin ang %s
 editor.add = Idagdag ang %s
@@ -1612,7 +1577,6 @@ issues.new.clear_assignees = I-clear ang mga mangangasiwa
 issues.new.no_assignees = Walang mga mangangasiwa
 issues.choose.invalid_config = Ang config ng isyu ay naglalaman ng mga error:
 issues.label_templates.info = Walang pang mga umiiral na label. Gumawa ng label gamit ang "Bagong label" o gumamit ng label preset:
-n_release_one = %s release
 issues.action_label = Label
 issues.action_milestone = Milestone
 issues.action_milestone_no_select = Walang milestone
@@ -1646,7 +1610,6 @@ issues.remove_project_at = `tinanggal ito mula sa <b>%s</b> na proyekto %s`
 issues.filter_label_select_no_label = Walang label
 issues.filter_sort.fewestforks = Pinakakaunting fork
 issues.add_assignee_at = `ay itinalaga ni/ng <b>%s</b> %s`
-n_release_few = %s mga release
 issues.remove_ref_at = `tinanggal ang sangguni na <b>%s</b> %s`
 issues.add_ref_at = `idinagdag ang sangguni na <b>%s</b> %s`
 issues.filter_milestone = Milestone
@@ -2710,7 +2673,6 @@ emails.updated = Napalitan na ang email
 emails.not_updated = Nabigong baguhin ang hinihiling na email address: %v
 monitor.next = Susunod na oras
 monitor.last_execution_result = Resulta
-dashboard.last_gc_time = Oras noong huling GC
 users.last_login = Huling nag sign-in
 first_page = Una
 last_page = Huli
@@ -2729,8 +2691,6 @@ config_settings = Mga setting
 dashboard.statistic = Buod
 dashboard.task.error = Error sa Utos: %[1]s: %[3]s
 users.full_name = Buong pangalan
-users.list_status_filter.menu_text = Isaasyos
-users.list_status_filter.not_2fa_enabled = Naka-disable ang 2FA
 users.never_login = Hindi nag-sign in kailanman
 dashboard.system_status = Status ng sistema
 dashboard.operation_switch = Palitan
@@ -2756,20 +2716,6 @@ dashboard.resync_all_hooks = I-resychronize ang mga Git hook ng lahat ng mga rep
 dashboard.cleanup_hook_task_table = Linisin ang hook_task table
 dashboard.cleanup_packages = Linisin ang mga na-expire na package
 dashboard.cleanup_actions = Linisin ang mga nag-expire na log at artifact mula sa mga aksyon
-dashboard.server_uptime = Uptime ng server
-dashboard.current_goroutine = Mga kasalukuyang goroutine
-dashboard.total_memory_allocated = Kabuuan na na-allocate na memory
-dashboard.memory_obtained = Mga nakuhang memory
-dashboard.pointer_lookup_times = Oras ng pointer lookup
-dashboard.memory_free_times = Mga memory free
-dashboard.current_heap_usage = Kasalukuyang paggamit ng heap
-dashboard.heap_memory_obtained = Nakuhang heap memory
-dashboard.heap_memory_idle = Idle ng heap memory
-dashboard.heap_objects = Mga heap object
-dashboard.bootstrap_stack_usage = Paggamit ng bootstrap stack
-dashboard.stack_memory_obtained = Nakuhang stack memory
-dashboard.profiling_bucket_hash_table_obtained = Mga nakuhang profiling bucket hash table
-dashboard.gc_metadata_obtained = Nakuhang GC metadata
 dashboard.delete_old_actions = Burahin ang lahat ng mga lumang aktibidad mula sa database
 dashboard.stop_endless_tasks = Itigil ang mga hindi natatapos na aksyon ng task
 dashboard.cancel_abandoned_jobs = Kanselahin ang mga naiwang aksyon ng trabaho
@@ -2788,16 +2734,7 @@ users.update_profile = I-update ang user account
 users.delete_account = Burahin ang user account
 users.cannot_delete_self = Hindi mo maaaring burahin ang sarili mo
 users.still_own_repo = Ang user na ito ay nagmamay-ari pa ng isa o higit pang mga repositoryo. Burahin o ilipat sila muna.
-users.list_status_filter.is_active = Aktibo
-users.list_status_filter.not_active = Hindi aktibo
-users.list_status_filter.is_admin = Tagapangasiwa
-users.list_status_filter.not_admin = Hindi tagapangasiwa
-users.list_status_filter.is_restricted = Pinaghihigpitan
-users.list_status_filter.is_prohibit_login = Pinagbawalan ang pag-login
-users.list_status_filter.not_prohibit_login = Pinapayagan ang pag-login
-users.list_status_filter.is_2fa_enabled = Naka-enable ang 2FA
 users.details = Mga detalye ng user
-dashboard.memory_allocate_times = Mga allocation ng memory
 users.edit = I-edit
 users = Mga user account
 organizations = Mga organisasyon
@@ -2830,13 +2767,7 @@ dashboard.reinit_missing_repos = Muling pagsasaayos ng lahat ng nawawalang mga r
 users.allow_git_hook_tooltip = Ang mga Git hook ay tinatakbo bilang OS user na tinatakbo ang Forgejo at may katulad na level ng pag-access ng host. Bilang isang resulta, ang mga gumagamit na may espesyal na pribilehiyo ng Git hook na ito ay maaaring ma-access at baguhin ang lahat ng mga repositori ng Forgejo pati na rin ang database na ginamit ng Forgejo. Dahil dito nakakamit din nila ang mga pribilehiyo ng Forgejo Administrator.
 dashboard.delete_repo_archives = Burahin ang lahat ng mga archive ng mga repositoryo (ZIP, TAR.GZ, atbp..)
 dashboard.sync_external_users = I-synchronize ang panlabas na user data
-dashboard.heap_memory_released = Mga na-release na heap memory
-dashboard.other_system_allocation_obtained = Ibang allocation ng sistema na nakuha
 users.allow_git_hook = Makakagawa ng mga Git hook
-dashboard.current_memory_usage = Kasalukuyang paggamit ng memory
-dashboard.gc_times = Mga oras ng GC
-users.list_status_filter.reset = I-reset
-users.list_status_filter.not_restricted = Hindi pinaghihigpitan
 config_summary = Buod
 dashboard.new_version_hint = Available na ang Forgejo %s, tumatakbo ka ng %s. Suriin ang <a target="_blank" rel="noreferrer" href="%s">blog</a> para sa karagdagang detalye.
 dashboard.operations = Mga operasyon ng pagpapanatili
@@ -2848,11 +2779,6 @@ dashboard.sync_repo_tags = I-sync ang mga tag mula sa Git data sa database
 dashboard.update_mirrors = I-update ang mga mirror
 dashboard.repo_health_check = Suriin ang kalusugan ng lahat ng mga repositoryo
 dashboard.check_repo_stats = Suriin ang lahat ng istatistika ng repositoryo
-dashboard.mspan_structures_usage = Paggamit ng MSpan structure
-dashboard.mspan_structures_obtained = Mga nakuhang MSpan structure
-dashboard.mcache_structures_usage = Paggamit ng MCache structure
-dashboard.next_gc_recycle = Susunod na GC recycle
-dashboard.mcache_structures_obtained = Mga nakuhang MCache structure
 dashboard.delete_old_actions.started = Nasimula na ang burahin ang lahat ng mga lumang aktibidad mula sa database.
 dashboard.update_checker = Tagasuri ng update
 dashboard.delete_old_system_notices = Burahin ang lahat ng mga lumang paunawa ng sistema mula sa database
@@ -2868,11 +2794,8 @@ users.is_activated = Naka-activate na account
 users.prohibit_login = Sinuspending account
 emails.email_manage_panel = Ipamahala ang mga email ng user
 self_check = Pansariling pagsusuri
-dashboard.total_gc_pause = Kabuuang GC pause
-dashboard.last_gc_pause = Huling GC pause
 users.still_has_org = Ang user na ito ay isang miyembro ng isang organisasyon. Tanggalin ang user sa anumang mga organisasyon muna.
 users.deletion_success = Binura na ang user account.
-dashboard.heap_memory_in_use = Ginagamit na heap memory
 emails.filter_sort.name = Username
 emails.primary = Pauna
 emails.filter_sort.email = Email
@@ -3042,8 +2965,6 @@ auths.allowed_domains = Mga pinapayagang domain
 auths.helo_hostname_helper = Hostname na pinapadala sa pamamagitan ng HELO. Iwanang walang laman para ipadala ang kasalukuyang hostname.
 auths.disable_helo = I-disable ang HELO
 auths.oauth2_profileURL = URL ng profile
-monitor.queue.settings.maxnumberworkers.placeholder = Kasalukuyang %[1]d
-monitor.queue.settings.remove_all_items = Tanggalin lahat
 users.block.description = Harangan ang tagagamit na ito mula sa pag-interact sa serbisyong ito sa pamamagitan ng kanilang mga account at pagbawalan ang pag-sign in.
 monitor.cron = Mga cron task
 config.mailer_sendmail_timeout = Timeout ng Sendmail
@@ -3062,13 +2983,9 @@ config.provider_config = Config ng provider
 config.cache_test_slow = Matagumpay ang pagsubok ng cache, ngunit mabagal ang tugon: %s.
 config.picture_config = Configuration ng larawan at avatar
 config.disabled_logger = Naka-disable
-monitor.queue.settings.submit = I-update ang mga setting
 auths.tips = Mga tip
 config.test_mail_sent = Ang isang test email ay ipinadala kay "%s".
 monitor.process.cancel = Kanselahin ang proseso
-monitor.queues = Mga queue
-monitor.queue.exemplar = Uri ng Exemplar
-monitor.queue.numberworkers = Numero ng mga worker
 config.enable_openid_signup = I-enable ang OpenID na pansariling pagrehistro
 config.session_config = Configuration ng session
 monitor.name = Pangalan
@@ -3079,9 +2996,6 @@ config.git_gc_args = Mga argument ng GC
 config.git_migrate_timeout = Timeout ng paglipat
 config.cache_config = Configuration ng cache
 config.git_pull_timeout = Timeout ng operasyon ng paghila
-monitor.queue.settings.maxnumberworkers = Pinakamaraming numero ng worker
-monitor.queue.settings.title = Mga setting ng pool
-monitor.queue.settings.desc = Dinamikang lumalaki ang mga pool tugon sa kanilang worker queue blocking.
 auths.tip.google_plus = Kumuha ng OAuth2 client credentials mula sa Google API console sa %s
 config.mail_notify = Paganahin ang mga email notification
 config.active_code_lives = Oras ng pag-expire ng activation code
@@ -3091,7 +3005,6 @@ users.organization_creation.description = Payagan ang paggawa ng mga bagong orga
 auths.delete_auth_title = Burahin ang source ng authentikasyon
 auths.delete_auth_desc = Ang pagtanggal ng authentication source ay pumipigil sa mga user na gamitin ito upang mag-sign in. Magpatuloy?
 auths.login_source_of_type_exist = Umiiral na ang authentication source na may ganitong uri.
-monitor.queue.settings.maxnumberworkers.error = Dapat numero ang pinakamaraming numero ng mga worker
 self_check.no_problem_found = Wala pang mga problema na nahanap.
 self_check.database_collation_mismatch = Inaasahan ang database na gamitin ang collation: %s
 auths.oauth2_admin_group = Group claim value para sa mga tagapangasiwa. (Opsyonal - kinakailangan ang claim name sa itaas)
@@ -3150,11 +3063,6 @@ monitor.desc = Paglalarawan
 monitor.start = Oras ng pagsimula
 monitor.execute_time = Oras ng pag-execute
 monitor.process.children = Mga anak
-monitor.queue = Queue: %s
-monitor.queue.type = Uri
-monitor.queue.maxnumberworkers = Pinakamaraming numero ng worker
-monitor.queue.numberinqueue = Number sa queue
-monitor.queue.review_add = Suriin / magdagdag ng mga worker
 self_check.database_collation_case_insensitive = Gumagamit ang database ng collation %s, na isang insensitive na collation. Bagama't maaaring gumana ang Forgejo dito, maaaring may ilang bihirang kaso na hindi gumagana gaya ng inaasahan.
 auths.tips.oauth2.general.tip = Kapag nagrerehistro ng bagong OAuth2 na authentication, ang callback/redirect URL ay dapat na:
 auths.activated = Na-activate na ang source ng authentikasyon
@@ -3168,14 +3076,11 @@ config.default_enable_timetracking = I-enable ang pagsubaybay ng oras bilang def
 auths.deletion_success = Binura na ang authentication source.
 auths.login_source_exist = Umiiral na ang authentication source na "%s".
 auths.still_in_used = Ginagamit pa ang authentication source. I-convert o burahin ang mga user na gumagamit ng authentication source na ito muna.
-monitor.queue.settings.remove_all_items_done = Tinanggal na ang lahat ng mga item sa queue.
-monitor.queue.settings.changed = Na-update ang mga setting
 auths.oauth2_map_group_to_team_removal = Tanggalin ang user sa mga naka-synchronize na team kung ang user ay hindi kasama sa katumbas na groupo.
 config.cache_test_succeeded = Matagumpay ang pagsubok ng cache, nakakuha ng tugon sa %s.
 config.open_with_editor_app_help = Ang mga "Open with" editor para sa clone menu. Kung iniwang walang laman, ang default ang gagamitin. I-expand para makita ang default.
 config.set_setting_failed = Nabigo ang pagtakda ng setting na %s
 monitor.download_diagnosis_report = I-download ang ulat ng diagnosis
-monitor.queue.activeworkers = Mga aktibong worker
 self_check.database_inconsistent_collation_columns = Gumagamit ang database ng collation %s, ngunit ang mga column na ito ay gumagamit ng hindi tugmang collations. Maaaring magdulot ito ng ilang hindi inaasahang problema.
 auths.tip.twitter = Pumunta sa %s, gumawa ng application at siguraduhing naka-enable ang "Payagan ang application na gamitin para Mag-sign in sa Twitter" na opsyon
 auths.tip.gitea = Magrehistro ng bagong OAuth2 na application. Ang guide ay mahahanap sa %s
@@ -3200,7 +3105,6 @@ config.gc_interval_time = Oras ng pagitan ng GC
 config.cookie_life_time = Lifetime ng cookie
 config.git_clone_timeout = Timeout ng operasyon na pag-clone
 monitor.process.cancel_desc = Ang pagkansela ng proseso ay maaaring magdulot ng pagkawalan ng data
-monitor.queue.name = Pangalan
 auths.oauth2_required_claim_value_helper = Itakda ang value na ito upang i-restrict ang pag-login mula sa pinagmulang ito sa mga user na may claim na may ganitong pangalan at value
 auths.tip.bitbucket = Magrehistro ng bagong OAuth consumer sa %s at idagdag ang pahintulot na "Account" - "Read"
 config.require_sign_in_view = Kailanganin ang pag-sign in para itignan ang nilalaman
@@ -3344,39 +3248,24 @@ owner.settings.cleanuprules.enabled = Naka-enable
 [actions]
 workflow.dispatch.trigger_found = Mayroong <c>workflow_dispatch</c> na trigger ang workflow na ito.
 unit.desc = Ipamahala ang mga pinag-sasamang CI/CD pipeline sa pamamagitan ng Forgejo Actions.
-variables.update.failed = Nabigong baguhin ang variable.
-variables.update.success = Nabago na ang variable.
-variables.edit = Baguhin ang Variable
 workflow.enable = I-enable ang workflow
 workflow.disabled = Naka-disable ang workflow.
 need_approval_desc = Kailangan ng pag-apruba para tumakbo ng mga workflow para sa fork na hiling sa paghila.
-variables = Mga variable
 runs.no_runs = Wala pang mga pagtatakbo ang workflow na ito sa ngayon.
-variables.creation = Magdagdag ng variable
-variables.none = Wala pang mga variable sa ngayon.
-variables.deletion = Tanggalin ang variable
-variables.deletion.description = Permanente ang pagtanggal ng isang variable at hindi ito mababalik. Magpatuloy?
 runs.empty_commit_message = (walang laman na mensahe ng commit)
 workflow.enable_success = Matagumpay na na-enable ang workflow na "%s".
 workflow.dispatch.run = Patakbuhin ang workflow
 workflow.dispatch.success = Matagumpay na nahiling ang pagtakbo ng workflow.
-variables.management = Ipamahala ang mga variable
-variables.deletion.failed = Nabigong tanggalin ang variable.
 workflow.disable = I-disable ang workflow
 workflow.disable_success = Matagumpay na na-disable ang workflow na "%s".
-variables.creation.failed = Nabigong idagdag ang variable.
 workflow.dispatch.use_from = Gamitin ang workflow mula sa
 workflow.dispatch.invalid_input_type = Hindi wastong input type "%s".
 workflow.dispatch.input_required = Kumailangan ng value para sa input na "%s".
 workflow.dispatch.warn_input_limit = Pinapakita lamang ang unang %d na mga input.
-variables.description = Ipapasa ang mga variable sa ilang mga aksyon at hindi mababasa kung hindi man.
 variables.id_not_exist = Hindi umiiral ang variable na may ID na %d.
-variables.deletion.success = Tinanggal na ang variable.
-variables.creation.success = Nadagdag na ang variable na "%s".
 runs.expire_log_message = Na-purge ang mga log dahil masyado silang luma.
 runs.no_workflows.help_write_access = Hindi alam kung paano magsimula sa Forgejo Actions? Tignan ang <a target="_blank" rel="noopener noreferrer" href="%s">mabilisang pagsimula sa user documentation</a> para magsimulang magsulat ng unang workflow, at <a target="_blank" rel="noopener noreferrer" href="%s">mag-setup ng Forgejo runner</a> para patakbuhin ang mga job.
 runs.no_workflows.help_no_write_access = Para matuto tungkol sa Forgejo Actions, tignan ang <a target="_blank" rel="noopener noreferrer" href="%s">dokumentasyon</a>.
-variables.not_found = Nabigong hanapin ang variable.
 
 [action]
 commit_repo = itinulak sa <a href="%[2]s">%[3]s</a> sa <a href="%[1]s">%[4]s</a>
@@ -3460,9 +3349,6 @@ management = Ipamahala ang mga secret
 deletion.description = Ang pagtanggal ng sikreto ay permanente at hindi mababawi. Magpatuloy?
 
 [markup]
-filepreview.line = Linya %[1]d sa %[2]s
-filepreview.truncated = Na-truncate ang preview
-filepreview.lines = Mga linya %[1]d hanggang %[2]d sa %[3]s
 
 [projects]
 deleted.display_name = Binurang proyekto
diff --git a/options/locale/locale_fr-FR.ini b/options/locale/locale_fr-FR.ini
index 1d856d1502..2558b99f74 100644
--- a/options/locale/locale_fr-FR.ini
+++ b/options/locale/locale_fr-FR.ini
@@ -37,18 +37,6 @@ twofa=Authentification à deux facteurs
 twofa_scratch=Code de secours pour l'authentification à deux facteurs
 passcode=Code d'accès
 
-webauthn_insert_key=Insérez votre clé de sécurité
-webauthn_sign_in=Appuyez sur le bouton de votre clé de sécurité. Si votre clé de sécurité n'a pas de bouton, réinsérez-la.
-webauthn_press_button=Veuillez appuyer sur le bouton de votre clé de sécurité…
-webauthn_use_twofa=Utilisez l'authentification à deux facteurs avec votre téléphone
-webauthn_error=Impossible de lire votre clé de sécurité.
-webauthn_unsupported_browser=Votre navigateur ne prend actuellement pas en charge WebAuthn.
-webauthn_error_unknown=Une erreur indéterminée s'est produite. Veuillez réessayer.
-webauthn_error_insecure=`WebAuthn ne prend en charge que les connexions sécurisées. Pour les tests via HTTP, vous pouvez utiliser l'origine "localhost" ou "127.0.0.1"`
-webauthn_error_unable_to_process=Le serveur n'a pas pu traiter votre demande.
-webauthn_error_duplicated=La clé de sécurité n'est pas autorisée pour cette demande. Veuillez vous assurer que la clé n'est pas déjà enregistrée.
-webauthn_error_empty=Vous devez définir un nom pour cette clé.
-webauthn_error_timeout=Le délai d'attente imparti a été atteint avant que votre clé ne puisse être lue. Veuillez recharger la page pour réessayer.
 repository=Dépôt
 organization=Organisation
 mirror=Miroir
@@ -1153,14 +1141,6 @@ migrate_options_lfs_endpoint.label=Point d'accès LFS
 migrate_options_lfs_endpoint.description=La migration va tenter d'utiliser votre dépôt Git distant pour <a target="_blank" rel="noopener noreferrer" href="%s">déterminer le serveur LFS</a>. Vous pouvez également spécifier un point d'accès personnalisé si les données LFS du dépôt sont stockées ailleurs.
 migrate_options_lfs_endpoint.description.local=Un chemin de serveur local est également pris en charge.
 migrate_options_lfs_endpoint.placeholder=Si laissé vide, le point de terminaison sera dérivé de l'URL du clone
-migrate_items=Éléments à migrer
-migrate_items_wiki=Wiki
-migrate_items_milestones=Jalons
-migrate_items_labels=Labels
-migrate_items_issues=Tickets
-migrate_items_pullrequests=Demandes d'ajout
-migrate_items_merge_requests=Demandes de fusion
-migrate_items_releases=Publications
 migrate_repo=Migrer le dépôt
 migrate.clone_address=Migrer/Cloner depuis une URL
 migrate.clone_address_desc=L'URL HTTP(S) ou Git "clone" d'un dépôt existant
@@ -1179,16 +1159,6 @@ migrate.migrating=Migration de <b>%s</b> …
 migrate.migrating_failed=La migration de <b>%s</b> a échoué.
 migrate.migrating_failed.error=Échec de la migration : %s
 migrate.migrating_failed_no_addr=Échec de la migration.
-migrate.migrating_git=Migration des données Git
-migrate.migrating_topics=Migration des sujets
-migrate.migrating_milestones=Migration des jalons
-migrate.migrating_labels=Migration des labels
-migrate.migrating_releases=Migration des publications
-migrate.migrating_issues=Migration des tickets
-migrate.migrating_pulls=Migration des demandes d'ajout
-migrate.cancel_migrating_title=Annuler la migration
-migrate.cancel_migrating_confirm=Voulez-vous abandonner cette migration ?
-
 mirror_from=miroir de
 forked_from=bifurqué depuis
 generated_from=généré depuis
@@ -2639,16 +2609,10 @@ file_follow = Suivre le lien symbolique
 settings.confirmation_string = Chaine de confirmation
 pulls.agit_explanation = Créé par le workflow AGit. AGit permet aux contributeurs de proposer des modifications en utilisant "git push" sans créer une bifurcation ou une nouvelle branche.
 stars = Étoiles
-n_tag_few = %s étiquettes
 editor.commit_id_not_matching = Le fichier a été modifié pendant que vous l'éditiez. Appliquez les modifications à une nouvelle branche puis procédez à la fusion.
 commits.search_branch = Cette branche
 open_with_editor = Ouvrir avec %s
 pulls.ready_for_review = Prêt à être évalué ?
-n_commit_one = %s commit
-n_commit_few = %s commits
-n_branch_one = %s branch
-n_branch_few = %s branches
-n_tag_one = %s étiquettes
 editor.push_out_of_date = Le push semble obsolète.
 issues.num_participants_one = %d participant
 issues.archived_label_description = (Archivé) %s
@@ -2679,8 +2643,6 @@ settings.federation_settings = Paramètres de féderation
 project = Projets
 subscribe.issue.guest.tooltip = Authentifiez vous pour vous abonner à ce ticket.
 subscribe.pull.guest.tooltip = Authentifiez vous pour suivre cette demande d'ajout.
-n_release_one = %s publication
-n_release_few = %s publications
 issues.author.tooltip.pr = Cet utilisateur est l'auteur de cette pull request.
 issues.author.tooltip.issue = Cet utilisateur est l'auteur de ce ticket.
 issues.edit.already_changed = Impossible de sauvegarder les changements du ticket car son contenu a déjà été modifié par un autre utilisateur. Veuillez recharger la page et essayer de l'éditer à nouveau pour éviter d'écraser ses changements
@@ -2962,34 +2924,6 @@ dashboard.sync_external_users=Synchroniser les données de l’utilisateur exter
 dashboard.cleanup_hook_task_table=Nettoyer la table hook_task
 dashboard.cleanup_packages=Nettoyer des paquets expirés
 dashboard.cleanup_actions=Nettoyer les journaux et les artefacts des actions obsolètes
-dashboard.server_uptime=Uptime du serveur
-dashboard.current_goroutine=Goroutines actuelles
-dashboard.current_memory_usage=Utilisation Mémoire actuelle
-dashboard.total_memory_allocated=Mémoire totale allouée
-dashboard.memory_obtained=Mémoire obtenue
-dashboard.pointer_lookup_times=Nombre de Consultations Pointeur
-dashboard.memory_allocate_times=Allocations de mémoire
-dashboard.memory_free_times=Nombre de libérations de mémoire
-dashboard.current_heap_usage=Utilisation Tas (Heap)
-dashboard.heap_memory_obtained=Mémoire tas (Heap) obtenue
-dashboard.heap_memory_idle=Mémoire tas (Heap) au repos
-dashboard.heap_memory_in_use=Utilisation mémoire tas (Heap)
-dashboard.heap_memory_released=Mémoire tas (Heap) libérée
-dashboard.heap_objects=Objets tas (Heap)
-dashboard.bootstrap_stack_usage=Utilisation pile bootstrap
-dashboard.stack_memory_obtained=Mémoire pile obtenue
-dashboard.mspan_structures_usage=Utilisation des structures MSpan
-dashboard.mspan_structures_obtained=Structures MSpan obtenues
-dashboard.mcache_structures_usage=Utilisation des structures MCache
-dashboard.mcache_structures_obtained=Structures MCache obtenues
-dashboard.profiling_bucket_hash_table_obtained=Profilage de seau de table de hashage obtenu
-dashboard.gc_metadata_obtained=Métadonnées GC obtenues
-dashboard.other_system_allocation_obtained=Autres allocation système obtenue
-dashboard.next_gc_recycle=Prochain recyclage GC
-dashboard.last_gc_time=Temps depuis le dernier GC
-dashboard.total_gc_pause=Pause totale GC
-dashboard.last_gc_pause=Dernière pause GC
-dashboard.gc_times=Nombres de GC
 dashboard.delete_old_actions=Supprimer toutes les anciennes activités de la base de données
 dashboard.delete_old_actions.started=Suppression de toutes les anciennes activités de la base de données démarrée.
 dashboard.update_checker=Vérificateur de mise à jour
@@ -3047,18 +2981,6 @@ users.purge_help=Éradique l’utilisateur et tous ses dépôts, organisations e
 users.still_own_packages=Cet utilisateur possède encore un ou plusieurs paquets. Supprimez d’abord ces paquets.
 users.deletion_success=Le compte a été supprimé.
 users.reset_2fa=Réinitialiser l'authentification à deux facteurs
-users.list_status_filter.menu_text=Filtrer
-users.list_status_filter.reset=Réinitialiser
-users.list_status_filter.is_active=Actif
-users.list_status_filter.not_active=Inactif
-users.list_status_filter.is_admin=Administrateur
-users.list_status_filter.not_admin=Non administrateur
-users.list_status_filter.is_restricted=Restreint
-users.list_status_filter.not_restricted=Non restreint
-users.list_status_filter.is_prohibit_login=Interdit de connexion
-users.list_status_filter.not_prohibit_login=Autorisé à se connecter
-users.list_status_filter.is_2fa_enabled=2FA Activé
-users.list_status_filter.not_2fa_enabled=2FA désactivé
 users.details=Informations de l’utilisateur
 
 emails.email_manage_panel=Gestion des courriels des utilisateurs
@@ -3378,26 +3300,6 @@ monitor.process.cancel_desc=L'annulation d'un processus peut entraîner une pert
 monitor.process.cancel_notices=Annuler : <strong>%s</strong> ?
 monitor.process.children=Enfant
 
-monitor.queues=Files d'attente
-monitor.queue=File d'attente : %s
-monitor.queue.name=Nom
-monitor.queue.type=Type
-monitor.queue.exemplar=Type d'exemple
-monitor.queue.numberworkers=Nombre de processus
-monitor.queue.activeworkers=Processus actifs
-monitor.queue.maxnumberworkers=Nombre maximal de processus
-monitor.queue.numberinqueue=Position dans la queue
-monitor.queue.review_add=Examiner / ajouter des processus
-monitor.queue.settings.title=Paramètres du réservoir
-monitor.queue.settings.desc=Les bassins croissent proportionnellement au besoin de leurs exécuteurs.
-monitor.queue.settings.maxnumberworkers=Nombre maximale de processus
-monitor.queue.settings.maxnumberworkers.placeholder=Actuellement %[1]d
-monitor.queue.settings.maxnumberworkers.error=Le nombre de processus doit être un nombre
-monitor.queue.settings.submit=Appliquer les paramètres
-monitor.queue.settings.changed=Paramètres mis à jour
-monitor.queue.settings.remove_all_items=Tout effacer
-monitor.queue.settings.remove_all_items_done=Tous les éléments de la file d'attente ont été effacés.
-
 notices.system_notice_list=Notifications systèmes
 notices.view_detail_header=Voir les détails de la notification
 notices.operations=Opérations
@@ -3540,21 +3442,7 @@ workflow.disabled=Le flux de travail est désactivé.
 
 need_approval_desc=Besoin d’approbation pour exécuter des flux de travail pour une demande d’ajout de bifurcation.
 
-variables=Variables
-variables.management=Gestion des variables
-variables.creation=Ajouter une variable
-variables.none=Il n'y a pas encore de variables.
-variables.deletion=Retirer la variable
-variables.deletion.description=La suppression d’une variable est permanente et ne peut être défaite. Continuer ?
-variables.description=Les variables sont passées aux actions et ne peuvent être lues autrement.
 variables.id_not_exist = La variable numéro %d n’existe pas.
-variables.edit=Modifier la variable
-variables.deletion.failed=Impossible de retirer la variable.
-variables.deletion.success=La variable a bien été retirée.
-variables.creation.failed=Impossible d'ajouter la variable.
-variables.creation.success=La variable « %s » a été ajoutée.
-variables.update.failed=Impossible d’éditer la variable.
-variables.update.success=La variable a bien été modifiée.
 workflow.dispatch.use_from = Utiliser un workflow depuis
 workflow.dispatch.trigger_found = Ce workflow a un déclencheur d'événement <c>workflow_dispatch</c>.
 workflow.dispatch.run = Exécuter le workflow
@@ -3565,7 +3453,6 @@ workflow.dispatch.warn_input_limit = Affichage des %d premiers champs seulement.
 runs.expire_log_message = Les journaux ont été purgés car ils étaient trop anciens.
 runs.no_workflows.help_write_access = Vous ne savez pas par où commencer avec Forgejo Actions ? Regardez la section <a target="_blank" rel="noopener noreferrer" href="%s"> démarrage rapide dans la documentation utilisateur</a> pour écrire votre premier workflow, puis <a target="_blank" rel="noopener noreferrer" href="%s">mettre en place un Forgejo runner</a> pour exécuter vos jobs.
 runs.no_workflows.help_no_write_access = Pour en savoir plus sur Forgejo Actions, consultez <a target="_blank" rel="noopener noreferrer" href="%s">la documentation</a>.
-variables.not_found = La variable n'a pas été trouvée.
 
 [projects]
 type-1.display_name=Projet personnel
@@ -3614,9 +3501,6 @@ regexp = RegExp
 [munits.data]
 
 [markup]
-filepreview.line = Ligne %[1]d dans %[2]s
-filepreview.lines = Lignes %[1]d jusqu'à %[2]d dans %[3]s
-filepreview.truncated = L'aperçu a été tronqué
 
 [repo.permissions]
 pulls.write = <b>Écrire :</b> Fermer des demandes de tirage et gérer les métadonnées telles que les étiquettes, les jalons, les assignés, les dates d'échéance et les dépendances.
diff --git a/options/locale/locale_ga-IE.ini b/options/locale/locale_ga-IE.ini
index f3fed02c5b..76ebcd1b91 100644
--- a/options/locale/locale_ga-IE.ini
+++ b/options/locale/locale_ga-IE.ini
@@ -35,18 +35,6 @@ captcha = CAPTCHA
 twofa = Fíordheimhniú Dhá-Fhachtóir
 twofa_scratch = Cód Scratch Dhá-Fhachtóra
 passcode = Paschód
-webauthn_insert_key = Cuir isteach d'eochair slándála
-webauthn_sign_in = Brúigh an cnaipe ar d'eochair slándála. Mura bhfuil aon chnaipe ag d'eochair slándála, cuir isteach é arís.
-webauthn_press_button = Brúigh an cnaipe ar d'eochair slándála le do thoil…
-webauthn_use_twofa = Úsáid cód dhá fhachtóir ó do ghuthán
-webauthn_error = Ní fhéadfaí do eochair slándála a léamh.
-webauthn_unsupported_browser = Ní thacaíonn do bhrabhsálaí le WebAuthn faoi láthair.
-webauthn_error_unknown = Tharla earráid anaithnid. Déan iarracht arís.
-webauthn_error_insecure = Ní thacaíonn WebAuthn ach le naisc slán. Le haghaidh tástála thar HTTP, is féidir leat an bunús “localhost” nó "127.0.0.1" a úsáid
-webauthn_error_unable_to_process = Ní fhéadfadh an freastalaí d'iarratas a phróiseáil.
-webauthn_error_duplicated = Ní cheadaítear an eochair slándála don iarratas seo. Déan cinnte le do thoil nach bhfuil an eochair cláraithe cheana féin.
-webauthn_error_empty = Ní mór duit ainm a shocrú don eochair seo.
-webauthn_error_timeout = Sroicheadh an teorainn ama sula bhféadfaí d’eochair a léamh. Athlódáil an leathanach seo, le do thoil, agus déan iarracht arís.
 repository = Stór
 organization = Eagraíocht
 mirror = Scáthán
@@ -310,7 +298,6 @@ enable_update_checker = Cumasaigh Seiceoir Nuashonraithe
 env_config_keys = Cumraíocht Comhshaoil
 env_config_keys_prompt = Cuirfear na hathróga comhshaoil seo a leanas i bhfeidhm ar do chomhad cumraíochta freisin:
 docker_helper = Má ritheann tú Forgejo taobh istigh de Docker, léigh an <a target="_blank" rel="noopener noreferrer" href="%s">doiciméadú</a> le do thoil sula n-athraíonn tú aon socruithe.
-
 require_db_desc = Éilíonn Forgejo MySQL, PostgreSQL, SQLite3 nó TiDB (prótacal MySQL).
 sqlite_helper = Cosán comhaid don bhunachar sonraí SQLite3.<br>Cuir isteach cosán absalóideach má ritheann tú Forgejo mar sheirbhís.
 reinstall_error = Tá tú ag iarraidh suiteáil i mbunachar sonraí Forgejo atá ann cheana féin
@@ -367,7 +354,6 @@ show_both_private_public = Ag taispeáint poiblí agus príobháideach araon
 show_only_private = Ag taispeáint príobháideach amháin
 show_only_public = Ag taispeáint poiblí amháin
 issues.in_your_repos = I do stórais
-
 my_orgs = Eagraíochtaí
 
 [explore]
@@ -437,7 +423,6 @@ password_pwned = Tá an pasfhocal a roghnaigh tú ar <a target="_blank" rel="noo
 password_pwned_err = Ní fhéadfaí iarratas a chomhlánú ar HaveIBeenPwned
 last_admin = Ní féidir leat an riarachán deireanach a bhaint. Caithfidh riarachán amháin ar a laghad a bheith ann.
 back_to_sign_in = Ar ais go Sínigh Isteach
-
 hint_login = An bhfuil cuntas agat cheana féin? <a href="%s">Sínigh isteach anois!</a>
 hint_register = An bhfuil cuntas uait? <a href="%s">Cláraigh anois.</a>
 sign_up_button = Cláraigh anois.
@@ -498,7 +483,6 @@ team_invite.subject = Tá cuireadh tugtha agat ag %[1]s chun dul le heagraíocht
 team_invite.text_1 = Tá cuireadh tugtha ag %[1]s duit chun dul le foireann %[2]s in eagraíocht %[3]s.
 team_invite.text_2 = Cliceáil ar an nasc seo a leanas le do thoil chun dul isteach san fhoireann:
 team_invite.text_3 = Nóta: Bhí an cuireadh seo beartaithe do %[1]s. Mura raibh tú ag súil leis an gcuireadh seo, is féidir leat neamhaird a dhéanamh den ríomhphost seo.
-
 link_not_working_do_paste = Nach bhfuil an nasc ag obair? Bain triail as é a chóipeáil agus a ghreamú i mbarra URL do bhrabhsálaí.
 admin.new_user.subject = Úsáideoir nua %s díreach cláraithe
 admin.new_user.user_info = Faisnéis úsáideora
@@ -604,7 +588,6 @@ must_use_public_key = Is eochair phríobháideach an eochair a sholáthraíonn t
 auth_failed = Theip ar fhíordheimhniú:%v
 target_branch_not_exist = Níl spriocbhrainse ann.
 admin_cannot_delete_self = Ní féidir leat tú féin a scriosadh nuair is riarachán tú. Bain do phribhléidí riaracháin ar dtús.
-
 FullName = Ainm iomlán
 Description = Cur síos
 Pronouns = Forainmneacha
@@ -647,7 +630,6 @@ settings = Socruithe Úsáideora
 disabled_public_activity = Dhíchumasaigh an t-úsáideoir seo infheictheacht phoiblí na gníomhaíochta.
 form.name_reserved = Tá an t-ainm úsáideora "%s" in áirithe.
 form.name_pattern_not_allowed = Ní cheadaítear an patrún "%s" in ainm úsáideora.
-
 followers.title.one = Leantóir
 followers.title.few = Leantóirí
 following.title.one = Ag leanúint
@@ -915,7 +897,6 @@ visibility.public_tooltip = Infheicthe do gach duine
 visibility.limited = Teoranta
 visibility.private = Príobháideach
 visibility.private_tooltip = Ní fheictear ach do bhaill d'eagraíochtaí a chuaigh tú isteach
-
 orgs = Eagraíochtaí
 blocked_users = Úsáideoirí blocáilte
 storage_overview = Forbhreathnú ar stóráil
@@ -1110,14 +1091,6 @@ migrate_options_lfs_endpoint.label = Críochphointe LFS
 migrate_options_lfs_endpoint.description = Déanfaidh imirce iarracht do chianda Git a úsáid chun <a target="_blank" rel="noopener noreferrer" href="%s">freastalaí LFS a chinneadh</a>. Is féidir leat críochphointe saincheaptha a shonrú freisin má tá na sonraí LFS stórtha stóráilte áit éigin eile.
 migrate_options_lfs_endpoint.description.local = Tacaítear le cosán freastalaí áitiúil freisin.
 migrate_options_lfs_endpoint.placeholder = Má fhágtar bán, díorthófar an críochphointe ón URL clóin
-migrate_items = Míreanna Imirce
-migrate_items_wiki = Wiki
-migrate_items_milestones = Clocha míle
-migrate_items_labels = Lipéid
-migrate_items_issues = Saincheisteanna
-migrate_items_pullrequests = Iarrataí Tarraing
-migrate_items_merge_requests = Iarrataí Cumaisc
-migrate_items_releases = Eisiúintí
 migrate_repo = Stóras Imirc
 migrate.clone_address = Aimirce/ Clón Ó URL
 migrate.github_token_desc = Is féidir leat comhartha amháin nó níos mó a chur anseo scartha le camóga chun an t-aistriú a dhéanamh níos tapúla trí theorainn ráta API GitHub a sheachaint. RABHADH: D’fhéadfadh mí-úsáid a bhaint as an ngné seo sárú a dhéanamh ar pholasaí an tsoláthraí seirbhíse agus d’fhéadfadh sé go gcuirfí bac ar do chuntas(í).
@@ -1134,15 +1107,6 @@ migrate.migrating = Ag aistriú ó <b>%s</b> …
 migrate.migrating_failed = Theip ar aistriú ó <b>%s</b>.
 migrate.migrating_failed.error = Theip ar aistriú: %s
 migrate.migrating_failed_no_addr = Theip ar an imirce.
-migrate.migrating_git = Sonraí Git a Aimirce
-migrate.migrating_topics = Ábhair Imirce
-migrate.migrating_milestones = Clocha Míle a Imirce
-migrate.migrating_labels = Lipéid Imirce
-migrate.migrating_releases = Eisiúintí Imirce
-migrate.migrating_issues = Saincheisteanna Imirce
-migrate.migrating_pulls = Iarratais Tarraingthe á n-Imirce
-migrate.cancel_migrating_title = Cealaigh Imirce
-migrate.cancel_migrating_confirm = Ar mhaith leat an imirce seo a chealú?
 mirror_from = scáthán de
 forked_from = forcailte ó
 generated_from = a ghintear ó
@@ -2347,7 +2311,6 @@ find_file.no_matching = Níl aon chomhad meaitseála le fáil
 error.csv.too_large = Ní féidir an comhad seo a rinneadh toisc go bhfuil sé ró-mhór.
 error.csv.unexpected = Ní féidir an comhad seo a rindreáil toisc go bhfuil carachtar ann gan súil leis i líne %d agus i gcolún %d.
 error.csv.invalid_field_count = Ní féidir an comhad seo a rindreáil toisc go bhfuil líon mícheart réimsí i líne %d.
-
 rss.must_be_on_branch = Ní mór duit a bheith ar bhrainse le go mbeidh fotha RSS agat.
 admin.manage_flags = Bainistigh bratacha
 admin.enabled_flags = Bratacha cumasaithe don stórlann:
@@ -2803,7 +2766,6 @@ teams.all_repositories_helper = Tá rochtain ag an bhfoireann ar gach stórais.
 teams.invite.title = Tugadh cuireadh duit dul isteach i bhfoireann <strong>%s</strong> san eagraíocht <strong>%s</strong>.
 teams.invite.by = Ar cuireadh ó %s
 teams.invite.description = Cliceáil ar an gcnaipe thíos le do thoil chun dul isteach san fhoireann.
-
 open_dashboard = Oscail an painéal rialaithe
 repo_updated = Nuashonraithe %s
 follow_blocked_user = Ní féidir leat an eagraíocht seo a leanúint mar tá bac curtha ag an eagraíocht seo ort.
@@ -2874,33 +2836,6 @@ dashboard.reinit_missing_repos = Aththosaigh gach stórais Git atá in easnamh a
 dashboard.sync_external_users = Sioncrónaigh sonraí úsáideoirí seachtracha
 dashboard.cleanup_hook_task_table = Glan suas an tábla hook_task
 dashboard.cleanup_packages = Glan suas pacáistí atá imithe in éag
-dashboard.server_uptime = Aga fónaimh Freastalaí
-dashboard.current_goroutine = Goroutines Reatha
-dashboard.current_memory_usage = Úsáid Cuimhne Reatha
-dashboard.total_memory_allocated = Cuimhne Iomlán Leithdháilte
-dashboard.memory_obtained = Cuimhne Faighte
-dashboard.pointer_lookup_times = Amanna Cuardaigh Pointeora
-dashboard.memory_allocate_times = Leithdháiltí Cuimhne
-dashboard.memory_free_times = Saorálann Cuimhne
-dashboard.current_heap_usage = Úsáid Charn Reatha
-dashboard.heap_memory_obtained = Cuimhne Charn Faighte
-dashboard.heap_memory_idle = Díomhaoin Cuimhne Carn
-dashboard.heap_memory_in_use = Cuimhne Carm In Úsáid
-dashboard.heap_memory_released = Cuimhne Carn Eisithe
-dashboard.heap_objects = Cuspóirí Carn
-dashboard.bootstrap_stack_usage = Úsáid Staca Bootstrap
-dashboard.stack_memory_obtained = Cuimhne Staca Faighte
-dashboard.mspan_structures_usage = Úsáid Struchtúir MSpan
-dashboard.mspan_structures_obtained = Struchtúir MSpan a Faightear
-dashboard.mcache_structures_usage = Úsáid Struchtúir MCache
-dashboard.mcache_structures_obtained = Struchtúir MCache a Faightear
-dashboard.profiling_bucket_hash_table_obtained = Tábla Hash Buicéad Próifílithe a Faightear
-dashboard.gc_metadata_obtained = Meiteashonraí GC faighte
-dashboard.other_system_allocation_obtained = Leithdháileadh Córais Eile a Fuarthas
-dashboard.next_gc_recycle = Athchúrsáil GC Eile
-dashboard.total_gc_pause = Sos Iomlán GC
-dashboard.last_gc_pause = Sos GC Deireanach
-dashboard.gc_times = Amanna GC
 dashboard.delete_old_actions = Scrios gach sean-ghníomhaíocht ón mbunachar
 dashboard.delete_old_actions.started = Scrios na sean-ghníomhaíocht go léir ón mbunachar sonraí tosaithe.
 dashboard.update_checker = Seiceoir nuashonraithe
@@ -2938,18 +2873,6 @@ users.purge = Úsáideoir a Ghlanadh
 users.still_own_packages = Tá pacáiste amháin nó níos mó fós ag an úsáideoir seo, scrios na pacáistí seo ar dtús.
 users.deletion_success = Scriosadh an cuntas úsáideora.
 users.reset_2fa = Athshocraigh 2FA
-users.list_status_filter.menu_text = Scagaire
-users.list_status_filter.reset = Athshocraigh
-users.list_status_filter.is_active = Gníomhach
-users.list_status_filter.not_active = Neamhghníomhach
-users.list_status_filter.is_admin = Riarachán
-users.list_status_filter.not_admin = Ní Riarachán
-users.list_status_filter.is_restricted = Srianta
-users.list_status_filter.not_restricted = Gan Srian
-users.list_status_filter.is_prohibit_login = Cosc ar Logáil Isteach
-users.list_status_filter.not_prohibit_login = Ceadaigh Logáil isteach
-users.list_status_filter.is_2fa_enabled = 2FA Cumasaithe
-users.list_status_filter.not_2fa_enabled = 2FA faoi mhíchumas
 users.details = Sonraí Úsáideora
 emails.primary = Bunscoile
 emails.activated = Gníomhachtaithe
@@ -3213,25 +3136,6 @@ monitor.execute_time = Am Forghníomhaithe
 monitor.last_execution_result = Toradh
 monitor.process.cancel = Cealaigh próiseas
 monitor.process.children = Leanaí
-monitor.queues = Scuaineanna
-monitor.queue = Scuaine: %s
-monitor.queue.name = Ainm
-monitor.queue.type = Cineál
-monitor.queue.exemplar = Cineál Eiseamláire
-monitor.queue.numberworkers = Líon na nOibrithe
-monitor.queue.activeworkers = Oibrithe Gníomhacha
-monitor.queue.maxnumberworkers = Líon Uasta na nOibrithe
-monitor.queue.numberinqueue = Uimhir i scuaine
-monitor.queue.review_add = Athbhreithniú / Cuir Oibrithe leis
-monitor.queue.settings.title = Socruithe Linn
-monitor.queue.settings.desc = Fásann linnte go dinimiciúil mar fhreagra ar a gcuid scuaine oibrithe a bhlocáil.
-monitor.queue.settings.maxnumberworkers = Uaslíon na n-oibrithe
-monitor.queue.settings.maxnumberworkers.placeholder = Faoi láthair %[1]d
-monitor.queue.settings.maxnumberworkers.error = Caithfidh uaslíon na n-oibrithe a bheith ina uimhir
-monitor.queue.settings.submit = Nuashonrú Socruithe
-monitor.queue.settings.changed = Socruithe Nuashonraithe
-monitor.queue.settings.remove_all_items = Bain gach
-monitor.queue.settings.remove_all_items_done = Baineadh na míreanna go léir sa scuaine.
 notices.system_notice_list = Fógraí Córais
 notices.operations = Oibríochtaí
 notices.select_all = Roghnaigh Gach
@@ -3248,7 +3152,6 @@ notices.delete_success = Scriosadh na fógraí córais.
 self_check.no_problem_found = Níor aimsíodh aon fhadhb fós.
 self_check.database_collation_mismatch = Bí ag súil le comhthiomsú a úsáid sa bhunachar sonraí: %s
 self_check.database_inconsistent_collation_columns = Tá comhthiomsú %s in úsáid ag an mbunachar sonraí, ach tá comhthiomsuithe mímheaitseála á n-úsáid ag na colúin seo. D'fhéadfadh sé a bheith ina chúis le roinnt fadhbanna gan choinne.
-
 dashboard.new_version_hint = Tá Forgejo %s ar fáil anois, tá %s á rith agat. Seiceáil <a target="_blank" rel="noreferrer" href="%s">an blag</a> le haghaidh tuilleadh sonraí.
 dashboard.operations = Oibríochtaí cothabhála
 dashboard.delete_repo_archives = Scrios cartlanna na stórtha uile (ZIP, TAR.GZ, srl.)
@@ -3257,7 +3160,6 @@ dashboard.resync_all_sshkeys = Nuashonraigh an comhad ".ssh/authorized_keys" le
 dashboard.resync_all_sshprincipals = Nuashonraigh an comhad ".ssh/authorized_principals" le príomhoidí SSH Forgejo.
 dashboard.resync_all_hooks = Athshioncrónaigh crúcaí Git na stórtha uile (réamhghlacadh, nuashonrú, iarghlacadh, próiseasghlacadh, ...)
 dashboard.cleanup_actions = Glan suas logaí agus déantáin atá imithe in éag ó ghníomhartha
-dashboard.last_gc_time = Am ó GC deireanach
 dashboard.stop_zombie_tasks = Stop tascanna gníomhartha zombie
 dashboard.stop_endless_tasks = Stop tascanna gníomhartha gan teorainn
 dashboard.cancel_abandoned_jobs = Cealaigh poist gníomhartha tréigthe
@@ -3416,7 +3318,6 @@ deletion = Bain rún
 deletion.description = Is buan rún a bhaint agus ní féidir é a chealú. Lean ort?
 deletion.success = Tá an rún bainte.
 deletion.failed = Theip ar rún a bhaint.
-
 management = Bainistigh rúin
 
 [actions]
@@ -3427,21 +3328,7 @@ workflow.disable = Díchumasaigh sreabhadh oibre
 workflow.enable = Cumasaigh sreabhadh oibre
 workflow.disabled = Tá an sreabhadh oibre díchumasaithe.
 need_approval_desc = Teastaíonn faomhadh chun sreafaí oibre a rith le haghaidh iarratas tarraingt forc.
-variables = Athróga
-variables.creation = Cuir Athróg leis
-variables.none = Níl aon athróga ann fós.
-variables.deletion = Bain athróg
-variables.deletion.description = Tá athróg a bhaint buan agus ní féidir é a chur ar ais. Lean ar aghaidh?
-variables.description = Cuirfear athróga chuig gníomhartha áirithe agus ní féidir iad a léamh ar mhalairt eile.
 variables.id_not_exist = Níl athróg le ID %d ann.
-variables.edit = Cuir Athróg in Eagar
-variables.deletion.failed = Theip ar athróg a bhaint.
-variables.deletion.success = Tá an athróg bainte.
-variables.creation.failed = Theip ar athróg a chur leis.
-variables.creation.success = Tá an athróg "%s" curtha leis.
-variables.update.failed = Theip ar athróg a chur in eagar.
-variables.update.success = Tá an t-athróg curtha in eagar.
-
 runs.no_workflows.help_write_access = Nach bhfuil a fhios agat conas tosú le Gníomhartha Forgejo? Féach ar an <a target="_blank" rel="noopener noreferrer" href="%s">tús tapa sa doiciméadacht úsáideora</a> chun do chéad sreabhadh oibre a scríobh, ansin <a target="_blank" rel="noopener noreferrer" href="%s">bunaigh rithire Forgejo</a> chun do phoist a fhorghníomhú.
 runs.no_workflows.help_no_write_access = Chun tuilleadh eolais a fháil faoi Ghníomhartha Forgejo, féach ar <a target="_blank" rel="noopener noreferrer" href="%s">an doiciméadacht</a>.
 workflow.disable_success = Sreabhadh oibre "%s" díchumasaithe go rathúil.
@@ -3453,8 +3340,6 @@ workflow.dispatch.success = Iarradh an sreabhadh oibre go rathúil.
 workflow.dispatch.input_required = Éilítear luach don ionchur "%s".
 workflow.dispatch.invalid_input_type = Cineál ionchuir neamhbhailí "%s".
 workflow.dispatch.warn_input_limit = Ag taispeáint na chéad %d ionchur amháin.
-variables.management = Bainistigh athróga
-variables.not_found = Theip ar an athróg a aimsiú.
 
 [projects]
 deleted.display_name = Tionscadal scriosta
@@ -3470,6 +3355,7 @@ executable_file = Comhad infheidhmithe
 symbolic_link = Nasc siombalach
 submodule = Fo-mhodúl
 
+
 [repo.permissions]
 code.read = <b>Léigh:</b> Rochtain a fháil ar chód an stórais agus é a chlónáil.
 code.write = <b>Scríobh:</b> Brúigh chuig an stórlann, cruthaigh brainsí agus clibeanna.
@@ -3491,9 +3377,6 @@ ext_issues = Rochtain ar an nasc chuig rianaitheoir saincheisteanna seachtrach.
 ext_wiki = Rochtain ar an nasc chuig vicí seachtrach. Déantar na ceadanna a bhainistiú go seachtrach.
 
 [markup]
-filepreview.line = Líne %[1]d i %[2]s
-filepreview.lines = Línte %[1]d go %[2]d i %[3]s
-filepreview.truncated = Tá an réamhamharc giorraithe
 
 [translation_meta]
-test = Is teaghrán tástála é seo. Ní thaispeántar é i gcomhéadan úsáideora Forgejo ach úsáidtear é chun críocha tástála. Ná bíodh drogall ort "ceart go leor" a iontráil chun am a shábháil (nó fíric spraíúil de do rogha féin) chun an marc críochnaithe 100% sin a bhaint amach :)
+test = Is teaghrán tástála é seo. Ní thaispeántar é i gcomhéadan úsáideora Forgejo ach úsáidtear é chun críocha tástála. Ná bíodh drogall ort "ceart go leor" a iontráil chun am a shábháil (nó fíric spraíúil de do rogha féin) chun an marc críochnaithe 100% sin a bhaint amach :)
\ No newline at end of file
diff --git a/options/locale/locale_gl.ini b/options/locale/locale_gl.ini
index 7ccafc81f4..43257512b9 100644
--- a/options/locale/locale_gl.ini
+++ b/options/locale/locale_gl.ini
@@ -31,15 +31,6 @@ re_type = Confirme o contrasinal
 captcha = CAPTCHA
 twofa = Autenticación de dobre factor
 passcode = Código de acceso
-webauthn_insert_key = Insira a súa chave de seguridade
-webauthn_press_button = Prema o botón da súa chave de seguridade…
-webauthn_use_twofa = Use o Código de Dous Factores do seu Teléfono
-webauthn_error = Non se puido ler a súa clave de seguridade.
-webauthn_unsupported_browser = O seu navegador non soporta WebAuthn actualmente.
-webauthn_error_unknown = Produciuse un erro descoñecido. Ténteo de novo.
-webauthn_error_unable_to_process = O servidor non puido procesar a súa solicitude.
-webauthn_error_duplicated = A clave de seguridade non está permitida para esta solicitude. Asegúrese de que a clave non estea xa rexistrada.
-webauthn_error_empty = Debe definir un nome para esta clave.
 repository = Repositorio
 organization = Organización
 mirror = Espello
@@ -96,13 +87,10 @@ copy_content = Copiar contido
 language = Linguaxe
 copy_hash = Copiar hash
 twofa_scratch = Código Scratch de Dous Factores
-webauthn_sign_in = Prema o botón da súa chave de seguridade. Se a súa chave de seguridade non ten ningún botón, volva inserila.
 issues = Incidencias
 disabled = Desactivado
 error404 = A páxina á que estás tentando acceder <strong>non existe</strong> ou <strong>non tes autorización</strong> para vela.
 tracked_time_summary = Resumo do tempo de seguimento baseado nos filtros da lista de incidencias
-webauthn_error_insecure = WebAuthn só admite conexións seguras. Para probar a través de HTTP, pode usar a orixe "localhost" ou "127.0.0.1"
-webauthn_error_timeout = Alcanzouse o límite de tempo antes de que se puidera ler a súa clave. Volva cargar esta páxina e ténteo de novo.
 remove = Quitar
 view = Ver
 copy_type_unsupported = Este tipo de ficheiro non se pode copiar
diff --git a/options/locale/locale_he.ini b/options/locale/locale_he.ini
index 047e4d7bd6..6e6252229d 100644
--- a/options/locale/locale_he.ini
+++ b/options/locale/locale_he.ini
@@ -1,5 +1,4 @@
 [common]
-webauthn_error_unable_to_process = שרת זה נכשל בעיבוד בקשתך.
 help = עזרה
 logo = לוגו
 sign_in_with_provider = כניסה דרך %s
@@ -29,9 +28,6 @@ access_token = קוד גישה
 captcha = CAPTCHA
 twofa_scratch = קוד אימות דו־שלבי
 passcode = קוד כניסה
-webauthn_error_unknown = שגיאה לא ידועה, אפשר לנסות שוב.
-webauthn_error_empty = שם המפתח הוא שדה חובה.
-webauthn_error_timeout = קריאת מפתחך לקחה יותר מדי זמן. אפשר לטעון מחדש את הדף ולנסות שוב.
 organization = ארגון
 mirror = מראה
 new_mirror = מראה חדשה
@@ -101,8 +97,6 @@ twofa = אימות דו־שלבי
 pull_requests = בקשות מיזוג
 powered_by = רץ על %s
 copy_generic = העתקה לCtrl + C
-webauthn_unsupported_browser = הדפדפן שלך לא תומך בWebAuthn.
-webauthn_error_insecure = הפרוטוקול WebAuthn לא תומך בחיבורים לא מאובטחים, למעט דרך "localhost" או "127.0.0.1"
 settings = הגדרות
 your_settings = הגדרות
 new_org.link = ארגון חדש
@@ -115,9 +109,6 @@ copy_content = העתקת תוכן
 copy_type_unsupported = אי אפשר להעתיק קבצים מסוג זה
 concept_system_global = גלובלי
 concept_user_individual = אישי
-webauthn_insert_key = יש להכניס את מפתח אבטחך
-webauthn_press_button = נא ללחוץ על הכפתור שעל מפתח האבטחה…
-webauthn_error = קריאת מפתח האבטחה נכשלה.
 repository = קרפיף
 new_repo.title = קרפיף חדש
 new_migrate.title = יבוא קרפיף
@@ -128,8 +119,6 @@ disabled = כבוי
 copy_path = העתקת מיקום קובץ
 invalid_data = הבנת הקלט נכשלה: %v
 concept_code_repository = קרפיף
-webauthn_sign_in = יש ללחוץ על הכפתור שעל מפתח האבטחה. אם אין כפתור, אפשר להוציא את המפתח ולחבר אותו שוב.
-webauthn_error_duplicated = מפתח האבטחה לא יכול לשמש לבקשה זו. נא לוודא שהמפתח לא רשום.
 dashboard = מבט על
 remove_label_str = הסרת "%s"
 explore = קטלוגים
@@ -139,7 +128,6 @@ confirm_delete_artifact = למחוק את הארטיפקט "%s"?
 toggle_menu = הצגת\הסתרת תפריט
 re_type = סיסמה (שוב)
 tracked_time_summary = סיכום זמן מעקב בהתבסס על מסננים של רשימת סוגיות
-webauthn_use_twofa = השתמש בקוד אימות דו־שלבי מהטלפון שלך
 error413 = מיצית את ההגבלה שלך.
 
 [search]
@@ -520,7 +508,7 @@ remove_account_link_success = החשבון המקושר הוסר.
 
 [repo]
 new_advanced = הגדרות מתקדמות
-new_advanced_expand =
+new_advanced_expand = 
 owner = בעלים
 repo_name = שם הקרפיף
 repo_name_helper = שמות קרפיפים טובים הם זכירים, קצרים וייחודיים.
@@ -571,9 +559,6 @@ desc.archived = בארכיון
 archive.pull.noreview = קרפיף זה בארכיון. אי אפשר לבקר בקשות מיזוג.
 form.reach_limit_of_creation_n = החשבון של הבעלים כבר הגיע לכמות הקרפיפים המקסימלית (%s).
 form.name_reserved = שם הקרפיף "%s" שמור.
-migrate_items_wiki = ויקי
-migrate_items_issues = סוגיות
-migrate_items_pullrequests = בקשות מיזוג
 migrate.clone_address = ייבוא \ שכפול מ־URL
 migrated_from = יובא מ‏־<a href="%[1]s">%[2]s</a>
 migrated_from_fake = יובא מ־%[1]s
@@ -582,8 +567,6 @@ migrate.migrating = פורג'ו בתהליכי יבוא מ־<b>%s</b>...
 migrate.migrating_failed = היבוא מ<b>%s</b> נכשל.
 migrate.migrating_failed.error = הייבוא נכשל: %s
 migrate.migrating_failed_no_addr = הייבוא נכשל.
-migrate.migrating_topics = ייבוא נושאים
-migrate.migrating_milestones = ייבוא אבני דרך
 editor.delete_this_file = מחיקת קובץ
 editor.name_your_file = שם הקובץ…
 editor.or = או
@@ -600,8 +583,6 @@ default_branch = ענף ברירת המחדל
 migrate_options_mirror_helper = קרפיף זה יהיה מראה
 migrate_options_lfs = ייבוא אחסון קבצים גדולים (LFS)
 migrate_options = אפשרויות ייבוא
-migrate.migrating_labels = ייבוא תוויות
-migrate.migrating_releases = ייבוא גרסאות
 editor.file_delete_success = הקובץ "%s" נמחק.
 editor.commit_message_desc = תיאור ארוך לא חובה…
 already_forked = כבר מזלגת את %s
@@ -631,7 +612,6 @@ template.topics = נושאים
 stars_remove_warning = פעולה זו תסיר מהקרפיף את כל הכוכבים.
 owner_helper = ארגונים שכבר יצרו את כמות הקרפיפים המקסימלית לא מוצגים בתפריט.
 fork_to_different_account = מזלוג לחשבון אחר
-migrate_items_releases = גרסאות
 migrate.permission_denied = אין לך הרשאה לייבא קרפיפים מהשרת הנוכחי.
 fork_repo = מזלוג
 watchers = מנויים
@@ -642,14 +622,11 @@ archive.title_date = קרפיך זה בארכיון כבר %s. אפשר לצפו
 form.name_pattern_not_allowed = התבנית "%s" לא חוקית בתוך שם של קרפיף.
 mirror_use_ssh.helper = פורג'ו ישקף את הקרפיף דרך התמיכה המובנית של גיט ב־SSH, ויצור בשבילך זוג מפתחות אוטומטית. באחריותך לוודא שלמפתח הציבורי שיווצר יהיה גישה לקרפיף היעד. אי אפשר להשתמש בכניסה על־בסיס סיסמה עם אפשרות זו.
 mirror_lfs = אחסון קבצים גדולים (LFS)
-migrate_items_labels = תוויות
 migrate_repo = ייבוא קרפיף
 transfer.no_permission_to_accept = אין לך הרשאה לאשר את העברת הקרפיף הזו.
 form.string_too_long = הטקסט הנתון ארוך מ־%d תווים.
-migrate_items_milestones = אבני דרך
 migrate.failed = הייבוא נכשל: %v
 migrate.migrate_items_options = פורג'ו צריך קוד גישה כדי לייבא מידע נוסף
-migrate.migrating_git = ייבוא הקרפיף עצמו
 editor.filename_help = אפשר להפריד בין תיקיות עם סלאשים, ו"למחוק" תיקיות עם backspace, כאילו זוהי תיבת טקסט רגילה.
 editor.filename_is_a_directory = אי אפשר לקרוא לקובץ "%s"; כבר קיימת תיקייה תחת אותו שם.
 editor.file_editing_no_longer_exists = הקובץ הנערך שהיה ידוע כ־"%s" לא קיים יותר בקרפיף זה.
diff --git a/options/locale/locale_hi.ini b/options/locale/locale_hi.ini
index 10a759689e..42d427f071 100644
--- a/options/locale/locale_hi.ini
+++ b/options/locale/locale_hi.ini
@@ -41,14 +41,6 @@ settings = सेटिंग्स
 your_settings = आपकी सेटिंग्स
 return_to_forgejo = फ़ोर्जेगो पे वापस जाएं
 access_token = एक्सेस टोकन
-webauthn_insert_key = अपनी सिक्योरिटी की डालें
-webauthn_press_button = अपनी सिक्योरिटी की पर बटन दबाएं…
-webauthn_use_twofa = अपने फ़ोन से दो फैक्टर कोड लाएं
-webauthn_unsupported_browser = आपका ब्राउज़र वेबौथ सपोर्ट नहीं करता।
-webauthn_error_unknown = कोई अंजान एरर हुई, फिर से कोशिश करें।
-webauthn_error_unable_to_process = सर्वर आपकी रिक्वेस्ट प्रोसेस नहीं कर पाया।
-webauthn_error_empty = कृपया इस चाभी का नाम रखें।
-webauthn_error_timeout = आपकी की पढ़ने से पहले टाइमआउट हो गया। पृष्ट रीलोड करें और फिर कोशिश करें।
 new_project = नया प्रोजेक्ट
 test = टेस्ट
 locked = लॉक्ड
@@ -88,13 +80,9 @@ remove_label_str = हटाएं आइटम “%s”
 edit = संपादित करना
 view = देखें
 disabled = असक्षम किया गया
-webauthn_sign_in = सिक्योरिटी की का बटन दबाएं, नहीं है तो फिर से प्लग करें।
-webauthn_error_insecure = वेबौथ पर सिर्फ सुरक्षित कनेक्शन हो. HTTP टेस्ट के लिए ओरिजिन “लोकलहोस्ट” या “127.0.0.1”
 new_repo.title = नई रिपॉजिटरी
 pull_requests = पुल्ल करें
 enabled = सक्षम किया गया
-webauthn_error = सिक्योरिटी की रीड नहीं हो पा रही।
-webauthn_error_duplicated = सिक्योरिटी की इस रिक्वेस्ट के लिए नहीं है। कृपया देखें की पहले से रजिस्टर्ड तो नहीं।
 new_migrate.title = नया प्रवासन
 activities = गतिविधियाँ
 rerun_all = फिर से सारे काम करें
diff --git a/options/locale/locale_hu-HU.ini b/options/locale/locale_hu-HU.ini
index 6810f20c1e..df48fcd03b 100644
--- a/options/locale/locale_hu-HU.ini
+++ b/options/locale/locale_hu-HU.ini
@@ -92,14 +92,7 @@ filter = Szűrő
 filter.is_archived = Archivált
 logo = Logó
 sign_in_with_provider = Bejelentkezés %s fiókkal
-webauthn_insert_key = Helyezze be biztonsági kulcsát
-webauthn_press_button = Nyomja meg a biztonsági kulcsán található gombot…
 access_token = Hozzáférési token
-webauthn_error = A biztonsági kulcsának beolvasása sikertelen volt.
-webauthn_unsupported_browser = A böngészője jelenleg nem támogatja a WebAuthn protokollt.
-webauthn_error_unknown = Ismeretlen hiba történt. Próbálja újra.
-webauthn_error_unable_to_process = A kiszolgáló nem tudta feldolgozni a kérését.
-webauthn_error_empty = Nevet kell adnia ennek a kulcsnak.
 new_project_column = Új oszlop
 never = Soha
 unknown = Ismeretlen
@@ -122,12 +115,8 @@ view = Megtekintés
 ok = OK
 copy_generic = Másolás vágólapra
 copy_url = Webcím másolása
-webauthn_error_insecure = A WebAuthn csak biztonságos kapcsolatokat támogat. HTTP-n keresztüli tesztelés esetén használja a „localhost” vagy a „127.0.0.1” forrást.
 filter.clear = Szűrők törlése
 enable_javascript = Az oldal működéséhez engedélyezni kell a JavaScriptet.
-webauthn_sign_in = Nyomja meg a biztonsági kulcsán található gombot. Ha nincs rajta gomb, próbálja meg újra behelyezni.
-webauthn_use_twofa = Kétlépcsős hitelesítési kód használata telefonról
-webauthn_error_timeout = Időtúllépés a kulcs beolvasása során. Töltse be újra ezt az oldalt, és próbálkozzon újra.
 copy_branch = Elágazás nevének másolása
 test = Tesztelés
 copy_type_unsupported = Ezt a fájltípust nem lehet másolni
@@ -152,7 +141,6 @@ new_migrate.link = Új migráció
 new_org.title = Új szervezet
 new_org.link = Új szervezet
 filter.is_fork = Másolatok
-webauthn_error_duplicated = A biztonsági kulcs nem engedélyezett ehhez a kéréshez. Győződjön meg róla, hogy a kulcs nincs-e már regisztrálva.
 filter.is_mirror = Tükrök
 
 [aria]
@@ -685,12 +673,6 @@ template.issue_labels=Hibajegy címkék
 template.one_item=Legalább egy sablonelemet ki kell választani
 template.invalid=Ki kell választani egy sablon tárolót
 
-migrate_items_wiki=Wiki
-migrate_items_milestones=Mérföldkövek
-migrate_items_labels=Címkék
-migrate_items_issues=Hibajegyek
-migrate_items_pullrequests=Pull request-ek
-migrate_items_releases=Kiadások
 migrate_repo=Tároló migrációja
 migrate.clone_address=Migráció / Másolás URL-ről
 migrate.clone_address_desc=HTTP(S) vagy Git URL-e egy már létező tárolónak
@@ -1304,34 +1286,6 @@ dashboard.clean_unbind_oauth_success=Az összes megszüntetett OAuth kapcsolat t
 dashboard.delete_generated_repository_avatars=Generált tároló avatarok törlése
 dashboard.reinit_missing_repos=Az összes Git tároló újra-inicializálása amihez léteznek bejegyzések
 dashboard.sync_external_users=Külső felhasználói adatok szinkronizálása
-dashboard.server_uptime=Kiszolgáló futási ideje
-dashboard.current_goroutine=Jelenlegi Goroutinok
-dashboard.current_memory_usage=Jelenlegi memória használat
-dashboard.total_memory_allocated=Összes lefoglalt memória
-dashboard.memory_obtained=Megszerzett Memória
-dashboard.pointer_lookup_times=Pointer Lookup Idők
-dashboard.memory_allocate_times=Memóriafoglalások
-dashboard.current_heap_usage=Aktuális Heap Használat
-dashboard.heap_memory_obtained=Heap Memória Megszerezve
-dashboard.heap_memory_idle=Tétlen Heap Memória
-dashboard.heap_memory_in_use=Használatban lévő Heap Memória
-dashboard.heap_memory_released=Elengedett Heap Memória
-dashboard.heap_objects=Heap Objektumok
-dashboard.bootstrap_stack_usage=Bootstrap Stack Használat
-dashboard.stack_memory_obtained=Stack Memória Megszerezve
-dashboard.mspan_structures_usage=MSpan Struktúrák Használata
-dashboard.mspan_structures_obtained=MSpan Struktúrák Megszerezve
-dashboard.mcache_structures_usage=MCache Struktúrák Használata
-dashboard.mcache_structures_obtained=MCache Struktúrák Megszerezve
-dashboard.profiling_bucket_hash_table_obtained=Profilozó Vödrös Hash Tábla Megszerezve
-dashboard.gc_metadata_obtained=GC Metaadat Megszerezve
-dashboard.other_system_allocation_obtained=Másik Rendszer Allokáció Megszerezve
-dashboard.next_gc_recycle=Következő GC Újrahasznosítás
-dashboard.last_gc_time=Utolsó GC óta eltelt idő
-dashboard.total_gc_pause=Teljes GC szünet
-dashboard.last_gc_pause=Utolsó GC szünet
-dashboard.gc_times=GC Idők
-
 users.new_account=Felhasználó létrehozása
 users.name=Felhasználónév
 users.full_name=Teljes név
@@ -1353,10 +1307,6 @@ users.allow_create_organization=Létrehozhat szervezeteket
 users.update_profile=Fiók frissítése
 users.delete_account=Fiók törlése
 users.still_has_org=Ez a felhasználó tagja egy szervezetnek. Először el kell távolítani a felhasználót az összes szervezetből.
-users.list_status_filter.is_active=Aktív
-users.list_status_filter.is_admin=Rendszergazda
-users.list_status_filter.is_restricted=Korlátozott
-
 emails.primary=Elsődleges
 emails.activated=Aktivált
 emails.filter_sort.email=Email
@@ -1574,10 +1524,6 @@ monitor.process.cancel=Folyamat megszakítása
 monitor.process.cancel_desc=Egy folyamat megszakítása adatvesztést okozhat
 monitor.process.cancel_notices=Megszakítás: <strong>%s</strong>?
 
-monitor.queue.name=Név
-monitor.queue.type=Típus
-monitor.queue.settings.submit=Beállítások frissítése
-
 notices.system_notice_list=Rendszer Értesítések
 notices.view_detail_header=Értesítés Részletei
 notices.select_all=Összes Kijelölése
diff --git a/options/locale/locale_id-ID.ini b/options/locale/locale_id-ID.ini
index fe35be8f8b..2379f3edfe 100644
--- a/options/locale/locale_id-ID.ini
+++ b/options/locale/locale_id-ID.ini
@@ -80,18 +80,6 @@ concept_code_repository=Repositori
 name=Nama
 
 re_type = Konfirmasi Kata Sandi
-webauthn_insert_key = Masukkan kunci keamanan anda
-webauthn_sign_in = Tekan tombol pada kunci keamanan Anda. Jika kunci keamanan Anda tidak memiliki tombol, masukkan kembali.
-webauthn_press_button = Silakan tekan tombol pada kunci keamanan Anda…
-webauthn_use_twofa = Gunakan kode dua faktor dari telepon Anda
-webauthn_error = Tidak dapat membaca kunci keamanan Anda.
-webauthn_unsupported_browser = Browser Anda saat ini tidak mendukung WebAuthn.
-webauthn_error_unknown = Terdapat kesalahan yang tidak diketahui. Mohon coba lagi.
-webauthn_error_insecure = `WebAuthn hanya mendukung koneksi aman. Untuk pengujian melalui HTTP, Anda dapat menggunakan "localhost" atau "127.0.0.1"`
-webauthn_error_unable_to_process = Server tidak dapat memproses permintaan Anda.
-webauthn_error_duplicated = Kunci keamanan tidak diperbolehkan untuk permintaan ini. Pastikan bahwa kunci ini belum terdaftar sebelumnya.
-webauthn_error_empty = Anda harus menetapkan nama untuk kunci ini.
-webauthn_error_timeout = Waktu habis sebelum kunci Anda dapat dibaca. Mohon muat ulang halaman ini dan coba lagi.
 new_project = Proyek Baru
 new_project_column = Kolom Baru
 ok = Oke
@@ -135,7 +123,6 @@ filter.private = Pribadi
 logo = Logo
 sign_in_with_provider = Masuk menggunakan %s
 active_stopwatch = Pelacak Waktu Aktif
-
 tracked_time_summary = Ringkasan waktu terlacak berdasarkan filter daftar isu
 enable_javascript = Situs web ini memerlukan JavaScript.
 licenses = Lisensi
@@ -167,14 +154,12 @@ filter.not_template = Bukan templat
 navbar = Bar Navigasi
 footer = Footer
 footer.links = Tautan
-
 footer.software = Tentang perangkat lunak ini
 
 [heatmap]
 number_of_contributions_in_the_last_12_months = %s Kontribusi pada 12 bulan terakhir
 less = Lebih sedikit
 more = Lebih banyak
-
 contributions_zero = Tidak ada kontribusi
 contributions_format = {contributions} pada {month} {day}, {year}
 contributions_one = kontribusi
@@ -195,7 +180,6 @@ buttons.ref.tooltip = Merujuk pada issue atau permintaan tarik
 buttons.switch_to_legacy.tooltip = Gunakan editor versi lama
 buttons.enable_monospace_font = Aktifkan font monospace
 buttons.disable_monospace_font = Non-Aktifkan font monospace
-
 buttons.indent.tooltip = Indentasi item satu tingkat
 buttons.unindent.tooltip = Hapus indentasi item satu tingkat
 buttons.new_table.tooltip = Tambahkan tabel
@@ -216,7 +200,6 @@ string.desc = Z - A
 [error]
 occurred = Terjadi kesalahan
 not_found = Target tidak dapat ditemukan.
-
 report_message = Jika Anda yakin ini adalah bug Forgejo, silakan cari issue di <a href="%s" target="_blank">Codeberg</a> atau buka issue baru jika diperlukan.
 network_error = Kesalahan jaringan
 server_internal = Kesalahan server internal
@@ -229,7 +212,6 @@ lightweight=Ringan
 lightweight_desc=Forgejo hanya membutuhkan persyaratan minimal dan bisa berjalan pada Raspberry Pi yang murah. Bisa menghemat listrik!
 license=Sumber Terbuka
 license_desc=Go get (Dapatkan kode sumber dari) <a target="_blank" rel="noopener noreferrer" href="%[1]s">Forgejo</a>! Mari bergabung dengan <a target="_blank" rel="noopener noreferrer" href="%[2]s">berkontribusi</a> untuk membuat proyek ini lebih baik. Jangan malu untuk menjadi kontributor!
-
 install_desc = Cukup <a target="_blank" rel="noopener noreferrer" href="%s">jalankan biner</a> untuk platform Anda, kirimkan dengan <a target="_blank" rel="noopener noreferrer" href="%s">Docker</a>, atau dapatkan dalam bentuk <a target="_blank" rel="noopener noreferrer" href="%s">paket</a>.
 platform_desc = Forgejo telah dikonfirmasi berjalan pada sistem operasi bebas seperti Linux dan FreeBSD, serta berbagai arsitektur CPU. Pilih yang Anda sukai!
 
@@ -256,7 +238,6 @@ admin_email=Alamat email
 
 email_title = Pengaturan email
 smtp_from = Kirim Email Sebagai
-
 install = Instalasi
 docker_helper = Jika Anda menjalankan Forgejo di dalam Docker, harap baca <a target="_blank" rel="noopener noreferrer" href="%s">dokumentasi</a> sebelum mengubah pengaturan apa pun.
 require_db_desc = Forgejo memerlukan MySQL, PostgreSQL, SQLite3, atau TiDB (protokol MySQL).
@@ -362,7 +343,6 @@ show_private=Pribadi
 issues.in_your_repos=Dalam repositori anda
 
 show_archived = Diarsipkan
-
 filter = Filter lainnya
 filter_by_team_repositories = Filter berdasarkan repositori tim
 feed_of = Umpan dari "%s"
@@ -378,7 +358,6 @@ repos=Repositori
 users=Pengguna
 organizations=Organisasi
 code=Kode
-
 go_to = Pergi ke
 code_last_indexed_at = Terakhir diindeks %s
 relevant_repositories_tooltip = Repositori yang merupakan garpu atau yang tidak memiliki topik, ikon, dan deskripsi disembunyikan.
@@ -430,7 +409,6 @@ authorize_application_created_by=Aplikasi ini dibuat oleh %s.
 authorize_application_description=Jika Anda memberikan akses, layanan tersebut akan dapat mengakses dan menulis ke semua informasi akun Anda, termasuk repositori privat dan organisasi.
 authorize_title=Izinkan "%s" untuk mengakses akun Anda?
 authorization_failed=Otorisasi gagal
-
 manual_activation_only = Hubungi administrator situs Anda untuk menyelesaikan aktivasi.
 remember_me = Ingat perangkat ini
 hint_login = Sudah punya akun? <a href="%s">Masuk sekarang!</a>
@@ -470,13 +448,6 @@ register_notify=Selamat datang di %s
 reset_password=Pulihkan akun Anda
 
 register_success=Pendaftaran berhasil
-
-
-
-
-
-
-
 view_it_on = Lihat di %s
 reply = atau balas email ini secara langsung
 link_not_working_do_paste = Tautan tidak berfungsi? Coba salin dan tempel ke bilah URL browser Anda.
@@ -540,12 +511,17 @@ team_invite.text_1 = %[1]s mengundang Anda untuk bergabung dengan tim %[2]s di o
 team_invite.text_2 = Silakan klik tautan berikut untuk bergabung dengan tim:
 team_invite.text_3 = Catatan: Undangan ini ditujukan untuk %[1]s. Jika Anda tidak mengharapkan undangan ini, Anda dapat mengabaikan email ini.
 
+
+
+
+
+
+
 [modal]
 yes=Ya
 no=Tidak
 cancel=Membatalkan
 modify=Perbarui
-
 confirm = Konfirmasi
 
 [form]
@@ -606,8 +582,6 @@ auth_failed=Otentikasi gagal: %v
 
 
 target_branch_not_exist=Target cabang tidak ada.
-
-
 FullName = Nama lengkap
 Description = Deskripsi
 Pronouns = Kata ganti
@@ -650,6 +624,7 @@ org_still_own_packages = Organisasi ini masih memiliki satu atau lebih paket, ha
 admin_cannot_delete_self = Anda tidak dapat menghapus diri sendiri saat Anda adalah admin. Harap hapus hak admin Anda terlebih dahulu.
 required_prefix = Masukan harus dimulai dengan "%s"
 
+
 [user]
 change_avatar=Ganti avatar anda…
 repositories=Repositori
@@ -661,8 +636,6 @@ following_few=%d mengikuti
 follow=Ikuti
 unfollow=Berhenti Mengikuti
 user_bio=Biografi
-
-
 joined_on = Bergabung pada %s
 followers.title.one = Pengikut
 followers.title.few = Pengikut
@@ -694,6 +667,7 @@ form.name_reserved = Nama pengguna "%s" sudah dicadangkan.
 form.name_pattern_not_allowed = Pola "%s" tidak diperbolehkan dalam nama pengguna.
 form.name_chars_not_allowed = Nama pengguna "%s" mengandung karakter yang tidak valid.
 
+
 [settings]
 profile=Profil
 account=Akun
@@ -869,7 +843,6 @@ email_notifications.submit=Atur preferensi email
 visibility.private=Pribadi
 
 visibility.public = Publik
-
 appearance = Tampilan
 webauthn = Autentikasi dua faktor (Kunci keamanan)
 blocked_users = Pengguna yang diblokir
@@ -1084,12 +1057,6 @@ template.topics=Topik
 template.avatar=Avatar
 template.issue_labels=Label isu
 
-migrate_items=Ihwal Migrasi
-migrate_items_wiki=Wiki
-migrate_items_milestones=Tonggak
-migrate_items_issues=Masalah
-migrate_items_pullrequests=Tarik Permintaan
-migrate_items_releases=Rilis
 migrate_repo=Migrasi repositori
 migrate.permission_denied=Anda tidak diizinkan untuk mengimpor repositori lokal.
 migrate.failed=Migrasi gagal: %v
@@ -1483,7 +1450,6 @@ desc.archived = Diarsipkan
 commitstatus.error = Gangguan
 projects.new = Proyek Baru
 milestones.filter_sort.name = Nama
-
 rss.must_be_on_branch = Anda harus berada di cabang untuk memiliki umpan RSS.
 admin.manage_flags = Kelola tanda
 admin.enabled_flags = Tanda yang diaktifkan untuk repositori:
@@ -2809,7 +2775,6 @@ teams.add_team_member=Tambah anggota tim
 teams.delete_team_success=Tim sudah di hapus.
 teams.repositories=Tim repositori
 settings.visibility.public = Publik
-
 org_name_helper = Nama organisasi sebaiknya singkat dan mudah diingat.
 open_dashboard = Buka dasbor
 code = Kode
@@ -2892,33 +2857,6 @@ dashboard.clean_unbind_oauth=Bersihkan koneksi OAuth yang tidak terikat
 dashboard.clean_unbind_oauth_success=Semua koneksi OAuth yang tidak terikat telah dihapus.
 dashboard.reinit_missing_repos=Menginstal kembali semua repositori Git yang hilang dimana ada catatan
 dashboard.sync_external_users=Sinkronkan data pengguna eksternal
-dashboard.server_uptime=Waktu aktif server
-dashboard.current_goroutine=Goroutine saat ini
-dashboard.current_memory_usage=Penggunaan memori saat ini
-dashboard.total_memory_allocated=Total memori yang dialokasikan
-dashboard.memory_obtained=Memori yang diperoleh
-dashboard.pointer_lookup_times=Jumlah pencarian pointer
-dashboard.current_heap_usage=Penggunaan heap saat ini
-dashboard.heap_memory_obtained=Memori heap yang diperoleh
-dashboard.heap_memory_idle=Memori heap yang menganggur
-dashboard.heap_memory_in_use=Memori heap yang digunakan
-dashboard.heap_memory_released=Memori heap yang dilepaskan
-dashboard.heap_objects=Objek heap
-dashboard.bootstrap_stack_usage=Penggunaan stack bootstrap
-dashboard.stack_memory_obtained=Memori stack yang diperoleh
-dashboard.mspan_structures_usage=Penggunaan struktur MSpan
-dashboard.mspan_structures_obtained=Struktur MSpan yang diperoleh
-dashboard.mcache_structures_usage=Penggunaan struktur MCache
-dashboard.mcache_structures_obtained=Struktur MCache yang diperoleh
-dashboard.profiling_bucket_hash_table_obtained=Tabel hash bucket pemrofilan yang diperoleh
-dashboard.gc_metadata_obtained=Metadata GC yang diperoleh
-dashboard.other_system_allocation_obtained=Alokasi sistem lainnya yang diperoleh
-dashboard.next_gc_recycle=Daur ulang GC berikutnya
-dashboard.last_gc_time=Waktu sejak GC terakhir
-dashboard.total_gc_pause=Total jeda GC
-dashboard.last_gc_pause=Jeda GC terakhir
-dashboard.gc_times=Jumlah GC
-
 users.full_name=Nama lengkap
 users.activated=Diaktifkan
 users.admin=Pengelola
@@ -2927,8 +2865,6 @@ users.created=Dibuat
 users.edit=Edit
 users.auth_source=Sumber autentikasi
 users.local=Lokal
-users.list_status_filter.is_admin=Pengelola
-
 emails.activated=Diaktifkan
 
 orgs.org_manage_panel=Kelola organisasi
@@ -3100,19 +3036,6 @@ monitor.execute_time=Waktu pelaksanaan
 monitor.process.cancel=Batalkan proses
 monitor.process.cancel_desc=Membatalkan proses dapat menyebabkan kehilangan data
 
-monitor.queues=Antrian
-monitor.queue=Antrian: %s
-monitor.queue.name=Nama
-monitor.queue.type=Tipe
-monitor.queue.exemplar=Contoh Tipe
-monitor.queue.numberworkers=Jumlah pekerja
-monitor.queue.maxnumberworkers=Jumlah maksimum pekerja
-monitor.queue.settings.title=Pengaturan pool
-monitor.queue.settings.maxnumberworkers=Jumlah Maks. Worker
-monitor.queue.settings.maxnumberworkers.error=Jumlah maks. worker haruslah sebuah angka
-monitor.queue.settings.submit=Perbarui pengaturan
-monitor.queue.settings.changed=Pengaturan diperbarui
-
 notices.system_notice_list=Pemberitahuan sistem
 notices.view_detail_header=Detail pemberitahuan
 notices.select_all=Pilih semua
@@ -3128,8 +3051,6 @@ notices.delete_success=Laporan sistem telah dihapus.
 
 
 config_settings = Pengaturan
-users.list_status_filter.menu_text = Saring
-
 self_check = Pemeriksaan mandiri
 identity_access = Identitas & akses
 users = Akun pengguna
@@ -3177,8 +3098,6 @@ dashboard.resync_all_hooks = Sinkronkan ulang hook Git dari semua repositori (pr
 dashboard.cleanup_hook_task_table = Bersihkan tabel hook_task
 dashboard.cleanup_packages = Bersihkan paket yang kedaluwarsa
 dashboard.cleanup_actions = Bersihkan log dan artefak yang kedaluwarsa dari aksi
-dashboard.memory_allocate_times = Alokasi memori
-dashboard.memory_free_times = Pembebasan memori
 dashboard.delete_old_actions = Hapus semua aktivitas lama dari basis data
 dashboard.delete_old_actions.started = Hapus semua aktivitas lama dari basis data dimulai.
 dashboard.update_checker = Pemeriksa pembaruan
@@ -3233,16 +3152,6 @@ users.purge_help = Hapus paksa pengguna beserta semua repositori, organisasi, da
 users.still_own_packages = Pengguna ini masih memiliki satu atau lebih paket, hapus paket tersebut terlebih dahulu.
 users.deletion_success = Akun pengguna telah dihapus.
 users.reset_2fa = Atur ulang 2FA
-users.list_status_filter.reset = Atur ulang
-users.list_status_filter.is_active = Aktif
-users.list_status_filter.not_active = Tidak aktif
-users.list_status_filter.not_admin = Bukan admin
-users.list_status_filter.is_restricted = Dibatasi
-users.list_status_filter.not_restricted = Tidak dibatasi
-users.list_status_filter.is_prohibit_login = Larang masuk
-users.list_status_filter.not_prohibit_login = Izinkan masuk
-users.list_status_filter.is_2fa_enabled = 2FA diaktifkan
-users.list_status_filter.not_2fa_enabled = 2FA dinonaktifkan
 users.details = Detail pengguna
 emails.email_manage_panel = Kelola email pengguna
 emails.primary = Utama
@@ -3401,13 +3310,6 @@ monitor.download_diagnosis_report = Unduh laporan diagnosis
 monitor.duration = Durasi (dtk)
 monitor.last_execution_result = Hasil
 monitor.process.cancel_notices = Batalkan: <strong>%s</strong>?
-monitor.queue.activeworkers = Pekerja aktif
-monitor.queue.numberinqueue = Jumlah dalam antrian
-monitor.queue.review_add = Tinjau / tambah pekerja
-monitor.queue.settings.desc = Pool berkembang secara dinamis sebagai respons terhadap pemblokiran antrian pekerja mereka.
-monitor.queue.settings.maxnumberworkers.placeholder = Saat ini %[1]d
-monitor.queue.settings.remove_all_items = Hapus semua
-monitor.queue.settings.remove_all_items_done = Semua item dalam antrian telah dihapus.
 notices.operations = Operasi
 notices.type_2 = Tugas
 self_check.no_problem_found = Belum ditemukan masalah.
@@ -3423,7 +3325,6 @@ transfer_repo=ditransfer repositori <code>%s</code> ke <a href="%s">%s</a>
 delete_tag=tag dihapus %[2]s dari <a href="%[1]s">%[3]s</a>
 delete_branch=cabang dihapus <code>%[2]s</code> dari <a href="%[1]s">%[3]s</a>
 compare_commits=Bandingkan %d melakukan
-
 commit_repo = mendorong ke <a href="%s">%s</a> di <a href="%s">%s</a>
 create_issue = `membuka issue <a href="%[1]s">%[3]s#%[2]s</a>`
 close_issue = `menutup issue <a href="%[1]s">%[3]s#%[2]s</a>`
@@ -3479,13 +3380,11 @@ raw_minutes=menit
 [units]
 error.no_unit_allowed_repo=Anda tidak diijinkan untuk melihat semua unit dari repositori ini.
 error.unit_not_allowed=Anda tidak diizinkan untuk mengunjungi unit repositori ini.
-
 unit = Unit
 
 [packages]
 conan.details.repository=Repositori
 owner.settings.cleanuprules.enabled=Aktif
-
 owner.settings.cleanuprules.keep.count.1 = 1 versi per paket
 owner.settings.cleanuprules.keep.count.n = %d versi per paket
 
@@ -3509,21 +3408,7 @@ workflow.disable = Nonaktifkan Alur Kerja
 workflow.enable = Aktifkan Alur Kerja
 workflow.disabled = Alur kerja dinonaktifkan.
 need_approval_desc = Butuh persetujuan untuk menjalankan alur kerja untuk pull request fork.
-variables = Variabel
-variables.creation = Tambah Variabel
-variables.none = Belum ada variabel.
-variables.deletion = Hapus variabel
-variables.deletion.description = Menghapus variabel bersifat permanen dan tidak dapat dibatalkan. Lanjutkan?
-variables.description = Variabel akan diteruskan ke beberapa tindakan dan tidak dapat dibaca sebaliknya.
 variables.id_not_exist = Variabel dengan ID %d tidak ada.
-variables.edit = Edit Variabel
-variables.deletion.failed = Gagal menghapus variabel.
-variables.deletion.success = Variabel telah dihapus.
-variables.creation.failed = Gagal menambahkan variabel.
-variables.creation.success = Variabel "%s" telah ditambahkan.
-variables.update.failed = Gagal mengedit variabel.
-variables.update.success = Variabel telah diedit.
-
 runs.no_workflows.help_write_access = Tidak tahu cara memulai dengan Forgejo Actions? Lihat <a target="_blank" rel="noopener noreferrer" href="%s">panduan memulai cepat di dokumentasi pengguna</a> untuk menulis alur kerja pertama Anda, lalu <a target="_blank" rel="noopener noreferrer" href="%s">siapkan runner Forgejo</a> untuk menjalankan pekerjaan Anda.
 runs.no_workflows.help_no_write_access = Untuk mempelajari Forgejo Actions, lihat <a target="_blank" rel="noopener noreferrer" href="%s">dokumentasi</a>.
 runs.expire_log_message = Log telah dihapus karena sudah terlalu lama.
@@ -3536,14 +3421,11 @@ workflow.dispatch.success = Permintaan jalankan alur kerja berhasil dikirim.
 workflow.dispatch.input_required = Wajib mengisi nilai untuk input "%s".
 workflow.dispatch.invalid_input_type = Jenis input tidak valid "%s".
 workflow.dispatch.warn_input_limit = Hanya menampilkan %d input pertama.
-variables.management = Kelola variabel
-variables.not_found = Gagal menemukan variabel.
 
 [projects]
 type-1.display_name = Proyek Individu
 type-2.display_name = Proyek Repositori
 type-3.display_name = Proyek Organisasi
-
 deleted.display_name = Proyek yang dihapus
 
 [git.filemode]
@@ -3580,6 +3462,7 @@ issue_kind = Cari isu…
 pull_kind = Cari permintaan tarik…
 keyword_search_unavailable = Pencarian berdasarkan kata kunci saat ini tidak tersedia. Silakan hubungi administrator situs.
 
+
 [repo.permissions]
 code.read = <b>Baca:</b> Akses dan klon kode repositori.
 code.write = <b>Tulis:</b> Dorong ke repositori, buat cabang dan tag.
@@ -3601,9 +3484,6 @@ ext_issues = Akses tautan ke pelacak issue eksternal. Izin dikelola secara ekste
 ext_wiki = Akses tautan ke wiki eksternal. Izin dikelola secara eksternal.
 
 [markup]
-filepreview.line = Baris %[1]d di %[2]s
-filepreview.lines = Baris %[1]d hingga %[2]d di %[3]s
-filepreview.truncated = Pratinjau telah dipotong
 
 [translation_meta]
-test = Ini adalah string uji. Tidak ditampilkan di antarmuka Forgejo tetapi digunakan untuk keperluan pengujian. Silakan masukkan "ok" untuk menghemat waktu (atau fakta menarik pilihan Anda) demi mencapai angka penyelesaian 100% yang memuaskan :)
+test = Ini adalah string uji. Tidak ditampilkan di antarmuka Forgejo tetapi digunakan untuk keperluan pengujian. Silakan masukkan "ok" untuk menghemat waktu (atau fakta menarik pilihan Anda) demi mencapai angka penyelesaian 100% yang memuaskan :)
\ No newline at end of file
diff --git a/options/locale/locale_is-IS.ini b/options/locale/locale_is-IS.ini
index 41d35e2738..e22dfefcc1 100644
--- a/options/locale/locale_is-IS.ini
+++ b/options/locale/locale_is-IS.ini
@@ -33,18 +33,6 @@ twofa=Tvíþætt Auðkenning
 twofa_scratch=Tveggja-Þátta Skrapkóði
 passcode=Aðgangstala
 
-webauthn_insert_key=Settu öryggislykilinn þinn inn
-webauthn_sign_in=Ýttu á hnappinn á öryggislyklinum þínum. Ef öryggislykillinn þinn hefur engan hnapp skaltu setja hann aftur inn.
-webauthn_press_button=Vinsamlegast ýttu á hnappinn á öryggislyklinum þínum…
-webauthn_use_twofa=Notaðu tveggja-þátta kóða úr símanum þínum
-webauthn_error=Gat ekki lesið öryggislykilinn þinn.
-webauthn_unsupported_browser=Vafrinn þinn styður ekki WebAuthn eins og er.
-webauthn_error_unknown=Óþekkt villa kom upp. Vinsamlegast reyndu aftur.
-webauthn_error_insecure=WebAuthn styður aðeins öruggar tengingar. Til að prófa yfir HTTP geturðu notað upprunann „localhost“ eða „127.0.0.1“
-webauthn_error_unable_to_process=Netþjónninn gat ekki ráðið við beiðni þína.
-webauthn_error_duplicated=Öryggislykillinn er ekki leyfður fyrir þessa beiðni. Gakktu úr skugga um að lykillinn sé ekki þegar skráður.
-webauthn_error_empty=Þú verður að setja nafn fyrir þennan lykil.
-webauthn_error_timeout=Tímamörk náð áður en hægt var að lesa lykilinn þinn. Vinsamlegast endurhlaðið þessa síðu og reyndu aftur.
 repository=Hugbúnaðarsafn
 organization=Stofnun
 mirror=Speglun
@@ -590,17 +578,8 @@ template.issue_labels=Vandamálslýsingar
 
 migrate_options_lfs=Flytja LFS skrár
 migrate_options_lfs_endpoint.label=LFS Endapunktur
-migrate_items_wiki=Handbók
-migrate_items_milestones=Tímamót
-migrate_items_labels=Skýringar
-migrate_items_issues=Vandamál
-migrate_items_pullrequests=Sameiningarbeiðnir
-migrate_items_merge_requests=Sameiningarbeiðnir
-migrate_items_releases=Útgáfur
 migrate_repo=Flytja Hugbúnaðarsafn
 migrate.migrate=Flytja Frá %s
-migrate.migrating_labels=Að færa Lýsingar
-
 mirror_from=speglun af
 forked_from=tvískipt frá
 generated_from=myndað frá
@@ -1128,9 +1107,6 @@ dashboard.statistic=Yfirlit
 dashboard.operation_switch=Skipta
 dashboard.operation_run=Keyra
 dashboard.update_mirrors=Uppfæra Speglanir
-dashboard.server_uptime=Uppitími Netþjóns
-dashboard.total_memory_allocated=Heildarminni úthlutað
-
 users.name=Notandanafn
 users.full_name=Fullt Nafn
 users.admin=Stjórnandi
@@ -1139,14 +1115,6 @@ users.repos=Söfn
 users.created=Búið til
 users.edit=Breyta
 users.local=Staðbundið
-users.list_status_filter.menu_text=Sía
-users.list_status_filter.reset=Endurstilla
-users.list_status_filter.is_active=Virkt
-users.list_status_filter.is_admin=Stjórnandi
-users.list_status_filter.is_prohibit_login=Stöðva Innskráningu
-users.list_status_filter.not_prohibit_login=Leyfa Innskráningu
-users.list_status_filter.not_2fa_enabled=Tvíþætt Auðkenning Óvirk
-
 emails.primary=Aðal
 emails.filter_sort.email=Tölvupóstur
 emails.filter_sort.name=Notandanafn
@@ -1226,12 +1194,6 @@ monitor.name=Heiti
 monitor.desc=Lýsing
 monitor.process.children=Börn
 
-monitor.queues=Raðir
-monitor.queue.name=Heiti
-monitor.queue.type=Tegund
-monitor.queue.settings.submit=Uppfæra Stillingar
-monitor.queue.settings.changed=Stillingar Uppfærðar
-
 notices.type=Tegund
 notices.type_1=Hugbúnaðarsafn
 notices.type_2=Verkefni
diff --git a/options/locale/locale_it-IT.ini b/options/locale/locale_it-IT.ini
index 2869750807..3b8475ba67 100644
--- a/options/locale/locale_it-IT.ini
+++ b/options/locale/locale_it-IT.ini
@@ -34,18 +34,6 @@ twofa=Autenticazione a due fattori
 twofa_scratch=Codice di recupero per l'autenticazione a due fattori
 passcode=Codice di sicurezza
 
-webauthn_insert_key=Inserisci la tua chiave di sicurezza
-webauthn_sign_in=Premi il pulsante sul tasto di sicurezza. Se il tasto di sicurezza non ha pulsante, reinseriscilo.
-webauthn_press_button=Premi il pulsante sulla chiave di sicurezza…
-webauthn_use_twofa=Usa un codice a due fattori dal tuo telefono
-webauthn_error=Impossibile leggere la tua chiave di sicurezza.
-webauthn_unsupported_browser=Il tuo browser al momento non supporta WebAuthn.
-webauthn_error_unknown=Si è verificato un errore sconosciuto. Riprova.
-webauthn_error_insecure=WebAuthn supporta solo connessioni sicure. Per il test su HTTP, è possibile utilizzare l'origine "localhost" o "127.0.0.1"
-webauthn_error_unable_to_process=Il server non può elaborare la richiesta.
-webauthn_error_duplicated=La chiave di sicurezza non è consentita per questa richiesta. Assicurati che la chiave non sia già registrata.
-webauthn_error_empty=Devi impostare un nome per questa chiave.
-webauthn_error_timeout=Timeout raggiunto prima che la tua chiave possa essere letta. Ricarica la pagina e riprova.
 repository=Repositorio
 organization=Organizzazione
 mirror=Mirror
@@ -1132,14 +1120,6 @@ migrate_options_lfs=Migra file LFS
 migrate_options_lfs_endpoint.label=Punto d'accesso LFS
 migrate_options_lfs_endpoint.description=La migrazione tenterà di utilizzare il tuo Git remote per <a target="_blank" rel="noopener noreferrer" href="%s">determinare il server LFS</a>. È inoltre possibile specificare un endpoint personalizzato se il repositorio dati LFS è memorizzato da qualche altra parte.
 migrate_options_lfs_endpoint.description.local=È supportato anche un percorso server locale.
-migrate_items=Elementi di migrazione
-migrate_items_wiki=Wiki
-migrate_items_milestones=Traguardi
-migrate_items_labels=Etichette
-migrate_items_issues=Segnalazioni
-migrate_items_pullrequests=Richieste di modifica
-migrate_items_merge_requests=Richieste di fusione
-migrate_items_releases=Rilasci
 migrate_repo=Migra repositorio
 migrate.clone_address=Migra / Clona da URL
 migrate.clone_address_desc=URL HTTP(S) o Git "clone" di un repositorio esistente
@@ -1156,14 +1136,6 @@ migrate.migrate=Migra da %s
 migrate.migrating=Migrazione da <b>%s</b>...
 migrate.migrating_failed=Migrazione da <b>%s</b> fallita.
 migrate.migrating_failed_no_addr=Migrazione non riuscita.
-migrate.migrating_git=Migrazione dei dati Git
-migrate.migrating_topics=Migrazione degli argomenti
-migrate.migrating_milestones=Migrazione dei traguardi
-migrate.migrating_labels=Migrazione delle etichette
-migrate.migrating_releases=Migrazione dei rilasci
-migrate.migrating_issues=Migrazione delle segnalazioni
-migrate.migrating_pulls=Migrazione delle richieste di modifica
-
 mirror_from=mirror da
 forked_from=derivato da
 generated_from=generato da
@@ -2316,7 +2288,6 @@ pulls.cmd_instruction_merge_title = Merge
 pulls.cmd_instruction_checkout_desc = Dalla tua repository del progetto, accedi a un nuovo ramo e prova le modifiche.
 milestones.new_subheader = I traguardi possono aiutarti ad organizzare le segnalazioni e a tracciarne i progressi.
 activity.navbar.contributors = Contributori
-migrate.cancel_migrating_title = Annulla migrazione
 more_operations = Ulteriori operazioni
 actions = Azioni
 commit.operations = Operazioni
@@ -2526,7 +2497,6 @@ tree_path_not_found.tag = Il percorso %[1]s non esiste nel tag %[2]s
 transfer.no_permission_to_accept = Non hai i permessi per accettare questo trasferimento.
 transfer.no_permission_to_reject = Non hai i permessi per rifiutare questo trasferimento.
 migrate_options_lfs_endpoint.placeholder = Se lasciato vuoto il punto di accesso sarà derivato dall'URL usato per clonare
-migrate.cancel_migrating_confirm = Vuoi annullare questa migrazione?
 editor.filename_is_invalid = Nome file invalido: "%s".
 editor.unable_to_upload_files = Impossibile caricare i file su "%s" con errore: %v
 projects.create_success = Il progetto "%s" è stato creato.
@@ -2645,9 +2615,6 @@ settings.event_pull_request_review_request_desc = Richiesta la revisione della r
 stars = Stelle
 issues.num_participants_one = %d partecipante
 open_with_editor = Apri con %s
-n_commit_few = %s commit
-n_branch_one = %s ramo
-n_tag_few = %s etichette
 settings.web_hook_name_sourcehut_builds = Build SourceHut
 settings.sourcehut_builds.manifest_path = Percorso manifest della build
 settings.sourcehut_builds.visibility = Visibilità attività
@@ -2658,13 +2625,10 @@ editor.push_out_of_date = Il push sembra essere obsoleto.
 issues.archived_label_description = (Archiviato) %s
 settings.sourcehut_builds.secrets_helper = Fornisci l'accesso ai segreti della build all'incarico (richiede il permesso SECRETS:RO)
 settings.add_webhook.invalid_path = Il percorso non deve contenere dei componenti quali ".", "..", o una stringa vuota. Non può iniziare o finire con uno slash.
-n_commit_one = %s commit
 settings.enforce_on_admins = Imponi questa regola agli amministratori del repository
 release.system_generated = Questo allegato è stato generato automaticamente.
 pulls.ready_for_review = Pronto alla revisione?
 editor.commit_id_not_matching = L'ID del commit non combacia con quello del commit che stavi modificando. Conferma le tue modifiche su un nuovo ramo, poi fondilo col ramo desiderato.
-n_branch_few = %s rami
-n_tag_one = %s etichetta
 commits.search_branch = Questo ramo
 settings.rename_branch_failed_protected = Non è possibile rinominare il ramo %s perché è un ramo protetto.
 settings.event_pull_request_enforcement = Imposizione
@@ -2678,8 +2642,6 @@ project = Progetti
 issues.edit.already_changed = Impossibile salvare le modifiche alla segnalazione. Sembra che il contenuto sia già stato modificato da un*altrə utente. Aggiornare la pagina e provare a modificare nuovamente per evitare di sovrascrivere le modifiche
 subscribe.pull.guest.tooltip = Accedi per iscriverti a questa richiesta di modifica.
 subscribe.issue.guest.tooltip = Accedere per seguire questa segnalazione.
-n_release_one = %s rilascio
-n_release_few = %s rilasci
 issues.author.tooltip.pr = Quest'utente è l'autorə di questa richiesta di modifica.
 release.hide_archive_links = Nascondi automaticamente gli archivi generati
 settings.federation_settings = Impostazioni di federazione
@@ -2953,34 +2915,6 @@ dashboard.reinit_missing_repos=Reinizializza tutti i repository Git mancanti per
 dashboard.sync_external_users=Sincronizza dati utente esterno
 dashboard.cleanup_hook_task_table=Pulisci tabella hook_task
 dashboard.cleanup_packages=Pulizia pacchetti scaduti
-dashboard.server_uptime=Tempo di attività
-dashboard.current_goroutine=Goroutine attuali
-dashboard.current_memory_usage=Utilizzo di memoria attuale
-dashboard.total_memory_allocated=Memoria allocata totale
-dashboard.memory_obtained=Memoria ottenuta
-dashboard.pointer_lookup_times=Tempi di ricerca del puntatore
-dashboard.memory_allocate_times=Allocazioni di memoria
-dashboard.memory_free_times=Rilasci di memoria
-dashboard.current_heap_usage=Utilizzo heap attuale
-dashboard.heap_memory_obtained=Memoria heap ottenuta
-dashboard.heap_memory_idle=Memoria heap inattiva
-dashboard.heap_memory_in_use=Memoria heap in uso
-dashboard.heap_memory_released=Memoria heap rilasciata
-dashboard.heap_objects=Oggetti dell'heap
-dashboard.bootstrap_stack_usage=Utilizzo pila iniziale
-dashboard.stack_memory_obtained=Memoria pila ottenuta
-dashboard.mspan_structures_usage=Utilizzo strutture MSpan
-dashboard.mspan_structures_obtained=Strutture MSpan ottenute
-dashboard.mcache_structures_usage=Utilizzo di strutture MCache
-dashboard.mcache_structures_obtained=Strutture MCache ottenute
-dashboard.profiling_bucket_hash_table_obtained=Tabelle hash del secchio di profilazione ottenute
-dashboard.gc_metadata_obtained=Metadata del GC ottenuto
-dashboard.other_system_allocation_obtained=Altre allocazioni di sistema ottenute
-dashboard.next_gc_recycle=Prossimo riciclaggio GC
-dashboard.last_gc_time=Dall'ultimo GC
-dashboard.total_gc_pause=Pausa totale del GC
-dashboard.last_gc_pause=Ultima pausa del GC
-dashboard.gc_times=Esecuzioni GC
 dashboard.delete_old_actions=Elimina tutte le vecchie azioni dal database
 dashboard.delete_old_actions.started=Elimina tutte le vecchie azioni dal database iniziate.
 dashboard.update_checker=Controllore dell'aggiornamento
@@ -3025,19 +2959,6 @@ users.purge=Elimina utente
 users.purge_help=Eliminare forzatamente l'utente e tutti i progetti, le organizzazioni e i pacchetti di proprietà dell'utente. Anche tutti i commenti e le segnalazioni verranno eliminati.
 users.deletion_success=L'account utente è stato eliminato.
 users.reset_2fa=Resetta 2FA
-users.list_status_filter.menu_text=Filtro
-users.list_status_filter.reset=Ripristina
-users.list_status_filter.is_active=Attivo
-users.list_status_filter.not_active=Inattivo
-users.list_status_filter.is_admin=Amministratore
-users.list_status_filter.not_admin=Non amministratore
-users.list_status_filter.is_restricted=Limitato
-users.list_status_filter.not_restricted=Non limitato
-users.list_status_filter.is_prohibit_login=Accesso vietato
-users.list_status_filter.not_prohibit_login=Accesso consentito
-users.list_status_filter.is_2fa_enabled=2FA abilitato
-users.list_status_filter.not_2fa_enabled=2FA disabilitato
-
 emails.email_manage_panel=Gestisci email dell'utente
 emails.primary=Primario
 emails.activated=Attivato
@@ -3330,21 +3251,6 @@ monitor.process.cancel_desc=Annullare un processo potrebbe causare una perdita d
 monitor.process.cancel_notices=Annulla: <strong>%s</strong>?
 monitor.process.children=Figli
 
-monitor.queues=Code
-monitor.queue=Coda: %s
-monitor.queue.name=Nome
-monitor.queue.type=Tipo
-monitor.queue.exemplar=Tipo di esemplare
-monitor.queue.numberworkers=Numero di lavoratori
-monitor.queue.maxnumberworkers=Massimo numero di lavoratori
-monitor.queue.numberinqueue=Numero in coda
-monitor.queue.settings.title=Impostazioni piscina
-monitor.queue.settings.maxnumberworkers=Massimo numero di workers
-monitor.queue.settings.maxnumberworkers.placeholder=Attualmente %[1]d
-monitor.queue.settings.maxnumberworkers.error=Il numero massimo di lavoratori deve essere un numero
-monitor.queue.settings.submit=Aggiorna impostazioni
-monitor.queue.settings.changed=Impostazioni aggiornate
-
 notices.system_notice_list=Avvisi di sistema
 notices.view_detail_header=Visualizza dettagli dell'avviso
 notices.select_all=Seleziona tutto
@@ -3383,7 +3289,6 @@ auths.tip.gitea = Registra una nuova applicazione OAuth2. La guida può essere t
 config.test_mail_sent = Una email di prova è stata inviata a "%s".
 monitor.processes_count = %d processi
 monitor.download_diagnosis_report = Scarica relazione diagnostica
-monitor.queue.activeworkers = Lavoratori attivi
 config.app_data_path = Percorso dati dell'applicazione
 packages.cleanup = Pulisci dati scaduti
 dashboard.cleanup_actions = Pulisci log scaduti e artefatti dalle azioni
@@ -3411,12 +3316,8 @@ auths.new_success = L'autenticazione "%s" è stata aggiunta.
 auths.tips.gmail_settings = Impostazioni Gmail:
 config.test_mail_failed = Impossibile inviare email di prova a "%s": %v
 users.details = Dettagli dell'utente
-monitor.queue.review_add = Revisiona / aggiungi lavoratori
 self_check.no_problem_found = Non c'è ancora nessuna segnalazione.
 self_check.database_inconsistent_collation_columns = La base di dati sta usando la collazione %s ma queste colonne usano una collazione diversa. Potrebbe causare problemi imprevisti.
-monitor.queue.settings.remove_all_items = Rimuovi tutto
-monitor.queue.settings.desc = Le piscine crescono dinamicamente in risposta al blocco dei lavoratori in coda.
-monitor.queue.settings.remove_all_items_done = Tutti gli elementi in coda sono stati rimossi.
 self_check.database_collation_mismatch = Pretendi che la base di dati usi la collazione: %s
 self_check.database_fix_mysql = Per utenti MySQL/MariaDB, potresti usare il comando "forgejo doctor convert" per risolvere problemi di collazione, o potresti risolvere il problema manualmente tramite SQL con "ALTER ... COLLATE ...".
 self_check.database_collation_case_insensitive = La base di dati sta usando la collazione %s, che è una collazione insensibile. Nonostante Forgejo potrebbe lavorarci, ci potrebbero essere rari casi che non vanno come previsto.
@@ -3530,29 +3431,15 @@ creation.success = Il segreto "%s" è stato aggiungo.
 deletion.success = Il segreto è stato rimosso.
 
 [actions]
-variables = Variabili
 unit.desc = Gestisci azioni
 workflow.enable = Abilita flusso di lavoro
-variables.update.success = La variabile è stata modificata.
-variables.update.failed = Impossibile modificare la variabile.
-variables.creation.failed = Errore nell'aggiunta della variabile.
-variables.deletion.success = La variabile è stata rimossa.
-variables.deletion.failed = Impossibile rimuovere la variabile.
-variables.edit = Modifica variabile
 variables.id_not_exist = La variabile con ID %s non esiste.
-variables.deletion.description = La rimozione di una variabile è permanente e non può essere annullata. Continuare?
-variables.deletion = Rimuovi variabile
-variables.none = Non ci sono ancora variabili.
-variables.creation = Aggiungi variabile
-variables.management = Gestisci variabili
 workflow.disabled = Il flusso di lavoro è disabilitato.
 workflow.enable_success = Il flusso di lavoro "%s" è stato abilitato correttamente.
 workflow.disable_success = Il flusso di lavoro "%s" è stato disabilitato con successo.
 workflow.disable = Disabilita flusso di lavoro
 runs.empty_commit_message = (messaggio di commit vuoto)
 runs.no_runs = Il flusso di lavoro non è stato ancora eseguito.
-variables.creation.success = La variabile "%s" è stata aggiunta.
-variables.description = Le variabili saranno passate a determinate azioni e non possono essere lette altrimenti.
 need_approval_desc = È necessaria l'approvazione per eseguire flussi di lavoro per richieste di modifica da fork.
 workflow.dispatch.trigger_found = Questo flusso di lavoro ha un rilevatore di eventi <c>workflow_dispatch</c>.
 workflow.dispatch.run = Esegui flusso di lavoro
@@ -3561,7 +3448,6 @@ workflow.dispatch.input_required = Richiedi valore per l'ingresso "%s".
 workflow.dispatch.invalid_input_type = Tipo ingresso "%s" non valido.
 workflow.dispatch.warn_input_limit = Visualizzati solo i primi %d ingressi.
 workflow.dispatch.use_from = Usa flusso di lavoro da
-variables.not_found = Non è stato possibile trovare la variabile.
 runs.expire_log_message = I log sono stati eliminati in quanto troppo vecchi.
 runs.no_workflows.help_no_write_access = Per saperne di più su Forgejo Actions, consulta <a target="_blank" rel="noopener noreferrer" href="%s">la documentazione</a>.
 runs.no_workflows.help_write_access = Non sai come iniziare con Forgejo Actions? Dai un'occhiata alla <a target="_blank" rel="noopener noreferrer" href="%s"> guida rapida nella documentazione utente</a> per scrivere il tuo primo flusso di lavoro, poi <a target="_blank" rel="noopener noreferrer" href="%s"> configura un esecutore Forgejo</a> per eseguire i tuoi incarichi.
@@ -3615,10 +3501,6 @@ union = Parole chiavi
 [munits.data]
 
 [markup]
-filepreview.lines = Linee da %[1]d a %[2]d in %[3]s
-filepreview.truncated = L'anteprima è stata troncata
-filepreview.line = Linea %[1]d in %[2]s
-
 
 [repo.permissions]
 issues.write = <b>Scrittura:</b> Chiudere segnalazioni e gestire metadati come etichette, traguardi, assegnatarɜ, scadenze e dipendenze.
diff --git a/options/locale/locale_ja-JP.ini b/options/locale/locale_ja-JP.ini
index 89da29c8a4..f4cbb22f49 100644
--- a/options/locale/locale_ja-JP.ini
+++ b/options/locale/locale_ja-JP.ini
@@ -37,18 +37,6 @@ twofa=2要素認証
 twofa_scratch=2要素認証スクラッチコード
 passcode=パスコード
 
-webauthn_insert_key=セキュリティキーを挿入
-webauthn_sign_in=セキュリティキーのボタンを押してください。セキュリティキーにボタンが無い場合は、挿入しなおしてください。
-webauthn_press_button=セキュリティキーのボタンを押してください…
-webauthn_use_twofa=携帯電話から2要素認証コードを使用する
-webauthn_error=セキュリティキーを読み取ることができません。
-webauthn_unsupported_browser=お使いのブラウザは現在 WebAuthn をサポートしていません。
-webauthn_error_unknown=不明なエラーが発生しました。 もう一度やり直してください。
-webauthn_error_insecure=WebAuthn はセキュアな接続のみをサポートしています。HTTP 経由でテストする場合は、"localhost" または "127.0.0.1" のオリジンが使用できます
-webauthn_error_unable_to_process=サーバーがリクエストを処理できませんでした。
-webauthn_error_duplicated=このリクエストに対しては、許可されていないセキュリティキーです。 キーが未登録であることを確認してください。
-webauthn_error_empty=このキーに名前を設定する必要があります。
-webauthn_error_timeout=キーを読み取る前にタイムアウトになりました。 このページをリロードしてもう一度やり直してください。
 repository=リポジトリ
 organization=組織
 mirror=ミラー
@@ -1149,14 +1137,6 @@ migrate_options_lfs_endpoint.label=LFS エンドポイント
 migrate_options_lfs_endpoint.description=マイグレーションでは、リモート側のGitをもとに<a target="_blank" rel="noopener noreferrer" href="%s">LFSサーバーを決定</a>しようとします。 リポジトリのLFSデータがほかの場所に保存されている場合は、独自のエンドポイントを指定することができます。
 migrate_options_lfs_endpoint.description.local=ローカルサーバーのパスもサポートされています。
 migrate_options_lfs_endpoint.placeholder=空にするとエンドポイントはクローン URL から決定されます
-migrate_items=移行する項目
-migrate_items_wiki=Wiki
-migrate_items_milestones=マイルストーン
-migrate_items_labels=ラベル
-migrate_items_issues=イシュー
-migrate_items_pullrequests=プルリクエスト
-migrate_items_merge_requests=マージリクエスト
-migrate_items_releases=リリース
 migrate_repo=リポジトリを移行
 migrate.clone_address=移行 / クローンするURL
 migrate.clone_address_desc=既存リポジトリの、HTTP(S)またはGit形式のクローンURL
@@ -1175,16 +1155,6 @@ migrate.migrating=<b>%s</b> から移行しています …
 migrate.migrating_failed=<b>%s</b> からの移行が失敗しました。
 migrate.migrating_failed.error=移行に失敗しました: %s
 migrate.migrating_failed_no_addr=移行に失敗しました。
-migrate.migrating_git=Gitデータ移行中
-migrate.migrating_topics=トピック移行中
-migrate.migrating_milestones=マイルストーン移行中
-migrate.migrating_labels=ラベル移行中
-migrate.migrating_releases=リリース移行中
-migrate.migrating_issues=イシュー移行中
-migrate.migrating_pulls=プルリクエスト移行中
-migrate.cancel_migrating_title=移行のキャンセル
-migrate.cancel_migrating_confirm=この移行をキャンセルしますか？
-
 mirror_from=ミラー元
 forked_from=フォーク元
 generated_from=generated from
@@ -2624,9 +2594,7 @@ settings.wiki_globally_editable = 誰でもWikiを編集できる様にする
 settings.confirmation_string = 確認
 settings.wiki_rename_branch_main_notices_1 = この操作は 取り消し<strong>できません</strong> 。
 stars = スター
-n_tag_few = %s のタグ
 settings.graphql_url = GraphQL URL
-n_branch_one = %s のブランチ
 settings.units.units = 機能設定
 settings.wiki_rename_branch_main_notices_2 = これにより、%s のリポジトリ wiki の内部ブランチの名前が永久に変更されます。既存のチェックアウトを更新する必要があります。
 settings.sourcehut_builds.access_token_helper = JOBS:RW 権限を持つアクセス トークン。meta.sr.ht で <a target="_blank" rel="noopener noreferrer" href="%s">builds.sr.ht トークン</a> または <a target="_blank" rel="noopener noreferrer" href="%s">シークレット アクセスを持つ builds.sr.ht トークン</a> を生成します。
@@ -2638,9 +2606,6 @@ open_with_editor = %s で開く
 release.system_generated = この添付ファイルは自動的に生成されます。
 settings.archive.mirrors_unavailable = リポジトリがアーカイブされている場合、ミラーは利用できません。
 settings.rename_branch_failed_protected = 保護されたブランチのため、ブランチ %s の名前を変更できません。
-n_tag_one = %s のタグ
-n_branch_few = %s のブランチ
-n_commit_few = %s のコミット
 settings.confirm_wiki_branch_rename = Wikiブランチの名前を変更する
 settings.add_collaborator_blocked_our = リポジトリ所有者が共同作業者をブロックしているため、共同作業者を追加できません。
 settings.sourcehut_builds.visibility = ジョブの可視性
@@ -2648,7 +2613,6 @@ settings.sourcehut_builds.secrets = シークレット
 settings.ignore_stale_approvals_desc = 古いコミット (古いレビュー) に対して行われた承認を、PR の承認数にカウントしないでください。古いレビューがすでに却下されている場合は関係ありません。
 settings.enforce_on_admins_desc = リポジトリ管理者はこのルールを回避できません。
 release.hide_archive_links = 自動生成されたアーカイブを非表示にする
-n_commit_one = %s のコミット
 settings.wiki_branch_rename_success = リポジトリ wiki のブランチ名が正常に正規化されました。
 settings.add_collaborator_blocked_them = リポジトリ所有者がブロックされているため、共同作業者を追加できません。
 settings.add_webhook.invalid_path = パスには「.」や「..」や空の文字列を含めることはできません。また、スラッシュで開始または終了することはできません。
@@ -2683,8 +2647,6 @@ issues.edit.already_changed = イシューの変更を保存できません。
 no_eol.text = EOLなし
 pulls.edit.already_changed = プルリクエストの変更を保存できません。コンテンツは既に別のユーザーによって変更されているようです。変更が上書きされないように、ページを更新して再度編集してください
 pulls.cmd_instruction_merge_warning = <b>警告:</b> このリポジトリでは「手動マージの自動検出」設定が有効になっていません。後でこのプル リクエストを手動でマージ済みとしてマークする必要があります。
-n_release_one = %s リリース
-n_release_few = %s リリース
 milestones.filter_sort.name = 名前
 mirror_use_ssh.not_available = SSH認証は利用できません。
 mirror_denied_combination = 公開鍵とパスワードベースの認証を組み合わせて使用することはできません。
@@ -2927,34 +2889,6 @@ dashboard.sync_external_users=外部ユーザーデータの同期
 dashboard.cleanup_hook_task_table=hook_taskテーブルのクリーンアップ
 dashboard.cleanup_packages=期限切れパッケージのクリーンアップ
 dashboard.cleanup_actions=Actionsから期限切れのログとアーティファクトのクリーンアップする
-dashboard.server_uptime=サーバーの稼働時間
-dashboard.current_goroutine=現在のGoroutine数
-dashboard.current_memory_usage=現在のメモリ使用量
-dashboard.total_memory_allocated=メモリ割当量の累計
-dashboard.memory_obtained=メモリ取得量
-dashboard.pointer_lookup_times=ポインタ参照回数
-dashboard.memory_allocate_times=メモリ割当回数
-dashboard.memory_free_times=メモリ解放回数
-dashboard.current_heap_usage=現在のヒープ使用量
-dashboard.heap_memory_obtained=ヒープ用メモリ取得量
-dashboard.heap_memory_idle=未使用のヒープ容量
-dashboard.heap_memory_in_use=使用中のヒープ容量
-dashboard.heap_memory_released=解放済みヒープ容量
-dashboard.heap_objects=ヒープオブジェクト数
-dashboard.bootstrap_stack_usage=スタック使用量
-dashboard.stack_memory_obtained=スタック用メモリ取得量
-dashboard.mspan_structures_usage=MSpan構造体の使用量
-dashboard.mspan_structures_obtained=MSpan構造体用取得量
-dashboard.mcache_structures_usage=MCache構造体の使用量
-dashboard.mcache_structures_obtained=MCache構造体用取得量
-dashboard.profiling_bucket_hash_table_obtained=バケットハッシュテーブルのプロファイリング割当量
-dashboard.gc_metadata_obtained=GCメタデータ用取得量
-dashboard.other_system_allocation_obtained=その他システム割当用取得量
-dashboard.next_gc_recycle=次回のGCリサイクル
-dashboard.last_gc_time=前回GCからの時間
-dashboard.total_gc_pause=GC停止時間の合計
-dashboard.last_gc_pause=前回のGC停止時間
-dashboard.gc_times=GC実行回数
 dashboard.delete_old_actions=データベースから古い操作履歴をすべて削除
 dashboard.delete_old_actions.started=データベースからの古い操作履歴の削除を開始しました。
 dashboard.update_checker=更新チェック
@@ -3011,18 +2945,6 @@ users.purge_help=強制的にユーザーとそのユーザーが所有してい
 users.still_own_packages=このユーザーはまだ1つ以上のパッケージを所有しています。先にそれらのパッケージを削除してください。
 users.deletion_success=ユーザーアカウントを削除しました。
 users.reset_2fa=2要素認証をリセット
-users.list_status_filter.menu_text=フィルター
-users.list_status_filter.reset=リセット
-users.list_status_filter.is_active=有効
-users.list_status_filter.not_active=無効
-users.list_status_filter.is_admin=管理者
-users.list_status_filter.not_admin=非管理者
-users.list_status_filter.is_restricted=制限あり
-users.list_status_filter.not_restricted=制限なし
-users.list_status_filter.is_prohibit_login=ログインを禁止
-users.list_status_filter.not_prohibit_login=ログインを許可
-users.list_status_filter.is_2fa_enabled=2要素認証有効
-users.list_status_filter.not_2fa_enabled=2要素認証無効
 users.details=ユーザーの詳細
 
 emails.email_manage_panel=ユーザーのメールアドレスを管理
@@ -3342,26 +3264,6 @@ monitor.process.cancel_desc=処理をキャンセルするとデータが失わ
 monitor.process.cancel_notices=キャンセル: <strong>%s</strong>?
 monitor.process.children=子プロセス
 
-monitor.queues=キュー
-monitor.queue=キュー: %s
-monitor.queue.name=キュー名
-monitor.queue.type=種類
-monitor.queue.exemplar=要素の型
-monitor.queue.numberworkers=ワーカー数
-monitor.queue.activeworkers=使用ワーカー数
-monitor.queue.maxnumberworkers=ワーカー数上限
-monitor.queue.numberinqueue=キュー内の数
-monitor.queue.review_add=ワーカーの確認 / 追加
-monitor.queue.settings.title=プール設定
-monitor.queue.settings.desc=プールはワーカーキューの待機状態に応じて動的に大きくなります。
-monitor.queue.settings.maxnumberworkers=ワーカー数上限
-monitor.queue.settings.maxnumberworkers.placeholder=現在の設定 %[1]d
-monitor.queue.settings.maxnumberworkers.error=ワーカー数上限は数値にしてください
-monitor.queue.settings.submit=設定を更新
-monitor.queue.settings.changed=設定を更新しました
-monitor.queue.settings.remove_all_items=すべて削除
-monitor.queue.settings.remove_all_items_done=キュー内のすべての項目を削除しました。
-
 notices.system_notice_list=システム通知
 notices.view_detail_header=通知の詳細
 notices.operations=操作
@@ -3507,20 +3409,6 @@ workflow.disabled=ワークフローは無効です。
 
 need_approval_desc=フォークプルリクエストのワークフローを実行するには承認が必要です。
 
-variables=変数
-variables.management=変数の管理
-variables.creation=変数の追加
-variables.none=変数はまだありません。
-variables.deletion=変数を削除
-variables.deletion.description=変数の削除は恒久的で元に戻すことはできません。 続行しますか？
-variables.description=変数は特定のActionsに渡されます。 それ以外で読み出されることはありません。
-variables.edit=変数の編集
-variables.deletion.failed=変数を削除できませんでした。
-variables.deletion.success=変数を削除しました。
-variables.creation.failed=変数を追加できませんでした。
-variables.creation.success=変数 "%s" を追加しました。
-variables.update.failed=変数を更新できませんでした。
-variables.update.success=変数を更新しました。
 variables.id_not_exist = idが%dの変数は存在しません。
 workflow.dispatch.run = ワークフローを実行
 workflow.dispatch.success = ワークフローの実行が正常にリクエストされました。
@@ -3530,7 +3418,6 @@ workflow.dispatch.input_required = 入力 "%s" に値が必要です。
 workflow.dispatch.invalid_input_type = 入力タイプ「%s」が無効です。
 workflow.dispatch.warn_input_limit = 最初の %d 個の入力のみを表示します。
 runs.expire_log_message = ログは古すぎるため消去されています。
-variables.not_found = 変数が見つかりませんでした。
 runs.no_workflows.help_no_write_access = Forgejoアクションの詳細については、<a target="_blank" rel="noopener noreferrer" href="%s">ドキュメント</a>を参照してください。
 runs.no_workflows.help_write_access = Forgejo アクションの始め方がわからない場合は、<a target="_blank" rel="noopener noreferrer" href="%s">ユーザードキュメントのクイック スタート</a>を参照して最初のワークフローを作成し、次に <a target="_blank" rel="noopener noreferrer" href="%s">Forgejo ランナーをセットアップ</a>してジョブを実行して下さい。
 
@@ -3582,9 +3469,6 @@ union = フレーズ一致
 [munits.data]
 
 [markup]
-filepreview.lines = %[3]s の %[1]d 行目から %[2]d 行目
-filepreview.line = %[2]s の %[1]d 行目
-filepreview.truncated = プレビューは途中から省略されています
 
 [repo.permissions]
 actions.write = <b>書き込み:</b> 保留中の CI/CD パイプラインを手動でトリガー、再起動、キャンセル、または承認します。
diff --git a/options/locale/locale_ka.ini b/options/locale/locale_ka.ini
index 8e47c125b8..d99ab6a667 100644
--- a/options/locale/locale_ka.ini
+++ b/options/locale/locale_ka.ini
@@ -285,10 +285,6 @@ template.webhooks = ვებჰუკები
 template.topics = თემები
 template.avatar = ავატარი
 need_auth = ავტორიზაცია
-migrate_items_wiki = ვიკი
-migrate_items_labels = ჭდეები
-migrate_items_issues = პრობლემები
-migrate_items_releases = რელიზები
 star = ვარსკვლავი
 unstar = ვარსკვლავის მოხსნა
 fork = ფორკი
@@ -579,7 +575,6 @@ diff.vendored = გარედან შემოტანილია
 release.edit = ჩასწორება
 release.type_attachment = მიმაგრებული ფაილი
 topic.done = დასრულება
-migrate_items_milestones = მისაღწევი გეგმები
 issues.subscribe = გამოწერა
 issues.review.outdated = ვადაგადაცილებული
 activity.merged_prs_label = შერწყმულია
@@ -646,10 +641,6 @@ users.repos = რეპოები
 users.created = შეიქმნა
 users.edit = ჩასწორება
 users.local = ლოკალური
-users.list_status_filter.reset = ჩამოყრა
-users.list_status_filter.is_active = აქტიურია
-users.list_status_filter.is_admin = ადმინი
-users.list_status_filter.is_restricted = შეზღუდული
 emails.primary = ძირითადი
 emails.activated = გააქტიურებულია
 emails.filter_sort.email = ელფოსტა
@@ -700,17 +691,12 @@ monitor.stacktrace = სტეკის დატრეისება
 monitor.desc = აღწერა
 monitor.last_execution_result = შედეგი
 monitor.process.children = შვილები
-monitor.queues = რიგები
-monitor.queue.name = სახელი
-monitor.queue.type = ტიპი
 notices.operations = ოპერაციები
 notices.type = ტიპი
 notices.type_1 = რეპოზიტორია
 notices.type_2 = ამოცანა
 notices.desc = აღწერა
 notices.op = ოპ.
-users.list_status_filter.menu_text = ფილტრი
-users.list_status_filter.not_active = არააქტიურია
 config.send_test_mail_submit = გაგზავნა
 packages.creator = შემქმნელი
 dashboard.operation_switch = გადართვა
@@ -743,7 +729,6 @@ owner.settings.cleanuprules.enabled = ჩართულია
 secrets = საიდუმლოები
 
 [actions]
-variables = ცვლადები
 
 [git.filemode]
 directory = საქაღალდე
diff --git a/options/locale/locale_kab.ini b/options/locale/locale_kab.ini
index c391e55c1c..71d7d508a1 100644
--- a/options/locale/locale_kab.ini
+++ b/options/locale/locale_kab.ini
@@ -76,7 +76,6 @@ return_to_forgejo = Tuɣalin ɣer Forgejo
 twofa = Asesteb s snat n tarrayin
 filter.not_template = Mačči d timudmiwin
 admin_panel = Tadbelt n wesmel
-
 add_all = Rnu-ten akk
 remove_all = Kkes-iten akk
 
@@ -116,13 +115,12 @@ create_new_team = Agraw amaynut
 create_team = Snulfu-d yiwen n ugraw
 team_name = Isem n ugraw
 settings = Iɣewwaren
-
+members.private_helper = Err-it ad yettban
 teams = Tirebbuyaɛ
 lower_members = Iɛeggalen
 team_permission_desc = Tasiregt
-members.private_helper = Err-it ad yettban
-teams.update_settings = Leqqem iɣewwaren
 teams.delete_team = Kkes tarbaɛt
+teams.update_settings = Leqqem iɣewwaren
 teams.delete_team_title = Kkes tarbaɛt
 
 [repo]
@@ -149,8 +147,6 @@ desc.sha256 = SHA256
 template.topics = Isental
 template.avatar = Avaṭar
 sync_fork.button = Mtawi
-migrate_items_wiki = Wiki
-migrate_items_labels = Tibzimin
 tags = Tibzimin
 project = Isenfaren
 packages = Ikemmusen
@@ -178,7 +174,6 @@ projects.title = Azwel
 projects.type.none = Ula yiwen
 projects.template.desc = Tamudemt
 mirror_sync = yemtawa
-migrate_items_issues = Uguren
 star = Rnu-yas itri
 branches = Tiṣeḍwa
 issues = Uguren
@@ -380,17 +375,16 @@ settings.basic_settings = Iɣewwaren n taffa
 settings.tracker_issue_style.alphanumeric = Agmumḍin
 settings.tracker_issue_style.numeric = Umḍin
 settings.teams = Igrawen
-
 visibility_helper = Err akufi d uslig
 issues.filter_poster_no_select = Akk imeskaren
 activity.git_stats_author_1 = %d n umeskar
 activity.git_stats_author_n = %d n imeskaren
 settings.packagist_api_token = Tiddest API
-diff.git-notes.add = Rnu tazmilt
-diff.git-notes.remove-header = Kkes tazmilt
 diff.view_file = Wali afaylu
 diff.show_more = Wali ugar
 diff.comment.add_review_comment = Rnu awennit
+diff.git-notes.add = Rnu tazmilt
+diff.git-notes.remove-header = Kkes tazmilt
 
 [install]
 admin_password = Awal n uɛeddi
@@ -430,7 +424,6 @@ auths.name = Isem
 config.db_name = Isem
 config.mailer_name = Isem
 monitor.name = Isem
-monitor.queue.name = Isem
 repositories = Ikufan
 dashboard = Tafelwit n usenqed
 organizations = Tuddsiwin
@@ -448,7 +441,6 @@ orgs.teams = Igrawen
 orgs.members = Imttekkiyen
 repos.owner = Bab-is
 config.mailer_user = Aseqdac
-users.list_status_filter.is_admin = Anedbal
 users.admin = Anedbal
 repos.size = Tiddi
 packages.owner = Bab-is
@@ -473,26 +465,22 @@ config.mailer_smtp_port = Tawwurt n SMTP
 config.mailer_use_sendmail = Seqdec Sendmail
 config.https_only = HTTPS kan
 config.git_config = Tawila n Git
-monitor.queue.settings.remove_all_items = Kkes-iten akk
-
+auths.oauth2_profileURL = URL n umaɣnu
 users.update_profile = Leqqem amiḍan n useqdac
-users.list_status_filter.is_active = D urmid
-users.list_status_filter.not_active = D arurmid
 auths.type = Anaw
 auths.enabled = D urmid
 auths.host = Asenneftaɣ
 auths.port = Tawwurt
-auths.oauth2_profileURL = URL n umaɣnu
 config.ssh_port = Tawwurt
 config.lfs_enabled = D urmid
 config.db_type = Anaw
 config.db_host = Asenneftaɣ
 config.db_schema = Azenziɣ
 config.db_path = Abrid
-config.enable_captcha = Sermed CAPTCHA
 config.mailer_enabled = D urmid
 config.mailer_protocol = Aneggaf
 monitor.stats = Tiddadanin
+config.enable_captcha = Sermed CAPTCHA
 notices.select_all = Fren-iten akk
 
 [search]
@@ -697,15 +685,14 @@ permissions_public_only = Azayez kan
 oauth2_application_name = Isem n usnas
 delete_account = Kkes amiḍan-ik
 quota.sizes.git.all = Agbur deg Git
-
 public_profile = Amaɣnu azayaz
-keep_activity_private = Ffer armud s ufella usebter n umaɣnu
-keep_email_private = Ffer tansa n yimayl
 show_openid = Sken-it-id ɣef umaɣnu
 hide_openid = Ffer-it s ufella umaɣnu
+keep_activity_private = Ffer armud s ufella usebter n umaɣnu
+keep_email_private = Ffer tansa n yimayl
+quota.sizes.repos.private = Ikufan usligen
 create_oauth2_application_button = Snulfu-d asnas
 oauth2_client_id = Asulay ID n wemsaɣ
-quota.sizes.repos.private = Ikufan usligen
 
 [packages]
 
@@ -726,7 +713,6 @@ years = %d n iseggasen
 1mon = 1 n wayyur
 1y = 1 n useggas
 1d = 1 n wass
-
 now = tura
 raw_seconds = tasinin
 raw_minutes = tesdatin
diff --git a/options/locale/locale_ko-KR.ini b/options/locale/locale_ko-KR.ini
index 5409c84818..7d8ddcf5b6 100644
--- a/options/locale/locale_ko-KR.ini
+++ b/options/locale/locale_ko-KR.ini
@@ -88,31 +88,19 @@ toc = 목차
 licenses = 라이센스
 return_to_forgejo = Forgejo로 돌아가기
 access_token = 액세스 토큰
-webauthn_error_unable_to_process = 서버가 귀하의 요청을 처리할 수 없습니다.
-webauthn_error_duplicated = 이 요청에는 보안 키가 허용되지 않습니다. 키가 이미 등록되어 있는지 확인하세요.
 remove_label_str = "%s" 항목 제거
 disabled = 비활성화됨
 locked = 잠김
 filter = 필터
 filter.not_fork = 포크가 아님
 filter.is_mirror = 미러
-webauthn_press_button = 보안 키의 버튼을 누르세요…
 toggle_menu = 토글 메뉴
-webauthn_error = 보안 키를 읽을 수 없습니다.
-webauthn_unsupported_browser = 현재 귀하의 브라우저는 웹 인증을 지원하지 않습니다.
-webauthn_insert_key = 보안 키를 입력하세요
-webauthn_sign_in = 보안 키에 있는 버튼을 누르세요. 만약 보안 키에 버튼이 없다면 다시 입력하세요.
-webauthn_use_twofa = 휴대전화 2단계 코드 사용
 retry = 다시 시도하기
 rerun = 다시 실행하기
 rerun_all = 모든 작업을 다시 실행하기
 copy = 복사
 new_project_column = 새 열
 more_items = 더 보기
-webauthn_error_unknown = 알 수 없는 오류가 발생했습니다. 다시 시도해주세요.
-webauthn_error_insecure = 웹 인증은 안전한 연결만 지원합니다. HTTP에서 테스트할 경우, "localhost" 또는 "127.0.0.1" 오리진을 사용할 수 있습니다.
-webauthn_error_empty = 키의 이름을 설정해야 합니다.
-webauthn_error_timeout = 키를 읽기 전에 시간이 초과되었습니다. 페이지를 새로 고치고 다시 시도해주세요.
 copy_generic = 클립보드에 복사
 copy_url = URL 복사
 copy_hash = 해시 복사
@@ -387,7 +375,7 @@ allow_password_change=사용자에게 비밀번호 변경을 요청 (권장됨)
 reset_password_mail_sent_prompt=확인 메일이 <b>%s</b>로 전송되었습니다. 받은 편지함으로 도착한 메일을 %s 안에 확인해서 비밀번호 찾기 절차를 완료하십시오.
 active_your_account=계정 활성화
 account_activated=계정이 활성화 되었습니다
-prohibit_login =
+prohibit_login = 
 resent_limit_prompt=활성화를 위한 이메일을 이미 전송했습니다. 3분 내로 이메일을 받지 못한 경우 재시도해주세요.
 has_unconfirmed_mail=안녕하세요 %s, 이메일 주소(<b>%s</b>)가 확인되지 않았습니다. 확인 메일을 받으시지 못하겼거나 새로운 확인 메일이 필요하다면, 아래 버튼을 클릭해 재발송하실 수 있습니다.
 resend_mail=여기를 눌러 확인 메일 재전송
@@ -752,11 +740,6 @@ template.avatar=아바타
 
 
 
-migrate_items_wiki=위키
-migrate_items_milestones=마일스톤
-migrate_items_issues=이슈
-migrate_items_pullrequests=풀 리퀘스트
-migrate_items_releases=릴리즈
 migrate_repo=저장소 마이그레이션
 migrate.clone_address=URL로 부터 마이그레이트 / 클론
 migrate.clone_local_path=또는 로컬 서버의 경로
@@ -1476,35 +1459,6 @@ dashboard.operation_switch=스위치
 dashboard.operation_run=실행
 dashboard.git_gc_repos=모든 저장소 가비지 콜렉트
 dashboard.sync_external_users=외부 사용자 데이터 동기화
-dashboard.server_uptime=서버를 켠 시간
-dashboard.current_goroutine=현재 Go루틴
-dashboard.current_memory_usage=현재 메모리 사용율
-dashboard.total_memory_allocated=전체 할당 메모리
-dashboard.memory_obtained=메모리 확보
-dashboard.pointer_lookup_times=포인터 조회 시간
-dashboard.memory_allocate_times=사용 메모리
-dashboard.memory_free_times=가용 메모리
-dashboard.current_heap_usage=현재 힙 사용현황
-dashboard.heap_memory_obtained=힙 메모리 확보
-dashboard.heap_memory_idle=힙 메모리 유휴
-dashboard.heap_memory_in_use=힙 메모리 사용중
-dashboard.heap_memory_released=힙 메모리 풀림
-dashboard.heap_objects=힙 객체
-dashboard.bootstrap_stack_usage=부트스트랩 스택 사용현황
-dashboard.stack_memory_obtained=스택 메모리 확보
-dashboard.mspan_structures_usage=MSpan 구조 사용현황
-dashboard.mspan_structures_obtained=MSpan 구조 확보
-dashboard.mcache_structures_usage=MCache 구조 사용현황
-dashboard.mcache_structures_obtained=MCache 구조 확보
-dashboard.profiling_bucket_hash_table_obtained=버켓 해시 테이블 확보 프로파일링
-dashboard.gc_metadata_obtained=가비지 콜렉션 메타 데이터 확보
-dashboard.other_system_allocation_obtained=기타 시스템 할당 확보
-dashboard.next_gc_recycle=다음 가비지 콜렉션 순환
-dashboard.last_gc_time=마지막 가비지 콜렉션 시간
-dashboard.total_gc_pause=모든 가비지 콜렉션 중지
-dashboard.last_gc_pause=마지막 가비지 콜렉션 중지
-dashboard.gc_times=가비지 콜렉션 시간
-
 users.user_manage_panel=사용자 계정 관리
 users.new_account=사용자 계정 생성
 users.name=사용자명
@@ -1533,9 +1487,6 @@ users.allow_create_organization=조직 생성 허용
 users.update_profile=사용자 계정 갱신
 users.delete_account=사용자 계정 삭제
 users.deletion_success=사용자 계정이 삭제되었습니다.
-users.list_status_filter.is_active=사용
-users.list_status_filter.is_admin=관리자
-
 emails.activated=활성화됨
 
 orgs.org_manage_panel=조직 관리
@@ -1730,10 +1681,6 @@ monitor.desc=설명
 monitor.start=시작 시간
 monitor.execute_time=실행 시간
 
-monitor.queue.name=이름
-monitor.queue.type=유형
-monitor.queue.settings.submit=설정 업데이트
-
 notices.system_notice_list=시스템 공지
 notices.view_detail_header=알림 세부정보 보기
 notices.select_all=모두 선택
diff --git a/options/locale/locale_kw.ini b/options/locale/locale_kw.ini
index 99ddd47efc..ac8dd8a41a 100644
--- a/options/locale/locale_kw.ini
+++ b/options/locale/locale_kw.ini
@@ -16,8 +16,6 @@ powered_by = Gallosegys gans %s
 page = Folen
 template = Ensampel
 notifications = Gwarnyansow
-active_stopwatch = Hedheuryer byw
-tracked_time_summary = Berrskrif a dermyn helerghys selys war sidhlow a rol kudynnow
 create_new = Gwruthyl…
 user_profile_and_more = Profil ha settyansow…
 signed_in_as = Omgelmys avel
@@ -36,18 +34,6 @@ captcha = CAPTCHA
 twofa = Gwirheans dewkamm
 twofa_scratch = Kod kravas dewkamm
 passcode = Kod-tremena
-webauthn_insert_key = Gorra a-bervedh agas alhwedh sawder
-webauthn_sign_in = Tavewgh an boton war agas alhwedh sawder. Mar nyns eus boton, gorrewgh a-bervedh arta.
-webauthn_press_button = Mar pleg gwaskewgh an boton war agas alhwedh sawder…
-webauthn_use_twofa = Devnydhyer kod dewkamm dhyworth agas klapkodh
-webauthn_error = Ny yllir redya agas alhwedh sawder.
-webauthn_unsupported_browser = Ny skoodhya a-lemmyn agas peurell WebAuthn.
-webauthn_error_unknown = Yth esa error ankoth. Mar pleg assayewgh arta.
-webauthn_error_insecure = WebAuthn a skoodh junyans saw yn unnik. Rag ow previ dres HTTP. ty a yll devnydhya an devedhyans "localhost" po "127.0.0.1"
-webauthn_error_unable_to_process = Ny yllir an servell argerdhes agas govyn.
-webauthn_error_duplicated = Nyns yw an alhwedh sawder gesys rag an govyn ma. Mar pleg, surhewgh nyns yw an alhwedh kovskrifys seulabrys.
-webauthn_error_empty = Res yw dhywgh settya hanow rag an alhwedh ma.
-webauthn_error_timeout = Termyn yn-mes hedhys kyns agas alhwedh y hyllys redys. Daskargewgh an folen ma mar pleg hag assayewgh arta.
 repository = Gwithva
 new_fork = Forgh gwithva nowydh
 new_project_column = Koloven nowydh
@@ -136,6 +122,8 @@ filter.is_template = Ensamplys
 filter.not_template = Na ensamplys
 filter.public = Poblek
 filter.private = Privedh
+active_stopwatch = Hedheuryer byw
+tracked_time_summary = Berrskrif a dermyn helerghys selys war sidhlow a rol kudynnow
 
 [search]
 search = Hwilas…
@@ -690,7 +678,6 @@ change_username_prompt = Noten: Ow chanjya agas hanow devnydhyer a wra chanjya a
 change_username_redirect_prompt = An hanow devnydhyer koth a wra daskevarwodha ernag yma nebonan ow perghenegi.
 change_username_redirect_prompt.with_cooldown.one = An hanow devnydhyer koth a wra bos kavadow rag pubonan wosa termyn-mygla a %[1]d dydh. Hwi a yll dasberghenegi an hanow devnydhyer koth dres an termyn-mygla.
 change_username_redirect_prompt.with_cooldown.few = An hanow devnydhyer koth a wra bos kavadow rag pubonan wosa termyn-mygla a %[1]d dedhyow. Hwi a yll dasberghenegi an hanow devnydhyer koth dres an termyn-mygla.
-cancel = Hedhi
 language = Yeth
 language.title = Yeth defowt
 language.description = An yeth ma y fydh sawys dh'gas akont ha devnydhys avel an defowt wosa omgelmowgh.
@@ -711,10 +698,6 @@ comment_type_group_milestone = Men mildir
 comment_type_group_assignee = Charjyer
 comment_type_group_title = Titel
 comment_type_group_branch = Skorr
-comment_type_group_time_tracking = Hedheuryer
-comment_type_group_deadline = Diwedhva
-comment_type_group_dependency = Serghek
-comment_type_group_lock = Studh alhwedha
 comment_type_group_review_request = Govyn breusyans
 comment_type_group_pull_request_push = Gwriansow keworrys
 comment_type_group_project = Ragdres
@@ -773,7 +756,6 @@ keep_email_private = Kudha trigva ebost
 keep_email_private_popup = Trigva ebost ny vydh diskwedhys war'n folen profil ha ny vydh an defowt rag gwriansow gwrys ow tevnydhya an ynterfas gwi, kepar ha ughkargys restren, golegyansow, ha gwriansow kesunyans. Yn le, trigva arbennik a yll bos devnydhys rag kevrenna gwriansow dhe'n akont devnydhyer. An dewis ma ny vydh menni gwriansow gwrys seulabrys.
 keep_pronouns_private = Diskwedhes rakhenwyn dhe dhevnydhyoryon reythhes yn unnik
 keep_pronouns_private.description = Hemm a wra kudha agas rakhenwyn rag vysytyoryon anomgelmys.
-openid_desc = OpenID a asa hwi kanasa gwirheans dhe brovier a-ves.
 manage_ssh_keys = Dyghtya alhwedhow SSH
 manage_ssh_principals = Dyghtya Penntestskifow SSH
 manage_gpg_keys = Dyghtya Alhwedhow GPG
@@ -781,6 +763,32 @@ add_key = Keworra alhwedh
 ssh_desc = An alhwedhow poblek SSH ma yw kowethys gans agas akont. An alhwedhow privedh a omdhesedh gasa hedhas leun dhe agas gwithvaow. Alhwedhow SSH gwirhes a yll bos devnydhys rag gwirhe gwriansow Git sinys gans SSH.
 principal_desc = An penntestskrifow SSH ma yw kowethys gans agas akont ha gasa hedhas leun dh'gas gwithvaow.
 gpg_desc = An alhwedhow poblek GPG yw kowethys gans agas akont ha yw devnydhys rag gwirhe dha gwriansow. Gwitha saw agas alhwedhow privedh drefen gasons i rag sina gwriansow gans agas honanieth.
+webauthn_nickname = Leshanow
+delete_account = Dilea agas akont
+confirm_delete_account = Afydhya dileyans
+delete_account_title = Dilea akont devnydhyer
+delete_account_desc = Owgh hwi sur mynnowgh dilea an akont devnydhyer ma yn andileadow?
+email_notifications.enable = Bywhe gwarnyansow ebost
+visibility = Gweladewder devnydhyer
+visibility.public = Poblek
+visibility.public_tooltip = Gweladow rag oll
+visibility.limited = Strothys
+visibility.limited_tooltip = Gweladow rag devnydhyoryon omgelmys yn unnik
+visibility.private = Privedh
+visibility.private_tooltip = Gweladow yn unnik rag eseli a gowethyansow may rann owgh hwi
+blocked_since = Lettys a-dhia %s
+user_unblock_success = An devnydhya re beu dilettys yn sewen.
+user_block_success = An devnydhya re beu lettys yn sewen.
+user_block_yourself = Ny yllowgh lettya agas honan.
+quota.sizes.assets.artifacts = Eskorransow
+quota.sizes.assets.packages.all = Fardellow
+quota.sizes.wiki = Wiki
+cancel = Hedhi
+comment_type_group_time_tracking = Hedheuryer
+comment_type_group_deadline = Diwedhva
+comment_type_group_dependency = Serghek
+comment_type_group_lock = Studh alhwedha
+openid_desc = OpenID a asa hwi kanasa gwirheans dhe brovier a-ves.
 ssh_helper = <strong>Eus edhom dhywgh a weres?</strong> Gwelewgh an kowethlyver rag <a href="%s">gwruthyl agas honan alhwedhow SSH</a> po digelmi <a href="%s">kudynnow kemmyn</a> gans ow tevnydhya SSH.
 gpg_helper = <strong>Eus edhom dhywgh a weres?</strong> Gwelewgh an kowethlyver rag <a href="%s">a-dro dhe GPG</a>.
 key_content_ssh_placeholder = Dalleth gans "ssh-ed25519", "ssh-rsa", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "sk-ecdsa-sha2-nistp256@openssh.com", po "sk-ssh-ed25519@openssh.com"
@@ -790,11 +798,8 @@ ssh_key_name_used = Yma alhwedh SSH gans an hanow keth war agas akont seulabrys.
 gpg_key_id_used = Yma alhwedh GPG poblek gans an ID keth seulabrys.
 gpg_no_key_email_found = An alhwedh GPG ma ny omdhesedha neb trigva ebost byw kowethys gans agas akont. Possybyl yw rag keworra mar sinewgh an tokyn provys.
 gpg_key_matched_identities = Honaniethow Omdhesedhys:
-gpg_key_matched_identities_long = An honaniethow a-bervedh y'n alhwedh ma a omdhesedh an trigvaow ebost byw a sew rag an devnydhyer ma. Gwriansow a omdhesedh an trigvaow ebost ma a yll bos gwirhys gans an alhwedh ma.
 gpg_key_verified = Alhwedh gwirhys
-gpg_key_verified_long = Alhwedh re beu gwirhys gans tokyn ha'n alhwedh ma a yll bos devnydhys rag gwirhe gwriansow a omdhesedh neb trigvaow ebost byw rag an devnydhyer ma ha neb honaniethow omdhesedhys rag an alwhedh ma.
 gpg_key_verify = Gwirhe
-gpg_invalid_token_signature = An alhwedh GPG provys, sinans ha tokyn ny omdhesedha po tokyn yw anterrus.
 gpg_token_required = Yma edhom dhywgh provia sinans rag an tokyn a-woles
 gpg_token = Tokyn
 gpg_token_help = Hwi a yll dinythi sinans ow tevnydhya:
@@ -802,9 +807,7 @@ gpg_token_signature = Sinans GPG arvwiskys
 key_signature_gpg_placeholder = Dalleth gans "-----BEGIN PGP SIGNATURE-----"
 verify_gpg_key_success = Alhwedh GPG "%s" re beu gwirhys.
 ssh_key_verified = Alhwedh gwirhys
-ssh_key_verified_long = Alhwedh re beu gwirhys gans tokyn ha'n alhwedh ma a yll bos devnydhys rag gwirhe gwriansow a omdhesedh neb trigvaow ebost byw rag an devnydhyer ma.
 ssh_key_verify = Gwirhe
-ssh_invalid_token_signature = An alhwedh SSH provys, sinans, po tokyn ny omdhesedha po tokyn yw anterrus.
 ssh_token_required = Yma edhom dhywgh provia sinans rag an tokyn a-woles
 ssh_token = Tokyn
 ssh_token_help = Hwi a yll dinythi sinans ow tevnydhya:
@@ -822,8 +825,6 @@ add_gpg_key_success = An alhwedh GPG "%s" re beu keworrys.
 delete_key = Remova
 ssh_key_deletion = Remova alhwedh SSH
 gpg_key_deletion = Remova alhwedh GPG
-ssh_key_deletion_desc = Ow tilea alhwedh SSH a wra remova an hedhas dh'gas akont. Pesya?
-gpg_key_deletion_desc = Ow tilea alhwedh GPG an digwirhys gwriansow sinys dhir. Pesya?
 ssh_key_deletion_success = An alhwedh SSH re beu removys.
 gpg_key_deletion_success = An alhwedh GPG re beu removys.
 added_on = Keworrys %s
@@ -838,7 +839,6 @@ token_state_desc = An tokyn ma re beu devnydhys y'n 7 dedhyow yw passys
 show_openid = Diskwedhes war brofil
 hide_openid = Kudha rag profil
 ssh_disabled = SSH yw marow
-ssh_signonly = SSH yw marow a-lemmyn ytho an alhwedhow ma yw devnydhys rag gwirheans sinans gwrians hepken.
 ssh_externally_managed = An alhwedh SSH ma yw dyghtys a-ves rag an devnydhyer ma
 manage_access_token = Toknys hedhas
 generate_new_token = Dinythi tokyn nowydh
@@ -862,8 +862,6 @@ select_permissions = Dewis kummyasow
 permission_no_access = Hedhas vyth
 permission_read = Redya
 permission_write = Redya ha skrifa
-access_token_desc = Kummyasow tokyn dewisys a finweth reythheans dhe'n hensyow <a href="%[1]s" target="_blank">API</a> a omdhesedh. Redyewgh an <a href="%[2]s" target="_blank">kowethlyver</a> rag moy kedhlow.
-at_least_one_permission = Res yw dhywgh dewis unn kummyas dhe'n lyha rag gwruthyl tokyn
 permissions_list = Kummyasow:
 manage_oauth2_applications = Dyghtya appys OAuth2
 edit_oauth2_application = Golegi App OAuth2
@@ -874,23 +872,52 @@ create_oauth2_application_button = Gwruthyl app
 create_oauth2_application_success = Hwi re gwrys appys OAuth2 nowydh yn sewen.
 update_oauth2_application_success = Hwi re nowedhys appys OAuth2 nowydh yn sewen.
 oauth2_application_name = Hanow app
-oauth2_confidential_client = Kliens kelfydhys. Dewis rag appys ow kwitha an kevrin kelfydhys, kepar hag appys gwi. Na dewisewgh rag appys teythiek ow synsi appys rag amontyellow ha klapkodhow.
-oauth2_redirect_uris = Daskevarwodha URIs. Devnydhyewgh linen nowydh rag pub URI mar pleg.
 save_application = Sawya
 oauth2_client_id = ID Kliens
 oauth2_client_secret = Kevrin kliens
 oauth2_regenerate_secret = Dasdinythi kevrin
-oauth2_regenerate_secret_hint = Kellys agas kevrin?
 oauth2_application_edit = Golegi
+revoke_key = Remova
+revoke_oauth2_grant = Remova hedhas
+revoke_oauth2_grant_success = Hedhas removys yn sewen.
+twofa_disable_note = Hwi a yll marowhe gwirheans dewkamm mars yw res.
+or_enter_secret = Po ynworra an kevrin: %s
+then_enter_passcode = Hag ynworra an kod-tremena diskwedhys y'n app:
+passcode_invalid = Anewn yw an kod-tremena. Assayewgh arta.
+twofa_failed_get_secret = Ny yllir kerghes kevrin.
+webauthn_register_key = Keworra alhwedh sawder
+webauthn_delete_key = Remova alhwedh sawder
+manage_account_links = Akontys keskelmys
+link_account = Keskelmi akont
+remove_account_link = Remova akont keskelmys
+blocked_users_none = Nyns eus devnydhyoryon lettys.
+email_notifications.disable = Marowhe gwarnyansow ebost
+email_notifications.submit = Settya dewis ebost
+quota.sizes.all = Oll
+quota.sizes.repos.all = Gwithvaow
+quota.sizes.repos.public = Gwithvaow poblek
+quota.sizes.repos.private = Gwithvaow privedh
+quota.sizes.git.all = Synsas Git
+quota.sizes.git.lfs = Git LFS
+gpg_key_matched_identities_long = An honaniethow a-bervedh y'n alhwedh ma a omdhesedh an trigvaow ebost byw a sew rag an devnydhyer ma. Gwriansow a omdhesedh an trigvaow ebost ma a yll bos gwirhys gans an alhwedh ma.
+gpg_key_verified_long = Alhwedh re beu gwirhys gans tokyn ha'n alhwedh ma a yll bos devnydhys rag gwirhe gwriansow a omdhesedh neb trigvaow ebost byw rag an devnydhyer ma ha neb honaniethow omdhesedhys rag an alwhedh ma.
+gpg_invalid_token_signature = An alhwedh GPG provys, sinans ha tokyn ny omdhesedha po tokyn yw anterrus.
+ssh_key_verified_long = Alhwedh re beu gwirhys gans tokyn ha'n alhwedh ma a yll bos devnydhys rag gwirhe gwriansow a omdhesedh neb trigvaow ebost byw rag an devnydhyer ma.
+ssh_invalid_token_signature = An alhwedh SSH provys, sinans, po tokyn ny omdhesedha po tokyn yw anterrus.
+ssh_key_deletion_desc = Ow tilea alhwedh SSH a wra remova an hedhas dh'gas akont. Pesya?
+gpg_key_deletion_desc = Ow tilea alhwedh GPG an digwirhys gwriansow sinys dhir. Pesya?
+ssh_signonly = SSH yw marow a-lemmyn ytho an alhwedhow ma yw devnydhys rag gwirheans sinans gwrians hepken.
+access_token_desc = Kummyasow tokyn dewisys a finweth reythheans dhe'n hensyow <a href="%[1]s" target="_blank">API</a> a omdhesedh. Redyewgh an <a href="%[2]s" target="_blank">kowethlyver</a> rag moy kedhlow.
+at_least_one_permission = Res yw dhywgh dewis unn kummyas dhe'n lyha rag gwruthyl tokyn
+oauth2_confidential_client = Kliens kelfydhys. Dewis rag appys ow kwitha an kevrin kelfydhys, kepar hag appys gwi. Na dewisewgh rag appys teythiek ow synsi appys rag amontyellow ha klapkodhow.
+oauth2_redirect_uris = Daskevarwodha URIs. Devnydhyewgh linen nowydh rag pub URI mar pleg.
+oauth2_regenerate_secret_hint = Kellys agas kevrin?
 oauth2_application_create_description = Appys OAuth2 ri hedhas dhe akontys devnydhyer war'n weyth ma dh'gas app parti-tressa.
 oauth2_application_remove_description = Ow tilea app OAuth2 a wra lettya rag ow trehedhes akontys devnydhyer reythhys war'n weyth ma. Pesya?
 oauth2_application_locked = Forgejo a ragkovskrif neb appys OAuth2 dres dalleth mar byw yn selyans. Rag lettya fara anwaytys, an re ma ny yllir bos golegys po removys. Gwelewgh an kowethlyver OAuth2 mar pleg rag moy kedhlow.
 authorized_oauth2_applications = Appys OAuth2 reythhys
 authorized_oauth2_applications_description = Hwi re grontys hedhas dh'gas akont Forgejo personel dhe'n appys parti-tressa ma. Removewgh hedhas mar pleg rag appys yn devnydh na fella.
-revoke_key = Remova
-revoke_oauth2_grant = Remova hedhas
 revoke_oauth2_grant_description = Ow tilea hedhas rag an app parti-tressa ma a wra lettya an app ma rag ow trehedhes agas data. Owgh hwi sur?
-revoke_oauth2_grant_success = Hedhas removys yn sewen.
 twofa_desc = Rag gwitha agas akont rag ladrans ger-tremena, hwi a yll devnydhya klapkodh po devis aral rag ow tegemeres geryow-tremena unweyth termyn-selys ("TOTP").
 twofa_recovery_tip = Mar kellowgh agas devis, hwi a yll bos abel rag devnydhya alhwedh yaghheans undevnydh rag daskemeres hedhas dh'gas akont.
 twofa_is_enrolled = Agas akont yw <strong>rolys</strong> yn gwirheans dewkamm a-lemmyn.
@@ -899,57 +926,14 @@ twofa_disable = Marowhe gwirheans dewkamm
 twofa_scratch_token_regenerate = Dasdinythi alhwedh yaghheans undevnydh
 twofa_scratch_token_regenerated = Agas alhwedh undevnydh yw %s lemmyn. Gwithewgh yn le saw, ny vydh diskwedhys arta.
 twofa_enroll = Rolya yn gwirheans dewkamm
-twofa_disable_note = Hwi a yll marowhe gwirheans dewkamm mars yw res.
 twofa_disable_desc = Ow marowhe gwirheans dewkamm a wra disdiogeli agas akont. Pesya?
 regenerate_scratch_token_desc = Mar kellowgh agas alhwedh yaghheans po hwi re devnydhys seulabrys, hwi a yll dassettya omma.
 twofa_disabled = Gwirheans dewkamm re beu marowhys.
 scan_this_image = Arhwilasewgh an skeusen ma gans agas app reythheans:
-or_enter_secret = Po ynworra an kevrin: %s
-then_enter_passcode = Hag ynworra an kod-tremena diskwedhys y'n app:
-passcode_invalid = Anewn yw an kod-tremena. Assayewgh arta.
 twofa_enrolled = Agas akont re beu rolys yn sewen. Gwithewgh agas alhwedh yaghheans undevnydh yn le saw, ny vydh diskwedhys arta.
-twofa_failed_get_secret = Ny yllir kerghes kevrin.
-webauthn_register_key = Keworra alhwedh sawder
-webauthn_nickname = Leshanow
-webauthn_delete_key = Remova alhwedh sawder
-manage_account_links = Akontys keskelmys
-link_account = Keskelmi akont
-remove_account_link = Remova akont keskelmys
-blocked_users_none = Nyns eus devnydhyoryon lettys.
-delete_account = Dilea agas akont
-confirm_delete_account = Afydhya dileyans
-delete_account_title = Dilea akont devnydhyer
-delete_account_desc = Owgh hwi sur mynnowgh dilea an akont devnydhyer ma yn andileadow?
-email_notifications.enable = Bywhe gwarnyansow ebost
-email_notifications.disable = Marowhe gwarnyansow ebost
-email_notifications.submit = Settya dewis ebost
-visibility = Gweladewder devnydhyer
-visibility.public = Poblek
-visibility.public_tooltip = Gweladow rag oll
-visibility.limited = Strothys
-visibility.limited_tooltip = Gweladow rag devnydhyoryon omgelmys yn unnik
-visibility.private = Privedh
-visibility.private_tooltip = Gweladow yn unnik rag eseli a gowethyansow may rann owgh hwi
-blocked_since = Lettys a-dhia %s
-user_unblock_success = An devnydhya re beu dilettys yn sewen.
-user_block_success = An devnydhya re beu lettys yn sewen.
-user_block_yourself = Ny yllowgh lettya agas honan.
-quota.sizes.all = Oll
-quota.sizes.repos.all = Gwithvaow
-quota.sizes.repos.public = Gwithvaow poblek
-quota.sizes.repos.private = Gwithvaow privedh
-quota.sizes.git.all = Synsas Git
-quota.sizes.git.lfs = Git LFS
-quota.sizes.assets.artifacts = Eskorransow
-quota.sizes.assets.packages.all = Fardellow
-quota.sizes.wiki = Wiki
 
 [repo]
-admin.manage_flags = Dyghtya baneryow
-admin.enabled_flags = Baneryow bywhys rag an gwithva:
-admin.update_flags = Nowedhi baneryow
-admin.failed_to_replace_flags = Ny yllir aslea baneryow gwithva
-admin.flags_replaced = Baneryow gwithva asleys
+repo_name = Hanow gwithva
 new_repo_helper = Gwithva syns oll restrennow ragdres, ow synsi istori amendyans. Owth ostyowgh onan yn le aral seulabrys? <a href="%s">Divroa gwithva</a>.
 new_from_template = Devnydhya ensampel
 new_from_template_description = Hwi a yll dewis ensampel gwithva seulabrys war'n weyth ma ha gweytha an settyansow.
@@ -957,7 +941,6 @@ new_advanced = Settyansow avonsys
 new_advanced_expand = Klyckyewgh rag lesa
 owner = Perghen
 owner_helper = Martesen ny vydh nebes kowethyansow diskwedhes y'n rol drefen finweth somm gwithvaow moyha.
-repo_name = Hanow gwithva
 repo_name_helper = Henwyn gwithvaow da devnydh geryow alhwedh berr, hegov hag unnik.
 repo_size = Braster Gwithva
 size_format = %[1]s: %[2]s, %[3]s: %[4]s
@@ -966,6 +949,11 @@ template_select = Dewis ensampel
 template_helper = Gwruthyl an withva ma ensampel
 template_description = Gwithvaow ensampel gasa devnydhyoryon dinythi gwithvaow nowydh gans an kesweyth restrenva, restrennow, ha settyansow dre dhewis keth.
 visibility = Gweladewder
+admin.manage_flags = Dyghtya baneryow
+admin.enabled_flags = Baneryow bywhys rag an gwithva:
+admin.update_flags = Nowedhi baneryow
+admin.failed_to_replace_flags = Ny yllir aslea baneryow gwithva
+admin.flags_replaced = Baneryow gwithva asleys
 visibility_helper = Gwruthyl gwithva privedh
 all_branches = Oll skorrow
 use_template = Devnydhya an ensampel ma
@@ -989,4 +977,4 @@ mirror_use_ssh.text = Devnydhya gwirheans SSH
 mirror_sync = kettermynyegys
 mirror_lfs_endpoint = Diwedhva LFS
 mirror_password_placeholder = (Anchanjys)
-mirror_password_blank_placeholder = (Ansettys)
+mirror_password_blank_placeholder = (Ansettys)
\ No newline at end of file
diff --git a/options/locale/locale_lt.ini b/options/locale/locale_lt.ini
index 11fa4a0a4f..72a726f9f6 100644
--- a/options/locale/locale_lt.ini
+++ b/options/locale/locale_lt.ini
@@ -32,14 +32,6 @@ re_type = Patvirtinti slaptažodį
 twofa = Dvigubas tapatybės nustatymas
 twofa_scratch = Dvigubo ženklo kodas
 passcode = PIN kodas
-webauthn_sign_in = Paspauskite saugumo rakto mygtuką. Jei saugumo raktas neturi mygtuko, įkiškite jį iš naujo.
-webauthn_press_button = Paspauskite saugumo rakto mygtuką…
-webauthn_error = Nepavyko nuskaityti saugumo rakto.
-webauthn_unsupported_browser = Jūsų naršyklė šiuo metu nepalaiko „WebAuthn“.
-webauthn_error_unknown = Įvyko nežinoma klaida. Bandykite dar kartą.
-webauthn_error_unable_to_process = Serveris negalėjo apdoroti jūsų prašymo.
-webauthn_error_duplicated = Saugumo raktas neleidžiamas šiai prašymai. Įsitikinkite, kad raktas dar nėra užregistruotas.
-webauthn_error_empty = Turite nustatyti šio rakto pavadinimą.
 repository = Saugykla
 organization = Organizacija
 mirror = Dubliuojančioji tinklavietė
@@ -106,15 +98,11 @@ confirm_delete_artifact = Ar tikrai norite ištrinti artefaktą „%s“?
 archived = Archyvuota
 concept_system_global = Globalus
 enable_javascript = Šiai svetainei reikalingas „JavaScript“.
-webauthn_insert_key = Įkiškite savo saugumo raktą
-webauthn_use_twofa = Naudoti dvigubą kodą iš telefono
-webauthn_error_timeout = Baigėsi laikas, per kurį nebuvo galima nuskaityti rakto. Perkraukite šį puslapį ir bandykite dar kartą.
 your_starred = Pažymėti žvaigždutę
 remove = Pašalinti
 copy_generic = Kopijuoti į iškarpinę
 captcha = Saugos testas (CAPTCHA)
 your_profile = Profilis
-webauthn_error_insecure = „WebAuthn“ palaiko tik saugius ryšius. Bandymams per HTTP galite naudoti „localhost“ arba „127.0.0.0.1“.
 collaborative = Bendradarbiavimas
 home = Pagrindinis
 page = Puslapis
@@ -191,7 +179,6 @@ type-2.display_name = Saugyklos projektas
 type-3.display_name = Organizacijos projektas
 
 [markup]
-filepreview.truncated = Peržiūra buvo sutrumpinta
 
 [mail]
 reset_password.text = Jei tai buvote jūs, spustelėkite toliau esančią nuorodą, kad atkurtumėte savo paskyrą per <b>%s</b>:
diff --git a/options/locale/locale_lv-LV.ini b/options/locale/locale_lv-LV.ini
index 4ffc1d37a7..79a2e1a08f 100644
--- a/options/locale/locale_lv-LV.ini
+++ b/options/locale/locale_lv-LV.ini
@@ -37,18 +37,6 @@ twofa=Divpakāpju pieteikšanās
 twofa_scratch=Divpakāpju vienreiz izmantojamais kods
 passcode=Kods
 
-webauthn_insert_key=Jāievieto sava drošības atslēga
-webauthn_sign_in=Jānospiež poga uz drošības atslēgas. Ja tai nav pogas, drošības atslēga ir atkārtoti jāievieto.
-webauthn_press_button=Lūgums nospiest pogu uz savas drošības atslēgas…
-webauthn_use_twofa=Izmantot divpakāpju kodu no sava tālruņa
-webauthn_error=Nevar nolasīt drošības atslēgu.
-webauthn_unsupported_browser=Pārlūks pašlaik nenodrošina WebAuthn.
-webauthn_error_unknown=Atgadījās nezināma kļūda. Lūgums mēģināt vēlreiz.
-webauthn_error_insecure=WebAuthn atbalsta tikai drošus savienojumus. Pārbaudīšanai ar HTTP var izmantot pirmavotu "localhost" vai "127.0.0.1"
-webauthn_error_unable_to_process=Serveris nevarēja apstrādāt pieprasījumu.
-webauthn_error_duplicated=Drošības atslēga nav atļauta šim pieprasījumam. Lūgums pārliecināties, ka šī atslēga nav jau reģistrēta.
-webauthn_error_empty=Jānorāda šīs atslēgas nosaukums.
-webauthn_error_timeout=Iestājās noildze, pirms varēja nolasīt atslēgu. Lūgums pārlādēt šo lapu un mēģināt vēlreiz.
 repository=Glabātava
 organization=Apvienība
 mirror=Spoguļglabātava
@@ -1155,14 +1143,6 @@ migrate_options_lfs_endpoint.label=LFS galapunkts
 migrate_options_lfs_endpoint.description=Pārcelšana mēģinās izmantot attālo Git, lai <a target="_blank" rel="noopener noreferrer" href="%s">noteiktu LFS serveri</a>. Var arī norādīt pielāgotu galapunktu, ja glabātavas LFS dati tiek glabāti kaut kur citur.
 migrate_options_lfs_endpoint.description.local=Iespējams norādīt arī servera ceļu.
 migrate_options_lfs_endpoint.placeholder=Ja nav norādīts, galamērķis tiks atvasināts no klonēšanas URL
-migrate_items=Pārcelšanas vienumi
-migrate_items_wiki=Vikivietni
-migrate_items_milestones=Atskaites punktus
-migrate_items_labels=Iezīmes
-migrate_items_issues=Pieteikumi
-migrate_items_pullrequests=Izmaiņu pieprasījumus
-migrate_items_merge_requests=Iekļaušanas pieprasījumi
-migrate_items_releases=Laidienus
 migrate_repo=Pārcelt glabātavu
 migrate.clone_address=Pārcelt/klonēt no URL
 migrate.clone_address_desc=Esošas glabātavas HTTP(S) vai Git "clone" URL
@@ -1181,16 +1161,6 @@ migrate.migrating=Pārceļ no <b>%s</b> …
 migrate.migrating_failed=Pārcelšana no <b>%s</b> neizdevās.
 migrate.migrating_failed.error=Neizdevās pārcelt: %s
 migrate.migrating_failed_no_addr=Pārcelšana neizdevās.
-migrate.migrating_git=Pārceļ Git datus
-migrate.migrating_topics=Pārceļ tēmas
-migrate.migrating_milestones=Pārceļ atskaites punktus
-migrate.migrating_labels=Pārceļ iezīmes
-migrate.migrating_releases=Pārceļ laidienus
-migrate.migrating_issues=Pārnes pieteikumus
-migrate.migrating_pulls=Pārceļ izmaiņu pieprasījumus
-migrate.cancel_migrating_title=Atcelt pārcelšanu
-migrate.cancel_migrating_confirm=Vai atcelt šo pārcelšanu?
-
 mirror_from=spoguļota no
 forked_from=atzarota no
 generated_from=izveidots no
@@ -2591,14 +2561,11 @@ find_file.no_matching=Netika atrasta neviena atbilstoša datne
 error.csv.too_large=Nevar atveidot šo datni, jo tā ir pārāk liela.
 error.csv.unexpected=Nevar atveidot šo datni, jo tā satur neparedzētu rakstzīmi %d. rindas %d. slejā.
 error.csv.invalid_field_count=Nevar atveidot šo datni, jo tā satur nepareizu lauku skaitu %d. rindā.
-n_release_one = %s laidiens
-n_release_few = %s laidieni
 issues.new.assign_to_me = Piešķirt man
 admin.flags_replaced = Glabātavas karogi aizvietoti
 admin.failed_to_replace_flags = Neizdevās aizvietot glabātavas karogus
 admin.manage_flags = Pārvaldīt karogus
 admin.enabled_flags = Glabātavā iespējotie karogi:
-n_commit_one = %s iesūtījums
 editor.push_out_of_date = Aizgādājums izskatās novecojis.
 file_follow = Sekot simboliskajai saitei
 stars = Zvaigznes
@@ -2612,16 +2579,11 @@ generated = Izveidota
 commits.search_branch = Šis zars
 editor.commit_id_not_matching = Datne labošanas laikā tika izmainīta. Jāiesūta jaunā zarā, tad jāapvieno.
 object_format = Objektu veidols
-n_tag_one = %s birka
-n_tag_few = %s birkas
-n_branch_few = %s zari
-n_branch_one = %s zars
 object_format_helper = Glabātavas objektu veidols. Vēlak to nevarēs mainīt. SHA1 ir vissaderīgākais.
 commits.renamed_from = Pārdēvēts no %s
 rss.must_be_on_branch = Jāatrodas zarā, lai iegūtu RSS barotni.
 admin.update_flags = Atjaunināt karogus
 open_with_editor = Atvērt ar %s
-n_commit_few = %s iesūtījumi
 no_eol.text = Nav EOL
 size_format = %[1]s: %[2]s; %[3]s: %[4]s
 mirror_public_key = Publiskā SSH atslēga
@@ -2966,34 +2928,6 @@ dashboard.sync_external_users=Sinhronizēt ārējo lietotāju datus
 dashboard.cleanup_hook_task_table=Iztīrīt tabulu hook_task
 dashboard.cleanup_packages=Notīrīt novecojušās pakotnes
 dashboard.cleanup_actions=Notīrīt darbību izbeigušos žurnālus un artefaktus
-dashboard.server_uptime=Servera darbības laiks
-dashboard.current_goroutine=Pašreizējās gorutīnas
-dashboard.current_memory_usage=Pašreizējais atmiņas lietojums
-dashboard.total_memory_allocated=Kopējā iedalītā atmiņa
-dashboard.memory_obtained=Iegūtā atmiņa
-dashboard.pointer_lookup_times=Rādītāju uzmeklēšanas reizes
-dashboard.memory_allocate_times=Atmiņas iedalīšanas
-dashboard.memory_free_times=Atmiņas atbrīvošanas
-dashboard.current_heap_usage=Pašreizējais grēdas lietojums
-dashboard.heap_memory_obtained=Iegūtā grēdas atmiņa
-dashboard.heap_memory_idle=Neizmantotā grēdas atmiņa
-dashboard.heap_memory_in_use=Izmantotā grēdas atmiņa
-dashboard.heap_memory_released=Atbrīvotā grēdas atmiņa
-dashboard.heap_objects=Grēdas objekti
-dashboard.bootstrap_stack_usage=Sākumielādētāja viengala rindas lietojums
-dashboard.stack_memory_obtained=Iegūtā viengala rindas atmiņa
-dashboard.mspan_structures_usage=MSpan struktūru lietojums
-dashboard.mspan_structures_obtained=Iegūtās MSpan struktūras
-dashboard.mcache_structures_usage=MCache struktūru lietojums
-dashboard.mcache_structures_obtained=Iegūtās MCache struktūras
-dashboard.profiling_bucket_hash_table_obtained=Iegūtā profilēšanas groza jaucējtabula
-dashboard.gc_metadata_obtained=Iegūtie GC metadati
-dashboard.other_system_allocation_obtained=Citas iegūtās sistēmas sadales
-dashboard.next_gc_recycle=Nākamā GC atkritne
-dashboard.last_gc_time=Laiks kopš pēdējās GC
-dashboard.total_gc_pause=Kopējais GC pārtraukums
-dashboard.last_gc_pause=Pedējais GC pārtraukums
-dashboard.gc_times=GC reizes
 dashboard.delete_old_actions=Izdzēst visas novecojušās darbības no datubāzes
 dashboard.delete_old_actions.started=Uzsākta visu novecojušo darbību izdzēšana no datubāzes.
 dashboard.update_checker=Atjauninājumu pārbaudītājs
@@ -3050,18 +2984,6 @@ users.purge_help=Veikt lietotāja un visu tam piederošo glabātavu, apvienību
 users.still_own_packages=Šim lietotājam pieder viena vai vairākas pakotnes, tās nepieciešams izdzēst.
 users.deletion_success=Lietotāja konts tika izdzēsts.
 users.reset_2fa=Atiestatīt 2FA
-users.list_status_filter.menu_text=Atlasīt
-users.list_status_filter.reset=Atiestatīt
-users.list_status_filter.is_active=Aktīvs
-users.list_status_filter.not_active=Neaktīvs
-users.list_status_filter.is_admin=Pārvaldītājs
-users.list_status_filter.not_admin=Nav pārvaldītājs
-users.list_status_filter.is_restricted=Ierobežots
-users.list_status_filter.not_restricted=Nav ierobežots
-users.list_status_filter.is_prohibit_login=Neļaut pieteikšanos
-users.list_status_filter.not_prohibit_login=Atļaut pieteikšanos
-users.list_status_filter.is_2fa_enabled=2FA iespējota
-users.list_status_filter.not_2fa_enabled=2FA atspējota
 users.details=Lietotāja informācija
 
 emails.email_manage_panel=Pārvaldīt lietotāju e-pasta adreses
@@ -3380,26 +3302,6 @@ monitor.process.cancel_desc=Procesa atcelšana var radīt datu zaudējumus
 monitor.process.cancel_notices=Atcelt: <strong>%s</strong>?
 monitor.process.children=Apakšprocesi
 
-monitor.queues=Rindsaraksti
-monitor.queue=Rindsaraksts: %s
-monitor.queue.name=Nosaukums
-monitor.queue.type=Veids
-monitor.queue.exemplar=Eksemplāra veids
-monitor.queue.numberworkers=Strādņu skaits
-monitor.queue.activeworkers=Darbojošies strādņi
-monitor.queue.maxnumberworkers=Lielākais pieļaujamais strādņu skaits
-monitor.queue.numberinqueue=Skaits rindsarakstā
-monitor.queue.review_add=Pārskatīt/pievienot strādņus
-monitor.queue.settings.title=Pūla iestatījumi
-monitor.queue.settings.desc=Pūli dinamiski palielinās atkarībā no to strādņu rindu aizturēšanas.
-monitor.queue.settings.maxnumberworkers=Maksimālais strādņu skaits
-monitor.queue.settings.maxnumberworkers.placeholder=Pašalaik %[1]d
-monitor.queue.settings.maxnumberworkers.error=Lielākajam pieļaujamajam strādņu skaitam ir jābūt skaitlim
-monitor.queue.settings.submit=Atjaunināt iestatījumus
-monitor.queue.settings.changed=Iestatījumi atjaunināti
-monitor.queue.settings.remove_all_items=Noņemt visus
-monitor.queue.settings.remove_all_items_done=Visi rindsaraksta vienumi tika noņemti.
-
 notices.system_notice_list=Sistēmas paziņojumi
 notices.view_detail_header=Apskatīt paziņojuma informāciju
 notices.operations=Darbības
@@ -3546,21 +3448,7 @@ workflow.disabled=Darbplūsma ir atspējota.
 
 need_approval_desc=Nepieciešams apstiprinājums, lai izpildītu darbplūsmas izmaiņu pieprasījumos no atzarojumiem.
 
-variables=Mainīgie
-variables.management=Pārvaldīt mainīgos
-variables.creation=Pievienot mainīgo
-variables.none=Vēl nav neviena mainīgā.
-variables.deletion=Noņemt mainīgo
-variables.deletion.description=Mainīgā noņemšana ir neatgriezeniska un nav atsaucama. Turpināt?
-variables.description=Mainīgie tiks padoti noteiktām darbībām, un citādāk tos nevar nolasīt.
 variables.id_not_exist=Mainīgais ar identifikatoru %d nepastāv.
-variables.edit=Labot mainīgo
-variables.deletion.failed=Neizdevās noņemt mainīgo.
-variables.deletion.success=Mainīgais tika noņemts.
-variables.creation.failed=Neizdevās pievienot mainīgo.
-variables.creation.success=Mainīgais "%s" tika pievienots.
-variables.update.failed=Neizdevās labot mainīgo.
-variables.update.success=Mainīgais tika labots.
 workflow.dispatch.invalid_input_type = Nederīgs ievades mainīgā veids "%s".
 workflow.dispatch.run = Izpildīt darbplūsmu
 workflow.dispatch.success = Darbplūsmas izpildīšana tika sekmīgi pieprasīta.
@@ -3571,7 +3459,6 @@ runs.no_workflows.help_no_write_access = Lai uzzinātu par Forgejo Acties, jāie
 runs.no_workflows.help_write_access = Nav skaidrs, kā sākt izmantot Forgejo Actions? Jāieskatās <a target="_blank" rel="noopener noreferrer" href="%s">ātrajā ievadā lietotāja dokumentācijā</a>, lai uzrakstītu savu pirmo darbplūsmu, tad <a target="_blank" rel="noopener noreferrer" href="%s">jāiestata Forgejo izpildītājs</a>, lai izpildītu savus darbus.
 workflow.dispatch.warn_input_limit = Attēlo tikai pirmos %d ievades mainīgos.
 workflow.dispatch.trigger_found = Šai darbplūsmai ir <c>workflow_dispatch</c> notikuma izraisītājs.
-variables.not_found = Neizdevās atrast mainīgo.
 
 [projects]
 type-1.display_name=Atsevišķs projekts
@@ -3640,9 +3527,6 @@ projects.read = <b>Lasīt</b>: piekļūt glabātavas projektu dēļiem.
 [munits.data]
 
 [markup]
-filepreview.line = %[1]d. rinda %[2]s
-filepreview.lines = %[1]d. līdz %[2]d. rinda %[3]s
-filepreview.truncated = Priekšskatījums tika saīsināts
 
 [translation_meta]
 test = Šī ir pārbaudes virkne. Tā netiek attēlota Forgejo saskarnē, bet tiek izmantota pārbaudes nolūkiem. Droši var ievadīt "ok", lai ietaupītu laiku (vai kādu jautru faktu pēc izvēles), lai sasniegtu to saldo 100% pabeigšanas atzīmi.
\ No newline at end of file
diff --git a/options/locale/locale_mk.ini b/options/locale/locale_mk.ini
index 860573a8a2..856593f398 100644
--- a/options/locale/locale_mk.ini
+++ b/options/locale/locale_mk.ini
@@ -3,11 +3,11 @@ home = Дома
 dashboard = Контролна табла
 help = Помош
 logo = Лого
-sign_in_or = или
 version = Верзија
 notifications = Нотификации
-username = Корисничко име
+sign_in_or = или
 password = Лозинка
+username = Корисничко име
 your_profile = Профил
 explore = Истражубај
 sign_in = Најавајте се
@@ -37,18 +37,6 @@ captcha = Капча
 twofa = Двофакторска автентификација
 twofa_scratch = Двофакторски исцртан код
 passcode = Шифра
-webauthn_insert_key = Вметнете го вашиот безбедносен клуч
-webauthn_sign_in = Притиснете го копчето на вашиот безбедносен клуч. Ако вашиот безбедносен клуч нема копче, повторно вметнете го.
-webauthn_press_button = Притиснете го копчето на вашиот безбедносен клуч…
-webauthn_use_twofa = Користете еден двофакторски код од вашиот телефон
-webauthn_error = Неможно да се чита бесбедносен клуч.
-webauthn_unsupported_browser = Вашиот прелистувач во моментов не ја поддржува WebAuthn.
-webauthn_error_unknown = Се случи непозната грешка. Ве молиме обидете се повторно.
-webauthn_error_insecure = WebAuthn поддржува само сигурни врски. За тестирање преку HTTP, можете да го користите изворот "localhost" или "127.0.0.1"
-webauthn_error_unable_to_process = Серверот не можеше да ја обработи вашето барање.
-webauthn_error_duplicated = Безбедносниот клуч не е дозволен за овој барање. Ве молиме уверете се дека клучот не е веќе регистриран.
-webauthn_error_empty = Мора да е поставено име за овој клуч.
-webauthn_error_timeout = Времето истечало пред да може да се прочита вашиот клуч. Ве молиме освежете ја оваа страница и обидете се повторно.
 repository = Репозиториум
 new_fork = нов форк на репозиториум
 new_project_column = Нова колумна
@@ -87,14 +75,13 @@ view = Гледајте
 test = Тест
 enabled = Овозможено
 disabled = Невозможено
+name = Име
 locked = Заклучено
 copy = Копирање
 copy_url = Копирајте УРЛ
 copy_hash = Копирајте Хеш
 copy_path = Копирајте патека
 copy_content = Копирајте содржина
-name = Име
-copy_success = Копирано!
 go_back = Иди назад
 pin = Пин
 archived = Архивирано
@@ -102,3 +89,4 @@ concept_system_global = Глобално
 concept_user_individual = Индивидуално
 concept_code_repository = репозиториум
 concept_user_organization = организација
+copy_success = Копирано!
\ No newline at end of file
diff --git a/options/locale/locale_ml-IN.ini b/options/locale/locale_ml-IN.ini
index f7eb04495e..e68ec7e99e 100644
--- a/options/locale/locale_ml-IN.ini
+++ b/options/locale/locale_ml-IN.ini
@@ -525,13 +525,6 @@ archive.title=ഈ കലവറ ചരിത്രരേഖാപരമായി
 form.name_reserved='%s' എന്ന കലവറയുടെ പേരു് മറ്റാവശ്യങ്ങള്‍ക്കായി നീക്കിവച്ചിരിക്കുന്നു.
 form.name_pattern_not_allowed=കലവറനാമത്തിൽ '%s' എന്ന ശ്രേണി അനുവദനീയമല്ല.
 
-migrate_items=മൈഗ്രേഷൻ ഇനങ്ങൾ
-migrate_items_wiki=വിക്കി
-migrate_items_milestones=നാഴികക്കല്ലുകള്‍
-migrate_items_labels=ലേബലുകള്‍
-migrate_items_issues=പ്രശ്നങ്ങൾ
-migrate_items_pullrequests=ലയന അഭ്യർത്ഥനകൾ
-migrate_items_releases=പ്രസിദ്ധീകരണങ്ങള്‍
 migrate_repo=കലവറ മൈഗ്രേറ്റ് ചെയ്യുക
 migrate.clone_address=URL- ൽ നിന്ന് മൈഗ്രേറ്റ് / ക്ലോൺ ചെയ്യുക
 migrate.clone_address_desc=നിലവിലുള്ള ഒരു കലവറയുടെ HTTP(S) അല്ലെങ്കിൽ ഗിറ്റു് 'ക്ലോൺ' URL
diff --git a/options/locale/locale_nb_NO.ini b/options/locale/locale_nb_NO.ini
index 692a70e350..bb9c6eaefb 100644
--- a/options/locale/locale_nb_NO.ini
+++ b/options/locale/locale_nb_NO.ini
@@ -27,18 +27,12 @@ download_logs = Last ned logger
 copy_hash = Kopier hash
 more_items = Flere elementer
 passcode = Adgangskode
-webauthn_insert_key = Skriv inn din sikkerhetsnøkkel
-webauthn_use_twofa = Bruk tofaktorkode fra din mobil
 organization = Organisasjon
 mirror = Speil
 new_mirror = Ny speiling
 repository = Depot
 new_project = Nytt prosjekt
 new_project_column = Ny kolonne
-webauthn_error = Klarte ikke lese sikkerhetsnøkkelen.
-webauthn_unsupported_browser = Nettleseren din støtter ikke WebAuthn.
-webauthn_error_unknown = En ukjent feil oppstod. Vennligst prøv igjen.
-webauthn_error_insecure = WebAuhn støtter kun sikre forbindelser. For testing over HTTP kan du bruke verten "localhost" eller "127.0.0.1"
 admin_panel = Nettsideadministrasjon
 settings = Innstillinger
 your_profile = Profil
@@ -122,15 +116,9 @@ sign_in_or = eller
 sign_out = Logg ut
 sign_up = Opprett konto
 confirm_delete_artifact = Er du sikker på at du vil slette artefakten "%s" ?
-webauthn_sign_in = Trykk på knappen på sikkerhetsnøkkelen din. Dersom nøkkelen din ikke har en knapp, sett den inn på nytt.
 copy_path = Kopier sti
-webauthn_error_unable_to_process = Tjeneren kunne ikke behandle forespørselen din.
-webauthn_error_empty = Du må gi nøkkelen et navn.
 toggle_menu = Åpne/lukke meny
 twofa_scratch = To-faktor skrapekode
-webauthn_press_button = Vennligst trykk på knappen på sikkerhetsnøkkelen…
-webauthn_error_duplicated = Sikkerhetsnøkkelen er ikke tillatt for denne forespørselen. Vennligst sørg for at nøkkelen ikke allerede er registrert.
-webauthn_error_timeout = Et tidsavbrudd oppsto før nøkkelen din kunne leses. Vennligst last inn siden på nytt og prøv igjen.
 new_fork = Ny forgrening av depot
 collaborative = Samarbeidende
 error413 = Du har brukt opp kvoten din.
@@ -454,7 +442,6 @@ relevant_repositories_tooltip = Depoter som er en forgrening eller har ingen tem
 relevant_repositories = Kun relevante depoter er vist, <a href="%s">vis ufiltrerte resultater</a>.
 
 [repo]
-migrate_items_releases = Utgivelser
 releases = Utgivelser
 n_release_few = %s utgivelser
 activity.title.releases_1 = %d utgivelse
diff --git a/options/locale/locale_nds.ini b/options/locale/locale_nds.ini
index 6825b38fe9..2476d7c16f 100644
--- a/options/locale/locale_nds.ini
+++ b/options/locale/locale_nds.ini
@@ -28,14 +28,7 @@ access_token = Togang-Teken
 captcha = CAPTCHA
 twofa = Twee-Faktooren-Anmellen
 twofa_scratch = Twee-Faktooren-Eenmaalpasswoord
-webauthn_insert_key = Steek dienen Sekerheids-Slötel in
-webauthn_press_button = Bidde drück de Knoop up dienem Sekerheids-Slötel …
-webauthn_use_twofa = Bruuk eene Twee-Faktooren-Tahl vun dienem Telefoon
-webauthn_error = Kunn dienen Sekerheids-Slötel nich lesen.
-webauthn_unsupported_browser = Dien Browser unnerstütt stedenwies WebAuthn nich.
-webauthn_error_unknown = Een unbekannter Fehler is uptreden. Bidde versöök dat noch eenmaal.
 passcode = Pass-Tahl
-webauthn_error_empty = Du muttst de Slötel eenen Naam geven.
 repository = Repositorium
 organization = Vereenigung
 new_fork = Neje Repositoriums-Gabel
@@ -47,12 +40,7 @@ register = Registreren
 licenses = Lizenzen
 email = E-Mail-Adress
 re_type = Passwoord utwiesen
-webauthn_error_unable_to_process = De Server kunn diene Anfraag nich verarbeiden.
 new_mirror = Nejer Spegel
-webauthn_sign_in = Drück de Knoop up dienem Sekerheids-Slötel. Wenn dien Slötel keenen Knoop hett, steek ’t ut un weer in.
-webauthn_error_insecure = WebAuthn unnerstütt blots seker Verbinnens. Wenn du över HTTP testen willst, kannst du de Quell »localhost« of »127.0.0.1« bruken
-webauthn_error_duplicated = De Sekerheids-Slötel is för deese Anfraag nich verlöövt. Bidde wees wiss, dat de Slötel nich al vermarkt is.
-webauthn_error_timeout = Tied överweggahn ehr dien Slötel lesen worden kunn. Bidde laad deese Sied neei un versöök dat noch eenmaal.
 mirror = Spegel
 new_project = Nejes Projekt
 new_project_column = Neje Rieg
@@ -980,11 +968,6 @@ template.one_item = Tominnst een Vörlaag-Ding mutt utköört worden
 template.invalid = Een Vörlaag-Repositorium mutt utköört worden
 migrate_options_lfs_endpoint.label = LFS-Ennpunkt
 migrate_options_lfs_endpoint.placeholder = Wenn leeg laten, word de Ennpunkt vun de Kloon-URL avleit
-migrate_items = Umtreck-Dingen
-migrate_items_wiki = Wiki
-migrate_items_milestones = Markstenen
-migrate_items_pullrequests = Haalvörslagen
-migrate_items_releases = Publizerens
 migrate_repo = Repositorium umtrecken
 migrate.clone_address = Umtrecken / Klonen vun URL
 migrate.failed = Umtreck fehlslagen: %v
@@ -992,12 +975,6 @@ migrate.migrate_items_options = Togang-Teken is nödig, um mehr Dingen umtotreck
 migrated_from = Vun <a href="%[1]s">%[2]s</a> umtrucken
 migrate.migrate = Vun %s umtrecken
 migrate.migrating = Treckt vun <b>%s</b> um …
-migrate.migrating_git = Git-Daten worden umtrucken
-migrate.migrating_topics = Themen worden umtrucken
-migrate.migrating_labels = Vermarkens worden umtrucken
-migrate.migrating_releases = Publizerens worden umtrucken
-migrate.migrating_issues = Gefallens worden umtrucken
-migrate.cancel_migrating_title = Umtreck ofbreken
 mirror_from = Spegel vun
 forked_from = gabelt vun
 fork_from_self = Du kannst dien eegen Repositorium nich gabeln.
@@ -1027,7 +1004,6 @@ mirror_password_help = Änner de Brukernaam, um een sekert Passwoord to lösken.
 author_search_tooltip = Wiest bit to 30 Brukers
 transfer.reject_desc = Överdragen to »%s« ofbreken
 migrate_options_lfs = LFS-Dateien umtrecken
-migrate_items_labels = Vermarkens
 migrate.clone_address_desc = De HTTP(S) of Git »clone« URL vun eenem bestahn Repositorium
 migrate.invalid_local_path = De stedenwies Padd is ungültig. ’t gifft dat nich of dat is keen Verteeknis.
 fork_guest_user = Mell di an, um deeses Repositorium to gabeln.
@@ -1050,13 +1026,11 @@ archive.title_date = Deeses Repositorium is am %s archiveert worden. Du kannst d
 form.reach_limit_of_creation_1 = De Eegner is al bi de Grenz vun %d Repositorium.
 form.name_reserved = De Repositoriums-Naam »%s« is vörbehollen.
 form.string_too_long = De angeven Text is langer as %d Bookstavens.
-migrate_items_issues = Gefallens
 template.items = Vörlaag-Dingen
 template.git_hooks_tooltip = Du kannst jüüst keene Git-Hakens bewarken of lösken, nadeem se hentoföögt sünd. Köör dat blots ut, wenn du de Vörlaag-Repositorium vertraust.
 form.reach_limit_of_creation_n = De Eegner is al bi de Grenz vun %d Repositoriums.
 migrate_options_mirror_helper = Deeses Repositorium word een Spegel wesen
 migrate_options_lfs_endpoint.description.local = Een stedenwies Server-Padd word ok unnerstütt.
-migrate_items_merge_requests = Tosamenföhren-Vörslagen
 migrate.permission_denied = Du düürst keene stedenwies Repositoriums importeren.
 archive.title = Deeses Repositorium is archiveert. Du kannst de Dateien ankieken un ’t klonen, aver du kannst sienen Tostand nich ännern, also nix schuven un keene nejen Gefallens, Haalvörslagen of Kommentaren maken.
 need_auth = Anmellen
@@ -1064,15 +1038,12 @@ migrate_options = Umtreck-Instellens
 migrate.clone_local_path = of een stedenwies Server-Padd
 migrate.migrating_failed.error = Umtrecken fehlslagen: %s
 migrate.migrating_failed_no_addr = Umtreck fehlslagen.
-migrate.migrating_pulls = Haalvörslagen worden umtrucken
 empty_message = Deeses Repositorium hett noch keenen Inholl.
 migrate.invalid_lfs_endpoint = De LFS-Ennpunkt is nich gültig.
 migrated_from_fake = Vun %[1]s umtrucken
 generated_from = maakt vun
 migrate.migrating_failed = Umtrecken un <b>%s</b> fehlslagen.
-migrate.migrating_milestones = Markstenen worden umtrucken
 create_new_repo_command = Een nejes Repositorium in de Oorderreeg maken
-migrate.cancel_migrating_confirm = Willst du deesen Umtreck ofbreken?
 subscribe.pull.guest.tooltip = Mell di an, um deesen Haalvörslag to abonneren.
 more_operations = Mehr doon
 find_tag = Mark finnen
@@ -1088,13 +1059,6 @@ milestones = Markstenen
 org_labels_desc_manage = Verwalten
 commits = Kommitterens
 commit = Kommitteren
-n_commit_one = %s Kommitteren
-n_commit_few = %s Kommitterens
-n_branch_one = %s Twieg
-n_tag_one = %s Mark
-n_tag_few = %s Markens
-n_release_one = %s Publizeren
-n_release_few = %s Publizerens
 file.title = %s am %s
 file_history = Histoorje
 file_view_source = Quelltext wiesen
@@ -1259,7 +1223,6 @@ symbolic_link = Symbolisk Verwies
 editor.cannot_edit_non_text_files = Binäärdateien könen nich in de Internett-Schnittstee bewarkt worden.
 editor.must_be_on_a_branch = Du muttst up eenem Twieg wesen, um Ännerns an deeser Datei to maken of vörtoslagen.
 editor.fork_before_edit = Du muttst deeses Repositorium gabeln, um Ännerns an deeser Datei to maken of vörtoslagen.
-n_branch_few = %s Twiegen
 released_this = hett dat publizeert
 escape_control_characters = Utkielen
 editor.edit_this_file = Datei bewarken
@@ -2766,9 +2729,6 @@ dashboard.resync_all_sshprincipals = De ».ssh/authorized_principals«-Datei mit
 dashboard.reinit_missing_repos = All fehlend Git-Repositoriums neei inrichten, för wat dat Uptekens gifft
 dashboard.cleanup_packages = Avlopen Paketen uprümen
 dashboard.cleanup_actions = Avlopen Utgaven un Objekten vun Aktioonen uprümen
-dashboard.current_goroutine = Stedenwies Go-Routinen
-dashboard.total_memory_allocated = Spieker towiesen all tosamen
-dashboard.memory_allocate_times = Spieker-Towiesens
 dashboard.system_status = Systeem-Tostand
 dashboard.operation_switch = Wesseln
 dashboard.operation_run = Utföhren
@@ -2789,8 +2749,6 @@ dashboard.operation_name = Aktioons-Naam
 dashboard.cron.process = Tiedplaan: %[1]s
 dashboard.cron.cancelled = Tiedplaan: %[1]s ofbroken: %[3]s
 dashboard.resync_all_sshkeys = De ».ssh/authorized_keys«-Datei mit de SSH-Slötels vun Forgejo vernejen.
-dashboard.memory_obtained = Spieker erhollen
-dashboard.pointer_lookup_times = Wieser-Nakiek-Tieden
 dashboard.task.started = Hett Upgaav begunnen: %[1]s
 dashboard.delete_inactive_accounts = All nich aktiveerten Konten lösken
 dashboard.delete_repo_archives.started = Upgaav, um all Repositoriums-Archiven to lösken, begunnen.
@@ -2801,25 +2759,6 @@ dashboard.sync_repo_branches = Fehlend Twiegen vun Git-Daten to de Datenbank spe
 dashboard.update_migration_poster_id = Umtreck-Autor-IDs vernejen
 dashboard.cleanup_hook_task_table = hook_task-Tabell uprümen
 dashboard.sync_external_users = Frömde Brukerdaten vernejen
-dashboard.server_uptime = Server-Bedrievstied
-dashboard.current_memory_usage = Stedenwies Spiekerbruuk
-dashboard.heap_memory_obtained = Hoopspieker erhollen
-dashboard.current_heap_usage = Stedenwies Hoopbruuk
-dashboard.heap_memory_idle = Hoopspieker mit nix to doon
-dashboard.heap_memory_released = Hoopspieker freeigeven
-dashboard.heap_objects = Hoopobjekten
-dashboard.bootstrap_stack_usage = Bootstrap-Stapelbruuk
-dashboard.stack_memory_obtained = Stapelspieker erhollen
-dashboard.mspan_structures_usage = MSpan-Struktuuren-Bruuk
-dashboard.mspan_structures_obtained = MSpan-Struktuuren erhollen
-dashboard.mcache_structures_usage = MCache-Struktuuren-Bruuk
-dashboard.gc_metadata_obtained = Wiedere Informatioonen för GC erhollen
-dashboard.other_system_allocation_obtained = Anner Systeemtowiesens erhollen
-dashboard.next_gc_recycle = Anner GC-Müllavhalen
-dashboard.last_gc_time = Tied siet lestem GC
-dashboard.total_gc_pause = GC-Paus all tosamen
-dashboard.last_gc_pause = Leste GC-Paus
-dashboard.gc_times = GC-Tieden
 dashboard.delete_old_actions = All olles Doon ut de Datenbank lösken
 dashboard.update_checker = Vernejens-Sööker
 dashboard.delete_old_system_notices = All ollen Systeemnarichten ut de Datenbank lösken
@@ -2855,16 +2794,12 @@ users.is_admin = Chefkonto
 users.admin.description = Deesem Bruker kumpleten Togriep to all Chef-Aktioonen geven, wat mit de Internett-Schnittstee un de API gahn.
 users.is_restricted = Begrenztes Konto
 users.allow_git_hook = Kann Git-Hakens maken
-dashboard.memory_free_times = Spieker-Freeigevens
 users.bot = Bot
 users.2fa = 2FA
-dashboard.profiling_bucket_hash_table_obtained = Profileren-Emmer-Prüfsummtabell erhollen
 dashboard.sync_tag.started = Mark-Vernejen begunnen
 dashboard.rebuild_issue_indexer = Gefall-Indizerer neei bauen
 users.activated.description = Of dat E-Mail-Utwiesen ofsluten is. De Eegner vun eenem nich aktiveerten Konto kann sik nich anmellen, bit dat E-Mail-Utwiesen ofsluten is.
-dashboard.heap_memory_in_use = Hoopspieker bruukt
 users.max_repo_creation_desc = (Giff -1 in, um de Normaalweert vun de Instanz to bruken.)
-dashboard.mcache_structures_obtained = MCache-Struktuuren erhollen
 dashboard.start_schedule_tasks = Aktioonen-Upgaven mit Tiedplaan begünnen
 users.remote = Frömd
 users.max_repo_creation = Hoogste Tahl vun Repositoriums
@@ -2884,12 +2819,6 @@ users.still_has_org = De Bruker is noch een Liddmaat vun eener Vereenigung. Doo
 users.purge = Bruker wegschüren
 users.purge_help = Mit Dwang de Bruker un all siene Repositoriums, Vereenigungen un Paketen lösken. All Kommentaren un Gefallens, wat deeser Bruker maakt hett, worden ok lösket.
 users.still_own_packages = Deeser Bruker is noch Eegner vun een of mehr Paketen, löske eerst deese Paketen.
-users.list_status_filter.menu_text = Filter
-users.list_status_filter.not_active = Nich aktiiv
-users.list_status_filter.is_restricted = Begrenzt
-users.list_status_filter.not_restricted = Unbegrenzt
-users.list_status_filter.is_2fa_enabled = 2FA anknipst
-users.list_status_filter.not_2fa_enabled = 2FA utknipst
 users.details = Bruker-Informatioonen
 emails.email_manage_panel = Bruker-E-Mails verwalten
 emails.primary = Höövd
@@ -3001,17 +2930,11 @@ auths.skip_local_two_fa = Stedenwies 2FA överspringen
 auths.oauth2_tenant = Inwohner
 auths.oauth2_scopes = Wiedere Rebeeten
 users.deletion_success = Dat Brukerkonto is lösket worden.
-users.list_status_filter.is_admin = Chef
 auths.syncenabled = Bruker-Vernejen anknipsen
 users.reset_2fa = 2FA torüggsetten
-users.list_status_filter.is_prohibit_login = Anmellen verseggen
-users.list_status_filter.not_admin = Keen Chef
 auths.auth_type = Anmellens-Aard
 auths.restricted_filter_helper = Laat dat leeg, wenn keene Brukers begrenzt wesen sallen. Bruuk eenen Steern (»*«), um all Brukers, wat nich up de Chef-Filter passen, as begrenzt to setten.
 auths.force_smtps_helper = SMTPS word alltieden up Poort 465 bruukt. Sett dat, um SMTPS up anner Poorten to dwingen. (Anners word up anner Poorten STARTTLS bruukt, wenn de Host dat unnerstütt.)
-users.list_status_filter.reset = Torüggsetten
-users.list_status_filter.is_active = Aktiiv
-users.list_status_filter.not_prohibit_login = Anmellen verlöven
 auths.auth_name = Anmellens-Naam
 auths.map_group_to_team = LDAP-Gruppens up Vereenigungs-Klottjen avbillen (laat dat Feld leeg, um dat to överspringen)
 auths.allowed_domains_helper = Laat dat leeg, um all Domänens to verlöven. Trenn mennig Domänen mit eenem Komma (»,«).
@@ -3185,20 +3108,6 @@ monitor.process.cancel = Prozess ofbreken
 monitor.process.cancel_desc = Wenn een Prozess ofbroken word, könen Daten verloren gahn
 monitor.process.cancel_notices = Ofbreken: <strong>%s</strong>?
 monitor.process.children = Kinners
-monitor.queues = Slangen
-monitor.queue = Slang: %s
-monitor.queue.name = Naam
-monitor.queue.activeworkers = Aktiiv Rieters
-monitor.queue.maxnumberworkers = Hoogste Tahl vun Rieters
-monitor.queue.numberinqueue = Tahl in de Slang
-monitor.queue.review_add = Rieters nakieken / hentofögen
-monitor.queue.settings.title = Vörraad-Instellens
-monitor.queue.settings.maxnumberworkers = Hoogste Tahl vun Rieters
-monitor.queue.settings.maxnumberworkers.placeholder = Stedenwies %[1]d
-monitor.queue.settings.maxnumberworkers.error = Hoogste Tahl vun Rieters mutt eene Tahl wesen
-monitor.queue.settings.submit = Instellens vernejen
-monitor.queue.settings.changed = Instellens verneeit
-monitor.queue.settings.remove_all_items = All wegdoon
 notices.system_notice_list = Systeem-Narichtens
 notices.operations = Doon
 notices.select_all = All utkören
@@ -3211,7 +3120,6 @@ notices.type_1 = Repositorium
 notices.type_2 = Upgaav
 notices.desc = Beschrieven
 notices.op = Up.
-monitor.queue.exemplar = Musteraard
 notices.view_detail_header = Naricht-Informatioonen
 self_check.no_problem_found = Noch keen Probleem funnen.
 self_check.database_collation_mismatch = Verwacht, dat de Datenbank deese Kollatioon bruukt: %s
@@ -3221,10 +3129,8 @@ self_check.database_inconsistent_collation_columns = Datenbank bruukt Kollatioon
 config.log_file_root_path = Utgaav-Padd
 config.reset_password_code_lives = Ofloops-Düür vun de Torügghalens-Teken
 config.allow_dots_in_usernames = Brukers verlöven, Punkten in hör Brukernamen to bruken. Ännert nix an bestahn Konten.
-monitor.queue.numberworkers = Tahl vun Rieters
 config.set_setting_failed = Instellen %s to setten fehlslagen
 monitor.execute_times = Utföhrens
-monitor.queue.settings.desc = Vörraden wassen as nödig, wenn hör Rieters-Slang blockeert.
 auths.tip.openid_connect = Bruuk de Utförsken-URL för OpenID-Verbinnen (<server>/.well-known/openid-configuration), um de Ennpunkten antogeven
 auths.login_source_of_type_exist = Eenen Anmellens-Quell vun deeser Aard gifft dat al.
 config.mailer_protocol = Protokoll
@@ -3234,8 +3140,6 @@ config.app_data_path = Programmdatenpadd
 config.service_config = Deenst-Inrichten
 config.enable_openid_signup = OpenID-Sülvst-Registreren anknipsen
 config.cache_test_slow = Tüskenspieker-Test daankregen, aver de Antwoord is langsaam: %s.
-monitor.queue.type = Aard
-monitor.queue.settings.remove_all_items_done = All Dingen in de Slang sünd wegdaan worden.
 auths.tip.mastodon = Giff eene eegene Instanz-URL för de Mastodon-Instanz, mit wat du anmellen willst, in (of bruuk de Normaalweert)
 notices.delete_success = De Systeem-Narichtens sünd wegdaan worden.
 config.repo_root_path = Repositoriums-Ruut-Padd
@@ -3464,28 +3368,13 @@ workflow.dispatch.input_required = Weert för Ingaav »%s« nödig.
 workflow.dispatch.invalid_input_type = Ungültige Ingaav-Aard »%s«.
 workflow.dispatch.warn_input_limit = Blots de eersten %d Ingaven worden wiesen.
 need_approval_desc = Warkwiesen vun eenem Haalvörslag ut eener Gabel mutten eerst tostimmt worden.
-variables = Variaabeln
-variables.management = Variaabeln verwalten
-variables.none = Dat gifft noch keene Variaabeln.
-variables.deletion = Variaabel wegdoon
-variables.description = Variaabeln worden an wisse Aktioonen övergeven un könen anners nich lesen worden.
 variables.id_not_exist = Variaabel mit ID %d gifft dat nich.
-variables.edit = Variaabel bewarken
-variables.deletion.failed = Kunn Variaabel nich wegdoon.
-variables.deletion.success = De Variaabel is wegdaan worden.
-variables.creation.failed = Kunn Variaabel nich hentofögen.
-variables.creation.success = De Variaabel »%s« is hentoföögt worden.
-variables.update.success = De Variaabel is bewarkt worden.
 workflow.disable = Warkwies utknipsen
-variables.creation = Variaabel hentofögen
-variables.update.failed = Kunn Variaabel nich bewarken.
 workflow.disable_success = Warkwies »%s« is utknipst worden.
 workflow.dispatch.success = Warkwies-Utföhren is vörmarkt worden.
-variables.deletion.description = Eene Variaabel wegtodoon is för all Tieden un kann nich torüggnohmen worden. Wiedermaken?
 unit.desc = Verwalt integreerte CI-/CD-Affolgens mit Forgejo-Aktioonen.
 runs.no_workflows.help_write_access = Weetst du nich, wo man mit Forgejo-Aktioonen begünnen sall? Kiek de <a target="_blank" rel="noopener noreferrer" href="%s">Fixanwies in de Bruker-Dokumenteren</a> an, um diene eerste Warkwies to schrieven, un <a target="_blank" rel="noopener noreferrer" href="%s">richt dann dienen eersten Forgejo-Loper in</a>, um diene Upgavens uttoföhren.
 runs.no_workflows.help_no_write_access = Um mehr över Forgejo-Aktioonen to lehren, kiek <a target="_blank" rel="noopener noreferrer" href="%s">de Dokumenteren</a> an.
-variables.not_found = Kunn de Variaabel nich finnen.
 
 [projects]
 deleted.display_name = Lösket Projekt
@@ -3502,9 +3391,6 @@ symbolic_link = Symbolisk Verwies
 submodule = Unnermoduul
 
 [markup]
-filepreview.lines = Riegen %[1]d bit %[2]d in %[3]s
-filepreview.truncated = Utkiek is ofsneden worden
-filepreview.line = Rieg %[1]d in %[2]s
 
 [translation_meta]
 test = Moin!
diff --git a/options/locale/locale_nl-NL.ini b/options/locale/locale_nl-NL.ini
index ff9da4670a..50d5dfd7d8 100644
--- a/options/locale/locale_nl-NL.ini
+++ b/options/locale/locale_nl-NL.ini
@@ -34,18 +34,6 @@ twofa=Tweefactorauthenticatie
 twofa_scratch=Tweefactor krascode
 passcode=Code
 
-webauthn_insert_key=Sluit uw beveiligingssleutel aan
-webauthn_sign_in=Druk op de knop van uw beveiligingssleutel. Als uw beveiligingssleutel geen knop heeft, sluit deze dan opnieuw aan.
-webauthn_press_button=Druk alstublieft op de knop van uw beveiligingssleutel…
-webauthn_use_twofa=Gebruik een tweefactor code van uw telefoon
-webauthn_error=Kon uw beveiligingssleutel niet lezen.
-webauthn_unsupported_browser=Uw browser ondersteunt momenteel geen WebAuthn.
-webauthn_error_unknown=Er is een onbekende fout opgetreden. Probeer het opnieuw.
-webauthn_error_insecure=WebAuthn ondersteunt alleen beveiligde verbindingen. Om te testen via HTTP, kan je als systeemnaam "localhost" of "127.0.0.1" gebruiken
-webauthn_error_unable_to_process=De server kon uw verzoek niet verwerken.
-webauthn_error_duplicated=De beveiligingssleutel is voor dit verzoek niet toegestaan. Controleer alstublieft of de sleutel niet al is geregistreerd.
-webauthn_error_empty=U moet een naam voor deze sleutel instellen.
-webauthn_error_timeout=Time-out bereikt voordat uw sleutel kon worden gelezen. Herlaad deze pagina en probeer het opnieuw.
 repository=Repository
 organization=Organisatie
 mirror=Kopie
@@ -1132,14 +1120,6 @@ migrate_options_lfs=Migreer LFS bestanden
 migrate_options_lfs_endpoint.label=LFS eindpunt
 migrate_options_lfs_endpoint.description=Migratie zal proberen om je Git remote te gebruiken om <a target="_blank" rel="noopener noreferrer" href="%s">de LFS-server</a> te bepalen. Je kan ook een aangepast eindpunt opgeven als de LFS-gegevens ergens anders zijn opgeslagen.
 migrate_options_lfs_endpoint.description.local=Een lokaal serverpad wordt ook ondersteund.
-migrate_items=Migratie items
-migrate_items_wiki=Wiki
-migrate_items_milestones=Mijlpalen
-migrate_items_labels=Labels
-migrate_items_issues=Issues
-migrate_items_pullrequests=Pull requests
-migrate_items_merge_requests=Samenvoeg verzoeken
-migrate_items_releases=Releases
 migrate_repo=Migreer repository
 migrate.clone_address=Migreer / kloon van URL
 migrate.clone_address_desc=De HTTP(S) of Git "kloon" URL van een bestaande repository
@@ -1156,14 +1136,6 @@ migrate.migrate=Migreer van %s
 migrate.migrating=Migreren van <b>%s</b>…
 migrate.migrating_failed=Migreren van <b>%s</b> is mislukt.
 migrate.migrating_failed_no_addr=Migratie is mislukt.
-migrate.migrating_git=Git gegevens migreren
-migrate.migrating_topics=Onderwerpen migreren
-migrate.migrating_milestones=Mijlpalen migreren
-migrate.migrating_labels=Labels migreren
-migrate.migrating_releases=Releases migreren
-migrate.migrating_issues=Issues migreren
-migrate.migrating_pulls=Pull requests migreren
-
 mirror_from=kopie van
 forked_from=geforked van
 generated_from=gegenereerd van
@@ -2355,8 +2327,6 @@ form.name_reserved = De repository naam "%s" is gereserveerd.
 form.name_pattern_not_allowed = Het patroon "%s" is niet toegestaan in een repository naam.
 migrate.invalid_local_path = Het lokale pad is niet geldig. Het bestaat niet of is geen folder.
 migrate.migrating_failed.error = Fout bij migreren: %s
-migrate.cancel_migrating_title = Annuleer migratie
-migrate.cancel_migrating_confirm = Wil je deze migratie annuleren?
 more_operations = Meer operaties
 cite_this_repo = Citeer deze repository
 actions = Acties
@@ -2643,12 +2613,6 @@ editor.push_out_of_date = De push lijkt verouderd.
 editor.commit_id_not_matching = Het bestand is gewijzigd terwijl je het aan het bewerken was. Committeer naar een nieuwe branch en voeg dan samen.
 settings.rename_branch_failed_protected = Kan branch %s niet hernoemen omdat het een beschermde branch is.
 stars = Sterren
-n_commit_few = %s commits
-n_branch_one = %s branch
-n_branch_few = %s branches
-n_tag_one = %s tag
-n_tag_few = %s tags
-n_commit_one = %s commit
 issues.num_participants_one = %d deelnemer
 size_format = %[1]s: %[2]s, %[3]s: %[4]s
 settings.enforce_on_admins = Handhaaf deze regel voor repository admins
@@ -2675,8 +2639,6 @@ wiki.search = Zoek wiki
 wiki.no_search_results = Geen resultaten
 settings.sourcehut_builds.visibility = Job zichtbaarheid
 settings.sourcehut_builds.manifest_path = Bouw manifestpad
-n_release_one = %s release
-n_release_few = %s releases
 issues.author.tooltip.issue = Deze gebruiker is de auteur van deze issue.
 issues.author.tooltip.pr = Deze gebruiker is de auteur van deze pull request.
 settings.matrix.room_id_helper = De kamer-ID kan worden opgehaald uit de Element webclient > Kamerinstellingen > Geavanceerd > Interne ruimte ID. Voorbeeld: %s.
@@ -2945,34 +2907,6 @@ dashboard.resync_all_sshprincipals=Update het ".ssh/authorized_principals" besta
 dashboard.resync_all_hooks=Git hooks van alle repositories opnieuw synchroniseren (pre-receive, update en, post-receive hooks van alle repositories, proc-receive, ...)
 dashboard.reinit_missing_repos=Herinitialiseer alle ontbrekende Git repositories waarvoor records bestaan
 dashboard.sync_external_users=Externe gebruikersgegevens synchroniseren
-dashboard.server_uptime=Uptime server
-dashboard.current_goroutine=Huidige goroutines
-dashboard.current_memory_usage=Huidig geheugen gebruik
-dashboard.total_memory_allocated=Totaal toegewezen geheugen
-dashboard.memory_obtained=Geheugen gebruikt
-dashboard.pointer_lookup_times=Aanwijzer Lookup keer
-dashboard.memory_allocate_times=Geheugentoewijzingen
-dashboard.memory_free_times=Geheugen vrjigemaakt
-dashboard.current_heap_usage=Huidige heap gebruik
-dashboard.heap_memory_obtained=Heap geheugen verkregen
-dashboard.heap_memory_idle=Heap geheugen inactief
-dashboard.heap_memory_in_use=Heap geheugen in gebruik
-dashboard.heap_memory_released=Heap geheugen vrijgegeven
-dashboard.heap_objects=Heap-objecten
-dashboard.bootstrap_stack_usage=Bootstrap Stack gebruik
-dashboard.stack_memory_obtained=Stapel geheugen verkregen
-dashboard.mspan_structures_usage=MSpan structuren gebruik
-dashboard.mspan_structures_obtained=MSpan structuren verkregen
-dashboard.mcache_structures_usage=MCache structuren gebruik
-dashboard.mcache_structures_obtained=MCache structuren verkregen
-dashboard.profiling_bucket_hash_table_obtained=Profilering emmer hashtabel verkregen
-dashboard.gc_metadata_obtained=GC metadada verkregen
-dashboard.other_system_allocation_obtained=Andere systeem toewijzing verkregen
-dashboard.next_gc_recycle=Volgende GC recycle
-dashboard.last_gc_time=Sinds vorige GC verwerkingstijd
-dashboard.total_gc_pause=Totaal GC verwerkingstijd
-dashboard.last_gc_pause=Laatste GC verwerkingstijd
-dashboard.gc_times=GC verwerkingen
 dashboard.delete_old_system_notices=Verwijder alle oude systeemmededelingen uit de database
 
 users.user_manage_panel=Gebruikersaccounts beheren
@@ -3010,12 +2944,6 @@ users.delete_account=Gebruikersaccount verwijderen
 users.still_own_repo=Deze gebruiker is nog steeds eigenaar van één of meerdere repositories. Verwijder of draag eerst deze repositories over.
 users.still_has_org=Deze gebruiker is lid van een organisatie. Verwijder de gebruiker eerst uit alle organisaties.
 users.deletion_success=De gebruiker is verwijderd.
-users.list_status_filter.menu_text=Filter
-users.list_status_filter.is_active=Actief
-users.list_status_filter.not_active=Inactief
-users.list_status_filter.is_admin=Beheerder
-users.list_status_filter.is_restricted=Beperkt
-
 emails.email_manage_panel=Gebruikersmails beheren
 emails.primary=Primair
 emails.activated=Geactiveerd
@@ -3259,20 +3187,6 @@ monitor.process.cancel=Annuleer proces
 monitor.process.cancel_desc=Annuleren van een proces kan gegevensverlies veroorzaken
 monitor.process.cancel_notices=Annuleer: <strong>%s</strong>?
 
-monitor.queues=Wachtrijen
-monitor.queue=Wachtrij: %s
-monitor.queue.name=Naam
-monitor.queue.type=Type
-monitor.queue.exemplar=Type voorbeeld
-monitor.queue.numberworkers=Aantal werkers
-monitor.queue.maxnumberworkers=Maximum aantal werkers
-monitor.queue.settings.title=Pool instellingen
-monitor.queue.settings.maxnumberworkers=Maximum aantal workers
-monitor.queue.settings.maxnumberworkers.placeholder=Momenteel %[1]d
-monitor.queue.settings.maxnumberworkers.error=Maximaal aantal workers moet een nummer zijn
-monitor.queue.settings.submit=Instellingen bijwerken
-monitor.queue.settings.changed=Instellingen bijgewerkt
-
 notices.system_notice_list=Systeemmeldingen
 notices.view_detail_header=Bekijk notificatie details
 notices.select_all=Alles selecteren
@@ -3286,12 +3200,6 @@ notices.type_2=Taak
 notices.desc=Beschrijving
 notices.op=Op.
 notices.delete_success=De systeemmeldingen zijn verwijderd.
-monitor.queue.activeworkers = Actieve werkers
-monitor.queue.numberinqueue = Aantal in wachtrij
-monitor.queue.review_add = Werkers beoordelen of toevoegen
-monitor.queue.settings.desc = Pools groeien dynamisch in reactie op het blokkeren van hun wachtrijen.
-monitor.queue.settings.remove_all_items = Alles verwijderen
-monitor.queue.settings.remove_all_items_done = Alle items in de wachtrij zijn verwijderd.
 notices.operations = Operaties
 self_check.no_problem_found = Nog geen probleem gevonden.
 self_check.database_collation_mismatch = Verwacht dat de database collatie gebruikt: %s
@@ -3300,12 +3208,6 @@ users.cannot_delete_self = Je kunt jezelf niet verwijderen
 users.purge = Gebruiker wissen
 users.still_own_packages = Deze gebruiker bezit nog steeds één of meerdere pakketten, verwijder deze pakketten eerst.
 users.reset_2fa = 2FA opnieuw instellen
-users.list_status_filter.reset = Reset
-users.list_status_filter.not_admin = Niet beheerder
-users.list_status_filter.not_restricted = Niet beperkt
-users.list_status_filter.is_prohibit_login = Inloggen verbieden
-users.list_status_filter.not_prohibit_login = Inloggen toestaan
-users.list_status_filter.is_2fa_enabled = 2FA ingeschakeld
 users.details = Gebruikersgegevens
 emails.change_email_text = Weet je zeker dat je dit e-mailadres wilt bijwerken?
 repos.lfs_size = LFS grootte
@@ -3331,7 +3233,6 @@ packages.cleanup = Verlopen gegevens opschonen
 defaulthooks.add_webhook = Standaard webhook toevoegen
 auths.oauth2_required_claim_value_helper = Stel deze waarde in om het aanmelden vanuit deze bron te beperken tot gebruikers met een claim met deze naam en waarde
 users.remote = Externe
-users.list_status_filter.not_2fa_enabled = 2FA uitgeschakeld
 users.reserved = Gereserveerd
 defaulthooks.desc = Webhooks doen automatisch HTTP POST verzoeken naar een server wanneer bepaalde Forgejo gebeurtenissen zich voordoen. Webhooks defined here are defaults and will be copied into all new repositories. Read more in the <a target="_blank" rel="noopener" href="%s">webhooks guide</a>.
 auths.verify_group_membership = Controleer het groepslidmaatschap in LDAP (laat het filter leeg om over te slaan)
@@ -3526,7 +3427,6 @@ creation.name_placeholder = hoofdlettergevoelig, alleen alfanumerieke tekens of
 deletion.failed = Mislukt om geheim te verwijderen.
 
 [actions]
-variables.update.failed = Mislukt bij het bewerken van variabele.
 runs.no_runs = De workflow heeft nog geen runs.
 runs.empty_commit_message = (leeg commit bericht)
 workflow.disable = Workflow uitschakelen
@@ -3534,22 +3434,9 @@ workflow.enable = Workflow inschakelen
 workflow.enable_success = Workflow "%s" is succesvol ingeschakeld.
 workflow.disabled = Workflow is uitgeschakeld.
 need_approval_desc = Heb goedkeuring nodig om workflows uit te voeren voor fork pull request.
-variables = Variabelen
-variables.management = Variabelenbeheer
-variables.creation = Variabele toevoegen
-variables.deletion = Variabel verwijderen
-variables.deletion.description = Een variabele verwijderen is permanent en kan niet ongedaan worden gemaakt. Doorgaan?
 variables.id_not_exist = Variabele met ID %d bestaat niet.
-variables.edit = Variabele bewerken
-variables.deletion.failed = Mislukt om variabele te verwijderen.
-variables.deletion.success = De variabele is verwijderd.
-variables.creation.failed = Mislukt om variable toe te voegen.
-variables.creation.success = De variabele "%s" is toegevoegd.
-variables.update.success = De variabele is bewerkt.
 unit.desc = Beheer geïntegreerde CI/CD-pijplijnen met Forgejo Actions.
 workflow.disable_success = Workflow "%s" is succesvol uitgeschakeld.
-variables.none = Er zijn nog geen variabelen.
-variables.description = Variabelen worden doorgegeven aan bepaalde acties en kunnen anders niet worden gelezen.
 workflow.dispatch.trigger_found = Deze workflow heeft een <c>workflow_dispatch</c> event trigger.
 workflow.dispatch.success = Workflow-run is met succes aangevraagd.
 workflow.dispatch.use_from = Gebruik workflow van
@@ -3560,10 +3447,6 @@ workflow.dispatch.input_required = Waarde vereist voor invoer “%s”.
 runs.expire_log_message = Logs zijn verwijderd omdat ze te oud waren.
 runs.no_workflows.help_no_write_access = Om meer te weten te komen over Forgejo Acties, zie <a target="_blank" rel="noopener noreferrer" href="%s">de documentatie</a>.
 runs.no_workflows.help_write_access = Weet je niet hoe je moet beginnen met Forgejo Actions? Bekijk de <a target="_blank" rel="noopener noreferrer" href="%s">snelstart in de gebruikersdocumentatie</a> om je eerste workflow te schrijven en <a target="_blank" rel="noopener noreferrer" href="%s">stel vervolgens een Forgejo runner in</a> om je jobs uit te voeren.
-variables.not_found = De variabele kon niet gevonden worden.
-
-
-
 
 [projects]
 type-1.display_name = Individueel project
@@ -3611,10 +3494,6 @@ regexp = RegExp
 [munits.data]
 
 [markup]
-filepreview.line = Lijn %[1]d in %[2]s
-filepreview.lines = Lijnen %[1]d naar %[2]d in %[3]s
-filepreview.truncated = Voorbeeld is ingekort
-
 
 [translation_meta]
 test = Oké
diff --git a/options/locale/locale_pl-PL.ini b/options/locale/locale_pl-PL.ini
index cc3b9daafe..7354373710 100644
--- a/options/locale/locale_pl-PL.ini
+++ b/options/locale/locale_pl-PL.ini
@@ -33,18 +33,6 @@ twofa=Uwierzytelnianie dwuskładnikowe
 twofa_scratch=Kod jednorazowy uwierzytelniania dwuskładnikowego
 passcode=Kod dostępu
 
-webauthn_insert_key=Podłącz swój klucz bezpieczeństwa
-webauthn_sign_in=Naciśnij przycisk na swoim kluczu bezpieczeństwa. Jeśli go nie posiada, podłącz go ponownie.
-webauthn_press_button=Naciśnij przycisk na swoim kluczu bezpieczeństwa…
-webauthn_use_twofa=Użyj kodu uwierzytelniania dwuskładnikowego ze swojego telefonu
-webauthn_error=Nie można odczytać Twojego klucza bezpieczeństwa.
-webauthn_unsupported_browser=Twoja przeglądarka nie obsługuje obecnie WebAuthn.
-webauthn_error_unknown=Wystąpił nieznany błąd. Spróbuj ponownie.
-webauthn_error_insecure=`WebAuthn obsługuje tylko bezpieczne połączenia. Do testowania przez HTTP można użyć "localhost" lub "127.0.0.1"`
-webauthn_error_unable_to_process=Serwer nie mógł obsłużyć Twojego żądania.
-webauthn_error_duplicated=Klucz bezpieczeństwa nie jest dozwolony dla tego żądania. Upewnij się, że klucz nie jest już zarejestrowany.
-webauthn_error_empty=Musisz ustawić nazwę dla tego klucza.
-webauthn_error_timeout=Osiągnięto limit czasu zanim Twój klucz może zostać odczytany. Odśwież stronę i spróbuj ponownie.
 repository=Repozytorium
 organization=Organizacja
 mirror=Kopia lustrzana
@@ -1122,14 +1110,6 @@ migrate_options_lfs=Migruj pliki LFS
 migrate_options_lfs_endpoint.label=Punkt końcowy LFS
 migrate_options_lfs_endpoint.description=Migracja spróbuje użyć Git remote, aby <a target="_blank" rel="noopener noreferrer" href="%s">określić serwer LFS</a>. Możesz również określić niestandardowy punkt końcowy, jeśli dane repozytorium LFS są przechowywane gdzieś indziej.
 migrate_options_lfs_endpoint.description.local=Obsługiwana jest również lokalna ścieżka serwera.
-migrate_items=Elementy migracji
-migrate_items_wiki=Wiki
-migrate_items_milestones=Kamienie milowe
-migrate_items_labels=Etykiety
-migrate_items_issues=Zgłoszenia
-migrate_items_pullrequests=Pull requesty
-migrate_items_merge_requests=Requesty scalające
-migrate_items_releases=Wydania
 migrate_repo=Migruj repozytorium
 migrate.clone_address=Migruj / Klonuj z adresu URL
 migrate.clone_address_desc=Adres HTTP(S) lub "klona" Gita istniejącego repozytorium
@@ -1145,14 +1125,6 @@ migrate.migrate=Migracja z %s
 migrate.migrating=Migrowanie z <b>%s</b>…
 migrate.migrating_failed=Migrowanie z <b>%s</b> nie powiodło się.
 migrate.migrating_failed_no_addr=Migracja nie powiodła się.
-migrate.migrating_git=Migracja danych Git
-migrate.migrating_topics=Migracja tematów
-migrate.migrating_milestones=Migracja kamieni milowych
-migrate.migrating_labels=Migracja etykiet
-migrate.migrating_releases=Migracja wydań
-migrate.migrating_issues=Migracja zgłoszeń
-migrate.migrating_pulls=Migracja pull requestów
-
 mirror_from=kopia lustrzana
 forked_from=sforkowany z
 generated_from=wygenerowane z
@@ -2233,8 +2205,6 @@ summary_card_alt = Karta podsumowania repozytorium %s
 tree_path_not_found.tag = Ścieżka %[1]s nie istnieje w tagu %[2]s
 archive.pull.noreview = To repozytorium jest zarchiwizowane. Nie możesz recenzować pull requestów.
 migrate.migrating_failed.error = Nie udało się migrować: %s
-migrate.cancel_migrating_title = Anuluj migrację
-migrate.cancel_migrating_confirm = Czy chcesz anulować tę migrację?
 migrate.github_token_desc = Możesz wprowadzić tutaj jeden lub więcej tokenów oddzielonych przecinkiem by przeprowadzić migrację szybciej w związku z ograniczeniem GitHub API. OSTRZEŻENIE: Nadużywanie tej funkcjonalności może naruszyć politykę dostawcy usług i doprowadzić do zablokowania konta.
 migrate.invalid_local_path = Ścieżka lokalna jest niepoprawna. Nie istnieje lub nie jest katalogiem.
 issues.review.add_remove_review_requests = poprosił o recenzje od %[1]s i cofnął prośby o recenzje od %[2]s %[3]s
@@ -2370,7 +2340,6 @@ settings.packagist_package_url = URL pakietu Packagist
 settings.update_protect_branch_success = Ochrona gałęzi dla reguły "%s" została zaktualizowana.
 topic.format_prompt = Tematy muszą zaczynać się od litery lub liczby, mogą zawierać myślniki ("-") i kropki ("."), mogą być długie do 35 znaków. Litery muszą być małe.
 find_file.go_to_file = Szukaj pliku
-n_branch_few = %s gałęzie
 issues.dismiss_review = Odrzuć recenzję
 settings.trust_model.collaboratorcommitter = Współpracownik+Commitujący
 release.type_attachment = Załącznik
@@ -2430,9 +2399,6 @@ activity.navbar.recent_commits = Ostatnie commity
 signing.wont_sign.headsigned = To scalenie nie będzie podpisane ponieważ head commit nie jest podpisany.
 pulls.has_changed_since_last_review = Zmiany od twojej ostatniej recenzji
 find_file.no_matching = Nie znaleziono pasujących plików
-n_tag_one = %s tag
-n_tag_few = %s tagi
-n_release_few = %s wydań
 no_eol.text = Brak znaku końca linii
 editor.add_file = Dodaj plik
 pulls.has_merged = Niepowodzenie: Pull request został scalony, nie możesz scalić ponownie lub zmienić gałęzi docelowej.
@@ -2459,11 +2425,7 @@ pulls.blocked_by_official_review_requests = Ten pull request jest zablokowany po
 pulls.wrong_commit_id = Identyfikator commitu musi być identyfikatorem commitu na gałęzi docelowej
 pulls.rebase_merge_commit_pull_request = Zmiana bazy, potem utwórz commit scalający
 branch.tag_collision = Gałąź "%s" nie może zostać utworzona, ponieważ tag z tą samą nazwą już istnieje w tym repozytorium.
-n_commit_one = %s commit
-n_commit_few = %s commity
 file_follow = Podążaj za dowiązaniem
-n_branch_one = %s gałąź
-n_release_one = %s wydanie
 editor.new_branch_name = Nazwij nową gałąź dla tego commita
 issues.action_check = Zaznacz/Odznacz
 issues.close = Zamknij zgłoszenie
@@ -2950,34 +2912,6 @@ dashboard.resync_all_hooks=Ponownie synchronizuj hooki Git we wszystkich repozyt
 dashboard.reinit_missing_repos=Ponownie zainicjalizuj wszystkie brakujące repozytoria Git, dla których istnieją rekordy
 dashboard.sync_external_users=Synchronizuj zewnętrzne dane użytkownika
 dashboard.cleanup_hook_task_table=Wyczyść tabelę hook_task
-dashboard.server_uptime=Czas pracy serwera
-dashboard.current_goroutine=Bieżące goroutines
-dashboard.current_memory_usage=Bieżące użycie pamięci
-dashboard.total_memory_allocated=Całkowita przydzielona pamięć
-dashboard.memory_obtained=Pamięć uzyskana
-dashboard.pointer_lookup_times=Czas określania wskaźników
-dashboard.memory_allocate_times=Alokacje pamięci
-dashboard.memory_free_times=Zwolnienie pamięci
-dashboard.current_heap_usage=Bieżące użycie sterty
-dashboard.heap_memory_obtained=Uzyskana pamięć sterty
-dashboard.heap_memory_idle=Bezczynna pamięć sterty
-dashboard.heap_memory_in_use=Używana pamięć sterty
-dashboard.heap_memory_released=Zwolniona pamięć sterty
-dashboard.heap_objects=Ilość obiektów na stercie
-dashboard.bootstrap_stack_usage=Użycie stosu bootstrap
-dashboard.stack_memory_obtained=Uzyskana pamięć stosu
-dashboard.mspan_structures_usage=Użycie struktur MSpan
-dashboard.mspan_structures_obtained=Uzyskane struktury MSpan
-dashboard.mcache_structures_usage=Użycie struktur MCache
-dashboard.mcache_structures_obtained=Uzyskane struktury MCache
-dashboard.profiling_bucket_hash_table_obtained=Uzyskana tablica haszująca profilowania
-dashboard.gc_metadata_obtained=Ilość metadanych uzyskanych przez GC
-dashboard.other_system_allocation_obtained=Inne uzyskane alokacje systemowe
-dashboard.next_gc_recycle=Następne wywołanie GC
-dashboard.last_gc_time=Czas od ostatniego wywołania GC
-dashboard.total_gc_pause=Sumaryczny czas wstrzymania przez GC
-dashboard.last_gc_pause=Ostatnie wstrzymanie przez GC
-dashboard.gc_times=Ilość wywołań GC
 dashboard.delete_old_actions=Usuń wszystkie stare akcje z bazy danych
 dashboard.delete_old_actions.started=Usuwanie wszystkich starych akcji z bazy danych rozpoczęte.
 
@@ -3017,10 +2951,6 @@ users.still_own_repo=Ten użytkownik jest właścicielem jednego lub większej i
 users.still_has_org=Ten użytkownik jest członkiem organizacji. Musisz go najpierw usunąć ze wszystkich organizacji.
 users.deletion_success=Konto użytkownika zostało usunięte.
 users.reset_2fa=Zresetuj 2FA
-users.list_status_filter.is_active=Aktywne
-users.list_status_filter.is_admin=Administrator
-users.list_status_filter.is_restricted=Ograniczone
-
 emails.email_manage_panel=Zarządzanie adresami e-mail
 emails.primary=Podstawowy
 emails.activated=Aktywowany
@@ -3275,20 +3205,6 @@ monitor.process.cancel=Anuluj proces
 monitor.process.cancel_desc=Anulowanie procesu może spowodować utratę danych
 monitor.process.cancel_notices=Anuluj: <strong>%s</strong>?
 
-monitor.queues=Kolejki
-monitor.queue=Kolejka: %s
-monitor.queue.name=Nazwa
-monitor.queue.type=Typ
-monitor.queue.exemplar=Przykładowy typ
-monitor.queue.numberworkers=Liczba procesów pracujących
-monitor.queue.maxnumberworkers=Maksymalna Liczba procesów pracujących
-monitor.queue.settings.title=Ustawienia puli
-monitor.queue.settings.maxnumberworkers=Maksymalna liczba procesów pracujących
-monitor.queue.settings.maxnumberworkers.placeholder=Obecnie %[1]d
-monitor.queue.settings.maxnumberworkers.error=Maksymalna liczba procesów pracujących musi być liczbą
-monitor.queue.settings.submit=Aktualizuj ustawienia
-monitor.queue.settings.changed=Zaktualizowano ustawienia
-
 notices.system_notice_list=Powiadomienia systemu
 notices.view_detail_header=Szczegóły powiadomienia
 notices.select_all=Wybierz wszystkie
@@ -3306,17 +3222,14 @@ monitor.last_execution_result = Wynik
 monitor.process.children = Dzieci
 integrations = Integracje
 users.bot = Bot
-users.list_status_filter.menu_text = Filtr
 packages.version = Wersja
 packages.creator = Twórca
-users.list_status_filter.not_active = Nieaktywne
 notices.operations = Operacje
 config.send_test_mail_submit = Wyślij
 packages.published = Opublikowane
 config.mailer_protocol = Protokół
 monitor.stats = Statystyki
 users.remote = Zdalnie
-users.list_status_filter.reset = Zresetuj
 config_summary = Podsumowanie
 config_settings = Ustawienia
 assets = Zasoby kodu
@@ -3337,10 +3250,6 @@ dashboard.stop_zombie_tasks = Zatrzymaj zadania zombi akcji
 users.cannot_delete_self = Nie możesz usunąć sam(a) siebie
 packages.cleanup.success = Pomyślnie wyczyszczono przedawnione dane
 dashboard.sync_tag.started = Synchronizacja tagu rozpoczęta
-users.list_status_filter.not_restricted = Nie ograniczony
-users.list_status_filter.is_prohibit_login = Zabroń logowania
-users.list_status_filter.not_prohibit_login = Zezwól na logowanie
-users.list_status_filter.is_2fa_enabled = 2FA włączone
 dashboard.gc_lfs = Wywołaj GC na metaobiektach LFS
 dashboard.stop_endless_tasks = Zatrzymaj niekończące się zadania akcji
 repos.lfs_size = Wielkość LFS
@@ -3356,8 +3265,6 @@ users.restricted.description = Zezwól tylko na interakcje z repozytoriami i org
 users.local_import.description = Zezwól na importowanie repozytoriów z lokalnego systemu plików serwera. To może być problemem zabezpieczeń.
 users.organization_creation.description = Zezwól na tworzenie nowych organizacji.
 users.still_own_packages = Ten użytkownik nadal jest właścicielem jednego lub więcej pakietów, usuń najpierw te pakiety.
-users.list_status_filter.not_admin = Nie administrator
-users.list_status_filter.not_2fa_enabled = 2FA wyłączone
 emails.change_email_text = Czy jesteś pewien(-na), że chcesz zaktualizować ten adres e-mail?
 emails.delete = Usuń adres e-mail
 emails.delete_desc = Czy jesteś pewien(-na), że chcesz usunąć ten adres e-mail?
@@ -3369,9 +3276,6 @@ dashboard.new_version_hint = Forgejo %s jest już dostępne, w tej chwili korzys
 identity_access = Tożsamość i dostęp
 dashboard.cron.cancelled = Cron: %[1]s anulowany: %[3]s
 config.domain = Domena serwera
-monitor.queue.activeworkers = Aktywne procesy pracujące
-monitor.queue.settings.remove_all_items = Usuń wszystkie
-monitor.queue.settings.desc = Pule rosną dynamicznie w odpowiedzi na blokadę kolejki procesów pracujących.
 config.mailer_config = Konfiguracja Mailer
 auths.tip.gitea = Zarejestruj nową aplikację OAuth2. Przewodnik można znaleźć na %s
 auths.unable_to_initialize_openid = Nie można zainicjalizować Dostawcy Uwierzytelniania OpenID Connect: %s
@@ -3379,7 +3283,6 @@ auths.force_smtps = Wymuś SMTPS
 auths.helo_hostname = Nazwa hosta HELO
 self_check = Autoweryfikacja
 config.mailer_enable_helo = Włącz HELO
-monitor.queue.settings.remove_all_items_done = Wszystkie elementy w kolejce zostały usunięte.
 auths.tips.gmail_settings = Ustawienia Gmail:
 auths.map_group_to_team_removal = Usuń użytkowników z synchronizowanych zespołów jeżeli użytkownik nie należy do odpowiadającej grupy LDAP
 auths.enable_ldap_groups = Włącz grupy LDAP
@@ -3396,8 +3299,6 @@ config.mailer_use_dummy = Testowa
 config.cache_test_failed = Nie udało się zbadać pamięci podręcznej: %v.
 config.cache_test = Przetestuj Pamięć Podręczną
 monitor.processes_count = %d Procesów
-monitor.queue.numberinqueue = Liczba w kolejce
-monitor.queue.review_add = Sprawdź / dodaj procesy pracujące
 self_check.no_problem_found = Nie znaleziono jeszcze żadnych problemów.
 config.cache_test_succeeded = Test pamięci podręcznej zakończony powodzeniem, otrzymano odpowiedź w ciągu %s.
 auths.login_source_exist = Źródło uwierzytelniania "%s" już istnieje.
@@ -3529,28 +3430,13 @@ management = Zarządzaj sekretami
 deletion.failed = Nie udało się usunąć sekretu.
 
 [actions]
-variables = Zmienne
 variables.id_not_exist = Zmienna o ID %d nie istnieje.
-variables.edit = Edytuj Zmienną
-variables.update.failed = Nie udało się zmienić zmiennej.
-variables.creation.success = Zmienna "%s" została dodana.
-variables.creation.failed = Nie udało się dodać zmiennej.
-variables.deletion.success = Zmienna została usunięta.
-variables.update.success = Zmienna została zmieniona.
-variables.deletion.failed = Nie udało się usunąć zmiennej.
 runs.no_workflows.help_write_access = Nie wiesz jak zacząć z Forgejo Actions? Sprawdź <a target="_blank" rel="noopener noreferrer" href="%s">szybki start w dokumentacji użytkownika</a> i napisz swój pierwszy proces pracy, a następnie <a target="_blank" rel="noopener noreferrer" href="%s">skonfiguruj runnera Forgejo</a> by wykonywał twoje zadania.
-variables.deletion.description = Usunięcie zmiennej jest permanentne i nie może zostać cofnięte. Kontynuować?
-variables.deletion = Usuń zmienną
-variables.management = Zarządzaj zmiennymi
 runs.expire_log_message = Logi zostały oczyszczone ponieważ były za stare.
-variables.none = Nie ma jeszcze zmiennych.
 runs.empty_commit_message = (pusta wiadomość commita)
-variables.creation = Dodaj zmienną
 runs.no_workflows.help_no_write_access = By dowiedzieć się o Forgejo Actions, zobacz <a target="_blank" rel="noopener noreferrer" href="%s">dokumentację</a>.
-variables.description = Zmienne będą przekazane pewnym akcjom, nie mogą być odczytane inaczej.
 workflow.disable = Wyłącz proces pracy
 unit.desc = Zarządzaj zintegrowanymi procesami CI/CD z Forgejo Actions.
-variables.not_found = Nie udało się znaleźć zmiennej.
 runs.no_runs = Ten proces pracy nie ma jeszcze uruchomień.
 workflow.dispatch.use_from = Wykorzystaj proces pracy z
 workflow.disabled = Proces pracy jest wyłączony.
@@ -3613,9 +3499,6 @@ regexp_tooltip = Interpretuj wyszukiwane hasło jako wyrażenie regularne
 
 
 [markup]
-filepreview.lines = Linie %[1]d do %[2]d w %[3]s
-filepreview.truncated = Podgląd został przycięty
-filepreview.line = Linia %[1]d w %[2]s
 
 [translation_meta]
 test = Litwo, Ojczyzno moja! ty jesteś jak zdrowie; ile cię trzeba cenić, ten tylko się dowie, kto cię stracił. Dziś piękność twą w całej ozdobie widzę i opisuję, bo tęsknię po tobie :)
diff --git a/options/locale/locale_pt-BR.ini b/options/locale/locale_pt-BR.ini
index 0c8436fb56..7e505b6920 100644
--- a/options/locale/locale_pt-BR.ini
+++ b/options/locale/locale_pt-BR.ini
@@ -36,18 +36,6 @@ twofa=Autenticação de dois fatores
 twofa_scratch=Código de uso único da autenticação de dois fatores
 passcode=Senha
 
-webauthn_insert_key=Insira sua chave de segurança
-webauthn_sign_in=Pressione o botão na sua chave de segurança. Caso a sua chave de segurança não possuir um botão, insira-a novamente.
-webauthn_press_button=Pressione o botão na sua chave de segurança…
-webauthn_use_twofa=Use um código de duas etapas do seu telefone
-webauthn_error=Não foi possível ler sua chave de segurança.
-webauthn_unsupported_browser=Seu navegador não oferece suporte ao WebAuthn.
-webauthn_error_unknown=Ocorreu um erro desconhecido. Tente novamente.
-webauthn_error_insecure=WebAuthn suporta apenas conexões seguras. Para testar via HTTP, você pode usar a origem "localhost" ou "127.0.0.1"
-webauthn_error_unable_to_process=O servidor não pôde processar sua solicitação.
-webauthn_error_duplicated=A chave de segurança não é permitida para esta solicitação. Por favor, certifique-se que a chave já não está registrada.
-webauthn_error_empty=Você deve definir um nome para esta chave.
-webauthn_error_timeout=Não foi possível ler a sua chave de segurança antes do tempo limite. Atualize a página e tente novamente.
 repository=Repositório
 organization=Organização
 mirror=Espelhamento
@@ -1146,14 +1134,6 @@ migrate_options_lfs_endpoint.label=Destino LFS
 migrate_options_lfs_endpoint.description=A migração tentará usar seu controle remoto Git para <a target="_blank" rel="noopener noreferrer" href="%s">determinar o servidor LFS</a>. Você também pode especificar um destino personalizado se os dados do repositório LFS forem armazenados em outro lugar.
 migrate_options_lfs_endpoint.description.local=Um caminho de servidor local também é suportado.
 migrate_options_lfs_endpoint.placeholder=Se for deixado em branco, o endpoint será derivado do URL do clone
-migrate_items=Itens da migração
-migrate_items_wiki=Wiki
-migrate_items_milestones=Marcos
-migrate_items_labels=Etiquetas
-migrate_items_issues=Issues
-migrate_items_pullrequests=Propostas de revisão
-migrate_items_merge_requests=Pedidos de merge
-migrate_items_releases=Versões
 migrate_repo=Migrar repositório
 migrate.clone_address=Migrar / Clonar de URL
 migrate.clone_address_desc=URL HTTP(S) ou comando git "clone" de um repositório existente
@@ -1172,16 +1152,6 @@ migrate.migrating=Migrando de <b>%s</b> …
 migrate.migrating_failed=Migração a partir de <b>%s</b> falhou.
 migrate.migrating_failed.error=Falha ao migrar: %s
 migrate.migrating_failed_no_addr=A migração falhou.
-migrate.migrating_git=Migrando dados Git
-migrate.migrating_topics=Migrando tópicos
-migrate.migrating_milestones=Migrando marcos
-migrate.migrating_labels=Migrando rótulos
-migrate.migrating_releases=Migrando releases
-migrate.migrating_issues=Migrando issues
-migrate.migrating_pulls=Migrando propostas de revisão
-migrate.cancel_migrating_title=Cancelar migração
-migrate.cancel_migrating_confirm=Você quer cancelar essa migração?
-
 mirror_from=espelhamento de
 forked_from=feito fork de
 generated_from=gerado a partir de
@@ -2580,10 +2550,7 @@ settings.units.units = Unidades
 vendored = Externo
 issues.num_participants_one = %d participante
 issues.archived_label_description = (arquivada) %s
-n_branch_few = %s ramos
 stars = Favoritos
-n_commit_one = %s commit
-n_tag_few = %s etiquetas
 settings.federation_settings = Configurações de federação
 settings.confirm_wiki_branch_rename = Renomar o ramo da wiki
 activity.navbar.recent_commits = Commits recentes
@@ -2595,15 +2562,10 @@ contributors.contribution_type.additions = Adições
 contributors.contribution_type.deletions = Remoções
 settings.transfer.button = Transferir titularidade
 settings.transfer.modal.title = Transferir titularidade
-n_commit_few = %s commits
-n_branch_one = %s ramo
-n_tag_one = %s etiqueta
 file_follow = Seguir ligação simbólica
 open_with_editor = Abrir com %s
 wiki.search = Pesquisar na wiki
 wiki.no_search_results = Nenhum resultado
-n_release_one = %s versão
-n_release_few = %s versões
 form.string_too_long = O texto fornecido possui mais que %d caracteres.
 branch.branch_name_conflict = O nome do ramo "%s" está em conflito com o ramo "%s" já existente.
 settings.graphql_url = URL do GraphQL
@@ -2958,34 +2920,6 @@ dashboard.reinit_missing_repos=Reinicializar todos os repositórios Git perdidos
 dashboard.sync_external_users=Sincronizar dados de usuário externo
 dashboard.cleanup_hook_task_table=Limpar tabela hook_task
 dashboard.cleanup_packages=Limpar pacotes expirados
-dashboard.server_uptime=Tempo de atividade do servidor
-dashboard.current_goroutine=Goroutines atuais
-dashboard.current_memory_usage=Uso de memória atual
-dashboard.total_memory_allocated=Total de memória alocada
-dashboard.memory_obtained=Memória obtida
-dashboard.pointer_lookup_times=Número de consultas a ponteiros
-dashboard.memory_allocate_times=Alocações de memória
-dashboard.memory_free_times=Liberações de memória
-dashboard.current_heap_usage=Uso atual da heap
-dashboard.heap_memory_obtained=Memória de heap obtida
-dashboard.heap_memory_idle=Memória de heap ociosa
-dashboard.heap_memory_in_use=Memória de heap em uso
-dashboard.heap_memory_released=Memória de heap liberada
-dashboard.heap_objects=Objetos na heap
-dashboard.bootstrap_stack_usage=Uso de pilha bootstrap
-dashboard.stack_memory_obtained=Memória de pilha obtida
-dashboard.mspan_structures_usage=Uso de estruturas MSpan
-dashboard.mspan_structures_obtained=Estruturas MSpan obtidas
-dashboard.mcache_structures_usage=Uso de estruturas MCache
-dashboard.mcache_structures_obtained=Estruturas MCache obtidas
-dashboard.profiling_bucket_hash_table_obtained=Hash table de profiling bucket obtida
-dashboard.gc_metadata_obtained=Metadados do GC obtidos
-dashboard.other_system_allocation_obtained=Outra alocação de sistema obtida
-dashboard.next_gc_recycle=Próxima reciclagem do GC
-dashboard.last_gc_time=Tempo desde última GC
-dashboard.total_gc_pause=Pausa total de GC
-dashboard.last_gc_pause=Última pausa de GC
-dashboard.gc_times=Número de execuções do GC
 dashboard.delete_old_actions=Excluir todas as atividades antigas do banco de dados
 dashboard.delete_old_actions.started=A exclusão de todas as atividades antigas do banco de dados foi iniciada.
 dashboard.update_checker=Verificador de atualização
@@ -3037,18 +2971,6 @@ users.purge_help=Exclua forçosamente o usuário e quaisquer repositórios, orga
 users.still_own_packages=Este usuário é dono de um ou mais pacotes. Exclua estes pacotes antes de continuar.
 users.deletion_success=A conta de usuário foi excluída.
 users.reset_2fa=Reinicializar 2FA
-users.list_status_filter.menu_text=Filtro
-users.list_status_filter.reset=Reset
-users.list_status_filter.is_active=Ativo
-users.list_status_filter.not_active=Inativo
-users.list_status_filter.is_admin=Administrador
-users.list_status_filter.not_admin=Não administrador
-users.list_status_filter.is_restricted=Restrito
-users.list_status_filter.not_restricted=Não restrito
-users.list_status_filter.is_prohibit_login=Proibir login
-users.list_status_filter.not_prohibit_login=Permitir login
-users.list_status_filter.is_2fa_enabled=Autenticação de dois fatores ativada
-users.list_status_filter.not_2fa_enabled=Autenticação em duas etapas desativada
 users.details=Detalhes do usuário
 
 emails.email_manage_panel=Gerenciar e-mails de usuários
@@ -3362,23 +3284,6 @@ monitor.process.cancel_desc=Cancelar um processo pode causar perda de dados
 monitor.process.cancel_notices=Cancelar: <strong>%s</strong>?
 monitor.process.children=Descendentes
 
-monitor.queues=Filas
-monitor.queue=Fila: %s
-monitor.queue.name=Nome
-monitor.queue.type=Tipo
-monitor.queue.exemplar=Tipo de modelo
-monitor.queue.numberworkers=Número de workers
-monitor.queue.maxnumberworkers=Número máximo de workers
-monitor.queue.numberinqueue=Número na fila
-monitor.queue.settings.title=Configurações do pool
-monitor.queue.settings.maxnumberworkers=Número máximo de executores
-monitor.queue.settings.maxnumberworkers.placeholder=Atualmente %[1]d
-monitor.queue.settings.maxnumberworkers.error=Número máximo de executores deve ser um número
-monitor.queue.settings.submit=Atualizar configurações
-monitor.queue.settings.changed=Configurações atualizadas
-monitor.queue.settings.remove_all_items=Remover tudo
-monitor.queue.settings.remove_all_items_done=Todos os itens da fila foram removidos.
-
 notices.system_notice_list=Avisos do sistema
 notices.view_detail_header=Detalhes do aviso
 notices.operations=Operações
@@ -3415,15 +3320,12 @@ dashboard.task.cancelled = Tarefa: %[1]s cancelada: %[3]s
 dashboard.sync_branch.started = Sincronização de ramos iniciada
 dashboard.sync_repo_branches = Sincronizar ramos perdidos do Git para o banco de dados
 packages.cleanup.success = Os dados expirados foram limpos com sucesso
-monitor.queue.activeworkers = Processos ativos
 systemhooks.desc = Os webhooks fazem automaticamente solicitações HTTP POST para um servidor quando certos eventos Forgejo são acionados. Os webhooks definidos aqui atuarão em todos os repositórios do sistema, então, considere quaisquer implicações de desempenho que isso possa ter. Leia mais no <a target="_blank" rel="noopener" href="%s">guia de webhooks</a>.
 defaulthooks.desc = Os webhooks fazem automaticamente solicitações HTTP POST para um servidor quando certos eventos Forgejo são acionados. Os webhooks definidos aqui são padrões e serão copiados para todos os novos repositórios. Leia mais no <a target="_blank" rel="noopener" href="%s">guia de webhooks</a>.
 self_check.database_fix_mysql = Para usuários do MySQL/MariaDB, você pode usar o comando "forgejo doctor convert" para corrigir os problemas de ordenamento, ou também pode corrigir o problema usando "ALTER ... COLLATE ..." SQLs manualmente.
-monitor.queue.settings.desc = Os pools crescem dinamicamente quando as filas de seus workers ficam bloqueadas.
 config.cache_test_succeeded = Teste de cache bem-sucedido, obteve uma resposta em %s.
 self_check.database_inconsistent_collation_columns = O banco de dados está usando o ordenamento %s, mas essas colunas estão usando ordenamentos incompatíveis. Isso pode causar alguns problemas inesperados.
 dashboard.rebuild_issue_indexer = Reconstruir indexador de problemas
-monitor.queue.review_add = Revisar / adicionar workers
 assets = Ativos de código
 config.open_with_editor_app_help = Os editores "Abrir com" para o menu clone. Se deixado em branco, o padrão será usado. Expanda para ver o padrão.
 config.cache_test_slow = Teste de cache bem-sucedido, mas a resposta é lenta: %s.
@@ -3536,21 +3438,8 @@ management=Gerenciamento de segredos
 unit.desc=Gerenciar pipelines integradas de CI/CD com Forgejo Actions.
 
 need_approval_desc=Precisa de aprovação para executar workflows para pull request do fork.
-variables.edit = Editar variável
-variables.deletion.success = A variável foi removida.
-variables.creation.success = A variável "%s" foi adicionada.
-variables.update.success = A variável foi editada.
-variables.creation = Adicionar variável
-variables.deletion = Remover variável
-variables.management = Gerenciar variáveis
-variables.none = Ainda não há variáveis.
-variables.update.failed = Falha ao editar a variável.
 runs.empty_commit_message = (mensagem de commit vazia)
-variables = Variáveis
 variables.id_not_exist = A variável com o ID %d não existe.
-variables.deletion.failed = Falha ao remover a variável.
-variables.creation.failed = Falha ao adicionar a variável.
-variables.description = As variáveis serão passadas para certas Actions e não poderão ser lidas de outra forma.
 workflow.dispatch.trigger_found = Este workflow tem um disparador de evento <c>workflow_dispatch</c>.
 workflow.dispatch.run = Executar workflow
 runs.no_runs = O workflow ainda não foi executado.
@@ -3564,12 +3453,9 @@ workflow.enable_success = Workflow "%s" ativado com sucesso.
 workflow.dispatch.success = Execução do workflow solicitada com sucesso.
 workflow.dispatch.input_required = Exigir um valor para a entrada "%s".
 workflow.dispatch.invalid_input_type = Tipo de entrada "%s" inválido.
-variables.deletion.description = Apagar uma variável é permanente e não pode ser desfeito. Continuar?
 runs.expire_log_message = Os logs foram apagados pois eram antigos demais.
 runs.no_workflows.help_no_write_access = Para aprender sobre as Actions do Forgejo, veja <a target="_blank" rel="noopener noreferrer" href="%s">a documentação</a>.
 runs.no_workflows.help_write_access = Não sabe como começar a usar as Actions do Forgejo? Veja o <a target="_blank" rel="noopener noreferrer" href="%s">guia de como começar na documentação do usuário</a> para escrever seu primeiro workflow, depois <a target="_blank" rel="noopener noreferrer" href="%s">configure um runner do Forgejo</a> para executar trabalhos.
-variables.not_found = Não foi possível encontrar a variável.
-
 
 [projects]
 type-1.display_name=Projeto individual
@@ -3617,9 +3503,6 @@ regexp = ExpReg
 [munits.data]
 
 [markup]
-filepreview.line = Linha %[1]d em %[2]s
-filepreview.lines = Linhas %[1]d a %[2]d em %[3]s
-filepreview.truncated = Pré-visualização truncada
 
 [repo.permissions]
 pulls.write = <b>Escrita:</b> Encerrar propostas de revisão e gerir metadados como rótulos, marcos, responsáveis, prazos e dependências.
diff --git a/options/locale/locale_pt-PT.ini b/options/locale/locale_pt-PT.ini
index 03a2ea5d8a..cede616bce 100644
--- a/options/locale/locale_pt-PT.ini
+++ b/options/locale/locale_pt-PT.ini
@@ -37,18 +37,6 @@ twofa=Autenticação de dois fatores
 twofa_scratch=Código de uso único de dois fatores
 passcode=Código
 
-webauthn_insert_key=Insira a sua chave de segurança
-webauthn_sign_in=Pressione o botão da sua chave de segurança. Se a sua chave de segurança não tiver um botão, insira-a novamente.
-webauthn_press_button=Por favor, prima o botão da sua chave de segurança…
-webauthn_use_twofa=Usar um código de dois passos do seu telefone
-webauthn_error=Não foi possível ler a sua chave de segurança.
-webauthn_unsupported_browser=O seu navegador não oferece suporte ao WebAuthn.
-webauthn_error_unknown=Ocorreu um erro desconhecido. Tente novamente, por favor.
-webauthn_error_insecure=`WebAuthn apenas suporta conexões seguras. Para testar sobre HTTP, pode usar a origem "localhost" ou "127.0.0.1"`
-webauthn_error_unable_to_process=O servidor não conseguiu processar o seu pedido.
-webauthn_error_duplicated=A chave de segurança não é permitida neste pedido. Certifique-se de que a chave não está já registada.
-webauthn_error_empty=Você tem que definir um nome para esta chave.
-webauthn_error_timeout=O tempo limite foi atingido antes que a sua chave pudesse ser lida. Recarregue esta página e tente novamente.
 repository=Repositório
 organization=Organização
 mirror=Réplica
@@ -1158,14 +1146,6 @@ migrate_options_lfs_endpoint.label=Destino LFS
 migrate_options_lfs_endpoint.description=A migração irá tentar usar o seu controlo remoto do Git para <a target="_blank" rel="noopener noreferrer" href="%s">determinar o servidor LFS</a>. Também pode especificar um destino personalizado se os dados do repositório LFS forem armazenados noutro lugar.
 migrate_options_lfs_endpoint.description.local=Uma localização de servidor local também é suportada.
 migrate_options_lfs_endpoint.placeholder=Se for deixado em branco, o destino será determinado a partir do URL do clone
-migrate_items=Itens da migração
-migrate_items_wiki=Wiki
-migrate_items_milestones=Etapas
-migrate_items_labels=Rótulos
-migrate_items_issues=Questões
-migrate_items_pullrequests=Pedidos de integração
-migrate_items_merge_requests=Pedidos de integração
-migrate_items_releases=Lançamentos
 migrate_repo=Migrar o repositório
 migrate.clone_address=Migrar / clonar a partir do URL
 migrate.clone_address_desc=O URL de clonagem HTTP(S) ou Git de um repositório existente
@@ -1184,16 +1164,6 @@ migrate.migrating=Migrando a partir de <b>%s</b> …
 migrate.migrating_failed=A migração de <b>%s</b> falhou.
 migrate.migrating_failed.error=Falhou a migração: %s
 migrate.migrating_failed_no_addr=A migração falhou.
-migrate.migrating_git=Migrando dados Git
-migrate.migrating_topics=Migrando tópicos
-migrate.migrating_milestones=Migrando etapas
-migrate.migrating_labels=Migrando rótulos
-migrate.migrating_releases=Migrando lançamentos
-migrate.migrating_issues=Migrando questões
-migrate.migrating_pulls=Migrando pedidos de integração
-migrate.cancel_migrating_title=Cancelar migração
-migrate.cancel_migrating_confirm=Quer cancelar esta migração?
-
 mirror_from=réplica de
 forked_from=derivado de
 generated_from=gerado a partir de
@@ -2623,12 +2593,6 @@ open_with_editor = Abrir com %s
 admin.manage_flags = Gerir marcadores
 file_follow = Seguir ligação simbólica
 rss.must_be_on_branch = Tem que estar num ramo que tenha uma fonte RSS.
-n_commit_few = %s cometimentos
-n_branch_one = %s ramo
-n_branch_few = %s ramos
-n_tag_one = %s etiqueta
-n_tag_few = %s etiquetas
-n_commit_one = %s cometimento
 editor.commit_id_not_matching = O ficheiro foi modificado enquanto o estava a editar. Cometa para um ramo novo e depois integre.
 commits.search_branch = Este ramo
 pulls.reopen_failed.base_branch = O pedido de integração não pode ser reaberto porque o ramo base já não existe.
@@ -2689,8 +2653,6 @@ subscribe.pull.guest.tooltip = Inicie sessão para subscrever este pedido de int
 comments.edit.already_changed = Não foi possível guardar as modificações do comentário. O conteúdo parece ter sido modificado por outro utilizador. Refresque a página e tente editar novamente para evitar sobrescrever as modificações que fizeram
 settings.federation_following_repos = URLs de repositórios que estão a ser seguidos. Separe-os com ";" sem espaços em branco.
 settings.federation_not_enabled = A federação não está a habilitada na sua instância.
-n_release_one = %s lançamento
-n_release_few = %s lançamentos
 issues.author.tooltip.issue = Este/a utilizador/a é o/a autor/a desta questão.
 issues.author.tooltip.pr = Este/a utilizador/a é o/a autor/a deste pedido de integração.
 activity.commit = Cometimentos feitos
@@ -2964,34 +2926,6 @@ dashboard.sync_external_users=Sincronizar dados externos do utilizador
 dashboard.cleanup_hook_task_table=Limpar tabela hook_task
 dashboard.cleanup_packages=Limpar pacotes expirados
 dashboard.cleanup_actions=Limpar registos e artefactos expirados das operações
-dashboard.server_uptime=Tempo em funcionamento contínuo do servidor
-dashboard.current_goroutine=Goroutines em execução
-dashboard.current_memory_usage=Utilização de memória corrente
-dashboard.total_memory_allocated=Total de memória alocada
-dashboard.memory_obtained=Memória obtida
-dashboard.pointer_lookup_times=N. º de consultas a ponteiros
-dashboard.memory_allocate_times=Alocações de memória
-dashboard.memory_free_times=Libertações de memória
-dashboard.current_heap_usage=Uso corrente da heap
-dashboard.heap_memory_obtained=Memória heap obtida
-dashboard.heap_memory_idle=Memória heap em repouso
-dashboard.heap_memory_in_use=Memória heap em uso
-dashboard.heap_memory_released=Memória heap libertada
-dashboard.heap_objects=Elementos heap
-dashboard.bootstrap_stack_usage=Uso da pilha de arranque
-dashboard.stack_memory_obtained=Memória da pilha obtida
-dashboard.mspan_structures_usage=Uso das estruturas MSpan
-dashboard.mspan_structures_obtained=Estruturas MSpan obtidas
-dashboard.mcache_structures_usage=Uso das estruturas MCache
-dashboard.mcache_structures_obtained=Estruturas MCache obtidas
-dashboard.profiling_bucket_hash_table_obtained=Perfil obtido da tabela de hash do balde
-dashboard.gc_metadata_obtained=Metadados obtidos da recolha de lixo
-dashboard.other_system_allocation_obtained=Outras alocações de sistema obtidas
-dashboard.next_gc_recycle=Próxima reciclagem da recolha de lixo
-dashboard.last_gc_time=Tempo decorrido desde a última recolha de lixo
-dashboard.total_gc_pause=Pausa total da recolha de lixo
-dashboard.last_gc_pause=Última pausa da recolha de lixo
-dashboard.gc_times=N.º de recolhas de lixo
 dashboard.delete_old_actions=Eliminar todos os trabalhos antigos da base de dados
 dashboard.delete_old_actions.started=Foi iniciado o processo de eliminação de todos os trabalhos antigos da base de dados.
 dashboard.update_checker=Verificador de novas versões
@@ -3049,18 +2983,6 @@ users.purge_help=Eliminar o utilizador à força, juntamente com todos os seus r
 users.still_own_packages=Este utilizador ainda possui um ou mais pacotes, elimine esses pacotes primeiro.
 users.deletion_success=A conta de utilizador foi eliminada.
 users.reset_2fa=Reinicializar a autenticação em dois passos
-users.list_status_filter.menu_text=Filtro
-users.list_status_filter.reset=Reiniciar
-users.list_status_filter.is_active=Ligado
-users.list_status_filter.not_active=Desligado
-users.list_status_filter.is_admin=Administrador
-users.list_status_filter.not_admin=Não Administrador
-users.list_status_filter.is_restricted=Restrito
-users.list_status_filter.not_restricted=Não restrito/a
-users.list_status_filter.is_prohibit_login=Proibir início de sessão
-users.list_status_filter.not_prohibit_login=Permitir início de sessão
-users.list_status_filter.is_2fa_enabled=Autenticação em dois passos habilitada
-users.list_status_filter.not_2fa_enabled=Autenticação em dois passos desabilitada
 users.details=Detalhes do utilizador
 
 emails.email_manage_panel=Gerir endereços de email do utilizador
@@ -3379,26 +3301,6 @@ monitor.process.cancel_desc=Cancelar um processo pode resultar na perda de dados
 monitor.process.cancel_notices=Cancelar: <strong>%s</strong>?
 monitor.process.children=Descendentes
 
-monitor.queues=Filas
-monitor.queue=Fila: %s
-monitor.queue.name=Nome
-monitor.queue.type=Tipo
-monitor.queue.exemplar=Tipo de exemplar
-monitor.queue.numberworkers=N.º de trabalhadores
-monitor.queue.activeworkers=Trabalhadores operantes
-monitor.queue.maxnumberworkers=N.º máximo de trabalhadores
-monitor.queue.numberinqueue=N.º na fila
-monitor.queue.review_add=Rever / adicionar trabalhadores
-monitor.queue.settings.title=Configurações do agregado
-monitor.queue.settings.desc=Agregados crescem dinamicamente em resposta aos bloqueios da sua fila de trabalhadores.
-monitor.queue.settings.maxnumberworkers=N.º máximo de trabalhadores
-monitor.queue.settings.maxnumberworkers.placeholder=De momento %[1]d
-monitor.queue.settings.maxnumberworkers.error=O número máximo de trabalhadores tem que ser um número
-monitor.queue.settings.submit=Modificar configurações
-monitor.queue.settings.changed=Configurações modificadas
-monitor.queue.settings.remove_all_items=Remover tudo
-monitor.queue.settings.remove_all_items_done=Todos os itens da fila foram removidos.
-
 notices.system_notice_list=Notificações do sistema
 notices.view_detail_header=Detalhes da notificação
 notices.operations=Operações
@@ -3543,21 +3445,7 @@ workflow.disabled=A sequência de trabalho está desabilitada.
 
 need_approval_desc=É necessária aprovação para executar sequências de trabalho para a derivação do pedido de integração.
 
-variables=Variáveis
-variables.management=Gerir variáveis
-variables.creation=Adicionar variável
-variables.none=Ainda não há variáveis.
-variables.deletion=Remover variável
-variables.deletion.description=Remover uma variável é permanente e não pode ser revertido. Quer continuar?
-variables.description=As variáveis serão transmitidas a certas operações e não poderão ser lidas de outra forma.
 variables.id_not_exist=A variável com o ID %d não existe.
-variables.edit=Editar variável
-variables.deletion.failed=Falha ao remover a variável.
-variables.deletion.success=A variável foi removida.
-variables.creation.failed=Falha ao adicionar a variável.
-variables.creation.success=A variável "%s" foi adicionada.
-variables.update.failed=Falha ao editar a variável.
-variables.update.success=A variável foi editada.
 workflow.dispatch.use_from = Usar sequência de trabalho de
 workflow.dispatch.run = Executar sequência de trabalho
 workflow.dispatch.input_required = Exigir valor para a entrada "%s".
@@ -3568,7 +3456,6 @@ workflow.dispatch.invalid_input_type = Tipo de entrada "%s" inválido.
 runs.expire_log_message = Os registos foram purgados por serem demasiado antigos.
 runs.no_workflows.help_no_write_access = Para aprender sobre Forgejo Actions, veja<a target="_blank" rel="noopener noreferrer" href="%s">a documentação</a>.
 runs.no_workflows.help_write_access = Não sabe como começar com o Forgejo Actions? Consulte o <a target="_blank" rel="noopener noreferrer" href="%s">início rápido na documentação do utilizador</a> para escrever a sua primeira sequência de trabalho, depois <a target="_blank" rel="noopener noreferrer" href="%s">prepare um executor Forgejo</a> para executar os seus trabalhos.
-variables.not_found = Não foi possível encontrar a variável.
 
 [projects]
 type-1.display_name=Projeto individual
@@ -3616,9 +3503,6 @@ regexp = ExpReg
 [munits.data]
 
 [markup]
-filepreview.lines = Linhas %[1]d até %[2]d em %[3]s
-filepreview.line = Linha %[1]d em %[2]s
-filepreview.truncated = A previsão foi truncada
 
 [translation_meta]
 test = ok :)
diff --git a/options/locale/locale_ro.ini b/options/locale/locale_ro.ini
index b9c1b9a525..ec266dfd90 100644
--- a/options/locale/locale_ro.ini
+++ b/options/locale/locale_ro.ini
@@ -28,14 +28,6 @@ password = Parolă
 access_token = Token de acces
 captcha = CAPTCHA
 twofa = Autentificare prin doi factori
-webauthn_insert_key = Inserează cheia de securitate
-webauthn_press_button = Apasă butonul de pe cheia de securitate…
-webauthn_use_twofa = Folosește un cod de verificare de pe telefon
-webauthn_error = Cheia de securitate nu a putut fi citită.
-webauthn_unsupported_browser = Browserul tău nu are abilități WebAuthn pe moment.
-webauthn_error_unable_to_process = Serverul nu a putut procesa cererea.
-webauthn_error_duplicated = Cheia de securitate nu este permisă pentru această cerere. Asigură-te că cheia nu este înregistrată deja.
-webauthn_error_empty = Trebuie să setezi un nume pentru această cheie.
 organization = Organizație
 mirror = Oglindă
 settings = Setări
@@ -79,9 +71,7 @@ filter = Filtru
 filter.clear = Șterge filtre
 filter.is_archived = Arhivat
 enable_javascript = Acest site are nevoie de JavaScript.
-webauthn_error_unknown = O eroare necunoscută a apărut. Te rog reîncearcă.
 re_type = Confirmă parola
-webauthn_sign_in = Apasă butonul de pe cheia de securitate. Dacă cheia de securitate nu are un buton, reintrodu-o.
 new_mirror = Oglindă nouă
 new_project = Proiect nou
 remove_label_str = Șterge elementul "%s"
@@ -92,8 +82,6 @@ error404 = Pagina pe care încercați să o vizitați fie <strong>nu există</st
 filter.not_archived = Nearhivat
 activities = Activități
 confirm_delete_selected = Ștergi toate elementele selectate?
-webauthn_error_insecure = WebAuthn funcționează doar prin conexiuni securizate. Pentru a testa folosind HTTP, poți folosi "localhost" sau "127.0.0.1" ca origine
-webauthn_error_timeout = Limita de timp a fost depășită înainte ca cheia ta să poată fi citită. Reîncarcă pagina și reîncearcă.
 copy_error = Copiere eșuată
 concept_user_individual = Individual
 unknown = Necunoscut
@@ -303,7 +291,6 @@ default_enable_timetracking = Activează urmărirea timpului în mod implicit
 default_enable_timetracking.description = Permite utilizarea funcției de urmărire a timpului pentru depozitele noi în mod implicit.
 invalid_repo_path = Calea rădăcină a depozitului este invalidă: %v
 run_user_not_match = Numele de utilizator „utilizatorul sub care rulează" nu este același cu numele de utilizator curent: %s -> %s
-
 enable_update_checker_helper_forgejo = Se va verifica periodic noi versiuni de Forgejo prin interogarea unei înregistrări DNS de tip TXT la release.forgejo.org.
 invalid_log_root_path = Calea către fișierul de loguri este invalidă: %v
 password_algorithm_helper = Setează algoritmul de hashing al parolei. Algoritmii au cerințe și puncte forte diferite. Algoritmul argon2 este foarte sigur, însă folosește multă memorie și poate fi nepotrivit pentru sistemele slabe.
diff --git a/options/locale/locale_ru-RU.ini b/options/locale/locale_ru-RU.ini
index 0fd24164b1..43e21a0c18 100644
--- a/options/locale/locale_ru-RU.ini
+++ b/options/locale/locale_ru-RU.ini
@@ -36,18 +36,6 @@ twofa=Двухфакторная аутентификация
 twofa_scratch=Код восстановления 2ФА
 passcode=Код
 
-webauthn_insert_key=Вставьте ваш токен авторизации
-webauthn_sign_in=Подтвердите действие на токене авторизации. Если на вашем токене нет кнопки, вставьте его заново.
-webauthn_press_button=Подтвердите действие на токене авторизации…
-webauthn_use_twofa=Используйте двухфакторный код с вашего телефона
-webauthn_error=Не удалось прочитать токен авторизации.
-webauthn_unsupported_browser=Ваш браузер в настоящее время не поддерживает WebAuthn.
-webauthn_error_unknown=Произошла неизвестная ошибка. Повторите попытку.
-webauthn_error_insecure=WebAuthn поддерживает только безопасные соединения. Для тестирования по HTTP можно использовать "localhost" или "127.0.0.1"
-webauthn_error_unable_to_process=Сервер не смог обработать ваш запрос.
-webauthn_error_duplicated=Этот токен авторизации не разрешен для выполнения этого запроса. Убедитесь, что токен не был зарегистрирован ранее.
-webauthn_error_empty=Необходимо задать имя для этого ключа.
-webauthn_error_timeout=Время истекло раньше, чем ключ был прочитан. Перезагрузите эту страницу и повторите попытку.
 repository=Репозиторий
 organization=Организация
 mirror=Зеркало
@@ -1143,14 +1131,6 @@ migrate_options_lfs=Перенос LFS файлов
 migrate_options_lfs_endpoint.label=Конечная точка LFS
 migrate_options_lfs_endpoint.description=При переносе будет произведена попытка <a target="_blank" rel="noopener noreferrer" href="%s">определить сервер LFS</a> автоматически через Git. Если данные LFS хранятся в другом месте, укажите конечную точку самостоятельно.
 migrate_options_lfs_endpoint.description.local=Также поддерживается путь на локальном сервере.
-migrate_items=Переносимые элементы
-migrate_items_wiki=Вики
-migrate_items_milestones=Этапы
-migrate_items_labels=Метки
-migrate_items_issues=Задачи
-migrate_items_pullrequests=Запросы на слияние
-migrate_items_merge_requests=Запросы на слияние
-migrate_items_releases=Выпуски
 migrate_repo=Перенос репозитория
 migrate.clone_address=Перенос / Клонирование по URL
 migrate.clone_address_desc=HTTP/HTTPS или Git адрес существующего репозитория
@@ -1169,16 +1149,6 @@ migrate.migrating=Перенос из <b>%s</b>…
 migrate.migrating_failed=Перенос из <b>%s</b> не удался.
 migrate.migrating_failed.error=Не удалось перенести: %s
 migrate.migrating_failed_no_addr=Перенос не удался.
-migrate.migrating_git=Перенос данных Git
-migrate.migrating_topics=Перенос тем
-migrate.migrating_milestones=Перенос этапов
-migrate.migrating_labels=Перенос меток
-migrate.migrating_releases=Перенос выпусков
-migrate.migrating_issues=Перенос задач
-migrate.migrating_pulls=Перенос запросов на слияние
-migrate.cancel_migrating_title=Отменить перенос
-migrate.cancel_migrating_confirm=Вы хотите отменить перенос?
-
 mirror_from=зеркало из
 forked_from=ответвлён от
 generated_from=создано из
@@ -2643,12 +2613,6 @@ wiki.original_git_entry_tooltip = Перейти по настоящему пу
 open_with_editor = Открыть в %s
 commits.search_branch = В этой ветви
 stars = Добавившие в избранное
-n_tag_one = %s тег
-n_branch_few = %s ветвей
-n_commit_few = %s коммитов
-n_commit_one = %s коммит
-n_tag_few = %s тегов
-n_branch_one = %s ветвь
 pulls.ready_for_review = Готово к рецензии?
 editor.commit_id_not_matching = Файл был изменён кем-то другим, пока вы его редактировали. Сохраните изменения в новую ветвь и выполните слияние.
 editor.push_out_of_date = Похоже, отправка устарела.
@@ -2686,8 +2650,6 @@ comments.edit.already_changed = Не удалось отредактироват
 settings.federation_settings = Настройки федерации
 settings.federation_apapiurl = Федеративная ссылка на этот репозиторий. Скопируйте и вставьте её в настройки федерации другого репозитория как ссылку отслеживаемого репозитория.
 settings.federation_following_repos = Ссылки на отслеживаемые репозитории. Разделяются с помощью «;», без пробелов.
-n_release_one = %s выпуск
-n_release_few = %s выпусков
 subscribe.issue.guest.tooltip = Войдите, чтобы подписаться на эту задачу.
 subscribe.pull.guest.tooltip = Войдите, чтобы подписаться на это слияние.
 issues.author.tooltip.issue = Автор этой задачи.
@@ -2961,34 +2923,6 @@ dashboard.reinit_missing_repos=Переинициализировать все 
 dashboard.sync_external_users=Синхронизировать данные сторонних пользователей
 dashboard.cleanup_hook_task_table=Очистить таблицу hook_task
 dashboard.cleanup_packages=Удалить устаревшие пакеты
-dashboard.server_uptime=Время работы
-dashboard.current_goroutine=Выполняемые goroutines
-dashboard.current_memory_usage=Текущее использование памяти
-dashboard.total_memory_allocated=Всего памяти выделялось
-dashboard.memory_obtained=Получено памяти
-dashboard.pointer_lookup_times=Поисков указателя
-dashboard.memory_allocate_times=Выделений памяти
-dashboard.memory_free_times=Высвобождений памяти
-dashboard.current_heap_usage=Текущее использование кучи
-dashboard.heap_memory_obtained=Получено динамической памяти
-dashboard.heap_memory_idle=Простаивающая динамическая память
-dashboard.heap_memory_in_use=Используемая динамическая память
-dashboard.heap_memory_released=Освобождено динамической памяти
-dashboard.heap_objects=Объектов динамической памяти
-dashboard.bootstrap_stack_usage=Использование стека загрузчика
-dashboard.stack_memory_obtained=Стековой памяти выделялось
-dashboard.mspan_structures_usage=Использование структур MSpan
-dashboard.mspan_structures_obtained=Структур MSpan выделялось
-dashboard.mcache_structures_usage=Использование структур MCache
-dashboard.mcache_structures_obtained=Получено структур MCache
-dashboard.profiling_bucket_hash_table_obtained=Хеш-таблиц получено при профайлинге
-dashboard.gc_metadata_obtained=Метаданных сборщика мусора создавалось
-dashboard.other_system_allocation_obtained=Прочие системные выделения памяти
-dashboard.next_gc_recycle=Следующее высвобождение сборщиком мусора
-dashboard.last_gc_time=Прошло с последнего сбора мусора
-dashboard.total_gc_pause=Итоговая задержка сборщика
-dashboard.last_gc_pause=Последняя пауза сборщика
-dashboard.gc_times=Сборок мусора
 dashboard.delete_old_actions=Удалить все старые активности из базы данных
 dashboard.delete_old_actions.started=Запущено удаление всех старых активностей из БД.
 dashboard.update_checker=Проверка обновлений
@@ -3042,18 +2976,6 @@ users.purge_help=Принудительно удалить все данные,
 users.still_own_packages=Этот пользователь всё ещё владеет одним или несколькими пакетами, сначала удалите их.
 users.deletion_success=Учётная запись успешно удалена.
 users.reset_2fa=Сброс 2ФА
-users.list_status_filter.menu_text=Фильтр
-users.list_status_filter.reset=Сбросить
-users.list_status_filter.is_active=Активные
-users.list_status_filter.not_active=Неактивные
-users.list_status_filter.is_admin=Администраторы
-users.list_status_filter.not_admin=Не администраторы
-users.list_status_filter.is_restricted=Ограниченные
-users.list_status_filter.not_restricted=Не ограниченные
-users.list_status_filter.is_prohibit_login=Вход запрещён
-users.list_status_filter.not_prohibit_login=Вход разрешён
-users.list_status_filter.is_2fa_enabled=2ФА включена
-users.list_status_filter.not_2fa_enabled=2ФА отключена
 users.details=О пользователе
 
 emails.email_manage_panel=Управление адресами эл. почты пользователей
@@ -3369,25 +3291,6 @@ monitor.process.cancel_desc=Отмена процесса может приве
 monitor.process.cancel_notices=Отменить: <strong>%s</strong>?
 monitor.process.children=Потомки
 
-monitor.queues=Очереди
-monitor.queue=Очередь: %s
-monitor.queue.name=Имя
-monitor.queue.type=Тип
-monitor.queue.exemplar=Тип образца
-monitor.queue.numberworkers=Количество обработчиков
-monitor.queue.activeworkers=Активные обработчики
-monitor.queue.maxnumberworkers=Макс. количество обработчиков
-monitor.queue.numberinqueue=Позиция в очереди
-monitor.queue.settings.title=Настройки пула
-monitor.queue.settings.desc=Пулы динамически растут в зависимости от блокировки очередей их рабочих.
-monitor.queue.settings.maxnumberworkers=Макс. количество обработчиков
-monitor.queue.settings.maxnumberworkers.placeholder=В настоящий момент %[1]d
-monitor.queue.settings.maxnumberworkers.error=Максимальное количество обработчиков должно быть числом
-monitor.queue.settings.submit=Обновить настройки
-monitor.queue.settings.changed=Настройки обновлены
-monitor.queue.settings.remove_all_items=Удалить все
-monitor.queue.settings.remove_all_items_done=Все элементы в очереди были удалены.
-
 notices.system_notice_list=Системные оповещения
 notices.view_detail_header=Подробности уведомления
 notices.operations=Операции
@@ -3426,7 +3329,6 @@ config.open_with_editor_app_help = Приложения для "Открыть 
 config_settings = Настройки
 auths.tips.gmail_settings = Настройки Gmail:
 auths.tip.gitlab_new = Создайте новое приложение в %s
-monitor.queue.review_add = Подробности / добавить обработчики
 auths.default_domain_name = Домен по умолчанию для адресов эл. почты
 config.app_slogan = Лозунг сервера
 config.cache_test = Проверить кэш
@@ -3548,20 +3450,6 @@ workflow.disabled=Рабочий поток выключен.
 
 need_approval_desc=Требуется одобрение, чтобы запустить рабочие потоки для запроса на слияние.
 
-variables=Переменные
-variables.management=Управление переменными
-variables.creation=Добавить переменную
-variables.none=Переменных пока нет.
-variables.deletion=Удалить переменную
-variables.deletion.description=Удаление переменной необратимо, его нельзя отменить. Продолжить?
-variables.description=Переменные будут передаваться определенным действиям и не могут быть прочитаны иначе.
-variables.edit=Изменить переменную
-variables.deletion.failed=Не удалось удалить переменную.
-variables.deletion.success=Переменная удалена.
-variables.creation.failed=Не удалось добавить переменную.
-variables.creation.success=Переменная «%s» добавлена.
-variables.update.failed=Не удалось изменить переменную.
-variables.update.success=Переменная изменена.
 variables.id_not_exist = Переменная с идентификатором %d не существует.
 workflow.dispatch.trigger_found = Этот рабочий поток срабатывает на события <c>workflow_dispatch</c>.
 workflow.dispatch.use_from = Использовать рабочий поток из
@@ -3573,7 +3461,6 @@ workflow.dispatch.warn_input_limit = Отображаются только пе
 runs.expire_log_message = Журнал был удалён из-за старости.
 runs.no_workflows.help_write_access = Не знаете, как начать использовать Действия Forgejo? Ознакомьтесь с <a target="_blank" rel="noopener noreferrer" href="%s">руководством по быстрому старту в документации</a> и создайте первый рабочий поток, затем <a target="_blank" rel="noopener noreferrer" href="%s">настройте исполнитель Forgejo</a>, который будет выполнять задачи.
 runs.no_workflows.help_no_write_access = Ознакомьтесь с <a target="_blank" rel="noopener noreferrer" href="%s">документацией</a>, чтобы узнать про Действия Forgejo.
-variables.not_found = Не удалось найти переменную.
 
 [projects]
 type-1.display_name=Индивидуальный проект
@@ -3620,9 +3507,6 @@ regexp_tooltip = Поисковый запрос будет воспринят 
 
 
 [markup]
-filepreview.line = Строка %[1]d в %[2]s
-filepreview.lines = Строки с %[1]d по %[2]d в %[3]s
-filepreview.truncated = Предпросмотр был обрезан
 
 [translation_meta]
 test = Wake up :)
diff --git a/options/locale/locale_si-LK.ini b/options/locale/locale_si-LK.ini
index df801ec30a..bc07de0e6f 100644
--- a/options/locale/locale_si-LK.ini
+++ b/options/locale/locale_si-LK.ini
@@ -750,14 +750,6 @@ migrate_options_lfs=LFS ගොනු සංක්රමණය
 migrate_options_lfs_endpoint.label=LFS එන්පොයින්ට්
 migrate_options_lfs_endpoint.description=සංක්රමණය ඔබගේ Git දුරස්ථ භාවිතා කිරීමට උත්සාහ කරනු ඇත <a target="_blank" rel="noopener noreferrer" href="%s">LFS සේවාදායකය තීරණය</a>. නිධිය LFS දත්ත වෙන කොහේ හරි ගබඩා කර තිබේ නම් ඔබට අභිරුචි අන්ත ලක්ෂ්යයක් නියම කළ හැකිය.
 migrate_options_lfs_endpoint.description.local=දේශීය සේවාදායක මාර්ගයක් ද සහාය දක්වයි.
-migrate_items=සංක්රමණ අයිතම
-migrate_items_wiki=විකි
-migrate_items_milestones=සන්ධිස්ථාන
-migrate_items_labels=ලේබල
-migrate_items_issues=ගැටළු
-migrate_items_pullrequests=ඉල්ලීම් අදින්න
-migrate_items_merge_requests=සංයුක්ත කිරීමේ ඉල්ලීම්
-migrate_items_releases=නිකුතු
 migrate_repo=නිධිය සංක්රමණය කරන්න
 migrate.clone_address=URL එක සිට සංක්රමණය/පරිගණක ක්රිඩාවට සමාන
 migrate.clone_address_desc=පවතින ගබඩාවේ HTTP (S) හෝ Git 'පරිගණක ක්රිඩාවට සමාන' URL
@@ -773,14 +765,6 @@ migrate.migrate=%sසිට සංක්රමණය
 migrate.migrating=<b>%s</b> සිට සංක්රමණය වීම...
 migrate.migrating_failed=<b>%s</b> සිට සංක්රමණය වීම අසාර්ථක විය.
 migrate.migrating_failed_no_addr=සංක්රමණය අසාර්ථකයි.
-migrate.migrating_git=Git දත්ත සංක්රමණය
-migrate.migrating_topics=සංක්රමණය මාතෘකා
-migrate.migrating_milestones=සංක්රමික සන්ධිස්ථාන
-migrate.migrating_labels=සංක්රමණය ලේබල
-migrate.migrating_releases=සංක්රමණ නිකුතු
-migrate.migrating_issues=සංක්රමණ ගැටළු
-migrate.migrating_pulls=අදින්න ඉල්ලීම් සංක්රමණය
-
 mirror_from=කැඩපත
 forked_from=සිට දෙබලක
 generated_from=වෙතින් ජනනය කරන ලද
@@ -1970,34 +1954,6 @@ dashboard.resync_all_hooks=පෙර ලැබීමට, යාවත්කා
 dashboard.reinit_missing_repos=අතුරුදහන් වූ සියලුම ගිට් නිධි නැවත ආරම්භ කිරීම
 dashboard.sync_external_users=බාහිර පරිශීලක දත්ත සමමුහූර්තනය
 dashboard.cleanup_hook_task_table=පිරිසිදු hook_task වගුව
-dashboard.server_uptime=සේවාදායකය යාවත්කාලීන කිරීම
-dashboard.current_goroutine=වත්මන් ගෝර්අවුට්ලයින්
-dashboard.current_memory_usage=වත්මන් මතක භාවිතය
-dashboard.total_memory_allocated=මුළු මතකය වෙන් කර ඇත
-dashboard.memory_obtained=ලබා ගත් මතකය
-dashboard.pointer_lookup_times=පොයින්ටර් Lookup ටයිම්ස්
-dashboard.memory_allocate_times=මතක ප්රතිපාදන
-dashboard.memory_free_times=මතක නිදහස්
-dashboard.current_heap_usage=වත්මන් heap භාවිතය
-dashboard.heap_memory_obtained=ලබා ගත් ගොඩක් මතකය
-dashboard.heap_memory_idle=ගොඩක් මතකය අලස
-dashboard.heap_memory_in_use=භාවිතයේ දී ගොඩක් මතකය
-dashboard.heap_memory_released=ගොඩක් මතකය නිකුත්
-dashboard.heap_objects=ගොඩක් වස්තු
-dashboard.bootstrap_stack_usage=Bootstrap Stack භාවිතය
-dashboard.stack_memory_obtained=ලබා මතකය ගොඩගසන්න
-dashboard.mspan_structures_usage=MsPan ව්යුහයන් භාවිතය
-dashboard.mspan_structures_obtained=ලබා ගත් MsPan ව්යුහයන්
-dashboard.mcache_structures_usage=මැචේ ව්යුහයන් භාවිතය
-dashboard.mcache_structures_obtained=ලබා ගත් මැචේ ව්යුහයන්
-dashboard.profiling_bucket_hash_table_obtained=ලබා භාජනයට හැෂ් වගුව පැතිකඩ
-dashboard.gc_metadata_obtained=ලබාගත් GC පාර-දත්ත
-dashboard.other_system_allocation_obtained=ලබා ගත් වෙනත් පද්ධති ප්රතිපාදන
-dashboard.next_gc_recycle=ඊලඟ GC, ප්රතිචක්රීකරණ
-dashboard.last_gc_time=පසුගිය GC වේලාව
-dashboard.total_gc_pause=මුළු GC විරාමය
-dashboard.last_gc_pause=අවසන් GC විරාමය
-dashboard.gc_times=GC ටයිම්ස්
 dashboard.delete_old_actions=සියලු පැරණි ක්රියා දත්ත සමුදායෙන් මකන්න
 dashboard.delete_old_actions.started=දත්ත සමුදාය ආරම්භ සිට සියලු පැරණි ක්රියා මකන්න.
 
@@ -2036,19 +1992,6 @@ users.still_own_repo=මෙම පරිශීලකයා තවමත් ග
 users.still_has_org=මෙම පරිශීලකයා සංවිධානයක සාමාජිකයෙකි. පළමුව ඕනෑම ආයතනයකින් පරිශීලකයා ඉවත් කරන්න.
 users.deletion_success=පරිශීලක ගිණුම මකා දමා ඇත.
 users.reset_2fa=2fa යළි පිහිටුවන්න
-users.list_status_filter.menu_text=පෙරහන
-users.list_status_filter.reset=යළි සකසන්න
-users.list_status_filter.is_active=ක්රියාකාරී
-users.list_status_filter.not_active=අක්රිය
-users.list_status_filter.is_admin=පරිපාලක
-users.list_status_filter.not_admin=පරිපාලක නොවන
-users.list_status_filter.is_restricted=සීමා
-users.list_status_filter.not_restricted=සීමා කර නැත
-users.list_status_filter.is_prohibit_login=ලොගින් වන්න තහනම්
-users.list_status_filter.not_prohibit_login=ලොගින් වන්න ඉඩ
-users.list_status_filter.is_2fa_enabled=2FA සක්රීය
-users.list_status_filter.not_2fa_enabled=2FA ආබාධිත
-
 emails.email_manage_panel=පරිශීලක විද්යුත් කළමනාකරණය
 emails.primary=ප්රාථමික
 emails.activated=සක්රිය
@@ -2313,20 +2256,6 @@ monitor.process.cancel=ක්රියාවලිය අවලංගු කර
 monitor.process.cancel_desc=ක්රියාවලියක් අවලංගු කිරීම දත්ත අහිමි වීමට හේතු විය හැක
 monitor.process.cancel_notices=<strong>%s</strong>: අවලංගු කරන්නද?
 
-monitor.queues=පෝලිම්
-monitor.queue=පෝලිම: %s
-monitor.queue.name=නම
-monitor.queue.type=වර්ගය
-monitor.queue.exemplar=ආදර්ශ වර්ගය
-monitor.queue.numberworkers=කම්කරුවන් සංඛ්යාව
-monitor.queue.maxnumberworkers=මැක්ස් කම්කරු සංඛ්යාව
-monitor.queue.settings.title=තටාකය සැකසුම්
-monitor.queue.settings.maxnumberworkers=මැක්ස් කම්කරුවන් සංඛ්යාව
-monitor.queue.settings.maxnumberworkers.placeholder=වත්මන්%[1]d
-monitor.queue.settings.maxnumberworkers.error=මැක්ස් කම්කරුවන්ගේ සංඛ්යාව අංකයක් විය යුතුය
-monitor.queue.settings.submit=සැකසුම් යාවත්කාල කරන්න
-monitor.queue.settings.changed=සැකසුම් යාවත්කාල කෙරිණි
-
 notices.system_notice_list=පද්ධතියේ දැන්වීම්
 notices.view_detail_header=දැන්වීමේ විස්තර දකින්න
 notices.select_all=සියල්ල තෝරන්න
diff --git a/options/locale/locale_sk-SK.ini b/options/locale/locale_sk-SK.ini
index e2be661dcf..829d8eaffe 100644
--- a/options/locale/locale_sk-SK.ini
+++ b/options/locale/locale_sk-SK.ini
@@ -37,18 +37,6 @@ twofa=Dvoj-faktorové overenie
 twofa_scratch=Dvojfaktorový dočasný kód
 passcode=Prístupový kód
 
-webauthn_insert_key=Zadajte bezpečnostný kľúč
-webauthn_sign_in=Stlačte tlačidlo na vašom bezpečnostnom kľúči. Ak váš kľúč nemá tlačidlo, vyberte a zasunte ho znova.
-webauthn_press_button=Stlačte, prosím, tlačidlo na vašom bezpečnostnom kľúči…
-webauthn_use_twofa=Použite kód dvojfaktorového overenia z vášho telefónu
-webauthn_error=Nie je možné prečítať váš bezpečnostný kód.
-webauthn_unsupported_browser=Váš prehliadač aktuálne nepodporuje WebAuthn.
-webauthn_error_unknown=Vyskytla sa neznáma chyba. Skúste to znova.
-webauthn_error_insecure=`WebAuthn podporuje iba bezpečné spojenia. Na testovanie cez HTTP môžete použiť "localhost" alebo "127.0.0.1"`
-webauthn_error_unable_to_process=Server nemohol spracovať vašu požiadavku.
-webauthn_error_duplicated=Bezpečnostný kľúč nie je pre túto požiadavku povolený. Uistite sa, že kľúč ešte nie je zaregistrovaný.
-webauthn_error_empty=Musíte nastaviť meno pre tento kľúč.
-webauthn_error_timeout=Vypršal čas na čítanie vašeho kľúča. Znova načítajte túto stránku a skúste to opäť.
 repository=Repozitár
 organization=Organizácia
 mirror=Zrkadlo
@@ -1004,11 +992,6 @@ migrate_options_lfs=Migrovať LFS súbory
 migrate_options_lfs_endpoint.label=Koncový bod LFS
 migrate_options_lfs_endpoint.description=Migrácia sa pokúsi použiť váš vzdialený Git na <a target="_blank" rel="noopener noreferrer" href="%s">určenie servera LFS</a>. Môžete tiež zadať vlastný koncový bod, ak sú dáta repozitára LFS uložené niekde inde.
 migrate_options_lfs_endpoint.description.local=Podporovaná je aj cesta k lokálnemu serveru.
-migrate_items=Položky migrácie
-migrate_items_wiki=Wiki
-migrate_items_milestones=Míľniky
-migrate_items_labels=Štítky
-migrate_items_pullrequests=Pull requesty
 migrate_repo=Migrovať repozitár
 migrate.clone_address_desc=HTTP(S) alebo Git 'clone' URL pre klonovanie existujúceho repozitára
 migrate.github_token_desc=Sem môžete vložiť jeden alebo viac tokenov oddelených čiarkami, aby sa migrácia zrýchlila z dôvodu limitu rýchlosti rozhrania GitHub API. UPOZORNENIE: Zneužitie tejto funkcie môže porušiť zásady poskytovateľa služieb a viesť k zablokovaniu účtu.
diff --git a/options/locale/locale_sl.ini b/options/locale/locale_sl.ini
index ec58b597df..ca991b53b4 100644
--- a/options/locale/locale_sl.ini
+++ b/options/locale/locale_sl.ini
@@ -1,9 +1,7 @@
 [common]
 language = Jezik
 passcode = Vstopna koda
-webauthn_error_timeout = Preden je bilo mogoče prebrati vaš ključ, je bil dosežen časovni rok. Ponovno naložite to stran in poskusite znova.
 cancel = Prekliči
-webauthn_sign_in = Pritisnite gumb na varnostnem ključu. Če varnostni ključ nima gumba, ga ponovno vstavite.
 create_new = Ustvari …
 disabled = Invalidi
 go_back = Pojdi nazaj
@@ -19,18 +17,15 @@ your_settings = Nastavitve
 explore = Razišči
 return_to_forgejo = Nazaj na Forgejo
 write = Napišite
-webauthn_error_unknown = Zgodila se je neznana napaka. Prosimo, poskusite znova.
 twofa = Dvofaktorsko preverjanje pristnosti
 version = Verzija
 copy_success = Kopirano!
 help = Pomoč
 copy_type_unsupported = Te vrste datotek ni mogoče kopirati
-webauthn_error_empty = Za ta ključ morate nastaviti ime.
 confirm_delete_selected = Potrdite brisanje vseh izbranih elementov?
 name = Ime
 sign_in_or = ali
 show_log_seconds = Prikaži sekunde
-webauthn_use_twofa = Uporaba kode z dvema faktorjema iz telefona
 edit = Uredi
 page = Stran
 concept_system_global = Globalno
@@ -51,7 +46,6 @@ admin_panel = Administracija spletnega mesta
 copy_error = Kopiranje ni uspelo
 new_mirror = Novo ogledalo
 re_type = Potrdite geslo
-webauthn_unsupported_browser = Vaš brskalnik trenutno ne podpira WebAuthna.
 copy = Kopiraj
 enabled = Omogočeno
 show_timestamps = Prikaži časovne žige
@@ -64,7 +58,6 @@ value = Vrednost
 concept_user_individual = Individualno
 notifications = Obvestila
 repository = Repository
-webauthn_error = Vašega varnostnega ključa ni bilo mogoče prebrati.
 add_all = Dodaj vse
 new_fork = Nova vilica repozitorija
 new_project_column = Nova kolumna
@@ -73,16 +66,12 @@ active_stopwatch = Aktivno sledenje času
 organization = Organizacija
 save = Shrani
 sign_in_with_provider = Prijava s/z %s
-webauthn_error_unable_to_process = Strežnik ni mogel obdelati vaše zahteve.
 register = Registracija
 mirror = Zrcalo
 access_token = Token za dostop
 download_logs = Prenos dnevnikov
-webauthn_insert_key = Vnesite varnostni ključ
 password = Geslo
-webauthn_error_duplicated = Varnostni ključ za to zahtevo ni dovoljen. Prepričajte se, da ključ še ni registriran.
 template = Predloga
-webauthn_press_button = Pritisnite gumb na varnostnem ključu…
 unknown = Neznano
 sign_up = Registracija
 enable_javascript = To spletno mesto zahteva JavaScript.
@@ -94,7 +83,6 @@ preview = Predogled
 mirrors = Ogledala
 loading = Nalaganje…
 show_full_screen = Prikaži celoten zaslon
-webauthn_error_insecure = WebAuthn podpira samo varne povezave. Za testiranje prek protokola HTTP lahko uporabite izvor "localhost" ali "127.0.0.1"
 username = Uporabniško ime
 tracked_time_summary = Povzetek spremljanega časa na podlagi filtrov seznama zadev
 email = E-poštni naslov
diff --git a/options/locale/locale_sr-SP.ini b/options/locale/locale_sr-SP.ini
index d55a963222..7e2fea2e88 100644
--- a/options/locale/locale_sr-SP.ini
+++ b/options/locale/locale_sr-SP.ini
@@ -36,23 +36,6 @@ link_account = Повежите рачун
 powered_by = Успостављено са %s
 notifications = Обавештења
 passcode = ПИН ко̑д
-webauthn_insert_key = Прикључите Ваш физички сигурносни кључ
-webauthn_sign_in = Притисните дугме на Вашем сигурносном кључу. Уколико Ваш кључ нема дугме, искључите и поново укључите га.
-webauthn_press_button = Молимо притисните дугме на Вашем сигурносном кључу…
-webauthn_use_twofa = Користите дво-факторски ко̑д са вашег мобитела
-webauthn_error = Сигурносни кључ се не да исчитати.
-webauthn_unsupported_browser = Ваш веб-прегледач тренутно не подржава "WebAuthn".
-webauthn_error_unknown = Непозната грешка се догодила. Молимо Вас да покушате поново.
-webauthn_error_insecure = "WebAuthn" једино подржава сигурне везе. За тестирање путем ХТТП, можете корисити извор "localhost" или "127.0.0.1"
-webauthn_error_unable_to_process = Сервер не може обрадити Ваш захтев.
-webauthn_error_duplicated = Сигурносни кључ није дозвољен за овај захтев. Уверите се да кључ није већ регистрован.
-webauthn_error_empty = Морате унети име за овај кључ.
-webauthn_error_timeout = Захтев је истекао пре што је очитавање Вашег кључа успео. Молимо Вас да актуализирате ову веб-страницу и покушате поново.
-
-
-
-
-
 
 [error]
 
@@ -566,33 +549,6 @@ total=Укупно: %d
 dashboard.operation_name=Име операције
 dashboard.operation_switch=Пребаци
 dashboard.operation_run=Покрени
-dashboard.server_uptime=Време непрекидног рада сервера
-dashboard.current_goroutine=Тренутнe Goroutine
-dashboard.current_memory_usage=Тренутна употреба меморије
-dashboard.total_memory_allocated=Укупно меморије алоцирано
-dashboard.memory_obtained=Коришћена меморија
-dashboard.pointer_lookup_times=Захтева показивача
-dashboard.current_heap_usage=Тренутна употреба динамичке меморије
-dashboard.heap_memory_obtained=Слободно динамичке меморије
-dashboard.heap_memory_idle=Некориштена динамичка меморија
-dashboard.heap_memory_in_use=Динамичка меморија у употреби
-dashboard.heap_memory_released=Ослобођено динамичке меморије
-dashboard.heap_objects=Објекти динамичке меморије
-dashboard.bootstrap_stack_usage=Коришћење стек меморије
-dashboard.stack_memory_obtained=Слободно стек меморије
-dashboard.mspan_structures_usage=Употреба структуре MSpan
-dashboard.mspan_structures_obtained=Добијено структуре MSpan
-dashboard.mcache_structures_usage=Употреба структурa MCache
-dashboard.mcache_structures_obtained=Добијено структурa MCache
-dashboard.profiling_bucket_hash_table_obtained=Хеш-табела постигнуто за Profiling Bucket
-dashboard.gc_metadata_obtained=Добијених метаподатака cакупљању смећа
-dashboard.other_system_allocation_obtained=Добијено друга системска меморија
-dashboard.next_gc_recycle=Следећа рециклажа cакупљању смећа
-dashboard.last_gc_time=Времена од прошлог cакупљању смећа
-dashboard.total_gc_pause=Укупно време cакупљању смећа
-dashboard.last_gc_pause=Задња пауза у cакупљању смећа
-dashboard.gc_times=Времена cакупљању смећа
-
 users.activated=Активиран
 users.admin=Администратор
 users.repos=репоси
diff --git a/options/locale/locale_sv-SE.ini b/options/locale/locale_sv-SE.ini
index 969bc6ea7b..d786a17f0f 100644
--- a/options/locale/locale_sv-SE.ini
+++ b/options/locale/locale_sv-SE.ini
@@ -91,7 +91,6 @@ sign_in_with_provider = Logga in med %s
 enable_javascript = Denna webbplats kräver JavaScript.
 ok = OK
 more_items = Fler objekt
-webauthn_sign_in = Tryck på knappen på din säkerhetsnyckel. Om din säkerhetsnyckel inte har en knapp, dra ut den och sätt in den igen.
 new_project_column = Ny kolumn
 copy_type_unsupported = Den här filtypen kan inte kopieras
 error = Fel
@@ -103,12 +102,6 @@ copy = Kopiera
 copy_url = Kopiera URL
 copy_error = Kopiering misslyckades
 copy_content = Kopiera innehåll
-webauthn_insert_key = Skriv in din säkerhetsnyckel
-webauthn_press_button = Vänligen tryck på knappen på din säkerhetsnyckel…
-webauthn_error = Det gick inte att läsa din säkerhetsnyckel.
-webauthn_unsupported_browser = Din webbläsare har ännu inte stöd för WebAuthn.
-webauthn_error_unknown = Ett okänt fel har inträffat. Vänligen försök igen.
-webauthn_error_empty = Du måste ange ett namn för den här nyckeln.
 new_org.title = Ny organisation
 new_org.link = Ny organisation
 test = Test
@@ -152,14 +145,9 @@ active_stopwatch = Spårning av aktiv tid
 tracked_time_summary = Sammanfattning av spårad tid baserat på filter av ärendelistan
 toggle_menu = Växla meny
 confirm_delete_selected = Bekräfta för att ta bort alla valda objekt?
-webauthn_error_timeout = Det gick inte att läsa din nyckel innan tidsgränsen nåddes. Läs om denna sida och försök igen.
 filter.is_fork = Avgreningar
-webauthn_error_duplicated = Säkerhetsnyckeln är inte tillåten för denna begäran. Se till att nyckeln inte redan är registrerad.
 filter.not_fork = Ej avgreningar
 remove_label_str = Ta bort objektet "%s"
-webauthn_use_twofa = Använd en tvåfaktorskod från din telefon
-webauthn_error_insecure = WebAuthn stöder endast säkra anslutningar. För testning över HTTP kan du använda "localhost" eller "127.0.0.1"
-webauthn_error_unable_to_process = Servern kunde inte hantera din begäran.
 copy_generic = Kopiera till urklipp
 
 [aria]
@@ -1093,14 +1081,6 @@ template.one_item=Du måste välja minst ett mallobjekt
 template.invalid=Du måste välja ett mallkodförråd
 
 migrate_options=Migreringsalternativ
-migrate_items=Migrationsobjekt
-migrate_items_wiki=Wiki
-migrate_items_milestones=Milstolpar
-migrate_items_labels=Etiketter
-migrate_items_issues=Ärenden
-migrate_items_pullrequests=Ändringsförfrågningar
-migrate_items_merge_requests=Ändringsförfrågningar
-migrate_items_releases=Utgåvor
 migrate_repo=Migrera kodförråd
 migrate.clone_address=Migrera eller klona från URL
 migrate.clone_address_desc=HTTP(S)- eller Git "clone"-länk för ett befintligt kodförråd
@@ -1113,8 +1093,6 @@ migrated_from_fake=Migrerad från %[1]s
 migrate.migrate=Migrera från %s
 migrate.migrating=Migrerar från <b>%s</b> …
 migrate.migrating_failed=Migrering från <b>%s</b> misslyckades.
-migrate.migrating_issues=Migrerar ärenden
-
 mirror_from=spegling av
 forked_from=avgrenad från
 generated_from=skapad från
@@ -2098,28 +2076,12 @@ migrate.invalid_local_path = Den lokala sökvägen är ogiltig. Den finns inte e
 migrate.invalid_lfs_endpoint = LFS-slutpunkten är inte giltig.
 migrate.migrating_failed.error = Misslyckades med att migrera: %s
 migrate.migrating_failed_no_addr = Migreringen misslyckades.
-migrate.migrating_git = Migrerar Git-data
-migrate.migrating_topics = Migrerar ämnen
-migrate.migrating_milestones = Migrerar milstolpar
-migrate.migrating_labels = Migrerar etiketter
-migrate.migrating_releases = Migrerar utgåvor
-migrate.migrating_pulls = Migrerar ändringsförfrågningar
-migrate.cancel_migrating_title = Avbryt migrering
-migrate.cancel_migrating_confirm = Vill du avbryta denna migrering?
 subscribe.issue.guest.tooltip = Logga in för att prenumerera på detta ärende.
 subscribe.pull.guest.tooltip = Logga in för att prenumerera på denna ändringsförfrågan.
 more_operations = Fler åtgärder
 cite_this_repo = Citera detta kodförråd
 broken_message = Git-datan som ligger till grund för detta kodförråd kan inte läsas. Kontakta administratören för denna instans eller ta bort detta kodförråd.
 actions = Actions
-n_commit_one = %s incheckning
-n_commit_few = %s incheckningar
-n_branch_one = %s gren
-n_branch_few = %s grenar
-n_tag_one = %s tagg
-n_tag_few = %s taggar
-n_release_one = %s utgåva
-n_release_few = %s utgåvor
 released_this = publicerade detta
 file.title = %s vid %s
 file_follow = Följ symlänk
@@ -2916,35 +2878,6 @@ dashboard.git_gc_repos=Rensa skräpfiler i samtliga kodförråd
 dashboard.resync_all_hooks=Återsynkronisera pre-receive-, update- och post-receive-krokar för alla kodförråd
 dashboard.reinit_missing_repos=Återinitialisera alla saknade kodförråd för vilka det finns poster
 dashboard.sync_external_users=Synkronisera extern användardata
-dashboard.server_uptime=Serverns upptid
-dashboard.current_goroutine=Aktuella gorutiner
-dashboard.current_memory_usage=Nuvarande minnesanvändning
-dashboard.total_memory_allocated=Total minnesanvändning
-dashboard.memory_obtained=Minnesåtgång
-dashboard.pointer_lookup_times=Pekaruppslagstider
-dashboard.memory_allocate_times=Minneallokeringar
-dashboard.memory_free_times=Minnesfrigörelser
-dashboard.current_heap_usage=Nuvarande heapanvändning
-dashboard.heap_memory_obtained=Heapminne som erhållits
-dashboard.heap_memory_idle=Heapminne som är inaktivt
-dashboard.heap_memory_in_use=Heapminne som används
-dashboard.heap_memory_released=Frigjort heap-minne
-dashboard.heap_objects=Heapobjekt
-dashboard.bootstrap_stack_usage=Bootstrap Stack-användning
-dashboard.stack_memory_obtained=Stackminne som erhålls
-dashboard.mspan_structures_usage=MSpan strukturanvändning
-dashboard.mspan_structures_obtained=MSpan strukturer som erhållits
-dashboard.mcache_structures_usage=MCache strukturanvändning
-dashboard.mcache_structures_obtained=MCache-strukturer som erhållits
-dashboard.profiling_bucket_hash_table_obtained=Profilering av Bucket Hash Table erhållen
-dashboard.gc_metadata_obtained=Metainformation om Skräpsamlaren Ihopsamlad
-dashboard.other_system_allocation_obtained=Övriga Systemallokeringar
-dashboard.next_gc_recycle=Nästa Skräpsamlarrunda
-dashboard.last_gc_time=Tidpunkt för senaste skräpsamling
-dashboard.total_gc_pause=Total tid för pauser vid skräpsamling
-dashboard.last_gc_pause=Senaste paus vid skräpsamling
-dashboard.gc_times=Skräpsamlingstider
-
 users.user_manage_panel=Hantera användarkonton
 users.new_account=Skapa användarkonto
 users.name=Användarnamn
@@ -2976,9 +2909,6 @@ users.delete_account=Ta bort användarkontot
 users.still_own_repo=Denna användare äger fortfarande ett eller flera kodförråd. Ta bort eller överför dessa kodförråd först.
 users.still_has_org=Denna användare är medlem i en eller flera organisationer. Ta bort användaren från dessa först.
 users.deletion_success=Användarkontot har blivit borttaget.
-users.list_status_filter.is_active=Aktiv
-users.list_status_filter.is_admin=Administratör
-
 emails.primary=Primär
 emails.activated=Aktiverad
 emails.filter_sort.email=E-post
@@ -3194,15 +3124,6 @@ monitor.desc=Beskrivning
 monitor.start=Starttid
 monitor.execute_time=Exekveringstid
 
-monitor.queues=Köer
-monitor.queue=Kö: %s
-monitor.queue.name=Namn
-monitor.queue.type=Typ
-monitor.queue.numberworkers=Antal arbetare
-monitor.queue.maxnumberworkers=Max antal arbetare
-monitor.queue.settings.submit=Uppdatera inställningar
-monitor.queue.settings.changed=Inställningar uppdaterade
-
 notices.system_notice_list=Systemnotiser
 notices.view_detail_header=Notisdetaljer
 notices.select_all=Markera alla
@@ -3226,7 +3147,6 @@ users.is_restricted = Begränsat konto
 self_check.database_inconsistent_collation_columns = Databasen använder kollateringen %s, men de här kolumner använder felanpassade kollateringar. Det kan komma att orsaka oväntade problem.
 hooks = webbkrokar
 integrations = Integrationer
-users.list_status_filter.menu_text = Filter
 packages.creator = Skapare
 packages.version = Version
 config.mailer_protocol = Protokoll
@@ -3235,8 +3155,6 @@ monitor.stats = Statistik
 monitor.last_execution_result = Resultat
 config_settings = Inställningar
 settings = Admininställningar
-users.list_status_filter.not_admin = Inte admin
-users.list_status_filter.not_prohibit_login = Tillåt inloggning
 users.details = Användardetaljer
 emails.updated = E-post uppdaterad
 packages.package_manage_panel = Hantera paket
@@ -3244,7 +3162,6 @@ auths.force_smtps = Tvinga SMTPS
 auths.oauth2_icon_url = Ikon-URL
 config.domain = Serverdomän
 config.lfs_config = LFS-konfiguration
-monitor.queue.settings.remove_all_items = Ta bort alla
 auths.tips.gmail_settings = Gmail-inställningar:
 self_check = Självkontroll
 identity_access = Identitet & åtkomst
@@ -3306,13 +3223,6 @@ users.purge = Rensa användare
 users.purge_help = Tvångsradera användare och alla kodförråd, organisationer och paket som ägs av användaren. Alla kommentarer och ärenden skapade av den här användare kommer också raderas.
 users.still_own_packages = den här användare äger fortfarande ett eller flera paket, radera de här paket först.
 users.reset_2fa = Återställ 2FA
-users.list_status_filter.reset = Återställ
-users.list_status_filter.not_active = Inaktiv
-users.list_status_filter.is_restricted = Begränsad
-users.list_status_filter.not_restricted = Ej begränsad
-users.list_status_filter.is_prohibit_login = Förbjud inloggning
-users.list_status_filter.is_2fa_enabled = 2FA aktiverad
-users.list_status_filter.not_2fa_enabled = 2FA inaktiverad
 emails.email_manage_panel = Hantera användares e-postadresser
 emails.not_updated = Det gick inte att uppdatera den begärda e-postadressen: %v
 emails.duplicate_active = den här e-postadress är redan aktiv för en annan användare.
@@ -3413,16 +3323,6 @@ monitor.duration = Varaktighet (s)
 monitor.process.cancel = Avbryt process
 monitor.process.cancel_desc = Att avbryta en process kan orsaka dataförlust
 monitor.process.cancel_notices = Avbryt: <strong>%s</strong>?
-monitor.queue.exemplar = Exempeltyp
-monitor.queue.activeworkers = Aktiva arbetare
-monitor.queue.numberinqueue = Antal i kö
-monitor.queue.review_add = Granska / lägg till arbetare
-monitor.queue.settings.title = Poolinställningar
-monitor.queue.settings.desc = Pooler växer dynamiskt som svar på att deras arbetarkö blockeras.
-monitor.queue.settings.maxnumberworkers = Max antal arbetare
-monitor.queue.settings.maxnumberworkers.placeholder = För närvarande %[1]d
-monitor.queue.settings.maxnumberworkers.error = Max antal arbetare måste vara ett tal
-monitor.queue.settings.remove_all_items_done = Alla objekt i kön har tagits bort.
 notices.operations = Åtgärder
 self_check.no_problem_found = Inga problem hittades ännu.
 self_check.database_collation_mismatch = Förväntar att databasen använder kollatering: %s
@@ -3515,11 +3415,6 @@ deletion.success = Hemligheten har tagits bort.
 deletion.failed = Misslyckades med att ta bort hemlighet.
 
 [actions]
-variables = Variabler
-variables.management = Hantera variabler
-variables.creation = Lägg till variabel
-variables.deletion = Ta bort variabel
-variables.edit = Redigera variabel
 runs.no_workflows.help_write_access = Vet du inte hur du kommer igång med Forgejo Actions? Se <a target="_blank" rel="noopener noreferrer" href="%s">snabbstarten i användardokumentationen</a> för att skriva ditt första arbetsflöde, sedan <a target="_blank" rel="noopener noreferrer" href="%s">konfigurera en Forgejo-körare</a> för att köra dina jobb.
 runs.no_workflows.help_no_write_access = För att lära dig mer om Forgejo Actions, se <a target="_blank" rel="noopener noreferrer" href="%s">dokumentationen</a>.
 runs.no_runs = Arbetsflödet har inga körningar ännu.
@@ -3538,19 +3433,6 @@ workflow.dispatch.input_required = Värde krävs för indata "%s".
 workflow.dispatch.invalid_input_type = Ogiltig indatatyp "%s".
 workflow.dispatch.warn_input_limit = Visar endast de första %d indatafälten.
 need_approval_desc = Godkännande krävs för att köra arbetsflöden för ändringsförfrågningar från avgreningar.
-variables.none = Det finns inga variabler ännu.
-variables.deletion.description = Borttagning av en variabel är permanent och kan inte ångras. Vill du fortsätta?
-variables.description = Variabler skickas till vissa actions och kan inte läsas annars.
-variables.not_found = Misslyckades med att hitta variabeln.
-variables.deletion.failed = Misslyckades med att ta bort variabel.
-variables.deletion.success = Variabeln har tagits bort.
-variables.creation.failed = Misslyckades med att lägga till variabel.
-variables.creation.success = Variabeln "%s" har lagts till.
-variables.update.failed = Misslyckades med att redigera variabel.
-variables.update.success = Variabeln har redigerats.
-
-
-
 
 [projects]
 type-1.display_name = Individuellt projekt
@@ -3621,7 +3503,4 @@ actions.write = <b>Skriv:</b> Starta, starta om, och avbryt arbetsflöden. Hante
 ext_issues = Åtkomst till länken till ett externt ärendehanteringssystem. Behörigheterna hanteras externt.
 ext_wiki = Åtkomst till länken till en extern wiki. Behörigheterna hanteras externt.
 
-[markup]
-filepreview.line = Rad %[1]d i %[2]s
-filepreview.lines = Rad %[1]d till %[2]d i %[3]s
-filepreview.truncated = Förhandsgranskningen har avkortats
\ No newline at end of file
+[markup]
\ No newline at end of file
diff --git a/options/locale/locale_ta.ini b/options/locale/locale_ta.ini
index b00b84a73a..8801c32888 100644
--- a/options/locale/locale_ta.ini
+++ b/options/locale/locale_ta.ini
@@ -36,18 +36,6 @@ captcha = கேப்ட்சா
 twofa = இரண்டு காரணி ஏற்பு
 twofa_scratch = இரண்டு காரணி கீறல் குறியீடு
 passcode = கடவுக்குறியீடு
-webauthn_insert_key = உங்கள் பாதுகாப்பு விசையைச் செருகவும்
-webauthn_sign_in = உங்கள் பாதுகாப்பு விசையில் உள்ள பொத்தானை அழுத்தவும். உங்கள் பாதுகாப்பு விசையில் பொத்தான் இல்லை என்றால், அதை மீண்டும் செருகவும்.
-webauthn_press_button = உங்கள் பாதுகாப்பு விசையில் உள்ள பொத்தானை அழுத்தவும்…
-webauthn_use_twofa = உங்கள் ஃபோனில் இருந்து இரண்டு காரணி குறியீட்டைப் பயன்படுத்தவும்
-webauthn_error = உங்கள் பாதுகாப்பு விசையைப் படிக்க முடியவில்லை.
-webauthn_unsupported_browser = உங்கள் உலாவி தற்போது WebAuthn ஐ ஆதரிக்கவில்லை.
-webauthn_error_unknown = அறியப்படாத பிழை ஏற்பட்டது. மீண்டும் முயற்சிக்கவும்.
-webauthn_error_insecure = WebAuthn பாதுகாப்பான இணைப்புகளை மட்டுமே ஆதரிக்கிறது. HTTP மூலம் சோதனை செய்ய, நீங்கள் "localhost" அல்லது "127.0.0.1" மூலத்தைப் பயன்படுத்தலாம்
-webauthn_error_unable_to_process = சேவையகத்தால் உங்கள் கோரிக்கையைச் செயல்படுத்த முடியவில்லை.
-webauthn_error_duplicated = இந்தக் கோரிக்கைக்கு பாதுகாப்பு விசை அனுமதிக்கப்படவில்லை. விசை ஏற்கனவே பதிவு செய்யப்படவில்லை என்பதை உறுதிப்படுத்தவும்.
-webauthn_error_empty = இந்த விசைக்கு நீங்கள் ஒரு பெயரை அமைக்க வேண்டும்.
-webauthn_error_timeout = உங்கள் விசையைப் படிக்கும் முன் காலாவதியானது. இந்தப் பக்கத்தை மீண்டும் ஏற்றி மீண்டும் முயற்சிக்கவும்.
 repository = களஞ்சியம்
 new_fork = புதிய களஞ்சிய போர்க்
 new_project_column = புதிய நெடுவரிசை
@@ -1124,14 +1112,6 @@ migrate_options_lfs_endpoint.label = LFS இறுதிப்புள்ளி
 migrate_options_lfs_endpoint.description = <a target="_blank" rel="noopener noreferrer" href="%s">LFS சர்வரைத் தீர்மானிக்க</a> உங்கள் Git ரிமோட்டைப் பயன்படுத்துவதற்கு இடம்பெயர்வு முயற்சிக்கும். களஞ்சியமான LFS தரவு வேறு எங்காவது சேமிக்கப்பட்டிருந்தால் தனிப்பயன் இறுதிப்புள்ளியையும் நீங்கள் குறிப்பிடலாம்.
 migrate_options_lfs_endpoint.description.local = உள்ளக சர்வர் பாதையும் ஆதரிக்கப்படுகிறது.
 migrate_options_lfs_endpoint.placeholder = காலியாக விடப்பட்டால், இறுதிப்புள்ளியானது நகலி முகவரி இலிருந்து பெறப்படும்
-migrate_items = இடம்பெயர்வு பொருட்கள்
-migrate_items_wiki = விக்கி
-migrate_items_milestones = மைல்கற்கள்
-migrate_items_labels = சிட்டைகள்
-migrate_items_issues = சிக்கல்கள்
-migrate_items_pullrequests = கோரிக்கைகளை இழுக்கவும்
-migrate_items_merge_requests = கோரிக்கைகளை ஒன்றிணைக்கவும்
-migrate_items_releases = வெளியிடுகிறது
 migrate_repo = களஞ்சியத்தை நகர்த்தவும்
 migrate.repo_desc_helper = ஏற்கனவே உள்ள விளக்கத்தை இறக்குமதி செய்ய காலியாக விடவும்
 migrate.clone_address = முகவரி இலிருந்து நகர்த்தவும் / நகலி செய்யவும்
@@ -1151,15 +1131,6 @@ migrate.migrating = <b>%s</b> இலிருந்து நகர்கிற
 migrate.migrating_failed = <b>%s</b> இலிருந்து நகர்த்துவது தோல்வியடைந்தது.
 migrate.migrating_failed.error = நகர்த்துவதில் தோல்வி: %s
 migrate.migrating_failed_no_addr = இடம்பெயர்வு தோல்வியடைந்தது.
-migrate.migrating_git = Git தரவை நகர்த்துகிறது
-migrate.migrating_topics = இடம்பெயர்ந்த தலைப்புகள்
-migrate.migrating_milestones = இடம்பெயரும் மைல்கற்கள்
-migrate.migrating_labels = இடம்பெயர்தல் லேபிள்கள்
-migrate.migrating_releases = இடம்பெயர்ந்த வெளியீடுகள்
-migrate.migrating_issues = இடம்பெயர்வு பிரச்சினைகள்
-migrate.migrating_pulls = இழுக்கும் கோரிக்கைகளை நகர்த்துகிறது
-migrate.cancel_migrating_title = இடம்பெயர்வை நீக்கறல்
-migrate.cancel_migrating_confirm = இந்த இடம்பெயர்வை ரத்துசெய்ய விரும்புகிறீர்களா?
 mirror_from = கண்ணாடி
 forked_from = இருந்து முட்கரண்டி
 generated_from = இருந்து உருவாக்கப்பட்டது
@@ -1200,14 +1171,6 @@ labels = சிட்டைகள்
 milestones = மைல்கற்கள்
 org_labels_desc = இந்த நிறுவனத்தின் கீழ் உள்ள <strong>அனைத்து களஞ்சியங்களுடனும்</strong> பயன்படுத்தக்கூடிய நிறுவன நிலை லேபிள்கள்
 org_labels_desc_manage = நிர்வகிக்க
-n_commit_one = %s உறுதி
-n_commit_few = %s உறுதியளிக்கிறது
-n_branch_one = %s கிளை
-n_branch_few = %s கிளைகள்
-n_tag_one = %s குறிச்சொல்
-n_tag_few = %s குறிச்சொற்கள்
-n_release_one = %s வெளியீடு
-n_release_few = %s வெளியீடுகள்
 released_this = இதை வெளியிட்டது
 file.title = %s இல் %s
 file_raw = மூல
@@ -2846,34 +2809,6 @@ dashboard.sync_external_users = வெளிப்புற பயனர் த
 dashboard.cleanup_hook_task_table = ஊக்_டாச்க் டேபிளை தூய்மை செய்யவும்
 dashboard.cleanup_packages = காலாவதியான தொகுப்புகளை தூய்மை செய்யவும்
 dashboard.cleanup_actions = செயல்களில் இருந்து காலாவதியான பதிவுகள் மற்றும் கலைப்பொருட்களை தூய்மை செய்யவும்
-dashboard.server_uptime = சேவையக இயக்க நேரம்
-dashboard.current_goroutine = தற்போதைய goroutines
-dashboard.current_memory_usage = தற்போதைய நினைவக பயன்பாடு
-dashboard.total_memory_allocated = மொத்த நினைவகம் ஒதுக்கப்பட்டது
-dashboard.memory_obtained = நினைவகம் கிடைத்தது
-dashboard.pointer_lookup_times = சுட்டி தேடுதல் நேரங்கள்
-dashboard.memory_allocate_times = நினைவக ஒதுக்கீடு
-dashboard.memory_free_times = நினைவகம் இலவசம்
-dashboard.current_heap_usage = தற்போதைய குவியல் பயன்பாடு
-dashboard.heap_memory_obtained = குவியல் நினைவகம் கிடைத்தது
-dashboard.heap_memory_idle = குவியல் நினைவகம் செயலற்றது
-dashboard.heap_memory_in_use = குவியல் நினைவகம் பயன்பாட்டில் உள்ளது
-dashboard.heap_memory_released = குவியல் நினைவகம் வெளியிடப்பட்டது
-dashboard.heap_objects = குவியல் பொருள்கள்
-dashboard.bootstrap_stack_usage = தொடக்கவார் ச்டாக் பயன்பாடு
-dashboard.stack_memory_obtained = அடுக்கு நினைவகம் பெறப்பட்டது
-dashboard.mspan_structures_usage = MSpan கட்டமைப்புகளின் பயன்பாடு
-dashboard.mspan_structures_obtained = MSpan கட்டமைப்புகள் பெறப்பட்டன
-dashboard.mcache_structures_usage = MCache கட்டமைப்புகளின் பயன்பாடு
-dashboard.mcache_structures_obtained = MCache கட்டமைப்புகள் பெறப்பட்டன
-dashboard.profiling_bucket_hash_table_obtained = விவரக்குறிப்பு பக்கெட் ஆச் அட்டவணை பெறப்பட்டது
-dashboard.gc_metadata_obtained = GC மேனிலை தரவு பெறப்பட்டது
-dashboard.other_system_allocation_obtained = பிற அமைப்பு ஒதுக்கீடு பெறப்பட்டது
-dashboard.next_gc_recycle = அடுத்த GC மறுசுழற்சி
-dashboard.last_gc_time = கடந்த சிசி முதல் நேரம்
-dashboard.total_gc_pause = மொத்த GC இடைநிறுத்தம்
-dashboard.last_gc_pause = கடைசி GC இடைநிறுத்தம்
-dashboard.gc_times = GC முறை
 dashboard.delete_old_actions = தரவுத்தளத்திலிருந்து அனைத்து பழைய செயல்பாடுகளையும் நீக்கவும்
 dashboard.delete_old_actions.started = தொடங்கப்பட்ட தரவுத்தளத்திலிருந்து அனைத்து பழைய செயல்பாடுகளையும் நீக்கவும்.
 dashboard.update_checker = புதுப்பிப்பு சரிபார்ப்பு
@@ -2936,18 +2871,6 @@ users.purge_help = பயனரை வலுக்கட்டாயமாக 
 users.still_own_packages = இந்தப் பயனர் இன்னும் ஒன்று அல்லது அதற்கு மேற்பட்ட தொகுப்புகளை வைத்திருக்கிறார், முதலில் இந்தத் தொகுப்புகளை நீக்கவும்.
 users.deletion_success = பயனர் கணக்கு நீக்கப்பட்டது.
 users.reset_2fa = 2FA ஐ மீட்டமைக்கவும்
-users.list_status_filter.menu_text = வடிப்பி
-users.list_status_filter.reset = மீட்டமை
-users.list_status_filter.is_active = செயலில்
-users.list_status_filter.not_active = செயலற்றது
-users.list_status_filter.is_admin = நிர்வாகி
-users.list_status_filter.not_admin = நிர்வாகி அல்ல
-users.list_status_filter.is_restricted = கட்டுப்படுத்தப்பட்டது
-users.list_status_filter.not_restricted = கட்டுப்படுத்தப்படவில்லை
-users.list_status_filter.is_prohibit_login = நுழைவதைத் தடைசெய்க
-users.list_status_filter.not_prohibit_login = உள்நுழைவை அனுமதிக்கவும்
-users.list_status_filter.is_2fa_enabled = 2FA இயக்கப்பட்டது
-users.list_status_filter.not_2fa_enabled = 2FA முடக்கப்பட்டுள்ளது
 users.details = பயனர் விவரங்கள்
 emails.email_manage_panel = பயனர் மின்னஞ்சல்களை நிர்வகிக்கவும்
 emails.primary = முதன்மை
@@ -3243,25 +3166,6 @@ monitor.last_execution_result = முடிவு
 monitor.process.cancel = செயல்முறையை நீக்கறல்
 monitor.process.cancel_desc = செயல்முறையை ரத்து செய்வது தரவு இழப்பை ஏற்படுத்தக்கூடும்
 monitor.process.cancel_notices = ரத்துசெய்: <strong>%s</strong>?
-monitor.queues = வால்கள்
-monitor.queue = வரிசை: %s
-monitor.queue.name = பெயர்
-monitor.queue.type = வகை
-monitor.queue.exemplar = முன்மாதிரி வகை
-monitor.queue.numberworkers = தொழிலாளர்களின் எண்ணிக்கை
-monitor.queue.activeworkers = சுறுசுறுப்பான தொழிலாளர்கள்
-monitor.queue.maxnumberworkers = தொழிலாளர்களின் அதிகபட்ச எண்ணிக்கை
-monitor.queue.numberinqueue = வரிசையில் உள்ள எண்
-monitor.queue.review_add = தொழிலாளர்களை மதிப்பாய்வு செய்யவும் / சேர்க்கவும்
-monitor.queue.settings.title = குளம் அமைப்புகள்
-monitor.queue.settings.desc = பணியாளர்களின் வரிசை தடுப்பிற்கு பதிலளிக்கும் வகையில் குளங்கள் மாறும் வகையில் வளரும்.
-monitor.queue.settings.maxnumberworkers = தொழிலாளர்களின் அதிகபட்ச எண்ணிக்கை
-monitor.queue.settings.maxnumberworkers.placeholder = தற்போது %[1]d
-monitor.queue.settings.maxnumberworkers.error = தொழிலாளர்களின் அதிகபட்ச எண்ணிக்கை ஒரு எண்ணாக இருக்க வேண்டும்
-monitor.queue.settings.submit = அமைப்புகளைப் புதுப்பிக்கவும்
-monitor.queue.settings.changed = அமைப்புகள் புதுப்பிக்கப்பட்டன
-monitor.queue.settings.remove_all_items = அனைத்தையும் அகற்று
-monitor.queue.settings.remove_all_items_done = வரிசையில் இருந்த அனைத்து பொருட்களும் அகற்றப்பட்டன.
 notices.system_notice_list = கணினி அறிவிப்புகள்
 notices.view_detail_header = அறிவிப்பு விவரங்கள்
 notices.operations = செயல்பாடுகள்
@@ -3385,21 +3289,6 @@ workflow.dispatch.input_required = "%s" உள்ளீட்டிற்கு
 workflow.dispatch.invalid_input_type = தவறான உள்ளீடு வகை "%s".
 workflow.dispatch.warn_input_limit = முதல் %d உள்ளீடுகளை மட்டும் காட்டுகிறது.
 need_approval_desc = ஃபோர்க் புல் கோரிக்கைக்கான பணிப்பாய்வுகளை இயக்க ஒப்புதல் தேவை.
-variables = மாறிகள்
-variables.management = மாறிகளை நிர்வகிக்கவும்
-variables.creation = மாறியைச் சேர்க்கவும்
-variables.none = இதுவரை மாறிகள் எதுவும் இல்லை.
-variables.deletion = மாறியை அகற்று
-variables.deletion.description = மாறியை அகற்றுவது நிரந்தரமானது மற்றும் செயல்தவிர்க்க முடியாது. தொடரவா?
-variables.description = சில செயல்களுக்கு மாறிகள் அனுப்பப்படும், இல்லையெனில் படிக்க முடியாது.
-variables.edit = திருத்து மாறி
-variables.not_found = மாறியைக் கண்டறிய முடியவில்லை.
-variables.deletion.failed = மாறியை அகற்ற முடியவில்லை.
-variables.deletion.success = மாறி நீக்கப்பட்டது.
-variables.creation.failed = மாறியைச் சேர்ப்பதில் தோல்வி.
-variables.creation.success = "%s" மாறி சேர்க்கப்பட்டது.
-variables.update.failed = மாறியை திருத்த முடியவில்லை.
-variables.update.success = மாறி திருத்தப்பட்டது.
 
 [projects]
 deleted.display_name = நீக்கப்பட்ட திட்டம்
@@ -3416,9 +3305,6 @@ symbolic_link = குறியீட்டு இணைப்பு
 submodule = துணைத் தொகுதி
 
 [markup]
-filepreview.line = %[2]s இல் வரி %[1]d
-filepreview.lines = %[3]s இல் %[1]d முதல் %[2]d வரையிலான கோடுகள்
-filepreview.truncated = முன்னோட்டம் துண்டிக்கப்பட்டது
 
 [translation_meta]
 test = இது ஒரு சோதனை சரம். இது Forgejo இடைமுகம் இல் காட்டப்படவில்லை, ஆனால் சோதனை நோக்கங்களுக்காகப் பயன்படுத்தப்படுகிறது. அந்த இனிமையான 100% நிறைவுக் குறியைப் பெற, நேரத்தைச் சேமிக்க (அல்லது உங்கள் விருப்பத்தின் வேடிக்கையான உண்மை) "சரி" என உள்ளிடவும் :)
\ No newline at end of file
diff --git a/options/locale/locale_th.ini b/options/locale/locale_th.ini
index de5c22ccc5..ef25055540 100644
--- a/options/locale/locale_th.ini
+++ b/options/locale/locale_th.ini
@@ -35,18 +35,6 @@ captcha = แคปช่า
 twofa = การยืนยันตัวตนแบบสองปัจจัย
 twofa_scratch = รหัสสำรองสำหรับการยืนยันตัวตนแบบสองปัจจัย
 passcode = รหัสผ่าน
-webauthn_insert_key = โปรดเสียบคีย์ความปลอดภัยของคุณ
-webauthn_sign_in = กดปุ่มบนคีย์ความปลอดภัยของคุณ หากคีย์ความปลอดภัยของคุณไม่มีปุ่ม ให้เสียบใหม่อีกครั้ง
-webauthn_press_button = กรุณากดปุ่มบนคีย์ความปลอดภัยของคุณ…
-webauthn_use_twofa = ใช้รหัสสองปัจจัยจากโทรศัพท์ของคุณ
-webauthn_error = ไม่สามารถอ่านคีย์ความปลอดภัยของคุณได้
-webauthn_unsupported_browser = เบราว์เซอร์ของคุณไม่รองรับ WebAuthn ในขณะนี้
-webauthn_error_unknown = เกิดข้อผิดพลาดที่ไม่รู้จัก กรุณาลองใหม่อีกครั้ง
-webauthn_error_insecure = WebAuthn รองรับเฉพาะการเชื่อมต่อที่ปลอดภัยเท่านั้น สำหรับการทดสอบผ่าน HTTP คุณสามารถใช้ต้นทาง "localhost" หรือ "127.0.0.1"
-webauthn_error_unable_to_process = เซิร์ฟเวอร์ไม่สามารถประมวลผลคำขอของคุณได้
-webauthn_error_duplicated = ไม่อนุญาตให้ใช้คีย์ความปลอดภัยสำหรับคำขอนี้ โปรดตรวจสอบให้แน่ใจว่าคีย์ยังไม่ได้ลงทะเบียน
-webauthn_error_empty = คุณต้องตั้งชื่อสำหรับคีย์นี้
-webauthn_error_timeout = หมดเวลาก่อนที่จะอ่านคีย์ของคุณได้ กรุณาโหลดหน้านี้ใหม่แล้วลองอีกครั้ง
 repository = ที่เก็บ
 new_fork = แยกที่เก็บใหม่
 new_project_column = คอลัมน์ใหม่
@@ -1124,14 +1112,6 @@ migrate_options_lfs_endpoint.label = ปลายทาง LFS
 migrate_options_lfs_endpoint.description = การย้ายจะพยายามใช้ Git remote ของคุณเพื่อ <a target="_blank" rel="noopener noreferrer" href="%s">กำหนดเซิร์ฟเวอร์ LFS</a> คุณยังสามารถระบุปลายทางที่กำหนดเองได้หากข้อมูล LFS ของที่เก็บถูกเก็บไว้ที่อื่น
 migrate_options_lfs_endpoint.description.local = รองรับพาธเซิร์ฟเวอร์โลคัลด้วย
 migrate_options_lfs_endpoint.placeholder = หากเว้นว่างไว้ ปลายทางจะถูกสืบทอดจาก URL การโคลน
-migrate_items = รายการการย้าย
-migrate_items_wiki = วิกิ
-migrate_items_milestones = เหตุการณ์สำคัญ
-migrate_items_labels = ป้ายกำกับ
-migrate_items_issues = ปัญหา
-migrate_items_pullrequests = คำขอดึง
-migrate_items_merge_requests = คำขอผสาน
-migrate_items_releases = รีลีส
 migrate_repo = ย้ายที่เก็บ
 migrate.repo_desc_helper = เว้นว่างไว้เพื่อนำเข้าคำอธิบายที่มีอยู่
 migrate.clone_address = ย้าย / โคลนจาก URL
@@ -1151,15 +1131,6 @@ migrate.migrating = กำลังย้ายจาก <b>%s</b> …
 migrate.migrating_failed = การย้ายจาก <b>%s</b> ล้มเหลว
 migrate.migrating_failed.error = ไม่สามารถย้าย: %s
 migrate.migrating_failed_no_addr = การย้ายล้มเหลว
-migrate.migrating_git = กำลังย้ายข้อมูล Git
-migrate.migrating_topics = กำลังย้ายหัวข้อ
-migrate.migrating_milestones = กำลังย้ายเหตุการณ์สำคัญ
-migrate.migrating_labels = กำลังย้ายป้ายกำกับ
-migrate.migrating_releases = กำลังย้ายรีลีส
-migrate.migrating_issues = กำลังย้ายปัญหา
-migrate.migrating_pulls = กำลังย้ายคำขอดึง
-migrate.cancel_migrating_title = ยกเลิกการย้าย
-migrate.cancel_migrating_confirm = คุณต้องการยกเลิกการย้ายนี้หรือไม่?
 mirror_from = มิเรอร์ของ
 forked_from = แยกจาก
 generated_from = สร้างจาก
@@ -1200,14 +1171,6 @@ labels = ป้ายกำกับ
 milestones = เหตุการณ์สำคัญ
 org_labels_desc = ป้ายกำกับระดับองค์กรที่สามารถใช้กับ <strong>ที่เก็บทั้งหมด</strong> ภายใต้องค์กรนี้
 org_labels_desc_manage = จัดการ
-n_commit_one = %s คอมมิต
-n_commit_few = %s คอมมิต
-n_branch_one = %s สาขา
-n_branch_few = %s สาขา
-n_tag_one = %s แท็ก
-n_tag_few = %s แท็ก
-n_release_one = %s รีลีส
-n_release_few = %s รีลีส
 released_this = ปล่อยสิ่งนี้
 file.title = %s ที่ %s
 file_raw = ดิบ
@@ -2846,34 +2809,6 @@ dashboard.sync_external_users = ซิงโครไนซ์ข้อมูล
 dashboard.cleanup_hook_task_table = ล้างตาราง hook_task
 dashboard.cleanup_packages = ล้างแพ็คเกจที่หมดอายุ
 dashboard.cleanup_actions = ล้างบันทึกและอาร์ติแฟกต์ที่หมดอายุจากการดำเนินการ
-dashboard.server_uptime = เวลาทำงานของเซิร์ฟเวอร์
-dashboard.current_goroutine = Goroutine ปัจจุบัน
-dashboard.current_memory_usage = การใช้หน่วยความจำปัจจุบัน
-dashboard.total_memory_allocated = หน่วยความจำที่จัดสรรทั้งหมด
-dashboard.memory_obtained = หน่วยความจำที่ได้รับ
-dashboard.pointer_lookup_times = เวลาค้นหาพอยน์เตอร์
-dashboard.memory_allocate_times = การจัดสรรหน่วยความจำ
-dashboard.memory_free_times = การปล่อยหน่วยความจำ
-dashboard.current_heap_usage = การใช้ฮีปปัจจุบัน
-dashboard.heap_memory_obtained = หน่วยความจำฮีปที่ได้รับ
-dashboard.heap_memory_idle = หน่วยความจำฮีปที่ไม่ได้ใช้งาน
-dashboard.heap_memory_in_use = หน่วยความจำฮีปที่ใช้งานอยู่
-dashboard.heap_memory_released = หน่วยความจำฮีปที่ปล่อยแล้ว
-dashboard.heap_objects = อ็อบเจกต์ฮีป
-dashboard.bootstrap_stack_usage = การใช้สแต็ก Bootstrap
-dashboard.stack_memory_obtained = หน่วยความจำสแต็กที่ได้รับ
-dashboard.mspan_structures_usage = การใช้โครงสร้าง MSpan
-dashboard.mspan_structures_obtained = โครงสร้าง MSpan ที่ได้รับ
-dashboard.mcache_structures_usage = การใช้โครงสร้าง MCache
-dashboard.mcache_structures_obtained = โครงสร้าง MCache ที่ได้รับ
-dashboard.profiling_bucket_hash_table_obtained = ตารางแฮชบัคเก็ตการทำโปรไฟล์ที่ได้รับ
-dashboard.gc_metadata_obtained = ข้อมูลเมตา GC ที่ได้รับ
-dashboard.other_system_allocation_obtained = การจัดสรรระบบอื่น ๆ ที่ได้รับ
-dashboard.next_gc_recycle = การรีไซเคิล GC ถัดไป
-dashboard.last_gc_time = เวลาตั้งแต่ GC ครั้งล่าสุด
-dashboard.total_gc_pause = การหยุด GC ทั้งหมด
-dashboard.last_gc_pause = การหยุด GC ครั้งล่าสุด
-dashboard.gc_times = เวลา GC
 dashboard.delete_old_actions = ลบกิจกรรมเก่าทั้งหมดออกจากฐานข้อมูล
 dashboard.delete_old_actions.started = เริ่มลบกิจกรรมเก่าทั้งหมดออกจากฐานข้อมูลแล้ว
 dashboard.update_checker = ตัวตรวจสอบการอัปเดต
@@ -2936,18 +2871,6 @@ users.purge_help = ลบผู้ใช้และที่เก็บ อง
 users.still_own_packages = ผู้ใช้นี้ยังคงเป็นเจ้าของแพ็คเกจอย่างน้อยหนึ่งรายการ ลบแพ็คเกจเหล่านี้ก่อน
 users.deletion_success = บัญชีผู้ใช้ถูกลบแล้ว
 users.reset_2fa = รีเซ็ต 2FA
-users.list_status_filter.menu_text = ตัวกรอง
-users.list_status_filter.reset = รีเซ็ต
-users.list_status_filter.is_active = ใช้งาน
-users.list_status_filter.not_active = ไม่ใช้งาน
-users.list_status_filter.is_admin = ผู้ดูแลระบบ
-users.list_status_filter.not_admin = ไม่ใช่ผู้ดูแลระบบ
-users.list_status_filter.is_restricted = จำกัด
-users.list_status_filter.not_restricted = ไม่จำกัด
-users.list_status_filter.is_prohibit_login = ห้ามเข้าสู่ระบบ
-users.list_status_filter.not_prohibit_login = อนุญาตให้เข้าสู่ระบบ
-users.list_status_filter.is_2fa_enabled = เปิดใช้งาน 2FA
-users.list_status_filter.not_2fa_enabled = ปิดใช้งาน 2FA
 users.details = รายละเอียดผู้ใช้
 emails.email_manage_panel = จัดการอีเมลผู้ใช้
 emails.primary = หลัก
@@ -3243,25 +3166,6 @@ monitor.last_execution_result = ผลลัพธ์
 monitor.process.cancel = ยกเลิกกระบวนการ
 monitor.process.cancel_desc = การยกเลิกกระบวนการอาจทำให้ข้อมูลสูญหาย
 monitor.process.cancel_notices = ยกเลิก: <strong>%s</strong>?
-monitor.queues = คิว
-monitor.queue = คิว: %s
-monitor.queue.name = ชื่อ
-monitor.queue.type = ประเภท
-monitor.queue.exemplar = ประเภทตัวอย่าง
-monitor.queue.numberworkers = จำนวนผู้ปฏิบัติงาน
-monitor.queue.activeworkers = ผู้ปฏิบัติงานที่ใช้งานอยู่
-monitor.queue.maxnumberworkers = จำนวนผู้ปฏิบัติงานสูงสุด
-monitor.queue.numberinqueue = จำนวนในคิว
-monitor.queue.review_add = ตรวจสอบ / เพิ่มผู้ปฏิบัติงาน
-monitor.queue.settings.title = การตั้งค่าพูล
-monitor.queue.settings.desc = พูลจะขยายตัวแบบไดนามิกเพื่อตอบสนองต่อการบล็อกคิวของผู้ปฏิบัติงาน
-monitor.queue.settings.maxnumberworkers = จำนวนผู้ปฏิบัติงานสูงสุด
-monitor.queue.settings.maxnumberworkers.placeholder = ปัจจุบัน %[1]d
-monitor.queue.settings.maxnumberworkers.error = จำนวนผู้ปฏิบัติงานสูงสุดต้องเป็นตัวเลข
-monitor.queue.settings.submit = อัปเดตการตั้งค่า
-monitor.queue.settings.changed = อัปเดตการตั้งค่าแล้ว
-monitor.queue.settings.remove_all_items = ลบทั้งหมด
-monitor.queue.settings.remove_all_items_done = ลบรายการทั้งหมดในคิวแล้ว
 notices.system_notice_list = ประกาศของระบบ
 notices.view_detail_header = รายละเอียดประกาศ
 notices.operations = การดำเนินการ
@@ -3385,21 +3289,6 @@ workflow.dispatch.input_required = ต้องการค่าสำหรั
 workflow.dispatch.invalid_input_type = ประเภทอินพุต "%s" ไม่ถูกต้อง
 workflow.dispatch.warn_input_limit = แสดงเฉพาะ %d อินพุตแรกเท่านั้น
 need_approval_desc = ต้องการการอนุมัติเพื่อเรียกใช้เวิร์กโฟลว์สำหรับคำขอดึงที่แยกมา
-variables = ตัวแปร
-variables.management = จัดการตัวแปร
-variables.creation = เพิ่มตัวแปร
-variables.none = ยังไม่มีตัวแปร
-variables.deletion = ลบตัวแปร
-variables.deletion.description = การลบตัวแปรเป็นการกระทำถาวรและไม่สามารถยกเลิกได้ ดำเนินการต่อหรือไม่?
-variables.description = ตัวแปรจะถูกส่งต่อไปยังการดำเนินการบางอย่างและไม่สามารถอ่านได้
-variables.edit = แก้ไขตัวแปร
-variables.not_found = ไม่พบตัวแปร
-variables.deletion.failed = ไม่สามารถลบตัวแปรได้
-variables.deletion.success = ลบตัวแปรแล้ว
-variables.creation.failed = ไม่สามารถเพิ่มตัวแปรได้
-variables.creation.success = เพิ่มตัวแปร "%s" แล้ว
-variables.update.failed = ไม่สามารถแก้ไขตัวแปรได้
-variables.update.success = แก้ไขตัวแปรแล้ว
 
 [projects]
 deleted.display_name = โปรเจกต์ที่ถูกลบ
@@ -3416,9 +3305,6 @@ symbolic_link = ลิงก์สัญลักษณ์
 submodule = โมดูลย่อย
 
 [markup]
-filepreview.line = บรรทัดที่ %[1]d ใน %[2]s
-filepreview.lines = บรรทัดที่ %[1]d ถึง %[2]d ใน %[3]s
-filepreview.truncated = ตัวอย่างถูกตัดทอน
 
 [translation_meta]
 test = ok
\ No newline at end of file
diff --git a/options/locale/locale_tok.ini b/options/locale/locale_tok.ini
index 5dc131cc4f..bb485b94fb 100644
--- a/options/locale/locale_tok.ini
+++ b/options/locale/locale_tok.ini
@@ -1,15 +1,18 @@
+
+
+
 [common]
 home = open
 dashboard = ijo sin
 explore = o alasa
 help = o pana e sona
 logo = sitelen pi ilo Posejo li lon poka sewi. jan li ken ala lukin e sitelen la, ona li lukin e toki "sitelen".
+link_account = o wan e nimi
+sign_up = o pali e nimi
 sign_in = o pana e nimi
 sign_in_with_provider = o pana e nimi kepeken %s
 sign_in_or = anu
 sign_out = o weka e nimi
-sign_up = o pali e nimi
-link_account = o wan e nimi
 register = o pali e nimi
 powered_by = kepeken %s
 page = lipu
diff --git a/options/locale/locale_tr-TR.ini b/options/locale/locale_tr-TR.ini
index 1622c29942..766a17df43 100644
--- a/options/locale/locale_tr-TR.ini
+++ b/options/locale/locale_tr-TR.ini
@@ -37,18 +37,6 @@ twofa=İki aşamalı doğrulama
 twofa_scratch=İki aşamalı kazınmış kod
 passcode=Şifre
 
-webauthn_insert_key=Güvenlik anahtarınızı ekleyin
-webauthn_sign_in=Güvenlik anahtarınızdaki düğmeye basın. Eğer düğme yoksa güvenlik anahtarınızı tekrar ekleyin.
-webauthn_press_button=Lütfen güvenlik anahtarınızdaki düğmeye basın…
-webauthn_use_twofa=Telefonunuzdan iki aşamalı doğrulama kodu kullanın
-webauthn_error=Güvenlik anahtarınız okunamıyor.
-webauthn_unsupported_browser=Tarayıcınız henüz WebAuthn desteklemiyor.
-webauthn_error_unknown=Bilinmeyen bir hata oluştu. Lütfen tekrar deneyin.
-webauthn_error_insecure=WebAuthn sadece güvenli bağlantıyı destekler. HTTP üzerinden test etmek için "localhost" veya "127.0.0.1" adreslerini kullanabilirsiniz.
-webauthn_error_unable_to_process=Sunucu isteğinizi işleyemedi.
-webauthn_error_duplicated=Güvenlik anahtarının bu istek için izni yok. Anahtarın halihazırda kayıtlı olmadığından emin olun.
-webauthn_error_empty=Bu anahtar için bir isim belirlemelisiniz.
-webauthn_error_timeout=Anahtarınız okunamadan zaman aşımı oldu. Lütfen sayfayı yenileyin ve tekrar deneyin.
 repository=Depo
 organization=Organizasyon
 mirror=Yansı
@@ -1156,14 +1144,6 @@ migrate_options_lfs_endpoint.label=LFS uç noktası
 migrate_options_lfs_endpoint.description=Taşıma, <a target="_blank" rel="noopener noreferrer" href="%s"> LFS sunucusunu belirlemek</a> için Git uzak sunucusunu kullanmaya çalışacak. Eğer LFS veri deposu başka yerdeyse özel bir uç nokta da belirtebilirsiniz.
 migrate_options_lfs_endpoint.description.local=Yerel bir sunucu yolu da destekleniyor.
 migrate_options_lfs_endpoint.placeholder=Boş bırakılırsa, uç nokta klon URL'sinden türetilecektir
-migrate_items=Taşıma öğeleri
-migrate_items_wiki=Wiki
-migrate_items_milestones=Kilometre Taşları
-migrate_items_labels=Etiketler
-migrate_items_issues=Konular
-migrate_items_pullrequests=Birleştirme istekleri
-migrate_items_merge_requests=Birleştirme istekleri
-migrate_items_releases=Sürümler
 migrate_repo=Depoyu taşı
 migrate.clone_address=URL'den Taşı / Klonla
 migrate.clone_address_desc=Varolan bir deponun HTTP(S) veya Git 'klonlama' URL'si
@@ -1182,16 +1162,6 @@ migrate.migrating=<b>%s</b> konumundan taşınıyor ...
 migrate.migrating_failed=<b>%s</b> konumundan taşıma başarısız oldu.
 migrate.migrating_failed.error=Göç yapılamadı: %s
 migrate.migrating_failed_no_addr=Göç başarısız oldu.
-migrate.migrating_git=Git Verilerini Taşıma
-migrate.migrating_topics=Konuları taşıma
-migrate.migrating_milestones=Kilometre Taşlarını Taşıma
-migrate.migrating_labels=Etiketleri Taşıma
-migrate.migrating_releases=Sürümleri Taşıma
-migrate.migrating_issues=Konuları Taşıma
-migrate.migrating_pulls=Değişiklik İsteklerini Taşıma
-migrate.cancel_migrating_title=Göçü iptal et
-migrate.cancel_migrating_confirm=Bu göçü iptal etmek istiyor musunuz?
-
 mirror_from=şunun yansıması
 forked_from=şundan çatallanmış
 generated_from=şuradan oluşturuldu
@@ -2642,13 +2612,9 @@ mirror_use_ssh.text = SSH yetkilendirme kullan
 settings.default_update_style_desc = Temel dalın ardındaki çekme isteklerini güncellemek için kullanılan varsayılan güncelleme stili.
 mirror_denied_combination = Ortak anahtar ve parola tabanlı kimlik doğrulama birlikte kullanılamaz.
 mirror_public_key = Ortak SSH anahtarı
-n_branch_few = %s dal
-n_commit_few = %s gönderi
-n_tag_few = %s etiket
 settings.wiki_rename_branch_main = Viki dal adını normalleştir
 mirror_use_ssh.not_available = SSH yetkilendirme kullanılamıyor.
 mirror_use_ssh.helper = Forgejo, bu seçeneği seçtiğinizde deponuzu SSH üzerinden Git üzerinden yansıtacak ve sizin için bir anahtar çifti oluşturacaktır. Oluşturulan ortak anahtarın hedef depoya gönderilmek üzere yetkilendirildiğinden emin olmalısınız. Bunu seçerken parola tabanlı yetkilendirme kullanamazsınız.
-n_branch_one = %s dal
 settings.units.add_more = Daha fazlasını etkinleştir
 settings.wiki_globally_editable = Vikiyi herkesin düzenlemesine izin ver
 issues.filter_no_results_placeholder = Arama filtrelerini değiştirmeyi deneyin.
@@ -2674,10 +2640,6 @@ migrate.repo_desc_helper = Var olan açıklamayı içe aktarmak için boş bıra
 subscribe.issue.guest.tooltip = Bu soruna abone olmak için oturum açın.
 subscribe.pull.guest.tooltip = Bu birleştirme isteğine abone olmak için oturum açın.
 project = Projeler
-n_commit_one = %s katkı
-n_tag_one = %s etiket
-n_release_one = %s sürüm
-n_release_few = %s sürüm
 file_follow = Sembolik bağlantıyı takip et
 no_eol.text = EOL bulunamadı
 no_eol.tooltip = Bu dosya, en sonunda satır sonu karakterini içermiyor.
@@ -2890,34 +2852,6 @@ dashboard.sync_external_users=Harici kullanıcı verisini senkronize et
 dashboard.cleanup_hook_task_table=Hook_task tablosunu temizleme
 dashboard.cleanup_packages=Süresi dolmuş paketleri temizleme
 dashboard.cleanup_actions=Eylemlerin süresi geçmiş günlük ve yapılarını temizle
-dashboard.server_uptime=Sunucunun Ayakta Kalma Süresi
-dashboard.current_goroutine=Güncel Goroutine'ler
-dashboard.current_memory_usage=Güncel Bellek Kullanımı
-dashboard.total_memory_allocated=Bellekte Ayrılan Toplam Yer
-dashboard.memory_obtained=Elde Edilen Bellek
-dashboard.pointer_lookup_times=İşaret Arama Zamanları
-dashboard.memory_allocate_times=Bellek Ayırmaları
-dashboard.memory_free_times=Bellek Boşaltmaları
-dashboard.current_heap_usage=Güncel Yığın Kullanımı
-dashboard.heap_memory_obtained=Elde Edilen Yığın Belleği
-dashboard.heap_memory_idle=Boştaki Yığın Belleği
-dashboard.heap_memory_in_use=Kullanımdaki Yığın Belleği
-dashboard.heap_memory_released=Serbest Bırakılmış Yığın Belleği
-dashboard.heap_objects=Yığın Nesneleri
-dashboard.bootstrap_stack_usage=İlk Yığın Kullanımı
-dashboard.stack_memory_obtained=Elde Edilen Yığın Belleği
-dashboard.mspan_structures_usage=Kullanımdaki MSpan Yapıları
-dashboard.mspan_structures_obtained=Elde Edilen MSpan Yapıları
-dashboard.mcache_structures_usage=Kullanılan MCache Yapıları
-dashboard.mcache_structures_obtained=Elde Edilen MCache Yapıları
-dashboard.profiling_bucket_hash_table_obtained=Elde Edilen Bucket Hash Tablosu Profilleme
-dashboard.gc_metadata_obtained=Elde Edilen GC Metadata
-dashboard.other_system_allocation_obtained=Elde Edilen Diğer Sistem Ayırmaları
-dashboard.next_gc_recycle=Sonraki GC Döngüsü
-dashboard.last_gc_time=Son GC Zamanından Beri
-dashboard.total_gc_pause=Toplam GC Durması
-dashboard.last_gc_pause=Son GC Durması
-dashboard.gc_times=GC Zamanları
 dashboard.delete_old_actions=Veritabanından tüm eski eylemleri sil
 dashboard.delete_old_actions.started=Veritabanından başlatılan tüm eski eylemleri silin.
 dashboard.update_checker=Denetleyiciyi güncelle
@@ -2974,18 +2908,6 @@ users.purge_help=Kullanıcıyı ve sahip olduğu herhangi bir depoyu, organizasy
 users.still_own_packages=Kullanıcının bir veya daha fazla paketi var, önce bu paketleri silin.
 users.deletion_success=Kullanıcı hesabı silindi.
 users.reset_2fa=2FD'yi sıfırla
-users.list_status_filter.menu_text=Filtre
-users.list_status_filter.reset=Sıfırla
-users.list_status_filter.is_active=Etkin
-users.list_status_filter.not_active=Etkin değil
-users.list_status_filter.is_admin=Yönetici
-users.list_status_filter.not_admin=Yönetici Değil
-users.list_status_filter.is_restricted=Kısıtlanmış
-users.list_status_filter.not_restricted=Kısıtlanmamış
-users.list_status_filter.is_prohibit_login=Oturum Açmayı Önle
-users.list_status_filter.not_prohibit_login=Oturum Açmaya İzin Ver
-users.list_status_filter.is_2fa_enabled=2FA Etkin
-users.list_status_filter.not_2fa_enabled=2FA Devre Dışı
 users.details=Kullanıcı Ayrıntıları
 
 emails.email_manage_panel=Kullanıcı E-posta Yönetimi
@@ -3304,26 +3226,6 @@ monitor.process.cancel_desc=Bir işlemi iptal etmek veri kaybına neden olabilir
 monitor.process.cancel_notices=İptal et: <strong>%s</strong>?
 monitor.process.children=Çocuklar
 
-monitor.queues=Kuyruklar
-monitor.queue=Kuyruk: %s
-monitor.queue.name=İsim
-monitor.queue.type=Tür
-monitor.queue.exemplar=Örnek Türü
-monitor.queue.numberworkers=Çalışan Sayısı
-monitor.queue.activeworkers=Etkin Çalışanlar
-monitor.queue.maxnumberworkers=En Fazla Çalışan Sayısı
-monitor.queue.numberinqueue=Kuyruktaki Sayı
-monitor.queue.review_add=Çalışanları İncele / Ekle
-monitor.queue.settings.title=Havuz Ayarları
-monitor.queue.settings.desc=Havuzlar, çalışan kuyruğu tıkanmasına bir yanıt olarak dinamik olarak büyürler.
-monitor.queue.settings.maxnumberworkers=En fazla çalışan Sayısı
-monitor.queue.settings.maxnumberworkers.placeholder=Şu anda %[1]d
-monitor.queue.settings.maxnumberworkers.error=En fazla çalışan sayısı bir sayı olmalıdır
-monitor.queue.settings.submit=Ayarları Güncelle
-monitor.queue.settings.changed=Ayarlar güncellendi
-monitor.queue.settings.remove_all_items=Tümünü kaldır
-monitor.queue.settings.remove_all_items_done=Kuyruktaki tüm öğeler kaldırıldı.
-
 notices.system_notice_list=Sistem Bildirimleri
 notices.view_detail_header=Bildirim Ayrıntılarını Görüntüle
 notices.operations=İşlemler
@@ -3457,20 +3359,6 @@ workflow.disabled=İş akışı devre dışı.
 
 need_approval_desc=Değişiklik isteği çatalında iş akışı çalıştırmak için onay gerekiyor.
 
-variables=Değişkenler
-variables.management=Değişken Yönetimi
-variables.creation=Değişken ekle
-variables.none=Henüz hiçbir değişken yok.
-variables.deletion=Değişkeni kaldır
-variables.deletion.description=Bir değişkeni kaldırma kalıcıdır ve geri alınamaz. Devam edilsin mi?
-variables.description=Değişkenler belirli işlemlere aktarılacaktır, bunun dışında okunamaz.
-variables.edit=Değişkeni Düzenle
-variables.deletion.failed=Değişken kaldırılamadı.
-variables.deletion.success=Değişken kaldırıldı.
-variables.creation.failed=Değişken eklenemedi.
-variables.creation.success=`"%s" değişkeni eklendi.`
-variables.update.failed=Değişken düzenlenemedi.
-variables.update.success=Değişken düzenlendi.
 variables.id_not_exist = %d kimlikli değişken mevcut değil.
 runs.expire_log_message = Günlükler, çok eski oldukları için temizlendiler.
 
diff --git a/options/locale/locale_uk-UA.ini b/options/locale/locale_uk-UA.ini
index a134fb0504..7f713b9d87 100644
--- a/options/locale/locale_uk-UA.ini
+++ b/options/locale/locale_uk-UA.ini
@@ -98,13 +98,6 @@ logo = Логотип
 sign_in_with_provider = Увійти через %s
 tracked_time_summary = Підсумок відстеженого часу з урахуванням фільтрів списку задач
 enable_javascript = Цей вебсайт потребує JavaScript.
-webauthn_press_button = Натисніть кнопку на ключі безпеки…
-webauthn_use_twofa = Введіть код підтвердження з телефону
-webauthn_error = Не вдалося розпізнати ключ безпеки.
-webauthn_error_unknown = Сталася невідома помилка. Будь ласка, повторіть спробу.
-webauthn_error_unable_to_process = Сервер не зміг обробити запит.
-webauthn_error_duplicated = Запит із наданим ключем безпеки відхилено. Впевніться, що цей ключ не є вже зареєстрованим.
-webauthn_error_empty = Ключ слід якось назвати.
 new_project_column = Новий стовпчик
 retry = Повторити
 rerun = Перезапустити
@@ -122,12 +115,7 @@ concept_system_global = Для всіх
 concept_user_individual = Для особи
 confirm_delete_selected = Точно видалити все вибране?
 value = Значення
-webauthn_insert_key = Під’єднайте ключ безпеки
 download_logs = Завантажити журнали
-webauthn_sign_in = Натисніть кнопку на ключі безпеки. Якщо ключ безпеки не має кнопки, від’єднайте його і під’єднайте ще раз.
-webauthn_unsupported_browser = Ваш браузер наразі не підтримує WebAuthn.
-webauthn_error_insecure = WebAuthn підтримує лише захищені з’єднання. Для тестування через HTTP можете використати origin-рядок «localhost» чи «127.0.0.1»
-webauthn_error_timeout = Ключ не встиг зчитатись протягом відведеного терміну. Будь ласка, перезавантажте сторінку й повторіть спробу.
 locked = Заблоковано
 filter.is_template = Шаблони
 test = Тест
@@ -1126,14 +1114,6 @@ migrate_options_lfs=Перенесення файлів LFS
 migrate_options_lfs_endpoint.label=Кінцева точка LFS
 migrate_options_lfs_endpoint.description=Під час перенесення буде виконано спробу <a target="_blank" rel="noopener noreferrer" href="%s">визначити сервер LFS</a> через ваш віддалений сервер Git. Ви також можете вказати свою кінцеву точку, якщо дані LFS репозиторію зберігаються в іншому місці.
 migrate_options_lfs_endpoint.description.local=Також підтримується шлях на локальному сервері.
-migrate_items=Елементи для перенесення
-migrate_items_wiki=Вікі
-migrate_items_milestones=Етапи
-migrate_items_labels=Мітки
-migrate_items_issues=Задачі
-migrate_items_pullrequests=Запити на злиття
-migrate_items_merge_requests=Запити на об’єднання
-migrate_items_releases=Випуски
 migrate_repo=Перенести репозиторій
 migrate.clone_address=Перенести / клонувати з URL-адреси
 migrate.clone_address_desc=URL-адреса HTTP(S) або Git «clone» існуючого репозиторію
@@ -1149,14 +1129,6 @@ migrate.migrate=Перенесення з %s
 migrate.migrating=Перенесення з <b>%s</b>…
 migrate.migrating_failed=Перенесення з <b>%s</b> не вдалося.
 migrate.migrating_failed_no_addr=Перенесення не вдалося.
-migrate.migrating_git=Перенесення даних Git
-migrate.migrating_topics=Перенесення тем
-migrate.migrating_milestones=Перенесення етапів
-migrate.migrating_labels=Перенесення міток
-migrate.migrating_releases=Перенесення випусків
-migrate.migrating_issues=Перенесення задач
-migrate.migrating_pulls=Перенесення запитів на злиття
-
 mirror_from=дзеркало
 forked_from=форк від
 generated_from=згенеровано з
@@ -2350,14 +2322,11 @@ pull.deleted_branch = (видалено): %s
 milestones.update_ago = Оновлено %s
 size_format = %[1]s: %[2]s; %[3]s: %[4]s
 settings.units.add_more = Увімкнути ще
-migrate.cancel_migrating_title = Скасувати перенесення
 settings.units.units = Розділи
 settings.units.overview = Огляд
 projects.create_success = Проєкт «%s» створено.
 issues.no_content = Немає опису.
 settings.mirror_settings.docs.doc_link_title = Як дзеркалювати репозиторії?
-n_commit_one = %s коміт
-n_commit_few = %s комітів
 signing.will_sign = Коміт буде підписано ключем «%s».
 signing.wont_sign.error = Під час перевірки можливості підписати коміт сталася помилка.
 commits.search_branch = У цій гілці
@@ -2371,8 +2340,6 @@ project = Проєкти
 issues.review.outdated_description = Вміст змінився з моменту написання цього коментаря
 commits.browse_further = Дивитися далі
 issues.unpin_issue = Відкріпити задачу
-n_branch_one = %s гілка
-n_branch_few = %s гілок
 executable_file = Виконуваний файл
 migrate_options_mirror_helper = Цей репозиторій буде дзеркалом
 projects.edit_success = Проєкт «%s» оновлено.
@@ -2457,10 +2424,8 @@ archive.title_date = Цей репозиторій архівовано %s. Ви
 settings.event_pull_request_review_request_desc = Створено або видалено запит на відгук до запиту на злиття.
 archive.pull.noreview = Цей репозиторій архівовано. Ви не можете рецензувати запити на злиття.
 issues.num_reviews_few = %d відгуків
-n_release_few = %s випусків
 release.releases_for = Випуски %s
 release.type_attachment = Вкладення
-n_release_one = %s випуск
 issues.reopen.blocked_by_user = Ви не можете знову відкрити цю задачу, оскільки вас заблокував власник репозиторію або автор задачі.
 settings.actions_desc = Увімкнути вбудовані конвеєри CI/CD з Діями Forgejo
 tree_path_not_found_commit = Шлях %[1]s не існує в коміті %[2]s
@@ -2498,8 +2463,6 @@ pulls.nothing_to_compare_have_tag = Вибрані гілки/теги одна
 pulls.delete_after_merge.head_branch.is_protected = Головна гілка, яку ви намагаєтеся видалити, є захищеною і її неможливо видалити.
 settings.default_update_style_desc = Типовий стиль оновлення для запитів на злиття, що знаходяться позаду базової гілки.
 commit.load_referencing_branches_and_tags = Завантажити гілки і теги, які посилаються на цей коміт
-n_tag_few = %s тегів
-n_tag_one = %s тег
 settings.branches.switch_default_branch = Змінити типову гілку
 branch.branch_already_exists = Гілка «%s» вже є у цьому репозиторії.
 commit.contained_in_default_branch = Цей коміт — частина типової гілки
@@ -2696,7 +2659,6 @@ settings.mirror_settings.docs.disabled_push_mirror.instructions = Налашту
 settings.mirror_settings.docs.disabled_push_mirror.info = Push-дзеркала вимкнено адміністрацією сайту.
 settings.mirror_settings.docs.disabled_pull_mirror.instructions = Налаштуйте свій проєкт на автоматичне надсилання комітів, тегів і гілок до іншого репозиторію. Pull-дзеркала вимкнено адміністрацією сайту.
 issues.label_templates.fail_to_load_file = Не вдалося завантажити файл шаблону міток «%s»: %v
-migrate.cancel_migrating_confirm = Бажаєте скасувати перенесення?
 transfer.no_permission_to_accept = У вас немає дозволу прийняти цю передачу.
 transfer.no_permission_to_reject = У вас немає дозволу відхилити цю передачу.
 issues.choose.ignore_invalid_templates = Недійсні шаблони проігноровано
@@ -2955,34 +2917,6 @@ dashboard.resync_all_hooks=Пересинхронізувати Git-хуки в
 dashboard.reinit_missing_repos=Переініціалізувати всі Git-репозиторії, для яких існують записи
 dashboard.sync_external_users=Синхронізувати дані зовнішніх користувачів
 dashboard.cleanup_hook_task_table=Очистити таблицю hook_task
-dashboard.server_uptime=Час роботи сервера
-dashboard.current_goroutine=Поточна кількість goroutines
-dashboard.current_memory_usage=Поточне використання пам’яті
-dashboard.total_memory_allocated=Виділено пам’яті загалом
-dashboard.memory_obtained=Отримано пам’яті
-dashboard.pointer_lookup_times=Пошуків вказівника
-dashboard.memory_allocate_times=Виділень пам’яті
-dashboard.memory_free_times=Звільнень пам’яті
-dashboard.current_heap_usage=Поточне використання динамічної пам’яті
-dashboard.heap_memory_obtained=Отримано динамічної пам’яті
-dashboard.heap_memory_idle=Динамічної пам’яті простоює
-dashboard.heap_memory_in_use=Динамічної пам’яті використовується
-dashboard.heap_memory_released=Звільнено динамічної пам’яті
-dashboard.heap_objects=Об’єктів динамічної пам’яті
-dashboard.bootstrap_stack_usage=Використання стеку bootstrap
-dashboard.stack_memory_obtained=Отримано пам’яті стеком
-dashboard.mspan_structures_usage=Використання структур MSpan
-dashboard.mspan_structures_obtained=Отримано структур MSpan
-dashboard.mcache_structures_usage=Використання структур MCache
-dashboard.mcache_structures_obtained=Отримано структур MCache
-dashboard.profiling_bucket_hash_table_obtained=Отримано хеш-таблиць профілювання
-dashboard.gc_metadata_obtained=Отримано метаданих збирача сміття
-dashboard.other_system_allocation_obtained=Отримано інших виділень пам’яті
-dashboard.next_gc_recycle=Наступний цикл збирача сміття
-dashboard.last_gc_time=З останнього запуску збирача сміття
-dashboard.total_gc_pause=Загальна пауза збирача сміття
-dashboard.last_gc_pause=Остання пауза збирача сміття
-dashboard.gc_times=Кількість запусків збирача сміття
 dashboard.delete_old_actions=Видалити всі старі активності з бази даних
 dashboard.delete_old_actions.started=Розпочато видалення всіх старих активностей з бази даних.
 
@@ -3022,19 +2956,6 @@ users.still_own_repo=Цьому користувачу досі належать
 users.still_has_org=Цей користувач є учасником однієї або декількох організацій. Спочатку видаліть користувача з усіх організацій.
 users.deletion_success=Обліковий запис користувача видалено.
 users.reset_2fa=Скинути 2FA
-users.list_status_filter.menu_text=Фільтр
-users.list_status_filter.reset=Скинути
-users.list_status_filter.is_active=Активні
-users.list_status_filter.not_active=Неактивні
-users.list_status_filter.is_admin=Адміністратор
-users.list_status_filter.not_admin=Не адміністратор
-users.list_status_filter.is_restricted=З обмеженнями
-users.list_status_filter.not_restricted=Без обмежень
-users.list_status_filter.is_prohibit_login=Вхід заборонено
-users.list_status_filter.not_prohibit_login=Вхід дозволено
-users.list_status_filter.is_2fa_enabled=2FA увімкнено
-users.list_status_filter.not_2fa_enabled=2FA вимкнено
-
 emails.email_manage_panel=Керування електронними адресами користувачів
 emails.primary=Головний
 emails.activated=Активовано
@@ -3301,20 +3222,6 @@ monitor.process.cancel_desc=Скасування процесу може при
 monitor.process.cancel_notices=Скасувати: <strong>%s</strong>?
 monitor.process.children=Дочірні процеси
 
-monitor.queues=Черги
-monitor.queue=Черга: %s
-monitor.queue.name=Назва
-monitor.queue.type=Тип
-monitor.queue.exemplar=Приклад типу
-monitor.queue.numberworkers=Кількість обробників
-monitor.queue.maxnumberworkers=Максимальна кількість обробників
-monitor.queue.settings.title=Налаштування пулу
-monitor.queue.settings.maxnumberworkers=Максимальна кількість обробників
-monitor.queue.settings.maxnumberworkers.placeholder=Поточний %[1]d
-monitor.queue.settings.maxnumberworkers.error=Максимальна кількість обробників має бути числом
-monitor.queue.settings.submit=Оновити налаштування
-monitor.queue.settings.changed=Налаштування оновлено
-
 notices.system_notice_list=Сповіщення системи
 notices.view_detail_header=Подробиці сповіщення
 notices.select_all=Вибрати все
@@ -3357,12 +3264,6 @@ users.new_success = Обліковий запис «%s» створено.
 config_settings = Налаштування
 self_check.no_problem_found = Проблем поки що не виявлено.
 config_summary = Підсумок
-monitor.queue.review_add = Переглянути / додати обробники
-monitor.queue.activeworkers = Активні обробники
-monitor.queue.numberinqueue = Номер у черзі
-monitor.queue.settings.desc = Пули динамічно зростають у відповідь на блокування черг їхніх обробників.
-monitor.queue.settings.remove_all_items_done = Усі елементи в черзі видалено.
-monitor.queue.settings.remove_all_items = Видалити всі
 config.app_slogan = Гасло екземпляра
 auths.tip.gitea = Зареєструйте нову програму OAuth. Інструкцію можна знайти на %s
 auths.tip.gitlab_new = Зареєструйте нову програму на %s
@@ -3533,21 +3434,7 @@ creation.value_placeholder = Уведіть довільний вміст. Пр
 description = Секрети передаються певним діям і не можуть бути прочитані інакше.
 
 [actions]
-variables.update.failed = Не вдалося змінити змінну.
-variables.update.success = Змінну змінено.
-variables.creation = Додати змінну
-variables.none = Змінних ще немає.
-variables.deletion = Видалити змінну
-variables = Змінні
-variables.deletion.success = Змінну видалено.
-variables.creation.failed = Не вдалося додати змінну.
-variables.deletion.failed = Не вдалося видалити змінну.
-variables.creation.success = Змінну «%s» додано.
-variables.description = Змінні передаються певним діям і не можуть бути прочитані інакше.
-variables.deletion.description = Видалення змінної є остаточним і його неможливо скасувати. Продовжити?
-variables.management = Керування змінними
 variables.id_not_exist = Змінної з ідентифікатором %d не існує.
-variables.edit = Редагувати змінну
 runs.expire_log_message = Журнали очищено, тому що вони були занадто старі.
 runs.empty_commit_message = (порожнє повідомлення коміту)
 workflow.enable_success = Робочий потік «%s» успішно ввімкнено.
@@ -3556,7 +3443,6 @@ workflow.disable_success = Робочий потік «%s» успішно ви
 workflow.disabled = Робочий потік вимкнено.
 workflow.enable = Увімкнути робочий потік
 need_approval_desc = Потрібне схвалення для запуску робочих потоків для запиту на злиття.
-variables.not_found = Не вдалося знайти змінну.
 runs.no_workflows.help_no_write_access = Щоб дізнатися більше про Дії Forgejo, читайте <a target="_blank" rel="noopener noreferrer" href="%s">документацію</a>.
 runs.no_workflows.help_write_access = Не знаєте, як почати роботу з Діями Forgejo? Перегляньте <a target="_blank" rel="noopener noreferrer" href="%s">посібник для початківців у документації</a>, щоб написати свій перший робочий потік, а потім <a target="_blank" rel="noopener noreferrer" href="%s">налаштуйте ранер Forgejo</a> для виконання завдань.
 unit.desc = Керування вбудованими конвеєрами CI/CD з Діями Forgejo.
@@ -3613,9 +3499,6 @@ pull_kind = Шукати запити на злиття…
 runner_kind = Шукати ранери…
 
 [markup]
-filepreview.truncated = Перегляд було урізано
-filepreview.line = Рядок %[1]d в %[2]s
-filepreview.lines = Рядки з %[1]d по %[2]d в %[3]s
 
 [translation_meta]
 test = Це тестовий текст. Він не відображається в інтерфейсі користувача Forgejo, а використовується з метою тестування
diff --git a/options/locale/locale_vi.ini b/options/locale/locale_vi.ini
index 61d7117b73..f8f5eba9d5 100644
--- a/options/locale/locale_vi.ini
+++ b/options/locale/locale_vi.ini
@@ -24,18 +24,8 @@ password = Mật khẩu
 access_token = Mã truy cập
 captcha = CAPTCHA
 twofa = Xác thực hai lớp
-webauthn_insert_key = Cắm khóa bảo mật của bạn vào
 copy_hash = Sao chép chuỗi băm
 sign_in_with_provider = Đăng nhập bằng %s
-webauthn_press_button = Hãy nhấn nút trên khóa bảo mật…
-webauthn_use_twofa = Dùng mã xác thực hai lớp ở trên điện thoại
-webauthn_error = Không thể đọc khóa bảo mật của bạn.
-webauthn_unsupported_browser = Trình duyệt của bạn hiện không hỗ trợ WebAuthn.
-webauthn_error_unknown = Có lỗi xảy ra. Vui lòng thử lại.
-webauthn_error_insecure = WebAuthn chỉ hỗ trợ kết nối mã hóa. Nếu đang thử nghiệm, bạn có thể dùng "localhost" hoặc "127.0.0.1"
-webauthn_error_unable_to_process = Máy chủ không thể xử lý yêu cầu của bạn.
-webauthn_error_empty = Bạn phải đặt tên cho khóa này.
-webauthn_error_timeout = Hết thời gian đọc khóa mất rồi. Hãy tải lại trang và thử lại.
 copy_type_unsupported = Không thể sao chép loại tệp này
 repository = Kho mã
 organization = Tổ chức
@@ -79,7 +69,6 @@ pin = Ghim
 archived = Đã lưu trữ
 signed_in_as = Đăng nhập bằng
 re_type = Xác nhận mật khẩu
-webauthn_sign_in = Nhấn nút trên khóa bảo mật, nếu không có nút thì bạn hãy rút ra rồi cắm lại.
 new_org.link = Tạo tổ chức
 error404 = Trang bạn đang tìm <strong>không tồn tại</strong>, <strong>đã bị xoá</strong> hoặc <strong>bạn không có quyền</strong> để xem nó.
 edit = Chỉnh sửa
@@ -89,7 +78,6 @@ logo = Logo
 toc = Mục lục
 user_profile_and_more = Hồ sơ và cài đặt…
 passcode = Mã xác thực
-webauthn_error_duplicated = Khóa bảo mật không được phép cho yêu cầu này. Vui lòng đảm bảo rằng khóa chưa được đăng ký trước đó.
 mirror = Bản sao
 new_mirror = Tạo bản sao mới
 your_starred = Đã đánh sao
@@ -706,7 +694,7 @@ update_hints = Cập nhật các gợi ý
 update_hints_success = Đã cập nhật các gợi ý.
 hidden_comment_types = Loại bình luận bị ẩn
 hidden_comment_types_description = Các loại bình luận được chọn ở đây sẽ không hiện trên các trang vấn đề. Ví dụ: Chọn "Nhãn" thì sẽ loại bỏ tất cả các bình luận "<user> đã thêm/bỏ <label>".
-hidden_comment_types.ref_tooltip =
+hidden_comment_types.ref_tooltip = 
 hidden_comment_types.issue_ref_tooltip = Các bình luận mà người dùng đổi nhánh/nhãn gắn với vấn đề
 comment_type_group_reference = Đề cập
 comment_type_group_label = Nhãn
@@ -782,7 +770,7 @@ key_content_gpg_placeholder = Bắt đầu bằng "-----BEGIN PGP PUBLIC KEY BLO
 ssh_key_been_used = Mã SSH này đã được thêm vào máy chủ rồi.
 ssh_key_name_used = Một mã SSH cùng tên đã tồn tại trong tài khoản của bạn.
 gpg_key_id_used = Một mã GPG công khai cùng ID đã tồn tại.
-gpg_no_key_email_found =
+gpg_no_key_email_found = 
 gpg_key_matched_identities = Các danh tính khớp:
 gpg_key_verify = Xác thực
 gpg_token_help = Bạn có thể tạo chữ kí bằng:
@@ -803,7 +791,7 @@ delete_key = Gỡ
 ssh_key_deletion = Gỡ mã SSH
 gpg_key_deletion = Gỡ mã GPG
 ssh_key_deletion_desc = Việc gỡ mã SSH sẽ tước quyền truy cập của nó đến tài khoản của bạn. Tiếp tục?
-gpg_key_deletion_desc =
+gpg_key_deletion_desc = 
 ssh_key_deletion_success = Đã gỡ mã SSH.
 gpg_key_deletion_success = Đã gỡ mã GPG.
 added_on = Đã được thêm từ %s
@@ -1043,11 +1031,6 @@ need_auth = Cấp phép
 migrate_options = Cài đặt nhập
 migrate_options_lfs = Nhập các tệp LFS
 migrate_options_lfs_endpoint.description.local = Đường dẫn máy chủ cục bộ cũng được hỗ trợ.
-migrate_items_milestones = Cột mốc
-migrate_items_labels = Nhãn
-migrate_items_issues = Vấn đề
-migrate_items_merge_requests = Yêu cầu hợp
-migrate_items_releases = Bản phát hành
 migrate_repo = Nhập kho mã
 migrate.repo_desc_helper = Bỏ trống để nhập mô tả có sẵn
 migrate.clone_local_path = hoặc một đường dẫn máy chủ cục bộ
@@ -1062,15 +1045,6 @@ migrate.migrating = Đang nhập từ <b>%s</b>…
 migrate.migrating_failed = Nhập từ <b>%s</b> thất bại.
 migrate.migrating_failed.error = Nhập thất bại: %s
 migrate.migrating_failed_no_addr = Nhập thất bại.
-migrate.migrating_git = Đang nhập dữ liệu Git
-migrate.migrating_topics = Đang nhập các chủ đề
-migrate.migrating_milestones = Đang nhập các cột mốc
-migrate.migrating_labels = Đang nhập các nhãn
-migrate.migrating_releases = Đang nhập các bản phát hành
-migrate.migrating_issues = Đang nhập các vấn đề
-migrate.migrating_pulls = Đang nhập các yêu cầu kéo
-migrate.cancel_migrating_title = Huỷ nhập
-migrate.cancel_migrating_confirm = Bạn có muốn huỷ nhập không?
 forked_from = phân nhánh từ
 generated_from = tạo từ
 fork_from_self = Bạn không thể phân nhánh kho mã của bạn.
@@ -1088,7 +1062,6 @@ more_operations = Thêm thao tác
 no_desc = Không có mô tả
 quick_guide = Chỉ dẫn nhanh
 fork_branch = Nhánh để nhân bản đến phân nhánh
-migrate_items_pullrequests = Yêu cầu kéo
 archive.pull.noreview = Kho mã này được lưu trữ. Bạn không thể xem xét yêu cầu kéo.
 archive.title_date = Kho mã này đã được lưu trữ vào %s. Bạn có thể xem tệp và nhân bản nó, nhưng bạn không thể thay đổi trạng thái của nó, như việc tạo vấn đề, yêu cầu kéo hay bình luận.
 archive.title = Kho mã này được lưu trữ. Bạn có thể xem tệp và nhân bản nó, nhưng bạn không thể thay đổi trạng thái của nó, như việc tạo vấn đề, yêu cầu kéo hay bình luận.
@@ -1174,8 +1147,6 @@ settings.packagist_api_token = Mã API
 filter_branch_and_tag = Lọc nhánh hoặc nhãn
 find_tag = Tìm nhãn
 tags = Nhãn
-n_tag_one = %s nhãn
-n_tag_few = %s nhãn
 video_not_supported_in_browser = Trình duyệt của bạn không hỗ trợ thẻ "video" HTML5.
 audio_not_supported_in_browser = Trình duyệt của bạn không hỗ trợ thẻ "audio" HTML5.
 pulls.nothing_to_compare_have_tag = Các nhánh/nhãn đã chọn bằng nhau.
@@ -1268,10 +1239,6 @@ labels = Nhãn
 milestones = Cột mốc
 org_labels_desc = Nhãn cấp tổ chức mà có thể được dùng với <strong>tất cả các kho mã</strong> của tổ chức này
 org_labels_desc_manage = quản lí
-n_branch_one = %s nhánh
-n_branch_few = %s nhánh
-n_release_one = %s bản phát hành
-n_release_few = %s bản phát hành
 released_this = đã phát hành bản này
 file.title = %s tại %s
 file_raw = Thô
diff --git a/options/locale/locale_zh-CN.ini b/options/locale/locale_zh-CN.ini
index f0ccbcb531..2a6686b2ec 100644
--- a/options/locale/locale_zh-CN.ini
+++ b/options/locale/locale_zh-CN.ini
@@ -37,18 +37,6 @@ twofa=两步验证
 twofa_scratch=两步验证备用验证码
 passcode=验证码
 
-webauthn_insert_key=插入安全密钥
-webauthn_sign_in=按下安全密钥上的按钮。如果安全密钥没有按钮，请重新插入它。
-webauthn_press_button=请按下安全密钥上的按钮……
-webauthn_use_twofa=使用来自手机中的两步验证码
-webauthn_error=无法读取安全密钥。
-webauthn_unsupported_browser=你的浏览器目前不支持WebAuthn。
-webauthn_error_unknown=发生未知错误。请重试。
-webauthn_error_insecure=WebAuthn仅支持安全连接。如果要在HTTP协议上进行测试，请使用"localhost"或"127.0.0.1"作为访问来源
-webauthn_error_unable_to_process=服务器无法处理您的请求。
-webauthn_error_duplicated=此安全密钥未被许可用于这个请求。请确保该密钥尚未注册。
-webauthn_error_empty=您必须为此密钥设置一个名称。
-webauthn_error_timeout=未能在允许的时限内读取密钥。请重新加载此页面并重试。
 repository=仓库
 organization=组织
 mirror=镜像
@@ -1156,14 +1144,6 @@ migrate_options_lfs_endpoint.label=LFS网址
 migrate_options_lfs_endpoint.description=迁移将尝试使用你的Git remote来<a target="_blank" rel="noopener noreferrer" href="%s">确定LFS服务器</a>。如果仓库LFS数据存储在其他位置，你还可以指定自定义网址。
 migrate_options_lfs_endpoint.description.local=支持本地服务器路径。
 migrate_options_lfs_endpoint.placeholder=如果留空，网址将从克隆URL中得到
-migrate_items=迁移项目
-migrate_items_wiki=百科
-migrate_items_milestones=里程碑
-migrate_items_labels=标签
-migrate_items_issues=议题
-migrate_items_pullrequests=合并请求
-migrate_items_merge_requests=合并请求
-migrate_items_releases=版本发布
 migrate_repo=迁移仓库
 migrate.clone_address=从URL迁移/克隆
 migrate.clone_address_desc=现有仓库的HTTP(S)或Git“clone”URL
@@ -1182,16 +1162,6 @@ migrate.migrating=正在从<b>%s</b>迁移……
 migrate.migrating_failed=从<b>%s</b>迁移失败。
 migrate.migrating_failed.error=迁移失败：%s
 migrate.migrating_failed_no_addr=迁移失败。
-migrate.migrating_git=迁移Git数据
-migrate.migrating_topics=正在迁移主题
-migrate.migrating_milestones=正在迁移里程碑
-migrate.migrating_labels=正在迁移标签
-migrate.migrating_releases=正在迁移发布
-migrate.migrating_issues=正在迁移议题
-migrate.migrating_pulls=正在迁移合并请求
-migrate.cancel_migrating_title=取消迁移
-migrate.cancel_migrating_confirm=您想要取消此次迁移吗？
-
 mirror_from=镜像自地址
 forked_from=派生自
 generated_from=生成自
@@ -2644,12 +2614,6 @@ open_with_editor = 使用%s打开
 settings.rename_branch_failed_protected = 无法重命名受保护的分支%s。
 stars = 点赞
 settings.confirmation_string = 确认输入
-n_commit_one = %s提交
-n_commit_few = %s提交
-n_branch_one = %s分支
-n_branch_few = %s分支
-n_tag_one = %s标签
-n_tag_few = %s标签
 editor.commit_id_not_matching = 您在编辑文件时该文件已被更改。请提交到一个新的分支，然后再将这个新的分支合并回当前分支。
 issues.num_participants_one = %d位参与者
 issues.archived_label_description = （已存档）%s
@@ -2677,8 +2641,6 @@ settings.transfer.button = 转移所有权
 wiki.search = 搜索百科
 wiki.no_search_results = 无结果
 form.string_too_long = 给定的字符串长度超过%d个字符。
-n_release_one = %s版本发布
-n_release_few = %s版本发布
 project = 项目
 issues.edit.already_changed = 无法保存对议题的更改。议题似乎已经被另一个用户修改了，为了防止修改被覆盖，请刷新页面后再次尝试编辑
 pulls.edit.already_changed = 无法保存对合并请求的更改。内容似乎已经被另一个用户修改了，为了防止修改被覆盖，请刷新页面后再次尝试编辑
@@ -2965,34 +2927,6 @@ dashboard.sync_external_users=同步外部用户数据
 dashboard.cleanup_hook_task_table=清理hook_task表
 dashboard.cleanup_packages=清理过期的软件包
 dashboard.cleanup_actions=清理过期的Actions日志和制品
-dashboard.server_uptime=服务运行时间
-dashboard.current_goroutine=当前Goroutines数量
-dashboard.current_memory_usage=当前内存使用量
-dashboard.total_memory_allocated=所有被分配的内存
-dashboard.memory_obtained=内存占用量
-dashboard.pointer_lookup_times=指针查找次数
-dashboard.memory_allocate_times=内存分配次数
-dashboard.memory_free_times=内存释放次数
-dashboard.current_heap_usage=当前Heap内存使用量
-dashboard.heap_memory_obtained=Heap内存占用量
-dashboard.heap_memory_idle=Heap内存空闲量
-dashboard.heap_memory_in_use=正在使用的Heap内存
-dashboard.heap_memory_released=被释放的Heap内存
-dashboard.heap_objects=Heap对象数量
-dashboard.bootstrap_stack_usage=启动Stack使用量
-dashboard.stack_memory_obtained=被分配的Stack内存
-dashboard.mspan_structures_usage=MSpan结构内存使用量
-dashboard.mspan_structures_obtained=被分配的MSpan结构内存
-dashboard.mcache_structures_usage=MCache结构内存使用量
-dashboard.mcache_structures_obtained=被分配的MCache结构内存
-dashboard.profiling_bucket_hash_table_obtained=被分配的剖析哈希表内存
-dashboard.gc_metadata_obtained=被分配的GC元数据内存
-dashboard.other_system_allocation_obtained=其它被分配的系统内存
-dashboard.next_gc_recycle=下次GC内存回收量
-dashboard.last_gc_time=距离上次GC时间
-dashboard.total_gc_pause=GC暂停时间总量
-dashboard.last_gc_pause=上次GC暂停时间
-dashboard.gc_times=GC执行次数
 dashboard.delete_old_actions=从数据库中删除所有旧操作记录
 dashboard.delete_old_actions.started=已开始从数据库中删除所有旧操作记录。
 dashboard.update_checker=更新检查器
@@ -3050,18 +2984,6 @@ users.purge_help=强制删除用户和用户拥有的任何仓库、组织和软
 users.still_own_packages=此用户仍然拥有一个或多个软件包，请先删除这些软件包。
 users.deletion_success=用户帐户已被删除。
 users.reset_2fa=重置两步验证
-users.list_status_filter.menu_text=过滤
-users.list_status_filter.reset=重置
-users.list_status_filter.is_active=已激活
-users.list_status_filter.not_active=未激活
-users.list_status_filter.is_admin=管理员
-users.list_status_filter.not_admin=非管理员
-users.list_status_filter.is_restricted=受限
-users.list_status_filter.not_restricted=不受限
-users.list_status_filter.is_prohibit_login=禁止登录
-users.list_status_filter.not_prohibit_login=允许登录
-users.list_status_filter.is_2fa_enabled=已启用2FA
-users.list_status_filter.not_2fa_enabled=未启用2FA
 users.details=用户详情
 
 emails.email_manage_panel=管理用户邮件地址
@@ -3381,26 +3303,6 @@ monitor.process.cancel_desc=中止一个进程可能导致数据丢失
 monitor.process.cancel_notices=中止：<strong>%s</strong>？
 monitor.process.children=子进程
 
-monitor.queues=队列
-monitor.queue=队列：%s
-monitor.queue.name=名称
-monitor.queue.type=类型
-monitor.queue.exemplar=数据类型
-monitor.queue.numberworkers=worker数量
-monitor.queue.activeworkers=活跃worker
-monitor.queue.maxnumberworkers=最大worker数量
-monitor.queue.numberinqueue=队列中的数量
-monitor.queue.review_add=审查/添加worker
-monitor.queue.settings.title=池设置
-monitor.queue.settings.desc=因为工作者队列阻塞，池正在动态扩展。
-monitor.queue.settings.maxnumberworkers=最大工作者数量
-monitor.queue.settings.maxnumberworkers.placeholder=当前%[1]d
-monitor.queue.settings.maxnumberworkers.error=最大工作者数必须是数字
-monitor.queue.settings.submit=更新设置
-monitor.queue.settings.changed=设置已更新
-monitor.queue.settings.remove_all_items=移除全部
-monitor.queue.settings.remove_all_items_done=队列中的所有项目已被移除。
-
 notices.system_notice_list=系统通知
 notices.view_detail_header=通知详情
 notices.operations=操作
@@ -3543,21 +3445,7 @@ workflow.disabled=工作流已禁用。
 
 need_approval_desc=该工作流由派生仓库的合并请求所触发，需要批准方可运行。
 
-variables=变量
-variables.management=管理变量
-variables.creation=添加变量
-variables.none=目前还没有变量。
-variables.deletion=删除变量
-variables.deletion.description=删除变量是永久性的，无法撤消。继续吗？
-variables.description=变量将被传给特定的Action，其它情况将不能被读取。
 variables.id_not_exist=ID为 %d 的变量不存在。
-variables.edit=编辑变量
-variables.deletion.failed=删除变量失败。
-variables.deletion.success=变量已被删除。
-variables.creation.failed=添加变量失败。
-variables.creation.success=变量 “%s” 添加成功。
-variables.update.failed=编辑变量失败。
-variables.update.success=该变量已被编辑。
 workflow.dispatch.trigger_found = 此工作流有<c>workflow_dispatch</c>事件触发器。
 workflow.dispatch.use_from = 使用工作流
 workflow.dispatch.invalid_input_type = 输入类型“%s”无效。
@@ -3568,7 +3456,6 @@ workflow.dispatch.input_required = 需要输入“%s”的值。
 runs.expire_log_message = 已清除日志，因为它们太旧了。
 runs.no_workflows.help_write_access = 不知道如何上手Forgejo Actions？查看<a target="_blank" rel="noopener noreferrer" href="%s">用户文档的快速上手部分</a>来编写你的第一个工作流，然后<a target="_blank" rel="noopener noreferrer" href="%s">配置一个Forgejo运行器</a>来运行你的任务。
 runs.no_workflows.help_no_write_access = 欲了解关于Forgejo Actions的更多信息，请参见<a target="_blank" rel="noopener noreferrer" href="%s">文档</a>。
-variables.not_found = 找不到变量。
 
 [projects]
 type-1.display_name=个人项目
@@ -3617,9 +3504,6 @@ regexp_tooltip = 将搜索内容解释为正则表达式
 [munits.data]
 
 [markup]
-filepreview.line = %[2]s中的第%[1]d行
-filepreview.lines = %[3]s中的第%[1]d到%[2]d行
-filepreview.truncated = 预览已被截断
 
 [translation_meta]
 test = 好的
diff --git a/options/locale/locale_zh-HK.ini b/options/locale/locale_zh-HK.ini
index dcec0908ef..becef6d682 100644
--- a/options/locale/locale_zh-HK.ini
+++ b/options/locale/locale_zh-HK.ini
@@ -70,19 +70,10 @@ return_to_forgejo = 返來 Forgejo
 username = 用戶名
 captcha = 驗證碼
 toggle_menu = 切換選單
-webauthn_insert_key = 插入安全密鑰
 twofa = 兩步驟驗證
-webauthn_sign_in = 撳下安全密鑰嘅掣。如果安全密鑰冇掣，請再插入。
-webauthn_press_button = 請撳下安全密鑰嘅掣…
 more_items = 多啲嘢
-webauthn_use_twofa = 用手機嘅兩步驟驗證
-webauthn_error = 唔可以讀取安全密鑰。
-webauthn_unsupported_browser = 你嘅瀏覽器唔支援 WebAuthn。
-webauthn_error_unknown = 發生未知嘅錯誤，請再試下。
-webauthn_error_unable_to_process = 伺服器唔可以執行你嘅請求。
 logo = 標識
 enable_javascript = 本網站需要 JavaScript。
-webauthn_error_empty = 你要起名呢條鎖匙。
 your_starred = 已加星號
 active_stopwatch = 活動時間追蹤器
 rerun = 重新執行
@@ -420,9 +411,6 @@ template.avatar=頭像
 
 
 
-migrate_items_issues=問題數
-migrate_items_pullrequests=合併請求
-migrate_items_releases=版本發佈
 migrate_repo=遷移儲存庫
 migrate.permission_denied=您並沒有導入本地儲存庫的權限。
 migrate.failed=遷移失敗：%v
@@ -725,7 +713,6 @@ release.downloads=下載附件
 mirror_password_blank_placeholder = （未設定）
 settings.trust_model.default = 預設信任模型
 issue_labels = 標籤
-migrate_items_milestones = 里程碑
 settings.default_merge_style_desc = 預設合併方式
 language_other = 其他
 delete_preexisting_label = 刪除
@@ -742,8 +729,6 @@ mirror_password_placeholder = （未變更）
 readme = 讀我檔案
 release = 發佈
 commit = 提交
-migrate_items_wiki = 維基
-migrate_items_labels = 標籤
 tag = 標籤
 settings.branches.switch_default_branch = 切換預設分支
 mirror_sync = 已同步
@@ -828,33 +813,6 @@ dashboard.clean_unbind_oauth=清理未綁定OAuth的連結
 dashboard.clean_unbind_oauth_success=所有未綁定 OAuth 的連結已刪除。
 dashboard.reinit_missing_repos=重新初始化所有遺失具已存在記錄的Git 儲存庫
 dashboard.sync_external_users=同步外部使用者資料
-dashboard.server_uptime=服務執行時間
-dashboard.current_goroutine=當前 Goroutines 數量
-dashboard.current_memory_usage=當前內存使用量
-dashboard.total_memory_allocated=所有被分配的內存
-dashboard.memory_obtained=內存佔用量
-dashboard.pointer_lookup_times=指針查找次數
-dashboard.current_heap_usage=當前 Heap 內存使用量
-dashboard.heap_memory_obtained=Heap 內存佔用量
-dashboard.heap_memory_idle=Heap 內存空閒量
-dashboard.heap_memory_in_use=正在使用的 Heap 內存
-dashboard.heap_memory_released=被釋放的 Heap 內存
-dashboard.heap_objects=Heap 對象數量
-dashboard.bootstrap_stack_usage=啟動 Stack 使用量
-dashboard.stack_memory_obtained=被分配的 Stack 內存
-dashboard.mspan_structures_usage=MSpan 結構內存使用量
-dashboard.mspan_structures_obtained=被分配的 MSpan 結構內存
-dashboard.mcache_structures_usage=MCache 結構內存使用量
-dashboard.mcache_structures_obtained=被分配的 MCache 結構內存
-dashboard.profiling_bucket_hash_table_obtained=被分配的剖析哈希表內存
-dashboard.gc_metadata_obtained=被分配的垃圾收集元資料內存
-dashboard.other_system_allocation_obtained=其它被分配的系統內存
-dashboard.next_gc_recycle=下次垃圾收集內存回收量
-dashboard.last_gc_time=距離上次垃圾收集時間
-dashboard.total_gc_pause=垃圾收集暫停時間總量
-dashboard.last_gc_pause=上次垃圾收集暫停時間
-dashboard.gc_times=垃圾收集執行次數
-
 users.full_name=組織全名
 users.activated=已啟用
 users.admin=管理員
@@ -863,8 +821,6 @@ users.created=建立時間
 users.edit=編輯
 users.auth_source=認證源
 users.local=本地
-users.list_status_filter.is_admin=管理員
-
 emails.activated=已啟用
 
 orgs.org_manage_panel=組織管理
@@ -1015,10 +971,6 @@ monitor.desc=進程描述
 monitor.start=開始時間
 monitor.execute_time=已執行時間
 
-monitor.queue.name=組織名稱
-monitor.queue.type=認證類型
-monitor.queue.settings.submit=更新設定
-
 notices.system_notice_list=系統提示管理
 notices.view_detail_header=查看提示細節
 notices.select_all=選取全部
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index b1b1156ef6..7f55fd662d 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -35,18 +35,6 @@ twofa=兩步驟驗證
 twofa_scratch=兩步驟驗證備用驗證碼
 passcode=驗證碼
 
-webauthn_insert_key=插入您的安全金鑰
-webauthn_sign_in=按下您安全金鑰上的按鈕。如果您的安全金鑰沒有按鈕，請重新插入。
-webauthn_press_button=請按下您安全金鑰上的按鈕…
-webauthn_use_twofa=使用來自手機的兩步驟驗證碼
-webauthn_error=無法讀取您的安全金鑰。
-webauthn_unsupported_browser=您的瀏覽器還不支援 WebAuthn。
-webauthn_error_unknown=發生未知的錯誤，請再試一次。
-webauthn_error_insecure=WebAuthn 只支援安全連線。想在 HTTP 上測試，您可以使用「localhost」或「127.0.0.1」
-webauthn_error_unable_to_process=伺服器無法處理您的請求。
-webauthn_error_duplicated=此安全金鑰無法允許這個請求。請確保該金鑰尚未被註冊。
-webauthn_error_empty=您必須命名此金鑰。
-webauthn_error_timeout=在成功讀取金鑰之前已逾時，請重新載入此頁面並重試。
 repository=儲存庫
 organization=組織
 mirror=鏡像
@@ -1133,14 +1121,6 @@ migrate_options_lfs=遷移 LFS 檔案
 migrate_options_lfs_endpoint.label=LFS 端點
 migrate_options_lfs_endpoint.description=遷移將會嘗試使用您的 Git 遠端來<a target="_blank" rel="noopener noreferrer" href="%s">確認 LFS 伺服器</a>。如果存儲庫的 LFS 資料放在其他地方，您也可以指定自訂的端點。
 migrate_options_lfs_endpoint.description.local=同時也支援本地伺服器路徑。
-migrate_items=遷移項目
-migrate_items_wiki=Wiki
-migrate_items_milestones=里程碑
-migrate_items_labels=標籤
-migrate_items_issues=問題
-migrate_items_pullrequests=合併請求
-migrate_items_merge_requests=合併請求
-migrate_items_releases=版本發布
 migrate_repo=遷移儲存庫
 migrate.clone_address=從 URL 遷移 / Clone
 migrate.clone_address_desc=現有儲存庫的 HTTP(S) 或 Git 「clone」 URL
@@ -1158,14 +1138,6 @@ migrate.migrate=從 %s 遷移
 migrate.migrating=正在從 <b>%s</b> 遷移…
 migrate.migrating_failed=從 <b>%s</b> 遷移失敗。
 migrate.migrating_failed_no_addr=遷移失敗。
-migrate.migrating_git=正在遷移 Git 資料
-migrate.migrating_topics=正在遷移主題
-migrate.migrating_milestones=正在遷移里程碑
-migrate.migrating_labels=正在遷移標籤
-migrate.migrating_releases=正在遷移版本發佈
-migrate.migrating_issues=正在遷移問題
-migrate.migrating_pulls=正在遷移合併請求
-
 mirror_from=鏡像自
 forked_from=分叉自
 generated_from=產生自
@@ -2447,7 +2419,6 @@ tree_path_not_found.branch = 路徑 %[1]s 不存在於分支 %[2]s 中
 transfer.no_permission_to_accept = 您沒有權限接受這項轉讓。
 archive.title = 這個儲存庫已被封存。您可以檢視其中的檔案或拓製儲存庫，但您無法提交推送和創建新議題、合併請求或評論。
 archive.title_date = 這個儲存庫在 %s 被封存了。您可以檢視其中的檔案或拓製儲存庫，但您無法提交推送和創建新議題、合併請求或評論。
-migrate.cancel_migrating_title = 取消遷移
 executable_file = 可執行檔
 all_branches = 所有分支
 object_format_helper = 儲存庫的物件格式。一旦設定便無法更改。SHA1 的相容性最好。
@@ -2459,7 +2430,6 @@ admin.manage_flags = 管理旗標
 visibility_helper = 將儲存庫設為私有
 mirror_address_url_invalid = 提供的網址無效。必須確保正確的跳脫（escape）此網址的每個部份。
 migrate.migrating_failed.error = 遷移失敗：%s
-migrate.cancel_migrating_confirm = 您確定要取消這次的遷移嗎？
 invisible_runes_header = `此檔案內含不可見的 Unicode 字元`
 ambiguous_runes_header = `這個檔案內含模棱兩可的 Unicode 字元`
 rss.must_be_on_branch = 您必須在一個分支上才能訂閱 RSS。
@@ -2478,17 +2448,11 @@ generated = 自動生成的
 object_format = 物件格式
 open_with_editor = 用 %s 打開
 stars = 星星
-n_tag_few = %s 個標籤
 migrate_options_lfs_endpoint.placeholder =如果留空，將利用拓製 URL 推導出 endpoint
 signing.wont_sign.nokey = 這個站點沒有可以用來簽署的金鑰。
-n_branch_few = %s 條分支
-n_tag_one = %s 個標籤
 settings.transfer.button = 轉移所有權
 settings.transfer.modal.title = 轉移所有權
 commits.view_path = 在歷史中檢視這個時間點
-n_commit_one = %s 個提交
-n_commit_few = %s 個提交
-n_branch_one = %s 條分支
 commits.search_branch = 此分支
 commits.browse_further = 進一步瀏覽
 commits.renamed_from = 自 %s 重新命名
@@ -2629,8 +2593,6 @@ milestones.new_subheader = 里程碑可以幫助你組織問題並追蹤其進
 comments.edit.already_changed = 無法儲存對評論的變更。內容似乎已被其他使用者變更。請重新整理頁面並再次嘗試編輯以避免覆蓋其變更
 activity.published_prerelease_label = 預發行
 no_eol.tooltip = 此檔案不包含行尾字元。
-n_release_one = %s 發行
-n_release_few = %s 發行
 no_eol.text = 無檔案結尾符
 issues.all_title = 全部
 mirror_public_key = 公共 SSH 金鑰
@@ -2954,34 +2916,6 @@ dashboard.reinit_missing_repos=重新初始化所有記錄存在但遺失的 Git
 dashboard.sync_external_users=同步外部使用者資料
 dashboard.cleanup_hook_task_table=清理 hook_task 資料表
 dashboard.cleanup_packages=清理過期的軟體包
-dashboard.server_uptime=伺服器運作時間
-dashboard.current_goroutine=目前的 Goroutines
-dashboard.current_memory_usage=目前記憶體使用量
-dashboard.total_memory_allocated=所有被分配的記憶體
-dashboard.memory_obtained=獲得的記憶體
-dashboard.pointer_lookup_times=指標尋找次數
-dashboard.memory_allocate_times=記憶體分配次數
-dashboard.memory_free_times=記憶體釋放次數
-dashboard.current_heap_usage=目前 Heap 記憶體使用量
-dashboard.heap_memory_obtained=獲得的 Heap 記憶體
-dashboard.heap_memory_idle=Heap 記憶體閒置量
-dashboard.heap_memory_in_use=正在使用的 Heap 記憶體
-dashboard.heap_memory_released=被釋放的 Heap 記憶體
-dashboard.heap_objects=Heap 物件數量
-dashboard.bootstrap_stack_usage=啟動 Stack 使用量
-dashboard.stack_memory_obtained=獲得的 Stack 記憶體
-dashboard.mspan_structures_usage=MSpan 結構使用量
-dashboard.mspan_structures_obtained=獲得的 MSpan 結構
-dashboard.mcache_structures_usage=MCache 結構使用量
-dashboard.mcache_structures_obtained=獲得的 MCache 結構
-dashboard.profiling_bucket_hash_table_obtained=被分配的剖析雜湊表
-dashboard.gc_metadata_obtained=被分配 GC Metadata
-dashboard.other_system_allocation_obtained=其他獲得的系統記憶體
-dashboard.next_gc_recycle=下次 GC 記憶體回收量
-dashboard.last_gc_time=距離上次 GC 時間
-dashboard.total_gc_pause=總 GC 暫停時間
-dashboard.last_gc_pause=上次 GC 暫停時間
-dashboard.gc_times=GC 執行次數
 dashboard.delete_old_actions=從資料庫刪除所有舊操作紀錄
 dashboard.delete_old_actions.started=從資料庫刪除所有舊操作紀錄的任務已啟動。
 dashboard.update_checker=更新檢查器
@@ -3032,19 +2966,6 @@ users.purge_help=強制刪除使用者和其所擁有的所有儲存庫、組織
 users.still_own_packages=此使用者仍然擁有至少一個軟體包，請先刪除這些軟體包。
 users.deletion_success=已刪除該使用者帳號。
 users.reset_2fa=重設兩步驟驗證
-users.list_status_filter.menu_text=篩選
-users.list_status_filter.reset=重設
-users.list_status_filter.is_active=已啟用
-users.list_status_filter.not_active=未啟用
-users.list_status_filter.is_admin=管理員
-users.list_status_filter.not_admin=非管理員
-users.list_status_filter.is_restricted=受限
-users.list_status_filter.not_restricted=未受限制
-users.list_status_filter.is_prohibit_login=禁止登入
-users.list_status_filter.not_prohibit_login=允許登入
-users.list_status_filter.is_2fa_enabled=已啟用兩步驟驗證
-users.list_status_filter.not_2fa_enabled=未啟用兩步驟驗證
-
 emails.email_manage_panel=使用者電子信箱管理
 emails.primary=主要
 emails.activated=已啟用
@@ -3346,21 +3267,6 @@ monitor.process.cancel_desc=結束處理程序可能造成資料遺失
 monitor.process.cancel_notices=結束: <strong>%s</strong>?
 monitor.process.children=子程序
 
-monitor.queues=佇列
-monitor.queue=佇列: %s
-monitor.queue.name=名稱
-monitor.queue.type=類型
-monitor.queue.exemplar=型別
-monitor.queue.numberworkers=工作者數量
-monitor.queue.maxnumberworkers=最大工作者數量
-monitor.queue.numberinqueue=佇列中的數量
-monitor.queue.settings.title=集區設定
-monitor.queue.settings.maxnumberworkers=最大工作者數量
-monitor.queue.settings.maxnumberworkers.placeholder=目前 %[1]d
-monitor.queue.settings.maxnumberworkers.error=最大工作者數量必須是數字
-monitor.queue.settings.submit=更新設定
-monitor.queue.settings.changed=已更新設定
-
 notices.system_notice_list=系統提示
 notices.view_detail_header=提示詳情
 notices.operations=操作
@@ -3383,7 +3289,6 @@ dashboard.cron.cancelled = 定時作業：%[1]s 已被取消：%[3]s
 dashboard.cleanup_actions = 清理過期的 Action 日誌和物件
 users.bot = 機器人
 users.remote = 遠端
-monitor.queue.settings.remove_all_items_done = 已移除佇列中所有項目。
 config.access_log_template = 存取日誌範本
 monitor.stats = 統計資料
 self_check.no_problem_found = 未發現任何問題。
@@ -3396,7 +3301,6 @@ repos.lfs_size = LFS 大小
 packages.cleanup = 清除過期的資料
 packages.cleanup.success = 已成功清除過期資料
 monitor.processes_count = %d 個程序
-monitor.queue.settings.remove_all_items = 全部移除
 identity_access = 身分和存取
 config.cache_test = 測試快取
 config_settings = 設定
@@ -3416,7 +3320,6 @@ users.organization_creation.description = 允許建立新組織。
 config.app_slogan = 站點口號
 self_check = 自助檢查
 config.logger_name_fmt = 日誌：%s
-monitor.queue.review_add = 審閱／增加 Worker
 self_check.database_fix_mysql = 對於 MySQL／MariaDB 的使用者，你可以使用命令「forgejo doctor convert」來修復排序規則問題，或者你也可以手動透過「ALTER ... COLLATE ...」SQL 修復問題。
 monitor.duration = 持續時間（秒）
 systemhooks.desc = 當某些 Forgejo 事件觸發時，Webhook 會自動向伺服器發出 HTTP POST 請求。此處定義的 Webhook 將作用於系統上的所有儲存庫，因此請考慮這可能產生的任何效能影響。更多資訊請參考<a target="_blank" rel="noopener" href="%s">Webhook 指南</a>。
@@ -3441,9 +3344,6 @@ users.admin.description = 授予此使用者透過網頁介面和 API 提供的
 auths.tip.gitea = 註冊一個新的 OAuth2 應用程式。指南可在 %s 找到
 
 
-monitor.queue.activeworkers = 活躍工作者
-monitor.queue.settings.desc = 集區會根據工作者佇列的阻塞情況動態增長。
-
 [action]
 create_repo=建立了儲存庫 <a href="%s">%s</a>
 rename_repo=重新命名儲存庫 <code>%[1]s</code> 為 <a href="%[2]s">%[3]s</a>
@@ -3541,21 +3441,7 @@ workflow.enable=啟用工作流程
 workflow.enable_success=已成功啟用工作流程「%s」。
 
 need_approval_desc=需要核可才能執行來自分叉儲存庫的合併請求工作流程。
-variables.edit = 編輯變數
-variables = 變數
-variables.management = 變數管理
 variables.id_not_exist = ID 為 %d 的變數不存在。
-variables.description = 變數會被傳給特定的 Actions，除此之外它們無法被讀取。
-variables.creation.failed = 變數新增失敗。
-variables.update.success = 該變數已被編輯。
-variables.deletion.failed = 變數刪除失敗。
-variables.deletion.success = 該變數已被刪除。
-variables.creation = 新增變數
-variables.none = 目前沒有變數。
-variables.deletion = 刪除變數
-variables.deletion.description = 刪除變數是永久且不可取消的。要繼續嗎？
-variables.creation.success = 已新增變數 「%s」。
-variables.update.failed = 編輯變數失敗。
 runs.empty_commit_message = （空白的提交訊息）
 workflow.disabled = 工作流程已被停用。
 workflow.dispatch.input_required = 需要輸入「%s」的值。
@@ -3568,8 +3454,6 @@ workflow.dispatch.success = 已成功請求工作流程運行。
 workflow.dispatch.use_from = 使用工作流程自
 runs.no_workflows.help_no_write_access = 要了解 Forgejo Actions，請參閱<a target="_blank" rel="noopener noreferrer" href="%s">文件</a>。
 runs.no_workflows.help_write_access = 不知道如何開始使用 Forgejo Actions？查看<a target="_blank" rel="noopener noreferrer" href="%s">使用者文件中的快速入門</a>來編寫你的第一個工作流程，然後<a target="_blank" rel="noopener noreferrer" href="%s">設定 Forgejo Runner</a>來執行你的工作。
-variables.not_found = 找不到變數。
-
 
 [projects]
 type-2.display_name = 儲存庫專案
@@ -3617,9 +3501,6 @@ union_tooltip = 包含與任何空格分隔的關鍵字相符的結果
 [munits.data]
 
 [markup]
-filepreview.truncated = 預覽已被截斷
-filepreview.lines = %[3]s 中的第 %[1]d 至 %[2]d 行
-filepreview.line = %[2]s 中的第 %[1]d 行
 
 [translation_meta]
 test = 好的
diff --git a/options/locale_next/locale_ar.json b/options/locale_next/locale_ar.json
index 6eb05e75c4..a2358fd17b 100644
--- a/options/locale_next/locale_ar.json
+++ b/options/locale_next/locale_ar.json
@@ -1,4 +1,56 @@
 {
+	"admin.monitor.queue.settings.changed": "تم تحديث الإعدادات",
+	"admin.monitor.queue.settings.submit": "حدّث الإعدادات",
+	"admin.monitor.queue.type": "النوع",
+	"admin.monitor.queue.name": "الاسم",
+	"admin.users.list_status_filter.not_restricted": "غير مقيد",
+	"admin.users.list_status_filter.is_restricted": "مقيَّد",
+	"admin.users.list_status_filter.not_admin": "غير مدير",
+	"admin.users.list_status_filter.is_admin": "مدير",
+	"admin.users.list_status_filter.not_active": "معطّل",
+	"admin.users.list_status_filter.is_active": "مفعّل",
+	"actions.variables.update.success": "عُدِّل المتغير.",
+	"actions.variables.update.failed": "فشل تعديل المتغير.",
+	"actions.variables.creation.success": "تم إضافة المتغير \"%s\".",
+	"actions.variables.creation.failed": "فشل إضافة المتغير.",
+	"actions.variables.deletion.success": "تم حذف المتغير.",
+	"actions.variables.deletion.failed": "فشل حذف المتغير.",
+	"actions.variables.edit": "عدّل المتغير",
+	"actions.variables.description": "تمرر المتغيرات إلى إجراءات معينة ولا يمكن قراءتها بطريقة أخرى.",
+	"actions.variables.deletion.description": "إزالة المتغيرات عملية نهائية لا يمكن التراجع عنها. أتريد الاستمرار؟",
+	"actions.variables.deletion": "أزل المتغير",
+	"actions.variables.none": "لا توجد متغيرات بعد.",
+	"actions.variables.creation": "أضف متغيرا",
+	"actions.variables.management": "إدارة المتغيرات",
+	"actions.variables": "المتغيرات",
+	"webauthn.error.timeout": "طال وقت الوصول قبل أن يُقرأ مفتاحك. من فضلك أعد تحميل الصفحة وحاول مجدداً.",
+	"webauthn.error.empty": "يلزم أن تضع اسم لهذا المفتاح.",
+	"webauthn.error.duplicated": "المفتاح الأمني غير مسموح له هذا الطلب. يرجى التأكد من أن المفتاح غير مسجل بالفعل.",
+	"webauthn.error.unable_to_process": "الخادم لا يمكنه معالجة طلبك.",
+	"webauthn.error.insecure": "ويب آوثن يدعم فقط الاتصالات الآمنة. للاختبار على HTTP، يمكنك استخدام \"localhost\" أو \"127.0.0.1\"",
+	"webauthn.error.unknown": "حدث خطأ غير معروف. من فضلك حاول مجدداً.",
+	"webauthn.unsupported_browser": "متصفحك لا يدعم ويب آوثن حالياً.",
+	"webauthn.error": "تعذر قراءة مفتاحك الأمني.",
+	"webauthn.use_twofa": "استخدم رمز المصادقة الموجود على هاتفك",
+	"webauthn.press_button": "من فضلك اضغط الزر على مفتاحك الأمني…",
+	"webauthn.sign_in": "اضغط الزر على مفتاحك الأمني إذا لم يكن لدى مفتاح الأمن الخاص بك أي زر، إعادة تشغيله.",
+	"webauthn.insert_key": "أدخل مفتاحك الأمني",
+	"counters.n_commits": {
+		"one": "%s إيداع",
+		"other": "%s إيداعات"
+	},
+	"counters.n_branches": {
+		"one": "%s فرع",
+		"other": "%s فروع"
+	},
+	"counters.n_tags": {
+		"one": "%s علامة",
+		"other": "‪%s علامات"
+	},
+	"counters.n_releases": {
+		"one": "%s إصدار",
+		"other": "%s إصدارات"
+	},
 	"actions.actions": "الإجراءات",
 	"actions.status.unknown": "مجهول",
 	"actions.status.waiting": "ينتظر",
@@ -254,6 +306,23 @@
 	"migrate.gitbucket.description": "ترحيل البيانات من مثيلات GitBucket.",
 	"migrate.codebase.description": "ترحيل البيانات من codebasehq.com.",
 	"migrate.forgejo.description": "ترحيل المعلومات من كودبيرج أو خوادم فورجيو الأخرى.",
+	"migrate.items.label": "عناصر الترحيل",
+	"migrate.items.wiki": "الموسوعة",
+	"migrate.items.milestones": "أهداف",
+	"migrate.items.labels": "تصنيفات",
+	"migrate.items.issues": "البلاغات",
+	"migrate.items.pull_requests": "طلبات السحب",
+	"migrate.items.merge_requests": "طلبات الدمج",
+	"migrate.items.releases": "الإصدارات",
+	"migrate.in_progress.git": "ترحيل بيانات Git",
+	"migrate.in_progress.topics": "ترحيل المواضيع",
+	"migrate.in_progress.milestones": "ترحيل الأهداف",
+	"migrate.in_progress.labels": "ترحيل الوسوم",
+	"migrate.in_progress.releases": "ترحيل الإصدارات",
+	"migrate.in_progress.issues": "ترحيل البلاغات",
+	"migrate.in_progress.pulls": "ترحيل طلبات السحب",
+	"migrate.cancel.title": "إلغاء الترحيل",
+	"migrate.cancel.confirmation": "تريد إلغاء عملية الترحيل هذه؟",
 	"user.ghost.tooltip": "تم حذف هذا المستخدم أو لا يمكن مطابقته.",
 	"migrate.form.error.url_credentials": "يحتوي عنوان الرابط على بيانات اعتماد، ضعها في حقلي اسم المستخدم وكلمة المرور على التوالي",
 	"pulse.n_active_issues": {
diff --git a/options/locale_next/locale_bg.json b/options/locale_next/locale_bg.json
index 2525e1c239..9b833c070d 100644
--- a/options/locale_next/locale_bg.json
+++ b/options/locale_next/locale_bg.json
@@ -1,4 +1,50 @@
 {
+	"admin.monitor.queue.type": "Тип",
+	"admin.monitor.queue": "Опашка: %s",
+	"admin.monitor.queues": "Опашки",
+	"markup.filepreview.lines": "Редове от %[1]d до %[2]d в %[3]s",
+	"markup.filepreview.line": "Ред %[1]d в %[2]s",
+	"actions.variables.update.success": "Променливата е редактирана.",
+	"actions.variables.update.failed": "Неуспешно редактиране на променлива.",
+	"actions.variables.creation.success": "Променливата „%s“ е добавена.",
+	"actions.variables.creation.failed": "Неуспешно добавяне на променлива.",
+	"actions.variables.deletion.success": "Променливата е премахната.",
+	"actions.variables.deletion.failed": "Неуспешно премахване на променлива.",
+	"actions.variables.not_found": "Променливата не е открита.",
+	"actions.variables.edit": "Редактиране на променливата",
+	"actions.variables.deletion": "Премахване на променливата",
+	"actions.variables.none": "Все още няма променливи.",
+	"actions.variables.creation": "Добавяне на променлива",
+	"actions.variables.management": "Управление на променливи",
+	"actions.variables": "Променливи",
+	"webauthn.error.timeout": "Времето за изчакване изтече преди ключът ви да бъде прочетен. Моля, презаредете страницата и опитайте отново.",
+	"webauthn.error.empty": "Трябва да зададете име за този ключ.",
+	"webauthn.error.duplicated": "Ключът за сигурност не е разрешен за тази заявка. Моля, уверете се, че ключът не е вече регистриран.",
+	"webauthn.error.unable_to_process": "Сървърът не можа да обработи заявката ви.",
+	"webauthn.error.insecure": "WebAuthn поддържа само сигурни връзки. За тестване през HTTP можете да използвате произход „localhost“ или „127.0.0.1“",
+	"webauthn.error.unknown": "Възникна неизвестна грешка. Моля, опитайте отново.",
+	"webauthn.unsupported_browser": "Вашият браузър в момента не поддържа WebAuthn.",
+	"webauthn.error": "Неуспешно прочитане на вашия ключ за сигурност.",
+	"webauthn.use_twofa": "Използвайте двуфакторен код от телефона си",
+	"webauthn.press_button": "Моля, натиснете бутона на вашия ключ за сигурност…",
+	"webauthn.sign_in": "Натиснете бутона на вашия ключ за сигурност. Ако ключът ви за сигурност няма бутон, поставете го отново.",
+	"webauthn.insert_key": "Поставете вашия ключ за сигурност",
+	"counters.n_commits": {
+		"one": "%s подаване",
+		"other": "%s подавания"
+	},
+	"counters.n_branches": {
+		"one": "%s клон",
+		"other": "%s клона"
+	},
+	"counters.n_tags": {
+		"one": "%s маркер",
+		"other": "%s маркера"
+	},
+	"counters.n_releases": {
+		"one": "%s издание",
+		"other": "%s издания"
+	},
 	"actions.actions": "Действия",
 	"actions.status.unknown": "Неизвестно",
 	"actions.status.waiting": "Изчаква се",
@@ -283,6 +329,23 @@
 	"migrate.gitbucket.description": "Мигриране на данни от GitBucket инстанции.",
 	"migrate.codebase.description": "Мигриране на данни от codebasehq.com.",
 	"migrate.forgejo.description": "Мигриране на данни от codeberg.org или други Forgejo инстанции.",
+	"migrate.items.label": "Елементи за мигриране",
+	"migrate.items.wiki": "Уики",
+	"migrate.items.milestones": "Етапи",
+	"migrate.items.labels": "Етикети",
+	"migrate.items.issues": "Задачи",
+	"migrate.items.pull_requests": "Заявки за сливане",
+	"migrate.items.merge_requests": "Заявки за сливане",
+	"migrate.items.releases": "Издания",
+	"migrate.in_progress.git": "Мигриране на Git данни",
+	"migrate.in_progress.topics": "Мигриране на теми",
+	"migrate.in_progress.milestones": "Мигриране на етапи",
+	"migrate.in_progress.labels": "Мигриране на етикети",
+	"migrate.in_progress.releases": "Мигриране на издания",
+	"migrate.in_progress.issues": "Мигриране на задачи",
+	"migrate.in_progress.pulls": "Мигриране на заявки за сливане",
+	"migrate.cancel.title": "Отказ от миграцията",
+	"migrate.cancel.confirmation": "Искате ли да откажете тази миграция?",
 	"keys.ssh.link": "SSH ключове",
 	"feed.atom.link": "Atom емисия",
 	"keys.gpg.link": "GPG ключове",
@@ -391,11 +454,8 @@
 	"avatar.constraints_hint": "Персонализираната профилна снимка не трябва да надвишава размер от %[1]s или да бъде по-голяма от %[2]dx%[3]d пиксела",
 	"user.ghost.tooltip": "Този потребител е изтрит или не може да бъде съпоставен.",
 	"og.repo.summary_card.alt_description": "Карта с обобщение на хранилище %[1]s, описано като: %[2]s",
-	"actions.runners.list_runners.details_column": "Подробности",
 	"actions.runners.list_runners.edit_column": "Редактиране",
 	"actions.runners.list_runners.delete_column": "Изтриване",
-	"actions.runners.list_runners.details_button": "Подробности",
-	"actions.runners.list_runners.details_button_aria": "Показване на подробности за %s",
 	"actions.runners.list_runners.delete_button": "Изтриване",
 	"actions.runners.list_runners.delete_button_aria": "Изтриване на %s",
 	"actions.runners.list_runners.edit_button": "Редактиране",
diff --git a/options/locale_next/locale_ca.json b/options/locale_next/locale_ca.json
index a09f89cb61..95db3f2943 100644
--- a/options/locale_next/locale_ca.json
+++ b/options/locale_next/locale_ca.json
@@ -1,4 +1,93 @@
 {
+	"admin.monitor.queue.type": "Tipus",
+	"admin.monitor.queue.name": "Nom",
+	"admin.users.list_status_filter.not_2fa_enabled": "A2F desactivada",
+	"admin.users.list_status_filter.is_2fa_enabled": "A2F activada",
+	"admin.users.list_status_filter.not_prohibit_login": "Inici de sessió permès",
+	"admin.users.list_status_filter.is_prohibit_login": "Inici de sessió prohibit",
+	"admin.users.list_status_filter.not_restricted": "No restringit",
+	"admin.users.list_status_filter.is_restricted": "Restringit",
+	"admin.users.list_status_filter.not_admin": "No administrador",
+	"admin.users.list_status_filter.is_admin": "Administrador",
+	"admin.users.list_status_filter.not_active": "Inactiu",
+	"admin.users.list_status_filter.is_active": "Actiu",
+	"admin.users.list_status_filter.reset": "Restaurar",
+	"admin.users.list_status_filter.menu_text": "Filtrar",
+	"admin.system_status.last_gc_pause": "Darrera pausa de GC",
+	"admin.system_status.total_gc_pause": "Pausa total de GC",
+	"admin.system_status.last_gc_time": "Temps des del darrer GC",
+	"admin.system_status.next_gc_recycle": "Proper cicle de GC",
+	"admin.system_status.gc_metadata_obtained": "Metadades del GC rebudes",
+	"admin.system_status.mcache_structures_obtained": "Estructures MCache rebudes",
+	"admin.system_status.mcache_structures_usage": "Ús de les estructures MCache",
+	"admin.system_status.mspan_structures_obtained": "Estructures MSpan rebudes",
+	"admin.system_status.mspan_structures_usage": "Ús de les estructures MSpan",
+	"admin.system_status.stack_memory_obtained": "Memòria de la pila (stack) rebuda",
+	"admin.system_status.bootstrap_stack_usage": "Ús de l'arrancada de la pila (stack)",
+	"admin.system_status.heap_objects": "Objectes del heap",
+	"admin.system_status.heap_memory_released": "Memòria del heap alliberada",
+	"admin.system_status.heap_memory_in_use": "Memòria del heap en ús",
+	"admin.system_status.heap_memory_idle": "Memòria del heap en repòs",
+	"admin.system_status.heap_memory_obtained": "Memòria de heap rebuda",
+	"admin.system_status.current_heap_usage": "Ús del heap actual",
+	"admin.system_status.memory_free_times": "Alliberaments de memòria",
+	"admin.system_status.memory_allocate_times": "Assignacions de memòria",
+	"admin.system_status.pointer_lookup_times": "Temps de consulta dels punters",
+	"admin.system_status.memory_obtained": "Memòria rebuda",
+	"admin.system_status.total_memory_allocated": "Total de memòria adjudicada",
+	"admin.system_status.current_memory_usage": "Ús de memòria actual",
+	"admin.system_status.current_goroutine": "Goroutines actuals",
+	"admin.system_status.server_uptime": "Temps de funcionament del servidor",
+	"markup.filepreview.truncated": "La vista prèvia s'ha truncat",
+	"markup.filepreview.lines": "Línies %[1]d a %[2]d en %[3]s",
+	"markup.filepreview.line": "Línia %[1]d a %[2]s",
+	"actions.variables.update.success": "S'ha editat la variable.",
+	"actions.variables.update.failed": "No s'ha pogut editar la variable.",
+	"actions.variables.creation.success": "S'ha afegit la variable \"%s\".",
+	"actions.variables.creation.failed": "No s'ha pogut afegir la variable.",
+	"actions.variables.deletion.success": "S'ha canviar el nom de la variable.",
+	"actions.variables.deletion.failed": "No s'ha pogut eliminar la variable.",
+	"actions.variables.not_found": "No s'ha trobat la variable.",
+	"actions.variables.edit": "Editar variable",
+	"actions.variables.description": "Les variables es passaran a certes accions i no es poden llegir altrament.",
+	"actions.variables.deletion.description": "Eliminar una variable és permanent i no es pot desfer. Continua?",
+	"actions.variables.deletion": "Eliminar variable",
+	"actions.variables.none": "Encara no hi ha variables.",
+	"actions.variables.creation": "Afegir variables",
+	"actions.variables.management": "Gestionar variables",
+	"actions.variables": "Variables",
+	"webauthn.error.timeout": "Temps d'espera finalitzar abans que la seva clau pogués ser llegida. Siusplau recarregueu la pàgina i torneu-ho a intentar.",
+	"webauthn.error.empty": "S'ha d'anomenar aquesta clau.",
+	"webauthn.error.duplicated": "La clau de seguretat no és permesa per aquesta sol·licitud. Si us plau, assegureu-vos que la clau encara no ha estat registrada.",
+	"webauthn.error.unable_to_process": "El servidor no ha pogut processar la vostra sol·licitud.",
+	"webauthn.error.insecure": "WebAuthn només suporta connexions segures. Per provar sobre HTTP, podeu utilitzar l'origen \"localhost\" o \"127.0.0.1\"",
+	"webauthn.error.unknown": "Hi ha hagut un error desconegut. Si us plau torneu-ho a intentar.",
+	"webauthn.unsupported_browser": "El teu navegador no suprta WebAuthn.",
+	"webauthn.error": "No s'ha pogut llegir la clau de seguretat.",
+	"webauthn.use_twofa": "Utilitza un codi de doble factor des del teu mòbil",
+	"webauthn.press_button": "Si us plau, premeu el botó a la vostra clau de seguretat…",
+	"webauthn.sign_in": "Premeu el botó a la vostra clau de seguretat. Si no en té, torneu-la a inserir.",
+	"webauthn.insert_key": "Inseriu la vostra clau de seguretat",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"many": "%s commits",
+		"other": ""
+	},
+	"counters.n_branches": {
+		"one": "Branca %s",
+		"many": "Branques %s",
+		"other": ""
+	},
+	"counters.n_tags": {
+		"one": "Etiqueta %s",
+		"many": "Etiquetes %s",
+		"other": ""
+	},
+	"counters.n_releases": {
+		"one": "Publicació %s",
+		"many": "Publicacions %s",
+		"other": ""
+	},
 	"fork.n_forks": {
 		"one": "%s fork",
 		"many": "%s forks",
@@ -65,6 +154,23 @@
 	"migrate.gitbucket.description": "Migrar dades d'instàncies de GitBucket.",
 	"migrate.codebase.description": "Migrar dades de codebasehq.com.",
 	"migrate.forgejo.description": "Migrar dades de codeberg.org o d'altres instàncies de Forgejo.",
+	"migrate.items.label": "Elements de migració",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Fites",
+	"migrate.items.labels": "Etiquetes",
+	"migrate.items.issues": "Problemes",
+	"migrate.items.pull_requests": "Pull requests",
+	"migrate.items.merge_requests": "Sol·licituds de fusió",
+	"migrate.items.releases": "Publicacions",
+	"migrate.in_progress.git": "Migrant dades Git",
+	"migrate.in_progress.topics": "Migrant tòpics",
+	"migrate.in_progress.milestones": "Migrant fites",
+	"migrate.in_progress.labels": "Migrant etiquetes",
+	"migrate.in_progress.releases": "Migrant publicacions",
+	"migrate.in_progress.issues": "Migrant problemes",
+	"migrate.in_progress.pulls": "Migrant «pull requests»",
+	"migrate.cancel.title": "Cancel·la la migració",
+	"migrate.cancel.confirmation": "Voleu cancel·lar aquesta migració?",
 	"repo.issue_indexer.title": "Indexador d'incidències",
 	"repo.settings.push_mirror.branch_filter.label": "Filtre de branca (opcional)",
 	"incorrect_root_url": "Aquesta instància de Forejo està configurada per ser servida a \"%s\". Actualment esteu veient Forgejo des d'una URL diferent, la qual cosa pot provocar que algunes parts de l'aplicació no funcionin correctament. Els administradors de Forgejo controlen l'URL canònica mitjançant el paràmetre ROOT_URL a app.ini.",
@@ -303,10 +409,46 @@
 	"packages.requirements": "Requisits",
 	"packages.dependencies": "Dependències",
 	"packages.keywords": "Paraules clau",
+	"migrate.select.title": "Migra el repositori",
 	"install.ssh_authorized_keys_unexpected_key": "Activar l'SSH a Forgejo entra en conflicte amb el fitxer localitzat a %s que ja conté claus SSH. Consell: useu un usuari de sistema dedicat per a Forgejo, o bé desactiveu l'SSH.",
+	"admin.federation.federation": "Federació",
+	"admin.federation.hosts": "Amfitrions",
+	"admin.federation.hosts.title": "Amfitrions de federació",
+	"admin.federation.hosts.manage_panel": "Gestiona els amfitrions de la federació",
+	"admin.federation.hosts.details_panel": "Detalls de l'amfitrió de la federació",
+	"admin.federation.hosts.show_details": "Mostra els detalls de l'amfitrió",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Esquema",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.software_name": "Programari",
+	"admin.federation.host.created": "Creat",
+	"admin.federation.host.updated": "Actualitzat",
+	"admin.federation.host.latest_activity": "Darrera activitat",
+	"admin.federation.users": "Usuaris",
+	"admin.federation.users.title": "Usuaris federats",
+	"admin.federation.users.manage_panel": "Gestiona usuaris federats",
+	"admin.federation.users.show_local_user": "Mostra detalls de l'usuari local",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID de l'usuari local",
+	"admin.federation.user.external_id": "ID de l'usuari extern",
+	"admin.federation.user.inbox_path": "Camí de la safata d'entrada",
+	"admin.config.federation": "Configuració de la federació",
+	"admin.config.federation.enabled": "Actiu",
+	"admin.config.federation.share_user_statistics": "Comparteix les estadístiques d'usuari amb altres amfitrions",
+	"admin.config.federation.max_size": "Mida màxima de resposta permesa",
+	"admin.config.federation.signature_enforced": "Requereix signatures HTTP",
+	"admin.config.federation.signature_algorithms": "Algoritmes de signatura",
+	"admin.config.federation.get_headers": "Capçaleres GET signades",
+	"admin.config.federation.post_headers": "Capçaleres POST signades",
 	"moderation.users.cannot_suspend_self": "No podeu suspendre-us.",
 	"settings.new_access_token": "Nou testimoni d'accés",
 	"settings.permissions_access_specific_repositories": "Repositoris específics",
+	"settings.access_token.selected_repositories": {
+		"one": "Repositori seleccionat (%d)",
+		"many": "Repositoris seleccionats (%d)",
+		"other": "Repositoris seleccionats (%d)"
+	},
 	"settings.access_token.available_repositories": "Repositoris disponibles",
 	"settings.access_token.no_repositories_selected": "No s'ha seleccionat cap repositori.",
 	"settings.access_token.no_repositories_found": "No s'ha trobat cap repositori.",
@@ -315,6 +457,9 @@
 	"settings.access_token.resource_public_only_help": "Limita l'accés als repositoris i organitzacions públics.",
 	"settings.access_token.resource_specific_repo_help": "Limita l'accés a una llista específica de repositoris. L'accés de només-lectura es permet a tots els repositoris públics. Només es poden habilitar els permisos que permeten l'accés a repositoris i incidències.",
 	"settings.access_token.admin_disabled": "Els permisos d'administració estan deshabilitats.",
+	"user.activitypub_feed.no_activity": "Sense activitat al fedivers",
+	"user.activitypub_feed.posted_on": "Publicat a %[1]s",
+	"user.activitypub_feed.original_source": "Font original",
 	"gpg.error.probable_bad_default_signature": "COMPTE! Malgrat la clau per defecte té aquesta ID, no verifica aquest commit! Aquest commit és SOSPITÓS.",
 	"notification.notifications": "Notificacions",
 	"notification.unread": "Sense llegir",
@@ -360,26 +505,19 @@
 	"packages.generic.download": "Baixeu el paquet des de la línia de comandes:",
 	"packages.go.install": "Instal·leu el paquet des de la línia de comandes:",
 	"admin.dashboard.actions_action_user": "Anul·la la confiança del Forgejo Actions als usuaris inactius",
+	"user.activitypub_feed.feed": "Fil del Fedivers",
+	"user.activitypub_feed.is_empty": "El vostre fil del fedivers és buit.",
+	"user.activitypub_feed.hint": "Aquest fil mostra activitats dels comptes del fedivers que seguiu, així com publicacions federades que us mencionen.",
 	"packages.alpine.registry": "Configureu aquest registre afegint l'URL en el vostre fitxer <code>/etc/apk/repositories</code>:",
 	"packages.alpine.registry.key": "Baixeu la clau pública RSA del registre al directori <code>/etc/apk/keys/</code> per verificar la signatura d'índex:",
 	"packages.arch.pacman.conf": "Afegiu el servidor amb la distribució i arquitectura relacionades a <code>/etc/pacman.conf</code> :",
-	"packages.cargo.registry": "Configureu aquest registre en el fitxer de configuració de Cargo (per exemple <code>~/.cargo/config.toml</code>):",
-	"packages.cargo.install": "Per instal·lar el paquet amb Cargo, executeu la comanda:",
-	"packages.chef.registry": "Configureu aquest registre en el vostre fitxer <code>~/.chef/config.rb</code>:",
-	"packages.composer.registry": "Configureu aquest registre en el vostre fitxer <code>~/.composer/config.json</code>:",
-	"packages.composer.install": "Per instal·lar el paquet amb Composer, executeu la comanda:",
 	"packages.composer.dependencies.development": "Dependències de desenvolupament",
 	"packages.conan.install": "Per instal·lar el paquet mitjançant Conan, executeu la següent comanda:",
-	"packages.conda.registry": "Configureu aquest registre com a un repositori Conda en el vostre fitxer <code>.condarc</code>:",
 	"packages.conda.install": "Per instal·lar el paquet mitjançant Conda, executeu la següent comanda:",
 	"packages.container.layers": "Capes d'imatge",
-	"packages.cran.registry": "Configureu aquest registre en el vostre fitxer <code>Rprofile.site</code>:",
-	"packages.maven.registry": "Configureu aquest registre en el fitxer <code>pom.xml</code> del vostre projecte:",
-	"packages.maven.install": "Per usar el paquet afegiu el següent en el bloc <code>dependencies</code> del fitxer <code>pom.xml</code>:",
 	"packages.maven.install2": "Executeu amb la línia de comandes:",
 	"packages.maven.download": "Per baixar la dependència, executeu amb la línia de comandes:",
 	"packages.nuget.install": "Per instal·lar el paquet mitjançant NuGet, executeu la següent comanda:",
-	"packages.npm.registry": "Configureu aquest registre en el fitxer <code>.npmrc</code> del vostre projecte:",
 	"packages.npm.install": "Per instal·lar el paquet mitjançant npm, executeu la següent comanda:",
 	"packages.npm.install2": "o afegiu-lo al fitxer package.json:",
 	"packages.npm.dependencies.development": "Dependències de desenvolupament",
@@ -400,9 +538,6 @@
 	"packages.rubygems.dependencies.development": "Dependències de desenvolupament",
 	"packages.rubygems.required.ruby": "Requereix la versió de Ruby",
 	"packages.rubygems.required.rubygems": "Requereix la versió de RubyGem",
-	"packages.swift.install": "Afegiu el paquet en el vostre fitxer <code>Package.swift</code>:",
-	"packages.swift.install2": "i executeu la comanda:",
-	"packages.vagrant.install": "Per afegir una caixa Vagrant, executeu la comanda:",
 	"packages.settings.link": "Enllaça aquest paquet a un repositori",
 	"packages.settings.link.description": "Si enllaceu un paquet amb un repositori, el paquet s'enllistarà al llistat de paquets del repositori.",
 	"packages.settings.link.select": "Selecciona un repositori",
@@ -414,13 +549,30 @@
 	"packages.settings.delete.notice": "Esteu a punt d'eliminar %s (%s). Aquesta operació no es pot desfer, n'esteu segurs?",
 	"packages.settings.delete.success": "S'ha eliminat el paquet.",
 	"packages.settings.delete.error": "No s'ha pogut eliminar el paquet.",
-	"packages.owner.settings.cargo.title": "Índex de registre de Cargo",
 	"packages.owner.settings.cargo.initialize": "Inicialitza l'índex",
 	"packages.owner.settings.cargo.initialize.description": "Cal un repositori Git d'índex especial per usar el registre del Cargo. Usar aquesta opció (re)crearà el repositori i el configurarà automàticament.",
 	"packages.owner.settings.cargo.initialize.error": "No s'ha pogut inicialitzar l'índex del Cargo: %v",
 	"packages.owner.settings.cargo.initialize.success": "S'ha creat l'índex del Cargo satisfactòriament.",
 	"packages.owner.settings.cargo.rebuild": "Recrea l'índex",
 	"packages.owner.settings.cargo.rebuild.description": "Recrear pot ser útil si l'índex no està sincronitzat amb els paquets Cargo desats.",
+	"repo.files.caption": "Fitxers del repositori (darrer commit primer)",
+	"repo.files.filename": "Nom del fitxer",
+	"repo.files.last_commit_message": "Missatge del darrer commit",
+	"repo.files.last_commit_date": "Data del darrer commit",
+	"packages.cargo.registry": "Configureu aquest registre en el fitxer de configuració de Cargo (per exemple <code>~/.cargo/config.toml</code>):",
+	"packages.cargo.install": "Per instal·lar el paquet amb Cargo, executeu la comanda:",
+	"packages.chef.registry": "Configureu aquest registre en el vostre fitxer <code>~/.chef/config.rb</code>:",
+	"packages.composer.registry": "Configureu aquest registre en el vostre fitxer <code>~/.composer/config.json</code>:",
+	"packages.composer.install": "Per instal·lar el paquet amb Composer, executeu la comanda:",
+	"packages.conda.registry": "Configureu aquest registre com a un repositori Conda en el vostre fitxer <code>.condarc</code>:",
+	"packages.cran.registry": "Configureu aquest registre en el vostre fitxer <code>Rprofile.site</code>:",
+	"packages.maven.registry": "Configureu aquest registre en el fitxer <code>pom.xml</code> del vostre projecte:",
+	"packages.maven.install": "Per usar el paquet afegiu el següent en el bloc <code>dependencies</code> del fitxer <code>pom.xml</code>:",
+	"packages.npm.registry": "Configureu aquest registre en el fitxer <code>.npmrc</code> del vostre projecte:",
+	"packages.swift.install": "Afegiu el paquet en el vostre fitxer <code>Package.swift</code>:",
+	"packages.swift.install2": "i executeu la comanda:",
+	"packages.vagrant.install": "Per afegir una caixa Vagrant, executeu la comanda:",
+	"packages.owner.settings.cargo.title": "Índex de registre de Cargo",
 	"packages.owner.settings.cargo.rebuild.error": "No s'ha pogut reconstruir l'índex de Cargo: %v",
 	"packages.owner.settings.cargo.rebuild.success": "S'ha reconstruït l'índex de Cargo satisfactòriament.",
 	"packages.owner.settings.cargo.rebuild.no_index": "No es pot reconstruir, no s'ha inicialitzat l'índex.",
@@ -432,10 +584,10 @@
 	"packages.owner.settings.cleanuprules.preview.overview": "%d paquets programats per eliminar.",
 	"packages.owner.settings.cleanuprules.preview.none": "La norma de neteja no coincideix amb cap paquet.",
 	"packages.owner.settings.cleanuprules.pattern_full_match": "Aplica el patró al nom sencer del paquet",
-	"packages.owner.settings.cleanuprules.keep.title": "Les versions que coincideixen amb aquestes normes es mantenen, malgrat coincideixin amb una norma d'eliminació més avall.",
 	"packages.owner.settings.cleanuprules.keep.count": "Manté el més recent",
 	"packages.owner.settings.cleanuprules.keep.pattern": "Manté les versions coincidents",
 	"packages.owner.settings.cleanuprules.keep.pattern.container": "La versió <code>latest</code> sempre es manté per paquets Container.",
+	"packages.owner.settings.cleanuprules.keep.title": "Les versions que coincideixen amb aquestes normes es mantenen, malgrat coincideixin amb una norma d'eliminació més avall.",
 	"packages.owner.settings.cleanuprules.remove.title": "Les versions que coincideixen amb aquestes normes s'eliminaran, a no ser que una norma més amunt la mantingui.",
 	"packages.owner.settings.cleanuprules.remove.days": "Elimina versions més antigues que",
 	"packages.owner.settings.cleanuprules.remove.pattern": "Elimina versions coincidents",
diff --git a/options/locale_next/locale_cs-CZ.json b/options/locale_next/locale_cs-CZ.json
index 36e727bb7e..c62f8c5cc8 100644
--- a/options/locale_next/locale_cs-CZ.json
+++ b/options/locale_next/locale_cs-CZ.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Všechny položky ve frontě byly odstraněny.",
+	"admin.monitor.queue.settings.remove_all_items": "Odstranit vše",
+	"admin.monitor.queue.settings.changed": "Nastavení upravena",
+	"admin.monitor.queue.settings.submit": "Upravit nastavení",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Maximální počet workerů musí být číslo",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "V současné době %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Maximální počet workerů",
+	"admin.monitor.queue.settings.description": "Pooly dynamicky rostou podle blokování fronty jejich workerů.",
+	"admin.monitor.queue.settings.title": "Nastavení poolu",
+	"admin.monitor.queue.review_add": "Posoudit / přidat workery",
+	"admin.monitor.queue.numberinqueue": "Číslo ve frontě",
+	"admin.monitor.queue.maxnumberworkers": "Maximální počet workerů",
+	"admin.monitor.queue.activeworkers": "Aktivní workery",
+	"admin.monitor.queue.numberworkers": "Počet workerů",
+	"admin.monitor.queue.exemplar": "Typ vzoru",
+	"admin.monitor.queue.type": "Typ",
+	"admin.monitor.queue.name": "Název",
+	"admin.monitor.queue": "Fronta: %s",
+	"admin.monitor.queues": "Fronty",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA zakázáno",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA povoleno",
+	"admin.users.list_status_filter.not_prohibit_login": "Povolit přihlášení",
+	"admin.users.list_status_filter.is_prohibit_login": "Zakázat přihlášení",
+	"admin.users.list_status_filter.not_restricted": "Není omezen",
+	"admin.users.list_status_filter.is_restricted": "Omezeno",
+	"admin.users.list_status_filter.not_admin": "Není administrátor",
+	"admin.users.list_status_filter.is_admin": "Administrátor",
+	"admin.users.list_status_filter.not_active": "Neaktivní",
+	"admin.users.list_status_filter.is_active": "Aktivní",
+	"admin.users.list_status_filter.reset": "Obnovit",
+	"admin.users.list_status_filter.menu_text": "Filtr",
+	"admin.system_status.gc_times": "Časy GC",
+	"admin.system_status.last_gc_pause": "Poslední pauza GC",
+	"admin.system_status.total_gc_pause": "Celková pauza GC",
+	"admin.system_status.last_gc_time": "Doba od posledního GC",
+	"admin.system_status.next_gc_recycle": "Příští recyklace GC",
+	"admin.system_status.other_system_allocation_obtained": "Získaná alokace ostatních systémových prostředků",
+	"admin.system_status.gc_metadata_obtained": "Získaná metadata GC",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Získaná profilovací bucket hash tabulka",
+	"admin.system_status.mcache_structures_obtained": "Získané struktury MCache",
+	"admin.system_status.mcache_structures_usage": "Využití struktur MCache",
+	"admin.system_status.mspan_structures_obtained": "Získané struktury MSpan",
+	"admin.system_status.mspan_structures_usage": "Užití struktur MSpan",
+	"admin.system_status.stack_memory_obtained": "Celková získaná pamět zásobníku",
+	"admin.system_status.bootstrap_stack_usage": "Využití zásobníku prvotního zavedení",
+	"admin.system_status.heap_objects": "Objekty zásobníku",
+	"admin.system_status.heap_memory_released": "Uvolněná paměť zásobníku",
+	"admin.system_status.heap_memory_in_use": "Používaná paměť zásobníku",
+	"admin.system_status.heap_memory_idle": "Nečinná paměť zásobníku",
+	"admin.system_status.heap_memory_obtained": "Získaná paměť zásobníku",
+	"admin.system_status.current_heap_usage": "Aktuální využití paměti zásobníku",
+	"admin.system_status.memory_free_times": "Uvolnění paměti",
+	"admin.system_status.memory_allocate_times": "Alokace paměti",
+	"admin.system_status.pointer_lookup_times": "Časy vyhledávání ukazatelů",
+	"admin.system_status.memory_obtained": "Získaná paměť",
+	"admin.system_status.total_memory_allocated": "Celková přidělená paměť",
+	"admin.system_status.current_memory_usage": "Aktuální využití paměti",
+	"admin.system_status.current_goroutine": "Aktuální goroutines",
+	"admin.system_status.server_uptime": "Doba provozu serveru",
+	"markup.filepreview.truncated": "Náhled byl zkrácen",
+	"markup.filepreview.lines": "Řádky %[1]d až %[2]d v souboru %[3]s",
+	"markup.filepreview.line": "Řádek %[1]d v souboru %[2]s",
+	"actions.variables.update.success": "Proměnná byla upravena.",
+	"actions.variables.update.failed": "Úprava proměnné se nezdařila.",
+	"actions.variables.creation.success": "Proměnná „%s“ byla přidána.",
+	"actions.variables.creation.failed": "Přidání proměnné se nezdařilo.",
+	"actions.variables.deletion.success": "Proměnná byla odstraněna.",
+	"actions.variables.deletion.failed": "Nepodařilo se odstranit proměnnou.",
+	"actions.variables.not_found": "Nepodařilo se najít proměnnou.",
+	"actions.variables.edit": "Upravit proměnnou",
+	"actions.variables.description": "Proměnné budou předány určitým akcím a nelze je přečíst jinak.",
+	"actions.variables.deletion.description": "Odstranění proměnné je trvalé a nelze jej vrátit zpět. Pokračovat?",
+	"actions.variables.deletion": "Odstranit proměnnou",
+	"actions.variables.none": "Zatím zde nejsou žádné proměnné.",
+	"actions.variables.creation": "Přidat proměnnou",
+	"actions.variables.management": "Správa proměnných",
+	"actions.variables": "Proměnné",
+	"webauthn.error.timeout": "Požadavek vypršel dříve, než se podařilo přečíst váš klíč. Znovu načtěte tuto stránku a akci opakujte.",
+	"webauthn.error.empty": "Musíte nastavit název tohoto klíče.",
+	"webauthn.error.duplicated": "Bezpečnostní klíč není pro tento požadavek povolen. Ujistěte se prosím, zda klíč již není registrován.",
+	"webauthn.error.unable_to_process": "Server nemohl zpracovat váš požadavek.",
+	"webauthn.error.insecure": "WebAuthn podporuje pouze zabezpečená připojení. Pro testování přes HTTP můžete použít výchozí „localhost“ nebo „127.0.0.1“",
+	"webauthn.error.unknown": "Došlo k neznámé chybě. Opakujte akci.",
+	"webauthn.unsupported_browser": "Váš prohlížeč momentálně nepodporuje WebAuthn.",
+	"webauthn.error": "Nepodařilo se přečíst váš bezpečnostní klíč.",
+	"webauthn.use_twofa": "Použít dvoufaktorový kód z vašeho telefonu",
+	"webauthn.press_button": "Stiskněte tlačítko na bezpečnostním klíči…",
+	"webauthn.sign_in": "Stiskněte tlačítko na svém bezpečnostním klíči. Pokud bezpečnostní klíč nemá žádné tlačítko, vložte jej znovu.",
+	"webauthn.insert_key": "Vložte svůj bezpečnostní klíč",
+	"counters.n_commits": {
+		"one": "%s revize",
+		"few": "%s revize",
+		"other": "%s revizí"
+	},
+	"counters.n_branches": {
+		"one": "%s větev",
+		"few": "%s větve",
+		"other": "%s větví"
+	},
+	"counters.n_tags": {
+		"one": "%s značka",
+		"few": "%s značky",
+		"other": "%s značek"
+	},
+	"counters.n_releases": {
+		"one": "%s vydání",
+		"few": "%s vydání",
+		"other": "%s vydání"
+	},
 	"gpg.default_key": "Podepsáno výchozím klíčem",
 	"gpg.error.extract_sign": "Nepodařilo se získat podpis",
 	"gpg.error.generate_hash": "Nepodařilo se vygenerovat hash revize",
@@ -334,6 +443,23 @@
 	"migrate.gitbucket.description": "Migrovat data z instancí GitBucket.",
 	"migrate.codebase.description": "Migrovat data z codebasehq.com.",
 	"migrate.forgejo.description": "Migrovat data z codeberg.org nebo jiných instancí Forgejo.",
+	"migrate.items.label": "Položky pro migrování",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Milníky",
+	"migrate.items.labels": "Štítky",
+	"migrate.items.issues": "Problémy",
+	"migrate.items.pull_requests": "Žádosti o sloučení",
+	"migrate.items.merge_requests": "Žádosti o sloučení",
+	"migrate.items.releases": "Vydání",
+	"migrate.in_progress.git": "Migrace dat z Gitu",
+	"migrate.in_progress.topics": "Migrace témat",
+	"migrate.in_progress.milestones": "Migrace milníků",
+	"migrate.in_progress.labels": "Migrace štítků",
+	"migrate.in_progress.releases": "Migrace vydání",
+	"migrate.in_progress.issues": "Migrace problémů",
+	"migrate.in_progress.pulls": "Migrace žádostí o sloučení",
+	"migrate.cancel.title": "Zrušit migraci",
+	"migrate.cancel.confirmation": "Chcete zrušit tuto migraci?",
 	"admin.config.security": "Nastavení zabezpečení",
 	"admin.config.global_2fa_requirement.title": "Globální požadavek dvoufázového ověření",
 	"error.must_enable_2fa": "Tato instance Forgejo vyžaduje, aby si všichni uživatelé zapnuli dvoufázové ověření, než začnou používat svůj účet. Povolíte jej zde: %s",
@@ -523,11 +649,8 @@
 	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "Token",
 	"actions.runners.ephemeral": "Dočasný",
-	"actions.runners.list_runners.details_column": "Podrobnosti",
 	"actions.runners.list_runners.edit_column": "Upravit",
 	"actions.runners.list_runners.delete_column": "Odstranit",
-	"actions.runners.list_runners.details_button": "Podrobnosti",
-	"actions.runners.list_runners.details_button_aria": "Zobrazit podrobnosti %s",
 	"actions.runners.list_runners.delete_button": "Odstranit",
 	"actions.runners.list_runners.delete_button_aria": "Odstranit %s",
 	"actions.runners.list_runners.edit_button": "Upravit",
@@ -583,6 +706,11 @@
 	"actions.secrets.mutation.name_description": "Název tajného klíče může obsahovat pouze písmena, číslice a podtržítka. Nemůže začínat textem FORGEJO_, GITEA_, GITHUB_ nebo číslem. Forgejo jej automaticky převede na velká písmena.",
 	"actions.secrets.mutation.value_description": "Existující hodnota nebude zobrazena. Ponechte pole prázdné, pokud jej nechcete upravit. Zvláštní znaky zůstanou zachovány. CRLF (zakončení řádků ve stylu Windows) budou automaticky převedeny na LF. Pokud chcete zachovat zakončení řádků, zakódujte hodnotu pomocí Base64.",
 	"settings.permissions_access_specific_repositories": "Konkrétní repozitáře",
+	"settings.access_token.selected_repositories": {
+		"one": "Vybrán repozitář (%d)",
+		"few": "Vybrány repozitáře (%d)",
+		"other": "Vybrány repozitáře (%d)"
+	},
 	"settings.access_token.available_repositories": "Dostupné repozitáře",
 	"settings.access_token.no_repositories_selected": "Nejsou vybrány žádné repozitáře.",
 	"settings.access_token.no_repositories_found": "Nenalezeny žádné repozitáře.",
@@ -594,8 +722,54 @@
 	"actions.runs.scheduled_description": "Naplánovaný běh revize <a href=\"%[1]s\">%[2]s</a>",
 	"actions.runs.workflow_dispatch_description": "Běh revize <a href=\"%[1]s\">%[2]s</a> spuštěný službou <a href=\"%[3]s\">%[4]s</a>",
 	"actions.runs.on_push_description": "Revize <a href=\"%[1]s\">%[2]s</a> odeslaná uživatelem <a href=\"%[3]s\">%[4]s</a>",
+	"members.add_member": "Přidat člena",
+	"members.user": "Uživatel",
+	"members.user_already_member": "Tento uživatel již je členem organizace.",
+	"members.no_team_selected": "Členové organizace musí patřit do alespoň jednoho týmu.",
+	"migrate.select.title": "Migrovat repozitář",
+	"admin.federation.federation": "Federace",
+	"admin.federation.hosts": "Hostitelé",
+	"admin.federation.hosts.title": "Hostitelé federace",
+	"admin.federation.hosts.manage_panel": "Spravovat hostitele federace",
+	"admin.federation.hosts.details_panel": "Podrobnosti o hostiteli federace",
+	"admin.federation.hosts.show_details": "Zobrazit podrobnosti o hostiteli",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Schéma",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.software_name": "Software",
+	"admin.federation.host.created": "Vytvořeno",
+	"admin.federation.host.updated": "Aktualizováno",
+	"admin.federation.host.latest_activity": "Poslední aktivita",
+	"admin.federation.users": "Uživatelé",
+	"admin.federation.users.title": "Federovaní uživatelé",
+	"admin.federation.users.manage_panel": "Spravovat federované uživatele",
+	"admin.federation.users.show_local_user": "Zobrazit podrobnosti o místním uživateli",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID místního uživatele",
+	"admin.federation.user.external_id": "ID externího uživatele",
+	"admin.federation.user.inbox_path": "Cesta ke schránce",
+	"admin.config.federation": "Nastavení federace",
+	"admin.config.federation.enabled": "Povolena",
+	"admin.config.federation.share_user_statistics": "Sdílet statistiky uživatelů s ostatními hostiteli",
+	"admin.config.federation.max_size": "Maximální povolená velikost odpovědi",
+	"admin.config.federation.signature_enforced": "Vyžadovat HTTP podpisy",
+	"admin.config.federation.signature_algorithms": "Algoritmy podpisu",
+	"admin.config.federation.digest_algorithm": "Algoritmus výpočtu kontrolního součtu podpisu",
+	"admin.config.federation.get_headers": "Podepsané hlavičky GET",
+	"admin.config.federation.post_headers": "Podepsané hlavičky POST",
 	"actions.runners.version": "Verze",
 	"actions.workflow.unknown_job_in_needs": "Úloha s ID %[1]s odkazuje na neznámé úlohy v `needs`: %[2]s.",
 	"actions.workflow.rerun_impossible": "Workflow nelze znovu spustit.",
-	"actions.workflow.job_rerun_impossible": "Úlohu nelze znovu spustit."
+	"actions.workflow.job_rerun_impossible": "Úlohu nelze znovu spustit.",
+	"user.activitypub_feed.feed": "Kanál Fediverse",
+	"user.activitypub_feed.no_activity": "Žádná aktivita ve Fediverse",
+	"user.activitypub_feed.is_empty": "Váš kanál Fediverse je prázdný.",
+	"user.activitypub_feed.hint": "Tento kanál zobrazuje aktivity z účtů Fediverse, které sledujete, a z federovaných příspěvků, které vás zmínily.",
+	"user.activitypub_feed.posted_on": "Zveřejněno na %[1]s",
+	"user.activitypub_feed.original_source": "Původní zdroj",
+	"repo.files.caption": "Soubory repozitáře (poslední revize jako první)",
+	"repo.files.filename": "Název souboru",
+	"repo.files.last_commit_message": "Zpráva poslední revize",
+	"repo.files.last_commit_date": "Datum poslední revize"
 }
diff --git a/options/locale_next/locale_da.json b/options/locale_next/locale_da.json
index 949283dc56..d863f0529d 100644
--- a/options/locale_next/locale_da.json
+++ b/options/locale_next/locale_da.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Alle varer i køen er blevet fjernet.",
+	"admin.monitor.queue.settings.remove_all_items": "Slet alle",
+	"admin.monitor.queue.settings.changed": "Indstillinger opdateret",
+	"admin.monitor.queue.settings.submit": "Opdater indstillinger",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Max antal arbejdere skal være et tal",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "I øjeblikket %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Max antal arbejdere",
+	"admin.monitor.queue.settings.description": "Puljer vokser dynamisk som reaktion på deres blokering af arbejderkø.",
+	"admin.monitor.queue.settings.title": "Pool indstillinger",
+	"admin.monitor.queue.review_add": "Gennemgå / tilføj arbejdere",
+	"admin.monitor.queue.numberinqueue": "Nummer i kø",
+	"admin.monitor.queue.maxnumberworkers": "Max antal arbejdere",
+	"admin.monitor.queue.activeworkers": "Aktive arbejdere",
+	"admin.monitor.queue.numberworkers": "Antal arbejdere",
+	"admin.monitor.queue.exemplar": "Eksempler type",
+	"admin.monitor.queue.type": "Type",
+	"admin.monitor.queue.name": "Navn",
+	"admin.monitor.queue": "Kø: %s",
+	"admin.monitor.queues": "Køer",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA deaktiveret",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA aktiveret",
+	"admin.users.list_status_filter.not_prohibit_login": "Tillad login",
+	"admin.users.list_status_filter.is_prohibit_login": "Forbyd login",
+	"admin.users.list_status_filter.not_restricted": "Ikke begrænset",
+	"admin.users.list_status_filter.is_restricted": "Begrænset",
+	"admin.users.list_status_filter.not_admin": "Ikke admin",
+	"admin.users.list_status_filter.is_admin": "Admin",
+	"admin.users.list_status_filter.not_active": "Inaktiv",
+	"admin.users.list_status_filter.is_active": "Aktiv",
+	"admin.users.list_status_filter.reset": "Nulstil",
+	"admin.users.list_status_filter.menu_text": "Filter",
+	"admin.system_status.gc_times": "GC times",
+	"admin.system_status.last_gc_pause": "Sidste GC-pause",
+	"admin.system_status.total_gc_pause": "Total GC-pause",
+	"admin.system_status.last_gc_time": "Tid siden sidste GC",
+	"admin.system_status.next_gc_recycle": "Næste GC genbrug",
+	"admin.system_status.other_system_allocation_obtained": "Anden systemallokering opnået",
+	"admin.system_status.gc_metadata_obtained": "GC-metadata opnået",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profilering bucket hash tabel opnået",
+	"admin.system_status.mcache_structures_obtained": "MCache-strukturer opnået",
+	"admin.system_status.mcache_structures_usage": "MCache strukturer brug",
+	"admin.system_status.mspan_structures_obtained": "Mspan strukturer opnået",
+	"admin.system_status.mspan_structures_usage": "MSpan strukturer brug",
+	"admin.system_status.stack_memory_obtained": "Stakhukommelse opnået",
+	"admin.system_status.bootstrap_stack_usage": "Brug af bootstrap-stak",
+	"admin.system_status.heap_objects": "Heap genstande",
+	"admin.system_status.heap_memory_released": "Heap-hukommelse frigivet",
+	"admin.system_status.heap_memory_in_use": "Heap hukommelse i brug",
+	"admin.system_status.heap_memory_idle": "Heap hukommelse inaktiv",
+	"admin.system_status.heap_memory_obtained": "Heap-hukommelse opnået",
+	"admin.system_status.current_heap_usage": "Nuværende heap-brug",
+	"admin.system_status.memory_free_times": "Hukommelses frigørelse",
+	"admin.system_status.memory_allocate_times": "Hukommelsestildelinger",
+	"admin.system_status.pointer_lookup_times": "Pointer-opslagstider",
+	"admin.system_status.memory_obtained": "Hukommelse opnået",
+	"admin.system_status.total_memory_allocated": "Samlet hukommelse tildelt",
+	"admin.system_status.current_memory_usage": "Aktuel hukommelsesbrug",
+	"admin.system_status.current_goroutine": "Nuværende goroutiner",
+	"admin.system_status.server_uptime": "Server oppetid",
+	"markup.filepreview.truncated": "Forhåndsvisningen er blevet afkortet",
+	"markup.filepreview.lines": "Linjer %[1]d til %[2]d i %[3]s",
+	"markup.filepreview.line": "Linje %[1]d i %[2]s",
+	"actions.variables.update.success": "Variablen er blevet redigeret.",
+	"actions.variables.update.failed": "Variablen kunne ikke redigeres.",
+	"actions.variables.creation.success": "Variablen \"%s\" er blevet tilføjet.",
+	"actions.variables.creation.failed": "Kunne ikke tilføje variabel.",
+	"actions.variables.deletion.success": "Variablen er blevet fjernet.",
+	"actions.variables.deletion.failed": "Variablen kunne ikke fjernes.",
+	"actions.variables.not_found": "Variablen kunne ikke findes.",
+	"actions.variables.edit": "Rediger variabel",
+	"actions.variables.description": "Variabler vil blive videregivet til visse handlinger og kan ikke læses på anden vis.",
+	"actions.variables.deletion.description": "Fjernelse af en variabel er permanent og kan ikke fortrydes. Vil du fortsætte?",
+	"actions.variables.deletion": "Fjern variabel",
+	"actions.variables.none": "Der er ingen variabler endnu.",
+	"actions.variables.creation": "Tilføj variabel",
+	"actions.variables.management": "Administrer variabler",
+	"actions.variables": "Variabler",
+	"webauthn.error.timeout": "Timeout nået, før din nøgle kunne læses. Genindlæs denne side og prøv igen.",
+	"webauthn.error.empty": "Du skal angive et navn for denne nøgle.",
+	"webauthn.error.duplicated": "Sikkerhedsnøglen er ikke tilladt for denne anmodning. Sørg for, at nøglen ikke allerede er registreret.",
+	"webauthn.error.unable_to_process": "Serveren kunne ikke behandle din anmodning.",
+	"webauthn.error.insecure": "WebAuthn understøtter kun sikre forbindelser. Til test over HTTP kan du bruge oprindelsen \"localhost\" eller \"127.0.0.1\"",
+	"webauthn.error.unknown": "Der opstod en ukendt fejl. Prøv venligst igen.",
+	"webauthn.unsupported_browser": "Din browser understøtter i øjeblikket ikke WebAuthn.",
+	"webauthn.error": "Kunne ikke læse din sikkerhedsnøgle.",
+	"webauthn.use_twofa": "Brug en tofaktorkode fra din telefon",
+	"webauthn.press_button": "Tryk venligst på knappen på din sikkerhedsnøgle…",
+	"webauthn.sign_in": "Tryk på knappen på din sikkerhedsnøgle. Hvis din sikkerhedsnøgle ikke har nogen knap, skal du indsætte den igen.",
+	"webauthn.insert_key": "Indsæt din sikkerhedsnøgle",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"other": "%s commits"
+	},
+	"counters.n_branches": {
+		"one": "%s gren",
+		"other": "%s grene"
+	},
+	"counters.n_tags": {
+		"one": "%s tag",
+		"other": "%s tags"
+	},
+	"counters.n_releases": {
+		"one": "%s udgivelse",
+		"other": "%s udgivelser"
+	},
 	"actions.actions": "Handlinger",
 	"actions.status.unknown": "Ukendt",
 	"actions.status.waiting": "Venter",
@@ -353,6 +458,23 @@
 	"migrate.gitbucket.description": "Migrer data fra GitBucket-instanser.",
 	"migrate.codebase.description": "Migrer data fra codebasehq.com.",
 	"migrate.forgejo.description": "Migrer data fra codeberg.org eller andre Forgejo-instanser.",
+	"migrate.items.label": "Migration Elementer",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Milepæle",
+	"migrate.items.labels": "Etiketter",
+	"migrate.items.issues": "Problemmer",
+	"migrate.items.pull_requests": "Pull-anmodninger",
+	"migrate.items.merge_requests": "Flet anmodninger",
+	"migrate.items.releases": "Udgivelser",
+	"migrate.in_progress.git": "Migrering af Git-data",
+	"migrate.in_progress.topics": "Migrering af emner",
+	"migrate.in_progress.milestones": "Migrerende milepæle",
+	"migrate.in_progress.labels": "Migrering af etiketter",
+	"migrate.in_progress.releases": "Migrering af udgivelser",
+	"migrate.in_progress.issues": "Migrering af problemer",
+	"migrate.in_progress.pulls": "Migrering af pull-anmodninger",
+	"migrate.cancel.title": "Annuller migrering",
+	"migrate.cancel.confirmation": "Vil du annullere denne migrering?",
 	"pulse.n_active_issues": {
 		"one": "%s aktivt problem",
 		"other": "%s aktive problemer"
diff --git a/options/locale_next/locale_de-DE.json b/options/locale_next/locale_de-DE.json
index 00f4eea189..b2ab8e138e 100644
--- a/options/locale_next/locale_de-DE.json
+++ b/options/locale_next/locale_de-DE.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Alle Elemente in der Warteschlange wurden entfernt.",
+	"admin.monitor.queue.settings.remove_all_items": "Alle entfernen",
+	"admin.monitor.queue.settings.changed": "Einstellungen aktualisiert",
+	"admin.monitor.queue.settings.submit": "Einstellungen aktualisieren",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Die Anzahl der Worker muss eine Zahl sein",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Derzeit %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Maximale Anzahl an Workern",
+	"admin.monitor.queue.settings.description": "Pools wachsen dynamisch basierend auf der Blockierung der Arbeitswarteschlange.",
+	"admin.monitor.queue.settings.title": "Pool-Einstellungen",
+	"admin.monitor.queue.review_add": "Worker hinzufügen/prüfen",
+	"admin.monitor.queue.numberinqueue": "Anzahl in der Warteschlange",
+	"admin.monitor.queue.maxnumberworkers": "Maximale Anzahl der Worker",
+	"admin.monitor.queue.activeworkers": "Aktive Worker",
+	"admin.monitor.queue.numberworkers": "Anzahl der Worker",
+	"admin.monitor.queue.exemplar": "Beispieltyp",
+	"admin.monitor.queue.type": "Typ",
+	"admin.monitor.queue.name": "Name",
+	"admin.monitor.queue": "Warteschlange: %s",
+	"admin.monitor.queues": "Warteschlangen",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA deaktiviert",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA aktiviert",
+	"admin.users.list_status_filter.not_prohibit_login": "Anmelden erlaubt",
+	"admin.users.list_status_filter.is_prohibit_login": "Anmelden verbieten",
+	"admin.users.list_status_filter.not_restricted": "Unbegrenzt",
+	"admin.users.list_status_filter.is_restricted": "Eingeschränkt",
+	"admin.users.list_status_filter.not_admin": "Nicht-Administrator",
+	"admin.users.list_status_filter.is_admin": "Administrator",
+	"admin.users.list_status_filter.not_active": "Inaktiv",
+	"admin.users.list_status_filter.is_active": "Aktiv",
+	"admin.users.list_status_filter.reset": "Zurücksetzen",
+	"admin.users.list_status_filter.menu_text": "Filter",
+	"admin.system_status.gc_times": "GC-Zeiten",
+	"admin.system_status.last_gc_pause": "Letzte GC-Pause",
+	"admin.system_status.total_gc_pause": "Gesamte GC-Pause",
+	"admin.system_status.last_gc_time": "Seit letztem GC-Zyklus",
+	"admin.system_status.next_gc_recycle": "Nächster GC-Zyklus",
+	"admin.system_status.other_system_allocation_obtained": "Andere erhaltene System-Allokationen",
+	"admin.system_status.gc_metadata_obtained": "Erhaltene GC-Metadaten",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Erhaltene Analysesatz-Hashtabellen",
+	"admin.system_status.mcache_structures_obtained": "Erhaltene MCache-Structures",
+	"admin.system_status.mcache_structures_usage": "MCache-Structures-Auslastung",
+	"admin.system_status.mspan_structures_obtained": "Erhaltene MSpan-Structures",
+	"admin.system_status.mspan_structures_usage": "MSpan-Structures-Auslastung",
+	"admin.system_status.stack_memory_obtained": "Erhaltener Stack-Arbeitsspeicher",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap-Stack-Auslastung",
+	"admin.system_status.heap_objects": "Heap-Objekte",
+	"admin.system_status.heap_memory_released": "Freigegebener Heap-Arbeitsspeicher",
+	"admin.system_status.heap_memory_in_use": "Benutzter-Heap-Arbeitsspeicher",
+	"admin.system_status.heap_memory_idle": "Unbenutzter Heap-Arbeitsspeicher",
+	"admin.system_status.heap_memory_obtained": "Erhaltener Heap-Arbeitsspeicher",
+	"admin.system_status.current_heap_usage": "Aktuelle Heap-Auslastung",
+	"admin.system_status.memory_free_times": "Speicherfreigaben",
+	"admin.system_status.memory_allocate_times": "Speicheranforderungen",
+	"admin.system_status.pointer_lookup_times": "Anzahl Zeigerlookups",
+	"admin.system_status.memory_obtained": "Erhaltener Speicher",
+	"admin.system_status.total_memory_allocated": "Zugeteilter Gesamtspeicher",
+	"admin.system_status.current_memory_usage": "Aktuelle Speichernutzung",
+	"admin.system_status.current_goroutine": "Aktuelle Goroutinen",
+	"admin.system_status.server_uptime": "Server-Uptime",
+	"markup.filepreview.truncated": "Vorschau wurde gekürzt",
+	"markup.filepreview.lines": "Zeilen %[1]d bis %[2]d in %[3]s",
+	"markup.filepreview.line": "Zeile %[1]d in %[2]s",
+	"actions.variables.update.success": "Die Variable wurde bearbeitet.",
+	"actions.variables.update.failed": "Fehler beim Bearbeiten der Variable.",
+	"actions.variables.creation.success": "Die Variable „%s“ wurde hinzugefügt.",
+	"actions.variables.creation.failed": "Fehler beim Hinzufügen der Variable.",
+	"actions.variables.deletion.success": "Die Variable wurde entfernt.",
+	"actions.variables.deletion.failed": "Fehler beim Entfernen der Variable.",
+	"actions.variables.not_found": "Die Variable wurde nicht gefunden.",
+	"actions.variables.edit": "Variable bearbeiten",
+	"actions.variables.description": "Variablen werden an bestimmte Aktionen übergeben und können nicht anderweitig gelesen werden.",
+	"actions.variables.deletion.description": "Das Entfernen einer Variable ist dauerhaft und kann nicht rückgängig gemacht werden. Fortfahren?",
+	"actions.variables.deletion": "Variable entfernen",
+	"actions.variables.none": "Es gibt noch keine Variablen.",
+	"actions.variables.creation": "Variable hinzufügen",
+	"actions.variables.management": "Variablen verwalten",
+	"actions.variables": "Variablen",
+	"webauthn.error.timeout": "Das Zeitlimit wurde erreicht, bevor dein Schlüssel gelesen werden konnte. Bitte lade die Seite erneut.",
+	"webauthn.error.empty": "Du musst einen Namen für diesen Schlüssel festlegen.",
+	"webauthn.error.duplicated": "Für diese Anfrage ist der Sicherheitsschlüssel nicht erlaubt. Bitte stell sicher, dass er nicht bereits registriert ist.",
+	"webauthn.error.unable_to_process": "Der Server konnte deine Anfrage nicht bearbeiten.",
+	"webauthn.error.insecure": "WebAuthn unterstützt nur sichere Verbindungen. Zum Testen über HTTP kannst du „localhost“ oder „127.0.0.1“ als Host verwenden",
+	"webauthn.error.unknown": "Ein unbekannter Fehler ist aufgetreten. Bitte versuche es erneut.",
+	"webauthn.unsupported_browser": "Dein Browser unterstützt derzeit kein WebAuthn.",
+	"webauthn.error": "Dein Sicherheitsschlüssel konnte nicht gelesen werden.",
+	"webauthn.use_twofa": "Zwei-Faktor-Authentifizierung via Handy verwenden",
+	"webauthn.press_button": "Drücke den Knopf auf deinem Sicherheitsschlüssel …",
+	"webauthn.sign_in": "Drücke den Knopf auf deinem Sicherheitsschlüssel. Wenn dein Sicherheitsschlüssel keinen Knopf hat, stecke ihn erneut ein.",
+	"webauthn.insert_key": "Hardware-Sicherheitsschlüssel einstecken",
+	"counters.n_commits": {
+		"one": "%s Commit",
+		"other": "%s Commits"
+	},
+	"counters.n_branches": {
+		"one": "%s Branch",
+		"other": "%s Branches"
+	},
+	"counters.n_tags": {
+		"one": "%s Tag",
+		"other": "%s Tags"
+	},
+	"counters.n_releases": {
+		"one": "%s Veröffentlichung",
+		"other": "%s Veröffentlichungen"
+	},
 	"gpg.default_key": "Mit Standardschlüssel signiert",
 	"gpg.error.extract_sign": "Die Signatur konnte nicht extrahiert werden",
 	"gpg.error.generate_hash": "Es konnte kein Hash vom Commit generiert werden",
@@ -317,6 +422,23 @@
 	"migrate.gitbucket.description": "Daten von GitBucket-Instanzen migrieren.",
 	"migrate.codebase.description": "Daten von codebasehq.com migrieren.",
 	"migrate.forgejo.description": "Daten von codeberg.org oder anderen Forgejo-Instanzen migrieren.",
+	"migrate.items.label": "Migrationselemente",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Meilensteine",
+	"migrate.items.labels": "Labels",
+	"migrate.items.issues": "Issues",
+	"migrate.items.pull_requests": "Pull-Requests",
+	"migrate.items.merge_requests": "Merge-Requests",
+	"migrate.items.releases": "Releases",
+	"migrate.in_progress.git": "Git-Daten werden migriert",
+	"migrate.in_progress.topics": "Themen werden migriert",
+	"migrate.in_progress.milestones": "Meilensteine werden migriert",
+	"migrate.in_progress.labels": "Labels werden migriert",
+	"migrate.in_progress.releases": "Releases werden migriert",
+	"migrate.in_progress.issues": "Issues werden migriert",
+	"migrate.in_progress.pulls": "Pull-Requests werden migriert",
+	"migrate.cancel.title": "Migration abbrechen",
+	"migrate.cancel.confirmation": "Möchtest du diese Migration abbrechen?",
 	"repo.pulls.already_merged": "Zusammenführung fehlgeschlagen. Der Pull-Request wurde bereits zusammengeführt.",
 	"migrate.pagure.incorrect_url": "Falsche Quellrepository-URL wurde angegeben",
 	"migrate.pagure.project_example": "Die URL des Pagure-Projekts, z. B. https://pagure.io/pagure",
@@ -508,11 +630,8 @@
 	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "Token",
 	"actions.runners.ephemeral": "Vorübergehend",
-	"actions.runners.list_runners.details_column": "Details",
 	"actions.runners.list_runners.edit_column": "Bearbeiten",
 	"actions.runners.list_runners.delete_column": "Löschen",
-	"actions.runners.list_runners.details_button": "Details",
-	"actions.runners.list_runners.details_button_aria": "Details für %s anzeigen",
 	"actions.runners.list_runners.delete_button": "Löschen",
 	"actions.runners.list_runners.delete_button_aria": "%s löschen",
 	"actions.runners.list_runners.edit_button": "Bearbeiten",
@@ -562,6 +681,10 @@
 	"graphs.recent_commits.title": "Anzahl der Commits im letzten Jahr",
 	"graphs.code_frequency.title": "Code-Frequenz über die Geschichte von {0}",
 	"settings.permissions_access_specific_repositories": "Bestimmte Repositorys",
+	"settings.access_token.selected_repositories": {
+		"one": "Ausgewähltes Repository (%d)",
+		"other": "Ausgewählte Repositorys (%d)"
+	},
 	"settings.access_token.available_repositories": "Verfügbare Repositorys",
 	"settings.access_token.no_repositories_selected": "Keine Repositorys ausgewählt.",
 	"settings.access_token.no_repositories_found": "Keine Repositorys gefunden.",
@@ -579,8 +702,54 @@
 	"actions.secrets.mutation.failure_message": "Das Geheimnis „%s“ konnte nicht aktualisiert werden.",
 	"actions.secrets.mutation.name_description": "Der Name eines Geheimnisses darf nur Buchstaben, Ziffern und Unterstriche enthalten. Er darf nicht mit „FORGEJO_“, „GITEA_“, „GITHUB_“ oder einer Zahl anfangen. Forgejo wird ihn automatisch in Großbuchstaben umwandeln.",
 	"actions.secrets.mutation.value_description": "Ein bereits existierender Wert wird nicht angezeigt. Lasse das Feld leer, wenn es nicht geändert werden soll. Sonderzeichen bleiben erhalten. CRLF (Windows-Zeilenumbrüche) werden automatisch in LF umgewandelt. Kodiere den Wert mit Base64, wenn Zeilenumbrüche beibehalten werden sollen.",
+	"members.add_member": "Mitglied hinzufügen",
+	"members.user": "Benutzer",
+	"members.user_already_member": "Dieser Benutzer ist bereits ein Mitglied der Organisation.",
+	"members.no_team_selected": "Organisationsmitglieder müssen mindestens einem Team angehören.",
+	"migrate.select.title": "Repository migrieren",
 	"actions.runners.version": "Version",
+	"admin.federation.federation": "Föderation",
+	"admin.federation.hosts": "Hosts",
+	"admin.federation.hosts.title": "Föderations-Hosts",
+	"admin.federation.hosts.manage_panel": "Föderations-Hosts verwalten",
+	"admin.federation.hosts.details_panel": "Föderations-Host-Details",
+	"admin.federation.hosts.show_details": "Host-Details anzeigen",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Schema",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.software_name": "Software",
+	"admin.federation.host.created": "Erstellt",
+	"admin.federation.host.updated": "Aktualisiert",
+	"admin.federation.host.latest_activity": "Neuste Aktivität",
+	"admin.federation.users": "Benutzer",
+	"admin.federation.users.title": "Föderierte Benutzer",
+	"admin.federation.users.manage_panel": "Föderierte Benutzer verwalten",
+	"admin.federation.users.show_local_user": "Lokale Benutzerdetails anzeigen",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "Lokale Benutzer-ID",
+	"admin.federation.user.external_id": "Externe Benutzer-ID",
+	"admin.federation.user.inbox_path": "Inbox-Pfad",
+	"admin.config.federation": "Föderations-Konfiguration",
+	"admin.config.federation.enabled": "Aktiviert",
+	"admin.config.federation.share_user_statistics": "Benutzerstatistik mit anderen Hosts teilen",
+	"admin.config.federation.max_size": "Max. erlaubte Antwortgröße",
+	"admin.config.federation.signature_enforced": "HTTP-Signaturen erfordern",
+	"admin.config.federation.signature_algorithms": "Signaturalgorithmen",
+	"admin.config.federation.digest_algorithm": "Signatur-Hashwert-Algorithmus",
+	"admin.config.federation.get_headers": "Signierte GET-Header",
+	"admin.config.federation.post_headers": "Signierte POST-Header",
 	"actions.workflow.unknown_job_in_needs": "Job mit ID %[1]s referenziert unbekannte Jobs in `needs`: %[2]s.",
 	"actions.workflow.rerun_impossible": "Der Workflow kann nicht erneut ausgeführt werden.",
-	"actions.workflow.job_rerun_impossible": "Der Job kann nicht erneut ausgeführt werden."
+	"actions.workflow.job_rerun_impossible": "Der Job kann nicht erneut ausgeführt werden.",
+	"user.activitypub_feed.feed": "Fediverse-Feed",
+	"user.activitypub_feed.no_activity": "Keine Fediverse-Aktivität",
+	"user.activitypub_feed.is_empty": "Dein Fediverse-Feed ist leer.",
+	"user.activitypub_feed.hint": "Dieser Feed zeigt Aktivitäten aus Fediverse-Konten, denen du folgst sowie föderierten Posts, die dich erwähnt haben.",
+	"user.activitypub_feed.posted_on": "Auf %[1]s gepostet",
+	"user.activitypub_feed.original_source": "Ursprüngliche Quelle",
+	"repo.files.caption": "Repository-Dateien (neuester Commit zuerst)",
+	"repo.files.filename": "Dateiname",
+	"repo.files.last_commit_message": "Letzte Commit-Nachricht",
+	"repo.files.last_commit_date": "Letztes Commit-Datum"
 }
diff --git a/options/locale_next/locale_el-GR.json b/options/locale_next/locale_el-GR.json
index b83629006d..ee9e48e977 100644
--- a/options/locale_next/locale_el-GR.json
+++ b/options/locale_next/locale_el-GR.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Όλα τα αντικείμενα στην ουρά αφαιρέθηκαν.",
+	"admin.monitor.queue.settings.remove_all_items": "Αφαίρεση όλων",
+	"admin.monitor.queue.settings.changed": "Οι ρυθμίσεις ενημερώθηκαν",
+	"admin.monitor.queue.settings.submit": "Ενημέρωση ρυθμίσεων",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Ο μέγιστος αριθμός εργατών πρέπει να είναι αριθμός",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Αυτή τη στιγμή %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Μέγιστος Αριθμός Εργατών",
+	"admin.monitor.queue.settings.description": "Οι δεξαμενές αυξάνονται δυναμικά όταν υπάρχει φραγή της ουράς των εργατών τους.",
+	"admin.monitor.queue.settings.title": "Ρυθμίσεις δεξαμενής",
+	"admin.monitor.queue.review_add": "Εξέταση / προσθήκη εργατών",
+	"admin.monitor.queue.numberinqueue": "Πλήθος ουράς",
+	"admin.monitor.queue.maxnumberworkers": "Μέγιστος αριθμός εργατών",
+	"admin.monitor.queue.activeworkers": "Ενεργοί εργάτες",
+	"admin.monitor.queue.numberworkers": "Αριθμός εργατών",
+	"admin.monitor.queue.exemplar": "Τύπος Υποδείγματος",
+	"admin.monitor.queue.type": "Τύπος",
+	"admin.monitor.queue.name": "Όνομα",
+	"admin.monitor.queue": "Ουρά: %s",
+	"admin.monitor.queues": "Ουρές",
+	"admin.users.list_status_filter.not_2fa_enabled": "Χωρίς 2FA",
+	"admin.users.list_status_filter.is_2fa_enabled": "Με ενεργοποιημένο 2FA",
+	"admin.users.list_status_filter.not_prohibit_login": "Επιτρέπεται η σύνδεση",
+	"admin.users.list_status_filter.is_prohibit_login": "Απαγορευμένη σύνδεση",
+	"admin.users.list_status_filter.not_restricted": "Χωρίς περιορισμούς",
+	"admin.users.list_status_filter.is_restricted": "Περιορισμένος",
+	"admin.users.list_status_filter.not_admin": "Χωρίς δικαιώματα διαχειριστή",
+	"admin.users.list_status_filter.is_admin": "Διαχειριστής",
+	"admin.users.list_status_filter.not_active": "Ανενεργό",
+	"admin.users.list_status_filter.is_active": "Ενεργό",
+	"admin.users.list_status_filter.reset": "Επαναφορά",
+	"admin.users.list_status_filter.menu_text": "Φίλτρο",
+	"admin.system_status.gc_times": "Χρόνοι GC",
+	"admin.system_status.last_gc_pause": "Τελευταία παύση GC",
+	"admin.system_status.total_gc_pause": "Σύνολο παύσης GC",
+	"admin.system_status.last_gc_time": "Χρόνος από την τελευταία φορά που έγινε GC",
+	"admin.system_status.next_gc_recycle": "Επόμενη ανακύκλωση GC",
+	"admin.system_status.other_system_allocation_obtained": "Άλλες κατανομές συστήματος που έχουν ληφθεί",
+	"admin.system_status.gc_metadata_obtained": "Μεταδεδομένα GC που έχουν ληφθεί",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profiling bucket hash table που έχει ληφθεί",
+	"admin.system_status.mcache_structures_obtained": "Δομές MCache που έχουν ληφθεί",
+	"admin.system_status.mcache_structures_usage": "Χρήση δομών MCache",
+	"admin.system_status.mspan_structures_obtained": "Δομές MSpan που έχουν ληφθεί",
+	"admin.system_status.mspan_structures_usage": "Χρήση δομών MSpan",
+	"admin.system_status.stack_memory_obtained": "Μνήμη στοίβας που λαμβάνεται",
+	"admin.system_status.bootstrap_stack_usage": "Χρήση στοίβας bootstrap",
+	"admin.system_status.heap_objects": "Αντικείμενα στο heap",
+	"admin.system_status.heap_memory_released": "Μνήμη heap που απελευθερώθηκε",
+	"admin.system_status.heap_memory_in_use": "Μνήμη heap σε χρήση",
+	"admin.system_status.heap_memory_idle": "Αδρανής μνήμη heap",
+	"admin.system_status.heap_memory_obtained": "Μνήμη heap που λαμβάνεται",
+	"admin.system_status.current_heap_usage": "Τρέχουσα χρήση heap",
+	"admin.system_status.memory_free_times": "Ελευθερώσεις μνήμης",
+	"admin.system_status.memory_allocate_times": "Κατανομές μνήμης",
+	"admin.system_status.pointer_lookup_times": "Πλήθος αναζητήσεων δείκτη",
+	"admin.system_status.memory_obtained": "Μνήμη που λαμβάνεται",
+	"admin.system_status.total_memory_allocated": "Συνολική χρησιμοποιούμενη μνήμη",
+	"admin.system_status.current_memory_usage": "Τρέχουσα χρήση μνήμης",
+	"admin.system_status.current_goroutine": "Τρέχουσες goroutines",
+	"admin.system_status.server_uptime": "Uptime διακομιστή",
+	"markup.filepreview.truncated": "Η προεπισκόπηση έχει περικοπεί",
+	"markup.filepreview.lines": "Γραμμές %[1]d έως %[2]d στο αρχείο %[3]s",
+	"markup.filepreview.line": "Γραμμή %[1]d στο αρχείο %[2]s",
+	"actions.variables.update.success": "Η μεταβλητή έχει τροποποιηθεί.",
+	"actions.variables.update.failed": "Αποτυχία επεξεργασίας μεταβλητής.",
+	"actions.variables.creation.success": "Η μεταβλητή «%s» προστέθηκε.",
+	"actions.variables.creation.failed": "Αποτυχία προσθήκης μεταβλητής.",
+	"actions.variables.deletion.success": "Η μεταβλητή έχει αφαιρεθεί.",
+	"actions.variables.deletion.failed": "Αποτυχία αφαίρεσης της μεταβλητής.",
+	"actions.variables.not_found": "Αποτυχία εύρεσης της μεταβλητής.",
+	"actions.variables.edit": "Επεξεργασία Μεταβλητής",
+	"actions.variables.description": "Η μεταβλητές θα δίνονται σε ορισμένες δράσεις και δεν μπορούν να διαβαστούν αλλιώς.",
+	"actions.variables.deletion.description": "Η αφαίρεση μιας μεταβλητής είναι μόνιμη και δεν μπορεί να αναιρεθεί. Συνέχεια;",
+	"actions.variables.deletion": "Αφαίρεση μεταβλητής",
+	"actions.variables.none": "Δεν υπάρχουν ακόμα μεταβλητές.",
+	"actions.variables.creation": "Προσθήκη μεταβλητή",
+	"actions.variables.management": "Διαχείριση μεταβλητών",
+	"actions.variables": "Μεταβλητές",
+	"webauthn.error.timeout": "Το χρονικό όριο έφτασε πριν το κλειδί να διαβαστεί. Παρακαλώ ανανεώστε τη σελίδα και προσπαθήστε ξανά.",
+	"webauthn.error.empty": "Πρέπει να ορίσετε ένα όνομα για αυτό το κλειδί.",
+	"webauthn.error.duplicated": "Το κλειδί ασφαλείας δεν επιτρέπεται για αυτό το αίτημα. Βεβαιωθείτε ότι το κλειδί δεν έχει ήδη καταχωρηθεί.",
+	"webauthn.error.unable_to_process": "Ο διακομιστής δεν μπόρεσε να επεξεργαστεί το αίτημά σας.",
+	"webauthn.error.insecure": "Το WebAuthn υποστηρίζει μόνο ασφαλές συνδέσεις. Αν θέλετε να διεξάγετε δοκιμές μέσω HTTP, μπορείτε να χρησιμοποιήσετε την προέλευση «localhost» ή «127.0.0.1»",
+	"webauthn.error.unknown": "Παρουσιάστηκε ένα άγνωστο σφάλμα. Παρακαλώ προσπαθήστε ξανά.",
+	"webauthn.unsupported_browser": "Το πρόγραμμα περιήγησής σας δεν υποστηρίζει επί του παρόντος WebAuthn.",
+	"webauthn.error": "Δεν ήταν δυνατή η επικοινωνία με το κλειδί ασφαλείας σας.",
+	"webauthn.use_twofa": "Χρησιμοποιήστε έναν κωδικό δύο παραγόντων από το τηλέφωνό σας",
+	"webauthn.press_button": "Παρακαλώ πατήστε το κουμπί στο κλειδί ασφαλείας…",
+	"webauthn.sign_in": "Πατήστε το κουμπί στο κλειδί ασφαλείας σας. Αν το κλειδί ασφαλείας σας δεν έχει κουμπί, αποσυνδέστε το και συνδέστε το ξανά.",
+	"webauthn.insert_key": "Εισάγετε το κλειδί ασφαλείας σας",
+	"counters.n_commits": {
+		"one": "%s υποβολή",
+		"other": "%s υποβολές"
+	},
+	"counters.n_branches": {
+		"one": "%s κλάδος",
+		"other": "%s κλάδοι"
+	},
+	"counters.n_tags": {
+		"one": "%s ετικέτα",
+		"other": "%s ετικέτες"
+	},
+	"counters.n_releases": {
+		"one": "%s κυκλοφορία",
+		"other": "%s κυκλοφορίες"
+	},
 	"gpg.default_key": "Υπογραφή με το προεπιλεγμένο κλειδί",
 	"gpg.error.extract_sign": "Αποτυχία εξαγωγής υπογραφής",
 	"gpg.error.generate_hash": "Αποτυχία δημιουργίας hash της υποβολής",
@@ -224,6 +329,23 @@
 	"migrate.gitbucket.description": "Μεταφορά δεδομένων από διακομιστές GitBucket.",
 	"migrate.codebase.description": "Μεταφορά δεδομένων από το codebasehq.com.",
 	"migrate.forgejo.description": "Μεταφορά δεδομένων από το codeberg.org ή άλλων υπηρεσιών Forgejo.",
+	"migrate.items.label": "Αντικείμενα μεταφοράς",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Ορόσημα",
+	"migrate.items.labels": "Σήματα",
+	"migrate.items.issues": "Ζητήματα",
+	"migrate.items.pull_requests": "Pull requests",
+	"migrate.items.merge_requests": "Merge requests",
+	"migrate.items.releases": "Κυκλοφορίες",
+	"migrate.in_progress.git": "Τα δεδομένα Git μεταφέρονται",
+	"migrate.in_progress.topics": "Τα θέματα μεταφέρονται",
+	"migrate.in_progress.milestones": "Τα ορόσημα μεταφέρονται",
+	"migrate.in_progress.labels": "Τα σήματα μεταφέρονται",
+	"migrate.in_progress.releases": "Οι κυκλοφορίες μεταφέρονται",
+	"migrate.in_progress.issues": "Τα ζητήματα μεταφέρονται",
+	"migrate.in_progress.pulls": "Μεταφέρονται τα pull requests",
+	"migrate.cancel.title": "Ακύρωση μεταφοράς",
+	"migrate.cancel.confirmation": "Θέλετε να ακυρώσετε αυτή τη μεταφορά;",
 	"relativetime.future": "στο μέλλον",
 	"relativetime.now": "τώρα",
 	"repo.form.cannot_create": "Όλοι οι χώροι που μπορείτε να δημιουργήσετε αποθετήρια έχουν φτάσει στο μέγιστο όριο αποθετηρίων.",
@@ -469,13 +591,10 @@
 	"actions.runners.create_runner.description_label": "Περιγραφή",
 	"actions.runners.ephemeral.yes": "ναι",
 	"actions.runners.ephemeral.no": "όχι",
-	"actions.runners.list_runners.details_column": "Λεπτομέρειες",
 	"actions.runners.list_runners.edit_column": "Επεξεργασία",
 	"actions.runners.list_runners.delete_column": "Διαγραφή",
 	"actions.runners.list_runners.delete_button": "Διαγραφή",
 	"actions.runners.uuid": "UUID",
-	"actions.runners.list_runners.details_button": "Λεπτομέρειες",
-	"actions.runners.list_runners.details_button_aria": "Εμφάνιση λεπτομερειών για %s",
 	"actions.runners.list_runners.delete_button_aria": "Διαγραφή %s",
 	"actions.runners.list_runners.edit_button": "Επεξεργασία",
 	"actions.runners.list_runners.edit_button_aria": "Επεξεργασία %s",
diff --git a/options/locale_next/locale_en-US.json b/options/locale_next/locale_en-US.json
index 648368bbc3..614f3c1ce9 100644
--- a/options/locale_next/locale_en-US.json
+++ b/options/locale_next/locale_en-US.json
@@ -52,6 +52,10 @@
 	"relativetime.1week": "last week",
 	"relativetime.1month": "last month",
 	"relativetime.1year": "last year",
+	"repo.files.caption": "Repository files (latest commit first)",
+	"repo.files.filename": "Filename",
+	"repo.files.last_commit_message": "Latest commit message",
+	"repo.files.last_commit_date": "Latest commit date",
 	"repo.issues.filter_poster.hint": "Filter by the author",
 	"repo.issues.filter_assignee.hint": "Filter by assigned user",
 	"repo.issues.filter_reviewers.hint": "Filter by user who reviewed",
@@ -88,6 +92,7 @@
 	"repo.pulls.maintainers_cannot_edit": "Maintainers cannot edit this pull request.",
 	"repo.form.cannot_create": "All spaces in which you can create repositories have reached the limit of repositories.",
 	"repo.view.gitmodules_too_large": "The .gitmodules file is too large and will be ignored (on API calls for instance)",
+	"migrate.select.title": "Migrate repository",
 	"migrate.form.error.url_credentials": "The URL contains credentials, put them in the username and password fields respectively",
 	"migrate.github.description": "Migrate data from github.com or GitHub Enterprise server.",
 	"migrate.git.description": "Migrate a repository only from any Git service.",
@@ -98,6 +103,23 @@
 	"migrate.gitbucket.description": "Migrate data from GitBucket instances.",
 	"migrate.codebase.description": "Migrate data from codebasehq.com.",
 	"migrate.forgejo.description": "Migrate data from codeberg.org or other Forgejo instances.",
+	"migrate.items.label": "Migration items",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Milestones",
+	"migrate.items.labels": "Labels",
+	"migrate.items.issues": "Issues",
+	"migrate.items.pull_requests": "Pull requests",
+	"migrate.items.merge_requests": "Merge requests",
+	"migrate.items.releases": "Releases",
+	"migrate.in_progress.git": "Migrating Git data",
+	"migrate.in_progress.topics": "Migrating topics",
+	"migrate.in_progress.milestones": "Migrating milestones",
+	"migrate.in_progress.labels": "Migrating labels",
+	"migrate.in_progress.releases": "Migrating releases",
+	"migrate.in_progress.issues": "Migrating issues",
+	"migrate.in_progress.pulls": "Migrating pull requests",
+	"migrate.cancel.title": "Cancel migration",
+	"migrate.cancel.confirmation": "Do you want to cancel this migration?",
 	"repo.issue_indexer.title": "Issue Indexer",
 	"search.milestone_kind": "Search milestones…",
 	"search.syntax": "Search syntax",
@@ -122,11 +144,101 @@
 	"keys.ssh.link": "SSH keys",
 	"keys.gpg.link": "GPG keys",
 	"keys.verify.token.hint": "The token is only valid for 1 minute. <a href=\"%[1]s\">Get a new one if it expired</a>.",
+	"admin.federation.federation": "Federation",
+	"admin.federation.hosts": "Hosts",
+	"admin.federation.hosts.title": "Federation hosts",
+	"admin.federation.hosts.manage_panel": "Manage federation hosts",
+	"admin.federation.hosts.details_panel": "Federation host details",
+	"admin.federation.hosts.show_details": "Show host details",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Schema",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.software_name": "Software",
+	"admin.federation.host.created": "Created",
+	"admin.federation.host.updated": "Updated",
+	"admin.federation.host.latest_activity": "Latest activity",
+	"admin.federation.users": "Users",
+	"admin.federation.users.title": "Federated users",
+	"admin.federation.users.manage_panel": "Manage federated users",
+	"admin.federation.users.show_local_user": "Show local user details",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "Local user ID",
+	"admin.federation.user.external_id": "External user ID",
+	"admin.federation.user.inbox_path": "Inbox path",
+	"admin.config.federation": "Federation configuration",
+	"admin.config.federation.enabled": "Enabled",
+	"admin.config.federation.share_user_statistics": "Share user statistics with other hosts",
+	"admin.config.federation.max_size": "Max allowed response size",
+	"admin.config.federation.signature_enforced": "Require HTTP signatures",
+	"admin.config.federation.signature_algorithms": "Signature algorithms",
+	"admin.config.federation.digest_algorithm": "Signature digest algorithm",
+	"admin.config.federation.get_headers": "Signed GET headers",
+	"admin.config.federation.post_headers": "Signed POST headers",
 	"admin.config.moderation_config": "Moderation configuration",
 	"admin.moderation.moderation_reports": "Moderation reports",
 	"admin.moderation.reports": "Reports",
 	"admin.moderation.no_open_reports": "There are currently no open reports.",
 	"admin.moderation.deleted_content_ref": "Reported content with type %[1]v and id %[2]d no longer exists",
+	"admin.system_status.server_uptime": "Server uptime",
+	"admin.system_status.current_goroutine": "Current goroutines",
+	"admin.system_status.current_memory_usage": "Current memory usage",
+	"admin.system_status.total_memory_allocated": "Total memory allocated",
+	"admin.system_status.memory_obtained": "Memory obtained",
+	"admin.system_status.pointer_lookup_times": "Pointer lookup times",
+	"admin.system_status.memory_allocate_times": "Memory allocations",
+	"admin.system_status.memory_free_times": "Memory frees",
+	"admin.system_status.current_heap_usage": "Current heap usage",
+	"admin.system_status.heap_memory_obtained": "Heap memory obtained",
+	"admin.system_status.heap_memory_idle": "Heap memory idle",
+	"admin.system_status.heap_memory_in_use": "Heap memory in use",
+	"admin.system_status.heap_memory_released": "Heap memory released",
+	"admin.system_status.heap_objects": "Heap objects",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap stack usage",
+	"admin.system_status.stack_memory_obtained": "Stack memory obtained",
+	"admin.system_status.mspan_structures_usage": "MSpan structures usage",
+	"admin.system_status.mspan_structures_obtained": "MSpan structures obtained",
+	"admin.system_status.mcache_structures_usage": "MCache structures usage",
+	"admin.system_status.mcache_structures_obtained": "MCache structures obtained",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profiling bucket hash table obtained",
+	"admin.system_status.gc_metadata_obtained": "GC metadata obtained",
+	"admin.system_status.other_system_allocation_obtained": "Other system allocation obtained",
+	"admin.system_status.next_gc_recycle": "Next GC recycle",
+	"admin.system_status.last_gc_time": "Time since last GC",
+	"admin.system_status.total_gc_pause": "Total GC pause",
+	"admin.system_status.last_gc_pause": "Last GC pause",
+	"admin.system_status.gc_times": "GC times",
+	"admin.users.list_status_filter.menu_text": "Filter",
+	"admin.users.list_status_filter.reset": "Reset",
+	"admin.users.list_status_filter.is_active": "Active",
+	"admin.users.list_status_filter.not_active": "Inactive",
+	"admin.users.list_status_filter.is_admin": "Admin",
+	"admin.users.list_status_filter.not_admin": "Not admin",
+	"admin.users.list_status_filter.is_restricted": "Restricted",
+	"admin.users.list_status_filter.not_restricted": "Not restricted",
+	"admin.users.list_status_filter.is_prohibit_login": "Prohibit login",
+	"admin.users.list_status_filter.not_prohibit_login": "Allow login",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA enabled",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA disabled",
+	"admin.monitor.queues": "Queues",
+	"admin.monitor.queue": "Queue: %s",
+	"admin.monitor.queue.name": "Name",
+	"admin.monitor.queue.type": "Type",
+	"admin.monitor.queue.exemplar": "Exemplar Type",
+	"admin.monitor.queue.numberworkers": "Number of workers",
+	"admin.monitor.queue.activeworkers": "Active workers",
+	"admin.monitor.queue.maxnumberworkers": "Max Number of workers",
+	"admin.monitor.queue.numberinqueue": "Number in queue",
+	"admin.monitor.queue.review_add": "Review / add workers",
+	"admin.monitor.queue.settings.title": "Pool settings",
+	"admin.monitor.queue.settings.description": "Pools dynamically grow in response to their worker queue blocking.",
+	"admin.monitor.queue.settings.maxnumberworkers": "Max Number of workers",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Currently %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Max number of workers must be a number",
+	"admin.monitor.queue.settings.submit": "Update settings",
+	"admin.monitor.queue.settings.changed": "Settings updated",
+	"admin.monitor.queue.settings.remove_all_items": "Remove all",
+	"admin.monitor.queue.settings.remove_all_items.success": "All items in the queue have been removed.",
 	"moderation.report.mark_as_handled": "Mark as handled",
 	"moderation.report.mark_as_ignored": "Mark as ignored",
 	"moderation.action.account.delete": "Delete account",
@@ -206,8 +318,26 @@
 	"settings.access_token.resource_public_only_help": "Limit access to repositories and organizations that are public.",
 	"settings.access_token.resource_specific_repo_help": "Limit access to a specific list of repositories. Read-only access is permitted to all public repositories. Only permissions that allow access to repositories and issues can be enabled.",
 	"settings.access_token.admin_disabled": "Administrative permissions are disabled.",
+	"webauthn.insert_key": "Insert your security key",
+	"webauthn.sign_in": "Press the button on your security key. If your security key has no button, re-insert it.",
+	"webauthn.press_button": "Please press the button on your security key…",
+	"webauthn.use_twofa": "Use a two-factor code from your phone",
+	"webauthn.error": "Could not read your security key.",
+	"webauthn.error.unknown": "An unknown error occurred. Please retry.",
+	"webauthn.error.insecure": "WebAuthn only supports secure connections. For testing over HTTP, you can use the origin \"localhost\" or \"127.0.0.1\"",
+	"webauthn.error.unable_to_process": "The server could not process your request.",
+	"webauthn.error.duplicated": "The security key is not permitted for this request. Please make sure that the key is not already registered.",
+	"webauthn.error.empty": "You must set a name for this key.",
+	"webauthn.error.timeout": "Timeout reached before your key could be read. Please reload this page and retry.",
+	"webauthn.unsupported_browser": "Your browser does not currently support WebAuthn.",
 	"error.must_enable_2fa": "This Forgejo instance requires users to enable two-factor authentication before they can access their accounts. Enable it at: %s",
 	"avatar.constraints_hint": "Custom avatar may not exceed %[1]s in size or be larger than %[2]dx%[3]d pixels",
+	"user.activitypub_feed.feed": "Fediverse Feed",
+	"user.activitypub_feed.no_activity": "No fediverse activity",
+	"user.activitypub_feed.is_empty": "Your fediverse feed is empty.",
+	"user.activitypub_feed.hint": "This feed shows activities from fediverse accounts that you follow, as well as federated posts that mentioned you.",
+	"user.activitypub_feed.posted_on": "Posted on %[1]s",
+	"user.activitypub_feed.original_source": "Original source",
 	"user.ghost.tooltip": "This user has been deleted, or cannot be matched.",
 	"og.repo.summary_card.alt_description": "Summary card of repository %[1]s, described as: %[2]s",
 	"repo.commit.load_tags_failed": "Load tags failed because of internal error",
@@ -257,6 +387,22 @@
 	"munits.data.tib": "TiB",
 	"munits.data.pib": "PiB",
 	"munits.data.eib": "EiB",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"other": "%s commits"
+	},
+	"counters.n_branches": {
+		"one": "%s branch",
+		"other": "%s branches"
+	},
+	"counters.n_tags": {
+		"one": "%s tag",
+		"other": "%s tags"
+	},
+	"counters.n_releases": {
+		"one": "%s release",
+		"other": "%s releases"
+	},
 	"packages.title": "Packages",
 	"packages.empty": "There are no packages yet.",
 	"packages.empty.documentation": "For more information on the package registry, see <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">the documentation</a>.",
@@ -526,6 +672,11 @@
 	"actions.runs.no_results": "No results matched.",
 	"actions.runs.no_workflows": "There are no workflows yet.",
 	"actions.runs.all_runs_link": "all runs",
+	"actions.runs.delete.error_could_not_load_run": "Could not load run to delete.",
+	"actions.runs.delete.error_could_not_delete_run": "Could not delete run.",
+	"actions.runs.delete.button": "Delete run",
+	"actions.runs.delete.error": "Could not delete the workflow run.",
+	"actions.runs.delete.confirm_action": "Do you really want to delete this workflow run?",
 	"actions.workflow.job_parsing_error": "Unable to parse jobs in workflow: %v",
 	"actions.workflow.event_detection_error": "Unable to parse supported events in workflow: %v",
 	"actions.workflow.persistent_incomplete_matrix": "Unable to evaluate `strategy.matrix` of job %[1]s due to a `needs` expression that was invalid. It may reference a job that is not in it's 'needs' list (%[2]s), or an output that doesn't exist on one of those jobs.",
@@ -548,6 +699,21 @@
 	"actions.secrets.creation.value_description": "The value of a secret can be any text. Special characters are retained. CRLF (Windows-style line breaks) is automatically converted to LF. Encode the value with Base64 if linebreaks should be retained.",
 	"actions.variables.mutation.name_description": "The name of a variable can only contain letters, numbers, and underscores. It cannot be named CI or start with FORGEJO_, GITEA_, GITHUB_, or a number. Forgejo will automatically convert it to uppercase.",
 	"actions.variables.mutation.value_description": "A variable's value can be any text. Special characters are retained. CRLF (Windows-style line breaks) is automatically converted to LF. Encode the value with Base64 if linebreaks should be retained.",
+	"actions.variables": "Variables",
+	"actions.variables.management": "Manage variables",
+	"actions.variables.creation": "Add variable",
+	"actions.variables.creation.failed": "Failed to add variable.",
+	"actions.variables.creation.success": "The variable \"%s\" has been added.",
+	"actions.variables.none": "There are no variables yet.",
+	"actions.variables.deletion": "Remove variable",
+	"actions.variables.deletion.description": "Removing a variable is permanent and cannot be undone. Continue?",
+	"actions.variables.deletion.failed": "Failed to remove variable.",
+	"actions.variables.deletion.success": "The variable has been removed.",
+	"actions.variables.description": "Variables will be passed to certain actions and cannot be read otherwise.",
+	"actions.variables.edit": "Edit Variable",
+	"actions.variables.not_found": "Failed to find the variable.",
+	"actions.variables.update.failed": "Failed to edit variable.",
+	"actions.variables.update.success": "The variable has been edited.",
 	"actions.secrets.edit_button": "Edit secret \"%s\"",
 	"actions.secrets.mutation.header": "Edit secret \"%s\"",
 	"actions.secrets.mutation.success_message": "The secret \"%s\" has been updated.",
@@ -564,6 +730,10 @@
 	},
 	"teams.add_all_repos.modal.header": "Add all repositories",
 	"teams.remove_all_repos.modal.header": "Remove all repositories",
+	"members.add_member": "Add member",
+	"members.user": "User",
+	"members.user_already_member": "This user is already a member of the organization.",
+	"members.no_team_selected": "Organization members must belong to at least one team.",
 	"pulls.manual_merge.helper": "Manual merge helper",
 	"pulls.manual_merge.helpder.description": "Use this merge commit message when completing the merge manually.",
 	"pulls.manual_merge.commit.title": "Merge commit title",
@@ -580,6 +750,9 @@
 	"editor.toggle_case": "Toggle case sensitivity",
 	"editor.toggle_regex": "Toggle using regular expressions",
 	"editor.toggle_whole_word": "Toggle matching whole words",
+	"markup.filepreview.line": "Line %[1]d in %[2]s",
+	"markup.filepreview.lines": "Lines %[1]d to %[2]d in %[3]s",
+	"markup.filepreview.truncated": "Preview has been truncated",
 	"form.RunnerName": "Name",
 	"graphs.recent_commits.title": "Number of commits in the past year",
 	"graphs.code_frequency.title": "Code frequency over the history of {0}",
diff --git a/options/locale_next/locale_eo.json b/options/locale_next/locale_eo.json
index 20d9f4515c..2a6d16e1f5 100644
--- a/options/locale_next/locale_eo.json
+++ b/options/locale_next/locale_eo.json
@@ -1,4 +1,22 @@
 {
+	"markup.filepreview.truncated": "La superrigardo estas mallongigita",
+	"markup.filepreview.lines": "Linioj %[1]d ĝis %[2]d en %[3]s",
+	"markup.filepreview.line": "Linio %[1]d en %[2]s",
+	"actions.variables.update.success": "La variablo estas redaktita.",
+	"actions.variables.update.failed": "Ne eblas redakti la variablon.",
+	"actions.variables.creation.success": "La variablo \"%s\" estas aldonita.",
+	"webauthn.error.timeout": "Tempo elĉerpiĝis antaŭ legiĝo de via ŝlosilo. Bonvolu reenlegi la retpaĝon kaj reprovi.",
+	"webauthn.error.empty": "Vi devas agordi nomon por la ŝlosilo.",
+	"webauthn.error.duplicated": "La sekurŝlosilo ne rajtas fari tiun ĉi peton. Bonvolu certigi ke la ŝlosilo estas ne jam registrita.",
+	"webauthn.error.unable_to_process": "La servilo ne povis trakti vian peton.",
+	"webauthn.error.insecure": "La salutmaniero WebAuthn sole subtenas sekurajn konektiĝojn. Testante HTTP’e, oni uzu la retadreson «localhost» aŭ «127.0.0.1»",
+	"webauthn.error.unknown": "Eraris pro nekonata kialo. Bonvolu reprovi.",
+	"webauthn.unsupported_browser": "Via retfoliumilo ne jam subtenas la salutmanieron WebAuthn.",
+	"webauthn.error": "Ne povis legi vian sekurŝlosilon.",
+	"webauthn.use_twofa": "Uzi dumanieran salutkodon de via poŝtelefono",
+	"webauthn.press_button": "Bonvolu premi la butonon sur via sekurŝlosilo…",
+	"webauthn.sign_in": "Premu la butonon sur via sekurŝlosilo. Se mankas butono, elprenu kaj reenmetu vian sekurŝlosilon.",
+	"webauthn.insert_key": "Enmetu vian sekurŝlosilon",
 	"packages.npm.details.tag": "Etikedo",
 	"fork.n_forks": {
 		"one": "%s disbranĉigo",
@@ -52,6 +70,9 @@
 	"migrate.gitbucket.description": "Migrigi datumojn el GitBucket instancoj.",
 	"migrate.codebase.description": "Migrigi datumojn el codebasehq.com.",
 	"migrate.forgejo.description": "Migrigi datumojn el codeberg.org aŭ aliaj Forgejo instancoj.",
+	"migrate.items.pull_requests": "Tirpetoj",
+	"migrate.items.releases": "Eldonoj",
+	"migrate.in_progress.pulls": "Migrante tirpetojn",
 	"repo.settings.push_mirror.branch_filter.label": "Branĉa filtrilo (malnepra)",
 	"themes.names.forgejo-auto": "Forgejo (konformi kun sistema etoso)",
 	"themes.names.forgejo-light": "Forgejo hela",
diff --git a/options/locale_next/locale_es-ES.json b/options/locale_next/locale_es-ES.json
index 0867d108a7..a98e2e3d66 100644
--- a/options/locale_next/locale_es-ES.json
+++ b/options/locale_next/locale_es-ES.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Todos los elementos en la cola han sido eliminados.",
+	"admin.monitor.queue.settings.remove_all_items": "Eliminar todo",
+	"admin.monitor.queue.settings.changed": "Ajustes actualizados",
+	"admin.monitor.queue.settings.submit": "Actualizar ajustes",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "El número máximo de trabajadores debe ser un número",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Actualmente %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Número máximo de trabajadores",
+	"admin.monitor.queue.settings.description": "Los grupos de trabajadores crecen dinámicamente en respuesta al bloqueo de cola de sus trabajadores.",
+	"admin.monitor.queue.settings.title": "Ajustes del grupo",
+	"admin.monitor.queue.review_add": "Revisar / Añadir trabajadores",
+	"admin.monitor.queue.numberinqueue": "Número en cola",
+	"admin.monitor.queue.maxnumberworkers": "Nº máx de trabajadores",
+	"admin.monitor.queue.activeworkers": "Trabajadores activos",
+	"admin.monitor.queue.numberworkers": "Número de trabajadores",
+	"admin.monitor.queue.exemplar": "Ejemplo",
+	"admin.monitor.queue.type": "Tipo",
+	"admin.monitor.queue.name": "Nombre",
+	"admin.monitor.queue": "Cola: %s",
+	"admin.monitor.queues": "Colas",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA deshabilitado",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA habilitado",
+	"admin.users.list_status_filter.not_prohibit_login": "Permitir el inicio de sesión",
+	"admin.users.list_status_filter.is_prohibit_login": "Prohibido el inicio de sesión",
+	"admin.users.list_status_filter.not_restricted": "No restringido",
+	"admin.users.list_status_filter.is_restricted": "Restringido",
+	"admin.users.list_status_filter.not_admin": "No admin",
+	"admin.users.list_status_filter.is_admin": "Administrador",
+	"admin.users.list_status_filter.not_active": "Inactivo",
+	"admin.users.list_status_filter.is_active": "Activo",
+	"admin.users.list_status_filter.reset": "Reiniciar",
+	"admin.users.list_status_filter.menu_text": "Filtro",
+	"admin.system_status.gc_times": "Ejecuciones del recolector de basura",
+	"admin.system_status.last_gc_pause": "Última pausa por el recolector de basura",
+	"admin.system_status.total_gc_pause": "Pausa total por el recolector de basura",
+	"admin.system_status.last_gc_time": "Tiempo desde la última recolección de basura",
+	"admin.system_status.next_gc_recycle": "Siguiente reciclaje del recolector de basura",
+	"admin.system_status.other_system_allocation_obtained": "Otros recursos asignados del sistema",
+	"admin.system_status.gc_metadata_obtained": "Metadatos obtenidos del recolector de basura",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profiling bucket hash table obtenido",
+	"admin.system_status.mcache_structures_obtained": "Estructuras MCache obtenidas",
+	"admin.system_status.mcache_structures_usage": "Uso de estructuras MCache",
+	"admin.system_status.mspan_structures_obtained": "Estructuras MSpan obtenidas",
+	"admin.system_status.mspan_structures_usage": "Uso de estructuras MSpan",
+	"admin.system_status.stack_memory_obtained": "Memoria de pila obtenida",
+	"admin.system_status.bootstrap_stack_usage": "Uso de la pila de Bootstrap",
+	"admin.system_status.heap_objects": "Objetos en el Heap",
+	"admin.system_status.heap_memory_released": "Memoria de Heap liberada",
+	"admin.system_status.heap_memory_in_use": "Memoria de Heap en uso",
+	"admin.system_status.heap_memory_idle": "Memoria de Heap inactiva",
+	"admin.system_status.heap_memory_obtained": "Memoria de Heap obtenida",
+	"admin.system_status.current_heap_usage": "Uso actual de Heap",
+	"admin.system_status.memory_free_times": "Liberaciones de memoria",
+	"admin.system_status.memory_allocate_times": "Asignaciones de memoria",
+	"admin.system_status.pointer_lookup_times": "Tiempos de búsqueda de punteros",
+	"admin.system_status.memory_obtained": "Memoria obtenida",
+	"admin.system_status.total_memory_allocated": "Total de Memoria Reservada",
+	"admin.system_status.current_memory_usage": "Uso actual de memoria",
+	"admin.system_status.current_goroutine": "Gorutinas actuales",
+	"admin.system_status.server_uptime": "Tiempo de actividad del servidor",
+	"markup.filepreview.truncated": "La vista previa se ha truncado",
+	"markup.filepreview.lines": "Líneas %[1]d a %[2]d en %[3]s",
+	"markup.filepreview.line": "Línea %[1]d en %[2]s",
+	"actions.variables.update.success": "La variable ha sido editada.",
+	"actions.variables.update.failed": "Error al editar la variable.",
+	"actions.variables.creation.success": "La variable \"%s\" ha sido añadida.",
+	"actions.variables.creation.failed": "No se pudo agregar la variable.",
+	"actions.variables.deletion.success": "La variable ha sido eliminada.",
+	"actions.variables.deletion.failed": "No se pudo eliminar la variable.",
+	"actions.variables.not_found": "No se ha encontrado la variable.",
+	"actions.variables.edit": "Editar variable",
+	"actions.variables.description": "Las variables se pasarán a ciertas acciones y no se podrán leer de otro modo.",
+	"actions.variables.deletion.description": "Eliminar una variable es permanente y no se puede deshacer. ¿Continuar?",
+	"actions.variables.deletion": "Eliminar variable",
+	"actions.variables.none": "Aún no hay variables.",
+	"actions.variables.creation": "Añadir variable",
+	"actions.variables.management": "Gestión de variables",
+	"actions.variables": "Variables",
+	"webauthn.error.timeout": "Tiempo de espera máximo alcanzado antes de que su clave pudiese ser leída. Por favor, cargue la página y vuelva a intentarlo.",
+	"webauthn.error.empty": "Debe establecer un nombre para esta clave.",
+	"webauthn.error.duplicated": "La clave de seguridad no está permitida para esta solicitud. Por favor, asegúrese de que la clave no está ya registrada.",
+	"webauthn.error.unable_to_process": "El servidor no pudo procesar su solicitud.",
+	"webauthn.error.insecure": "WebAuthn sólo soporta conexiones seguras. Para probar sobre HTTP, puede utilizar el origen \"localhost\" o \"127.0.0.1\"",
+	"webauthn.error.unknown": "Ha ocurrido un error desconocido. Por favor, inténtelo de nuevo.",
+	"webauthn.unsupported_browser": "Actualmente su navegador no soporta WebAuthn.",
+	"webauthn.error": "No se pudo leer su llave de seguridad.",
+	"webauthn.use_twofa": "Utilice un código de doble factor desde su teléfono móvil",
+	"webauthn.press_button": "Por favor, presione el botón en su clave de seguridad…",
+	"webauthn.sign_in": "Presione el botón en su clave de seguridad. Si su clave de seguridad no tiene ningún botón, vuelva a insertarla.",
+	"webauthn.insert_key": "Introduzca su clave de seguridad",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"many": "%s commits",
+		"other": ""
+	},
+	"counters.n_branches": {
+		"one": "%s rama",
+		"many": "%s ramas",
+		"other": ""
+	},
+	"counters.n_tags": {
+		"one": "%s etiqueta",
+		"many": "%s etiquetas",
+		"other": ""
+	},
+	"counters.n_releases": {
+		"one": "%s lanzamiento",
+		"many": "%s versiones",
+		"other": ""
+	},
 	"actions.actions": "Acciones",
 	"actions.status.unknown": "Desconocido",
 	"actions.status.waiting": "Esperando",
@@ -355,6 +464,23 @@
 	"migrate.gitbucket.description": "Migrar datos de instancias de GitBucket.",
 	"migrate.codebase.description": "Migrar datos desde codebasehq.com.",
 	"migrate.forgejo.description": "Migrar datos desde codeberg.org u otras instancias de Forgejo.",
+	"migrate.items.label": "Objetos de migración",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Hitos",
+	"migrate.items.labels": "Etiquetas",
+	"migrate.items.issues": "Incidencias",
+	"migrate.items.pull_requests": "Solicitudes de extracción",
+	"migrate.items.merge_requests": "Solicitudes de fusión",
+	"migrate.items.releases": "Lanzamientos",
+	"migrate.in_progress.git": "Migrando datos de Git",
+	"migrate.in_progress.topics": "Migrando temas",
+	"migrate.in_progress.milestones": "Migrando hitos",
+	"migrate.in_progress.labels": "Migrando etiquetas",
+	"migrate.in_progress.releases": "Migrar versiones",
+	"migrate.in_progress.issues": "Migrando incidencias",
+	"migrate.in_progress.pulls": "Migrando solicitudes de incorporación de cambios",
+	"migrate.cancel.title": "Cancelar la migración",
+	"migrate.cancel.confirmation": "¿Quiere cancelar esta migración?",
 	"moderation.abuse_category.spam": "Spam",
 	"pulse.n_active_issues": {
 		"one": "%s incidencia activa",
@@ -418,10 +544,40 @@
 	"repo.pulls.poster_trust_always": "Siempre aprobar",
 	"repo.pulls.maintainers_can_edit": "Los mantenedores pueden editar esta solicitud de incorporación de cambios.",
 	"repo.pulls.maintainers_cannot_edit": "Los mantenedores no pueden editar esta solicitud de incorporación de cambios.",
+	"migrate.select.title": "Migrar repositorio",
 	"search.fuzzy": "Difuso",
 	"search.fuzzy_tooltip": "Incluir resultados es una coincidencia aproximada para el término de búsqueda",
 	"install.ssh_authorized_keys_unexpected_key": "Habilitar SSH para Forgejo en conflicto con el archivo localizado en %s que contiene claves SSH existentes. Sugerencia: utilice un sistema dedicado de usuario para Forgejo, o inhabilite SSH.",
 	"keys.verify.token.hint": "El token siempre es válido por 1 minuto. <a href=\"%[1]s\">Obtenga uno nuevo si caduca</a>.",
+	"admin.federation.federation": "Federación",
+	"admin.federation.hosts": "Hospedajes",
+	"admin.federation.hosts.title": "Hospedajes de la Federación",
+	"admin.federation.hosts.manage_panel": "Gestionar hospedajes de federación",
+	"admin.federation.hosts.details_panel": "Detalles de hospedajes de federación",
+	"admin.federation.hosts.show_details": "Muestra detalles del hospedaje",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.port": "Puerto",
+	"admin.federation.host.software_name": "Software",
+	"admin.federation.host.created": "Creado",
+	"admin.federation.host.updated": "Actualizado",
+	"admin.federation.host.latest_activity": "Actividad última",
+	"admin.federation.users": "Usuarios",
+	"admin.federation.users.title": "Usuarios federados",
+	"admin.federation.users.manage_panel": "Gestionar usuarios federados",
+	"admin.federation.users.show_local_user": "Muestra detalles de usuario local",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID de usuario local",
+	"admin.federation.user.external_id": "ID de usuario externo",
+	"admin.federation.user.inbox_path": "Ruta de buzón",
+	"admin.config.federation": "Configuración de federación",
+	"admin.config.federation.enabled": "Habilitado",
+	"admin.config.federation.share_user_statistics": "Compartir estadísticas de usuario con otros huéspedes",
+	"admin.config.federation.max_size": "Tamaño máximo de respuesta concedida",
+	"admin.config.federation.signature_enforced": "Requiere firmas HTTP",
+	"admin.config.federation.signature_algorithms": "Algoritmo de firma",
+	"admin.config.federation.digest_algorithm": "Algoritmo digest de firma",
+	"admin.config.federation.get_headers": "Cabeceras GET firmadas",
+	"admin.config.federation.post_headers": "Cabeceras POST firmadas",
 	"moderation.report.mark_as_handled": "Marcar como manipulado",
 	"moderation.users.cannot_suspend_self": "No se puede suspenderse para sí.",
 	"moderation.users.cannot_delete_admins": "Los usuarios con privilegios admin no pueden ser eliminados.",
@@ -449,6 +605,11 @@
 	"settings.specific_repo_access": "Acceso al repositorio",
 	"settings.new_access_token": "Nuevo token de acceso",
 	"settings.permissions_access_specific_repositories": "Repositorios específicos",
+	"settings.access_token.selected_repositories": {
+		"one": "Repositorio seleccionado (%d)",
+		"many": "Repositorios seleccionados (%d)",
+		"other": "Repositorios seleccionados (%d)"
+	},
 	"settings.access_token.available_repositories": "Repositorios disponibles",
 	"settings.access_token.no_repositories_selected": "Ningún repositorio seleccionado.",
 	"settings.access_token.no_repositories_found": "Ningún repositorio encontrado.",
@@ -459,6 +620,8 @@
 	"settings.access_token.admin_disabled": "Los permisos administrativos están inhabilitados.",
 	"error.must_enable_2fa": "Esta instancia de Forgejo requiere usuarios para habilitar autenticación de dos factores antes que puedan acceder a sus cuentas. Habilítela en: %s",
 	"avatar.constraints_hint": "El avatar personal puede superar %[1]s en tamaño o sea mayor que %[2]dx%[3]d píxeles",
+	"user.activitypub_feed.posted_on": "Publicado en %[1]s",
+	"user.activitypub_feed.original_source": "Fuente original",
 	"user.ghost.tooltip": "Este usuario ha sido eliminado, o no puede ser emparejado.",
 	"og.repo.summary_card.alt_description": "Ficha resumen del repositorio %[1]s, descrito como: %[2]s",
 	"repo.commit.load_tags_failed": "La carga de etiquetas falló debido a un error interno",
@@ -480,8 +643,8 @@
 	"actions.runners.version": "Versión",
 	"actions.runners.list_runners.edit_column": "Editar",
 	"actions.runners.list_runners.delete_column": "Eliminar",
-	"actions.runners.list_runners.delete_button": "Eliminar",
-	"actions.runners.list_runners.delete_button_aria": "Eliminar",
 	"teams.remove_all_repos.modal.header": "Retira todos los repositorios",
-	"admin.auths.oauth2_quota_group_map_removal": "Retire los usuarios desde los grupos de cuota sincronizados si el usuario no pertenece al grupo correspondiente."
+	"admin.auths.oauth2_quota_group_map_removal": "Retire los usuarios desde los grupos de cuota sincronizados si el usuario no pertenece al grupo correspondiente.",
+	"actions.runners.list_runners.delete_button": "Eliminar",
+	"actions.runners.list_runners.delete_button_aria": "Eliminar"
 }
diff --git a/options/locale_next/locale_et.json b/options/locale_next/locale_et.json
index 239e73968f..c3246e4185 100644
--- a/options/locale_next/locale_et.json
+++ b/options/locale_next/locale_et.json
@@ -1,4 +1,25 @@
 {
+	"actions.variables.deletion": "Eemalda muutuja",
+	"actions.variables.none": "Muutujaid veel pole.",
+	"actions.variables.creation": "Lisa muutuja",
+	"actions.variables.management": "Halda muutujaid",
+	"actions.variables": "Muutujad",
+	"webauthn.error.timeout": "Päring aegus enne võtme lugemist. Palun laadi see lehekülg uuesti ja proovi uuesti.",
+	"webauthn.error.empty": "Palun lisa sellele võtmele täisnimi.",
+	"webauthn.error.duplicated": "Turvavõti ei ole selle päringu puhul lubatud. Palun veendu, et võti ei ole juba registreeritud.",
+	"webauthn.error.unable_to_process": "Server ei saanud sinu päringut töödelda.",
+	"webauthn.error.insecure": "WebAuthn toetab ainult turvalisi ühendusi. HTTP kaudu testimiseks võid kasutada lähteaadressina „localhost“ või „127.0.0.1“",
+	"webauthn.error.unknown": "Tekkis tundmatu viga. Palun proovi uuesti.",
+	"webauthn.unsupported_browser": "Sinu veebibrauser ei toeta praegu WebAuthn-liidestust.",
+	"webauthn.error": "Sinu turvavõtit ei saanud lugeda.",
+	"webauthn.use_twofa": "Sisesta oma telefonist kahefaktorilise autentimise kood",
+	"webauthn.press_button": "Palun vajuta turvavõtme nuppu…",
+	"webauthn.sign_in": "Vajuta turvavõtme nuppu. Kui sinu turvavõtmel ei ole nuppu, sisesta see uuesti.",
+	"webauthn.insert_key": "Sisesta oma turvavõti",
+	"counters.n_branches": {
+		"one": "%s alamharu",
+		"other": "%s alamharu"
+	},
 	"packages.alpine.repository.branches": "Alamharud",
 	"stars.n_stars": {
 		"one": "%s tärn",
@@ -82,5 +103,6 @@
 	"repo.pulls.poster_trust_deny.tooltip": "Töövood, mis ootavad heakskiitu, tühistatakse.",
 	"repo.pulls.poster_trust_once": "Luba üks kord",
 	"repo.pulls.poster_trust_always": "Luba alati",
-	"repo.pulls.poster_trust_revoke": "Tühista"
+	"repo.pulls.poster_trust_revoke": "Tühista",
+	"migrate.select.title": "Migreeri hoidla"
 }
diff --git a/options/locale_next/locale_eu.json b/options/locale_next/locale_eu.json
index e1940e1e14..463859b1a4 100644
--- a/options/locale_next/locale_eu.json
+++ b/options/locale_next/locale_eu.json
@@ -1,3 +1,15 @@
 {
+	"webauthn.error.timeout": "Zure gakoa irakurri aurretik denbora-muga gainditu da. Kargatu berriro orrialde hau eta saiatu berriro.",
+	"webauthn.error.empty": "Gako honetarako izen bat jarri behar duzu.",
+	"webauthn.error.duplicated": "Segurtasun-gakorik ez da onartzen eskaera honetarako. Mesedez, ziurtatu giltza ea dagoela erregistratuta.",
+	"webauthn.error.unable_to_process": "Zerbitzariak ezin izan du zure eskaera prozesatu.",
+	"webauthn.error.insecure": "WebAuthnek konexio seguruak baino ez ditu onartzen. HTTP bidez probatzeko, \"localhost\" edo \"127.0.0.1\" jatorria erabil daiteke",
+	"webauthn.error.unknown": "Akats ezezagun bat gertatu da. Mesedez, saiatu berriro.",
+	"webauthn.unsupported_browser": "Zure nabigatzaileak ez du WebAuthn onartzen.",
+	"webauthn.error": "Ezin izan da irakurri zure segurtasun-gakoa.",
+	"webauthn.use_twofa": "Erabili zure telefonoko bi faktoreko kodea",
+	"webauthn.press_button": "Mesedez, sakatu botoia zure segurtasun-gakoan…",
+	"webauthn.sign_in": "Sakatu botoia zure segurtasun-gakoan. Zure segurtasun-gakoak ez badu botoirik, sartu berriro.",
+	"webauthn.insert_key": "Sartu zure segurtasun-gakoa",
 	"meta.last_line": " "
 }
diff --git a/options/locale_next/locale_fa-IR.json b/options/locale_next/locale_fa-IR.json
index 72dec1fc85..91c2e5f3bd 100644
--- a/options/locale_next/locale_fa-IR.json
+++ b/options/locale_next/locale_fa-IR.json
@@ -1,4 +1,79 @@
 {
+	"admin.monitor.queue.settings.changed": "تنظیمات تازه شد",
+	"admin.monitor.queue.settings.submit": "بالا بردن ساماندهی",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "حداکثر تعداد کارگران باید یک عدد باشد",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "در حال حاضر %[1]v",
+	"admin.monitor.queue.settings.maxnumberworkers": "بیشینه تعداد کارگران",
+	"admin.monitor.queue.settings.title": "تنظیمات استخر",
+	"admin.monitor.queue.maxnumberworkers": "بیشینه تعداد کارگران",
+	"admin.monitor.queue.numberworkers": "تعداد کارگران",
+	"admin.monitor.queue.exemplar": "نوع نمونه",
+	"admin.monitor.queue.type": "نوع",
+	"admin.monitor.queue.name": "نام",
+	"admin.monitor.queue": "صف: %s",
+	"admin.monitor.queues": "صف ها",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA غیرفعال است",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA فعال است",
+	"admin.users.list_status_filter.not_prohibit_login": "اجازه ورود",
+	"admin.users.list_status_filter.is_prohibit_login": "ورود را ممنوع شود",
+	"admin.users.list_status_filter.not_restricted": "محدود نشده است",
+	"admin.users.list_status_filter.is_restricted": "محصور",
+	"admin.users.list_status_filter.not_admin": "غیرادمین",
+	"admin.users.list_status_filter.is_admin": "ادمین",
+	"admin.users.list_status_filter.not_active": "غیرفعال",
+	"admin.users.list_status_filter.is_active": "فعال",
+	"admin.users.list_status_filter.reset": "شروع دوباره",
+	"admin.users.list_status_filter.menu_text": "فیلتر",
+	"admin.system_status.gc_times": "زمان های GC",
+	"admin.system_status.last_gc_pause": "واپسین مکث در GC",
+	"admin.system_status.total_gc_pause": "کل زمان مکث GC",
+	"admin.system_status.last_gc_time": "زمان از آخرین GC",
+	"admin.system_status.next_gc_recycle": "بازیافت GC بعدی",
+	"admin.system_status.other_system_allocation_obtained": "تخصیص های حافظه در سایر قسمت های سیستم",
+	"admin.system_status.gc_metadata_obtained": "متادیتاهای بدست امده از GC",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profiling Bucket Hash Table به دست آمده",
+	"admin.system_status.mcache_structures_obtained": "ساختار های MCache به دست آمده",
+	"admin.system_status.mcache_structures_usage": "میزان استفاده از ساختار های MCache",
+	"admin.system_status.mspan_structures_obtained": "ساختار های MSpan به دست آمده",
+	"admin.system_status.mspan_structures_usage": "میزان استفاده‌ی ساختار های MSpan",
+	"admin.system_status.stack_memory_obtained": "حافظه پشته به دست آمده",
+	"admin.system_status.bootstrap_stack_usage": "میزان استفاده از پشته توسط راهنداز",
+	"admin.system_status.heap_objects": "شی توده یا Heap",
+	"admin.system_status.heap_memory_released": "حافظه توده آزاد شد",
+	"admin.system_status.heap_memory_in_use": "حافظه توده در حال استفاده",
+	"admin.system_status.heap_memory_idle": "بیکار بوده حافظه توده",
+	"admin.system_status.heap_memory_obtained": "حافظه به دست آمده برای توده",
+	"admin.system_status.current_heap_usage": "میزان مصرف توده فعلی",
+	"admin.system_status.memory_free_times": "آزادسازی حافظه",
+	"admin.system_status.memory_allocate_times": "تخصیص یافتن حافظه",
+	"admin.system_status.pointer_lookup_times": "اشاره‌گر زمان‌های جستجو",
+	"admin.system_status.memory_obtained": "حافظه به دست آمده",
+	"admin.system_status.total_memory_allocated": "کل حافظه اختصاص داده شده",
+	"admin.system_status.current_memory_usage": "میزان مصرف فعلی از حافظه",
+	"admin.system_status.current_goroutine": "Goroutine های فعلی",
+	"admin.system_status.server_uptime": "فعالیت بی‌وقفه سرور",
+	"actions.variables.update.success": "تغییر متغیر با موفقیت انجام شد.",
+	"actions.variables.update.failed": "عدم موفقیت در تغییر متغیر",
+	"actions.variables.creation.success": "متغیر \"%s\" ایجاد شد.",
+	"actions.variables.deletion.success": "متغیر حذف شد.",
+	"actions.variables.edit": "تغییر متغیر",
+	"actions.variables.deletion": "حذف متغیر",
+	"actions.variables.none": "هیچ متغیری هنوز وجود ندارد.",
+	"actions.variables.creation": "افزودن متغیر",
+	"actions.variables.management": "مدیریت متغیرها",
+	"actions.variables": "متغیرها",
+	"webauthn.error.timeout": "مهلت زمانی قبل از اینکه کلید شما خوانده شود تمام شد. لطفاً این صفحه را تازه‌سازی کرده و مجدد تلاش کنید.",
+	"webauthn.error.empty": "شما باید یک نام برای این کلید انتخاب کنید.",
+	"webauthn.error.duplicated": "کلید امنیتی برای این درخواست مجاز نیست. لطفاً مطمئن شوید که این کلید در حال حاضر ثبت نشده است.",
+	"webauthn.error.unable_to_process": "کارساز نتوانست درخواست شما را پردازش کند.",
+	"webauthn.error.insecure": "احرازوب فقط از روش‌های ایمن ممکن است. برای آزمودن بر روی اچ‌تی‌تی‌پی می‌توانید از «میزبان‌محلی» یا «۱۲۷.۰.۰.۱» استفاده کنید.",
+	"webauthn.error.unknown": "خطایی ناشناخته رخ داد. لطفاً دوباره سعی کنید.",
+	"webauthn.unsupported_browser": "مرورگر شما در حال حاضر از WebAuthn پشتیبانی نمی‌کند.",
+	"webauthn.error": "کلید امنیتی شما نتوانست خوانده شود.",
+	"webauthn.use_twofa": "از یک کد دومرحله‌ای از تلفنتان استفاده کنید",
+	"webauthn.press_button": "لطفاً دکمۀ روی کلید امنیتی را فشار دهید…",
+	"webauthn.sign_in": "دکمۀ روی کلید امنیتی را فشار دهید. اگر کلید امنیتی شما دکمه‌ای ندارد، آن را دوباره وارد کنید.",
+	"webauthn.insert_key": "کلید امنیتی خود را وارد کنید",
 	"actions.runners.name": "نام",
 	"actions.runners.owner_type": "نوع",
 	"actions.runners.description": "شرح",
@@ -52,6 +127,21 @@
 	"migrate.onedev.description": "مهاجرت داده از code.onedev.io یا پیاده‌سازی‌های دیگر OneDev.",
 	"migrate.gitbucket.description": "مهاجرت داده از نمونه های GitBucket",
 	"migrate.codebase.description": "مهاجر داده ها از codebasehq.com.",
+	"migrate.items.label": "مولفه های مهاجرت",
+	"migrate.items.wiki": "دانشنامه",
+	"migrate.items.milestones": "نقاط عطف",
+	"migrate.items.labels": "برچسب‌ها",
+	"migrate.items.issues": "مسائل",
+	"migrate.items.pull_requests": "تقاضاهای واکشی",
+	"migrate.items.merge_requests": "تقاضاهای واکشی",
+	"migrate.items.releases": "انتشارها",
+	"migrate.in_progress.git": "انتقال داده های Git",
+	"migrate.in_progress.topics": "موضوعات مهاجرت",
+	"migrate.in_progress.milestones": "نقاط عطف مهاجرت",
+	"migrate.in_progress.labels": "برچسب های مهاجرت",
+	"migrate.in_progress.releases": "انتشارات مهاجرت",
+	"migrate.in_progress.issues": "مشکلات مهاجرت",
+	"migrate.in_progress.pulls": "مهاجرت درخواست های pull",
 	"pulse.n_active_issues": {
 		"one": "%s مسئله فعال",
 		"other": "%s مسئله فعال"
diff --git a/options/locale_next/locale_fi-FI.json b/options/locale_next/locale_fi-FI.json
index e2862e49a2..11de17d613 100644
--- a/options/locale_next/locale_fi-FI.json
+++ b/options/locale_next/locale_fi-FI.json
@@ -1,4 +1,96 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Kaikki jonossa olleet tietueet on poistettu.",
+	"admin.monitor.queue.settings.remove_all_items": "Poista kaikki",
+	"admin.monitor.queue.settings.changed": "Asetukset päivitetty",
+	"admin.monitor.queue.settings.submit": "Päivitä asetukset",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Tällä hetkellä %[1]d",
+	"admin.monitor.queue.type": "Tyyppi",
+	"admin.monitor.queue.name": "Nimi",
+	"admin.monitor.queue": "Jono: %s",
+	"admin.monitor.queues": "Jonot",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA ei käytössä",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA käytössä",
+	"admin.users.list_status_filter.not_prohibit_login": "Kirjautuminen sallittu",
+	"admin.users.list_status_filter.is_prohibit_login": "Kirjautuminen estetty",
+	"admin.users.list_status_filter.not_restricted": "Ei rajoitettu",
+	"admin.users.list_status_filter.is_restricted": "Rajoitettu",
+	"admin.users.list_status_filter.not_admin": "Ei ylläpitäjä",
+	"admin.users.list_status_filter.is_admin": "Ylläpitäjä",
+	"admin.users.list_status_filter.not_active": "Ei-aktiivinen",
+	"admin.users.list_status_filter.is_active": "Aktiivinen",
+	"admin.users.list_status_filter.reset": "Tyhjennä",
+	"admin.users.list_status_filter.menu_text": "Suodata",
+	"admin.system_status.gc_times": "Roskienkeruuajat",
+	"admin.system_status.last_gc_pause": "Viimeinen roskienkeruutauko",
+	"admin.system_status.total_gc_pause": "Yhteensä roskienkeruutauko",
+	"admin.system_status.last_gc_time": "Aika edellisestä roskienkeruusta",
+	"admin.system_status.next_gc_recycle": "Seuraava roskienkeruukierrätys",
+	"admin.system_status.other_system_allocation_obtained": "Muu järjestestelmän varaus saatu",
+	"admin.system_status.gc_metadata_obtained": "Roskienkeruumetatiedot saatu",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profilointiämpäritiivistetaulukko saatu",
+	"admin.system_status.mcache_structures_obtained": "MCache-rakenteet saatu",
+	"admin.system_status.mcache_structures_usage": "MCache-rakenteiden käyttö",
+	"admin.system_status.mspan_structures_obtained": "MSpan-rakenteet saatu",
+	"admin.system_status.mspan_structures_usage": "MSpan-rakenteiden käyttö",
+	"admin.system_status.stack_memory_obtained": "Pinonmuisti saatu",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap-pinon käyttö",
+	"admin.system_status.heap_objects": "Heap-objektit",
+	"admin.system_status.heap_memory_released": "Heap-muisti vapautettu",
+	"admin.system_status.heap_memory_in_use": "Heap-muisti käytössä",
+	"admin.system_status.heap_memory_idle": "Heap-muisti tyhjäkäynnillä",
+	"admin.system_status.heap_memory_obtained": "Heap-muisti saatu",
+	"admin.system_status.current_heap_usage": "Nykyinen heapin käyttö",
+	"admin.system_status.memory_allocate_times": "Muistiallokaatiot",
+	"admin.system_status.pointer_lookup_times": "Osoittimen hakuajat",
+	"admin.system_status.memory_obtained": "Muistia saatu",
+	"admin.system_status.total_memory_allocated": "Yhteensä muistia varattu",
+	"admin.system_status.current_memory_usage": "Nykyinen muistinkäyttö",
+	"admin.system_status.current_goroutine": "Nykyiset goroutinet",
+	"admin.system_status.server_uptime": "Palvelimen uptime",
+	"markup.filepreview.truncated": "Esikatselu on typistetty",
+	"actions.variables.update.success": "Muuttuja muokattu.",
+	"actions.variables.update.failed": "Muuttujan muokkaus epäonnistui.",
+	"actions.variables.creation.success": "Muuttuja \"%s\" lisätty.",
+	"actions.variables.creation.failed": "Muuttujan lisäys epäonnistui.",
+	"actions.variables.deletion.success": "Muuttuja poistettu.",
+	"actions.variables.deletion.failed": "Muuttujan poisto epäonnistui.",
+	"actions.variables.not_found": "Muuttujaa ei löytynyt.",
+	"actions.variables.edit": "Muokkaa muuttujaa",
+	"actions.variables.description": "Muuttujat asetetaan tietyille toiminnoille eikä niitä voida lukea muutoin.",
+	"actions.variables.deletion.description": "Muuttujan poistaminen on lopullista, eikä sitä voi perua. Jatketaanko?",
+	"actions.variables.deletion": "Poista muuttuja",
+	"actions.variables.none": "Ei muuttujia vielä.",
+	"actions.variables.creation": "Lisää muuttuja",
+	"actions.variables.management": "Hallitse muuttujia",
+	"actions.variables": "Muuttujat",
+	"webauthn.error.timeout": "Aikakatkaisu ennen kuin avaintasi voitiin lukea. Lataa tämä sivu uudelleen ja yritä uudelleen.",
+	"webauthn.error.empty": "Sinun täytyy asettaa nimi tälle avaimelle.",
+	"webauthn.error.duplicated": "Turva-avainta ei ole sallittu tässä pyynnössä. Varmista, ettei avainta ole jo rekisteröity.",
+	"webauthn.error.unable_to_process": "Palvelin ei pystynyt käsittelemään pyyntöä.",
+	"webauthn.error.insecure": "WebAuthn tukee vain turvallisia yhteyksiä. Testaamista varten HTTP-välityksellä voit käyttää alkuperää \"localhost\" tai \"127.0.0.1\"",
+	"webauthn.error.unknown": "Tuntematon virhe. Yritä uudelleen.",
+	"webauthn.unsupported_browser": "Selaimesi ei tällä hetkellä tue WebAuthnia.",
+	"webauthn.error": "Turva-avainta ei voitu lukea.",
+	"webauthn.use_twofa": "Käytä kaksivaihesta todennusta puhelimestasi",
+	"webauthn.press_button": "Paina turva-avaimesi painiketta…",
+	"webauthn.sign_in": "Paina turva-avaimesi painiketta. Jos turva-avaimessasi ei ole painiketta, irrota se ja aseta uudelleen.",
+	"webauthn.insert_key": "Aseta turva-avaimesi",
+	"counters.n_commits": {
+		"one": "%s kommitti",
+		"other": "%s kommittia"
+	},
+	"counters.n_branches": {
+		"one": "%s haara",
+		"other": "%s haaraa"
+	},
+	"counters.n_tags": {
+		"one": "%s tagi",
+		"other": "%s tagia"
+	},
+	"counters.n_releases": {
+		"one": "%s julkaisu",
+		"other": "%s julkaisua"
+	},
 	"gpg.default_key": "Allekirjoitettu oletusavaimella",
 	"gpg.error.extract_sign": "Allekirjoituksen purkaminen epäonnistui",
 	"gpg.error.generate_hash": "Kommitin tiivisteen luominen epäonnistui",
@@ -284,6 +376,23 @@
 	"migrate.gitbucket.description": "Tee migraatio GitBucket-instansseista.",
 	"migrate.codebase.description": "Tee migraatio codebasehq.comista.",
 	"migrate.forgejo.description": "Tee migraatio codeberg.orgista tai muista Forgejo-instansseista.",
+	"migrate.items.label": "Migraation kohteet",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Merkkipaalut",
+	"migrate.items.labels": "Nimilaput",
+	"migrate.items.issues": "Ongelmat",
+	"migrate.items.pull_requests": "Vetopyynnöt",
+	"migrate.items.merge_requests": "Yhdistämispyynnöt",
+	"migrate.items.releases": "Julkaisut",
+	"migrate.in_progress.git": "Suoritetaan Git-datan migraatiota",
+	"migrate.in_progress.topics": "Suoritetaan aiheiden migraatiota",
+	"migrate.in_progress.milestones": "Suoritetaan merkkipaalujen migraatiota",
+	"migrate.in_progress.labels": "Suoritetaan nimilappujen migraatiota",
+	"migrate.in_progress.releases": "Suoritetaan julkaisujen migraatiota",
+	"migrate.in_progress.issues": "Suoritetaan ongelmien migraatiota",
+	"migrate.in_progress.pulls": "Suoritetaan vetopyyntöjen migraatiota",
+	"migrate.cancel.title": "Peruuta migraatio",
+	"migrate.cancel.confirmation": "Haluatko perua tämän migraation?",
 	"moderation.report_abuse_form.invalid": "Virheelliset argumentit",
 	"admin.config.security": "Turvallisuusasetukset",
 	"admin.config.global_2fa_requirement.title": "Globaali kaksivaiheisen tunnistuksen vaatimus",
diff --git a/options/locale_next/locale_fil.json b/options/locale_next/locale_fil.json
index d700dd9792..0b3a418f44 100644
--- a/options/locale_next/locale_fil.json
+++ b/options/locale_next/locale_fil.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Tinanggal na ang lahat ng mga item sa queue.",
+	"admin.monitor.queue.settings.remove_all_items": "Tanggalin lahat",
+	"admin.monitor.queue.settings.changed": "Na-update ang mga setting",
+	"admin.monitor.queue.settings.submit": "I-update ang mga setting",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Dapat numero ang pinakamaraming numero ng mga worker",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Kasalukuyang %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Pinakamaraming numero ng worker",
+	"admin.monitor.queue.settings.description": "Dinamikang lumalaki ang mga pool tugon sa kanilang worker queue blocking.",
+	"admin.monitor.queue.settings.title": "Mga setting ng pool",
+	"admin.monitor.queue.review_add": "Suriin / magdagdag ng mga worker",
+	"admin.monitor.queue.numberinqueue": "Number sa queue",
+	"admin.monitor.queue.maxnumberworkers": "Pinakamaraming numero ng worker",
+	"admin.monitor.queue.activeworkers": "Mga aktibong worker",
+	"admin.monitor.queue.numberworkers": "Numero ng mga worker",
+	"admin.monitor.queue.exemplar": "Uri ng Exemplar",
+	"admin.monitor.queue.type": "Uri",
+	"admin.monitor.queue.name": "Pangalan",
+	"admin.monitor.queue": "Queue: %s",
+	"admin.monitor.queues": "Mga queue",
+	"admin.users.list_status_filter.not_2fa_enabled": "Naka-disable ang 2FA",
+	"admin.users.list_status_filter.is_2fa_enabled": "Naka-enable ang 2FA",
+	"admin.users.list_status_filter.not_prohibit_login": "Pinapayagan ang pag-login",
+	"admin.users.list_status_filter.is_prohibit_login": "Pinagbawalan ang pag-login",
+	"admin.users.list_status_filter.not_restricted": "Hindi pinaghihigpitan",
+	"admin.users.list_status_filter.is_restricted": "Pinaghihigpitan",
+	"admin.users.list_status_filter.not_admin": "Hindi tagapangasiwa",
+	"admin.users.list_status_filter.is_admin": "Tagapangasiwa",
+	"admin.users.list_status_filter.not_active": "Hindi aktibo",
+	"admin.users.list_status_filter.is_active": "Aktibo",
+	"admin.users.list_status_filter.reset": "I-reset",
+	"admin.users.list_status_filter.menu_text": "Isaasyos",
+	"admin.system_status.gc_times": "Mga oras ng GC",
+	"admin.system_status.last_gc_pause": "Huling GC pause",
+	"admin.system_status.total_gc_pause": "Kabuuang GC pause",
+	"admin.system_status.last_gc_time": "Oras noong huling GC",
+	"admin.system_status.next_gc_recycle": "Susunod na GC recycle",
+	"admin.system_status.other_system_allocation_obtained": "Ibang allocation ng sistema na nakuha",
+	"admin.system_status.gc_metadata_obtained": "Nakuhang GC metadata",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Mga nakuhang profiling bucket hash table",
+	"admin.system_status.mcache_structures_obtained": "Mga nakuhang MCache structure",
+	"admin.system_status.mcache_structures_usage": "Paggamit ng MCache structure",
+	"admin.system_status.mspan_structures_obtained": "Mga nakuhang MSpan structure",
+	"admin.system_status.mspan_structures_usage": "Paggamit ng MSpan structure",
+	"admin.system_status.stack_memory_obtained": "Nakuhang stack memory",
+	"admin.system_status.bootstrap_stack_usage": "Paggamit ng bootstrap stack",
+	"admin.system_status.heap_objects": "Mga heap object",
+	"admin.system_status.heap_memory_released": "Mga na-release na heap memory",
+	"admin.system_status.heap_memory_in_use": "Ginagamit na heap memory",
+	"admin.system_status.heap_memory_idle": "Idle ng heap memory",
+	"admin.system_status.heap_memory_obtained": "Nakuhang heap memory",
+	"admin.system_status.current_heap_usage": "Kasalukuyang paggamit ng heap",
+	"admin.system_status.memory_free_times": "Mga memory free",
+	"admin.system_status.memory_allocate_times": "Mga allocation ng memory",
+	"admin.system_status.pointer_lookup_times": "Oras ng pointer lookup",
+	"admin.system_status.memory_obtained": "Mga nakuhang memory",
+	"admin.system_status.total_memory_allocated": "Kabuuan na na-allocate na memory",
+	"admin.system_status.current_memory_usage": "Kasalukuyang paggamit ng memory",
+	"admin.system_status.current_goroutine": "Mga kasalukuyang goroutine",
+	"admin.system_status.server_uptime": "Uptime ng server",
+	"markup.filepreview.truncated": "Na-truncate ang preview",
+	"markup.filepreview.lines": "Mga linya %[1]d hanggang %[2]d sa %[3]s",
+	"markup.filepreview.line": "Linya %[1]d sa %[2]s",
+	"actions.variables.update.success": "Nabago na ang variable.",
+	"actions.variables.update.failed": "Nabigong baguhin ang variable.",
+	"actions.variables.creation.success": "Nadagdag na ang variable na \"%s\".",
+	"actions.variables.creation.failed": "Nabigong idagdag ang variable.",
+	"actions.variables.deletion.success": "Tinanggal na ang variable.",
+	"actions.variables.deletion.failed": "Nabigong tanggalin ang variable.",
+	"actions.variables.not_found": "Nabigong hanapin ang variable.",
+	"actions.variables.edit": "Baguhin ang Variable",
+	"actions.variables.description": "Ipapasa ang mga variable sa ilang mga aksyon at hindi mababasa kung hindi man.",
+	"actions.variables.deletion.description": "Permanente ang pagtanggal ng isang variable at hindi ito mababalik. Magpatuloy?",
+	"actions.variables.deletion": "Tanggalin ang variable",
+	"actions.variables.none": "Wala pang mga variable sa ngayon.",
+	"actions.variables.creation": "Magdagdag ng variable",
+	"actions.variables.management": "Ipamahala ang mga variable",
+	"actions.variables": "Mga variable",
+	"webauthn.error.timeout": "Naabot ang timeout bago mabasa ang iyong key. Mangyaring i-reload ang page na ito at subukan muli.",
+	"webauthn.error.empty": "Kailangan mong maglapat ng pangalan para sa key na ito.",
+	"webauthn.error.duplicated": "Hindi pinapayagan ang security key na ito para sa hiling na ito. Mangyaring siguraduhin na ang key na ito ay hindi ito nakarehistro na.",
+	"webauthn.error.unable_to_process": "Hindi maproseso ng server ang iyong hiling.",
+	"webauthn.error.insecure": "Sinusuportahan lamang ng WebAuthn ang mga secure na koneksyon. Para sa pagsubok sa HTTP, pwede mo gamitin ang origin na \"localhost\" o \"127.0.0.1\"",
+	"webauthn.error.unknown": "May nangyaring hindi alam na error. Magyaring subukan muli.",
+	"webauthn.unsupported_browser": "Kasalukuyang hindi sinusuportahan ng iyong browser ang WebAuthn.",
+	"webauthn.error": "Hindi mabasa ang iyong security key.",
+	"webauthn.use_twofa": "Gumamit ng two-factor code galing sa iyong telepono",
+	"webauthn.press_button": "Pindutin ang button ng iyong security key…",
+	"webauthn.sign_in": "Pindutin ang button ng iyong security key. Kung walang button ang iyong security key, ilagay muli.",
+	"webauthn.insert_key": "Ilagay ang iyong security key",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"other": "%s mga commit"
+	},
+	"counters.n_branches": {
+		"one": "%s branch",
+		"other": "%s mga branch"
+	},
+	"counters.n_tags": {
+		"one": "%s tag",
+		"other": "%s mga tag"
+	},
+	"counters.n_releases": {
+		"one": "%s release",
+		"other": "%s mga release"
+	},
 	"gpg.default_key": "Naka-sign gamit ang default key",
 	"gpg.error.extract_sign": "Nabigong i-extract ang signature",
 	"gpg.error.generate_hash": "Nabigong i-generate ang hash ng commit",
@@ -323,6 +428,23 @@
 	"migrate.gitbucket.description": "Mag-migrate ng data mula sa mga GitBucket na instansya.",
 	"migrate.codebase.description": "Mag-migrate ng data mula sa codebasehq.com.",
 	"migrate.forgejo.description": "Mag-migrate ng data mula sa codeberg.org o iba pang mga Forgejo na instansya.",
+	"migrate.items.label": "Mga item sa pagmigrate",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Mga milestone",
+	"migrate.items.labels": "Mga label",
+	"migrate.items.issues": "Mga isyu",
+	"migrate.items.pull_requests": "Mga hiling sa paghila",
+	"migrate.items.merge_requests": "Mga merge request",
+	"migrate.items.releases": "Mga paglabas",
+	"migrate.in_progress.git": "Nililipat ang Git data",
+	"migrate.in_progress.topics": "Nililipat ang mga paksa",
+	"migrate.in_progress.milestones": "Nililipat ang mga milestone",
+	"migrate.in_progress.labels": "Nililipat ang mga label",
+	"migrate.in_progress.releases": "Nililipat ang mga paglabas",
+	"migrate.in_progress.issues": "Nililipat ang mga isyu",
+	"migrate.in_progress.pulls": "Nililipat ang mga pull request",
+	"migrate.cancel.title": "Kanselahin ang pag-migrate",
+	"migrate.cancel.confirmation": "Gusto mo bang kanselahin ang migration na ito?",
 	"admin.config.security": "Pagsasaayos sa seguridad",
 	"error.must_enable_2fa": "Kinakailangan ng instansyang ito na ang mga user ay paganahin ang authentikasyong two-factor bago nila i-access ang kani-kanilang account. Paganahin ito sa: %s",
 	"admin.config.global_2fa_requirement.title": "Global na pangangailangan ng two-factor",
@@ -501,9 +623,14 @@
 	"packages.common.repository": "Info ng repositoryo",
 	"actions.runs.all_runs_link": "lahat ng mga takbo",
 	"repo.pulls.auto_merge.no_permission": "Wala kang pahintulot na kanselahin ang auto merge sa hiling sa paghila.",
+	"migrate.select.title": "I-migrate ang repositoryo",
 	"settings.specific_repo_access": "Access sa repositoryo",
 	"settings.new_access_token": "Bagong access token",
 	"settings.permissions_access_specific_repositories": "Ilang repositoryo",
+	"settings.access_token.selected_repositories": {
+		"one": "%d piniling repositoryo",
+		"other": "%d (na) piniling repositoryo"
+	},
 	"settings.access_token.available_repositories": "Mga available na repositoryo",
 	"settings.access_token.no_repositories_selected": "Walang mga piniling repositoryo.",
 	"settings.access_token.no_repositories_found": "Walang mga nahanap na repositoryo.",
@@ -518,11 +645,8 @@
 	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "Token",
 	"actions.runners.ephemeral": "Ephemeral",
-	"actions.runners.list_runners.details_column": "Mga detalye",
 	"actions.runners.list_runners.edit_column": "I-edit",
 	"actions.runners.list_runners.delete_column": "Burahin",
-	"actions.runners.list_runners.details_button": "Mga detalye",
-	"actions.runners.list_runners.details_button_aria": "Ipakita ang mga detalye ng %s",
 	"actions.runners.list_runners.delete_button": "Burahin",
 	"actions.runners.list_runners.delete_button_aria": "Burahin ang %s",
 	"actions.runners.list_runners.edit_button": "I-edit",
diff --git a/options/locale_next/locale_fr-FR.json b/options/locale_next/locale_fr-FR.json
index ba7f64e270..68d76f83f3 100644
--- a/options/locale_next/locale_fr-FR.json
+++ b/options/locale_next/locale_fr-FR.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Tous les éléments de la file d'attente ont été effacés.",
+	"admin.monitor.queue.settings.remove_all_items": "Tout effacer",
+	"admin.monitor.queue.settings.changed": "Paramètres mis à jour",
+	"admin.monitor.queue.settings.submit": "Appliquer les paramètres",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Le nombre de processus doit être un nombre",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Actuellement %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Nombre maximale de processus",
+	"admin.monitor.queue.settings.description": "Les bassins croissent proportionnellement au besoin de leurs exécuteurs.",
+	"admin.monitor.queue.settings.title": "Paramètres du réservoir",
+	"admin.monitor.queue.review_add": "Examiner / ajouter des processus",
+	"admin.monitor.queue.numberinqueue": "Position dans la queue",
+	"admin.monitor.queue.maxnumberworkers": "Nombre maximal de processus",
+	"admin.monitor.queue.activeworkers": "Processus actifs",
+	"admin.monitor.queue.numberworkers": "Nombre de processus",
+	"admin.monitor.queue.exemplar": "Type d'exemple",
+	"admin.monitor.queue.type": "Type",
+	"admin.monitor.queue.name": "Nom",
+	"admin.monitor.queue": "File d'attente : %s",
+	"admin.monitor.queues": "Files d'attente",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA désactivé",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA Activé",
+	"admin.users.list_status_filter.not_prohibit_login": "Autorisé à se connecter",
+	"admin.users.list_status_filter.is_prohibit_login": "Interdit de connexion",
+	"admin.users.list_status_filter.not_restricted": "Non restreint",
+	"admin.users.list_status_filter.is_restricted": "Restreint",
+	"admin.users.list_status_filter.not_admin": "Non administrateur",
+	"admin.users.list_status_filter.is_admin": "Administrateur",
+	"admin.users.list_status_filter.not_active": "Inactif",
+	"admin.users.list_status_filter.is_active": "Actif",
+	"admin.users.list_status_filter.reset": "Réinitialiser",
+	"admin.users.list_status_filter.menu_text": "Filtrer",
+	"admin.system_status.gc_times": "Nombres de GC",
+	"admin.system_status.last_gc_pause": "Dernière pause GC",
+	"admin.system_status.total_gc_pause": "Pause totale GC",
+	"admin.system_status.last_gc_time": "Temps depuis le dernier GC",
+	"admin.system_status.next_gc_recycle": "Prochain recyclage GC",
+	"admin.system_status.other_system_allocation_obtained": "Autres allocation système obtenue",
+	"admin.system_status.gc_metadata_obtained": "Métadonnées GC obtenues",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profilage de seau de table de hashage obtenu",
+	"admin.system_status.mcache_structures_obtained": "Structures MCache obtenues",
+	"admin.system_status.mcache_structures_usage": "Utilisation des structures MCache",
+	"admin.system_status.mspan_structures_obtained": "Structures MSpan obtenues",
+	"admin.system_status.mspan_structures_usage": "Utilisation des structures MSpan",
+	"admin.system_status.stack_memory_obtained": "Mémoire pile obtenue",
+	"admin.system_status.bootstrap_stack_usage": "Utilisation pile bootstrap",
+	"admin.system_status.heap_objects": "Objets tas (Heap)",
+	"admin.system_status.heap_memory_released": "Mémoire tas (Heap) libérée",
+	"admin.system_status.heap_memory_in_use": "Utilisation mémoire tas (Heap)",
+	"admin.system_status.heap_memory_idle": "Mémoire tas (Heap) au repos",
+	"admin.system_status.heap_memory_obtained": "Mémoire tas (Heap) obtenue",
+	"admin.system_status.current_heap_usage": "Utilisation Tas (Heap)",
+	"admin.system_status.memory_free_times": "Nombre de libérations de mémoire",
+	"admin.system_status.memory_allocate_times": "Allocations de mémoire",
+	"admin.system_status.pointer_lookup_times": "Nombre de Consultations Pointeur",
+	"admin.system_status.memory_obtained": "Mémoire obtenue",
+	"admin.system_status.total_memory_allocated": "Mémoire totale allouée",
+	"admin.system_status.current_memory_usage": "Utilisation Mémoire actuelle",
+	"admin.system_status.current_goroutine": "Goroutines actuelles",
+	"admin.system_status.server_uptime": "Uptime du serveur",
+	"markup.filepreview.truncated": "L'aperçu a été tronqué",
+	"markup.filepreview.lines": "Lignes %[1]d jusqu'à %[2]d dans %[3]s",
+	"markup.filepreview.line": "Ligne %[1]d dans %[2]s",
+	"actions.variables.update.success": "La variable a bien été modifiée.",
+	"actions.variables.update.failed": "Impossible d’éditer la variable.",
+	"actions.variables.creation.success": "La variable « %s » a été ajoutée.",
+	"actions.variables.creation.failed": "Impossible d'ajouter la variable.",
+	"actions.variables.deletion.success": "La variable a bien été retirée.",
+	"actions.variables.deletion.failed": "Impossible de retirer la variable.",
+	"actions.variables.not_found": "La variable n'a pas été trouvée.",
+	"actions.variables.edit": "Modifier la variable",
+	"actions.variables.description": "Les variables sont passées aux actions et ne peuvent être lues autrement.",
+	"actions.variables.deletion.description": "La suppression d’une variable est permanente et ne peut être défaite. Continuer ?",
+	"actions.variables.deletion": "Retirer la variable",
+	"actions.variables.none": "Il n'y a pas encore de variables.",
+	"actions.variables.creation": "Ajouter une variable",
+	"actions.variables.management": "Gestion des variables",
+	"actions.variables": "Variables",
+	"webauthn.error.timeout": "Le délai d'attente imparti a été atteint avant que votre clé ne puisse être lue. Veuillez recharger la page pour réessayer.",
+	"webauthn.error.empty": "Vous devez définir un nom pour cette clé.",
+	"webauthn.error.duplicated": "La clé de sécurité n'est pas autorisée pour cette demande. Veuillez vous assurer que la clé n'est pas déjà enregistrée.",
+	"webauthn.error.unable_to_process": "Le serveur n'a pas pu traiter votre demande.",
+	"webauthn.error.insecure": "`WebAuthn ne prend en charge que les connexions sécurisées. Pour les tests via HTTP, vous pouvez utiliser l'origine \"localhost\" ou \"127.0.0.1\"`",
+	"webauthn.error.unknown": "Une erreur indéterminée s'est produite. Veuillez réessayer.",
+	"webauthn.unsupported_browser": "Votre navigateur ne prend actuellement pas en charge WebAuthn.",
+	"webauthn.error": "Impossible de lire votre clé de sécurité.",
+	"webauthn.use_twofa": "Utilisez l'authentification à deux facteurs avec votre téléphone",
+	"webauthn.press_button": "Veuillez appuyer sur le bouton de votre clé de sécurité…",
+	"webauthn.sign_in": "Appuyez sur le bouton de votre clé de sécurité. Si votre clé de sécurité n'a pas de bouton, réinsérez-la.",
+	"webauthn.insert_key": "Insérez votre clé de sécurité",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"many": "%s commits",
+		"other": ""
+	},
+	"counters.n_branches": {
+		"one": "%s branch",
+		"many": "%s branches",
+		"other": ""
+	},
+	"counters.n_tags": {
+		"one": "%s étiquettes",
+		"many": "%s étiquettes",
+		"other": ""
+	},
+	"counters.n_releases": {
+		"one": "%s publication",
+		"many": "%s publications",
+		"other": ""
+	},
 	"gpg.default_key": "Signé avec la clé par défaut",
 	"gpg.error.extract_sign": "Impossible d'extraire la signature",
 	"gpg.error.generate_hash": "Impossible de générer la chaine de hachage de la révision",
@@ -326,6 +435,23 @@
 	"migrate.gitbucket.description": "Migrer les données depuis des instances GitBucket.",
 	"migrate.codebase.description": "Migrer les données depuis codebasehq.com.",
 	"migrate.forgejo.description": "Migrer les données depuis codeberg.org ou une autre instance Forgejo.",
+	"migrate.items.label": "Éléments à migrer",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Jalons",
+	"migrate.items.labels": "Labels",
+	"migrate.items.issues": "Tickets",
+	"migrate.items.pull_requests": "Demandes d'ajout",
+	"migrate.items.merge_requests": "Demandes de fusion",
+	"migrate.items.releases": "Publications",
+	"migrate.in_progress.git": "Migration des données Git",
+	"migrate.in_progress.topics": "Migration des sujets",
+	"migrate.in_progress.milestones": "Migration des jalons",
+	"migrate.in_progress.labels": "Migration des labels",
+	"migrate.in_progress.releases": "Migration des publications",
+	"migrate.in_progress.issues": "Migration des tickets",
+	"migrate.in_progress.pulls": "Migration des demandes d'ajout",
+	"migrate.cancel.title": "Annuler la migration",
+	"migrate.cancel.confirmation": "Voulez-vous abandonner cette migration ?",
 	"admin.dashboard.remove_resolved_reports": "Supprimer les signalements résolus",
 	"admin.auths.allow_username_change": "Autoriser le changement de nom d'utilisateur",
 	"admin.auths.allow_username_change.description": "Autoriser les utilisateurs à changer leur nom d'utilisateur dans les paramètres du profil",
@@ -508,10 +634,8 @@
 	"issues.filters.labels.unexclude": "Enlever les exclusions",
 	"repo.pulls.auto_merge.no_permission": "Vous n'avez pas la permission d'annuler la fusion automatique de cette pull request.",
 	"settings.specific_repo_access": "Accès au dépôt",
-	"actions.runners.list_runners.details_column": "Détails",
 	"actions.runners.list_runners.edit_column": "Modifier",
 	"actions.runners.list_runners.delete_column": "Supprimer",
-	"actions.runners.list_runners.details_button_aria": "Afficher les détails de %s",
 	"actions.runners.create_runner.properties_fieldset": "Propriétés",
 	"actions.runners.create_runner.create_button": "Créer",
 	"actions.runners.edit_runner.properties_fieldset": "Propriétés",
@@ -522,7 +646,6 @@
 	"settings.new_access_token": "Nouveau jeton d'accès",
 	"actions.runners.uuid": "UUID",
 	"actions.runners.ephemeral": "Éphémère",
-	"actions.runners.list_runners.details_button": "Détails",
 	"actions.runners.list_runners.delete_button": "Supprimer",
 	"actions.runners.list_runners.delete_button_aria": "Supprimer %s",
 	"actions.runners.list_runners.edit_button": "Modifier",
@@ -565,6 +688,11 @@
 	"graphs.recent_commits.title": "Nombre de commits au cours de l'année écoulée",
 	"graphs.code_frequency.title": "Fréquence de code sur l'historique de {0}",
 	"settings.permissions_access_specific_repositories": "Dépôts spécifiques",
+	"settings.access_token.selected_repositories": {
+		"one": "Dépôt sélectionné (%d)",
+		"many": "Dépôts sélectionnés (%d)",
+		"other": "Dépôts sélectionnés (%d)"
+	},
 	"settings.access_token.available_repositories": "Dépôts disponibles",
 	"settings.access_token.no_repositories_selected": "Aucun dépôt sélectionné.",
 	"settings.access_token.no_repositories_found": "Aucun dépôt trouvé.",
@@ -577,6 +705,25 @@
 	"actions.runs.scheduled_description": "Exécution planifiée du commit <a href=\"%[1]s\">%[2]s</a>",
 	"actions.runs.workflow_dispatch_description": "Exécution du commit <a href=\"%[1]s\">%[2]s</a> déclenché par <a href=\"%[3]s\">%[4]s</a>",
 	"actions.runs.on_push_description": "Commit <a href=\"%[1]s\">%[2]s</a> poussé par <a href=\"%[3]s\">%[4]s</a>",
+	"migrate.select.title": "Migrer le dépôt",
+	"admin.federation.federation": "Fédération",
+	"admin.federation.hosts": "Hôtes",
+	"admin.federation.hosts.show_details": "Afficher les détails de l'hôte",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.schema": "Schéma",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.latest_activity": "Dernières activités",
+	"admin.federation.users": "Utilisateurs",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID utilisateur local",
+	"admin.federation.user.external_id": "ID utilisateur externe",
+	"admin.config.federation": "Configuration de la fédération",
+	"admin.config.federation.enabled": "Activé",
 	"settings.access_token.resource_all_help": "Autoriser l'accès à toutes les ressources.",
-	"actions.runners.version": "Version"
+	"user.activitypub_feed.posted_on": "Posté sur %[1]s",
+	"actions.runners.version": "Version",
+	"repo.files.filename": "Fichier",
+	"repo.files.last_commit_message": "Dernier message de commit",
+	"repo.files.last_commit_date": "Date du dernier commit",
+	"admin.federation.host.created": "Créé"
 }
diff --git a/options/locale_next/locale_ga.json b/options/locale_next/locale_ga.json
index 1c85809692..0ef3186852 100644
--- a/options/locale_next/locale_ga.json
+++ b/options/locale_next/locale_ga.json
@@ -1,4 +1,93 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Baineadh na míreanna go léir sa scuaine.",
+	"admin.monitor.queue.settings.remove_all_items": "Bain gach",
+	"admin.monitor.queue.settings.changed": "Socruithe Nuashonraithe",
+	"admin.monitor.queue.settings.submit": "Nuashonrú Socruithe",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Caithfidh uaslíon na n-oibrithe a bheith ina uimhir",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Faoi láthair %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Uaslíon na n-oibrithe",
+	"admin.monitor.queue.settings.description": "Fásann linnte go dinimiciúil mar fhreagra ar a gcuid scuaine oibrithe a bhlocáil.",
+	"admin.monitor.queue.settings.title": "Socruithe Linn",
+	"admin.monitor.queue.review_add": "Athbhreithniú / Cuir Oibrithe leis",
+	"admin.monitor.queue.numberinqueue": "Uimhir i scuaine",
+	"admin.monitor.queue.maxnumberworkers": "Líon Uasta na nOibrithe",
+	"admin.monitor.queue.activeworkers": "Oibrithe Gníomhacha",
+	"admin.monitor.queue.numberworkers": "Líon na nOibrithe",
+	"admin.monitor.queue.exemplar": "Cineál Eiseamláire",
+	"admin.monitor.queue.type": "Cineál",
+	"admin.monitor.queue.name": "Ainm",
+	"admin.monitor.queue": "Scuaine: %s",
+	"admin.monitor.queues": "Scuaineanna",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA faoi mhíchumas",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA Cumasaithe",
+	"admin.users.list_status_filter.not_prohibit_login": "Ceadaigh Logáil isteach",
+	"admin.users.list_status_filter.is_prohibit_login": "Cosc ar Logáil Isteach",
+	"admin.users.list_status_filter.not_restricted": "Gan Srian",
+	"admin.users.list_status_filter.is_restricted": "Srianta",
+	"admin.users.list_status_filter.not_admin": "Ní Riarachán",
+	"admin.users.list_status_filter.is_admin": "Riarachán",
+	"admin.users.list_status_filter.not_active": "Neamhghníomhach",
+	"admin.users.list_status_filter.is_active": "Gníomhach",
+	"admin.users.list_status_filter.reset": "Athshocraigh",
+	"admin.users.list_status_filter.menu_text": "Scagaire",
+	"admin.system_status.gc_times": "Amanna GC",
+	"admin.system_status.last_gc_pause": "Sos GC Deireanach",
+	"admin.system_status.total_gc_pause": "Sos Iomlán GC",
+	"admin.system_status.last_gc_time": "Am ó GC deireanach",
+	"admin.system_status.next_gc_recycle": "Athchúrsáil GC Eile",
+	"admin.system_status.other_system_allocation_obtained": "Leithdháileadh Córais Eile a Fuarthas",
+	"admin.system_status.gc_metadata_obtained": "Meiteashonraí GC faighte",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Tábla Hash Buicéad Próifílithe a Faightear",
+	"admin.system_status.mcache_structures_obtained": "Struchtúir MCache a Faightear",
+	"admin.system_status.mcache_structures_usage": "Úsáid Struchtúir MCache",
+	"admin.system_status.mspan_structures_obtained": "Struchtúir MSpan a Faightear",
+	"admin.system_status.mspan_structures_usage": "Úsáid Struchtúir MSpan",
+	"admin.system_status.stack_memory_obtained": "Cuimhne Staca Faighte",
+	"admin.system_status.bootstrap_stack_usage": "Úsáid Staca Bootstrap",
+	"admin.system_status.heap_objects": "Cuspóirí Carn",
+	"admin.system_status.heap_memory_released": "Cuimhne Carn Eisithe",
+	"admin.system_status.heap_memory_in_use": "Cuimhne Carm In Úsáid",
+	"admin.system_status.heap_memory_idle": "Díomhaoin Cuimhne Carn",
+	"admin.system_status.heap_memory_obtained": "Cuimhne Charn Faighte",
+	"admin.system_status.current_heap_usage": "Úsáid Charn Reatha",
+	"admin.system_status.memory_free_times": "Saorálann Cuimhne",
+	"admin.system_status.memory_allocate_times": "Leithdháiltí Cuimhne",
+	"admin.system_status.pointer_lookup_times": "Amanna Cuardaigh Pointeora",
+	"admin.system_status.memory_obtained": "Cuimhne Faighte",
+	"admin.system_status.total_memory_allocated": "Cuimhne Iomlán Leithdháilte",
+	"admin.system_status.current_memory_usage": "Úsáid Cuimhne Reatha",
+	"admin.system_status.current_goroutine": "Goroutines Reatha",
+	"admin.system_status.server_uptime": "Aga fónaimh Freastalaí",
+	"markup.filepreview.truncated": "Tá an réamhamharc giorraithe",
+	"markup.filepreview.lines": "Línte %[1]d go %[2]d i %[3]s",
+	"markup.filepreview.line": "Líne %[1]d i %[2]s",
+	"actions.variables.update.success": "Tá an t-athróg curtha in eagar.",
+	"actions.variables.update.failed": "Theip ar athróg a chur in eagar.",
+	"actions.variables.creation.success": "Tá an athróg \"%s\" curtha leis.",
+	"actions.variables.creation.failed": "Theip ar athróg a chur leis.",
+	"actions.variables.deletion.success": "Tá an athróg bainte.",
+	"actions.variables.deletion.failed": "Theip ar athróg a bhaint.",
+	"actions.variables.not_found": "Theip ar an athróg a aimsiú.",
+	"actions.variables.edit": "Cuir Athróg in Eagar",
+	"actions.variables.description": "Cuirfear athróga chuig gníomhartha áirithe agus ní féidir iad a léamh ar mhalairt eile.",
+	"actions.variables.deletion.description": "Tá athróg a bhaint buan agus ní féidir é a chur ar ais. Lean ar aghaidh?",
+	"actions.variables.deletion": "Bain athróg",
+	"actions.variables.none": "Níl aon athróga ann fós.",
+	"actions.variables.creation": "Cuir Athróg leis",
+	"actions.variables.management": "Bainistigh athróga",
+	"actions.variables": "Athróga",
+	"webauthn.error.timeout": "Sroicheadh an teorainn ama sula bhféadfaí d’eochair a léamh. Athlódáil an leathanach seo, le do thoil, agus déan iarracht arís.",
+	"webauthn.error.empty": "Ní mór duit ainm a shocrú don eochair seo.",
+	"webauthn.error.duplicated": "Ní cheadaítear an eochair slándála don iarratas seo. Déan cinnte le do thoil nach bhfuil an eochair cláraithe cheana féin.",
+	"webauthn.error.unable_to_process": "Ní fhéadfadh an freastalaí d'iarratas a phróiseáil.",
+	"webauthn.error.insecure": "Ní thacaíonn WebAuthn ach le naisc slán. Le haghaidh tástála thar HTTP, is féidir leat an bunús “localhost” nó \"127.0.0.1\" a úsáid",
+	"webauthn.error.unknown": "Tharla earráid anaithnid. Déan iarracht arís.",
+	"webauthn.unsupported_browser": "Ní thacaíonn do bhrabhsálaí le WebAuthn faoi láthair.",
+	"webauthn.error": "Ní fhéadfaí do eochair slándála a léamh.",
+	"webauthn.use_twofa": "Úsáid cód dhá fhachtóir ó do ghuthán",
+	"webauthn.press_button": "Brúigh an cnaipe ar d'eochair slándála le do thoil…",
+	"webauthn.sign_in": "Brúigh an cnaipe ar d'eochair slándála. Mura bhfuil aon chnaipe ag d'eochair slándála, cuir isteach é arís.",
+	"webauthn.insert_key": "Cuir isteach d'eochair slándála",
 	"gpg.default_key": "Sínithe leis an eochair réamhshocraithe",
 	"gpg.error.extract_sign": "Theip ar an síniú a bhaint",
 	"gpg.error.generate_hash": "Theip ar hash gealltanas a ghiniúint",
@@ -151,6 +240,23 @@
 	"migrate.onedev.description": "Imirce sonraí ó code.onedev.io nó ó chásanna OneDev eile.",
 	"migrate.gitbucket.description": "Imirce sonraí ó chásanna GitBucket.",
 	"migrate.codebase.description": "Imirce sonraí ó codebasehq.com.",
+	"migrate.items.label": "Míreanna Imirce",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Clocha míle",
+	"migrate.items.labels": "Lipéid",
+	"migrate.items.issues": "Saincheisteanna",
+	"migrate.items.pull_requests": "Iarrataí Tarraing",
+	"migrate.items.merge_requests": "Iarrataí Cumaisc",
+	"migrate.items.releases": "Eisiúintí",
+	"migrate.in_progress.git": "Sonraí Git a Aimirce",
+	"migrate.in_progress.topics": "Ábhair Imirce",
+	"migrate.in_progress.milestones": "Clocha Míle a Imirce",
+	"migrate.in_progress.labels": "Lipéid Imirce",
+	"migrate.in_progress.releases": "Eisiúintí Imirce",
+	"migrate.in_progress.issues": "Saincheisteanna Imirce",
+	"migrate.in_progress.pulls": "Iarratais Tarraingthe á n-Imirce",
+	"migrate.cancel.title": "Cealaigh Imirce",
+	"migrate.cancel.confirmation": "Ar mhaith leat an imirce seo a chealú?",
 	"pulse.n_active_issues": {
 		"one": "%s saincheist ghníomhach",
 		"two": "%s saincheisteanna ghníomhach",
@@ -546,9 +652,48 @@
 	"actions.variables.mutation.name_description": "Ní féidir ach litreacha, uimhreacha agus fo-línte a bheith in ainm athróige. Ní féidir CI a thabhairt air ná tosú le FORGEJO_, GITEA_, GITHUB_, ná uimhir. Déanfaidh Forgejo é a thiontú go huachtarlitir go huathoibríoch.",
 	"actions.variables.mutation.value_description": "Is féidir luach athróg a bheith ina théacs ar bith. Coinnítear carachtair speisialta. Déantar CRLF (briseadh líne stíl Windows) a thiontú go huathoibríoch go LF. Ionchódaigh an luach le Base64 más ceart briseadh líne a choinneáil.",
 	"repo.pulls.auto_merge.no_permission": "Níl cead agat cumasc uathoibríoch an iarratais tarraingthe seo a chealú.",
+	"migrate.select.title": "Imirce stór",
+	"admin.federation.federation": "Cónaidhm",
+	"admin.federation.hosts": "Óstaigh",
+	"admin.federation.hosts.title": "Óstaigh an Chónaidhm",
+	"admin.federation.hosts.manage_panel": "Bainistigh óstach cónaidhme",
+	"admin.federation.hosts.details_panel": "Sonraí óstach cónaidhme",
+	"admin.federation.hosts.show_details": "Taispeáin sonraí an óstaigh",
+	"admin.federation.host.id": "Aitheantas",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Scéim",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.software_name": "Bogearraí",
+	"admin.federation.host.created": "Cruthaithe",
+	"admin.federation.host.updated": "Nuashonraithe",
+	"admin.federation.host.latest_activity": "Gníomhaíocht is déanaí",
+	"admin.federation.users": "Úsáideoirí",
+	"admin.federation.users.title": "Úsáideoirí cónaidhme",
+	"admin.federation.users.manage_panel": "Bainistigh úsáideoirí cónaidhme",
+	"admin.federation.users.show_local_user": "Taispeáin sonraí úsáideora áitiúil",
+	"admin.federation.user.id": "Aitheantas",
+	"admin.federation.user.user_id": "Aitheantas úsáideora áitiúil",
+	"admin.federation.user.external_id": "Aitheantas úsáideora seachtrach",
+	"admin.federation.user.inbox_path": "Cosán an bhosca isteach",
+	"admin.config.federation": "Cumraíocht an Chónaidhm",
+	"admin.config.federation.enabled": "Cumasaithe",
+	"admin.config.federation.share_user_statistics": "Comhroinn staitisticí úsáideora le hóstach eile",
+	"admin.config.federation.max_size": "Uasmhéid freagartha ceadaithe",
+	"admin.config.federation.signature_enforced": "Éiligh sínithe HTTP",
+	"admin.config.federation.signature_algorithms": "Algartaim shínithe",
+	"admin.config.federation.digest_algorithm": "Algartam díleá sínithe",
+	"admin.config.federation.get_headers": "Ceanntásca GET sínithe",
+	"admin.config.federation.post_headers": "Ceanntásca POST sínithe",
 	"settings.specific_repo_access": "Rochtain ar an stór",
 	"settings.new_access_token": "Comhartha rochtana nua",
 	"settings.permissions_access_specific_repositories": "Stórtha sonracha",
+	"settings.access_token.selected_repositories": {
+		"one": "Stórlann roghnaithe (%d)",
+		"two": "Stórtha roghnaithe (%d)",
+		"few": "Stórtha roghnaithe (%d)",
+		"many": "Stórtha roghnaithe (%d)",
+		"other": "Stórtha roghnaithe (%d)"
+	},
 	"settings.access_token.available_repositories": "Stórtha atá ar fáil",
 	"settings.access_token.no_repositories_selected": "Níl aon stórtha roghnaithe.",
 	"settings.access_token.no_repositories_found": "Níor aimsíodh aon stórtha.",
@@ -557,6 +702,40 @@
 	"settings.access_token.resource_public_only_help": "Teorainn a chur le rochtain ar stórtha agus ar eagraíochtaí atá poiblí.",
 	"settings.access_token.resource_specific_repo_help": "Teorainn a chur le rochtain ar liosta sonrach stórtha. Ceadaítear rochtain léite amháin do gach stór poiblí. Ní féidir ach ceadanna a chumasú a cheadaíonn rochtain ar stórtha agus ar shaincheisteanna.",
 	"settings.access_token.admin_disabled": "Tá ceadanna riaracháin díchumasaithe.",
+	"user.activitypub_feed.feed": "Beatha Fediverse",
+	"user.activitypub_feed.no_activity": "Gan aon ghníomhaíocht ilghnéitheach",
+	"user.activitypub_feed.is_empty": "Tá do bheatha fediverse folamh.",
+	"user.activitypub_feed.hint": "Taispeánann an fotha seo gníomhaíochtaí ó chuntais fediverse a leanann tú, chomh maith le poist chónaidhme inar luaigh tú.",
+	"user.activitypub_feed.posted_on": "Postáilte ar %[1]s",
+	"user.activitypub_feed.original_source": "Foinse bhunaidh",
+	"counters.n_commits": {
+		"one": "%s tiomantas",
+		"two": "%s tiomantais",
+		"few": "%s tiomantais",
+		"many": "%s tiomantais",
+		"other": "%s tiomantais"
+	},
+	"counters.n_branches": {
+		"one": "%s brainse",
+		"two": "%s brainsí",
+		"few": "%s brainsí",
+		"many": "%s brainsí",
+		"other": "%s brainsí"
+	},
+	"counters.n_tags": {
+		"one": "%s clib",
+		"two": "%s clibeanna",
+		"few": "%s clibeanna",
+		"many": "%s clibeanna",
+		"other": "%s clibeanna"
+	},
+	"counters.n_releases": {
+		"one": "%s eisiúint",
+		"two": "%s eisiúintí",
+		"few": "%s eisiúintí",
+		"many": "%s eisiúintí",
+		"other": "%s eisiúintí"
+	},
 	"access_token.error.specified_repos_none": "Ní mór stór amháin ar a laghad a bheith ag comharthaí rochtana le stórtha sonraithe.",
 	"access_token.error.specified_repos_and_public_only": "Ní féidir comharthaí rochtana le stórtha sonraithe a chomhcheangal leis an raon feidhme poiblí amháin.",
 	"access_token.error.specified_repos_and_invalid_scope": "Ní féidir comharthaí rochtana le stórtha sonraithe a úsáid ach leis na raonta read:issue, write:issue, read:repository, agus write:repository.",
@@ -564,11 +743,8 @@
 	"actions.runners.token": "Comhartha",
 	"actions.runners.ephemeral": "Sealadach",
 	"actions.runners.version": "Leagan",
-	"actions.runners.list_runners.details_column": "Sonraí",
 	"actions.runners.list_runners.edit_column": "Cuir in Eagar",
 	"actions.runners.list_runners.delete_column": "Scrios",
-	"actions.runners.list_runners.details_button": "Sonraí",
-	"actions.runners.list_runners.details_button_aria": "Taispeáin sonraí %s",
 	"actions.runners.list_runners.delete_button": "Scrios",
 	"actions.runners.list_runners.delete_button_aria": "Scrios %s",
 	"actions.runners.list_runners.edit_button": "Cuir in Eagar",
@@ -625,6 +801,10 @@
 	"actions.secrets.mutation.failure_message": "Níorbh fhéidir an rún \"%s\" a nuashonrú.",
 	"actions.secrets.mutation.name_description": "Ní féidir ach litreacha, uimhreacha agus fo-línte a bheith in ainm rúnda. Ní féidir leis tosú le FORGEJO_, GITEA_, GITHUB_, ná uimhir. Déanfaidh Forgejo é a thiontú go huachtarlitir go huathoibríoch.",
 	"actions.secrets.mutation.value_description": "Ní thaispeánfar an luach atá ann cheana. Fág an réimse folamh mura mian leat é a mhodhnú. Coinnítear carachtair speisialta. Déantar CRLF (briseadh líne de stíl Windows) a thiontú go huathoibríoch go LF. Ionchódaigh an luach le Base64 más ceart briseadh líne a choinneáil.",
+	"members.add_member": "Cuir ball leis",
+	"members.user": "Úsáideoir",
+	"members.user_already_member": "Is ball den eagraíocht an t-úsáideoir seo cheana féin.",
+	"members.no_team_selected": "Ní mór do bhaill na heagraíochta a bheith ina mbaill de fhoireann amháin ar a laghad.",
 	"form.RunnerName": "Ainm",
 	"graphs.recent_commits.title": "Líon na ngealltanas le bliain anuas",
 	"graphs.code_frequency.title": "Minicíocht chód thar stair {0}"
diff --git a/options/locale_next/locale_gl.json b/options/locale_next/locale_gl.json
index 1ab14bedc5..7878b0a7f1 100644
--- a/options/locale_next/locale_gl.json
+++ b/options/locale_next/locale_gl.json
@@ -1,4 +1,16 @@
 {
+	"webauthn.error.timeout": "Alcanzouse o límite de tempo antes de que se puidera ler a súa clave. Volva cargar esta páxina e ténteo de novo.",
+	"webauthn.error.empty": "Debe definir un nome para esta clave.",
+	"webauthn.error.duplicated": "A clave de seguridade non está permitida para esta solicitude. Asegúrese de que a clave non estea xa rexistrada.",
+	"webauthn.error.unable_to_process": "O servidor non puido procesar a súa solicitude.",
+	"webauthn.error.insecure": "WebAuthn só admite conexións seguras. Para probar a través de HTTP, pode usar a orixe \"localhost\" ou \"127.0.0.1\"",
+	"webauthn.error.unknown": "Produciuse un erro descoñecido. Ténteo de novo.",
+	"webauthn.unsupported_browser": "O seu navegador non soporta WebAuthn actualmente.",
+	"webauthn.error": "Non se puido ler a súa clave de seguridade.",
+	"webauthn.use_twofa": "Use o Código de Dous Factores do seu Teléfono",
+	"webauthn.press_button": "Prema o botón da súa chave de seguridade…",
+	"webauthn.sign_in": "Prema o botón da súa chave de seguridade. Se a súa chave de seguridade non ten ningún botón, volva inserila.",
+	"webauthn.insert_key": "Insira a súa chave de seguridade",
 	"relativetime.now": "agora",
 	"relativetime.future": "máis adiante",
 	"repo.form.cannot_create": "Todos os espazos onde podes crear repositorios chegaron ao límite de repositorios creados.",
diff --git a/options/locale_next/locale_he.json b/options/locale_next/locale_he.json
index c06efd2497..c8fafcf414 100644
--- a/options/locale_next/locale_he.json
+++ b/options/locale_next/locale_he.json
@@ -1,4 +1,16 @@
 {
+	"webauthn.error.timeout": "קריאת מפתחך לקחה יותר מדי זמן. אפשר לטעון מחדש את הדף ולנסות שוב.",
+	"webauthn.error.empty": "שם המפתח הוא שדה חובה.",
+	"webauthn.error.duplicated": "מפתח האבטחה לא יכול לשמש לבקשה זו. נא לוודא שהמפתח לא רשום.",
+	"webauthn.error.unable_to_process": "שרת זה נכשל בעיבוד בקשתך.",
+	"webauthn.error.insecure": "הפרוטוקול WebAuthn לא תומך בחיבורים לא מאובטחים, למעט דרך \"localhost\" או \"127.0.0.1\"",
+	"webauthn.error.unknown": "שגיאה לא ידועה, אפשר לנסות שוב.",
+	"webauthn.unsupported_browser": "הדפדפן שלך לא תומך בWebAuthn.",
+	"webauthn.error": "קריאת מפתח האבטחה נכשלה.",
+	"webauthn.use_twofa": "השתמש בקוד אימות דו־שלבי מהטלפון שלך",
+	"webauthn.press_button": "נא ללחוץ על הכפתור שעל מפתח האבטחה…",
+	"webauthn.sign_in": "יש ללחוץ על הכפתור שעל מפתח האבטחה. אם אין כפתור, אפשר להוציא את המפתח ולחבר אותו שוב.",
+	"webauthn.insert_key": "יש להכניס את מפתח אבטחך",
 	"fork.n_forks": {
 		"one": "מזלוג אחד",
 		"two": "%s מזלוגים",
@@ -18,6 +30,17 @@
 	"migrate.gitbucket.description": "יבוא מידע משרת GitBucket.",
 	"migrate.codebase.description": "ייבוא מידע מ־codebasehq.com.",
 	"migrate.forgejo.description": "ייבוא מידע מקודברג או שרת פורג'ו אחר.",
+	"migrate.items.wiki": "ויקי",
+	"migrate.items.milestones": "אבני דרך",
+	"migrate.items.labels": "תוויות",
+	"migrate.items.issues": "סוגיות",
+	"migrate.items.pull_requests": "בקשות מיזוג",
+	"migrate.items.releases": "גרסאות",
+	"migrate.in_progress.git": "ייבוא הקרפיף עצמו",
+	"migrate.in_progress.topics": "ייבוא נושאים",
+	"migrate.in_progress.milestones": "ייבוא אבני דרך",
+	"migrate.in_progress.labels": "ייבוא תוויות",
+	"migrate.in_progress.releases": "ייבוא גרסאות",
 	"home.welcome.no_activity": "אין פעילות",
 	"home.explore_users": "גלה משתמשים",
 	"home.explore_orgs": "גלה ארגונים",
diff --git a/options/locale_next/locale_hi.json b/options/locale_next/locale_hi.json
index 79b6fdeb42..86919e5eb4 100644
--- a/options/locale_next/locale_hi.json
+++ b/options/locale_next/locale_hi.json
@@ -1,4 +1,16 @@
 {
+	"webauthn.error.timeout": "आपकी की पढ़ने से पहले टाइमआउट हो गया। पृष्ट रीलोड करें और फिर कोशिश करें।",
+	"webauthn.error.empty": "कृपया इस चाभी का नाम रखें।",
+	"webauthn.error.duplicated": "सिक्योरिटी की इस रिक्वेस्ट के लिए नहीं है। कृपया देखें की पहले से रजिस्टर्ड तो नहीं।",
+	"webauthn.error.unable_to_process": "सर्वर आपकी रिक्वेस्ट प्रोसेस नहीं कर पाया।",
+	"webauthn.error.insecure": "वेबौथ पर सिर्फ सुरक्षित कनेक्शन हो. HTTP टेस्ट के लिए ओरिजिन “लोकलहोस्ट” या “127.0.0.1”",
+	"webauthn.error.unknown": "कोई अंजान एरर हुई, फिर से कोशिश करें।",
+	"webauthn.unsupported_browser": "आपका ब्राउज़र वेबौथ सपोर्ट नहीं करता।",
+	"webauthn.error": "सिक्योरिटी की रीड नहीं हो पा रही।",
+	"webauthn.use_twofa": "अपने फ़ोन से दो फैक्टर कोड लाएं",
+	"webauthn.press_button": "अपनी सिक्योरिटी की पर बटन दबाएं…",
+	"webauthn.sign_in": "सिक्योरिटी की का बटन दबाएं, नहीं है तो फिर से प्लग करें।",
+	"webauthn.insert_key": "अपनी सिक्योरिटी की डालें",
 	"fork.n_forks": {
 		"one": "%s फोर्क",
 		"other": "%s फोर्कस"
diff --git a/options/locale_next/locale_hu-HU.json b/options/locale_next/locale_hu-HU.json
index 2b9b2b5181..4f28acaa45 100644
--- a/options/locale_next/locale_hu-HU.json
+++ b/options/locale_next/locale_hu-HU.json
@@ -1,4 +1,55 @@
 {
+	"admin.monitor.queue.settings.submit": "Beállítások frissítése",
+	"admin.monitor.queue.type": "Típus",
+	"admin.monitor.queue.name": "Név",
+	"admin.users.list_status_filter.is_restricted": "Korlátozott",
+	"admin.users.list_status_filter.is_admin": "Rendszergazda",
+	"admin.users.list_status_filter.is_active": "Aktív",
+	"admin.system_status.gc_times": "GC Idők",
+	"admin.system_status.last_gc_pause": "Utolsó GC szünet",
+	"admin.system_status.total_gc_pause": "Teljes GC szünet",
+	"admin.system_status.last_gc_time": "Utolsó GC óta eltelt idő",
+	"admin.system_status.next_gc_recycle": "Következő GC Újrahasznosítás",
+	"admin.system_status.other_system_allocation_obtained": "Másik Rendszer Allokáció Megszerezve",
+	"admin.system_status.gc_metadata_obtained": "GC Metaadat Megszerezve",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profilozó Vödrös Hash Tábla Megszerezve",
+	"admin.system_status.mcache_structures_obtained": "MCache Struktúrák Megszerezve",
+	"admin.system_status.mcache_structures_usage": "MCache Struktúrák Használata",
+	"admin.system_status.mspan_structures_obtained": "MSpan Struktúrák Megszerezve",
+	"admin.system_status.mspan_structures_usage": "MSpan Struktúrák Használata",
+	"admin.system_status.stack_memory_obtained": "Stack Memória Megszerezve",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap Stack Használat",
+	"admin.system_status.heap_objects": "Heap Objektumok",
+	"admin.system_status.heap_memory_released": "Elengedett Heap Memória",
+	"admin.system_status.heap_memory_in_use": "Használatban lévő Heap Memória",
+	"admin.system_status.heap_memory_idle": "Tétlen Heap Memória",
+	"admin.system_status.heap_memory_obtained": "Heap Memória Megszerezve",
+	"admin.system_status.current_heap_usage": "Aktuális Heap Használat",
+	"admin.system_status.memory_allocate_times": "Memóriafoglalások",
+	"admin.system_status.pointer_lookup_times": "Pointer Lookup Idők",
+	"admin.system_status.memory_obtained": "Megszerzett Memória",
+	"admin.system_status.total_memory_allocated": "Összes lefoglalt memória",
+	"admin.system_status.current_memory_usage": "Jelenlegi memória használat",
+	"admin.system_status.current_goroutine": "Jelenlegi Goroutinok",
+	"admin.system_status.server_uptime": "Kiszolgáló futási ideje",
+	"webauthn.error.timeout": "Időtúllépés a kulcs beolvasása során. Töltse be újra ezt az oldalt, és próbálkozzon újra.",
+	"webauthn.error.empty": "Nevet kell adnia ennek a kulcsnak.",
+	"webauthn.error.duplicated": "A biztonsági kulcs nem engedélyezett ehhez a kéréshez. Győződjön meg róla, hogy a kulcs nincs-e már regisztrálva.",
+	"webauthn.error.unable_to_process": "A kiszolgáló nem tudta feldolgozni a kérését.",
+	"webauthn.error.insecure": "A WebAuthn csak biztonságos kapcsolatokat támogat. HTTP-n keresztüli tesztelés esetén használja a „localhost” vagy a „127.0.0.1” forrást.",
+	"webauthn.error.unknown": "Ismeretlen hiba történt. Próbálja újra.",
+	"webauthn.unsupported_browser": "A böngészője jelenleg nem támogatja a WebAuthn protokollt.",
+	"webauthn.error": "A biztonsági kulcsának beolvasása sikertelen volt.",
+	"webauthn.use_twofa": "Kétlépcsős hitelesítési kód használata telefonról",
+	"webauthn.press_button": "Nyomja meg a biztonsági kulcsán található gombot…",
+	"webauthn.sign_in": "Nyomja meg a biztonsági kulcsán található gombot. Ha nincs rajta gomb, próbálja meg újra behelyezni.",
+	"webauthn.insert_key": "Helyezze be biztonsági kulcsát",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Mérföldkövek",
+	"migrate.items.labels": "Címkék",
+	"migrate.items.issues": "Hibajegyek",
+	"migrate.items.pull_requests": "Pull request-ek",
+	"migrate.items.releases": "Kiadások",
 	"actions.runners.name": "Név",
 	"actions.runners.owner_type": "Típus",
 	"actions.runners.description": "Leírás",
diff --git a/options/locale_next/locale_id-ID.json b/options/locale_next/locale_id-ID.json
index 646bec6144..d0e58fcbb4 100644
--- a/options/locale_next/locale_id-ID.json
+++ b/options/locale_next/locale_id-ID.json
@@ -1,4 +1,93 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Semua item dalam antrian telah dihapus.",
+	"admin.monitor.queue.settings.remove_all_items": "Hapus semua",
+	"admin.monitor.queue.settings.changed": "Pengaturan diperbarui",
+	"admin.monitor.queue.settings.submit": "Perbarui pengaturan",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Jumlah maks. worker haruslah sebuah angka",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Saat ini %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Jumlah Maks. Worker",
+	"admin.monitor.queue.settings.description": "Pool berkembang secara dinamis sebagai respons terhadap pemblokiran antrian pekerja mereka.",
+	"admin.monitor.queue.settings.title": "Pengaturan pool",
+	"admin.monitor.queue.review_add": "Tinjau / tambah pekerja",
+	"admin.monitor.queue.numberinqueue": "Jumlah dalam antrian",
+	"admin.monitor.queue.maxnumberworkers": "Jumlah maksimum pekerja",
+	"admin.monitor.queue.activeworkers": "Pekerja aktif",
+	"admin.monitor.queue.numberworkers": "Jumlah pekerja",
+	"admin.monitor.queue.exemplar": "Contoh Tipe",
+	"admin.monitor.queue.type": "Tipe",
+	"admin.monitor.queue.name": "Nama",
+	"admin.monitor.queue": "Antrian: %s",
+	"admin.monitor.queues": "Antrian",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA dinonaktifkan",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA diaktifkan",
+	"admin.users.list_status_filter.not_prohibit_login": "Izinkan masuk",
+	"admin.users.list_status_filter.is_prohibit_login": "Larang masuk",
+	"admin.users.list_status_filter.not_restricted": "Tidak dibatasi",
+	"admin.users.list_status_filter.is_restricted": "Dibatasi",
+	"admin.users.list_status_filter.not_admin": "Bukan admin",
+	"admin.users.list_status_filter.is_admin": "Pengelola",
+	"admin.users.list_status_filter.not_active": "Tidak aktif",
+	"admin.users.list_status_filter.is_active": "Aktif",
+	"admin.users.list_status_filter.reset": "Atur ulang",
+	"admin.users.list_status_filter.menu_text": "Saring",
+	"admin.system_status.gc_times": "Jumlah GC",
+	"admin.system_status.last_gc_pause": "Jeda GC terakhir",
+	"admin.system_status.total_gc_pause": "Total jeda GC",
+	"admin.system_status.last_gc_time": "Waktu sejak GC terakhir",
+	"admin.system_status.next_gc_recycle": "Daur ulang GC berikutnya",
+	"admin.system_status.other_system_allocation_obtained": "Alokasi sistem lainnya yang diperoleh",
+	"admin.system_status.gc_metadata_obtained": "Metadata GC yang diperoleh",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Tabel hash bucket pemrofilan yang diperoleh",
+	"admin.system_status.mcache_structures_obtained": "Struktur MCache yang diperoleh",
+	"admin.system_status.mcache_structures_usage": "Penggunaan struktur MCache",
+	"admin.system_status.mspan_structures_obtained": "Struktur MSpan yang diperoleh",
+	"admin.system_status.mspan_structures_usage": "Penggunaan struktur MSpan",
+	"admin.system_status.stack_memory_obtained": "Memori stack yang diperoleh",
+	"admin.system_status.bootstrap_stack_usage": "Penggunaan stack bootstrap",
+	"admin.system_status.heap_objects": "Objek heap",
+	"admin.system_status.heap_memory_released": "Memori heap yang dilepaskan",
+	"admin.system_status.heap_memory_in_use": "Memori heap yang digunakan",
+	"admin.system_status.heap_memory_idle": "Memori heap yang menganggur",
+	"admin.system_status.heap_memory_obtained": "Memori heap yang diperoleh",
+	"admin.system_status.current_heap_usage": "Penggunaan heap saat ini",
+	"admin.system_status.memory_free_times": "Pembebasan memori",
+	"admin.system_status.memory_allocate_times": "Alokasi memori",
+	"admin.system_status.pointer_lookup_times": "Jumlah pencarian pointer",
+	"admin.system_status.memory_obtained": "Memori yang diperoleh",
+	"admin.system_status.total_memory_allocated": "Total memori yang dialokasikan",
+	"admin.system_status.current_memory_usage": "Penggunaan memori saat ini",
+	"admin.system_status.current_goroutine": "Goroutine saat ini",
+	"admin.system_status.server_uptime": "Waktu aktif server",
+	"markup.filepreview.truncated": "Pratinjau telah dipotong",
+	"markup.filepreview.lines": "Baris %[1]d hingga %[2]d di %[3]s",
+	"markup.filepreview.line": "Baris %[1]d di %[2]s",
+	"actions.variables.update.success": "Variabel telah diedit.",
+	"actions.variables.update.failed": "Gagal mengedit variabel.",
+	"actions.variables.creation.success": "Variabel \"%s\" telah ditambahkan.",
+	"actions.variables.creation.failed": "Gagal menambahkan variabel.",
+	"actions.variables.deletion.success": "Variabel telah dihapus.",
+	"actions.variables.deletion.failed": "Gagal menghapus variabel.",
+	"actions.variables.not_found": "Gagal menemukan variabel.",
+	"actions.variables.edit": "Edit Variabel",
+	"actions.variables.description": "Variabel akan diteruskan ke beberapa tindakan dan tidak dapat dibaca sebaliknya.",
+	"actions.variables.deletion.description": "Menghapus variabel bersifat permanen dan tidak dapat dibatalkan. Lanjutkan?",
+	"actions.variables.deletion": "Hapus variabel",
+	"actions.variables.none": "Belum ada variabel.",
+	"actions.variables.creation": "Tambah Variabel",
+	"actions.variables.management": "Kelola variabel",
+	"actions.variables": "Variabel",
+	"webauthn.error.timeout": "Waktu habis sebelum kunci Anda dapat dibaca. Mohon muat ulang halaman ini dan coba lagi.",
+	"webauthn.error.empty": "Anda harus menetapkan nama untuk kunci ini.",
+	"webauthn.error.duplicated": "Kunci keamanan tidak diperbolehkan untuk permintaan ini. Pastikan bahwa kunci ini belum terdaftar sebelumnya.",
+	"webauthn.error.unable_to_process": "Server tidak dapat memproses permintaan Anda.",
+	"webauthn.error.insecure": "`WebAuthn hanya mendukung koneksi aman. Untuk pengujian melalui HTTP, Anda dapat menggunakan \"localhost\" atau \"127.0.0.1\"`",
+	"webauthn.error.unknown": "Terdapat kesalahan yang tidak diketahui. Mohon coba lagi.",
+	"webauthn.unsupported_browser": "Browser Anda saat ini tidak mendukung WebAuthn.",
+	"webauthn.error": "Tidak dapat membaca kunci keamanan Anda.",
+	"webauthn.use_twofa": "Gunakan kode dua faktor dari telepon Anda",
+	"webauthn.press_button": "Silakan tekan tombol pada kunci keamanan Anda…",
+	"webauthn.sign_in": "Tekan tombol pada kunci keamanan Anda. Jika kunci keamanan Anda tidak memiliki tombol, masukkan kembali.",
+	"webauthn.insert_key": "Masukkan kunci keamanan anda",
 	"gpg.error.extract_sign": "Gagal untuk mengambil tanda tangan",
 	"gpg.error.generate_hash": "Gagal untuk menghasilkan hash komit",
 	"gpg.error.no_gpg_keys_found": "Tidak diketahui kunci yang ditemukan di database signature",
@@ -59,6 +148,12 @@
 	"migrate.gitbucket.description": "Migrasikan data dari instance GitBucket.",
 	"migrate.codebase.description": "Migrasikan data dari codebasehq.com.",
 	"migrate.forgejo.description": "Migrasikan data dari codeberg.org atau instance Forgejo lainnya.",
+	"migrate.items.label": "Ihwal Migrasi",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Tonggak",
+	"migrate.items.issues": "Masalah",
+	"migrate.items.pull_requests": "Tarik Permintaan",
+	"migrate.items.releases": "Rilis",
 	"repo.issue_indexer.title": "Indeks Masalah",
 	"search.milestone_kind": "Cari milestone…",
 	"repo.settings.push_mirror.branch_filter.label": "Filter cabang (opsional)",
@@ -189,12 +284,55 @@
 	"repo.pulls.poster_trust_revoke": "Cabut",
 	"repo.pulls.poster_trust_revoke.tooltip": "Penulis permintaan tarik ini tidak lagi dipercaya untuk menjalankan alur kerja yang dipicu oleh peristiwa `pull_request`, setiap jalannya harus disetujui secara manual.",
 	"repo.view.gitmodules_too_large": "File .gitmodules terlalu besar dan akan diabaikan (misalnya pada pemanggilan API)",
+	"migrate.select.title": "Migrasi repositori",
+	"migrate.items.labels": "Label",
+	"migrate.items.merge_requests": "Permintaan gabung",
+	"migrate.in_progress.git": "Migrasi data Git",
+	"migrate.in_progress.topics": "Migrasi topik",
+	"migrate.in_progress.milestones": "Migrasi tonggak pencapaian",
+	"migrate.in_progress.labels": "Migrasi label",
+	"migrate.in_progress.releases": "Migrasi rilis",
+	"migrate.in_progress.issues": "Migrasi isu",
+	"migrate.in_progress.pulls": "Migrasi permintaan tarik",
+	"migrate.cancel.title": "Batalkan migrasi",
+	"migrate.cancel.confirmation": "Apakah Anda ingin membatalkan migrasi ini?",
 	"search.syntax": "Sintaks pencarian",
 	"search.fuzzy": "Fuzzy",
 	"search.fuzzy_tooltip": "Sertakan hasil yang kira-kira cocok dengan kata kunci pencarian",
 	"install.ssh_authorized_keys_inspection_error": "Gagal memeriksa file authorized_keys yang ada: %v",
 	"install.ssh_authorized_keys_unexpected_key": "Mengaktifkan SSH untuk Forgejo berkonflik dengan file yang terletak di %s yang berisi kunci SSH yang ada. Saran: gunakan pengguna sistem khusus untuk Forgejo, atau nonaktifkan SSH.",
 	"keys.verify.token.hint": "Token hanya berlaku selama 1 menit. <a href=\"%s\">Dapatkan yang baru jika sudah kedaluwarsa</a>.",
+	"admin.federation.federation": "Federasi",
+	"admin.federation.hosts": "Host",
+	"admin.federation.hosts.title": "Host federasi",
+	"admin.federation.hosts.manage_panel": "Kelola host federasi",
+	"admin.federation.hosts.details_panel": "Detail host federasi",
+	"admin.federation.hosts.show_details": "Tampilkan detail host",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Skema",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.software_name": "Perangkat lunak",
+	"admin.federation.host.created": "Dibuat",
+	"admin.federation.host.updated": "Diperbarui",
+	"admin.federation.host.latest_activity": "Aktivitas terbaru",
+	"admin.federation.users": "Pengguna",
+	"admin.federation.users.title": "Pengguna terfederasi",
+	"admin.federation.users.manage_panel": "Kelola pengguna terfederasi",
+	"admin.federation.users.show_local_user": "Tampilkan detail pengguna lokal",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID pengguna lokal",
+	"admin.federation.user.external_id": "ID pengguna eksternal",
+	"admin.federation.user.inbox_path": "Jalur kotak masuk",
+	"admin.config.federation": "Konfigurasi federasi",
+	"admin.config.federation.enabled": "Diaktifkan",
+	"admin.config.federation.share_user_statistics": "Bagikan statistik pengguna dengan host lain",
+	"admin.config.federation.max_size": "Ukuran respons maksimum yang diizinkan",
+	"admin.config.federation.signature_enforced": "Wajibkan tanda tangan HTTP",
+	"admin.config.federation.signature_algorithms": "Algoritma tanda tangan",
+	"admin.config.federation.digest_algorithm": "Algoritma intisari tanda tangan",
+	"admin.config.federation.get_headers": "Header GET yang ditandatangani",
+	"admin.config.federation.post_headers": "Header POST yang ditandatangani",
 	"moderation.report.mark_as_handled": "Tandai sebagai ditangani",
 	"moderation.report.mark_as_ignored": "Tandai sebagai diabaikan",
 	"moderation.action.account.delete": "Hapus akun",
@@ -225,6 +363,12 @@
 	"settings.access_token.resource_public_only_help": "Batasi akses ke repositori dan organisasi yang bersifat publik.",
 	"settings.access_token.resource_specific_repo_help": "Batasi akses ke daftar repositori tertentu. Akses hanya-baca diizinkan untuk semua repositori publik. Hanya izin yang memungkinkan akses ke repositori dan issue yang dapat diaktifkan.",
 	"settings.access_token.admin_disabled": "Izin administratif dinonaktifkan.",
+	"user.activitypub_feed.feed": "Umpan Fediverse",
+	"user.activitypub_feed.no_activity": "Tidak ada aktivitas fediverse",
+	"user.activitypub_feed.is_empty": "Umpan fediverse Anda kosong.",
+	"user.activitypub_feed.hint": "Umpan ini menampilkan aktivitas dari akun fediverse yang Anda ikuti, serta postingan terfederasi yang menyebut Anda.",
+	"user.activitypub_feed.posted_on": "Diposting pada %s",
+	"user.activitypub_feed.original_source": "Sumber asli",
 	"release.n_downloads": "%s unduhan",
 	"gpg.default_key": "Ditandatangani dengan kunci default",
 	"gpg.error.no_committer_account": "Tidak ada akun yang terhubung ke alamat email pembuat komit",
@@ -243,6 +387,10 @@
 	"munits.data.tib": "TiB",
 	"munits.data.pib": "PiB",
 	"munits.data.eib": "EiB",
+	"counters.n_commits": "%s komit",
+	"counters.n_branches": "%s cabang",
+	"counters.n_tags": "%s tag",
+	"counters.n_releases": "%s rilis",
 	"packages.title": "Paket",
 	"packages.empty": "Belum ada paket.",
 	"packages.empty.documentation": "Untuk informasi lebih lanjut tentang registri paket, lihat <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">dokumentasi</a>.",
@@ -517,6 +665,10 @@
 	"actions.secrets.mutation.value_description": "Nilai yang ada tidak akan ditampilkan. Biarkan kolom kosong jika Anda tidak ingin mengubahnya. Karakter khusus tetap dipertahankan. CRLF (jeda baris gaya Windows) secara otomatis dikonversi menjadi LF. Enkode nilai dengan Base64 jika jeda baris perlu dipertahankan.",
 	"teams.add_all_repos.modal.header": "Tambahkan semua repositori",
 	"teams.remove_all_repos.modal.header": "Hapus semua repositori",
+	"members.add_member": "Tambahkan anggota",
+	"members.user": "Pengguna",
+	"members.user_already_member": "Pengguna ini sudah menjadi anggota organisasi.",
+	"members.no_team_selected": "Anggota organisasi harus tergabung dalam setidaknya satu tim.",
 	"pulls.manual_merge.helper": "Pembantu penggabungan manual",
 	"pulls.manual_merge.helpder.description": "Gunakan pesan commit penggabungan ini saat menyelesaikan penggabungan secara manual.",
 	"pulls.manual_merge.commit.title": "Judul commit penggabungan",
diff --git a/options/locale_next/locale_is-IS.json b/options/locale_next/locale_is-IS.json
index ff203bc503..fceede90e6 100644
--- a/options/locale_next/locale_is-IS.json
+++ b/options/locale_next/locale_is-IS.json
@@ -1,4 +1,30 @@
 {
+	"admin.monitor.queue.settings.changed": "Stillingar Uppfærðar",
+	"admin.monitor.queue.settings.submit": "Uppfæra Stillingar",
+	"admin.monitor.queue.type": "Tegund",
+	"admin.monitor.queue.name": "Heiti",
+	"admin.monitor.queues": "Raðir",
+	"admin.users.list_status_filter.not_2fa_enabled": "Tvíþætt Auðkenning Óvirk",
+	"admin.users.list_status_filter.not_prohibit_login": "Leyfa Innskráningu",
+	"admin.users.list_status_filter.is_prohibit_login": "Stöðva Innskráningu",
+	"admin.users.list_status_filter.is_admin": "Stjórnandi",
+	"admin.users.list_status_filter.is_active": "Virkt",
+	"admin.users.list_status_filter.reset": "Endurstilla",
+	"admin.users.list_status_filter.menu_text": "Sía",
+	"admin.system_status.total_memory_allocated": "Heildarminni úthlutað",
+	"admin.system_status.server_uptime": "Uppitími Netþjóns",
+	"webauthn.error.timeout": "Tímamörk náð áður en hægt var að lesa lykilinn þinn. Vinsamlegast endurhlaðið þessa síðu og reyndu aftur.",
+	"webauthn.error.empty": "Þú verður að setja nafn fyrir þennan lykil.",
+	"webauthn.error.duplicated": "Öryggislykillinn er ekki leyfður fyrir þessa beiðni. Gakktu úr skugga um að lykillinn sé ekki þegar skráður.",
+	"webauthn.error.unable_to_process": "Netþjónninn gat ekki ráðið við beiðni þína.",
+	"webauthn.error.insecure": "WebAuthn styður aðeins öruggar tengingar. Til að prófa yfir HTTP geturðu notað upprunann „localhost“ eða „127.0.0.1“",
+	"webauthn.error.unknown": "Óþekkt villa kom upp. Vinsamlegast reyndu aftur.",
+	"webauthn.unsupported_browser": "Vafrinn þinn styður ekki WebAuthn eins og er.",
+	"webauthn.error": "Gat ekki lesið öryggislykilinn þinn.",
+	"webauthn.use_twofa": "Notaðu tveggja-þátta kóða úr símanum þínum",
+	"webauthn.press_button": "Vinsamlegast ýttu á hnappinn á öryggislyklinum þínum…",
+	"webauthn.sign_in": "Ýttu á hnappinn á öryggislyklinum þínum. Ef öryggislykillinn þinn hefur engan hnapp skaltu setja hann aftur inn.",
+	"webauthn.insert_key": "Settu öryggislykilinn þinn inn",
 	"actions.runners.name": "Heiti",
 	"actions.runners.owner_type": "Tegund",
 	"actions.runners.description": "Lýsing",
@@ -32,5 +58,13 @@
 	"packages.pypi.requires": "Þarfnast Python",
 	"repo.pulls.title_desc": "vill sameina %[1]d framlög frá <code>%[2]s</code> í <code id=\"%[4]s\">%[3]s</code>",
 	"migrate.git.description": "Flytja hugbúnaðarsafn aðeins frá Git þjónustu.",
+	"migrate.items.wiki": "Handbók",
+	"migrate.items.milestones": "Tímamót",
+	"migrate.items.labels": "Skýringar",
+	"migrate.items.issues": "Vandamál",
+	"migrate.items.pull_requests": "Sameiningarbeiðnir",
+	"migrate.items.merge_requests": "Sameiningarbeiðnir",
+	"migrate.items.releases": "Útgáfur",
+	"migrate.in_progress.labels": "Að færa Lýsingar",
 	"meta.last_line": " "
 }
diff --git a/options/locale_next/locale_it-IT.json b/options/locale_next/locale_it-IT.json
index 54a8de0f50..0efdd472c6 100644
--- a/options/locale_next/locale_it-IT.json
+++ b/options/locale_next/locale_it-IT.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Tutti gli elementi in coda sono stati rimossi.",
+	"admin.monitor.queue.settings.remove_all_items": "Rimuovi tutto",
+	"admin.monitor.queue.settings.changed": "Impostazioni aggiornate",
+	"admin.monitor.queue.settings.submit": "Aggiorna impostazioni",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Il numero massimo di lavoratori deve essere un numero",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Attualmente %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Massimo numero di workers",
+	"admin.monitor.queue.settings.description": "Le piscine crescono dinamicamente in risposta al blocco dei lavoratori in coda.",
+	"admin.monitor.queue.settings.title": "Impostazioni piscina",
+	"admin.monitor.queue.review_add": "Revisiona / aggiungi lavoratori",
+	"admin.monitor.queue.numberinqueue": "Numero in coda",
+	"admin.monitor.queue.maxnumberworkers": "Massimo numero di lavoratori",
+	"admin.monitor.queue.activeworkers": "Lavoratori attivi",
+	"admin.monitor.queue.numberworkers": "Numero di lavoratori",
+	"admin.monitor.queue.exemplar": "Tipo di esemplare",
+	"admin.monitor.queue.type": "Tipo",
+	"admin.monitor.queue.name": "Nome",
+	"admin.monitor.queue": "Coda: %s",
+	"admin.monitor.queues": "Code",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA disabilitato",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA abilitato",
+	"admin.users.list_status_filter.not_prohibit_login": "Accesso consentito",
+	"admin.users.list_status_filter.is_prohibit_login": "Accesso vietato",
+	"admin.users.list_status_filter.not_restricted": "Non limitato",
+	"admin.users.list_status_filter.is_restricted": "Limitato",
+	"admin.users.list_status_filter.not_admin": "Non amministratore",
+	"admin.users.list_status_filter.is_admin": "Amministratore",
+	"admin.users.list_status_filter.not_active": "Inattivo",
+	"admin.users.list_status_filter.is_active": "Attivo",
+	"admin.users.list_status_filter.reset": "Ripristina",
+	"admin.users.list_status_filter.menu_text": "Filtro",
+	"admin.system_status.gc_times": "Esecuzioni GC",
+	"admin.system_status.last_gc_pause": "Ultima pausa del GC",
+	"admin.system_status.total_gc_pause": "Pausa totale del GC",
+	"admin.system_status.last_gc_time": "Dall'ultimo GC",
+	"admin.system_status.next_gc_recycle": "Prossimo riciclaggio GC",
+	"admin.system_status.other_system_allocation_obtained": "Altre allocazioni di sistema ottenute",
+	"admin.system_status.gc_metadata_obtained": "Metadata del GC ottenuto",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Tabelle hash del secchio di profilazione ottenute",
+	"admin.system_status.mcache_structures_obtained": "Strutture MCache ottenute",
+	"admin.system_status.mcache_structures_usage": "Utilizzo di strutture MCache",
+	"admin.system_status.mspan_structures_obtained": "Strutture MSpan ottenute",
+	"admin.system_status.mspan_structures_usage": "Utilizzo strutture MSpan",
+	"admin.system_status.stack_memory_obtained": "Memoria pila ottenuta",
+	"admin.system_status.bootstrap_stack_usage": "Utilizzo pila iniziale",
+	"admin.system_status.heap_objects": "Oggetti dell'heap",
+	"admin.system_status.heap_memory_released": "Memoria heap rilasciata",
+	"admin.system_status.heap_memory_in_use": "Memoria heap in uso",
+	"admin.system_status.heap_memory_idle": "Memoria heap inattiva",
+	"admin.system_status.heap_memory_obtained": "Memoria heap ottenuta",
+	"admin.system_status.current_heap_usage": "Utilizzo heap attuale",
+	"admin.system_status.memory_free_times": "Rilasci di memoria",
+	"admin.system_status.memory_allocate_times": "Allocazioni di memoria",
+	"admin.system_status.pointer_lookup_times": "Tempi di ricerca del puntatore",
+	"admin.system_status.memory_obtained": "Memoria ottenuta",
+	"admin.system_status.total_memory_allocated": "Memoria allocata totale",
+	"admin.system_status.current_memory_usage": "Utilizzo di memoria attuale",
+	"admin.system_status.current_goroutine": "Goroutine attuali",
+	"admin.system_status.server_uptime": "Tempo di attività",
+	"markup.filepreview.truncated": "L'anteprima è stata troncata",
+	"markup.filepreview.lines": "Linee da %[1]d a %[2]d in %[3]s",
+	"markup.filepreview.line": "Linea %[1]d in %[2]s",
+	"actions.variables.update.success": "La variabile è stata modificata.",
+	"actions.variables.update.failed": "Impossibile modificare la variabile.",
+	"actions.variables.creation.success": "La variabile \"%s\" è stata aggiunta.",
+	"actions.variables.creation.failed": "Errore nell'aggiunta della variabile.",
+	"actions.variables.deletion.success": "La variabile è stata rimossa.",
+	"actions.variables.deletion.failed": "Impossibile rimuovere la variabile.",
+	"actions.variables.not_found": "Non è stato possibile trovare la variabile.",
+	"actions.variables.edit": "Modifica variabile",
+	"actions.variables.description": "Le variabili saranno passate a determinate azioni e non possono essere lette altrimenti.",
+	"actions.variables.deletion.description": "La rimozione di una variabile è permanente e non può essere annullata. Continuare?",
+	"actions.variables.deletion": "Rimuovi variabile",
+	"actions.variables.none": "Non ci sono ancora variabili.",
+	"actions.variables.creation": "Aggiungi variabile",
+	"actions.variables.management": "Gestisci variabili",
+	"actions.variables": "Variabili",
+	"webauthn.error.timeout": "Timeout raggiunto prima che la tua chiave possa essere letta. Ricarica la pagina e riprova.",
+	"webauthn.error.empty": "Devi impostare un nome per questa chiave.",
+	"webauthn.error.duplicated": "La chiave di sicurezza non è consentita per questa richiesta. Assicurati che la chiave non sia già registrata.",
+	"webauthn.error.unable_to_process": "Il server non può elaborare la richiesta.",
+	"webauthn.error.insecure": "WebAuthn supporta solo connessioni sicure. Per il test su HTTP, è possibile utilizzare l'origine \"localhost\" o \"127.0.0.1\"",
+	"webauthn.error.unknown": "Si è verificato un errore sconosciuto. Riprova.",
+	"webauthn.unsupported_browser": "Il tuo browser al momento non supporta WebAuthn.",
+	"webauthn.error": "Impossibile leggere la tua chiave di sicurezza.",
+	"webauthn.use_twofa": "Usa un codice a due fattori dal tuo telefono",
+	"webauthn.press_button": "Premi il pulsante sulla chiave di sicurezza…",
+	"webauthn.sign_in": "Premi il pulsante sul tasto di sicurezza. Se il tasto di sicurezza non ha pulsante, reinseriscilo.",
+	"webauthn.insert_key": "Inserisci la tua chiave di sicurezza",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"many": "%s commit",
+		"other": ""
+	},
+	"counters.n_branches": {
+		"one": "%s ramo",
+		"many": "%s rami",
+		"other": ""
+	},
+	"counters.n_tags": {
+		"one": "%s etichetta",
+		"many": "%s etichette",
+		"other": ""
+	},
+	"counters.n_releases": {
+		"one": "%s rilascio",
+		"many": "%s rilasci",
+		"other": ""
+	},
 	"gpg.default_key": "Firmato con la chiave predefinita",
 	"gpg.error.extract_sign": "Impossibile ricavare la firma",
 	"gpg.error.generate_hash": "Impossibile generare hash del commit",
@@ -296,6 +405,23 @@
 	"migrate.gitbucket.description": "Migra i dati dalle istanze di GitBucket.",
 	"migrate.codebase.description": "Migrare i dati da codebasehq.com.",
 	"migrate.forgejo.description": "Migra dati da codeberg.org o da altre istanze Forgejo.",
+	"migrate.items.label": "Elementi di migrazione",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Traguardi",
+	"migrate.items.labels": "Etichette",
+	"migrate.items.issues": "Segnalazioni",
+	"migrate.items.pull_requests": "Richieste di modifica",
+	"migrate.items.merge_requests": "Richieste di fusione",
+	"migrate.items.releases": "Rilasci",
+	"migrate.in_progress.git": "Migrazione dei dati Git",
+	"migrate.in_progress.topics": "Migrazione degli argomenti",
+	"migrate.in_progress.milestones": "Migrazione dei traguardi",
+	"migrate.in_progress.labels": "Migrazione delle etichette",
+	"migrate.in_progress.releases": "Migrazione dei rilasci",
+	"migrate.in_progress.issues": "Migrazione delle segnalazioni",
+	"migrate.in_progress.pulls": "Migrazione delle richieste di modifica",
+	"migrate.cancel.title": "Annulla migrazione",
+	"migrate.cancel.confirmation": "Vuoi annullare questa migrazione?",
 	"repo.settings.push_mirror.branch_filter.label": "Filtro ramo (opzionale)",
 	"alert.range_error": " deve essere un numero tra %[1]s e %[2]s.",
 	"keys.gpg.link": "Chiavi GPG",
diff --git a/options/locale_next/locale_ja-JP.json b/options/locale_next/locale_ja-JP.json
index bc9038e648..f462ff4e74 100644
--- a/options/locale_next/locale_ja-JP.json
+++ b/options/locale_next/locale_ja-JP.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "キュー内のすべての項目を削除しました。",
+	"admin.monitor.queue.settings.remove_all_items": "すべて削除",
+	"admin.monitor.queue.settings.changed": "設定を更新しました",
+	"admin.monitor.queue.settings.submit": "設定を更新",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "ワーカー数上限は数値にしてください",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "現在の設定 %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "ワーカー数上限",
+	"admin.monitor.queue.settings.description": "プールはワーカーキューの待機状態に応じて動的に大きくなります。",
+	"admin.monitor.queue.settings.title": "プール設定",
+	"admin.monitor.queue.review_add": "ワーカーの確認 / 追加",
+	"admin.monitor.queue.numberinqueue": "キュー内の数",
+	"admin.monitor.queue.maxnumberworkers": "ワーカー数上限",
+	"admin.monitor.queue.activeworkers": "使用ワーカー数",
+	"admin.monitor.queue.numberworkers": "ワーカー数",
+	"admin.monitor.queue.exemplar": "要素の型",
+	"admin.monitor.queue.type": "種類",
+	"admin.monitor.queue.name": "キュー名",
+	"admin.monitor.queue": "キュー: %s",
+	"admin.monitor.queues": "キュー",
+	"admin.users.list_status_filter.not_2fa_enabled": "2要素認証無効",
+	"admin.users.list_status_filter.is_2fa_enabled": "2要素認証有効",
+	"admin.users.list_status_filter.not_prohibit_login": "ログインを許可",
+	"admin.users.list_status_filter.is_prohibit_login": "ログインを禁止",
+	"admin.users.list_status_filter.not_restricted": "制限なし",
+	"admin.users.list_status_filter.is_restricted": "制限あり",
+	"admin.users.list_status_filter.not_admin": "非管理者",
+	"admin.users.list_status_filter.is_admin": "管理者",
+	"admin.users.list_status_filter.not_active": "無効",
+	"admin.users.list_status_filter.is_active": "有効",
+	"admin.users.list_status_filter.reset": "リセット",
+	"admin.users.list_status_filter.menu_text": "フィルター",
+	"admin.system_status.gc_times": "GC実行回数",
+	"admin.system_status.last_gc_pause": "前回のGC停止時間",
+	"admin.system_status.total_gc_pause": "GC停止時間の合計",
+	"admin.system_status.last_gc_time": "前回GCからの時間",
+	"admin.system_status.next_gc_recycle": "次回のGCリサイクル",
+	"admin.system_status.other_system_allocation_obtained": "その他システム割当用取得量",
+	"admin.system_status.gc_metadata_obtained": "GCメタデータ用取得量",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "バケットハッシュテーブルのプロファイリング割当量",
+	"admin.system_status.mcache_structures_obtained": "MCache構造体用取得量",
+	"admin.system_status.mcache_structures_usage": "MCache構造体の使用量",
+	"admin.system_status.mspan_structures_obtained": "MSpan構造体用取得量",
+	"admin.system_status.mspan_structures_usage": "MSpan構造体の使用量",
+	"admin.system_status.stack_memory_obtained": "スタック用メモリ取得量",
+	"admin.system_status.bootstrap_stack_usage": "スタック使用量",
+	"admin.system_status.heap_objects": "ヒープオブジェクト数",
+	"admin.system_status.heap_memory_released": "解放済みヒープ容量",
+	"admin.system_status.heap_memory_in_use": "使用中のヒープ容量",
+	"admin.system_status.heap_memory_idle": "未使用のヒープ容量",
+	"admin.system_status.heap_memory_obtained": "ヒープ用メモリ取得量",
+	"admin.system_status.current_heap_usage": "現在のヒープ使用量",
+	"admin.system_status.memory_free_times": "メモリ解放回数",
+	"admin.system_status.memory_allocate_times": "メモリ割当回数",
+	"admin.system_status.pointer_lookup_times": "ポインタ参照回数",
+	"admin.system_status.memory_obtained": "メモリ取得量",
+	"admin.system_status.total_memory_allocated": "メモリ割当量の累計",
+	"admin.system_status.current_memory_usage": "現在のメモリ使用量",
+	"admin.system_status.current_goroutine": "現在のGoroutine数",
+	"admin.system_status.server_uptime": "サーバーの稼働時間",
+	"markup.filepreview.truncated": "プレビューは途中から省略されています",
+	"markup.filepreview.lines": "%[3]s の %[1]d 行目から %[2]d 行目",
+	"markup.filepreview.line": "%[2]s の %[1]d 行目",
+	"actions.variables.update.success": "変数を更新しました。",
+	"actions.variables.update.failed": "変数を更新できませんでした。",
+	"actions.variables.creation.success": "変数 \"%s\" を追加しました。",
+	"actions.variables.creation.failed": "変数を追加できませんでした。",
+	"actions.variables.deletion.success": "変数を削除しました。",
+	"actions.variables.deletion.failed": "変数を削除できませんでした。",
+	"actions.variables.not_found": "変数が見つかりませんでした。",
+	"actions.variables.edit": "変数の編集",
+	"actions.variables.description": "変数は特定のActionsに渡されます。 それ以外で読み出されることはありません。",
+	"actions.variables.deletion.description": "変数の削除は恒久的で元に戻すことはできません。 続行しますか？",
+	"actions.variables.deletion": "変数を削除",
+	"actions.variables.none": "変数はまだありません。",
+	"actions.variables.creation": "変数の追加",
+	"actions.variables.management": "変数の管理",
+	"actions.variables": "変数",
+	"webauthn.error.timeout": "キーを読み取る前にタイムアウトになりました。 このページをリロードしてもう一度やり直してください。",
+	"webauthn.error.empty": "このキーに名前を設定する必要があります。",
+	"webauthn.error.duplicated": "このリクエストに対しては、許可されていないセキュリティキーです。 キーが未登録であることを確認してください。",
+	"webauthn.error.unable_to_process": "サーバーがリクエストを処理できませんでした。",
+	"webauthn.error.insecure": "WebAuthn はセキュアな接続のみをサポートしています。HTTP 経由でテストする場合は、\"localhost\" または \"127.0.0.1\" のオリジンが使用できます",
+	"webauthn.error.unknown": "不明なエラーが発生しました。 もう一度やり直してください。",
+	"webauthn.unsupported_browser": "お使いのブラウザは現在 WebAuthn をサポートしていません。",
+	"webauthn.error": "セキュリティキーを読み取ることができません。",
+	"webauthn.use_twofa": "携帯電話から2要素認証コードを使用する",
+	"webauthn.press_button": "セキュリティキーのボタンを押してください…",
+	"webauthn.sign_in": "セキュリティキーのボタンを押してください。セキュリティキーにボタンが無い場合は、挿入しなおしてください。",
+	"webauthn.insert_key": "セキュリティキーを挿入",
+	"counters.n_commits": {
+		"one": "%s のコミット",
+		"other": "%s のコミット"
+	},
+	"counters.n_branches": {
+		"one": "%s のブランチ",
+		"other": "%s のブランチ"
+	},
+	"counters.n_tags": {
+		"one": "%s のタグ",
+		"other": "%s のタグ"
+	},
+	"counters.n_releases": {
+		"one": "%s リリース",
+		"other": "%s リリース"
+	},
 	"actions.actions": "Actions",
 	"actions.status.unknown": "不明",
 	"actions.status.waiting": "待機中",
@@ -229,6 +334,23 @@
 	"migrate.gitbucket.description": "GitBucket インスタンスからデータを移行します。",
 	"migrate.codebase.description": "codebasehq.com からデータを移行します。",
 	"migrate.forgejo.description": "codeberg.orgまたは他のインスタンスからデータを移行する。",
+	"migrate.items.label": "移行する項目",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "マイルストーン",
+	"migrate.items.labels": "ラベル",
+	"migrate.items.issues": "イシュー",
+	"migrate.items.pull_requests": "プルリクエスト",
+	"migrate.items.merge_requests": "マージリクエスト",
+	"migrate.items.releases": "リリース",
+	"migrate.in_progress.git": "Gitデータ移行中",
+	"migrate.in_progress.topics": "トピック移行中",
+	"migrate.in_progress.milestones": "マイルストーン移行中",
+	"migrate.in_progress.labels": "ラベル移行中",
+	"migrate.in_progress.releases": "リリース移行中",
+	"migrate.in_progress.issues": "イシュー移行中",
+	"migrate.in_progress.pulls": "プルリクエスト移行中",
+	"migrate.cancel.title": "移行のキャンセル",
+	"migrate.cancel.confirmation": "この移行をキャンセルしますか？",
 	"pulse.n_active_issues": "%s件のアクティブなイシュー",
 	"pulse.n_active_prs": "%s件のアクティブなプルリクエスト",
 	"meta.last_line": " ",
diff --git a/options/locale_next/locale_ka.json b/options/locale_next/locale_ka.json
index 37fd5b4a8b..bfd0bbf460 100644
--- a/options/locale_next/locale_ka.json
+++ b/options/locale_next/locale_ka.json
@@ -1,4 +1,19 @@
 {
+	"admin.monitor.queue.type": "ტიპი",
+	"admin.monitor.queue.name": "სახელი",
+	"admin.monitor.queues": "რიგები",
+	"admin.users.list_status_filter.is_restricted": "შეზღუდული",
+	"admin.users.list_status_filter.is_admin": "ადმინი",
+	"admin.users.list_status_filter.not_active": "არააქტიურია",
+	"admin.users.list_status_filter.is_active": "აქტიურია",
+	"admin.users.list_status_filter.reset": "ჩამოყრა",
+	"admin.users.list_status_filter.menu_text": "ფილტრი",
+	"actions.variables": "ცვლადები",
+	"migrate.items.wiki": "ვიკი",
+	"migrate.items.milestones": "მისაღწევი გეგმები",
+	"migrate.items.labels": "ჭდეები",
+	"migrate.items.issues": "პრობლემები",
+	"migrate.items.releases": "რელიზები",
 	"actions.actions": "ქმედებები",
 	"actions.status.unknown": "უცნობი",
 	"actions.status.waiting": "ველოდები",
diff --git a/options/locale_next/locale_kab.json b/options/locale_next/locale_kab.json
index 17120dd836..5d874fb42d 100644
--- a/options/locale_next/locale_kab.json
+++ b/options/locale_next/locale_kab.json
@@ -1,4 +1,9 @@
 {
+	"admin.monitor.queue.settings.remove_all_items": "Kkes-iten akk",
+	"admin.monitor.queue.name": "Isem",
+	"admin.users.list_status_filter.is_admin": "Anedbal",
+	"admin.users.list_status_filter.not_active": "D arurmid",
+	"admin.users.list_status_filter.is_active": "D urmid",
 	"actions.runners.name": "Isem",
 	"actions.runners.description": "Aglam",
 	"actions.runners.task_list.repository": "Akufi",
@@ -29,6 +34,9 @@
 	"admin.config.global_2fa_requirement.none": "Uhu",
 	"admin.config.global_2fa_requirement.admin": "Inedbalen",
 	"migrate.pagure.token_label": "Ajiṭun API n Pagure",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.labels": "Tibzimin",
+	"migrate.items.issues": "Uguren",
 	"home.explore_repos": "Snirem ikufan",
 	"home.explore_users": "Snirem iseqdacen",
 	"relativetime.1week": "dduṛt yezrin",
@@ -106,11 +114,8 @@
 	"packages.settings.delete": "Kkes akemmus",
 	"actions.actions": "Tigawin",
 	"actions.runners.token": "Tiddest",
-	"actions.runners.version": "Lqem",
-	"actions.runners.list_runners.details_column": "Talqayt",
 	"actions.runners.list_runners.edit_column": "Ẓreg",
 	"actions.runners.list_runners.delete_column": "Kkes",
-	"actions.runners.list_runners.details_button": "Talqayt",
 	"actions.runners.list_runners.delete_button": "Kkes",
 	"actions.runners.list_runners.edit_button": "Ẓreg",
 	"actions.runners.ephemeral.yes": "ih",
@@ -124,5 +129,13 @@
 	"actions.runners.edit_runner.description_label": "Aglam",
 	"actions.runners.edit_runner.save_button": "Sekles",
 	"actions.runners.edit_runner.cancel_button": "Semmet",
-	"form.RunnerName": "Isem"
+	"form.RunnerName": "Isem",
+	"members.user": "Aseqdac",
+	"actions.runners.version": "Lqem",
+	"admin.federation.host.schema": "Azenziɣ",
+	"admin.federation.host.port": "Tawwurt",
+	"admin.federation.host.software_name": "Aseɣẓan",
+	"admin.federation.users": "Iseqdacen",
+	"admin.federation.user.id": "Asulay ID",
+	"admin.config.federation.enabled": "D urmid"
 }
diff --git a/options/locale_next/locale_ko-KR.json b/options/locale_next/locale_ko-KR.json
index 08b746eba9..b6f638bf0f 100644
--- a/options/locale_next/locale_ko-KR.json
+++ b/options/locale_next/locale_ko-KR.json
@@ -1,4 +1,54 @@
 {
+	"admin.monitor.queue.settings.submit": "설정 업데이트",
+	"admin.monitor.queue.type": "유형",
+	"admin.monitor.queue.name": "이름",
+	"admin.users.list_status_filter.is_admin": "관리자",
+	"admin.users.list_status_filter.is_active": "사용",
+	"admin.system_status.gc_times": "가비지 콜렉션 시간",
+	"admin.system_status.last_gc_pause": "마지막 가비지 콜렉션 중지",
+	"admin.system_status.total_gc_pause": "모든 가비지 콜렉션 중지",
+	"admin.system_status.last_gc_time": "마지막 가비지 콜렉션 시간",
+	"admin.system_status.next_gc_recycle": "다음 가비지 콜렉션 순환",
+	"admin.system_status.other_system_allocation_obtained": "기타 시스템 할당 확보",
+	"admin.system_status.gc_metadata_obtained": "가비지 콜렉션 메타 데이터 확보",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "버켓 해시 테이블 확보 프로파일링",
+	"admin.system_status.mcache_structures_obtained": "MCache 구조 확보",
+	"admin.system_status.mcache_structures_usage": "MCache 구조 사용현황",
+	"admin.system_status.mspan_structures_obtained": "MSpan 구조 확보",
+	"admin.system_status.mspan_structures_usage": "MSpan 구조 사용현황",
+	"admin.system_status.stack_memory_obtained": "스택 메모리 확보",
+	"admin.system_status.bootstrap_stack_usage": "부트스트랩 스택 사용현황",
+	"admin.system_status.heap_objects": "힙 객체",
+	"admin.system_status.heap_memory_released": "힙 메모리 풀림",
+	"admin.system_status.heap_memory_in_use": "힙 메모리 사용중",
+	"admin.system_status.heap_memory_idle": "힙 메모리 유휴",
+	"admin.system_status.heap_memory_obtained": "힙 메모리 확보",
+	"admin.system_status.current_heap_usage": "현재 힙 사용현황",
+	"admin.system_status.memory_free_times": "가용 메모리",
+	"admin.system_status.memory_allocate_times": "사용 메모리",
+	"admin.system_status.pointer_lookup_times": "포인터 조회 시간",
+	"admin.system_status.memory_obtained": "메모리 확보",
+	"admin.system_status.total_memory_allocated": "전체 할당 메모리",
+	"admin.system_status.current_memory_usage": "현재 메모리 사용율",
+	"admin.system_status.current_goroutine": "현재 Go루틴",
+	"admin.system_status.server_uptime": "서버를 켠 시간",
+	"webauthn.error.timeout": "키를 읽기 전에 시간이 초과되었습니다. 페이지를 새로 고치고 다시 시도해주세요.",
+	"webauthn.error.empty": "키의 이름을 설정해야 합니다.",
+	"webauthn.error.duplicated": "이 요청에는 보안 키가 허용되지 않습니다. 키가 이미 등록되어 있는지 확인하세요.",
+	"webauthn.error.unable_to_process": "서버가 귀하의 요청을 처리할 수 없습니다.",
+	"webauthn.error.insecure": "웹 인증은 안전한 연결만 지원합니다. HTTP에서 테스트할 경우, \"localhost\" 또는 \"127.0.0.1\" 오리진을 사용할 수 있습니다.",
+	"webauthn.error.unknown": "알 수 없는 오류가 발생했습니다. 다시 시도해주세요.",
+	"webauthn.unsupported_browser": "현재 귀하의 브라우저는 웹 인증을 지원하지 않습니다.",
+	"webauthn.error": "보안 키를 읽을 수 없습니다.",
+	"webauthn.use_twofa": "휴대전화 2단계 코드 사용",
+	"webauthn.press_button": "보안 키의 버튼을 누르세요…",
+	"webauthn.sign_in": "보안 키에 있는 버튼을 누르세요. 만약 보안 키에 버튼이 없다면 다시 입력하세요.",
+	"webauthn.insert_key": "보안 키를 입력하세요",
+	"migrate.items.wiki": "위키",
+	"migrate.items.milestones": "마일스톤",
+	"migrate.items.issues": "이슈",
+	"migrate.items.pull_requests": "풀 리퀘스트",
+	"migrate.items.releases": "릴리즈",
 	"actions.runners.name": "이름",
 	"actions.runners.owner_type": "유형",
 	"actions.runners.description": "설명",
diff --git a/options/locale_next/locale_kw.ini b/options/locale_next/locale_kw.ini
deleted file mode 100644
index 19b2bd44c4..0000000000
--- a/options/locale_next/locale_kw.ini
+++ /dev/null
@@ -1 +0,0 @@
-{"home.welcome.no_activity": "Nyns eys aktivita"}
diff --git a/options/locale_next/locale_kw.json b/options/locale_next/locale_kw.json
new file mode 100644
index 0000000000..5287b1d0f5
--- /dev/null
+++ b/options/locale_next/locale_kw.json
@@ -0,0 +1,15 @@
+{
+	"webauthn.error.timeout": "Termyn yn-mes hedhys kyns agas alhwedh y hyllys redys. Daskargewgh an folen ma mar pleg hag assayewgh arta.",
+	"webauthn.error.empty": "Res yw dhywgh settya hanow rag an alhwedh ma.",
+	"webauthn.error.duplicated": "Nyns yw an alhwedh sawder gesys rag an govyn ma. Mar pleg, surhewgh nyns yw an alhwedh kovskrifys seulabrys.",
+	"webauthn.error.unable_to_process": "Ny yllir an servell argerdhes agas govyn.",
+	"webauthn.error.insecure": "WebAuthn a skoodh junyans saw yn unnik. Rag ow previ dres HTTP. ty a yll devnydhya an devedhyans \"localhost\" po \"127.0.0.1\"",
+	"webauthn.error.unknown": "Yth esa error ankoth. Mar pleg assayewgh arta.",
+	"webauthn.unsupported_browser": "Ny skoodhya a-lemmyn agas peurell WebAuthn.",
+	"webauthn.error": "Ny yllir redya agas alhwedh sawder.",
+	"webauthn.use_twofa": "Devnydhyer kod dewkamm dhyworth agas klapkodh",
+	"webauthn.press_button": "Mar pleg gwaskewgh an boton war agas alhwedh sawder…",
+	"webauthn.sign_in": "Tavewgh an boton war agas alhwedh sawder. Mar nyns eus boton, gorrewgh a-bervedh arta.",
+	"webauthn.insert_key": "Gorra a-bervedh agas alhwedh sawder",
+	"home.welcome.no_activity": "Nyns eys aktivita"
+}
diff --git a/options/locale_next/locale_lt.json b/options/locale_next/locale_lt.json
index bd3d3d0e54..a60c96a4ae 100644
--- a/options/locale_next/locale_lt.json
+++ b/options/locale_next/locale_lt.json
@@ -1,4 +1,17 @@
 {
+	"markup.filepreview.truncated": "Peržiūra buvo sutrumpinta",
+	"webauthn.error.timeout": "Baigėsi laikas, per kurį nebuvo galima nuskaityti rakto. Perkraukite šį puslapį ir bandykite dar kartą.",
+	"webauthn.error.empty": "Turite nustatyti šio rakto pavadinimą.",
+	"webauthn.error.duplicated": "Saugumo raktas neleidžiamas šiai prašymai. Įsitikinkite, kad raktas dar nėra užregistruotas.",
+	"webauthn.error.unable_to_process": "Serveris negalėjo apdoroti jūsų prašymo.",
+	"webauthn.error.insecure": "„WebAuthn“ palaiko tik saugius ryšius. Bandymams per HTTP galite naudoti „localhost“ arba „127.0.0.0.1“.",
+	"webauthn.error.unknown": "Įvyko nežinoma klaida. Bandykite dar kartą.",
+	"webauthn.unsupported_browser": "Jūsų naršyklė šiuo metu nepalaiko „WebAuthn“.",
+	"webauthn.error": "Nepavyko nuskaityti saugumo rakto.",
+	"webauthn.use_twofa": "Naudoti dvigubą kodą iš telefono",
+	"webauthn.press_button": "Paspauskite saugumo rakto mygtuką…",
+	"webauthn.sign_in": "Paspauskite saugumo rakto mygtuką. Jei saugumo raktas neturi mygtuko, įkiškite jį iš naujo.",
+	"webauthn.insert_key": "Įkiškite savo saugumo raktą",
 	"search.milestone_kind": "Ieškoti gairių...",
 	"meta.last_line": " "
 }
diff --git a/options/locale_next/locale_lv-LV.json b/options/locale_next/locale_lv-LV.json
index 817e2a4ae5..066ecfaea4 100644
--- a/options/locale_next/locale_lv-LV.json
+++ b/options/locale_next/locale_lv-LV.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Visi rindsaraksta vienumi tika noņemti.",
+	"admin.monitor.queue.settings.remove_all_items": "Noņemt visus",
+	"admin.monitor.queue.settings.changed": "Iestatījumi atjaunināti",
+	"admin.monitor.queue.settings.submit": "Atjaunināt iestatījumus",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Lielākajam pieļaujamajam strādņu skaitam ir jābūt skaitlim",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Pašalaik %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Maksimālais strādņu skaits",
+	"admin.monitor.queue.settings.description": "Pūli dinamiski palielinās atkarībā no to strādņu rindu aizturēšanas.",
+	"admin.monitor.queue.settings.title": "Pūla iestatījumi",
+	"admin.monitor.queue.review_add": "Pārskatīt/pievienot strādņus",
+	"admin.monitor.queue.numberinqueue": "Skaits rindsarakstā",
+	"admin.monitor.queue.maxnumberworkers": "Lielākais pieļaujamais strādņu skaits",
+	"admin.monitor.queue.activeworkers": "Darbojošies strādņi",
+	"admin.monitor.queue.numberworkers": "Strādņu skaits",
+	"admin.monitor.queue.exemplar": "Eksemplāra veids",
+	"admin.monitor.queue.type": "Veids",
+	"admin.monitor.queue.name": "Nosaukums",
+	"admin.monitor.queue": "Rindsaraksts: %s",
+	"admin.monitor.queues": "Rindsaraksti",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA atspējota",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA iespējota",
+	"admin.users.list_status_filter.not_prohibit_login": "Atļaut pieteikšanos",
+	"admin.users.list_status_filter.is_prohibit_login": "Neļaut pieteikšanos",
+	"admin.users.list_status_filter.not_restricted": "Nav ierobežots",
+	"admin.users.list_status_filter.is_restricted": "Ierobežots",
+	"admin.users.list_status_filter.not_admin": "Nav pārvaldītājs",
+	"admin.users.list_status_filter.is_admin": "Pārvaldītājs",
+	"admin.users.list_status_filter.not_active": "Neaktīvs",
+	"admin.users.list_status_filter.is_active": "Aktīvs",
+	"admin.users.list_status_filter.reset": "Atiestatīt",
+	"admin.users.list_status_filter.menu_text": "Atlasīt",
+	"admin.system_status.gc_times": "GC reizes",
+	"admin.system_status.last_gc_pause": "Pedējais GC pārtraukums",
+	"admin.system_status.total_gc_pause": "Kopējais GC pārtraukums",
+	"admin.system_status.last_gc_time": "Laiks kopš pēdējās GC",
+	"admin.system_status.next_gc_recycle": "Nākamā GC atkritne",
+	"admin.system_status.other_system_allocation_obtained": "Citas iegūtās sistēmas sadales",
+	"admin.system_status.gc_metadata_obtained": "Iegūtie GC metadati",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Iegūtā profilēšanas groza jaucējtabula",
+	"admin.system_status.mcache_structures_obtained": "Iegūtās MCache struktūras",
+	"admin.system_status.mcache_structures_usage": "MCache struktūru lietojums",
+	"admin.system_status.mspan_structures_obtained": "Iegūtās MSpan struktūras",
+	"admin.system_status.mspan_structures_usage": "MSpan struktūru lietojums",
+	"admin.system_status.stack_memory_obtained": "Iegūtā viengala rindas atmiņa",
+	"admin.system_status.bootstrap_stack_usage": "Sākumielādētāja viengala rindas lietojums",
+	"admin.system_status.heap_objects": "Grēdas objekti",
+	"admin.system_status.heap_memory_released": "Atbrīvotā grēdas atmiņa",
+	"admin.system_status.heap_memory_in_use": "Izmantotā grēdas atmiņa",
+	"admin.system_status.heap_memory_idle": "Neizmantotā grēdas atmiņa",
+	"admin.system_status.heap_memory_obtained": "Iegūtā grēdas atmiņa",
+	"admin.system_status.current_heap_usage": "Pašreizējais grēdas lietojums",
+	"admin.system_status.memory_free_times": "Atmiņas atbrīvošanas",
+	"admin.system_status.memory_allocate_times": "Atmiņas iedalīšanas",
+	"admin.system_status.pointer_lookup_times": "Rādītāju uzmeklēšanas reizes",
+	"admin.system_status.memory_obtained": "Iegūtā atmiņa",
+	"admin.system_status.total_memory_allocated": "Kopējā iedalītā atmiņa",
+	"admin.system_status.current_memory_usage": "Pašreizējais atmiņas lietojums",
+	"admin.system_status.current_goroutine": "Pašreizējās gorutīnas",
+	"admin.system_status.server_uptime": "Servera darbības laiks",
+	"markup.filepreview.truncated": "Priekšskatījums tika saīsināts",
+	"markup.filepreview.lines": "%[1]d. līdz %[2]d. rinda %[3]s",
+	"markup.filepreview.line": "%[1]d. rinda %[2]s",
+	"actions.variables.update.success": "Mainīgais tika labots.",
+	"actions.variables.update.failed": "Neizdevās labot mainīgo.",
+	"actions.variables.creation.success": "Mainīgais \"%s\" tika pievienots.",
+	"actions.variables.creation.failed": "Neizdevās pievienot mainīgo.",
+	"actions.variables.deletion.success": "Mainīgais tika noņemts.",
+	"actions.variables.deletion.failed": "Neizdevās noņemt mainīgo.",
+	"actions.variables.not_found": "Neizdevās atrast mainīgo.",
+	"actions.variables.edit": "Labot mainīgo",
+	"actions.variables.description": "Mainīgie tiks padoti noteiktām darbībām, un citādāk tos nevar nolasīt.",
+	"actions.variables.deletion.description": "Mainīgā noņemšana ir neatgriezeniska un nav atsaucama. Turpināt?",
+	"actions.variables.deletion": "Noņemt mainīgo",
+	"actions.variables.none": "Vēl nav neviena mainīgā.",
+	"actions.variables.creation": "Pievienot mainīgo",
+	"actions.variables.management": "Pārvaldīt mainīgos",
+	"actions.variables": "Mainīgie",
+	"webauthn.error.timeout": "Iestājās noildze, pirms varēja nolasīt atslēgu. Lūgums pārlādēt šo lapu un mēģināt vēlreiz.",
+	"webauthn.error.empty": "Jānorāda šīs atslēgas nosaukums.",
+	"webauthn.error.duplicated": "Drošības atslēga nav atļauta šim pieprasījumam. Lūgums pārliecināties, ka šī atslēga nav jau reģistrēta.",
+	"webauthn.error.unable_to_process": "Serveris nevarēja apstrādāt pieprasījumu.",
+	"webauthn.error.insecure": "WebAuthn atbalsta tikai drošus savienojumus. Pārbaudīšanai ar HTTP var izmantot pirmavotu \"localhost\" vai \"127.0.0.1\"",
+	"webauthn.error.unknown": "Atgadījās nezināma kļūda. Lūgums mēģināt vēlreiz.",
+	"webauthn.unsupported_browser": "Pārlūks pašlaik nenodrošina WebAuthn.",
+	"webauthn.error": "Nevar nolasīt drošības atslēgu.",
+	"webauthn.use_twofa": "Izmantot divpakāpju kodu no sava tālruņa",
+	"webauthn.press_button": "Lūgums nospiest pogu uz savas drošības atslēgas…",
+	"webauthn.sign_in": "Jānospiež poga uz drošības atslēgas. Ja tai nav pogas, drošības atslēga ir atkārtoti jāievieto.",
+	"webauthn.insert_key": "Jāievieto sava drošības atslēga",
+	"counters.n_commits": {
+		"zero": "%s iesūtījumu",
+		"one": "%s iesūtījums",
+		"other": "%s iesūtījumi"
+	},
+	"counters.n_branches": {
+		"zero": "%s zaru",
+		"one": "%s zars",
+		"other": "%s zari"
+	},
+	"counters.n_tags": {
+		"zero": "%s birku",
+		"one": "%s birka",
+		"other": "%s birkas"
+	},
+	"counters.n_releases": {
+		"zero": "%s laidienu",
+		"one": "%s laidiens",
+		"other": "%s laidieni"
+	},
 	"gpg.default_key": "Parakstīts ar noklusējuma atslēgu",
 	"gpg.error.extract_sign": "Neizdevās izgūt parakstu",
 	"gpg.error.generate_hash": "Neizdevās izveidot iesūtījuma jaucējkodu",
@@ -333,6 +442,23 @@
 	"migrate.gitbucket.description": "Pārcelt datus no GitBucket serveriem.",
 	"migrate.codebase.description": "Pārcelt datus no codebasehq.com.",
 	"migrate.forgejo.description": "Pārcelt datus no codeberg.org vai citiem Fogejo serveriem.",
+	"migrate.items.label": "Pārcelšanas vienumi",
+	"migrate.items.wiki": "Vikivietni",
+	"migrate.items.milestones": "Atskaites punktus",
+	"migrate.items.labels": "Iezīmes",
+	"migrate.items.issues": "Pieteikumus",
+	"migrate.items.pull_requests": "Izmaiņu pieprasījumus",
+	"migrate.items.merge_requests": "Iekļaušanas pieprasījumus",
+	"migrate.items.releases": "Laidienus",
+	"migrate.in_progress.git": "Pārceļ Git datus",
+	"migrate.in_progress.topics": "Pārceļ tēmas",
+	"migrate.in_progress.milestones": "Pārceļ atskaites punktus",
+	"migrate.in_progress.labels": "Pārceļ iezīmes",
+	"migrate.in_progress.releases": "Pārceļ laidienus",
+	"migrate.in_progress.issues": "Pārceļ pieteikumus",
+	"migrate.in_progress.pulls": "Pārceļ izmaiņu pieprasījumus",
+	"migrate.cancel.title": "Atcelt pārcelšanu",
+	"migrate.cancel.confirmation": "Vai atcelt šo pārcelšanu?",
 	"repo.pulls.already_merged": "Apvienošana neizdevās: šis izmaiņu pieprasījums jau ir iekļauts.",
 	"admin.config.security": "Drošības konfigurācija",
 	"settings.twofa_reenroll.description": "Atkārtoti ieslēgt savu divpakāpju autentificēšanos",
@@ -514,8 +640,31 @@
 	"packages.common.registry": "Šis reģistrs ir iestatāms komandrindā:",
 	"packages.common.repository": "Informācija par glabātavu",
 	"actions.runs.all_runs_link": "visas izpildīšanas",
+	"settings.access_token.selected_repositories": {
+		"zero": "Atlasītās glabātavas (%d)",
+		"one": "Atlasītās glabātavas (%d)",
+		"other": "Atlasītās glabātavas (%d)"
+	},
 	"repo.issues.filter_sort.hint_with_placeholder": "Kārtot pēc: %s",
 	"repo.pulls.auto_merge.no_permission": "Nav atļaujas atcelt šī izmaiņu pieprasījuma automātisko iekļaušanu.",
+	"migrate.select.title": "Pārcelt glabātavu",
+	"admin.federation.host.id": "Id",
+	"admin.federation.host.port": "Ports",
+	"admin.federation.host.software_name": "Programmatūra",
+	"admin.federation.host.created": "Izveidots",
+	"admin.federation.host.updated": "Atjaunināts",
+	"admin.federation.host.latest_activity": "Pēdējā darbība",
+	"admin.federation.users": "Lietotāji",
+	"admin.federation.users.show_local_user": "Rādīt vietējo informāciju par lietotāju",
+	"admin.federation.user.id": "Id",
+	"admin.federation.user.user_id": "Vietējais lietotāja Id",
+	"admin.federation.user.external_id": "Ārējais lietotāja Id",
+	"admin.config.federation.enabled": "Iespējota",
+	"admin.config.federation.max_size": "Lielākais pieļaujamais atbildes izmērs",
+	"admin.config.federation.signature_enforced": "Pieprasīt HTTP parakstus",
+	"admin.config.federation.signature_algorithms": "Parakstu algoritmi",
+	"admin.config.federation.get_headers": "Parakstītas GET galvenes",
+	"admin.config.federation.post_headers": "Parakstītas POST galvenes",
 	"settings.specific_repo_access": "Glabātavas piekļuve",
 	"settings.new_access_token": "Jauna piekļuves pilnvara",
 	"settings.permissions_access_specific_repositories": "Noteiktām glabātavām",
diff --git a/options/locale_next/locale_mk.ini b/options/locale_next/locale_mk.ini
deleted file mode 100644
index 21ede0ed67..0000000000
--- a/options/locale_next/locale_mk.ini
+++ /dev/null
@@ -1 +0,0 @@
-{"home.welcome.no_activity": "Нема активност", "home.welcome.activity_hint": "Сè уште нема ништо во вашиот фид. Вашите активности и дејства од репозиториумите што ги следите ќе се појават овде.", "home.explore_repos": "Истражи репозиториуми", "home.explore_users": "Истражи корисници", "home.explore_orgs": "Истражи организации", "stars.list.none": "Никој не го означи овој репо со ѕвездичка.", "watch.list.none": "Никој не го гледа ова репо.", "followers.incoming.list.self.none": "Никој не го следи вашиот профил.", "followers.incoming.list.none": "Никој не го следи овој корисник.", "followers.outgoing.list.self.none": "Не следите никого.", "followers.outgoing.list.none": "%s не следи никого.", "relativetime.now": "сега", "relativetime.future": "во иднина", "relativetime.1day": "вчера", "relativetime.1week": "последна недела", "relativetime.1month": "последен месец", "relativetime.1year": "псоледна година", "repo.issues.filter_poster.hint": "Филтрирајте по автор", "repo.issues.filter_assignee.hint": "Филтрирајте по доделен корисник", "repo.issues.filter_reviewers.hint": "Филтрирајте по корисник кој прегледаше", "repo.issues.filter_mention.hint": "Филтрирајте по споменат корисник", "repo.issues.filter_modified.hint": "Филтрирајте по датум на последна измена", "repo.issues.filter_sort.hint_with_placeholder": "Сортирајте по: %s", "gpg.error.probable_bad_signature": "ПРЕДУПРЕДУВАЊЕ! Иако во базата на податоци постои клуч со овој идентификатор, тој не го потврдува овојто извршење! Извршењето е СОМНИТЕЛНО.", "gpg.error.probable_bad_default_signature": "ПРЕДУПРЕДУВАЊЕ! Иако стандардниот клуч го има овој ИД, тој не го потврдува овојто извршење! Извршењето е СОМНИТЕЛНО.", "notification.notifications": "Нотификации", "notification.unread": "Непрочитано", "notification.read": "Прочитано", "notification.no_unread": "Нема непрочитани нотификации.", "notification.no_read": "Нема прочитени нотификации."}
diff --git a/options/locale_next/locale_mk.json b/options/locale_next/locale_mk.json
new file mode 100644
index 0000000000..cd4b0f830c
--- /dev/null
+++ b/options/locale_next/locale_mk.json
@@ -0,0 +1,80 @@
+{
+	"webauthn.error.timeout": "Времето истечало пред да може да се прочита вашиот клуч. Ве молиме освежете ја оваа страница и обидете се повторно.",
+	"webauthn.error.empty": "Мора да е поставено име за овој клуч.",
+	"webauthn.error.duplicated": "Безбедносниот клуч не е дозволен за овој барање. Ве молиме уверете се дека клучот не е веќе регистриран.",
+	"webauthn.error.unable_to_process": "Серверот не можеше да ја обработи вашето барање.",
+	"webauthn.error.insecure": "WebAuthn поддржува само сигурни врски. За тестирање преку HTTP, можете да го користите изворот \"localhost\" или \"127.0.0.1\"",
+	"webauthn.error.unknown": "Се случи непозната грешка. Ве молиме обидете се повторно.",
+	"webauthn.unsupported_browser": "Вашиот прелистувач во моментов не ја поддржува WebAuthn.",
+	"webauthn.error": "Неможно да се чита бесбедносен клуч.",
+	"webauthn.use_twofa": "Користете еден двофакторски код од вашиот телефон",
+	"webauthn.press_button": "Притиснете го копчето на вашиот безбедносен клуч…",
+	"webauthn.sign_in": "Притиснете го копчето на вашиот безбедносен клуч. Ако вашиот безбедносен клуч нема копче, повторно вметнете го.",
+	"webauthn.insert_key": "Вметнете го вашиот безбедносен клуч",
+	"home.welcome.no_activity": "Нема активност",
+	"home.welcome.activity_hint": "Сè уште нема ништо во вашиот фид. Вашите активности и дејства од репозиториумите што ги следите ќе се појават овде.",
+	"home.explore_repos": "Истражи репозиториуми",
+	"home.explore_users": "Истражи корисници",
+	"home.explore_orgs": "Истражи организации",
+	"fork.n_forks": {
+		"one": "%s форк",
+		"other": "%s форкови"
+	},
+	"stars.list.none": "Никој не го означи овој репо со ѕвездичка.",
+	"stars.n_stars": {
+		"one": "%s ѕвезда",
+		"other": "%s ѕвезди"
+	},
+	"watch.list.none": "Никој не го гледа ова репо.",
+	"watch.n_watchers": {
+		"one": "%s гледач",
+		"other": "%s гледачи"
+	},
+	"followers.incoming.list.self.none": "Никој не го следи вашиот профил.",
+	"followers.incoming.list.none": "Никој не го следи овој корисник.",
+	"followers.outgoing.list.self.none": "Не следите никого.",
+	"followers.outgoing.list.none": "%s не следи никого.",
+	"relativetime.now": "сега",
+	"relativetime.future": "во иднина",
+	"relativetime.mins": {
+		"one": "пред %d минута",
+		"other": "пред %d минути"
+	},
+	"relativetime.hours": {
+		"one": "пред %d час",
+		"other": "пред %d часа"
+	},
+	"relativetime.days": {
+		"one": "пред %d ден",
+		"other": "пред %d дена"
+	},
+	"relativetime.weeks": {
+		"one": "пред %d недела",
+		"other": "пред %d недели"
+	},
+	"relativetime.months": {
+		"one": "пред %d месец",
+		"other": "пред %d месеци"
+	},
+	"relativetime.years": {
+		"one": "пред %d година",
+		"other": "пред %d години"
+	},
+	"relativetime.1day": "вчера",
+	"relativetime.1week": "последна недела",
+	"relativetime.1month": "последен месец",
+	"relativetime.1year": "псоледна година",
+	"repo.issues.filter_poster.hint": "Филтрирајте по автор",
+	"repo.issues.filter_assignee.hint": "Филтрирајте по доделен корисник",
+	"repo.issues.filter_reviewers.hint": "Филтрирајте по корисник кој прегледаше",
+	"repo.issues.filter_mention.hint": "Филтрирајте по споменат корисник",
+	"repo.issues.filter_modified.hint": "Филтрирајте по датум на последна измена",
+	"repo.issues.filter_sort.hint_with_placeholder": "Сортирајте по: %s",
+	"gpg.error.probable_bad_signature": "ПРЕДУПРЕДУВАЊЕ! Иако во базата на податоци постои клуч со овој идентификатор, тој не го потврдува овојто извршење! Извршењето е СОМНИТЕЛНО.",
+	"gpg.error.probable_bad_default_signature": "ПРЕДУПРЕДУВАЊЕ! Иако стандардниот клуч го има овој ИД, тој не го потврдува овојто извршење! Извршењето е СОМНИТЕЛНО.",
+	"notification.notifications": "Нотификации",
+	"notification.unread": "Непрочитано",
+	"notification.read": "Прочитано",
+	"notification.no_unread": "Нема непрочитани нотификации.",
+	"notification.no_read": "Нема прочитени нотификации."
+}
diff --git a/options/locale_next/locale_ml-IN.json b/options/locale_next/locale_ml-IN.json
index e1940e1e14..c960db3be9 100644
--- a/options/locale_next/locale_ml-IN.json
+++ b/options/locale_next/locale_ml-IN.json
@@ -1,3 +1,10 @@
 {
+	"migrate.items.label": "മൈഗ്രേഷൻ ഇനങ്ങൾ",
+	"migrate.items.wiki": "വിക്കി",
+	"migrate.items.milestones": "നാഴികക്കല്ലുകള്‍",
+	"migrate.items.labels": "ലേബലുകള്‍",
+	"migrate.items.issues": "പ്രശ്നങ്ങൾ",
+	"migrate.items.pull_requests": "ലയന അഭ്യർത്ഥനകൾ",
+	"migrate.items.releases": "പ്രസിദ്ധീകരണങ്ങള്‍",
 	"meta.last_line": " "
 }
diff --git a/options/locale_next/locale_nb_NO.json b/options/locale_next/locale_nb_NO.json
index 3fe643bf12..1cc4caa13c 100644
--- a/options/locale_next/locale_nb_NO.json
+++ b/options/locale_next/locale_nb_NO.json
@@ -1,4 +1,16 @@
 {
+	"webauthn.error.timeout": "Et tidsavbrudd oppsto før nøkkelen din kunne leses. Vennligst last inn siden på nytt og prøv igjen.",
+	"webauthn.error.empty": "Du må gi nøkkelen et navn.",
+	"webauthn.error.duplicated": "Sikkerhetsnøkkelen er ikke tillatt for denne forespørselen. Vennligst sørg for at nøkkelen ikke allerede er registrert.",
+	"webauthn.error.unable_to_process": "Tjeneren kunne ikke behandle forespørselen din.",
+	"webauthn.error.insecure": "WebAuhn støtter kun sikre forbindelser. For testing over HTTP kan du bruke verten \"localhost\" eller \"127.0.0.1\"",
+	"webauthn.error.unknown": "En ukjent feil oppstod. Vennligst prøv igjen.",
+	"webauthn.unsupported_browser": "Nettleseren din støtter ikke WebAuthn.",
+	"webauthn.error": "Klarte ikke lese sikkerhetsnøkkelen.",
+	"webauthn.use_twofa": "Bruk tofaktorkode fra din mobil",
+	"webauthn.press_button": "Vennligst trykk på knappen på sikkerhetsnøkkelen…",
+	"webauthn.sign_in": "Trykk på knappen på sikkerhetsnøkkelen din. Dersom nøkkelen din ikke har en knapp, sett den inn på nytt.",
+	"webauthn.insert_key": "Skriv inn din sikkerhetsnøkkel",
 	"relativetime.1day": "i går",
 	"moderation.abuse_category.other_violations": "Andre regel overtredelser",
 	"moderation.report_remarks": "Kommentar",
@@ -144,6 +156,7 @@
 	"migrate.gitbucket.description": "Migrer data fra GitBucket instanser.",
 	"migrate.codebase.description": "Migrer data fra codebasehq.com.",
 	"migrate.forgejo.description": "Migrer data fra codeberg.org eller andre Forgejo instanser.",
+	"migrate.items.releases": "Utgivelser",
 	"search.syntax": "Søkesyntaks",
 	"search.fuzzy": "Fuzzy",
 	"search.fuzzy_tooltip": "Inkluder resultater som er omtrent like søkeordet",
diff --git a/options/locale_next/locale_nds.json b/options/locale_next/locale_nds.json
index 8b920aee97..15d3326530 100644
--- a/options/locale_next/locale_nds.json
+++ b/options/locale_next/locale_nds.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "All Dingen in de Slang sünd wegdaan worden.",
+	"admin.monitor.queue.settings.remove_all_items": "All wegdoon",
+	"admin.monitor.queue.settings.changed": "Instellens verneeit",
+	"admin.monitor.queue.settings.submit": "Instellens vernejen",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Hoogste Tahl vun Rieters mutt eene Tahl wesen",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Stedenwies %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Hoogste Tahl vun Rieters",
+	"admin.monitor.queue.settings.description": "Vörraden wassen as nödig, wenn hör Rieters-Slang blockeert.",
+	"admin.monitor.queue.settings.title": "Vörraad-Instellens",
+	"admin.monitor.queue.review_add": "Rieters nakieken / hentofögen",
+	"admin.monitor.queue.numberinqueue": "Tahl in de Slang",
+	"admin.monitor.queue.maxnumberworkers": "Hoogste Tahl vun Rieters",
+	"admin.monitor.queue.activeworkers": "Aktiiv Rieters",
+	"admin.monitor.queue.numberworkers": "Tahl vun Rieters",
+	"admin.monitor.queue.exemplar": "Musteraard",
+	"admin.monitor.queue.type": "Aard",
+	"admin.monitor.queue.name": "Naam",
+	"admin.monitor.queue": "Slang: %s",
+	"admin.monitor.queues": "Slangen",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA utknipst",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA anknipst",
+	"admin.users.list_status_filter.not_prohibit_login": "Anmellen verlöven",
+	"admin.users.list_status_filter.is_prohibit_login": "Anmellen verseggen",
+	"admin.users.list_status_filter.not_restricted": "Unbegrenzt",
+	"admin.users.list_status_filter.is_restricted": "Begrenzt",
+	"admin.users.list_status_filter.not_admin": "Keen Chef",
+	"admin.users.list_status_filter.is_admin": "Chef",
+	"admin.users.list_status_filter.not_active": "Nich aktiiv",
+	"admin.users.list_status_filter.is_active": "Aktiiv",
+	"admin.users.list_status_filter.reset": "Torüggsetten",
+	"admin.users.list_status_filter.menu_text": "Filter",
+	"admin.system_status.gc_times": "GC-Tieden",
+	"admin.system_status.last_gc_pause": "Leste GC-Paus",
+	"admin.system_status.total_gc_pause": "GC-Paus all tosamen",
+	"admin.system_status.last_gc_time": "Tied siet lestem GC",
+	"admin.system_status.next_gc_recycle": "Anner GC-Müllavhalen",
+	"admin.system_status.other_system_allocation_obtained": "Anner Systeemtowiesens erhollen",
+	"admin.system_status.gc_metadata_obtained": "Wiedere Informatioonen för GC erhollen",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profileren-Emmer-Prüfsummtabell erhollen",
+	"admin.system_status.mcache_structures_obtained": "MCache-Struktuuren erhollen",
+	"admin.system_status.mcache_structures_usage": "MCache-Struktuuren-Bruuk",
+	"admin.system_status.mspan_structures_obtained": "MSpan-Struktuuren erhollen",
+	"admin.system_status.mspan_structures_usage": "MSpan-Struktuuren-Bruuk",
+	"admin.system_status.stack_memory_obtained": "Stapelspieker erhollen",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap-Stapelbruuk",
+	"admin.system_status.heap_objects": "Hoopobjekten",
+	"admin.system_status.heap_memory_released": "Hoopspieker freeigeven",
+	"admin.system_status.heap_memory_in_use": "Hoopspieker bruukt",
+	"admin.system_status.heap_memory_idle": "Hoopspieker mit nix to doon",
+	"admin.system_status.heap_memory_obtained": "Hoopspieker erhollen",
+	"admin.system_status.current_heap_usage": "Stedenwies Hoopbruuk",
+	"admin.system_status.memory_free_times": "Spieker-Freeigevens",
+	"admin.system_status.memory_allocate_times": "Spieker-Towiesens",
+	"admin.system_status.pointer_lookup_times": "Wieser-Nakiek-Tieden",
+	"admin.system_status.memory_obtained": "Spieker erhollen",
+	"admin.system_status.total_memory_allocated": "Spieker towiesen all tosamen",
+	"admin.system_status.current_memory_usage": "Stedenwies Spiekerbruuk",
+	"admin.system_status.current_goroutine": "Stedenwies Go-Routinen",
+	"admin.system_status.server_uptime": "Server-Bedrievstied",
+	"markup.filepreview.truncated": "Utkiek is ofsneden worden",
+	"markup.filepreview.lines": "Riegen %[1]d bit %[2]d in %[3]s",
+	"markup.filepreview.line": "Rieg %[1]d in %[2]s",
+	"actions.variables.update.success": "De Variaabel is bewarkt worden.",
+	"actions.variables.update.failed": "Kunn Variaabel nich bewarken.",
+	"actions.variables.creation.success": "De Variaabel »%s« is hentoföögt worden.",
+	"actions.variables.creation.failed": "Kunn Variaabel nich hentofögen.",
+	"actions.variables.deletion.success": "De Variaabel is wegdaan worden.",
+	"actions.variables.deletion.failed": "Kunn Variaabel nich wegdoon.",
+	"actions.variables.not_found": "Kunn de Variaabel nich finnen.",
+	"actions.variables.edit": "Variaabel bewarken",
+	"actions.variables.description": "Variaabeln worden an wisse Aktioonen övergeven un könen anners nich lesen worden.",
+	"actions.variables.deletion.description": "Eene Variaabel wegtodoon is för all Tieden un kann nich torüggnohmen worden. Wiedermaken?",
+	"actions.variables.deletion": "Variaabel wegdoon",
+	"actions.variables.none": "Dat gifft noch keene Variaabeln.",
+	"actions.variables.creation": "Variaabel hentofögen",
+	"actions.variables.management": "Variaabeln verwalten",
+	"actions.variables": "Variaabeln",
+	"webauthn.error.timeout": "Tied överweggahn ehr dien Slötel lesen worden kunn. Bidde laad deese Sied neei un versöök dat noch eenmaal.",
+	"webauthn.error.empty": "Du muttst de Slötel eenen Naam geven.",
+	"webauthn.error.duplicated": "De Sekerheids-Slötel is för deese Anfraag nich verlöövt. Bidde wees wiss, dat de Slötel nich al vermarkt is.",
+	"webauthn.error.unable_to_process": "De Server kunn diene Anfraag nich verarbeiden.",
+	"webauthn.error.insecure": "WebAuthn unnerstütt blots seker Verbinnens. Wenn du över HTTP testen willst, kannst du de Quell »localhost« of »127.0.0.1« bruken",
+	"webauthn.error.unknown": "Een unbekannter Fehler is uptreden. Bidde versöök dat noch eenmaal.",
+	"webauthn.unsupported_browser": "Dien Browser unnerstütt stedenwies WebAuthn nich.",
+	"webauthn.error": "Kunn dienen Sekerheids-Slötel nich lesen.",
+	"webauthn.use_twofa": "Bruuk eene Twee-Faktooren-Tahl vun dienem Telefoon",
+	"webauthn.press_button": "Bidde drück de Knoop up dienem Sekerheids-Slötel …",
+	"webauthn.sign_in": "Drück de Knoop up dienem Sekerheids-Slötel. Wenn dien Slötel keenen Knoop hett, steek ’t ut un weer in.",
+	"webauthn.insert_key": "Steek dienen Sekerheids-Slötel in",
+	"counters.n_commits": {
+		"one": "%s Kommitteren",
+		"other": "%s Kommitterens"
+	},
+	"counters.n_branches": {
+		"one": "%s Twieg",
+		"other": "%s Twiegen"
+	},
+	"counters.n_tags": {
+		"one": "%s Mark",
+		"other": "%s Markens"
+	},
+	"counters.n_releases": {
+		"one": "%s Publizeren",
+		"other": "%s Publizerens"
+	},
 	"gpg.default_key": "Mit normaalem Slötel unnerschrieven",
 	"gpg.error.extract_sign": "Kunn Unnerschrift nich uttrecken",
 	"gpg.error.generate_hash": "Kunn Prüfsumm vum Kommitteren nich bereken",
@@ -323,6 +428,23 @@
 	"migrate.gitbucket.description": "Daten vun GitBucket-Instanzen umtrecken.",
 	"migrate.codebase.description": "Daten vun codebasehq.com umtrecken.",
 	"migrate.forgejo.description": "Daten vun codeberg.org of anner Forgejo-Instanzen umtrecken.",
+	"migrate.items.label": "Umtreck-Dingen",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Markstenen",
+	"migrate.items.labels": "Vermarkens",
+	"migrate.items.issues": "Gefallens",
+	"migrate.items.pull_requests": "Haalvörslagen",
+	"migrate.items.merge_requests": "Tosamenföhren-Vörslagen",
+	"migrate.items.releases": "Publizerens",
+	"migrate.in_progress.git": "Git-Daten worden umtrucken",
+	"migrate.in_progress.topics": "Themen worden umtrucken",
+	"migrate.in_progress.milestones": "Markstenen worden umtrucken",
+	"migrate.in_progress.labels": "Vermarkens worden umtrucken",
+	"migrate.in_progress.releases": "Publizerens worden umtrucken",
+	"migrate.in_progress.issues": "Gefallens worden umtrucken",
+	"migrate.in_progress.pulls": "Haalvörslagen worden umtrucken",
+	"migrate.cancel.title": "Umtreck ofbreken",
+	"migrate.cancel.confirmation": "Willst du deesen Umtreck ofbreken?",
 	"admin.config.security": "Sekerheids-Instellens",
 	"admin.config.global_2fa_requirement.all": "All Brukers",
 	"error.must_enable_2fa": "Deese Forgejo-Instanz verlangt, dat Brukers Twee-Faktooren-Anmellen anknipsen, ehr se up hör Konten togriepen könen. Knips dat hier an: %s",
@@ -507,11 +629,8 @@
 	"settings.specific_repo_access": "Repositoriums-Togang",
 	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "Teken",
-	"actions.runners.list_runners.details_column": "Mehr Informationen",
 	"actions.runners.list_runners.edit_column": "Bewarken",
 	"actions.runners.list_runners.delete_column": "Lösken",
-	"actions.runners.list_runners.details_button": "Mehr Informationen",
-	"actions.runners.list_runners.details_button_aria": "Mehr Informatioonen över %s wiesen",
 	"actions.runners.list_runners.delete_button": "Lösken",
 	"actions.runners.list_runners.delete_button_aria": "%s lösken",
 	"actions.runners.list_runners.edit_button": "Bewarken",
@@ -583,8 +702,54 @@
 	"actions.runs.scheduled_description": "Utföhren na Tiedplaan vun Kommitteren <a href=\"%[1]s\">%[2]s</a>",
 	"actions.runs.workflow_dispatch_description": "Utföhren vun Kommitteren <a href=\"%[1]s\">%[2]s</a> vun <a href=\"%[3]s\">%[4]s</a> utlööst",
 	"actions.runs.on_push_description": "Kommitteren <a href=\"%[1]s\">%[2]s</a> vun <a href=\"%[3]s\">%[4]s</a> schuven",
+	"members.add_member": "Liddmaat hentofögen",
+	"members.user": "Bruker",
+	"members.user_already_member": "Deeser Bruker is al een Liddmaat vun deeser Vereenigung.",
+	"members.no_team_selected": "Vereenigungs-Liddmaten mutten to tominnst eener Klottje tohören.",
+	"migrate.select.title": "Repositorium umtrecken",
 	"actions.runners.version": "Versioon",
+	"admin.federation.federation": "Verdeeltheid",
+	"admin.federation.hosts": "Hosts",
+	"admin.federation.hosts.title": "Verdeeltheids-Hosts",
+	"admin.federation.hosts.manage_panel": "Verdeeltheid-Hosts verwalten",
+	"admin.federation.hosts.details_panel": "Verdeeltheids-Host-Informatioonen",
+	"admin.federation.hosts.show_details": "Informatioonen över de Host wiesen",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.schema": "Schema",
+	"admin.federation.host.port": "Poort",
+	"admin.federation.host.created": "Maakt",
+	"admin.federation.host.updated": "Verneeit",
+	"admin.federation.users": "Brukers",
+	"admin.federation.users.title": "Verdeelt Brukers",
+	"admin.federation.users.manage_panel": "Verdeelt Brukers verwalten",
+	"admin.federation.users.show_local_user": "Informatioonen över stedenwies Bruker wiesen",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID vum stedenwies Bruker",
+	"admin.federation.user.external_id": "ID vum frömden Bruker",
+	"admin.config.federation": "Verdeeltheids-Instellens",
+	"admin.config.federation.enabled": "Anknipst",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.software_name": "Programm",
+	"admin.federation.host.latest_activity": "Lestes Doon",
+	"admin.federation.user.inbox_path": "Ingangs-Padd",
+	"admin.config.federation.share_user_statistics": "Tahlen över Brukers mit anner Hosts delen",
+	"admin.config.federation.max_size": "Hoogste verlöövt Antwoord-Grött",
+	"admin.config.federation.signature_enforced": "HTTP-Unnerschrievens verlangen",
+	"admin.config.federation.signature_algorithms": "Unnerschriev-Programmen",
+	"admin.config.federation.digest_algorithm": "Unnerschrift-Prüüfsumm-Programm",
+	"admin.config.federation.get_headers": "Unnerschreven GET-Koppriegen",
+	"admin.config.federation.post_headers": "Unnerschreven POST-Koppriegen",
 	"actions.workflow.unknown_job_in_needs": "Upgaav mit ID %[1]s benöömt unbekannte Upgaven in `needs`: %[2]s.",
 	"actions.workflow.rerun_impossible": "De Warkwies kann nich weer lopen laten worden.",
-	"actions.workflow.job_rerun_impossible": "De Upgaav kann nich weer lopen laten worden."
+	"actions.workflow.job_rerun_impossible": "De Upgaav kann nich weer lopen laten worden.",
+	"user.activitypub_feed.feed": "Fediversum-Schuuv",
+	"user.activitypub_feed.no_activity": "Keen Fediversums-Doon",
+	"user.activitypub_feed.is_empty": "Dien Fediversum-Schuuv is leeg.",
+	"user.activitypub_feed.hint": "Deeser Schuuv wiest Doon vun Fediversums-Konten, wat du nagahst, un ok verdeelte Kommentaren, wat di benöömt hebben.",
+	"user.activitypub_feed.posted_on": "Up %[1]s schreven",
+	"user.activitypub_feed.original_source": "Eerste Quell",
+	"repo.files.caption": "Repositoriums-Dateien (lestes Kommitteren toeerst)",
+	"repo.files.filename": "Dateinaam",
+	"repo.files.last_commit_message": "Leste Kommitterens-Naricht",
+	"repo.files.last_commit_date": "Lestes Kommitterens-Datum"
 }
diff --git a/options/locale_next/locale_nl-NL.json b/options/locale_next/locale_nl-NL.json
index a3ca2ccd2d..dc49ebdccb 100644
--- a/options/locale_next/locale_nl-NL.json
+++ b/options/locale_next/locale_nl-NL.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Alle items in de wachtrij zijn verwijderd.",
+	"admin.monitor.queue.settings.remove_all_items": "Alles verwijderen",
+	"admin.monitor.queue.settings.changed": "Instellingen bijgewerkt",
+	"admin.monitor.queue.settings.submit": "Instellingen bijwerken",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Maximaal aantal workers moet een nummer zijn",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Momenteel %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Maximum aantal workers",
+	"admin.monitor.queue.settings.description": "Pools groeien dynamisch in reactie op het blokkeren van hun wachtrijen.",
+	"admin.monitor.queue.settings.title": "Pool instellingen",
+	"admin.monitor.queue.review_add": "Werkers beoordelen of toevoegen",
+	"admin.monitor.queue.numberinqueue": "Aantal in wachtrij",
+	"admin.monitor.queue.maxnumberworkers": "Maximum aantal werkers",
+	"admin.monitor.queue.activeworkers": "Actieve werkers",
+	"admin.monitor.queue.numberworkers": "Aantal werkers",
+	"admin.monitor.queue.exemplar": "Type voorbeeld",
+	"admin.monitor.queue.type": "Type",
+	"admin.monitor.queue.name": "Naam",
+	"admin.monitor.queue": "Wachtrij: %s",
+	"admin.monitor.queues": "Wachtrijen",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA uitgeschakeld",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA ingeschakeld",
+	"admin.users.list_status_filter.not_prohibit_login": "Inloggen toestaan",
+	"admin.users.list_status_filter.is_prohibit_login": "Inloggen verbieden",
+	"admin.users.list_status_filter.not_restricted": "Niet beperkt",
+	"admin.users.list_status_filter.is_restricted": "Beperkt",
+	"admin.users.list_status_filter.not_admin": "Niet beheerder",
+	"admin.users.list_status_filter.is_admin": "Beheerder",
+	"admin.users.list_status_filter.not_active": "Inactief",
+	"admin.users.list_status_filter.is_active": "Actief",
+	"admin.users.list_status_filter.reset": "Reset",
+	"admin.users.list_status_filter.menu_text": "Filter",
+	"admin.system_status.gc_times": "GC verwerkingen",
+	"admin.system_status.last_gc_pause": "Laatste GC verwerkingstijd",
+	"admin.system_status.total_gc_pause": "Totaal GC verwerkingstijd",
+	"admin.system_status.last_gc_time": "Sinds vorige GC verwerkingstijd",
+	"admin.system_status.next_gc_recycle": "Volgende GC recycle",
+	"admin.system_status.other_system_allocation_obtained": "Andere systeem toewijzing verkregen",
+	"admin.system_status.gc_metadata_obtained": "GC metadada verkregen",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profilering emmer hashtabel verkregen",
+	"admin.system_status.mcache_structures_obtained": "MCache structuren verkregen",
+	"admin.system_status.mcache_structures_usage": "MCache structuren gebruik",
+	"admin.system_status.mspan_structures_obtained": "MSpan structuren verkregen",
+	"admin.system_status.mspan_structures_usage": "MSpan structuren gebruik",
+	"admin.system_status.stack_memory_obtained": "Stapel geheugen verkregen",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap Stack gebruik",
+	"admin.system_status.heap_objects": "Heap-objecten",
+	"admin.system_status.heap_memory_released": "Heap geheugen vrijgegeven",
+	"admin.system_status.heap_memory_in_use": "Heap geheugen in gebruik",
+	"admin.system_status.heap_memory_idle": "Heap geheugen inactief",
+	"admin.system_status.heap_memory_obtained": "Heap geheugen verkregen",
+	"admin.system_status.current_heap_usage": "Huidige heap gebruik",
+	"admin.system_status.memory_free_times": "Geheugen vrjigemaakt",
+	"admin.system_status.memory_allocate_times": "Geheugentoewijzingen",
+	"admin.system_status.pointer_lookup_times": "Aanwijzer Lookup keer",
+	"admin.system_status.memory_obtained": "Geheugen gebruikt",
+	"admin.system_status.total_memory_allocated": "Totaal toegewezen geheugen",
+	"admin.system_status.current_memory_usage": "Huidig geheugen gebruik",
+	"admin.system_status.current_goroutine": "Huidige goroutines",
+	"admin.system_status.server_uptime": "Uptime server",
+	"markup.filepreview.truncated": "Voorbeeld is ingekort",
+	"markup.filepreview.lines": "Lijnen %[1]d naar %[2]d in %[3]s",
+	"markup.filepreview.line": "Lijn %[1]d in %[2]s",
+	"actions.variables.update.success": "De variabele is bewerkt.",
+	"actions.variables.update.failed": "Mislukt bij het bewerken van variabele.",
+	"actions.variables.creation.success": "De variabele \"%s\" is toegevoegd.",
+	"actions.variables.creation.failed": "Mislukt om variable toe te voegen.",
+	"actions.variables.deletion.success": "De variabele is verwijderd.",
+	"actions.variables.deletion.failed": "Mislukt om variabele te verwijderen.",
+	"actions.variables.not_found": "De variabele kon niet gevonden worden.",
+	"actions.variables.edit": "Variabele bewerken",
+	"actions.variables.description": "Variabelen worden doorgegeven aan bepaalde acties en kunnen anders niet worden gelezen.",
+	"actions.variables.deletion.description": "Een variabele verwijderen is permanent en kan niet ongedaan worden gemaakt. Doorgaan?",
+	"actions.variables.deletion": "Variabel verwijderen",
+	"actions.variables.none": "Er zijn nog geen variabelen.",
+	"actions.variables.creation": "Variabele toevoegen",
+	"actions.variables.management": "Variabelenbeheer",
+	"actions.variables": "Variabelen",
+	"webauthn.error.timeout": "Time-out bereikt voordat uw sleutel kon worden gelezen. Herlaad deze pagina en probeer het opnieuw.",
+	"webauthn.error.empty": "U moet een naam voor deze sleutel instellen.",
+	"webauthn.error.duplicated": "De beveiligingssleutel is voor dit verzoek niet toegestaan. Controleer alstublieft of de sleutel niet al is geregistreerd.",
+	"webauthn.error.unable_to_process": "De server kon uw verzoek niet verwerken.",
+	"webauthn.error.insecure": "WebAuthn ondersteunt alleen beveiligde verbindingen. Om te testen via HTTP, kan je als systeemnaam \"localhost\" of \"127.0.0.1\" gebruiken",
+	"webauthn.error.unknown": "Er is een onbekende fout opgetreden. Probeer het opnieuw.",
+	"webauthn.unsupported_browser": "Uw browser ondersteunt momenteel geen WebAuthn.",
+	"webauthn.error": "Kon uw beveiligingssleutel niet lezen.",
+	"webauthn.use_twofa": "Gebruik een tweefactor code van uw telefoon",
+	"webauthn.press_button": "Druk alstublieft op de knop van uw beveiligingssleutel…",
+	"webauthn.sign_in": "Druk op de knop van uw beveiligingssleutel. Als uw beveiligingssleutel geen knop heeft, sluit deze dan opnieuw aan.",
+	"webauthn.insert_key": "Sluit uw beveiligingssleutel aan",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"other": "%s commits"
+	},
+	"counters.n_branches": {
+		"one": "%s branch",
+		"other": "%s branches"
+	},
+	"counters.n_tags": {
+		"one": "%s tag",
+		"other": "%s tags"
+	},
+	"counters.n_releases": {
+		"one": "%s release",
+		"other": "%s releases"
+	},
 	"gpg.default_key": "Ondertekend met standaard sleutel",
 	"gpg.error.extract_sign": "Handtekening uitpakken mislukt",
 	"gpg.error.generate_hash": "Genereren van commit hash mislukt",
@@ -323,6 +428,23 @@
 	"migrate.gitbucket.description": "Gegevens migreren van GitBucket instanties.",
 	"migrate.codebase.description": "Gegevens migreren van codebasehq.com.",
 	"migrate.forgejo.description": "Migreer data van codeberg.org of andere Forgejo instanties.",
+	"migrate.items.label": "Migratie items",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Mijlpalen",
+	"migrate.items.labels": "Labels",
+	"migrate.items.issues": "Issues",
+	"migrate.items.pull_requests": "Pull requests",
+	"migrate.items.merge_requests": "Samenvoeg verzoeken",
+	"migrate.items.releases": "Releases",
+	"migrate.in_progress.git": "Git gegevens migreren",
+	"migrate.in_progress.topics": "Onderwerpen migreren",
+	"migrate.in_progress.milestones": "Mijlpalen migreren",
+	"migrate.in_progress.labels": "Labels migreren",
+	"migrate.in_progress.releases": "Releases migreren",
+	"migrate.in_progress.issues": "Issues migreren",
+	"migrate.in_progress.pulls": "Pull requests migreren",
+	"migrate.cancel.title": "Annuleer migratie",
+	"migrate.cancel.confirmation": "Wil je deze migratie annuleren?",
 	"settings.twofa_unroll_unavailable": "Tweefactorauthenticatie is vereist voor uw account en kan niet worden uitgeschakeld.",
 	"admin.config.security": "Beveiligingsconfiguratie",
 	"admin.config.global_2fa_requirement.title": "Globale vereiste van tweefactorauthenticatie",
@@ -509,10 +631,50 @@
 	"settings.access_token.resource_all_help": "Toegang tot alle bronnen toestaan.",
 	"settings.access_token.resource_public_only_help": "Toegang tot repositories en organisaties die openbaar zijn beperken.",
 	"actions.runners.list_runners.delete_column": "Verwijder",
+	"admin.federation.host.software_name": "Software",
 	"repo.pulls.auto_merge.no_permission": "U heeft niet de permissie om deze pull request auto merge uit te zetten.",
+	"migrate.select.title": "Migreer repository",
+	"admin.federation.federation": "Federeren",
+	"admin.federation.hosts": "Servers",
+	"admin.federation.hosts.title": "Federatie servers",
+	"admin.federation.hosts.manage_panel": "Federatie servers beheren",
+	"admin.federation.hosts.details_panel": "Federatie server details",
+	"admin.federation.hosts.show_details": "Toon server details",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Schema",
+	"admin.federation.host.port": "Poort",
+	"admin.federation.host.created": "Aangemaakt",
+	"admin.federation.host.updated": "Bijgewerkt",
+	"admin.federation.host.latest_activity": "Laatste activiteit",
+	"admin.federation.users": "Gebruikers",
+	"admin.federation.users.title": "Gefedereerde gebruikers",
+	"admin.federation.users.manage_panel": "Beheer gefedereerde gebruikers",
+	"admin.federation.users.show_local_user": "Toon lokale gebruikerdetails",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "Lokale gebruikersID",
+	"admin.federation.user.external_id": "Externe gebruikersID",
+	"admin.federation.user.inbox_path": "Inboxpad",
+	"admin.config.federation": "Federeerconfiguratie",
+	"admin.config.federation.enabled": "Ingeschakeld",
+	"admin.config.federation.share_user_statistics": "Deel gebruikersstatistieken met andere servers",
+	"admin.config.federation.max_size": "Maximaal toegestane responsegrootte",
+	"admin.config.federation.signature_enforced": "Vereist HTTP handtekeningen",
+	"admin.config.federation.signature_algorithms": "Handtekeningalgoritmes",
+	"admin.config.federation.digest_algorithm": "Handtekening-hashalgoritme",
+	"admin.config.federation.get_headers": "Ondertekende GET headers",
+	"admin.config.federation.post_headers": "Ondertekende POST headers",
 	"settings.new_access_token": "Nieuwe toegangstoken",
+	"settings.access_token.selected_repositories": {
+		"one": "Geselecteerde repository (%d)",
+		"other": "Geselecteerde repositories (%d)"
+	},
 	"settings.access_token.resource_specific_repo_help": "Beperk toegang tot een specifieke lijst aan repositories. Alleen-lezen toegang is toegestaan voor alle openbare repositories. Alleen permissies die toegang geven tot repositories en issues kunnen aangezet worden.",
 	"settings.access_token.admin_disabled": "Adminstratische permissies zijn uitgezet.",
+	"user.activitypub_feed.no_activity": "Geen fediverse-activiteit",
+	"user.activitypub_feed.is_empty": "Uw fediverse-feed is leeg.",
+	"user.activitypub_feed.hint": "Deze feed toont activiteiten van fediverse accounts die u volgt, alsook van gefedereerde boodschappen die u vermelden.",
+	"user.activitypub_feed.posted_on": "Gepost op %[1]s",
 	"actions.runners.list_runners.delete_button_aria": "Verwijder %s",
 	"actions.runners.list_runners.edit_button": "Wijzig",
 	"actions.runners.list_runners.edit_button_aria": "Wijzig %s",
@@ -568,16 +730,22 @@
 	"actions.secrets.mutation.failure_message": "Het geheim \"%s\" kon niet worden gewijzigd.",
 	"actions.secrets.mutation.name_description": "De naam van een geheim mag alleen letters, cijfers en underscores bevatten. Deze mag niet beginnen met FORGEJO_, GITEA_, GITHUB_ of een cijfer. Forgejo zet de naam automatisch om naar hoofdletters.",
 	"actions.secrets.mutation.value_description": "De bestaande waarde wordt niet weergegeven. Laat het veld leeg als je deze niet wilt wijzigen. Speciale tekens blijven behouden. CRLF (Windows-regelafbrekingen) wordt automatisch omgezet naar LF. Converteer de waarde naar Base64 als regelafbrekingen behouden moeten blijven.",
+	"members.add_member": "Voeg lid toe",
+	"members.user": "Gebruiker",
+	"members.user_already_member": "Deze gebruiker is al lid van deze organisatie.",
+	"members.no_team_selected": "Organisatieleden moeten bij minimaal één team zijn aangesloten.",
 	"form.RunnerName": "Naam",
 	"graphs.recent_commits.title": "Aantal commits in het afgelopen jaar",
 	"graphs.code_frequency.title": "Codefrequentie over de geschiedenis van {0}",
+	"user.activitypub_feed.feed": "Fediverse feed",
+	"user.activitypub_feed.original_source": "Oorspronkelijke bron",
 	"access_token.error.specified_repos_none": "Toegangstokens met opgegeven repositories moeten ten minste één repository bevatten.",
 	"access_token.error.specified_repos_and_public_only": "Toegangstokens voor bepaalde repositories kunnen niet worden gecombineerd met het bereik 'alleen openbaar'.",
 	"access_token.error.specified_repos_and_invalid_scope": "Toegangstokens voor bepaalde repositories kunnen alleen worden gebruikt met de reikwijdtes read:issue, write:issue, read:repository en write:repository.",
-	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "Token",
 	"actions.runners.ephemeral": "Eenmalig",
-	"actions.runners.version": "Versie",
+	"actions.runners.uuid": "UUID",
 	"actions.runners.list_runners.edit_column": "Aanpassen",
+	"actions.runners.version": "Versie",
 	"actions.runners.list_runners.delete_button": "Verwijderen"
 }
diff --git a/options/locale_next/locale_pl-PL.json b/options/locale_next/locale_pl-PL.json
index 5498dea8ee..41e84196d8 100644
--- a/options/locale_next/locale_pl-PL.json
+++ b/options/locale_next/locale_pl-PL.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Wszystkie elementy w kolejce zostały usunięte.",
+	"admin.monitor.queue.settings.remove_all_items": "Usuń wszystkie",
+	"admin.monitor.queue.settings.changed": "Zaktualizowano ustawienia",
+	"admin.monitor.queue.settings.submit": "Aktualizuj ustawienia",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Maksymalna liczba procesów pracujących musi być liczbą",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Obecnie %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Maksymalna liczba procesów pracujących",
+	"admin.monitor.queue.settings.description": "Pule rosną dynamicznie w odpowiedzi na blokadę kolejki procesów pracujących.",
+	"admin.monitor.queue.settings.title": "Ustawienia puli",
+	"admin.monitor.queue.review_add": "Sprawdź / dodaj procesy pracujące",
+	"admin.monitor.queue.numberinqueue": "Liczba w kolejce",
+	"admin.monitor.queue.maxnumberworkers": "Maksymalna Liczba procesów pracujących",
+	"admin.monitor.queue.activeworkers": "Aktywne procesy pracujące",
+	"admin.monitor.queue.numberworkers": "Liczba procesów pracujących",
+	"admin.monitor.queue.exemplar": "Przykładowy typ",
+	"admin.monitor.queue.type": "Typ",
+	"admin.monitor.queue.name": "Nazwa",
+	"admin.monitor.queue": "Kolejka: %s",
+	"admin.monitor.queues": "Kolejki",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA wyłączone",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA włączone",
+	"admin.users.list_status_filter.not_prohibit_login": "Zezwól na logowanie",
+	"admin.users.list_status_filter.is_prohibit_login": "Zabroń logowania",
+	"admin.users.list_status_filter.not_restricted": "Nie ograniczony",
+	"admin.users.list_status_filter.is_restricted": "Ograniczone",
+	"admin.users.list_status_filter.not_admin": "Nie administrator",
+	"admin.users.list_status_filter.is_admin": "Administrator",
+	"admin.users.list_status_filter.not_active": "Nieaktywne",
+	"admin.users.list_status_filter.is_active": "Aktywne",
+	"admin.users.list_status_filter.reset": "Zresetuj",
+	"admin.users.list_status_filter.menu_text": "Filtr",
+	"admin.system_status.gc_times": "Ilość wywołań GC",
+	"admin.system_status.last_gc_pause": "Ostatnie wstrzymanie przez GC",
+	"admin.system_status.total_gc_pause": "Sumaryczny czas wstrzymania przez GC",
+	"admin.system_status.last_gc_time": "Czas od ostatniego wywołania GC",
+	"admin.system_status.next_gc_recycle": "Następne wywołanie GC",
+	"admin.system_status.other_system_allocation_obtained": "Inne uzyskane alokacje systemowe",
+	"admin.system_status.gc_metadata_obtained": "Ilość metadanych uzyskanych przez GC",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Uzyskana tablica haszująca profilowania",
+	"admin.system_status.mcache_structures_obtained": "Uzyskane struktury MCache",
+	"admin.system_status.mcache_structures_usage": "Użycie struktur MCache",
+	"admin.system_status.mspan_structures_obtained": "Uzyskane struktury MSpan",
+	"admin.system_status.mspan_structures_usage": "Użycie struktur MSpan",
+	"admin.system_status.stack_memory_obtained": "Uzyskana pamięć stosu",
+	"admin.system_status.bootstrap_stack_usage": "Użycie stosu bootstrap",
+	"admin.system_status.heap_objects": "Ilość obiektów na stercie",
+	"admin.system_status.heap_memory_released": "Zwolniona pamięć sterty",
+	"admin.system_status.heap_memory_in_use": "Używana pamięć sterty",
+	"admin.system_status.heap_memory_idle": "Bezczynna pamięć sterty",
+	"admin.system_status.heap_memory_obtained": "Uzyskana pamięć sterty",
+	"admin.system_status.current_heap_usage": "Bieżące użycie sterty",
+	"admin.system_status.memory_free_times": "Zwolnienie pamięci",
+	"admin.system_status.memory_allocate_times": "Alokacje pamięci",
+	"admin.system_status.pointer_lookup_times": "Czas określania wskaźników",
+	"admin.system_status.memory_obtained": "Pamięć uzyskana",
+	"admin.system_status.total_memory_allocated": "Całkowita przydzielona pamięć",
+	"admin.system_status.current_memory_usage": "Bieżące użycie pamięci",
+	"admin.system_status.current_goroutine": "Bieżące goroutines",
+	"admin.system_status.server_uptime": "Czas pracy serwera",
+	"markup.filepreview.truncated": "Podgląd został przycięty",
+	"markup.filepreview.lines": "Linie %[1]d do %[2]d w %[3]s",
+	"markup.filepreview.line": "Linia %[1]d w %[2]s",
+	"actions.variables.update.success": "Zmienna została zmieniona.",
+	"actions.variables.update.failed": "Nie udało się zmienić zmiennej.",
+	"actions.variables.creation.success": "Zmienna \"%s\" została dodana.",
+	"actions.variables.creation.failed": "Nie udało się dodać zmiennej.",
+	"actions.variables.deletion.success": "Zmienna została usunięta.",
+	"actions.variables.deletion.failed": "Nie udało się usunąć zmiennej.",
+	"actions.variables.not_found": "Nie udało się znaleźć zmiennej.",
+	"actions.variables.edit": "Edytuj Zmienną",
+	"actions.variables.description": "Zmienne będą przekazane pewnym akcjom, nie mogą być odczytane inaczej.",
+	"actions.variables.deletion.description": "Usunięcie zmiennej jest permanentne i nie może zostać cofnięte. Kontynuować?",
+	"actions.variables.deletion": "Usuń zmienną",
+	"actions.variables.none": "Nie ma jeszcze zmiennych.",
+	"actions.variables.creation": "Dodaj zmienną",
+	"actions.variables.management": "Zarządzaj zmiennymi",
+	"actions.variables": "Zmienne",
+	"webauthn.error.timeout": "Osiągnięto limit czasu zanim Twój klucz może zostać odczytany. Odśwież stronę i spróbuj ponownie.",
+	"webauthn.error.empty": "Musisz ustawić nazwę dla tego klucza.",
+	"webauthn.error.duplicated": "Klucz bezpieczeństwa nie jest dozwolony dla tego żądania. Upewnij się, że klucz nie jest już zarejestrowany.",
+	"webauthn.error.unable_to_process": "Serwer nie mógł obsłużyć Twojego żądania.",
+	"webauthn.error.insecure": "`WebAuthn obsługuje tylko bezpieczne połączenia. Do testowania przez HTTP można użyć \"localhost\" lub \"127.0.0.1\"`",
+	"webauthn.error.unknown": "Wystąpił nieznany błąd. Spróbuj ponownie.",
+	"webauthn.unsupported_browser": "Twoja przeglądarka nie obsługuje obecnie WebAuthn.",
+	"webauthn.error": "Nie można odczytać Twojego klucza bezpieczeństwa.",
+	"webauthn.use_twofa": "Użyj kodu uwierzytelniania dwuskładnikowego ze swojego telefonu",
+	"webauthn.press_button": "Naciśnij przycisk na swoim kluczu bezpieczeństwa…",
+	"webauthn.sign_in": "Naciśnij przycisk na swoim kluczu bezpieczeństwa. Jeśli go nie posiada, podłącz go ponownie.",
+	"webauthn.insert_key": "Podłącz swój klucz bezpieczeństwa",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"many": "%s commity"
+	},
+	"counters.n_branches": {
+		"one": "%s gałąź",
+		"many": "%s gałęzie"
+	},
+	"counters.n_tags": {
+		"one": "%s tag",
+		"many": "%s tagi"
+	},
+	"counters.n_releases": {
+		"one": "%s wydanie",
+		"many": "%s wydań"
+	},
 	"gpg.default_key": "Podpisano domyślnym kluczem",
 	"gpg.error.extract_sign": "Nie udało się wyłuskać podpisu",
 	"gpg.error.generate_hash": "Nie udało się wygenerować skrótu dla commitu",
@@ -195,7 +300,7 @@
 	"release.n_downloads": {
 		"one": "%s pobranie",
 		"few": "%s pobrania",
-		"many": ""
+		"many": "%s pobrań"
 	},
 	"repo.pulls.merged_title_desc": {
 		"one": "scala %[1]d commit z <code>%[2]s</code> do <code>%[3]s</code> %[4]s",
@@ -236,6 +341,23 @@
 	"migrate.gitbucket.description": "Migruj dane z instancji GitBucket.",
 	"migrate.codebase.description": "Migracja danych z codebasehq.com.",
 	"migrate.forgejo.description": "Migruj dane z codeberg.org lub innych instancji Forgejo.",
+	"migrate.items.label": "Elementy migracji",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Kamienie milowe",
+	"migrate.items.labels": "Etykiety",
+	"migrate.items.issues": "Zgłoszenia",
+	"migrate.items.pull_requests": "Pull requesty",
+	"migrate.items.merge_requests": "Requesty scalające",
+	"migrate.items.releases": "Wydania",
+	"migrate.in_progress.git": "Migracja danych Git",
+	"migrate.in_progress.topics": "Migracja tematów",
+	"migrate.in_progress.milestones": "Migracja kamieni milowych",
+	"migrate.in_progress.labels": "Migracja etykiet",
+	"migrate.in_progress.releases": "Migracja wydań",
+	"migrate.in_progress.issues": "Migracja zgłoszeń",
+	"migrate.in_progress.pulls": "Migracja pull requestów",
+	"migrate.cancel.title": "Anuluj migrację",
+	"migrate.cancel.confirmation": "Czy chcesz anulować tę migrację?",
 	"relativetime.hours": {
 		"one": "godzinę temu",
 		"few": "%d godziny temu",
@@ -466,5 +588,10 @@
 	"repo.issues.filter_sort.hint_with_placeholder": "Sortuj wg: %s",
 	"issues.filters.labels.exclude": "Wyklucz etykietę",
 	"issues.filters.labels.unexclude": "Usuń wykluczenie",
-	"repo.pulls.auto_merge.no_permission": "Nie masz uprawnień aby anulować auto merge tego pull requesta."
+	"repo.pulls.auto_merge.no_permission": "Nie masz uprawnień aby anulować auto merge tego pull requesta.",
+	"settings.access_token.selected_repositories": {
+		"one": "Wybrane (%d) repozytorium",
+		"few": "Wybrane (%d) repozytoria",
+		"many": "Wybrane (%d) repozytoriów"
+	}
 }
diff --git a/options/locale_next/locale_pt-BR.json b/options/locale_next/locale_pt-BR.json
index 2d9b377f5e..ea5832a8e4 100644
--- a/options/locale_next/locale_pt-BR.json
+++ b/options/locale_next/locale_pt-BR.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Todos os itens da fila foram removidos.",
+	"admin.monitor.queue.settings.remove_all_items": "Remover tudo",
+	"admin.monitor.queue.settings.changed": "Configurações atualizadas",
+	"admin.monitor.queue.settings.submit": "Atualizar configurações",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Número máximo de executores deve ser um número",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Atualmente %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Número máximo de executores",
+	"admin.monitor.queue.settings.description": "Os pools crescem dinamicamente quando as filas de seus workers ficam bloqueadas.",
+	"admin.monitor.queue.settings.title": "Configurações do pool",
+	"admin.monitor.queue.review_add": "Revisar / adicionar workers",
+	"admin.monitor.queue.numberinqueue": "Número na fila",
+	"admin.monitor.queue.maxnumberworkers": "Número máximo de workers",
+	"admin.monitor.queue.activeworkers": "Processos ativos",
+	"admin.monitor.queue.numberworkers": "Número de workers",
+	"admin.monitor.queue.exemplar": "Tipo de modelo",
+	"admin.monitor.queue.type": "Tipo",
+	"admin.monitor.queue.name": "Nome",
+	"admin.monitor.queue": "Fila: %s",
+	"admin.monitor.queues": "Filas",
+	"admin.users.list_status_filter.not_2fa_enabled": "Autenticação em duas etapas desativada",
+	"admin.users.list_status_filter.is_2fa_enabled": "Autenticação de dois fatores ativada",
+	"admin.users.list_status_filter.not_prohibit_login": "Permitir login",
+	"admin.users.list_status_filter.is_prohibit_login": "Proibir login",
+	"admin.users.list_status_filter.not_restricted": "Não restrito",
+	"admin.users.list_status_filter.is_restricted": "Restrito",
+	"admin.users.list_status_filter.not_admin": "Não administrador",
+	"admin.users.list_status_filter.is_admin": "Administrador",
+	"admin.users.list_status_filter.not_active": "Inativo",
+	"admin.users.list_status_filter.is_active": "Ativo",
+	"admin.users.list_status_filter.reset": "Reset",
+	"admin.users.list_status_filter.menu_text": "Filtro",
+	"admin.system_status.gc_times": "Número de execuções do GC",
+	"admin.system_status.last_gc_pause": "Última pausa de GC",
+	"admin.system_status.total_gc_pause": "Pausa total de GC",
+	"admin.system_status.last_gc_time": "Tempo desde última GC",
+	"admin.system_status.next_gc_recycle": "Próxima reciclagem do GC",
+	"admin.system_status.other_system_allocation_obtained": "Outra alocação de sistema obtida",
+	"admin.system_status.gc_metadata_obtained": "Metadados do GC obtidos",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Hash table de profiling bucket obtida",
+	"admin.system_status.mcache_structures_obtained": "Estruturas MCache obtidas",
+	"admin.system_status.mcache_structures_usage": "Uso de estruturas MCache",
+	"admin.system_status.mspan_structures_obtained": "Estruturas MSpan obtidas",
+	"admin.system_status.mspan_structures_usage": "Uso de estruturas MSpan",
+	"admin.system_status.stack_memory_obtained": "Memória de pilha obtida",
+	"admin.system_status.bootstrap_stack_usage": "Uso de pilha bootstrap",
+	"admin.system_status.heap_objects": "Objetos na heap",
+	"admin.system_status.heap_memory_released": "Memória de heap liberada",
+	"admin.system_status.heap_memory_in_use": "Memória de heap em uso",
+	"admin.system_status.heap_memory_idle": "Memória de heap ociosa",
+	"admin.system_status.heap_memory_obtained": "Memória de heap obtida",
+	"admin.system_status.current_heap_usage": "Uso atual da heap",
+	"admin.system_status.memory_free_times": "Liberações de memória",
+	"admin.system_status.memory_allocate_times": "Alocações de memória",
+	"admin.system_status.pointer_lookup_times": "Número de consultas a ponteiros",
+	"admin.system_status.memory_obtained": "Memória obtida",
+	"admin.system_status.total_memory_allocated": "Total de memória alocada",
+	"admin.system_status.current_memory_usage": "Uso de memória atual",
+	"admin.system_status.current_goroutine": "Goroutines atuais",
+	"admin.system_status.server_uptime": "Tempo de atividade do servidor",
+	"markup.filepreview.truncated": "Pré-visualização truncada",
+	"markup.filepreview.lines": "Linhas %[1]d a %[2]d em %[3]s",
+	"markup.filepreview.line": "Linha %[1]d em %[2]s",
+	"actions.variables.update.success": "A variável foi editada.",
+	"actions.variables.update.failed": "Falha ao editar a variável.",
+	"actions.variables.creation.success": "A variável \"%s\" foi adicionada.",
+	"actions.variables.creation.failed": "Falha ao adicionar a variável.",
+	"actions.variables.deletion.success": "A variável foi removida.",
+	"actions.variables.deletion.failed": "Falha ao remover a variável.",
+	"actions.variables.not_found": "Não foi possível encontrar a variável.",
+	"actions.variables.edit": "Editar variável",
+	"actions.variables.description": "As variáveis serão passadas para certas Actions e não poderão ser lidas de outra forma.",
+	"actions.variables.deletion.description": "Apagar uma variável é permanente e não pode ser desfeito. Continuar?",
+	"actions.variables.deletion": "Remover variável",
+	"actions.variables.none": "Ainda não há variáveis.",
+	"actions.variables.creation": "Adicionar variável",
+	"actions.variables.management": "Gerenciar variáveis",
+	"actions.variables": "Variáveis",
+	"webauthn.error.timeout": "Não foi possível ler a sua chave de segurança antes do tempo limite. Atualize a página e tente novamente.",
+	"webauthn.error.empty": "Você deve definir um nome para esta chave.",
+	"webauthn.error.duplicated": "A chave de segurança não é permitida para esta solicitação. Por favor, certifique-se que a chave já não está registrada.",
+	"webauthn.error.unable_to_process": "O servidor não pôde processar sua solicitação.",
+	"webauthn.error.insecure": "WebAuthn suporta apenas conexões seguras. Para testar via HTTP, você pode usar a origem \"localhost\" ou \"127.0.0.1\"",
+	"webauthn.error.unknown": "Ocorreu um erro desconhecido. Tente novamente.",
+	"webauthn.unsupported_browser": "Seu navegador não oferece suporte ao WebAuthn.",
+	"webauthn.error": "Não foi possível ler sua chave de segurança.",
+	"webauthn.use_twofa": "Use um código de duas etapas do seu telefone",
+	"webauthn.press_button": "Pressione o botão na sua chave de segurança…",
+	"webauthn.sign_in": "Pressione o botão na sua chave de segurança. Caso a sua chave de segurança não possuir um botão, insira-a novamente.",
+	"webauthn.insert_key": "Insira sua chave de segurança",
+	"counters.n_commits": {
+		"one": "%s commit",
+		"many": "%s commits",
+		"other": ""
+	},
+	"counters.n_branches": {
+		"one": "%s ramo",
+		"many": "%s ramos",
+		"other": ""
+	},
+	"counters.n_tags": {
+		"one": "%s etiqueta",
+		"many": "%s etiquetas",
+		"other": ""
+	},
+	"counters.n_releases": {
+		"one": "%s versão",
+		"many": "%s versões",
+		"other": ""
+	},
 	"gpg.default_key": "Assinado com a chave padrão",
 	"gpg.error.extract_sign": "Falha ao extrair assinatura",
 	"gpg.error.generate_hash": "Falha ao gerar hash de commit",
@@ -328,6 +437,23 @@
 	"migrate.gitbucket.description": "Migrar dados de instâncias do GitBucket.",
 	"migrate.codebase.description": "Migrar dados de codebasehq.com.",
 	"migrate.forgejo.description": "Migrar dados do codeberg.org ou outras servidores Forgejo.",
+	"migrate.items.label": "Itens da migração",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Marcos",
+	"migrate.items.labels": "Etiquetas",
+	"migrate.items.issues": "Issues",
+	"migrate.items.pull_requests": "Propostas de revisão",
+	"migrate.items.merge_requests": "Pedidos de merge",
+	"migrate.items.releases": "Versões",
+	"migrate.in_progress.git": "Migrando dados Git",
+	"migrate.in_progress.topics": "Migrando tópicos",
+	"migrate.in_progress.milestones": "Migrando marcos",
+	"migrate.in_progress.labels": "Migrando rótulos",
+	"migrate.in_progress.releases": "Migrando releases",
+	"migrate.in_progress.issues": "Migrando issues",
+	"migrate.in_progress.pulls": "Migrando propostas de revisão",
+	"migrate.cancel.title": "Cancelar migração",
+	"migrate.cancel.confirmation": "Você quer cancelar essa migração?",
 	"warning.repository.out_of_sync": "A representação deste repositório no banco de dados está fora de sincronia. Se este aviso ainda aparecer após fazer push de um commit para este repositório, contate o administrador.",
 	"repo.pulls.already_merged": "Mescla falhou: Este pull request já foi mesclado.",
 	"migrate.pagure.incorrect_url": "Uma URL incorreta do repositório fonte foi fornecida",
@@ -522,15 +648,37 @@
 	"settings.access_token.no_repositories_selected": "Nenhum repositório selecionado.",
 	"settings.access_token.no_repositories_found": "Nenhum repositório encontrado.",
 	"settings.access_token.remove": "Remova %s",
-	"actions.runners.task_list_admin": "Tarefas recentes neste executor",
-	"actions.runners.task_list_user": "Tarefas recentes deste usuário neste executor",
-	"actions.runners.edit_runner_button": "Editar executor",
-	"actions.runners.create_runner.page_title": "Criar novo executor",
-	"actions.runners.create_runner.title": "Criar novo executor",
-	"actions.runners.create_runner.name_label": "Noe",
-	"actions.runners.edit_runner.page_title": "Editar executor %s",
 	"actions.runners.edit_runner.title": "Editar executor %s",
+	"actions.runners.edit_runner.page_title": "Editar executor %s",
+	"actions.runners.create_runner.name_label": "Noe",
+	"actions.runners.create_runner.title": "Criar novo executor",
+	"actions.runners.create_runner.page_title": "Criar novo executor",
+	"actions.runners.edit_runner_button": "Editar executor",
+	"actions.runners.task_list_user": "Tarefas recentes deste usuário neste executor",
+	"actions.runners.task_list_admin": "Tarefas recentes neste executor",
 	"repo.pulls.auto_merge.no_permission": "Você não tem permissão para cancelar a mesclagem automática deste pull request.",
+	"migrate.select.title": "Migrar repositório",
+	"admin.federation.federation": "Federação",
+	"admin.federation.hosts": "Hosts",
+	"admin.federation.hosts.title": "Hosts federados",
+	"admin.federation.hosts.manage_panel": "Gerenciar hosts federados",
+	"admin.federation.hosts.details_panel": "Detalhes dos hosts federados",
+	"admin.federation.hosts.show_details": "Mostrar detalhes do host",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Schema",
+	"admin.federation.host.port": "Porta",
+	"admin.federation.host.software_name": "Software",
+	"admin.federation.host.created": "Criado em",
+	"admin.federation.host.updated": "Atualizado em",
+	"admin.federation.host.latest_activity": "Última atividade",
+	"admin.federation.users": "Usuários",
+	"admin.federation.users.title": "Usuários federados",
+	"admin.federation.users.manage_panel": "Gerenciar usuários federados",
+	"admin.federation.users.show_local_user": "Mostrar detalhes do usuário local",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID do usuário local",
+	"admin.federation.user.external_id": "ID do usuário externo",
 	"access_token.error.specified_repos_and_invalid_scope": "Tokens de acesso com repositórios especificados só podem ser usados com os escopos read:issue, write:issue, read:repository e write:repository.",
 	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "Token",
diff --git a/options/locale_next/locale_pt-PT.json b/options/locale_next/locale_pt-PT.json
index 740ac5a97b..9be71cfa06 100644
--- a/options/locale_next/locale_pt-PT.json
+++ b/options/locale_next/locale_pt-PT.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Todos os itens da fila foram removidos.",
+	"admin.monitor.queue.settings.remove_all_items": "Remover tudo",
+	"admin.monitor.queue.settings.changed": "Configurações modificadas",
+	"admin.monitor.queue.settings.submit": "Modificar configurações",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "O número máximo de trabalhadores tem que ser um número",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "De momento %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "N.º máximo de trabalhadores",
+	"admin.monitor.queue.settings.description": "Agregados crescem dinamicamente em resposta aos bloqueios da sua fila de trabalhadores.",
+	"admin.monitor.queue.settings.title": "Configurações do agregado",
+	"admin.monitor.queue.review_add": "Rever / adicionar trabalhadores",
+	"admin.monitor.queue.numberinqueue": "N.º na fila",
+	"admin.monitor.queue.maxnumberworkers": "N.º máximo de trabalhadores",
+	"admin.monitor.queue.activeworkers": "Trabalhadores operantes",
+	"admin.monitor.queue.numberworkers": "N.º de trabalhadores",
+	"admin.monitor.queue.exemplar": "Tipo de exemplar",
+	"admin.monitor.queue.type": "Tipo",
+	"admin.monitor.queue.name": "Nome",
+	"admin.monitor.queue": "Fila: %s",
+	"admin.monitor.queues": "Filas",
+	"admin.users.list_status_filter.not_2fa_enabled": "Autenticação em dois passos desabilitada",
+	"admin.users.list_status_filter.is_2fa_enabled": "Autenticação em dois passos habilitada",
+	"admin.users.list_status_filter.not_prohibit_login": "Permitir início de sessão",
+	"admin.users.list_status_filter.is_prohibit_login": "Proibir início de sessão",
+	"admin.users.list_status_filter.not_restricted": "Não restrito/a",
+	"admin.users.list_status_filter.is_restricted": "Restrito",
+	"admin.users.list_status_filter.not_admin": "Não Administrador",
+	"admin.users.list_status_filter.is_admin": "Administrador",
+	"admin.users.list_status_filter.not_active": "Desligado",
+	"admin.users.list_status_filter.is_active": "Ligado",
+	"admin.users.list_status_filter.reset": "Reiniciar",
+	"admin.users.list_status_filter.menu_text": "Filtro",
+	"admin.system_status.gc_times": "N.º de recolhas de lixo",
+	"admin.system_status.last_gc_pause": "Última pausa da recolha de lixo",
+	"admin.system_status.total_gc_pause": "Pausa total da recolha de lixo",
+	"admin.system_status.last_gc_time": "Tempo decorrido desde a última recolha de lixo",
+	"admin.system_status.next_gc_recycle": "Próxima reciclagem da recolha de lixo",
+	"admin.system_status.other_system_allocation_obtained": "Outras alocações de sistema obtidas",
+	"admin.system_status.gc_metadata_obtained": "Metadados obtidos da recolha de lixo",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Perfil obtido da tabela de hash do balde",
+	"admin.system_status.mcache_structures_obtained": "Estruturas MCache obtidas",
+	"admin.system_status.mcache_structures_usage": "Uso das estruturas MCache",
+	"admin.system_status.mspan_structures_obtained": "Estruturas MSpan obtidas",
+	"admin.system_status.mspan_structures_usage": "Uso das estruturas MSpan",
+	"admin.system_status.stack_memory_obtained": "Memória da pilha obtida",
+	"admin.system_status.bootstrap_stack_usage": "Uso da pilha de arranque",
+	"admin.system_status.heap_objects": "Elementos heap",
+	"admin.system_status.heap_memory_released": "Memória heap libertada",
+	"admin.system_status.heap_memory_in_use": "Memória heap em uso",
+	"admin.system_status.heap_memory_idle": "Memória heap em repouso",
+	"admin.system_status.heap_memory_obtained": "Memória heap obtida",
+	"admin.system_status.current_heap_usage": "Uso corrente da heap",
+	"admin.system_status.memory_free_times": "Libertações de memória",
+	"admin.system_status.memory_allocate_times": "Alocações de memória",
+	"admin.system_status.pointer_lookup_times": "N. º de consultas a ponteiros",
+	"admin.system_status.memory_obtained": "Memória obtida",
+	"admin.system_status.total_memory_allocated": "Total de memória alocada",
+	"admin.system_status.current_memory_usage": "Utilização de memória corrente",
+	"admin.system_status.current_goroutine": "Goroutines em execução",
+	"admin.system_status.server_uptime": "Tempo em funcionamento contínuo do servidor",
+	"markup.filepreview.truncated": "A previsão foi truncada",
+	"markup.filepreview.lines": "Linhas %[1]d até %[2]d em %[3]s",
+	"markup.filepreview.line": "Linha %[1]d em %[2]s",
+	"actions.variables.update.success": "A variável foi editada.",
+	"actions.variables.update.failed": "Falha ao editar a variável.",
+	"actions.variables.creation.success": "A variável \"%s\" foi adicionada.",
+	"actions.variables.creation.failed": "Falha ao adicionar a variável.",
+	"actions.variables.deletion.success": "A variável foi removida.",
+	"actions.variables.deletion.failed": "Falha ao remover a variável.",
+	"actions.variables.not_found": "Não foi possível encontrar a variável.",
+	"actions.variables.edit": "Editar variável",
+	"actions.variables.description": "As variáveis serão transmitidas a certas operações e não poderão ser lidas de outra forma.",
+	"actions.variables.deletion.description": "Remover uma variável é permanente e não pode ser revertido. Quer continuar?",
+	"actions.variables.deletion": "Remover variável",
+	"actions.variables.none": "Ainda não há variáveis.",
+	"actions.variables.creation": "Adicionar variável",
+	"actions.variables.management": "Gerir variáveis",
+	"actions.variables": "Variáveis",
+	"webauthn.error.timeout": "O tempo limite foi atingido antes que a sua chave pudesse ser lida. Recarregue esta página e tente novamente.",
+	"webauthn.error.empty": "Você tem que definir um nome para esta chave.",
+	"webauthn.error.duplicated": "A chave de segurança não é permitida neste pedido. Certifique-se de que a chave não está já registada.",
+	"webauthn.error.unable_to_process": "O servidor não conseguiu processar o seu pedido.",
+	"webauthn.error.insecure": "`WebAuthn apenas suporta conexões seguras. Para testar sobre HTTP, pode usar a origem \"localhost\" ou \"127.0.0.1\"`",
+	"webauthn.error.unknown": "Ocorreu um erro desconhecido. Tente novamente, por favor.",
+	"webauthn.unsupported_browser": "O seu navegador não oferece suporte ao WebAuthn.",
+	"webauthn.error": "Não foi possível ler a sua chave de segurança.",
+	"webauthn.use_twofa": "Usar um código de dois passos do seu telefone",
+	"webauthn.press_button": "Por favor, prima o botão da sua chave de segurança…",
+	"webauthn.sign_in": "Pressione o botão da sua chave de segurança. Se a sua chave de segurança não tiver um botão, insira-a novamente.",
+	"webauthn.insert_key": "Insira a sua chave de segurança",
+	"counters.n_commits": {
+		"one": "%s cometimento",
+		"many": "%s cometimentos",
+		"other": ""
+	},
+	"counters.n_branches": {
+		"one": "%s ramo",
+		"many": "%s ramos",
+		"other": ""
+	},
+	"counters.n_tags": {
+		"one": "%s etiqueta",
+		"many": "%s etiquetas",
+		"other": ""
+	},
+	"counters.n_releases": {
+		"one": "%s lançamento",
+		"many": "%s lançamentos",
+		"other": ""
+	},
 	"gpg.default_key": "Assinado com a chave padrão",
 	"gpg.error.extract_sign": "Falhou ao extrair a assinatura",
 	"gpg.error.generate_hash": "Falhou ao gerar o <i>hash</i> do cometimento",
@@ -345,6 +454,23 @@
 	"migrate.codebase.description": "Migrar dados de codebasehq.com.",
 	"migrate.forgejo.description": "Migrar dados de codeberg.org ou de outras instâncias Forgejo.",
 	"migrate.form.error.url_credentials": "O URL contém credenciais, insira-as nos campos do nome de utilizador e palavra-passe, respetivamente",
+	"migrate.items.label": "Itens da migração",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Etapas",
+	"migrate.items.labels": "Rótulos",
+	"migrate.items.issues": "Questões",
+	"migrate.items.pull_requests": "Pedidos de integração",
+	"migrate.items.merge_requests": "Pedidos de integração",
+	"migrate.items.releases": "Lançamentos",
+	"migrate.in_progress.git": "Migrando dados Git",
+	"migrate.in_progress.topics": "Migrando tópicos",
+	"migrate.in_progress.milestones": "Migrando etapas",
+	"migrate.in_progress.labels": "Migrando rótulos",
+	"migrate.in_progress.releases": "Migrando lançamentos",
+	"migrate.in_progress.issues": "Migrando questões",
+	"migrate.in_progress.pulls": "Migrando pedidos de integração",
+	"migrate.cancel.title": "Cancelar migração",
+	"migrate.cancel.confirmation": "Quer cancelar esta migração?",
 	"user.ghost.tooltip": "Este utilizador foi eliminado ou não é possível encontrar uma correspondência.",
 	"actions.runs.run_attempt_label": "Tentativa de execução #%[1]s (%[2]s)",
 	"actions.runs.viewing_out_of_date_run": "Está a visualizar uma execução desatualizada deste trabalho que foi executado %[1]s.",
@@ -529,11 +655,8 @@
 	"actions.runners.runner_setup.button_copy_token_aria": "Copiar token do executor",
 	"actions.runners.reset_registration_token.token": "Token de Registo (Obsoleto)",
 	"actions.runners.ephemeral": "Efémero",
-	"actions.runners.list_runners.details_column": "Detalhes",
 	"actions.runners.list_runners.edit_column": "Editar",
 	"actions.runners.list_runners.delete_column": "Eliminar",
-	"actions.runners.list_runners.details_button": "Detalhes",
-	"actions.runners.list_runners.details_button_aria": "Mostrar detalhes de %s",
 	"actions.runners.list_runners.delete_button": "Eliminar",
 	"actions.runners.list_runners.delete_button_aria": "Eliminar %s",
 	"actions.runners.list_runners.edit_button": "Editar",
@@ -599,6 +722,48 @@
 	"actions.runs.scheduled_description": "Execução agendada do cometimento <a href=\"%[1]s\">%[2]s</a>",
 	"actions.runs.workflow_dispatch_description": "Execução do commit <a href=\"%[1]s\">%[2]s</a> acionada por <a href=\"%[3]s\">%[4]s</a>",
 	"actions.runs.on_push_description": "Cometimento <a href=\"%[1]s\">%[2]s</a> enviado por <a href=\"%[3]s\">%[4]s</a>",
+	"migrate.select.title": "Migrar repositório",
+	"members.add_member": "Adicionar membro",
+	"members.user": "Utilizador",
+	"members.user_already_member": "Este utilizador já é membro da organização.",
+	"members.no_team_selected": "Os membros da organização devem pertencer a, pelo menos, uma equipa.",
+	"admin.federation.federation": "Federação",
+	"admin.federation.hosts": "Servidores",
+	"admin.federation.hosts.title": "Servidores da federação",
+	"admin.federation.hosts.manage_panel": "Gerir servidores da federação",
+	"admin.federation.hosts.details_panel": "Detalhes do servidor da federação",
+	"admin.federation.hosts.show_details": "Mostrar detalhes do servidor",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Esquema",
+	"admin.federation.host.port": "Porto",
+	"admin.federation.host.software_name": "Software",
+	"admin.federation.host.created": "Criado",
+	"admin.federation.host.updated": "Atualizado",
+	"admin.federation.host.latest_activity": "Atividade mais recente",
+	"admin.federation.users": "Utilizadores",
+	"admin.federation.users.title": "Utilizadores federados",
+	"admin.federation.users.manage_panel": "Gerir utilizadores federados",
+	"admin.federation.users.show_local_user": "Mostrar detalhes do utilizador local",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "ID do utilizador local",
+	"admin.federation.user.external_id": "ID do utilizador externo",
+	"admin.federation.user.inbox_path": "Caminho da caixa de entrada",
+	"admin.config.federation": "Configuração da federação",
+	"admin.config.federation.enabled": "Habilitado",
+	"admin.config.federation.share_user_statistics": "Partilhar estatísticas de utilizadores com outros servidores",
+	"admin.config.federation.max_size": "Tamanho máximo permitido da resposta",
+	"admin.config.federation.signature_enforced": "Exigir assinaturas HTTP",
+	"admin.config.federation.signature_algorithms": "Algoritmos de assinatura",
+	"admin.config.federation.digest_algorithm": "Algoritmo de resumo da assinatura",
+	"admin.config.federation.get_headers": "Cabeçalhos GET assinados",
+	"admin.config.federation.post_headers": "Cabeçalhos POST assinados",
+	"user.activitypub_feed.feed": "Feed do Fediverso",
+	"user.activitypub_feed.no_activity": "Sem atividade no fediverso",
+	"user.activitypub_feed.is_empty": "O seu feed do fediverso está vazio.",
+	"user.activitypub_feed.hint": "Este feed mostra as atividades das contas do fediverso que segue, bem como as publicações federadas que o mencionaram.",
+	"user.activitypub_feed.posted_on": "Publicado em %[1]s",
+	"user.activitypub_feed.original_source": "Fonte original",
 	"actions.runners.version": "Versão",
 	"actions.workflow.unknown_job_in_needs": "O trabalho com o ID %[1]s faz referência a trabalhos desconhecidos em `needs`: %[2]s.",
 	"actions.workflow.rerun_impossible": "A sequência de trabalho não pode ser executada novamente.",
diff --git a/options/locale_next/locale_ro.json b/options/locale_next/locale_ro.json
index 0f3e8af7ee..6f22c9a600 100644
--- a/options/locale_next/locale_ro.json
+++ b/options/locale_next/locale_ro.json
@@ -1,4 +1,16 @@
 {
+	"webauthn.error.timeout": "Limita de timp a fost depășită înainte ca cheia ta să poată fi citită. Reîncarcă pagina și reîncearcă.",
+	"webauthn.error.empty": "Trebuie să setezi un nume pentru această cheie.",
+	"webauthn.error.duplicated": "Cheia de securitate nu este permisă pentru această cerere. Asigură-te că cheia nu este înregistrată deja.",
+	"webauthn.error.unable_to_process": "Serverul nu a putut procesa cererea.",
+	"webauthn.error.insecure": "WebAuthn funcționează doar prin conexiuni securizate. Pentru a testa folosind HTTP, poți folosi \"localhost\" sau \"127.0.0.1\" ca origine",
+	"webauthn.error.unknown": "O eroare necunoscută a apărut. Te rog reîncearcă.",
+	"webauthn.unsupported_browser": "Browserul tău nu are abilități WebAuthn pe moment.",
+	"webauthn.error": "Cheia de securitate nu a putut fi citită.",
+	"webauthn.use_twofa": "Folosește un cod de verificare de pe telefon",
+	"webauthn.press_button": "Apasă butonul de pe cheia de securitate…",
+	"webauthn.sign_in": "Apasă butonul de pe cheia de securitate. Dacă cheia de securitate nu are un buton, reintrodu-o.",
+	"webauthn.insert_key": "Inserează cheia de securitate",
 	"meta.last_line": " ",
 	"packages.empty": "Momentan nu există pachete."
 }
diff --git a/options/locale_next/locale_ru-RU.json b/options/locale_next/locale_ru-RU.json
index 553f4ea91a..cb55dc14ac 100644
--- a/options/locale_next/locale_ru-RU.json
+++ b/options/locale_next/locale_ru-RU.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Все элементы в очереди были удалены.",
+	"admin.monitor.queue.settings.remove_all_items": "Удалить все",
+	"admin.monitor.queue.settings.changed": "Настройки обновлены",
+	"admin.monitor.queue.settings.submit": "Обновить настройки",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Максимальное количество обработчиков должно быть числом",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "В настоящий момент %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Макс. количество обработчиков",
+	"admin.monitor.queue.settings.description": "Пулы динамически растут в зависимости от блокировки очередей их рабочих.",
+	"admin.monitor.queue.settings.title": "Настройки пула",
+	"admin.monitor.queue.review_add": "Подробности / добавить обработчики",
+	"admin.monitor.queue.numberinqueue": "Позиция в очереди",
+	"admin.monitor.queue.maxnumberworkers": "Макс. количество обработчиков",
+	"admin.monitor.queue.activeworkers": "Активные обработчики",
+	"admin.monitor.queue.numberworkers": "Количество обработчиков",
+	"admin.monitor.queue.exemplar": "Тип образца",
+	"admin.monitor.queue.type": "Тип",
+	"admin.monitor.queue.name": "Имя",
+	"admin.monitor.queue": "Очередь: %s",
+	"admin.monitor.queues": "Очереди",
+	"admin.users.list_status_filter.not_2fa_enabled": "2ФА отключена",
+	"admin.users.list_status_filter.is_2fa_enabled": "2ФА включена",
+	"admin.users.list_status_filter.not_prohibit_login": "Вход разрешён",
+	"admin.users.list_status_filter.is_prohibit_login": "Вход запрещён",
+	"admin.users.list_status_filter.not_restricted": "Не ограниченные",
+	"admin.users.list_status_filter.is_restricted": "Ограниченные",
+	"admin.users.list_status_filter.not_admin": "Не администраторы",
+	"admin.users.list_status_filter.is_admin": "Администраторы",
+	"admin.users.list_status_filter.not_active": "Неактивные",
+	"admin.users.list_status_filter.is_active": "Активные",
+	"admin.users.list_status_filter.reset": "Сбросить",
+	"admin.users.list_status_filter.menu_text": "Фильтр",
+	"admin.system_status.gc_times": "Сборок мусора",
+	"admin.system_status.last_gc_pause": "Последняя пауза сборщика",
+	"admin.system_status.total_gc_pause": "Итоговая задержка сборщика",
+	"admin.system_status.last_gc_time": "Прошло с последнего сбора мусора",
+	"admin.system_status.next_gc_recycle": "Следующее высвобождение сборщиком мусора",
+	"admin.system_status.other_system_allocation_obtained": "Прочие системные выделения памяти",
+	"admin.system_status.gc_metadata_obtained": "Метаданных сборщика мусора создавалось",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Хеш-таблиц получено при профайлинге",
+	"admin.system_status.mcache_structures_obtained": "Получено структур MCache",
+	"admin.system_status.mcache_structures_usage": "Использование структур MCache",
+	"admin.system_status.mspan_structures_obtained": "Структур MSpan выделялось",
+	"admin.system_status.mspan_structures_usage": "Использование структур MSpan",
+	"admin.system_status.stack_memory_obtained": "Стековой памяти выделялось",
+	"admin.system_status.bootstrap_stack_usage": "Использование стека загрузчика",
+	"admin.system_status.heap_objects": "Объектов динамической памяти",
+	"admin.system_status.heap_memory_released": "Освобождено динамической памяти",
+	"admin.system_status.heap_memory_in_use": "Используемая динамическая память",
+	"admin.system_status.heap_memory_idle": "Простаивающая динамическая память",
+	"admin.system_status.heap_memory_obtained": "Получено динамической памяти",
+	"admin.system_status.current_heap_usage": "Текущее использование кучи",
+	"admin.system_status.memory_free_times": "Высвобождений памяти",
+	"admin.system_status.memory_allocate_times": "Выделений памяти",
+	"admin.system_status.pointer_lookup_times": "Поисков указателя",
+	"admin.system_status.memory_obtained": "Получено памяти",
+	"admin.system_status.total_memory_allocated": "Всего памяти выделялось",
+	"admin.system_status.current_memory_usage": "Текущее использование памяти",
+	"admin.system_status.current_goroutine": "Выполняемые goroutines",
+	"admin.system_status.server_uptime": "Время работы",
+	"markup.filepreview.truncated": "Предпросмотр был обрезан",
+	"markup.filepreview.lines": "Строки с %[1]d по %[2]d в %[3]s",
+	"markup.filepreview.line": "Строка %[1]d в %[2]s",
+	"actions.variables.update.success": "Переменная изменена.",
+	"actions.variables.update.failed": "Не удалось изменить переменную.",
+	"actions.variables.creation.success": "Переменная «%s» добавлена.",
+	"actions.variables.creation.failed": "Не удалось добавить переменную.",
+	"actions.variables.deletion.success": "Переменная удалена.",
+	"actions.variables.deletion.failed": "Не удалось удалить переменную.",
+	"actions.variables.not_found": "Не удалось найти переменную.",
+	"actions.variables.edit": "Изменить переменную",
+	"actions.variables.description": "Переменные будут передаваться определенным действиям и не могут быть прочитаны иначе.",
+	"actions.variables.deletion.description": "Удаление переменной необратимо, его нельзя отменить. Продолжить?",
+	"actions.variables.deletion": "Удалить переменную",
+	"actions.variables.none": "Переменных пока нет.",
+	"actions.variables.creation": "Добавить переменную",
+	"actions.variables.management": "Управление переменными",
+	"actions.variables": "Переменные",
+	"webauthn.error.timeout": "Время истекло раньше, чем ключ был прочитан. Перезагрузите эту страницу и повторите попытку.",
+	"webauthn.error.empty": "Необходимо задать имя для этого ключа.",
+	"webauthn.error.duplicated": "Этот токен авторизации не разрешен для выполнения этого запроса. Убедитесь, что токен не был зарегистрирован ранее.",
+	"webauthn.error.unable_to_process": "Сервер не смог обработать ваш запрос.",
+	"webauthn.error.insecure": "WebAuthn поддерживает только безопасные соединения. Для тестирования по HTTP можно использовать \"localhost\" или \"127.0.0.1\"",
+	"webauthn.error.unknown": "Произошла неизвестная ошибка. Повторите попытку.",
+	"webauthn.unsupported_browser": "Ваш браузер в настоящее время не поддерживает WebAuthn.",
+	"webauthn.error": "Не удалось прочитать токен авторизации.",
+	"webauthn.use_twofa": "Используйте двухфакторный код с вашего телефона",
+	"webauthn.press_button": "Подтвердите действие на токене авторизации…",
+	"webauthn.sign_in": "Подтвердите действие на токене авторизации. Если на вашем токене нет кнопки, вставьте его заново.",
+	"webauthn.insert_key": "Вставьте ваш токен авторизации",
+	"counters.n_commits": {
+		"one": "%s коммит",
+		"few": "%s коммита",
+		"many": "%s коммитов"
+	},
+	"counters.n_branches": {
+		"one": "%s ветвь",
+		"few": "%s ветви",
+		"many": "%s ветвей"
+	},
+	"counters.n_tags": {
+		"one": "%s тег",
+		"few": "%s тега",
+		"many": "%s тегов"
+	},
+	"counters.n_releases": {
+		"one": "%s выпуск",
+		"few": "%s выпуска",
+		"many": "%s выпусков"
+	},
 	"gpg.default_key": "Подписано ключом по умолчанию",
 	"gpg.error.extract_sign": "Не удалось извлечь подпись",
 	"gpg.error.generate_hash": "Не удалось создать хеш коммита",
@@ -344,6 +453,23 @@
 	"migrate.gitbucket.description": "Перенести данные с сервера GitBucket.",
 	"migrate.codebase.description": "Перенести данные с codebasehq.com.",
 	"migrate.forgejo.description": "Перенести данные с codeberg.org или другого сервера Forgejo.",
+	"migrate.items.label": "Элементы для переноса",
+	"migrate.items.wiki": "Вики",
+	"migrate.items.milestones": "Этапы",
+	"migrate.items.labels": "Метки",
+	"migrate.items.issues": "Задачи",
+	"migrate.items.pull_requests": "Запросы слияний",
+	"migrate.items.merge_requests": "Запросы слияний",
+	"migrate.items.releases": "Выпуски",
+	"migrate.in_progress.git": "Перенос данных Git",
+	"migrate.in_progress.topics": "Перенос тем",
+	"migrate.in_progress.milestones": "Перенос этапов",
+	"migrate.in_progress.labels": "Перенос меток",
+	"migrate.in_progress.releases": "Перенос выпусков",
+	"migrate.in_progress.issues": "Перенос задач",
+	"migrate.in_progress.pulls": "Перенос запросов слияний",
+	"migrate.cancel.title": "Отменить перенос",
+	"migrate.cancel.confirmation": "Отменить перенос репозитория?",
 	"user.ghost.tooltip": "Пользователь удалён или неизвестен.",
 	"migrate.form.error.url_credentials": "Ссылка содержит данные авторизации. Поместите их в соответствующие поля",
 	"actions.runs.run_attempt_label": "Попытка №%[1]s (%[2]s)",
@@ -523,7 +649,6 @@
 	"actions.runners.uuid": "УУИД",
 	"actions.runners.token": "Токен",
 	"actions.runners.ephemeral": "Одноразовый",
-	"actions.runners.list_runners.details_column": "Свойства",
 	"actions.runners.list_runners.delete_column": "Удаление",
 	"actions.runners.runner_setup.list_of_runners_link": "Список исполнителей",
 	"actions.runners.runner_setup.last_chance_copying_token": "Скопируйте токен сейчас – потом он не будет отображаться!",
@@ -554,14 +679,16 @@
 	"actions.runners.runner_setup.configuration_snippet_aria": "Часть конфигурации, которую нужно добавить",
 	"actions.runners.runner_setup.instruction_replace_connection_name": "Замените название подключения (в примере – <code>forgejo</code>) на нужное.",
 	"actions.runners.runner_setup.heading_using_options": "Используя параметры запуска",
+	"members.add_member": "Добавить участника",
+	"members.user": "Пользователь",
+	"members.user_already_member": "Этот пользователь уже состоит в организации.",
+	"members.no_team_selected": "Участники организации должны состоять хотя бы в одной команде.",
 	"settings.access_token.remove": "Исключить %s",
 	"settings.access_token.resource_all_help": "Разрешить доступ ко всем ресурсам.",
 	"settings.access_token.resource_public_only_help": "Разрешить доступ только к публичным репозиториям и организациям.",
 	"settings.access_token.resource_specific_repo_help": "Разрешить доступ только к списку выбранных репозиториев. Доступ на чтение разрешён для всех публичных репозиториев. Могут быть выбраны только разрешения, относящиеся к репозиториям и задачам.",
 	"settings.access_token.admin_disabled": "Административные разрешения выключены.",
 	"actions.runners.list_runners.edit_column": "Правка",
-	"actions.runners.list_runners.details_button": "Свойства",
-	"actions.runners.list_runners.details_button_aria": "Открыть свойства %s",
 	"actions.runners.list_runners.delete_button": "Удалить",
 	"actions.runners.list_runners.delete_button_aria": "Удалить %s",
 	"actions.runners.list_runners.edit_button": "Изменить",
@@ -573,20 +700,60 @@
 	"actions.runners.create_runner.create_button": "Создать",
 	"actions.runners.create_runner.cancel_button": "Отмена",
 	"actions.runners.show_registration_token": "Показать токен регистрации",
-	"actions.runners.version": "Версия",
+	"migrate.select.title": "Перенос репозитория",
 	"actions.runners.edit_runner.page_title": "Изменение исполнителя %s",
+	"actions.runners.edit_runner.save_button": "Сохранить",
+	"actions.runners.edit_runner.description_label": "Описание",
+	"actions.runners.runner_details.page_title": "Исполнитель %s",
+	"admin.federation.federation": "Федерация",
+	"admin.federation.host.id": "ИД",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Схема",
+	"admin.federation.host.port": "Порт",
+	"admin.federation.host.created": "Создан",
+	"admin.federation.host.updated": "Обновлён",
+	"admin.federation.host.latest_activity": "Недавняя активность",
+	"admin.federation.users": "Пользователи",
+	"admin.federation.user.id": "ИД",
+	"admin.config.federation": "Настройки федерации",
+	"admin.config.federation.enabled": "Включена",
+	"admin.config.federation.max_size": "Макс. разрешённый размер ответа",
+	"admin.config.federation.signature_enforced": "Требовать подписи HTTP",
+	"admin.config.federation.signature_algorithms": "Алгоритмы подписей",
+	"user.activitypub_feed.feed": "Феди-лента",
+	"actions.runners.version": "Версия",
 	"actions.runners.edit_runner.title": "Изменить исполнителя %s",
 	"actions.runners.edit_runner.properties_fieldset": "Свойства",
-	"actions.runners.edit_runner.description_label": "Описание",
-	"actions.runners.edit_runner.save_button": "Сохранить",
 	"actions.runners.edit_runner.cancel_button": "Отмена",
-	"actions.runners.runner_details.page_title": "Исполнитель %s",
-	"actions.runners.runner_setup.instruction_advanced_configurations": "Для настройки исполнителя Forgejo Действий в контейнерах и др. расширенных настроек, обратитесь к <a href=\"%s\">документации</a>.",
 	"actions.workflow.rerun_impossible": "Раб. поток невозможно выполнить повторно.",
 	"actions.workflow.job_rerun_impossible": "Задание невозможно выполнить повторно.",
+	"actions.runners.runner_setup.instruction_advanced_configurations": "Для настройки исполнителя Forgejo Действий в контейнерах и др. расширенных настроек, обратитесь к <a href=\"%s\">документации</a>.",
+	"actions.runs.on_push_description": "Коммит <a href=\"%[1]s\">%[2]s</a>, отправленный <a href=\"%[3]s\">%[4]s</a>",
+	"repo.files.caption": "Файлы репозитория (в начале последний коммит)",
+	"repo.files.filename": "Имя файла",
+	"repo.files.last_commit_message": "Текст последнего коммита",
+	"repo.files.last_commit_date": "Дата последнего коммита",
+	"admin.federation.host.software_name": "ПО",
+	"admin.federation.users.title": "Пользователи федерации",
+	"admin.federation.user.user_id": "ИД локального пользователя",
+	"admin.federation.user.external_id": "ИД внешнего пользователя",
+	"admin.federation.hosts": "Узлы",
+	"admin.federation.hosts.title": "Узлы федерации",
+	"admin.federation.hosts.manage_panel": "Управлять узлами федерации",
+	"admin.federation.hosts.details_panel": "Подробности об узле федерации",
+	"admin.federation.hosts.show_details": "Показать подробности об узле",
+	"admin.federation.users.manage_panel": "Управлять пользователями федерации",
+	"admin.federation.users.show_local_user": "Показать подробности локального пользователя",
+	"admin.config.federation.share_user_statistics": "Делиться статистикой пользователей с другими узлами",
+	"admin.config.federation.get_headers": "Подписанные заголовки GET",
+	"admin.config.federation.post_headers": "Подписанные заголовки POST",
+	"admin.config.federation.digest_algorithm": "Алгоритм хеширования для подписей",
+	"user.activitypub_feed.no_activity": "Нет активности из Федивёрса",
+	"user.activitypub_feed.hint": "В этой ленте будут появляться активности пользователей Федивёрса, на которых вы подписаны, а также записи, в которых вы упомянуты.",
+	"user.activitypub_feed.posted_on": "Опубликовано %[1]s",
+	"user.activitypub_feed.original_source": "Первоисточник",
 	"actions.runners.runner_setup.title": "Настройка исполнителя %s",
 	"actions.runners.runner_setup.page_title": "Настройка исполнителя %s",
-	"actions.runs.on_push_description": "Коммит <a href=\"%[1]s\">%[2]s</a>, отправленный <a href=\"%[3]s\">%[4]s</a>",
 	"actions.secrets.edit_button": "Изменить секрет «%s»",
 	"actions.secrets.mutation.success_message": "Секрет «%s» был изменён.",
 	"actions.secrets.mutation.name_description": "Название секрета может содержать только буквы, цифры и нижние подчёркивания. Оно не может начинаться на FORGEJO_, GITEA_, GITHUB_, или на цифру. Оно будет сохранено в верхнем регистре."
diff --git a/options/locale_next/locale_si-LK.json b/options/locale_next/locale_si-LK.json
index 42f249b0a8..2e6decc0e9 100644
--- a/options/locale_next/locale_si-LK.json
+++ b/options/locale_next/locale_si-LK.json
@@ -1,4 +1,57 @@
 {
+	"admin.monitor.queue.settings.changed": "සැකසුම් යාවත්කාල කෙරිණි",
+	"admin.monitor.queue.settings.submit": "සැකසුම් යාවත්කාල කරන්න",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "මැක්ස් කම්කරුවන්ගේ සංඛ්යාව අංකයක් විය යුතුය",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "වත්මන්%[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "මැක්ස් කම්කරුවන් සංඛ්යාව",
+	"admin.monitor.queue.settings.title": "තටාකය සැකසුම්",
+	"admin.monitor.queue.maxnumberworkers": "මැක්ස් කම්කරු සංඛ්යාව",
+	"admin.monitor.queue.numberworkers": "කම්කරුවන් සංඛ්යාව",
+	"admin.monitor.queue.exemplar": "ආදර්ශ වර්ගය",
+	"admin.monitor.queue.type": "වර්ගය",
+	"admin.monitor.queue.name": "නම",
+	"admin.monitor.queue": "පෝලිම: %s",
+	"admin.monitor.queues": "පෝලිම්",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA ආබාධිත",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA සක්රීය",
+	"admin.users.list_status_filter.not_prohibit_login": "ලොගින් වන්න ඉඩ",
+	"admin.users.list_status_filter.is_prohibit_login": "ලොගින් වන්න තහනම්",
+	"admin.users.list_status_filter.not_restricted": "සීමා කර නැත",
+	"admin.users.list_status_filter.is_restricted": "සීමා",
+	"admin.users.list_status_filter.not_admin": "පරිපාලක නොවන",
+	"admin.users.list_status_filter.is_admin": "පරිපාලක",
+	"admin.users.list_status_filter.not_active": "අක්රිය",
+	"admin.users.list_status_filter.is_active": "ක්රියාකාරී",
+	"admin.users.list_status_filter.reset": "යළි සකසන්න",
+	"admin.users.list_status_filter.menu_text": "පෙරහන",
+	"admin.system_status.gc_times": "GC ටයිම්ස්",
+	"admin.system_status.last_gc_pause": "අවසන් GC විරාමය",
+	"admin.system_status.total_gc_pause": "මුළු GC විරාමය",
+	"admin.system_status.last_gc_time": "පසුගිය GC වේලාව",
+	"admin.system_status.next_gc_recycle": "ඊලඟ GC, ප්රතිචක්රීකරණ",
+	"admin.system_status.other_system_allocation_obtained": "ලබා ගත් වෙනත් පද්ධති ප්රතිපාදන",
+	"admin.system_status.gc_metadata_obtained": "ලබාගත් GC පාර-දත්ත",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "ලබා භාජනයට හැෂ් වගුව පැතිකඩ",
+	"admin.system_status.mcache_structures_obtained": "ලබා ගත් මැචේ ව්යුහයන්",
+	"admin.system_status.mcache_structures_usage": "මැචේ ව්යුහයන් භාවිතය",
+	"admin.system_status.mspan_structures_obtained": "ලබා ගත් MsPan ව්යුහයන්",
+	"admin.system_status.mspan_structures_usage": "MsPan ව්යුහයන් භාවිතය",
+	"admin.system_status.stack_memory_obtained": "ලබා මතකය ගොඩගසන්න",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap Stack භාවිතය",
+	"admin.system_status.heap_objects": "ගොඩක් වස්තු",
+	"admin.system_status.heap_memory_released": "ගොඩක් මතකය නිකුත්",
+	"admin.system_status.heap_memory_in_use": "භාවිතයේ දී ගොඩක් මතකය",
+	"admin.system_status.heap_memory_idle": "ගොඩක් මතකය අලස",
+	"admin.system_status.heap_memory_obtained": "ලබා ගත් ගොඩක් මතකය",
+	"admin.system_status.current_heap_usage": "වත්මන් heap භාවිතය",
+	"admin.system_status.memory_free_times": "මතක නිදහස්",
+	"admin.system_status.memory_allocate_times": "මතක ප්රතිපාදන",
+	"admin.system_status.pointer_lookup_times": "පොයින්ටර් Lookup ටයිම්ස්",
+	"admin.system_status.memory_obtained": "ලබා ගත් මතකය",
+	"admin.system_status.total_memory_allocated": "මුළු මතකය වෙන් කර ඇත",
+	"admin.system_status.current_memory_usage": "වත්මන් මතක භාවිතය",
+	"admin.system_status.current_goroutine": "වත්මන් ගෝර්අවුට්ලයින්",
+	"admin.system_status.server_uptime": "සේවාදායකය යාවත්කාලීන කිරීම",
 	"actions.runners.name": "නම",
 	"actions.runners.owner_type": "වර්ගය",
 	"actions.runners.description": "සවිස්තරය",
@@ -24,6 +77,21 @@
 	"migrate.gogs.description": "notabug.org හෝ වෙනත් Gogs අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.",
 	"migrate.onedev.description": "code.onedev.io හෝ වෙනත් OnedeV අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.",
 	"migrate.gitbucket.description": "GitBucket අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.",
+	"migrate.items.label": "සංක්රමණ අයිතම",
+	"migrate.items.wiki": "විකි",
+	"migrate.items.milestones": "සන්ධිස්ථාන",
+	"migrate.items.labels": "ලේබල",
+	"migrate.items.issues": "ගැටළු",
+	"migrate.items.pull_requests": "ඉල්ලීම් අදින්න",
+	"migrate.items.merge_requests": "සංයුක්ත කිරීමේ ඉල්ලීම්",
+	"migrate.items.releases": "නිකුතු",
+	"migrate.in_progress.git": "Git දත්ත සංක්රමණය",
+	"migrate.in_progress.topics": "සංක්රමණය මාතෘකා",
+	"migrate.in_progress.milestones": "සංක්රමික සන්ධිස්ථාන",
+	"migrate.in_progress.labels": "සංක්රමණය ලේබල",
+	"migrate.in_progress.releases": "සංක්රමණ නිකුතු",
+	"migrate.in_progress.issues": "සංක්රමණ ගැටළු",
+	"migrate.in_progress.pulls": "අදින්න ඉල්ලීම් සංක්රමණය",
 	"pulse.n_active_issues": {
 		"one": "%s ක්රියාකාරී නිකුතුව",
 		"other": "%s ක්රියාකාරී ගැටළු"
diff --git a/options/locale_next/locale_sk-SK.json b/options/locale_next/locale_sk-SK.json
index 2844fd9645..f7c2c1c5a4 100644
--- a/options/locale_next/locale_sk-SK.json
+++ b/options/locale_next/locale_sk-SK.json
@@ -1,4 +1,16 @@
 {
+	"webauthn.error.timeout": "Vypršal čas na čítanie vašeho kľúča. Znova načítajte túto stránku a skúste to opäť.",
+	"webauthn.error.empty": "Musíte nastaviť meno pre tento kľúč.",
+	"webauthn.error.duplicated": "Bezpečnostný kľúč nie je pre túto požiadavku povolený. Uistite sa, že kľúč ešte nie je zaregistrovaný.",
+	"webauthn.error.unable_to_process": "Server nemohol spracovať vašu požiadavku.",
+	"webauthn.error.insecure": "`WebAuthn podporuje iba bezpečné spojenia. Na testovanie cez HTTP môžete použiť \"localhost\" alebo \"127.0.0.1\"`",
+	"webauthn.error.unknown": "Vyskytla sa neznáma chyba. Skúste to znova.",
+	"webauthn.unsupported_browser": "Váš prehliadač aktuálne nepodporuje WebAuthn.",
+	"webauthn.error": "Nie je možné prečítať váš bezpečnostný kód.",
+	"webauthn.use_twofa": "Použite kód dvojfaktorového overenia z vášho telefónu",
+	"webauthn.press_button": "Stlačte, prosím, tlačidlo na vašom bezpečnostnom kľúči…",
+	"webauthn.sign_in": "Stlačte tlačidlo na vašom bezpečnostnom kľúči. Ak váš kľúč nemá tlačidlo, vyberte a zasunte ho znova.",
+	"webauthn.insert_key": "Zadajte bezpečnostný kľúč",
 	"actions.runners.labels": "Štítky",
 	"gpg.error.no_committer_account": "Žiadny účet nie je prepojený s e-mailovou adresou prispievateľa",
 	"gpg.error.not_signed_commit": "Nie je podpísaný commit",
@@ -113,6 +125,11 @@
 	"migrate.onedev.description": "Migrovať dáta z code.onedev.io alebo iných inštancií OneDev.",
 	"migrate.gitbucket.description": "Migrovať dáta z inštancií GitBucket.",
 	"migrate.codebase.description": "Migrovať dáta z codebasehq.com.",
+	"migrate.items.label": "Položky migrácie",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Míľniky",
+	"migrate.items.labels": "Štítky",
+	"migrate.items.pull_requests": "Pull requesty",
 	"repo.pulls.title_desc": {
 		"one": "je potrebné zlúčiť %[1]d revíziu z <code>%[2]s</code> do <code id=\"%[4]s\">%[3]s</code>",
 		"few": "je potrebné zlúčiť %[1]d revízie z <code>%[2]s</code> do <code id=\"%[4]s\">%[3]s</code>",
diff --git a/options/locale_next/locale_sl.json b/options/locale_next/locale_sl.json
index 0fcc19880f..61c89d24fa 100644
--- a/options/locale_next/locale_sl.json
+++ b/options/locale_next/locale_sl.json
@@ -1,4 +1,16 @@
 {
+	"webauthn.error.timeout": "Preden je bilo mogoče prebrati vaš ključ, je bil dosežen časovni rok. Ponovno naložite to stran in poskusite znova.",
+	"webauthn.error.empty": "Za ta ključ morate nastaviti ime.",
+	"webauthn.error.duplicated": "Varnostni ključ za to zahtevo ni dovoljen. Prepričajte se, da ključ še ni registriran.",
+	"webauthn.error.unable_to_process": "Strežnik ni mogel obdelati vaše zahteve.",
+	"webauthn.error.insecure": "WebAuthn podpira samo varne povezave. Za testiranje prek protokola HTTP lahko uporabite izvor \"localhost\" ali \"127.0.0.1\"",
+	"webauthn.error.unknown": "Zgodila se je neznana napaka. Prosimo, poskusite znova.",
+	"webauthn.unsupported_browser": "Vaš brskalnik trenutno ne podpira WebAuthna.",
+	"webauthn.error": "Vašega varnostnega ključa ni bilo mogoče prebrati.",
+	"webauthn.use_twofa": "Uporaba kode z dvema faktorjema iz telefona",
+	"webauthn.press_button": "Pritisnite gumb na varnostnem ključu…",
+	"webauthn.sign_in": "Pritisnite gumb na varnostnem ključu. Če varnostni ključ nima gumba, ga ponovno vstavite.",
+	"webauthn.insert_key": "Vnesite varnostni ključ",
 	"actions.runners.runner_manage_panel": "Upravljanje tekačev",
 	"packages.owner.settings.chef.keypair.description": "Za preverjanje pristnosti v registru Chef je potreben par ključev. Če ste par ključev ustvarili že prej, se pri ustvarjanju novega para ključev stari par ključev zavrže.",
 	"meta.last_line": " "
diff --git a/options/locale_next/locale_sr-SP.json b/options/locale_next/locale_sr-SP.json
index 1ec60d3df7..b4f0454546 100644
--- a/options/locale_next/locale_sr-SP.json
+++ b/options/locale_next/locale_sr-SP.json
@@ -1,4 +1,42 @@
 {
+	"admin.system_status.gc_times": "Времена cакупљању смећа",
+	"admin.system_status.last_gc_pause": "Задња пауза у cакупљању смећа",
+	"admin.system_status.total_gc_pause": "Укупно време cакупљању смећа",
+	"admin.system_status.last_gc_time": "Времена од прошлог cакупљању смећа",
+	"admin.system_status.next_gc_recycle": "Следећа рециклажа cакупљању смећа",
+	"admin.system_status.other_system_allocation_obtained": "Добијено друга системска меморија",
+	"admin.system_status.gc_metadata_obtained": "Добијених метаподатака cакупљању смећа",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Хеш-табела постигнуто за Profiling Bucket",
+	"admin.system_status.mcache_structures_obtained": "Добијено структурa MCache",
+	"admin.system_status.mcache_structures_usage": "Употреба структурa MCache",
+	"admin.system_status.mspan_structures_obtained": "Добијено структуре MSpan",
+	"admin.system_status.mspan_structures_usage": "Употреба структуре MSpan",
+	"admin.system_status.stack_memory_obtained": "Слободно стек меморије",
+	"admin.system_status.bootstrap_stack_usage": "Коришћење стек меморије",
+	"admin.system_status.heap_objects": "Објекти динамичке меморије",
+	"admin.system_status.heap_memory_released": "Ослобођено динамичке меморије",
+	"admin.system_status.heap_memory_in_use": "Динамичка меморија у употреби",
+	"admin.system_status.heap_memory_idle": "Некориштена динамичка меморија",
+	"admin.system_status.heap_memory_obtained": "Слободно динамичке меморије",
+	"admin.system_status.current_heap_usage": "Тренутна употреба динамичке меморије",
+	"admin.system_status.pointer_lookup_times": "Захтева показивача",
+	"admin.system_status.memory_obtained": "Коришћена меморија",
+	"admin.system_status.total_memory_allocated": "Укупно меморије алоцирано",
+	"admin.system_status.current_memory_usage": "Тренутна употреба меморије",
+	"admin.system_status.current_goroutine": "Тренутнe Goroutine",
+	"admin.system_status.server_uptime": "Време непрекидног рада сервера",
+	"webauthn.error.timeout": "Захтев је истекао пре што је очитавање Вашег кључа успео. Молимо Вас да актуализирате ову веб-страницу и покушате поново.",
+	"webauthn.error.empty": "Морате унети име за овај кључ.",
+	"webauthn.error.duplicated": "Сигурносни кључ није дозвољен за овај захтев. Уверите се да кључ није већ регистрован.",
+	"webauthn.error.unable_to_process": "Сервер не може обрадити Ваш захтев.",
+	"webauthn.error.insecure": "\"WebAuthn\" једино подржава сигурне везе. За тестирање путем ХТТП, можете корисити извор \"localhost\" или \"127.0.0.1\"",
+	"webauthn.error.unknown": "Непозната грешка се догодила. Молимо Вас да покушате поново.",
+	"webauthn.unsupported_browser": "Ваш веб-прегледач тренутно не подржава \"WebAuthn\".",
+	"webauthn.error": "Сигурносни кључ се не да исчитати.",
+	"webauthn.use_twofa": "Користите дво-факторски ко̑д са вашег мобитела",
+	"webauthn.press_button": "Молимо притисните дугме на Вашем сигурносном кључу…",
+	"webauthn.sign_in": "Притисните дугме на Вашем сигурносном кључу. Уколико Ваш кључ нема дугме, искључите и поново укључите га.",
+	"webauthn.insert_key": "Прикључите Ваш физички сигурносни кључ",
 	"dropzone.remove_file": "Уклони датотеку",
 	"moderation.abuse_category.malware": "Малвер",
 	"home.welcome.no_activity": "Без активности",
diff --git a/options/locale_next/locale_sv-SE.json b/options/locale_next/locale_sv-SE.json
index 7365fac570..953bb8fe44 100644
--- a/options/locale_next/locale_sv-SE.json
+++ b/options/locale_next/locale_sv-SE.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Alla objekt i kön har tagits bort.",
+	"admin.monitor.queue.settings.remove_all_items": "Ta bort alla",
+	"admin.monitor.queue.settings.changed": "Inställningar uppdaterade",
+	"admin.monitor.queue.settings.submit": "Uppdatera inställningar",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Max antal arbetare måste vara ett tal",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "För närvarande %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Max antal arbetare",
+	"admin.monitor.queue.settings.description": "Pooler växer dynamiskt som svar på att deras arbetarkö blockeras.",
+	"admin.monitor.queue.settings.title": "Poolinställningar",
+	"admin.monitor.queue.review_add": "Granska / lägg till arbetare",
+	"admin.monitor.queue.numberinqueue": "Antal i kö",
+	"admin.monitor.queue.maxnumberworkers": "Max antal arbetare",
+	"admin.monitor.queue.activeworkers": "Aktiva arbetare",
+	"admin.monitor.queue.numberworkers": "Antal arbetare",
+	"admin.monitor.queue.exemplar": "Exempeltyp",
+	"admin.monitor.queue.type": "Typ",
+	"admin.monitor.queue.name": "Namn",
+	"admin.monitor.queue": "Kö: %s",
+	"admin.monitor.queues": "Köer",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA inaktiverad",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA aktiverad",
+	"admin.users.list_status_filter.not_prohibit_login": "Tillåt inloggning",
+	"admin.users.list_status_filter.is_prohibit_login": "Förbjud inloggning",
+	"admin.users.list_status_filter.not_restricted": "Ej begränsad",
+	"admin.users.list_status_filter.is_restricted": "Begränsad",
+	"admin.users.list_status_filter.not_admin": "Inte admin",
+	"admin.users.list_status_filter.is_admin": "Administratör",
+	"admin.users.list_status_filter.not_active": "Inaktiv",
+	"admin.users.list_status_filter.is_active": "Aktiv",
+	"admin.users.list_status_filter.reset": "Återställ",
+	"admin.users.list_status_filter.menu_text": "Filter",
+	"admin.system_status.gc_times": "Skräpsamlingstider",
+	"admin.system_status.last_gc_pause": "Senaste paus vid skräpsamling",
+	"admin.system_status.total_gc_pause": "Total tid för pauser vid skräpsamling",
+	"admin.system_status.last_gc_time": "Tidpunkt för senaste skräpsamling",
+	"admin.system_status.next_gc_recycle": "Nästa Skräpsamlarrunda",
+	"admin.system_status.other_system_allocation_obtained": "Övriga Systemallokeringar",
+	"admin.system_status.gc_metadata_obtained": "Metainformation om Skräpsamlaren Ihopsamlad",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Profilering av Bucket Hash Table erhållen",
+	"admin.system_status.mcache_structures_obtained": "MCache-strukturer som erhållits",
+	"admin.system_status.mcache_structures_usage": "MCache strukturanvändning",
+	"admin.system_status.mspan_structures_obtained": "MSpan strukturer som erhållits",
+	"admin.system_status.mspan_structures_usage": "MSpan strukturanvändning",
+	"admin.system_status.stack_memory_obtained": "Stackminne som erhålls",
+	"admin.system_status.bootstrap_stack_usage": "Bootstrap Stack-användning",
+	"admin.system_status.heap_objects": "Heapobjekt",
+	"admin.system_status.heap_memory_released": "Frigjort heap-minne",
+	"admin.system_status.heap_memory_in_use": "Heapminne som används",
+	"admin.system_status.heap_memory_idle": "Heapminne som är inaktivt",
+	"admin.system_status.heap_memory_obtained": "Heapminne som erhållits",
+	"admin.system_status.current_heap_usage": "Nuvarande heapanvändning",
+	"admin.system_status.memory_free_times": "Minnesfrigörelser",
+	"admin.system_status.memory_allocate_times": "Minneallokeringar",
+	"admin.system_status.pointer_lookup_times": "Pekaruppslagstider",
+	"admin.system_status.memory_obtained": "Minnesåtgång",
+	"admin.system_status.total_memory_allocated": "Total minnesanvändning",
+	"admin.system_status.current_memory_usage": "Nuvarande minnesanvändning",
+	"admin.system_status.current_goroutine": "Aktuella gorutiner",
+	"admin.system_status.server_uptime": "Serverns upptid",
+	"markup.filepreview.truncated": "Förhandsgranskningen har avkortats",
+	"markup.filepreview.lines": "Rad %[1]d till %[2]d i %[3]s",
+	"markup.filepreview.line": "Rad %[1]d i %[2]s",
+	"actions.variables.update.success": "Variabeln har redigerats.",
+	"actions.variables.update.failed": "Misslyckades med att redigera variabel.",
+	"actions.variables.creation.success": "Variabeln \"%s\" har lagts till.",
+	"actions.variables.creation.failed": "Misslyckades med att lägga till variabel.",
+	"actions.variables.deletion.success": "Variabeln har tagits bort.",
+	"actions.variables.deletion.failed": "Misslyckades med att ta bort variabel.",
+	"actions.variables.not_found": "Misslyckades med att hitta variabeln.",
+	"actions.variables.edit": "Redigera variabel",
+	"actions.variables.description": "Variabler skickas till vissa actions och kan inte läsas annars.",
+	"actions.variables.deletion.description": "Borttagning av en variabel är permanent och kan inte ångras. Vill du fortsätta?",
+	"actions.variables.deletion": "Ta bort variabel",
+	"actions.variables.none": "Det finns inga variabler ännu.",
+	"actions.variables.creation": "Lägg till variabel",
+	"actions.variables.management": "Hantera variabler",
+	"actions.variables": "Variabler",
+	"webauthn.error.timeout": "Det gick inte att läsa din nyckel innan tidsgränsen nåddes. Läs om denna sida och försök igen.",
+	"webauthn.error.empty": "Du måste ange ett namn för den här nyckeln.",
+	"webauthn.error.duplicated": "Säkerhetsnyckeln är inte tillåten för denna begäran. Se till att nyckeln inte redan är registrerad.",
+	"webauthn.error.unable_to_process": "Servern kunde inte hantera din begäran.",
+	"webauthn.error.insecure": "WebAuthn stöder endast säkra anslutningar. För testning över HTTP kan du använda \"localhost\" eller \"127.0.0.1\"",
+	"webauthn.error.unknown": "Ett okänt fel har inträffat. Vänligen försök igen.",
+	"webauthn.unsupported_browser": "Din webbläsare har ännu inte stöd för WebAuthn.",
+	"webauthn.error": "Det gick inte att läsa din säkerhetsnyckel.",
+	"webauthn.use_twofa": "Använd en tvåfaktorskod från din telefon",
+	"webauthn.press_button": "Vänligen tryck på knappen på din säkerhetsnyckel…",
+	"webauthn.sign_in": "Tryck på knappen på din säkerhetsnyckel. Om din säkerhetsnyckel inte har en knapp, dra ut den och sätt in den igen.",
+	"webauthn.insert_key": "Skriv in din säkerhetsnyckel",
+	"counters.n_commits": {
+		"one": "%s incheckning",
+		"other": "%s incheckningar"
+	},
+	"counters.n_branches": {
+		"one": "%s gren",
+		"other": "%s grenar"
+	},
+	"counters.n_tags": {
+		"one": "%s tagg",
+		"other": "%s taggar"
+	},
+	"counters.n_releases": {
+		"one": "%s utgåva",
+		"other": "%s utgåvor"
+	},
 	"gpg.default_key": "Signerad med standardnyckeln",
 	"gpg.error.extract_sign": "Det gick inte att extrahera signatur",
 	"gpg.error.generate_hash": "Misslyckades att generera en hashsumma för incheckningen",
@@ -304,6 +409,23 @@
 	"migrate.gitbucket.description": "Migrera data från GitBucket-instans.",
 	"migrate.codebase.description": "Migrera data från codebasehq.com.",
 	"migrate.forgejo.description": "Migrera data från codeberg.org eller annan Forgejo-instans.",
+	"migrate.items.label": "Migrationsobjekt",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Milstolpar",
+	"migrate.items.labels": "Etiketter",
+	"migrate.items.issues": "Ärenden",
+	"migrate.items.pull_requests": "Ändringsförfrågningar",
+	"migrate.items.merge_requests": "Ändringsförfrågningar",
+	"migrate.items.releases": "Utgåvor",
+	"migrate.in_progress.git": "Migrerar Git-data",
+	"migrate.in_progress.topics": "Migrerar ämnen",
+	"migrate.in_progress.milestones": "Migrerar milstolpar",
+	"migrate.in_progress.labels": "Migrerar etiketter",
+	"migrate.in_progress.releases": "Migrerar utgåvor",
+	"migrate.in_progress.issues": "Migrerar ärenden",
+	"migrate.in_progress.pulls": "Migrerar ändringsförfrågningar",
+	"migrate.cancel.title": "Avbryt migrering",
+	"migrate.cancel.confirmation": "Vill du avbryta denna migrering?",
 	"repo.settings.push_mirror.branch_filter.label": "Grenfilter (frivilligt)",
 	"repo.settings.push_mirror.branch_filter.description": "Grenar att speglas. Lämna tom för att spegla alla grenar. Se <a href=\"%[1]s\">%[2]s dokumentation</a> för syntax. Exempel: <code>main, release/*</code>",
 	"admin.moderation.moderation_reports": "Modereringsrapporter",
@@ -507,10 +629,8 @@
 	"settings.specific_repo_access": "Kodförrådsåtkomst",
 	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "Token",
-	"actions.runners.list_runners.details_column": "Detaljer",
 	"actions.runners.list_runners.edit_column": "Redigera",
 	"actions.runners.list_runners.delete_column": "Ta bort",
-	"actions.runners.list_runners.details_button_aria": "Visa detaljer för %",
 	"actions.runners.list_runners.delete_button_aria": "Ta bort %s",
 	"actions.runners.list_runners.edit_button": "Redigera",
 	"actions.runners.list_runners.edit_button_aria": "Redigera %s",
@@ -547,7 +667,6 @@
 	"actions.runners.runner_setup.configuration_snippet_aria": "Textavsnitt att infoga i körarens konfiguration",
 	"actions.runners.runner_setup.program_options_snippet_aria": "Hur man anropar forgejo-runner",
 	"actions.runners.ephemeral": "Tillfällig",
-	"actions.runners.list_runners.details_button": "Detaljer",
 	"actions.runners.list_runners.delete_button": "Ta bort",
 	"actions.runners.runner_setup.instruction_replace_connection_name": "Ersätt anslutningsnamnet (<code>forgejo</code> i exemplet) med ett värde.",
 	"actions.runners.runner_setup.heading_using_options": "Använder programval",
@@ -583,7 +702,49 @@
 	"actions.secrets.mutation.failure_message": "Hemligheten \"%s\" kunde inte uppdateras.",
 	"actions.secrets.mutation.name_description": "Namnet på en hemlighet får bara innehålla bokstäver, siffror och understreck. Den får inte börja med FORGEJO_, GITEA_, GITHUB_ eller en siffra. Forgejo konverterar den automatiskt till versaler.",
 	"actions.secrets.mutation.value_description": "Det existerande värdet visas inte. Lämna fältet tomt om du inte vill ändra det. Specialtecken behålls. CRLF (radbrytningar i Windows-stil) konverteras automatiskt till LF. Koda värdet med Base64 om radbrytningar ska behållas.",
+	"members.add_member": "Lägg till medlem",
+	"members.user": "Användare",
+	"members.user_already_member": "Den här användaren är redan medlem i organisationen.",
+	"members.no_team_selected": "Organisationsmedlemmar måste tillhöra minst ett lag.",
+	"migrate.select.title": "Migrera kodförråd",
+	"admin.federation.federation": "Federation",
+	"admin.federation.hosts": "servrar",
+	"admin.federation.hosts.title": "Federationsservrar",
+	"admin.federation.hosts.manage_panel": "Hantera federationsservrar",
+	"admin.federation.hosts.details_panel": "Detaljer för federationsserver",
+	"admin.federation.hosts.show_details": "Visa serverdetaljer",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "Schema",
+	"admin.federation.host.port": "Port",
+	"admin.federation.host.software_name": "Programvara",
+	"admin.federation.host.created": "Skapad",
+	"admin.federation.host.updated": "Uppdaterad",
+	"admin.federation.host.latest_activity": "Senaste aktivitet",
+	"admin.federation.users": "Användare",
+	"admin.federation.users.title": "Federerade användare",
+	"admin.federation.users.manage_panel": "Hantera federerade användare",
+	"admin.federation.users.show_local_user": "Visa lokala användaruppgifter",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "Lokalt användar-ID",
+	"admin.federation.user.external_id": "Externt användar-ID",
+	"admin.config.federation": "Federationskonfiguration",
+	"admin.config.federation.enabled": "Aktiverad",
+	"admin.config.federation.share_user_statistics": "Dela användarstatistik med andra värdar",
+	"admin.config.federation.max_size": "Maximal tillåten svarsstorlek",
+	"admin.config.federation.signature_enforced": "Kräv HTTP-signaturer",
+	"admin.config.federation.signature_algorithms": "Signaturalgoritmer",
+	"admin.config.federation.digest_algorithm": "Signatursammanfattning algoritm",
+	"admin.config.federation.get_headers": "Signerade GET-rubriker",
+	"admin.config.federation.post_headers": "Signerade POST-rubriker",
 	"actions.runners.version": "Version",
+	"admin.federation.user.inbox_path": "Inkorgssökväg",
+	"user.activitypub_feed.feed": "Fediversum flöde",
+	"user.activitypub_feed.no_activity": "Ingen fediversum aktivitet",
+	"user.activitypub_feed.is_empty": "Ditt fediversum dlöde är tomt.",
+	"user.activitypub_feed.hint": "Detta flöde visar aktiviteter från fediversum konton som du följer, såväl som federerade inlägg som nämner dig.",
+	"user.activitypub_feed.posted_on": "Postat på %[1]s",
+	"user.activitypub_feed.original_source": "Ursprunglig källa",
 	"actions.workflow.unknown_job_in_needs": "Jobb med ID %[1]s refererar till okända jobb i `needs`: %[2]s.",
 	"actions.workflow.rerun_impossible": "Arbetsflödet kan inte köras om.",
 	"actions.workflow.job_rerun_impossible": "Jobbet kan inte köras om."
diff --git a/options/locale_next/locale_ta.json b/options/locale_next/locale_ta.json
index 70e894aa0b..44dd41629c 100644
--- a/options/locale_next/locale_ta.json
+++ b/options/locale_next/locale_ta.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "வரிசையில் இருந்த அனைத்து பொருட்களும் அகற்றப்பட்டன.",
+	"admin.monitor.queue.settings.remove_all_items": "அனைத்தையும் அகற்று",
+	"admin.monitor.queue.settings.changed": "அமைப்புகள் புதுப்பிக்கப்பட்டன",
+	"admin.monitor.queue.settings.submit": "அமைப்புகளைப் புதுப்பிக்கவும்",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "தொழிலாளர்களின் அதிகபட்ச எண்ணிக்கை ஒரு எண்ணாக இருக்க வேண்டும்",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "தற்போது %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "தொழிலாளர்களின் அதிகபட்ச எண்ணிக்கை",
+	"admin.monitor.queue.settings.description": "பணியாளர்களின் வரிசை தடுப்பிற்கு பதிலளிக்கும் வகையில் குளங்கள் மாறும் வகையில் வளரும்.",
+	"admin.monitor.queue.settings.title": "குளம் அமைப்புகள்",
+	"admin.monitor.queue.review_add": "தொழிலாளர்களை மதிப்பாய்வு செய்யவும் / சேர்க்கவும்",
+	"admin.monitor.queue.numberinqueue": "வரிசையில் உள்ள எண்",
+	"admin.monitor.queue.maxnumberworkers": "தொழிலாளர்களின் அதிகபட்ச எண்ணிக்கை",
+	"admin.monitor.queue.activeworkers": "சுறுசுறுப்பான தொழிலாளர்கள்",
+	"admin.monitor.queue.numberworkers": "தொழிலாளர்களின் எண்ணிக்கை",
+	"admin.monitor.queue.exemplar": "முன்மாதிரி வகை",
+	"admin.monitor.queue.type": "வகை",
+	"admin.monitor.queue.name": "பெயர்",
+	"admin.monitor.queue": "வரிசை: %s",
+	"admin.monitor.queues": "வால்கள்",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA முடக்கப்பட்டுள்ளது",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA இயக்கப்பட்டது",
+	"admin.users.list_status_filter.not_prohibit_login": "உள்நுழைவை அனுமதிக்கவும்",
+	"admin.users.list_status_filter.is_prohibit_login": "நுழைவதைத் தடைசெய்க",
+	"admin.users.list_status_filter.not_restricted": "கட்டுப்படுத்தப்படவில்லை",
+	"admin.users.list_status_filter.is_restricted": "கட்டுப்படுத்தப்பட்டது",
+	"admin.users.list_status_filter.not_admin": "நிர்வாகி அல்ல",
+	"admin.users.list_status_filter.is_admin": "நிர்வாகி",
+	"admin.users.list_status_filter.not_active": "செயலற்றது",
+	"admin.users.list_status_filter.is_active": "செயலில்",
+	"admin.users.list_status_filter.reset": "மீட்டமை",
+	"admin.users.list_status_filter.menu_text": "வடிப்பி",
+	"admin.system_status.gc_times": "GC முறை",
+	"admin.system_status.last_gc_pause": "கடைசி GC இடைநிறுத்தம்",
+	"admin.system_status.total_gc_pause": "மொத்த GC இடைநிறுத்தம்",
+	"admin.system_status.last_gc_time": "கடந்த சிசி முதல் நேரம்",
+	"admin.system_status.next_gc_recycle": "அடுத்த GC மறுசுழற்சி",
+	"admin.system_status.other_system_allocation_obtained": "பிற அமைப்பு ஒதுக்கீடு பெறப்பட்டது",
+	"admin.system_status.gc_metadata_obtained": "GC மேனிலை தரவு பெறப்பட்டது",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "விவரக்குறிப்பு பக்கெட் ஆச் அட்டவணை பெறப்பட்டது",
+	"admin.system_status.mcache_structures_obtained": "MCache கட்டமைப்புகள் பெறப்பட்டன",
+	"admin.system_status.mcache_structures_usage": "MCache கட்டமைப்புகளின் பயன்பாடு",
+	"admin.system_status.mspan_structures_obtained": "MSpan கட்டமைப்புகள் பெறப்பட்டன",
+	"admin.system_status.mspan_structures_usage": "MSpan கட்டமைப்புகளின் பயன்பாடு",
+	"admin.system_status.stack_memory_obtained": "அடுக்கு நினைவகம் பெறப்பட்டது",
+	"admin.system_status.bootstrap_stack_usage": "தொடக்கவார் ச்டாக் பயன்பாடு",
+	"admin.system_status.heap_objects": "குவியல் பொருள்கள்",
+	"admin.system_status.heap_memory_released": "குவியல் நினைவகம் வெளியிடப்பட்டது",
+	"admin.system_status.heap_memory_in_use": "குவியல் நினைவகம் பயன்பாட்டில் உள்ளது",
+	"admin.system_status.heap_memory_idle": "குவியல் நினைவகம் செயலற்றது",
+	"admin.system_status.heap_memory_obtained": "குவியல் நினைவகம் கிடைத்தது",
+	"admin.system_status.current_heap_usage": "தற்போதைய குவியல் பயன்பாடு",
+	"admin.system_status.memory_free_times": "நினைவகம் இலவசம்",
+	"admin.system_status.memory_allocate_times": "நினைவக ஒதுக்கீடு",
+	"admin.system_status.pointer_lookup_times": "சுட்டி தேடுதல் நேரங்கள்",
+	"admin.system_status.memory_obtained": "நினைவகம் கிடைத்தது",
+	"admin.system_status.total_memory_allocated": "மொத்த நினைவகம் ஒதுக்கப்பட்டது",
+	"admin.system_status.current_memory_usage": "தற்போதைய நினைவக பயன்பாடு",
+	"admin.system_status.current_goroutine": "தற்போதைய goroutines",
+	"admin.system_status.server_uptime": "சேவையக இயக்க நேரம்",
+	"markup.filepreview.truncated": "முன்னோட்டம் துண்டிக்கப்பட்டது",
+	"markup.filepreview.lines": "%[3]s இல் %[1]d முதல் %[2]d வரையிலான கோடுகள்",
+	"markup.filepreview.line": "%[2]s இல் வரி %[1]d",
+	"actions.variables.update.success": "மாறி திருத்தப்பட்டது.",
+	"actions.variables.update.failed": "மாறியை திருத்த முடியவில்லை.",
+	"actions.variables.creation.success": "\"%s\" மாறி சேர்க்கப்பட்டது.",
+	"actions.variables.creation.failed": "மாறியைச் சேர்ப்பதில் தோல்வி.",
+	"actions.variables.deletion.success": "மாறி நீக்கப்பட்டது.",
+	"actions.variables.deletion.failed": "மாறியை அகற்ற முடியவில்லை.",
+	"actions.variables.not_found": "மாறியைக் கண்டறிய முடியவில்லை.",
+	"actions.variables.edit": "திருத்து மாறி",
+	"actions.variables.description": "சில செயல்களுக்கு மாறிகள் அனுப்பப்படும், இல்லையெனில் படிக்க முடியாது.",
+	"actions.variables.deletion.description": "மாறியை அகற்றுவது நிரந்தரமானது மற்றும் செயல்தவிர்க்க முடியாது. தொடரவா?",
+	"actions.variables.deletion": "மாறியை அகற்று",
+	"actions.variables.none": "இதுவரை மாறிகள் எதுவும் இல்லை.",
+	"actions.variables.creation": "மாறியைச் சேர்க்கவும்",
+	"actions.variables.management": "மாறிகளை நிர்வகிக்கவும்",
+	"actions.variables": "மாறிகள்",
+	"webauthn.error.timeout": "உங்கள் விசையைப் படிக்கும் முன் காலாவதியானது. இந்தப் பக்கத்தை மீண்டும் ஏற்றி மீண்டும் முயற்சிக்கவும்.",
+	"webauthn.error.empty": "இந்த விசைக்கு நீங்கள் ஒரு பெயரை அமைக்க வேண்டும்.",
+	"webauthn.error.duplicated": "இந்தக் கோரிக்கைக்கு பாதுகாப்பு விசை அனுமதிக்கப்படவில்லை. விசை ஏற்கனவே பதிவு செய்யப்படவில்லை என்பதை உறுதிப்படுத்தவும்.",
+	"webauthn.error.unable_to_process": "சேவையகத்தால் உங்கள் கோரிக்கையைச் செயல்படுத்த முடியவில்லை.",
+	"webauthn.error.insecure": "WebAuthn பாதுகாப்பான இணைப்புகளை மட்டுமே ஆதரிக்கிறது. HTTP மூலம் சோதனை செய்ய, நீங்கள் \"localhost\" அல்லது \"127.0.0.1\" மூலத்தைப் பயன்படுத்தலாம்",
+	"webauthn.error.unknown": "அறியப்படாத பிழை ஏற்பட்டது. மீண்டும் முயற்சிக்கவும்.",
+	"webauthn.unsupported_browser": "உங்கள் உலாவி தற்போது WebAuthn ஐ ஆதரிக்கவில்லை.",
+	"webauthn.error": "உங்கள் பாதுகாப்பு விசையைப் படிக்க முடியவில்லை.",
+	"webauthn.use_twofa": "உங்கள் ஃபோனில் இருந்து இரண்டு காரணி குறியீட்டைப் பயன்படுத்தவும்",
+	"webauthn.press_button": "உங்கள் பாதுகாப்பு விசையில் உள்ள பொத்தானை அழுத்தவும்…",
+	"webauthn.sign_in": "உங்கள் பாதுகாப்பு விசையில் உள்ள பொத்தானை அழுத்தவும். உங்கள் பாதுகாப்பு விசையில் பொத்தான் இல்லை என்றால், அதை மீண்டும் செருகவும்.",
+	"webauthn.insert_key": "உங்கள் பாதுகாப்பு விசையைச் செருகவும்",
+	"counters.n_commits": {
+		"one": "%s உறுதி",
+		"other": "%s உறுதியளிக்கிறது"
+	},
+	"counters.n_branches": {
+		"one": "%s கிளை",
+		"other": "%s கிளைகள்"
+	},
+	"counters.n_tags": {
+		"one": "%s குறிச்சொல்",
+		"other": "%s குறிச்சொற்கள்"
+	},
+	"counters.n_releases": {
+		"one": "%s வெளியீடு",
+		"other": "%s வெளியீடுகள்"
+	},
 	"gpg.default_key": "இயல்புநிலை விசையுடன் கையொப்பமிடப்பட்டது",
 	"gpg.error.extract_sign": "கையொப்பத்தைப் பிரித்தெடுக்க முடியவில்லை",
 	"gpg.error.generate_hash": "உறுதியின் ஆச் உருவாக்க முடியவில்லை",
@@ -257,6 +362,23 @@
 	"migrate.gitbucket.description": "GitBucket நிகழ்வுகளிலிருந்து தரவை நகர்த்தவும்.",
 	"migrate.codebase.description": "codebasehq.com இலிருந்து தரவை நகர்த்தவும்.",
 	"migrate.forgejo.description": "codeberg.org அல்லது பிற Forgejo நிகழ்வுகளில் இருந்து தரவை நகர்த்தவும்.",
+	"migrate.items.label": "இடம்பெயர்வு பொருட்கள்",
+	"migrate.items.wiki": "விக்கி",
+	"migrate.items.milestones": "மைல்கற்கள்",
+	"migrate.items.labels": "சிட்டைகள்",
+	"migrate.items.issues": "சிக்கல்கள்",
+	"migrate.items.pull_requests": "கோரிக்கைகளை இழுக்கவும்",
+	"migrate.items.merge_requests": "கோரிக்கைகளை ஒன்றிணைக்கவும்",
+	"migrate.items.releases": "வெளியிடுகிறது",
+	"migrate.in_progress.git": "Git தரவை நகர்த்துகிறது",
+	"migrate.in_progress.topics": "இடம்பெயர்ந்த தலைப்புகள்",
+	"migrate.in_progress.milestones": "இடம்பெயரும் மைல்கற்கள்",
+	"migrate.in_progress.labels": "இடம்பெயர்தல் லேபிள்கள்",
+	"migrate.in_progress.releases": "இடம்பெயர்ந்த வெளியீடுகள்",
+	"migrate.in_progress.issues": "இடம்பெயர்வு பிரச்சினைகள்",
+	"migrate.in_progress.pulls": "இழுக்கும் கோரிக்கைகளை நகர்த்துகிறது",
+	"migrate.cancel.title": "இடம்பெயர்வை நீக்கறல்",
+	"migrate.cancel.confirmation": "இந்த இடம்பெயர்வை ரத்துசெய்ய விரும்புகிறீர்களா?",
 	"repo.issue_indexer.title": "வெளியீட்டு அட்டவணை",
 	"search.milestone_kind": "மைல்கற்களைத் தேடு…",
 	"repo.settings.push_mirror.branch_filter.label": "கிளை வடிகட்டி (விரும்பினால்)",
diff --git a/options/locale_next/locale_th.json b/options/locale_next/locale_th.json
index a0bad37ae5..71d798c512 100644
--- a/options/locale_next/locale_th.json
+++ b/options/locale_next/locale_th.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "ลบรายการทั้งหมดในคิวแล้ว",
+	"admin.monitor.queue.settings.remove_all_items": "ลบทั้งหมด",
+	"admin.monitor.queue.settings.changed": "อัปเดตการตั้งค่าแล้ว",
+	"admin.monitor.queue.settings.submit": "อัปเดตการตั้งค่า",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "จำนวนผู้ปฏิบัติงานสูงสุดต้องเป็นตัวเลข",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "ปัจจุบัน %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "จำนวนผู้ปฏิบัติงานสูงสุด",
+	"admin.monitor.queue.settings.description": "พูลจะขยายตัวแบบไดนามิกเพื่อตอบสนองต่อการบล็อกคิวของผู้ปฏิบัติงาน",
+	"admin.monitor.queue.settings.title": "การตั้งค่าพูล",
+	"admin.monitor.queue.review_add": "ตรวจสอบ / เพิ่มผู้ปฏิบัติงาน",
+	"admin.monitor.queue.numberinqueue": "จำนวนในคิว",
+	"admin.monitor.queue.maxnumberworkers": "จำนวนผู้ปฏิบัติงานสูงสุด",
+	"admin.monitor.queue.activeworkers": "ผู้ปฏิบัติงานที่ใช้งานอยู่",
+	"admin.monitor.queue.numberworkers": "จำนวนผู้ปฏิบัติงาน",
+	"admin.monitor.queue.exemplar": "ประเภทตัวอย่าง",
+	"admin.monitor.queue.type": "ประเภท",
+	"admin.monitor.queue.name": "ชื่อ",
+	"admin.monitor.queue": "คิว: %s",
+	"admin.monitor.queues": "คิว",
+	"admin.users.list_status_filter.not_2fa_enabled": "ปิดใช้งาน 2FA",
+	"admin.users.list_status_filter.is_2fa_enabled": "เปิดใช้งาน 2FA",
+	"admin.users.list_status_filter.not_prohibit_login": "อนุญาตให้เข้าสู่ระบบ",
+	"admin.users.list_status_filter.is_prohibit_login": "ห้ามเข้าสู่ระบบ",
+	"admin.users.list_status_filter.not_restricted": "ไม่จำกัด",
+	"admin.users.list_status_filter.is_restricted": "จำกัด",
+	"admin.users.list_status_filter.not_admin": "ไม่ใช่ผู้ดูแลระบบ",
+	"admin.users.list_status_filter.is_admin": "ผู้ดูแลระบบ",
+	"admin.users.list_status_filter.not_active": "ไม่ใช้งาน",
+	"admin.users.list_status_filter.is_active": "ใช้งาน",
+	"admin.users.list_status_filter.reset": "รีเซ็ต",
+	"admin.users.list_status_filter.menu_text": "ตัวกรอง",
+	"admin.system_status.gc_times": "เวลา GC",
+	"admin.system_status.last_gc_pause": "การหยุด GC ครั้งล่าสุด",
+	"admin.system_status.total_gc_pause": "การหยุด GC ทั้งหมด",
+	"admin.system_status.last_gc_time": "เวลาตั้งแต่ GC ครั้งล่าสุด",
+	"admin.system_status.next_gc_recycle": "การรีไซเคิล GC ถัดไป",
+	"admin.system_status.other_system_allocation_obtained": "การจัดสรรระบบอื่น ๆ ที่ได้รับ",
+	"admin.system_status.gc_metadata_obtained": "ข้อมูลเมตา GC ที่ได้รับ",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "ตารางแฮชบัคเก็ตการทำโปรไฟล์ที่ได้รับ",
+	"admin.system_status.mcache_structures_obtained": "โครงสร้าง MCache ที่ได้รับ",
+	"admin.system_status.mcache_structures_usage": "การใช้โครงสร้าง MCache",
+	"admin.system_status.mspan_structures_obtained": "โครงสร้าง MSpan ที่ได้รับ",
+	"admin.system_status.mspan_structures_usage": "การใช้โครงสร้าง MSpan",
+	"admin.system_status.stack_memory_obtained": "หน่วยความจำสแต็กที่ได้รับ",
+	"admin.system_status.bootstrap_stack_usage": "การใช้สแต็ก Bootstrap",
+	"admin.system_status.heap_objects": "อ็อบเจกต์ฮีป",
+	"admin.system_status.heap_memory_released": "หน่วยความจำฮีปที่ปล่อยแล้ว",
+	"admin.system_status.heap_memory_in_use": "หน่วยความจำฮีปที่ใช้งานอยู่",
+	"admin.system_status.heap_memory_idle": "หน่วยความจำฮีปที่ไม่ได้ใช้งาน",
+	"admin.system_status.heap_memory_obtained": "หน่วยความจำฮีปที่ได้รับ",
+	"admin.system_status.current_heap_usage": "การใช้ฮีปปัจจุบัน",
+	"admin.system_status.memory_free_times": "การปล่อยหน่วยความจำ",
+	"admin.system_status.memory_allocate_times": "การจัดสรรหน่วยความจำ",
+	"admin.system_status.pointer_lookup_times": "เวลาค้นหาพอยน์เตอร์",
+	"admin.system_status.memory_obtained": "หน่วยความจำที่ได้รับ",
+	"admin.system_status.total_memory_allocated": "หน่วยความจำที่จัดสรรทั้งหมด",
+	"admin.system_status.current_memory_usage": "การใช้หน่วยความจำปัจจุบัน",
+	"admin.system_status.current_goroutine": "Goroutine ปัจจุบัน",
+	"admin.system_status.server_uptime": "เวลาทำงานของเซิร์ฟเวอร์",
+	"markup.filepreview.truncated": "ตัวอย่างถูกตัดทอน",
+	"markup.filepreview.lines": "บรรทัดที่ %[1]d ถึง %[2]d ใน %[3]s",
+	"markup.filepreview.line": "บรรทัดที่ %[1]d ใน %[2]s",
+	"actions.variables.update.success": "แก้ไขตัวแปรแล้ว",
+	"actions.variables.update.failed": "ไม่สามารถแก้ไขตัวแปรได้",
+	"actions.variables.creation.success": "เพิ่มตัวแปร \"%s\" แล้ว",
+	"actions.variables.creation.failed": "ไม่สามารถเพิ่มตัวแปรได้",
+	"actions.variables.deletion.success": "ลบตัวแปรแล้ว",
+	"actions.variables.deletion.failed": "ไม่สามารถลบตัวแปรได้",
+	"actions.variables.not_found": "ไม่พบตัวแปร",
+	"actions.variables.edit": "แก้ไขตัวแปร",
+	"actions.variables.description": "ตัวแปรจะถูกส่งต่อไปยังการดำเนินการบางอย่างและไม่สามารถอ่านได้",
+	"actions.variables.deletion.description": "การลบตัวแปรเป็นการกระทำถาวรและไม่สามารถยกเลิกได้ ดำเนินการต่อหรือไม่?",
+	"actions.variables.deletion": "ลบตัวแปร",
+	"actions.variables.none": "ยังไม่มีตัวแปร",
+	"actions.variables.creation": "เพิ่มตัวแปร",
+	"actions.variables.management": "จัดการตัวแปร",
+	"actions.variables": "ตัวแปร",
+	"webauthn.error.timeout": "หมดเวลาก่อนที่จะอ่านคีย์ของคุณได้ กรุณาโหลดหน้านี้ใหม่แล้วลองอีกครั้ง",
+	"webauthn.error.empty": "คุณต้องตั้งชื่อสำหรับคีย์นี้",
+	"webauthn.error.duplicated": "ไม่อนุญาตให้ใช้คีย์ความปลอดภัยสำหรับคำขอนี้ โปรดตรวจสอบให้แน่ใจว่าคีย์ยังไม่ได้ลงทะเบียน",
+	"webauthn.error.unable_to_process": "เซิร์ฟเวอร์ไม่สามารถประมวลผลคำขอของคุณได้",
+	"webauthn.error.insecure": "WebAuthn รองรับเฉพาะการเชื่อมต่อที่ปลอดภัยเท่านั้น สำหรับการทดสอบผ่าน HTTP คุณสามารถใช้ต้นทาง \"localhost\" หรือ \"127.0.0.1\"",
+	"webauthn.error.unknown": "เกิดข้อผิดพลาดที่ไม่รู้จัก กรุณาลองใหม่อีกครั้ง",
+	"webauthn.unsupported_browser": "เบราว์เซอร์ของคุณไม่รองรับ WebAuthn ในขณะนี้",
+	"webauthn.error": "ไม่สามารถอ่านคีย์ความปลอดภัยของคุณได้",
+	"webauthn.use_twofa": "ใช้รหัสสองปัจจัยจากโทรศัพท์ของคุณ",
+	"webauthn.press_button": "กรุณากดปุ่มบนคีย์ความปลอดภัยของคุณ…",
+	"webauthn.sign_in": "กดปุ่มบนคีย์ความปลอดภัยของคุณ หากคีย์ความปลอดภัยของคุณไม่มีปุ่ม ให้เสียบใหม่อีกครั้ง",
+	"webauthn.insert_key": "โปรดเสียบคีย์ความปลอดภัยของคุณ",
+	"counters.n_commits": {
+		"one": "%s คอมมิต",
+		"other": "%s คอมมิต"
+	},
+	"counters.n_branches": {
+		"one": "%s สาขา",
+		"other": "%s สาขา"
+	},
+	"counters.n_tags": {
+		"one": "%s แท็ก",
+		"other": "%s แท็ก"
+	},
+	"counters.n_releases": {
+		"one": "%s รีลีส",
+		"other": "%s รีลีส"
+	},
 	"gpg.default_key": "ลงนามด้วยคีย์เริ่มต้น",
 	"gpg.error.extract_sign": "ไม่สามารถแยกข้อมูลลายเซ็นได้",
 	"gpg.error.generate_hash": "ไม่สามารถสร้างแฮชของคอมมิตได้",
@@ -224,6 +329,23 @@
 	"migrate.gitbucket.description": "ย้ายข้อมูลจากอินสแตนซ์ GitBucket",
 	"migrate.codebase.description": "ย้ายข้อมูลจาก codebasehq.com",
 	"migrate.forgejo.description": "ย้ายข้อมูลจาก codeberg.org หรืออินสแตนซ์ Forgejo อื่นๆ",
+	"migrate.items.label": "รายการการย้าย",
+	"migrate.items.wiki": "วิกิ",
+	"migrate.items.milestones": "เหตุการณ์สำคัญ",
+	"migrate.items.labels": "ป้ายกำกับ",
+	"migrate.items.issues": "ปัญหา",
+	"migrate.items.pull_requests": "คำขอดึง",
+	"migrate.items.merge_requests": "คำขอผสาน",
+	"migrate.items.releases": "รีลีส",
+	"migrate.in_progress.git": "กำลังย้ายข้อมูล Git",
+	"migrate.in_progress.topics": "กำลังย้ายหัวข้อ",
+	"migrate.in_progress.milestones": "กำลังย้ายเหตุการณ์สำคัญ",
+	"migrate.in_progress.labels": "กำลังย้ายป้ายกำกับ",
+	"migrate.in_progress.releases": "กำลังย้ายรีลีส",
+	"migrate.in_progress.issues": "กำลังย้ายปัญหา",
+	"migrate.in_progress.pulls": "กำลังย้ายคำขอดึง",
+	"migrate.cancel.title": "ยกเลิกการย้าย",
+	"migrate.cancel.confirmation": "คุณต้องการยกเลิกการย้ายนี้หรือไม่?",
 	"repo.issue_indexer.title": "ตัวจัดทำดัชนี Issue",
 	"search.milestone_kind": "ค้นหาเหตุการณ์สำคัญ…",
 	"repo.settings.push_mirror.branch_filter.label": "ตัวกรองสาขา (ไม่บังคับ)",
diff --git a/options/locale_next/locale_tr-TR.json b/options/locale_next/locale_tr-TR.json
index 9b5944e01e..5528274be5 100644
--- a/options/locale_next/locale_tr-TR.json
+++ b/options/locale_next/locale_tr-TR.json
@@ -1,4 +1,105 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Kuyruktaki tüm öğeler kaldırıldı.",
+	"admin.monitor.queue.settings.remove_all_items": "Tümünü kaldır",
+	"admin.monitor.queue.settings.changed": "Ayarlar güncellendi",
+	"admin.monitor.queue.settings.submit": "Ayarları Güncelle",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "En fazla çalışan sayısı bir sayı olmalıdır",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Şu anda %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "En fazla çalışan Sayısı",
+	"admin.monitor.queue.settings.description": "Havuzlar, çalışan kuyruğu tıkanmasına bir yanıt olarak dinamik olarak büyürler.",
+	"admin.monitor.queue.settings.title": "Havuz Ayarları",
+	"admin.monitor.queue.review_add": "Çalışanları İncele / Ekle",
+	"admin.monitor.queue.numberinqueue": "Kuyruktaki Sayı",
+	"admin.monitor.queue.maxnumberworkers": "En Fazla Çalışan Sayısı",
+	"admin.monitor.queue.activeworkers": "Etkin Çalışanlar",
+	"admin.monitor.queue.numberworkers": "Çalışan Sayısı",
+	"admin.monitor.queue.exemplar": "Örnek Türü",
+	"admin.monitor.queue.type": "Tür",
+	"admin.monitor.queue.name": "İsim",
+	"admin.monitor.queue": "Kuyruk: %s",
+	"admin.monitor.queues": "Kuyruklar",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA Devre Dışı",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA Etkin",
+	"admin.users.list_status_filter.not_prohibit_login": "Oturum Açmaya İzin Ver",
+	"admin.users.list_status_filter.is_prohibit_login": "Oturum Açmayı Önle",
+	"admin.users.list_status_filter.not_restricted": "Kısıtlanmamış",
+	"admin.users.list_status_filter.is_restricted": "Kısıtlanmış",
+	"admin.users.list_status_filter.not_admin": "Yönetici Değil",
+	"admin.users.list_status_filter.is_admin": "Yönetici",
+	"admin.users.list_status_filter.not_active": "Etkin değil",
+	"admin.users.list_status_filter.is_active": "Etkin",
+	"admin.users.list_status_filter.reset": "Sıfırla",
+	"admin.users.list_status_filter.menu_text": "Filtre",
+	"admin.system_status.gc_times": "GC Zamanları",
+	"admin.system_status.last_gc_pause": "Son GC Durması",
+	"admin.system_status.total_gc_pause": "Toplam GC Durması",
+	"admin.system_status.last_gc_time": "Son GC Zamanından Beri",
+	"admin.system_status.next_gc_recycle": "Sonraki GC Döngüsü",
+	"admin.system_status.other_system_allocation_obtained": "Elde Edilen Diğer Sistem Ayırmaları",
+	"admin.system_status.gc_metadata_obtained": "Elde Edilen GC Metadata",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Elde Edilen Bucket Hash Tablosu Profilleme",
+	"admin.system_status.mcache_structures_obtained": "Elde Edilen MCache Yapıları",
+	"admin.system_status.mcache_structures_usage": "Kullanılan MCache Yapıları",
+	"admin.system_status.mspan_structures_obtained": "Elde Edilen MSpan Yapıları",
+	"admin.system_status.mspan_structures_usage": "Kullanımdaki MSpan Yapıları",
+	"admin.system_status.stack_memory_obtained": "Elde Edilen Yığın Belleği",
+	"admin.system_status.bootstrap_stack_usage": "İlk Yığın Kullanımı",
+	"admin.system_status.heap_objects": "Yığın Nesneleri",
+	"admin.system_status.heap_memory_released": "Serbest Bırakılmış Yığın Belleği",
+	"admin.system_status.heap_memory_in_use": "Kullanımdaki Yığın Belleği",
+	"admin.system_status.heap_memory_idle": "Boştaki Yığın Belleği",
+	"admin.system_status.heap_memory_obtained": "Elde Edilen Yığın Belleği",
+	"admin.system_status.current_heap_usage": "Güncel Yığın Kullanımı",
+	"admin.system_status.memory_free_times": "Bellek Boşaltmaları",
+	"admin.system_status.memory_allocate_times": "Bellek Ayırmaları",
+	"admin.system_status.pointer_lookup_times": "İşaret Arama Zamanları",
+	"admin.system_status.memory_obtained": "Elde Edilen Bellek",
+	"admin.system_status.total_memory_allocated": "Bellekte Ayrılan Toplam Yer",
+	"admin.system_status.current_memory_usage": "Güncel Bellek Kullanımı",
+	"admin.system_status.current_goroutine": "Güncel Goroutine'ler",
+	"admin.system_status.server_uptime": "Sunucunun Ayakta Kalma Süresi",
+	"actions.variables.update.success": "Değişken düzenlendi.",
+	"actions.variables.update.failed": "Değişken düzenlenemedi.",
+	"actions.variables.creation.success": "`\"%s\" değişkeni eklendi.`",
+	"actions.variables.creation.failed": "Değişken eklenemedi.",
+	"actions.variables.deletion.success": "Değişken kaldırıldı.",
+	"actions.variables.deletion.failed": "Değişken kaldırılamadı.",
+	"actions.variables.edit": "Değişkeni Düzenle",
+	"actions.variables.description": "Değişkenler belirli işlemlere aktarılacaktır, bunun dışında okunamaz.",
+	"actions.variables.deletion.description": "Bir değişkeni kaldırma kalıcıdır ve geri alınamaz. Devam edilsin mi?",
+	"actions.variables.deletion": "Değişkeni kaldır",
+	"actions.variables.none": "Henüz hiçbir değişken yok.",
+	"actions.variables.creation": "Değişken ekle",
+	"actions.variables.management": "Değişken Yönetimi",
+	"actions.variables": "Değişkenler",
+	"webauthn.error.timeout": "Anahtarınız okunamadan zaman aşımı oldu. Lütfen sayfayı yenileyin ve tekrar deneyin.",
+	"webauthn.error.empty": "Bu anahtar için bir isim belirlemelisiniz.",
+	"webauthn.error.duplicated": "Güvenlik anahtarının bu istek için izni yok. Anahtarın halihazırda kayıtlı olmadığından emin olun.",
+	"webauthn.error.unable_to_process": "Sunucu isteğinizi işleyemedi.",
+	"webauthn.error.insecure": "WebAuthn sadece güvenli bağlantıyı destekler. HTTP üzerinden test etmek için \"localhost\" veya \"127.0.0.1\" adreslerini kullanabilirsiniz.",
+	"webauthn.error.unknown": "Bilinmeyen bir hata oluştu. Lütfen tekrar deneyin.",
+	"webauthn.unsupported_browser": "Tarayıcınız henüz WebAuthn desteklemiyor.",
+	"webauthn.error": "Güvenlik anahtarınız okunamıyor.",
+	"webauthn.use_twofa": "Telefonunuzdan iki aşamalı doğrulama kodu kullanın",
+	"webauthn.press_button": "Lütfen güvenlik anahtarınızdaki düğmeye basın…",
+	"webauthn.sign_in": "Güvenlik anahtarınızdaki düğmeye basın. Eğer düğme yoksa güvenlik anahtarınızı tekrar ekleyin.",
+	"webauthn.insert_key": "Güvenlik anahtarınızı ekleyin",
+	"counters.n_commits": {
+		"one": "%s değişiklik(commit)",
+		"other": "%s değişiklikler(commits)"
+	},
+	"counters.n_branches": {
+		"one": "%s dal",
+		"other": "%s dallar"
+	},
+	"counters.n_tags": {
+		"one": "%s etiket",
+		"other": "%s etiketler"
+	},
+	"counters.n_releases": {
+		"one": "%s yayın",
+		"other": "%s yayınlar"
+	},
 	"gpg.default_key": "Varsayılan anahtarla imzalandı",
 	"gpg.error.extract_sign": "İmza çıkartılamadı",
 	"gpg.error.generate_hash": "Değişikliğin(commit) karma değeri(sağlama değeri veya hash) oluşturulamadı",
@@ -186,6 +287,23 @@
 	"migrate.onedev.description": "code.onedev.io veya diğer OneDev oluşumlarından veri aktar.",
 	"migrate.gitbucket.description": "GitBucket oluşumlarından veri aktar.",
 	"migrate.codebase.description": "codebasehq.com'dan veri aktar.",
+	"migrate.items.label": "Taşıma öğeleri",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "Kilometre Taşları",
+	"migrate.items.labels": "Etiketler",
+	"migrate.items.issues": "Konular",
+	"migrate.items.pull_requests": "Birleştirme istekleri",
+	"migrate.items.merge_requests": "Birleştirme istekleri",
+	"migrate.items.releases": "Sürümler",
+	"migrate.in_progress.git": "Git Verilerini Taşıma",
+	"migrate.in_progress.topics": "Konuları taşıma",
+	"migrate.in_progress.milestones": "Kilometre Taşlarını Taşıma",
+	"migrate.in_progress.labels": "Etiketleri Taşıma",
+	"migrate.in_progress.releases": "Sürümleri Taşıma",
+	"migrate.in_progress.issues": "Konuları Taşıma",
+	"migrate.in_progress.pulls": "Değişiklik İsteklerini Taşıma",
+	"migrate.cancel.title": "Göçü iptal et",
+	"migrate.cancel.confirmation": "Bu göçü iptal etmek istiyor musunuz?",
 	"pulse.n_active_issues": {
 		"one": "%s aktif sorun",
 		"other": "%s aktif sorunlar"
@@ -396,7 +514,6 @@
 	"repo.issues.filter_mention.hint": "Bahsedilen kullanıcıya göre filtrele",
 	"repo.issues.filter_modified.hint": "Son değiştirilme tarihine göre filtrele",
 	"repo.issues.filter_sort.hint_with_placeholder": "Sıralama: %s",
-	"issues.updated": "güncellenenler %s",
 	"issues.filters.labels.exclude": "Etiketi hariç tut",
 	"issues.filters.labels.unexclude": "Kesin olarak hariç tut",
 	"repo.pulls.auto_merge.no_permission": "Bu çekme isteğinin otomatik birleştirilmesini iptal etme izniniz yok.",
@@ -414,12 +531,44 @@
 	"repo.pulls.poster_trust_revoke": "Geri al",
 	"repo.pulls.poster_trust_revoke.tooltip": "Bu çekme isteğinin yazarı, artık `pull_request` olayıyla tetiklenen iş akışlarını çalıştırma konusunda güvenilir kabul edilmeyecek; her çalıştırma işlemi manuel olarak onaylanmalıdır.",
 	"repo.view.gitmodules_too_large": ".gitmodules dosyası çok büyük ve (örneğin API çağrılarında) göz ardı edilecektir",
+	"migrate.select.title": "Depoyu taşı",
 	"search.syntax": "Arama sözdizimi",
 	"search.fuzzy": "Bulanık(belirsiz)",
 	"search.fuzzy_tooltip": "\"Sonuçları dahil et\" seçeneği, arama terimiyle yaklaşık eşleşmeleri gösterir",
 	"install.ssh_authorized_keys_inspection_error": "Mevcut authorized_keys dosyası incelenemedi: %v",
 	"install.ssh_authorized_keys_unexpected_key": "Forgejo için SSH'yi etkinleştirmek, mevcut SSH anahtarlarını içeren %s konumundaki dosyayla çakışıyor. Öneriler: Forgejo için ayrı bir sistem kullanıcısı oluşturun veya SSH'yi devre dışı bırakın.",
 	"keys.verify.token.hint": "Bu jeton(token) sadece 1 dakika geçerlidir. <a href=\"%[1]s\">Süresi dolduysa yenisini alın</a>.",
+	"admin.federation.federation": "Federasyon(Birlik)",
+	"admin.federation.hosts": "Ev sahipleri",
+	"admin.federation.hosts.title": "Federasyon Barındırıcıları(host)",
+	"admin.federation.hosts.manage_panel": "Federasyon Barındırıcılarını(host) Yönet",
+	"admin.federation.hosts.details_panel": "Federasyon barındırıcı (host) bilgileri",
+	"admin.federation.hosts.show_details": "Barındırıcının(host) ayrıntılarını göster",
+	"admin.federation.host.id": "Kimliği(ID)",
+	"admin.federation.host.fqdn": "Tam Etki Alanı Adı(FQDN)",
+	"admin.federation.host.schema": "Şema",
+	"admin.federation.host.port": "Bağlantı Noktası(Port)",
+	"admin.federation.host.software_name": "Yazılım",
+	"admin.federation.host.created": "Yaratıldı",
+	"admin.federation.host.updated": "Güncellendi",
+	"admin.federation.host.latest_activity": "Son etkinlikler(akvititeler)",
+	"admin.federation.users": "Kullanıcılar",
+	"admin.federation.users.title": "Birleşik(Federe) kullanıcılar",
+	"admin.federation.users.manage_panel": "Birleşik(Federe) Kullanıcıları Yönet",
+	"admin.federation.users.show_local_user": "Yerel(lokal) kullanıcının detaylarını göster",
+	"admin.federation.user.id": "Kullanıcı Kimliği(ID)",
+	"admin.federation.user.user_id": "Yerel(lokal) Kullanıcı Kimliği(ID)",
+	"admin.federation.user.external_id": "Harici Kullanıcı Kimliği(ID)",
+	"admin.federation.user.inbox_path": "Gelen kutusu yolu",
+	"admin.config.federation": "Birlik(Federasyon) yapılandırması",
+	"admin.config.federation.enabled": "Etkin(Aktif)",
+	"admin.config.federation.share_user_statistics": "Kullanıcı istatistiklerini diğer barındırıcılarla(host) paylaş",
+	"admin.config.federation.max_size": "İzin verilen maksimum yanıt boyutu",
+	"admin.config.federation.signature_enforced": "HTTP imzalarını zorunlu kıl",
+	"admin.config.federation.signature_algorithms": "İmza algoritmaları",
+	"admin.config.federation.digest_algorithm": "İmza özet algoritması",
+	"admin.config.federation.get_headers": "İmzalı GET başlıkları",
+	"admin.config.federation.post_headers": "İmzalı POST başlıkları",
 	"moderation.report.mark_as_handled": "\"Çözüldü\" olarak işaretle",
 	"moderation.report.mark_as_ignored": "\"Yoksay\" olarak işaretle",
 	"moderation.action.account.delete": "Hesabı sil",
@@ -441,6 +590,10 @@
 	"settings.specific_repo_access": "Depoya erişim",
 	"settings.new_access_token": "Yeni erişim jetonu(token)",
 	"settings.permissions_access_specific_repositories": "Belirli depolar",
+	"settings.access_token.selected_repositories": {
+		"one": "Seçilen depo (%d)",
+		"other": "Seçilen depolar (%d)"
+	},
 	"settings.access_token.available_repositories": "Kullanılabilir depolar",
 	"settings.access_token.no_repositories_selected": "Hiçbir depo seçilmedi.",
 	"settings.access_token.no_repositories_found": "Herhangi bir depo bulunamadı.",
@@ -449,6 +602,12 @@
 	"settings.access_token.resource_public_only_help": "Herkese açık depolara ve kuruluşlara(organizasyonlara) erişimi sınırlayın.",
 	"settings.access_token.resource_specific_repo_help": "Belirli bir depo listesine erişimi sınırlayın. Tüm genel depolara salt okunur erişim izni verilir. Yalnızca depolara ve sorunlara erişim izni veren izinler etkinleştirilebilir.",
 	"settings.access_token.admin_disabled": "Yönetici izinleri devre dışı bırakılmıştır.",
+	"user.activitypub_feed.feed": "Fediverse(Birlik-Evreni) Akışı",
+	"user.activitypub_feed.no_activity": "Fediverse(Birlik-Evreni) etkinliği(aktivitesi) yok",
+	"user.activitypub_feed.is_empty": "Senin Fediverse(Birlik-Evreni) akışın boş.",
+	"user.activitypub_feed.hint": "Bu akış, takip ettiğiniz Fediverse(Birlik-Evreni) hesaplarının etkinliklerini ve adınızın geçtiği federasyon gönderilerini gösterir.",
+	"user.activitypub_feed.posted_on": "%[1] ’de yayınlandı",
+	"user.activitypub_feed.original_source": "Köken(Orijinal) kaynak",
 	"packages.search_in_external_registry": "%s içinde ara",
 	"packages.common.install": "Paketi yüklemek için aşağıdaki komutu çalıştırın:",
 	"packages.common.registry": "Bu kayıt defterini komut satırından kurun:",
@@ -477,6 +636,10 @@
 	"access_token.error.specified_repos_none": "Belirtilen depolara sahip erişim jetonları’nda(token) en az bir depo bulunmalıdır.",
 	"access_token.error.specified_repos_and_public_only": "Belirtilen depolara sahip erişim jetonları(token’lar), sadece-herkese-açık kapsamıyla birleştirilemez.",
 	"access_token.error.specified_repos_and_invalid_scope": "Belirtilen depolara sahip erişim jetonları yalnızca read:issue, write:issue, read:repository ve write:repository kapsamlarıyla kullanılabilir.",
+	"actions.status.diagnostics.waiting": {
+		"one": "Aşağıdaki etikete sahip bir koşucu bekleniyor: %s",
+		"other": "Aşağıdaki etiketlere sahip bir koşucu bekleniyor: %s"
+	},
 	"actions.runners.uuid": "Evrensel Benzersiz Kimlik Tanımlayıcı(UUID)",
 	"actions.runners.token": "Jeton(Token)",
 	"actions.runners.ephemeral": "Geçici",
@@ -495,6 +658,7 @@
 	"actions.runners.task_list_user": "Bu kullanıcının bu çalıştırıcıdaki son görevleri",
 	"actions.runners.edit_runner_button": "Koşucuyu(runner) düzenle",
 	"actions.runners.create_runner.page_title": "Yeni koşucu(runner) oluştur",
+	"issues.updated": "güncellenenler %s",
 	"actions.runners.create_runner.title": "Yeni çalıştırıcı oluştur",
 	"actions.runners.create_runner.properties_fieldset": "Özellikler",
 	"actions.runners.create_runner.name_label": "Adı",
@@ -557,6 +721,10 @@
 	"actions.secrets.mutation.failure_message": "\"%s\" gizli bilgisi güncellenemedi.",
 	"actions.secrets.mutation.name_description": "Bir gizli bilginin adı yalnızca harfler, rakamlar ve alt çizgilerden oluşabilir. Ad, FORGEJO_, GITEA_, GITHUB_ veya bir rakamla başlayamaz. Forgejo, adı otomatik olarak büyük harfe dönüştürür.",
 	"actions.secrets.mutation.value_description": "Mevcut değer gösterilmeyecektir. Değiştirmek istemiyorsanız alanı boş bırakın. Özel karakterler korunur. CRLF (Windows tarzı satır sonları) otomatik olarak LF'ye dönüştürülür. Satır sonlarının korunması gerekiyorsa değeri Base64 ile kodlayın.",
+	"members.add_member": "Üye ekle",
+	"members.user": "Kullanıcı",
+	"members.user_already_member": "Bu kullanıcı zaten kuruluşun(organizasyonun) bir üyesidir.",
+	"members.no_team_selected": "Kuruluş(organizasyon) üyeleri en az bir takıma üye olmalıdır.",
 	"pulls.manual_merge.helper": "Elle(manuel) birleştirme yardımcısı",
 	"pulls.manual_merge.helpder.description": "Birleştirme işlemini kendiniz elle(manuel olarak) tamamlarken bu birleştirmenin değişiklik(commit) mesajını kullanın.",
 	"pulls.manual_merge.commit.title": "Birleştirme değişikliğinin(commit'in) başlığı",
diff --git a/options/locale_next/locale_uk-UA.json b/options/locale_next/locale_uk-UA.json
index 319ac965dc..9913d47281 100644
--- a/options/locale_next/locale_uk-UA.json
+++ b/options/locale_next/locale_uk-UA.json
@@ -1,4 +1,113 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "Усі елементи в черзі видалено.",
+	"admin.monitor.queue.settings.remove_all_items": "Видалити всі",
+	"admin.monitor.queue.settings.changed": "Налаштування оновлено",
+	"admin.monitor.queue.settings.submit": "Оновити налаштування",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "Максимальна кількість обробників має бути числом",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "Поточний %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "Максимальна кількість обробників",
+	"admin.monitor.queue.settings.description": "Пули динамічно зростають у відповідь на блокування черг їхніх обробників.",
+	"admin.monitor.queue.settings.title": "Налаштування пулу",
+	"admin.monitor.queue.review_add": "Переглянути / додати обробники",
+	"admin.monitor.queue.numberinqueue": "Номер у черзі",
+	"admin.monitor.queue.maxnumberworkers": "Максимальна кількість обробників",
+	"admin.monitor.queue.activeworkers": "Активні обробники",
+	"admin.monitor.queue.numberworkers": "Кількість обробників",
+	"admin.monitor.queue.exemplar": "Приклад типу",
+	"admin.monitor.queue.type": "Тип",
+	"admin.monitor.queue.name": "Назва",
+	"admin.monitor.queue": "Черга: %s",
+	"admin.monitor.queues": "Черги",
+	"admin.users.list_status_filter.not_2fa_enabled": "2FA вимкнено",
+	"admin.users.list_status_filter.is_2fa_enabled": "2FA увімкнено",
+	"admin.users.list_status_filter.not_prohibit_login": "Вхід дозволено",
+	"admin.users.list_status_filter.is_prohibit_login": "Вхід заборонено",
+	"admin.users.list_status_filter.not_restricted": "Без обмежень",
+	"admin.users.list_status_filter.is_restricted": "З обмеженнями",
+	"admin.users.list_status_filter.not_admin": "Не адміністратор",
+	"admin.users.list_status_filter.is_admin": "Адміністратор",
+	"admin.users.list_status_filter.not_active": "Неактивні",
+	"admin.users.list_status_filter.is_active": "Активні",
+	"admin.users.list_status_filter.reset": "Скинути",
+	"admin.users.list_status_filter.menu_text": "Фільтр",
+	"admin.system_status.gc_times": "Кількість запусків збирача сміття",
+	"admin.system_status.last_gc_pause": "Остання пауза збирача сміття",
+	"admin.system_status.total_gc_pause": "Загальна пауза збирача сміття",
+	"admin.system_status.last_gc_time": "З останнього запуску збирача сміття",
+	"admin.system_status.next_gc_recycle": "Наступний цикл збирача сміття",
+	"admin.system_status.other_system_allocation_obtained": "Отримано інших виділень пам’яті",
+	"admin.system_status.gc_metadata_obtained": "Отримано метаданих збирача сміття",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "Отримано хеш-таблиць профілювання",
+	"admin.system_status.mcache_structures_obtained": "Отримано структур MCache",
+	"admin.system_status.mcache_structures_usage": "Використання структур MCache",
+	"admin.system_status.mspan_structures_obtained": "Отримано структур MSpan",
+	"admin.system_status.mspan_structures_usage": "Використання структур MSpan",
+	"admin.system_status.stack_memory_obtained": "Отримано пам’яті стеком",
+	"admin.system_status.bootstrap_stack_usage": "Використання стеку bootstrap",
+	"admin.system_status.heap_objects": "Об’єктів динамічної пам’яті",
+	"admin.system_status.heap_memory_released": "Звільнено динамічної пам’яті",
+	"admin.system_status.heap_memory_in_use": "Динамічної пам’яті використовується",
+	"admin.system_status.heap_memory_idle": "Динамічної пам’яті простоює",
+	"admin.system_status.heap_memory_obtained": "Отримано динамічної пам’яті",
+	"admin.system_status.current_heap_usage": "Поточне використання динамічної пам’яті",
+	"admin.system_status.memory_free_times": "Звільнень пам’яті",
+	"admin.system_status.memory_allocate_times": "Виділень пам’яті",
+	"admin.system_status.pointer_lookup_times": "Пошуків вказівника",
+	"admin.system_status.memory_obtained": "Отримано пам’яті",
+	"admin.system_status.total_memory_allocated": "Виділено пам’яті загалом",
+	"admin.system_status.current_memory_usage": "Поточне використання пам’яті",
+	"admin.system_status.current_goroutine": "Поточна кількість goroutines",
+	"admin.system_status.server_uptime": "Час роботи сервера",
+	"markup.filepreview.truncated": "Перегляд було урізано",
+	"markup.filepreview.lines": "Рядки з %[1]d по %[2]d в %[3]s",
+	"markup.filepreview.line": "Рядок %[1]d в %[2]s",
+	"actions.variables.update.success": "Змінну змінено.",
+	"actions.variables.update.failed": "Не вдалося змінити змінну.",
+	"actions.variables.creation.success": "Змінну «%s» додано.",
+	"actions.variables.creation.failed": "Не вдалося додати змінну.",
+	"actions.variables.deletion.success": "Змінну видалено.",
+	"actions.variables.deletion.failed": "Не вдалося видалити змінну.",
+	"actions.variables.not_found": "Не вдалося знайти змінну.",
+	"actions.variables.edit": "Редагувати змінну",
+	"actions.variables.description": "Змінні передаються певним діям і не можуть бути прочитані інакше.",
+	"actions.variables.deletion.description": "Видалення змінної є остаточним і його неможливо скасувати. Продовжити?",
+	"actions.variables.deletion": "Видалити змінну",
+	"actions.variables.none": "Змінних ще немає.",
+	"actions.variables.creation": "Додати змінну",
+	"actions.variables.management": "Керування змінними",
+	"actions.variables": "Змінні",
+	"webauthn.error.timeout": "Ключ не встиг зчитатись протягом відведеного терміну. Будь ласка, перезавантажте сторінку й повторіть спробу.",
+	"webauthn.error.empty": "Ключ слід якось назвати.",
+	"webauthn.error.duplicated": "Запит із наданим ключем безпеки відхилено. Впевніться, що цей ключ не є вже зареєстрованим.",
+	"webauthn.error.unable_to_process": "Сервер не зміг обробити запит.",
+	"webauthn.error.insecure": "WebAuthn підтримує лише захищені з’єднання. Для тестування через HTTP можете використати origin-рядок «localhost» чи «127.0.0.1»",
+	"webauthn.error.unknown": "Сталася невідома помилка. Будь ласка, повторіть спробу.",
+	"webauthn.unsupported_browser": "Ваш браузер наразі не підтримує WebAuthn.",
+	"webauthn.error": "Не вдалося розпізнати ключ безпеки.",
+	"webauthn.use_twofa": "Введіть код підтвердження з телефону",
+	"webauthn.press_button": "Натисніть кнопку на ключі безпеки…",
+	"webauthn.sign_in": "Натисніть кнопку на ключі безпеки. Якщо ключ безпеки не має кнопки, від’єднайте його і під’єднайте ще раз.",
+	"webauthn.insert_key": "Під’єднайте ключ безпеки",
+	"counters.n_commits": {
+		"one": "%s коміт",
+		"few": "%s коміти",
+		"many": "%s комітів"
+	},
+	"counters.n_branches": {
+		"one": "%s гілка",
+		"few": "%s гілки",
+		"many": "%s гілок"
+	},
+	"counters.n_tags": {
+		"one": "%s тег",
+		"few": "%s теги",
+		"many": "%s тегів"
+	},
+	"counters.n_releases": {
+		"one": "%s випуск",
+		"few": "%s випуски",
+		"many": "%s випусків"
+	},
 	"gpg.default_key": "Підписано типовим ключем",
 	"gpg.error.extract_sign": "Не вдалося витягти підпис",
 	"gpg.error.generate_hash": "Не вдалося згенерувати хеш коміту",
@@ -334,6 +443,23 @@
 	"migrate.gitbucket.description": "Перенести дані з екземплярів GitBucket.",
 	"migrate.codebase.description": "Перенести дані з codebasehq.com.",
 	"migrate.forgejo.description": "Перенести дані з codeberg.org або інших екземплярів Forgejo.",
+	"migrate.items.label": "Елементи для перенесення",
+	"migrate.items.wiki": "Вікі",
+	"migrate.items.milestones": "Етапи",
+	"migrate.items.labels": "Мітки",
+	"migrate.items.issues": "Задачі",
+	"migrate.items.pull_requests": "Запити на злиття",
+	"migrate.items.merge_requests": "Запити на об’єднання",
+	"migrate.items.releases": "Випуски",
+	"migrate.in_progress.git": "Перенесення даних Git",
+	"migrate.in_progress.topics": "Перенесення тем",
+	"migrate.in_progress.milestones": "Перенесення етапів",
+	"migrate.in_progress.labels": "Перенесення міток",
+	"migrate.in_progress.releases": "Перенесення випусків",
+	"migrate.in_progress.issues": "Перенесення задач",
+	"migrate.in_progress.pulls": "Перенесення запитів на злиття",
+	"migrate.cancel.title": "Скасувати перенесення",
+	"migrate.cancel.confirmation": "Бажаєте скасувати перенесення?",
 	"settings.must_enable_2fa": "На цьому екземплярі Forgejo для доступу до облікового запису вам необхідно захистити його двофакторною автентифікацією.",
 	"error.must_enable_2fa": "На цьому екземплярі Forgejo для доступу до облікового запису вам необхідно захистити його двофакторною автентифікацією. Увімкніть її тут: %s",
 	"admin.config.global_2fa_requirement.none": "Немає",
@@ -526,8 +652,6 @@
 	"actions.runners.create_runner.description_label": "Опис",
 	"actions.runners.edit_runner.description_label": "Опис",
 	"actions.runners.runner_details.page_title": "Ранер %s",
-	"actions.runners.list_runners.details_column": "Подробиці",
-	"actions.runners.list_runners.details_button": "Подробиці",
 	"actions.runners.list_runners.edit_column": "Редагувати",
 	"actions.runners.list_runners.edit_button": "Редагувати",
 	"actions.runners.list_runners.edit_button_aria": "Редагувати %s",
@@ -555,7 +679,6 @@
 	"actions.runners.runner_setup.list_of_runners_link": "Список ранерів",
 	"actions.runners.runner_setup.button_copy_uuid_aria": "Копіювати UUID ранера",
 	"actions.runners.runner_setup.button_copy_token_aria": "Копіювати токен ранера",
-	"actions.runners.list_runners.details_button_aria": "Показати дані про %s",
 	"actions.runners.runner_setup.title": "Налаштувати ранер %s",
 	"actions.runners.runner_setup.page_title": "Налаштувати ранер %s",
 	"actions.runners.edit_runner.regenerate_token_help": "Існуючий токен негайно втратить чинність. Ви отримаєте новий токен на наступній сторінці.",
@@ -599,8 +722,54 @@
 	"settings.access_token.resource_public_only_help": "Дозволити доступ лише до публічних репозиторіїв та організацій.",
 	"settings.access_token.resource_specific_repo_help": "Дозволити доступ лише до окремих репозиторіїв. Доступ тільки для читання дозволено до всіх публічних репозиторіїв. Можна ввімкнути лише дозволи, що надають доступ до репозиторіїв і задач.",
 	"settings.permissions_access_specific_repositories": "Визначені репозиторії",
+	"members.add_member": "Додати учасника",
+	"members.user": "Користувач",
+	"members.user_already_member": "Цей користувач уже є учасником організації.",
+	"members.no_team_selected": "Учасники організації повинні входити принаймні до однієї команди.",
+	"migrate.select.title": "Перенести репозиторій",
 	"actions.runners.version": "Версія",
-	"actions.workflow.unknown_job_in_needs": "Завдання з ID %[1]s посилається на невідомі завдання в `needs`: %[2]s.",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.created": "Створено",
+	"admin.federation.host.updated": "Оновлено",
+	"admin.federation.federation": "Федерація",
+	"admin.federation.host.port": "Порт",
+	"admin.federation.host.software_name": "Програмне забезпечення",
+	"admin.config.federation.enabled": "Увімкнено",
+	"admin.federation.host.id": "ID",
+	"admin.federation.user.id": "ID",
+	"admin.federation.hosts": "Хости",
+	"admin.federation.hosts.title": "Хости федерації",
+	"admin.federation.host.schema": "Схема",
+	"admin.federation.users": "Користувачі",
+	"admin.config.federation": "Налаштування федерації",
+	"admin.config.federation.post_headers": "Підписані заголовки POST",
+	"admin.config.federation.get_headers": "Підписані заголовки GET",
+	"admin.config.federation.signature_algorithms": "Алгоритми підпису",
+	"admin.config.federation.signature_enforced": "Вимагати підписів HTTP",
 	"actions.workflow.rerun_impossible": "Робочий потік неможливо перезапустити.",
-	"actions.workflow.job_rerun_impossible": "Завдання неможливо перезапустити."
+	"actions.workflow.job_rerun_impossible": "Завдання неможливо перезапустити.",
+	"actions.workflow.unknown_job_in_needs": "Завдання з ID %[1]s посилається на невідомі завдання в `needs`: %[2]s.",
+	"admin.config.federation.digest_algorithm": "Алгоритм хешування для підписів",
+	"admin.config.federation.max_size": "Максимальний розмір відповіді",
+	"admin.config.federation.share_user_statistics": "Ділитися статистикою користувачів з іншими хостами",
+	"admin.federation.user.inbox_path": "Шлях до вхідних",
+	"admin.federation.hosts.manage_panel": "Керування хостами федерації",
+	"admin.federation.hosts.details_panel": "Інформація про хост федерації",
+	"admin.federation.hosts.show_details": "Показати дані про хост",
+	"admin.federation.users.show_local_user": "Показати дані про локального користувача",
+	"admin.federation.host.latest_activity": "Остання активність",
+	"admin.federation.users.title": "Користувачі федерації",
+	"admin.federation.users.manage_panel": "Керування користувачами федерації",
+	"admin.federation.user.user_id": "ID локального користувача",
+	"admin.federation.user.external_id": "ID зовнішнього користувача",
+	"user.activitypub_feed.feed": "Стрічка Федісвіту",
+	"user.activitypub_feed.posted_on": "Опубліковано %[1]s",
+	"user.activitypub_feed.no_activity": "Немає подій Федісвіту",
+	"user.activitypub_feed.is_empty": "Ваша стрічка Федісвіту порожня.",
+	"user.activitypub_feed.original_source": "Першоджерело",
+	"user.activitypub_feed.hint": "У цій стрічці відображається діяльність облікових записів Федісвіту, на які ви підписані, а також федеративні публікації, в яких вас згадано.",
+	"repo.files.filename": "Назва файлу",
+	"repo.files.last_commit_message": "Повідомлення останнього коміту",
+	"repo.files.last_commit_date": "Дата останнього коміту",
+	"repo.files.caption": "Файли репозиторію (спочатку останній коміт)"
 }
diff --git a/options/locale_next/locale_vi.json b/options/locale_next/locale_vi.json
index dee83ccaa0..28b84ca6ec 100644
--- a/options/locale_next/locale_vi.json
+++ b/options/locale_next/locale_vi.json
@@ -1,4 +1,28 @@
 {
+	"webauthn.error.timeout": "Hết thời gian đọc khóa mất rồi. Hãy tải lại trang và thử lại.",
+	"webauthn.error.empty": "Bạn phải đặt tên cho khóa này.",
+	"webauthn.error.duplicated": "Khóa bảo mật không được phép cho yêu cầu này. Vui lòng đảm bảo rằng khóa chưa được đăng ký trước đó.",
+	"webauthn.error.unable_to_process": "Máy chủ không thể xử lý yêu cầu của bạn.",
+	"webauthn.error.insecure": "WebAuthn chỉ hỗ trợ kết nối mã hóa. Nếu đang thử nghiệm, bạn có thể dùng \"localhost\" hoặc \"127.0.0.1\"",
+	"webauthn.error.unknown": "Có lỗi xảy ra. Vui lòng thử lại.",
+	"webauthn.unsupported_browser": "Trình duyệt của bạn hiện không hỗ trợ WebAuthn.",
+	"webauthn.error": "Không thể đọc khóa bảo mật của bạn.",
+	"webauthn.use_twofa": "Dùng mã xác thực hai lớp ở trên điện thoại",
+	"webauthn.press_button": "Hãy nhấn nút trên khóa bảo mật…",
+	"webauthn.sign_in": "Nhấn nút trên khóa bảo mật, nếu không có nút thì bạn hãy rút ra rồi cắm lại.",
+	"webauthn.insert_key": "Cắm khóa bảo mật của bạn vào",
+	"counters.n_branches": {
+		"one": "%s nhánh",
+		"other": "%s nhánh"
+	},
+	"counters.n_tags": {
+		"one": "%s nhãn",
+		"other": "%s nhãn"
+	},
+	"counters.n_releases": {
+		"one": "%s bản phát hành",
+		"other": "%s bản phát hành"
+	},
 	"packages.filter.container.tagged": "Được gắn nhãn",
 	"packages.filter.container.untagged": "Không được gắn nhãn",
 	"packages.details.project_site": "Trang mạng dự án",
@@ -30,6 +54,21 @@
 	"migrate.form.error.url_credentials": "URL có chứa thông tin đăng nhập, điền chúng vào các ô tên người dùng và mật khẩu tương ứng",
 	"migrate.github.description": "Nhập dữ liệu từ github.com hoặc máy chủ GitHub Enterprise.",
 	"migrate.git.description": "Chỉ nhập kho mã từ dịch vụ Git bất kì.",
+	"migrate.items.milestones": "Cột mốc",
+	"migrate.items.labels": "Nhãn",
+	"migrate.items.issues": "Vấn đề",
+	"migrate.items.pull_requests": "Yêu cầu kéo",
+	"migrate.items.merge_requests": "Yêu cầu hợp",
+	"migrate.items.releases": "Bản phát hành",
+	"migrate.in_progress.git": "Đang nhập dữ liệu Git",
+	"migrate.in_progress.topics": "Đang nhập các chủ đề",
+	"migrate.in_progress.milestones": "Đang nhập các cột mốc",
+	"migrate.in_progress.labels": "Đang nhập các nhãn",
+	"migrate.in_progress.releases": "Đang nhập các bản phát hành",
+	"migrate.in_progress.issues": "Đang nhập các vấn đề",
+	"migrate.in_progress.pulls": "Đang nhập các yêu cầu kéo",
+	"migrate.cancel.title": "Huỷ nhập",
+	"migrate.cancel.confirmation": "Bạn có muốn huỷ nhập không?",
 	"home.explore_repos": "Khám phá kho mã",
 	"stars.list.none": "Chưa ai tặng sao cho kho mã này.",
 	"watch.list.none": "Không có ai đang theo dõi kho mã này.",
diff --git a/options/locale_next/locale_zh-CN.json b/options/locale_next/locale_zh-CN.json
index 73f6a3f722..bd7fbcf3d2 100644
--- a/options/locale_next/locale_zh-CN.json
+++ b/options/locale_next/locale_zh-CN.json
@@ -1,4 +1,97 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "队列中的所有项目已被移除。",
+	"admin.monitor.queue.settings.remove_all_items": "移除全部",
+	"admin.monitor.queue.settings.changed": "设置已更新",
+	"admin.monitor.queue.settings.submit": "更新设置",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "最大工作者数必须是数字",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "当前%[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "最大工作者数量",
+	"admin.monitor.queue.settings.description": "因为工作者队列阻塞，池正在动态扩展。",
+	"admin.monitor.queue.settings.title": "池设置",
+	"admin.monitor.queue.review_add": "审查/添加worker",
+	"admin.monitor.queue.numberinqueue": "队列中的数量",
+	"admin.monitor.queue.maxnumberworkers": "最大worker数量",
+	"admin.monitor.queue.activeworkers": "活跃worker",
+	"admin.monitor.queue.numberworkers": "worker数量",
+	"admin.monitor.queue.exemplar": "数据类型",
+	"admin.monitor.queue.type": "类型",
+	"admin.monitor.queue.name": "名称",
+	"admin.monitor.queue": "队列：%s",
+	"admin.monitor.queues": "队列",
+	"admin.users.list_status_filter.not_2fa_enabled": "未启用2FA",
+	"admin.users.list_status_filter.is_2fa_enabled": "已启用2FA",
+	"admin.users.list_status_filter.not_prohibit_login": "允许登录",
+	"admin.users.list_status_filter.is_prohibit_login": "禁止登录",
+	"admin.users.list_status_filter.not_restricted": "不受限",
+	"admin.users.list_status_filter.is_restricted": "受限",
+	"admin.users.list_status_filter.not_admin": "非管理员",
+	"admin.users.list_status_filter.is_admin": "管理员",
+	"admin.users.list_status_filter.not_active": "未激活",
+	"admin.users.list_status_filter.is_active": "已激活",
+	"admin.users.list_status_filter.reset": "重置",
+	"admin.users.list_status_filter.menu_text": "过滤",
+	"admin.system_status.gc_times": "GC执行次数",
+	"admin.system_status.last_gc_pause": "上次GC暂停时间",
+	"admin.system_status.total_gc_pause": "GC暂停时间总量",
+	"admin.system_status.last_gc_time": "距离上次GC时间",
+	"admin.system_status.next_gc_recycle": "下次GC内存回收量",
+	"admin.system_status.other_system_allocation_obtained": "其它被分配的系统内存",
+	"admin.system_status.gc_metadata_obtained": "被分配的GC元数据内存",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "被分配的剖析哈希表内存",
+	"admin.system_status.mcache_structures_obtained": "被分配的MCache结构内存",
+	"admin.system_status.mcache_structures_usage": "MCache结构内存使用量",
+	"admin.system_status.mspan_structures_obtained": "被分配的MSpan结构内存",
+	"admin.system_status.mspan_structures_usage": "MSpan结构内存使用量",
+	"admin.system_status.stack_memory_obtained": "被分配的Stack内存",
+	"admin.system_status.bootstrap_stack_usage": "启动Stack使用量",
+	"admin.system_status.heap_objects": "Heap对象数量",
+	"admin.system_status.heap_memory_released": "被释放的Heap内存",
+	"admin.system_status.heap_memory_in_use": "正在使用的Heap内存",
+	"admin.system_status.heap_memory_idle": "Heap内存空闲量",
+	"admin.system_status.heap_memory_obtained": "Heap内存占用量",
+	"admin.system_status.current_heap_usage": "当前Heap内存使用量",
+	"admin.system_status.memory_free_times": "内存释放次数",
+	"admin.system_status.memory_allocate_times": "内存分配次数",
+	"admin.system_status.pointer_lookup_times": "指针查找次数",
+	"admin.system_status.memory_obtained": "内存占用量",
+	"admin.system_status.total_memory_allocated": "所有被分配的内存",
+	"admin.system_status.current_memory_usage": "当前内存使用量",
+	"admin.system_status.current_goroutine": "当前Goroutines数量",
+	"admin.system_status.server_uptime": "服务运行时间",
+	"markup.filepreview.truncated": "预览已被截断",
+	"markup.filepreview.lines": "%[3]s中的第%[1]d到%[2]d行",
+	"markup.filepreview.line": "%[2]s中的第%[1]d行",
+	"actions.variables.update.success": "该变量已被编辑。",
+	"actions.variables.update.failed": "编辑变量失败。",
+	"actions.variables.creation.success": "变量 “%s” 添加成功。",
+	"actions.variables.creation.failed": "添加变量失败。",
+	"actions.variables.deletion.success": "变量已被删除。",
+	"actions.variables.deletion.failed": "删除变量失败。",
+	"actions.variables.not_found": "找不到变量。",
+	"actions.variables.edit": "编辑变量",
+	"actions.variables.description": "变量将被传给特定的Action，其它情况将不能被读取。",
+	"actions.variables.deletion.description": "删除变量是永久性的，无法撤消。继续吗？",
+	"actions.variables.deletion": "删除变量",
+	"actions.variables.none": "目前还没有变量。",
+	"actions.variables.creation": "添加变量",
+	"actions.variables.management": "管理变量",
+	"actions.variables": "变量",
+	"webauthn.error.timeout": "未能在允许的时限内读取密钥。请重新加载此页面并重试。",
+	"webauthn.error.empty": "您必须为此密钥设置一个名称。",
+	"webauthn.error.duplicated": "此安全密钥未被许可用于这个请求。请确保该密钥尚未注册。",
+	"webauthn.error.unable_to_process": "服务器无法处理您的请求。",
+	"webauthn.error.insecure": "WebAuthn仅支持安全连接。如果要在HTTP协议上进行测试，请使用\"localhost\"或\"127.0.0.1\"作为访问来源",
+	"webauthn.error.unknown": "发生未知错误。请重试。",
+	"webauthn.unsupported_browser": "你的浏览器目前不支持WebAuthn。",
+	"webauthn.error": "无法读取安全密钥。",
+	"webauthn.use_twofa": "使用来自手机中的两步验证码",
+	"webauthn.press_button": "请按下安全密钥上的按钮……",
+	"webauthn.sign_in": "按下安全密钥上的按钮。如果安全密钥没有按钮，请重新插入它。",
+	"webauthn.insert_key": "插入安全密钥",
+	"counters.n_commits": "%s笔提交",
+	"counters.n_branches": "%s个分支",
+	"counters.n_tags": "%s个标签",
+	"counters.n_releases": "%s个发布版本",
 	"gpg.default_key": "使用默认密钥签名",
 	"gpg.error.extract_sign": "无法提取签名",
 	"gpg.error.generate_hash": "无法生成提交散列",
@@ -284,6 +377,23 @@
 	"migrate.gitbucket.description": "从GitBucket实例迁移数据。",
 	"migrate.codebase.description": "从codebasehq.com迁移数据。",
 	"migrate.forgejo.description": "从codeberg.org或其他Forgejo实例迁移数据。",
+	"migrate.items.label": "迁移内容",
+	"migrate.items.wiki": "百科",
+	"migrate.items.milestones": "里程碑",
+	"migrate.items.labels": "标签",
+	"migrate.items.issues": "议题",
+	"migrate.items.pull_requests": "合并请求",
+	"migrate.items.merge_requests": "合并请求",
+	"migrate.items.releases": "版本发布",
+	"migrate.in_progress.git": "正在迁移Git数据",
+	"migrate.in_progress.topics": "正在迁移主题",
+	"migrate.in_progress.milestones": "正在迁移里程碑",
+	"migrate.in_progress.labels": "正在迁移标签",
+	"migrate.in_progress.releases": "正在迁移版本发布",
+	"migrate.in_progress.issues": "正在迁移议题",
+	"migrate.in_progress.pulls": "正在迁移合并请求",
+	"migrate.cancel.title": "取消迁移",
+	"migrate.cancel.confirmation": "确定要取消此次迁移吗？",
 	"warning.repository.out_of_sync": "此仓库的数据库表示已脱同步。如果在向此仓库推送提交后仍出现此警告，请联系管理员。",
 	"admin.config.security": "安全设置",
 	"settings.twofa_unroll_unavailable": "你的账户必须启用双因子认证，无法禁用。",
@@ -463,11 +573,8 @@
 	"actions.runners.uuid": "UUID",
 	"actions.runners.token": "令牌",
 	"actions.runners.ephemeral": "一次性",
-	"actions.runners.list_runners.details_column": "详情",
 	"actions.runners.list_runners.edit_column": "编辑",
 	"actions.runners.list_runners.delete_column": "删除",
-	"actions.runners.list_runners.details_button": "详情",
-	"actions.runners.list_runners.details_button_aria": "显示%s的细节",
 	"actions.runners.list_runners.delete_button": "删除",
 	"actions.runners.list_runners.delete_button_aria": "删除%s",
 	"actions.runners.list_runners.edit_button": "编辑",
@@ -535,8 +642,54 @@
 	"actions.secrets.mutation.failure_message": "无法更新机密“%s”。",
 	"actions.secrets.mutation.name_description": "机密的名字只能包含字母、数字和下划线，不能以FORGEJO_、GITEA_、GITHUB_或数字开头，会自动转换为大写格式。",
 	"actions.secrets.mutation.value_description": "现有值不会显示，留空以保留现有值。特殊字符会被保留，CRLF（Windows式换行符）会被转换为LF；要保留换行符，请使用Base64编码。",
+	"members.add_member": "添加成员",
+	"members.user": "用户",
+	"members.user_already_member": "该用户已是组织成员。",
+	"members.no_team_selected": "组织成员至少要属于一个团队。",
+	"migrate.select.title": "迁移仓库",
+	"admin.federation.federation": "联邦",
+	"admin.federation.hosts": "主机",
+	"admin.federation.hosts.title": "联邦主机",
+	"admin.federation.hosts.manage_panel": "管理联邦主机",
+	"admin.federation.hosts.details_panel": "联邦主机信息",
+	"admin.federation.hosts.show_details": "显示主机信息",
+	"admin.federation.host.id": "ID",
+	"admin.federation.host.fqdn": "FQDN",
+	"admin.federation.host.schema": "方案",
+	"admin.federation.host.port": "端口",
+	"admin.federation.host.software_name": "软件",
+	"admin.federation.host.created": "创建时间",
+	"admin.federation.host.updated": "更新时间",
+	"admin.federation.host.latest_activity": "最后活动时间",
+	"admin.federation.users": "用户数",
+	"admin.federation.users.title": "联合的用户",
+	"admin.federation.users.manage_panel": "管理联合的用户",
+	"admin.federation.users.show_local_user": "显示本地用户信息",
+	"admin.federation.user.id": "ID",
+	"admin.federation.user.user_id": "本地用户ID",
+	"admin.federation.user.external_id": "外部用户ID",
+	"admin.federation.user.inbox_path": "收件箱路径",
+	"admin.config.federation": "联邦配置",
+	"admin.config.federation.enabled": "启用",
+	"admin.config.federation.share_user_statistics": "与其他主机共享用户统计信息",
+	"admin.config.federation.max_size": "允许的最大响应大小",
+	"admin.config.federation.signature_enforced": "强制要求HTTP签名",
+	"admin.config.federation.signature_algorithms": "签名算法",
+	"admin.config.federation.digest_algorithm": "签名摘要算法",
+	"admin.config.federation.get_headers": "GET请求中要签名的请求头",
+	"admin.config.federation.post_headers": "POST请求中要签名的请求头",
+	"user.activitypub_feed.feed": "联邦订阅源",
+	"user.activitypub_feed.no_activity": "没有联邦活动",
+	"user.activitypub_feed.is_empty": "你的联邦订阅源是空的。",
+	"user.activitypub_feed.hint": "此订阅源展示你关注的联邦账户的活动和提到你的联邦活动。",
+	"user.activitypub_feed.posted_on": "发布于%[1]s",
+	"user.activitypub_feed.original_source": "原始来源",
 	"actions.runners.version": "版本",
 	"actions.workflow.unknown_job_in_needs": "ID为“%[1]s”的任务在`needs`中引用了未知任务“%[2]s”。",
 	"actions.workflow.rerun_impossible": "工作流无法重新运行。",
-	"actions.workflow.job_rerun_impossible": "任务无法重新运行。"
+	"actions.workflow.job_rerun_impossible": "任务无法重新运行。",
+	"repo.files.caption": "仓库文件（优先显示最新提交）",
+	"repo.files.filename": "文件名",
+	"repo.files.last_commit_message": "最新提交消息",
+	"repo.files.last_commit_date": "最新提交日期"
 }
diff --git a/options/locale_next/locale_zh-HK.json b/options/locale_next/locale_zh-HK.json
index a595ec54f5..5f1dc8f7e1 100644
--- a/options/locale_next/locale_zh-HK.json
+++ b/options/locale_next/locale_zh-HK.json
@@ -1,4 +1,49 @@
 {
+	"admin.monitor.queue.settings.submit": "更新設定",
+	"admin.monitor.queue.type": "認證類型",
+	"admin.monitor.queue.name": "組織名稱",
+	"admin.users.list_status_filter.is_admin": "管理員",
+	"admin.system_status.gc_times": "垃圾收集執行次數",
+	"admin.system_status.last_gc_pause": "上次垃圾收集暫停時間",
+	"admin.system_status.total_gc_pause": "垃圾收集暫停時間總量",
+	"admin.system_status.last_gc_time": "距離上次垃圾收集時間",
+	"admin.system_status.next_gc_recycle": "下次垃圾收集內存回收量",
+	"admin.system_status.other_system_allocation_obtained": "其它被分配的系統內存",
+	"admin.system_status.gc_metadata_obtained": "被分配的垃圾收集元資料內存",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "被分配的剖析哈希表內存",
+	"admin.system_status.mcache_structures_obtained": "被分配的 MCache 結構內存",
+	"admin.system_status.mcache_structures_usage": "MCache 結構內存使用量",
+	"admin.system_status.mspan_structures_obtained": "被分配的 MSpan 結構內存",
+	"admin.system_status.mspan_structures_usage": "MSpan 結構內存使用量",
+	"admin.system_status.stack_memory_obtained": "被分配的 Stack 內存",
+	"admin.system_status.bootstrap_stack_usage": "啟動 Stack 使用量",
+	"admin.system_status.heap_objects": "Heap 對象數量",
+	"admin.system_status.heap_memory_released": "被釋放的 Heap 內存",
+	"admin.system_status.heap_memory_in_use": "正在使用的 Heap 內存",
+	"admin.system_status.heap_memory_idle": "Heap 內存空閒量",
+	"admin.system_status.heap_memory_obtained": "Heap 內存佔用量",
+	"admin.system_status.current_heap_usage": "當前 Heap 內存使用量",
+	"admin.system_status.pointer_lookup_times": "指針查找次數",
+	"admin.system_status.memory_obtained": "內存佔用量",
+	"admin.system_status.total_memory_allocated": "所有被分配的內存",
+	"admin.system_status.current_memory_usage": "當前內存使用量",
+	"admin.system_status.current_goroutine": "當前 Goroutines 數量",
+	"admin.system_status.server_uptime": "服務執行時間",
+	"webauthn.error.empty": "你要起名呢條鎖匙。",
+	"webauthn.error.unable_to_process": "伺服器唔可以執行你嘅請求。",
+	"webauthn.error.unknown": "發生未知嘅錯誤，請再試下。",
+	"webauthn.unsupported_browser": "你嘅瀏覽器唔支援 WebAuthn。",
+	"webauthn.error": "唔可以讀取安全密鑰。",
+	"webauthn.use_twofa": "用手機嘅兩步驟驗證",
+	"webauthn.press_button": "請撳下安全密鑰嘅掣…",
+	"webauthn.sign_in": "撳下安全密鑰嘅掣。如果安全密鑰冇掣，請再插入。",
+	"webauthn.insert_key": "插入安全密鑰",
+	"migrate.items.wiki": "維基",
+	"migrate.items.milestones": "里程碑",
+	"migrate.items.labels": "標籤",
+	"migrate.items.issues": "問題數",
+	"migrate.items.pull_requests": "合併請求",
+	"migrate.items.releases": "版本發佈",
 	"actions.runners.name": "名稱",
 	"actions.runners.owner_type": "認證類型",
 	"actions.runners.description": "描述",
diff --git a/options/locale_next/locale_zh-TW.json b/options/locale_next/locale_zh-TW.json
index 08649ca69a..c2d5063457 100644
--- a/options/locale_next/locale_zh-TW.json
+++ b/options/locale_next/locale_zh-TW.json
@@ -1,4 +1,109 @@
 {
+	"admin.monitor.queue.settings.remove_all_items.success": "已移除佇列中所有項目。",
+	"admin.monitor.queue.settings.remove_all_items": "全部移除",
+	"admin.monitor.queue.settings.changed": "已更新設定",
+	"admin.monitor.queue.settings.submit": "更新設定",
+	"admin.monitor.queue.settings.maxnumberworkers.error": "最大工作者數量必須是數字",
+	"admin.monitor.queue.settings.maxnumberworkers.placeholder": "目前 %[1]d",
+	"admin.monitor.queue.settings.maxnumberworkers": "最大工作者數量",
+	"admin.monitor.queue.settings.description": "集區會根據工作者佇列的阻塞情況動態增長。",
+	"admin.monitor.queue.settings.title": "集區設定",
+	"admin.monitor.queue.review_add": "審閱／增加 Worker",
+	"admin.monitor.queue.numberinqueue": "佇列中的數量",
+	"admin.monitor.queue.maxnumberworkers": "最大工作者數量",
+	"admin.monitor.queue.activeworkers": "活躍工作者",
+	"admin.monitor.queue.numberworkers": "工作者數量",
+	"admin.monitor.queue.exemplar": "型別",
+	"admin.monitor.queue.type": "類型",
+	"admin.monitor.queue.name": "名稱",
+	"admin.monitor.queue": "佇列: %s",
+	"admin.monitor.queues": "佇列",
+	"admin.users.list_status_filter.not_2fa_enabled": "未啟用兩步驟驗證",
+	"admin.users.list_status_filter.is_2fa_enabled": "已啟用兩步驟驗證",
+	"admin.users.list_status_filter.not_prohibit_login": "允許登入",
+	"admin.users.list_status_filter.is_prohibit_login": "禁止登入",
+	"admin.users.list_status_filter.not_restricted": "未受限制",
+	"admin.users.list_status_filter.is_restricted": "受限",
+	"admin.users.list_status_filter.not_admin": "非管理員",
+	"admin.users.list_status_filter.is_admin": "管理員",
+	"admin.users.list_status_filter.not_active": "未啟用",
+	"admin.users.list_status_filter.is_active": "已啟用",
+	"admin.users.list_status_filter.reset": "重設",
+	"admin.users.list_status_filter.menu_text": "篩選",
+	"admin.system_status.gc_times": "GC 執行次數",
+	"admin.system_status.last_gc_pause": "上次 GC 暫停時間",
+	"admin.system_status.total_gc_pause": "總 GC 暫停時間",
+	"admin.system_status.last_gc_time": "距離上次 GC 時間",
+	"admin.system_status.next_gc_recycle": "下次 GC 記憶體回收量",
+	"admin.system_status.other_system_allocation_obtained": "其他獲得的系統記憶體",
+	"admin.system_status.gc_metadata_obtained": "被分配 GC Metadata",
+	"admin.system_status.profiling_bucket_hash_table_obtained": "被分配的剖析雜湊表",
+	"admin.system_status.mcache_structures_obtained": "獲得的 MCache 結構",
+	"admin.system_status.mcache_structures_usage": "MCache 結構使用量",
+	"admin.system_status.mspan_structures_obtained": "獲得的 MSpan 結構",
+	"admin.system_status.mspan_structures_usage": "MSpan 結構使用量",
+	"admin.system_status.stack_memory_obtained": "獲得的 Stack 記憶體",
+	"admin.system_status.bootstrap_stack_usage": "啟動 Stack 使用量",
+	"admin.system_status.heap_objects": "Heap 物件數量",
+	"admin.system_status.heap_memory_released": "被釋放的 Heap 記憶體",
+	"admin.system_status.heap_memory_in_use": "正在使用的 Heap 記憶體",
+	"admin.system_status.heap_memory_idle": "Heap 記憶體閒置量",
+	"admin.system_status.heap_memory_obtained": "獲得的 Heap 記憶體",
+	"admin.system_status.current_heap_usage": "目前 Heap 記憶體使用量",
+	"admin.system_status.memory_free_times": "記憶體釋放次數",
+	"admin.system_status.memory_allocate_times": "記憶體分配次數",
+	"admin.system_status.pointer_lookup_times": "指標尋找次數",
+	"admin.system_status.memory_obtained": "獲得的記憶體",
+	"admin.system_status.total_memory_allocated": "所有被分配的記憶體",
+	"admin.system_status.current_memory_usage": "目前記憶體使用量",
+	"admin.system_status.current_goroutine": "目前的 Goroutines",
+	"admin.system_status.server_uptime": "伺服器運作時間",
+	"markup.filepreview.truncated": "預覽已被截斷",
+	"markup.filepreview.lines": "%[3]s 中的第 %[1]d 至 %[2]d 行",
+	"markup.filepreview.line": "%[2]s 中的第 %[1]d 行",
+	"actions.variables.update.success": "該變數已被編輯。",
+	"actions.variables.update.failed": "編輯變數失敗。",
+	"actions.variables.creation.success": "已新增變數 「%s」。",
+	"actions.variables.creation.failed": "變數新增失敗。",
+	"actions.variables.deletion.success": "該變數已被刪除。",
+	"actions.variables.deletion.failed": "變數刪除失敗。",
+	"actions.variables.not_found": "找不到變數。",
+	"actions.variables.edit": "編輯變數",
+	"actions.variables.description": "變數會被傳給特定的 Actions，除此之外它們無法被讀取。",
+	"actions.variables.deletion.description": "刪除變數是永久且不可取消的。要繼續嗎？",
+	"actions.variables.deletion": "刪除變數",
+	"actions.variables.none": "目前沒有變數。",
+	"actions.variables.creation": "新增變數",
+	"actions.variables.management": "變數管理",
+	"actions.variables": "變數",
+	"webauthn.error.timeout": "在成功讀取金鑰之前已逾時，請重新載入此頁面並重試。",
+	"webauthn.error.empty": "您必須命名此金鑰。",
+	"webauthn.error.duplicated": "此安全金鑰無法允許這個請求。請確保該金鑰尚未被註冊。",
+	"webauthn.error.unable_to_process": "伺服器無法處理您的請求。",
+	"webauthn.error.insecure": "WebAuthn 只支援安全連線。想在 HTTP 上測試，您可以使用「localhost」或「127.0.0.1」",
+	"webauthn.error.unknown": "發生未知的錯誤，請再試一次。",
+	"webauthn.unsupported_browser": "您的瀏覽器還不支援 WebAuthn。",
+	"webauthn.error": "無法讀取您的安全金鑰。",
+	"webauthn.use_twofa": "使用來自手機的兩步驟驗證碼",
+	"webauthn.press_button": "請按下您安全金鑰上的按鈕…",
+	"webauthn.sign_in": "按下您安全金鑰上的按鈕。如果您的安全金鑰沒有按鈕，請重新插入。",
+	"webauthn.insert_key": "插入您的安全金鑰",
+	"counters.n_commits": {
+		"one": "%s 個提交",
+		"other": "%s 個提交"
+	},
+	"counters.n_branches": {
+		"one": "%s 條分支",
+		"other": "%s 條分支"
+	},
+	"counters.n_tags": {
+		"one": "%s 個標籤",
+		"other": "%s 個標籤"
+	},
+	"counters.n_releases": {
+		"one": "%s 發行",
+		"other": "%s 發行"
+	},
 	"actions.actions": "Actions",
 	"actions.status.unknown": "未知的",
 	"actions.status.waiting": "等待中",
@@ -315,6 +420,23 @@
 	"migrate.gitbucket.description": "從 GitBucket 站點遷移資料。",
 	"migrate.codebase.description": "從 codebasehq.com 遷移資料。",
 	"migrate.forgejo.description": "從 codeberg.org 或其他 Forgejo 站點遷移資料。",
+	"migrate.items.label": "遷移項目",
+	"migrate.items.wiki": "Wiki",
+	"migrate.items.milestones": "里程碑",
+	"migrate.items.labels": "標籤",
+	"migrate.items.issues": "問題",
+	"migrate.items.pull_requests": "合併請求",
+	"migrate.items.merge_requests": "合併請求",
+	"migrate.items.releases": "版本發布",
+	"migrate.in_progress.git": "正在遷移 Git 資料",
+	"migrate.in_progress.topics": "正在遷移主題",
+	"migrate.in_progress.milestones": "正在遷移里程碑",
+	"migrate.in_progress.labels": "正在遷移標籤",
+	"migrate.in_progress.releases": "正在遷移版本發佈",
+	"migrate.in_progress.issues": "正在遷移問題",
+	"migrate.in_progress.pulls": "正在遷移合併請求",
+	"migrate.cancel.title": "取消遷移",
+	"migrate.cancel.confirmation": "您確定要取消這次的遷移嗎？",
 	"pulse.n_active_issues": "%s 個問題",
 	"pulse.n_active_prs": "%s 個合併請求",
 	"watch.n_watchers": "%s 位關注者",
diff --git a/package-lock.json b/package-lock.json
index 87a9add4d6..93eea24572 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
         "@citation-js/core": "0.7.21",
         "@citation-js/plugin-bibtex": "0.7.21",
         "@citation-js/plugin-software-formats": "0.6.2",
-        "@codemirror/autocomplete": "6.20.1",
+        "@codemirror/autocomplete": "6.20.2",
         "@codemirror/commands": "6.10.3",
         "@codemirror/lang-cpp": "6.0.3",
         "@codemirror/lang-css": "6.3.1",
@@ -26,11 +26,11 @@
         "@codemirror/lang-rust": "6.0.2",
         "@codemirror/lang-sass": "6.0.2",
         "@codemirror/lang-xml": "6.1.0",
-        "@codemirror/lang-yaml": "6.1.2",
-        "@codemirror/language": "6.12.2",
-        "@codemirror/search": "6.6.0",
+        "@codemirror/lang-yaml": "6.1.3",
+        "@codemirror/language": "6.12.3",
+        "@codemirror/search": "6.7.0",
         "@codemirror/state": "6.6.0",
-        "@codemirror/view": "6.40.0",
+        "@codemirror/view": "6.42.1",
         "@github/markdown-toolbar-element": "2.2.3",
         "@github/quote-selection": "2.1.0",
         "@github/text-expander-element": "2.9.4",
@@ -43,28 +43,28 @@
         "chart.js": "4.5.1",
         "chartjs-adapter-dayjs-4": "1.0.4",
         "chartjs-plugin-zoom": "2.2.0",
-        "clippie": "4.1.10",
+        "clippie": "4.1.15",
         "css-loader": "7.1.3",
         "dayjs": "1.11.19",
         "dropzone": "6.0.0-beta.2",
         "easymde": "2.18.0",
-        "esbuild-loader": "4.4.2",
+        "esbuild-loader": "4.4.3",
         "escape-goat": "4.0.0",
         "fast-glob": "3.3.3",
-        "htmx.org": "2.0.8",
+        "htmx.org": "2.0.10",
         "idiomorph": "0.3.0",
         "jquery": "3.7.1",
-        "katex": "0.16.38",
+        "katex": "0.16.45",
         "mermaid": "11.15.0",
         "mini-css-extract-plugin": "2.10.0",
-        "minimatch": "10.2.4",
+        "minimatch": "10.2.5",
         "pdfobject": "2.3.0",
-        "postcss": "8.5.10",
+        "postcss": "8.5.13",
         "postcss-loader": "8.2.1",
         "postcss-nesting": "14.0.0",
         "pretty-ms": "9.0.0",
         "sortablejs": "1.15.7",
-        "swagger-ui-dist": "5.31.2",
+        "swagger-ui-dist": "5.32.5",
         "tailwindcss": "3.4.19",
         "throttle-debounce": "5.0.0",
         "tinycolor2": "1.6.0",
@@ -73,55 +73,56 @@
         "tributejs": "5.1.3",
         "uint8-to-base64": "0.2.1",
         "vanilla-colorful": "0.7.2",
-        "vue": "3.5.28",
+        "vue": "3.5.33",
         "vue-chartjs": "5.3.3",
         "vue-loader": "17.4.2",
         "vue3-calendar-heatmap": "2.0.5",
-        "webpack": "5.105.4",
-        "webpack-cli": "6.0.1",
+        "webpack": "5.106.2",
+        "webpack-cli": "7.0.2",
         "wrap-ansi": "10.0.0"
       },
       "devDependencies": {
-        "@axe-core/playwright": "4.11.0",
+        "@axe-core/playwright": "4.11.2",
         "@eslint-community/eslint-plugin-eslint-comments": "4.7.1",
-        "@playwright/test": "1.57.0",
-        "@stoplight/spectral-cli": "6.15.0",
+        "@playwright/test": "1.58.2",
+        "@stoplight/spectral-cli": "6.15.1",
         "@stylistic/eslint-plugin": "5.10.0",
         "@stylistic/stylelint-plugin": "4.0.1",
-        "@vitejs/plugin-vue": "6.0.3",
-        "@vitest/coverage-v8": "4.0.18",
-        "@vitest/eslint-plugin": "1.6.9",
-        "@vue/test-utils": "2.4.6",
+        "@vitejs/plugin-vue": "6.0.6",
+        "@vitest/coverage-v8": "4.1.2",
+        "@vitest/eslint-plugin": "1.6.13",
+        "@vue/test-utils": "2.4.9",
         "eslint": "9.39.4",
         "eslint-import-resolver-typescript": "4.4.4",
         "eslint-plugin-array-func": "5.1.1",
-        "eslint-plugin-import-x": "4.16.1",
+        "eslint-plugin-import-x": "4.16.2",
         "eslint-plugin-no-jquery": "3.1.1",
         "eslint-plugin-no-use-extend-native": "0.7.2",
-        "eslint-plugin-playwright": "2.9.0",
-        "eslint-plugin-regexp": "3.0.0",
+        "eslint-plugin-playwright": "2.10.1",
+        "eslint-plugin-regexp": "3.1.0",
         "eslint-plugin-sonarjs": "3.0.7",
         "eslint-plugin-toml": "0.13.1",
         "eslint-plugin-unicorn": "63.0.0",
-        "eslint-plugin-vitest-globals": "1.5.0",
+        "eslint-plugin-vitest-globals": "1.6.1",
         "eslint-plugin-vue": "10.8.0",
         "eslint-plugin-vue-scoped-css": "2.12.0",
         "eslint-plugin-wc": "3.1.0",
-        "globals": "17.4.0",
+        "globals": "17.6.0",
         "happy-dom": "20.8.9",
         "license-checker-rseidelsohn": "4.4.2",
-        "markdownlint-cli": "0.47.0",
+        "markdownlint-cli": "0.48.0",
         "postcss-html": "1.8.1",
         "sharp": "0.34.5",
         "stylelint": "16.26.1",
         "stylelint-declaration-block-no-ignored-properties": "2.8.0",
         "stylelint-declaration-strict-value": "1.11.1",
+        "stylelint-plugin-logical-css": "2.1.0",
         "stylelint-value-no-unknown-custom-properties": "6.1.1",
         "svgo": "4.0.1",
         "typescript": "5.9.3",
-        "typescript-eslint": "8.56.1",
-        "vite-string-plugin": "2.0.0",
-        "vitest": "4.0.18"
+        "typescript-eslint": "8.58.0",
+        "vite-string-plugin": "2.0.2",
+        "vitest": "4.1.2"
       },
       "engines": {
         "node": ">= 20.0.0"
@@ -153,9 +154,9 @@
       }
     },
     "node_modules/@asyncapi/specs": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@asyncapi/specs/-/specs-6.10.0.tgz",
-      "integrity": "sha512-vB5oKLsdrLUORIZ5BXortZTlVyGWWMC1Nud/0LtgxQ3Yn2738HigAD6EVqScvpPsDUI/bcLVsYEXN4dtXQHVng==",
+      "version": "6.11.1",
+      "resolved": "https://registry.npmjs.org/@asyncapi/specs/-/specs-6.11.1.tgz",
+      "integrity": "sha512-A3WBLqAKGoJ2+6FWFtpjBlCQ1oFCcs4GxF7zsIGvNqp/klGUHjlA3aAcZ9XMMpLGE8zPeYDz2x9FmO6DSuKraQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -163,22 +164,22 @@
       }
     },
     "node_modules/@axe-core/playwright": {
-      "version": "4.11.0",
-      "resolved": "https://registry.npmjs.org/@axe-core/playwright/-/playwright-4.11.0.tgz",
-      "integrity": "sha512-70vBT/Ylqpm65RQz2iCG2o0JJCEG/WCNyefTr2xcOcr1CoSee60gNQYUMZZ7YukoKkFLv26I/jjlsvwwp532oQ==",
+      "version": "4.11.2",
+      "resolved": "https://registry.npmjs.org/@axe-core/playwright/-/playwright-4.11.2.tgz",
+      "integrity": "sha512-iP6hfNl9G0j/SEUSo8M7D80RbcDo9KRAAfDP4IT5OHB+Wm6zUHIrm8Y51BKI+Oyqduvipf9u1hcRy57zCBKzWQ==",
       "dev": true,
       "license": "MPL-2.0",
       "dependencies": {
-        "axe-core": "~4.11.0"
+        "axe-core": "~4.11.3"
       },
       "peerDependencies": {
         "playwright-core": ">= 1.0.0"
       }
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.28.6.tgz",
-      "integrity": "sha512-JYgintcMjRiCvS8mMECzaEn+m3PfoQiyqukOMCCVQtoJGYJw8j/8LBJEiqkHLkfwCcs74E3pbAUFNg7d9VNJ+Q==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
+      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-validator-identifier": "^7.28.5",
@@ -214,9 +215,9 @@
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
-      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
+      "version": "7.29.3",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
+      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.0"
@@ -229,9 +230,9 @@
       }
     },
     "node_modules/@babel/runtime": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
-      "integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
+      "version": "7.29.2",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.2.tgz",
+      "integrity": "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -261,22 +262,22 @@
       }
     },
     "node_modules/@braintree/sanitize-url": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-7.1.1.tgz",
-      "integrity": "sha512-i1L7noDNxtFyL5DmZafWy1wRVhGehQmzZaz1HiN5e7iylJMSZR7ekOV7NsIqa5qBldlLrsKv4HbgFUVlQrz8Mw==",
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-7.1.2.tgz",
+      "integrity": "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==",
       "license": "MIT"
     },
     "node_modules/@cacheable/memory": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.0.7.tgz",
-      "integrity": "sha512-RbxnxAMf89Tp1dLhXMS7ceft/PGsDl1Ip7T20z5nZ+pwIAsQ1p2izPjVG69oCLv/jfQ7HDPHTWK0c9rcAWXN3A==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.0.8.tgz",
+      "integrity": "sha512-FvEb29x5wVwu/Kf93IWwsOOEuhHh6dYCJF3vcKLzXc0KXIW181AOzv6ceT4ZpBHDvAfG60eqb+ekmrnLHIy+jw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@cacheable/utils": "^2.3.3",
-        "@keyv/bigmap": "^1.3.0",
-        "hookified": "^1.14.0",
-        "keyv": "^5.5.5"
+        "@cacheable/utils": "^2.4.0",
+        "@keyv/bigmap": "^1.3.1",
+        "hookified": "^1.15.1",
+        "keyv": "^5.6.0"
       }
     },
     "node_modules/@cacheable/memory/node_modules/@keyv/bigmap": {
@@ -307,14 +308,14 @@
       }
     },
     "node_modules/@cacheable/utils": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.3.3.tgz",
-      "integrity": "sha512-JsXDL70gQ+1Vc2W/KUFfkAJzgb4puKwwKehNLuB+HrNKWf91O736kGfxn4KujXCCSuh6mRRL4XEB0PkAFjWS0A==",
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.4.1.tgz",
+      "integrity": "sha512-eiFgzCbIneyMlLOmNG4g9xzF7Hv3Mga4LjxjcSC/ues6VYq2+gUbQI8JqNuw/ZM8tJIeIaBGpswAsqV2V7ApgA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hashery": "^1.3.0",
-        "keyv": "^5.5.5"
+        "hashery": "^1.5.1",
+        "keyv": "^5.6.0"
       }
     },
     "node_modules/@cacheable/utils/node_modules/keyv": {
@@ -464,9 +465,9 @@
       }
     },
     "node_modules/@codemirror/autocomplete": {
-      "version": "6.20.1",
-      "resolved": "https://registry.npmjs.org/@codemirror/autocomplete/-/autocomplete-6.20.1.tgz",
-      "integrity": "sha512-1cvg3Vz1dSSToCNlJfRA2WSI4ht3K+WplO0UMOgmUYPivCyy2oueZY6Lx7M9wThm7SDUBViRmuT+OG/i8+ON9A==",
+      "version": "6.20.2",
+      "resolved": "https://registry.npmjs.org/@codemirror/autocomplete/-/autocomplete-6.20.2.tgz",
+      "integrity": "sha512-G5FPkgIiLjOgZMjqVjvuKQ1rGPtHogLldJr33eFJdVLtmwY+giGrlv/ewljLz6b9BSQLkjxuwBc6g6omDM+YxQ==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/language": "^6.0.0",
@@ -683,9 +684,9 @@
       }
     },
     "node_modules/@codemirror/lang-yaml": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/@codemirror/lang-yaml/-/lang-yaml-6.1.2.tgz",
-      "integrity": "sha512-dxrfG8w5Ce/QbT7YID7mWZFKhdhsaTNOYjOkSIMt1qmC4VQnXSDSYVHHHn8k6kJUfIhtLo8t1JJgltlxWdsITw==",
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/@codemirror/lang-yaml/-/lang-yaml-6.1.3.tgz",
+      "integrity": "sha512-AZ8DJBuXGVHybpBQhmZtgew5//4hv3tdkXnr3vDmOUMJRuB6vn/uuwtmTOTlqEaQFg3hQSVeA90NmvIQyUV6FQ==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/autocomplete": "^6.0.0",
@@ -698,9 +699,9 @@
       }
     },
     "node_modules/@codemirror/language": {
-      "version": "6.12.2",
-      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.12.2.tgz",
-      "integrity": "sha512-jEPmz2nGGDxhRTg3lTpzmIyGKxz3Gp3SJES4b0nAuE5SWQoKdT5GoQ69cwMmFd+wvFUhYirtDTr0/DRHpQAyWg==",
+      "version": "6.12.3",
+      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.12.3.tgz",
+      "integrity": "sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/state": "^6.0.0",
@@ -712,9 +713,9 @@
       }
     },
     "node_modules/@codemirror/lint": {
-      "version": "6.9.2",
-      "resolved": "https://registry.npmjs.org/@codemirror/lint/-/lint-6.9.2.tgz",
-      "integrity": "sha512-sv3DylBiIyi+xKwRCJAAsBZZZWo82shJ/RTMymLabAdtbkV5cSKwWDeCgtUq3v8flTaXS2y1kKkICuRYtUswyQ==",
+      "version": "6.9.5",
+      "resolved": "https://registry.npmjs.org/@codemirror/lint/-/lint-6.9.5.tgz",
+      "integrity": "sha512-GElsbU9G7QT9xXhpUg1zWGmftA/7jamh+7+ydKRuT0ORpWS3wOSP0yT1FOlIZa7mIJjpVPipErsyvVqB9cfTFA==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/state": "^6.0.0",
@@ -723,9 +724,9 @@
       }
     },
     "node_modules/@codemirror/search": {
-      "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/@codemirror/search/-/search-6.6.0.tgz",
-      "integrity": "sha512-koFuNXcDvyyotWcgOnZGmY7LZqEOXZaaxD/j6n18TCLx2/9HieZJ5H6hs1g8FiRxBD0DNfs0nXn17g872RmYdw==",
+      "version": "6.7.0",
+      "resolved": "https://registry.npmjs.org/@codemirror/search/-/search-6.7.0.tgz",
+      "integrity": "sha512-ZvGm99wc/s2cITtMT15LFdn8aH/aS+V+DqyGq/N5ZlV5vWtH+nILvC2nw0zX7ByNoHHDZ2IxxdW38O0tc5nVHg==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/state": "^6.0.0",
@@ -743,9 +744,9 @@
       }
     },
     "node_modules/@codemirror/view": {
-      "version": "6.40.0",
-      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.40.0.tgz",
-      "integrity": "sha512-WA0zdU7xfF10+5I3HhUUq3kqOx3KjqmtQ9lqZjfK7jtYk4G72YW9rezcSywpaUMCWOMlq+6E0pO1IWg1TNIhtg==",
+      "version": "6.42.1",
+      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.42.1.tgz",
+      "integrity": "sha512-ToN3oFc0nsxNUYVF5P0ztLgbC4UPPjPtA9aKYhkOKQaZASpOUo6ISXyQLP66ctVwlDc+j6Jv0uK5IFALkiXztg==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/state": "^6.6.0",
@@ -778,9 +779,9 @@
       }
     },
     "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.0.26",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.0.26.tgz",
-      "integrity": "sha512-6boXK0KkzT5u5xOgF6TKB+CLq9SOpEGmkZw0g5n9/7yg85wab3UzSxB8TxhLJ31L4SGJ6BCFRw/iftTha1CJXA==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.3.tgz",
+      "integrity": "sha512-SH60bMfrRCJF3morcdk57WklujF4Jr/EsQUzqkarfHXEFcAR1gg7fS/chAE922Sehgzc1/+Tz5H3Ypa1HiEKrg==",
       "dev": true,
       "funding": [
         {
@@ -792,7 +793,15 @@
           "url": "https://opencollective.com/csstools"
         }
       ],
-      "license": "MIT-0"
+      "license": "MIT-0",
+      "peerDependencies": {
+        "css-tree": "^3.2.1"
+      },
+      "peerDependenciesMeta": {
+        "css-tree": {
+          "optional": true
+        }
+      }
     },
     "node_modules/@csstools/css-tokenizer": {
       "version": "3.0.4",
@@ -861,10 +870,9 @@
       }
     },
     "node_modules/@csstools/selector-specificity": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-5.0.0.tgz",
-      "integrity": "sha512-PCqQV3c4CoVm3kdPhyeZ07VmBRdH2EpMFA/pd9OASpOEC3aXNGoqPDAZ80D0cLpMBxnmk0+yNhGsEx31hq7Gtw==",
-      "dev": true,
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-6.0.0.tgz",
+      "integrity": "sha512-4sSgl78OtOXEX/2d++8A83zHNTgwCJMaR24FvsYL7Uf/VS8HZk9PTwR51elTbGqMuwH3szLvvOXEaVnqn0Z3zA==",
       "funding": [
         {
           "type": "github",
@@ -877,16 +885,16 @@
       ],
       "license": "MIT-0",
       "engines": {
-        "node": ">=18"
+        "node": ">=20.19.0"
       },
       "peerDependencies": {
-        "postcss-selector-parser": "^7.0.0"
+        "postcss-selector-parser": "^7.1.1"
       }
     },
     "node_modules/@discoveryjs/json-ext": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.6.3.tgz",
-      "integrity": "sha512-4B4OijXeVNOPZlYA2oEwWOTkzyltLao+xbotHQeqN++Rv27Y6s818+n2Qkp8q+Fxhn0t/5lA5X1Mxktud8eayQ==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-1.1.0.tgz",
+      "integrity": "sha512-Xc3VhU02wqZ1HvHRJUwL09HkZSTvidqY5Ya0NXBSYOxAp+Ln9dcJr9fySI+CkONzP3PekQo9WdzCv0PGER/mOA==",
       "license": "MIT",
       "engines": {
         "node": ">=14.17.0"
@@ -904,21 +912,21 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.8.1.tgz",
-      "integrity": "sha512-AvT9QFpxK0Zd8J0jopedNm+w/2fIzvtPKPjqyw9jwvBaReTTqPBk9Hixaz7KbjimP+QNz605/XnjFcDAL2pqBg==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.1.0",
+        "@emnapi/wasi-threads": "1.2.1",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.8.1.tgz",
-      "integrity": "sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -927,9 +935,9 @@
       }
     },
     "node_modules/@emnapi/wasi-threads": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.1.0.tgz",
-      "integrity": "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
+      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -938,9 +946,9 @@
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.2.tgz",
-      "integrity": "sha512-GZMB+a0mOMZs4MpDbj8RJp4cw+w1WV5NYD6xzgvzUJ5Ek2jerwfO2eADyI6ExDSUED+1X8aMbegahsJi+8mgpw==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
+      "integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",
       "cpu": [
         "ppc64"
       ],
@@ -954,9 +962,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.2.tgz",
-      "integrity": "sha512-DVNI8jlPa7Ujbr1yjU2PfUSRtAUZPG9I1RwW4F4xFB1Imiu2on0ADiI/c3td+KmDtVKNbi+nffGDQMfcIMkwIA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",
+      "integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",
       "cpu": [
         "arm"
       ],
@@ -970,9 +978,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.2.tgz",
-      "integrity": "sha512-pvz8ZZ7ot/RBphf8fv60ljmaoydPU12VuXHImtAs0XhLLw+EXBi2BLe3OYSBslR4rryHvweW5gmkKFwTiFy6KA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",
+      "integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",
       "cpu": [
         "arm64"
       ],
@@ -986,9 +994,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.2.tgz",
-      "integrity": "sha512-z8Ank4Byh4TJJOh4wpz8g2vDy75zFL0TlZlkUkEwYXuPSgX8yzep596n6mT7905kA9uHZsf/o2OJZubl2l3M7A==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",
+      "integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",
       "cpu": [
         "x64"
       ],
@@ -1002,9 +1010,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.2.tgz",
-      "integrity": "sha512-davCD2Zc80nzDVRwXTcQP/28fiJbcOwvdolL0sOiOsbwBa72kegmVU0Wrh1MYrbuCL98Omp5dVhQFWRKR2ZAlg==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",
+      "integrity": "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==",
       "cpu": [
         "arm64"
       ],
@@ -1018,9 +1026,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.2.tgz",
-      "integrity": "sha512-ZxtijOmlQCBWGwbVmwOF/UCzuGIbUkqB1faQRf5akQmxRJ1ujusWsb3CVfk/9iZKr2L5SMU5wPBi1UWbvL+VQA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",
+      "integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",
       "cpu": [
         "x64"
       ],
@@ -1034,9 +1042,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.2.tgz",
-      "integrity": "sha512-lS/9CN+rgqQ9czogxlMcBMGd+l8Q3Nj1MFQwBZJyoEKI50XGxwuzznYdwcav6lpOGv5BqaZXqvBSiB/kJ5op+g==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",
       "cpu": [
         "arm64"
       ],
@@ -1050,9 +1058,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.2.tgz",
-      "integrity": "sha512-tAfqtNYb4YgPnJlEFu4c212HYjQWSO/w/h/lQaBK7RbwGIkBOuNKQI9tqWzx7Wtp7bTPaGC6MJvWI608P3wXYA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",
+      "integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",
       "cpu": [
         "x64"
       ],
@@ -1066,9 +1074,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.2.tgz",
-      "integrity": "sha512-vWfq4GaIMP9AIe4yj1ZUW18RDhx6EPQKjwe7n8BbIecFtCQG4CfHGaHuh7fdfq+y3LIA2vGS/o9ZBGVxIDi9hw==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",
+      "integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",
       "cpu": [
         "arm"
       ],
@@ -1082,9 +1090,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.2.tgz",
-      "integrity": "sha512-hYxN8pr66NsCCiRFkHUAsxylNOcAQaxSSkHMMjcpx0si13t1LHFphxJZUiGwojB1a/Hd5OiPIqDdXONia6bhTw==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",
+      "integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",
       "cpu": [
         "arm64"
       ],
@@ -1098,9 +1106,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.2.tgz",
-      "integrity": "sha512-MJt5BRRSScPDwG2hLelYhAAKh9imjHK5+NE/tvnRLbIqUWa+0E9N4WNMjmp/kXXPHZGqPLxggwVhz7QP8CTR8w==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",
+      "integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",
       "cpu": [
         "ia32"
       ],
@@ -1114,9 +1122,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.2.tgz",
-      "integrity": "sha512-lugyF1atnAT463aO6KPshVCJK5NgRnU4yb3FUumyVz+cGvZbontBgzeGFO1nF+dPueHD367a2ZXe1NtUkAjOtg==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",
+      "integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",
       "cpu": [
         "loong64"
       ],
@@ -1130,9 +1138,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.2.tgz",
-      "integrity": "sha512-nlP2I6ArEBewvJ2gjrrkESEZkB5mIoaTswuqNFRv/WYd+ATtUpe9Y09RnJvgvdag7he0OWgEZWhviS1OTOKixw==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",
+      "integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",
       "cpu": [
         "mips64el"
       ],
@@ -1146,9 +1154,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.2.tgz",
-      "integrity": "sha512-C92gnpey7tUQONqg1n6dKVbx3vphKtTHJaNG2Ok9lGwbZil6DrfyecMsp9CrmXGQJmZ7iiVXvvZH6Ml5hL6XdQ==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",
+      "integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",
       "cpu": [
         "ppc64"
       ],
@@ -1162,9 +1170,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.2.tgz",
-      "integrity": "sha512-B5BOmojNtUyN8AXlK0QJyvjEZkWwy/FKvakkTDCziX95AowLZKR6aCDhG7LeF7uMCXEJqwa8Bejz5LTPYm8AvA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",
+      "integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",
       "cpu": [
         "riscv64"
       ],
@@ -1178,9 +1186,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.2.tgz",
-      "integrity": "sha512-p4bm9+wsPwup5Z8f4EpfN63qNagQ47Ua2znaqGH6bqLlmJ4bx97Y9JdqxgGZ6Y8xVTixUnEkoKSHcpRlDnNr5w==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",
+      "integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",
       "cpu": [
         "s390x"
       ],
@@ -1194,9 +1202,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.2.tgz",
-      "integrity": "sha512-uwp2Tip5aPmH+NRUwTcfLb+W32WXjpFejTIOWZFw/v7/KnpCDKG66u4DLcurQpiYTiYwQ9B7KOeMJvLCu/OvbA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
+      "integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
       "cpu": [
         "x64"
       ],
@@ -1210,9 +1218,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.2.tgz",
-      "integrity": "sha512-Kj6DiBlwXrPsCRDeRvGAUb/LNrBASrfqAIok+xB0LxK8CHqxZ037viF13ugfsIpePH93mX7xfJp97cyDuTZ3cw==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",
       "cpu": [
         "arm64"
       ],
@@ -1226,9 +1234,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.2.tgz",
-      "integrity": "sha512-HwGDZ0VLVBY3Y+Nw0JexZy9o/nUAWq9MlV7cahpaXKW6TOzfVno3y3/M8Ga8u8Yr7GldLOov27xiCnqRZf0tCA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",
       "cpu": [
         "x64"
       ],
@@ -1242,9 +1250,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.2.tgz",
-      "integrity": "sha512-DNIHH2BPQ5551A7oSHD0CKbwIA/Ox7+78/AWkbS5QoRzaqlev2uFayfSxq68EkonB+IKjiuxBFoV8ESJy8bOHA==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",
       "cpu": [
         "arm64"
       ],
@@ -1258,9 +1266,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.2.tgz",
-      "integrity": "sha512-/it7w9Nb7+0KFIzjalNJVR5bOzA9Vay+yIPLVHfIQYG/j+j9VTH84aNB8ExGKPU4AzfaEvN9/V4HV+F+vo8OEg==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",
       "cpu": [
         "x64"
       ],
@@ -1274,9 +1282,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.2.tgz",
-      "integrity": "sha512-LRBbCmiU51IXfeXk59csuX/aSaToeG7w48nMwA6049Y4J4+VbWALAuXcs+qcD04rHDuSCSRKdmY63sruDS5qag==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",
+      "integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",
       "cpu": [
         "arm64"
       ],
@@ -1290,9 +1298,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.2.tgz",
-      "integrity": "sha512-kMtx1yqJHTmqaqHPAzKCAkDaKsffmXkPHThSfRwZGyuqyIeBvf08KSsYXl+abf5HDAPMJIPnbBfXvP2ZC2TfHg==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",
+      "integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",
       "cpu": [
         "x64"
       ],
@@ -1306,9 +1314,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.2.tgz",
-      "integrity": "sha512-Yaf78O/B3Kkh+nKABUF++bvJv5Ijoy9AN1ww904rOXZFLWVc5OLOfL56W+C8F9xn5JQZa3UX6m+IktJnIb1Jjg==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",
+      "integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",
       "cpu": [
         "arm64"
       ],
@@ -1322,9 +1330,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.2.tgz",
-      "integrity": "sha512-Iuws0kxo4yusk7sw70Xa2E2imZU5HoixzxfGCdxwBdhiDgt9vX9VUCBhqcwY7/uh//78A1hMkkROMJq9l27oLQ==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",
+      "integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",
       "cpu": [
         "ia32"
       ],
@@ -1338,9 +1346,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.2.tgz",
-      "integrity": "sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",
+      "integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",
       "cpu": [
         "x64"
       ],
@@ -1373,16 +1381,6 @@
         "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0"
       }
     },
-    "node_modules/@eslint-community/eslint-plugin-eslint-comments/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.9.1",
       "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
@@ -1440,6 +1438,24 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@eslint/config-array/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/config-array/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@eslint/config-array/node_modules/minimatch": {
       "version": "3.1.5",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
@@ -1504,9 +1520,9 @@
       }
     },
     "node_modules/@eslint/eslintrc/node_modules/ajv": {
-      "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
-      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1520,6 +1536,24 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/globals": {
       "version": "14.0.0",
       "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
@@ -1533,6 +1567,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -1635,29 +1679,43 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -1693,20 +1751,20 @@
       "license": "MIT"
     },
     "node_modules/@iconify/utils": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.0.tgz",
-      "integrity": "sha512-Zlzem1ZXhI1iHeeERabLNzBHdOa4VhQbqAcOQaMKuTuyZCpwKbC2R4Dd0Zo3g9EAc+Y4fiarO8HIHRAth7+skw==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.1.tgz",
+      "integrity": "sha512-MwzoDtw9rO1x+qfgLTV/IVXsHDBqeYZoMIQC8SfxfYSlaSUG+oWiAcoiB1yajAda6mqblm4/1/w2E8tRu7a7Tw==",
       "license": "MIT",
       "dependencies": {
         "@antfu/install-pkg": "^1.1.0",
         "@iconify/types": "^2.0.0",
-        "mlly": "^1.8.0"
+        "mlly": "^1.8.2"
       }
     },
     "node_modules/@img/colour": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.0.0.tgz",
-      "integrity": "sha512-A5P/LfWGFSl6nsckYtjw9da+19jB8hkJ6ACTGcDfEJ0aE+l2n2El7dsVM7UVHZQ9s2lmYMWlrS21YLy2IR1LUw==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
+      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1801,6 +1859,9 @@
         "arm"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1818,6 +1879,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1835,6 +1899,9 @@
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1852,6 +1919,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1869,6 +1939,9 @@
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1886,6 +1959,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1903,6 +1979,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1920,6 +1999,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1937,6 +2019,9 @@
         "arm"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1960,6 +2045,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1983,6 +2071,9 @@
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2006,6 +2097,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2029,6 +2123,9 @@
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2052,6 +2149,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2075,6 +2175,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2098,6 +2201,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2286,13 +2392,13 @@
       }
     },
     "node_modules/@isaacs/cliui/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -2417,9 +2523,9 @@
       "license": "MIT"
     },
     "node_modules/@lezer/common": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.5.0.tgz",
-      "integrity": "sha512-PNGcolp9hr4PJdXR4ix7XtixDrClScvtSCYW3rQG106oVMOOI+jFb+0+J3mbeL/53g1Zd6s0kJzaw6Ri68GmAA==",
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.5.2.tgz",
+      "integrity": "sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ==",
       "license": "MIT"
     },
     "node_modules/@lezer/cpp": {
@@ -2434,9 +2540,9 @@
       }
     },
     "node_modules/@lezer/css": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@lezer/css/-/css-1.3.0.tgz",
-      "integrity": "sha512-pBL7hup88KbI7hXnZV3PQsn43DHy6TWyzuyk2AO9UyoXcDltvIdqWKE1dLL/45JVZ+YZkHe1WVHqO6wugZZWcw==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@lezer/css/-/css-1.3.3.tgz",
+      "integrity": "sha512-RzBo8r+/6QJeow7aPHIpGVIH59xTcJXp399820gZoMo9noQDRVpJLheIBUicYwKcsbOYoBRoLZlf2720dG/4Tg==",
       "license": "MIT",
       "dependencies": {
         "@lezer/common": "^1.2.0",
@@ -2509,9 +2615,9 @@
       }
     },
     "node_modules/@lezer/lr": {
-      "version": "1.4.8",
-      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.8.tgz",
-      "integrity": "sha512-bPWa0Pgx69ylNlMlPvBPryqeLYQjyJjqPx+Aupm5zydLIF3NE+6MMLT8Yi23Bd9cif9VS00aUebn+6fDIGBcDA==",
+      "version": "1.4.10",
+      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.10.tgz",
+      "integrity": "sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A==",
       "license": "MIT",
       "dependencies": {
         "@lezer/common": "^1.0.0"
@@ -2583,9 +2689,9 @@
       }
     },
     "node_modules/@lezer/yaml": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@lezer/yaml/-/yaml-1.0.3.tgz",
-      "integrity": "sha512-GuBLekbw9jDBDhGur82nuwkxKQ+a3W5H0GfaAthDXcAu+XdpS43VlnxA9E9hllkpSP5ellRDKjLLj7Lu9Wr6xA==",
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@lezer/yaml/-/yaml-1.0.4.tgz",
+      "integrity": "sha512-2lrrHqxalACEbxIbsjhqGpSW8kWpUKuY6RHgnSAFZa6qK62wvnPxA8hGOwOoDbwHcOFs5M4o27mjGu+P7TvBmw==",
       "license": "MIT",
       "dependencies": {
         "@lezer/common": "^1.2.0",
@@ -2754,6 +2860,23 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@oxc-project/types": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.127.0.tgz",
+      "integrity": "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "node_modules/@package-json/types": {
+      "version": "0.0.12",
+      "resolved": "https://registry.npmjs.org/@package-json/types/-/types-0.0.12.tgz",
+      "integrity": "sha512-uu43FGU34B5VM9mCNjXCwLaGHYjXdNincqKLaraaCW+7S2+SmiBg1Nv8bPnmschrIfZmfKNY9f3fC376MRrObw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
@@ -2766,13 +2889,13 @@
       }
     },
     "node_modules/@playwright/test": {
-      "version": "1.57.0",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.57.0.tgz",
-      "integrity": "sha512-6TyEnHgd6SArQO8UO2OMTxshln3QMWBtPGrOCgs3wVEmQmwyuNtB10IZMfmYDE0riwNR1cu4q+pPcxMVtaG3TA==",
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.57.0"
+        "playwright": "1.58.2"
       },
       "bin": {
         "playwright": "cli.js"
@@ -2800,10 +2923,304 @@
         "object-assign": "^4.1.1"
       }
     },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-s70pVGhw4zqGeFnXWvAzJDlvxhlRollagdCCKRgOsgUOH3N1l0LIxf83AtGzmb5SiVM4Hjl5HyarMRfdfj3DaQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-4ksWc9n0mhlZpZ9PMZgTGjeOPRu8MB1Z3Tz0Mo02eWfWCHMW1zN82Qz/pL/rC+yQa+8ZnutMF0JjJe7PjwasYw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-SUSDOI6WwUVNcWxd02QEBjLdY1VPHvlEkw6T/8nYG322iYWCTxRb1vzk4E+mWWYehTp7ERibq54LSJGjmouOsw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-hwnz3nw9dbJ05EDO/PvcjaaewqqDy7Y1rn1UO81l8iIK1GjenME75dl16ajbvSSMfv66WXSRCYKIqfgq2KCfxw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.17.tgz",
+      "integrity": "sha512-IS+W7epTcwANmFSQFrS1SivEXHtl1JtuQA9wlxrZTcNi6mx+FDOYrakGevvvTwgj2JvWiK8B29/qD9BELZPyXQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-e6usGaHKW5BMNZOymS1UcEYGowQMWcgZ71Z17Sl/h2+ZziNJ1a9n3Zvcz6LdRyIW5572wBCTH/Z+bKuZouGk9Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.17.tgz",
+      "integrity": "sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.17.tgz",
+      "integrity": "sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.17.tgz",
+      "integrity": "sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.17.tgz",
+      "integrity": "sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.17.tgz",
+      "integrity": "sha512-LEXei6vo0E5wTGwpkJ4KoT3OZJRnglwldt5ziLzOlc6qqb55z4tWNq2A+PFqCJuvWWdP53CVhG1Z9NtToDPJrA==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.17.tgz",
+      "integrity": "sha512-gUmyzBl3SPMa6hrqFUth9sVfcLBlYsbMzBx5PlexMroZStgzGqlZ26pYG89rBb45Mnia+oil6YAIFeEWGWhoZA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.17.tgz",
+      "integrity": "sha512-3hkiolcUAvPB9FLb3UZdfjVVNWherN1f/skkGWJP/fgSQhYUZpSIRr0/I8ZK9TkF3F7kxvJAk0+IcKvPHk9qQg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
     "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.0-beta.53",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.53.tgz",
-      "integrity": "sha512-vENRlFU4YbrwVqNDZ7fLvy+JR1CRkyr01jhSiDpE1u6py3OMzQfztQU2jxykW3ALNxO4kSlqIDeYyD0Y9RcQeQ==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.13.tgz",
+      "integrity": "sha512-3ngTAv6F/Py35BsYbeeLeecvhMKdsKm4AoOETVhAA+Qc8nrA2I0kF7oa93mE9qnIurngOSpMnQ0x2nQY2FPviA==",
       "dev": true,
       "license": "MIT"
     },
@@ -2854,356 +3271,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.56.0.tgz",
-      "integrity": "sha512-LNKIPA5k8PF1+jAFomGe3qN3bbIgJe/IlpDBwuVjrDKrJhVWywgnJvflMt/zkbVNLFtF1+94SljYQS6e99klnw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
-    },
-    "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.56.0.tgz",
-      "integrity": "sha512-lfbVUbelYqXlYiU/HApNMJzT1E87UPGvzveGg2h0ktUNlOCxKlWuJ9jtfvs1sKHdwU4fzY7Pl8sAl49/XaEk6Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
-    },
-    "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.56.0.tgz",
-      "integrity": "sha512-EgxD1ocWfhoD6xSOeEEwyE7tDvwTgZc8Bss7wCWe+uc7wO8G34HHCUH+Q6cHqJubxIAnQzAsyUsClt0yFLu06w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.56.0.tgz",
-      "integrity": "sha512-1vXe1vcMOssb/hOF8iv52A7feWW2xnu+c8BV4t1F//m9QVLTfNVpEdja5ia762j/UEJe2Z1jAmEqZAK42tVW3g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.56.0.tgz",
-      "integrity": "sha512-bof7fbIlvqsyv/DtaXSck4VYQ9lPtoWNFCB/JY4snlFuJREXfZnm+Ej6yaCHfQvofJDXLDMTVxWscVSuQvVWUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.56.0.tgz",
-      "integrity": "sha512-KNa6lYHloW+7lTEkYGa37fpvPq+NKG/EHKM8+G/g9WDU7ls4sMqbVRV78J6LdNuVaeeK5WB9/9VAFbKxcbXKYg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.56.0.tgz",
-      "integrity": "sha512-E8jKK87uOvLrrLN28jnAAAChNq5LeCd2mGgZF+fGF5D507WlG/Noct3lP/QzQ6MrqJ5BCKNwI9ipADB6jyiq2A==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.56.0.tgz",
-      "integrity": "sha512-jQosa5FMYF5Z6prEpTCCmzCXz6eKr/tCBssSmQGEeozA9tkRUty/5Vx06ibaOP9RCrW1Pvb8yp3gvZhHwTDsJw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.56.0.tgz",
-      "integrity": "sha512-uQVoKkrC1KGEV6udrdVahASIsaF8h7iLG0U0W+Xn14ucFwi6uS539PsAr24IEF9/FoDtzMeeJXJIBo5RkbNWvQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.56.0.tgz",
-      "integrity": "sha512-vLZ1yJKLxhQLFKTs42RwTwa6zkGln+bnXc8ueFGMYmBTLfNu58sl5/eXyxRa2RarTkJbXl8TKPgfS6V5ijNqEA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.56.0.tgz",
-      "integrity": "sha512-FWfHOCub564kSE3xJQLLIC/hbKqHSVxy8vY75/YHHzWvbJL7aYJkdgwD/xGfUlL5UV2SB7otapLrcCj2xnF1dg==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.56.0.tgz",
-      "integrity": "sha512-z1EkujxIh7nbrKL1lmIpqFTc/sr0u8Uk0zK/qIEFldbt6EDKWFk/pxFq3gYj4Bjn3aa9eEhYRlL3H8ZbPT1xvA==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.56.0.tgz",
-      "integrity": "sha512-iNFTluqgdoQC7AIE8Q34R3AuPrJGJirj5wMUErxj22deOcY7XwZRaqYmB6ZKFHoVGqRcRd0mqO+845jAibKCkw==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.56.0.tgz",
-      "integrity": "sha512-MtMeFVlD2LIKjp2sE2xM2slq3Zxf9zwVuw0jemsxvh1QOpHSsSzfNOTH9uYW9i1MXFxUSMmLpeVeUzoNOKBaWg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.56.0.tgz",
-      "integrity": "sha512-in+v6wiHdzzVhYKXIk5U74dEZHdKN9KH0Q4ANHOTvyXPG41bajYRsy7a8TPKbYPl34hU7PP7hMVHRvv/5aCSew==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.56.0.tgz",
-      "integrity": "sha512-yni2raKHB8m9NQpI9fPVwN754mn6dHQSbDTwxdr9SE0ks38DTjLMMBjrwvB5+mXrX+C0npX0CVeCUcvvvD8CNQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.56.0.tgz",
-      "integrity": "sha512-zhLLJx9nQPu7wezbxt2ut+CI4YlXi68ndEve16tPc/iwoylWS9B3FxpLS2PkmfYgDQtosah07Mj9E0khc3Y+vQ==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.56.0.tgz",
-      "integrity": "sha512-MVC6UDp16ZSH7x4rtuJPAEoE1RwS8N4oK9DLHy3FTEdFoUTCFVzMfJl/BVJ330C+hx8FfprA5Wqx4FhZXkj2Kw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.56.0.tgz",
-      "integrity": "sha512-ZhGH1eA4Qv0lxaV00azCIS1ChedK0V32952Md3FtnxSqZTBTd6tgil4nZT5cU8B+SIw3PFYkvyR4FKo2oyZIHA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.56.0.tgz",
-      "integrity": "sha512-O16XcmyDeFI9879pEcmtWvD/2nyxR9mF7Gs44lf1vGGx8Vg2DRNx11aVXBEqOQhWb92WN4z7fW/q4+2NYzCbBA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.56.0.tgz",
-      "integrity": "sha512-LhN/Reh+7F3RCgQIRbgw8ZMwUwyqJM+8pXNT6IIJAqm2IdKkzpCh/V9EdgOMBKuebIrzswqy4ATlrDgiOwbRcQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.56.0.tgz",
-      "integrity": "sha512-kbFsOObXp3LBULg1d3JIUQMa9Kv4UitDmpS+k0tinPBz3watcUiV2/LUDMMucA6pZO3WGE27P7DsfaN54l9ing==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.56.0.tgz",
-      "integrity": "sha512-vSSgny54D6P4vf2izbtFm/TcWYedw7f8eBrOiGGecyHyQB9q4Kqentjaj8hToe+995nob/Wv48pDqL5a62EWtg==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.56.0.tgz",
-      "integrity": "sha512-FeCnkPCTHQJFbiGG49KjV5YGW/8b9rrXAM2Mz2kiIoktq2qsJxRD5giEMEOD2lPdgs72upzefaUvS+nc8E3UzQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.56.0.tgz",
-      "integrity": "sha512-H8AE9Ur/t0+1VXujj90w0HrSOuv0Nq9r1vSZF2t5km20NTfosQsGGUXDaKdQZzwuLts7IyL1fYT4hM95TI9c4g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
     "node_modules/@scarf/scarf": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/@scarf/scarf/-/scarf-1.4.0.tgz",
@@ -3212,12 +3279,12 @@
       "license": "Apache-2.0"
     },
     "node_modules/@solid-primitives/refs": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@solid-primitives/refs/-/refs-1.1.2.tgz",
-      "integrity": "sha512-K7tf2thy7L+YJjdqXspXOg5xvNEOH8tgEWsp0+1mQk3obHBRD6hEjYZk7p7FlJphSZImS35je3UfmWuD7MhDfg==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@solid-primitives/refs/-/refs-1.1.3.tgz",
+      "integrity": "sha512-aam02fjNKpBteewF/UliPSQCVJsIIGOLEWQOh+ll6R/QePzBOOBMcC4G+5jTaO75JuUS1d/14Q1YXT3X0Ow6iA==",
       "license": "MIT",
       "dependencies": {
-        "@solid-primitives/utils": "^6.3.2"
+        "@solid-primitives/utils": "^6.4.0"
       },
       "peerDependencies": {
         "solid-js": "^1.6.12"
@@ -3233,9 +3300,9 @@
       }
     },
     "node_modules/@solid-primitives/utils": {
-      "version": "6.3.2",
-      "resolved": "https://registry.npmjs.org/@solid-primitives/utils/-/utils-6.3.2.tgz",
-      "integrity": "sha512-hZ/M/qr25QOCcwDPOHtGjxTD8w2mNyVAYvcfgwzBHq2RwNqHNdDNsMZYap20+ruRwW4A3Cdkczyoz0TSxLCAPQ==",
+      "version": "6.4.0",
+      "resolved": "https://registry.npmjs.org/@solid-primitives/utils/-/utils-6.4.0.tgz",
+      "integrity": "sha512-AeGTBg8Wtkh/0s+evyLtP8piQoS4wyqqQaAFs2HJcFMMjYAtUgo+ZPduRXLjPlqKVc2ejeR544oeqpbn8Egn8A==",
       "license": "MIT",
       "peerDependencies": {
         "solid-js": "^1.6.12"
@@ -3347,9 +3414,9 @@
       }
     },
     "node_modules/@stoplight/spectral-cli": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-cli/-/spectral-cli-6.15.0.tgz",
-      "integrity": "sha512-FVeQIuqQQnnLfa8vy+oatTKUve7uU+3SaaAfdjpX/B+uB1NcfkKRJYhKT9wMEehDRaMPL5AKIRYMCFerdEbIpw==",
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-cli/-/spectral-cli-6.15.1.tgz",
+      "integrity": "sha512-ev72bUglbaZvFSMWCP5o1Iso5NGgbLZOAuedvRxYrUMey9dVCR83i033tSFvDv6cpj86HsbEmiilh8vwrY/asQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3367,7 +3434,7 @@
         "chalk": "4.1.2",
         "fast-glob": "~3.2.12",
         "hpagent": "~1.2.0",
-        "lodash": "~4.17.21",
+        "lodash": "^4.18.1",
         "pony-cause": "^1.1.1",
         "stacktracey": "^2.1.8",
         "tslib": "^2.8.1",
@@ -3411,9 +3478,9 @@
       }
     },
     "node_modules/@stoplight/spectral-core": {
-      "version": "1.20.0",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-core/-/spectral-core-1.20.0.tgz",
-      "integrity": "sha512-5hBP81nCC1zn1hJXL/uxPNRKNcB+/pEIHgCjPRpl/w/qy9yC9ver04tw1W0l/PMiv0UeB5dYgozXVQ4j5a6QQQ==",
+      "version": "1.22.0",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-core/-/spectral-core-1.22.0.tgz",
+      "integrity": "sha512-4hTxMDs4TFUG4/jKjaZttA65gNuV2PCKI9+51I+J4nL6ylo17DlbW+sl6byKnBuV/85HxaV33ri5fEGlp8lTSA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3426,17 +3493,17 @@
         "@stoplight/types": "~13.6.0",
         "@types/es-aggregate-error": "^1.0.2",
         "@types/json-schema": "^7.0.11",
-        "ajv": "^8.17.1",
+        "ajv": "^8.18.0",
         "ajv-errors": "~3.0.0",
         "ajv-formats": "~2.1.1",
         "es-aggregate-error": "^1.0.7",
+        "expr-eval-fork": "^3.0.1",
         "jsonpath-plus": "^10.3.0",
-        "lodash": "~4.17.21",
+        "lodash": "^4.18.1",
         "lodash.topath": "^4.5.2",
-        "minimatch": "3.1.2",
+        "minimatch": "^3.1.4",
         "nimma": "0.2.3",
         "pony-cause": "^1.1.1",
-        "simple-eval": "1.0.1",
         "tslib": "^2.8.1"
       },
       "engines": {
@@ -3457,10 +3524,28 @@
         "node": "^12.20 || >=14.13"
       }
     },
+    "node_modules/@stoplight/spectral-core/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@stoplight/spectral-core/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@stoplight/spectral-core/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -3487,9 +3572,9 @@
       }
     },
     "node_modules/@stoplight/spectral-formatters": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-formatters/-/spectral-formatters-1.5.0.tgz",
-      "integrity": "sha512-lR7s41Z00Mf8TdXBBZQ3oi2uR8wqAtR6NO0KA8Ltk4FSpmAy0i6CKUmJG9hZQjanTnGmwpQkT/WP66p1GY3iXA==",
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-formatters/-/spectral-formatters-1.5.1.tgz",
+      "integrity": "sha512-mGXaiIrPglPokSnbFqbkWN3DoozIbwrZAA6OgqSIl+djeD5+e6PMELg0g6r3ot3ZzntO+6/GXaDnxEQ/p9M/EQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3500,7 +3585,7 @@
         "@types/markdown-escape": "^1.1.3",
         "chalk": "4.1.2",
         "cliui": "7.0.4",
-        "lodash": "^4.17.21",
+        "lodash": "^4.18.1",
         "markdown-escape": "^2.0.0",
         "node-sarif-builder": "^2.0.3",
         "strip-ansi": "6.0",
@@ -3512,9 +3597,9 @@
       }
     },
     "node_modules/@stoplight/spectral-functions": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-functions/-/spectral-functions-1.10.1.tgz",
-      "integrity": "sha512-obu8ZfoHxELOapfGsCJixKZXZcffjg+lSoNuttpmUFuDzVLT3VmH8QkPXfOGOL5Pz80BR35ClNAToDkdnYIURg==",
+      "version": "1.10.2",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-functions/-/spectral-functions-1.10.2.tgz",
+      "integrity": "sha512-PIfPUgTRo8EtAnL1MIrzhHoUuojSaE8shGSMaHS3BxGyc8d079BE5+TqJa1/WLUb9YT9JQnZ0Aj4xfi8NcJOIw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3523,11 +3608,11 @@
         "@stoplight/spectral-core": "^1.19.4",
         "@stoplight/spectral-formats": "^1.8.1",
         "@stoplight/spectral-runtime": "^1.1.2",
-        "ajv": "^8.17.1",
+        "ajv": "^8.18.0",
         "ajv-draft-04": "~1.0.0",
         "ajv-errors": "~3.0.0",
         "ajv-formats": "~2.1.1",
-        "lodash": "~4.17.21",
+        "lodash": "^4.18.1",
         "tslib": "^2.8.1"
       },
       "engines": {
@@ -3582,9 +3667,9 @@
       }
     },
     "node_modules/@stoplight/spectral-ruleset-bundler": {
-      "version": "1.6.3",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-ruleset-bundler/-/spectral-ruleset-bundler-1.6.3.tgz",
-      "integrity": "sha512-AQFRO6OCKg8SZJUupnr3+OzI1LrMieDTEUHsYgmaRpNiDRPvzImE3bzM1KyQg99q58kTQyZ8kpr7sG8Lp94RRA==",
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-ruleset-bundler/-/spectral-ruleset-bundler-1.7.0.tgz",
+      "integrity": "sha512-PpIdj5Wje0T7ktxY8EUzBWLU0+mGGQHznT8nlQxTMnRhWLNYsm6HvSZDXLtMi+86yqvTuf7loJy6JvLBDzHGAA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3601,7 +3686,7 @@
         "@stoplight/types": "^13.6.0",
         "@types/node": "*",
         "pony-cause": "1.1.1",
-        "rollup": "~2.79.2",
+        "rollup": "~2.80.0",
         "tslib": "^2.8.1",
         "validate-npm-package-name": "3.0.0"
       },
@@ -3610,9 +3695,9 @@
       }
     },
     "node_modules/@stoplight/spectral-ruleset-migrator": {
-      "version": "1.11.3",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-ruleset-migrator/-/spectral-ruleset-migrator-1.11.3.tgz",
-      "integrity": "sha512-+9Y1zFxYmSsneT5FPkgS1IlRQs0VgtdMT77f5xf6vzje9ezyhfs7oXwbZOCSZjEJew8iVZBKQtiOFndcBrdtqg==",
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-ruleset-migrator/-/spectral-ruleset-migrator-1.12.0.tgz",
+      "integrity": "sha512-KINmItys8OhdmjudgcIu7siuxQ4hDdbMsTPW/UkXhoiEosiwok1xAyaYLBfckH9zH85TZBkDDbIbsiMoDCIxBw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3624,7 +3709,7 @@
         "@stoplight/types": "^13.6.0",
         "@stoplight/yaml": "~4.2.3",
         "@types/node": "*",
-        "ajv": "^8.17.1",
+        "ajv": "^8.18.0",
         "ast-types": "0.14.2",
         "astring": "^1.9.0",
         "reserved": "0.1.2",
@@ -3659,9 +3744,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/@stoplight/spectral-rulesets": {
-      "version": "1.22.0",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-rulesets/-/spectral-rulesets-1.22.0.tgz",
-      "integrity": "sha512-l2EY2jiKKLsvnPfGy+pXC0LeGsbJzcQP5G/AojHgf+cwN//VYxW1Wvv4WKFx/CLmLxc42mJYF2juwWofjWYNIQ==",
+      "version": "1.22.1",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-rulesets/-/spectral-rulesets-1.22.1.tgz",
+      "integrity": "sha512-DaaQJioKuYkRsOuKIJfX2ek7G7f6OCU3CI3K7ABaOcTFMiHj29SJLDdb04mCjXZFXMlXHjmCl2ZpKW6heieXpw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3674,11 +3759,11 @@
         "@stoplight/spectral-runtime": "^1.1.2",
         "@stoplight/types": "^13.6.0",
         "@types/json-schema": "^7.0.7",
-        "ajv": "^8.17.1",
+        "ajv": "^8.18.0",
         "ajv-formats": "~2.1.1",
         "json-schema-traverse": "^1.0.0",
         "leven": "3.1.0",
-        "lodash": "~4.17.21",
+        "lodash": "^4.18.1",
         "tslib": "^2.8.1"
       },
       "engines": {
@@ -3686,9 +3771,9 @@
       }
     },
     "node_modules/@stoplight/spectral-runtime": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@stoplight/spectral-runtime/-/spectral-runtime-1.1.4.tgz",
-      "integrity": "sha512-YHbhX3dqW0do6DhiPSgSGQzr6yQLlWybhKwWx0cqxjMwxej3TqLv3BXMfIUYFKKUqIwH4Q2mV8rrMM8qD2N0rQ==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@stoplight/spectral-runtime/-/spectral-runtime-1.1.5.tgz",
+      "integrity": "sha512-6/HSCQBKnI4M5qonCKos2W7oggXv+U/ml+m/cAd4eJAYfIVEmaLUo03qSWIIl4cBc5ujJPmn2WnCiRrz1++P7Q==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3696,7 +3781,7 @@
         "@stoplight/path": "^1.3.2",
         "@stoplight/types": "^13.6.0",
         "abort-controller": "^3.0.0",
-        "lodash": "^4.17.21",
+        "lodash": "^4.18.1",
         "node-fetch": "^2.7.0",
         "tslib": "^2.8.1"
       },
@@ -3777,9 +3862,9 @@
       }
     },
     "node_modules/@stylistic/eslint-plugin/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4102,9 +4187,9 @@
       }
     },
     "node_modules/@types/debug": {
-      "version": "4.1.12",
-      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
-      "integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==",
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4200,12 +4285,12 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "20.19.30",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.30.tgz",
-      "integrity": "sha512-WJtwWJu7UdlvzEAUm484QNg5eAoq5QR08KDNx7g45Usrs2NtOPiX8ugDqmKdXkyL03rBqU5dYNYVQetEpBHq2g==",
+      "version": "25.6.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.0.tgz",
+      "integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~6.21.0"
+        "undici-types": "~7.19.0"
       }
     },
     "node_modules/@types/sarif": {
@@ -4262,20 +4347,20 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.56.1.tgz",
-      "integrity": "sha512-Jz9ZztpB37dNC+HU2HI28Bs9QXpzCz+y/twHOwhyrIRdbuVDxSytJNDl6z/aAKlaRIwC7y8wJdkBv7FxYGgi0A==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.58.0.tgz",
+      "integrity": "sha512-RLkVSiNuUP1C2ROIWfqX+YcUfLaSnxGE/8M+Y57lopVwg9VTYYfhuz15Yf1IzCKgZj6/rIbYTmJCUSqr76r0Wg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/type-utils": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
+        "@typescript-eslint/scope-manager": "8.58.0",
+        "@typescript-eslint/type-utils": "8.58.0",
+        "@typescript-eslint/utils": "8.58.0",
+        "@typescript-eslint/visitor-keys": "8.58.0",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
-        "ts-api-utils": "^2.4.0"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4285,32 +4370,22 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.56.1",
+        "@typescript-eslint/parser": "^8.58.0",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.56.1.tgz",
-      "integrity": "sha512-klQbnPAAiGYFyI02+znpBRLyjL4/BrBd0nyWkdC0s/6xFLkXYQ8OoRrSkqacS1ddVxf/LDyODIKbQ5TgKAf/Fg==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.58.0.tgz",
+      "integrity": "sha512-rLoGZIf9afaRBYsPUMtvkDWykwXwUPL60HebR4JgTI8mxfFe2cQTu3AGitANp4b9B2QlVru6WzjgB2IzJKiCSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
+        "@typescript-eslint/scope-manager": "8.58.0",
+        "@typescript-eslint/types": "8.58.0",
+        "@typescript-eslint/typescript-estree": "8.58.0",
+        "@typescript-eslint/visitor-keys": "8.58.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -4322,18 +4397,18 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.56.1.tgz",
-      "integrity": "sha512-TAdqQTzHNNvlVFfR+hu2PDJrURiwKsUvxFn1M0h95BB8ah5jejas08jUWG4dBA68jDMI988IvtfdAI53JzEHOQ==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.58.0.tgz",
+      "integrity": "sha512-8Q/wBPWLQP1j16NxoPNIKpDZFMaxl7yWIoqXWYeWO+Bbd2mjgvoF0dxP2jKZg5+x49rgKdf7Ck473M8PC3V9lg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.56.1",
-        "@typescript-eslint/types": "^8.56.1",
+        "@typescript-eslint/tsconfig-utils": "^8.58.0",
+        "@typescript-eslint/types": "^8.58.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -4344,18 +4419,18 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.56.1.tgz",
-      "integrity": "sha512-YAi4VDKcIZp0O4tz/haYKhmIDZFEUPOreKbfdAN3SzUDMcPhJ8QI99xQXqX+HoUVq8cs85eRKnD+rne2UAnj2w==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.58.0.tgz",
+      "integrity": "sha512-W1Lur1oF50FxSnNdGp3Vs6P+yBRSmZiw4IIjEeYxd8UQJwhUF0gDgDD/W/Tgmh73mxgEU3qX0Bzdl/NGuSPEpQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1"
+        "@typescript-eslint/types": "8.58.0",
+        "@typescript-eslint/visitor-keys": "8.58.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4366,9 +4441,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.56.1.tgz",
-      "integrity": "sha512-qOtCYzKEeyr3aR9f28mPJqBty7+DBqsdd63eO0yyDwc6vgThj2UjWfJIcsFeSucYydqcuudMOprZ+x1SpF3ZuQ==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.58.0.tgz",
+      "integrity": "sha512-doNSZEVJsWEu4htiVC+PR6NpM+pa+a4ClH9INRWOWCUzMst/VA9c4gXq92F8GUD1rwhNvRLkgjfYtFXegXQF7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4379,21 +4454,21 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.56.1.tgz",
-      "integrity": "sha512-yB/7dxi7MgTtGhZdaHCemf7PuwrHMenHjmzgUW1aJpO+bBU43OycnM3Wn+DdvDO/8zzA9HlhaJ0AUGuvri4oGg==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.58.0.tgz",
+      "integrity": "sha512-aGsCQImkDIqMyx1u4PrVlbi/krmDsQUs4zAcCV6M7yPcPev+RqVlndsJy9kJ8TLihW9TZ0kbDAzctpLn5o+lOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1",
+        "@typescript-eslint/types": "8.58.0",
+        "@typescript-eslint/typescript-estree": "8.58.0",
+        "@typescript-eslint/utils": "8.58.0",
         "debug": "^4.4.3",
-        "ts-api-utils": "^2.4.0"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4404,13 +4479,13 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.56.1.tgz",
-      "integrity": "sha512-dbMkdIUkIkchgGDIv7KLUpa0Mda4IYjo4IAMJUZ+3xNoUXxMsk9YtKpTHSChRS85o+H9ftm51gsK1dZReY9CVw==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.58.0.tgz",
+      "integrity": "sha512-O9CjxypDT89fbHxRfETNoAnHj/i6IpRK0CvbVN3qibxlLdo5p5hcLmUuCCrHMpxiWSwKyI8mCP7qRNYuOJ0Uww==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4422,21 +4497,21 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.56.1.tgz",
-      "integrity": "sha512-qzUL1qgalIvKWAf9C1HpvBjif+Vm6rcT5wZd4VoMb9+Km3iS3Cv9DY6dMRMDtPnwRAFyAi7YXJpTIEXLvdfPxg==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.58.0.tgz",
+      "integrity": "sha512-7vv5UWbHqew/dvs+D3e1RvLv1v2eeZ9txRHPnEEBUgSNLx5ghdzjHa0sgLWYVKssH+lYmV0JaWdoubo0ncGYLA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.56.1",
-        "@typescript-eslint/tsconfig-utils": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
+        "@typescript-eslint/project-service": "8.58.0",
+        "@typescript-eslint/tsconfig-utils": "8.58.0",
+        "@typescript-eslint/types": "8.58.0",
+        "@typescript-eslint/visitor-keys": "8.58.0",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
         "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.4.0"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4446,20 +4521,20 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.56.1.tgz",
-      "integrity": "sha512-HPAVNIME3tABJ61siYlHzSWCGtOoeP2RTIaHXFMPqjrQKCGB9OgUVdiNgH7TJS2JNIQ5qQ4RsAUDuGaGme/KOA==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.58.0.tgz",
+      "integrity": "sha512-RfeSqcFeHMHlAWzt4TBjWOAtoW9lnsAGiP3GbaX9uVgTYYrMbVnGONEfUCiSss+xMHFl+eHZiipmA8WkQ7FuNA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1"
+        "@typescript-eslint/scope-manager": "8.58.0",
+        "@typescript-eslint/types": "8.58.0",
+        "@typescript-eslint/typescript-estree": "8.58.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4470,17 +4545,17 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.56.1.tgz",
-      "integrity": "sha512-KiROIzYdEV85YygXw6BI/Dx4fnBlFQu6Mq4QE4MOH9fFnhohw6wX/OAvDY2/C+ut0I3RSPKenvZJIVYqJNkhEw==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.58.0.tgz",
+      "integrity": "sha512-XJ9UD9+bbDo4a4epraTwG3TsNPeiB9aShrUneAVXy8q4LuwowN+qu89/6ByLMINqvIMeI9H9hOHQtg/ijrYXzQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
+        "@typescript-eslint/types": "8.58.0",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -4610,6 +4685,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4624,6 +4702,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4638,6 +4719,9 @@
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4652,6 +4736,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4666,6 +4753,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4680,6 +4770,9 @@
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4694,6 +4787,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4708,6 +4804,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4784,46 +4883,46 @@
       }
     },
     "node_modules/@vitejs/plugin-vue": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-6.0.3.tgz",
-      "integrity": "sha512-TlGPkLFLVOY3T7fZrwdvKpjprR3s4fxRln0ORDo1VQ7HHyxJwTlrjKU3kpVWTlaAjIEuCTokmjkZnr8Tpc925w==",
+      "version": "6.0.6",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-6.0.6.tgz",
+      "integrity": "sha512-u9HHgfrq3AjXlysn0eINFnWQOJQLO9WN6VprZ8FXl7A2bYisv3Hui9Ij+7QZ41F/WYWarHjwBbXtD7dKg3uxbg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rolldown/pluginutils": "1.0.0-beta.53"
+        "@rolldown/pluginutils": "1.0.0-rc.13"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
       },
       "peerDependencies": {
-        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0",
         "vue": "^3.2.25"
       }
     },
     "node_modules/@vitest/coverage-v8": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.0.18.tgz",
-      "integrity": "sha512-7i+N2i0+ME+2JFZhfuz7Tg/FqKtilHjGyGvoHYQ6iLV0zahbsJ9sljC9OcFcPDbhYKCet+sG8SsVqlyGvPflZg==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.2.tgz",
+      "integrity": "sha512-sPK//PHO+kAkScb8XITeB1bf7fsk85Km7+rt4eeuRR3VS1/crD47cmV5wicisJmjNdfeokTZwjMk4Mj2d58Mgg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^1.0.2",
-        "@vitest/utils": "4.0.18",
-        "ast-v8-to-istanbul": "^0.3.10",
+        "@vitest/utils": "4.1.2",
+        "ast-v8-to-istanbul": "^1.0.0",
         "istanbul-lib-coverage": "^3.2.2",
         "istanbul-lib-report": "^3.0.1",
         "istanbul-reports": "^3.2.0",
-        "magicast": "^0.5.1",
+        "magicast": "^0.5.2",
         "obug": "^2.1.1",
-        "std-env": "^3.10.0",
-        "tinyrainbow": "^3.0.3"
+        "std-env": "^4.0.0-rc.1",
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@vitest/browser": "4.0.18",
-        "vitest": "4.0.18"
+        "@vitest/browser": "4.1.2",
+        "vitest": "4.1.2"
       },
       "peerDependenciesMeta": {
         "@vitest/browser": {
@@ -4832,9 +4931,9 @@
       }
     },
     "node_modules/@vitest/eslint-plugin": {
-      "version": "1.6.9",
-      "resolved": "https://registry.npmjs.org/@vitest/eslint-plugin/-/eslint-plugin-1.6.9.tgz",
-      "integrity": "sha512-9WfPx1OwJ19QLCSRLkqVO7//1WcWnK3fE/3fJhKMAmDe8+9G4rB47xCNIIeCq3FdEzkIoLTfDlwDlPBaUTMhow==",
+      "version": "1.6.13",
+      "resolved": "https://registry.npmjs.org/@vitest/eslint-plugin/-/eslint-plugin-1.6.13.tgz",
+      "integrity": "sha512-ui7JGWBoQpS5NKKW0FDb1eTuFEZ5EupEv2Psemuyfba7DfA5K52SeDLelt6P4pQJJ/4UGkker/BgMk/KrjH3WQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4845,11 +4944,15 @@
         "node": ">=18"
       },
       "peerDependencies": {
+        "@typescript-eslint/eslint-plugin": "*",
         "eslint": ">=8.57.0",
         "typescript": ">=5.0.0",
         "vitest": "*"
       },
       "peerDependenciesMeta": {
+        "@typescript-eslint/eslint-plugin": {
+          "optional": true
+        },
         "typescript": {
           "optional": true
         },
@@ -4859,31 +4962,31 @@
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz",
-      "integrity": "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.2.tgz",
+      "integrity": "sha512-gbu+7B0YgUJ2nkdsRJrFFW6X7NTP44WlhiclHniUhxADQJH5Szt9mZ9hWnJPJ8YwOK5zUOSSlSvyzRf0u1DSBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.0.18",
-        "@vitest/utils": "4.0.18",
-        "chai": "^6.2.1",
-        "tinyrainbow": "^3.0.3"
+        "@vitest/spy": "4.1.2",
+        "@vitest/utils": "4.1.2",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.0.18.tgz",
-      "integrity": "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.2.tgz",
+      "integrity": "sha512-Ize4iQtEALHDttPRCmN+FKqOl2vxTiNUhzobQFFt/BM1lRUTG7zRCLOykG/6Vo4E4hnUdfVLo5/eqKPukcWW7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.0.18",
+        "@vitest/spy": "4.1.2",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -4892,7 +4995,7 @@
       },
       "peerDependencies": {
         "msw": "^2.4.9",
-        "vite": "^6.0.0 || ^7.0.0-0"
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
         "msw": {
@@ -4931,26 +5034,26 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.0.18.tgz",
-      "integrity": "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.2.tgz",
+      "integrity": "sha512-dwQga8aejqeuB+TvXCMzSQemvV9hNEtDDpgUKDzOmNQayl2OG241PSWeJwKRH3CiC+sESrmoFd49rfnq7T4RnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tinyrainbow": "^3.0.3"
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.0.18.tgz",
-      "integrity": "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.2.tgz",
+      "integrity": "sha512-Gr+FQan34CdiYAwpGJmQG8PgkyFVmARK8/xSijia3eTFgVfpcpztWLuP6FttGNfPLJhaZVP/euvujeNYar36OQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.0.18",
+        "@vitest/utils": "4.1.2",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -4958,13 +5061,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.0.18.tgz",
-      "integrity": "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.2.tgz",
+      "integrity": "sha512-g7yfUmxYS4mNxk31qbOYsSt2F4m1E02LFqO53Xpzg3zKMhLAPZAjjfyl9e6z7HrW6LvUdTwAQR3HHfLjpko16A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.0.18",
+        "@vitest/pretty-format": "4.1.2",
+        "@vitest/utils": "4.1.2",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -4983,9 +5087,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.0.18.tgz",
-      "integrity": "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.2.tgz",
+      "integrity": "sha512-DU4fBnbVCJGNBwVA6xSToNXrkZNSiw59H8tcuUspVMsBDBST4nfvsPsEHDHGtWRRnqBERBQu7TrTKskmjqTXKA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -4993,68 +5097,57 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.0.18.tgz",
-      "integrity": "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.2.tgz",
+      "integrity": "sha512-xw2/TiX82lQHA06cgbqRKFb5lCAy3axQ4H4SoUFhUsg+wztiet+co86IAMDtF6Vm1hc7J6j09oh/rgDn+JdKIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.0.18",
-        "tinyrainbow": "^3.0.3"
+        "@vitest/pretty-format": "4.1.2",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vue/compiler-core": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.28.tgz",
-      "integrity": "sha512-kviccYxTgoE8n6OCw96BNdYlBg2GOWfBuOW4Vqwrt7mSKWKwFVvI8egdTltqRgITGPsTFYtKYfxIG8ptX2PJHQ==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.33.tgz",
+      "integrity": "sha512-3PZLQwFw4Za3TC8t0FvTy3wI16Kt+pmwcgNZca4Pj9iWL2E72a/gZlpBtAJvEdDMdCxdG/qq0C7PN0bsJuv0Rw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@vue/shared": "3.5.28",
+        "@babel/parser": "^7.29.2",
+        "@vue/shared": "3.5.33",
         "entities": "^7.0.1",
         "estree-walker": "^2.0.2",
         "source-map-js": "^1.2.1"
       }
     },
-    "node_modules/@vue/compiler-core/node_modules/entities": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
-      "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.12"
-      },
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
     "node_modules/@vue/compiler-dom": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.28.tgz",
-      "integrity": "sha512-/1ZepxAb159jKR1btkefDP+J2xuWL5V3WtleRmxaT+K2Aqiek/Ab/+Ebrw2pPj0sdHO8ViAyyJWfhXXOP/+LQA==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.33.tgz",
+      "integrity": "sha512-PXq0yrfCLzzL07rbXO4awtXY1Z06LG2eu6Adg3RJFa/j3Cii217XxxLXG22N330gw7GmALCY0Z8RgXEviwgpjA==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-core": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/compiler-core": "3.5.33",
+        "@vue/shared": "3.5.33"
       }
     },
     "node_modules/@vue/compiler-sfc": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.28.tgz",
-      "integrity": "sha512-6TnKMiNkd6u6VeVDhZn/07KhEZuBSn43Wd2No5zaP5s3xm8IqFTHBj84HJah4UepSUJTro5SoqqlOY22FKY96g==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.33.tgz",
+      "integrity": "sha512-UTUvRO9cY+rROrx/pvN9P5Z7FgA6QGfokUCfhQE4EnmUj3rVnK+CHI0LsEO1pg+I7//iRYMUfcNcCPe7tg0CoA==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@vue/compiler-core": "3.5.28",
-        "@vue/compiler-dom": "3.5.28",
-        "@vue/compiler-ssr": "3.5.28",
-        "@vue/shared": "3.5.28",
+        "@babel/parser": "^7.29.2",
+        "@vue/compiler-core": "3.5.33",
+        "@vue/compiler-dom": "3.5.33",
+        "@vue/compiler-ssr": "3.5.33",
+        "@vue/shared": "3.5.33",
         "estree-walker": "^2.0.2",
         "magic-string": "^0.30.21",
-        "postcss": "^8.5.6",
+        "postcss": "^8.5.10",
         "source-map-js": "^1.2.1"
       }
     },
@@ -5068,74 +5161,84 @@
       }
     },
     "node_modules/@vue/compiler-ssr": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.28.tgz",
-      "integrity": "sha512-JCq//9w1qmC6UGLWJX7RXzrGpKkroubey/ZFqTpvEIDJEKGgntuDMqkuWiZvzTzTA5h2qZvFBFHY7fAAa9475g==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.33.tgz",
+      "integrity": "sha512-IErjYdnj1qIupG5xxiVIYiiRvDhGWV4zuh/RCrwfYpuL+HWQzeU6lCk/nF9r7olWMnjKxCAkOctT2qFWFkzb1A==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-dom": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/compiler-dom": "3.5.33",
+        "@vue/shared": "3.5.33"
       }
     },
     "node_modules/@vue/reactivity": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.28.tgz",
-      "integrity": "sha512-gr5hEsxvn+RNyu9/9o1WtdYdwDjg5FgjUSBEkZWqgTKlo/fvwZ2+8W6AfKsc9YN2k/+iHYdS9vZYAhpi10kNaw==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.33.tgz",
+      "integrity": "sha512-p8UfIqyIhb0rYGlSgSBV+lPhF2iUSBcRy7enhTmPqKWadHy9kcOFYF1AejYBP9P+avnd3OBbD49DU4pLWX/94A==",
       "license": "MIT",
       "dependencies": {
-        "@vue/shared": "3.5.28"
+        "@vue/shared": "3.5.33"
       }
     },
     "node_modules/@vue/runtime-core": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.28.tgz",
-      "integrity": "sha512-POVHTdbgnrBBIpnbYU4y7pOMNlPn2QVxVzkvEA2pEgvzbelQq4ZOUxbp2oiyo+BOtiYlm8Q44wShHJoBvDPAjQ==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.33.tgz",
+      "integrity": "sha512-UpFF45RI9//a7rvq7RdOQblb4tup7hHG9QsmIrxkFQLzQ7R8/iNQ5LE15NhLZ1/WcHMU2b47u6P33CPUelHyIQ==",
       "license": "MIT",
       "dependencies": {
-        "@vue/reactivity": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/reactivity": "3.5.33",
+        "@vue/shared": "3.5.33"
       }
     },
     "node_modules/@vue/runtime-dom": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.28.tgz",
-      "integrity": "sha512-4SXxSF8SXYMuhAIkT+eBRqOkWEfPu6nhccrzrkioA6l0boiq7sp18HCOov9qWJA5HML61kW8p/cB4MmBiG9dSA==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.33.tgz",
+      "integrity": "sha512-IOxMsAOwquhfITgmOgaPYl7/j8gKUxUFoflRc+u4LxyD3+783xne8vNta1PONVCvCV9A0w7hkyEepINDqfO0tw==",
       "license": "MIT",
       "dependencies": {
-        "@vue/reactivity": "3.5.28",
-        "@vue/runtime-core": "3.5.28",
-        "@vue/shared": "3.5.28",
+        "@vue/reactivity": "3.5.33",
+        "@vue/runtime-core": "3.5.33",
+        "@vue/shared": "3.5.33",
         "csstype": "^3.2.3"
       }
     },
     "node_modules/@vue/server-renderer": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.28.tgz",
-      "integrity": "sha512-pf+5ECKGj8fX95bNincbzJ6yp6nyzuLDhYZCeFxUNp8EBrQpPpQaLX3nNCp49+UbgbPun3CeVE+5CXVV1Xydfg==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.33.tgz",
+      "integrity": "sha512-0xylq/8/h44lVG0pZFknv1XIdEgymq2E9n59uTWJBG+dIgiT0TMCSsxrN7nO16Z0MU0MPjFcguBbZV8Itk52Hw==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-ssr": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/compiler-ssr": "3.5.33",
+        "@vue/shared": "3.5.33"
       },
       "peerDependencies": {
-        "vue": "3.5.28"
+        "vue": "3.5.33"
       }
     },
     "node_modules/@vue/shared": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.28.tgz",
-      "integrity": "sha512-cfWa1fCGBxrvaHRhvV3Is0MgmrbSCxYTXCSCau2I0a1Xw1N1pHAvkWCiXPRAqjvToILvguNyEwjevUqAuBQWvQ==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.33.tgz",
+      "integrity": "sha512-5vR2QIlmaLG77Ygd4pMP6+SGQ5yox9VhtnbDWTy9DzMzdmeLxZ1QqxrywEZ9sa1AVubfIJyaCG3ytyWU81ufcQ==",
       "license": "MIT"
     },
     "node_modules/@vue/test-utils": {
-      "version": "2.4.6",
-      "resolved": "https://registry.npmjs.org/@vue/test-utils/-/test-utils-2.4.6.tgz",
-      "integrity": "sha512-FMxEjOpYNYiFe0GkaHsnJPXFHxQ6m4t8vI/ElPGpMWxZKpmRvQ33OIrvRXemy6yha03RxhOlQuy+gZMC3CQSow==",
+      "version": "2.4.9",
+      "resolved": "https://registry.npmjs.org/@vue/test-utils/-/test-utils-2.4.9.tgz",
+      "integrity": "sha512-YwgowiO1mPleZqpgAGfxvWu/A5A8nkLrbyH2SqiQRkyzCIaDzzo27/2uS/F1g7fRLvl8BUY0+Sr1eC+6+IHfrw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "js-beautify": "^1.14.9",
-        "vue-component-type-helpers": "^2.0.0"
+        "vue-component-type-helpers": "^3.0.0"
+      },
+      "peerDependencies": {
+        "@vue/compiler-dom": "3.x",
+        "@vue/server-renderer": "3.x",
+        "vue": "3.x"
+      },
+      "peerDependenciesMeta": {
+        "@vue/server-renderer": {
+          "optional": true
+        }
       }
     },
     "node_modules/@webassemblyjs/ast": {
@@ -5284,50 +5387,6 @@
         "@xtuc/long": "4.2.2"
       }
     },
-    "node_modules/@webpack-cli/configtest": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@webpack-cli/configtest/-/configtest-3.0.1.tgz",
-      "integrity": "sha512-u8d0pJ5YFgneF/GuvEiDA61Tf1VDomHHYMjv/wc9XzYj7nopltpG96nXN5dJRstxZhcNpV1g+nT6CydO7pHbjA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.12.0"
-      },
-      "peerDependencies": {
-        "webpack": "^5.82.0",
-        "webpack-cli": "6.x.x"
-      }
-    },
-    "node_modules/@webpack-cli/info": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@webpack-cli/info/-/info-3.0.1.tgz",
-      "integrity": "sha512-coEmDzc2u/ffMvuW9aCjoRzNSPDl/XLuhPdlFRpT9tZHmJ/039az33CE7uH+8s0uL1j5ZNtfdv0HkfaKRBGJsQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.12.0"
-      },
-      "peerDependencies": {
-        "webpack": "^5.82.0",
-        "webpack-cli": "6.x.x"
-      }
-    },
-    "node_modules/@webpack-cli/serve": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@webpack-cli/serve/-/serve-3.0.1.tgz",
-      "integrity": "sha512-sbgw03xQaCLiT6gcY/6u3qBDn01CWw/nbaXl3gTdTFuJJ75Gffv3E3DBpgvY2fkkrdS1fpjaXNOmJlnbtKauKg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.12.0"
-      },
-      "peerDependencies": {
-        "webpack": "^5.82.0",
-        "webpack-cli": "6.x.x"
-      },
-      "peerDependenciesMeta": {
-        "webpack-dev-server": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@xtuc/ieee754": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
@@ -5398,9 +5457,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -5636,15 +5695,15 @@
       }
     },
     "node_modules/ast-v8-to-istanbul": {
-      "version": "0.3.10",
-      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-0.3.10.tgz",
-      "integrity": "sha512-p4K7vMz2ZSk3wN8l5o3y2bJAoZXT3VuJI5OLTATY/01CYWumWvwkUw0SqDBnNq6IiTO3qDa1eSQDibAV8g7XOQ==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.0.tgz",
+      "integrity": "sha512-1fSfIwuDICFA4LKkCzRPO7F0hzFf0B7+Xqrl27ynQaa+Rh0e1Es0v6kWHPott3lU10AyAr7oKHa65OppjLn3Rg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.31",
         "estree-walker": "^3.0.3",
-        "js-tokens": "^9.0.1"
+        "js-tokens": "^10.0.0"
       }
     },
     "node_modules/ast-v8-to-istanbul/node_modules/@types/estree": {
@@ -5724,9 +5783,9 @@
       }
     },
     "node_modules/axe-core": {
-      "version": "4.11.1",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.11.1.tgz",
-      "integrity": "sha512-BASOg+YwO2C+346x3LZOeoovTIoTrRqEsqMa6fmfAV0P+U9mFr9NsyOEpiYvFjbc64NMrSswhV50WdXzdb/Z5A==",
+      "version": "4.11.4",
+      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.11.4.tgz",
+      "integrity": "sha512-KunSNx+TVpkAw/6ULfhnx+HWRecjqZGTOyquAoWHYLRSdK1tB5Ihce1ZW+UY3fj33bYAFWPu7W/GRSmmrCGuxA==",
       "dev": true,
       "license": "MPL-2.0",
       "engines": {
@@ -5734,11 +5793,13 @@
       }
     },
     "node_modules/balanced-match": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-2.0.0.tgz",
-      "integrity": "sha512-1ugUSr8BHXRnK23KfuYS+gVMC3LB8QGH9W1iGtDPsNWoQbgtXSExkBu2aDR4epiGWZOjZsj6lDl/N/AqqTC3UA==",
-      "dev": true,
-      "license": "MIT"
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
     },
     "node_modules/base64-js": {
       "version": "1.5.1",
@@ -5761,12 +5822,15 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.18",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.18.tgz",
-      "integrity": "sha512-e23vBV1ZLfjb9apvfPk4rHVu2ry6RIr2Wfs+O324okSidrX7pTAnEJPCh/O5BtRlr7QtZI7ktOP3vsqr7Z5XoA==",
+      "version": "2.10.27",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.27.tgz",
+      "integrity": "sha512-zEs/ufmZoUd7WftKpKyXaT6RFxpQ5Qm9xytKRHvJfxFV9DFJkZph9RvJ1LcOUi0Z1ZVijMte65JbILeV+8QQEA==",
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/big.js": {
@@ -5798,23 +5862,17 @@
       "license": "ISC"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
-      "dev": true,
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/brace-expansion/node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/braces": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
@@ -5828,9 +5886,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "version": "4.28.2",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
+      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
       "funding": [
         {
           "type": "opencollective",
@@ -5847,11 +5905,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.9.0",
-        "caniuse-lite": "^1.0.30001759",
-        "electron-to-chromium": "^1.5.263",
-        "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.2.0"
+        "baseline-browser-mapping": "^2.10.12",
+        "caniuse-lite": "^1.0.30001782",
+        "electron-to-chromium": "^1.5.328",
+        "node-releases": "^2.0.36",
+        "update-browserslist-db": "^1.2.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -5921,17 +5979,17 @@
       }
     },
     "node_modules/cacheable": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.3.2.tgz",
-      "integrity": "sha512-w+ZuRNmex9c1TR9RcsxbfTKCjSL0rh1WA5SABbrWprIHeNBdmyQLSYonlDy9gpD+63XT8DgZ/wNh1Smvc9WnJA==",
+      "version": "2.3.4",
+      "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.3.4.tgz",
+      "integrity": "sha512-djgxybDbw9fL/ZWMI3+CE8ZilNxcwFkVtDc1gJ+IlOSSWkSMPQabhV/XCHTQ6pwwN6aivXPZ43omTooZiX06Ew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@cacheable/memory": "^2.0.7",
-        "@cacheable/utils": "^2.3.3",
+        "@cacheable/memory": "^2.0.8",
+        "@cacheable/utils": "^2.4.0",
         "hookified": "^1.15.0",
-        "keyv": "^5.5.5",
-        "qified": "^0.6.0"
+        "keyv": "^5.6.0",
+        "qified": "^0.9.0"
       }
     },
     "node_modules/cacheable/node_modules/keyv": {
@@ -5945,15 +6003,15 @@
       }
     },
     "node_modules/call-bind": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
-      "integrity": "sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.9.tgz",
+      "integrity": "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "call-bind-apply-helpers": "^1.0.0",
-        "es-define-property": "^1.0.0",
-        "get-intrinsic": "^1.2.4",
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "get-intrinsic": "^1.3.0",
         "set-function-length": "^1.2.2"
       },
       "engines": {
@@ -6013,9 +6071,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001766",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001766.tgz",
-      "integrity": "sha512-4C0lfJ0/YPjJQHagaE9x2Elb69CIqEPZeG0anQt9SIvIoOH4a4uaRl73IavyO+0qZh6MDLH//DrXThEYKHkmYA==",
+      "version": "1.0.30001791",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001791.tgz",
+      "integrity": "sha512-yk0l/YSrOnFZk3UROpDLQD9+kC1l4meK/wed583AXrzoarMGJcbRi2Q4RaUYbKxYAsZ8sWmaSa/DsLmdBeI1vQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -6182,9 +6240,9 @@
       }
     },
     "node_modules/ci-info": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
-      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
+      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
       "dev": true,
       "funding": [
         {
@@ -6221,9 +6279,9 @@
       }
     },
     "node_modules/clippie": {
-      "version": "4.1.10",
-      "resolved": "https://registry.npmjs.org/clippie/-/clippie-4.1.10.tgz",
-      "integrity": "sha512-zUjK2fLH8/wju2lks5mH0u8wSRYCOJoHfT1KQ61+aCT5O1ouONnSrnKQ3BTKvIYLUYJarbLZo4FLHyce/SLF2g==",
+      "version": "4.1.15",
+      "resolved": "https://registry.npmjs.org/clippie/-/clippie-4.1.15.tgz",
+      "integrity": "sha512-K4z5MF32z7Gr1fUcfuUZvmrzpdNs5q8zAm2yqsWhA8mZ9Q6GL4HNdR2k3h3ubEEEGoyb8fvMA48LDr2MKYDASA==",
       "license": "BSD-2-Clause"
     },
     "node_modules/cliui": {
@@ -6283,9 +6341,9 @@
       }
     },
     "node_modules/codemirror": {
-      "version": "5.65.20",
-      "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-5.65.20.tgz",
-      "integrity": "sha512-i5dLDDxwkFCbhjvL2pNjShsojoL3XHyDwsGv1jqETUoW+lzpBKKqNTUWgQwVAOa0tUm4BwekT455ujafi8payA==",
+      "version": "5.65.21",
+      "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-5.65.21.tgz",
+      "integrity": "sha512-6teYk0bA0nR3QP0ihGMoxuKzpl5W80FpnHpBJpgy66NK3cZv5b/d/HY8PnRvfSsCG1MTfr92u2WUl+wT0E40mQ==",
       "license": "MIT"
     },
     "node_modules/codemirror-spell-checker": {
@@ -6322,12 +6380,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/colorette": {
-      "version": "2.0.20",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
-      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
-      "license": "MIT"
-    },
     "node_modules/commander": {
       "version": "10.0.1",
       "resolved": "https://registry.npmjs.org/commander/-/commander-10.0.1.tgz",
@@ -6339,9 +6391,9 @@
       }
     },
     "node_modules/comment-parser": {
-      "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.5.tgz",
-      "integrity": "sha512-aRDkn3uyIlCFfk5NUA+VdwMmMsh8JGhc4hapfV4yxymHGQ3BVskMQfoXGpCo5IoBuQ9tS5iiVKhCpTcB4pW4qw==",
+      "version": "1.4.6",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.6.tgz",
+      "integrity": "sha512-ObxuY6vnbWTN6Od72xfwN9DbzC7Y2vv8u1Soi9ahRKL37gb6y1qk6/dgjs+3JWuXJHWvsg3BXIwzd/rkmAwavg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6379,10 +6431,17 @@
         "proto-list": "~1.2.1"
       }
     },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/core-js-compat": {
-      "version": "3.48.0",
-      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.48.0.tgz",
-      "integrity": "sha512-OM4cAF3D6VtH/WkLtWvyNC56EZVXsZdU3iqaMG2B4WvYrlqU831pc4UtG5yp0sE9z8Y02wVN7PjW5Zf9Gt0f1Q==",
+      "version": "3.49.0",
+      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.49.0.tgz",
+      "integrity": "sha512-VQXt1jr9cBz03b331DFDCCP90b3fanciLkgiOoy8SBHy06gNf+vQ1A3WFLqG7I8TipYIKeYK9wxd0tUrvHcOZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6403,9 +6462,9 @@
       }
     },
     "node_modules/cosmiconfig": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-9.0.0.tgz",
-      "integrity": "sha512-itvL5h8RETACmOTFc4UfIyB2RfEHi71Ax6E/PivVxq9NseKbOWpeyHEOIbmAw1rs8Ak0VursQNww7lf7YtUwzg==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-9.0.1.tgz",
+      "integrity": "sha512-hr4ihw+DBqcvrsEDioRO31Z17x71pUYoNe/4h6Z0wB72p7MU7/9gH8Q3s12NFhHPfYBBOV3qyfUxmr/Yn3shnQ==",
       "license": "MIT",
       "dependencies": {
         "env-paths": "^2.2.1",
@@ -6461,13 +6520,13 @@
       }
     },
     "node_modules/css-functions-list": {
-      "version": "3.2.3",
-      "resolved": "https://registry.npmjs.org/css-functions-list/-/css-functions-list-3.2.3.tgz",
-      "integrity": "sha512-IQOkD3hbR5KrN93MtcYuad6YPuTSUhntLHDuLEbFWE+ff2/XSZNdZG+LcbbIW5AXKg/WFIfYItIzVoHngHXZzA==",
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/css-functions-list/-/css-functions-list-3.3.3.tgz",
+      "integrity": "sha512-8HFEBPKhOpJPEPu70wJJetjKta86Gw9+CCyCnB3sui2qQfOvRyqBy4IKLKKAwdMpWb2lHXWk9Wb4Z6AmaUT1Pg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=12 || >=16"
+        "node": ">=12"
       }
     },
     "node_modules/css-loader": {
@@ -6523,14 +6582,14 @@
       }
     },
     "node_modules/css-tree": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.1.0.tgz",
-      "integrity": "sha512-0eW44TGN5SQXU1mWSkKwFstI/22X2bG1nYzZTYMAWjylYURhse752YgbE4Cx46AC+bAvI+/dYTPRk1LqSUnu6w==",
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
+      "integrity": "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "mdn-data": "2.12.2",
-        "source-map-js": "^1.0.1"
+        "mdn-data": "2.27.1",
+        "source-map-js": "^1.2.1"
       },
       "engines": {
         "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
@@ -6604,9 +6663,9 @@
       "license": "MIT"
     },
     "node_modules/cytoscape": {
-      "version": "3.33.1",
-      "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.1.tgz",
-      "integrity": "sha512-iJc4TwyANnOGR1OmWhsS9ayRS3s+XQ185FmuHObThD+5AeJCakAAbWv8KimMTt08xCCLNgneQwFp+JRJOr9qGQ==",
+      "version": "3.33.3",
+      "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.3.tgz",
+      "integrity": "sha512-Gej7U+OKR+LZ8kvX7rb2HhCYJ0IhvEFsnkud4SB1PR+BUY/TsSO0dmOW59WEVLu51b1Rm+gQRKoz4bLYxGSZ2g==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10"
@@ -7268,9 +7327,9 @@
       }
     },
     "node_modules/delaunator": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.0.1.tgz",
-      "integrity": "sha512-8nvh+XBe96aCESrGOqMp/84b13H9cdKbG5P2ejQCh4d4sK9RL4371qou9drQjMhvnPmhWl5hnmqbEE0fXr9Xnw==",
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.1.0.tgz",
+      "integrity": "sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==",
       "license": "ISC",
       "dependencies": {
         "robust-predicates": "^3.0.2"
@@ -7369,6 +7428,19 @@
         "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
       }
     },
+    "node_modules/dom-serializer/node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/domelementtype": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
@@ -7399,9 +7471,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz",
-      "integrity": "sha512-qkdCKzLNtrgPFP1Vo+98FRzJnBRGe4ffyCea9IwHB1fyxPOeNTHpLKYGd4Uk9xvNoH0ZoOjwZxNptyMwqrId1Q==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.2.tgz",
+      "integrity": "sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -7468,15 +7540,15 @@
       }
     },
     "node_modules/editorconfig": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/editorconfig/-/editorconfig-1.0.4.tgz",
-      "integrity": "sha512-L9Qe08KWTlqYMVvMcTIvMAdl1cDUubzRNYL+WfA4bLDMHe4nemKkpmYzkznE1FwLKu0EEmy6obgQKzMJrg4x9Q==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/editorconfig/-/editorconfig-1.0.7.tgz",
+      "integrity": "sha512-e0GOtq/aTQhVdNyDU9e02+wz9oDDM+SIOQxWME2QRjzRX5yyLAuHDE+0aE8vHb9XRC8XD37eO2u57+F09JqFhw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@one-ini/wasm": "0.1.1",
         "commander": "^10.0.0",
-        "minimatch": "9.0.1",
+        "minimatch": "^9.0.1",
         "semver": "^7.5.3"
       },
       "bin": {
@@ -7494,9 +7566,9 @@
       "license": "MIT"
     },
     "node_modules/editorconfig/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7504,13 +7576,13 @@
       }
     },
     "node_modules/editorconfig/node_modules/minimatch": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.1.tgz",
-      "integrity": "sha512-0jWhJpD/MdhPXwPuiRkCbfYfSKp2qnn2eOc279qI7f+osl/l+prKSrvhg157zSYvx/1nmgn2NqdT6k2Z7zSH9w==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -7520,9 +7592,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.278",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.278.tgz",
-      "integrity": "sha512-dQ0tM1svDRQOwxnXxm+twlGTjr9Upvt8UFWAgmLsxEzFQxhbti4VwxmMjsDxVC51Zo84swW7FVCXEV+VAkhuPw==",
+      "version": "1.5.349",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.349.tgz",
+      "integrity": "sha512-QsWVGyRuY07Aqb234QytTfwd5d9AJlfNIQ5wIOl1L+PZDzI9d9+Fn0FRale/QYlFxt/bUnB0/nLd1jFPGxGK1A==",
       "license": "ISC"
     },
     "node_modules/emoji-regex": {
@@ -7542,23 +7614,22 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.20.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.20.0.tgz",
-      "integrity": "sha512-/ce7+jQ1PQ6rVXwe+jKEg5hW5ciicHwIQUagZkp6IufBoY3YDgdTTY1azVs0qoRgVmvsNB+rbjLJxDAeHHtwsQ==",
+      "version": "5.21.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.0.tgz",
+      "integrity": "sha512-otxSQPw4lkOZWkHpB3zaEQs6gWYEsmX4xQF68ElXC/TWvGxGMSGOvoNbaLXm6/cS/fSfHtsEdw90y20PCd+sCA==",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
-        "tapable": "^2.3.0"
+        "tapable": "^2.3.3"
       },
       "engines": {
         "node": ">=10.13.0"
       }
     },
     "node_modules/entities": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
-      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
-      "dev": true,
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
+      "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=0.12"
@@ -7598,9 +7669,9 @@
       }
     },
     "node_modules/es-abstract": {
-      "version": "1.24.1",
-      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.1.tgz",
-      "integrity": "sha512-zHXBLhP+QehSSbsS9Pt23Gg964240DPd6QCf8WpkqEXxQ7fhdZzYsocOr5u7apWonsS5EjZDmTF+/slGMyasvw==",
+      "version": "1.24.2",
+      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.2.tgz",
+      "integrity": "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7703,17 +7774,15 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
       "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
-      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
-      "dev": true,
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
+      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
@@ -7774,9 +7843,9 @@
       ]
     },
     "node_modules/esbuild": {
-      "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.2.tgz",
-      "integrity": "sha512-HyNQImnsOC7X9PMNaCIeAm4ISCQXs5a5YasTXVliKv4uuBo1dKrG0A+uQS8M5eXjVMnLg3WgXaKvprHlFJQffw==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
+      "integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
       "hasInstallScript": true,
       "license": "MIT",
       "bin": {
@@ -7786,44 +7855,44 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.2",
-        "@esbuild/android-arm": "0.27.2",
-        "@esbuild/android-arm64": "0.27.2",
-        "@esbuild/android-x64": "0.27.2",
-        "@esbuild/darwin-arm64": "0.27.2",
-        "@esbuild/darwin-x64": "0.27.2",
-        "@esbuild/freebsd-arm64": "0.27.2",
-        "@esbuild/freebsd-x64": "0.27.2",
-        "@esbuild/linux-arm": "0.27.2",
-        "@esbuild/linux-arm64": "0.27.2",
-        "@esbuild/linux-ia32": "0.27.2",
-        "@esbuild/linux-loong64": "0.27.2",
-        "@esbuild/linux-mips64el": "0.27.2",
-        "@esbuild/linux-ppc64": "0.27.2",
-        "@esbuild/linux-riscv64": "0.27.2",
-        "@esbuild/linux-s390x": "0.27.2",
-        "@esbuild/linux-x64": "0.27.2",
-        "@esbuild/netbsd-arm64": "0.27.2",
-        "@esbuild/netbsd-x64": "0.27.2",
-        "@esbuild/openbsd-arm64": "0.27.2",
-        "@esbuild/openbsd-x64": "0.27.2",
-        "@esbuild/openharmony-arm64": "0.27.2",
-        "@esbuild/sunos-x64": "0.27.2",
-        "@esbuild/win32-arm64": "0.27.2",
-        "@esbuild/win32-ia32": "0.27.2",
-        "@esbuild/win32-x64": "0.27.2"
+        "@esbuild/aix-ppc64": "0.27.7",
+        "@esbuild/android-arm": "0.27.7",
+        "@esbuild/android-arm64": "0.27.7",
+        "@esbuild/android-x64": "0.27.7",
+        "@esbuild/darwin-arm64": "0.27.7",
+        "@esbuild/darwin-x64": "0.27.7",
+        "@esbuild/freebsd-arm64": "0.27.7",
+        "@esbuild/freebsd-x64": "0.27.7",
+        "@esbuild/linux-arm": "0.27.7",
+        "@esbuild/linux-arm64": "0.27.7",
+        "@esbuild/linux-ia32": "0.27.7",
+        "@esbuild/linux-loong64": "0.27.7",
+        "@esbuild/linux-mips64el": "0.27.7",
+        "@esbuild/linux-ppc64": "0.27.7",
+        "@esbuild/linux-riscv64": "0.27.7",
+        "@esbuild/linux-s390x": "0.27.7",
+        "@esbuild/linux-x64": "0.27.7",
+        "@esbuild/netbsd-arm64": "0.27.7",
+        "@esbuild/netbsd-x64": "0.27.7",
+        "@esbuild/openbsd-arm64": "0.27.7",
+        "@esbuild/openbsd-x64": "0.27.7",
+        "@esbuild/openharmony-arm64": "0.27.7",
+        "@esbuild/sunos-x64": "0.27.7",
+        "@esbuild/win32-arm64": "0.27.7",
+        "@esbuild/win32-ia32": "0.27.7",
+        "@esbuild/win32-x64": "0.27.7"
       }
     },
     "node_modules/esbuild-loader": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/esbuild-loader/-/esbuild-loader-4.4.2.tgz",
-      "integrity": "sha512-8LdoT9sC7fzfvhxhsIAiWhzLJr9yT3ggmckXxsgvM07wgrRxhuT98XhLn3E7VczU5W5AFsPKv9DdWcZIubbWkQ==",
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/esbuild-loader/-/esbuild-loader-4.4.3.tgz",
+      "integrity": "sha512-Wpui03EzqC151xFteKlgJQhbyZl5CgnBpUHXVuao02nItULlkaTeiLdEMPTmR2zdwpEBWkXVNoT5dDOYJluUzg==",
       "license": "MIT",
       "dependencies": {
         "esbuild": "^0.27.1",
         "get-tsconfig": "^4.10.1",
         "loader-utils": "^2.0.4",
-        "webpack-sources": "^1.4.3"
+        "webpack-sources": "^3.3.4"
       },
       "funding": {
         "url": "https://github.com/privatenumber/esbuild-loader?sponsor=1"
@@ -8016,18 +8085,19 @@
       }
     },
     "node_modules/eslint-plugin-import-x": {
-      "version": "4.16.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-import-x/-/eslint-plugin-import-x-4.16.1.tgz",
-      "integrity": "sha512-vPZZsiOKaBAIATpFE2uMI4w5IRwdv/FpQ+qZZMR4E+PeOcM4OeoEbqxRMnywdxP19TyB/3h6QBB0EWon7letSQ==",
+      "version": "4.16.2",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-import-x/-/eslint-plugin-import-x-4.16.2.tgz",
+      "integrity": "sha512-rM9K8UBHcWKpzQzStn1YRN2T5NvdeIfSVoKu/lKF41znQXHAUcBbYXe5wd6GNjZjTrP7viQ49n1D83x/2gYgIw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "^8.35.0",
+        "@package-json/types": "^0.0.12",
+        "@typescript-eslint/types": "^8.56.0",
         "comment-parser": "^1.4.1",
         "debug": "^4.4.1",
         "eslint-import-context": "^0.1.9",
         "is-glob": "^4.0.3",
-        "minimatch": "^9.0.3 || ^10.0.1",
+        "minimatch": "^9.0.3 || ^10.1.2",
         "semver": "^7.7.2",
         "stable-hash-x": "^0.2.0",
         "unrs-resolver": "^1.9.2"
@@ -8039,8 +8109,8 @@
         "url": "https://opencollective.com/eslint-plugin-import-x"
       },
       "peerDependencies": {
-        "@typescript-eslint/utils": "^8.0.0",
-        "eslint": "^8.57.0 || ^9.0.0",
+        "@typescript-eslint/utils": "^8.56.0",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "eslint-import-resolver-node": "*"
       },
       "peerDependenciesMeta": {
@@ -8082,9 +8152,9 @@
       }
     },
     "node_modules/eslint-plugin-playwright": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-playwright/-/eslint-plugin-playwright-2.9.0.tgz",
-      "integrity": "sha512-k3xrG6YzrallWNFMoGUjMNeu3SFFKXN79KJQBD2PkM4PasJegqV2Up+mPY5od2UmPKQGT+MeIhCmWH8r5eYuQQ==",
+      "version": "2.10.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-playwright/-/eslint-plugin-playwright-2.10.1.tgz",
+      "integrity": "sha512-qea3UxBOb8fTwJ77FMApZKvRye5DOluDHcev0LDJwID3RELeun0JlqzrNIXAB/SXCyB/AesCW/6sZfcT9q3Edg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8098,9 +8168,9 @@
       }
     },
     "node_modules/eslint-plugin-regexp": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.0.0.tgz",
-      "integrity": "sha512-iW7hgAV8NOG6E2dz+VeKpq67YLQ9jaajOKYpoOSic2/q8y9BMdXBKkSR9gcMtbqEhNQzdW41E3wWzvhp8ExYwQ==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.1.0.tgz",
+      "integrity": "sha512-qGXIC3DIKZHcK1H9A9+Byz9gmndY6TTSRkSMTZpNXdyCw2ObSehRgccJv35n9AdUakEjQp5VFNLas6BMXizCZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8226,11 +8296,18 @@
       }
     },
     "node_modules/eslint-plugin-vitest-globals": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-vitest-globals/-/eslint-plugin-vitest-globals-1.5.0.tgz",
-      "integrity": "sha512-ZSsVOaOIig0oVLzRTyk8lUfBfqzWxr/J3/NFMfGGRIkGQPejJYmDH3gXmSJxAojts77uzAGB/UmVrwi2DC4LYA==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-vitest-globals/-/eslint-plugin-vitest-globals-1.6.1.tgz",
+      "integrity": "sha512-ydMvr96XRaT913a8gy8TY/LLyGB49Wmj0+x/FCbaWSpWMSaWDLG63/5zSLLrdSGXJ0PTjWpYZOZ61YBuzNyyTw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/saqqdy"
+      }
     },
     "node_modules/eslint-plugin-vue": {
       "version": "10.8.0",
@@ -8343,9 +8420,9 @@
       "license": "MIT"
     },
     "node_modules/eslint/node_modules/ajv": {
-      "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
-      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8359,6 +8436,34 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
+    "node_modules/eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint/node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/eslint/node_modules/json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -8476,6 +8581,16 @@
         "node": ">=12.0.0"
       }
     },
+    "node_modules/expr-eval-fork": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/expr-eval-fork/-/expr-eval-fork-3.0.3.tgz",
+      "integrity": "sha512-BhC+hbc5lIVjygr840n5DEkW3MQq7H9o+mc1/N7Z5uIiCFVyESLL5DIE7LNq4CYUNxy+XjA+3jRrL/h0Kt2xcg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.9.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -8680,9 +8795,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -8913,9 +9028,9 @@
       }
     },
     "node_modules/get-tsconfig": {
-      "version": "4.13.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.13.0.tgz",
-      "integrity": "sha512-1VKTZJCwBrvbd+Wn3AOgQP/2Av+TfTCOlE4AcRJE72W1ksZXbAx8PPBR9RzgTeSPzlPMHrbANMH3LbltH73wxQ==",
+      "version": "4.14.0",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.0.tgz",
+      "integrity": "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==",
       "license": "MIT",
       "dependencies": {
         "resolve-pkg-maps": "^1.0.0"
@@ -8928,7 +9043,7 @@
       "version": "7.2.3",
       "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
       "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -8964,10 +9079,28 @@
       "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==",
       "license": "BSD-2-Clause"
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -9019,9 +9152,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.4.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.4.0.tgz",
-      "integrity": "sha512-hjrNztw/VajQwOLsMNT1cbJiH2muO3OROCHnbehc8eY5JyD2gqz4AcMHPqgaOR59DjgUjYAYLeH699g/eWi2jw==",
+      "version": "17.6.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.6.0.tgz",
+      "integrity": "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9069,6 +9202,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/globby/node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/globjoin": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/globjoin/-/globjoin-0.1.4.tgz",
@@ -9128,19 +9271,6 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/happy-dom/node_modules/entities": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
-      "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.12"
-      },
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
     "node_modules/has-bigints": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.1.0.tgz",
@@ -9228,22 +9358,22 @@
       "license": "MIT"
     },
     "node_modules/hashery": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.4.0.tgz",
-      "integrity": "sha512-Wn2i1In6XFxl8Az55kkgnFRiAlIAushzh26PTjL2AKtQcEfXrcLa7Hn5QOWGZEf3LU057P9TwwZjFyxfS1VuvQ==",
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz",
+      "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hookified": "^1.14.0"
+        "hookified": "^1.15.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -9253,9 +9383,9 @@
       }
     },
     "node_modules/hookified": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.0.tgz",
-      "integrity": "sha512-51w+ZZGt7Zw5q7rM3nC4t3aLn/xvKDETsXqMczndvwyVQhAHfUmUuFBRFcos8Iyebtk7OAE9dL26wFNzZVVOkw==",
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
+      "integrity": "sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==",
       "dev": true,
       "license": "MIT"
     },
@@ -9322,10 +9452,23 @@
         "entities": "^4.4.0"
       }
     },
+    "node_modules/htmlparser2/node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/htmx.org": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/htmx.org/-/htmx.org-2.0.8.tgz",
-      "integrity": "sha512-fm297iru0iWsNJlBrjvtN7V9zjaxd+69Oqjh4F/Vq9Wwi2kFisLcrLCiv5oBX0KLfOX/zG8AUo9ROMU5XUB44Q==",
+      "version": "2.0.10",
+      "resolved": "https://registry.npmjs.org/htmx.org/-/htmx.org-2.0.10.tgz",
+      "integrity": "sha512-kdeJe7ZVwaS6QMz/ebBIVtZdpwen6L0OQ5GOhPV9MKBb196TCZeZu4yA7ZIQsaLKv7EpXz+So7KSXNuHXhj7Cw==",
       "license": "0BSD"
     },
     "node_modules/iconv-lite": {
@@ -9379,9 +9522,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/ignore": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9651,9 +9794,9 @@
       }
     },
     "node_modules/is-builtin-module/node_modules/builtin-modules": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-5.0.0.tgz",
-      "integrity": "sha512-bkXY9WsVpY7CvMhKSR6pZilZu9Ln5WDrKVBUXf2S443etkmEO4V58heTecXcUIsNsi4Rx8JUO4NfX1IcQl4deg==",
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-5.1.0.tgz",
+      "integrity": "sha512-c5JxaDrzwRjq3WyJkI1AGR5xy6Gr6udlt7sQPbl09+3ckB+Zo2qqQ2KhCTBr7Q8dHB43bENGYEk4xddrFH/b7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10271,9 +10414,9 @@
       "license": "MIT"
     },
     "node_modules/js-beautify/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10284,6 +10427,7 @@
       "version": "10.5.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
       "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -10302,13 +10446,13 @@
       }
     },
     "node_modules/js-beautify/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -10335,9 +10479,9 @@
       "license": "MIT"
     },
     "node_modules/js-tokens": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-9.0.1.tgz",
-      "integrity": "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==",
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
+      "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -10367,9 +10511,9 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.1.1.tgz",
-      "integrity": "sha512-/2uqY7x6bsrpi3i9LVU6J89352C0rpMk0as8trXxCtvd4kPk1ke/Eyif6wqfSLvoNJqcDG9Vk4UsXgygzCt2xA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.2.0.tgz",
+      "integrity": "sha512-dh140MMgjyg3JhJZY/+iEzW+NO5xR2gpbDFKHqotCmexElVntw7GjWjt511+C/Ef02RU5TKYrJo/Xlzk+OLaTw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10445,9 +10589,9 @@
       "license": "MIT"
     },
     "node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10458,9 +10602,9 @@
       }
     },
     "node_modules/jsonpath-plus": {
-      "version": "10.3.0",
-      "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-10.3.0.tgz",
-      "integrity": "sha512-8TNmfeTCk2Le33A3vRRwtuworG/L5RrgMvdjhKZxvyShO+mBu2fP50OWUjRLNtvw344DdDarFh9buFAZs5ujeA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-10.4.0.tgz",
+      "integrity": "sha512-T92WWatJXmhBbKsgH/0hl+jxjdXrifi5IKeMY02DWggRxX0UElcbVzPlmgLTbvsPeW1PasQ6xE2Q75stkhGbsA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10503,9 +10647,9 @@
       "license": "MIT"
     },
     "node_modules/katex": {
-      "version": "0.16.38",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.38.tgz",
-      "integrity": "sha512-cjHooZUmIAUmDsHBN+1n8LaZdpmbj03LtYeYPyuYB7OuloiaeaV6N4LcfjcnHVzGWjVQmKrxxTrpDcmSzEZQwQ==",
+      "version": "0.16.45",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.45.tgz",
+      "integrity": "sha512-pQpZbdBu7wCTmQUh7ufPmLr0pFoObnGUoL/yhtwJDgmmQpbkg/0HSVti25Fu4rmd1oCR6NGWe9vqTWuWv3GcNA==",
       "funding": [
         "https://opencollective.com/katex",
         "https://github.com/sponsors/katex"
@@ -10624,6 +10768,279 @@
         "immediate": "~3.0.5"
       }
     },
+    "node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
     "node_modules/lilconfig": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
@@ -10684,9 +11101,9 @@
       }
     },
     "node_modules/loader-runner": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/loader-runner/-/loader-runner-4.3.1.tgz",
-      "integrity": "sha512-IWqP2SCPhyVFTBtRcgMHdzlf9ul25NwaFx4wCEH/KjAXuuHY4yNjvPXsBokp8jCB936PyWRaPKUNh8NvylLp2Q==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/loader-runner/-/loader-runner-4.3.2.tgz",
+      "integrity": "sha512-DFEqQ3ihfS9blba08cLfYf1NRAIEm+dDjic073DRDc3/JspI/8wYmtDsHwd3+4hwvdxSK7PGaElfTmm0awWJ4w==",
       "license": "MIT",
       "engines": {
         "node": ">=6.11.5"
@@ -10727,16 +11144,16 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/lodash-es": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
-      "integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
+      "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
       "license": "MIT"
     },
     "node_modules/lodash.clonedeep": {
@@ -10808,14 +11225,14 @@
       }
     },
     "node_modules/magicast": {
-      "version": "0.5.1",
-      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.1.tgz",
-      "integrity": "sha512-xrHS24IxaLrvuo613F719wvOIv9xPHFWQHuvGUBmPnCA/3MQxKI3b+r7n1jAoDHmsbC5bRhTZYR77invLAxVnw==",
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.2.tgz",
+      "integrity": "sha512-E3ZJh4J3S9KfwdjZhe2afj6R9lGIN5Pher1pF39UGrXRqq/VDaGVIGN13BjHd2u8B61hArAGOnso7nBOouW3TQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.28.5",
-        "@babel/types": "^7.28.5",
+        "@babel/parser": "^7.29.0",
+        "@babel/types": "^7.29.0",
         "source-map-js": "^1.2.1"
       }
     },
@@ -10843,9 +11260,9 @@
       "license": "MIT"
     },
     "node_modules/markdown-it": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.0.tgz",
-      "integrity": "sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg==",
+      "version": "14.1.1",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
+      "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10860,6 +11277,19 @@
         "markdown-it": "bin/markdown-it.mjs"
       }
     },
+    "node_modules/markdown-it/node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/markdownlint": {
       "version": "0.40.0",
       "resolved": "https://registry.npmjs.org/markdownlint/-/markdownlint-0.40.0.tgz",
@@ -10885,23 +11315,23 @@
       }
     },
     "node_modules/markdownlint-cli": {
-      "version": "0.47.0",
-      "resolved": "https://registry.npmjs.org/markdownlint-cli/-/markdownlint-cli-0.47.0.tgz",
-      "integrity": "sha512-HOcxeKFAdDoldvoYDofd85vI8LgNWy8vmYpCwnlLV46PJcodmGzD7COSSBlhHwsfT4o9KrAStGodImVBus31Bg==",
+      "version": "0.48.0",
+      "resolved": "https://registry.npmjs.org/markdownlint-cli/-/markdownlint-cli-0.48.0.tgz",
+      "integrity": "sha512-NkZQNu2E0Q5qLEEHwWj674eYISTLD4jMHkBzDobujXd1kv+yCxi8jOaD/rZoQNW1FBBMMGQpuW5So8B51N/e0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "commander": "~14.0.2",
+        "commander": "~14.0.3",
         "deep-extend": "~0.6.0",
         "ignore": "~7.0.5",
         "js-yaml": "~4.1.1",
         "jsonc-parser": "~3.3.1",
         "jsonpointer": "~5.0.1",
-        "markdown-it": "~14.1.0",
+        "markdown-it": "~14.1.1",
         "markdownlint": "~0.40.0",
-        "minimatch": "~10.1.1",
+        "minimatch": "~10.2.4",
         "run-con": "~1.3.2",
-        "smol-toml": "~1.5.2",
+        "smol-toml": "~1.6.0",
         "tinyglobby": "~0.2.15"
       },
       "bin": {
@@ -10911,49 +11341,16 @@
         "node": ">=20"
       }
     },
-    "node_modules/markdownlint-cli/node_modules/balanced-match": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.3.tgz",
-      "integrity": "sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/markdownlint-cli/node_modules/brace-expansion": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.2.tgz",
-      "integrity": "sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/markdownlint-cli/node_modules/commander": {
-      "version": "14.0.2",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.2.tgz",
-      "integrity": "sha512-TywoWNNRbhoD0BXs1P3ZEScW8W5iKrnbithIl0YH+uCmBd0QpPOA8yc82DS3BIE5Ma6FnBVUsJ7wVUDz4dvOWQ==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=20"
       }
     },
-    "node_modules/markdownlint-cli/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/markdownlint-cli/node_modules/jsonc-parser": {
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
@@ -10961,22 +11358,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/markdownlint-cli/node_modules/minimatch": {
-      "version": "10.1.3",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.3.tgz",
-      "integrity": "sha512-IF6URNyBX7Z6XfvjpaNy5meRxPZiIf2OqtOoSLs+hLJ9pJAScnM1RjrFcbCaD85y42KcI+oZmKjFIJKYDFjQfg==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/markdownlint/node_modules/ansi-regex": {
       "version": "6.2.2",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
@@ -11008,13 +11389,13 @@
       }
     },
     "node_modules/markdownlint/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -11057,9 +11438,9 @@
       }
     },
     "node_modules/mdn-data": {
-      "version": "2.12.2",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.12.2.tgz",
-      "integrity": "sha512-IEn+pegP1aManZuckezWCO+XZQDplx1366JoVhTpMpBB1sPey/SbveZQUosKiKiGYjg1wH4pMlNgXbCiYgihQA==",
+      "version": "2.27.1",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
+      "integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
       "dev": true,
       "license": "CC0-1.0"
     },
@@ -11689,26 +12070,14 @@
       }
     },
     "node_modules/mime-db": {
-      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "version": "1.54.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/mime-types": {
-      "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "1.52.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/mini-css-extract-plugin": {
       "version": "2.10.0",
       "resolved": "https://registry.npmjs.org/mini-css-extract-plugin/-/mini-css-extract-plugin-2.10.0.tgz",
@@ -11730,12 +12099,12 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -11744,27 +12113,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/minimatch/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/minimatch/node_modules/brace-expansion": {
-      "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz",
-      "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -11776,11 +12124,11 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
@@ -11799,21 +12147,21 @@
       }
     },
     "node_modules/mlly": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.8.0.tgz",
-      "integrity": "sha512-l8D9ODSRWLe2KHJSifWGwBqpTZXIXTeo8mlKjY+E2HAakaTeNpqAyBZ8GSqLzHgw4XmHmC8whvpjJNMbFZN7/g==",
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.8.2.tgz",
+      "integrity": "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==",
       "license": "MIT",
       "dependencies": {
-        "acorn": "^8.15.0",
+        "acorn": "^8.16.0",
         "pathe": "^2.0.3",
         "pkg-types": "^1.3.1",
-        "ufo": "^1.6.1"
+        "ufo": "^1.6.3"
       }
     },
     "node_modules/moo": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/moo/-/moo-0.5.2.tgz",
-      "integrity": "sha512-iSAJLHYKnX41mKcJKjqvnAN9sf0LMDTXDEvFv+ffuRR9a1MIuXLjMNL6EsnDHSkKLTWNqQQ5uo61P4EbU4NU+Q==",
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/moo/-/moo-0.5.3.tgz",
+      "integrity": "sha512-m2fmM2dDm7GZQsY7KK2cme8agi+AAljILjQnof7p1ZMDe6dQ4bdnSMx0cPppudoeNv5hEFQirN6u+O4fDE0IWA==",
       "license": "BSD-3-Clause"
     },
     "node_modules/ms": {
@@ -11835,9 +12183,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.12",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
       "funding": [
         {
           "type": "github",
@@ -11922,9 +12270,9 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.27",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+      "version": "2.0.38",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.38.tgz",
+      "integrity": "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw==",
       "license": "MIT"
     },
     "node_modules/node-sarif-builder": {
@@ -12343,9 +12691,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "license": "MIT",
       "engines": {
         "node": ">=8.6"
@@ -12448,13 +12796,13 @@
       }
     },
     "node_modules/playwright": {
-      "version": "1.57.0",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.57.0.tgz",
-      "integrity": "sha512-ilYQj1s8sr2ppEJ2YVadYBN0Mb3mdo9J0wQ+UuDhzYqURwSoW4n1Xs5vs7ORwgDGmyEh33tRMeS8KhdkMoLXQw==",
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.57.0"
+        "playwright-core": "1.58.2"
       },
       "bin": {
         "playwright": "cli.js"
@@ -12467,9 +12815,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.57.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.57.0.tgz",
-      "integrity": "sha512-agTcKlMw/mjBWOnD6kFZttAAGHgi/Nw0CZ2o6JqWSbMlI219lAFLZZCyqByTsvVAJq5XA5H8cA6PrvBRpBWEuQ==",
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -12526,9 +12874,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.10",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
-      "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
+      "version": "8.5.13",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.13.tgz",
+      "integrity": "sha512-qif0+jGGZoLWdHey3UFHHWP0H7Gbmsk8T5VEqyYFbWqPr1XqvLGBbk/sl8V5exGmcYJklJOhOQq1pV9IcsiFag==",
       "funding": [
         {
           "type": "opencollective",
@@ -12569,6 +12917,13 @@
         "node": "^12 || >=14"
       }
     },
+    "node_modules/postcss-html/node_modules/js-tokens": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-9.0.1.tgz",
+      "integrity": "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/postcss-import": {
       "version": "15.1.0",
       "resolved": "https://registry.npmjs.org/postcss-import/-/postcss-import-15.1.0.tgz",
@@ -12808,28 +13163,6 @@
         "postcss": "^8.4"
       }
     },
-    "node_modules/postcss-nesting/node_modules/@csstools/selector-specificity": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-6.0.0.tgz",
-      "integrity": "sha512-4sSgl78OtOXEX/2d++8A83zHNTgwCJMaR24FvsYL7Uf/VS8HZk9PTwR51elTbGqMuwH3szLvvOXEaVnqn0Z3zA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "postcss-selector-parser": "^7.1.1"
-      }
-    },
     "node_modules/postcss-resolve-nested-selector": {
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/postcss-resolve-nested-selector/-/postcss-resolve-nested-selector-0.1.6.tgz",
@@ -12970,9 +13303,9 @@
       "license": "ISC"
     },
     "node_modules/prototype-properties": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/prototype-properties/-/prototype-properties-5.0.0.tgz",
-      "integrity": "sha512-uCWE2QqnGlwvvJXTwiHTPTyHE62+zORO5hpFWhAwBGDtEtTmNZZleNLJDoFsqHCL4p/CeAP2Q1uMKFUKALuRGQ==",
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/prototype-properties/-/prototype-properties-5.1.0.tgz",
+      "integrity": "sha512-lq/vK1+nYV/bbjZ70pDmaTzin143xX9hVAU5CrsNQL57A8j4Q6AfjsY8kRFoUpCBncaUdfkz9MdsQ8PFtiKrUQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13003,18 +13336,25 @@
       }
     },
     "node_modules/qified": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/qified/-/qified-0.6.0.tgz",
-      "integrity": "sha512-tsSGN1x3h569ZSU1u6diwhltLyfUWDp3YbFHedapTmpBl0B3P6U3+Qptg7xu+v+1io1EwhdPyyRHYbEw0KN2FA==",
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/qified/-/qified-0.9.1.tgz",
+      "integrity": "sha512-n7mar4T0xQ+39dE2vGTAlbxUEpndwPANH0kDef1/MYsB8Bba9wshkybIRx74qgcvKQPEWErf9AqAdYjhzY2Ilg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hookified": "^1.14.0"
+        "hookified": "^2.1.1"
       },
       "engines": {
         "node": ">=20"
       }
     },
+    "node_modules/qified/node_modules/hookified": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-2.2.0.tgz",
+      "integrity": "sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
@@ -13089,9 +13429,9 @@
       "license": "MIT"
     },
     "node_modules/read-package-json/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13102,6 +13442,7 @@
       "version": "10.5.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
       "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -13130,13 +13471,13 @@
       }
     },
     "node_modules/read-package-json/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -13251,9 +13592,9 @@
       }
     },
     "node_modules/regjsparser": {
-      "version": "0.13.0",
-      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.13.0.tgz",
-      "integrity": "sha512-NZQZdC5wOE/H3UT28fVGL+ikOZcEzfMGk/c3iN9UGxzWHMa1op7274oyiUVrAG4B2EuFhus8SvkaYnhvW92p9Q==",
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.13.1.tgz",
+      "integrity": "sha512-dLsljMd9sqwRkby8zhO1gSg3PnJIBFid8f4CQj/sXx+7cKx+E7u0PKhZ+U4wmhx7EfmtvnA318oVaIkAB1lRJw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -13292,11 +13633,12 @@
       }
     },
     "node_modules/resolve": {
-      "version": "1.22.11",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
-      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
+      "version": "1.22.12",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
+      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
       "license": "MIT",
       "dependencies": {
+        "es-errors": "^1.3.0",
         "is-core-module": "^2.16.1",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
@@ -13361,15 +13703,56 @@
       }
     },
     "node_modules/robust-predicates": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz",
-      "integrity": "sha512-IXgzBWvWQwE6PrDI05OvmXUIruQTcoMDzRsOd5CDvHCVLcLHMTSYvOK5Cm46kWqlV3yAbuSpBZdJ5oP5OUoStg==",
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",
+      "integrity": "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==",
       "license": "Unlicense"
     },
+    "node_modules/rolldown": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.17.tgz",
+      "integrity": "sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.127.0",
+        "@rolldown/pluginutils": "1.0.0-rc.17"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.0.0-rc.17",
+        "@rolldown/binding-darwin-arm64": "1.0.0-rc.17",
+        "@rolldown/binding-darwin-x64": "1.0.0-rc.17",
+        "@rolldown/binding-freebsd-x64": "1.0.0-rc.17",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.17",
+        "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.17",
+        "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.17",
+        "@rolldown/binding-linux-x64-musl": "1.0.0-rc.17",
+        "@rolldown/binding-openharmony-arm64": "1.0.0-rc.17",
+        "@rolldown/binding-wasm32-wasi": "1.0.0-rc.17",
+        "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.17",
+        "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.17"
+      }
+    },
+    "node_modules/rolldown/node_modules/@rolldown/pluginutils": {
+      "version": "1.0.0-rc.17",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.17.tgz",
+      "integrity": "sha512-n8iosDOt6Ig1UhJ2AYqoIhHWh/isz0xpicHTzpKBeotdVsTEcxsSA/i3EVM7gQAj0rU27OLAxCjzlj15IWY7bg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/rollup": {
-      "version": "2.79.2",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.79.2.tgz",
-      "integrity": "sha512-fS6iqSPZDs3dr/y7Od6y5nha8dW1YnbgtsyotCVvoFGKbERG++CVRFv1meyGDE1SNItQA8BrnCw7ScdAhRJ3XQ==",
+      "version": "2.80.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.80.0.tgz",
+      "integrity": "sha512-cIFJOD1DESzpjOBl763Kp1AH7UE/0fcdHe6rZXUdQ9c50uvgigvW97u3IcSeBwOkgqL/PXPBktBCh0KEu5L8XQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -13450,15 +13833,15 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/safe-array-concat": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.1.3.tgz",
-      "integrity": "sha512-AURm5f0jYEOydBj7VQlVvDrjeFgthDdEF5H1dP+6mNpoXOMo1quQqJ4wvJDyRZ9+pO3kGWoOdmV08cSv2aJV6Q==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.1.4.tgz",
+      "integrity": "sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "call-bind": "^1.0.8",
-        "call-bound": "^1.0.2",
-        "get-intrinsic": "^1.2.6",
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "get-intrinsic": "^1.3.0",
         "has-symbols": "^1.1.0",
         "isarray": "^2.0.5"
       },
@@ -13571,18 +13954,18 @@
       }
     },
     "node_modules/seroval": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.0.tgz",
-      "integrity": "sha512-OE4cvmJ1uSPrKorFIH9/w/Qwuvi/IMcGbv5RKgcJ/zjA/IohDLU6SVaxFN9FwajbP7nsX0dQqMDes1whk3y+yw==",
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.2.tgz",
+      "integrity": "sha512-xcRN39BdsnO9Tf+VzsE7b3JyTJASItIV1FVFewJKCFcW4s4haIKS3e6vj8PGB9qBwC7tnuOywQMdv5N4qkzi7Q==",
       "license": "MIT",
       "engines": {
         "node": ">=10"
       }
     },
     "node_modules/seroval-plugins": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/seroval-plugins/-/seroval-plugins-1.5.0.tgz",
-      "integrity": "sha512-EAHqADIQondwRZIdeW2I636zgsODzoBDwb3PT/+7TLDWyw1Dy/Xv7iGUIEXXav7usHDE9HVhOU61irI3EnyyHA==",
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/seroval-plugins/-/seroval-plugins-1.5.2.tgz",
+      "integrity": "sha512-qpY0Cl+fKYFn4GOf3cMiq6l72CpuVaawb6ILjubOQ+diJ54LfOWaSSPsaswN8DRPIPW4Yq+tE1k5aKd7ILyaFg==",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -13739,14 +14122,14 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3"
+        "object-inspect": "^1.13.4"
       },
       "engines": {
         "node": ">= 0.4"
@@ -13814,19 +14197,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/simple-eval": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-eval/-/simple-eval-1.0.1.tgz",
-      "integrity": "sha512-LH7FpTAkeD+y5xQC4fzS+tFtaNlvt3Ib1zKzvhjv/Y+cioV4zIuw4IZr2yhRLu67CWL7FR9/6KXKnjRoZTvGGQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "jsep": "^1.3.6"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
     "node_modules/slash": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
@@ -13866,9 +14236,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.5.2",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.5.2.tgz",
-      "integrity": "sha512-QlaZEqcAH3/RtNyet1IPIYPsEWAaYyXXv1Krsi+1L/QHppjX4Ifm8MQsBISz9vE8cHicIq3clogsheili5vhaQ==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.1.tgz",
+      "integrity": "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -13879,9 +14249,9 @@
       }
     },
     "node_modules/solid-js": {
-      "version": "1.9.11",
-      "resolved": "https://registry.npmjs.org/solid-js/-/solid-js-1.9.11.tgz",
-      "integrity": "sha512-WEJtcc5mkh/BnHA6Yrg4whlF8g6QwpmXXRg4P2ztPmcKeHHlH4+djYecBLhSpecZY2RRECXYUwIc/C2r3yzQ4Q==",
+      "version": "1.9.12",
+      "resolved": "https://registry.npmjs.org/solid-js/-/solid-js-1.9.12.tgz",
+      "integrity": "sha512-QzKaSJq2/iDrWR1As6MHZQ8fQkdOBf8GReYb7L5iKwMGceg7HxDcaOHk0at66tNgn9U2U7dXo8ZZpLIAmGMzgw==",
       "license": "MIT",
       "dependencies": {
         "csstype": "^3.1.0",
@@ -13912,12 +14282,6 @@
       "integrity": "sha512-Kk8wLQPlS+yi1ZEf48a4+fzHa4yxjC30M/Sr2AnQu+f/MPwvvX9XjZ6OWejiz8crBsLwSq8GHqaxaET7u6ux0A==",
       "license": "MIT"
     },
-    "node_modules/source-list-map": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/source-list-map/-/source-list-map-2.0.1.tgz",
-      "integrity": "sha512-qnQ7gVMxGNxsiL4lEuJwe/To8UnK7fAnmbGEEH8RpLouuKbeEm0lhbQVFIrNSuB+G7tVrAlVsZgETT5nljf+Iw==",
-      "license": "MIT"
-    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -14008,9 +14372,9 @@
       }
     },
     "node_modules/spdx-license-ids": {
-      "version": "3.0.22",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.22.tgz",
-      "integrity": "sha512-4PRT4nh1EImPbt2jASOKHX7PB7I+e4IWNLvkKFDxNhJlfjbYlleYQh285Z/3mPTHSAK/AvdMmw5BNNuYH8ShgQ==",
+      "version": "3.0.23",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
+      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
       "dev": true,
       "license": "CC0-1.0"
     },
@@ -14051,9 +14415,9 @@
       "license": "MIT"
     },
     "node_modules/stacktracey": {
-      "version": "2.1.8",
-      "resolved": "https://registry.npmjs.org/stacktracey/-/stacktracey-2.1.8.tgz",
-      "integrity": "sha512-Kpij9riA+UNg7TnphqjH7/CzctQ/owJGNbFkfEeve4Z4uxT5+JapVLFXcsurIfN34gnTWZNJ/f7NMG0E8JDzTw==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/stacktracey/-/stacktracey-2.2.0.tgz",
+      "integrity": "sha512-ETyQEz+CzXiLjEbyJqpbp+/T79RQD/6wqFucRBIlVNZfYq2Ay7wbretD4cxpbymZlaPWx58aIhPEY1Cr8DlVvg==",
       "dev": true,
       "license": "Unlicense",
       "dependencies": {
@@ -14062,9 +14426,9 @@
       }
     },
     "node_modules/std-env": {
-      "version": "3.10.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
-      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz",
+      "integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -14328,6 +14692,16 @@
         "stylelint": ">=16 <=17"
       }
     },
+    "node_modules/stylelint-plugin-logical-css": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/stylelint-plugin-logical-css/-/stylelint-plugin-logical-css-2.1.0.tgz",
+      "integrity": "sha512-625OT+p5y2kkGBaRV7uTYscuH0m1UueMXh0WcidrXgwF2DOnKov+un9tvuyNG+SUC07W0ibcn+fZvQs/keskww==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "stylelint": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0"
+      }
+    },
     "node_modules/stylelint-value-no-unknown-custom-properties": {
       "version": "6.1.1",
       "resolved": "https://registry.npmjs.org/stylelint-value-no-unknown-custom-properties/-/stylelint-value-no-unknown-custom-properties-6.1.1.tgz",
@@ -14345,6 +14719,36 @@
         "stylelint": ">=16"
       }
     },
+    "node_modules/stylelint/node_modules/@csstools/selector-specificity": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-5.0.0.tgz",
+      "integrity": "sha512-PCqQV3c4CoVm3kdPhyeZ07VmBRdH2EpMFA/pd9OASpOEC3aXNGoqPDAZ80D0cLpMBxnmk0+yNhGsEx31hq7Gtw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "postcss-selector-parser": "^7.0.0"
+      }
+    },
+    "node_modules/stylelint/node_modules/balanced-match": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-2.0.0.tgz",
+      "integrity": "sha512-1ugUSr8BHXRnK23KfuYS+gVMC3LB8QGH9W1iGtDPsNWoQbgtXSExkBu2aDR4epiGWZOjZsj6lDl/N/AqqTC3UA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/stylelint/node_modules/file-entry-cache": {
       "version": "11.1.2",
       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.2.tgz",
@@ -14356,27 +14760,17 @@
       }
     },
     "node_modules/stylelint/node_modules/flat-cache": {
-      "version": "6.1.20",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.20.tgz",
-      "integrity": "sha512-AhHYqwvN62NVLp4lObVXGVluiABTHapoB57EyegZVmazN+hhGhLTn3uZbOofoTw4DSDvVCadzzyChXhOAvy8uQ==",
+      "version": "6.1.22",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.22.tgz",
+      "integrity": "sha512-N2dnzVJIphnNsjHcrxGW7DePckJ6haPrSFqpsBUhHYgwtKGVq4JrBGielEGD2fCVnsGm1zlBVZ8wGhkyuetgug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "cacheable": "^2.3.2",
-        "flatted": "^3.3.3",
+        "cacheable": "^2.3.4",
+        "flatted": "^3.4.2",
         "hookified": "^1.15.0"
       }
     },
-    "node_modules/stylelint/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/stylelint/node_modules/postcss-safe-parser": {
       "version": "7.0.1",
       "resolved": "https://registry.npmjs.org/postcss-safe-parser/-/postcss-safe-parser-7.0.1.tgz",
@@ -14415,9 +14809,9 @@
       }
     },
     "node_modules/stylis": {
-      "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/stylis/-/stylis-4.3.6.tgz",
-      "integrity": "sha512-yQ3rwFWRfwNUY7H5vpU0wfdkNSnvnJinhF9830Swlaxl03zsOjCfmX0ugac+3LtK0lYSgwL/KXc8oYL3mG4YFQ==",
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/stylis/-/stylis-4.4.0.tgz",
+      "integrity": "sha512-5Z9ZpRzfuH6l/UAvCPAPUo3665Nk2wLaZU3x+TLHKVzIz33+sbJqbtrYoC3KD4/uVOr2Zp+L0LySezP9OHV9yA==",
       "license": "MIT"
     },
     "node_modules/stylus": {
@@ -14566,9 +14960,9 @@
       }
     },
     "node_modules/svgo/node_modules/sax": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.5.0.tgz",
-      "integrity": "sha512-21IYA3Q5cQf089Z6tgaUTr7lDAyzoTPx5HRtbhsME8Udispad8dC/+sziTNugOEx54ilvatQ9YCzl4KQLPcRHA==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.0.tgz",
+      "integrity": "sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -14576,9 +14970,9 @@
       }
     },
     "node_modules/swagger-ui-dist": {
-      "version": "5.31.2",
-      "resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.31.2.tgz",
-      "integrity": "sha512-uIoesCjDcxnAKj/C/HG5pjHZMQs2K/qmqpUlwLxxaVryGKlgm8Ri+VOza5xywAqf//pgg/hW16RYa6dDuTCOSg==",
+      "version": "5.32.5",
+      "resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.32.5.tgz",
+      "integrity": "sha512-7/FQfWe9A4qoyYFdAwy0chD0uDYidDp/ZT9VQ9LZlgD4AnnHJk8/+ytAA1HkJYOPySmK6helPDdJQMlcumt7HA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@scarf/scarf": "=1.4.0"
@@ -14674,9 +15068,9 @@
       }
     },
     "node_modules/tapable": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
-      "integrity": "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==",
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -14687,9 +15081,9 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.46.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.46.0.tgz",
-      "integrity": "sha512-jTwoImyr/QbOWFFso3YoU3ik0jBBDJ6JTOQiy/J2YxVJdZCc+5u7skhNwiOR3FQIygFqVUPHl7qbbxtjW2K3Qg==",
+      "version": "5.46.2",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.46.2.tgz",
+      "integrity": "sha512-uxfo9fPcSgLDYob/w1FuL0c99MWiJDnv+5qXSQc5+Ki5NjVNsYi66INnMFBjf6uFz6OnX12piJQPF4IpjJTNTw==",
       "license": "BSD-2-Clause",
       "dependencies": {
         "@jridgewell/source-map": "^0.3.3",
@@ -14705,9 +15099,9 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.3.17",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.17.tgz",
-      "integrity": "sha512-YR7PtUp6GMU91BgSJmlaX/rS2lGDbAF7D+Wtq7hRO+MiljNmodYvqslzCFiYVAgW+Qoaaia/QUIP4lGXufjdZw==",
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.5.0.tgz",
+      "integrity": "sha512-UYhptBwhWvfIjKd/UuFo6D8uq9xpGLDK+z8EDsj/zWhrTaH34cKEbrkMKfV5YWqGBvAYA3tlzZbs2R+qYrbQJA==",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.25",
@@ -14801,22 +15195,22 @@
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.1.2.tgz",
+      "integrity": "sha512-dAqSqE/RabpBKI8+h26GfLq6Vb3JVXs30XYQjdMjaj/c2tS8IYYMbIzP599KtRj7c57/wYApb3QjgRgXmrCukA==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "version": "0.2.16",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
+      "integrity": "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==",
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "picomatch": "^4.0.4"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -14843,9 +15237,9 @@
       }
     },
     "node_modules/tinyglobby/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -14855,9 +15249,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
-      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
+      "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -14943,9 +15337,9 @@
       "license": "MIT"
     },
     "node_modules/ts-api-utils": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.4.0.tgz",
-      "integrity": "sha512-3TaVTaAv2gTiMB35i3FiGJaRfwb3Pyn/j3m/bfAvGe8FB7CF6u+LMYqYlDh7reQf7UNvoTvdfAqHGmPGOSsPmA==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15083,16 +15477,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.56.1.tgz",
-      "integrity": "sha512-U4lM6pjmBX7J5wk4szltF7I1cGBHXZopnAXCMXb3+fZ3B/0Z3hq3wS/CCUB2NZBNAExK92mCU2tEohWuwVMsDQ==",
+      "version": "8.58.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.58.0.tgz",
+      "integrity": "sha512-e2TQzKfaI85fO+F3QywtX+tCTsu/D3WW5LVU6nz8hTFKFZ8yBJ6mSYRpXqdR3mFjPWmO0eWsTa5f+UpAOe/FMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.56.1",
-        "@typescript-eslint/parser": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1"
+        "@typescript-eslint/eslint-plugin": "8.58.0",
+        "@typescript-eslint/parser": "8.58.0",
+        "@typescript-eslint/typescript-estree": "8.58.0",
+        "@typescript-eslint/utils": "8.58.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -15103,7 +15497,7 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/typo-js": {
@@ -15120,9 +15514,9 @@
       "license": "MIT"
     },
     "node_modules/ufo": {
-      "version": "1.6.3",
-      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.3.tgz",
-      "integrity": "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==",
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.4.tgz",
+      "integrity": "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==",
       "license": "MIT"
     },
     "node_modules/uint8-to-base64": {
@@ -15151,9 +15545,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "version": "7.19.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz",
+      "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
       "license": "MIT"
     },
     "node_modules/universalify": {
@@ -15265,9 +15659,9 @@
       }
     },
     "node_modules/uuid": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
-      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -15305,18 +15699,17 @@
       "license": "MIT"
     },
     "node_modules/vite": {
-      "version": "7.3.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
-      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
+      "version": "8.0.10",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.10.tgz",
+      "integrity": "sha512-rZuUu9j6J5uotLDs+cAA4O5H4K1SfPliUlQwqa6YEwSrWDZzP4rhm00oJR5snMewjxF5V/K3D4kctsUTsIU9Mw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "^0.27.0",
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.3",
-        "postcss": "^8.5.6",
-        "rollup": "^4.43.0",
-        "tinyglobby": "^0.2.15"
+        "lightningcss": "^1.32.0",
+        "picomatch": "^4.0.4",
+        "postcss": "^8.5.10",
+        "rolldown": "1.0.0-rc.17",
+        "tinyglobby": "^0.2.16"
       },
       "bin": {
         "vite": "bin/vite.js"
@@ -15332,9 +15725,10 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.1.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
-        "lightningcss": "^1.21.0",
         "sass": "^1.70.0",
         "sass-embedded": "^1.70.0",
         "stylus": ">=0.54.8",
@@ -15347,15 +15741,18 @@
         "@types/node": {
           "optional": true
         },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
         "jiti": {
           "optional": true
         },
         "less": {
           "optional": true
         },
-        "lightningcss": {
-          "optional": true
-        },
         "sass": {
           "optional": true
         },
@@ -15380,40 +15777,15 @@
       }
     },
     "node_modules/vite-string-plugin": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/vite-string-plugin/-/vite-string-plugin-2.0.0.tgz",
-      "integrity": "sha512-7p4aOvow1kphhZppt62A6Aj03NhUzOTiBgjHaTWDIdmtiUbjoJeVLarV52UjQNvLFC6BxJgV8r1AAwJfcxwZSQ==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/vite-string-plugin/-/vite-string-plugin-2.0.2.tgz",
+      "integrity": "sha512-pHU9lZuUoMSYyZixdn2XBYko9IAhk3dr41CG6VsXrjB+wN2th06SZsO9mJm6+2NhKBJKNfRERaRej8TBcoq9tQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "peerDependencies": {
         "vite": "*"
       }
     },
-    "node_modules/vite/node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/vite/node_modules/fdir": {
-      "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "peerDependencies": {
-        "picomatch": "^3 || ^4"
-      },
-      "peerDependenciesMeta": {
-        "picomatch": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/vite/node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
@@ -15430,9 +15802,9 @@
       }
     },
     "node_modules/vite/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15442,77 +15814,32 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/vite/node_modules/rollup": {
-      "version": "4.56.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.56.0.tgz",
-      "integrity": "sha512-9FwVqlgUHzbXtDg9RCMgodF3Ua4Na6Gau+Sdt9vyCN4RhHfVKX2DCHy3BjMLTDd47ITDhYAnTwGulWTblJSDLg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "1.0.8"
-      },
-      "bin": {
-        "rollup": "dist/bin/rollup"
-      },
-      "engines": {
-        "node": ">=18.0.0",
-        "npm": ">=8.0.0"
-      },
-      "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.56.0",
-        "@rollup/rollup-android-arm64": "4.56.0",
-        "@rollup/rollup-darwin-arm64": "4.56.0",
-        "@rollup/rollup-darwin-x64": "4.56.0",
-        "@rollup/rollup-freebsd-arm64": "4.56.0",
-        "@rollup/rollup-freebsd-x64": "4.56.0",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.56.0",
-        "@rollup/rollup-linux-arm-musleabihf": "4.56.0",
-        "@rollup/rollup-linux-arm64-gnu": "4.56.0",
-        "@rollup/rollup-linux-arm64-musl": "4.56.0",
-        "@rollup/rollup-linux-loong64-gnu": "4.56.0",
-        "@rollup/rollup-linux-loong64-musl": "4.56.0",
-        "@rollup/rollup-linux-ppc64-gnu": "4.56.0",
-        "@rollup/rollup-linux-ppc64-musl": "4.56.0",
-        "@rollup/rollup-linux-riscv64-gnu": "4.56.0",
-        "@rollup/rollup-linux-riscv64-musl": "4.56.0",
-        "@rollup/rollup-linux-s390x-gnu": "4.56.0",
-        "@rollup/rollup-linux-x64-gnu": "4.56.0",
-        "@rollup/rollup-linux-x64-musl": "4.56.0",
-        "@rollup/rollup-openbsd-x64": "4.56.0",
-        "@rollup/rollup-openharmony-arm64": "4.56.0",
-        "@rollup/rollup-win32-arm64-msvc": "4.56.0",
-        "@rollup/rollup-win32-ia32-msvc": "4.56.0",
-        "@rollup/rollup-win32-x64-gnu": "4.56.0",
-        "@rollup/rollup-win32-x64-msvc": "4.56.0",
-        "fsevents": "~2.3.2"
-      }
-    },
     "node_modules/vitest": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.0.18.tgz",
-      "integrity": "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.2.tgz",
+      "integrity": "sha512-xjR1dMTVHlFLh98JE3i/f/WePqJsah4A0FK9cc8Ehp9Udk0AZk6ccpIZhh1qJ/yxVWRZ+Q54ocnD8TXmkhspGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.0.18",
-        "@vitest/mocker": "4.0.18",
-        "@vitest/pretty-format": "4.0.18",
-        "@vitest/runner": "4.0.18",
-        "@vitest/snapshot": "4.0.18",
-        "@vitest/spy": "4.0.18",
-        "@vitest/utils": "4.0.18",
-        "es-module-lexer": "^1.7.0",
-        "expect-type": "^1.2.2",
+        "@vitest/expect": "4.1.2",
+        "@vitest/mocker": "4.1.2",
+        "@vitest/pretty-format": "4.1.2",
+        "@vitest/runner": "4.1.2",
+        "@vitest/snapshot": "4.1.2",
+        "@vitest/spy": "4.1.2",
+        "@vitest/utils": "4.1.2",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
         "obug": "^2.1.1",
         "pathe": "^2.0.3",
         "picomatch": "^4.0.3",
-        "std-env": "^3.10.0",
+        "std-env": "^4.0.0-rc.1",
         "tinybench": "^2.9.0",
         "tinyexec": "^1.0.2",
         "tinyglobby": "^0.2.15",
-        "tinyrainbow": "^3.0.3",
-        "vite": "^6.0.0 || ^7.0.0",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
         "why-is-node-running": "^2.3.0"
       },
       "bin": {
@@ -15528,12 +15855,13 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.0.18",
-        "@vitest/browser-preview": "4.0.18",
-        "@vitest/browser-webdriverio": "4.0.18",
-        "@vitest/ui": "4.0.18",
+        "@vitest/browser-playwright": "4.1.2",
+        "@vitest/browser-preview": "4.1.2",
+        "@vitest/browser-webdriverio": "4.1.2",
+        "@vitest/ui": "4.1.2",
         "happy-dom": "*",
-        "jsdom": "*"
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
         "@edge-runtime/vm": {
@@ -15562,6 +15890,9 @@
         },
         "jsdom": {
           "optional": true
+        },
+        "vite": {
+          "optional": false
         }
       }
     },
@@ -15576,9 +15907,9 @@
       }
     },
     "node_modules/vitest/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15589,16 +15920,16 @@
       }
     },
     "node_modules/vue": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.28.tgz",
-      "integrity": "sha512-BRdrNfeoccSoIZeIhyPBfvWSLFP4q8J3u8Ju8Ug5vu3LdD+yTM13Sg4sKtljxozbnuMu1NB1X5HBHRYUzFocKg==",
+      "version": "3.5.33",
+      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.33.tgz",
+      "integrity": "sha512-1AgChhx5w3ALgT4oK3acm2Es/7jyZhWSVUfs3rOBlGQC0rjEDkS7G4lWlJJGGNQD+BV3reCwbQrOe1mPNwKHBQ==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-dom": "3.5.28",
-        "@vue/compiler-sfc": "3.5.28",
-        "@vue/runtime-dom": "3.5.28",
-        "@vue/server-renderer": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/compiler-dom": "3.5.33",
+        "@vue/compiler-sfc": "3.5.33",
+        "@vue/runtime-dom": "3.5.33",
+        "@vue/server-renderer": "3.5.33",
+        "@vue/shared": "3.5.33"
       },
       "peerDependencies": {
         "typescript": "*"
@@ -15620,24 +15951,24 @@
       }
     },
     "node_modules/vue-component-type-helpers": {
-      "version": "2.2.12",
-      "resolved": "https://registry.npmjs.org/vue-component-type-helpers/-/vue-component-type-helpers-2.2.12.tgz",
-      "integrity": "sha512-YbGqHZ5/eW4SnkPNR44mKVc6ZKQoRs/Rux1sxC6rdwXb4qpbOSYfDr9DsTHolOTGmIKgM9j141mZbBeg05R1pw==",
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/vue-component-type-helpers/-/vue-component-type-helpers-3.2.7.tgz",
+      "integrity": "sha512-+gPp5YGmhfsj1IN+xUo7y0fb4clfnOiiUA39y07yW1VzCRjzVgwLbtmdWlghh7mXrPsEaYc7rrIir/HT6C8vYQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/vue-eslint-parser": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/vue-eslint-parser/-/vue-eslint-parser-10.2.0.tgz",
-      "integrity": "sha512-CydUvFOQKD928UzZhTp4pr2vWz1L+H99t7Pkln2QSPdvmURT0MoC4wUccfCnuEaihNsu9aYYyk+bep8rlfkUXw==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/vue-eslint-parser/-/vue-eslint-parser-10.4.0.tgz",
+      "integrity": "sha512-Vxi9pJdbN3ZnVGLODVtZ7y4Y2kzAAE2Cm0CZ3ZDRvydVYxZ6VrnBhLikBsRS+dpwj4Jv4UCv21PTEwF5rQ9WXg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
       "dependencies": {
         "debug": "^4.4.0",
-        "eslint-scope": "^8.2.0",
-        "eslint-visitor-keys": "^4.2.0",
-        "espree": "^10.3.0",
+        "eslint-scope": "^8.2.0 || ^9.0.0",
+        "eslint-visitor-keys": "^4.2.0 || ^5.0.0",
+        "espree": "^10.3.0 || ^11.0.0",
         "esquery": "^1.6.0",
         "semver": "^7.6.3"
       },
@@ -15648,7 +15979,7 @@
         "url": "https://github.com/sponsors/mysticatea"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0"
       }
     },
     "node_modules/vue-loader": {
@@ -15712,9 +16043,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/webpack": {
-      "version": "5.105.4",
-      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.105.4.tgz",
-      "integrity": "sha512-jTywjboN9aHxFlToqb0K0Zs9SbBoW4zRUlGzI2tYNxVYcEi/IPpn+Xi4ye5jTLvX2YeLuic/IvxNot+Q1jMoOw==",
+      "version": "5.106.2",
+      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.106.2.tgz",
+      "integrity": "sha512-wGN3qcrBQIFmQ/c0AiOAQBvrZ5lmY8vbbMv4Mxfgzqd/B6+9pXtLo73WuS1dSGXM5QYY3hZnIbvx+K1xxe6FyA==",
       "license": "MIT",
       "dependencies": {
         "@types/eslint-scope": "^3.7.7",
@@ -15733,9 +16064,8 @@
         "events": "^3.2.0",
         "glob-to-regexp": "^0.4.1",
         "graceful-fs": "^4.2.11",
-        "json-parse-even-better-errors": "^2.3.1",
         "loader-runner": "^4.3.1",
-        "mime-types": "^2.1.27",
+        "mime-db": "^1.54.0",
         "neo-async": "^2.6.2",
         "schema-utils": "^4.3.3",
         "tapable": "^2.3.0",
@@ -15760,18 +16090,14 @@
       }
     },
     "node_modules/webpack-cli": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/webpack-cli/-/webpack-cli-6.0.1.tgz",
-      "integrity": "sha512-MfwFQ6SfwinsUVi0rNJm7rHZ31GyTcpVE5pgVA3hwFRb7COD4TzjUUwhGWKfO50+xdc2MQPuEBBJoqIMGt3JDw==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/webpack-cli/-/webpack-cli-7.0.2.tgz",
+      "integrity": "sha512-dB0R4T+C/8YuvM+fabdvil6QE44/ChDXikV5lOOkrUeCkW5hTJv2pGLE3keh+D5hjYw8icBaJkZzpFoaHV4T+g==",
       "license": "MIT",
       "dependencies": {
-        "@discoveryjs/json-ext": "^0.6.1",
-        "@webpack-cli/configtest": "^3.0.1",
-        "@webpack-cli/info": "^3.0.1",
-        "@webpack-cli/serve": "^3.0.1",
-        "colorette": "^2.0.14",
-        "commander": "^12.1.0",
-        "cross-spawn": "^7.0.3",
+        "@discoveryjs/json-ext": "^1.0.0",
+        "commander": "^14.0.3",
+        "cross-spawn": "^7.0.6",
         "envinfo": "^7.14.0",
         "fastest-levenshtein": "^1.0.12",
         "import-local": "^3.0.2",
@@ -15783,14 +16109,16 @@
         "webpack-cli": "bin/cli.js"
       },
       "engines": {
-        "node": ">=18.12.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/webpack"
       },
       "peerDependencies": {
-        "webpack": "^5.82.0"
+        "webpack": "^5.101.0",
+        "webpack-bundle-analyzer": "^4.0.0 || ^5.0.0",
+        "webpack-dev-server": "^5.0.0"
       },
       "peerDependenciesMeta": {
         "webpack-bundle-analyzer": {
@@ -15802,12 +16130,12 @@
       }
     },
     "node_modules/webpack-cli/node_modules/commander": {
-      "version": "12.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
-      "integrity": "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       }
     },
     "node_modules/webpack-merge": {
@@ -15825,13 +16153,12 @@
       }
     },
     "node_modules/webpack-sources": {
-      "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-1.4.3.tgz",
-      "integrity": "sha512-lgTS3Xhv1lCOKo7SA5TjKXMjpSM4sBjNV5+q2bqesbSPs5FjGmU6jjtBSkX9b4qW87vDIsCIlUPOEhbZrMdjeQ==",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.4.1.tgz",
+      "integrity": "sha512-eACpxRN02yaawnt+uUNIF7Qje6A9zArxBbcAJjK1PK3S9Ycg5jIuJ8pW4q8EMnwNZCEGltcjkRx1QzOxOkKD8A==",
       "license": "MIT",
-      "dependencies": {
-        "source-list-map": "^2.0.0",
-        "source-map": "~0.6.1"
+      "engines": {
+        "node": ">=10.13.0"
       }
     },
     "node_modules/webpack/node_modules/@types/estree": {
@@ -15840,12 +16167,6 @@
       "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "license": "MIT"
     },
-    "node_modules/webpack/node_modules/es-module-lexer": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.0.0.tgz",
-      "integrity": "sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw==",
-      "license": "MIT"
-    },
     "node_modules/webpack/node_modules/eslint-scope": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
@@ -15868,15 +16189,6 @@
         "node": ">=4.0"
       }
     },
-    "node_modules/webpack/node_modules/webpack-sources": {
-      "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.4.tgz",
-      "integrity": "sha512-7tP1PdV4vF+lYPnkMR0jMY5/la2ub5Fc/8VQrrU+lXkiM6C4TjVfGw7iKfyhnTQOsD+6Q/iKw0eFciziRgD58Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
     "node_modules/whatwg-mimetype": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-3.0.0.tgz",
@@ -16095,9 +16407,9 @@
       }
     },
     "node_modules/wrap-ansi/node_modules/string-width": {
-      "version": "8.2.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.0.tgz",
-      "integrity": "sha512-6hJPQ8N0V0P3SNmP6h2J99RLuzrWz2gvT7VnK5tKvrNqJoyS9W4/Fb8mo31UiPvy00z7DQXkP2hnKBVav76thw==",
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
       "license": "MIT",
       "dependencies": {
         "get-east-asian-width": "^1.5.0",
diff --git a/package.json b/package.json
index 67d3128d58..323dbb1de3 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
     "@citation-js/core": "0.7.21",
     "@citation-js/plugin-bibtex": "0.7.21",
     "@citation-js/plugin-software-formats": "0.6.2",
-    "@codemirror/autocomplete": "6.20.1",
+    "@codemirror/autocomplete": "6.20.2",
     "@codemirror/commands": "6.10.3",
     "@codemirror/lang-cpp": "6.0.3",
     "@codemirror/lang-css": "6.3.1",
@@ -25,11 +25,11 @@
     "@codemirror/lang-rust": "6.0.2",
     "@codemirror/lang-sass": "6.0.2",
     "@codemirror/lang-xml": "6.1.0",
-    "@codemirror/lang-yaml": "6.1.2",
-    "@codemirror/language": "6.12.2",
-    "@codemirror/search": "6.6.0",
+    "@codemirror/lang-yaml": "6.1.3",
+    "@codemirror/language": "6.12.3",
+    "@codemirror/search": "6.7.0",
     "@codemirror/state": "6.6.0",
-    "@codemirror/view": "6.40.0",
+    "@codemirror/view": "6.42.1",
     "@github/markdown-toolbar-element": "2.2.3",
     "@github/quote-selection": "2.1.0",
     "@github/text-expander-element": "2.9.4",
@@ -42,28 +42,28 @@
     "chart.js": "4.5.1",
     "chartjs-adapter-dayjs-4": "1.0.4",
     "chartjs-plugin-zoom": "2.2.0",
-    "clippie": "4.1.10",
+    "clippie": "4.1.15",
     "css-loader": "7.1.3",
     "dayjs": "1.11.19",
     "dropzone": "6.0.0-beta.2",
     "easymde": "2.18.0",
-    "esbuild-loader": "4.4.2",
+    "esbuild-loader": "4.4.3",
     "escape-goat": "4.0.0",
     "fast-glob": "3.3.3",
-    "htmx.org": "2.0.8",
+    "htmx.org": "2.0.10",
     "idiomorph": "0.3.0",
     "jquery": "3.7.1",
-    "katex": "0.16.38",
+    "katex": "0.16.45",
     "mermaid": "11.15.0",
     "mini-css-extract-plugin": "2.10.0",
-    "minimatch": "10.2.4",
+    "minimatch": "10.2.5",
     "pdfobject": "2.3.0",
-    "postcss": "8.5.10",
+    "postcss": "8.5.13",
     "postcss-loader": "8.2.1",
     "postcss-nesting": "14.0.0",
     "pretty-ms": "9.0.0",
     "sortablejs": "1.15.7",
-    "swagger-ui-dist": "5.31.2",
+    "swagger-ui-dist": "5.32.5",
     "tailwindcss": "3.4.19",
     "throttle-debounce": "5.0.0",
     "tinycolor2": "1.6.0",
@@ -72,55 +72,56 @@
     "tributejs": "5.1.3",
     "uint8-to-base64": "0.2.1",
     "vanilla-colorful": "0.7.2",
-    "vue": "3.5.28",
+    "vue": "3.5.33",
     "vue-chartjs": "5.3.3",
     "vue-loader": "17.4.2",
     "vue3-calendar-heatmap": "2.0.5",
-    "webpack": "5.105.4",
-    "webpack-cli": "6.0.1",
+    "webpack": "5.106.2",
+    "webpack-cli": "7.0.2",
     "wrap-ansi": "10.0.0"
   },
   "devDependencies": {
-    "@axe-core/playwright": "4.11.0",
+    "@axe-core/playwright": "4.11.2",
     "@eslint-community/eslint-plugin-eslint-comments": "4.7.1",
-    "@playwright/test": "1.57.0",
-    "@stoplight/spectral-cli": "6.15.0",
+    "@playwright/test": "1.58.2",
+    "@stoplight/spectral-cli": "6.15.1",
     "@stylistic/eslint-plugin": "5.10.0",
     "@stylistic/stylelint-plugin": "4.0.1",
-    "@vitejs/plugin-vue": "6.0.3",
-    "@vitest/coverage-v8": "4.0.18",
-    "@vitest/eslint-plugin": "1.6.9",
-    "@vue/test-utils": "2.4.6",
+    "@vitejs/plugin-vue": "6.0.6",
+    "@vitest/coverage-v8": "4.1.2",
+    "@vitest/eslint-plugin": "1.6.13",
+    "@vue/test-utils": "2.4.9",
     "eslint": "9.39.4",
     "eslint-import-resolver-typescript": "4.4.4",
     "eslint-plugin-array-func": "5.1.1",
-    "eslint-plugin-import-x": "4.16.1",
+    "eslint-plugin-import-x": "4.16.2",
     "eslint-plugin-no-jquery": "3.1.1",
     "eslint-plugin-no-use-extend-native": "0.7.2",
-    "eslint-plugin-playwright": "2.9.0",
-    "eslint-plugin-regexp": "3.0.0",
+    "eslint-plugin-playwright": "2.10.1",
+    "eslint-plugin-regexp": "3.1.0",
     "eslint-plugin-sonarjs": "3.0.7",
     "eslint-plugin-toml": "0.13.1",
     "eslint-plugin-unicorn": "63.0.0",
-    "eslint-plugin-vitest-globals": "1.5.0",
+    "eslint-plugin-vitest-globals": "1.6.1",
     "eslint-plugin-vue": "10.8.0",
     "eslint-plugin-vue-scoped-css": "2.12.0",
     "eslint-plugin-wc": "3.1.0",
-    "globals": "17.4.0",
+    "globals": "17.6.0",
     "happy-dom": "20.8.9",
     "license-checker-rseidelsohn": "4.4.2",
-    "markdownlint-cli": "0.47.0",
+    "markdownlint-cli": "0.48.0",
     "postcss-html": "1.8.1",
     "sharp": "0.34.5",
     "stylelint": "16.26.1",
     "stylelint-declaration-block-no-ignored-properties": "2.8.0",
     "stylelint-declaration-strict-value": "1.11.1",
+    "stylelint-plugin-logical-css": "2.1.0",
     "stylelint-value-no-unknown-custom-properties": "6.1.1",
     "svgo": "4.0.1",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.56.1",
-    "vite-string-plugin": "2.0.0",
-    "vitest": "4.0.18"
+    "typescript-eslint": "8.58.0",
+    "vite-string-plugin": "2.0.2",
+    "vitest": "4.1.2"
   },
   "browserslist": ["defaults"],
   "scarfSettings": {
diff --git a/public/assets/img/svg/fediverse-small.svg b/public/assets/img/svg/fediverse-small.svg
new file mode 100644
index 0000000000..90f9a79ef5
--- /dev/null
+++ b/public/assets/img/svg/fediverse-small.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 6.35 6.35" class="svg fediverse-small" width="16" height="16" aria-hidden="true"><path d="M3.59 1.16a.204.204 0 0 0-.24.16.204.204 0 0 0 .158.24 1.63 1.63 0 0 1 .832.45 1.64 1.64 0 0 1 .353 1.806.204.204 0 0 0 .11.268.204.204 0 0 0 .265-.11A2.055 2.055 0 0 0 3.59 1.16M1.547 2.266a.204.204 0 0 0-.266.109 2.054 2.054 0 0 0 1.48 2.814.204.204 0 0 0 .241-.158.204.204 0 0 0-.16-.242 1.63 1.63 0 0 1-.832-.45 1.64 1.64 0 0 1-.483-1.163c0-.228.046-.446.13-.643a.204.204 0 0 0-.11-.267" style="stroke-linecap:round" transform="matrix(1.28704 0 0 1.31102 -.911 -.987)"/><path d="M1.72.264C1.065.264.53.802.53 1.456c0 .655.535 1.19 1.19 1.19s1.19-.535 1.19-1.19S2.373.264 1.72.264m0 .53c.368 0 .661.294.661.662a.66.66 0 0 1-.661.662.66.66 0 0 1-.662-.662c0-.368.293-.661.662-.661M4.63 3.705c-.654 0-1.19.535-1.19 1.19s.536 1.19 1.19 1.19c.655 0 1.19-.536 1.19-1.19 0-.655-.535-1.19-1.19-1.19m0 .527c.37 0 .661.294.661.663a.657.657 0 0 1-.66.662.66.66 0 0 1-.662-.662c0-.369.293-.663.662-.663"/></svg>
\ No newline at end of file
diff --git a/release-notes-assistant.sh b/release-notes-assistant.sh
index 4963edf286..9fdadc06f3 100755
--- a/release-notes-assistant.sh
+++ b/release-notes-assistant.sh
@@ -40,7 +40,7 @@ function test_main() {
   test "$(categorize)" = 'BB Breaking bug fixes'
 
   test_payload_labels $label_worth $label_breaking
-  test "$(categorize)" = 'ZB Breaking changes without a feature or bug label'
+  test "$(categorize)" = 'BC Breaking changes without a feature or bug label'
 
   test_payload_labels $label_worth $label_ui $label_feature
   test "$(categorize)" = 'CA User Interface features'
@@ -232,7 +232,7 @@ function categorize() {
     elif $is_bug; then
       echo -n BB Breaking bug fixes
     else
-      echo -n ZB Breaking changes without a feature or bug label
+      echo -n BC Breaking changes without a feature or bug label
     fi
   elif $is_ui; then
     if $is_feature; then
diff --git a/release-notes-published/11.0.12.md b/release-notes-published/11.0.12.md
new file mode 100644
index 0000000000..34b91c3460
--- /dev/null
+++ b/release-notes-published/11.0.12.md
@@ -0,0 +1,18 @@
+
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12027): <!--number 12027 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ28gdG8gdjEuMjUuOSAodjExLjAvZm9yZ2Vqbyk=-->Update dependency go to v1.25.9 (v11.0/forgejo)<!--description-->
+- Bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11642) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11679)): <!--number 11679 --><!--line 0 --><!--description Zml4OiBkb24ndCB0cmlwIGRlbGV0aW5nIGF0dGFjaG1lbnQgd2l0aCBtaXNzaW5nIHBlcm1pc3Npb24gZXJyb3I=-->fix: don't trip deleting attachment with missing permission error<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11884): <!--number 11884 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgaGFwcHktZG9tIHRvIHYyMC44LjkgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update dependency happy-dom to v20.8.9 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11898): <!--number 11898 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWdpdC9nby1naXQvdjUgdG8gdjUuMTcuMSBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11837): <!--number 11837 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgaGFwcHktZG9tIHRvIHYyMC44LjggW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update dependency happy-dom to v20.8.8 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11831): <!--number 11831 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUxLjAgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.51.0 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11819): <!--number 11819 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzguMCBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.38.0 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11801) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11803)): <!--number 11803 --><!--line 0 --><!--description Y2k6IHVwZGF0ZSB0ZXN0cyB0byBydW4gZGViaWFuIHRyaXhpZSwgcmVtb3ZlIG1hbnVhbCBpbnN0YWxsYXRpb24gZnJvbSBgdGVzdGluZ2A=-->ci: update tests to run debian trixie, remove manual installation from `testing`<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes-published/11.0.13.md b/release-notes-published/11.0.13.md
new file mode 100644
index 0000000000..2db924f20b
--- /dev/null
+++ b/release-notes-published/11.0.13.md
@@ -0,0 +1,15 @@
+
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12295): <!--number 12295 --><!--line 0 --><!--description V2hlbiBhIHB1bGwgcmVxdWVzdCBpcyBvcGVuZWQsIHRoZSBhdXRob3IgaXMgYWJsZSB0byBtYXJrIHRoYXQgcHVsbCByZXF1ZXN0IHRvICJBbGxvdyBlZGl0cyBmcm9tIG1haW50YWluZXJzIiwgd2hpY2ggZ3JhbnRzIHRoZSBtYWludGFpbmVycyBvZiB0aGUgcHVsbCByZXF1ZXN0J3MgcmVwbyBhY2Nlc3MgdG8gZWRpdCB0aGUgcHVsbCByZXF1ZXN0IGJyYW5jaCBjb250ZW50cy4gIEl0IGlzIHBvc3NpYmxlIHRvIGNyZWF0ZSBhIHB1bGwgcmVxdWVzdCB3aGVyZSB0aGUgcHVsbCByZXF1ZXN0IGF1dGhvciBkb2VzIG5vdCBoYXZlIHRoZSBhYmlsaXR5IHRvIGVkaXQgdGhlIHB1bGwgcmVxdWVzdCBicmFuY2guICBEdWUgdG8gYSBtaXNzaW5nIHNlY3VyaXR5IGNoZWNrIGZvciB0aGlzIGNhc2UsIG1haW50YWluZXJzIG9mIHRoZSBwdWxsIHJlcXVlc3QgcmVwbyB3b3VsZCBiZSBncmFudGVkIHRoZSBhYmlsaXR5IHRvIGVkaXQgdGhlIHB1bGwgcmVxdWVzdCBicmFuY2gsIGV2ZW4gaWYgdGhlIGF1dGhvciBvZiB0aGUgcHVsbCByZXF1ZXN0IGRpZCBub3QgaGF2ZSB0aGF0IGFiaWxpdHkuICBCeSBleHBsb2l0aW5nIHRoaXMgbWlzc2luZyBzZWN1cml0eSBjaGVjaywgYSB1c2VyIGNhbiBlZGl0IGFueSBicmFuY2ggaW4gYSByZXBvc2l0b3J5IGlmIHRoZXkncmUgYWJsZSB0byBmb3JrIHRoYXQgcmVwb3NpdG9yeS4gIFRoZSBpc3N1ZSBpcyBiZWluZyBmaXhlZCBieSByZXN0cmljdGluZyB0aGUgc2NvcGUgb2YgIkFsbG93IGVkaXRzIGZyb20gbWFpbnRhaW5lcnMiIHRvIG9ubHkgZ3JhbnQgdGhhdCBhY2Nlc3MgaWYgdGhlIHB1bGwgcmVxdWVzdCBhdXRob3IgYWxzbyBoYWQgYWNjZXNzIHRvIGVkaXQgdGhlIGJyYW5jaC4=-->When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents.  It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch.  Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability.  By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository.  The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12156) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12315)): <!--number 12315 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8tYnVpbGQtcHVibGlzaCBhY3Rpb24gdG8gdjUuNi4wIChmb3JnZWpvKQ==-->Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.6.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12253): <!--number 12253 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgcG9zdGNzcyB0byB2OC41LjEwIFtTRUNVUklUWV0gKHYxMS4wL2Zvcmdlam8p-->Update dependency postcss to v8.5.10 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12222): <!--number 12222 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzkuMCBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.39.0 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12175): <!--number 12175 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWdpdC9nby1naXQvdjUgdG8gdjUuMTguMCBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKSAtIGF1dG9jbG9zZWQ=-->Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (v11.0/forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12144) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12148)): <!--number 12148 --><!--line 0 --><!--description Zml4OiBtYWtlIC9yZXBvcy9zZWFyY2g/dWlkPS0yIHJldHVybiB6ZXJvIHJlc3VsdHMsIG5vIHJlcG9zIHdpdGggdGhhdCBvd25lcg==-->fix: make /repos/search?uid=-2 return zero results, no repos with that owner<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes-published/11.0.14.md b/release-notes-published/11.0.14.md
new file mode 100644
index 0000000000..1c7bf69e3f
--- /dev/null
+++ b/release-notes-published/11.0.14.md
@@ -0,0 +1,17 @@
+
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 0 --><!--description LSBmaXg6IHByZXZlbnQgZ2l0IHdyaXRlIHRvIHdpa2kgcmVwbyBmcm9tIHVuYXV0aG9yaXplZCB1c2VyIHZpYSBnaXQgSFRUUA==-->fix: prevent git write to wiki repo from unauthorized user via git HTTP<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 1 --><!--description LSBmaXg6IHByZXZlbnQgTEZTIGF1dGhvcml6YXRpb24gdG9rZW4gZnJvbSBiZWluZyB1c2VkIGZvciByZWFkL3dyaXRlIGFjY2VzcyBhZnRlciB1c2VyJ3MgYWNjZXNzIGlzIHJlc3RyaWN0ZWQgZnJvbSBGb3JnZWpv-->fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 2 --><!--description LSBmaXg6IHByZXZlbnQgc2NvcGVkIEFQSSBhY2Nlc3MgKE9BdXRoIHRva2VucywgQWNjZXNzIHRva2VucykgZnJvbSBhY2Nlc3NpbmcgcmVzb3VyY2VzIGJleW9uZCB0aGVpciBwZXJtaXR0ZWQgc2NvcGUgdmlhIG5vbi1BUEkgZW5kcG9pbnRzIChlLmcuIC91c2VyL3JlcG8vcmF3Ly4uLik=-->fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 3 --><!--description LSBmaXg6IGltcGxlbWVudGluZyBtaXNzaW5nIE9BdXRoIHZhbGlkYXRpb24gY2hlY2tzLCBpbXByb3ZlIHByb3RlY3Rpb25zIGFnYWluc3QgcmFjZSBjb25kaXRpb25z-->fix: implementing missing OAuth validation checks, improve protections against race conditions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 4 --><!--description LSBmaXg6IHByZXZlbnQgT0F1dGggcmVkaXJlY3QgVVJJIHNwb29maW5nIHZpYSBub24tYXNjaWkgY2FzZSBjb2xsaXNpb24=-->fix: prevent OAuth redirect URI spoofing via non-ascii case collision<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 5 --><!--description LSBmaXg6IHN0cmVuZ3RoZW4gQWN0aW9ucyBBcnRpZmFjdCBWNCBzaWduYXR1cmUgYWxnb3JpdGhtIGFnYWluc3Qgc3Bvb2ZpbmcgYXR0YWNrcw==-->fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12527): <!--number 12527 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWVybWFpZCB0byB2MTEuMTUuMCBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update dependency mermaid to v11.15.0 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12463): <!--number 12463 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUzLjAgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.53.0 [SECURITY] (v11.0/forgejo)<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes-published/14.0.4.md b/release-notes-published/14.0.4.md
new file mode 100644
index 0000000000..533378dc21
--- /dev/null
+++ b/release-notes-published/14.0.4.md
@@ -0,0 +1,30 @@
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12028): <!--number 12028 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ28gdG8gdjEuMjUuOSAodjE0LjAvZm9yZ2Vqbyk=-->Update dependency go to v1.25.9 (v14.0/forgejo)<!--description-->
+- User Interface bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11614) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11725)): <!--number 11725 --><!--line 0 --><!--description TWFrZSBvdmVyZmxvdy1tZW51IFdlYiBDb21wb25lbnQgc2Nyb2xsIC8gb3ZlcmZsb3cgd2l0aCBKUyBvZmY=-->Make overflow-menu Web Component scroll / overflow with JS off<!--description-->
+- Localization
+  - Updates from from Codeberg Translate: [#12039](https://codeberg.org/forgejo/forgejo/pulls/12039) (backport of [#11460](https://codeberg.org/forgejo/forgejo/pulls/11460), [#11810](https://codeberg.org/forgejo/forgejo/pulls/11810))
+- Bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11821) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11850)): <!--number 11850 --><!--line 0 --><!--description Zml4OiBvdXQgb2Ygc3luY2hyb25pemF0aW9uIGVycm9yIGFmdGVyIGludGVycnVwdGluZyBhIFBSIG1lcmdlIGJ5IHVzZXItYWdlbnQgZGlzY29ubmVjdA==-->fix: out of synchronization error after interrupting a PR merge by user-agent disconnect<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11623) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11742)): <!--number 11742 --><!--line 0 --><!--description Zml4OiBjb21tZW50IGF0dGFjaG1lbnQgQVBJIGlzIG1vcmUgcmVzdHJpY3RpdmUgdGhhbiB0aGUgd2ViIFVJ-->fix: comment attachment API is more restrictive than the web UI<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11642) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11658)): <!--number 11658 --><!--line 0 --><!--description Zml4OiBkb24ndCB0cmlwIGRlbGV0aW5nIGF0dGFjaG1lbnQgd2l0aCBtaXNzaW5nIHBlcm1pc3Npb24gZXJyb3I=-->fix: don't trip deleting attachment with missing permission error<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11885): <!--number 11885 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgaGFwcHktZG9tIHRvIHYyMC44LjkgW1NFQ1VSSVRZXSAodjE0LjAvZm9yZ2Vqbyk=-->Update dependency happy-dom to v20.8.9 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11296) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11317)): <!--number 11317 --><!--line 0 --><!--description UEFNOiBwb3J0YWJsZSBlcnJvciByZXBvcnRpbmc=-->PAM: portable error reporting<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11899): <!--number 11899 --><!--line 0 --><!--description VXBkYXRlIGdpdGh1Yi5jb20vZ28tZ2l0L2dvLWdpdC92NSAoaW5kaXJlY3QpIHRvIHY1LjE3LjEgW1NFQ1VSSVRZXSAodjE0LjAvZm9yZ2Vqbyk=-->Update github.com/go-git/go-git/v5 (indirect) to v5.17.1 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11838): <!--number 11838 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgaGFwcHktZG9tIHRvIHYyMC44LjggW1NFQ1VSSVRZXSAodjE0LjAvZm9yZ2Vqbyk=-->Update dependency happy-dom to v20.8.8 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11828): <!--number 11828 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUxLjAgW1NFQ1VSSVRZXSAodjE0LjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.51.0 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11820): <!--number 11820 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzguMCBbU0VDVVJJVFldICh2MTQuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.38.0 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11801) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11802)): <!--number 11802 --><!--line 0 --><!--description Y2k6IHVwZGF0ZSB0ZXN0cyB0byBydW4gZGViaWFuIHRyaXhpZSwgcmVtb3ZlIG1hbnVhbCBpbnN0YWxsYXRpb24gZnJvbSBgdGVzdGluZ2A=-->ci: update tests to run debian trixie, remove manual installation from `testing`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11733) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11737)): <!--number 11737 --><!--line 0 --><!--description Zml4OiBwcmV2ZW50IGNvbnRhaW5lciByZWdpc3RyeSBoZWFkZXJzIGZyb20gbGVha2luZyBpbnRvIG90aGVyIHJlZ2lzdHJpZXM=-->fix: prevent container registry headers from leaking into other registries<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11691) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11722)): <!--number 11722 --><!--line 0 --><!--description Zml4OiByZW1vdmUgdGVtcGxhdGUgZmlsZSBmcm9tIGdlbmVyYXRlZCByZXBv-->fix: remove template file from generated repo<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11624) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11626)): <!--number 11626 --><!--line 0 --><!--description Y2hvcmUoZGVwcyk6IGJ1bXAgeG9ybSB0byB2MS4zLjktZm9yZ2Vqby44-->chore(deps): bump xorm to v1.3.9-forgejo.8<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11616) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11625)): <!--number 11625 --><!--line 0 --><!--description OiBmaXg6IHJlbW92ZSBzZWNvbmQgY2hhbGxlbmdlIGZyb20gV1dXLUF1dGhlbnRpY2F0ZSBoZWFkZXI=-->fix: remove second challenge from WWW-Authenticate header<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11588) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11613)): <!--number 11613 --><!--line 0 --><!--description Zml4OiB3ZWJob29rL2Rpc2NvcmQ6IG9taXQgZW1wdHkgZW1iZWRzLmZvb3RlciBmcm9tIHRoZSBwYXlsb2FkIGZvciBTcGFjZWJhciBjb21wYXRpYmlsaXR5-->fix: webhook/discord: omit empty embeds.footer from the payload for Spacebar compatibility<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11585) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11596)): <!--number 11596 --><!--line 0 --><!--description Zml4KGlzc3VlLXNlYXJjaCk6IGRlbGV0ZSBpc3N1ZSBmcm9tIGluZGV4ZXIgb24gRGVsZXRlSXNzdWU=-->fix(issue-search): delete issue from indexer on DeleteIssue<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11442) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11594)): <!--number 11594 --><!--line 0 --><!--description Zml4OiBlbmZvcmNlIHBhY2thZ2UgcXVvdGEgYWdhaW5zdCBwYWNrYWdlIG93bmVyLCBub3QgdXBsb2FkZXI=-->fix: enforce package quota against package owner, not uploader<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes-published/14.0.5.md b/release-notes-published/14.0.5.md
new file mode 100644
index 0000000000..4794bfb96d
--- /dev/null
+++ b/release-notes-published/14.0.5.md
@@ -0,0 +1,17 @@
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12294): <!--number 12294 --><!--line 0 --><!--description V2hlbiBhIHB1bGwgcmVxdWVzdCBpcyBvcGVuZWQsIHRoZSBhdXRob3IgaXMgYWJsZSB0byBtYXJrIHRoYXQgcHVsbCByZXF1ZXN0IHRvICJBbGxvdyBlZGl0cyBmcm9tIG1haW50YWluZXJzIiwgd2hpY2ggZ3JhbnRzIHRoZSBtYWludGFpbmVycyBvZiB0aGUgcHVsbCByZXF1ZXN0J3MgcmVwbyBhY2Nlc3MgdG8gZWRpdCB0aGUgcHVsbCByZXF1ZXN0IGJyYW5jaCBjb250ZW50cy4gIEl0IGlzIHBvc3NpYmxlIHRvIGNyZWF0ZSBhIHB1bGwgcmVxdWVzdCB3aGVyZSB0aGUgcHVsbCByZXF1ZXN0IGF1dGhvciBkb2VzIG5vdCBoYXZlIHRoZSBhYmlsaXR5IHRvIGVkaXQgdGhlIHB1bGwgcmVxdWVzdCBicmFuY2guICBEdWUgdG8gYSBtaXNzaW5nIHNlY3VyaXR5IGNoZWNrIGZvciB0aGlzIGNhc2UsIG1haW50YWluZXJzIG9mIHRoZSBwdWxsIHJlcXVlc3QgcmVwbyB3b3VsZCBiZSBncmFudGVkIHRoZSBhYmlsaXR5IHRvIGVkaXQgdGhlIHB1bGwgcmVxdWVzdCBicmFuY2gsIGV2ZW4gaWYgdGhlIGF1dGhvciBvZiB0aGUgcHVsbCByZXF1ZXN0IGRpZCBub3QgaGF2ZSB0aGF0IGFiaWxpdHkuICBCeSBleHBsb2l0aW5nIHRoaXMgbWlzc2luZyBzZWN1cml0eSBjaGVjaywgYSB1c2VyIGNhbiBlZGl0IGFueSBicmFuY2ggaW4gYSByZXBvc2l0b3J5IGlmIHRoZXkncmUgYWJsZSB0byBmb3JrIHRoYXQgcmVwb3NpdG9yeS4gIFRoZSBpc3N1ZSBpcyBiZWluZyBmaXhlZCBieSByZXN0cmljdGluZyB0aGUgc2NvcGUgb2YgIkFsbG93IGVkaXRzIGZyb20gbWFpbnRhaW5lcnMiIHRvIG9ubHkgZ3JhbnQgdGhhdCBhY2Nlc3MgaWYgdGhlIHB1bGwgcmVxdWVzdCBhdXRob3IgYWxzbyBoYWQgYWNjZXNzIHRvIGVkaXQgdGhlIGJyYW5jaC4=-->When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents.  It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch.  Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability.  By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository.  The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.<!--description-->
+- Localization
+  - Backport of translations from Codeberg Translate: [#12305](https://codeberg.org/forgejo/forgejo/pulls/12305) (backport of [#12128](https://codeberg.org/forgejo/forgejo/pulls/12128))
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12156) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12316)): <!--number 12316 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8tYnVpbGQtcHVibGlzaCBhY3Rpb24gdG8gdjUuNi4wIChmb3JnZWpvKQ==-->Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.6.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12254): <!--number 12254 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgcG9zdGNzcyB0byB2OC41LjEwIFtTRUNVUklUWV0gKHYxNC4wL2Zvcmdlam8p-->Update dependency postcss to v8.5.10 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12223): <!--number 12223 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzkuMCBbU0VDVVJJVFldICh2MTQuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.39.0 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12176): <!--number 12176 --><!--line 0 --><!--description VXBkYXRlIGdpdGh1Yi5jb20vZ28tZ2l0L2dvLWdpdC92NSAoaW5kaXJlY3QpIHRvIHY1LjE4LjAgW1NFQ1VSSVRZXSAodjE0LjAvZm9yZ2VqbykgLSBhdXRvY2xvc2Vk-->Update github.com/go-git/go-git/v5 (indirect) to v5.18.0 [SECURITY] (v14.0/forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12133): <!--number 12133 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2phY2tjL3BneC92NSB0byB2NS45LjAgW1NFQ1VSSVRZXSAodjE0LjAvZm9yZ2Vqbyk=-->Update module github.com/jackc/pgx/v5 to v5.9.0 [SECURITY] (v14.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12144) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12149)): <!--number 12149 --><!--line 0 --><!--description Zml4OiBtYWtlIC9yZXBvcy9zZWFyY2g/dWlkPS0yIHJldHVybiB6ZXJvIHJlc3VsdHMsIG5vIHJlcG9zIHdpdGggdGhhdCBvd25lcg==-->fix: make /repos/search?uid=-2 return zero results, no repos with that owner<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes-published/15.0.0.md b/release-notes-published/15.0.0.md
new file mode 100644
index 0000000000..58859791b0
--- /dev/null
+++ b/release-notes-published/15.0.0.md
@@ -0,0 +1,597 @@
+A [companion blog post](https://forgejo.org/2026-04-release-v15-0/) provides additional context on this major release.
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security features
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10059): <!--number 10059 --><!--line 0 --><!--description dXNlIGBrZXlpbmdgIGZvciB3ZWJob29rIHNlY3JldHM=-->use `keying` for webhook secrets<!--description-->
+- Breaking features
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11468): <!--number 11468 --><!--line 0 --><!--description cmVtb3ZlIGFkbWluLWxldmVsIHBlcm1pc3Npb25zIGZyb20gcmVwby1zcGVjaWZpYyAmIHB1YmxpYy1vbmx5IGFjY2VzcyB0b2tlbnM=-->remove admin-level permissions from repo-specific & public-only access tokens<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11736): <!--number 11736 --><!--line 0 --><!--description VGhlIHRlbXBsYXRlIGdlbmVyYXRpb24gKGBQT1NUIC9yZXBvcy97dGVtcGxhdGVfb3duZXJ9L3t0ZW1wbGF0ZV9yZXBvfS9nZW5lcmF0ZWApIGFuZCByZXBvc2l0b3J5IGRlbGV0aW9uIChgREVMRVRFIC9yZXBvcy97dXNlcm5hbWV9L3tyZXBvbmFtZX1gKSBBUElzIGhhdmUgYmVlbiB1cGRhdGVkIHRvIHJlcXVpcmUgdGhlIHNhbWUgcGVybWlzc2lvbiBzY29wZSBhcyBjcmVhdGluZyBhIG5ldyByZXBvc2l0b3J5LiBFaXRoZXIgYHdyaXRlOnVzZXJgIG9yIGB3cml0ZTpvcmdhbml6YXRpb25gIGlzIHJlcXVpcmVkLCBkZXBlbmRpbmcgb24gdGhlIG93bmVyIG9mIHRoZSByZXBvc2l0b3J5IGJlaW5nIGNyZWF0ZWQgb3IgZGVsZXRlZC4=-->The template generation (`POST /repos/{template_owner}/{template_repo}/generate`) and repository deletion (`DELETE /repos/{username}/{reponame}`) APIs have been updated to require the same permission scope as creating a new repository. Either `write:user` or `write:organization` is required, depending on the owner of the repository being created or deleted.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11457): <!--number 11457 --><!--line 0 --><!--description QWNjZXNzaW5nIHRoZSBgL3JlcG9zaXRvcmllcy97aWR9YCBBUEkgd2l0aCBhIHB1YmxpYy1vbmx5IGFjY2VzcyB0b2tlbiBkaWQgbm90IHJlc3RyaWN0IHJlYWQgYWNjZXNzIHRvIG9ubHkgcHVibGljIHJlcG9zaXRvcmllcywgd2hpY2ggaXMgbm93IHByZXZlbnRlZC4=-->Accessing the `/repositories/{id}` API with a public-only access token did not restrict read access to only public repositories, which is now prevented.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11457): <!--number 11457 --><!--line 1 --><!--description QWNjZXNzaW5nIHRoZSBgL3JlcG9zL3tvd25lcn0ve3JlcG99L2lzc3Vlcy97aW5kZXh9L2RlcGVuZGVuY2llc2AgYW5kIGAvcmVwb3Mve293bmVyfS97cmVwb30vaXNzdWVzL3tpbmRleH0vYmxvY2tzYCBBUElzIHdpdGggYSBwdWJsaWMtb25seSBhY2Nlc3MgdG9rZW4gaGFkIGFjY2VzcyB0byBtb2RpZmljYXRpb24gb3BlcmF0aW9ucyBhZ2FpbnN0IHByaXZhdGUgcmVwb3NpdG9yaWVzIGluIHRoZSAqZm9ybSogY29tcG9uZW50IG9mIHRoZSBBUEkgKG5vdCB0aGUgVVJMIGNvbXBvbmVudCksIHdoaWNoIGlzIG5vdyBwcmV2ZW50ZWQu-->Accessing the `/repos/{owner}/{repo}/issues/{index}/dependencies` and `/repos/{owner}/{repo}/issues/{index}/blocks` APIs with a public-only access token had access to modification operations against private repositories in the *form* component of the API (not the URL component), which is now prevented.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11457): <!--number 11457 --><!--line 2 --><!--description QWNjZXNzaW5nIHRoZSBgL3JlcG9zL3tvd25lcn0ve3JlcG99L2lzc3Vlcy97aW5kZXh9L2RlcGVuZGVuY2llc2AgYW5kIGAvcmVwb3Mve293bmVyfS97cmVwb30vaXNzdWVzL3tpbmRleH0vYmxvY2tzYCBBUElzIHdpdGggYSBwdWJsaWMtb25seSBhY2Nlc3MgdG9rZW4gY291bGQgdmlldyBkZXBlbmRlbmNpZXMgb3IgYmxvY2tpbmcgaXNzdWVzIGZyb20gcHJpdmF0ZSByZXBvc2l0b3JpZXMsIHdoaWNoIGlzIG5vdyBwcmV2ZW50ZWQu-->Accessing the `/repos/{owner}/{repo}/issues/{index}/dependencies` and `/repos/{owner}/{repo}/issues/{index}/blocks` APIs with a public-only access token could view dependencies or blocking issues from private repositories, which is now prevented.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11457): <!--number 11457 --><!--line 3 --><!--description QWNjZXNzaW5nIHRoZSBgL3JlcG9zL3tvd25lcn0ve3JlcG99L2lzc3Vlcy97aW5kZXh9L3RpbWVsaW5lYCBBUEkgd2l0aCBhIHB1YmxpYy1vbmx5IGFjY2VzcyB0b2tlbiBjb3VsZCB2aWV3IGNvbW1lbnQgY3Jvc3MtcmVmZXJlbmNlcyBmcm9tIHByaXZhdGUgcmVwb3NpdG9yaWVzLCB3aGljaCBpcyBub3cgcHJldmVudGVkLg==-->Accessing the `/repos/{owner}/{repo}/issues/{index}/timeline` API with a public-only access token could view comment cross-references from private repositories, which is now prevented.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11457): <!--number 11457 --><!--line 4 --><!--description QWNjZXNzaW5nIHRoZSBgL3RlYW1zL3tpZH0vcmVwb3Mve29yZ30ve3JlcG99YCBBUEkgd2l0aCBhIHB1YmxpYy1vbmx5IGFjY2VzcyB0b2tlbiBjb3VsZCB2aWV3IHByaXZhdGUgcmVwb3NpdG9yaWVzIGFzc2lnbmVkIHRvIGEgdGVhbSwgd2hpY2ggaXMgbm93IHByZXZlbnRlZC4=-->Accessing the `/teams/{id}/repos/{org}/{repo}` API with a public-only access token could view private repositories assigned to a team, which is now prevented.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11457): <!--number 11457 --><!--line 5 --><!--description QWNjZXNzIHRoZSB3YXRjaGVkIHJlcG9zIGFuZCBzdGFycmVkIHJlcG9zIG9mIGEgeW91ciBvd24gdXNlciB0aHJvdWdoIC91c2VyL3N1YnNjcmlwdGlvbnMgYW5kIC91c2VyL3N0YXJyZWQgQVBJcyB3aXRoIGEgcHVibGljLW9ubHkgYWNjZXNzIHRva2VuIGNvdWxkIHZpZXcgcHJpdmF0ZSByZXBvc2l0b3JpZXMsIHdoaWNoIGlzIG5vdyBwcmV2ZW50ZWQu-->Access the watched repos and starred repos of a your own user through /user/subscriptions and /user/starred APIs with a public-only access token could view private repositories, which is now prevented.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11458): <!--number 11458 --><!--line 0 --><!--description aW1wbGVtZW50IHJlcG8tc3BlY2lmaWMgYWNjZXNzIHRva2VucyBpbiByZWxldmFudCBzZWFyY2ggJiBsaXN0IEFQSXMuICAqKkJyZWFraW5nKio6IHRoZSBmb2xsb3dpbmcgQVBJcyBjb3VsZCBwcmV2aW91c2x5IHJldHVybiBwcml2YXRlIHJlcG9zaXRvcmllcyB3aGVuIHVzaW5nIGEgcHVibGljLW9ubHkgYWNjZXNzIHRva2VuLCBidXQgY2FuIG5vIGxvbmdlciBkbyBzbzogYC91c2VyL3JlcG9zYCwgYC91c2Vycy97dXNlcm5hbWV9L3JlcG9zYCwgYC9vcmdzL3tvcmd9L3JlcG9zYCwgYW5kIGAvdGVhbXMve2lkfS9yZXBvc2Au-->implement repo-specific access tokens in relevant search & list APIs. **Breaking**: the following APIs could previously return private repositories when using a public-only access token, but can no longer do so: `/user/repos`, `/users/{username}/repos`, `/orgs/{org}/repos`, and `/teams/{id}/repos`.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11437): <!--number 11437 --><!--line 0 --><!--description aW1wbGVtZW50IHJlcG8tc3BlY2lmaWMgYWNjZXNzIHRva2VucyBicm9hZGx5IGZvciB1bml2ZXJzYWwgQVBJIHBlcm1pc3Npb24gY2hlY2tzLiAgKipCcmVha2luZzoqKiBBUEkgYWNjZXNzIHdpdGggYSBwdWJsaWMtb25seSBhY2Nlc3MgdG9rZW4gd291bGQgcHJldmlvdXNseSByZXR1cm4gYSBgNDAzIEZvcmJpZGRlbmAgZXJyb3Igd2hlbiBhdHRlbXB0aW5nIHRvIGFjY2VzcyBhIHByaXZhdGUgcmVwb3NpdG9yeSB3aGVyZSB0aGUgcmVwb3NpdG9yeSBpcyBvbiB0aGUgQVBJIHBhdGguICBBcyBwYXJ0IG9mIGluY29ycG9yYXRpbmcgdGhlIHB1YmxpYy1vbmx5IGxvZ2ljIGludG8gdGhlIGNlbnRyYWxpemVkIHBlcm1pc3Npb24gY2hlY2ssIHRoZXNlIEFQSXMgd2lsbCBub3cgcmV0dXJuIGA0MDQgTm90IEZvdW5kYCBpbnN0ZWFkLCBjb25zaXN0ZW50IHdpdGggaG93IG1vc3QgcGVybWlzc2lvbiBjaGVja3MgYXJlIGltcGxlbWVudGVkIGluIG9yZGVyIHRvIHJlZHVjZSB0aGUgcmlzayBvZiBkYXRhIHByb2JpbmcgdGhyb3VnaCBlcnJvciBtZXNzYWdlcy4=-->implement repo-specific access tokens broadly for universal API permission checks. **Breaking:** API access with a public-only access token would previously return a `403 Forbidden` error when attempting to access a private repository where the repository is on the API path.  As part of incorporating the public-only logic into the centralized permission check, these APIs will now return `404 Not Found` instead, consistent with how most permission checks are implemented in order to reduce the risk of data probing through error messages.<!--description-->
+- Breaking bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11096): <!--number 11096 --><!--line 0 --><!--description Zml4KHVpKSE6IFJlbW92ZSB0aGUgaW5zdGFuY2UgY29uZmlndXJhdGlvbiBvcHRpb24gYHJlcG9zaXRvcnkucHVsbC1yZXF1ZXN0LkFERF9DT19DT01NSVRURVJfVFJBSUxFUlNgICh3YXMgZW5hYmxlZCBieSBkZWZhdWx0KS4gSXQgd2FzIHJlc3BvbnNpYmxlIGZvciBhZGRpdGlvbiBvZiB1bmV4cGVjdGVkIHRyYWlsZXJzIHRvIGNvbW1pdCBtZXNzYWdlcyBpbiBzcXVhc2ggbWVyZ2VzLiBUaGVzZSB0cmFpbGVycyB3ZXJlIGBDby1hdXRob3JlZC1ieTogYCBhbmQgYENvLWNvbW1pdHRlZC1ieTogYC4gQm90aCB1c2VkIHRoZSBwdWxsIHJlcXVlc3QgYXV0aG9yIGFzIHZhbHVlLCB3aG8gaXMgYWxzbyBhc3NpZ25lZCBhcyB0aGUgYXV0aG9yIG9mIHRoZSBzcXVhc2ggbWVyZ2UgY29tbWl0LCB3aGljaCB0aGV5IHdlcmUganVzdCByZXBlYXRpbmcuIEZ1cnRoZXJtb3JlLCBgQ28tY29tbWl0dGVkLWJ5OiBgIGlzIGFuIHVuY29tbW9uIGNvbW1pdCB0cmFpbGVyLCBhbmQgdGhlcmUgaXMgb25seSBvbmUgY29tbWl0dGVyIGZvciBhIGNvbW1pdC4gVGhlIHRyYWlsZXJzIHdlcmUgYmVpbmcgYWRkZWQgYnkgRm9yZ2VqbyB3aGlsZSBwZXJmb3JtaW5nIHRoZSBtZXJnZSwgYnlwYXNzaW5nIHVzZXIgaW5wdXQgaW4gdGhlIFVJIGFuZCB3ZXJlbid0IHNob3duIGluIGl0LiBTZWUgZnVydGhlciBkZXNjcmlwdGlvbiBhbmQgbW9yZSBleGFtcGxlcyBpbiBbIzExMDk3XShodHRwczovL2NvZGViZXJnLm9yZy9mb3JnZWpvL2Zvcmdlam8vaXNzdWVzLzExMDk3KS4=-->fix(ui)!: Remove the instance configuration option `repository.pull-request.ADD_CO_COMMITTER_TRAILERS` (was enabled by default). It was responsible for addition of unexpected trailers to commit messages in squash merges. These trailers were `Co-authored-by: ` and `Co-committed-by: `. Both used the pull request author as value, who is also assigned as the author of the squash merge commit, which they were just repeating. Furthermore, `Co-committed-by: ` is an uncommon commit trailer, and there is only one committer for a commit. The trailers were being added by Forgejo while performing the merge, bypassing user input in the UI and weren't shown in it. See further description and more examples in [#11097](https://codeberg.org/forgejo/forgejo/issues/11097).<!--description-->
+- Breaking changes without a feature or bug label
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11098): <!--number 11098 --><!--line 0 --><!--description SW4gRm9yZ2VqbyB2OC4wLjAsIHRoZSBkZWZhdWx0IGxvY2F0aW9uIGZvciB0aGUgY29uZmlnIGZpbGUgd2FzIGNoYW5nZWQgZnJvbSBgL2V0Yy9naXRlYS9hcHAuaW5pYCB0byBgL3Zhci9saWIvZ2l0ZWEvYXBwLmluaWAuIEJhY2t3YXJkIGNvbXBhdGliaWxpdHkgbG9naWMgYW5kIHN0YXJ0dXAgd2FybmluZ3Mgd2VyZSBhZGRlZCB0byBjb250YWluZXIgc2V0dXAgYW5kIGVudHJ5cG9pbnQgc2NyaXB0cy4gTm93IHRoZXkgYXJlIHJlbW92ZWQuIFRoaXMgY2hhbmdlIG9ubHkgYWZmZWN0cyB0aG9zZSB1c2luZyBjb250YWluZXIgZGVwbG95bWVudHMgd2l0aCByb290bGVzcyBpbWFnZXMuIElmIHlvdSBoYXZlIHRoZSBjb25maWcgZmlsZSBzdG9yZWQgaW4gYSB2b2x1bWUgYm91bmQgdG8gY29udGFpbmVyJ3MgL2V0Yy9naXRlYSwgbW92ZSBpdCB0byB0aGUgbmV3IGxvY2F0aW9uIG9yIG92ZXJyaWRlIHRoZSBlbnZpcm9ubWVudCB2YXJpYWJsZSBgR0lURUFfQVBQX0lOSWAuIEFuIHVudXNlZCB2b2x1bWUgYC9ldGMvZ2l0ZWFgIGNhbiBiZSBzYWZlbHkgcmVtb3ZlZCBmcm9tIHRoZSBjb250YWluZXIgYWZ0ZXIgbW92aW5nIHRoZSBjb25maWcgb3IgaWYgdGhlIGRlcGxveW1lbnQgbmV2ZXIgdXNlZCB2ZXJzaW9ucyBwcmlvciB0byB2OC4wLjAu-->In Forgejo v8.0.0, the default location for the config file was changed from `/etc/gitea/app.ini` to `/var/lib/gitea/custom/conf/app.ini`. Backward compatibility logic and startup warnings were added to container setup and entrypoint scripts. Now they are removed. This change only affects those using container deployments with rootless images. If you have the config file stored in a volume bound to container's /etc/gitea, move it to the new location or override the environment variable `GITEA_APP_INI`. An unused volume `/etc/gitea` can be safely removed from the container after moving the config or if the deployment never used versions prior to v8.0.0.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11720) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12137)): <!--number 12137 --><!--line 0 --><!--description Y2hvcmUoRG9ja2VyZmlsZS5yb290bGVzcyk6IHVwZGF0ZSBzaGFkb3dlZCBlbnYgdmFyaWFibGVz-->chore(Dockerfile.rootless): update shadowed env variables<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10645): <!--number 10645 --><!--line 0 --><!--description TWFrZSBjb29raWUgbmFtZXMgYnJhbmQgaW5kZXBlbmRlbnQuPGJyPkF0dGVudGlvbjogQWxsIHVzZXJzIG5lZWQgdG8gcmUtbG9naW4sIGlmIHlvdSBoYXZlbid0IG1hbnVhbGx5IHNldCBhIGNvb2tpZSBuYW1lIGluIHRoZSBzZXR0aW5ncy4gVGhpcyBjYW4gYmUgcHJldmVudGVkIGJ5IGNoYW5naW5nIHRoZSBbcmVtZW1iZXIgbWUgY29va2llXShodHRwczovL2Zvcmdlam8ub3JnL2RvY3MvbGF0ZXN0L2FkbWluL2NvbmZpZy1jaGVhdC1zaGVldC8jc2VjdXJpdHktc2VjdXJpdHk6fjp0ZXh0PUNPT0tJRV9SRU1FTUJFUl9OQU1FKSBiYWNrIHRvIGBnaXRlYV9pbmNyZWRpYmxlYA==-->Make cookie names brand independent.<br>Attention: All users need to re-login, if you haven't manually set a cookie name in the settings. This can be prevented by changing the [remember me cookie](https://forgejo.org/docs/latest/admin/config-cheat-sheet/#security-security:~:text=COOKIE_REMEMBER_NAME) back to `gitea_incredible`<!--description-->
+- User Interface features
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11516): <!--number 11516 --><!--line 0 --><!--description YWRkIGZvcm0tYmFzZWQgcnVubmVyIG1hbmFnZW1lbnQ=-->add form-based runner management<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10932): <!--number 10932 --><!--line 0 --><!--description ZmVhdChwZXJmKTogcmVtb3ZlIHVudXNlZCBzaXplIHVybCBwYXJhbWV0ZXIgZm9yIGxvY2FsIGF2YXRhcnM=-->feat(perf): remove unused size url parameter for local avatars<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11080): <!--number 11080 --><!--line 0 --><!--description ZmVhdCh1aSk6IHJlc3BvbnNpdmUgcmVsZWFzZXMgbGlzdA==-->feat(ui): responsive releases list<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11604): <!--number 11604 --><!--line 0 --><!--description ZmVhdCh1aSk6IGRpc3BsYXkgcmVwb3NpdG9yaWVzIGFjY2Vzc2libGUgYnkgcmVwby1zcGVjaWZpYyBhY2Nlc3MgdG9rZW5z-->feat(ui): display repositories accessible by repo-specific access tokens<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11375) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11950)): <!--number 11950 --><!--line 0 --><!--description ZW5oOiBhZGQgc3VnZ2VzdGlvbiB0byBkb2N1bWVudCByZWFzb24gZm9yIHJlcG9zaXRvcnkgYXJjaGl2YWw=-->enh: add suggestion to document reason for repository archival<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11770): <!--number 11770 --><!--line 0 --><!--description c2hvdyB3b3JrZmxvdyBuYW1lIGZvciBzY2hlZHVsZWQgcnVucw==-->show workflow name for scheduled runs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11659): <!--number 11659 --><!--line 0 --><!--description dWk6IG1vdmUgIk5ldyBhY2Nlc3MgdG9rZW4iIHRvIGEgc2VwYXJhdGUgVUkgcGFnZQ==-->ui: move "New access token" to a separate UI page<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11439): <!--number 11439 --><!--line 0 --><!--description ZmVhdChtYXJrdXAtcmVuZGVyZXIpOiBtYXRjaCBvbiBjb21wb3VuZCBmaWxlbmFtZSBleHRlbnNpb25z-->feat(markup-renderer): match on compound filename extensions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11677): <!--number 11677 --><!--line 0 --><!--description ZmVhdCh1aSk6IHVzZSBiZXR0ZXIgY29udHJhc3QgY29sb3IgZm9yIHJlcXVpcmVkIGZpZWxkIGluZGljYXRvcg==-->feat(ui): use better contrast color for required field indicator<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11340): <!--number 11340 --><!--line 0 --><!--description ZmVhdCh1aSk6IGVuYWJsZSB0ZXh0IGF1dG8tc3BhY2luZw==-->feat(ui): enable text auto-spacing<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11472): <!--number 11472 --><!--line 0 --><!--description ZmVhdCh1aSk6IGltcHJvdmUgdmlzaWJpbGl0eSBvZiBjb3VudGVycyBpbnNpZGUgb2Ygc3dpdGNoIGl0ZW1z-->feat(ui): improve visibility of counters inside of switch items<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11466): <!--number 11466 --><!--line 0 --><!--description QWRkIHNob3J0Y3V0IHRvIGxpbmsgbWFya2Rvd24gYWN0aW9u-->Add shortcut to link markdown action<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11127): <!--number 11127 --><!--line 0 --><!--description ZmVhdCh1aSk6IGNvbnZlcnQgb3JnIG1lbWJlcnMgbGlzdCB0byBncmlk-->feat(ui): convert org members list to grid<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11196): <!--number 11196 --><!--line 0 --><!--description ZmVhdCh1aSk6IGNvbnNpc3RlbnRseSB1c2UgQXBwVmVyTm9NZXRhZGF0YSBpbiBmb290ZXI=-->feat(ui): consistently use AppVerNoMetadata in footer<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10702): <!--number 10702 --><!--line 0 --><!--description aW1wcm92ZSBsYWJlbCBmaWx0ZXJpbmcgZXhjbHVzaW9u-->improve label filtering exclusion<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10873): <!--number 10873 --><!--line 0 --><!--description ZGVkaWNhdGVkIGljb24gZm9yIENJVEFUSU9OIGZpbGU=-->dedicated icon for CITATION file<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10559): <!--number 10559 --><!--line 0 --><!--description ZmVhdCh1aSk6IHJlcGxhY2UgTW9uYWNvIHdpdGggQ29kZU1pcnJvcg==-->feat(ui): replace Monaco with CodeMirror<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10530): <!--number 10530 --><!--line 0 --><!--description Zml4KHVpKTogaW1wcm92ZSByZW5kZXJpbmcgb2YgY29tbWl0IGxpbmtz-->fix(ui): improve rendering of commit links<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10022): <!--number 10022 --><!--line 0 --><!--description UmV0cmlldmUgZGVmYXVsdCBtZXJnZSBjb21taXQgbWVzc2FnZSBmb3IgcHVsbCByZXF1ZXN0cw==-->Retrieve default merge commit message for pull requests<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9261): <!--number 9261 --><!--line 0 --><!--description c2hvdyBjYW5jZWwgYnV0dG9uIGZvciBhY3Rpb25zIHJ1biB1bnRpbCBhbGwgam9icyBhcmUgZmluaXNoZWQ=-->show cancel button for actions run until all jobs are finished<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10488): <!--number 10488 --><!--line 0 --><!--description c2hvdyB1cGRhdGUgdGltZSB3aGVuIHNvcnRpbmcgYnkgcmVjZW50bHkgdXBkYXRlZA==-->show update time when sorting by recently updated<!--description-->
+- User Interface bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11607): <!--number 11607 --><!--line 0 --><!--description Zml4KHVpKTogYWxsb3cgbGFiZWwgZGVzY3JpcHRpb25zIHRvIHdyYXAgaW4gZHJvcGRvd24=-->fix(ui): allow label descriptions to wrap in dropdown<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11365): <!--number 11365 --><!--line 0 --><!--description ZWRpdCByYXcgaW5zdGVhZCBvZiByZW5kZXJlZCBHaXQgbm90ZXMgd2hlbiBlZGl0aW5nIG5vdGVzIG9uIGNvbW1pdCBwYWdlcw==-->edit raw instead of rendered Git notes when editing notes on commit pages<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11365): <!--number 11365 --><!--line 1 --><!--description bWFrZSBlZGl0aW5nIEdpdCBub3RlcyBmcm9tIHNpbmdsZS1jb21taXQgUFIgcGFnZSBhY3R1YWxseSB3b3Jr-->make editing Git notes from single-commit PR page actually work<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11365): <!--number 11365 --><!--line 2 --><!--description YWRkIGNhbmNlbCBidXR0b24gdG8gR2l0IG5vdGUgYWRkaW5nIGFuZCBlZGl0aW5n-->add cancel button to Git note adding and editing<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11315): <!--number 11315 --><!--line 0 --><!--description Zml4KHVpKTogYWRkIGFjdGl2ZSBiYWNrZ3JvdW5kIGNvbG9yIGZvciBtZW51IGl0ZW1zIGluIHRpcHB5IHRvb2x0aXBz-->fix(ui): add active background color for menu items in tippy tooltips<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11423): <!--number 11423 --><!--line 0 --><!--description Zml4KHVpKTogdXBkYXRlIHNvcnQgZHJvcGRvd24gc3RydWN0dXJlIGZvciBjb25zaXN0ZW5jeSBhY3Jvc3MgdGVtcGxhdGVz-->fix(ui): update sort dropdown structure for consistency across templates<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11190): <!--number 11190 --><!--line 0 --><!--description Zml4KCMxMTE4OSk6IG5vcm1hbGl6ZSBpc3N1ZSB0aXRsZSBjYXNlIHdoZW4gbWF0Y2hpbmcgcHJlZml4ZXM=-->fix(#11189): normalize issue title case when matching prefixes<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11259): <!--number 11259 --><!--line 0 --><!--description Zml4KHVpKTogaW1wcm92ZSBhbGlnbm1lbnQgb2YgaWNvbnMgaW4gbmF2YmFy-->fix(ui): improve alignment of icons in navbar<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11231): <!--number 11231 --><!--line 0 --><!--description Zml4KHVpKTogbWFrZSByZWxhdGl2ZSB0aW1lIGNvbnNpc3RlbnQgd2l0aCBvdGhlciB0ZXh0IHdoZW4gc2VsZWN0ZWQ=-->fix(ui): make relative time consistent with other text when selected<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11343): <!--number 11343 --><!--line 0 --><!--description Zml4KHVpKTogaW1wcm92ZSBhIGZldyBFbmdsaXNoIHN0cmluZ3M=-->fix(ui): improve a few English strings<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11274): <!--number 11274 --><!--line 0 --><!--description Zml4KHVpKTogYXBwbHkgbmF2YmFyIG1pbi1oZWlnaHQgY29ycmVjdGx5LCBmaXggaml0dGVyIG9uIG1vYmlsZQ==-->fix(ui): apply navbar min-height correctly, fix jitter on mobile<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11262): <!--number 11262 --><!--line 0 --><!--description Zml4KHVpKTogZml4IGdhcCBjb25zaXN0ZW5jeSBiZXR3ZWVuIG5hdmJhciBpdGVtcyBvbiBtb2JpbGU=-->fix(ui): fix gap consistency between navbar items on mobile<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11469): <!--number 11469 --><!--line 0 --><!--description Zml4KHVpKTogdXNlIG92ZXJmbG93OmF1dG8gdG8gYXZvaWQgc2Nyb2xsYmFycyB3aGVuIHRoZXkgYXJlIG5vdCBuZWVkZWQ=-->fix(ui): use overflow:auto to avoid scrollbars when they are not needed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11461): <!--number 11461 --><!--line 0 --><!--description Zml4KHVpKTogZml4IGRhc2hib2FyZCBzb21lIHN0eWxlIGlzc3Vlcw==-->fix(ui): fix dashboard some style issues<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11057): <!--number 11057 --><!--line 0 --><!--description Zml4KHVpKTogY2VudGVyLWFsaWduIGVtb2ppcyB0byBuZWlnaGJvdXJpbmcgdGV4dA==-->fix(ui): center-align emojis to neighbouring text<!--description-->
+- Localization
+  - Updates from Codeberg Translate: [#10417](https://codeberg.org/forgejo/forgejo/pulls/10417), [#10599](https://codeberg.org/forgejo/forgejo/pulls/10599), [#10660](https://codeberg.org/forgejo/forgejo/pulls/10660), [#10978](https://codeberg.org/forgejo/forgejo/pulls/10978), [#11344](https://codeberg.org/forgejo/forgejo/pulls/11344), [#11460](https://codeberg.org/forgejo/forgejo/pulls/11460), [#12129](https://codeberg.org/forgejo/forgejo/pulls/12129) (backport of [#11810](https://codeberg.org/forgejo/forgejo/pulls/11810), [#11963](https://codeberg.org/forgejo/forgejo/pulls/11963))
+- Features
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10617): <!--number 10617 --><!--line 0 --><!--description QXV0by1saW5rIGNvbnRhaW5lciBpbWFnZXMgdG8gcmVwb3NpdG9yeQ==-->Auto-link container images to repository<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11687): <!--number 11687 --><!--line 0 --><!--description ZXhwb3NlIGF0dGVtcHQgbnVtYmVyIG9mIEFjdGlvblJ1bkpvYiBpbiBIVFRQIEFQSQ==-->expose attempt number of ActionRunJob in HTTP API<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11584): <!--number 11584 --><!--line 0 --><!--description YWRkIG1vcmUgZmlsdGVycyB0byBhY3Rpb25zIHJ1biBhbmQgdGFza3MgYXBp-->add more filters to actions run and tasks api<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10941): <!--number 10941 --><!--line 0 --><!--description ZGV0YWlsZWQgcGVybWlzc2lvbiBkZW5pZWQgbWVzc2FnZSBvbiBwdXNo-->detailed permission denied message on push<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11013): <!--number 11013 --><!--line 0 --><!--description ZmlsdGVyIGFjdGlvbiBydW5zIGJ5IEdpdCByZWZlcmVuY2U=-->filter action runs by Git reference<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11846) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12031)): <!--number 12031 --><!--line 0 --><!--description SW1wcm92ZSByZXBvIGZpbGUgbGlzdCB0YWJsZSBzZW1hbnRpY3MgZm9yIHNjcmVlbiByZWFkZXJz-->Improve repo file list table semantics for screen readers<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11851) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11986)): <!--number 11986 --><!--line 0 --><!--description ZmVhdDogc3VwcG9ydCBgdGltZXpvbmVgIGluIHNjaGVkdWxlZCB3b3JrZmxvd3M=-->feat: support `timezone` in scheduled workflows<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11895) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11970)): <!--number 11970 --><!--line 0 --><!--description QWRkIGFyaWEtbGFiZWw9IkNvcHkiIHRvIGNvcHkgYnV0dG9u-->Add aria-label="Copy" to copy button<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11887) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11969)): <!--number 11969 --><!--line 0 --><!--description QWRkIGFyaWEtY3VycmVudD0icGFnZSIgdG8gYWN0aXZlIG5hdmJhciBpdGVtcw==-->Add aria-current="page" to active navbar items<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11676): <!--number 11676 --><!--line 0 --><!--description YWxsb3cgcnVubmVycyB0byByZXF1ZXN0IGEgcGFydGljdWxhciBqb2I=-->allow runners to request a particular job<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11589): <!--number 11589 --><!--line 0 --><!--description YWRkIHdpa2kgZ2l0IGluZm8gdG8gQVBJ-->add wiki git info to API<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10677): <!--number 10677 --><!--line 0 --><!--description YWRkIEhUVFAgQVBJIGVuZHBvaW50IGZvciBydW5uZXIgcmVnaXN0cmF0aW9u-->add HTTP API endpoint for runner registration<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11489): <!--number 11489 --><!--line 0 --><!--description QWRkIGBIRUFEYCBzdXBwb3J0IGZvciBkZWJpYW4gcmVwbyBmaWxlcyAoIzExNDg4KQ==-->Add `HEAD` support for debian repo files (#11488)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10573): <!--number 10573 --><!--line 0 --><!--description cmVmYWN0b3I6IHVwZGF0ZSBBY3Rpb25zIFJ1bm5lciBhZG1pbiBBUEkgZW5kcG9pbnQgVVJMcyB0byBiZSBjb25zaXN0ZW50IHcvIG90aGVyIGxldmVscw==-->refactor: update Actions Runner admin API endpoint URLs to be consistent w/ other levels<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11671): <!--number 11671 --><!--line 0 --><!--description bWFrZSBpdCBwb3NzaWJsZSB0byBzZWFyY2ggcnVubmVycyBieSBVVUlE-->make it possible to search runners by UUID<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11670): <!--number 11670 --><!--line 0 --><!--description YWRkIHZpc2libGUgZmxhZyB0byBIVFRQIEFQSSBlbmRwb2ludHMgdGhhdCByZXR1cm4gcnVubmVycw==-->add visible flag to HTTP API endpoints that return runners<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10627): <!--number 10627 --><!--line 0 --><!--description c3VwcG9ydCBqb2JzLjxqb2JfaWQ+LnNlY3JldHMgd2l0aCByZXVzYWJsZSB3b3JrZmxvdyBleHBhbnNpb24=-->support jobs.<job_id>.secrets with reusable workflow expansion<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10563): <!--number 10563 --><!--line 0 --><!--description aW5jcmVhc2UgZGVmYXVsdCBsaW1pdCBvZiBkaXNwYXRjaCBpbnB1dHMgdG8gMTAw-->increase default limit of dispatch inputs to 100<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11059): <!--number 11059 --><!--line 0 --><!--description ZW5hYmxlIFNRTGl0ZSBXQUwgYnkgZGVmYXVsdA==-->enable SQLite WAL by default<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10614): <!--number 10614 --><!--line 0 --><!--description c3VwcG9ydCB3b3JrZmxvdyBpbnB1dHMgb24gZXhwYW5kZWQgcmV1c2FibGUgd29ya2Zsb3dz-->support workflow inputs on expanded reusable workflows<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10388): <!--number 10388 --><!--line 0 --><!--description YWxsb3cgdG8gYWRkIHBhbSBzb3VyY2UgZnJvbSBjb21tYW5kIGxpbmU=-->allow to add pam source from command line<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10578): <!--number 10578 --><!--line 0 --><!--description c3VwcG9ydCB3b3JrZmxvdyBvdXRwdXRzIG9uIGV4cGFuZGVkIHJldXNhYmxlIHdvcmtmbG93cw==-->support workflow outputs on expanded reusable workflows<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11504): <!--number 11504 --><!--line 0 --><!--description cmVhZCwgY3JlYXRlLCAmIGRlbGV0ZSByZXBvLXNwZWNpZmljIGFjY2VzcyB0b2tlbnMgdmlhIEFQSQ==-->read, create, & delete repo-specific access tokens via API<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11216): <!--number 11216 --><!--line 0 --><!--description bGluayBDSSBqb2IgdG8gaXRzIGRlZmluaW5nIHdvcmtmbG93IGZpbGU=-->link CI job to its defining workflow file<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9962): <!--number 9962 --><!--line 0 --><!--description SW1wbGVtZW50IEVwaGVtZXJhbCBydW5uZXJz-->Implement Ephemeral runners<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/5384): <!--number 5384 --><!--line 0 --><!--description W2FsbG93IGZvcmdlam8gdG8gcnVuIGFzIGEgcHdhIHN0YW5kYWxvbmUgYXBwbGljYXRpb24gJiBvdmVycmlkZSBvZiB0aGUgd2ViYXBwIG1hbmlmZXN0Lmpzb24gdmlhIHRoZSBhIGN1c3RvbSBmaWxlIGluIGBwdWJsaWMvbWFuaWZlc3QuanNvbmBdKGh0dHBzOi8vY29kZWJlcmcub3JnL2Zvcmdlam8vZm9yZ2Vqby9wdWxscy81Mzg0KQ==-->[allow forgejo to run as a pwa standalone application & override of the webapp manifest.json via the a custom file in `public/manifest.json`](https://codeberg.org/forgejo/forgejo/pulls/5384)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10647): <!--number 10647 --><!--line 0 --><!--description c3VwcG9ydCByZXVzYWJsZSB3b3JrZmxvdyBleHBhbnNpb24gd2hlbiBgd2l0aGAgb3IgYHN0cmF0ZWd5Lm1hdHJpeGAgY29udGFpbnMgJHt7IG5lZWRzLi4uIH19-->support reusable workflow expansion when `with` or `strategy.matrix` contains ${{ needs... }}<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10602): <!--number 10602 --><!--line 0 --><!--description cHJvdmlkZSBtdWx0aXBsZSB0YXNrcyB0byBSdW5uZXIgaW4gb25lIEZldGNoVGFzayB3aGVuIHJlcXVlc3RlZA==-->provide multiple tasks to Runner in one FetchTask when requested<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10642): <!--number 10642 --><!--line 0 --><!--description YWRkIEZvcmdlam8gc2VydmVyIHZlcnNpb24gdG8gcnVubmVyIGNvbnRleHQ=-->add Forgejo server version to runner context<!--description-->
+- Bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11715): <!--number 11715 --><!--line 0 --><!--description aW1wcm92ZSBPQXV0aDIgZXhwZXJpZW5jZQ==-->improve OAuth2 experience<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11401): <!--number 11401 --><!--line 0 --><!--description YWxsb3cgQWN0aW9ucyBydW5uZXIgdG8gcmVjb3ZlciB0YXNrcyBsb3N0IGR1cmluZyBmZXRjaGluZyBmcm9tIGludGVybWl0dGVudCBlcnJvcnM=-->allow Actions runner to recover tasks lost during fetching from intermittent errors<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11932) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12033)): <!--number 12033 --><!--line 0 --><!--description UHJlc2VydmUgZm9jdXMgb24gc3Rhci91bnN0YXIgJiB3YXRjaC91bndhdGNoIGJ1dHRvbnMgYWZ0ZXIgY2xpY2s=-->Preserve focus on star/unstar & watch/unwatch buttons after click<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11909) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11984)): <!--number 11984 --><!--line 0 --><!--description Zml4OiBzdG9yZSBwdWxsIG1pcnJvciBjcmVkcyBlbmNyeXB0ZWQgd2l0aCBrZXlpbmc=-->fix: store pull mirror creds encrypted with keying<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11878) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11967)): <!--number 11967 --><!--line 0 --><!--description QWRkIGFyaWEtbGFiZWxzIHRvIGVuc3VyZSB3YXRjaCBhbmQgc3RhciBidXR0b25zIGFsd2F5cyBoYXZlIGEgdGV4dCBsYWJlbA==-->Add aria-labels to ensure watch and star buttons always have a text label<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11858) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11966)): <!--number 11966 --><!--line 0 --><!--description TWFrZSBsYWJlbCBkcm9wZG93biBtZW51IGl0ZW1zIHdpdGggLnR3LWhpZGRlbiB1bnNlbGVjdGFibGU=-->Make label dropdown menu items with .tw-hidden unselectable<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11860) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11922)): <!--number 11922 --><!--line 0 --><!--description Rml4IEBtZW50aW9uIGNvbWJvYm94IHNlbWFudGljcyBmb3Igc2NyZWVuIHJlYWRlciBhY2Nlc3NpYmlsaXR5-->Fix @mention combobox semantics for screen reader accessibility<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11881) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11906)): <!--number 11906 --><!--line 0 --><!--description Zml4OiB1bmlxdWUga2V5IHZpb2xhdGlvbiBpbiBmaXJzdC10aW1lIGNvbmN1cnJlbnQgZGViaWFuIHBhY2thZ2UgdXBsb2FkcyB0byBhIHVzZXI=-->fix: unique key violation in first-time concurrent debian package uploads to a user<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11821) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11830)): <!--number 11830 --><!--line 0 --><!--description Zml4OiBvdXQgb2Ygc3luY2hyb25pemF0aW9uIGVycm9yIGFmdGVyIGludGVycnVwdGluZyBhIFBSIG1lcmdlIGJ5IHVzZXItYWdlbnQgZGlzY29ubmVjdA==-->fix: out of synchronization error after interrupting a PR merge by user-agent disconnect<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11292): <!--number 11292 --><!--line 0 --><!--description aW1wcm92ZSBTUUxpdGUgImRhdGFiYXNlIGlzIGxvY2tlZCIgZXJyb3JzIGJ5IGluY3JlYXNpbmcgZGVmYXVsdCBgU1FMSVRFX1RJTUVPVVRgICh0YWtlIDIp-->improve SQLite "database is locked" errors by increasing default `SQLITE_TIMEOUT` (take 2)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11735): <!--number 11735 --><!--line 0 --><!--description aTE4bjogaGFyZGNvZGVkIHN0cmluZ3MgaW4gcmVwb3NpdG9yeSBhY3Rpdml0eSBncmFwaHM=-->i18n: hardcoded strings in repository activity graphs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11052): <!--number 11052 --><!--line 0 --><!--description bm9ybWFsaXplIHNlY3JldHMgY29uc2lzdGVudGx5LCBkaXNwbGF5IGFjY3VyYXRlIGhlbHA=-->normalize secrets consistently, display accurate help<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11699): <!--number 11699 --><!--line 0 --><!--description VGhlIERCIGVudHJpZXMgYWJvdXQgdXNlcnMgZm9sbG93aW5nIGFuIG9yZ2FuaXphdGlvbiBhbmQgdXNlcnMgYmxvY2tlZCBieSBhbiBvcmdhbml6YXRpb24gd2VyZSBub3QgZGVsZXRlZCB3aGVuIGFuIG9yZ2FuaXphdGlvbiB3YXMgZGVsZXRlZC4gT3JwaGFuZWQgZW50cmllcyBjYW4gYmUgY2xlYW5lZCB1cCBieSBydW5uaW5nIGBmb3JnZWpvIGRvY3RvciBjaGVjayAtLXJ1biBjaGVjay1kYi1jb25zaXN0ZW5jeSAtLWZpeGAu-->The DB entries about users following an organization and users blocked by an organization were not deleted when an organization was deleted. Orphaned entries can be cleaned up by running `forgejo doctor check --run check-db-consistency --fix`.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9906): <!--number 9906 --><!--line 0 --><!--description Zml4KHVpKTogSG9ub3Igb3JnL3VzZXIgcHJvamVjdCBpbiBuZXcgaXNzdWUgKCM4NDg5KQ==-->fix(ui): Honor org/user project in new issue (#8489)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10008): <!--number 10008 --><!--line 0 --><!--description ZW5zdXJlIGFjdGlvbnMgbG9ncyBhcmUgdHJhbnNmZXJyZWQgd2hlbiBhIHRhc2sgaXMgZG9uZQ==-->ensure actions logs are transferred when a task is done<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10954): <!--number 10954 --><!--line 0 --><!--description Zml4KHBhY2thZ2VzKTogcmV0dXJuIGJhZCByZXF1ZXN0IG9uIG1hbGZvcm1lZCB1cGxvYWQgaW5wdXQ=-->fix(packages): return bad request on malformed upload input<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11240): <!--number 11240 --><!--line 0 --><!--description Y29ycmVjdCBSZXZpZXdlZC1vbiBVUkwgaW4gbWVyZ2UgbWVzc2FnZSBmb3Igc3VicGF0aCBkZXBsb3ltZW50cw==-->correct Reviewed-on URL in merge message for subpath deployments<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11153): <!--number 11153 --><!--line 0 --><!--description cnVieSBwYWNrYWdlIHZlcnNpb25zOiBvbmx5IHNraXAgZXhwbGljaXQgPj0gMCBhbmQgbGVhdmUgcGVzc2ltaXN0aWMgdmVyc2lvbiBsb2NraW5nIGludGFjdA==-->ruby package versions: only skip explicit >= 0 and leave pessimistic version locking intact<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11109): <!--number 11109 --><!--line 0 --><!--description Zml4IHNlYXJjaGluZyBpc3N1ZXMgYnkgb3JnIGxhYmVscyB2aWEgYXBp-->fix searching issues by org labels via api<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10691): <!--number 10691 --><!--line 0 --><!--description Zml4KGkxOG4pOiByZW1vdmUgdW5uZWVkZWQgc3BlY2lhbCBjYXNlcyBmb3IgcmVsYXRpdmUgdGltZQ==-->fix(i18n): remove unneeded special cases for relative time<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10528): <!--number 10528 --><!--line 0 --><!--description Zml4KCMxMDE1NSk6IGRvbid0IGRpc3BsYXkgcGVuZGluZyByZXZpZXdzIGFzIHBhcnRpY2lwYW50cw==-->fix(#10155): don't display pending reviews as participants<!--description-->
+- User Interface changes without a feature or bug label
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10768): <!--number 10768 --><!--line 0 --><!--description Y2hvcmUodWkpOiBjbGVhbnVwIFBSIGNoZWNrcyBhcmVh-->chore(ui): cleanup PR checks area<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10524): <!--number 10524 --><!--line 0 --><!--description Zml4KHVpKTogYXZhdGFyIGZvciBkaXNtaXNzZWQgcmV2aWV3IGlzIHN0cmV0Y2hlZCBpZiBub3Qgc3F1YXJl-->fix(ui): avatar for dismissed review is stretched if not square<!--description-->
+- Other changes without a feature or bug label
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11822) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11829)): <!--number 11829 --><!--line 0 --><!--description Zml4KGFwaSk6IHBhY2thZ2UgbmFtZSBpbiByb3V0ZSBub3QgcHJvcGVybHkgdW5lc2NhcGVk-->fix(api): package name in route not properly unescaped<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11650): <!--number 11650 --><!--line 0 --><!--description Y2hvcmU6IGRlcHJlY2F0ZSBIVFRQIEFQSSBlbmRwb2ludHMgZm9yIG9idGFpbmluZyB0aGUgcnVubmVyIHJlZ2lzdHJhdGlvbiB0b2tlbg==-->chore: deprecate HTTP API endpoints for obtaining the runner registration token<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11232): <!--number 11232 --><!--line 0 --><!--description Y2hvcmU6IHJlbW92ZSBkZXByZWNhdGVkIGF1dGggbWV0aG9kcyBmcm9tIEFQSSBkb2Nz-->chore: remove deprecated auth methods from API docs<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12134) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12136)): <!--number 12136 --><!--line 0 --><!--description Y2hvcmU6IGZpeCBUZXN0TWlycm9yUHVsbCBvbiBvbGRlciBnaXQgKDIuMzQuMSkgaW5zdGFsbGF0aW9u-->chore: fix TestMirrorPull on older git (2.34.1) installation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12131) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12132)): <!--number 12132 --><!--line 0 --><!--description Y2hvcmU6IGZpeCBjb29raWUgbmFtZSBjb21tZW50cyBpbiBleGFtcGxlIGluaQ==-->chore: fix cookie name comments in example ini<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12113) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12130)): <!--number 12130 --><!--line 0 --><!--description Zml4OiBpbXByb3ZlIHJ1bm5lciBsaXN0IGFuZCBkZXRhaWxzIHZpZXc=-->fix: improve runner list and details view<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12114): <!--number 12114 --><!--line 0 --><!--description Zml4KHVpKTogYSBmZXcgc21hbGwgcnVubmVycyBVSSBmaXhlcw==-->fix(ui): a few small runners UI fixes<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11733): <!--number 11733 --><!--line 0 --><!--description cHJldmVudCBjb250YWluZXIgcmVnaXN0cnkgaGVhZGVycyBmcm9tIGxlYWtpbmcgaW50byBvdGhlciByZWdpc3RyaWVz-->prevent container registry headers from leaking into other registries<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11337): <!--number 11337 --><!--line 0 --><!--description Rm9yZ2VqbyBTZWN1cml0eSBQYXRjaGVzLCAyMDI2LTAzLTA5-->fix(e2e): use empty user for overflow menu test<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11324): <!--number 11324 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2dvLWNoaS9zZXNzaW9uIHRvIHYxLjAuMyAoZm9yZ2Vqbyk=-->Update module code.forgejo.org/go-chi/session to v1.0.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10727): <!--number 10727 --><!--line 0 --><!--description dGhlIGVycm9yIG1lc3NhZ2Ugb2YgYSBmYWlsZWQgbWlncmF0aW9uIGJlY2F1c2Ugb2YgYSB3cm9uZyB0b2tlbiBpcyBjb25mdXNpbmc=-->the error message of a failed migration because of a wrong token is confusing<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12009) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12112)): <!--number 12112 --><!--line 0 --><!--description aTE4bihtYWlsZXIpOiBGaXggc3BlY2lhbCB1c2FnZSBvZiAuTG9jYWxlIGluIGFkbWluX25ld191c2Vy-->i18n(mailer): Fix special usage of .Locale in admin_new_user<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10898): <!--number 10898 --><!--line 0 --><!--description Y2hvcmUodWkpOiByZW1vdmUgb2Jzb2xldGUgdmFyIC0tY29sb3ItbmF2LXRleHQ=-->chore(ui): remove obsolete var --color-nav-text<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12094): <!--number 12094 --><!--line 0 --><!--description UmV2ZXJ0ICJJbXByb3ZlIHJlcG8gZmlsZSBsaXN0IHRhYmxlIHNlbWFudGljcyBmb3Igc2NyZWVuIHJlYWRlcnMgKCMxMjAzMSki-->Revert "Improve repo file list table semantics for screen readers (#12031)"<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12046) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12077)): <!--number 12077 --><!--line 0 --><!--description Zml4OiBwcmV2ZW50IGpvYnMgd2l0aCB1bmtub3duIG5lZWRzIGZyb20gcnVubmluZw==-->fix: prevent jobs with unknown needs from running<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12059) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12063)): <!--number 12063 --><!--line 0 --><!--description Zml4OiBkaXNwbGF5IHJ1bm5lciB2ZXJzaW9uIG9uIGRldGFpbHMgcGFnZQ==-->fix: display runner version on details page<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12058) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12060)): <!--number 12060 --><!--line 0 --><!--description UmV2ZXJ0ICJmaXg6IGFkZCBjaGFsbGVuZ2UgZm9yIEhUVFAgQmFzaWMgQXV0aGVudGljYXRpb24gdG8gY29udGFpbmVyIHJlZ2lzdHJ5Ig==-->Revert "fix: add challenge for HTTP Basic Authentication to container registry"<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11678): <!--number 11678 --><!--line 0 --><!--description YWRkIGNoYWxsZW5nZSBmb3IgSFRUUCBCYXNpYyBBdXRoZW50aWNhdGlvbiB0byBjb250YWluZXIgcmVnaXN0cnk=-->add challenge for HTTP Basic Authentication to container registry<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12021) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12044)): <!--number 12044 --><!--line 0 --><!--description Zml4OiBpbmNvcnJlY3QgaWRlbnRpZmljYXRpb24gb2Ygb3V0ZGF0ZWQgcnVuIGF0dGVtcHRz-->fix: incorrect identification of outdated run attempts<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11750): <!--number 11750 --><!--line 0 --><!--description c2V0IGF0dGVtcHQgbnVtYmVyIG9mIGFjdGlvbiBydW4gam9icyBlYWdlcmx5-->set attempt number of action run jobs eagerly<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12023) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12040)): <!--number 12040 --><!--line 0 --><!--description Zml4KGRvY3Rvcik6IHJlbW92ZSBicm9rZW4gbWVyZ2ViYXNlIGNoZWNr-->fix(doctor): remove broken mergebase check<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12030) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12038)): <!--number 12038 --><!--line 0 --><!--description Zml4OiBwcmV2ZW50IGFjdGlvbnMgd29ya2Zsb3dzIGZyb20gZ2VuZXJhdGluZyBPSURDIHRva2VucyBpZiBub3QgYXV0aG9yaXplZCBpbiB3b3JrZmxvdw==-->fix: prevent actions workflows from generating OIDC tokens if not authorized in workflow<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12029): <!--number 12029 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ28gdG8gdjEuMjYuMiAodjE1LjAvZm9yZ2Vqbyk=-->Update dependency go to v1.26.2 (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11997) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11998)): <!--number 11998 --><!--line 0 --><!--description dGVzdDogZml4IGludGVybWl0dGVudCB0ZXN0IGZhaWx1cmUgaW4gVGVzdFBhY2thZ2VEZWJpYW5Db25jdXJyZW50-->test: fix intermittent test failure in TestPackageDebianConcurrent<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11992) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11996)): <!--number 11996 --><!--line 0 --><!--description Y2hvcmUoZGVwcyk6IGJ1bXAgeG9ybSB0byB2MS4zLjktZm9yZ2Vqby4xMCAoIzExOTkyKQ==-->chore(deps): bump xorm to v1.3.9-forgejo.10 (#11992)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11945) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11987)): <!--number 11987 --><!--line 0 --><!--description Zml4OiBtaXNzaW5nIHN5bnRheCBkaWFsb2cgcm91bmRlZCBjb3JuZXJz-->fix: missing syntax dialog rounded corners<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11999) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12000)): <!--number 12000 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlZHVjZSBjb2RlIGR1cGxpY2F0aW9uIHdoZW4gYWNjZXNzaW5nIGBEZWZhdWx0TWF4SW5TaXplYA==-->refactor: reduce code duplication when accessing `DefaultMaxInSize`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11988) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11995)): <!--number 11995 --><!--line 0 --><!--description cGVyZjogYnVsayBsb2FkIHJlc29sdmVycyAmIHJlYWN0aW9ucyBvbiBwdWxsIHJlcXVlc3QgY29tbWVudHM=-->perf: bulk load resolvers & reactions on pull request comments<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11956) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11964)): <!--number 11964 --><!--line 0 --><!--description Zml4OiBzdXBlcmZsdW91cyBpbmNyZW1lbnQgb2YgQWN0aW9uVGFzayBhdHRlbXB0IGJyZWFrcyBqb2Igdmlldw==-->fix: superfluous increment of ActionTask attempt breaks job view<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11949): <!--number 11949 --><!--line 0 --><!--description OiBjaG9yZTogYWRkIG1vZGVybml6ZXIgbGludGVy-->: chore: add modernizer linter<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11296): <!--number 11296 --><!--line 0 --><!--description UEFNOiBwb3J0YWJsZSBlcnJvciByZXBvcnRpbmc=-->PAM: portable error reporting<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11948): <!--number 11948 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZ2NpL2dvbGFuZ2NpLWxpbnQvdjIvY21kL2dvbGFuZ2NpLWxpbnQgdG8gdjIuMTEuNCAodjE1LjAvZm9yZ2Vqbyk=-->Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.11.4 (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11927) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11933)): <!--number 11933 --><!--line 0 --><!--description Zml4OiBhbGxvdyByZXBvc2l0b3J5IGRlbGV0aW9uIHdoZW4gcmVmZXJlbmNlZCBieSBhIHJlcG8tc3BlY2lmaWMgYWNjZXNzIHRva2Vu-->fix: allow repository deletion when referenced by a repo-specific access token<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11843) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11931)): <!--number 11931 --><!--line 0 --><!--description Zml4OiBhbGxvdyBtb2RhbHMgdG8gYmUgc3VibWl0dGVkIG11bHRpcGxlIHRpbWVz-->fix: allow modals to be submitted multiple times<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11872) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11907)): <!--number 11907 --><!--line 0 --><!--description Y2k6IHByZXZlbnQgdXNhZ2Ugb2YgbGl2ZSBhcHBsaWNhdGlvbiBtb2RlbHMgJiBzZXJ2aWNlcyBpbiBtaWdyYXRpb25z-->ci: prevent usage of live application models & services in migrations<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11432): <!--number 11432 --><!--line 0 --><!--description TW92ZSBDb250YWluZXIgQVBJIHByb2Nlc3NpbmcgbG9naWMgdG8gc2VydmljZQ==-->Move Container API processing logic to service<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11900): <!--number 11900 --><!--line 0 --><!--description VXBkYXRlIGdpdGh1Yi5jb20vZ28tZ2l0L2dvLWdpdC92NSAoaW5kaXJlY3QpIHRvIHY1LjE3LjEgW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2Vqbyk=-->Update github.com/go-git/go-git/v5 (indirect) to v5.17.1 [SECURITY] (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11886): <!--number 11886 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgaGFwcHktZG9tIHRvIHYyMC44LjkgW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2VqbykgLSBhdXRvY2xvc2Vk-->Update dependency happy-dom to v20.8.9 [SECURITY] (v15.0/forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11874) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11877)): <!--number 11877 --><!--line 0 --><!--description ZmVhdDogdXNlIGAtLXRva2VuLXVybGAgaW4gcnVubmVyIHNldHVwIGluc3RydWN0aW9ucw==-->feat: use `--token-url` in runner setup instructions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11696): <!--number 11696 --><!--line 0 --><!--description ZmVhdCh1aSk6IGNyZWF0ZSByZXBvLXNwZWNpZmljIGFjY2VzcyB0b2tlbnM=-->feat(ui): create repo-specific access tokens<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11839): <!--number 11839 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgaGFwcHktZG9tIHRvIHYyMC44LjggW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2Vqbyk=-->Update dependency happy-dom to v20.8.8 [SECURITY] (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11776) ([backported](https://codeberg.org/forgejo/forgejo/pulls/11833)): <!--number 11833 --><!--line 0 --><!--description Zml4OiBkdXBsaWNhdGUga2V5IHZpb2xhdGVzIHVuaXF1ZSBjb25zdHJhaW50IGluIGNvbmN1cnJlbnQgZGViaWFuIHBhY2thZ2UgdXBsb2Fkcw==-->fix: duplicate key violates unique constraint in concurrent debian package uploads<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11801): <!--number 11801 --><!--line 0 --><!--description Y2k6IHVwZGF0ZSB0ZXN0cyB0byBydW4gZGViaWFuIHRyaXhpZSwgcmVtb3ZlIG1hbnVhbCBpbnN0YWxsYXRpb24gZnJvbSBgdGVzdGluZ2A=-->ci: update tests to run debian trixie, remove manual installation from `testing`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11825): <!--number 11825 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzguMCBbU0VDVVJJVFldICh2MTUuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.38.0 [SECURITY] (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11805): <!--number 11805 --><!--line 0 --><!--description VXBkYXRlIE5vZGUuanMgdG8gdjI0LjE0LjEgKGZvcmdlam8p-->Update Node.js to v24.14.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11806): <!--number 11806 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vYWN0aW9ucy1wcm90byB0byB2MC43LjAgKGZvcmdlam8p-->Update module code.forgejo.org/forgejo/actions-proto to v0.7.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11804): <!--number 11804 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNy4zIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.7.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11789): <!--number 11789 --><!--line 0 --><!--description Y2hvcmU6IGxpbmsgdG8gQUkgQWdyZWVtZW50IGluIFBSIHRlbXBsYXRl-->chore: link to AI Agreement in PR template<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11732): <!--number 11732 --><!--line 0 --><!--description YWxsb3cgcmVuYW1pbmcgYW5kIHJlcGxhY2luZyBzZWNyZXRz-->allow renaming and replacing secrets<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11781): <!--number 11781 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIERvY2tlciB0YWcgdG8gdjQzLjg2LjEgKGZvcmdlam8p-->Update renovate Docker tag to v43.86.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11772): <!--number 11772 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2phY2tjL3BneC92NSB0byB2NS45LjEgKGZvcmdlam8p-->Update module github.com/jackc/pgx/v5 to v5.9.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11717): <!--number 11717 --><!--line 0 --><!--description ZG9jdW1lbnQgbW9yZSBzdGF0dXMgY29kZXMgaW4gdGhlIEFQSQ==-->document more status codes in the API<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11217): <!--number 11217 --><!--line 0 --><!--description YnVpbGQ6IHBvbGlzaCBsaW50ZXIgZXJyb3IgdnMuIGRlYWQgY29kZSByZXBvcnRpbmc=-->build: polish linter error vs. dead code reporting<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11751): <!--number 11751 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3l1aW4vZ29sZG1hcmsgdG8gdjEuNy4xNyAoZm9yZ2Vqbyk=-->Update module github.com/yuin/goldmark to v1.7.17 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10541): <!--number 10541 --><!--line 0 --><!--description YWRkIG1hbmFnZV9jcmVkZW50aWFscyB0byB1c2VyIGRpc2FibGUgZmVhdHVyZXM=-->add manage_credentials to user disable features<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11745): <!--number 11745 --><!--line 0 --><!--description VXBkYXRlIE5vZGUuanMgdG8gdjI0LjE0LjAgKGZvcmdlam8p-->Update Node.js to v24.14.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11743): <!--number 11743 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvdG9vbHMvY21kL2RlYWRjb2RlIHRvIHYwLjQzLjAgKGZvcmdlam8p-->Update module golang.org/x/tools/cmd/deadcode to v0.43.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11741): <!--number 11741 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvb2F1dGgyIHRvIHYwLjM2LjAgKGZvcmdlam8p-->Update module golang.org/x/oauth2 to v0.36.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11674): <!--number 11674 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLXdlYmF1dGhuL3dlYmF1dGhuIHRvIHYwLjE2LjEgKGZvcmdlam8p-->Update module github.com/go-webauthn/webauthn to v0.16.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11744): <!--number 11744 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBtdmRhbi5jYy94dXJscy92MiB0byB2Mi42LjAgKGZvcmdlam8p-->Update module mvdan.cc/xurls/v2 to v2.6.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11632): <!--number 11632 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvb2dsZS9nby1saWNlbnNlcyB0byB2MiAoZm9yZ2VqbykgLSBhdXRvY2xvc2Vk-->Update module github.com/google/go-licenses to v2 (forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11740): <!--number 11740 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUyLjAgKGZvcmdlam8p-->Update module golang.org/x/net to v0.52.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11264): <!--number 11264 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgY2xpcHBpZSB0byB2NC4xLjEwIChmb3JnZWpvKQ==-->Update dependency clippie to v4.1.10 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11738): <!--number 11738 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL1Byb3Rvbk1haWwvZ28tY3J5cHRvIHRvIHYxLjQuMSAoZm9yZ2Vqbyk=-->Update module github.com/ProtonMail/go-crypto to v1.4.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11739): <!--number 11739 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzcuMCAoZm9yZ2Vqbyk=-->Update module golang.org/x/image to v0.37.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11691): <!--number 11691 --><!--line 0 --><!--description cmVtb3ZlIHRlbXBsYXRlIGZpbGUgZnJvbSBnZW5lcmF0ZWQgcmVwbw==-->remove template file from generated repo<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11713): <!--number 11713 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3VyZmF2ZS9jbGkvdjMgdG8gdjMuNy4wIChmb3JnZWpvKQ==-->Update module github.com/urfave/cli/v3 to v3.7.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11729): <!--number 11729 --><!--line 0 --><!--description cGVyZjogcmVtb3ZlIHJlZHVuZGFudCAmIGluY29ycmVjdCBmaWx0ZXJzIG9uICdTZWFyY2hSZXBvT3B0aW9ucy5Pd25lcklEJw==-->perf: remove redundant & incorrect filters on 'SearchRepoOptions.OwnerID'<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11728): <!--number 11728 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvY3J5cHRvIHRvIHYwLjQ5LjAgKGZvcmdlam8p-->Update module golang.org/x/crypto to v0.49.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11718): <!--number 11718 --><!--line 0 --><!--description dXNlIENTUyBjbGFzcyB0byBpbmRpY2F0ZSB0aGF0IHJ1bm5lciBuYW1lIGlzIHJlcXVpcmVk-->use CSS class to indicate that runner name is required<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11709): <!--number 11709 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL1Byb3Rvbk1haWwvZ28tY3J5cHRvIHRvIHYxLjQuMCAoZm9yZ2Vqbyk=-->Update module github.com/ProtonMail/go-crypto to v1.4.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11700): <!--number 11700 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3BxdWVybmEvb3RwIHRvIHYxLjUuMCAoZm9yZ2VqbykgLSBhdXRvY2xvc2Vk-->Update module github.com/pquerna/otp to v1.5.0 (forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11719): <!--number 11719 --><!--line 0 --><!--description Zml4KHVpKTogY2xlYW51cCBjc3MgZGVhZGNvZGUgcmVsYXRlZCB0byBzdGFja2FibGUgbWVudXM=-->fix(ui): cleanup css deadcode related to stackable menus<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11707): <!--number 11707 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBmaWxsbW9yZS1sYWJzLmNvbS9lcnJvcnR5cGUgdG8gdjAuMC4xMSAoZm9yZ2Vqbyk=-->Update module fillmore-labs.com/errortype to v0.0.11 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11708): <!--number 11708 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21hdHRuL2dvLXNxbGl0ZTMgdG8gdjEuMTQuMzcgKGZvcmdlam8p-->Update module github.com/mattn/go-sqlite3 to v1.14.37 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11690): <!--number 11690 --><!--line 0 --><!--description c2NvcGUtc3BlY2lmaWMgaGVhZGluZ3MgZm9yIGxpc3Qgb2YgcmVjZW50IHRhc2tz-->scope-specific headings for list of recent tasks<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11616): <!--number 11616 --><!--line 0 --><!--description cmVtb3ZlIHNlY29uZCBjaGFsbGVuZ2UgZnJvbSBXV1ctQXV0aGVudGljYXRlIGhlYWRlcg==-->remove second challenge from WWW-Authenticate header<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11686): <!--number 11686 --><!--line 0 --><!--description dGVzdDogYXR0ZW1wdCB0byBmaXggZmxha3kgVGVzdEJsZXZlRGVsZXRlSXNzdWU=-->test: attempt to fix flaky TestBleveDeleteIssue<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11053): <!--number 11053 --><!--line 0 --><!--description YnVpbGQ6IG1vdmUgYmFja2VuZC1jaGVja3MgQ0kgY2hlY2tzIHRvIE1ha2VmaWxlOiBgbWFrZSBwci1nb2A=-->build: move backend-checks CI checks to Makefile: `make pr-go`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11507): <!--number 11507 --><!--line 0 --><!--description UmVwbGFjZSByZWZlcmVuY2UgdG8gTW9uYWNvIHdpdGggQ29kZU1pcnJvciBpbiBhcHAuZXhhbXBsZS5pbmk=-->Replace reference to Monaco with CodeMirror in app.example.ini<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11295): <!--number 11295 --><!--line 0 --><!--description Zml4KHByb3h5cHJvdG9jb2wpOiByZW1vdmUgdHJhaWxpbmcgbnVsbCBieXRlIGZvciBsb2NhbCBjb25uZWN0aW9u-->fix(proxyprotocol): remove trailing null byte for local connection<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10525): <!--number 10525 --><!--line 0 --><!--description ZXhwYW5kIHJldXNhYmxlIHdvcmtmbG93IGNhbGxzIGludG8gdGhlaXIgaW5uZXIgam9icw==-->expand reusable workflow calls into their inner jobs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11692): <!--number 11692 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIERvY2tlciB0YWcgdG8gdjQzLjc2LjIgKGZvcmdlam8p-->Update renovate Docker tag to v43.76.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11697): <!--number 11697 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGdvb2dsZS9tb2RlbC12aWV3ZXIgdG8gdjQuMi4wIChmb3JnZWpvKQ==-->Update dependency @google/model-viewer to v4.2.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11695): <!--number 11695 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLXN3YWdnZXIvZ28tc3dhZ2dlci9jbWQvc3dhZ2dlciB0byB2MC4zMy4yIChmb3JnZWpvKQ==-->Update module github.com/go-swagger/go-swagger/cmd/swagger to v0.33.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11693): <!--number 11693 --><!--line 0 --><!--description VXBkYXRlIENvZGVNaXJyb3IgKGZvcmdlam8p-->Update CodeMirror (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11683): <!--number 11683 --><!--line 0 --><!--description Zml4KGkxOG4pOiByZXVzZSBzdHJpbmcgZm9yIHJlcG9zaXRvcnkgYWNjZXNzLCBmaXggY2FwaXRhbGl6YXRpb24gY29uc2lzdGVuY3k=-->fix(i18n): reuse string for repository access, fix capitalization consistency<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11675): <!--number 11675 --><!--line 0 --><!--description Zml4KHVpKTogaW1wcm92ZSBjb25zaXN0ZW5jeSBpbiBuZXcgcnVubmVyIG1hbmFnZW1lbnQgcGFnZXM=-->fix(ui): improve consistency in new runner management pages<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11682): <!--number 11682 --><!--line 0 --><!--description aW5jb3JyZWN0IERCIGVycm9yIGhhbmRsaW5nIGluICdQT1NUIC91c2Vycy97dXNlcm5hbWV9L3Rva2Vucyc=-->incorrect DB error handling in 'POST /users/{username}/tokens'<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11585): <!--number 11585 --><!--line 0 --><!--description Zml4KGlzc3VlLXNlYXJjaCk6IGRlbGV0ZSBpc3N1ZSBmcm9tIGluZGV4ZXIgb24gRGVsZXRlSXNzdWU=-->fix(issue-search): delete issue from indexer on DeleteIssue<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11672): <!--number 11672 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGNvZGVtaXJyb3IvdmlldyB0byB2Ni4zOS4xNyAoZm9yZ2Vqbyk=-->Update dependency @codemirror/view to v6.39.17 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11335): <!--number 11335 --><!--line 0 --><!--description c2tpcCByZXBvIGF2YXRhciB1cGxvYWQgd2hlbiBubyBmaWxlIGlzIHNlbGVjdGVk-->skip repo avatar upload when no file is selected<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11478): <!--number 11478 --><!--line 0 --><!--description UlBNIHJlZ2lzdHJ5IGFkZHJlcG8gaW5zdHJ1Y3Rpb25z-->RPM registry addrepo instructions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11525): <!--number 11525 --><!--line 0 --><!--description Y2hvcmU6IGFkZCBtb3JlIGRpYWdub3N0aWMgb3V0cHV0IHRvIGRiZnMgU3RhdCBlcnJvcg==-->chore: add more diagnostic output to dbfs Stat error<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11280): <!--number 11280 --><!--line 0 --><!--description Y2k6IGVuc3VyZSBjb3JyZWN0IG5vZGUgdmVyc2lvbg==-->ci: ensure correct node version<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11542): <!--number 11542 --><!--line 0 --><!--description Y2hvcmU6IHNraXAgc2hhMjU2IHJlcG8gZm9yIG9sZGVyIGdpdCB2ZXJzaW9ucw==-->chore: skip sha256 repo for older git versions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11176): <!--number 11176 --><!--line 0 --><!--description ZW5zdXJlIGNvbnNpc3RlbnQgc29ydCBvcmRlciBpbiBUZXN0RmVlZCBmaXh0dXJl-->ensure consistent sort order in TestFeed fixture<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11007): <!--number 11007 --><!--line 0 --><!--description Zml4IE5ld01vY2tXZWJTZXJ2ZXIoKTogSGVhZGVycyBuZXZlciByZWFjaGVkIHRoZSBodHRwIGNsaWVudA==-->fix NewMockWebServer(): Headers never reached the http client<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10798): <!--number 10798 --><!--line 0 --><!--description bWlncmF0aW9ucy9naXRodWI6IGF2b2lkIGdldHRpbmcgdGhlIGZpcnN0IGlzc3VlcyBwYWdlIHR3aWNl-->migrations/github: avoid getting the first issues page twice<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10846): <!--number 10846 --><!--line 0 --><!--description bWlncmF0aW9ucy9naXRodWI6IFdhaXQgJiByZXRyeSB3aGVuIHByaW1hcnkgcmF0ZSBsaW1pdCBpcyBoaXQ=-->migrations/github: Wait & retry when primary rate limit is hit<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11038): <!--number 11038 --><!--line 0 --><!--description ZGV0ZWN0IHJlbmFtZXMgd2hlbiB1c2luZyBkaWZmLXRyZWU=-->detect renames when using diff-tree<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10883): <!--number 10883 --><!--line 0 --><!--description Y2k6IHRpZSBnbyBjYWNoZSB0byBnbyB2ZXJzaW9uIGFuZCBhZGQgYE1ha2VmaWxlYCB0byBrZXkgaGFzaA==-->ci: tie go cache to go version and add `Makefile` to key hash<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10893): <!--number 10893 --><!--line 0 --><!--description cmV0cnkgQWN0aW9uUnVuIHVwZGF0ZXMgd2hlbiBvcHRpbWlzdGljLWNvbmN1cnJlbmN5LWNvbnRyb2wgaW5kaWNhdGVzIHJlY29yZCBjaGFuZ2Vk-->retry ActionRun updates when optimistic-concurrency-control indicates record changed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10481): <!--number 10481 --><!--line 0 --><!--description YWRkIE9JREMgd29ya2xvYWQgaWRlbnRpdHkgZmVkZXJhdGlvbiBzdXBwb3J0-->add OIDC workload identity federation support<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11662): <!--number 11662 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvb2NpL2dvbGFuZyBEb2NrZXIgdGFnIHRvIHYxLjI2IChmb3JnZWpvKSAtIGF1dG9jbG9zZWQ=-->Update data.forgejo.org/oci/golang Docker tag to v1.26 (forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11660): <!--number 11660 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTEgKGZvcmdlam8p-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.11 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11663): <!--number 11663 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWVybWFpZCB0byB2MTEuMTMuMCAoZm9yZ2Vqbyk=-->Update dependency mermaid to v11.13.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11657): <!--number 11657 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlcGxhY2UgV2l0aEF2YWlsYWJsZSB3aXRoIFdpdGhWaXNpYmxlIHdoZW4gZmV0Y2hpbmcgcnVubmVycw==-->refactor: replace WithAvailable with WithVisible when fetching runners<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11653): <!--number 11653 --><!--line 0 --><!--description Y3JlYXRlIHJlcG8tc3BlY2lmaWMgYWNjZXNzIHRva2VuIHVuZXhwZWN0ZWQgYmVoYXZpb3VyIHdpdGggYCJyZXBvc2l0b3JpZXMiOiBbXWA=-->create repo-specific access token unexpected behaviour with `"repositories": []`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11627): <!--number 11627 --><!--line 0 --><!--description VXBkYXRlIGxpbnRlcnMgKGZvcmdlam8p-->Update linters (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11320): <!--number 11320 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ28gdG8gdjEuMjYgKGZvcmdlam8p-->Update dependency go to v1.26 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11334): <!--number 11334 --><!--line 0 --><!--description Zml4KG1vZGVscyk6IGRlZHVwbGljYXRlIHByb2plY3Qgc29ydGluZyB2YWx1ZXMgYW5kIGFkZCB1bmlxdWUgY29uc3RyYWludHM=-->fix(models): deduplicate project sorting values and add unique constraints<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11644): <!--number 11644 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuOCAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.8 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11639): <!--number 11639 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNy4yIChmb3JnZWpvKSAtIGF1dG9jbG9zZWQ=-->Update module code.forgejo.org/forgejo/runner/v12 to v12.7.2 (forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11638): <!--number 11638 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kga2F0ZXggdG8gdjAuMTYuMzggKGZvcmdlam8p-->Update dependency katex to v0.16.38 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11630): <!--number 11630 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9mb3JnZWpvL3VwbG9hZC1hcnRpZmFjdCBhY3Rpb24gdG8gdjUgKGZvcmdlam8pIC0gYXV0b2Nsb3NlZA==-->Update https://code.forgejo.org/forgejo/upload-artifact action to v5 (forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11631): <!--number 11631 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL3VwbG9hZC1hcnRpZmFjdCBhY3Rpb24gdG8gdjUgKGZvcmdlam8p-->Update https://data.forgejo.org/forgejo/upload-artifact action to v5 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11629): <!--number 11629 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgd3JhcC1hbnNpIHRvIHYxMCAoZm9yZ2Vqbyk=-->Update dependency wrap-ansi to v10 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11605): <!--number 11605 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgYXNjaWluZW1hLXBsYXllciB0byB2My4xNS4xIChmb3JnZWpvKQ==-->Update dependency asciinema-player to v3.15.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11624): <!--number 11624 --><!--line 0 --><!--description Y2hvcmUoZGVwcyk6IGJ1bXAgeG9ybSB0byB2MS4zLjktZm9yZ2Vqby44-->chore(deps): bump xorm to v1.3.9-forgejo.8<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11342): <!--number 11342 --><!--line 0 --><!--description Y2hvcmUocmVmYWN0b3IpOiBzcGxpdCBBZGRSZXBvc2l0b3J5IGFuZCBBZGRUZWFtTWVtYmVyIHRvIHJldHVybiB0aGUgaW5zZXJ0ZWQgdmFsdWU=-->chore(refactor): split AddRepository and AddTeamMember to return the inserted value<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11621): <!--number 11621 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ2xvYmFscyB0byB2MTcuNC4wIChmb3JnZWpvKQ==-->Update dependency globals to v17.4.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11588): <!--number 11588 --><!--line 0 --><!--description d2ViaG9vay9kaXNjb3JkOiBvbWl0IGVtcHR5IGVtYmVkcy5mb290ZXIgZnJvbSB0aGUgcGF5bG9hZCBmb3IgU3BhY2ViYXIgY29tcGF0aWJpbGl0eQ==-->webhook/discord: omit empty embeds.footer from the payload for Spacebar compatibility<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11601): <!--number 11601 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlcGxhY2UgQWN0aW9uUnVubmVyVG9rZW4uT3duZXJJRCAmIFJlcG9JRCB3aXRoIG9wdGlvbmFsLk9wdGlvbltpbnQ2NF0=-->refactor: replace ActionRunnerToken.OwnerID & RepoID with optional.Option[int64]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11593): <!--number 11593 --><!--line 0 --><!--description Y2k6IGRldGVjdCBhbmQgcHJldmVudCBlbXB0eSBgY2FzZWAgc3RhdGVtZW50cyBpbiBHbyBjb2Rl-->ci: detect and prevent empty `case` statements in Go code<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11599): <!--number 11599 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kga2F0ZXggdG8gdjAuMTYuMzcgKGZvcmdlam8p-->Update dependency katex to v0.16.37 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11595): <!--number 11595 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlbmFtZSBBY2Nlc3NUb2tlbkVycm9yIHRvIEFjY2Vzc1Rva2VuRXJyb3JSZXNwb25zZQ==-->refactor: rename AccessTokenError to AccessTokenErrorResponse<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11442): <!--number 11442 --><!--line 0 --><!--description ZW5mb3JjZSBwYWNrYWdlIHF1b3RhIGFnYWluc3QgcGFja2FnZSBvd25lciwgbm90IHVwbG9hZGVy-->enforce package quota against package owner, not uploader<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11144): <!--number 11144 --><!--line 0 --><!--description Y2hvcmU6IGFkZCBjb21tZW50IGZvciBhcCBtaWdyYXRpb24=-->chore: add comment for ap migration<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9254): <!--number 9254 --><!--line 0 --><!--description ZmVhdChhY3Rpdml0eXB1Yik6IHVzZSBzdHJ1Y3R1cmUgQFByZWZlcnJlZFVzZXJuYW1lQGhvc3QudGxkOnBvcnQgZm9yIGFjdG9ycw==-->feat(activitypub): use structure @PreferredUsername@host.tld:port for actors<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11568): <!--number 11568 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21pbmlvL21pbmlvLWdvL3Y3IHRvIHY3LjAuOTkgKGZvcmdlam8pIC0gYXV0b2Nsb3NlZA==-->Update module github.com/minio/minio-go/v7 to v7.0.99 (forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11576): <!--number 11576 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kga2F0ZXggdG8gdjAuMTYuMzUgKGZvcmdlam8p-->Update dependency katex to v0.16.35 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11558): <!--number 11558 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgd2VicGFjayB0byB2NS4xMDUuNCAoZm9yZ2Vqbyk=-->Update dependency webpack to v5.105.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11587): <!--number 11587 --><!--line 0 --><!--description Y2hvcmU6IGNsZWFudXAgTWFrZWZpbGU=-->chore: cleanup Makefile<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11583): <!--number 11583 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjE0LjAuMyBbc2tpcCBjaV0=-->chore(release-notes): Forgejo v14.0.3 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11582): <!--number 11582 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjExLjAuMTEgW3NraXAgY2ld-->chore(release-notes): Forgejo v11.0.11 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11553): <!--number 11553 --><!--line 0 --><!--description Y2hvcmU6IHN1cHBvcnQgYE9wdGlvbltUXWAgYXMgYSB0eXBlIG9uIGRhdGFiYXNlIHNjaGVtYSBzdHJ1Y3Rz-->chore: support `Option[T]` as a type on database schema structs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11564): <!--number 11564 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWVucnkvZ28tZW5yeS92MiB0byB2Mi45LjUgKGZvcmdlam8p-->Update module github.com/go-enry/go-enry/v2 to v2.9.5 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11559): <!--number 11559 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNyAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.7 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11562): <!--number 11562 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNy4xIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.7.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11481): <!--number 11481 --><!--line 0 --><!--description Y2hvcmUodHJlZXdpZGUpOiByZW5hbWUgU2FmZUhUTUwgdG8gVHJ1c3RIVE1M-->chore(treewide): rename SafeHTML to TrustHTML<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11563): <!--number 11563 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2JsZXZlc2VhcmNoL2JsZXZlL3YyIHRvIHYyLjUuNyAoZm9yZ2Vqbyk=-->Update module github.com/blevesearch/bleve/v2 to v2.5.7 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11368): <!--number 11368 --><!--line 0 --><!--description ZmVhdChhcGkpOiBtb3JlIHZlcmJvc2UgZXJyb3IgbWVzc2FnZXMgYW5kIHN3YWdnZXIgY29tbWVudHMgZm9yIHBvc3RpbmcgaXNzdWUgY29tbWVudHM=-->feat(api): more verbose error messages and swagger comments for posting issue comments<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11486): <!--number 11486 --><!--line 0 --><!--description VXBkYXRlIGNvZGUuZm9yZ2Vqby5vcmcvZm9yZ2Vqby1jb250cmliL2dvLWxpYnJhdmF0YXIgZGlnZXN0IHRvIGFkZDQ5NGUgKGZvcmdlam8p-->Update code.forgejo.org/forgejo-contrib/go-libravatar digest to add494e (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11545): <!--number 11545 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgdGFpbHdpbmRjc3MgdG8gdjMuNC4xOSAoZm9yZ2Vqbyk=-->Update dependency tailwindcss to v3.4.19 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11538): <!--number 11538 --><!--line 0 --><!--description Y2hvcmUoZGVwcyk6IHVwZ3JhZGUgeG9ybSB0byB2MS4zLjktZm9yZ2Vqby43-->chore(deps): upgrade xorm to v1.3.9-forgejo.7<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11549): <!--number 11549 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgdWludDgtdG8tYmFzZTY0IHRvIHYwLjIuMSAoZm9yZ2Vqbyk=-->Update dependency uint8-to-base64 to v0.2.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11543): <!--number 11543 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS42LjEgKGZvcmdlam8p-->Update dependency forgejo/release-notes-assistant to v1.6.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11470): <!--number 11470 --><!--line 0 --><!--description Zml4KHRlc3RzKTogZG8gbm90IGxlYWsgZ2xvYmFsIHJlcG9zaXRvcnkgdW5pdCBkZWZhdWx0cw==-->fix(tests): do not leak global repository unit defaults<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11523): <!--number 11523 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWluaW1hdGNoIHRvIHYxMC4yLjQgKGZvcmdlam8p-->Update dependency minimatch to v10.2.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11521): <!--number 11521 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ28gdG8gdjEuMjUuOCAoZm9yZ2Vqbyk=-->Update dependency go to v1.25.8 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11520): <!--number 11520 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kga2F0ZXggdG8gdjAuMTYuMzMgKGZvcmdlam8p-->Update dependency katex to v0.16.33 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11519): <!--number 11519 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZGF5anMgdG8gdjEuMTEuMTkgKGZvcmdlam8p-->Update dependency dayjs to v1.11.19 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11517): <!--number 11517 --><!--line 0 --><!--description VXBkYXRlIENvZGVNaXJyb3IgKGZvcmdlam8p-->Update CodeMirror (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9873): <!--number 9873 --><!--line 0 --><!--description SGFuZGxlIGVycm9yIHR5cGVzIGNvbnNpc3RlbnRseQ==-->Handle error types consistently<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11450): <!--number 11450 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21hcmtiYXRlcy9nb3RoIHRvIHYxLjgyLjAgKGZvcmdlam8p-->Update module github.com/markbates/goth to v1.82.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11385): <!--number 11385 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWVybWFpZCB0byB2MTEuMTIuMyAoZm9yZ2Vqbyk=-->Update dependency mermaid to v11.12.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11508): <!--number 11508 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgc3ZnbyB0byB2NC4wLjEgW1NFQ1VSSVRZXSAoZm9yZ2Vqbyk=-->Update dependency svgo to v4.0.1 [SECURITY] (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11388): <!--number 11388 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWluaW1hdGNoIHRvIHYxMC4yLjEgKGZvcmdlam8p-->Update dependency minimatch to v10.2.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11376): <!--number 11376 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS42LjAgKGZvcmdlam8p-->Update dependency forgejo/release-notes-assistant to v1.6.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11384): <!--number 11384 --><!--line 0 --><!--description UmVwbGFjZSBOb2RlLmpzIHdpdGggZGF0YS5mb3JnZWpvLm9yZy9vY2kvbm9kZSAyNC10cml4aWUgKGZvcmdlam8p-->Replace Node.js with data.forgejo.org/oci/node 24-trixie (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11441): <!--number 11441 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWluaW1hdGNoIHRvIHYxMC4yLjMgW1NFQ1VSSVRZXSAoZm9yZ2Vqbyk=-->Update dependency minimatch to v10.2.3 [SECURITY] (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11359): <!--number 11359 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNiAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.6 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11406): <!--number 11406 --><!--line 0 --><!--description UmV2ZXJ0ICJSZXBsYWNlIE5vZGUuanMgd2l0aCBkYXRhLmZvcmdlam8ub3JnL29jaS9ub2RlIDI0LXRyaXhpZSAoZm9yZ2VqbykgKCMxMTM4NCki-->Revert "Replace Node.js with data.forgejo.org/oci/node 24-trixie (forgejo) (#11384)"<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11392): <!--number 11392 --><!--line 0 --><!--description Y2hvcmUocmVub3ZhdGUpOiBwcmVwYXJlIGZvciBvcGVyYXRvcg==-->chore(renovate): prepare for operator<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11363): <!--number 11363 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNy4wIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.7.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11243): <!--number 11243 --><!--line 0 --><!--description Y2hvcmUocmVub3ZhdGUpOiBkaXNhYmxlIG1ham9yIHVwZGF0ZXMgb24gc3RhYmxlIGJyYW5jaGVzIGJ5IGRlZmF1bHQ=-->chore(renovate): disable major updates on stable branches by default<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11293): <!--number 11293 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgc29ydGFibGVqcyB0byB2MS4xNS43IChmb3JnZWpvKQ==-->Update dependency sortablejs to v1.15.7 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11233): <!--number 11233 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21hdHRuL2dvLXNxbGl0ZTMgdG8gdjEuMTQuMzQgKGZvcmdlam8p-->Update module github.com/mattn/go-sqlite3 to v1.14.34 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11350): <!--number 11350 --><!--line 0 --><!--description Y2hvcmU6IHJlbW92ZSBmaWVsZCBlcGhlbWVyYWwgZnJvbSBydW5uZXIgcmVnaXN0cmF0aW9uIHJlc3BvbnNl-->chore: remove field ephemeral from runner registration response<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11218): <!--number 11218 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlcGxhY2UgYFZhbHVlKClgIGZyb20gT3B0aW9uW1RdIHdpdGggYEdldCgpYCAmIGBWYWx1ZU9yWmVyb1ZhbHVlKClg-->refactor: replace `Value()` from Option[T] with `Get()` & `ValueOrZeroValue()`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11222): <!--number 11222 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNi40IChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.6.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11319): <!--number 11319 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgcG9zdGNzcy1sb2FkZXIgdG8gdjguMi4xIChmb3JnZWpvKQ==-->Update dependency postcss-loader to v8.2.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11226): <!--number 11226 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzYuMCAoZm9yZ2Vqbyk=-->Update module golang.org/x/image to v0.36.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11241): <!--number 11241 --><!--line 0 --><!--description ZmVhdCh1aSk6IHN1cHBvcnQgQzMgbGFuZ3VhZ2UgaGlnaGxpZ2h0aW5nIGluIGZpbGUgZWRpdG9y-->feat(ui): support C3 language highlighting in file editor<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11210): <!--number 11210 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgcG9zdGNzcy1uZXN0aW5nIHRvIHYxNCAoZm9yZ2Vqbyk=-->Update dependency postcss-nesting to v14 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11201): <!--number 11201 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGNvZGVtaXJyb3IvY29tbWFuZHMgdG8gdjYuMTAuMiAoZm9yZ2Vqbyk=-->Update dependency @codemirror/commands to v6.10.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11237): <!--number 11237 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUwLjAgKGZvcmdlam8p-->Update module golang.org/x/net to v0.50.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11333): <!--number 11333 --><!--line 0 --><!--description Zml4KGkxOG4pOiB1bmhhcmRjb2RlIGxhYmVsIGV4Y2x1c2lvbiB0b29sdGlwcw==-->fix(i18n): unhardcode label exclusion tooltips<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11235): <!--number 11235 --><!--line 0 --><!--description Y2hvcmUobGludCk6IGVuYWJsZSBuaWxuaWw=-->chore(lint): enable nilnil<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11325): <!--number 11325 --><!--line 0 --><!--description aTE4bigqKTogbWlncmF0ZSA5MiBzdHJpbmdzIHRvIGpzb24=-->i18n(*): migrate 92 strings to json<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11093): <!--number 11093 --><!--line 0 --><!--description Y29ycmVjdCBtYWxmb3JtZWQgQ3JlYXRlVGVhbU9wdGlvbiBleGFtcGxl-->correct malformed CreateTeamOption example<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11225): <!--number 11225 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvY3J5cHRvIHRvIHYwLjQ4LjAgKGZvcmdlam8p-->Update module golang.org/x/crypto to v0.48.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10979): <!--number 10979 --><!--line 0 --><!--description aTE4bigqKTogbWlncmF0ZSBpbmkgc2VjdGlvbiBbcGFja2FnZXNdIHRvIGpzb24=-->i18n(*): migrate ini section [packages] to json<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11345): <!--number 11345 --><!--line 0 --><!--description Y2hvcmUoaTE4bik6IGRlZHVwbGljYXRlIGNvbW1vbiBwYWNrYWdlcyByZWxhdGVkIHN0cmluZ3M=-->chore(i18n): deduplicate common packages related strings<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11277): <!--number 11277 --><!--line 0 --><!--description Q2hvcmUgbW9kdWxlcy9zZXNzaW9uL3ZpcnR1YWw6IGdjIF9vbGRfdWlkIGhhY2s=-->Chore modules/session/virtual: gc _old_uid hack<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11236): <!--number 11236 --><!--line 0 --><!--description VXBkYXRlIE5vZGUuanMgdG8gdjI0LjEzLjEgKGZvcmdlam8p-->Update Node.js to v24.13.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11156): <!--number 11156 --><!--line 0 --><!--description ZmVhdCh1aSk6IHN1cHBvcnQgYWRkaXRpb25hbCBqb2Igc3RhdHVzIHNlbGVjdGlvbiBpbiBkcm9wZG93biBtZW51IG9uIEFjdGlvbnMgdGFi-->feat(ui): support additional job status selection in dropdown menu on Actions tab<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11284): <!--number 11284 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgd2VicGFjayB0byB2NS4xMDUuMiAoZm9yZ2Vqbyk=-->Update dependency webpack to v5.105.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11251): <!--number 11251 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGNvZGVtaXJyb3IvdmlldyB0byB2Ni4zOS4xNCAoZm9yZ2Vqbyk=-->Update dependency @codemirror/view to v6.39.14 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11326): <!--number 11326 --><!--line 0 --><!--description VXNlclR5cGVSZW1vdGVVc2VyIGlzIGFuIGVsaWdpYmxlIG9yZ2FuaXphdGlvbiBtZW1iZXI=-->UserTypeRemoteUser is an eligible organization member<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11223): <!--number 11223 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2tsYXVzcG9zdC9jb21wcmVzcyB0byB2MS4xOC40IChmb3JnZWpvKQ==-->Update module github.com/klauspost/compress to v1.18.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11199): <!--number 11199 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0MyAoZm9yZ2VqbykgKG1ham9yKQ==-->Update renovate to v43 (forgejo) (major)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11318): <!--number 11318 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgYXNjaWluZW1hLXBsYXllciB0byB2My4xNC4xNSAoZm9yZ2Vqbyk=-->Update dependency asciinema-player to v3.14.15 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11142): <!--number 11142 --><!--line 0 --><!--description Y2k6IGludHJvZHVjZSBgc2VtZ3JlcGAgdG8gcHJldmVudCB1c2luZyBgeG9ybS5TeW5jKClgIGluY29ycmVjdGx5IGluIG5ldyBtaWdyYXRpb25z-->ci: introduce `semgrep` to prevent using `xorm.Sync()` incorrectly in new migrations<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11169): <!--number 11169 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS41LjIgKGZvcmdlam8p-->Update dependency forgejo/release-notes-assistant to v1.5.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11197): <!--number 11197 --><!--line 0 --><!--description Y2hvcmUodWkpOiBhZGQgaW50ZWdyYXRpb24gdGVzdHMgZm9yIGZvb3RlciB0bXBsIGxvZ2lj-->chore(ui): add integration tests for footer tmpl logic<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11143): <!--number 11143 --><!--line 0 --><!--description c2hvdyBub3RlIHRoYXQgdXNlciBoYXMgbm8gU1NIIGtleXM=-->show note that user has no SSH keys<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11171): <!--number 11171 --><!--line 0 --><!--description cmVmbGVjdCBhbGxvd2VkIHVzZXJuYW1lIGNoYW5nZSBpbiBwcm9maWxlIHNldHRpbmc=-->reflect allowed username change in profile setting<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11136): <!--number 11136 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGNvZGVtaXJyb3IvdmlldyB0byB2Ni4zOS4xMiAoZm9yZ2Vqbyk=-->Update dependency @codemirror/view to v6.39.12 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11170): <!--number 11170 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWNoaS9jaGkvdjUgdG8gdjUuMi41IChmb3JnZWpvKQ==-->Update module github.com/go-chi/chi/v5 to v5.2.5 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11184): <!--number 11184 --><!--line 0 --><!--description bmV3bHkgZXhwYW5kZWQgZHluYW1pYyBtYXRyaXggam9icyBjYW4gYmVjb21lIHN0dWNrIGluIGEgJ2Jsb2NrZWQnIHN0YXRl-->newly expanded dynamic matrix jobs can become stuck in a 'blocked' state<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11067): <!--number 11067 --><!--line 0 --><!--description UmVmYWN0b3Igand0eC9zaWduaW5na2V5OiBBZGQgSldUKCkgbWV0aG9kIGZvciBjb252ZW5pZW5jZS9jbGFyaXR5-->Refactor jwtx/signingkey: Add JWT() method for convenience/clarity<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11183): <!--number 11183 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgd2VicGFjayB0byB2NS4xMDUuMCAoZm9yZ2Vqbyk=-->Update dependency webpack to v5.105.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11149): <!--number 11149 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ28gdG8gdjEuMjUuNyAoZm9yZ2Vqbyk=-->Update dependency go to v1.25.7 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11104): <!--number 11104 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNCAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10552): <!--number 10552 --><!--line 0 --><!--description ZmVhdChpc3N1ZS1zZWFyY2gpOiBzdXBwb3J0IGZpbHRlcmluZyBmb3IgaXNzdWVzIHdpdGggbXVsdGlwbGUgYXNzaWduZWVz-->feat(issue-search): support filtering for issues with multiple assignees<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11448): <!--number 11448 --><!--line 0 --><!--description VXBkYXRlIGxpbnRlcnMgKGZvcmdlam8p-->Update linters (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11493): <!--number 11493 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQHZpdGVzdC9lc2xpbnQtcGx1Z2luIHRvIHYxLjYuOSAoZm9yZ2VqbykgLSBhdXRvY2xvc2Vk-->Update dependency @vitest/eslint-plugin to v1.6.9 (forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11492): <!--number 11492 --><!--line 0 --><!--description VXBkYXRlIGdpdGh1Yi5jb20vY2xvdWRmbGFyZS9jaXJjbCAoaW5kaXJlY3QpIHRvIHYxLjYuMyBbU0VDVVJJVFldIChmb3JnZWpvKQ==-->Update github.com/cloudflare/circl (indirect) to v1.6.3 [SECURITY] (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11485): <!--number 11485 --><!--line 0 --><!--description Y2hvcmU6IHVwZGF0ZSBsaWNlbnNlIHRlc3Q=-->chore: update license test<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11490): <!--number 11490 --><!--line 0 --><!--description Y2hvcmUocmVub3ZhdGUpOiB1cGRhdGUgY29uZmln-->chore(renovate): update config<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11158): <!--number 11158 --><!--line 0 --><!--description Y2hvcmU6IHVwZGF0ZSBsaWNlbnNlcyBhbmQgZ2l0aWdub3JlcyBbc2tpcCBjaV0=-->chore: update licenses and gitignores [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10311): <!--number 10311 --><!--line 0 --><!--description cmVmYWN0b3I6IHVzZSBzaWduYWwuTm90aWZ5Q29udGV4dCBvdmVyIGN1c3RvbSBpbXBsZW1lbnRhdGlvbg==-->refactor: use signal.NotifyContext over custom implementation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11477): <!--number 11477 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3ZhbHlhbGEvZmFzdGpzb24gdG8gdjEuNi4xMCAoZm9yZ2Vqbyk=-->Update module github.com/valyala/fastjson to v1.6.10 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11476): <!--number 11476 --><!--line 0 --><!--description Y2k6IGFkZCBgc2VtZ3JlcGAgZGV0ZWN0aW9uIGZvciBBUEkgY29kZSBpZ25vcmluZyByZXBvLXNwZWNpZmljIGFjY2VzcyB0b2tlbnM=-->ci: add `semgrep` detection for API code ignoring repo-specific access tokens<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11374): <!--number 11374 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgc3dhZ2dlci11aS1kaXN0IHRvIHY1LjMxLjEgKGZvcmdlam8p-->Update dependency swagger-ui-dist to v5.31.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11462): <!--number 11462 --><!--line 0 --><!--description UmV2ZXJ0ICJmaXg6IGVuc3VyZSBhY3Rpb25zIGxvZ3MgYXJlIHRyYW5zZmVycmVkIHdoZW4gYSB0YXNrIGlzIGRvbmUgKCMxMDAwOCki-->Revert "fix: ensure actions logs are transferred when a task is done (#10008)"<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11447): <!--number 11447 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUxLjAgW1NFQ1VSSVRZXSAoZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.51.0 [SECURITY] (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11451): <!--number 11451 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL1NhdmVUaGVSYnR6L3pzdGQtc2Vla2FibGUtZm9ybWF0LWdvL3BrZyB0byB2MC44LjAgKGZvcmdlam8p-->Update module github.com/SaveTheRbtz/zstd-seekable-format-go/pkg to v0.8.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11463): <!--number 11463 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLnN1cGVyc2VyaW91c2J1c2luZXNzLm9yZy9leGlmLXRlcm1pbmF0b3IgdG8gdjAuMTEuMSAoZm9yZ2Vqbyk=-->Update module code.superseriousbusiness.org/exif-terminator to v0.11.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11175): <!--number 11175 --><!--line 0 --><!--description QWRkIFRyYWNlIGxvZ2dpbmcgZm9yIEpXVCBzZXNzaW9u-->Add Trace logging for JWT session<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11449): <!--number 11449 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZ2NpL2dvbGFuZ2NpLWxpbnQvdjIvY21kL2dvbGFuZ2NpLWxpbnQgdG8gdjIuMTAuMSAoZm9yZ2Vqbyk=-->Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.10.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11434): <!--number 11434 --><!--line 0 --><!--description Y29yZSBpbmZyYXN0cnVjdHVyZSBmb3IgcmVwb3NpdG9yeS1zcGVjaWZpYyBhY2Nlc3MgdG9rZW5z-->core infrastructure for repository-specific access tokens<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11452): <!--number 11452 --><!--line 0 --><!--description aW1wbGVtZW50IHJlcG8tc3BlY2lmaWMgYWNjZXNzIHRva2VucyBpbiBnaXQgb3BlcmF0aW9ucw==-->implement repo-specific access tokens in git operations<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11110): <!--number 11110 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgY3NzLWxvYWRlciB0byB2Ny4xLjMgKGZvcmdlam8p-->Update dependency css-loader to v7.1.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11121): <!--number 11121 --><!--line 0 --><!--description VXBkYXRlIHZpdGVzdCBtb25vcmVwbyB0byB2NC4wLjE4IChmb3JnZWpvKQ==-->Update vitest monorepo to v4.0.18 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11062): <!--number 11062 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21laWxpc2VhcmNoL21laWxpc2VhcmNoLWdvIHRvIHYwLjM2LjAgKGZvcmdlam8p-->Update module github.com/meilisearch/meilisearch-go to v0.36.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11103): <!--number 11103 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2NhY2hlIGFjdGlvbiB0byB2NS4wLjMgKGZvcmdlam8p-->Update https://data.forgejo.org/actions/cache action to v5.0.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10915): <!--number 10915 --><!--line 0 --><!--description d2ViL2F1dGg6IHNpZ251cCBwb2xpc2g=-->web/auth: signup polish<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10937): <!--number 10937 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3VyZmF2ZS9jbGkvdjMgdG8gdjMuNi4yIChmb3JnZWpvKQ==-->Update module github.com/urfave/cli/v3 to v3.6.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11090): <!--number 11090 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZy1qd3Qvand0L3Y1IHRvIHY1LjMuMSAoZm9yZ2Vqbyk=-->Update module github.com/golang-jwt/jwt/v5 to v5.3.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11077): <!--number 11077 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi45My4xIChmb3JnZWpvKQ==-->Update renovate to v42.93.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10753): <!--number 10753 --><!--line 0 --><!--description Zml4IHR5cG9zIHRocm91Z2hvdXQgdGhlIGNvZGViYXNl-->fix typos throughout the codebase<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10922): <!--number 10922 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGdpdGh1Yi90ZXh0LWV4cGFuZGVyLWVsZW1lbnQgdG8gdjIuOS40IChmb3JnZWpvKQ==-->Update dependency @github/text-expander-element to v2.9.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11066): <!--number 11066 --><!--line 0 --><!--description UG9saXNoIGp3dHgvc2lnbmluZ2tleTogQXZvaWQgbG9nLkZhdGFsKCk=-->Polish jwtx/signingkey: Avoid log.Fatal()<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11092): <!--number 11092 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjE0LjAuMiBbc2tpcCBjaV0=-->chore(release-notes): Forgejo v14.0.2 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10936): <!--number 10936 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2FsZWN0aG9tYXMvY2hyb21hL3YyIHRvIHYyLjIzLjEgKGZvcmdlam8p-->Update module github.com/alecthomas/chroma/v2 to v2.23.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11095): <!--number 11095 --><!--line 0 --><!--description InJldmVydCBVcGRhdGUgbW9kdWxlIGdpdGh1Yi5jb20vdXJmYXZlL2NsaS92MyB0byB2My42LjIgKGZvcmdlam8pICgjMTA5MzcpIg==-->"revert Update module github.com/urfave/cli/v3 to v3.6.2 (forgejo) (#10937)"<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11147): <!--number 11147 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ2xvYmFscyB0byB2MTcuMy4wIChmb3JnZWpvKQ==-->Update dependency globals to v17.3.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11061): <!--number 11061 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ2xvYmFscyB0byB2MTcuMS4wIChmb3JnZWpvKQ==-->Update dependency globals to v17.1.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11111): <!--number 11111 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ2xvYmFscyB0byB2MTcuMi4wIChmb3JnZWpvKQ==-->Update dependency globals to v17.2.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11105): <!--number 11105 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWVucnkvZ28tZW5yeS92MiB0byB2Mi45LjQgKGZvcmdlam8p-->Update module github.com/go-enry/go-enry/v2 to v2.9.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11088): <!--number 11088 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNi4zIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.6.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11047): <!--number 11047 --><!--line 0 --><!--description TG9jayBmaWxlIG1haW50ZW5hbmNlIChmb3JnZWpvKQ==-->Lock file maintenance (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10975): <!--number 10975 --><!--line 0 --><!--description Y2k6IHVzZSBuZXdlciBmb3JnZWpvIGZvciByZWxlYXNlIHNpbXVsYXRpb24=-->ci: use newer forgejo for release simulation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10356): <!--number 10356 --><!--line 0 --><!--description ImRpc2FibGUgcm91dGVyIGxvZyIgaW5kaWNhdG9yIG9uIGNvbmZpZ3VyYXRpb24gc3VtbWFyeSBwYWdl-->"disable router log" indicator on configuration summary page<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10847): <!--number 10847 --><!--line 0 --><!--description SW1wcm92ZSBpc3N1ZSB0ZW1wbGF0ZXMgZm9yIG5ldyB3b3JrZmxvdw==-->Improve issue templates for new workflow<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11019): <!--number 11019 --><!--line 0 --><!--description Y2hvcmUodWkpOiBjaGFuZ2UgL2RldnRlc3QgdG8gLy0vZGVtbw==-->chore(ui): change /devtest to /-/demo<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10919): <!--number 10919 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMSAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10976): <!--number 10976 --><!--line 0 --><!--description Y2k6IGFkZCBuYW1lIHRvIHN0ZXA=-->ci: add name to step<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10987): <!--number 10987 --><!--line 0 --><!--description b3B0aW1pemF0aW9uOiB1c2UgZnMuUmVhZEZpbGU=-->optimization: use fs.ReadFile<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11035): <!--number 11035 --><!--line 0 --><!--description Rml4IHRlc3QgY2FzZXMgd2hlcmUgcmVxdWlyZS5FcnJvckNvbnRhaW5zKCkgaXMgaW50ZW5kZWQsIGJ1dCByZXF1aXJlLkVycm9yZigpIGlzIHVzZWQ=-->Fix test cases where require.ErrorContains() is intended, but require.Errorf() is used<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10890): <!--number 10890 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2NhY2hlIGFjdGlvbiB0byB2NS4wLjIgKGZvcmdlam8p-->Update https://data.forgejo.org/actions/cache action to v5.0.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11045): <!--number 11045 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3JlZGlzL2dvLXJlZGlzL3Y5IHRvIHY5LjE3LjMgKGZvcmdlam8p-->Update module github.com/redis/go-redis/v9 to v9.17.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10977): <!--number 10977 --><!--line 0 --><!--description InJldmVydCBVcGRhdGUgaHR0cHM6Ly9kYXRhLmZvcmdlam8ub3JnL2Zvcmdlam8vZm9yZ2Vqby1idWlsZC1wdWJsaXNoIGFjdGlvbiB0byB2NS41LjAi-->"revert Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.5.0"<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10999): <!--number 10999 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNi4wIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.6.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10889): <!--number 10889 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgcG9zdGNzcy1odG1sIHRvIHYxLjguMSAoZm9yZ2Vqbyk=-->Update dependency postcss-html to v1.8.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10880): <!--number 10880 --><!--line 0 --><!--description ZGVsZXRlIGRlYWQgY29kZSBpbiBXYXRjaElmQXV0byBhbmQgZ2VuZXJhbCBtb2RlbCBkb2N1bWVudGF0aW9u-->delete dead code in WatchIfAuto and general model documentation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10972): <!--number 10972 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8tYnVpbGQtcHVibGlzaCBhY3Rpb24gdG8gdjUuNS4wIChmb3JnZWpvKQ==-->Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.5.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10966): <!--number 10966 --><!--line 0 --><!--description Zml4IHR5cG86IHNheSBnb29kIGJ5ZSB0byB0aGUgc2luZ2luZyBrZXk=-->fix typo: say good bye to the singing key<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10897): <!--number 10897 --><!--line 0 --><!--description ZXNjYXBlIEhUTUwgdGFncyBpbiBpbmxpbmUgY29kZSBibG9ja3MgaW4gZGVzY3JpcHRpb24=-->escape HTML tags in inline code blocks in description<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11004): <!--number 11004 --><!--line 0 --><!--description Zml4KGxvY2FsZSk6IHRvb2x0aXAgZm9yICJPd25lciIgcm9sZSBzaG91bGQgbm90IGltcGx5IHVuaXF1ZSBvd25lcg==-->fix(locale): tooltip for "Owner" role should not imply unique owner<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10934): <!--number 10934 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWluaS1jc3MtZXh0cmFjdC1wbHVnaW4gdG8gdjIuMTAuMCAoZm9yZ2Vqbyk=-->Update dependency mini-css-extract-plugin to v2.10.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11015): <!--number 11015 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNi4yIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.6.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10935): <!--number 10935 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9pbmZyYXN0cnVjdHVyZS9pc3N1ZS1hY3Rpb24gYWN0aW9uIHRvIHYxLjUuMCAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/infrastructure/issue-action action to v1.5.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11022): <!--number 11022 --><!--line 0 --><!--description Zml4IGNhc2UtaW5zZW5zaXRpdmUgd2hlbiB1c2luZyBibGV2ZQ==-->fix case-insensitive when using bleve<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11014): <!--number 11014 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMyAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10980): <!--number 10980 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8tYnVpbGQtcHVibGlzaCBhY3Rpb24gdG8gdjUuNS4xIChmb3JnZWpvKQ==-->Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.5.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11005): <!--number 11005 --><!--line 0 --><!--description UmVwbGFjZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vZm9yZ2VqbyBEb2NrZXIgdGFnIHdpdGggZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8gKGZvcmdlam8p-->Replace code.forgejo.org/forgejo/forgejo Docker tag with data.forgejo.org/forgejo/forgejo (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10967): <!--number 10967 --><!--line 0 --><!--description cG9saXNoIG9hdXRoOiBEbyBub3QgcGFzcyB0aGUgZnVsbCBzaWduaW5nIGtleSB0byB0ZW1wbGF0ZQ==-->polish oauth: Do not pass the full signing key to template<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11037): <!--number 11037 --><!--line 0 --><!--description UG9saXNoIG1vZHVsZXMvc3RvcmFnZSB0ZXN0IHVzZSBvZiByZXF1aXJlLkVycm9yZigp-->Polish modules/storage test use of require.Errorf()<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10911): <!--number 10911 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNS4zIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.5.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10891): <!--number 10891 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2tsYXVzcG9zdC9jb21wcmVzcyB0byB2MS4xOC4zIChmb3JnZWpvKQ==-->Update module github.com/klauspost/compress to v1.18.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10854): <!--number 10854 --><!--line 0 --><!--description cmVjcmVhdGUtdGFibGVzIGRvZXNuJ3Qgd29yayBvbiBQb3N0Z3JlU1FMIHdpdGggbXVsdGlwbGUgRm9yZ2VqbyBzY2hlbWFz-->recreate-tables doesn't work on PostgreSQL with multiple Forgejo schemas<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10799): <!--number 10799 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNS4yIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.5.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10850): <!--number 10850 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ28gdG8gdjEuMjUuNiAoZm9yZ2Vqbyk=-->Update dependency go to v1.25.6 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10802): <!--number 10802 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjQ5LjAgKGZvcmdlam8p-->Update module golang.org/x/net to v0.49.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10828): <!--number 10828 --><!--line 0 --><!--description cGluIGdpdGh1Yi5jb20vdXJmYXZlL2NsaSB0byB2My41LjA=-->pin github.com/urfave/cli to v3.5.0<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10837): <!--number 10837 --><!--line 0 --><!--description W3NraXAgY2ldIGNob3JlKHJlbGVhc2UpOiBkZWxldGUgMTAwMzcgYW5kIDk4NDAgcmVsZWFzZSBub3Rlcw==-->[skip ci] chore(release): delete 10037 and 9840 release notes<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10894): <!--number 10894 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjExLjAuMTAgW3NraXAgY2ld-->chore(release-notes): Forgejo v11.0.10 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10841): <!--number 10841 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWNoaS9jaGkvdjUgdG8gdjUuMi40IChmb3JnZWpvKQ==-->Update module github.com/go-chi/chi/v5 to v5.2.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10842): <!--number 10842 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21pbmlvL21pbmlvLWdvL3Y3IHRvIHY3LjAuOTggKGZvcmdlam8p-->Update module github.com/minio/minio-go/v7 to v7.0.98 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10875): <!--number 10875 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGNpdGF0aW9uLWpzL3BsdWdpbi1zb2Z0d2FyZS1mb3JtYXRzIHRvIHYwLjYuMiAoZm9yZ2Vqbyk=-->Update dependency @citation-js/plugin-software-formats to v0.6.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10832): <!--number 10832 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjE0LjAuMCBbc2tpcCBjaV0=-->chore(release-notes): Forgejo v14.0.0 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10865): <!--number 10865 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS41LjEgKGZvcmdlam8p-->Update dependency forgejo/release-notes-assistant to v1.5.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10896): <!--number 10896 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjEzLjAuNSBbc2tpcCBjaV0=-->chore(release-notes): Forgejo v13.0.5 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10892): <!--number 10892 --><!--line 0 --><!--description VXBkYXRlIENvZGVNaXJyb3IgKGZvcmdlam8p-->Update CodeMirror (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10673): <!--number 10673 --><!--line 0 --><!--description Y2hvcmU6IHVwZGF0ZSBnb2YzL3YzIHYzLjExLjE1-->chore: update gof3/v3 v3.11.15<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10682): <!--number 10682 --><!--line 0 --><!--description YWN0aW9ucyB2YXJpYWJsZSBhbmQgc2VjcmV0IG5hbWVzIHZhbGlkYXRpb24=-->actions variable and secret names validation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10790): <!--number 10790 --><!--line 0 --><!--description Y2hvcmU6IFRlYWNoIE1ha2VmaWxlIHRvIGhhbmRsZSBub2RlIHByZS1yZWxlYXNlIHZlcnNpb25z-->chore: Teach Makefile to handle node pre-release versions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10867): <!--number 10867 --><!--line 0 --><!--description Y2k6IHVzZSBybmEgYmluYXJ5IGluc3RlYWQgb2Ygc291cmNl-->ci: use rna binary instead of source<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10821): <!--number 10821 --><!--line 0 --><!--description Y29uZmlnOiBMb3dlciBkZWZhdWx0IGBbZGF0YWJhc2VdLk1BWF9PUEVOX0NPTk5TYA==-->config: Lower default `[database].MAX_OPEN_CONNS`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10759): <!--number 10759 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgYXNjaWluZW1hLXBsYXllciB0byB2My4xNC4wIChmb3JnZWpvKQ==-->Update dependency asciinema-player to v3.14.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10895): <!--number 10895 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjE0LjAuMSBbc2tpcCBjaV0=-->chore(release-notes): Forgejo v14.0.1 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10866): <!--number 10866 --><!--line 0 --><!--description W3NraXAgY2ldIGZpeChyZWxlYXNlKTogbW92ZSByZXZlcnRlZCB2MTQuMC4wIGZlYXR1cmUgbGluZSB0byBJbmNsdWRlZCBmb3IgY29tcGxldGVuZXNz-->[skip ci] fix(release): move reverted v14.0.0 feature line to Included for completeness<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10815): <!--number 10815 --><!--line 0 --><!--description bWFrZSBsYXN0Y29tbWl0IGF2YWlsYWJsZSBmb3Igbm9uLXNpZ25lZC1pbiB1c2Vycw==-->make lastcommit available for non-signed-in users<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10822): <!--number 10822 --><!--line 0 --><!--description VXBkYXRlIE5vZGUuanMgdG8gdjI0LjEzLjAgKGZvcmdlam8p-->Update Node.js to v24.13.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10761): <!--number 10761 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMCAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10728): <!--number 10728 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjExLjAuOSBbc2tpcCBjaV0=-->chore(release-notes): Forgejo v11.0.9 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10775): <!--number 10775 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZ2xvYmFscyB0byB2MTcgKGZvcmdlam8p-->Update dependency globals to v17 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10756): <!--number 10756 --><!--line 0 --><!--description YWRkIGZvcmVpZ24ga2V5cyB0byB0aGUgYGFjdGlvbl9ydW5uZXJfdG9rZW5gIHRhYmxl-->add foreign keys to the `action_runner_token` table<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9380): <!--number 9380 --><!--line 0 --><!--description c3dhZ2dlcjogQWRkIGhlYWRlciBhbm5vdGF0aW9ucyBmb3IgYWNjdXJhdGUgQVBJIGRvY3VtZW50YXRpb24=-->swagger: Add header annotations for accurate API documentation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10731): <!--number 10731 --><!--line 0 --><!--description Y2hvcmUocmVub3ZhdGUpOiB1c2UgYGZvcmdlam8tcmVsZWFzZXNgIGRhdGFzb3VyY2U=-->chore(renovate): use `forgejo-releases` datasource<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10700): <!--number 10700 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3l1aW4vZ29sZG1hcmsgdG8gdjEuNy4xNCAoZm9yZ2Vqbyk=-->Update module github.com/yuin/goldmark to v1.7.14 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10795): <!--number 10795 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNS4xIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.5.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10701): <!--number 10701 --><!--line 0 --><!--description VXBkYXRlIENvZGVNaXJyb3IgKGZvcmdlam8p-->Update CodeMirror (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10780): <!--number 10780 --><!--line 0 --><!--description Y2hvcmU6IGNvcnJlY3Qgc3BlbGxpbmcgZXJyb3IgaW4gY2xlYW51cC1jb21taXQtc3RhdHVzIENMSSBkb2Nz-->chore: correct spelling error in cleanup-commit-status CLI docs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10749): <!--number 10749 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS41LjAgKGZvcmdlam8p-->Update dependency forgejo/release-notes-assistant to v1.5.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10755): <!--number 10755 --><!--line 0 --><!--description ZmVhdChidWlsZCk6IHRlYWNoIGxpbnQtbG9jYWxlLXVzYWdlIGFib3V0IE9iamVjdFZlcmlmaWNhdGlvbi5SZWFzb24=-->feat(build): teach lint-locale-usage about ObjectVerification.Reason<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10738): <!--number 10738 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNS4wIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.5.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10762): <!--number 10762 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2FsZWN0aG9tYXMvY2hyb21hL3YyIHRvIHYyLjIyLjAgKGZvcmdlam8p-->Update module github.com/alecthomas/chroma/v2 to v2.22.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10726): <!--number 10726 --><!--line 0 --><!--description ZGlzYWJsZSBhY3Rpb25zIGVuZHBvaW50cyBvZiByZXBvc2l0b3J5IGlmIGFjdGlvbnMgYXJlIGRpc2FibGVk-->disable actions endpoints of repository if actions are disabled<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10716): <!--number 10716 --><!--line 0 --><!--description Y2hvcmU6IGFkZCBAMHhsbHgwIHRvIGZlZGVyYXRpb24gY29kZW93bmVycw==-->chore: add @0xllx0 to federation codeowners<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10737): <!--number 10737 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS40LjMgKGZvcmdlam8p-->Update dependency forgejo/release-notes-assistant to v1.4.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10740): <!--number 10740 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvc3lzIHRvIHYwLjQwLjAgKGZvcmdlam8p-->Update module golang.org/x/sys to v0.40.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10696): <!--number 10696 --><!--line 0 --><!--description cmV0YWluIEZvcmdlam8gQWN0aW9uJ3MgY29tbWl0X3N0YXR1cyBlbnRyaWVzIHdpdGggZGlzdGluY3QgZGVzY3JpcHRpb25z-->retain Forgejo Action's commit_status entries with distinct descriptions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10713): <!--number 10713 --><!--line 0 --><!--description cHJldmVudCBpbnRlcm1pdHRlbnQgdGVzdCBmYWlsdXJlcyBjYXVzZWQgYnkgdW5jYW5jZWxsYWJsZSB0YXNrcw==-->prevent intermittent test failures caused by uncancellable tasks<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10715): <!--number 10715 --><!--line 0 --><!--description Rml4IGVycm9yIG1lc3NhZ2VzIGluIHB1bGwuZ28=-->Fix error messages in pull.go<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10758): <!--number 10758 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGNvZGVtaXJyb3IvdmlldyB0byB2Ni4zOS45IChmb3JnZWpvKQ==-->Update dependency @codemirror/view to v6.39.9 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10730): <!--number 10730 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IEZvcmdlam8gdjEzLjAuNCBbc2tpcCBjaV0=-->chore(release-notes): Forgejo v13.0.4 [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10699): <!--number 10699 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQGxlemVyL2hpZ2hsaWdodCB0byB2MS4yLjMgKGZvcmdlam8p-->Update dependency @lezer/highlight to v1.2.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10707): <!--number 10707 --><!--line 0 --><!--description W3NraXAgY2ldIGNob3JlOiBVcGRhdGUgcHVsbCByZXF1ZXN0IHRlbXBsYXRlIHJlZ2FyZGluZyB0aGUgcmVsZWFzZSBub3Rlcw==-->[skip ci] chore: Update pull request template regarding the release notes<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10724): <!--number 10724 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWVucnkvZ28tZW5yeS92MiB0byB2Mi45LjMgKGZvcmdlam8p-->Update module github.com/go-enry/go-enry/v2 to v2.9.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10619): <!--number 10619 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjAuNyAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/setup-forgejo action to v3.0.7 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10709): <!--number 10709 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3l1aW4vZ29sZG1hcmsgdG8gdjEuNy4xNiAoZm9yZ2Vqbyk=-->Update module github.com/yuin/goldmark to v1.7.16 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10752): <!--number 10752 --><!--line 0 --><!--description Y2hvcmU6IHJ1biByZW5vdmF0ZSBvbiB2MTQgYnJhbmNoLCByZW1vdmUgdjEz-->chore: run renovate on v14 branch, remove v13<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10706): <!--number 10706 --><!--line 0 --><!--description Y2hvcmU6IGFkZCBmYW1mbyB0byBDT0RFT1dORVJTIGZvciBmZWRlcmF0aW9uIGNvZGU=-->chore: add famfo to CODEOWNERS for federation code<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10785): <!--number 10785 --><!--line 0 --><!--description TG9jayBmaWxlIG1haW50ZW5hbmNlIChmb3JnZWpvKQ==-->Lock file maintenance (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10658): <!--number 10658 --><!--line 0 --><!--description ZHluYW1pYyBBY3Rpb24gam9icyBjYW4gc3RhbGwgYnkgbWFya2luZyB0aGVtc2VsdmVzIGJsb2NrZWQ=-->dynamic Action jobs can stall by marking themselves blocked<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10665): <!--number 10665 --><!--line 0 --><!--description c2ltdWx0YW5lb3VzbHkgZXhwZXJpZW5jaW5nIGEgUHJlRXhlY3V0aW9uRXJyb3IgYW5kIHVuYmxvY2tpbmcgYSBkaWZmZXJlbnQgam9iIGNhdXNlcyBlcnJvciBibG9ja2luZyBqb2IgZW1pdHRlciBxdWV1ZQ==-->simultaneously experiencing a PreExecutionError and unblocking a different job causes error blocking job emitter queue<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10632): <!--number 10632 --><!--line 0 --><!--description YnVpbGQtcmVsZWFzZSB3b3JrZmxvdyBzdG9wcyBpdHMgb3duIGVuZC10by1lbmQgY2hlY2tzIHdoZW4gcnVuIGNvbmN1cnJlbnRseQ==-->build-release workflow stops its own end-to-end checks when run concurrently<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10666): <!--number 10666 --><!--line 0 --><!--description cmUtcnVubmluZyBhbiBleHBhbmRlZCByZXVzYWJsZSB3b3JrZmxvdyBjYXVzZXMgZHVwbGljYXRlICJhdHRlbXB0IDEiIGpvYg==-->re-running an expanded reusable workflow causes duplicate "attempt 1" job<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10588): <!--number 10588 --><!--line 0 --><!--description TGlzdFRyYWNrZWRUaW1lcyBBUEkgaGFzIG5vIGRlZmluZWQgcmVjb3JkIG9yZGVyaW5n-->ListTrackedTimes API has no defined record ordering<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10661): <!--number 10661 --><!--line 0 --><!--description aTE4bihuZXh0KTogY29udmVydCBpbmRlbnRpb24gc3R5bGUgdG8gdGFiczogZW4sIGVkaXRvcmNvbmZpZw==-->i18n(next): convert indention style to tabs: en, editorconfig<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10591): <!--number 10591 --><!--line 0 --><!--description dGVzdDogcmVtb3ZlIGRpYWdub3N0aWMgb3V0cHV0IGluICdjb3B5IHRvIGV4cGVyaW1lbnRhbCc=-->test: remove diagnostic output in 'copy to experimental'<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10623): <!--number 10623 --><!--line 0 --><!--description TG9jayBmaWxlIG1haW50ZW5hbmNlIChmb3JnZWpvKQ==-->Lock file maintenance (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10579): <!--number 10579 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLW9wZW5hcGkvc3BlYyB0byB2MC4yMi4zIChmb3JnZWpvKQ==-->Update module github.com/go-openapi/spec to v0.22.3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10668): <!--number 10668 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21hdHRuL2dvLXNxbGl0ZTMgdG8gdjEuMTQuMzMgKGZvcmdlam8p-->Update module github.com/mattn/go-sqlite3 to v1.14.33 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10610): <!--number 10610 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vYWN0aW9ucy1wcm90byB0byB2MC42LjAgKGZvcmdlam8p-->Update module code.forgejo.org/forgejo/actions-proto to v0.6.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10596): <!--number 10596 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2phY2tjL3BneC92NSB0byB2NS44LjAgKGZvcmdlam8p-->Update module github.com/jackc/pgx/v5 to v5.8.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10655): <!--number 10655 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuNC4wIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.4.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10583): <!--number 10583 --><!--line 0 --><!--description ZXhwZXJpbWVudGFsIHJlbGVhc2VzIGFyZSBub3QgYmVpbmcgY29waWVkIHRvIGZvcmdlam8tZXhwZXJpbWVudGFs-->experimental releases are not being copied to forgejo-experimental<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10678): <!--number 10678 --><!--line 0 --><!--description ZG9uJ3QgZHVwbGljYXRlIGNvbW1pdCBzdGF0dXMgcmVjb3JkcyBvbiB3b3JrZmxvd3Mgd2l0aCBlbXB0eSBuYW1l-->don't duplicate commit status records on workflows with empty name<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10638): <!--number 10638 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IHRlYWNoIHJlbGVhc2Utbm90ZXMtYXNzaXN0YW50IHRoYXQgdjExLjAgaXMgTFRT-->chore(release-notes): teach release-notes-assistant that v11.0 is LTS<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10587): <!--number 10587 --><!--line 0 --><!--description dGVzdDogZml4IGludGVybWl0dGVudCBQb3N0Z3JlU1FMIGZhaWx1cmUgaW4gVGVzdEFkbWluVmlld1JlcG9z-->test: fix intermittent PostgreSQL failure in TestAdminViewRepos<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10581): <!--number 10581 --><!--line 0 --><!--description Y2hvcmUodWkpOiByZW1vdmUgb2Jzb2xldGUgY29kZSBmcm9tIGJ1dHRvbi1sZWdhY3kuY3Nz-->chore(ui): remove obsolete code from button-legacy.css<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10683): <!--number 10683 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS40LjIgKGZvcmdlam8p-->Update dependency forgejo/release-notes-assistant to v1.4.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10662): <!--number 10662 --><!--line 0 --><!--description Y2hvcmUoY2xlYW51cCk6IG1vdmUgYWxsIHRlc3QgYmxhbmsgaW1wb3J0cyBpbiBhIHNpbmdsZSBwYWNrYWdl-->chore(cleanup): move all test blank imports in a single package<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10692): <!--number 10692 --><!--line 0 --><!--description Y2hvcmU6IGRvd25sb2FkIGdpdC1tYW4gb3ZlciBUTFM=-->chore: download git-man over TLS<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10586): <!--number 10586 --><!--line 0 --><!--description dXNlIFJVTk5FUl9URU1QIGluIGJ1aWxkLXJlbGVhc2UueW1s-->use RUNNER_TEMP in build-release.yml<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10608): <!--number 10608 --><!--line 0 --><!--description TG9jayBmaWxlIG1haW50ZW5hbmNlIChmb3JnZWpvKQ==-->Lock file maintenance (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10667): <!--number 10667 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZXNidWlsZC1sb2FkZXIgdG8gdjQuNC4yIChmb3JnZWpvKQ==-->Update dependency esbuild-loader to v4.4.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10626): <!--number 10626 --><!--line 0 --><!--description aW1wcm92ZSBEaXNjb3JkIHdlYmhvb2sgbWVzc2FnZSBmb3JtYXR0aW5n-->improve Discord webhook message formatting<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10656): <!--number 10656 --><!--line 0 --><!--description aW4tcHJvZ3Jlc3Mgam9iIGljb24gZG9lc24ndCByb3RhdGUgb24gcmVwbydzIGFjdGlvbiBsaXN0-->in-progress job icon doesn't rotate on repo's action list<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10535): <!--number 10535 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuMy4wIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.3.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10492): <!--number 10492 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgd2VicGFjayB0byB2NS4xMDQuMCAoZm9yZ2Vqbyk=-->Update dependency webpack to v5.104.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10479): <!--number 10479 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2FsZWN0aG9tYXMvY2hyb21hL3YyIHRvIHYyLjIxLjEgKGZvcmdlam8p-->Update module github.com/alecthomas/chroma/v2 to v2.21.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10482): <!--number 10482 --><!--line 0 --><!--description Y2hvcmU6IDE0LjAgaXMgbm93IHN0YWJsZQ==-->chore: 14.0 is now stable<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10549): <!--number 10549 --><!--line 0 --><!--description Y2hvcmUoc2VhcmNoKTogbWlub3IgY29kZSBjbGVhbnVw-->chore(search): minor code cleanup<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10505): <!--number 10505 --><!--line 0 --><!--description VXBkYXRlIGdvLW9wZW5hcGkgcGFja2FnZXMgKGZvcmdlam8p-->Update go-openapi packages (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10575): <!--number 10575 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuMy4xIChmb3JnZWpvKQ==-->Update module code.forgejo.org/forgejo/runner/v12 to v12.3.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10545): <!--number 10545 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZXNidWlsZC1sb2FkZXIgdG8gdjQuNC4xIChmb3JnZWpvKQ==-->Update dependency esbuild-loader to v4.4.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10491): <!--number 10491 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgYXNjaWluZW1hLXBsYXllciB0byB2My4xMy41IChmb3JnZWpvKQ==-->Update dependency asciinema-player to v3.13.5 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10450): <!--number 10450 --><!--line 0 --><!--description Y2hvcmU6IHJldmlzZSBydW5uZXIgUkVTVCBBUEkgZW5kcG9pbnRz-->chore: revise runner REST API endpoints<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10538): <!--number 10538 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgd2VicGFjayB0byB2NS4xMDQuMSAoZm9yZ2Vqbyk=-->Update dependency webpack to v5.104.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10550): <!--number 10550 --><!--line 0 --><!--description cG9ydChnaXRlYSk6IEZpeCBwYXNzd29yZCBsZWFrIGluIGxvZyBtZXNzYWdlcyAoZ28tZ2l0ZWEvZ2l0ZWEhMzU1ODQp-->port(gitea): Fix password leak in log messages (go-gitea/gitea!35584)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10537): <!--number 10537 --><!--line 0 --><!--description cmVmYWN0b3I6IHNwbGl0IGBBY3Rpb25Kb2JTdGVwTGlzdGAgb3V0IG9mIGBSZXBvQWN0aW9uVmlld2A=-->refactor: split `ActionJobStepList` out of `RepoActionView`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10539): <!--number 10539 --><!--line 0 --><!--description Y2hvcmUodGVzdCk6IHNlcGFyYXRlIGFuZCBtb3ZlIGFyb3VuZCBpMThuIHRlc3Rpbmc=-->chore(test): separate and move around i18n testing<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10551): <!--number 10551 --><!--line 0 --><!--description Y2hvcmU6IGRvY3VtZW50LCB0ZXN0IHBhZ2luYXRpb24gb2YgYC9ydW5uZXJzYCBBUEkgZW5kcG9pbnQ=-->chore: document, test pagination of `/runners` API endpoint<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10518): <!--number 10518 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2NoZWNrb3V0IGFjdGlvbiB0byB2NiAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/checkout action to v6 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10490): <!--number 10490 --><!--line 0 --><!--description dGVzdDogaW5jcmVhc2UgdGVzdCBjb3ZlcmFnZSBvZiBydW5uZXIgbWFuYWdlbWVudA==-->test: increase test coverage of runner management<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/8643): <!--number 8643 --><!--line 0 --><!--description bGlua2luZyBzaGExIGhhc2hlcyB3aXRoIHRyYWlsaW5nIHB1bmN0dWF0aW9u-->linking sha1 hashes with trailing punctuation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10519): <!--number 10519 --><!--line 0 --><!--description TG9jayBmaWxlIG1haW50ZW5hbmNlIChmb3JnZWpvKQ==-->Lock file maintenance (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10517): <!--number 10517 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2NhY2hlIGFjdGlvbiB0byB2NSAoZm9yZ2Vqbyk=-->Update https://data.forgejo.org/actions/cache action to v5 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11409): <!--number 11409 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIERvY2tlciB0YWcgdG8gdjQzLjMxLjEgKGZvcmdlam8p-->Update renovate Docker tag to v43.31.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11321): <!--number 11321 --><!--line 0 --><!--description VXBkYXRlIHgvdG9vbHMgdG8gdjAuNDIuMCAoZm9yZ2Vqbyk=-->Update x/tools to v0.42.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11322): <!--number 11322 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZXNsaW50LXBsdWdpbi11bmljb3JuIHRvIHY2MyAoZm9yZ2Vqbyk=-->Update dependency eslint-plugin-unicorn to v63 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11302): <!--number 11302 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0My4xNS4xIChmb3JnZWpvKQ==-->Update renovate to v43.15.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11265): <!--number 11265 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgdnVlIHRvIHYzLjUuMjggKGZvcmdlam8p-->Update dependency vue to v3.5.28 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11213): <!--number 11213 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgdml0ZS1zdHJpbmctcGx1Z2luIHRvIHYyIChmb3JnZWpvKQ==-->Update dependency vite-string-plugin to v2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11207): <!--number 11207 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZXNsaW50LXBsdWdpbi1yZWdleHAgdG8gdjMgKGZvcmdlam8p-->Update dependency eslint-plugin-regexp to v3 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11202): <!--number 11202 --><!--line 0 --><!--description VXBkYXRlIGxpbnRlcnMgKGZvcmdlam8p-->Update linters (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11203): <!--number 11203 --><!--line 0 --><!--description VXBkYXRlIHgvdG9vbHMgdG8gdjAuNDEuMCAoZm9yZ2Vqbyk=-->Update x/tools to v0.41.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11129): <!--number 11129 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi45NS4yIChmb3JnZWpvKQ==-->Update renovate to v42.95.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11162): <!--number 11162 --><!--line 0 --><!--description TW9yZSBqd3R4IHJlZmFjdG9yaW5nOiBHZXRTaWduaW5nTWV0aG9kKCksIGZpeCBvcGVuIG1vZGUsIHNwbGl0IGxvYWRPckNyZWF0ZUFzeW1tZXRyaWNLZXkoKQ==-->More jwtx refactoring: GetSigningMethod(), fix open mode, split loadOrCreateAsymmetricKey()<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11118): <!--number 11118 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQHN0eWxpc3RpYy9zdHlsZWxpbnQtcGx1Z2luIHRvIHY0LjAuMSAoZm9yZ2Vqbyk=-->Update dependency @stylistic/stylelint-plugin to v4.0.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11119): <!--number 11119 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQHZpdGVzdC9lc2xpbnQtcGx1Z2luIHRvIHYxLjYuNiAoZm9yZ2Vqbyk=-->Update dependency @vitest/eslint-plugin to v1.6.6 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11120): <!--number 11120 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2VkaXRvcmNvbmZpZy1jaGVja2VyL2VkaXRvcmNvbmZpZy1jaGVja2VyL3YzL2NtZC9lZGl0b3Jjb25maWctY2hlY2tlciB0byB2My42LjEgKGZvcmdlam8p-->Update module github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker to v3.6.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10659): <!--number 10659 --><!--line 0 --><!--description aTE4bihuZXh0KTogY29udmVydCBpbmRlbnRpb24gdG8gdGFicw==-->i18n(next): convert indention to tabs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11044): <!--number 11044 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi45Mi4xMCAoZm9yZ2Vqbyk=-->Update renovate to v42.92.10 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10998): <!--number 10998 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgdnVlIHRvIHYzLjUuMjcgKGZvcmdlam8p-->Update dependency vue to v3.5.27 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10918): <!--number 10918 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi44NC4yIChmb3JnZWpvKQ==-->Update renovate to v42.84.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10912): <!--number 10912 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3VyZmF2ZS9jbGkvdjMgdG8gdjMuNi4yIChmb3JnZWpvKQ==-->Update module github.com/urfave/cli/v3 to v3.6.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10784): <!--number 10784 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi43OC4yIChmb3JnZWpvKQ==-->Update renovate to v42.78.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10698): <!--number 10698 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi43MS4wIChmb3JnZWpvKQ==-->Update renovate to v42.71.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10618): <!--number 10618 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi42Ni4xMSAoZm9yZ2Vqbyk=-->Update renovate to v42.66.11 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10607): <!--number 10607 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQHZpdGVzdC9lc2xpbnQtcGx1Z2luIHRvIHYxLjYuNCAoZm9yZ2Vqbyk=-->Update dependency @vitest/eslint-plugin to v1.6.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10605): <!--number 10605 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi42Ni45IChmb3JnZWpvKQ==-->Update renovate to v42.66.9 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10606): <!--number 10606 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgdHlwZXNjcmlwdC1lc2xpbnQgdG8gdjguNTAuMSAoZm9yZ2Vqbyk=-->Update dependency typescript-eslint to v8.50.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10547): <!--number 10547 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgc3R5bGVsaW50LXZhbHVlLW5vLXVua25vd24tY3VzdG9tLXByb3BlcnRpZXMgdG8gdjYuMS4wIChmb3JnZWpvKQ==-->Update dependency stylelint-value-no-unknown-custom-properties to v6.1.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10546): <!--number 10546 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQHZpdGVzdC9lc2xpbnQtcGx1Z2luIHRvIHYxLjUuNCAoZm9yZ2Vqbyk=-->Update dependency @vitest/eslint-plugin to v1.5.4 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10504): <!--number 10504 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgdnVlIHRvIHYzLjUuMjYgKGZvcmdlam8p-->Update dependency vue to v3.5.26 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10514): <!--number 10514 --><!--line 0 --><!--description VXBkYXRlIHJlbm92YXRlIHRvIHY0Mi42NC4xIChmb3JnZWpvKQ==-->Update renovate to v42.64.1 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10507): <!--number 10507 --><!--line 0 --><!--description VXBkYXRlIHZpdGVzdCBtb25vcmVwbyB0byB2NC4wLjE2IChmb3JnZWpvKQ==-->Update vitest monorepo to v4.0.16 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10511): <!--number 10511 --><!--line 0 --><!--description VXBkYXRlIHgvdG9vbHMgdG8gdjAuNDAuMCAoZm9yZ2Vqbyk=-->Update x/tools to v0.40.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10510): <!--number 10510 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL1B1ZXJraXRvQmlvL2dvcXVlcnkgdG8gdjEuMTEuMCAoZm9yZ2Vqbyk=-->Update module github.com/PuerkitoBio/goquery to v1.11.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10509): <!--number 10509 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZ2NpL2dvbGFuZ2NpLWxpbnQvdjIvY21kL2dvbGFuZ2NpLWxpbnQgdG8gdjIuNy4yIChmb3JnZWpvKQ==-->Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.7.2 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10508): <!--number 10508 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWFya2Rvd25saW50LWNsaSB0byB2MC40Ny4wIChmb3JnZWpvKQ==-->Update dependency markdownlint-cli to v0.47.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10506): <!--number 10506 --><!--line 0 --><!--description VXBkYXRlIGxpbnRlcnMgKGZvcmdlam8p-->Update linters (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10503): <!--number 10503 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgQHZpdGVqcy9wbHVnaW4tdnVlIHRvIHY2LjAuMyAoZm9yZ2Vqbyk=-->Update dependency @vitejs/plugin-vue to v6.0.3 (forgejo)<!--description-->
+- Already announced in the release notes of an older stable release
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11513): <!--number 11513 --><!--line 0 --><!--description LSBmaXg6IFBLQ0UgY2hhbGxlbmdlcyB0byBGb3JnZWpvJ3MgT0F1dGggaWRlbnRpdHkgcHJvdmlkZXIgd2VyZSBub3QgdmFsaWRhdGVkIHdoZW4gdXNpbmcgdGhlIGBTMjU2YCBhbGdvcml0aG0=-->- fix: PKCE challenges to Forgejo's OAuth identity provider were not validated when using the `S256` algorithm<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11513): <!--number 11513 --><!--line 1 --><!--description LSBmaXg6IEZvcmdlam8gc3VwcG9ydHMgdXNpbmcgYW4gT0F1dGggQmVhcmVyIHRva2VuIHdpdGggSFRUUCBiYXNpYyBhdXRoZW50aWNhdGlvbiwgcmF0aGVyIHRoYW4gQmVhcmVyIHRva2VuIGF1dGhlbnRpY2F0aW9uLCBidXQgZGlkIG5vdCBwcm9wZXJseSBhcHBseSB0aGUgbGltaXRlZCBzY29wZXMgb2YgdGhlIE9BdXRoIGdyYW50-->- fix: Forgejo supports using an OAuth Bearer token with HTTP basic authentication, rather than Bearer token authentication, but did not properly apply the limited scopes of the OAuth grant<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11513): <!--number 11513 --><!--line 2 --><!--description LSBmaXg6IG1pc3NpbmcgcGVybWlzc2lvbiBjaGVja3MgaW4gYXR0YWNobWVudC1yZWxhdGVkIHdlYiBlbmRwb2ludHMgYWxsb3dlZCBtb2RpZnlpbmcgYXR0YWNobWVudHMgdGhhdCBhIHVzZXIgZGlkIG5vdCBvd24=-->- fix: missing permission checks in attachment-related web endpoints allowed modifying attachments that a user did not own<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11513): <!--number 11513 --><!--line 3 --><!--description LSBmaXg6IGVtYWlsIG5vdGlmaWNhdGlvbnMgZm9yIG5ldyByZWxlYXNlcyBjb3VsZCBiZSBzZW50IHRvIHVzZXJzIHRoYXQgbm8gbG9uZ2VyIGFjY2VzcyB0byB0aGUgcmVwb3NpdG9yeSwgb3IgdG8gaW5hY3RpdmUgdXNlcnM=-->- fix: email notifications for new releases could be sent to users that no longer access to the repository, or to inactive users<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11513): <!--number 11513 --><!--line 4 --><!--description LSBmaXg6IG1pc3NpbmcgcGVybWlzc2lvbiBjaGVja3MgaW4gdXNlci9vcmctb3duZWQgcHJvamVjdHMgd291bGQgYWxsb3cgbW9kaWZpY2F0aW9ucyBvZiB0aGUgb3Blbi9jbG9zZWQgc3RhdGUgdG8gYmUgbWFkZSB0byBwcm9qZWN0cyB2aWEgaW5zZWN1cmUgZGlyZWN0IG9iamVjdCByZWZlcmVuY2Vz-->- fix: missing permission checks in user/org-owned projects would allow modifications of the open/closed state to be made to projects via insecure direct object references<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11513): <!--number 11513 --><!--line 5 --><!--description LSBmaXg6IG1pc3NpbmcgcGVybWlzc2lvbiBjaGVja3MgaW4gYSB3ZWIgZW5kcG9pbnQgYWxsb3dlZCBjYW5jZWxsYXRpb24gb2YgdGhlIGF1dG9tZXJnZSBvZiBhIFBS-->- fix: missing permission checks in a web endpoint allowed cancellation of the automerge of a PR<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11513): <!--number 11513 --><!--line 6 --><!--description LSBmaXg6IHByZXZlbnQgYWRkaXRpb25hbCBwYXRoLXRyYXZlcnNhbHMgaW4gcG9zdC1sb2dpbiByZWRpcmVjdCBwYXJhbWV0ZXJzIHRoYXQgYWxsb3dlZCBmb3IgYXJiaXRyYXJ5IHJlZGlyZWN0cw==-->- fix: prevent additional path-traversals in post-login redirect parameters that allowed for arbitrary redirects<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10719): <!--number 10719 --><!--line 0 --><!--description aGlkZSB1c2VyIHByb2ZpbGUgYW5vbnltb3VzIG9wdGlvbnMgb24gcHVibGljIHJlcG8gQVBJcw==-->hide user profile anonymous options on public repo APIs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10719): <!--number 10719 --><!--line 1 --><!--description aW5jb3JyZWN0IHdoaXRlc3BhY2UgaGFuZGxpbmcgb24gcHJlJnBvc3QgcmVjZWl2ZSBob29rcw==-->incorrect whitespace handling on pre&post receive hooks<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10719): <!--number 10719 --><!--line 2 --><!--description cmVkdWNlIG1lbW9yeSB1c2FnZSB3aGlsZSBwcm9jZXNzaW5nIGxhcmdlIGF0dGFjaG1lbnQgdXBsb2Fkcw==-->reduce memory usage while processing large attachment uploads<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10719): <!--number 10719 --><!--line 3 --><!--description bG9hZCByZXZpZXdlciBmb3IgcHVsbCByZXZpZXcgZGlzbWlzcyBhY3Rpb24gbm90aWZpZXI=-->load reviewer for pull review dismiss action notifier<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10719): <!--number 10719 --><!--line 4 --><!--description dXNlIGNvcnJlY3QgR1BHIGtleSBmb3IgZXhwb3J0-->use correct GPG key for export<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11393): <!--number 11393 --><!--line 0 --><!--description ZXh0ZW5kIGJhc2ljIGF1dGggdG8gL3YyLCBhbHdheXMgaW5jbHVkZSBXV1ctQXV0aGVudGljYXRlIGhlYWRlcg==-->extend basic auth to /v2, always include WWW-Authenticate header<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11282): <!--number 11282 --><!--line 0 --><!--description cHJldmVudCBwYW5pYyB3aGVuIGltcG9ydGluZyBpc3N1ZXMgZnJvbSBHaXRMYWI=-->prevent panic when importing issues from GitLab<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11282): <!--number 11282 --><!--line 1 --><!--description cHJldmVudCBwYW5pYyB3aGVuIGltcG9ydGluZyByZWxlYXNlcyB3aXRoIG1vcmUgdGhhbiA0IHJlbGVhc2UgYXNzZXRzIGZyb20gR2l0TGFi-->prevent panic when importing releases with more than 4 release assets from GitLab<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11282): <!--number 11282 --><!--line 2 --><!--description Y29ycmVjdCByZS1tYXBwaW5nIG9mIG1lcmdlLXJlcXVlc3QgbnVtYmVycyBtZW50aW9uZWQgaW4gR2l0TGFiIGNvbW1lbnRz-->correct re-mapping of merge-request numbers mentioned in GitLab comments<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11642): <!--number 11642 --><!--line 0 --><!--description ZG9uJ3QgdHJpcCBkZWxldGluZyBhdHRhY2htZW50IHdpdGggbWlzc2luZyBwZXJtaXNzaW9uIGVycm9y-->don't trip deleting attachment with missing permission error<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11145): <!--number 11145 --><!--line 0 --><!--description ZG9uJ3QgYWJhbmRvbiBBY3Rpb24gam9icyB3YWl0aW5nIGZvciBhcHByb3ZhbA==-->don't abandon Action jobs waiting for approval<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10812): <!--number 10812 --><!--line 0 --><!--description ZHJvcCBzcWxpdGUgc2hhcmVkIGNhY2hl-->drop sqlite shared cache<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11134): <!--number 11134 --><!--line 0 --><!--description Y2FuY2VsIHJ1bnMgcGVuZGluZyBhcHByb3ZhbCB3aGVuIGEgUFIgaXMgY2xvc2Vk-->cancel runs pending approval when a PR is closed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10568): <!--number 10568 --><!--line 0 --><!--description bWlncmF0aW9uOiB1cGRhdGUgZXhpc3RpbmcgZm9yZWlnbiBrZXkgbWlncmF0aW9ucyB0byBhdXRvbWF0aWNhbGx5IGZpeCBpbmNvbnNpc3RlbmNpZXM=-->migration: update existing foreign key migrations to automatically fix inconsistencies<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11623): <!--number 11623 --><!--line 0 --><!--description Y29tbWVudCBhdHRhY2htZW50IEFQSSBpcyBtb3JlIHJlc3RyaWN0aXZlIHRoYW4gdGhlIHdlYiBVSQ==-->comment attachment API is more restrictive than the web UI<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11614): <!--number 11614 --><!--line 0 --><!--description TWFrZSBvdmVyZmxvdy1tZW51IFdlYiBDb21wb25lbnQgc2Nyb2xsIC8gb3ZlcmZsb3cgd2l0aCBKUyBvZmY=-->Make overflow-menu Web Component scroll / overflow with JS off<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11547): <!--number 11547 --><!--line 0 --><!--description bW9kYWxzIG9uIHNtYWxsIHZpZXdwb3J0IGhlaWdodA==-->modals on small viewport height<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11381): <!--number 11381 --><!--line 0 --><!--description Zml4KHVpKTogaGFyZGNvZGUgc29ydCBvcHRpb25zIGluIHNlYXJjaCBzeW50YXggaGludCwgaW1wcm92ZSBsb29r-->fix(ui): hardcode sort options in search syntax hint, improve look<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11287): <!--number 11287 --><!--line 0 --><!--description Zml4KHVpKTogcHJldmVudCBsYWJlbCBvdmVyZmxvdyBpbiBQUiBDSSBjaGVja3Mgb24gbW9iaWxl-->fix(ui): prevent label overflow in PR CI checks on mobile<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11341): <!--number 11341 --><!--line 0 --><!--description Zml4KHVpL21kZSk6IGlucHV0cyBpbiB0YWJsZS9saW5rIGluc2VydGlvbiBtb2RhbHM=-->fix(ui/mde): inputs in table/link insertion modals<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11179): <!--number 11179 --><!--line 0 --><!--description aW1wcm92ZSBTUUxpdGUgImRhdGFiYXNlIGlzIGxvY2tlZCIgZXJyb3JzIGJ5IGluY3JlYXNpbmcgZGVmYXVsdCBgU1FMSVRFX1RJTUVPVVRg-->improve SQLite "database is locked" errors by increasing default `SQLITE_TIMEOUT`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11246): <!--number 11246 --><!--line 0 --><!--description Y2xlYW51cCBvZiBtdWx0aS1wbGF0Zm9ybSBjb250YWluZXIgaW1hZ2Vz-->cleanup of multi-platform container images<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10925): <!--number 10925 --><!--line 0 --><!--description Zml4KGFwaSk6IGRlZmF1bHQgbmV3IHJlbGVhc2UgJ3RpdGxlJyBmaWVsZCB0byBsYWJlbCBuYW1lLCBpZiBub3QgcHJvdmlkZWQ=-->fix(api): default new release 'title' field to label name, if not provided<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10969): <!--number 10969 --><!--line 0 --><!--description Zml4KHVpKTogdGlwcHkgbWVudSBzdHlsZXMgdG9vIGJyb2FkLCBhZmZlY3Rpbmcgc3dpdGNoIGluIFBSIHJldmlldw==-->fix(ui): tippy menu styles too broad, affecting switch in PR review<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10945): <!--number 10945 --><!--line 0 --><!--description cmVtb3ZlIGluZmluaXRlIGxvb3AgaW4gVXBkYXRlUnVuSm9iV2l0aG91dE5vdGlmaWNhdGlvbiB3aGVuIHJ1biBpbiB0cmFuc2FjdGlvbg==-->remove infinite loop in UpdateRunJobWithoutNotification when run in transaction<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11073): <!--number 11073 --><!--line 0 --><!--description YWxsb3cgdGVzdCBkZWxpdmVyeSBmb3Igd2ViaG9va3Mgbm90IGVuYWJsZWQgZm9yIHB1c2ggZXZlbnRz-->allow test delivery for webhooks not enabled for push events<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10948): <!--number 10948 --><!--line 0 --><!--description ZG9uJ3QgY2xvYmJlciBhdXRob3JpemVkX2tleXMgZmlsZSBkdXJpbmcgaW5zdGFsbGF0aW9u-->don't clobber authorized_keys file during installation<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10939): <!--number 10939 --><!--line 0 --><!--description Zml4KHVpKTogaW1wcm92ZSBmb3JjZS1wdXNoIGxheW91dCBhbGlnbm1lbnQ=-->fix(ui): improve force-push layout alignment<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10964): <!--number 10964 --><!--line 0 --><!--description Zml4KHVpKTogYWRkIG1pc3NpbmcgdHJhbnNsYXRpb24gZm9yIGNvZGUgc2VhcmNoIHdoZW4ga2V5d29yZCBpcyBlbXB0eSBzdHJpbmc=-->fix(ui): add missing translation for code search when keyword is empty string<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10888): <!--number 10888 --><!--line 0 --><!--description dXNlIEFMVEVSIFRBQkxFIGluIFNRTGl0ZSBEcm9wVGFibGVDb2x1bW5zKCksIGFsbG93aW5nIHVuZXhwZWN0ZWQgZGF0YWJhc2Ugc291cmNlcyB0byB3b3JrIGJldHRlciBpbiBtaWdyYXRpb25z-->use ALTER TABLE in SQLite DropTableColumns(), allowing unexpected database sources to work better in migrations<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10899): <!--number 10899 --><!--line 0 --><!--description ZG9uJ3QgcmV0dXJuIEFkZGl0aW9uYWxUYXNrcyBmcm9tIEZldGNoVGFzayBpZiB0aGVyZSBpcyBubyBUYXNr-->don't return AdditionalTasks from FetchTask if there is no Task<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10914): <!--number 10914 --><!--line 0 --><!--description c3RyaXAgbmV3bGluZXMgb24gb2cgaW1hZ2UgcmVuZGVyaW5n-->strip newlines on og image rendering<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11164): <!--number 11164 --><!--line 0 --><!--description d2hlbiBleHBhbmRpbmcgYSBkeW5hbWljIG1hdHJpeCwgb3JpZ2luYWwgJ25lZWRzJyBhY2Nlc3Mgd2FzIGxvc3Q=-->when expanding a dynamic matrix, original 'needs' access was lost<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10933): <!--number 10933 --><!--line 0 --><!--description dXNlIGFuIGFic29sdXRlIFVSTCBmb3IgY29tcGFyZSBsaW5rcyBpbiBhdG9tIGZlZWQ=-->use an absolute URL for compare links in atom feed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11063): <!--number 11063 --><!--line 0 --><!--description ZW1wdHkgZHluYW1pYyBtYXRyaXggY2FuIGxlYXZlIGFjdGlvbiBydW4gaGFuZ2luZyBpbmNvbXBsZXRl-->empty dynamic matrix can leave action run hanging incomplete<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10882): <!--number 10882 --><!--line 0 --><!--description Rml4IG5vdCBkZWNyZWFzaW5nIHdhdGNoIGNvdW50IHdoZW4gYmxvY2tpbmcgdXNlcg==-->Fix not decreasing watch count when blocking user<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10827): <!--number 10827 --><!--line 0 --><!--description cHJvcGVyIHN0eWxpbmcgZm9yIGdsb2JhbCB0aW1lIHRyYWNrZXIgcG9wdXA=-->proper styling for global time tracker popup<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10814): <!--number 10814 --><!--line 0 --><!--description Zml4KHVpKTogc2hvdyBzd2l0Y2ggZGVmYXVsdCBicmFuY2ggYnV0dG9uIGluIGJyYW5jaCBsaXN0IG9ubHkgZm9yIHJlcG8gYWRtaW5z-->fix(ui): show switch default branch button in branch list only for repo admins<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10863): <!--number 10863 --><!--line 0 --><!--description bWFrZSBjb25jdXJyZW5jeSBncm91cCBqb2IgY2FuY2VsbGF0aW9uIGVmZmVjdCBydW5zIHRoYXQgYXJlIGZhaWxlZA==-->make concurrency group job cancellation effect runs that are failed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10851): <!--number 10851 --><!--line 0 --><!--description dXNlIGBzdHJpY3Qtb3JpZ2luYCBhcyByZWZlcnJlciBwb2xpY3k=-->use `strict-origin` as referrer policy<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10648): <!--number 10648 --><!--line 0 --><!--description Zml4KHVpKTogYWN0aW9ucyBsaXN0IGxheW91dCBicmVha2FnZSB3aXRoIGxvbmcgY29udGVudA==-->fix(ui): actions list layout breakage with long content<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10686): <!--number 10686 --><!--line 0 --><!--description YWRkIGBmb3JnZWpvIGRvY3RvciBjbGVhbnVwLWNvbW1pdC1zdGF0dXNgIGNvbW1hbmQgdG8gcmVjb3ZlciBmcm9tICMxMDY3MQ==-->add `forgejo doctor cleanup-commit-status` command to recover from #10671<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10747): <!--number 10747 --><!--line 0 --><!--description Y29ycmVjdGx5IGNvbXB1dGUgcmVxdWlyZWQgY29tbWl0IHN0YXR1cw==-->correctly compute required commit status<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10744): <!--number 10744 --><!--line 0 --><!--description Zml4IDUwMCBlcnJvciBvbiBsYXJnZSAuZ2l0bW9kdWxlcw==-->fix 500 error on large .gitmodules<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10484): <!--number 10484 --><!--line 0 --><!--description ZGlzcGxheSBvcnBoYW4gYnJhbmNoZXMgc2VwYXJhdGVseSBpbiBjb21taXQgZ3JhcGg=-->display orphan branches separately in commit graph<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10652): <!--number 10652 --><!--line 0 --><!--description Zml4KHVpKTogcHVsbCByZXF1ZXN0IG1lcmdlIG1lbnUgaXRlbSBjbGlwcGluZyB0aGUgYXV0byBtZXJnZSB0aXA=-->fix(ui): pull request merge menu item clipping the auto merge tip<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10594): <!--number 10594 --><!--line 0 --><!--description YWxsb3cgQWN0aW9ucyB0cnVzdCBtYW5hZ2VtZW50IG9uIGNvbmZsaWN0ZWQgUFJz-->allow Actions trust management on conflicted PRs<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10572): <!--number 10572 --><!--line 0 --><!--description Zml4KHVpKTogcHJvY2VzcyBkeW5hbWljYWxseSBhZGRlZCBjb250ZW50IHZpYSBodG14-->fix(ui): process dynamically added content via htmx<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10556): <!--number 10556 --><!--line 0 --><!--description Zml4KHVpKTogZG9uJ3Qgc3RyZXRjaCBhY3Rpdml0eSB0b3AgYXV0aG9yIGltYWdl-->fix(ui): don't stretch activity top author image<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10486): <!--number 10486 --><!--line 0 --><!--description aWdub3JlIHByaXZhdGUgLnByb2ZpbGUgcmVwbyBvbiB1c2VyIHByb2ZpbGUgcGFnZQ==-->ignore private .profile repo on user profile page<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10521): <!--number 10521 --><!--line 0 --><!--description Zml4KHVpKTogYWRkIG1pc3Npbmcgc3BhY2UgYmVmb3JlICdDb21taXQnIGJhY2s=-->fix(ui): add missing space before 'Commit' back<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10520): <!--number 10520 --><!--line 0 --><!--description UHJldmVudCBmb3JtIHN1Ym1pc3Npb24gYnkgYnV0dG9ucyBpbiBVR0MgbWFya2Rvd24=-->Prevent form submission by buttons in UGC markdown<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10394): <!--number 10394 --><!--line 0 --><!--description YWx3YXlzIHNlYXJjaCBmb3IgaXNzdWUgcG9zdGVycyBieSB1c2VyIGFuZCBmdWxsIG5hbWU=-->always search for issue posters by user and full name<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10489): <!--number 10489 --><!--line 0 --><!--description YWxpZ24gZHVlIGRhdGUgaWNvbiBpbiBpc3N1ZSBsaXN0-->align due date icon in issue list<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/8244): <!--number 8244 --><!--line 0 --><!--description YWRkIGR5bmFtaWMgYXJpYS1sYWJlbCB0byBtb25vc3BhY2UgYnV0dG9uIGluIG1hcmtkb3duIGVkaXRvcg==-->add dynamic aria-label to monospace button in markdown editor<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes-published/15.0.1.md b/release-notes-published/15.0.1.md
new file mode 100644
index 0000000000..4d05ed923c
--- /dev/null
+++ b/release-notes-published/15.0.1.md
@@ -0,0 +1,29 @@
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12293): <!--number 12293 --><!--line 0 --><!--description V2hlbiBhIHB1bGwgcmVxdWVzdCBpcyBvcGVuZWQsIHRoZSBhdXRob3IgaXMgYWJsZSB0byBtYXJrIHRoYXQgcHVsbCByZXF1ZXN0IHRvICJBbGxvdyBlZGl0cyBmcm9tIG1haW50YWluZXJzIiwgd2hpY2ggZ3JhbnRzIHRoZSBtYWludGFpbmVycyBvZiB0aGUgcHVsbCByZXF1ZXN0J3MgcmVwbyBhY2Nlc3MgdG8gZWRpdCB0aGUgcHVsbCByZXF1ZXN0IGJyYW5jaCBjb250ZW50cy4gIEl0IGlzIHBvc3NpYmxlIHRvIGNyZWF0ZSBhIHB1bGwgcmVxdWVzdCB3aGVyZSB0aGUgcHVsbCByZXF1ZXN0IGF1dGhvciBkb2VzIG5vdCBoYXZlIHRoZSBhYmlsaXR5IHRvIGVkaXQgdGhlIHB1bGwgcmVxdWVzdCBicmFuY2guICBEdWUgdG8gYSBtaXNzaW5nIHNlY3VyaXR5IGNoZWNrIGZvciB0aGlzIGNhc2UsIG1haW50YWluZXJzIG9mIHRoZSBwdWxsIHJlcXVlc3QgcmVwbyB3b3VsZCBiZSBncmFudGVkIHRoZSBhYmlsaXR5IHRvIGVkaXQgdGhlIHB1bGwgcmVxdWVzdCBicmFuY2gsIGV2ZW4gaWYgdGhlIGF1dGhvciBvZiB0aGUgcHVsbCByZXF1ZXN0IGRpZCBub3QgaGF2ZSB0aGF0IGFiaWxpdHkuICBCeSBleHBsb2l0aW5nIHRoaXMgbWlzc2luZyBzZWN1cml0eSBjaGVjaywgYSB1c2VyIGNhbiBlZGl0IGFueSBicmFuY2ggaW4gYSByZXBvc2l0b3J5IGlmIHRoZXkncmUgYWJsZSB0byBmb3JrIHRoYXQgcmVwb3NpdG9yeS4gIFRoZSBpc3N1ZSBpcyBiZWluZyBmaXhlZCBieSByZXN0cmljdGluZyB0aGUgc2NvcGUgb2YgIkFsbG93IGVkaXRzIGZyb20gbWFpbnRhaW5lcnMiIHRvIG9ubHkgZ3JhbnQgdGhhdCBhY2Nlc3MgaWYgdGhlIHB1bGwgcmVxdWVzdCBhdXRob3IgYWxzbyBoYWQgYWNjZXNzIHRvIGVkaXQgdGhlIGJyYW5jaC4=-->When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents.  It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch.  Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability.  By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository.  The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.<!--description-->
+- Localization
+  - Backport of translations from Codeberg Translate: [#12306](https://codeberg.org/forgejo/forgejo/pulls/12306) (backport of [#12128](https://codeberg.org/forgejo/forgejo/pulls/12128))
+- Bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11685) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12171)): <!--number 12171 --><!--line 0 --><!--description Zml4OiBhbHdheXMgaW5jbHVkZSBmaWxlcyBzZXQgdG8gYmUgZGV0ZWN0YWJsZSBmb3IgbGFuZ3VhZ2Ugc3RhdHM=-->fix: always include files set to be detectable for language stats<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12079) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12166)): <!--number 12166 --><!--line 0 --><!--description RXhjbHVkZSBTU0ggY2VydGlmaWNhdGUgcHJpbmNpcGFscyBmcm9tIG91dHB1dCB3aGVuIHZpZXdpbmcgdXNlcidzIFNTSCBrZXlz-->Exclude SSH certificate principals from output when viewing user's SSH keys<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12156) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12317)): <!--number 12317 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8tYnVpbGQtcHVibGlzaCBhY3Rpb24gdG8gdjUuNi4wIChmb3JnZWpvKQ==-->Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.6.0 (forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12271) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12272)): <!--number 12272 --><!--line 0 --><!--description Zml4OiBhbGxvdyB2aWV3aW5nIEFjdGlvbnMgcnVuIHRyaWdnZXJlZCBieSBkZWxldGVkIHVzZXI=-->fix: allow viewing Actions run triggered by deleted user<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12255): <!--number 12255 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgcG9zdGNzcyB0byB2OC41LjEwIFtTRUNVUklUWV0gKHYxNS4wL2Zvcmdlam8p-->Update dependency postcss to v8.5.10 [SECURITY] (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12235): <!--number 12235 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2phY2tjL3BneC92NSB0byB2NS45LjIgW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2Vqbyk=-->Update module github.com/jackc/pgx/v5 to v5.9.2 [SECURITY] (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12227) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12233)): <!--number 12233 --><!--line 0 --><!--description Zml4OiBjb21wYXJlIGJyYW5jaGVzIHdpdGggbmFtZXMgYGRpZmZgIG9yIGBwYXRjaGA=-->fix: compare branches with names `diff` or `patch`<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12224) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12229)): <!--number 12229 --><!--line 0 --><!--description Zml4OiByZXNvbHZlIG91dGVyIHdvcmtmbG93IGNhbGwgdG8gc3VjY2Vzcywgbm90IGZhaWx1cmUsIG9uIGlubmVyIGpvYiBza2lw-->fix: resolve outer workflow call to success, not failure, on inner job skip<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12218): <!--number 12218 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuMzkuMCAodjE1LjAvZm9yZ2Vqbyk=-->Update module golang.org/x/image to v0.39.0 (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12213) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12216)): <!--number 12216 --><!--line 0 --><!--description Zml4OiBzZWNyZXQgbmFtZS1wcmVmaXggcmVnZXg=-->fix: secret name-prefix regex<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12214) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12215)): <!--number 12215 --><!--line 0 --><!--description Zml4KHVpKTogYWxsb3cgY3JlYXRpbmcgZmlsZXMgd2l0aCBuYW1lIHN0YXJ0aW5nIHdpdGggZGFzaA==-->fix(ui): allow creating files with name starting with dash<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12151) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12199)): <!--number 12199 --><!--line 0 --><!--description Zml4OiBDb2RlTWlycm9yIGUyZSB0ZXN0-->fix: CodeMirror e2e test<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12183) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12185)): <!--number 12185 --><!--line 0 --><!--description Zml4KGkxOG4pOiBkb24ndCBsb2cgaGFybWxlc3MgbWlzc2luZyB0cmFuc2xhdGlvbnMgYXMgZXJyb3Jz-->fix(i18n): don't log harmless missing translations as errors<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12177): <!--number 12177 --><!--line 0 --><!--description VXBkYXRlIGdpdGh1Yi5jb20vZ28tZ2l0L2dvLWdpdC92NSAoaW5kaXJlY3QpIHRvIHY1LjE4LjAgW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2VqbykgLSBhdXRvY2xvc2Vk-->Update github.com/go-git/go-git/v5 (indirect) to v5.18.0 [SECURITY] (v15.0/forgejo) - autoclosed<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12154): <!--number 12154 --><!--line 0 --><!--description Y2hvcmU6IGJ1bXAgeG9ybSB0byB2MS4zLjktZm9yZ2Vqby4xMQ==-->chore: bump xorm to v1.3.9-forgejo.11<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12144) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12150)): <!--number 12150 --><!--line 0 --><!--description Zml4OiBtYWtlIC9yZXBvcy9zZWFyY2g/dWlkPS0yIHJldHVybiB6ZXJvIHJlc3VsdHMsIG5vIHJlcG9zIHdpdGggdGhhdCBvd25lcg==-->fix: make /repos/search?uid=-2 return zero results, no repos with that owner<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12143) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12147)): <!--number 12147 --><!--line 0 --><!--description Zml4OiBjb250aW51ZWQgQVBJIHJlc3BvbnNlIHByb2Nlc3NpbmcgYWZ0ZXIgZXJyb3IgaW4gYC9yZXBvcy9zZWFyY2hgIEFQSQ==-->fix: continued API response processing after error in `/repos/search` API<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes-published/15.0.2.md b/release-notes-published/15.0.2.md
new file mode 100644
index 0000000000..c5c8c14648
--- /dev/null
+++ b/release-notes-published/15.0.2.md
@@ -0,0 +1,33 @@
+
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): <!--number 12494 --><!--line 0 --><!--description LSBmaXg6IHByZXZlbnQgZ2l0IHdyaXRlIHRvIHdpa2kgcmVwbyBmcm9tIHVuYXV0aG9yaXplZCB1c2VyIHZpYSBnaXQgSFRUUA==-->fix: prevent git write to wiki repo from unauthorized user via git HTTP<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): <!--number 12494 --><!--line 1 --><!--description LSBmaXg6IHByZXZlbnQgTEZTIGF1dGhvcml6YXRpb24gdG9rZW4gZnJvbSBiZWluZyB1c2VkIGZvciByZWFkL3dyaXRlIGFjY2VzcyBhZnRlciB1c2VyJ3MgYWNjZXNzIGlzIHJlc3RyaWN0ZWQgZnJvbSBGb3JnZWpv-->fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): <!--number 12494 --><!--line 2 --><!--description LSBmaXg6IHByZXZlbnQgc2NvcGVkIEFQSSBhY2Nlc3MgKE9BdXRoIHRva2VucywgQWNjZXNzIHRva2VucykgZnJvbSBhY2Nlc3NpbmcgcmVzb3VyY2VzIGJleW9uZCB0aGVpciBwZXJtaXR0ZWQgc2NvcGUgdmlhIG5vbi1BUEkgZW5kcG9pbnRzIChlLmcuIC91c2VyL3JlcG8vcmF3Ly4uLik=-->fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): <!--number 12494 --><!--line 3 --><!--description LSBmaXg6IGltcGxlbWVudGluZyBtaXNzaW5nIE9BdXRoIHZhbGlkYXRpb24gY2hlY2tzLCBpbXByb3ZlIHByb3RlY3Rpb25zIGFnYWluc3QgcmFjZSBjb25kaXRpb25z-->fix: implementing missing OAuth validation checks, improve protections against race conditions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): <!--number 12494 --><!--line 4 --><!--description LSBmaXg6IHByZXZlbnQgT0F1dGggcmVkaXJlY3QgVVJJIHNwb29maW5nIHZpYSBub24tYXNjaWkgY2FzZSBjb2xsaXNpb24=-->fix: prevent OAuth redirect URI spoofing via non-ascii case collision<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): <!--number 12494 --><!--line 5 --><!--description LSBmaXg6IHN0cmVuZ3RoZW4gQWN0aW9ucyBBcnRpZmFjdCBWNCBzaWduYXR1cmUgYWxnb3JpdGhtIGFnYWluc3Qgc3Bvb2ZpbmcgYXR0YWNrcw==-->fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks<!--description-->
+- User Interface bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12366) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12492)): <!--number 12492 --><!--line 0 --><!--description V2hlbiB0aGUgYXV0aG9yIG9mIGEgcHVsbCByZXF1ZXN0IGlzIFtkZW5pZWQgdGhlIHJpZ2h0IHRvIHJ1biBBY3Rpb25zXShodHRwczovL2Zvcmdlam8ub3JnL2RvY3MvbmV4dC91c2VyL2FjdGlvbnMvc2VjdXJpdHktcHVsbC1yZXF1ZXN0LykgYnkgY2xpY2tpbmcgb24gdGhlICJEZW55IiBidXR0b24gb24gdGhlIHB1bGwgcmVxdWVzdCB0cnVzdCBtYW5hZ2VtZW50IHBhbmVsLCB0aGUgd29ya2Zsb3cgcnVucyBjcmVhdGVkIGZvciBhbGwgY29tbWl0cyBwdXNoZWQgdG8gdGhlIHB1bGwgcmVxdWVzdCBhcmUgY2FuY2VsbGVkLiBCZWZvcmUgdGhhdCwgcnVucyB0aGF0IHdlcmUgYXV0b21hdGljYWxseSBjYW5jZWxsZWQgYmVjYXVzZSBhIG5ld2VyIGNvbW1pdCB3YXMgcHVzaGVkIHRvIHRoZSBwdWxsIHJlcXVlc3QgW3dlcmUgc3R1Y2sgaW4gYSBzdGF0ZSB3YWl0aW5nIGZvciBhcHByb3ZhbF0oaHR0cHM6Ly9jb2RlYmVyZy5vcmcvZm9yZ2Vqby9mb3JnZWpvL2lzc3Vlcy8xMjM1MCku-->When the author of a pull request is [denied the right to run Actions](https://forgejo.org/docs/next/user/actions/security-pull-request/) by clicking on the "Deny" button on the pull request trust management panel, the workflow runs created for all commits pushed to the pull request are cancelled. Before that, runs that were automatically cancelled because a newer commit was pushed to the pull request [were stuck in a state waiting for approval](https://codeberg.org/forgejo/forgejo/issues/12350).<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12447) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12461)): <!--number 12461 --><!--line 0 --><!--description Zml4OiBwYWdpbmF0ZSB0ZWFtIG1lbWJlcnMgbGlzdA==-->fix: paginate team members list<!--description-->
+- Bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12302) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12470)): <!--number 12470 --><!--line 0 --><!--description V2hlbiBhIHJldmlldyB3YXMgY3JlYXRlZCBhcyBwZW5kaW5nIGFuZCB0aGVuIHN1Ym1pdHRlZCwgdGhlIHJldmlldyByZXF1ZXN0IHdhc24ndCBkZWxldGVkLiBUaGVzZSByZXZpZXcgcmVxdWVzdHMgY291bGRuJ3QgYmUgcmVtb3ZlZCwgYXMgdGhlIG5vdyBleGlzdGluZyByZXZpZXcgc2hhZG93ZWQgdGhlIHJldmlldyByZXF1ZXN0LiBOb3csIHJldmlldyByZXF1ZXN0cyBnZXQgZGVsZXRlZCB3aGVuIGEgcGVuZGluZyByZXZpZXcgZnJvbSB0aGF0IHJldmlld2VyIGdldHMgc3VibWl0dGVkLCBhbmQgYnJva2VuIHJldmlldyByZXF1ZXN0cyBpbiBhbHJlYWR5IGV4aXN0aW5nIGRhdGEgY2FuIGJlIG5vcm1hbGx5IHJlbW92ZWQgdmlhIHRoZSBVSS4=-->When a review was created as pending and then submitted, the review request wasn't deleted. These review requests couldn't be removed, as the now existing review shadowed the review request. Now, review requests get deleted when a pending review from that reviewer gets submitted, and broken review requests in already existing data can be normally removed via the UI.<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12446) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12452)): <!--number 12452 --><!--line 0 --><!--description Zml4OiBtYWtlIHBhY2thZ2UgY2xlYW51cCB3b3JrIGFnYWlu-->fix: make package cleanup work again<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12370) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12422)): <!--number 12422 --><!--line 0 --><!--description Zml4OiBjbGVhbnVwIGRhdGEgYmVmb3JlIG1pZ3JhdGlvbiByZXRyeQ==-->fix: cleanup data before migration retry<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12382) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12533)): <!--number 12533 --><!--line 0 --><!--description Zml4KGFjdGl2aXR5cHViKTogb25seSByZXR1cm4gcHVibGljIGFjdGl2aXRpZXMgb24gcmVxdWVzdCAoIzEyMzgyKQ==-->fix(activitypub): only return public activities on request (#12382)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12531): <!--number 12531 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWVybWFpZCB0byB2MTEuMTUuMCBbU0VDVVJJVFldICh2MTUuMC9mb3JnZWpvKQ==-->Update dependency mermaid to v11.15.0 [SECURITY] (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12503): <!--number 12503 --><!--line 0 --><!--description Y2hvcmU6IFBHUCBzaWduIC53ZWxsLWtub3duL3NlY3VyaXR5LnR4dCBbc2tpcCBjaV0=-->chore: PGP sign .well-known/security.txt [skip ci]<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12465): <!--number 12465 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUzLjAgW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.53.0 [SECURITY] (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12433) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12467)): <!--number 12467 --><!--line 0 --><!--description W3BhZ3VyZV0gZW5zdXJlIG1vdmluZyBhbGwgY29tbWl0cyBpbiBhIHB1bGwgcmVxdWVzdA==-->[pagure] ensure moving all commits in a pull request<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12231) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12468)): <!--number 12468 --><!--line 0 --><!--description cmVmYWN0b3I6IGNsYXJpZnkgZm91ciBkaWZmZXJlbnQgb3V0cHV0cyB0aGF0IGF1dGhlbnRpY2F0aW9uIG1ldGhvZHMgcHJvdmlkZQ==-->refactor: clarify four different outputs that authentication methods provide<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12202) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12462)): <!--number 12462 --><!--line 0 --><!--description cmVmYWN0b3I6IGNoYW5nZSBhdXRoZW50aWNhdGlvbiB0byByZXR1cm4gc3RydWN0dXJlZCBkYXRh-->refactor: change authentication to return structured data<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12456): <!--number 12456 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjYuMyAodjE1LjAvZm9yZ2Vqbyk=-->Update go toolchain directive to v1.26.3 (v15.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12351) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12395)): <!--number 12395 --><!--line 0 --><!--description Zml4OiBnZXQgdGFnIG11c3QgcmV0dXJuIHRoZSB0YWcgc2lnbmF0dXJlIGluc3RlYWQgb2YgY29tbWl0IHNpZ25hdHVyZQ==-->fix: get tag must return the tag signature instead of commit signature<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12357) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12362)): <!--number 12362 --><!--line 0 --><!--description Zml4OiBzZXQgYHJlcG9faWRgIGZvciBtaWdyYXRlZCBhdHRhY2htZW50-->fix: set `repo_id` for migrated attachment<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12291) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12354)): <!--number 12354 --><!--line 0 --><!--description Zml4KG9hdXRoKTogb25seSBhY2NlcHQgcmVmcmVzaCB0b2tlbnMgYXMgcmVmcmVzaCB0b2tlbnM=-->fix(oauth): only accept refresh tokens as refresh tokens<!--description-->
+<!--end release-notes-assistant-->
diff --git a/release-notes/10380.md b/release-notes/10380.md
new file mode 100644
index 0000000000..04c1b7c665
--- /dev/null
+++ b/release-notes/10380.md
@@ -0,0 +1 @@
+Allow forgejo users to follow remote users and display federated notes. This feature is still missing some some other basic features for "production use": there is no moderation support, UI for following federated users, and federation is still limited to forgejo, Mastodon, and GoToSocial.
diff --git a/release-notes/10397.md b/release-notes/10397.md
new file mode 100644
index 0000000000..0560c173b9
--- /dev/null
+++ b/release-notes/10397.md
@@ -0,0 +1 @@
+feat: replace repository based server-side hooks with centralised hooks. Migration guide is available in [Admin docs](https://forgejo.org/docs/latest/admin/upgrade/#when-upgrading-from--known-problematic-versions-or-upgrade-paths).
diff --git a/release-notes/10719.md b/release-notes/10719.md
deleted file mode 100644
index 807e660339..0000000000
--- a/release-notes/10719.md
+++ /dev/null
@@ -1,5 +0,0 @@
-fix: hide user profile anonymous options on public repo APIs
-fix: incorrect whitespace handling on pre&post receive hooks
-fix: reduce memory usage while processing large attachment uploads
-fix: load reviewer for pull review dismiss action notifier
-fix: use correct GPG key for export
diff --git a/release-notes/11194.md b/release-notes/11194.md
new file mode 100644
index 0000000000..1ca37e04c3
--- /dev/null
+++ b/release-notes/11194.md
@@ -0,0 +1 @@
+Configuration of JSON Web Token (JWT) signing secrets in the `app.ini` file has been unified: `[pfx]SIGNING_ALGORITHM` determines the algorithm, `[pfx]SECRET` is a literal secret for symmetric algorithms, `[pfx]SECRET_URI` is the `file:` uri of a secret for symmetric algorithms `[pfx]SIGNING_PRIVATE_KEY_FILE` is the file with a private key for asymmetric algorithms. For the following configuration keys, the existing behavior is preserved: `[oauth2]` pfx = `JWT_`, `[actions]` pfx = `ID_TOKEN_` only supports asymmetric algorithms. `[server]` pfx = `LFS_JWT_` gained support for asymmetric algorithms. For consistency with `[pfx]SIGNING_PRIVATE_KEY_FILE`, `[pfx]SECRET_URI` now also accepts relative paths.
diff --git a/release-notes/12095.md b/release-notes/12095.md
new file mode 100644
index 0000000000..3930b07f46
--- /dev/null
+++ b/release-notes/12095.md
@@ -0,0 +1 @@
+Hosted PyPI packages may be accessed via the [simple JSON API](https://packaging.python.org/en/latest/specifications/simple-repository-api/#json-serialization) in addition to the simple HTML API already available.
diff --git a/release-notes/12293.md b/release-notes/12293.md
new file mode 100644
index 0000000000..0052eced48
--- /dev/null
+++ b/release-notes/12293.md
@@ -0,0 +1 @@
+When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents.  It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch.  Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability.  By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository.  The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.
diff --git a/release-notes/12294.md b/release-notes/12294.md
new file mode 100644
index 0000000000..0052eced48
--- /dev/null
+++ b/release-notes/12294.md
@@ -0,0 +1 @@
+When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents.  It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch.  Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability.  By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository.  The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.
diff --git a/release-notes/12295.md b/release-notes/12295.md
new file mode 100644
index 0000000000..0052eced48
--- /dev/null
+++ b/release-notes/12295.md
@@ -0,0 +1 @@
+When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents.  It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch.  Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability.  By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository.  The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.
diff --git a/release-notes/12494.md b/release-notes/12494.md
new file mode 100644
index 0000000000..a26776b47c
--- /dev/null
+++ b/release-notes/12494.md
@@ -0,0 +1,6 @@
+- fix: prevent git write to wiki repo from unauthorized user via git HTTP
+- fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo
+- fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)
+- fix: implementing missing OAuth validation checks, improve protections against race conditions
+- fix: prevent OAuth redirect URI spoofing via non-ascii case collision
+- fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks
diff --git a/release-notes/12495.md b/release-notes/12495.md
new file mode 100644
index 0000000000..a26776b47c
--- /dev/null
+++ b/release-notes/12495.md
@@ -0,0 +1,6 @@
+- fix: prevent git write to wiki repo from unauthorized user via git HTTP
+- fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo
+- fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)
+- fix: implementing missing OAuth validation checks, improve protections against race conditions
+- fix: prevent OAuth redirect URI spoofing via non-ascii case collision
+- fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks
diff --git a/routers/api/actions/artifactsv4.go b/routers/api/actions/artifactsv4.go
index 94699e576f..c3d3c37e79 100644
--- a/routers/api/actions/artifactsv4.go
+++ b/routers/api/actions/artifactsv4.go
@@ -572,7 +572,7 @@ func (r *artifactV4Routes) downloadArtifact(ctx *ArtifactContext) {
 		return
 	}
 
-	common.ServeContentByReadSeeker(ctx.Base, artifactName, util.ToPointer(artifact.UpdatedUnix.AsTime()), file)
+	common.ServeContentByReadSeeker(ctx.Base, artifactName, new(artifact.UpdatedUnix.AsTime()), file)
 }
 
 func (r *artifactV4Routes) deleteArtifact(ctx *ArtifactContext) {
diff --git a/routers/api/actions/oidc.go b/routers/api/actions/oidc.go
index d824030ca7..23b6fec16c 100644
--- a/routers/api/actions/oidc.go
+++ b/routers/api/actions/oidc.go
@@ -14,6 +14,7 @@ import (
 	"forgejo.org/modules/web"
 	web_types "forgejo.org/modules/web/types"
 	actions_service "forgejo.org/services/actions"
+	auth_method "forgejo.org/services/auth/method"
 	"forgejo.org/services/context"
 )
 
@@ -48,7 +49,7 @@ type OIDCContext struct {
 
 func InitOIDC() error {
 	var err error
-	jwtSigningKey, err = jwtx.InitAsymmetricSigningKey(setting.Actions.IDTokenSigningPrivateKeyFile, string(setting.Actions.IDTokenSigningAlgorithm))
+	jwtSigningKey, err = jwtx.InitSigningKey(&setting.Actions.KeyCfg.Signing)
 	if err != nil {
 		return err
 	}
@@ -66,6 +67,7 @@ func init() {
 	web.RegisterResponseStatusProvider[*OIDCContext](func(req *http.Request) web_types.ResponseStatusProvider {
 		return req.Context().Value(oidcContextKey).(*OIDCContext)
 	})
+	auth_method.RegisterInternalIssuer("api/actions", internalIssuer{})
 }
 
 func OIDCContexter() func(next http.Handler) http.Handler {
@@ -101,8 +103,7 @@ func OIDCRoutes(prefix string) *web.Route {
 	// and inspecting the names of the json struct tags
 	rt := reflect.TypeFor[actions_service.IDTokenCustomClaims]()
 
-	for i := 0; i < rt.NumField(); i++ {
-		f := rt.Field(i)
+	for f := range rt.Fields() {
 		v := strings.Split(f.Tag.Get("json"), ",")[0]
 		if v == "" || v == "-" {
 			continue
@@ -118,7 +119,7 @@ func OIDCRoutes(prefix string) *web.Route {
 			SubjectTypesSupported:            []string{"public"},
 			ResponseTypesSupported:           []string{"id_token"},
 			ClaimsSupported:                  claimsSupported,
-			IDTokenSigningAlgValuesSupported: []string{string(setting.Actions.IDTokenSigningAlgorithm)},
+			IDTokenSigningAlgValuesSupported: []string{jwtSigningKey.SigningMethod().Alg()},
 			ScopesSupported:                  []string{"openid"},
 		},
 		jwks: map[string][]map[string]string{
@@ -143,3 +144,16 @@ func (o *oidcRoutes) configuration(ctx *OIDCContext) {
 func (o *oidcRoutes) keys(ctx *OIDCContext) {
 	ctx.JSON(http.StatusOK, o.jwks)
 }
+
+// Register Actions OIDC as an internal issuer for authorized integrations.  This allows an authorized integration to
+// have the value `urn:forgejo:authorized-integrations:actions` as an issuer, and perform JWT signature validation
+// against the in-memory signing key defined in this module.
+type internalIssuer struct{}
+
+func (internalIssuer) IssuerPlaceholder() string {
+	return "urn:forgejo:authorized-integrations:actions"
+}
+
+func (internalIssuer) SigningKey() jwtx.SigningKey {
+	return jwtSigningKey
+}
diff --git a/routers/api/packages/api.go b/routers/api/packages/api.go
index 7096cd9e51..7106521e85 100644
--- a/routers/api/packages/api.go
+++ b/routers/api/packages/api.go
@@ -193,9 +193,13 @@ func CommonRoutes() *web.Route {
 	verifyAuth(r, []auth.Method{
 		&auth_method.OAuth2{},
 		&auth_method.Basic{},
+		&auth_method.AccessToken{},
+		&auth_method.ActionRuntimeToken{},
+		&auth_method.ActionTaskToken{},
 		&nuget.Auth{},
 		&conan.Auth{},
 		&chef.Auth{},
+		&auth_method.AuthorizedIntegration{},
 	})
 
 	r.Group("/{username}", func() {
@@ -836,7 +840,18 @@ func ContainerRoutes() *web.Route {
 
 	r.Use(context.PackageContexter())
 
-	verifyContainerAuth(r, []auth.Method{&auth_method.Basic{}, &container.Auth{}})
+	verifyContainerAuth(r, []auth.Method{
+		&auth_method.Basic{},
+		&auth_method.AccessToken{},
+		&auth_method.ActionRuntimeToken{},
+		&auth_method.ActionTaskToken{},
+		&container.Auth{},
+		&auth_method.AuthorizedIntegration{
+			// `docker login` can't send a bearer token, so enable reading a token from the password field of
+			// `Authorization: Basic ...`.
+			PermitBasic: true,
+		},
+	})
 
 	r.Get("", container.ReqContainerAccess, container.DetermineSupport)
 	r.Group("/token", func() {
diff --git a/routers/api/packages/conan/conan.go b/routers/api/packages/conan/conan.go
index cc894aec2f..5829c432ad 100644
--- a/routers/api/packages/conan/conan.go
+++ b/routers/api/packages/conan/conan.go
@@ -119,8 +119,9 @@ func Authenticate(ctx *context.Context) {
 
 	// If there's an API scope, ensure it propagates.
 	scope := ctx.Authentication.Scope().ValueOrZeroValue()
+	exp := ctx.Authentication.ExpiresAt()
 
-	token, err := packages_service.CreateAuthorizationToken(ctx.Doer, scope)
+	token, err := packages_service.CreateAuthorizationToken(ctx.Doer, scope, exp)
 	if err != nil {
 		apiError(ctx, http.StatusInternalServerError, err)
 		return
diff --git a/routers/api/packages/container/container.go b/routers/api/packages/container/container.go
index eb81773b4c..df14ca6280 100644
--- a/routers/api/packages/container/container.go
+++ b/routers/api/packages/container/container.go
@@ -158,8 +158,9 @@ func Authenticate(ctx *context.Context) {
 
 	// If there's an API scope, ensure it propagates.
 	scope := ctx.Authentication.Scope().ValueOrZeroValue()
+	exp := ctx.Authentication.ExpiresAt()
 
-	token, err := packages_service.CreateAuthorizationToken(u, scope)
+	token, err := packages_service.CreateAuthorizationToken(u, scope, exp)
 	if err != nil {
 		apiError(ctx, http.StatusInternalServerError, err)
 		return
diff --git a/routers/api/packages/pypi/pypi.go b/routers/api/packages/pypi/pypi.go
index 360632570e..5d8bf5d45f 100644
--- a/routers/api/packages/pypi/pypi.go
+++ b/routers/api/packages/pypi/pypi.go
@@ -8,11 +8,14 @@ import (
 	"io"
 	"net/http"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"unicode"
 
 	packages_model "forgejo.org/models/packages"
+	"forgejo.org/modules/json"
+	"forgejo.org/modules/log"
 	packages_module "forgejo.org/modules/packages"
 	pypi_module "forgejo.org/modules/packages/pypi"
 	"forgejo.org/modules/setting"
@@ -44,8 +47,14 @@ func apiError(ctx *context.Context, status int, obj any) {
 	})
 }
 
-// PackageMetadata returns the metadata for a single package
-func PackageMetadata(ctx *context.Context) {
+func contentTypeSupported(ctyps []string, v string) bool {
+	return slices.ContainsFunc(ctyps, func(ctyp string) bool {
+		return strings.HasPrefix(ctyp, v)
+	})
+}
+
+// HTMLPackageMetadata returns the metadata for a single package in Simple HTML per PEP691
+func HTMLPackageMetadata(ctx *context.Context) {
 	packageName := normalizer.Replace(ctx.Params("id"))
 
 	pvs, err := packages_model.GetVersionsByPackageName(ctx, ctx.Package.Owner.ID, packages_model.TypePyPI, packageName)
@@ -72,9 +81,82 @@ func PackageMetadata(ctx *context.Context) {
 	ctx.Data["RegistryURL"] = setting.AppURL + "api/packages/" + ctx.Package.Owner.Name + "/pypi"
 	ctx.Data["PackageDescriptor"] = pds[0]
 	ctx.Data["PackageDescriptors"] = pds
+	// Content-Type headers need to be in this order for the page to show in the browser
+	ctx.Resp.Header().Set("Content-Type", "application/vnd.pypi.simple.v1+html")
+	ctx.Resp.Header().Add("Content-Type", "text/html")
 	ctx.HTML(http.StatusOK, "api/packages/pypi/simple")
 }
 
+// JSONPackageMetadata returns the metadata for a single package in Simple JSON per PEP691
+func JSONPackageMetadata(ctx *context.Context) {
+	packageName := normalizer.Replace(ctx.Params("id"))
+
+	pvs, err := packages_model.GetVersionsByPackageName(ctx, ctx.Package.Owner.ID, packages_model.TypePyPI, packageName)
+	if err != nil {
+		apiError(ctx, http.StatusInternalServerError, err)
+		return
+	}
+	if len(pvs) == 0 {
+		apiError(ctx, http.StatusNotFound, err)
+		return
+	}
+
+	pds, err := packages_model.GetPackageDescriptors(ctx, pvs)
+	if err != nil {
+		apiError(ctx, http.StatusInternalServerError, err)
+		return
+	}
+
+	// sort package descriptors by version to mimic PyPI format
+	slices.SortFunc(pds, func(a, b *packages_model.PackageDescriptor) int {
+		return strings.Compare(a.Version.Version, b.Version.Version)
+	})
+	registryURL := setting.AppURL + "api/packages/" + ctx.Package.Owner.Name + "/pypi"
+	versions := make([]string, len(pvs))
+	for i, pv := range pvs {
+		versions[i] = pv.Version
+	}
+	var fileCounter int
+	for _, pd := range pds {
+		fileCounter += len(pd.Files)
+	}
+	files := make([]pypi_module.FileJSON, fileCounter)
+	var i int
+	for _, pd := range pds {
+		for _, file := range pd.Files {
+			files[i] = pypi_module.FileJSON{
+				Filename:       file.File.Name,
+				URL:            registryURL + "/files/" + pd.Package.LowerName + "/" + pd.Version.Version + "/" + file.File.Name,
+				RequiresPython: pd.Metadata.(*pypi_module.Metadata).RequiresPython,
+				Hashes:         pypi_module.FileHashesJSON{SHA256: file.Blob.HashSHA256},
+				Size:           file.Blob.Size,
+			}
+			i++
+		}
+	}
+	content := pypi_module.PackageJSON{
+		Name:     pds[0].Package.Name,
+		Meta:     pypi_module.PackageMetaJSON{APIVersion: "1.4"},
+		Versions: versions,
+		Files:    files,
+	}
+	ctx.Resp.Header().Set("Content-Type", "application/vnd.pypi.simple.v1+json")
+	ctx.Resp.Header().Add("Content-Type", "application/json")
+	if err := json.NewEncoder(ctx.Resp).Encode(content); err != nil {
+		log.Error("Render JSON failed: %v", err)
+		apiError(ctx, http.StatusInternalServerError, err)
+	}
+}
+
+func PackageMetadata(ctx *context.Context) {
+	ctyp := ctx.Req.Header["Accept"]
+	if contentTypeSupported(ctyp, "application/vnd.pypi.simple.v1+json") {
+		JSONPackageMetadata(ctx)
+	} else {
+		HTMLPackageMetadata(ctx)
+	}
+}
+
 // DownloadPackageFile serves the content of a package
 func DownloadPackageFile(ctx *context.Context) {
 	packageName := normalizer.Replace(ctx.Params("id"))
diff --git a/routers/api/shared/middleware.go b/routers/api/shared/middleware.go
index 5a2debf3af..f6dd30f8b8 100644
--- a/routers/api/shared/middleware.go
+++ b/routers/api/shared/middleware.go
@@ -50,6 +50,10 @@ func buildAuthGroup() *auth_method.Group {
 		&auth_method.OAuth2{},
 		&auth_method.HTTPSign{},
 		&auth_method.Basic{}, // FIXME: this should be removed once we don't allow basic auth in API
+		&auth_method.AccessToken{},
+		&auth_method.ActionRuntimeToken{},
+		&auth_method.ActionTaskToken{},
+		&auth_method.AuthorizedIntegration{},
 	)
 	if setting.Service.EnableReverseProxyAuthAPI {
 		group.Add(&auth_method.ReverseProxy{})
diff --git a/routers/api/v1/activitypub/actor.go b/routers/api/v1/activitypub/actor.go
index f8b08e92c3..4bbeb7e7f2 100644
--- a/routers/api/v1/activitypub/actor.go
+++ b/routers/api/v1/activitypub/actor.go
@@ -32,7 +32,7 @@ func Actor(ctx *context.APIContext) {
 	actor := ap.ActorNew(ap.IRI(link), ap.ApplicationType)
 
 	actor.PreferredUsername = ap.NaturalLanguageValuesNew()
-	err := actor.PreferredUsername.Set("en", ap.Content("ghost"))
+	err := actor.PreferredUsername.Set(ap.NilLangRef, ap.Content("ghost"))
 	if err != nil {
 		ctx.ServerError("PreferredUsername.Set", err)
 		return
diff --git a/routers/api/v1/activitypub/repository.go b/routers/api/v1/activitypub/repository.go
index 178f4b246f..153719478f 100644
--- a/routers/api/v1/activitypub/repository.go
+++ b/routers/api/v1/activitypub/repository.go
@@ -45,7 +45,7 @@ func Repository(ctx *context.APIContext) {
 	repo.Outbox = ap.IRI(link + "/outbox")
 
 	repo.Name = ap.NaturalLanguageValuesNew()
-	err := repo.Name.Set("en", ap.Content(ctx.Repo.Repository.Name))
+	err := repo.Name.Set(ap.NilLangRef, ap.Content(ctx.Repo.Repository.Name))
 	if err != nil {
 		ctx.Error(http.StatusInternalServerError, "Set Name", err)
 		return
diff --git a/routers/api/v1/activitypub/reqsignature.go b/routers/api/v1/activitypub/reqsignature.go
index 2c17d953d0..100378b5f1 100644
--- a/routers/api/v1/activitypub/reqsignature.go
+++ b/routers/api/v1/activitypub/reqsignature.go
@@ -30,13 +30,9 @@ func verifyHTTPSignature(ctx app_context.APIContext) (authenticated bool, err er
 
 	log.Debug("Verify %q, signed by KeyId: %v", r.URL.Path, v.KeyId())
 	signatureAlgorithm := httpsig.Algorithm(setting.Federation.SignatureAlgorithms[0])
-	pubKey, err := federation.FindOrCreateFederatedUserKey(ctx, v.KeyId())
-	if err != nil || pubKey == nil {
-		pubKey, err = federation.FindOrCreateFederationHostKey(ctx, v.KeyId())
-		if err != nil {
-			log.Debug("For %q verification failed: %v", r.URL.Path, err)
-			return false, err
-		}
+	pubKey, err := federation.FindOrCreateActorKey(ctx, v.KeyId())
+	if err != nil {
+		return false, err
 	}
 
 	err = v.Verify(pubKey, signatureAlgorithm)
diff --git a/routers/api/v1/admin/user.go b/routers/api/v1/admin/user.go
index f30ba8b5dd..be02d3e198 100644
--- a/routers/api/v1/admin/user.go
+++ b/routers/api/v1/admin/user.go
@@ -416,6 +416,10 @@ func SearchUsers(ctx *context.APIContext) {
 	//   in: query
 	//   description: user's login name to search for
 	//   type: string
+	// - name: is_2fa_enabled
+	//   in: query
+	//   description: whether or not to filter users with the 2fa enabled
+	//   type: boolean
 	// - name: sort
 	//   in: query
 	//   description: sort order of results
@@ -446,12 +450,13 @@ func SearchUsers(ctx *context.APIContext) {
 	}
 
 	users, maxResults, err := user_model.SearchUsers(ctx, &user_model.SearchUserOptions{
-		Actor:       ctx.Doer,
-		Type:        user_model.UserTypeIndividual,
-		LoginName:   ctx.FormTrim("login_name"),
-		SourceID:    sourceID,
-		OrderBy:     utils.GetDbSearchOrder(ctx),
-		ListOptions: listOptions,
+		Actor:              ctx.Doer,
+		Type:               user_model.UserTypeIndividual,
+		LoginName:          ctx.FormTrim("login_name"),
+		IsTwoFactorEnabled: ctx.FormOptionalBool("is_2fa_enabled"),
+		SourceID:           sourceID,
+		OrderBy:            utils.GetDbSearchOrder(ctx),
+		ListOptions:        listOptions,
 	})
 	if err != nil {
 		ctx.Error(http.StatusInternalServerError, "SearchUsers", err)
diff --git a/routers/api/v1/admin/user_token.go b/routers/api/v1/admin/user_token.go
new file mode 100644
index 0000000000..852c29c69d
--- /dev/null
+++ b/routers/api/v1/admin/user_token.go
@@ -0,0 +1,107 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package admin
+
+import (
+	"forgejo.org/routers/api/v1/utils"
+	"forgejo.org/services/context"
+)
+
+// ListUserAccessTokens lists all access tokens for a given user.
+// This endpoint is admin-only and does not require Basic auth.
+func ListUserAccessTokens(ctx *context.APIContext) {
+	// swagger:operation GET /admin/users/{username}/tokens admin adminListUserAccessTokens
+	// ---
+	// summary: List the specified user's access tokens
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: username
+	//   in: path
+	//   description: username of user
+	//   type: string
+	//   required: true
+	// - name: page
+	//   in: query
+	//   description: page number of results to return (1-based)
+	//   type: integer
+	// - name: limit
+	//   in: query
+	//   description: page size of results
+	//   type: integer
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/AccessTokenList"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	utils.ListAccessTokens(ctx)
+}
+
+// CreateUserAccessToken creates a new access token for a given user.
+// This endpoint is admin-only and does not require Basic auth.
+func CreateUserAccessToken(ctx *context.APIContext) {
+	// swagger:operation POST /admin/users/{username}/tokens admin adminCreateUserAccessToken
+	// ---
+	// summary: Create an access token for the specified user
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: username
+	//   in: path
+	//   description: username of user
+	//   required: true
+	//   type: string
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/CreateAccessTokenOption"
+	// responses:
+	//   "201":
+	//     "$ref": "#/responses/AccessToken"
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	utils.CreateAccessToken(ctx)
+}
+
+// DeleteUserAccessToken deletes an access token for a given user.
+// This endpoint is admin-only and does not require Basic auth.
+func DeleteUserAccessToken(ctx *context.APIContext) {
+	// swagger:operation DELETE /admin/users/{username}/tokens/{token} admin adminDeleteUserAccessToken
+	// ---
+	// summary: Delete an access token for the specified user
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: username
+	//   in: path
+	//   description: username of user
+	//   type: string
+	//   required: true
+	// - name: token
+	//   in: path
+	//   description: token to be deleted, identified by ID and if not available by name
+	//   type: string
+	//   required: true
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/error"
+
+	utils.DeleteAccessToken(ctx)
+}
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index e70db7f2d3..2ec7617215 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -450,9 +450,16 @@ func reqSelfOrAdmin() func(ctx *context.APIContext) {
 	}
 }
 
-// reqAdmin user should be an owner or a collaborator with admin write of a repository, or site admin
-func reqAdmin() func(ctx *context.APIContext) {
+// reqAdmin user should be an owner or a collaborator with admin write of a repository, or site admin. If one or more
+// unitTypes are given, it also requires that at least one the respective unitTypes is enabled.
+func reqAdmin(unitTypes ...unit.Type) func(ctx *context.APIContext) {
 	return func(ctx *context.APIContext) {
+		if len(unitTypes) > 0 && !slices.ContainsFunc(unitTypes, func(unitType unit.Type) bool {
+			return ctx.Repo.Repository.UnitEnabled(ctx, unitType)
+		}) {
+			ctx.NotFound()
+			return
+		}
 		if !ctx.IsUserRepoAdmin() && !ctx.IsUserSiteAdmin() {
 			ctx.Error(http.StatusForbidden, "reqAdmin", "user should be an owner or a collaborator with admin write of a repository")
 			return
@@ -873,31 +880,28 @@ func Routes() *web.Route {
 		if setting.Federation.Enabled {
 			m.Get("/nodeinfo", misc.NodeInfo)
 			m.Group("/activitypub", func() {
-				m.Group("/user-id/{user-id}", func() {
-					m.Get("", activitypub.ReqHTTPSignature(), activitypub.Person)
-					m.Post("/inbox",
-						activitypub.ReqHTTPSignature(),
-						bind(ap.Activity{}),
-						activitypub.PersonInbox)
-					m.Group("/activities/{activity-id}", func() {
-						m.Get("", activitypub.PersonActivityNote)
-						m.Get("/activity", activitypub.PersonActivity)
+				// The instance actor must always be fetchable without signatures
+				m.Get("/actor", activitypub.Actor)
+				m.Group("", func() {
+					m.Group("/actor", func() {
+						m.Post("/inbox", activitypub.ActorInbox)
+						m.Get("/outbox", activitypub.ActorOutbox)
 					})
-					m.Get("/outbox", activitypub.ReqHTTPSignature(), activitypub.PersonFeed)
-				}, context.UserIDAssignmentAPI(), checkTokenPublicOnly())
-				m.Group("/actor", func() {
-					m.Get("", activitypub.Actor)
-					m.Post("/inbox", activitypub.ReqHTTPSignature(), activitypub.ActorInbox)
-					m.Get("/outbox", activitypub.ActorOutbox)
-				})
-				m.Group("/repository-id/{repository-id}", func() {
-					m.Get("", activitypub.ReqHTTPSignature(), activitypub.Repository)
-					m.Post("/inbox",
-						bind(ap.Activity{}),
-						activitypub.ReqHTTPSignature(),
-						activitypub.RepositoryInbox)
-					m.Get("/outbox", activitypub.ReqHTTPSignature(), activitypub.RepositoryOutbox)
-				}, context.RepositoryIDAssignmentAPI())
+					m.Group("/user-id/{user-id}", func() {
+						m.Get("", activitypub.Person)
+						m.Post("/inbox", bind(ap.Activity{}), activitypub.PersonInbox)
+						m.Get("/outbox", activitypub.PersonFeed)
+						m.Group("/activities/{activity-id}", func() {
+							m.Get("", activitypub.PersonActivityNote)
+							m.Get("/activity", activitypub.PersonActivity)
+						})
+					}, context.UserIDAssignmentAPI(), checkTokenPublicOnly())
+					m.Group("/repository-id/{repository-id}", func() {
+						m.Get("", activitypub.Repository)
+						m.Post("/inbox", bind(ap.Activity{}), activitypub.RepositoryInbox)
+						m.Get("/outbox", activitypub.RepositoryOutbox)
+					}, context.RepositoryIDAssignmentAPI())
+				}, activitypub.ReqHTTPSignature())
 			}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryActivityPub))
 		}
 
@@ -1035,6 +1039,11 @@ func Routes() *web.Route {
 					m.Delete("", user.Unfollow)
 				}, context.UserAssignmentAPI())
 			})
+			if setting.Federation.Enabled {
+				m.Group("/activitypub", func() {
+					m.Post("/follow", bind(api.APRemoteFollowOption{}), user.ActivityPubFollow)
+				})
+			}
 
 			// (admin:public_key scope)
 			m.Group("/keys", func() {
@@ -1234,9 +1243,18 @@ func Routes() *web.Route {
 				}, reqToken(), reqAdmin())
 				m.Group("/actions", func() {
 					m.Get("/tasks", repo.ListActionTasks)
+					m.Group("/artifacts", func() {
+						m.Get("", repo.ListActionArtifacts)
+						m.Get("/{artifact_id}", repo.GetActionArtifact)
+						m.Delete("/{artifact_id}", reqToken(), reqRepoWriter(unit.TypeActions), repo.DeleteActionArtifact)
+						m.Get("/{artifact_id}/zip", repo.DownloadActionArtifact)
+					})
 					m.Group("/runs", func() {
 						m.Get("", repo.ListActionRuns)
 						m.Get("/{run_id}", repo.GetActionRun)
+						m.Delete("/{run_id}", reqToken(), reqAdmin(unit.TypeActions), repo.DeleteActionRun)
+						m.Get("/{run_id}/jobs", repo.ListActionRunJobs)
+						m.Get("/{run_id}/artifacts", repo.ListActionRunArtifacts)
 					})
 
 					m.Group("/workflows", func() {
@@ -1679,6 +1697,11 @@ func Routes() *web.Route {
 					m.Combo("/emails").
 						Get(admin.ListUserEmails).
 						Delete(bind(api.DeleteEmailOption{}), admin.DeleteUserEmails)
+					m.Group("/tokens", func() {
+						m.Combo("").Get(admin.ListUserAccessTokens).
+							Post(bind(api.CreateAccessTokenOption{}), admin.CreateUserAccessToken)
+						m.Combo("/{id}").Delete(admin.DeleteUserAccessToken)
+					})
 					if setting.Quota.Enabled {
 						m.Group("/quota", func() {
 							m.Get("", admin.GetUserQuota)
diff --git a/routers/api/v1/repo/action.go b/routers/api/v1/repo/action.go
index 63baaf4437..b0c65009c6 100644
--- a/routers/api/v1/repo/action.go
+++ b/routers/api/v1/repo/action.go
@@ -1031,3 +1031,444 @@ func GetActionRun(ctx *context.APIContext) {
 
 	ctx.JSON(http.StatusOK, convert.ToActionRun(ctx, run, ctx.Doer))
 }
+
+// DeleteActionRun removes a completed workflow run.
+func DeleteActionRun(ctx *context.APIContext) {
+	// swagger:operation DELETE /repos/{owner}/{repo}/actions/runs/{run_id} repository DeleteActionRun
+	// ---
+	// summary: Delete a completed workflow run.
+	// description: >
+	//   Remove a particular workflow run. The workflow run must have completed (succeeded, failed, cancelled) for the
+	//   operation to succeed. Otherwise, an error is returned.
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: run_id
+	//   in: path
+	//   description: id of the action run
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "204":
+	//     description: Workflow run has been removed
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	run, err := actions_model.GetRunByID(ctx, ctx.ParamsInt64(":run_id"))
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			ctx.Error(http.StatusNotFound, "GetRunById", err)
+			return
+		}
+
+		ctx.Error(http.StatusInternalServerError, "GetRunByID", err)
+		return
+	}
+
+	if ctx.Repo.Repository.ID != run.RepoID {
+		ctx.Error(http.StatusNotFound, "GetRunById", util.ErrNotExist)
+		return
+	}
+
+	err = actions_service.DeleteRun(ctx, run.ID)
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, "DeleteRun", err)
+		return
+	}
+
+	ctx.Status(http.StatusNoContent)
+}
+
+// ListActionRunJobs return a filtered list of jobs that belong to a single workflow run
+func ListActionRunJobs(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs repository ListActionRunJobs
+	// ---
+	// summary: List jobs of a workflow run
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: run_id
+	//   in: path
+	//   description: ID of the workflow run
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/ActionRunJobList"
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	run, err := actions_model.GetRunByID(ctx, ctx.ParamsInt64(":run_id"))
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			ctx.Error(http.StatusNotFound, "GetRunById", err)
+		} else {
+			ctx.Error(http.StatusInternalServerError, "GetRunByID", err)
+		}
+		return
+	}
+
+	// Action runs lives in its own table, therefore we check that the
+	// run with the requested ID is owned by the repository
+	if ctx.Repo.Repository.ID != run.RepoID {
+		ctx.Error(http.StatusNotFound, "GetRunById", util.ErrNotExist)
+		return
+	}
+
+	jobs, err := actions_model.GetRunJobsByRunID(ctx, run.ID)
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, "GetRunJobsByRunID", err)
+		return
+	}
+
+	response := make([]*api.ActionRunJob, 0, len(jobs))
+	for _, job := range jobs {
+		response = append(response, convert.ToActionRunJob(job))
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+// ListActionArtifacts list artifacts for a repository
+func ListActionArtifacts(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/actions/artifacts repository ListActionArtifacts
+	// ---
+	// summary: List a repository's artifacts
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: name
+	//   in: query
+	//   description: filter by artifact name
+	//   type: string
+	// - name: page
+	//   in: query
+	//   description: page number of results to return (1-based)
+	//   type: integer
+	// - name: limit
+	//   in: query
+	//   description: page size of results, default maximum page size is 50
+	//   type: integer
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/ActionArtifactList"
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+
+	opts := actions_model.FindArtifactsOptions{
+		ListOptions:  utils.GetListOptions(ctx),
+		RepoID:       ctx.Repo.Repository.ID,
+		ArtifactName: ctx.FormString("name"),
+	}
+
+	arts, total, err := actions_model.ListAggregatedArtifacts(ctx, opts)
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, "ListAggregatedArtifacts", err)
+		return
+	}
+
+	repoAPIURL := ctx.Repo.Repository.APIURL()
+
+	entries := make([]*api.ActionArtifact, len(arts))
+	for i, art := range arts {
+		entries[i] = convert.ToActionArtifact(repoAPIURL, art)
+	}
+
+	ctx.SetLinkHeader(int(total), opts.PageSize)
+	ctx.SetTotalCountHeader(total)
+	ctx.JSON(http.StatusOK, entries)
+}
+
+// ListActionRunArtifacts list artifacts for a workflow run
+func ListActionRunArtifacts(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts repository ListActionRunArtifacts
+	// ---
+	// summary: List artifacts of a workflow run
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: run_id
+	//   in: path
+	//   description: ID of the workflow run
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// - name: name
+	//   in: query
+	//   description: filter by artifact name
+	//   type: string
+	// - name: page
+	//   in: query
+	//   description: page number of results to return (1-based)
+	//   type: integer
+	// - name: limit
+	//   in: query
+	//   description: page size of results, default maximum page size is 50
+	//   type: integer
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/ActionArtifactList"
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	runID := ctx.ParamsInt64(":run_id")
+	run, err := actions_model.GetRunByID(ctx, runID)
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			ctx.Error(http.StatusNotFound, "GetRunByID", err)
+		} else {
+			ctx.Error(http.StatusInternalServerError, "GetRunByID", err)
+		}
+		return
+	}
+	if ctx.Repo.Repository.ID != run.RepoID {
+		ctx.Error(http.StatusNotFound, "GetRunByID", util.ErrNotExist)
+		return
+	}
+
+	opts := actions_model.FindArtifactsOptions{
+		ListOptions:  utils.GetListOptions(ctx),
+		RunID:        runID,
+		ArtifactName: ctx.FormString("name"),
+	}
+
+	arts, total, err := actions_model.ListAggregatedArtifacts(ctx, opts)
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, "ListAggregatedArtifacts", err)
+		return
+	}
+
+	repoAPIURL := ctx.Repo.Repository.APIURL()
+
+	entries := make([]*api.ActionArtifact, len(arts))
+	for i, art := range arts {
+		entries[i] = convert.ToActionArtifact(repoAPIURL, art)
+	}
+
+	ctx.SetLinkHeader(int(total), opts.PageSize)
+	ctx.SetTotalCountHeader(total)
+	ctx.JSON(http.StatusOK, entries)
+}
+
+// GetActionArtifact get an artifact by its ID
+func GetActionArtifact(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id} repository GetActionArtifact
+	// ---
+	// summary: Get an artifact by ID
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: artifact_id
+	//   in: path
+	//   description: ID of the artifact
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/ActionArtifact"
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	meta, err := actions_model.GetAggregatedArtifactByID(ctx, ctx.Repo.Repository.ID, ctx.ParamsInt64(":artifact_id"))
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			ctx.Error(http.StatusNotFound, "GetAggregatedArtifactByID", err)
+		} else {
+			ctx.Error(http.StatusInternalServerError, "GetAggregatedArtifactByID", err)
+		}
+		return
+	}
+
+	ctx.JSON(http.StatusOK, convert.ToActionArtifact(ctx.Repo.Repository.APIURL(), meta))
+}
+
+// DownloadActionArtifact download an artifact by its ID
+func DownloadActionArtifact(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/zip repository DownloadActionArtifact
+	// ---
+	// summary: Download an artifact
+	// produces:
+	// - application/zip
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: artifact_id
+	//   in: path
+	//   description: ID of the artifact
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "200":
+	//     description: the artifact archive
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	meta, err := actions_model.GetAggregatedArtifactByID(ctx, ctx.Repo.Repository.ID, ctx.ParamsInt64(":artifact_id"))
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			ctx.Error(http.StatusNotFound, "GetAggregatedArtifactByID", err)
+		} else {
+			ctx.Error(http.StatusInternalServerError, "GetAggregatedArtifactByID", err)
+		}
+		return
+	}
+
+	// Load all artifact rows for this logical artifact
+	artifacts, err := db.Find[actions_model.ActionArtifact](ctx, actions_model.FindArtifactsOptions{
+		RunID:        meta.RunID,
+		ArtifactName: meta.ArtifactName,
+	})
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, "FindArtifacts", err)
+		return
+	}
+
+	for _, art := range artifacts {
+		if art.Status != int64(actions_model.ArtifactStatusUploadConfirmed) {
+			ctx.Error(http.StatusNotFound, "DownloadActionArtifact", errors.New("artifact not confirmed"))
+			return
+		}
+	}
+
+	if err := actions_service.ServeArtifact(ctx.Base, artifacts); err != nil {
+		ctx.Error(http.StatusInternalServerError, "ServeArtifact", err)
+		return
+	}
+}
+
+// DeleteActionArtifact marks an artifact for deletion
+func DeleteActionArtifact(ctx *context.APIContext) {
+	// swagger:operation DELETE /repos/{owner}/{repo}/actions/artifacts/{artifact_id} repository DeleteActionArtifact
+	// ---
+	// summary: Mark an artifact for deletion
+	// description: |
+	//   Marks the artifact for deletion. Storage space will be reclaimed
+	//   asynchronously by a background job.
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: artifact_id
+	//   in: path
+	//   description: ID of the artifact
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "204":
+	//     description: artifact marked for deletion
+	//   "400":
+	//     "$ref": "#/responses/error"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	meta, err := actions_model.GetAggregatedArtifactByID(ctx, ctx.Repo.Repository.ID, ctx.ParamsInt64(":artifact_id"))
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			ctx.Error(http.StatusNotFound, "GetAggregatedArtifactByID", err)
+		} else {
+			ctx.Error(http.StatusInternalServerError, "GetAggregatedArtifactByID", err)
+		}
+		return
+	}
+
+	if err := actions_model.SetArtifactNeedDelete(ctx, meta.RunID, meta.ArtifactName); err != nil {
+		ctx.Error(http.StatusInternalServerError, "SetArtifactNeedDelete", err)
+		return
+	}
+
+	ctx.Status(http.StatusNoContent)
+}
diff --git a/routers/api/v1/repo/commits.go b/routers/api/v1/repo/commits.go
index 4221e59f17..4d89eb182d 100644
--- a/routers/api/v1/repo/commits.go
+++ b/routers/api/v1/repo/commits.go
@@ -135,7 +135,7 @@ func GetAllCommits(ctx *context.APIContext) {
 	//   type: integer
 	// - name: limit
 	//   in: query
-	//   description: page size of results (ignored if used with 'path')
+	//   description: page size of results
 	//   type: integer
 	// - name: not
 	//   in: query
@@ -244,6 +244,7 @@ func GetAllCommits(ctx *context.APIContext) {
 				File:     path,
 				Not:      not,
 				Page:     listOptions.Page,
+				PageSize: listOptions.PageSize,
 			})
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "CommitsByFileAndRange", err)
diff --git a/routers/api/v1/repo/pull.go b/routers/api/v1/repo/pull.go
index 3c3eb66d5c..37be508512 100644
--- a/routers/api/v1/repo/pull.go
+++ b/routers/api/v1/repo/pull.go
@@ -90,6 +90,14 @@ func ListPullRequests(ctx *context.APIContext) {
 	//   in: query
 	//   description: Filter by pull request author
 	//   type: string
+	// - name: base
+	//   in: query
+	//   description: Filter by base branch name
+	//   type: string
+	// - name: head
+	//   in: query
+	//   description: Filter by head branch name
+	//   type: string
 	// - name: page
 	//   in: query
 	//   description: Page number of results to return (1-based)
@@ -137,6 +145,8 @@ func ListPullRequests(ctx *context.APIContext) {
 		Labels:      labelIDs,
 		MilestoneID: ctx.FormInt64("milestone"),
 		PosterID:    posterID,
+		BaseBranch:  ctx.FormTrim("base"),
+		HeadBranch:  ctx.FormTrim("head"),
 	})
 	if err != nil {
 		ctx.Error(http.StatusInternalServerError, "PullRequests", err)
@@ -922,7 +932,8 @@ func MergePullRequest(ctx *context.APIContext) {
 		}
 	}
 
-	manuallyMerged := repo_model.MergeStyle(form.Do) == repo_model.MergeStyleManuallyMerged
+	mergeStyle := repo_model.MergeStyle(form.Do)
+	manuallyMerged := mergeStyle == repo_model.MergeStyleManuallyMerged
 
 	mergeCheckType := pull_service.MergeCheckTypeGeneral
 	if form.MergeWhenChecksSucceed {
@@ -933,7 +944,7 @@ func MergePullRequest(ctx *context.APIContext) {
 	}
 
 	// start with merging by checking
-	if err := pull_service.CheckPullMergeable(ctx, ctx.Doer, &ctx.Repo.Permission, pr, mergeCheckType, form.ForceMerge); err != nil {
+	if err := pull_service.CheckPullMergeable(ctx, ctx.Doer, &ctx.Repo.Permission, pr, mergeCheckType, form.ForceMerge, mergeStyle); err != nil {
 		if errors.Is(err, pull_service.ErrIsClosed) {
 			ctx.NotFound()
 		} else if errors.Is(err, pull_service.ErrUserNotAllowedToMerge) {
diff --git a/routers/api/v1/repo/pull_review.go b/routers/api/v1/repo/pull_review.go
index 97c5dcee78..e28c1edafc 100644
--- a/routers/api/v1/repo/pull_review.go
+++ b/routers/api/v1/repo/pull_review.go
@@ -337,6 +337,8 @@ func CreatePullReviewComment(ctx *context.APIContext) {
 		pr.Issue,
 		opts.Body,
 		opts.Path,
+		pr.MergeBase,
+		review.CommitID,
 		line,
 		review.ID,
 		nil,
@@ -508,6 +510,7 @@ func CreatePullReview(ctx *context.APIContext) {
 			c.Path,
 			true, // pending review
 			0,    // no reply
+			pr.MergeBase,
 			opts.CommitID,
 			nil,
 		); err != nil {
diff --git a/routers/api/v1/shared/runners.go b/routers/api/v1/shared/runners.go
index 21021e4076..6c99630ae1 100644
--- a/routers/api/v1/shared/runners.go
+++ b/routers/api/v1/shared/runners.go
@@ -74,18 +74,7 @@ func fromRunJobModelToResponse(job []*actions_model.ActionRunJob, labels []strin
 	var res []*structs.ActionRunJob
 	for i := range job {
 		if len(labels) == 0 || labels[0] == "" && len(job[i].RunsOn) == 0 || job[i].ItRunsOn(labels) {
-			res = append(res, &structs.ActionRunJob{
-				ID:      job[i].ID,
-				Attempt: job[i].Attempt,
-				Handle:  job[i].Handle,
-				RepoID:  job[i].RepoID,
-				OwnerID: job[i].OwnerID,
-				Name:    job[i].Name,
-				Needs:   job[i].Needs,
-				RunsOn:  job[i].RunsOn,
-				TaskID:  job[i].TaskID,
-				Status:  job[i].Status.String(),
-			})
+			res = append(res, convert.ToActionRunJob(job[i]))
 		}
 	}
 	return res
diff --git a/routers/api/v1/swagger/options.go b/routers/api/v1/swagger/options.go
index 1cc77b319a..7df4d42c34 100644
--- a/routers/api/v1/swagger/options.go
+++ b/routers/api/v1/swagger/options.go
@@ -19,6 +19,9 @@ type swaggerParameterBodies struct {
 	// in:body
 	ForgeLike ffed.ForgeLike
 
+	// in:body
+	APRemoteFollowOption api.APRemoteFollowOption `json:"body"`
+
 	// in:body
 	AddCollaboratorOption api.AddCollaboratorOption
 
diff --git a/routers/api/v1/swagger/repo.go b/routers/api/v1/swagger/repo.go
index 31da865bb5..f93f523d8e 100644
--- a/routers/api/v1/swagger/repo.go
+++ b/routers/api/v1/swagger/repo.go
@@ -526,3 +526,24 @@ type swaggerActionRun struct {
 	// in:body
 	Body api.ActionRun `json:"body"`
 }
+
+// ActionRunJobList
+// swagger:response ActionRunJobList
+type swaggerActionRunJobList struct {
+	// in:body
+	Body []api.ActionRunJob `json:"body"`
+}
+
+// ActionArtifactList
+// swagger:response ActionArtifactList
+type swaggerActionArtifactList struct {
+	// in:body
+	Body []api.ActionArtifact `json:"body"`
+}
+
+// ActionArtifact
+// swagger:response ActionArtifact
+type swaggerActionArtifact struct {
+	// in:body
+	Body api.ActionArtifact `json:"body"`
+}
diff --git a/routers/api/v1/user/app.go b/routers/api/v1/user/app.go
index 8d8ead9234..90d72c76aa 100644
--- a/routers/api/v1/user/app.go
+++ b/routers/api/v1/user/app.go
@@ -5,24 +5,13 @@
 package user
 
 import (
-	"cmp"
-	stdCtx "context"
-	"errors"
-	"fmt"
 	"net/http"
-	"slices"
-	"strconv"
-	"strings"
 
 	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/db"
-	access_model "forgejo.org/models/perm/access"
-	repo_model "forgejo.org/models/repo"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/web"
 	"forgejo.org/routers/api/v1/utils"
-	"forgejo.org/routers/web/shared/user"
-	"forgejo.org/services/authz"
 	"forgejo.org/services/context"
 	"forgejo.org/services/convert"
 )
@@ -56,63 +45,7 @@ func ListAccessTokens(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"
 
-	opts := auth_model.ListAccessTokensOptions{UserID: ctx.ContextUser.ID, ListOptions: utils.GetListOptions(ctx)}
-
-	tokens, count, err := db.FindAndCount[auth_model.AccessToken](ctx, opts)
-	if err != nil {
-		ctx.InternalServerError(err)
-		return
-	}
-
-	// Load all the AccessTokenResourceRepo for the tokens that we're returning:
-	repoModelsByTokenID, err := repo_model.BulkGetRepositoriesForAccessTokens(ctx, tokens,
-		func(repo *repo_model.Repository) (bool, error) {
-			// Repos associated with a repo-specific access token should already be visible to the token owner, but it's
-			// possible that access has changed, such as a removed collaborator on a repo -- don't provide info on that
-			// repo if so.
-			permission, err := access_model.GetUserRepoPermissionWithReducer(ctx, repo, ctx.Doer, ctx.Reducer)
-			if err != nil {
-				return false, err
-			}
-			return permission.HasAccess(), nil
-		})
-	if err != nil {
-		ctx.InternalServerError(err)
-		return
-	}
-	// Convert map[int64]*Repository -> map[int64]*RepositoryMeta...
-	reposByTokenID := make(map[int64][]*api.RepositoryMeta)
-	for tokenID, repoModels := range repoModelsByTokenID {
-		repos := make([]*api.RepositoryMeta, len(repoModels))
-		for i, repo := range repoModels {
-			repos[i] = &api.RepositoryMeta{
-				ID:       repo.ID,
-				Name:     repo.Name,
-				Owner:    repo.OwnerName,
-				FullName: repo.FullName(),
-			}
-		}
-		reposByTokenID[tokenID] = repos
-	}
-
-	apiTokens := make([]*api.AccessToken, len(tokens))
-	for i := range tokens {
-		apiTokens[i] = &api.AccessToken{
-			ID:             tokens[i].ID,
-			Name:           tokens[i].Name,
-			TokenLastEight: tokens[i].TokenLastEight,
-			Scopes:         tokens[i].Scope.StringSlice(),
-			Repositories:   reposByTokenID[tokens[i].ID],
-		}
-		// Provide a consistent sort order on repositories, helpful for test consistency.  Hard to do any earlier
-		// because of the bulk loading maps.
-		slices.SortFunc(apiTokens[i].Repositories, func(a, b *api.RepositoryMeta) int {
-			return cmp.Compare(a.ID, b.ID)
-		})
-	}
-
-	ctx.SetTotalCountHeader(count)
-	ctx.JSON(http.StatusOK, &apiTokens)
+	utils.ListAccessTokens(ctx)
 }
 
 // CreateAccessToken creates an access token
@@ -144,104 +77,7 @@ func CreateAccessToken(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"
 
-	form := web.GetForm(ctx).(*api.CreateAccessTokenOption)
-
-	t := &auth_model.AccessToken{
-		UID:  ctx.ContextUser.ID,
-		Name: form.Name,
-	}
-
-	exist, err := auth_model.AccessTokenByNameExists(ctx, t)
-	if err != nil {
-		ctx.InternalServerError(err)
-		return
-	}
-	if exist {
-		ctx.Error(http.StatusBadRequest, "AccessTokenByNameExists", errors.New("access token name has been used already"))
-		return
-	}
-
-	scope, err := auth_model.AccessTokenScope(strings.Join(form.Scopes, ",")).Normalize()
-	if err != nil {
-		ctx.Error(http.StatusBadRequest, "AccessTokenScope.Normalize", fmt.Errorf("invalid access token scope provided: %w", err))
-		return
-	}
-	if scope == "" {
-		ctx.Error(http.StatusBadRequest, "AccessTokenScope", "access token must have a scope")
-		return
-	}
-	t.Scope = scope
-
-	var resourceRepos []*auth_model.AccessTokenResourceRepo
-	var tokenRepositories []*api.RepositoryMeta
-
-	if form.Repositories != nil {
-		repos := make([]*repo_model.Repository, len(form.Repositories))
-		for i, repoTarget := range form.Repositories {
-			repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, repoTarget.Owner, repoTarget.Name)
-			if err != nil && repo_model.IsErrRepoNotExist(err) {
-				ctx.Error(http.StatusBadRequest, "GetRepositoryByOwnerAndName", fmt.Errorf("repository %s/%s does not exist", repoTarget.Owner, repoTarget.Name))
-				return
-			} else if err != nil {
-				ctx.ServerError("GetRepositoryByOwnerAndName", err)
-				return
-			}
-			permission, err := access_model.GetUserRepoPermissionWithReducer(ctx, repo, ctx.Doer, ctx.Reducer)
-			if err != nil {
-				ctx.ServerError("GetUserRepoPermissionWithReducer", err)
-				return
-			} else if !permission.HasAccess() {
-				// Prevent data existence probing -- ensure this error is the exact same as the !IsErrRepoNotExist case above
-				ctx.Error(http.StatusBadRequest, "GetRepositoryByOwnerAndName", fmt.Errorf("repository %s/%s does not exist", repoTarget.Owner, repoTarget.Name))
-				return
-			}
-			repos[i] = repo
-		}
-
-		for _, repo := range repos {
-			resourceRepos = append(resourceRepos, &auth_model.AccessTokenResourceRepo{RepoID: repo.ID})
-			tokenRepositories = append(tokenRepositories, &api.RepositoryMeta{
-				ID:       repo.ID,
-				Name:     repo.Name,
-				Owner:    repo.OwnerName,
-				FullName: repo.FullName(),
-			})
-		}
-
-		t.ResourceAllRepos = false
-	} else {
-		// token has access to all repository resources
-		t.ResourceAllRepos = true
-	}
-
-	if err := authz.ValidateAccessToken(t, resourceRepos); err != nil {
-		s := user.TranslateAccessTokenValidationError(ctx.Base, err)
-		if has, str := s.Get(); has {
-			ctx.Error(http.StatusBadRequest, "ValidateAccessToken", str)
-			return
-		}
-		ctx.ServerError("ValidateAccessToken", err)
-		return
-	}
-
-	err = db.WithTx(ctx, func(ctx stdCtx.Context) error {
-		if err := auth_model.NewAccessToken(ctx, t); err != nil {
-			return err
-		}
-		return auth_model.InsertAccessTokenResourceRepos(ctx, t.ID, resourceRepos)
-	})
-	if err != nil {
-		ctx.Error(http.StatusInternalServerError, "NewAccessToken", err)
-		return
-	}
-	ctx.JSON(http.StatusCreated, &api.AccessToken{
-		Name:           t.Name,
-		Token:          t.Token,
-		ID:             t.ID,
-		TokenLastEight: t.TokenLastEight,
-		Scopes:         t.Scope.StringSlice(),
-		Repositories:   tokenRepositories,
-	})
+	utils.CreateAccessToken(ctx)
 }
 
 // DeleteAccessToken deletes an access token
@@ -272,45 +108,7 @@ func DeleteAccessToken(ctx *context.APIContext) {
 	//   "422":
 	//     "$ref": "#/responses/error"
 
-	token := ctx.Params(":id")
-	tokenID, _ := strconv.ParseInt(token, 0, 64)
-
-	if tokenID == 0 {
-		tokens, err := db.Find[auth_model.AccessToken](ctx, auth_model.ListAccessTokensOptions{
-			Name:   token,
-			UserID: ctx.ContextUser.ID,
-		})
-		if err != nil {
-			ctx.Error(http.StatusInternalServerError, "ListAccessTokens", err)
-			return
-		}
-
-		switch len(tokens) {
-		case 0:
-			ctx.NotFound()
-			return
-		case 1:
-			tokenID = tokens[0].ID
-		default:
-			ctx.Error(http.StatusUnprocessableEntity, "DeleteAccessTokenByID", fmt.Errorf("multiple matches for token name '%s'", token))
-			return
-		}
-	}
-	if tokenID == 0 {
-		ctx.Error(http.StatusInternalServerError, "Invalid TokenID", nil)
-		return
-	}
-
-	if err := auth_model.DeleteAccessTokenByID(ctx, tokenID, ctx.ContextUser.ID); err != nil {
-		if auth_model.IsErrAccessTokenNotExist(err) {
-			ctx.NotFound()
-		} else {
-			ctx.Error(http.StatusInternalServerError, "DeleteAccessTokenByID", err)
-		}
-		return
-	}
-
-	ctx.Status(http.StatusNoContent)
+	utils.DeleteAccessToken(ctx)
 }
 
 // CreateOauth2Application is the handler to create a new OAuth2 Application for the authenticated user
diff --git a/routers/api/v1/user/follower.go b/routers/api/v1/user/follower.go
index 643ad49b80..508632a6e7 100644
--- a/routers/api/v1/user/follower.go
+++ b/routers/api/v1/user/follower.go
@@ -10,9 +10,11 @@ import (
 
 	user_model "forgejo.org/models/user"
 	api "forgejo.org/modules/structs"
+	"forgejo.org/modules/web"
 	"forgejo.org/routers/api/v1/utils"
 	"forgejo.org/services/context"
 	"forgejo.org/services/convert"
+	"forgejo.org/services/federation"
 )
 
 func responseAPIUsers(ctx *context.APIContext, users []*user_model.User) {
@@ -279,3 +281,33 @@ func Unfollow(ctx *context.APIContext) {
 	}
 	ctx.Status(http.StatusNoContent)
 }
+
+// Follow follow a remote activitypub account
+func ActivityPubFollow(ctx *context.APIContext) {
+	// swagger:operation POST /user/activitypub/follow user userCurrentActivityPubFollow
+	// ---
+	// summary: Follow a remote activitypub account
+	// parameters:
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/APRemoteFollowOption"
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+	//   "401":
+	//     "$ref": "#/responses/unauthorized"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+
+	form := web.GetForm(ctx).(*api.APRemoteFollowOption)
+
+	if err := federation.FollowRemoteActor(ctx, ctx.Doer, form.Target); err != nil {
+		ctx.Error(http.StatusInternalServerError, "federation.FollowRemoteActor", err)
+		return
+	}
+
+	ctx.Status(http.StatusNoContent)
+}
diff --git a/routers/api/v1/utils/access_token.go b/routers/api/v1/utils/access_token.go
new file mode 100644
index 0000000000..a0f6b7449b
--- /dev/null
+++ b/routers/api/v1/utils/access_token.go
@@ -0,0 +1,234 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package utils
+
+import (
+	"cmp"
+	stdCtx "context"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/db"
+	access_model "forgejo.org/models/perm/access"
+	repo_model "forgejo.org/models/repo"
+	api "forgejo.org/modules/structs"
+	"forgejo.org/modules/web"
+	"forgejo.org/routers/web/shared/user"
+	"forgejo.org/services/authz"
+	"forgejo.org/services/context"
+)
+
+// DeleteAccessToken deletes an access token for a user identified by ctx.ContextUser.
+// Shared logic between user and admin token deletion endpoints.
+func DeleteAccessToken(ctx *context.APIContext) {
+	token := ctx.Params(":id")
+	tokenID, _ := strconv.ParseInt(token, 0, 64)
+
+	if tokenID == 0 {
+		tokens, err := db.Find[auth_model.AccessToken](ctx, auth_model.ListAccessTokensOptions{
+			Name:   token,
+			UserID: ctx.ContextUser.ID,
+		})
+		if err != nil {
+			ctx.Error(http.StatusInternalServerError, "ListAccessTokens", err)
+			return
+		}
+
+		switch len(tokens) {
+		case 0:
+			ctx.NotFound()
+			return
+		case 1:
+			tokenID = tokens[0].ID
+		default:
+			ctx.Error(http.StatusUnprocessableEntity, "DeleteAccessTokenByID", fmt.Errorf("multiple matches for token name '%s'", token))
+			return
+		}
+	}
+	if tokenID == 0 {
+		ctx.Error(http.StatusInternalServerError, "Invalid TokenID", nil)
+		return
+	}
+
+	if err := auth_model.DeleteAccessTokenByID(ctx, tokenID, ctx.ContextUser.ID); err != nil {
+		if auth_model.IsErrAccessTokenNotExist(err) {
+			ctx.NotFound()
+		} else {
+			ctx.Error(http.StatusInternalServerError, "DeleteAccessTokenByID", err)
+		}
+		return
+	}
+
+	ctx.Status(http.StatusNoContent)
+}
+
+// ListAccessTokens lists access tokens for a user identified by ctx.ContextUser.
+// Shared logic between user and admin token listing endpoints.
+func ListAccessTokens(ctx *context.APIContext) {
+	opts := auth_model.ListAccessTokensOptions{UserID: ctx.ContextUser.ID, ListOptions: GetListOptions(ctx)}
+
+	tokens, count, err := db.FindAndCount[auth_model.AccessToken](ctx, opts)
+	if err != nil {
+		ctx.InternalServerError(err)
+		return
+	}
+
+	// Load all the AccessTokenResourceRepo for the tokens that we're returning:
+	repoModelsByTokenID, err := repo_model.BulkGetRepositoriesForAccessTokens(ctx, tokens,
+		func(repo *repo_model.Repository) (bool, error) {
+			// Repos associated with a repo-specific access token should already be visible to the token owner, but it's
+			// possible that access has changed, such as a removed collaborator on a repo -- don't provide info on that
+			// repo if so.
+			permission, err := access_model.GetUserRepoPermissionWithReducer(ctx, repo, ctx.Doer, ctx.Reducer)
+			if err != nil {
+				return false, err
+			}
+			return permission.HasAccess(), nil
+		})
+	if err != nil {
+		ctx.InternalServerError(err)
+		return
+	}
+	// Convert map[int64]*Repository -> map[int64]*RepositoryMeta...
+	reposByTokenID := make(map[int64][]*api.RepositoryMeta)
+	for tokenID, repoModels := range repoModelsByTokenID {
+		repos := make([]*api.RepositoryMeta, len(repoModels))
+		for i, repo := range repoModels {
+			repos[i] = &api.RepositoryMeta{
+				ID:       repo.ID,
+				Name:     repo.Name,
+				Owner:    repo.OwnerName,
+				FullName: repo.FullName(),
+			}
+		}
+		reposByTokenID[tokenID] = repos
+	}
+
+	apiTokens := make([]*api.AccessToken, len(tokens))
+	for i := range tokens {
+		apiTokens[i] = &api.AccessToken{
+			ID:             tokens[i].ID,
+			Name:           tokens[i].Name,
+			TokenLastEight: tokens[i].TokenLastEight,
+			Scopes:         tokens[i].Scope.StringSlice(),
+			Repositories:   reposByTokenID[tokens[i].ID],
+		}
+		// Provide a consistent sort order on repositories, helpful for test consistency.  Hard to do any earlier
+		// because of the bulk loading maps.
+		slices.SortFunc(apiTokens[i].Repositories, func(a, b *api.RepositoryMeta) int {
+			return cmp.Compare(a.ID, b.ID)
+		})
+	}
+
+	ctx.SetTotalCountHeader(count)
+	ctx.JSON(http.StatusOK, &apiTokens)
+}
+
+// CreateAccessToken creates an access token for a user identified by ctx.ContextUser.
+// Shared logic between user and admin token creation endpoints.
+func CreateAccessToken(ctx *context.APIContext) {
+	form := web.GetForm(ctx).(*api.CreateAccessTokenOption)
+
+	t := &auth_model.AccessToken{
+		UID:  ctx.ContextUser.ID,
+		Name: form.Name,
+	}
+
+	exist, err := auth_model.AccessTokenByNameExists(ctx, t)
+	if err != nil {
+		ctx.InternalServerError(err)
+		return
+	}
+	if exist {
+		ctx.Error(http.StatusBadRequest, "AccessTokenByNameExists", errors.New("access token name has been used already"))
+		return
+	}
+
+	scope, err := auth_model.AccessTokenScope(strings.Join(form.Scopes, ",")).Normalize()
+	if err != nil {
+		ctx.Error(http.StatusBadRequest, "AccessTokenScope.Normalize", fmt.Errorf("invalid access token scope provided: %w", err))
+		return
+	}
+	if scope == "" {
+		ctx.Error(http.StatusBadRequest, "AccessTokenScope", "access token must have a scope")
+		return
+	}
+	t.Scope = scope
+
+	var resourceRepos []*auth_model.AccessTokenResourceRepo
+	var tokenRepositories []*api.RepositoryMeta
+
+	if form.Repositories != nil {
+		repos := make([]*repo_model.Repository, len(form.Repositories))
+		for i, repoTarget := range form.Repositories {
+			repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, repoTarget.Owner, repoTarget.Name)
+			if err != nil && repo_model.IsErrRepoNotExist(err) {
+				ctx.Error(http.StatusBadRequest, "GetRepositoryByOwnerAndName", fmt.Errorf("repository %s/%s does not exist", repoTarget.Owner, repoTarget.Name))
+				return
+			} else if err != nil {
+				ctx.ServerError("GetRepositoryByOwnerAndName", err)
+				return
+			}
+			permission, err := access_model.GetUserRepoPermissionWithReducer(ctx, repo, ctx.Doer, ctx.Reducer)
+			if err != nil {
+				ctx.ServerError("GetUserRepoPermissionWithReducer", err)
+				return
+			} else if !permission.HasAccess() {
+				// Prevent data existence probing -- ensure this error is the exact same as the !IsErrRepoNotExist case above
+				ctx.Error(http.StatusBadRequest, "GetRepositoryByOwnerAndName", fmt.Errorf("repository %s/%s does not exist", repoTarget.Owner, repoTarget.Name))
+				return
+			}
+			repos[i] = repo
+		}
+
+		for _, repo := range repos {
+			resourceRepos = append(resourceRepos, &auth_model.AccessTokenResourceRepo{RepoID: repo.ID})
+			tokenRepositories = append(tokenRepositories, &api.RepositoryMeta{
+				ID:       repo.ID,
+				Name:     repo.Name,
+				Owner:    repo.OwnerName,
+				FullName: repo.FullName(),
+			})
+		}
+
+		t.ResourceAllRepos = false
+	} else {
+		// token has access to all repository resources
+		t.ResourceAllRepos = true
+	}
+
+	if err := authz.ValidateAccessToken(t, resourceRepos); err != nil {
+		s := user.TranslateAccessTokenValidationError(ctx.Base, err)
+		if has, str := s.Get(); has {
+			ctx.Error(http.StatusBadRequest, "ValidateAccessToken", str)
+			return
+		}
+		ctx.ServerError("ValidateAccessToken", err)
+		return
+	}
+
+	err = db.WithTx(ctx, func(ctx stdCtx.Context) error {
+		if err := auth_model.NewAccessToken(ctx, t); err != nil {
+			return err
+		}
+		return auth_model.InsertAccessTokenResourceRepos(ctx, t.ID, resourceRepos)
+	})
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, "NewAccessToken", err)
+		return
+	}
+	ctx.JSON(http.StatusCreated, &api.AccessToken{
+		Name:           t.Name,
+		Token:          t.Token,
+		ID:             t.ID,
+		TokenLastEight: t.TokenLastEight,
+		Scopes:         t.Scope.StringSlice(),
+		Repositories:   tokenRepositories,
+	})
+}
diff --git a/routers/init.go b/routers/init.go
index 26cf0ace3e..f272d60d63 100644
--- a/routers/init.go
+++ b/routers/init.go
@@ -92,8 +92,6 @@ func syncAppConfForGit(ctx context.Context) error {
 	}
 
 	if updated {
-		log.Info("re-sync repository hooks ...")
-		mustInitCtx(ctx, repo_service.SyncRepositoryHooks)
 		return system.AppState.Set(ctx, runtimeState)
 	}
 	return nil
diff --git a/routers/install/routes_test.go b/routers/install/routes_test.go
index 9b10f05b3b..d4409b36d0 100644
--- a/routers/install/routes_test.go
+++ b/routers/install/routes_test.go
@@ -34,5 +34,5 @@ func TestRoutes(t *testing.T) {
 }
 
 func TestMain(m *testing.M) {
-	unittest.MainTest(m)
+	unittest.MainTest(m, &unittest.TestOptions{IniFileOverride: "install.ini"})
 }
diff --git a/routers/web/admin/config.go b/routers/web/admin/config.go
index 2d3ea78052..c0eae0846b 100644
--- a/routers/web/admin/config.go
+++ b/routers/web/admin/config.go
@@ -148,6 +148,8 @@ func Config(ctx *context.Context) {
 	ctx.Data["DbCfg"] = setting.Database
 	ctx.Data["Webhook"] = setting.Webhook
 	ctx.Data["Moderation"] = setting.Moderation
+	ctx.Data["Federation"] = setting.Federation
+	ctx.Data["FederationMaxSize"] = setting.Federation.MaxSize / 1024 / 1024 // in MiB
 
 	ctx.Data["MailerEnabled"] = false
 	if setting.MailService != nil {
diff --git a/routers/web/admin/federation_host.go b/routers/web/admin/federation_host.go
new file mode 100644
index 0000000000..fa7ac80c30
--- /dev/null
+++ b/routers/web/admin/federation_host.go
@@ -0,0 +1,62 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package admin
+
+import (
+	"net/http"
+
+	"forgejo.org/models/db"
+	"forgejo.org/models/forgefed"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/base"
+	"forgejo.org/modules/setting"
+	"forgejo.org/services/context"
+)
+
+const (
+	tplFederationHost base.TplName = "admin/federation/host"
+)
+
+func FederationHost(ctx *context.Context) {
+	federationHostID := ctx.ParamsInt64("id")
+	page := max(ctx.FormInt("page"), 1)
+
+	host, err := forgefed.GetFederationHost(ctx, federationHostID)
+	if err != nil {
+		ctx.ServerError("GetFederationHost", err)
+		return
+	}
+
+	users, err := user_model.FindFederatedUsersByHostID(ctx, federationHostID, db.ListOptions{
+		PageSize: setting.UI.Admin.FederationUserPagingNum,
+		Page:     page,
+	})
+	if err != nil {
+		ctx.ServerError("FindFederatedUsersByHostID", err)
+		return
+	}
+
+	total, err := user_model.CountFederatedUsersByHostID(ctx, federationHostID)
+	if err != nil {
+		ctx.ServerError("CountFederatedUsersByHostID", err)
+		return
+	}
+
+	ctx.Data["Host"] = host
+	ctx.Data["Users"] = users
+	ctx.Data["UsersTotal"] = int(total)
+	ctx.Data["Title"] = ctx.Tr("admin.federation.hosts.details_panel")
+	ctx.Data["PageIsAdminFederationHosts"] = true
+
+	numPages := 0
+	if total > 0 {
+		numPages = (int(total) - 1/setting.UI.Admin.FederationUserPagingNum)
+	}
+
+	pager := context.NewPagination(int(total), setting.UI.Admin.FederationUserPagingNum, page, numPages)
+	pager.SetDefaultParams(ctx)
+	ctx.Data["Page"] = pager
+
+	ctx.HTML(http.StatusOK, tplFederationHost)
+}
diff --git a/routers/web/admin/federation_hosts.go b/routers/web/admin/federation_hosts.go
new file mode 100644
index 0000000000..a371b2c064
--- /dev/null
+++ b/routers/web/admin/federation_hosts.go
@@ -0,0 +1,55 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package admin
+
+import (
+	"net/http"
+
+	"forgejo.org/models/db"
+	"forgejo.org/models/forgefed"
+	"forgejo.org/modules/base"
+	"forgejo.org/modules/setting"
+	"forgejo.org/services/context"
+)
+
+const (
+	tplFederationHosts base.TplName = "admin/federation/hosts"
+)
+
+func FederationHosts(ctx *context.Context) {
+	sort := ctx.FormTrim("sort")
+	page := max(ctx.FormInt("page"), 1)
+
+	hosts, err := forgefed.FindFederationHosts(ctx, db.ListOptions{
+		Page:     page,
+		PageSize: setting.UI.Admin.FederationHostPagingNum,
+	})
+	if err != nil {
+		ctx.ServerError("GetFederationHosts", err)
+		return
+	}
+
+	total, err := forgefed.CountFederationHosts(ctx)
+	if err != nil {
+		ctx.ServerError("CountFederationHosts", err)
+		return
+	}
+
+	ctx.Data["Title"] = ctx.Tr("admin.federation.hosts.title")
+	ctx.Data["PageIsAdminFederationHosts"] = true
+	ctx.Data["SortType"] = sort
+	ctx.Data["TotalCount"] = int(total)
+	ctx.Data["Hosts"] = hosts
+
+	numPages := 0
+	if total > 0 {
+		numPages = (int(total) - 1/setting.UI.Admin.FederationHostPagingNum)
+	}
+
+	pager := context.NewPagination(int(total), setting.UI.Admin.FederationHostPagingNum, page, numPages)
+	pager.SetDefaultParams(ctx)
+	ctx.Data["Page"] = pager
+
+	ctx.HTML(http.StatusOK, tplFederationHosts)
+}
diff --git a/routers/web/admin/federation_users.go b/routers/web/admin/federation_users.go
new file mode 100644
index 0000000000..f7e89e164f
--- /dev/null
+++ b/routers/web/admin/federation_users.go
@@ -0,0 +1,53 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package admin
+
+import (
+	"net/http"
+
+	"forgejo.org/models/db"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/base"
+	"forgejo.org/modules/setting"
+	"forgejo.org/services/context"
+)
+
+const (
+	tplFederationUsers base.TplName = "admin/federation/users"
+)
+
+func FederationUsers(ctx *context.Context) {
+	page := max(ctx.FormInt("page"), 1)
+
+	users, err := user_model.FindFederatedUsers(ctx, db.ListOptions{
+		Page:     page,
+		PageSize: setting.UI.Admin.FederationUserPagingNum,
+	})
+	if err != nil {
+		ctx.ServerError("FindFederatedUsers", err)
+		return
+	}
+
+	total, err := user_model.CountFederatedUsers(ctx)
+	if err != nil {
+		ctx.ServerError("CountFederatedUsers", err)
+		return
+	}
+
+	ctx.Data["Users"] = users
+	ctx.Data["TotalCount"] = int(total)
+	ctx.Data["Title"] = ctx.Tr("admin.federation.users.title")
+	ctx.Data["PageIsAdminFederationUsers"] = true
+
+	numPages := 0
+	if total > 0 {
+		numPages = (int(total) - 1/setting.UI.Admin.FederationUserPagingNum)
+	}
+
+	pager := context.NewPagination(int(total), setting.UI.Admin.FederationUserPagingNum, page, numPages)
+	pager.SetDefaultParams(ctx)
+	ctx.Data["Page"] = pager
+
+	ctx.HTML(http.StatusOK, tplFederationUsers)
+}
diff --git a/routers/web/admin/queue.go b/routers/web/admin/queue.go
index 03bbfe5af4..377f03450f 100644
--- a/routers/web/admin/queue.go
+++ b/routers/web/admin/queue.go
@@ -84,6 +84,6 @@ func QueueRemoveAllItems(ctx *context.Context) {
 		return
 	}
 
-	ctx.Flash.Success(ctx.Tr("admin.monitor.queue.settings.remove_all_items_done"))
+	ctx.Flash.Success(ctx.Tr("admin.monitor.queue.settings.remove_all_items.success"))
 	ctx.Redirect(setting.AppSubURL + "/admin/monitor/queue/" + strconv.FormatInt(qid, 10))
 }
diff --git a/routers/web/auth/oauth.go b/routers/web/auth/oauth.go
index 201155452a..828027c0a8 100644
--- a/routers/web/auth/oauth.go
+++ b/routers/web/auth/oauth.go
@@ -33,7 +33,6 @@ import (
 	"forgejo.org/modules/util"
 	"forgejo.org/modules/web"
 	"forgejo.org/modules/web/middleware"
-	auth_method "forgejo.org/services/auth/method"
 	source_service "forgejo.org/services/auth/source"
 	"forgejo.org/services/auth/source/oauth2"
 	"forgejo.org/services/context"
@@ -294,7 +293,9 @@ func ifOnlyPublicGroups(scopes string) bool {
 
 // InfoOAuth manages request for userinfo endpoint
 func InfoOAuth(ctx *context.Context) {
-	if ctx.Doer == nil || !ctx.Authentication.IsOAuth2JWTAuthentication() {
+	hasGrantScopes, grantScopes := ctx.Authentication.OAuth2GrantScopes().Get()
+
+	if ctx.Doer == nil || !hasGrantScopes {
 		ctx.Resp.Header().Set("WWW-Authenticate", `Bearer realm=""`)
 		ctx.PlainText(http.StatusUnauthorized, "no valid authorization")
 		return
@@ -308,17 +309,7 @@ func InfoOAuth(ctx *context.Context) {
 		Picture:  ctx.Doer.AvatarLink(ctx),
 	}
 
-	var token string
-	if auHead := ctx.Req.Header.Get("Authorization"); auHead != "" {
-		auths := strings.Fields(auHead)
-		if len(auths) == 2 && (auths[0] == "token" || strings.ToLower(auths[0]) == "bearer") {
-			token = auths[1]
-		}
-	}
-
-	_, grantScopes := auth_method.CheckOAuthAccessToken(ctx, token)
 	onlyPublicGroups := ifOnlyPublicGroups(grantScopes)
-
 	groups, err := getOAuthGroupsForUser(ctx, ctx.Doer, onlyPublicGroups)
 	if err != nil {
 		ctx.ServerError("Oauth groups for user", err)
diff --git a/routers/web/org/members.go b/routers/web/org/members.go
index 3237e23ab9..8a8c5122de 100644
--- a/routers/web/org/members.go
+++ b/routers/web/org/members.go
@@ -5,10 +5,12 @@
 package org
 
 import (
+	"fmt"
 	"net/http"
 
 	"forgejo.org/models"
 	"forgejo.org/models/organization"
+	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/base"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/setting"
@@ -64,8 +66,14 @@ func Members(ctx *context.Context) {
 		ctx.ServerError("GetMembers", err)
 		return
 	}
+	teams, err := organization.FindOrgTeams(ctx, org.ID)
+	if err != nil {
+		ctx.ServerError("GetTeams", err)
+		return
+	}
 	ctx.Data["Page"] = pager
 	ctx.Data["Members"] = members
+	ctx.Data["Teams"] = teams
 	ctx.Data["MembersIsPublicMember"] = membersIsPublic
 	ctx.Data["MembersIsUserOrgOwner"] = organization.IsUserOrgOwner(ctx, members, org.ID)
 	ctx.Data["MembersTwoFaStatus"] = members.GetTwoFaStatus(ctx)
@@ -107,6 +115,59 @@ func MembersAction(ctx *context.Context) {
 			ctx.JSONRedirect(ctx.Org.OrgLink + "/members")
 			return
 		}
+	case "add":
+		if !ctx.Org.IsOwner {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+		uname := ctx.FormString("uname")
+		var u *user_model.User
+		u, err = user_model.GetUserByName(ctx, uname)
+		if err != nil {
+			ctx.ServerError("GetUserByName", err)
+			return
+		}
+
+		if u.IsOrganization() {
+			ctx.Flash.Error(ctx.Tr("form.cannot_add_org_to_team"))
+			ctx.Redirect(ctx.Org.OrgLink + "/members")
+			return
+		}
+
+		alreadyMember, err := ctx.Org.Organization.IsOrgMember(ctx, u.ID)
+		if err != nil {
+			ctx.ServerError("IsOrgMember", err)
+			return
+		}
+		if alreadyMember {
+			ctx.Flash.Error(ctx.Tr("members.user_already_member"))
+			ctx.Redirect(ctx.Org.OrgLink + "/members")
+			return
+		}
+
+		teams, err := organization.FindOrgTeams(ctx, org.ID)
+		if err != nil {
+			ctx.ServerError("GetTeams", err)
+			return
+		}
+		addedToTeam := false
+		for _, team := range teams {
+			addToTeam := ctx.FormBool(fmt.Sprintf("team_%d", team.ID))
+			if addToTeam {
+				err = models.AddTeamMember(ctx, team, u.ID)
+				if err != nil {
+					ctx.ServerError("AddTeamMember", err)
+					return
+				}
+				addedToTeam = true
+			}
+		}
+
+		if !addedToTeam {
+			ctx.Flash.Error(ctx.Tr("members.no_team_selected"))
+		}
+		ctx.Redirect(ctx.Org.OrgLink + "/members")
+		return
 	case "leave":
 		err = models.RemoveOrgUser(ctx, org.ID, ctx.Doer.ID)
 		if err == nil {
diff --git a/routers/web/repo/actions/view.go b/routers/web/repo/actions/view.go
index 63db9d0997..4bd7f12637 100644
--- a/routers/web/repo/actions/view.go
+++ b/routers/web/repo/actions/view.go
@@ -5,13 +5,9 @@
 package actions
 
 import (
-	"archive/zip"
-	"compress/gzip"
-	"context"
 	"errors"
 	"fmt"
 	"html/template"
-	"io"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -28,18 +24,12 @@ import (
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/json"
 	"forgejo.org/modules/log"
-	"forgejo.org/modules/setting"
-	"forgejo.org/modules/storage"
 	"forgejo.org/modules/templates"
-	"forgejo.org/modules/timeutil"
 	"forgejo.org/modules/translation"
 	"forgejo.org/modules/util"
 	"forgejo.org/modules/web"
-	"forgejo.org/routers/common"
 	actions_service "forgejo.org/services/actions"
 	app_context "forgejo.org/services/context"
-
-	"xorm.io/builder"
 )
 
 func RedirectToLatestAttempt(ctx *app_context.Context) {
@@ -178,6 +168,7 @@ type ViewRunInfo struct {
 	CanApprove        bool          `json:"canApprove"` // the run needs an approval and the doer has permission to approve
 	CanRerun          bool          `json:"canRerun"`
 	CanDeleteArtifact bool          `json:"canDeleteArtifact"`
+	CanDelete         bool          `json:"canDelete"`
 	Done              bool          `json:"done"`
 	Jobs              []*ViewJob    `json:"jobs"`
 	Commit            ViewCommit    `json:"commit"`
@@ -298,6 +289,7 @@ func getViewResponse(ctx *app_context.Context, req *ViewRequest, runIndex, jobIn
 	resp.State.Run.CanApprove = run.NeedApproval && ctx.Repo.CanWrite(unit.TypeActions)
 	resp.State.Run.CanRerun = run.CanBeRerun() && ctx.Repo.CanWrite(unit.TypeActions)
 	resp.State.Run.CanDeleteArtifact = run.Status.IsDone() && ctx.Repo.CanWrite(unit.TypeActions)
+	resp.State.Run.CanDelete = run.Status.IsDone() && ctx.IsUserRepoAdmin()
 	resp.State.Run.Jobs = make([]*ViewJob, 0, len(jobs)) // marshal to '[]' instead of 'null' in json
 	resp.State.Run.Status = run.Status.String()
 	resp.State.Run.PreExecutionError = actions_model.TranslatePreExecutionError(ctx.Locale, run)
@@ -314,11 +306,16 @@ func getViewResponse(ctx *app_context.Context, req *ViewRequest, runIndex, jobIn
 			// Ah, another job is still running. Keep the frontend polling enabled then.
 			done = false
 		}
+		canBeRerun, err := v.CanBeRerun(ctx)
+		if err != nil {
+			ctx.Error(http.StatusInternalServerError, err.Error())
+			return nil
+		}
 		resp.State.Run.Jobs = append(resp.State.Run.Jobs, &ViewJob{
 			ID:       v.ID,
 			Name:     v.Name,
 			Status:   v.Status.String(),
-			CanRerun: v.CanBeRerun() && ctx.Repo.CanWrite(unit.TypeActions),
+			CanRerun: canBeRerun && ctx.Repo.CanWrite(unit.TypeActions),
 			Duration: v.Duration().String(),
 		})
 	}
@@ -495,120 +492,48 @@ func Rerun(ctx *app_context.Context) {
 		ctx.Error(http.StatusInternalServerError, err.Error())
 		return
 	}
-	if jobIndexStr == "" && !run.CanBeRerun() {
-		ctx.JSONError(ctx.Locale.Tr("actions.workflow.rerun_impossible"))
-		return
-	}
 
-	// can not rerun job when workflow is disabled
-	cfgUnit := ctx.Repo.Repository.MustGetUnit(ctx, unit.TypeActions)
-	cfg := cfgUnit.ActionsConfig()
-	if cfg.IsWorkflowDisabled(run.WorkflowID) {
-		ctx.JSONError(ctx.Locale.Tr("actions.workflow.disabled"))
-		return
-	}
-
-	// reset run's start and stop time when it is done
-	if run.Status.IsDone() {
-		run.PreviousDuration = run.Duration()
-		run.Started = 0
-		run.Stopped = 0
-		if err := actions_service.UpdateRun(ctx, run, "started", "stopped", "previous_duration"); err != nil {
-			ctx.Error(http.StatusInternalServerError, err.Error())
+	var rerunJobs []*actions_model.ActionRunJob
+	if jobIndexStr == "" { // Rerun the entire workflow.
+		rerunJobs, err = actions_service.RerunAllJobs(ctx, run)
+	} else { // Rerun a single job
+		job, _ := getRunJobs(ctx, runIndex, jobIndex)
+		if ctx.Written() {
 			return
 		}
+		rerunJobs, err = actions_service.RerunJob(ctx, job)
 	}
 
-	job, jobs := getRunJobs(ctx, runIndex, jobIndex)
-	if ctx.Written() {
-		return
-	}
-
-	if jobIndexStr == "" { // rerun all jobs
-		var redirectURL string
-		for _, j := range jobs {
-			if !j.CanBeRerun() {
-				ctx.JSONError(ctx.Locale.Tr("actions.workflow.job_rerun_impossible"))
-				return
-			}
-
-			// if the job has needs, it should be set to "blocked" status to wait for other jobs
-			shouldBlock := len(j.Needs) > 0
-			if err := rerunJob(ctx, j, shouldBlock); err != nil {
-				ctx.Error(http.StatusInternalServerError, err.Error())
-				return
-			}
-			if redirectURL == "" {
-				redirectURL, err = j.HTMLURL(ctx)
-				if err != nil {
-					ctx.Error(http.StatusInternalServerError, err.Error())
-					return
-				}
-			}
+	if err != nil {
+		if errors.Is(err, actions_service.ErrRerunWorkflowInvalid) ||
+			errors.Is(err, actions_service.ErrRerunWorkflowStillRunning) {
+			ctx.JSONError(ctx.Locale.Tr("actions.workflow.rerun_impossible"))
+			return
 		}
-
-		if redirectURL != "" {
-			ctx.JSON(http.StatusOK, &redirectObject{Redirect: redirectURL})
-		} else {
-			ctx.Error(http.StatusInternalServerError, "unable to determine redirectURL for job rerun")
+		if errors.Is(err, actions_service.ErrRerunWorkflowDisabled) {
+			ctx.JSONError(ctx.Locale.Tr("actions.workflow.disabled"))
+			return
 		}
-		return
-	}
-
-	rerunJobs := actions_service.GetAllRerunJobs(job, jobs)
-
-	var redirectURL string
-	for _, j := range rerunJobs {
-		if !j.CanBeRerun() {
+		if errors.Is(err, actions_service.ErrRerunJobStillRunning) {
 			ctx.JSONError(ctx.Locale.Tr("actions.workflow.job_rerun_impossible"))
 			return
 		}
-
-		// jobs other than the specified one should be set to "blocked" status
-		shouldBlock := j.JobID != job.JobID
-		if err := rerunJob(ctx, j, shouldBlock); err != nil {
-			ctx.Error(http.StatusInternalServerError, err.Error())
-			return
-		}
-		if j.JobID == job.JobID {
-			redirectURL, err = j.HTMLURL(ctx)
-			if err != nil {
-				ctx.Error(http.StatusInternalServerError, err.Error())
-				return
-			}
-		}
+		ctx.Error(http.StatusInternalServerError, err.Error())
+		return
 	}
 
-	if redirectURL != "" {
-		ctx.JSON(http.StatusOK, &redirectObject{Redirect: redirectURL})
-	} else {
-		ctx.Error(http.StatusInternalServerError, "unable to determine redirectURL for job rerun")
-	}
-}
-
-func rerunJob(ctx *app_context.Context, job *actions_model.ActionRunJob, shouldBlock bool) error {
-	status := job.Status
-	if !status.IsDone() {
-		return nil
+	if len(rerunJobs) == 0 {
+		ctx.Error(http.StatusInternalServerError, "no jobs were rerun")
+		return
 	}
 
-	initialStatus := actions_model.StatusWaiting
-	if shouldBlock {
-		initialStatus = actions_model.StatusBlocked
-	}
-	if err := job.PrepareNextAttempt(initialStatus); err != nil {
-		return err
+	redirectURL, err := rerunJobs[0].HTMLURL(ctx)
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, err.Error())
+		return
 	}
 
-	if err := db.WithTx(ctx, func(ctx context.Context) error {
-		_, err := actions_service.UpdateRunJob(ctx, job, builder.Eq{"status": status}, "handle", "attempt", "task_id", "status", "started", "stopped")
-		return err
-	}); err != nil {
-		return err
-	}
-
-	actions_service.CreateCommitStatus(ctx, job)
-	return nil
+	ctx.JSON(http.StatusOK, &redirectObject{Redirect: redirectURL})
 }
 
 func Logs(ctx *app_context.Context) {
@@ -664,44 +589,45 @@ func Logs(ctx *app_context.Context) {
 func Cancel(ctx *app_context.Context) {
 	runIndex := ctx.ParamsInt64("run")
 
-	_, jobs := getRunJobs(ctx, runIndex, -1)
-	if ctx.Written() {
+	run, err := actions_model.GetRunByIndex(ctx, ctx.Repo.Repository.ID, runIndex)
+	if err != nil {
+		ctx.Error(http.StatusInternalServerError, err.Error())
 		return
 	}
-
-	if err := db.WithTx(ctx, func(ctx context.Context) error {
-		for _, job := range jobs {
-			status := job.Status
-			if status.IsDone() {
-				continue
-			}
-			if job.TaskID == 0 {
-				job.Status = actions_model.StatusCancelled
-				job.Stopped = timeutil.TimeStampNow()
-				n, err := actions_service.UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
-				if err != nil {
-					return err
-				}
-				if n == 0 {
-					return errors.New("job has changed, try again")
-				}
-				continue
-			}
-			if err := actions_service.StopTask(ctx, job.TaskID, actions_model.StatusCancelled); err != nil {
-				return err
-			}
-		}
-		return nil
-	}); err != nil {
+	if err := actions_service.CancelRun(ctx, run); err != nil {
 		ctx.Error(http.StatusInternalServerError, err.Error())
 		return
 	}
 
-	actions_service.CreateCommitStatus(ctx, jobs...)
-
 	ctx.JSON(http.StatusOK, struct{}{})
 }
 
+func DeleteRun(ctx *app_context.Context) {
+	runIndex := ctx.ParamsInt64("run")
+
+	run, err := actions_model.GetRunByIndex(ctx, ctx.Repo.Repository.ID, runIndex)
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			log.Debug("Run at index %d in repository %d does not exist", runIndex, ctx.Repo.Repository.ID)
+			ctx.JSONOK()
+			return
+		}
+
+		log.Debug("Could not load run at index %d in repository %d: %s", runIndex, ctx.Repo.Repository.ID, err)
+		errorMessage := ctx.Locale.Tr("actions.runs.delete.error_could_not_load_run")
+		ctx.JSON(http.StatusInternalServerError, map[string]any{"message": errorMessage})
+		return
+	}
+	if err = actions_service.DeleteRun(ctx, run.ID); err != nil {
+		log.Debug("Could not delete run %d: %s", run.ID, err)
+		errorMessage := ctx.Locale.Tr("actions.runs.delete.error_could_not_delete_run")
+		ctx.JSON(http.StatusInternalServerError, map[string]any{"message": errorMessage})
+		return
+	}
+
+	ctx.JSONOK()
+}
+
 // getRunJobs gets the jobs of runIndex, and returns jobs[jobIndex], jobs.
 // Any error will be written to the ctx.
 // It never returns a nil job of an empty jobs, if the jobIndex is out of range, it will be treated as 0.
@@ -885,7 +811,6 @@ func ArtifactsDownloadView(ctx *app_context.Context) {
 		return
 	}
 
-	// if artifacts status is not uploaded-confirmed, treat it as not found
 	for _, art := range artifacts {
 		if art.Status != int64(actions_model.ArtifactStatusUploadConfirmed) {
 			ctx.Error(http.StatusNotFound, "artifact not found")
@@ -893,63 +818,10 @@ func ArtifactsDownloadView(ctx *app_context.Context) {
 		}
 	}
 
-	// Artifacts using the v4 backend are stored as a single combined zip file per artifact on the backend
-	// The v4 backend ensures ContentEncoding is set to "application/zip", which is not the case for the old backend
-	if len(artifacts) == 1 && artifacts[0].ArtifactName+".zip" == artifacts[0].ArtifactPath && artifacts[0].ContentEncoding == "application/zip" {
-		art := artifacts[0]
-		if setting.Actions.ArtifactStorage.MinioConfig.ServeDirect {
-			u, err := storage.ActionsArtifacts.URL(art.StoragePath, art.ArtifactPath, nil)
-
-			if u != nil && err == nil {
-				ctx.Redirect(u.String())
-				return
-			}
-		}
-		f, err := storage.ActionsArtifacts.Open(art.StoragePath)
-		if err != nil {
-			ctx.Error(http.StatusInternalServerError, err.Error())
-			return
-		}
-		common.ServeContentByReadSeeker(ctx.Base, artifacts[0].ArtifactName+".zip", util.ToPointer(art.UpdatedUnix.AsTime()), f)
+	if err := actions_service.ServeArtifact(ctx.Base, artifacts); err != nil {
+		ctx.Error(http.StatusInternalServerError, err.Error())
 		return
 	}
-
-	// Artifacts using the v1-v3 backend are stored as multiple individual files per artifact on the backend
-	// Those need to be zipped for download
-	artifactName := artifacts[0].ArtifactName
-
-	ctx.Resp.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s.zip; filename*=UTF-8''%s.zip", url.PathEscape(artifactName), artifactName))
-	writer := zip.NewWriter(ctx.Resp)
-	defer writer.Close()
-	for _, art := range artifacts {
-		f, err := storage.ActionsArtifacts.Open(art.StoragePath)
-		if err != nil {
-			ctx.Error(http.StatusInternalServerError, err.Error())
-			return
-		}
-
-		var r io.ReadCloser
-		if art.ContentEncoding == "gzip" {
-			r, err = gzip.NewReader(f)
-			if err != nil {
-				ctx.Error(http.StatusInternalServerError, err.Error())
-				return
-			}
-		} else {
-			r = f
-		}
-		defer r.Close()
-
-		w, err := writer.Create(art.ArtifactPath)
-		if err != nil {
-			ctx.Error(http.StatusInternalServerError, err.Error())
-			return
-		}
-		if _, err := io.Copy(w, r); err != nil {
-			ctx.Error(http.StatusInternalServerError, err.Error())
-			return
-		}
-	}
 }
 
 func DisableWorkflowFile(ctx *app_context.Context) {
diff --git a/routers/web/repo/actions/view_test.go b/routers/web/repo/actions/view_test.go
index 04d32f191b..0b66b7f7b8 100644
--- a/routers/web/repo/actions/view_test.go
+++ b/routers/web/repo/actions/view_test.go
@@ -554,7 +554,7 @@ func TestActionsRerun(t *testing.T) {
 			runIndex:     138575,
 			jobIndex:     1,
 			expectedCode: 400,
-			expectedBody: "{\"errorMessage\":\"actions.workflow.job_rerun_impossible\",\"renderFormat\":\"html\"}\n",
+			expectedBody: "{\"errorMessage\":\"actions.workflow.rerun_impossible\",\"renderFormat\":\"html\"}\n",
 		},
 	}
 	for _, tt := range tests {
diff --git a/routers/web/repo/attachment.go b/routers/web/repo/attachment.go
index fbfa8632c9..65be51ba08 100644
--- a/routers/web/repo/attachment.go
+++ b/routers/web/repo/attachment.go
@@ -14,7 +14,6 @@ import (
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/storage"
-	"forgejo.org/modules/util"
 	"forgejo.org/routers/common"
 	"forgejo.org/services/attachment"
 	"forgejo.org/services/context"
@@ -188,7 +187,7 @@ func ServeAttachment(ctx *context.Context, uuid string) {
 	}
 	defer fr.Close()
 
-	common.ServeContentByReadSeeker(ctx.Base, attach.Name, util.ToPointer(attach.CreatedUnix.AsTime()), fr)
+	common.ServeContentByReadSeeker(ctx.Base, attach.Name, new(attach.CreatedUnix.AsTime()), fr)
 }
 
 // GetAttachment serve attachments
diff --git a/routers/web/repo/commit.go b/routers/web/repo/commit.go
index 5b8f35f5b1..082716adbc 100644
--- a/routers/web/repo/commit.go
+++ b/routers/web/repo/commit.go
@@ -45,10 +45,19 @@ const (
 func RefCommits(ctx *context.Context) {
 	switch {
 	case len(ctx.Repo.TreePath) == 0:
+		ctx.Data["TreeNames"] = []string{}
 		Commits(ctx)
 	case ctx.Repo.TreePath == "search":
+		ctx.Data["TreeNames"] = []string{}
 		SearchCommits(ctx)
 	default:
+		treeNames := strings.Split(ctx.Repo.TreePath, "/")
+		paths := make([]string, len(treeNames))
+		for i := range treeNames {
+			paths[i] = strings.Join(treeNames[:i+1], "/")
+		}
+		ctx.Data["TreeNames"] = treeNames
+		ctx.Data["Paths"] = paths
 		FileHistory(ctx)
 	}
 }
@@ -272,6 +281,9 @@ func FileHistory(ctx *context.Context) {
 		}
 	}
 
+	branchLink := ctx.Repo.RepoLink + "/src/" + ctx.Repo.BranchNameSubURL()
+	ctx.Data["BranchLink"] = branchLink
+
 	ctx.Data["Commits"] = git_model.ParseCommitsWithStatus(ctx, commits, ctx.Repo.Repository)
 
 	ctx.Data["Username"] = ctx.Repo.Owner.Name
diff --git a/routers/web/repo/editor.go b/routers/web/repo/editor.go
index fb1aaf042a..5a6e99f8aa 100644
--- a/routers/web/repo/editor.go
+++ b/routers/web/repo/editor.go
@@ -30,6 +30,8 @@ import (
 	"forgejo.org/services/context/upload"
 	"forgejo.org/services/forms"
 	files_service "forgejo.org/services/repository/files"
+
+	"github.com/editorconfig/editorconfig-core-go/v2"
 )
 
 const (
@@ -223,13 +225,22 @@ func editFile(ctx *context.Context, isNewFile bool) {
 	ctx.Data["last_commit"] = ctx.Repo.CommitID
 	ctx.Data["PreviewableExtensions"] = strings.Join(markup.PreviewableExtensions(), ",")
 	ctx.Data["LineWrapExtensions"] = strings.Join(setting.Repository.Editor.LineWrapExtensions, ",")
-	ctx.Data["EditorconfigJson"] = GetEditorConfig(ctx, treePath)
+	ctx.Data["EditorconfigJson"] = GetEditorConfigJSON(ctx, treePath)
 
 	ctx.HTML(http.StatusOK, tplEditFile)
 }
 
-// GetEditorConfig returns a editorconfig JSON string for given treePath or "null"
-func GetEditorConfig(ctx *context.Context, treePath string) string {
+// GetEditorConfig returns a editorconfig object for given treePath or nil
+func GetEditorConfig(ctx *context.Context, treePath string) (ec *editorconfig.Editorconfig) {
+	ec, _, err := ctx.Repo.GetEditorconfig()
+	if err == nil {
+		return ec
+	}
+	return nil
+}
+
+// GetEditorConfigJSON returns a editorconfig JSON string for given treePath or "null"
+func GetEditorConfigJSON(ctx *context.Context, treePath string) string {
 	ec, _, err := ctx.Repo.GetEditorconfig()
 	if err == nil {
 		def, err := ec.GetDefinitionForFilename(treePath)
@@ -274,7 +285,7 @@ func editFilePost(ctx *context.Context, form forms.EditRepoFileForm, isNewFile b
 	ctx.Data["last_commit"] = ctx.Repo.CommitID
 	ctx.Data["PreviewableExtensions"] = strings.Join(markup.PreviewableExtensions(), ",")
 	ctx.Data["LineWrapExtensions"] = strings.Join(setting.Repository.Editor.LineWrapExtensions, ",")
-	ctx.Data["EditorconfigJson"] = GetEditorConfig(ctx, form.TreePath)
+	ctx.Data["EditorconfigJson"] = GetEditorConfigJSON(ctx, form.TreePath)
 
 	if ctx.HasError() {
 		ctx.HTML(http.StatusOK, tplEditFile)
@@ -458,6 +469,7 @@ func DiffPreviewPost(ctx *context.Context) {
 		return
 	}
 	ctx.Data["File"] = diff.Files[0]
+	ctx.Data["Editorconfig"] = GetEditorConfig(ctx, treePath)
 
 	ctx.HTML(http.StatusOK, tplEditDiffPreview)
 }
diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go
index bb4185f785..e1ee785ce4 100644
--- a/routers/web/repo/issue.go
+++ b/routers/web/repo/issue.go
@@ -604,7 +604,7 @@ func retrieveProjects(ctx *context.Context, repo *repo_model.Repository) {
 		repoOwnerType = project_model.TypeOrganization
 	}
 	var err error
-	projects, err := db.Find[project_model.Project](ctx, project_model.SearchOptions{
+	repositoryProjects, err := db.Find[project_model.Project](ctx, project_model.SearchOptions{
 		ListOptions: db.ListOptionsAll,
 		RepoID:      repo.ID,
 		IsClosed:    optional.Some(false),
@@ -614,7 +614,7 @@ func retrieveProjects(ctx *context.Context, repo *repo_model.Repository) {
 		ctx.ServerError("GetProjects", err)
 		return
 	}
-	projects2, err := db.Find[project_model.Project](ctx, project_model.SearchOptions{
+	ownerProjects, err := db.Find[project_model.Project](ctx, project_model.SearchOptions{
 		ListOptions: db.ListOptionsAll,
 		OwnerID:     repo.OwnerID,
 		IsClosed:    optional.Some(false),
@@ -625,9 +625,10 @@ func retrieveProjects(ctx *context.Context, repo *repo_model.Repository) {
 		return
 	}
 
-	ctx.Data["OpenProjects"] = append(projects, projects2...)
+	ownerHasOpenProjects := len(ownerProjects) > 0
+	ctx.Data["OpenProjects"] = append(repositoryProjects, ownerProjects...)
 
-	projects, err = db.Find[project_model.Project](ctx, project_model.SearchOptions{
+	repositoryProjects, err = db.Find[project_model.Project](ctx, project_model.SearchOptions{
 		ListOptions: db.ListOptionsAll,
 		RepoID:      repo.ID,
 		IsClosed:    optional.Some(true),
@@ -637,7 +638,7 @@ func retrieveProjects(ctx *context.Context, repo *repo_model.Repository) {
 		ctx.ServerError("GetProjects", err)
 		return
 	}
-	projects2, err = db.Find[project_model.Project](ctx, project_model.SearchOptions{
+	ownerProjects, err = db.Find[project_model.Project](ctx, project_model.SearchOptions{
 		ListOptions: db.ListOptionsAll,
 		OwnerID:     repo.OwnerID,
 		IsClosed:    optional.Some(true),
@@ -648,7 +649,8 @@ func retrieveProjects(ctx *context.Context, repo *repo_model.Repository) {
 		return
 	}
 
-	ctx.Data["ClosedProjects"] = append(projects, projects2...)
+	ctx.Data["OwnerHasProjects"] = ownerHasOpenProjects || len(ownerProjects) > 0
+	ctx.Data["ClosedProjects"] = append(repositoryProjects, ownerProjects...)
 }
 
 // repoReviewerSelection items to bee shown
@@ -968,6 +970,14 @@ func NewIssue(ctx *context.Context) {
 
 	isProjectsEnabled := ctx.Repo.CanRead(unit.TypeProjects)
 	ctx.Data["IsProjectsEnabled"] = isProjectsEnabled
+
+	// Individuals always have projects unit enabled
+	isOwnerProjectsEnabled := true
+	if ctx.Repo.Owner.IsOrganization() {
+		isOwnerProjectsEnabled = ctx.Org.CanReadUnit(ctx, unit.TypeProjects)
+	}
+	ctx.Data["IsOwnerProjectsEnabled"] = isOwnerProjectsEnabled
+
 	ctx.Data["IsAttachmentEnabled"] = setting.Attachment.Enabled
 	upload.AddUploadContext(ctx, "comment")
 
@@ -983,7 +993,7 @@ func NewIssue(ctx *context.Context) {
 	}
 
 	projectID := ctx.FormInt64("project")
-	if projectID > 0 && isProjectsEnabled {
+	if projectID > 0 && (isProjectsEnabled || isOwnerProjectsEnabled) {
 		project, err := project_model.GetProjectByID(ctx, projectID)
 		if err != nil {
 			log.Error("GetProjectByID: %d: %v", projectID, err)
@@ -1276,9 +1286,9 @@ func NewIssuePost(ctx *context.Context) {
 	}
 
 	if projectID > 0 {
-		if !ctx.Repo.CanRead(unit.TypeProjects) {
+		if !ctx.Repo.CanRead(unit.TypeProjects) || (ctx.ContextUser.IsOrganization() && !ctx.Org.CanReadUnit(ctx, unit.TypeProjects)) {
 			// User must also be able to see the project.
-			ctx.Error(http.StatusBadRequest, "user hasn't permissions to read projects")
+			ctx.Error(http.StatusForbidden, "user doesn't have permissions to read projects")
 			return
 		}
 		if err := issues_model.IssueAssignOrRemoveProject(ctx, issue, ctx.Doer, projectID, 0); err != nil {
@@ -1477,7 +1487,8 @@ func ViewIssue(ctx *context.Context) {
 	}
 
 	ctx.Data["IsModerationEnabled"] = setting.Moderation.Enabled
-	ctx.Data["IsProjectsEnabled"] = ctx.Repo.CanRead(unit.TypeProjects)
+	isProjectsEnabled := ctx.Repo.CanRead(unit.TypeProjects)
+	ctx.Data["IsProjectsEnabled"] = isProjectsEnabled
 	ctx.Data["IsAttachmentEnabled"] = setting.Attachment.Enabled
 	upload.AddUploadContext(ctx, "comment")
 
@@ -1546,6 +1557,7 @@ func ViewIssue(ctx *context.Context) {
 	}
 	ctx.Data["Labels"] = labels
 
+	isOwnerProjectsEnabled := true
 	if repo.Owner.IsOrganization() {
 		orgLabels, err := issues_model.GetLabelsByOrgID(ctx, repo.Owner.ID, ctx.FormString("sort"), db.ListOptions{})
 		if err != nil {
@@ -1553,9 +1565,11 @@ func ViewIssue(ctx *context.Context) {
 			return
 		}
 		ctx.Data["OrgLabels"] = orgLabels
-
 		labels = append(labels, orgLabels...)
+
+		isOwnerProjectsEnabled = ctx.Org.CanReadUnit(ctx, unit.TypeProjects)
 	}
+	ctx.Data["IsOwnerProjectsEnabled"] = isOwnerProjectsEnabled
 
 	hasSelected := false
 	for i := range labels {
@@ -1569,7 +1583,9 @@ func ViewIssue(ctx *context.Context) {
 	// Check milestone and assignee.
 	if ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) {
 		RetrieveRepoMilestonesAndAssignees(ctx, repo)
-		retrieveProjects(ctx, repo)
+		if isProjectsEnabled || isOwnerProjectsEnabled {
+			retrieveProjects(ctx, repo)
+		}
 
 		if ctx.Written() {
 			return
diff --git a/routers/web/repo/issue_test.go b/routers/web/repo/issue_test.go
index 3644dd131f..e2c812084d 100644
--- a/routers/web/repo/issue_test.go
+++ b/routers/web/repo/issue_test.go
@@ -74,6 +74,9 @@ func TestNewIssueValidateProject(t *testing.T) {
 			contexttest.LoadUser(t, ctx, testCase.userID)
 			contexttest.LoadRepo(t, ctx, testCase.repoID)
 			contexttest.LoadGitRepo(t, ctx)
+			if ctx.Repo.Owner.IsOrganization() {
+				contexttest.LoadOrganization(t, ctx, ctx.Repo.Owner.ID)
+			}
 
 			NewIssue(ctx)
 
diff --git a/routers/web/repo/projects.go b/routers/web/repo/projects.go
index 98e4c35fa2..f007dfa7ba 100644
--- a/routers/web/repo/projects.go
+++ b/routers/web/repo/projects.go
@@ -400,7 +400,7 @@ func UpdateIssueProject(ctx *context.Context) {
 		return
 	}
 	if _, err := issues.LoadRepositories(ctx); err != nil {
-		ctx.ServerError("LoadProjects", err)
+		ctx.ServerError("LoadRepositories", err)
 		return
 	}
 
diff --git a/routers/web/repo/pull.go b/routers/web/repo/pull.go
index e9cdfc5ac7..2c5c7f94f3 100644
--- a/routers/web/repo/pull.go
+++ b/routers/web/repo/pull.go
@@ -1027,7 +1027,11 @@ func viewPullFiles(ctx *context.Context, specifiedStartCommit, specifiedEndCommi
 		}
 
 		endCommitID = commitID
-		startCommitID = prInfo.MergeBase
+		if prevCommit != nil {
+			startCommitID = prevCommit.ID.String()
+		} else {
+			startCommitID = prInfo.MergeBase
+		}
 		ctx.Data["IsShowingAllCommits"] = false
 	} else if willShowSpecifiedCommitRange {
 		if len(specifiedEndCommit) > 0 {
@@ -1099,7 +1103,7 @@ func viewPullFiles(ctx *context.Context, specifiedStartCommit, specifiedEndCommi
 		"numberOfViewedFiles": diff.NumViewedFiles,
 	}
 
-	if err = diff.LoadComments(ctx, issue, ctx.Doer, ctx.Data["ShowOutdatedComments"].(bool)); err != nil {
+	if err = diff.LoadComments(ctx, issue, ctx.Doer, ctx.Data["ShowOutdatedComments"].(bool), endCommitID); err != nil {
 		ctx.ServerError("LoadComments", err)
 		return
 	}
@@ -1317,7 +1321,8 @@ func MergePullRequest(ctx *context.Context) {
 	pr.Issue = issue
 	pr.Issue.Repo = ctx.Repo.Repository
 
-	manuallyMerged := repo_model.MergeStyle(form.Do) == repo_model.MergeStyleManuallyMerged
+	mergeStyle := repo_model.MergeStyle(form.Do)
+	manuallyMerged := mergeStyle == repo_model.MergeStyleManuallyMerged
 
 	mergeCheckType := pull_service.MergeCheckTypeGeneral
 	if form.MergeWhenChecksSucceed {
@@ -1328,7 +1333,7 @@ func MergePullRequest(ctx *context.Context) {
 	}
 
 	// start with merging by checking
-	if err := pull_service.CheckPullMergeable(ctx, ctx.Doer, &ctx.Repo.Permission, pr, mergeCheckType, form.ForceMerge); err != nil {
+	if err := pull_service.CheckPullMergeable(ctx, ctx.Doer, &ctx.Repo.Permission, pr, mergeCheckType, form.ForceMerge, mergeStyle); err != nil {
 		switch {
 		case errors.Is(err, pull_service.ErrIsClosed):
 			if issue.IsPull {
diff --git a/routers/web/repo/pull_review.go b/routers/web/repo/pull_review.go
index 941e428039..401f100d84 100644
--- a/routers/web/repo/pull_review.go
+++ b/routers/web/repo/pull_review.go
@@ -44,12 +44,24 @@ func RenderNewCodeCommentForm(ctx *context.Context) {
 	ctx.Data["PageIsPullFiles"] = true
 	ctx.Data["Issue"] = issue
 	ctx.Data["CurrentReview"] = currentReview
-	pullHeadCommitID, err := ctx.Repo.GitRepo.GetRefCommitID(issue.PullRequest.GetGitRefName())
-	if err != nil {
-		ctx.ServerError("GetRefCommitID", err)
-		return
+	afterCommitID := ctx.FormString("after_commit_id")
+	if afterCommitID == "" {
+		afterCommitID, err = ctx.Repo.GitRepo.GetRefCommitID(issue.PullRequest.GetGitRefName())
+		if err != nil {
+			ctx.ServerError("GetRefCommitID", err)
+			return
+		}
 	}
-	ctx.Data["AfterCommitID"] = pullHeadCommitID
+	ctx.Data["AfterCommitID"] = afterCommitID
+	beforeCommitID := ctx.FormString("before_commit_id")
+	if beforeCommitID == "" {
+		if err := issue.LoadPullRequest(ctx); err != nil {
+			ctx.ServerError("LoadPullRequest", err)
+			return
+		}
+		beforeCommitID = issue.PullRequest.MergeBase
+	}
+	ctx.Data["BeforeCommitID"] = beforeCommitID
 	ctx.Data["IsAttachmentEnabled"] = setting.Attachment.Enabled
 	upload.AddUploadContext(ctx, "comment")
 	ctx.HTML(http.StatusOK, tplNewComment)
@@ -109,6 +121,7 @@ func CreateCodeComment(ctx *context.Context) {
 		form.TreePath,
 		pendingReview,
 		form.Reply,
+		form.BeforeCommitID,
 		form.LatestCommitID,
 		attachments,
 	)
diff --git a/routers/web/repo/pull_review_test.go b/routers/web/repo/pull_review_test.go
index 14e6714a63..c068f575dd 100644
--- a/routers/web/repo/pull_review_test.go
+++ b/routers/web/repo/pull_review_test.go
@@ -11,6 +11,7 @@ import (
 	"forgejo.org/models/db"
 	issues_model "forgejo.org/models/issues"
 	"forgejo.org/models/unittest"
+	"forgejo.org/modules/git"
 	"forgejo.org/modules/templates"
 	"forgejo.org/services/context"
 	"forgejo.org/services/contexttest"
@@ -28,6 +29,13 @@ func TestRenderConversation(t *testing.T) {
 	_ = pr.Issue.LoadPoster(db.DefaultContext)
 	_ = pr.Issue.LoadRepo(db.DefaultContext)
 
+	require.NoError(t, pr.LoadHeadRepo(t.Context()))
+	repo, err := git.OpenRepository(t.Context(), pr.HeadRepo.RepoPath())
+	defer repo.Close()
+	require.NoError(t, err)
+	prHeadCommitID, err := repo.GetBranchCommitID(pr.HeadBranch)
+	require.NoError(t, err)
+
 	run := func(name string, cb func(t *testing.T, ctx *context.Context, resp *httptest.ResponseRecorder)) {
 		t.Run(name, func(t *testing.T) {
 			ctx, resp := contexttest.MockContext(t, "/")
@@ -42,7 +50,9 @@ func TestRenderConversation(t *testing.T) {
 
 	var preparedComment *issues_model.Comment
 	run("prepare", func(t *testing.T, ctx *context.Context, resp *httptest.ResponseRecorder) {
-		comment, err := pull.CreateCodeComment(ctx, pr.Issue.Poster, ctx.Repo.GitRepo, pr.Issue, 1, "content", "", false, 0, pr.HeadCommitID, nil)
+		comment, err := pull.CreateCodeComment(ctx, pr.Issue.Poster, ctx.Repo.GitRepo, pr.Issue,
+			1, "content", "", false, 0, pr.MergeBase,
+			prHeadCommitID, nil)
 		require.NoError(t, err)
 
 		comment.Invalidated = true
diff --git a/routers/web/repo/setting/webhook.go b/routers/web/repo/setting/webhook.go
index 9bd4422556..cf28983ba4 100644
--- a/routers/web/repo/setting/webhook.go
+++ b/routers/web/repo/setting/webhook.go
@@ -341,7 +341,7 @@ func checkWebhook(ctx *context.Context) (*ownerRepoCtx, *webhook.Webhook) {
 	var w *webhook.Webhook
 	if orCtx.RepoID > 0 {
 		w, err = webhook.GetWebhookByRepoID(ctx, orCtx.RepoID, ctx.ParamsInt64(":id"))
-	} else if orCtx.OwnerID > 0 {
+	} else if orCtx.OwnerID > 0 { // nosemgrep: forgejo-logic-suspicious-OwnerID-check (system users do not own webhooks)
 		w, err = webhook.GetWebhookByOwnerID(ctx, orCtx.OwnerID, ctx.ParamsInt64(":id"))
 	} else if orCtx.IsAdmin {
 		w, err = webhook.GetSystemOrDefaultWebhook(ctx, ctx.ParamsInt64(":id"))
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 287cd1b6aa..df0255279a 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -120,7 +120,7 @@ func FindReadmeFileInEntries(ctx *context.Context, entries []*git.TreeEntry, try
 			log.Debug("Potential readme file: %s", entry.Name())
 			if readmeFiles[i] == nil || base.NaturalSortLess(readmeFiles[i].Name(), entry.Blob().Name()) {
 				if entry.IsLink() {
-					target, _, err := entry.FollowLinks()
+					target, err := entry.FollowLinks()
 					if err != nil && !git.IsErrBadLink(err) {
 						return "", nil, err
 					} else if target != nil && (target.IsExecutable() || target.IsRegular()) {
@@ -270,7 +270,7 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.TreeEntry) {
 	target := readmeFile
 	if readmeFile != nil && readmeFile.IsLink() {
-		target, _, _ = readmeFile.FollowLinks()
+		target, _ = readmeFile.FollowLinks()
 	}
 	if target == nil {
 		// if findReadmeFile() failed and/or gave us a broken symlink (which it shouldn't)
@@ -398,11 +398,14 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 	ctx.Data["OpenGraphNoDescription"] = true
 
 	if entry.IsLink() {
-		_, link, err := entry.FollowLinks()
+		target, err := entry.FollowLinks()
 		// Errors should be allowed, because this shouldn't
 		// block rendering invalid symlink files.
 		if err == nil {
-			ctx.Data["SymlinkURL"] = ctx.Repo.RepoLink + "/src/" + ctx.Repo.BranchNameSubURL() + "/" + util.PathEscapeSegments(link)
+			targetPath, err := target.Path()
+			if err == nil {
+				ctx.Data["SymlinkURL"] = ctx.Repo.RepoLink + "/src/" + ctx.Repo.BranchNameSubURL() + "/" + util.PathEscapeSegments(targetPath)
+			}
 		}
 	}
 
diff --git a/routers/web/user/profile.go b/routers/web/user/profile.go
index 2a3893f80e..1c5392ba83 100644
--- a/routers/web/user/profile.go
+++ b/routers/web/user/profile.go
@@ -1,6 +1,6 @@
 // Copyright 2015 The Gogs Authors. All rights reserved.
 // Copyright 2019 The Gitea Authors. All rights reserved.
-// Copyright 2023 The Forgejo Authors. All rights reserved.
+// Copyright 2025 The Forgejo Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
 package user
@@ -176,6 +176,28 @@ func prepareUserProfileTabData(ctx *context.Context, showPrivate bool, profileDb
 		} else {
 			ctx.Data["CardsNoneMsg"] = ctx.Tr("followers.outgoing.list.none", ctx.ContextUser.Name)
 		}
+	case "feed":
+		if setting.Federation.Enabled {
+			pagingNum = setting.UI.FeedPagingNum
+			var items []*activities_model.FederatedUserActivity
+			var count int64
+			if ctx.Doer != nil {
+				items, count, err = activities_model.GetFollowingFeeds(ctx,
+					ctx.Doer.ID,
+					activities_model.GetFollowingFeedsOptions{
+						ListOptions: db.ListOptions{
+							PageSize: pagingNum,
+							Page:     page,
+						},
+					})
+				if err != nil {
+					ctx.ServerError("GetFollowingFeeds", err)
+					return
+				}
+			}
+			ctx.Data["FollowingFeeds"] = items
+			total = int(count)
+		}
 	case "activity":
 		// prepare heatmap data
 		if setting.Service.EnableUserHeatmap {
diff --git a/routers/web/web.go b/routers/web/web.go
index eca460a60f..c19ecfd411 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -111,6 +111,12 @@ func buildAuthGroup() *auth_method.Group {
 	group.Add(&auth_method.OAuth2{}) // FIXME: this should be removed and only applied in download and oauth related routers
 	group.Add(&auth_method.Basic{})  // FIXME: this should be removed and only applied in download and git/lfs routers
 
+	// FIXME: extracted from OAuth2 & Basic -- these methods have internal URL filters that should be moved into
+	// middlewares (if we can figure out the right way to do that), similar to the notes on OAuth2 & Basic above.
+	group.Add(&auth_method.AccessToken{})
+	group.Add(&auth_method.ActionRuntimeToken{})
+	group.Add(&auth_method.ActionTaskToken{})
+
 	if setting.Service.EnableReverseProxyAuth {
 		group.Add(&auth_method.ReverseProxy{}) // reverseproxy should before Session, otherwise the header will be ignored if user has login
 	}
@@ -857,6 +863,14 @@ func registerRoutes(m *web.Route) {
 			})
 			m.Post("/abuse_reports/act", admin.PerformAction)
 		}
+
+		if setting.Federation.Enabled {
+			m.Group("/federation", func() {
+				m.Get("/hosts", admin.FederationHosts)
+				m.Get("/users", admin.FederationUsers)
+				m.Get("/hosts/{id}", admin.FederationHost)
+			})
+		}
 	}, adminReq, ctxDataSet("EnableOAuth2", setting.OAuth2.Enabled, "EnablePackages", setting.Packages.Enabled, "EnableModeration", setting.Moderation.Enabled))
 	// ***** END: Admin *****
 
@@ -892,6 +906,29 @@ func registerRoutes(m *web.Route) {
 		}
 	}
 
+	reqRepoOrOwnerProjectReader := func(ctx *context.Context) {
+		unitType := unit.TypeProjects
+		if ctx.ContextUser == nil || ctx.Doer == nil {
+			ctx.NotFound(unitType.String(), nil)
+			return
+		}
+
+		switch {
+		case ctx.ContextUser.IsIndividual():
+			if ctx.Doer.ID == ctx.ContextUser.ID || ctx.Doer.IsAdmin {
+				return
+			}
+		case ctx.ContextUser.IsOrganization():
+			if ctx.Org.Organization.UnitPermission(ctx, ctx.Doer, unitType) >= perm.AccessModeRead {
+				return
+			}
+		default:
+			ctx.NotFound(unitType.String(), nil)
+			return
+		}
+		reqRepoProjectsReader(ctx)
+	}
+
 	individualPermsChecker := func(ctx *context.Context) {
 		// org permissions have been checked in context.OrgAssignment(), but individual permissions haven't been checked.
 		if ctx.ContextUser.IsIndividual() {
@@ -1241,7 +1278,7 @@ func registerRoutes(m *web.Route) {
 		}
 		m.Group("/issues", func() {
 			m.Group("/new", func() {
-				m.Combo("").Get(context.RepoRef(), repo.NewIssue).
+				m.Combo("", context.EnsureOrg()).Get(context.RepoRef(), repo.NewIssue).
 					Post(web.Bind(forms.CreateIssueForm{}), repo.NewIssuePost)
 				m.Get("/choose", context.RepoRef(), repo.NewIssueChooseTemplate)
 			})
@@ -1287,7 +1324,7 @@ func registerRoutes(m *web.Route) {
 
 			m.Post("/labels", reqRepoIssuesOrPullsWriter, repo.UpdateIssueLabel)
 			m.Post("/milestone", reqRepoIssuesOrPullsWriter, repo.UpdateIssueMilestone)
-			m.Post("/projects", reqRepoIssuesOrPullsWriter, reqRepoProjectsReader, repo.UpdateIssueProject)
+			m.Post("/projects", reqRepoIssuesOrPullsWriter, context.EnsureOrg(), reqRepoOrOwnerProjectReader, repo.UpdateIssueProject)
 			m.Post("/assignee", reqRepoIssuesOrPullsWriter, repo.UpdateIssueAssignee)
 			m.Post("/request_review", reqRepoIssuesOrPullsReader, repo.UpdatePullReviewRequest)
 			m.Post("/dismiss_review", reqRepoAdmin, web.Bind(forms.DismissReviewForm{}), repo.DismissReview)
@@ -1413,7 +1450,7 @@ func registerRoutes(m *web.Route) {
 		m.Group("", func() {
 			m.Get("/issues/posters", repo.IssuePosters) // it can't use {type:issues|pulls} because other routes like "/pulls/{index}" has higher priority
 			m.Get("/{type:^(issues|pulls)$}", repo.Issues)
-			m.Get("/{type:^(issues|pulls)$}/{index}", repo.ViewIssue)
+			m.Get("/{type:^(issues|pulls)$}/{index}", context.EnsureOrg(), repo.ViewIssue)
 			m.Group("/{type:^(issues|pulls)$}/{index}/content-history", func() {
 				m.Get("/overview", repo.GetContentHistoryOverview)
 				m.Get("/list", repo.GetContentHistoryList)
@@ -1498,6 +1535,7 @@ func registerRoutes(m *web.Route) {
 						})
 					})
 					m.Post("/cancel", reqRepoActionsWriter, actions.Cancel)
+					m.Post("/delete", reqRepoAdmin, actions.DeleteRun)
 					m.Get("/artifacts", actions.ArtifactsView)
 					m.Get("/artifacts/{artifact_name_or_id}", actions.ArtifactsDownloadView)
 					m.Delete("/artifacts/{artifact_name}", reqRepoActionsWriter, actions.ArtifactsDeleteView)
@@ -1586,7 +1624,7 @@ func registerRoutes(m *web.Route) {
 
 		m.Get("/pulls/posters", repo.PullPosters)
 		m.Group("/pulls/{index}", func() {
-			m.Get("", repo.SetWhitespaceBehavior, repo.GetPullDiffStats, repo.ViewIssue)
+			m.Get("", repo.SetWhitespaceBehavior, repo.GetPullDiffStats, context.EnsureOrg(), repo.ViewIssue)
 			m.Get(".diff", repo.DownloadPullDiff)
 			m.Get(".patch", repo.DownloadPullPatch)
 			m.Group("/commits", func() {
diff --git a/services/actions/TestDeleteJobsOfRun/action_run.yml b/services/actions/TestDeleteJobsOfRun/action_run.yml
new file mode 100644
index 0000000000..e1f2dcc9cf
--- /dev/null
+++ b/services/actions/TestDeleteJobsOfRun/action_run.yml
@@ -0,0 +1,5 @@
+- id: 34901
+  status: 2 # StatusFailure
+
+- id: 34902
+  status: 5 # StatusWaiting
\ No newline at end of file
diff --git a/services/actions/TestDeleteJobsOfRun/action_run_job.yml b/services/actions/TestDeleteJobsOfRun/action_run_job.yml
new file mode 100644
index 0000000000..3cc196d9fe
--- /dev/null
+++ b/services/actions/TestDeleteJobsOfRun/action_run_job.yml
@@ -0,0 +1,7 @@
+- id: 47301
+  run_id: 34901
+  status: 2 # StatusFailure
+
+- id: 47302
+  run_id: 34902
+  status: 5 # StatusWaiting
diff --git a/services/actions/TestDeleteJobsOfRun/action_task.yml b/services/actions/TestDeleteJobsOfRun/action_task.yml
new file mode 100644
index 0000000000..57d0f680b7
--- /dev/null
+++ b/services/actions/TestDeleteJobsOfRun/action_task.yml
@@ -0,0 +1,11 @@
+- id: 87601
+  job_id: 47301
+  log_filename: somebody/somerepo/15631/87601.log.zst
+  log_in_storage: false
+  status: 2 # StatusFailure
+
+- id: 87602
+  job_id: 47302
+  log_filename: somebody/somerepo/15632/87602.log.zst
+  log_in_storage: false
+  status: 5 # StatusWaiting
diff --git a/services/actions/TestDeleteJobsOfRun/action_task_output.yml b/services/actions/TestDeleteJobsOfRun/action_task_output.yml
new file mode 100644
index 0000000000..6244bc9405
--- /dev/null
+++ b/services/actions/TestDeleteJobsOfRun/action_task_output.yml
@@ -0,0 +1,14 @@
+- id: 90041
+  task_id: 87601
+  output_key: one
+  output_value: a
+
+- id: 90042
+  task_id: 87601
+  output_key: two
+  output_value: b
+
+- id: 90043
+  task_id: 87602
+  output_key: three
+  output_value: c
diff --git a/services/actions/TestDeleteJobsOfRun/action_task_step.yml b/services/actions/TestDeleteJobsOfRun/action_task_step.yml
new file mode 100644
index 0000000000..b438f959ba
--- /dev/null
+++ b/services/actions/TestDeleteJobsOfRun/action_task_step.yml
@@ -0,0 +1,9 @@
+- id: 98801
+  name: echo OK
+  task_id: 87601
+  status: 1 # StatusSuccess
+
+- id: 98802
+  name: echo OK
+  task_id: 87602
+  status: 6 # StatusRunning
diff --git a/services/actions/TestDeleteRun/action_artifact.yml b/services/actions/TestDeleteRun/action_artifact.yml
new file mode 100644
index 0000000000..73697d9d69
--- /dev/null
+++ b/services/actions/TestDeleteRun/action_artifact.yml
@@ -0,0 +1,9 @@
+- id: 19401
+  run_id: 34901
+  status: 2 # ArtifactStatusUploadConfirmed
+- id: 19402
+  run_id: 34901
+  status: 1 # ArtifactStatusUploadPending
+- id: 19403
+  run_id: 34902
+  status: 2 # ArtifactStatusUploadConfirmed
diff --git a/services/actions/TestDeleteRun/action_run.yml b/services/actions/TestDeleteRun/action_run.yml
new file mode 100644
index 0000000000..e1f2dcc9cf
--- /dev/null
+++ b/services/actions/TestDeleteRun/action_run.yml
@@ -0,0 +1,5 @@
+- id: 34901
+  status: 2 # StatusFailure
+
+- id: 34902
+  status: 5 # StatusWaiting
\ No newline at end of file
diff --git a/services/actions/TestDeleteRun/action_run_job.yml b/services/actions/TestDeleteRun/action_run_job.yml
new file mode 100644
index 0000000000..3cc196d9fe
--- /dev/null
+++ b/services/actions/TestDeleteRun/action_run_job.yml
@@ -0,0 +1,7 @@
+- id: 47301
+  run_id: 34901
+  status: 2 # StatusFailure
+
+- id: 47302
+  run_id: 34902
+  status: 5 # StatusWaiting
diff --git a/services/actions/TestDeleteRun/action_task.yml b/services/actions/TestDeleteRun/action_task.yml
new file mode 100644
index 0000000000..57d0f680b7
--- /dev/null
+++ b/services/actions/TestDeleteRun/action_task.yml
@@ -0,0 +1,11 @@
+- id: 87601
+  job_id: 47301
+  log_filename: somebody/somerepo/15631/87601.log.zst
+  log_in_storage: false
+  status: 2 # StatusFailure
+
+- id: 87602
+  job_id: 47302
+  log_filename: somebody/somerepo/15632/87602.log.zst
+  log_in_storage: false
+  status: 5 # StatusWaiting
diff --git a/services/actions/TestDeleteRun/action_task_output.yml b/services/actions/TestDeleteRun/action_task_output.yml
new file mode 100644
index 0000000000..6244bc9405
--- /dev/null
+++ b/services/actions/TestDeleteRun/action_task_output.yml
@@ -0,0 +1,14 @@
+- id: 90041
+  task_id: 87601
+  output_key: one
+  output_value: a
+
+- id: 90042
+  task_id: 87601
+  output_key: two
+  output_value: b
+
+- id: 90043
+  task_id: 87602
+  output_key: three
+  output_value: c
diff --git a/services/actions/TestDeleteRun/action_task_step.yml b/services/actions/TestDeleteRun/action_task_step.yml
new file mode 100644
index 0000000000..b438f959ba
--- /dev/null
+++ b/services/actions/TestDeleteRun/action_task_step.yml
@@ -0,0 +1,9 @@
+- id: 98801
+  name: echo OK
+  task_id: 87601
+  status: 1 # StatusSuccess
+
+- id: 98802
+  name: echo OK
+  task_id: 87602
+  status: 6 # StatusRunning
diff --git a/services/actions/TestDeleteTask/action_runner.yml b/services/actions/TestDeleteTask/action_runner.yml
new file mode 100644
index 0000000000..862b715ab6
--- /dev/null
+++ b/services/actions/TestDeleteTask/action_runner.yml
@@ -0,0 +1,6 @@
+- id: 41601
+  uuid: 61a71de6-8127-40c9-a30e-63647e93edad
+  ephemeral: true
+- id: 41602
+  uuid: fae04d20-98ae-4b69-8439-213dac373e19
+  ephemeral: false
\ No newline at end of file
diff --git a/services/actions/TestDeleteTask/action_task.yml b/services/actions/TestDeleteTask/action_task.yml
new file mode 100644
index 0000000000..f9b979f437
--- /dev/null
+++ b/services/actions/TestDeleteTask/action_task.yml
@@ -0,0 +1,16 @@
+- id: 87601
+  log_filename: somebody/somerepo/15631/87601.log.zst
+  log_in_storage: false
+  status: 1 # StatusSuccess
+  runner_id: 41601
+
+- id: 87602
+  log_filename: somebody/somerepo/15632/87602.log.zst
+  log_in_storage: false
+  status: 6 # StatusRunning
+
+- id: 87603
+  log_filename: somebody/somerepo/15631/87603.log.zst
+  log_in_storage: false
+  status: 2 # StatusFailure
+  runner_id: 41602
diff --git a/services/actions/TestDeleteTask/action_task_output.yml b/services/actions/TestDeleteTask/action_task_output.yml
new file mode 100644
index 0000000000..6244bc9405
--- /dev/null
+++ b/services/actions/TestDeleteTask/action_task_output.yml
@@ -0,0 +1,14 @@
+- id: 90041
+  task_id: 87601
+  output_key: one
+  output_value: a
+
+- id: 90042
+  task_id: 87601
+  output_key: two
+  output_value: b
+
+- id: 90043
+  task_id: 87602
+  output_key: three
+  output_value: c
diff --git a/services/actions/TestDeleteTask/action_task_step.yml b/services/actions/TestDeleteTask/action_task_step.yml
new file mode 100644
index 0000000000..8050e4002d
--- /dev/null
+++ b/services/actions/TestDeleteTask/action_task_step.yml
@@ -0,0 +1,14 @@
+- id: 98801
+  name: echo OK
+  task_id: 87601
+  status: 1 # StatusSuccess
+
+- id: 98802
+  name: echo OK
+  task_id: 87602
+  status: 6 # StatusRunning
+
+- id: 98803
+  name: echo OK
+  task_id: 87603
+  status: 2 # StatusFailure
diff --git a/services/actions/TestRerun_RerunAllJobs/action_artifact.yml b/services/actions/TestRerun_RerunAllJobs/action_artifact.yml
new file mode 100644
index 0000000000..58ffe67e8d
--- /dev/null
+++ b/services/actions/TestRerun_RerunAllJobs/action_artifact.yml
@@ -0,0 +1,11 @@
+- id: 59220
+  run_id: 455620
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed
+
+- id: 59230
+  run_id: 455630
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed
\ No newline at end of file
diff --git a/services/actions/TestRerun_RerunAllJobs/action_run.yml b/services/actions/TestRerun_RerunAllJobs/action_run.yml
new file mode 100644
index 0000000000..386a62d926
--- /dev/null
+++ b/services/actions/TestRerun_RerunAllJobs/action_run.yml
@@ -0,0 +1,82 @@
+- id: 455620
+  title: Completed workflow
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: test.yaml
+  workflow_directory: .forgejo/workflows
+  index: 110
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: 1ca7f0f9-81e7-4e27-85eb-b080c33d32d3
+  event: push
+  event_payload: "{}"
+  status: 1 # success
+  version: 4
+  started: 1776279254
+  stopped: 1776279265
+  previous_duration: 0
+  created: 1776263479
+  updated: 1776279265
+
+- id: 455630
+  title: Running workflow
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: test.yaml
+  workflow_directory: .forgejo/workflows
+  index: 111
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  event: push
+  event_payload: "{}"
+  status: 6 # running
+  version: 2
+  started: 1776281360
+  stopped: 0
+  previous_duration: 0
+  created: 1776281359
+  updated: 1776281367
+
+- id: 455640
+  title: Invalid workflow
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: invalid.yaml
+  workflow_directory: .forgejo/workflows
+  index: 112
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: 4055b3488bf960c9c9f5c1eb2d84e346faaad7dc
+  event: push
+  event_payload: "{}"
+  status: 2 # failure
+  version: 2
+  started: 0
+  stopped: 0
+  previous_duration: 0
+  created: 1776282729
+  updated: 1776282729
+  pre_execution_error_code: 1
+  pre_execution_error_details:
+    - "yaml: unmarshal errors:\n  line 7: cannot unmarshal !!map into []*model.Step"
+
+- id: 455650
+  title: Workflow with dependent jobs
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: dependent.yaml
+  workflow_directory: .forgejo/workflows
+  index: 113
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  event: push
+  event_payload: "{}"
+  status: 1 # success
+  version: 2
+  started: 1776331635
+  stopped: 1776331721
+  previous_duration: 0
+  created: 1776331495
+  updated: 1776331721
diff --git a/services/actions/TestRerun_RerunAllJobs/action_run_job.yml b/services/actions/TestRerun_RerunAllJobs/action_run_job.yml
new file mode 100644
index 0000000000..c04717ede9
--- /dev/null
+++ b/services/actions/TestRerun_RerunAllJobs/action_run_job.yml
@@ -0,0 +1,227 @@
+# Jobs of completed workflow run.
+- id: 683880
+  run_id: 455620
+  repo_id: 62
+  owner_id: 2
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  name: caller
+  attempt: 1
+  handle: 7ecf26bd-408d-485f-b162-f349f5fe95bc
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      caller:
+        name: caller
+        runs-on: []
+        if: false
+    __metadata:
+      workflow_call_inputs:
+        greet_target: Mona the Octocat
+      workflow_call_id: d4f799b5a5d27e303ab97a546708c2aca6c1672b3bbc5defa0d73b251bca7955
+  job_id: caller
+  needs: ["caller.callee"]
+  runs_on: []
+  task_id: 0
+  status: 1 # success
+  started: 0
+  stopped: 0
+  created: 1776263479
+  updated: 1776279265
+- id: 683881
+  run_id: 455620
+  repo_id: 62
+  owner_id: 2
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  name: callee
+  attempt: 1
+  handle: 24920992-6701-48cc-872d-d017b33ee90e
+  workflow_payload: |
+    "on":
+      workflow_call:
+        inputs:
+          greet_target:
+            default: Mona the Octocat
+            type: string
+    jobs:
+      caller.callee:
+        name: callee
+        runs-on: ubuntu-latest
+        steps:
+          - run: |
+              echo "Hello ${{ inputs.greet_target }}"
+    __metadata:
+      workflow_call_parent: d4f799b5a5d27e303ab97a546708c2aca6c1672b3bbc5defa0d73b251bca7955
+  job_id: caller.callee
+  needs: null
+  runs_on: ["ubuntu-latest"]
+  task_id: 989
+  status: 1 # success
+  started: 1776279254
+  stopped: 1776279264
+  created: 1776263479
+  updated: 1776279264
+
+# Jobs of running workflow run.
+- id: 683890
+  run_id: 455630
+  repo_id: 62
+  owner_id: 2
+  commit_sha: 41569413fe943e3f4e8e9625e14c1e01d85581af
+  name: caller
+  attempt: 1
+  handle: 0185f661-3b6b-4f49-8a56-f6585c9c396e
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      caller:
+        name: caller
+        runs-on: []
+        if: false
+    __metadata:
+      workflow_call_inputs:
+        greet_target: Mona the Octocat
+      workflow_call_id: d4f799b5a5d27e303ab97a546708c2aca6c1672b3bbc5defa0d73b251bca7955
+  job_id: caller
+  needs: ["caller.callee"]
+  runs_on: []
+  task_id: 0
+  status: 7 # blocked
+  started: 0
+  stopped: 0
+  created: 1776281359
+  updated: 1776281359
+- id: 683891
+  run_id: 455630
+  repo_id: 62
+  owner_id: 2
+  commit_sha: 41569413fe943e3f4e8e9625e14c1e01d85581af
+  name: callee
+  attempt: 1
+  handle: 4ee3bdf7-69f6-4174-9ffd-eb4a250188bc
+  workflow_payload: |
+    "on":
+      workflow_call:
+        inputs:
+          greet_target:
+            default: Mona the Octocat
+            type: string
+    jobs:
+      caller.callee:
+        name: callee
+        runs-on: ubuntu-latest
+        steps:
+          - run: |
+              echo "Hello ${{ inputs.greet_target }}"
+    __metadata:
+      workflow_call_parent: d4f799b5a5d27e303ab97a546708c2aca6c1672b3bbc5defa0d73b251bca7955
+  job_id: caller.callee
+  needs: null
+  runs_on: ["ubuntu-latest"]
+  task_id: 989
+  status: 6 # running
+  started: 1776281360
+  stopped: 0
+  created: 1776281359
+  updated: 1776281367
+
+# Jobs of invalid workflow.
+- id: 683900
+  run_id: 455640
+  repo_id: 62
+  owner_id: 2
+  commit_sha: 4055b3488bf960c9c9f5c1eb2d84e346faaad7dc
+  name: test
+  attempt: 1
+  handle: c60533ff-61b3-4f6f-9788-260911cda6ed
+  workflow_payload: ""
+  job_id:
+  needs: []
+  runs_on: []
+  task_id: 0
+  status: 2 # failure
+  started: 0
+  stopped: 0
+  created: 1776282729
+  updated: 1776282729
+
+# Jobs of workflow with dependent jobs.
+- id: 683910
+  run_id: 455650
+  repo_id: 62
+  owner_id: 2
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  name: lint
+  attempt: 1
+  handle: 0a721b46-36d1-4540-b070-d559cf87515b
+  workflow_payload: |
+    "on":
+        push:
+    jobs:
+        lint:
+            name: lint
+            runs-on: ubuntu-latest
+            steps:
+                - run: echo "Linting"
+  job_id: lint
+  needs: null
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331495
+  stopped: 1776331523
+  created: 1776331495
+  updated: 1776331523
+- id: 683911
+  run_id: 455650
+  repo_id: 62
+  owner_id: 2
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  name: build
+  attempt: 1
+  handle: eec6b880-b013-4426-9361-8a4ad491ae91
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      build:
+        name: build
+        runs-on: ubuntu-latest
+        steps:
+          - run: echo "Building"
+  job_id: build
+  needs: [lint]
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331693
+  stopped: 1776331721
+  created: 1776331495
+  updated: 1776331721
+- id: 683912
+  run_id: 455650
+  repo_id: 62
+  owner_id: 2
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  name: test
+  attempt: 1
+  handle: b6398b81-f644-4f4b-9ed9-0c596c090b2f
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      test:
+        name: test
+        runs-on: ubuntu-latest
+        steps:
+          - run: echo "Testing"
+  job_id: test
+  needs: [build]
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331665
+  stopped: 1776331693
+  created: 1776331495
+  updated: 1776331693
diff --git a/services/actions/TestRerun_RerunJob/action_artifact.yml b/services/actions/TestRerun_RerunJob/action_artifact.yml
new file mode 100644
index 0000000000..5f59c87183
--- /dev/null
+++ b/services/actions/TestRerun_RerunJob/action_artifact.yml
@@ -0,0 +1,11 @@
+- id: 59240
+  run_id: 455640
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed
+
+- id: 59250
+  run_id: 455650
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed
\ No newline at end of file
diff --git a/services/actions/TestRerun_RerunJob/action_run.yml b/services/actions/TestRerun_RerunJob/action_run.yml
new file mode 100644
index 0000000000..bac9eb9531
--- /dev/null
+++ b/services/actions/TestRerun_RerunJob/action_run.yml
@@ -0,0 +1,82 @@
+- id: 455620
+  title: Completed workflow
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: test.yaml
+  workflow_directory: .forgejo/workflows
+  index: 110
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: 1ca7f0f9-81e7-4e27-85eb-b080c33d32d3
+  event: push
+  event_payload: "{}"
+  status: 1 # success
+  version: 4
+  started: 1776279254
+  stopped: 1776279265
+  previous_duration: 0
+  created: 1776263479
+  updated: 1776279265
+
+- id: 455630
+  title: Running workflow
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: test.yaml
+  workflow_directory: .forgejo/workflows
+  index: 111
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  event: push
+  event_payload: "{}"
+  status: 6 # running
+  version: 2
+  started: 1776281360
+  stopped: 0
+  previous_duration: 0
+  created: 1776281359
+  updated: 1776281367
+
+- id: 455640
+  title: Invalid workflow
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: invalid.yaml
+  workflow_directory: .forgejo/workflows
+  index: 112
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: 4055b3488bf960c9c9f5c1eb2d84e346faaad7dc
+  event: push
+  event_payload: "{}"
+  status: 2 # failure
+  version: 2
+  started: 0
+  stopped: 0
+  previous_duration: 0
+  created: 1776282729
+  updated: 1776282729
+  pre_execution_error_code: 1
+  pre_execution_error_details:
+    - "yaml: unmarshal errors:\n  line 7: cannot unmarshal !!map into []*model.Step"
+
+- id: 455650
+  title: Workflow with dependent jobs
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  workflow_id: dependent.yaml
+  workflow_directory: .forgejo/workflows
+  index: 113
+  trigger_user_id: 2
+  ref: refs/heads/main
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  event: push
+  event_payload: "{}"
+  status: 6 # running
+  version: 2
+  started: 1776331635
+  stopped: 0
+  previous_duration: 0
+  created: 1776331495
+  updated: 1776331721
diff --git a/services/actions/TestRerun_RerunJob/action_run_job.yml b/services/actions/TestRerun_RerunJob/action_run_job.yml
new file mode 100644
index 0000000000..7e219e6ffe
--- /dev/null
+++ b/services/actions/TestRerun_RerunJob/action_run_job.yml
@@ -0,0 +1,244 @@
+# Jobs of completed workflow run.
+- id: 683880
+  run_id: 455620
+  repo_id: 62
+  owner_id: 2
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  name: caller
+  attempt: 1
+  handle: 7ecf26bd-408d-485f-b162-f349f5fe95bc
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      caller:
+        name: caller
+        runs-on: []
+        if: false
+    __metadata:
+      workflow_call_inputs:
+        greet_target: Mona the Octocat
+      workflow_call_id: d4f799b5a5d27e303ab97a546708c2aca6c1672b3bbc5defa0d73b251bca7955
+  job_id: caller
+  needs: ["caller.callee"]
+  runs_on: []
+  task_id: 0
+  status: 1 # success
+  started: 0
+  stopped: 0
+  created: 1776263479
+  updated: 1776279265
+- id: 683881
+  run_id: 455620
+  repo_id: 62
+  owner_id: 2
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  name: callee
+  attempt: 1
+  handle: 24920992-6701-48cc-872d-d017b33ee90e
+  workflow_payload: |
+    "on":
+      workflow_call:
+        inputs:
+          greet_target:
+            default: Mona the Octocat
+            type: string
+    jobs:
+      caller.callee:
+        name: callee
+        runs-on: ubuntu-latest
+        steps:
+          - run: |
+              echo "Hello ${{ inputs.greet_target }}"
+    __metadata:
+      workflow_call_parent: d4f799b5a5d27e303ab97a546708c2aca6c1672b3bbc5defa0d73b251bca7955
+  job_id: caller.callee
+  needs: null
+  runs_on: ["ubuntu-latest"]
+  task_id: 989
+  status: 1 # success
+  started: 1776279254
+  stopped: 1776279264
+  created: 1776263479
+  updated: 1776279264
+
+# Jobs of running workflow run.
+- id: 683590
+  run_id: 455630
+  repo_id: 62
+  owner_id: 2
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  name: lint
+  attempt: 1
+  handle: d114a733-b364-4c08-b15d-77b6cc21a616
+  workflow_payload: |
+    "on":
+        push:
+    jobs:
+        lint:
+            name: lint
+            runs-on: ubuntu-latest
+            steps:
+                - run: echo "Linting"
+  job_id: lint
+  needs: null
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331495
+  stopped: 1776331523
+  created: 1776331495
+  updated: 1776331523
+- id: 683591
+  run_id: 455630
+  repo_id: 62
+  owner_id: 2
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  name: build
+  attempt: 1
+  handle: afd58a3e-76e9-467a-9a9d-9d6250fcc905
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      build:
+        name: build
+        runs-on: ubuntu-latest
+        steps:
+          - run: echo "Building"
+  job_id: build
+  needs: [lint]
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331693
+  stopped: 1776331721
+  created: 1776331495
+  updated: 1776331721
+- id: 683592
+  run_id: 455630
+  repo_id: 62
+  owner_id: 2
+  commit_sha: e36900942550acf94ddd8c0a3b91cc0165b4bd02
+  name: test
+  attempt: 1
+  handle: 2d9438cb-5067-4aff-9adb-9c1265fb42d5
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      test:
+        name: test
+        runs-on: ubuntu-latest
+        steps:
+          - run: echo "Testing"
+  job_id: test
+  needs: [build]
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 6 # StatusRunning
+  started: 1776331665
+  stopped: 0
+  created: 1776331495
+  updated: 1776331693
+
+
+# Jobs of invalid workflow.
+- id: 683900
+  run_id: 455640
+  repo_id: 62
+  owner_id: 2
+  commit_sha: 4055b3488bf960c9c9f5c1eb2d84e346faaad7dc
+  name: test
+  attempt: 1
+  handle: c60533ff-61b3-4f6f-9788-260911cda6ed
+  workflow_payload: ""
+  job_id:
+  needs: []
+  runs_on: []
+  task_id: 0
+  status: 2 # failure
+  started: 0
+  stopped: 0
+  created: 1776282729
+  updated: 1776282729
+
+# Jobs of successful workflow run with dependent jobs.
+- id: 683910
+  run_id: 455650
+  repo_id: 62
+  owner_id: 2
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  name: lint
+  attempt: 1
+  handle: 0a721b46-36d1-4540-b070-d559cf87515b
+  workflow_payload: |
+    "on":
+        push:
+    jobs:
+        lint:
+            name: lint
+            runs-on: ubuntu-latest
+            steps:
+                - run: echo "Linting"
+  job_id: lint
+  needs: null
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331495
+  stopped: 1776331523
+  created: 1776331495
+  updated: 1776331523
+- id: 683911
+  run_id: 455650
+  repo_id: 62
+  owner_id: 2
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  name: build
+  attempt: 1
+  handle: eec6b880-b013-4426-9361-8a4ad491ae91
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      build:
+        name: build
+        runs-on: ubuntu-latest
+        steps:
+          - run: echo "Building"
+  job_id: build
+  needs: []
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331693
+  stopped: 1776331721
+  created: 1776331495
+  updated: 1776331721
+- id: 683912
+  run_id: 455650
+  repo_id: 62
+  owner_id: 2
+  commit_sha: ae36c1d75cc82cb9f9e54a86c8137ed05c3bd66e
+  name: test
+  attempt: 1
+  handle: b6398b81-f644-4f4b-9ed9-0c596c090b2f
+  workflow_payload: |
+    "on":
+      push:
+    jobs:
+      test:
+        name: test
+        runs-on: ubuntu-latest
+        steps:
+          - run: echo "Testing"
+  job_id: test
+  needs: [build]
+  runs_on: ["ubuntu-latest"]
+  task_id: 0
+  status: 1 # success
+  started: 1776331665
+  stopped: 1776331693
+  created: 1776331495
+  updated: 1776331693
diff --git a/services/actions/auth.go b/services/actions/auth.go
index c147643504..2b276cc347 100644
--- a/services/actions/auth.go
+++ b/services/actions/auth.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	actions_model "forgejo.org/models/actions"
+	repo_model "forgejo.org/models/repo"
 	"forgejo.org/modules/json"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/setting"
@@ -30,21 +31,24 @@ type AuthorizationTokenClaims struct {
 }
 
 type IDTokenCustomClaims struct {
-	Actor           string `json:"actor"`
-	BaseRef         string `json:"base_ref"`
-	EventName       string `json:"event_name"`
-	HeadRef         string `json:"head_ref"`
-	Ref             string `json:"ref"`
-	RefProtected    string `json:"ref_protected"`
-	RefType         string `json:"ref_type"`
-	Repository      string `json:"repository"`
-	RepositoryOwner string `json:"repository_owner"`
-	RunAttempt      string `json:"run_attempt"`
-	RunID           string `json:"run_id"`
-	RunNumber       string `json:"run_number"`
-	Sha             string `json:"sha"`
-	Workflow        string `json:"workflow"`
-	WorkflowRef     string `json:"workflow_ref"`
+	Actor             string `json:"actor"`
+	ActorID           string `json:"actor_id"`
+	BaseRef           string `json:"base_ref"`
+	EventName         string `json:"event_name"`
+	HeadRef           string `json:"head_ref"`
+	Ref               string `json:"ref"`
+	RefProtected      string `json:"ref_protected"`
+	RefType           string `json:"ref_type"`
+	Repository        string `json:"repository"`
+	RepositoryID      string `json:"repository_id"`
+	RepositoryOwner   string `json:"repository_owner"`
+	RepositoryOwnerID string `json:"repository_owner_id"`
+	RunAttempt        string `json:"run_attempt"`
+	RunID             string `json:"run_id"`
+	RunNumber         string `json:"run_number"`
+	Sha               string `json:"sha"`
+	Workflow          string `json:"workflow"`
+	WorkflowRef       string `json:"workflow_ref"`
 }
 
 type actionsCacheScope struct {
@@ -59,7 +63,7 @@ const (
 	actionsCachePermissionWrite
 )
 
-func CreateAuthorizationToken(task *actions_model.ActionTask, gitGtx map[string]any, enableOpenIDConnect bool) (string, error) {
+func CreateAuthorizationToken(task *actions_model.ActionTask, gitGtx map[string]any, enableOpenIDConnect bool, actionsConfig *repo_model.ActionsConfig) (string, error) {
 	now := time.Now()
 	taskID := task.ID
 	runID := task.Job.RunID
@@ -96,7 +100,16 @@ func CreateAuthorizationToken(task *actions_model.ActionTask, gitGtx map[string]
 		}
 
 		claims.OIDCExtra = oidcExtra
-		claims.OIDCSub = generateOIDCSub(gitGtx)
+
+		switch actionsConfig.OIDCSubjectFormat {
+		case repo_model.OIDCSubjectFormatDefault:
+			claims.OIDCSub = generateOIDCSub(gitGtx)
+		case repo_model.OIDCSubjectFormatLegacyForgejo15:
+			claims.OIDCSub = legacyGenerateOIDCSub(gitGtx)
+		default:
+			return "", fmt.Errorf("unexpected oidc subject format: %q", actionsConfig.OIDCSubjectFormat)
+		}
+
 		claims.Scp = fmt.Sprintf("%s generate_id_token:%s", claims.Scp, runIDJobID)
 	}
 
@@ -120,21 +133,24 @@ func generateOIDCExtra(gitCtx map[string]any) (string, error) {
 	}
 
 	claims := IDTokenCustomClaims{
-		Actor:           ctxVal("actor"),
-		BaseRef:         ctxVal("base_ref"),
-		EventName:       ctxVal("event_name"),
-		HeadRef:         ctxVal("head_ref"),
-		Ref:             ctxVal("ref"),
-		RefProtected:    ctxVal("ref_protected"),
-		RefType:         ctxVal("ref_type"),
-		Repository:      ctxVal("repository"),
-		RepositoryOwner: ctxVal("repository_owner"),
-		RunAttempt:      ctxVal("run_attempt"),
-		RunID:           ctxVal("run_id"),
-		RunNumber:       ctxVal("run_number"),
-		Sha:             ctxVal("sha"),
-		Workflow:        ctxVal("workflow"),
-		WorkflowRef:     ctxVal("workflow_ref"),
+		Actor:             ctxVal("actor"),
+		ActorID:           ctxVal("actor_id"),
+		BaseRef:           ctxVal("base_ref"),
+		EventName:         ctxVal("event_name"),
+		HeadRef:           ctxVal("head_ref"),
+		Ref:               ctxVal("ref"),
+		RefProtected:      ctxVal("ref_protected"),
+		RefType:           ctxVal("ref_type"),
+		Repository:        ctxVal("repository"),
+		RepositoryID:      ctxVal("repository_id"),
+		RepositoryOwner:   ctxVal("repository_owner"),
+		RepositoryOwnerID: ctxVal("repository_owner_id"),
+		RunAttempt:        ctxVal("run_attempt"),
+		RunID:             ctxVal("run_id"),
+		RunNumber:         ctxVal("run_number"),
+		Sha:               ctxVal("sha"),
+		Workflow:          ctxVal("workflow"),
+		WorkflowRef:       ctxVal("workflow_ref"),
 	}
 
 	ret, err := json.Marshal(claims)
@@ -146,6 +162,17 @@ func generateOIDCExtra(gitCtx map[string]any) (string, error) {
 }
 
 func generateOIDCSub(gitCtx map[string]any) string {
+	nameParts := strings.SplitN(gitCtx["repository"].(string), "/", 2)
+	repoName := nameParts[1]
+	switch gitCtx["event_name"] {
+	case "pull_request":
+		return fmt.Sprintf("repo:%s-%s/%s-%s:pull_request", gitCtx["repository_owner"], gitCtx["repository_owner_id"], repoName, gitCtx["repository_id"])
+	default:
+		return fmt.Sprintf("repo:%s-%s/%s-%s:ref:%s", gitCtx["repository_owner"], gitCtx["repository_owner_id"], repoName, gitCtx["repository_id"], gitCtx["ref"])
+	}
+}
+
+func legacyGenerateOIDCSub(gitCtx map[string]any) string {
 	switch gitCtx["event_name"] {
 	case "pull_request":
 		return fmt.Sprintf("repo:%s:pull_request", gitCtx["repository"])
diff --git a/services/actions/auth_test.go b/services/actions/auth_test.go
index 82d4d2efd3..ce75efb655 100644
--- a/services/actions/auth_test.go
+++ b/services/actions/auth_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	actions_model "forgejo.org/models/actions"
+	repo_model "forgejo.org/models/repo"
 	"forgejo.org/modules/json"
 	"forgejo.org/modules/setting"
 
@@ -39,28 +40,32 @@ func TestCreateAuthorizationToken(t *testing.T) {
 			name:                "enableOpenIDConnect true",
 			enableOpenIDConnect: true,
 			gitCtx: map[string]any{
-				"actor":            "user1",
-				"base_ref":         "master",
-				"event_name":       "push",
-				"head_ref":         "master",
-				"ref":              "refs/heads/master",
-				"ref_protected":    "false",
-				"ref_type":         "branch",
-				"repository":       "mpminardi/testing",
-				"repository_owner": "mpminardi",
-				"run_attempt":      "1",
-				"run_id":           "1",
-				"run_number":       "1",
-				"sha":              "pretend-sha",
-				"workflow":         "test.yml",
-				"workflow_ref":     "pretend-ref",
+				"actor":               "user1",
+				"actor_id":            "123",
+				"base_ref":            "master",
+				"event_name":          "push",
+				"head_ref":            "master",
+				"ref":                 "refs/heads/master",
+				"ref_protected":       "false",
+				"ref_type":            "branch",
+				"repository":          "mpminardi/testing",
+				"repository_id":       "456",
+				"repository_owner":    "mpminardi",
+				"repository_owner_id": "789",
+				"run_attempt":         "1",
+				"run_id":              "1",
+				"run_number":          "1",
+				"sha":                 "pretend-sha",
+				"workflow":            "test.yml",
+				"workflow_ref":        "pretend-ref",
 			},
 		},
 	}
 
 	for _, tc := range testcases {
 		t.Run(tc.name, func(t *testing.T) {
-			token, err := CreateAuthorizationToken(task, tc.gitCtx, tc.enableOpenIDConnect)
+			token, err := CreateAuthorizationToken(task, tc.gitCtx, tc.enableOpenIDConnect,
+				&repo_model.ActionsConfig{})
 			require.NoError(t, err)
 			assert.NotEmpty(t, token)
 			claims := jwt.MapClaims{}
@@ -87,7 +92,7 @@ func TestCreateAuthorizationToken(t *testing.T) {
 				assert.Contains(t, scp, "generate_id_token:1:2")
 				oidcSubClaim, ok := claims["oidc_sub"]
 				assert.True(t, ok, "Has oidc_sub claim in jwt token")
-				assert.Equal(t, "repo:mpminardi/testing:ref:refs/heads/master", oidcSubClaim)
+				assert.Equal(t, "repo:mpminardi-789/testing-456:ref:refs/heads/master", oidcSubClaim)
 				oidcExtraClaim, ok := claims["oidc_extra"]
 				assert.True(t, ok, "Has oidc_extra claim in jwt token")
 				val, err := json.Marshal(tc.gitCtx)
@@ -100,6 +105,27 @@ func TestCreateAuthorizationToken(t *testing.T) {
 				_, ok = claims["oidc_extra"]
 				assert.False(t, ok, "Does not have oidc_extra claim in jwt token")
 			}
+
+			token, err = CreateAuthorizationToken(task, tc.gitCtx, tc.enableOpenIDConnect,
+				&repo_model.ActionsConfig{OIDCSubjectFormat: repo_model.OIDCSubjectFormatLegacyForgejo15})
+			require.NoError(t, err)
+			assert.NotEmpty(t, token)
+			claims = jwt.MapClaims{}
+			_, err = jwt.ParseWithClaims(token, claims, func(t *jwt.Token) (any, error) {
+				return setting.GetGeneralTokenSigningSecret(), nil
+			})
+			require.NoError(t, err)
+			if tc.enableOpenIDConnect {
+				oidcSubClaim, ok := claims["oidc_sub"]
+				assert.True(t, ok, "Has oidc_sub claim in jwt token")
+				assert.Equal(t, "repo:mpminardi/testing:ref:refs/heads/master", oidcSubClaim)
+			} else {
+				assert.NotContains(t, scp, "generate_id_token")
+				_, ok := claims["oidc_sub"]
+				assert.False(t, ok, "Does not have oidc_sub claim in jwt token")
+				_, ok = claims["oidc_extra"]
+				assert.False(t, ok, "Does not have oidc_extra claim in jwt token")
+			}
 		})
 	}
 }
@@ -112,7 +138,7 @@ func TestParseAuthorizationToken(t *testing.T) {
 			RunID: 1,
 		},
 	}
-	token, err := CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 	assert.NotEmpty(t, token)
 	headers := http.Header{}
@@ -133,23 +159,26 @@ func TestParseAuthorizationTokenClaims(t *testing.T) {
 		},
 	}
 	gitCtx := map[string]any{
-		"actor":            "user1",
-		"base_ref":         "master",
-		"event_name":       "push",
-		"head_ref":         "master",
-		"ref":              "refs/heads/master",
-		"ref_protected":    "false",
-		"ref_type":         "branch",
-		"repository":       "mpminardi/testing",
-		"repository_owner": "mpminardi",
-		"run_attempt":      "1",
-		"run_id":           "1",
-		"run_number":       "1",
-		"sha":              "pretend-sha",
-		"workflow":         "test.yml",
-		"workflow_ref":     "pretend-ref",
+		"actor":               "user1",
+		"actor_id":            "123",
+		"base_ref":            "master",
+		"event_name":          "push",
+		"head_ref":            "master",
+		"ref":                 "refs/heads/master",
+		"ref_protected":       "false",
+		"ref_type":            "branch",
+		"repository":          "mpminardi/testing",
+		"repository_id":       "456",
+		"repository_owner":    "mpminardi",
+		"repository_owner_id": "789",
+		"run_attempt":         "1",
+		"run_id":              "1",
+		"run_number":          "1",
+		"sha":                 "pretend-sha",
+		"workflow":            "test.yml",
+		"workflow_ref":        "pretend-ref",
 	}
-	token, err := CreateAuthorizationToken(task, gitCtx, true)
+	token, err := CreateAuthorizationToken(task, gitCtx, true, &repo_model.ActionsConfig{OIDCSubjectFormat: repo_model.OIDCSubjectFormatLegacyForgejo15})
 	require.NoError(t, err)
 	assert.NotEmpty(t, token)
 	headers := http.Header{}
@@ -180,6 +209,32 @@ func TestParseAuthorizationTokenNoAuthHeader(t *testing.T) {
 func TestGenerateOIDCSub(t *testing.T) {
 	t.Run("pull_request event", func(t *testing.T) {
 		sub := generateOIDCSub(map[string]any{
+			"event_name":          "pull_request",
+			"repository":          "mpminardi/testing",
+			"ref":                 "refs/heads/master",
+			"repository_owner":    "mpminardi",
+			"repository_owner_id": "123",
+			"repository_id":       "456",
+		})
+		assert.Equal(t, "repo:mpminardi-123/testing-456:pull_request", sub)
+	})
+
+	t.Run("other event", func(t *testing.T) {
+		sub := generateOIDCSub(map[string]any{
+			"event_name":          "random",
+			"repository":          "mpminardi/testing",
+			"ref":                 "refs/heads/master",
+			"repository_owner":    "mpminardi",
+			"repository_owner_id": "123",
+			"repository_id":       "456",
+		})
+		assert.Equal(t, "repo:mpminardi-123/testing-456:ref:refs/heads/master", sub)
+	})
+}
+
+func TestLegacyGenerateOIDCSub(t *testing.T) {
+	t.Run("pull_request event", func(t *testing.T) {
+		sub := legacyGenerateOIDCSub(map[string]any{
 			"event_name": "pull_request",
 			"repository": "mpminardi/testing",
 			"ref":        "refs/heads/master",
@@ -189,7 +244,7 @@ func TestGenerateOIDCSub(t *testing.T) {
 	})
 
 	t.Run("other event", func(t *testing.T) {
-		sub := generateOIDCSub(map[string]any{
+		sub := legacyGenerateOIDCSub(map[string]any{
 			"event_name": "random",
 			"repository": "mpminardi/testing",
 			"ref":        "refs/heads/master",
diff --git a/services/actions/context.go b/services/actions/context.go
index 0313b11031..ecd7f44da2 100644
--- a/services/actions/context.go
+++ b/services/actions/context.go
@@ -6,6 +6,7 @@ package actions
 import (
 	"context"
 	"fmt"
+	"strconv"
 
 	actions_model "forgejo.org/models/actions"
 	"forgejo.org/models/db"
@@ -97,18 +98,21 @@ func GenerateGiteaContext(run *actions_model.ActionRun, job *actions_model.Actio
 	gitContext, _ := githubContextToMap(gitContextObj)
 
 	// standard contexts, see https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
-	gitContext["action_status"] = ""                                    // string, For a composite action, the current result of the composite action.
-	gitContext["actor"] = run.TriggerUser.Name                          // string, The username of the user that triggered the initial workflow run. If the workflow run is a re-run, this value may differ from github.triggering_actor. Any workflow re-runs will use the privileges of github.actor, even if the actor initiating the re-run (github.triggering_actor) has different privileges.
-	gitContext["env"] = ""                                              // string, Path on the runner to the file that sets environment variables from workflow commands. This file is unique to the current step and is a different file for each step in a job. For more information, see "Workflow commands for GitHub Actions."
-	gitContext["path"] = ""                                             // string, Path on the runner to the file that sets system PATH variables from workflow commands. This file is unique to the current step and is a different file for each step in a job. For more information, see "Workflow commands for GitHub Actions."
-	gitContext["ref_protected"] = false                                 // boolean, true if branch protections are configured for the ref that triggered the workflow run.
-	gitContext["repository_owner"] = run.Repo.OwnerName                 // string, The repository owner's name. For example, Codertocat.
-	gitContext["repository"] = run.Repo.OwnerName + "/" + run.Repo.Name // string, The owner and repository name. For example, Codertocat/Hello-World.
-	gitContext["repositoryUrl"] = run.Repo.HTMLURL()                    // string, The Git URL to the repository. For example, git://github.com/codertocat/hello-world.git.
-	gitContext["secret_source"] = "Actions"                             // string, The source of a secret used in a workflow. Possible values are None, Actions, Dependabot, or Codespaces.
-	gitContext["server_url"] = setting.AppURL                           // string, The URL of the GitHub server. For example: https://github.com.
-	gitContext["triggering_actor"] = ""                                 // string, The username of the user that initiated the workflow run. If the workflow run is a re-run, this value may differ from github.actor. Any workflow re-runs will use the privileges of github.actor, even if the actor initiating the re-run (github.triggering_actor) has different privileges.
-	gitContext["workflow"] = run.WorkflowID                             // string, The name of the workflow. If the workflow file doesn't specify a name, the value of this property is the full path of the workflow file in the repository.
+	gitContext["action_status"] = ""                                            // string, For a composite action, the current result of the composite action.
+	gitContext["actor"] = run.TriggerUser.Name                                  // string, The username of the user that triggered the initial workflow run. If the workflow run is a re-run, this value may differ from github.triggering_actor. Any workflow re-runs will use the privileges of github.actor, even if the actor initiating the re-run (github.triggering_actor) has different privileges.
+	gitContext["actor_id"] = strconv.FormatInt(run.TriggerUserID, 10)           // string, Immutable unique identifier of the triggering user (unlike actor, which can be renamed)
+	gitContext["env"] = ""                                                      // string, Path on the runner to the file that sets environment variables from workflow commands. This file is unique to the current step and is a different file for each step in a job. For more information, see "Workflow commands for GitHub Actions."
+	gitContext["path"] = ""                                                     // string, Path on the runner to the file that sets system PATH variables from workflow commands. This file is unique to the current step and is a different file for each step in a job. For more information, see "Workflow commands for GitHub Actions."
+	gitContext["ref_protected"] = false                                         // boolean, true if branch protections are configured for the ref that triggered the workflow run.
+	gitContext["repository_owner"] = run.Repo.OwnerName                         // string, The repository owner's name. For example, Codertocat.
+	gitContext["repository_owner_id"] = strconv.FormatInt(run.Repo.OwnerID, 10) // string, Immutable unique identifier for the repository owner (unlike repository_owner, which can change with a user rename)
+	gitContext["repository"] = run.Repo.OwnerName + "/" + run.Repo.Name         // string, The owner and repository name. For example, Codertocat/Hello-World.
+	gitContext["repository_id"] = strconv.FormatInt(run.RepoID, 10)             // string, Immutable unique identifier for the repository (unlike repository, which can be renamed)
+	gitContext["repositoryUrl"] = run.Repo.HTMLURL()                            // string, The Git URL to the repository. For example, git://github.com/codertocat/hello-world.git.
+	gitContext["secret_source"] = "Actions"                                     // string, The source of a secret used in a workflow. Possible values are None, Actions, Dependabot, or Codespaces.
+	gitContext["server_url"] = setting.AppURL                                   // string, The URL of the GitHub server. For example: https://github.com.
+	gitContext["triggering_actor"] = ""                                         // string, The username of the user that initiated the workflow run. If the workflow run is a re-run, this value may differ from github.actor. Any workflow re-runs will use the privileges of github.actor, even if the actor initiating the re-run (github.triggering_actor) has different privileges.
+	gitContext["workflow"] = run.WorkflowID                                     // string, The name of the workflow. If the workflow file doesn't specify a name, the value of this property is the full path of the workflow file in the repository.
 
 	// additional contexts
 	gitContext["gitea_default_actions_url"] = setting.Actions.DefaultActionsURL.URL()
diff --git a/services/actions/context_test.go b/services/actions/context_test.go
index 665f207219..5abd8afb00 100644
--- a/services/actions/context_test.go
+++ b/services/actions/context_test.go
@@ -36,12 +36,13 @@ func TestFindTaskNeeds(t *testing.T) {
 
 func TestGenerateGiteaContext(t *testing.T) {
 	testUser := &user.User{
-		ID:   1,
+		ID:   123,
 		Name: "testuser",
 	}
 
 	testRepo := &repo.Repository{
-		ID:        1,
+		ID:        456,
+		OwnerID:   789,
 		OwnerName: "testowner",
 		Name:      "testrepo",
 	}
@@ -56,7 +57,9 @@ func TestGenerateGiteaContext(t *testing.T) {
 		run := &actions_model.ActionRun{
 			ID:                1,
 			Index:             42,
+			TriggerUserID:     testUser.ID,
 			TriggerUser:       testUser,
+			RepoID:            testRepo.ID,
 			Repo:              testRepo,
 			TriggerEvent:      "push",
 			Ref:               "refs/heads/main",
@@ -70,12 +73,15 @@ func TestGenerateGiteaContext(t *testing.T) {
 		require.NoError(t, err)
 
 		assert.Equal(t, "testuser", context["actor"])
+		assert.Equal(t, "123", context["actor_id"])
 		assert.Equal(t, setting.AppURL+"api/v1", context["api_url"])
 		assert.Equal(t, "push", context["event_name"])
 		assert.Equal(t, "refs/heads/main", context["ref"])
 		assert.Equal(t, "main", context["ref_name"])
 		assert.Equal(t, "branch", context["ref_type"])
+		assert.Equal(t, "789", context["repository_owner_id"])
 		assert.Equal(t, "testowner/testrepo", context["repository"])
+		assert.Equal(t, "456", context["repository_id"])
 		assert.Equal(t, "testowner", context["repository_owner"])
 		assert.Equal(t, "abc123def456", context["sha"])
 		assert.Equal(t, "42", context["run_number"])
diff --git a/services/actions/download.go b/services/actions/download.go
new file mode 100644
index 0000000000..34de121220
--- /dev/null
+++ b/services/actions/download.go
@@ -0,0 +1,95 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package actions
+
+import (
+	"archive/zip"
+	"compress/gzip"
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+
+	actions_model "forgejo.org/models/actions"
+	"forgejo.org/modules/httplib"
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/storage"
+	"forgejo.org/services/context"
+)
+
+// ServeArtifact writes an artifact archive to the response. The given rows
+// must all belong to the same logical artifact (same run_id + artifact_name)
+// and be in ArtifactStatusUploadConfirmed; callers are responsible for
+// validating status and repository ownership beforehand.
+//
+// When the artifact was produced by the v4 backend (a single zip already
+// sitting in storage), it is streamed or redirected to directly. Otherwise
+// (v1-v3 backend) the archive is assembled on the fly from the individual
+// file rows, applying gzip decompression where needed.
+func ServeArtifact(base *context.Base, artifacts []*actions_model.ActionArtifact) error {
+	if len(artifacts) == 0 {
+		return errors.New("no artifacts to serve")
+	}
+
+	if len(artifacts) == 1 && artifacts[0].IsV4() {
+		return serveV4Artifact(base, artifacts[0])
+	}
+	return serveLegacyArtifact(base, artifacts)
+}
+
+func serveV4Artifact(base *context.Base, art *actions_model.ActionArtifact) error {
+	if setting.Actions.ArtifactStorage.MinioConfig.ServeDirect {
+		u, err := storage.ActionsArtifacts.URL(art.StoragePath, art.ArtifactPath, nil)
+		if u != nil && err == nil {
+			base.Redirect(u.String())
+			return nil
+		}
+	}
+	f, err := storage.ActionsArtifacts.Open(art.StoragePath)
+	if err != nil {
+		return err
+	}
+	httplib.ServeContentByReadSeeker(base.Req, base.Resp, art.ArtifactName+".zip", new(art.UpdatedUnix.AsTime()), f)
+	return nil
+}
+
+func serveLegacyArtifact(base *context.Base, artifacts []*actions_model.ActionArtifact) error {
+	name := artifacts[0].ArtifactName
+	base.Resp.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s.zip; filename*=UTF-8''%s.zip", url.PathEscape(name), name))
+
+	writer := zip.NewWriter(base.Resp)
+	defer writer.Close()
+
+	for _, art := range artifacts {
+		if err := writeArtifactFile(writer, art); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func writeArtifactFile(writer *zip.Writer, art *actions_model.ActionArtifact) error {
+	f, err := storage.ActionsArtifacts.Open(art.StoragePath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	var r io.Reader = f
+	if art.ContentEncoding == "gzip" {
+		gz, err := gzip.NewReader(f)
+		if err != nil {
+			return err
+		}
+		defer gz.Close()
+		r = gz
+	}
+
+	w, err := writer.Create(art.ArtifactPath)
+	if err != nil {
+		return err
+	}
+	_, err = io.Copy(w, r)
+	return err
+}
diff --git a/services/actions/job.go b/services/actions/job.go
new file mode 100644
index 0000000000..6ee8260ac7
--- /dev/null
+++ b/services/actions/job.go
@@ -0,0 +1,47 @@
+// Copyright 2026 The Forgejo Authors.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package actions
+
+import (
+	"context"
+	"fmt"
+
+	"forgejo.org/models/actions"
+	"forgejo.org/models/db"
+)
+
+// deleteJobsOfRun removes all jobs that belong to the given run, including its associated tasks. Each job has to be
+// completed for the operation to succeed.
+func deleteJobsOfRun(ctx context.Context, runID int64) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		jobs, err := actions.GetRunJobsByRunID(ctx, runID)
+		if err != nil {
+			return fmt.Errorf("unable to load jobs of run %d: %w", runID, err)
+		}
+
+		for _, job := range jobs {
+			if !job.Status.IsDone() {
+				return fmt.Errorf("unable to delete job %d because it has not completed yet", job.ID)
+			}
+
+			tasks, err := actions.GetTasksOfJob(ctx, job.ID)
+			if err != nil {
+				return err
+			}
+			for _, task := range tasks {
+				err = deleteTask(ctx, task.ID)
+				if err != nil {
+					return err
+				}
+			}
+
+			err = actions.DeleteJob(ctx, job.ID)
+			if err != nil {
+				return fmt.Errorf("unable to delete job %d of run %d: %w", job.ID, job.RunID, err)
+			}
+		}
+
+		return nil
+	})
+}
diff --git a/services/actions/job_emitter.go b/services/actions/job_emitter.go
index 0a9c297033..faaf9d2cdf 100644
--- a/services/actions/job_emitter.go
+++ b/services/actions/job_emitter.go
@@ -77,7 +77,7 @@ func checkJobsOfRun(ctx context.Context, runID int64, recursionCount int) error
 				job.Status = status
 				updateColumns := []string{"status"}
 
-				if status == actions_model.StatusWaiting {
+				if status.IsWaiting() {
 					behaviour, err := tryHandleIncompleteMatrix(ctx, job, jobs)
 					switch behaviour {
 					case behaviourError:
@@ -95,7 +95,7 @@ func checkJobsOfRun(ctx context.Context, runID int64, recursionCount int) error
 						// Stop processing any other jobs in this run.
 						return nil
 					}
-				} else if status == actions_model.StatusSuccess || status == actions_model.StatusFailure {
+				} else if status.IsSuccess() || status.IsFailure() || status.IsSkipped() {
 					// Transition to these states can be triggered by workflow call outer jobs
 					additionalColumns, err := tryHandleWorkflowCallOuterJob(ctx, job)
 					if err != nil {
@@ -192,7 +192,7 @@ func (r *jobStatusResolver) resolve() map[int64]actions_model.Status {
 		if status != actions_model.StatusBlocked {
 			continue
 		}
-		allDone, allSucceed, allSucceedOrSkip := true, true, true
+		allDone, allSucceed, allSucceedOrSkip, allSkip := true, true, true, true
 		for _, need := range r.needs[id] {
 			needStatus := r.statuses[need]
 			if !needStatus.IsDone() {
@@ -204,12 +204,15 @@ func (r *jobStatusResolver) resolve() map[int64]actions_model.Status {
 			if needStatus.In(actions_model.StatusFailure, actions_model.StatusCancelled) {
 				allSucceedOrSkip = false
 			}
+			if !needStatus.IsSkipped() {
+				allSkip = false
+			}
 		}
 		if allDone {
 			if isWorkflowCallOuterJob, _ := r.jobMap[id].IsWorkflowCallOuterJob(); isWorkflowCallOuterJob {
 				// If the dependent job was a workflow call outer job, then options aren't waiting/skipped, but rather
-				// success/failure.  checkJobsOfRun will do additional work in these cases to "finish" the workflow call
-				// job as well.
+				// success/skip/failure.  checkJobsOfRun will do additional work in these cases to "finish" the workflow
+				// call job as well.
 				if allSucceedOrSkip {
 					isIncompleteMatrix, _, _ := r.jobMap[id].HasIncompleteMatrix()
 					isIncompleteWith, _, _, _ := r.jobMap[id].HasIncompleteWith()
@@ -221,6 +224,12 @@ func (r *jobStatusResolver) resolve() map[int64]actions_model.Status {
 						// `tryHandleIncompleteMatrix` to be reparsed, replaced with a full job definition, with new
 						// `needs` that contain its inner jobs:
 						ret[id] = actions_model.StatusWaiting
+					} else if allSkip {
+						// All of the inner jobs are skipped -- this most likely occurs because an outer job's `if:`
+						// condition was false, and that condition was populated to all the inner jobs.  Even if that's
+						// not the case, it's effectively true that the reusable workflow was skipped if all the inner
+						// jobs had their own `if:` conditions that were skipped.
+						ret[id] = actions_model.StatusSkipped
 					} else {
 						// This job is done by virtue of its inner jobs being done successfully.
 						ret[id] = actions_model.StatusSuccess
diff --git a/services/actions/job_emitter_test.go b/services/actions/job_emitter_test.go
index a7e3b7467b..d6696b3482 100644
--- a/services/actions/job_emitter_test.go
+++ b/services/actions/job_emitter_test.go
@@ -179,6 +179,27 @@ __metadata:
 				3: actions_model.StatusSuccess,
 			},
 		},
+		{
+			name: "unblocked workflow call outer job with only skip",
+			jobs: actions_model.ActionJobList{
+				{ID: 1, JobID: "job1.innerjob1", Status: actions_model.StatusSkipped, Needs: []string{}},
+				{ID: 2, JobID: "job1.innerjob2", Status: actions_model.StatusSkipped, Needs: []string{}},
+				{ID: 3, JobID: "job1", Status: actions_model.StatusBlocked, Needs: []string{"job1.innerjob1", "job1.innerjob2"}, WorkflowPayload: []byte(
+					`
+name: test
+on: push
+jobs:
+  job2:
+    if: false
+    uses: ./.forgejo/workflows/reusable.yml
+__metadata:
+  workflow_call_id: b5a9f46f1f2513d7777fde50b169d323a6519e349cc175484c947ac315a209ed
+`)},
+			},
+			want: map[int64]actions_model.Status{
+				3: actions_model.StatusSkipped,
+			},
+		},
 		{
 			name: "unblocked workflow call outer job, incomplete `with`",
 			jobs: actions_model.ActionJobList{
diff --git a/services/actions/job_test.go b/services/actions/job_test.go
new file mode 100644
index 0000000000..b669bce301
--- /dev/null
+++ b/services/actions/job_test.go
@@ -0,0 +1,45 @@
+// Copyright 2026 The Forgejo Authors.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package actions
+
+import (
+	"testing"
+
+	actions_model "forgejo.org/models/actions"
+	"forgejo.org/models/unittest"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDeleteJobsOfRun(t *testing.T) {
+	t.Run("Deletes completed job", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestDeleteJobsOfRun")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 47301, RunID: run.ID})
+		unittest.AssertCount(t, &actions_model.ActionTask{JobID: job.ID}, 1)
+
+		require.NoError(t, deleteJobsOfRun(t.Context(), run.ID))
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRunJob{ID: job.ID})
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 47302})
+		unittest.AssertCount(t, &actions_model.ActionTask{JobID: job.ID}, 0)
+	})
+
+	t.Run("Error if job has not completed", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestDeleteJobsOfRun")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34902})
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 47302, RunID: run.ID})
+		unittest.AssertCount(t, &actions_model.ActionTask{JobID: job.ID}, 1)
+
+		err := deleteJobsOfRun(t.Context(), run.ID)
+		require.ErrorContains(t, err, "unable to delete job 47302 because it has not completed yet")
+
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: job.ID})
+		unittest.AssertCount(t, &actions_model.ActionTask{JobID: job.ID}, 1)
+	})
+}
diff --git a/services/actions/rerun.go b/services/actions/rerun.go
index 61aede5d7c..4ca32276d1 100644
--- a/services/actions/rerun.go
+++ b/services/actions/rerun.go
@@ -4,10 +4,30 @@
 package actions
 
 import (
+	"context"
+	"errors"
+	"fmt"
 	"slices"
 
 	actions_model "forgejo.org/models/actions"
+	"forgejo.org/models/db"
+	"forgejo.org/models/unit"
 	"forgejo.org/modules/container"
+
+	"xorm.io/builder"
+)
+
+var (
+	// ErrRerunWorkflowInvalid signals that the workflow cannot be run because it is invalid, for example, due to syntax
+	// errors.
+	ErrRerunWorkflowInvalid = errors.New("workflow is invalid")
+	// ErrRerunWorkflowDisabled indicates that the workflow cannot be run because it has been disabled by the user or
+	// Forgejo.
+	ErrRerunWorkflowDisabled = errors.New("workflow is disabled")
+	// ErrRerunWorkflowStillRunning signals that the workflow cannot be rerun because at least one job is still running.
+	ErrRerunWorkflowStillRunning = errors.New("workflow is still running")
+	// ErrRerunJobStillRunning signals that the job cannot be rerun because it is still running.
+	ErrRerunJobStillRunning = errors.New("job is still running")
 )
 
 // GetAllRerunJobs get all jobs that need to be rerun when job should be rerun
@@ -16,22 +36,168 @@ func GetAllRerunJobs(job *actions_model.ActionRunJob, allJobs []*actions_model.A
 	rerunJobsIDSet := make(container.Set[string])
 	rerunJobsIDSet.Add(job.JobID)
 
-	for {
-		found := false
-		for _, j := range allJobs {
-			if rerunJobsIDSet.Contains(j.JobID) {
-				continue
-			}
-			if slices.ContainsFunc(j.Needs, rerunJobsIDSet.Contains) {
-				found = true
-				rerunJobs = append(rerunJobs, j)
-				rerunJobsIDSet.Add(j.JobID)
-			}
+	for _, j := range allJobs {
+		if rerunJobsIDSet.Contains(j.JobID) {
+			continue
 		}
-		if !found {
-			break
+		if slices.ContainsFunc(j.Needs, rerunJobsIDSet.Contains) {
+			rerunJobs = append(rerunJobs, j)
+			rerunJobsIDSet.Add(j.JobID)
 		}
 	}
 
 	return rerunJobs
 }
+
+// RerunAllJobs reruns all jobs of the given run and returns them. For it to succeed, the workflow must be valid, and the
+// previous run must have completed.
+func RerunAllJobs(ctx context.Context, run *actions_model.ActionRun) ([]*actions_model.ActionRunJob, error) {
+	if !run.IsValid() {
+		return nil, ErrRerunWorkflowInvalid
+	}
+	if !run.Status.IsDone() {
+		return nil, ErrRerunWorkflowStillRunning
+	}
+
+	if err := run.LoadRepo(ctx); err != nil {
+		return nil, fmt.Errorf("cannot load repo of run %d: %w", run.ID, err)
+	}
+
+	actionsConfig := run.Repo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
+	if actionsConfig.IsWorkflowDisabled(run.WorkflowID) {
+		return nil, ErrRerunWorkflowDisabled
+	}
+
+	var rerunJobs []*actions_model.ActionRunJob
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
+		if run.Status != actions_model.StatusUnknown && !run.Status.IsDone() {
+			return fmt.Errorf("cannot prepare next attempt because run %d is active: %s", run.ID, run.Status.String())
+		}
+
+		// Wipe all artifacts before a rerun to prevent stale artifacts from polluting artifacts collected during the
+		// rerun.
+		if err := actions_model.SetArtifactsOfRunDeleted(ctx, run.ID); err != nil {
+			return fmt.Errorf("cannot remove artifacts of previous run of run %d: %w", run.ID, err)
+		}
+
+		run.PreviousDuration = run.Duration()
+
+		run.Status = actions_model.StatusWaiting
+		run.Started = 0
+		run.Stopped = 0
+
+		// The columns have to be specified here to work around a xorm quirk: It won't update columns that are set to
+		// their zero value without AllCols().
+		if err := UpdateRun(ctx, run, "status", "started", "stopped", "previous_duration"); err != nil {
+			return fmt.Errorf("cannot update run %d: %w", run.ID, err)
+		}
+
+		jobs, err := actions_model.GetRunJobsByRunID(ctx, run.ID)
+		if err != nil {
+			return fmt.Errorf("could not load jobs of run %d: %w", run.ID, err)
+		}
+
+		for _, job := range jobs {
+			initialStatus := actions_model.StatusWaiting
+			if len(job.Needs) > 0 {
+				initialStatus = actions_model.StatusBlocked
+			}
+
+			if err := rerunSingleJob(ctx, job, initialStatus); err != nil {
+				return fmt.Errorf("could not rerun job %d of run %d: %w", job.ID, run.ID, err)
+			}
+
+			rerunJobs = append(rerunJobs, job)
+		}
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	return rerunJobs, nil
+}
+
+// RerunJob reruns the given job and all its dependent jobs. It returns all jobs that were rerun. For it to succeed, the
+// workflow that defines this job must be valid, and the previous run must have completed. Dependent jobs that have not
+// completed yet are ignored.
+func RerunJob(ctx context.Context, job *actions_model.ActionRunJob) ([]*actions_model.ActionRunJob, error) {
+	if err := job.LoadAttributes(ctx); err != nil {
+		return nil, fmt.Errorf("cannot load attributes of job %d: %w", job.ID, err)
+	}
+	if !job.Run.IsValid() {
+		return nil, ErrRerunWorkflowInvalid
+	}
+
+	actionsConfig := job.Run.Repo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
+	if actionsConfig.IsWorkflowDisabled(job.Run.WorkflowID) {
+		return nil, ErrRerunWorkflowDisabled
+	}
+
+	if !job.Status.IsDone() {
+		return nil, ErrRerunJobStillRunning
+	}
+
+	var rerunJobs []*actions_model.ActionRunJob
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
+		jobs, err := actions_model.GetRunJobsByRunID(ctx, job.RunID)
+		if err != nil {
+			return fmt.Errorf("could not load jobs of run %d: %w", job.RunID, err)
+		}
+
+		// Wipe all artifacts before a rerun to prevent stale artifacts from polluting the artifacts collected during
+		// the rerun. Because artifacts are bound to a run and not to a job, it is not possible to only remove the
+		// artifacts of the jobs that are going to be rerun. That means that artifacts created by jobs that are not
+		// rerun will be lost. That matches GitHub Actions' behaviour as of May 2026.
+		if err := actions_model.SetArtifactsOfRunDeleted(ctx, job.RunID); err != nil {
+			return fmt.Errorf("cannot remove artifacts of previous run of run %d: %w", job.RunID, err)
+		}
+
+		for _, jobToRerun := range GetAllRerunJobs(job, jobs) {
+			canBeRerun, err := jobToRerun.CanBeRerun(ctx)
+			if err != nil {
+				return fmt.Errorf("cannot determine whether job %d can be rerun: %w", jobToRerun.ID, err)
+			}
+
+			// Skipping jobs that cannot be rerun is wrong. They should be cancelled and rerun, instead, because they
+			// are dependent jobs and the old results might be worthless, anyway. But we keep that behaviour for now,
+			// because changing it requires more rework.
+			if !canBeRerun {
+				continue
+			}
+
+			// The job that should be rerun cannot be blocked, even if it has needs.
+			initialStatus := actions_model.StatusWaiting
+			if len(jobToRerun.Needs) > 0 && jobToRerun.ID != job.ID {
+				initialStatus = actions_model.StatusBlocked
+			}
+
+			if err := rerunSingleJob(ctx, jobToRerun, initialStatus); err != nil {
+				return fmt.Errorf("cannot rerun job %d: %w", jobToRerun.ID, err)
+			}
+			rerunJobs = append(rerunJobs, jobToRerun)
+		}
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	return rerunJobs, nil
+}
+
+func rerunSingleJob(ctx context.Context, job *actions_model.ActionRunJob, initialStatus actions_model.Status) error {
+	oldStatus := job.Status
+
+	if err := job.PrepareNextAttempt(initialStatus); err != nil {
+		return err
+	}
+
+	// The columns have to be specified here to work around a xorm quirk: It won't update columns that are set to their
+	// zero value without AllCols().
+	if _, err := UpdateRunJob(ctx, job, builder.Eq{"status": oldStatus}, "handle", "attempt", "task_id", "status", "started", "stopped"); err != nil {
+		return err
+	}
+
+	CreateCommitStatus(ctx, job)
+
+	return nil
+}
diff --git a/services/actions/rerun_test.go b/services/actions/rerun_test.go
index 4b822e8da1..fcd638e448 100644
--- a/services/actions/rerun_test.go
+++ b/services/actions/rerun_test.go
@@ -5,13 +5,18 @@ package actions
 
 import (
 	"testing"
+	"time"
 
 	actions_model "forgejo.org/models/actions"
+	"forgejo.org/models/unit"
+	"forgejo.org/models/unittest"
+	"forgejo.org/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-func TestGetAllRerunJobs(t *testing.T) {
+func TestRerun_GetAllRerunJobs(t *testing.T) {
 	job1 := &actions_model.ActionRunJob{JobID: "job1"}
 	job2 := &actions_model.ActionRunJob{JobID: "job2", Needs: []string{"job1"}}
 	job3 := &actions_model.ActionRunJob{JobID: "job3", Needs: []string{"job2"}}
@@ -46,3 +51,271 @@ func TestGetAllRerunJobs(t *testing.T) {
 		assert.ElementsMatch(t, tc.rerunJobs, rerunJobs)
 	}
 }
+
+func TestRerun_RerunAllJobs(t *testing.T) {
+	t.Run("Reruns completed workflow", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunAllJobs")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455620})
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
+		rerunJobs, err := RerunAllJobs(t.Context(), run)
+		require.NoError(t, err)
+
+		run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455620})
+
+		assert.Equal(t, actions_model.StatusWaiting, run.Status)
+		assert.Equal(t, timeutil.TimeStamp(0), run.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), run.Stopped)
+		assert.Equal(t, 11*time.Second, run.PreviousDuration)
+
+		assert.Len(t, rerunJobs, 2)
+		assert.Equal(t, int64(683880), rerunJobs[0].ID)
+		assert.Equal(t, int64(2), rerunJobs[0].Attempt)
+		assert.Equal(t, actions_model.StatusBlocked, rerunJobs[0].Status)
+		assert.Equal(t, timeutil.TimeStamp(0), rerunJobs[0].Started)
+		assert.Equal(t, timeutil.TimeStamp(0), rerunJobs[0].Stopped)
+
+		assert.Equal(t, int64(683881), rerunJobs[1].ID)
+		assert.Equal(t, int64(2), rerunJobs[1].Attempt)
+		assert.Equal(t, actions_model.StatusWaiting, rerunJobs[1].Status)
+		assert.Equal(t, timeutil.TimeStamp(0), rerunJobs[1].Started)
+		assert.Equal(t, timeutil.TimeStamp(0), rerunJobs[1].Stopped)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 1)
+	})
+
+	t.Run("Error if workflow running", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunAllJobs")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455630})
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
+		rerunJobs, err := RerunAllJobs(t.Context(), run)
+		require.ErrorContains(t, err, "workflow is still running")
+
+		run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455630})
+
+		assert.Equal(t, actions_model.StatusRunning, run.Status)
+		assert.Equal(t, timeutil.TimeStamp(1776281360), run.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), run.Stopped)
+		assert.Equal(t, time.Duration(0), run.PreviousDuration)
+
+		assert.Empty(t, rerunJobs)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+	})
+
+	t.Run("Error if workflow invalid", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunAllJobs")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455640})
+
+		rerunJobs, err := RerunAllJobs(t.Context(), run)
+		require.ErrorContains(t, err, "workflow is invalid")
+
+		run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455640})
+
+		assert.Equal(t, actions_model.StatusFailure, run.Status)
+		assert.Equal(t, timeutil.TimeStamp(0), run.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), run.Stopped)
+		assert.Equal(t, time.Duration(0), run.PreviousDuration)
+
+		assert.Empty(t, rerunJobs)
+	})
+
+	t.Run("Error if workflow disabled", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunAllJobs")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455620})
+
+		// Disable workflow
+		require.NoError(t, run.LoadAttributes(t.Context()))
+		actionsConfig := run.Repo.MustGetUnit(t.Context(), unit.TypeActions).ActionsConfig()
+		actionsConfig.DisableWorkflow(run.WorkflowID)
+
+		rerunJobs, err := RerunAllJobs(t.Context(), run)
+		require.ErrorContains(t, err, "workflow is disabled")
+
+		run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455620})
+
+		assert.Equal(t, actions_model.StatusSuccess, run.Status)
+		assert.Equal(t, timeutil.TimeStamp(1776279254), run.Started)
+		assert.Equal(t, timeutil.TimeStamp(1776279265), run.Stopped)
+		assert.Equal(t, time.Duration(0), run.PreviousDuration)
+
+		assert.Empty(t, rerunJobs)
+	})
+}
+
+func TestRerun_RerunJob(t *testing.T) {
+	t.Run("Rerun independent job", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunJob")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683910})
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: job.RunID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
+		rerunJobs, err := RerunJob(t.Context(), job)
+
+		require.NoError(t, err)
+
+		assert.Len(t, rerunJobs, 1)
+		assert.Equal(t, job.ID, rerunJobs[0].ID)
+
+		job = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683910})
+
+		assert.Equal(t, int64(2), job.Attempt)
+		assert.Equal(t, actions_model.StatusWaiting, job.Status)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Stopped)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 1)
+	})
+
+	t.Run("Rerun job needed by others", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunJob")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683911})
+
+		rerunJobs, err := RerunJob(t.Context(), job)
+
+		require.NoError(t, err)
+
+		assert.Len(t, rerunJobs, 2)
+		assert.Equal(t, int64(683911), rerunJobs[0].ID)
+		assert.Equal(t, int64(683912), rerunJobs[1].ID)
+
+		job = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683911})
+
+		assert.Equal(t, int64(2), job.Attempt)
+		assert.Equal(t, actions_model.StatusWaiting, job.Status)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Stopped)
+
+		dependentJob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683912})
+
+		assert.Equal(t, int64(2), dependentJob.Attempt)
+		assert.Equal(t, actions_model.StatusBlocked, dependentJob.Status)
+		assert.Equal(t, timeutil.TimeStamp(0), dependentJob.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), dependentJob.Stopped)
+	})
+
+	t.Run("Rerun job with needs", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunJob")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683912})
+
+		rerunJobs, err := RerunJob(t.Context(), job)
+
+		require.NoError(t, err)
+
+		assert.Len(t, rerunJobs, 1)
+		assert.Equal(t, int64(683912), rerunJobs[0].ID)
+
+		job = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683912})
+
+		assert.Len(t, job.Needs, 1)
+		assert.Equal(t, int64(2), job.Attempt)
+		assert.Equal(t, actions_model.StatusWaiting, job.Status)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Stopped)
+	})
+
+	t.Run("Error if workflow invalid", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunJob")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683900})
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: job.RunID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
+		rerunJobs, err := RerunJob(t.Context(), job)
+
+		require.ErrorContains(t, err, "workflow is invalid")
+		assert.Empty(t, rerunJobs)
+
+		job = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683900})
+
+		assert.Equal(t, int64(1), job.Attempt)
+		assert.Equal(t, actions_model.StatusFailure, job.Status)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Stopped)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: job.RunID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+	})
+
+	t.Run("Error if workflow disabled", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunJob")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683881})
+
+		// Disable workflow
+		require.NoError(t, job.LoadAttributes(t.Context()))
+		actionsConfig := job.Run.Repo.MustGetUnit(t.Context(), unit.TypeActions).ActionsConfig()
+		actionsConfig.DisableWorkflow(job.Run.WorkflowID)
+
+		rerunJobs, err := RerunJob(t.Context(), job)
+
+		require.ErrorContains(t, err, "workflow is disabled")
+		assert.Empty(t, rerunJobs)
+
+		job = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683881})
+
+		assert.Equal(t, int64(1), job.Attempt)
+		assert.Equal(t, actions_model.StatusSuccess, job.Status)
+		assert.Equal(t, timeutil.TimeStamp(1776279254), job.Started)
+		assert.Equal(t, timeutil.TimeStamp(1776279264), job.Stopped)
+	})
+
+	t.Run("Error if job still running", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestRerun_RerunJob")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683592})
+
+		rerunJobs, err := RerunJob(t.Context(), job)
+
+		require.ErrorContains(t, err, "job is still running")
+		assert.Empty(t, rerunJobs)
+
+		job = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683592})
+
+		assert.Equal(t, int64(1), job.Attempt)
+		assert.Equal(t, actions_model.StatusRunning, job.Status)
+		assert.Equal(t, timeutil.TimeStamp(1776331665), job.Started)
+		assert.Equal(t, timeutil.TimeStamp(0), job.Stopped)
+	})
+}
diff --git a/services/actions/run.go b/services/actions/run.go
index bee0b1581d..d0e874ff54 100644
--- a/services/actions/run.go
+++ b/services/actions/run.go
@@ -5,6 +5,7 @@ package actions
 
 import (
 	"context"
+	"fmt"
 	"slices"
 	"strings"
 
@@ -27,7 +28,7 @@ func killRun(ctx context.Context, run *actions_model.ActionRun, newStatus action
 			if job.TaskID == 0 {
 				job.Status = newStatus
 				job.Stopped = timeutil.TimeStampNow()
-				_, err := actions_model.UpdateRunJobWithoutNotification(ctx, job, nil, "status", "stopped")
+				_, err := UpdateRunJob(ctx, job, nil, "status", "stopped")
 				if err != nil {
 					return err
 				}
@@ -203,3 +204,30 @@ func checkJobRunsOnStaticMatrixError(ctx context.Context, job *actions_model.Act
 
 	return true, nil
 }
+
+// DeleteRun removes a particular run including all associated artifacts, jobs, tasks, and logs. The run has to be
+// completed for the operation to succeed.
+func DeleteRun(ctx context.Context, runID int64) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		run, err := actions_model.GetRunByID(ctx, runID)
+		if err != nil {
+			return fmt.Errorf("unable to load run %d: %w", runID, err)
+		}
+
+		if !run.Status.IsDone() {
+			return fmt.Errorf("cannot delete run %d because it has not completed yet", run.ID)
+		}
+
+		err = actions_model.SetArtifactsOfRunDeleted(ctx, runID)
+		if err != nil {
+			return fmt.Errorf("unable to delete artifacts of run %d: %w", run.ID, err)
+		}
+
+		err = deleteJobsOfRun(ctx, run.ID)
+		if err != nil {
+			return fmt.Errorf("unable to delete jobs of run %d: %w", run.ID, err)
+		}
+
+		return actions_model.DeleteRun(ctx, run.ID)
+	})
+}
diff --git a/services/actions/run_test.go b/services/actions/run_test.go
index 61e580aed1..19cad919db 100644
--- a/services/actions/run_test.go
+++ b/services/actions/run_test.go
@@ -160,3 +160,42 @@ func TestActions_consistencyCheckRun(t *testing.T) {
 		})
 	}
 }
+
+func TestDeleteRun(t *testing.T) {
+	t.Run("Removes run and its dependencies", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestDeleteRun")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 2)
+
+		require.NoError(t, DeleteRun(t.Context(), run.ID))
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRun{ID: run.ID})
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRunJob{ID: job.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID:  run.ID,
+			Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 2)
+	})
+
+	t.Run("Error if run not done", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestDeleteRun")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34902})
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 1)
+
+		err := DeleteRun(t.Context(), run.ID)
+		require.ErrorContains(t, err, "cannot delete run 34902 because it has not completed yet")
+
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: job.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID:  run.ID,
+			Status: int64(actions_model.ArtifactStatusUploadConfirmed),
+		}, 1)
+	})
+}
diff --git a/services/actions/schedule_tasks.go b/services/actions/schedule_tasks.go
index cda41fa08b..a1e9874984 100644
--- a/services/actions/schedule_tasks.go
+++ b/services/actions/schedule_tasks.go
@@ -22,7 +22,7 @@ import (
 
 	"code.forgejo.org/forgejo/runner/v12/act/jobparser"
 	act_model "code.forgejo.org/forgejo/runner/v12/act/model"
-	"github.com/robfig/cron/v3"
+	"github.com/gdgvda/cron"
 )
 
 // StartScheduleTasks start the task
diff --git a/services/actions/task.go b/services/actions/task.go
index ce43180b7b..a08403ad08 100644
--- a/services/actions/task.go
+++ b/services/actions/task.go
@@ -10,6 +10,8 @@ import (
 
 	actions_model "forgejo.org/models/actions"
 	"forgejo.org/models/db"
+	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unit"
 	actions_module "forgejo.org/modules/actions"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/timeutil"
@@ -68,7 +70,12 @@ func PickTask(ctx context.Context, runner *actions_model.ActionRunner, requestKe
 			return fmt.Errorf("findTaskNeeds: %w", err)
 		}
 
-		taskContext, err := generateTaskContext(t)
+		unit, err := t.Job.Run.Repo.GetUnit(ctx, unit.TypeActions)
+		if err != nil {
+			return fmt.Errorf("GetUnit: %w", err)
+		}
+
+		taskContext, err := generateTaskContext(t, unit.ActionsConfig())
 		if err != nil {
 			return fmt.Errorf("generateTaskContext: %w", err)
 		}
@@ -128,7 +135,12 @@ func RecoverTasks(ctx context.Context, tasks []*actions_model.ActionTask) ([]*ru
 				return fmt.Errorf("findTaskNeeds: %w", err)
 			}
 
-			taskContext, err := generateTaskContext(t)
+			unit, err := t.Job.Run.Repo.GetUnit(ctx, unit.TypeActions)
+			if err != nil {
+				return fmt.Errorf("GetUnit: %w", err)
+			}
+
+			taskContext, err := generateTaskContext(t, unit.ActionsConfig())
 			if err != nil {
 				return fmt.Errorf("generateTaskContext: %w", err)
 			}
@@ -151,7 +163,7 @@ func RecoverTasks(ctx context.Context, tasks []*actions_model.ActionTask) ([]*ru
 	return retval, nil
 }
 
-func generateTaskContext(t *actions_model.ActionTask) (*structpb.Struct, error) {
+func generateTaskContext(t *actions_model.ActionTask, ac *repo_model.ActionsConfig) (*structpb.Struct, error) {
 	run := t.Job.Run
 	gitCtx, err := GenerateGiteaContext(run, t.Job)
 	if err != nil {
@@ -170,7 +182,7 @@ func generateTaskContext(t *actions_model.ActionTask) (*structpb.Struct, error)
 		enableOpenIDConnect = false
 	}
 
-	giteaRuntimeToken, err := CreateAuthorizationToken(t, gitCtx, enableOpenIDConnect)
+	giteaRuntimeToken, err := CreateAuthorizationToken(t, gitCtx, enableOpenIDConnect, ac)
 	if err != nil {
 		return nil, err
 	}
@@ -355,3 +367,40 @@ func convertTimestamp(timestamp *timestamppb.Timestamp) timeutil.TimeStamp {
 	}
 	return timeutil.TimeStamp(timestamp.AsTime().Unix())
 }
+
+// deleteTask removes the given task with all associated steps, outputs, logs, and ephemeral runners, if any. For
+// deleteTask to succeed, it must have completed. If it has not, an error is returned. If the given task does not exist,
+// nothing happens.
+func deleteTask(ctx context.Context, taskID int64) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		task, err := actions_model.GetTaskByID(ctx, taskID)
+		if err != nil {
+			if errors.Is(err, util.ErrNotExist) {
+				return nil
+			}
+			return fmt.Errorf("unable to load task %d: %w", taskID, err)
+		}
+
+		if !task.Status.IsDone() {
+			return fmt.Errorf("unable to remove task %d because it has not completed yet", taskID)
+		}
+
+		err = actions_module.RemoveLogs(ctx, task.LogInStorage, task.LogFilename)
+		if err != nil {
+			return fmt.Errorf("unable to remove logs of task %d: %w", taskID, err)
+		}
+
+		// Whether an ephemeral runner has been used is determined based on whether it is assigned to a task.
+		// Consequently, ephemeral runners have to be cleaned up before any task can be removed.
+		err = actions_model.DeleteEphemeralRunner(ctx, task.RunnerID)
+		if err != nil {
+			return fmt.Errorf("unable to cleanup ephemeral runners before removing task %d: %w", taskID, err)
+		}
+		err = actions_model.DeleteTask(ctx, task.ID)
+		if err != nil {
+			return fmt.Errorf("unable to remove task %d: %w", task.ID, err)
+		}
+
+		return nil
+	})
+}
diff --git a/services/actions/task_test.go b/services/actions/task_test.go
index f725a93674..375359b5e8 100644
--- a/services/actions/task_test.go
+++ b/services/actions/task_test.go
@@ -5,9 +5,13 @@ import (
 	"testing"
 
 	actions_model "forgejo.org/models/actions"
-	"forgejo.org/models/repo"
+	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unittest"
 	"forgejo.org/models/user"
+	"forgejo.org/modules/actions"
 
+	runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -27,7 +31,7 @@ jobs:
 		Name: "testuser",
 	}
 
-	testRepo := &repo.Repository{
+	testRepo := &repo_model.Repository{
 		ID:        1,
 		OwnerName: "testowner",
 		Name:      "testrepo",
@@ -60,7 +64,7 @@ jobs:
 	t.Run("openid connect enabled", func(t *testing.T) {
 		task := createTask(fmt.Sprintf(workflowFormat, "true"), false, "push")
 
-		taskContext, err := generateTaskContext(task)
+		taskContext, err := generateTaskContext(task, &repo_model.ActionsConfig{})
 		require.NoError(t, err)
 		require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
 		require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
@@ -70,7 +74,7 @@ jobs:
 	t.Run("openid connect enabled from fork with pull_request_target event", func(t *testing.T) {
 		task := createTask(fmt.Sprintf(workflowFormat, "true"), true, "pull_request_target")
 
-		taskContext, err := generateTaskContext(task)
+		taskContext, err := generateTaskContext(task, &repo_model.ActionsConfig{})
 		require.NoError(t, err)
 		require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
 		require.NotEmpty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
@@ -80,7 +84,7 @@ jobs:
 	t.Run("openid connect enabled from fork with pull_request event", func(t *testing.T) {
 		task := createTask(fmt.Sprintf(workflowFormat, "true"), true, "pull_request")
 
-		taskContext, err := generateTaskContext(task)
+		taskContext, err := generateTaskContext(task, &repo_model.ActionsConfig{})
 		require.NoError(t, err)
 		require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
 		require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
@@ -90,10 +94,97 @@ jobs:
 	t.Run("openid connect disabled", func(t *testing.T) {
 		task := createTask(fmt.Sprintf(workflowFormat, "false"), false, "push")
 
-		taskContext, err := generateTaskContext(task)
+		taskContext, err := generateTaskContext(task, &repo_model.ActionsConfig{})
 		require.NoError(t, err)
 		require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_token"].GetStringValue())
 		require.Empty(t, taskContext.Fields["forgejo_actions_id_token_request_url"].GetStringValue())
 		require.NotEmpty(t, taskContext.Fields["gitea_runtime_token"].GetStringValue())
 	})
 }
+
+func TestDeleteTask(t *testing.T) {
+	t.Run("Task removed with logs and ephemeral runner", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestDeleteTask")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		task := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 87601})
+		runner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 41601})
+		unittest.AssertCount(t, &actions_model.ActionTaskOutput{TaskID: task.ID}, 2)
+		unittest.AssertCount(t, &actions_model.ActionTaskStep{TaskID: task.ID}, 1)
+
+		_, err := actions.WriteLogs(t.Context(), task.LogFilename, 0, []*runnerv1.LogRow{{Content: "OK"}})
+		require.NoError(t, err)
+
+		logExists, err := actions.ExistsLogs(t.Context(), task.LogFilename)
+		require.NoError(t, err)
+		assert.True(t, logExists)
+
+		require.NoError(t, deleteTask(t.Context(), task.ID))
+
+		logExists, err = actions.ExistsLogs(t.Context(), task.LogFilename)
+		require.NoError(t, err)
+		assert.False(t, logExists)
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionTask{ID: task.ID})
+		unittest.AssertCount(t, &actions_model.ActionTaskOutput{TaskID: task.ID}, 0)
+		unittest.AssertCount(t, &actions_model.ActionTaskStep{TaskID: task.ID}, 0)
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRunner{ID: runner.ID})
+
+		// Verify that other tasks have been left alone.
+		otherTask := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 87602})
+		unittest.AssertCount(t, &actions_model.ActionTaskOutput{TaskID: otherTask.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionTaskStep{TaskID: otherTask.ID}, 1)
+	})
+
+	t.Run("Task removed and persistent runner kept", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestDeleteTask")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		task := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 87603})
+		runner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 41602})
+		unittest.AssertCount(t, &actions_model.ActionTaskOutput{TaskID: task.ID}, 0)
+		unittest.AssertCount(t, &actions_model.ActionTaskStep{TaskID: task.ID}, 1)
+
+		_, err := actions.WriteLogs(t.Context(), task.LogFilename, 0, []*runnerv1.LogRow{{Content: "OK"}})
+		require.NoError(t, err)
+
+		logExists, err := actions.ExistsLogs(t.Context(), task.LogFilename)
+		require.NoError(t, err)
+		assert.True(t, logExists)
+
+		require.NoError(t, deleteTask(t.Context(), task.ID))
+
+		logExists, err = actions.ExistsLogs(t.Context(), task.LogFilename)
+		require.NoError(t, err)
+		assert.False(t, logExists)
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionTask{ID: task.ID})
+		unittest.AssertCount(t, &actions_model.ActionTaskOutput{TaskID: task.ID}, 0)
+		unittest.AssertCount(t, &actions_model.ActionTaskStep{TaskID: task.ID}, 0)
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: runner.ID})
+	})
+
+	t.Run("No error if task does not exist", func(t *testing.T) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionTask{ID: 87601})
+		require.NoError(t, deleteTask(t.Context(), 87601))
+	})
+
+	t.Run("Error if task is not done", func(t *testing.T) {
+		defer unittest.OverrideFixtures("services/actions/TestDeleteTask")()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		task := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 87602})
+		unittest.AssertCount(t, &actions_model.ActionTaskOutput{TaskID: task.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionTaskStep{TaskID: task.ID}, 1)
+
+		err := deleteTask(t.Context(), task.ID)
+		require.ErrorContains(t, err, "unable to remove task 87602 because it has not completed yet")
+
+		// Verify nothing has been deleted.
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: task.ID})
+		unittest.AssertCount(t, &actions_model.ActionTaskOutput{TaskID: task.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionTaskStep{TaskID: task.ID}, 1)
+	})
+}
diff --git a/services/actions/workflows.go b/services/actions/workflows.go
index a08a069cc1..d7d0f781d6 100644
--- a/services/actions/workflows.go
+++ b/services/actions/workflows.go
@@ -97,6 +97,8 @@ func (entry *Workflow) Dispatch(ctx context.Context, inputGetter InputValueGette
 		title = fullWorkflowID
 	}
 
+	// Runner expects a `map[string]string` for inputs in in the payload dispatch, but newer code in the Runner's
+	// jobparser library takes a map[string]any which is more directly actionable for parsing:
 	inputs := make(map[string]string)
 	inputsAny := make(map[string]any)
 	if workflowDispatch := wf.WorkflowDispatchConfig(); workflowDispatch != nil {
@@ -109,6 +111,12 @@ func (entry *Workflow) Dispatch(ctx context.Context, inputGetter InputValueGette
 			}
 			inputs[key] = value
 			inputsAny[key] = value
+			// To match the behaviour of the runner when parsing map[string]string into map[string]any, check for
+			// boolean type inputs and convert them to booleans for expression evaluation:
+			// https://code.forgejo.org/forgejo/runner/src/commit/d5693e379c034a3afcb920087570d9a6e179e86e/act/runner/expression.go#L435-L439
+			if input.Type == "boolean" {
+				inputsAny[key] = value == "true"
+			}
 		}
 	}
 
diff --git a/services/auth/interface.go b/services/auth/interface.go
index bbfe641520..ca0bb661ba 100644
--- a/services/auth/interface.go
+++ b/services/auth/interface.go
@@ -11,6 +11,7 @@ import (
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/optional"
 	"forgejo.org/modules/session"
+	"forgejo.org/modules/timeutil"
 	"forgejo.org/modules/web/middleware"
 	"forgejo.org/services/authz"
 )
@@ -97,19 +98,23 @@ type AuthenticationResult interface {
 	// Identifies if the authentication was performed by a reverse proxy.
 	IsReverseProxyAuthentication() bool
 
-	// Identifies specifically that the OAuth2 JWT authentication method was used. If so, some related OAuth2 API
-	// endpoints may be accessible that otherwise wouldn't be.
-	IsOAuth2JWTAuthentication() bool
+	// Defined scopes of the [OAuth2Grant] as a comma-separated string, if authenticated via an OAuth access token JWT.
+	// Otherwise, None.
+	OAuth2GrantScopes() optional.Option[string]
 
 	// If authenticated as an Actions task (using ${{ forgejo.token }}), then indicates the specific task that performed
 	// the authentication.
 	ActionsTaskID() optional.Option[int64]
+
+	// If the authentication method used has a limited time validity, such as a JWT with an `exp` claim, that expiry
+	// time can be accessed through this method.  Otherwise, returns None.
+	ExpiresAt() optional.Option[timeutil.TimeStamp]
 }
 
 type BaseAuthenticationResult struct{}
 
-func (*BaseAuthenticationResult) IsOAuth2JWTAuthentication() bool {
-	return false
+func (*BaseAuthenticationResult) OAuth2GrantScopes() optional.Option[string] {
+	return optional.None[string]()
 }
 
 func (*BaseAuthenticationResult) IsPasswordAuthentication() bool {
@@ -132,6 +137,10 @@ func (*BaseAuthenticationResult) Scope() optional.Option[auth_model.AccessTokenS
 	return optional.None[auth_model.AccessTokenScope]()
 }
 
+func (*BaseAuthenticationResult) ExpiresAt() optional.Option[timeutil.TimeStamp] {
+	return optional.None[timeutil.TimeStamp]()
+}
+
 type UnauthenticatedResult struct {
 	*BaseAuthenticationResult
 }
diff --git a/services/auth/method/access_token.go b/services/auth/method/access_token.go
new file mode 100644
index 0000000000..f1a5e8e766
--- /dev/null
+++ b/services/auth/method/access_token.go
@@ -0,0 +1,78 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"fmt"
+	"net/http"
+
+	auth_model "forgejo.org/models/auth"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/log"
+	"forgejo.org/modules/optional"
+	"forgejo.org/modules/web/middleware"
+	"forgejo.org/services/auth"
+	"forgejo.org/services/authz"
+)
+
+var _ auth.Method = &AccessToken{}
+
+type AccessToken struct{}
+
+func (a *AccessToken) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionStore) auth.MethodOutput {
+	// Authentication previously was performed in a single routine for `Authorization: Basic ...` and `Authorization:
+	// Bearer ...`, and both routines had separate URL exclusion lists onto which they wouldn't apply.  That behaviour
+	// is maintained by cloning those conditions here and deciding whether to look at basic/bearer auth, or not.  In the
+	// future this should be removed and migrated to route-specific middleware.
+	legacySkipBasic := !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req)
+	legacySkipFormAndBearer := !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isAuthenticatedTokenRequest(req) && !isGitRawOrAttachPath(req) && !isArchivePath(req)
+
+	maybeAuthToken := a.getTokenFromRequest(req, legacySkipBasic, legacySkipFormAndBearer)
+	if !maybeAuthToken.Has() {
+		return &auth.AuthenticationNotAttempted{}
+	}
+	_, authToken := maybeAuthToken.Get()
+
+	// check personal access token
+	token, err := auth_model.GetAccessTokenBySHA(req.Context(), authToken)
+	if auth_model.IsErrAccessTokenNotExist(err) || auth_model.IsErrAccessTokenEmpty(err) {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: err}
+	} else if err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("access token GetAccessTokenBySHA: %w", err)}
+	}
+
+	log.Trace("AccessToken: Valid AccessToken for user[%d]", token.UID)
+	u, err := user_model.GetUserByID(req.Context(), token.UID)
+	if err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("access token GetUserByID: %w", err)}
+	}
+
+	if err = token.UpdateLastUsed(req.Context()); err != nil {
+		log.Error("UpdateLastUsed:  %v", err)
+	}
+
+	reducer, err := authz.GetAuthorizationReducerForAccessToken(req.Context(), token)
+	if err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("access token GetAuthorizationReducerForAccessToken: %w", err)}
+	}
+
+	return &auth.AuthenticationSuccess{Result: &accessTokenAuthenticationResult{user: u, scope: token.Scope, reducer: reducer}}
+}
+
+func (a *AccessToken) getTokenFromRequest(req *http.Request, skipBasic, skipFormAndBearer bool) optional.Option[string] {
+	if !skipFormAndBearer {
+		if has, token := tokenFromForm(req).Get(); has {
+			return optional.Some(token)
+		}
+		if has, token := tokenFromAuthorizationBearer(req).Get(); has {
+			return optional.Some(token)
+		}
+	}
+	if !skipBasic {
+		if has, token := tokenFromAuthorizationBasic(req).Get(); has {
+			return optional.Some(token)
+		}
+	}
+	return optional.None[string]()
+}
diff --git a/services/auth/method/action_runtime_token.go b/services/auth/method/action_runtime_token.go
new file mode 100644
index 0000000000..2d15476424
--- /dev/null
+++ b/services/auth/method/action_runtime_token.go
@@ -0,0 +1,67 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	actions_model "forgejo.org/models/actions"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/optional"
+	"forgejo.org/modules/web/middleware"
+	"forgejo.org/services/actions"
+	"forgejo.org/services/auth"
+)
+
+var _ auth.Method = &ActionRuntimeToken{}
+
+type ActionRuntimeToken struct{}
+
+func (a *ActionRuntimeToken) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionStore) auth.MethodOutput {
+	// In the future this should be removed and migrated to route-specific middleware:
+	if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isAuthenticatedTokenRequest(req) && !isGitRawOrAttachPath(req) && !isArchivePath(req) {
+		return &auth.AuthenticationNotAttempted{}
+	}
+
+	maybeAuthToken := a.getTokenFromRequest(req)
+	if !maybeAuthToken.Has() {
+		return &auth.AuthenticationNotAttempted{}
+	}
+	_, authToken := maybeAuthToken.Get()
+
+	taskID, err := actions.TokenToTaskID(authToken)
+	if err != nil {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: err}
+	}
+
+	if !checkTaskIsRunning(req.Context(), taskID) {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: errors.New("failure to authenticate with action runtime token: task is no longer running")}
+	}
+
+	return &auth.AuthenticationSuccess{Result: &actionsTaskTokenAuthenticationResult{user: user_model.NewActionsUser(), taskID: taskID}}
+}
+
+func (a *ActionRuntimeToken) getTokenFromRequest(req *http.Request) optional.Option[string] {
+	if has, token := tokenFromForm(req).Get(); has {
+		return optional.Some(token)
+	}
+	if has, token := tokenFromAuthorizationBearer(req).Get(); has {
+		return optional.Some(token)
+	}
+	return optional.None[string]()
+}
+
+// CheckTaskIsRunning verifies that the TaskID corresponds to a running task
+func checkTaskIsRunning(ctx context.Context, taskID int64) bool {
+	// Verify the task exists
+	task, err := actions_model.GetTaskByID(ctx, taskID)
+	if err != nil {
+		return false
+	}
+
+	// Verify that it's running
+	return task.Status == actions_model.StatusRunning
+}
diff --git a/services/auth/method/action_runtime_token_test.go b/services/auth/method/action_runtime_token_test.go
new file mode 100644
index 0000000000..4a4db62b3f
--- /dev/null
+++ b/services/auth/method/action_runtime_token_test.go
@@ -0,0 +1,75 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package method
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+
+	actions_model "forgejo.org/models/actions"
+	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unittest"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/services/actions"
+	auth_service "forgejo.org/services/auth"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestActionRuntimeTokenVerify(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	t.Run("Actions JWT", func(t *testing.T) {
+		const RunningTaskID = 47
+		task := &actions_model.ActionTask{
+			ID: RunningTaskID,
+			Job: &actions_model.ActionRunJob{
+				ID:    2,
+				RunID: 1,
+			},
+		}
+		token, err := actions.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
+		require.NoError(t, err)
+
+		req := http.Request{
+			URL: &url.URL{Path: "/api/v1/"},
+			Header: map[string][]string{
+				"Authorization": {fmt.Sprintf("Bearer %s", token)},
+			},
+		}
+
+		o := ActionRuntimeToken{}
+		output := o.Verify(&req, nil, nil)
+		ar, authSuccess := output.(*auth_service.AuthenticationSuccess)
+		require.True(t, authSuccess, "expected type AuthenticationSuccess, but was: %#v", output)
+		authResult := ar.Result
+		assert.Equal(t, int64(user_model.ActionsUserID), authResult.User().ID)
+		isActionsToken, authTaskID := authResult.ActionsTaskID().Get()
+		assert.True(t, isActionsToken)
+		assert.Equal(t, int64(RunningTaskID), authTaskID)
+	})
+}
+
+func TestCheckTaskIsRunning(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	cases := map[string]struct {
+		TaskID   int64
+		Expected bool
+	}{
+		"Running":   {TaskID: 47, Expected: true},
+		"Missing":   {TaskID: 1, Expected: false},
+		"Cancelled": {TaskID: 46, Expected: false},
+	}
+
+	for name := range cases {
+		c := cases[name]
+		t.Run(name, func(t *testing.T) {
+			actual := checkTaskIsRunning(t.Context(), c.TaskID)
+			assert.Equal(t, c.Expected, actual)
+		})
+	}
+}
diff --git a/services/auth/method/action_task_token.go b/services/auth/method/action_task_token.go
new file mode 100644
index 0000000000..b5e1ab4f59
--- /dev/null
+++ b/services/auth/method/action_task_token.go
@@ -0,0 +1,67 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	actions_model "forgejo.org/models/actions"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/log"
+	"forgejo.org/modules/optional"
+	"forgejo.org/modules/util"
+	"forgejo.org/modules/web/middleware"
+	"forgejo.org/services/auth"
+)
+
+var _ auth.Method = &ActionTaskToken{}
+
+type ActionTaskToken struct{}
+
+func (a *ActionTaskToken) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionStore) auth.MethodOutput {
+	// Authentication previously was performed in a single routine for `Authorization: Basic ...` and `Authorization:
+	// Bearer ...`, and both routines had separate URL exclusion lists onto which they wouldn't apply.  That behaviour
+	// is maintained by cloning those conditions here and deciding whether to look at basic/bearer auth, or not.  In the
+	// future this should be removed and migrated to route-specific middleware.
+	legacySkipBasic := !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req)
+	legacySkipFormAndBearer := !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isAuthenticatedTokenRequest(req) && !isGitRawOrAttachPath(req) && !isArchivePath(req)
+
+	maybeAuthToken := a.getTokenFromRequest(req, legacySkipBasic, legacySkipFormAndBearer)
+	if !maybeAuthToken.Has() {
+		return &auth.AuthenticationNotAttempted{}
+	}
+	_, authToken := maybeAuthToken.Get()
+
+	// check task token
+	task, err := actions_model.GetRunningTaskByToken(req.Context(), authToken)
+	if err != nil && errors.Is(err, util.ErrNotExist) {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: err}
+	} else if err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("action task token GetRunningTaskByToken: %w", err)}
+	} else if task == nil {
+		return &auth.AuthenticationError{Error: errors.New("failed to retrieve non-nil task")}
+	}
+
+	log.Trace("Basic Authorization: Valid AccessToken for task[%d]", task.ID)
+	return &auth.AuthenticationSuccess{Result: &actionsTaskTokenAuthenticationResult{user: user_model.NewActionsUser(), taskID: task.ID}}
+}
+
+func (a *ActionTaskToken) getTokenFromRequest(req *http.Request, skipBasic, skipFormAndBearer bool) optional.Option[string] {
+	if !skipFormAndBearer {
+		if has, token := tokenFromForm(req).Get(); has {
+			return optional.Some(token)
+		}
+		if has, token := tokenFromAuthorizationBearer(req).Get(); has {
+			return optional.Some(token)
+		}
+	}
+	if !skipBasic {
+		if has, token := tokenFromAuthorizationBasic(req).Get(); has {
+			return optional.Some(token)
+		}
+	}
+	return optional.None[string]()
+}
diff --git a/services/auth/method/auth_result_authorized_integration.go b/services/auth/method/auth_result_authorized_integration.go
new file mode 100644
index 0000000000..aed06e76a3
--- /dev/null
+++ b/services/auth/method/auth_result_authorized_integration.go
@@ -0,0 +1,39 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	auth_model "forgejo.org/models/auth"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/optional"
+	"forgejo.org/modules/timeutil"
+	"forgejo.org/services/auth"
+	"forgejo.org/services/authz"
+)
+
+var _ auth.AuthenticationResult = &authorizedIntegrationAuthenticationResult{}
+
+type authorizedIntegrationAuthenticationResult struct {
+	*auth.BaseAuthenticationResult
+	user      *user_model.User
+	scope     auth_model.AccessTokenScope
+	reducer   authz.AuthorizationReducer
+	expiresAt optional.Option[timeutil.TimeStamp]
+}
+
+func (r *authorizedIntegrationAuthenticationResult) User() *user_model.User {
+	return r.user
+}
+
+func (r *authorizedIntegrationAuthenticationResult) Scope() optional.Option[auth_model.AccessTokenScope] {
+	return optional.Some(r.scope)
+}
+
+func (r *authorizedIntegrationAuthenticationResult) Reducer() authz.AuthorizationReducer {
+	return r.reducer
+}
+
+func (r *authorizedIntegrationAuthenticationResult) ExpiresAt() optional.Option[timeutil.TimeStamp] {
+	return r.expiresAt
+}
diff --git a/services/auth/method/auth_result_oauth.go b/services/auth/method/auth_result_oauth.go
index ce451e6459..392e616837 100644
--- a/services/auth/method/auth_result_oauth.go
+++ b/services/auth/method/auth_result_oauth.go
@@ -14,8 +14,9 @@ var _ auth.AuthenticationResult = &oAuth2JWTAuthenticationResult{}
 
 type oAuth2JWTAuthenticationResult struct {
 	*auth.BaseAuthenticationResult
-	user  *user_model.User
-	scope optional.Option[auth_model.AccessTokenScope]
+	user        *user_model.User
+	scope       optional.Option[auth_model.AccessTokenScope]
+	grantScopes string
 }
 
 func (*oAuth2JWTAuthenticationResult) IsOAuth2JWTAuthentication() bool {
@@ -29,3 +30,7 @@ func (r *oAuth2JWTAuthenticationResult) User() *user_model.User {
 func (r *oAuth2JWTAuthenticationResult) Scope() optional.Option[auth_model.AccessTokenScope] {
 	return r.scope
 }
+
+func (r *oAuth2JWTAuthenticationResult) OAuth2GrantScopes() optional.Option[string] {
+	return optional.Some(r.grantScopes)
+}
diff --git a/services/auth/method/authorized_integration.go b/services/auth/method/authorized_integration.go
new file mode 100644
index 0000000000..d9fb0c10cc
--- /dev/null
+++ b/services/auth/method/authorized_integration.go
@@ -0,0 +1,512 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	auth_model "forgejo.org/models/auth"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/cache"
+	"forgejo.org/modules/hostmatcher"
+	"forgejo.org/modules/json"
+	"forgejo.org/modules/jwtx"
+	"forgejo.org/modules/log"
+	"forgejo.org/modules/optional"
+	"forgejo.org/modules/proxy"
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/timeutil"
+	"forgejo.org/modules/util"
+	"forgejo.org/services/auth"
+	"forgejo.org/services/authz"
+
+	"github.com/gobwas/glob"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+var (
+	_ auth.Method = &AuthorizedIntegration{}
+
+	aiHTTPClient   *http.Client
+	initHTTPClient sync.Once
+
+	errParseInternalServer = errors.New("internal server error")
+
+	// Allow mocking / overridding during tests:
+	GetAuthorizedIntegrationHTTPClient = func() *http.Client {
+		initHTTPClient.Do(initAuthorizedIntegrationHTTPClient)
+		return aiHTTPClient
+	}
+	getCache = cache.GetCache
+
+	internalIssuers = make(map[string]InternalIssuer)
+)
+
+// Authorized Integrations can verify the signature of JWTs that the application itself generated without requiring
+// remote access, and in a manner that is flexible to changes in [setting.AppURL].
+//
+// For example, Forgejo Actions is often used to access Forgejo with a JWT, by setting `enable-openid-connect: true` in
+// a workflow.  Without any special support for this internal access situation, problems would occur:
+//
+// 1. Forgejo would need to make an HTTP request to itself to get the valid public key for the JWT, in order to validate
+// its signature.  This is a waste of resources, and introduces a self-DoS risk.
+//
+// 2. Forgejo would need to be available via TLS in order for Actions to make service calls to Forgejo with that JWT
+// (due to the TLS requirement for public key fetching).
+//
+// 3. Authorized Integrations would need to be saved with the `issuer` URL of Forgejo.  If Forgejo's own
+// [setting.AppURL] changed, all the persisted records in the database would become incorrect.
+//
+// Internal Issuers work by registering a URL suffix like "/api/actions".  When a JWT is received with an issuer
+// matching [setting.AppURL] and the registered URL suffix, then the [InternalIssuer] interface is used to access the
+// JWT public key, and the value to be saved in the Authorized Integrations table as the issuer.
+func RegisterInternalIssuer(urlSuffix string, internalIssuer InternalIssuer) {
+	internalIssuers[urlSuffix] = internalIssuer
+}
+
+//mockery:generate: true
+type InternalIssuer interface {
+	// Signing key used to validate a JWT from this internal issuer.
+	SigningKey() jwtx.SigningKey
+	// Value to store in [auth_model.AuthorizedIntegration]'s Issuer field to reflect the use of this internal issuer.
+	IssuerPlaceholder() string
+}
+
+// Restrict document size to prevent resource exhaustion attack with a malicious authorized integration; largest
+// real-world openid-configuration observed is about 1kB, largest JWKS is 6kB, so for both cases 16kB should be
+// sufficient. If this needs to change in the future, it could be moved to a config setting -- but until a reason comes
+// up it seems reasonable to keep microscopic settings out-of-sight.
+const authorizedIntegrationRequestBodyLimit = int64(16 * 1024)
+
+// Authenticates incoming requests by JWTs that are issued by an authorized integration.  Authorized integrations are
+// stored in the database in the [auth_model.AuthorizedIntegration] table.  Once authenticated, the request can perform
+// actions as the owner of the authorized integration, with limited access defined by the scope and resources stored on
+// the database record.
+//
+// Authorization is received from HTTP requests as a `Authorization: Bearer [...jwt...]` (or `Authorization: Token
+// [...jwt...]`).
+type AuthorizedIntegration struct {
+	// Permit the use of `Authorization: Basic ...`, in addition to the typical bearer/token authorization header.  If
+	// true, the basic password will be interpreted as a JWT token if present and valid.  The username is ignored.
+	PermitBasic bool
+
+	// For testing -- interpret JWTs with now as a fixed time.
+	fixedTime *time.Time
+}
+
+func (a *AuthorizedIntegration) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionStore) auth.MethodOutput {
+	hasToken, token := tokenFromAuthorizationBearer(req).Get()
+	if !hasToken {
+		if !a.PermitBasic {
+			return &auth.AuthenticationNotAttempted{}
+		}
+		hasBasic, basicToken := tokenFromAuthorizationBasic(req).Get()
+		if !hasBasic {
+			return &auth.AuthenticationNotAttempted{}
+		}
+		token = basicToken
+	}
+
+	var authorizedIntegration *auth_model.AuthorizedIntegration
+
+	parsedToken, err := jwt.ParseWithClaims(token, &flexibleClaims{},
+		func(t *jwt.Token) (any, error) {
+			keyID, ok := t.Header["kid"]
+			if !ok {
+				return nil, errors.New("failed finding key identifer (kid) in JWT headers")
+			}
+
+			issuer, err := t.Claims.GetIssuer()
+			if err != nil {
+				return nil, fmt.Errorf("failed getting `iss` claim: %w", err)
+			} else if len(issuer) == 0 {
+				return nil, fmt.Errorf("invalid `iss` claim: %q", issuer)
+			}
+			audienceArray, err := t.Claims.GetAudience()
+			if err != nil {
+				return nil, fmt.Errorf("failed getting `aud` claim: %w", err)
+			} else if len(audienceArray) != 1 {
+				return nil, fmt.Errorf("required one and only one `aud` claim, but received %d", len(audienceArray))
+			}
+			audience := audienceArray[0]
+			if len(audience) == 0 {
+				return nil, fmt.Errorf("invalid `aud` claim: %q", audience)
+			}
+
+			// Check if there's an internal issuer that matches the JWT's issuer, and if so, change `queryIssuer` to the
+			// internal issuer's placeholder, and store `internalIssuer` for later:
+			queryIssuer := issuer
+			var internalIssuer InternalIssuer
+			issuerSuffix := strings.TrimPrefix(issuer, setting.AppURL)
+			if issuer != issuerSuffix { // TrimPrefix will return a different string when the prefix was present
+				if ii, ok := internalIssuers[issuerSuffix]; ok {
+					internalIssuer = ii
+					queryIssuer = internalIssuer.IssuerPlaceholder()
+				}
+			}
+
+			authorizedIntegration, err = auth_model.GetAuthorizedIntegration(req.Context(), queryIssuer, audience)
+			if errors.Is(err, util.ErrNotExist) {
+				return nil, errors.New("matching authorized_integration not found")
+			} else if err != nil {
+				return nil, fmt.Errorf("failure reading authorized_integration: %w (%w)", err, errParseInternalServer)
+			}
+
+			// Do the claim check before accessing the issuer's OIDC metadata and JWKS, to reduce risk of resource
+			// utilization attack through invalid JWTs causing remote requests.
+			err = a.checkClaims(t.Claims.(*flexibleClaims), authorizedIntegration.ClaimRules)
+			if err != nil {
+				return nil, fmt.Errorf("claim mismatch: %w", err)
+			}
+
+			// If an internal issuer was found earlier, then we can skip the JWKS fetch and just use its in-memory
+			// signing key to validate the JWT.  It is critical we do this after the `checkClaims` above so that we
+			// don't miss important validation of the JWT.
+			if internalIssuer != nil {
+				key := internalIssuer.SigningKey().VerifyKey()
+				return key, nil
+			}
+
+			issuerURL, err := url.Parse(issuer)
+			if err != nil {
+				return nil, fmt.Errorf("failed parsing issuer: %w", err)
+			}
+
+			issuerOIDCURL := issuerURL.JoinPath(".well-known/openid-configuration")
+			var oidcConfig openIDConfiguration
+			if err := authorizedIntegrationFetchJSON(issuerOIDCURL.String(), &oidcConfig); err != nil {
+				return nil, fmt.Errorf("error when fetching .well-known/openid-configuration from %s: %w", issuerOIDCURL, err)
+			}
+
+			if oidcConfig.Issuer != issuer {
+				return nil, fmt.Errorf("issuer mismatch; expected %q, received %q from %s", issuer, oidcConfig.Issuer, issuerOIDCURL)
+			}
+			if !slices.Contains(oidcConfig.IDTokenSigningAlgValuesSupported, t.Method.Alg()) {
+				return nil, fmt.Errorf("issuer supports signature algorithms %#v, but received token with algorithm %s", oidcConfig.IDTokenSigningAlgValuesSupported, t.Method.Alg())
+			}
+
+			jwksURI, err := url.Parse(oidcConfig.JwksURI)
+			if err != nil {
+				return nil, fmt.Errorf("failed parsing jwks_uri: %w", err)
+			} else if jwksURI.Host != issuerURL.Host {
+				// Prevent SSRF which could occur if a malicious openid-connection response returned a jwks_uri field
+				// that causes Forgejo to access other hostnames.  This could be considered a valid case as well and we
+				// can rely on the config-based allowed and blocked domains for the [authorized_integration] section,
+				// but until a real-world case comes up where that is needed, this is a safety-first restriction.
+				return nil, fmt.Errorf("jwks_uri host mismatch: must be the same as issuer host %q, but was %q", issuerURL.Host, jwksURI.Host)
+			}
+			var keys openIDKeys
+			if err := authorizedIntegrationFetchJSON(oidcConfig.JwksURI, &keys); err != nil {
+				return nil, fmt.Errorf("error when fetching JWKS from %s: %w", oidcConfig.JwksURI, err)
+			}
+
+			for _, key := range keys.Keys {
+				if key["kid"] == keyID {
+					alg, algPresent := key["alg"] // "alg" is an optional field
+					if algPresent && alg != t.Method.Alg() {
+						return nil, fmt.Errorf("kid %q doesn't match expected algorithm %s, was %v", keyID, t.Method.Alg(), key["alg"])
+					}
+
+					use, usePresent := key["use"] // "use" is also an optional field
+					if usePresent && use != "sig" {
+						return nil, fmt.Errorf("kid %q isn't designated for signing usage, was %s", keyID, key["use"])
+					}
+
+					pub, err := jwtx.ParseJWKToPublicKey(key)
+					if err != nil {
+						return nil, fmt.Errorf("failed to parse JWKS: %w", err)
+					}
+					return pub, nil
+				}
+			}
+
+			return nil, errors.New("no key identified")
+		},
+		jwt.WithValidMethods(jwtx.ValidAsymmetricAlgorithms), // only asymetric algorithms, as JWKS must have a public key only
+		jwt.WithIssuedAt(),
+		jwt.WithTimeFunc(func() time.Time {
+			if a.fixedTime != nil {
+				return *a.fixedTime
+			}
+			return time.Now()
+		}),
+	)
+	if err != nil && errors.Is(err, errParseInternalServer) {
+		// Errors from parsing marked errParseInternalServer are AuthenticationError, not incorrect creds:
+		return &auth.AuthenticationError{Error: err}
+	} else if err != nil {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: fmt.Errorf("authorized integration: parse JWT error: %w", err)}
+	} else if !parsedToken.Valid {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: errors.New("authorized integration: JWT not valid")}
+	} else if authorizedIntegration == nil { // shouldn't be possible, but overly safe
+		return &auth.AuthenticationError{Error: errors.New("authorized integration: nil authorized integration")}
+	}
+
+	u, err := user_model.GetUserByID(req.Context(), authorizedIntegration.UserID)
+	if err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("authorized integration: GetUserByID: %w", err)}
+	}
+
+	if err = authorizedIntegration.UpdateLastUsed(req.Context()); err != nil {
+		log.Error("UpdateLastUsed:  %v", err)
+	}
+
+	reducer, err := authz.GetAuthorizationReducerForAuthorizedIntegration(req.Context(), authorizedIntegration)
+	if err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("authorized integration GetAuthorizationReducerForAuthorizedIntegration: %w", err)}
+	}
+
+	var optionalExp optional.Option[timeutil.TimeStamp]
+	if exp, err := parsedToken.Claims.GetExpirationTime(); err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("authorized integration GetExpirationTime: %w", err)}
+	} else if exp != nil {
+		optionalExp = optional.Some(timeutil.TimeStamp(exp.Unix()))
+	}
+
+	return &auth.AuthenticationSuccess{
+		Result: &authorizedIntegrationAuthenticationResult{
+			user:      u,
+			scope:     authorizedIntegration.Scope,
+			reducer:   reducer,
+			expiresAt: optionalExp,
+		},
+	}
+}
+
+func initAuthorizedIntegrationHTTPClient() {
+	blockList := hostmatcher.ParseSimpleMatchList("authorized_integration.BLOCKED_DOMAINS", setting.AuthorizedIntegration.BlockedDomains)
+
+	allowList := hostmatcher.ParseSimpleMatchList("authorized_integration.ALLOWED_DOMAINS", setting.AuthorizedIntegration.AllowedDomains)
+	if allowList.IsEmpty() {
+		// the default policy is that authorized integrations can access external hosts
+		allowList.AppendBuiltin(hostmatcher.MatchBuiltinExternal)
+	}
+	if setting.AuthorizedIntegration.AllowLocalNetworks {
+		allowList.AppendBuiltin(hostmatcher.MatchBuiltinPrivate)
+		allowList.AppendBuiltin(hostmatcher.MatchBuiltinLoopback)
+	}
+
+	aiHTTPClient = &http.Client{
+		Timeout: setting.AuthorizedIntegration.RequestTimeout,
+		Transport: &http.Transport{
+			Proxy:       proxy.Proxy(),
+			DialContext: hostmatcher.NewDialContext("authorized_integration", allowList, blockList, setting.Proxy.ProxyURLFixed),
+		},
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			// It might be possible to come up with some reasonable capability to support redirects -- such as
+			// keeping them within the same issuer host? -- but there are risks that this can be used for SSRF
+			// attacks.  In the face of those risks, and with a lack of real-world use-cases, disable redirects.
+			return errors.New("authorized integration: HTTP redirects are disabled")
+		},
+	}
+}
+
+func authorizedIntegrationCacheKey(urlString string) string {
+	return fmt.Sprintf("auth-int-remote:%s", urlString)
+}
+
+func authorizedIntegrationCacheGetJSON[K any](urlString string, v *K) bool {
+	conn := getCache()
+	if conn == nil {
+		return false
+	}
+
+	cachedAny := conn.Get(authorizedIntegrationCacheKey(urlString))
+	if cachedAny == nil {
+		return false
+	}
+	cachedBytes, ok := cachedAny.([]byte)
+	if !ok {
+		cachedString, ok := cachedAny.(string)
+		if !ok {
+			log.Error("cached content was not []byte or string, but was %T", cachedAny)
+			return false
+		}
+		cachedBytes = []byte(cachedString)
+	}
+
+	err := json.Unmarshal(cachedBytes, &v)
+	if err != nil {
+		// This error case shouldn't occur, as we only store data in the cache once we're sure we could unmarshal it.
+		// If it does occur, log and fallback to treating as uncached.
+		log.Error("failed to Unmarshal cached content: %s", err)
+		// Caller may reuse `v` in a future unmarshal/decode call, and failure here may have polluted it.
+		var zeroValue K
+		*v = zeroValue
+		return false
+	}
+
+	return true
+}
+
+func authorizedIntegrationCacheSetJSON(urlString string, buf []byte) {
+	conn := getCache()
+	if conn == nil {
+		return
+	}
+	err := conn.Put(authorizedIntegrationCacheKey(urlString), buf, int64(setting.AuthorizedIntegration.CacheTTL.Seconds()))
+	if err != nil {
+		log.Error("failed to put cache: %s", err)
+	}
+}
+
+func authorizedIntegrationFetchJSON[K any](urlString string, v *K) error {
+	parsedURL, err := url.Parse(urlString)
+	if err != nil {
+		return fmt.Errorf("failed parsing URL %q: %w", urlString, err)
+	}
+	// Fetching openid-connect or JWKS needs to come from a source that is authentic, and therefore only `https` is
+	// supported.  This also protects against a trusted issuer being configured maliciously  as `file://` or a JKWS URI
+	// being `file://` -- the HTTP client won't permit that, but, extra safety doesn't hurt.
+	if parsedURL.Scheme != "https" {
+		return fmt.Errorf("unsupported URL scheme: %q", parsedURL.String())
+	}
+
+	// Check our cache, save a remote HTTP interaction.
+	if authorizedIntegrationCacheGetJSON(urlString, v) {
+		return nil
+	}
+
+	resp, err := GetAuthorizedIntegrationHTTPClient().Get(parsedURL.String())
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("non-OK response code: %s", resp.Status)
+	}
+
+	bodyReader := io.LimitReader(resp.Body, authorizedIntegrationRequestBodyLimit)
+	var buf bytes.Buffer
+	_, err = io.Copy(bufio.NewWriter(&buf), bodyReader)
+	if err != nil {
+		return fmt.Errorf("read from remote error: %w", err)
+	}
+
+	err = json.Unmarshal(buf.Bytes(), &v)
+	if err != nil {
+		// If a decoding error is hit, decorate with information about the limited body size so that it doesn't look
+		// like the remote server provided an incomplete response. err should be something like `io.UnexpectedEOF` in
+		// this case, but it actually isn't, so don't bother trying to detect precisely.
+		return fmt.Errorf("failed to decode (response body restricted to %d bytes): %w", authorizedIntegrationRequestBodyLimit, err)
+	}
+
+	// Successfully decoded the response -- cache the raw bytes for later access.
+	authorizedIntegrationCacheSetJSON(urlString, buf.Bytes())
+
+	return nil
+}
+
+// Compare a map[string]any of incoming claims against an array of claim rules.  All rules must match successfully or
+// else an error with the mismatch detail is returned.
+func (a *AuthorizedIntegration) checkClaims(incomingClaims any, stored *auth_model.ClaimRules) error {
+	if stored == nil {
+		return nil
+	}
+
+	for _, rule := range stored.Rules {
+		var lhs any
+
+		if lhsClaim, isFlex := incomingClaims.(*flexibleClaims); isFlex {
+			switch rule.Claim {
+			case "iss":
+				lhs = lhsClaim.Issuer
+			case "sub":
+				lhs = lhsClaim.Subject
+			case "jti":
+				lhs = lhsClaim.ID
+			case "aud":
+				audienceArray, err := lhsClaim.GetAudience()
+				if err != nil {
+					return fmt.Errorf("failed getting `aud` claim: %w", err)
+				} else if len(audienceArray) != 1 {
+					return fmt.Errorf("required one and only one `aud` claim, but received %d", len(audienceArray))
+				}
+				lhs = audienceArray[0]
+			default:
+				v, present := lhsClaim.other[rule.Claim]
+				if !present {
+					return fmt.Errorf("claim rule on %q couldn't be satisfied: claim not found", rule.Claim)
+				}
+				lhs = v
+			}
+		} else if lhsMap, isMap := incomingClaims.(map[string]any); isMap {
+			v, present := lhsMap[rule.Claim]
+			if !present {
+				return fmt.Errorf("claim rule on %q couldn't be satisfied: claim not found", rule.Claim)
+			}
+			lhs = v
+		} else {
+			return fmt.Errorf("unexpected incoming claims type: %T", incomingClaims)
+		}
+
+		switch rule.Comparison {
+		case auth_model.ClaimEqual:
+			lhsStr, ok := lhs.(string)
+			if !ok {
+				return fmt.Errorf("claim %q must be a string, but was %T", rule.Claim, lhs)
+			} else if lhsStr != rule.Value {
+				return fmt.Errorf("claim %q must be %q, but was %q", rule.Claim, rule.Value, lhsStr)
+			}
+		case auth_model.ClaimIn:
+			lhsStr, ok := lhs.(string)
+			if !ok {
+				return fmt.Errorf("claim %q must be a string, but was %T", rule.Claim, lhs)
+			} else if !slices.Contains(rule.Values, lhsStr) {
+				return fmt.Errorf("claim %q must be one of %q, but was %q", rule.Claim, rule.Values, lhsStr)
+			}
+		case auth_model.ClaimGlob:
+			lhsStr, ok := lhs.(string)
+			if !ok {
+				return fmt.Errorf("claim %q must be a string, but was %T", rule.Claim, lhs)
+			}
+			r, err := glob.Compile(rule.Value)
+			if err != nil {
+				return fmt.Errorf("unable to parse glob for claim rule on %q; glob = %q, err = %w", rule.Claim, rule.Value, err)
+			}
+			if !r.Match(lhsStr) {
+				return fmt.Errorf("claim %q must match glob %q, but value %q did not match", rule.Claim, rule.Value, lhsStr)
+			}
+		case auth_model.ClaimGlobIn:
+			lhsStr, ok := lhs.(string)
+			if !ok {
+				return fmt.Errorf("claim %q must be a string, but was %T", rule.Claim, lhs)
+			}
+			matched := false
+			for _, g := range rule.Values {
+				r, err := glob.Compile(g)
+				if err != nil {
+					return fmt.Errorf("unable to parse glob for claim rule on %q; glob = %q, err = %w", rule.Claim, g, err)
+				}
+				if r.Match(lhsStr) {
+					matched = true
+					break
+				}
+			}
+			if !matched {
+				return fmt.Errorf("claim %q must glob match one of %q, but value %q did not match", rule.Claim, rule.Values, lhsStr)
+			}
+		case auth_model.ClaimNested:
+			lhsMap, ok := lhs.(map[string]any)
+			if !ok {
+				return fmt.Errorf("claim %q must be a map, but was %T", rule.Claim, lhs)
+			} else if err := a.checkClaims(lhsMap, rule.Nested); err != nil {
+				return fmt.Errorf("in nested claim %q: %w", rule.Claim, err)
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/services/auth/method/authorized_integration_claims.go b/services/auth/method/authorized_integration_claims.go
new file mode 100644
index 0000000000..1518683ca8
--- /dev/null
+++ b/services/auth/method/authorized_integration_claims.go
@@ -0,0 +1,109 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"fmt"
+	"maps"
+
+	"forgejo.org/modules/json"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// Structure for inspecting the standard claims of a JWT (jwt.RegisteredClaims), which also stores any provided
+// service-defined claims in an unstructured map[string]any.
+type flexibleClaims struct {
+	jwt.RegisteredClaims
+	other map[string]any
+}
+
+// Populate a [flexibleClaims] from JSON data, implementing [json.Unmarshaler].
+func (a *flexibleClaims) UnmarshalJSON(b []byte) error {
+	var s map[string]any
+	if err := json.Unmarshal(b, &s); err != nil {
+		return err
+	}
+
+	var rc jwt.RegisteredClaims
+	other := map[string]any{}
+	for k, v := range s {
+		switch k {
+		case "iss":
+			str, ok := v.(string)
+			if !ok {
+				return fmt.Errorf("expected `iss` to be string, but was %v", v)
+			}
+			rc.Issuer = str
+		case "sub":
+			str, ok := v.(string)
+			if !ok {
+				return fmt.Errorf("expected `sub` to be string, but was %v", v)
+			}
+			rc.Subject = str
+		case "aud":
+			b, err := json.Marshal(v)
+			if err != nil {
+				return fmt.Errorf("uanble to return `aud` to []byte: %w", err)
+			}
+			if err := json.Unmarshal(b, &rc.Audience); err != nil {
+				return fmt.Errorf("uanble to decode `aud: %w", err)
+			}
+		case "exp":
+			b, err := json.Marshal(v)
+			if err != nil {
+				return fmt.Errorf("uanble to return `exp` to []byte: %w", err)
+			}
+			if err := json.Unmarshal(b, &rc.ExpiresAt); err != nil {
+				return fmt.Errorf("uanble to decode `exp: %w", err)
+			}
+		case "nbf":
+			b, err := json.Marshal(v)
+			if err != nil {
+				return fmt.Errorf("uanble to return `nbf` to []byte: %w", err)
+			}
+			if err := json.Unmarshal(b, &rc.NotBefore); err != nil {
+				return fmt.Errorf("uanble to decode `nbf: %w", err)
+			}
+		case "iat":
+			b, err := json.Marshal(v)
+			if err != nil {
+				return fmt.Errorf("uanble to return `iat` to []byte: %w", err)
+			}
+			if err := json.Unmarshal(b, &rc.IssuedAt); err != nil {
+				return fmt.Errorf("uanble to decode `iat: %w", err)
+			}
+		case "jti":
+			str, ok := v.(string)
+			if !ok {
+				return fmt.Errorf("expected `jti` to be string, but was %v", v)
+			}
+			rc.ID = str
+		default:
+			other[k] = v
+		}
+	}
+
+	a.RegisteredClaims = rc
+	a.other = other
+
+	return nil
+}
+
+// Marshal flexibleClaims to JSON, merging both the registered claims and the additional claims into a map.
+func (a flexibleClaims) MarshalJSON() ([]byte, error) {
+	rcJSON, err := json.Marshal(a.RegisteredClaims)
+	if err != nil {
+		return nil, err
+	}
+
+	var fullMap map[string]any
+	err = json.Unmarshal(rcJSON, &fullMap)
+	if err != nil {
+		return nil, err
+	}
+	maps.Copy(fullMap, a.other)
+
+	return json.Marshal(fullMap)
+}
diff --git a/services/auth/method/authorized_integration_claims_test.go b/services/auth/method/authorized_integration_claims_test.go
new file mode 100644
index 0000000000..399bb6138e
--- /dev/null
+++ b/services/auth/method/authorized_integration_claims_test.go
@@ -0,0 +1,149 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"testing"
+	"time"
+
+	"forgejo.org/modules/json"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Real-world Forgejo Actions claims, Forgejo v15
+const forgejoClaims = `
+{
+  "actor": "coolguy",
+  "aud": "https://example.org/-/coolguy/authorized-integration/346e1496",
+  "base_ref": "main",
+  "event_name": "pull_request",
+  "exp": 1776979110,
+  "head_ref": "forgejo-oidc-test",
+  "iat": 1776975510,
+  "iss": "https://example.org/api/actions",
+  "nbf": 1776975510,
+  "ref": "refs/pull/113/head",
+  "ref_protected": "false",
+  "ref_type": "",
+  "repository": "coolguy/test",
+  "repository_owner": "coolguy",
+  "run_attempt": "4",
+  "run_id": "3572",
+  "run_number": "2054",
+  "sha": "d4083cc0f4e7452dc00f7a5f73ec5486a549adb9",
+  "sub": "repo:coolguy/test:pull_request",
+  "workflow": "main.yml",
+  "workflow_ref": "coolguy/test/.forgejo/workflows/main.yml@refs/pull/113/head"
+}
+`
+
+// Real-world GitHub Actions claims
+const githubClaims = `
+{
+  "actor": "coolguy",
+  "actor_id": "91093",
+  "aud": "https://example.org/-/coolguy/authorized-integration/6cc55ba0",
+  "base_ref": "main",
+  "check_run_id": "72783197645",
+  "event_name": "pull_request",
+  "exp": 1776980496,
+  "head_ref": "github-oidc-test",
+  "iat": 1776980196,
+  "iss": "https://token.actions.githubusercontent.com",
+  "job_workflow_ref": "coolguy/forgejo-runner-testrepo/.github/workflows/main.yml@refs/pull/3/merge",
+  "job_workflow_sha": "62a34e2bf42fda53a0209bfd485dcab3013b1160",
+  "jti": "83545042-379e-4328-8e60-3b6d46594a5f",
+  "nbf": 1776979896,
+  "ref": "refs/pull/3/merge",
+  "ref_protected": "false",
+  "ref_type": "branch",
+  "repository": "coolguy/forgejo-runner-testrepo",
+  "repository_id": "1113890566",
+  "repository_owner": "coolguy",
+  "repository_owner_id": "91093",
+  "repository_visibility": "private",
+  "run_attempt": "8",
+  "run_id": "24846522812",
+  "run_number": "10",
+  "runner_environment": "github-hosted",
+  "sha": "62a34e2bf42fda53a0209bfd485dcab3013b1160",
+  "sub": "repo:coolguy/forgejo-runner-testrepo:pull_request",
+  "workflow": ".github/workflows/main.yml",
+  "workflow_ref": "coolguy/forgejo-runner-testrepo/.github/workflows/main.yml@refs/pull/3/merge",
+  "workflow_sha": "62a34e2bf42fda53a0209bfd485dcab3013b1160"
+}
+`
+
+// Real-world AWS Federated Web Identity claims
+const awsClaims = `
+{
+  "aud": "https://example.org/-/coolguy/authorized-integration/7895835c",
+  "sub": "arn:aws:iam::1234567890:role/service-role/forgejo-oidc-accepting-test-role-x7t3fgko",
+  "https://sts.amazonaws.com/": {
+    "aws_account": "1234567890",
+    "original_session_exp": "2026-04-24T09:34:34Z",
+    "source_region": "us-west-2",
+    "principal_id": "arn:aws:iam::1234567890:role/service-role/forgejo-oidc-accepting-test-role-x7t3fgko",
+    "lambda_source_function_arn": "arn:aws:lambda:us-west-2:1234567890:function:forgejo-oidc-accepting-test"
+  },
+  "iss": "https://a103a2cc-b461-473d-84fe-6c4f6d45af88.tokens.sts.global.api.aws",
+  "exp": 1776980375,
+  "iat": 1776980075,
+  "jti": "0afcbeb7-512d-479f-b596-703c03ae65a5"
+}
+`
+
+func TestFlexibleClaimsUnmarshal(t *testing.T) {
+	t.Run("Forgejo", func(t *testing.T) {
+		var retval flexibleClaims
+		data := []byte(forgejoClaims)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		// assert the claims that are handled specially in flexibleClaims UnmarshalJSON
+		assert.Equal(t, "https://example.org/api/actions", retval.Issuer)
+		assert.Equal(t, "repo:coolguy/test:pull_request", retval.Subject)
+		assert.Equal(t, jwt.ClaimStrings{"https://example.org/-/coolguy/authorized-integration/346e1496"}, retval.Audience)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 21, 18, 30, 0, time.Local)}, retval.ExpiresAt)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 20, 18, 30, 0, time.Local)}, retval.NotBefore)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 20, 18, 30, 0, time.Local)}, retval.IssuedAt)
+		assert.Empty(t, retval.ID)
+		// short check that the 'other' claims were stored as well
+		assert.Equal(t, "d4083cc0f4e7452dc00f7a5f73ec5486a549adb9", retval.other["sha"])
+		assert.Len(t, retval.other, 15)
+	})
+	t.Run("GitHub", func(t *testing.T) {
+		var retval flexibleClaims
+		data := []byte(githubClaims)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		// assert the claims that are handled specially in flexibleClaims UnmarshalJSON
+		assert.Equal(t, "https://token.actions.githubusercontent.com", retval.Issuer)
+		assert.Equal(t, "repo:coolguy/forgejo-runner-testrepo:pull_request", retval.Subject)
+		assert.Equal(t, jwt.ClaimStrings{"https://example.org/-/coolguy/authorized-integration/6cc55ba0"}, retval.Audience)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 21, 41, 36, 0, time.Local)}, retval.ExpiresAt)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 21, 31, 36, 0, time.Local)}, retval.NotBefore)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 21, 36, 36, 0, time.Local)}, retval.IssuedAt)
+		assert.Equal(t, "83545042-379e-4328-8e60-3b6d46594a5f", retval.ID)
+		// short check that the 'other' claims were stored as well
+		assert.Equal(t, "62a34e2bf42fda53a0209bfd485dcab3013b1160", retval.other["sha"])
+		assert.Len(t, retval.other, 24)
+	})
+	t.Run("AWS", func(t *testing.T) {
+		var retval flexibleClaims
+		data := []byte(awsClaims)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		// assert the claims that are handled specially in flexibleClaims UnmarshalJSON
+		assert.Equal(t, "https://a103a2cc-b461-473d-84fe-6c4f6d45af88.tokens.sts.global.api.aws", retval.Issuer)
+		assert.Equal(t, "arn:aws:iam::1234567890:role/service-role/forgejo-oidc-accepting-test-role-x7t3fgko", retval.Subject)
+		assert.Equal(t, jwt.ClaimStrings{"https://example.org/-/coolguy/authorized-integration/7895835c"}, retval.Audience)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 21, 39, 35, 0, time.Local)}, retval.ExpiresAt)
+		assert.Nil(t, retval.NotBefore)
+		assert.Equal(t, &jwt.NumericDate{Time: time.Date(2026, time.April, 23, 21, 34, 35, 0, time.Local)}, retval.IssuedAt)
+		assert.Equal(t, "0afcbeb7-512d-479f-b596-703c03ae65a5", retval.ID)
+		// short check that the 'other' claims were stored as well
+		assert.Equal(t, "1234567890", retval.other["https://sts.amazonaws.com/"].(map[string]any)["aws_account"])
+		assert.Len(t, retval.other, 1)
+	})
+}
diff --git a/services/auth/method/authorized_integration_oidc.go b/services/auth/method/authorized_integration_oidc.go
new file mode 100644
index 0000000000..2e35b63ace
--- /dev/null
+++ b/services/auth/method/authorized_integration_oidc.go
@@ -0,0 +1,20 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+// Response structure for a JWT issuer's `${iss}/.well-known/openid-configuration` URL endpoint; this is pared down to
+// the relevant entries for authorized integrations to inspect from the remote issuer.
+type openIDConfiguration struct {
+	Issuer                           string   `json:"issuer"`
+	JwksURI                          string   `json:"jwks_uri"`
+	IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported"`
+}
+
+// Response structure for a JSON Web Key Set, which is typically read from the JwksURI field of [openIDConfiguration].
+type openIDKeys struct {
+	// Typically map[string]string, for fields like "kty", "alg", "use", "kid", "n", "e", but also string:any for fields
+	// like x5c which are []string. We currently don't parse any fields that aren't string, but we need to Unmarshal
+	// into this field successfully in those cases.
+	Keys []map[string]any `json:"keys"`
+}
diff --git a/services/auth/method/authorized_integration_oidc_test.go b/services/auth/method/authorized_integration_oidc_test.go
new file mode 100644
index 0000000000..b394ab0c01
--- /dev/null
+++ b/services/auth/method/authorized_integration_oidc_test.go
@@ -0,0 +1,273 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"testing"
+
+	"forgejo.org/modules/json"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Real-world Forgejo Actions .well-known/openid-configuration from Forgejo v15
+const forgejoOIDC = `
+{
+    "issuer": "https://example.org/api/actions",
+    "jwks_uri": "https://example.org/api/actions/.well-known/keys",
+    "subject_types_supported": [
+        "public"
+    ],
+    "response_types_supported": [
+        "id_token"
+    ],
+    "claims_supported": [
+        "sub",
+        "aud",
+        "exp",
+        "iat",
+        "iss",
+        "nbf",
+        "actor",
+        "base_ref",
+        "event_name",
+        "head_ref",
+        "ref",
+        "ref_protected",
+        "ref_type",
+        "repository",
+        "repository_owner",
+        "run_attempt",
+        "run_id",
+        "run_number",
+        "sha",
+        "workflow",
+        "workflow_ref"
+    ],
+    "id_token_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "scopes_supported": [
+        "openid"
+    ]
+}
+`
+
+// Real-world Forgejo Actions JWKS from Forgejo v15
+const forgejoJWKS = `
+{
+    "keys": [
+        {
+            "alg": "RS256",
+            "e": "AQAB",
+            "kid": "SNNttXGzw6l53JC158lXddjSjQ5bJ9bdTTqTi12gaLY",
+            "kty": "RSA",
+            "n": "7RL963BVzemasfImhlR3KUX97YdA7g3SBnq_ZLzcdxLXPGDhsnSoxMX7gY30b1qpQlML8yiAyz_gxUydiVlqpEEPypR9lfKtZXv4JTM-X2rccegcreUyfFJnFuzVUoY7SVEzAulLUwqP8MH8kxDI7JZRQ8_JIjm9IxEuWCSc3XnVxNCTS2XEdHsug_Kt6SQdcH8xL9U2w0EHAUna9KkLAl6_PzBg1JxIQDHQtfp_CN7YNyoyilH88XAGEeQm0fLz6GH7hhyw6y1b9NprYIxNrdD4Pb1b66j4K--bCJy530UmEAlfLbCiDCh4k78TPUnU_YwwT4ujC0t28zoHNB3Y0w",
+            "use": "sig"
+        }
+    ]
+}
+`
+
+// Real-world GitHub Actions /.well-known/openid-configuration
+const githubOIDC = `
+{
+    "issuer": "https://token.actions.githubusercontent.com",
+    "jwks_uri": "https://token.actions.githubusercontent.com/.well-known/jwks",
+    "subject_types_supported": [
+        "public",
+        "pairwise"
+    ],
+    "response_types_supported": [
+        "id_token"
+    ],
+    "claims_supported": [
+        "sub",
+        "aud",
+        "exp",
+        "iat",
+        "iss",
+        "jti",
+        "nbf",
+        "ref",
+        "sha",
+        "repository",
+        "repository_id",
+        "repository_owner",
+        "repository_owner_id",
+        "enterprise",
+        "enterprise_id",
+        "run_id",
+        "run_number",
+        "run_attempt",
+        "actor",
+        "actor_id",
+        "workflow",
+        "workflow_ref",
+        "workflow_sha",
+        "head_ref",
+        "base_ref",
+        "event_name",
+        "ref_type",
+        "ref_protected",
+        "environment",
+        "environment_node_id",
+        "job_workflow_ref",
+        "job_workflow_sha",
+        "repository_visibility",
+        "runner_environment",
+        "issuer_scope",
+        "check_run_id"
+    ],
+    "id_token_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "scopes_supported": [
+        "openid"
+    ]
+}
+`
+
+// Real-world GitHub Actions JWKS
+const githubJWKS = `
+{
+    "keys": [
+        {
+            "kty": "RSA",
+            "alg": "RS256",
+            "use": "sig",
+            "kid": "cc413527-173f-5a05-976e-9c52b1d7b431",
+            "n": "w4M936N3ZxNaEblcUoBm-xu0-V9JxNx5S7TmF0M3SBK-2bmDyAeDdeIOTcIVZHG-ZX9N9W0u1yWafgWewHrsz66BkxXq3bscvQUTAw7W3s6TEeYY7o9shPkFfOiU3x_KYgOo06SpiFdymwJflRs9cnbaU88i5fZJmUepUHVllP2tpPWTi-7UA3AdP3cdcCs5bnFfTRKzH2W0xqKsY_jIG95aQJRBDpbiesefjuyxcQnOv88j9tCKWzHpJzRKYjAUM6OPgN4HYnaSWrPJj1v41eEkFM1kORuj-GSH2qMVD02VklcqaerhQHIqM-RjeHsN7G05YtwYzomE5G-fZuwgvQ",
+            "e": "AQAB"
+        },
+        {
+            "kty": "RSA",
+            "alg": "RS256",
+            "use": "sig",
+            "kid": "38826b17-6a30-5f9b-b169-8beb8202f723",
+            "n": "5Manmy-zwsk3wEftXNdKFZec4rSWENW4jTGevlvAcU9z3bgLBogQVvqYLtu9baVm2B3rfe5onadobq8po5UakJ0YsTiiEfXWdST7YI2Sdkvv-hOYMcZKYZ4dFvuSO1vQ2DgEkw_OZNiYI1S518MWEcNxnPU5u67zkawAGsLlmXNbOylgVfBRJrG8gj6scr-sBs4LaCa3kg5IuaCHe1pB-nSYHovGV_z0egE83C098FfwO1dNZBWeo4Obhb5Z-ZYFLJcZfngMY0zJnCVNmpHQWOgxfGikh3cwi4MYrFrbB4NTlxbrQ3bL-rGKR5X318veyDlo8Dyz2KWMobT4wB9U1Q",
+            "e": "AQAB",
+            "x5c": [
+                "MIIDKzCCAhOgAwIBAgIUDnwm6eRIqGFA3o/P1oBrChvx/nowDQYJKoZIhvcNAQELBQAwJTEjMCEGA1UEAwwaYWN0aW9ucy5zZWxmLXNpZ25lZC5naXRodWIwHhcNMjQwMTIzMTUyNTM2WhcNMzQwMTIwMTUyNTM2WjAlMSMwIQYDVQQDDBphY3Rpb25zLnNlbGYtc2lnbmVkLmdpdGh1YjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOTGp5svs8LJN8BH7VzXShWXnOK0lhDVuI0xnr5bwHFPc924CwaIEFb6mC7bvW2lZtgd633uaJ2naG6vKaOVGpCdGLE4ohH11nUk+2CNknZL7/oTmDHGSmGeHRb7kjtb0Ng4BJMPzmTYmCNUudfDFhHDcZz1Obuu85GsABrC5ZlzWzspYFXwUSaxvII+rHK/rAbOC2gmt5IOSLmgh3taQfp0mB6Lxlf89HoBPNwtPfBX8DtXTWQVnqODm4W+WfmWBSyXGX54DGNMyZwlTZqR0FjoMXxopId3MIuDGKxa2weDU5cW60N2y/qxikeV99fL3sg5aPA8s9iljKG0+MAfVNUCAwEAAaNTMFEwHQYDVR0OBBYEFIPALo5VanJ6E1B9eLQgGO+uGV65MB8GA1UdIwQYMBaAFIPALo5VanJ6E1B9eLQgGO+uGV65MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAGS0hZE+DqKIRi49Z2KDOMOaSZnAYgqq6ws9HJHT09MXWlMHB8E/apvy2ZuFrcSu14ZLweJid+PrrooXEXEO6azEakzCjeUb9G1QwlzP4CkTcMGCw1Snh3jWZIuKaw21f7mp2rQ+YNltgHVDKY2s8AD273E8musEsWxJl80/MNvMie8Hfh4n4/Xl2r6t1YPmUJMoXAXdTBb0hkPy1fUu3r2T+1oi7Rw6kuVDfAZjaHupNHzJeDOg2KxUoK/GF2/M2qpVrd19Pv/JXNkQXRE4DFbErMmA7tXpp1tkXJRPhFui/Pv5H9cPgObEf9x6W4KnCXzT3ReeeRDKF8SqGTPELsc="
+            ],
+            "x5t": "ykNaY4qM_ta4k2TgZOCEYLkcYlA"
+        },
+        {
+            "kty": "RSA",
+            "alg": "RS256",
+            "use": "sig",
+            "kid": "38E9B30B3A023A1B72309921A69A42FCC496C42C",
+            "n": "tEq2Fp9HcdT5MwMsB_UTm8j_woJJLi3sA-y0RX2tioTm581seyfvOH6lJ5JmHVtS-_fb8B2tRT1pznHQSNq14PsJdu9bp5egbWmIz-5RvhqoM-oKem_MJENCNFuqXijRLT47FRdfH3inqde1vJlA_JJHCqYMKIpHH7kqNFYcCpwr0vk80Hc2rTyL0uBXI7NqBZbtUgNoyucWO5O7QQrPNOmlr-GI8aFckFRfobCaCOiH9qW02FtkV74fwBGVCNhNf3a1CK81-O8xEGimvVydI_pQA5B8QqVuQjY_ntOu555HdirA0hKkY6fsE9eZCMFmWDHZ2kSWLjhabxWxIzSzXQ",
+            "e": "AQAB",
+            "x5c": [
+                "MIIDrDCCApSgAwIBAgIQbuIOJTcGQ4GOQs29F1/uLzANBgkqhkiG9w0BAQsFADA2MTQwMgYDVQQDEyt2c3RzLXZzdHNnaHJ0LWdoLXZzby1vYXV0aC52aXN1YWxzdHVkaW8uY29tMB4XDTI1MDkxMTE5MzcxOFoXDTI3MDkxMTE5NDcxOFowNjE0MDIGA1UEAxMrdnN0cy12c3RzZ2hydC1naC12c28tb2F1dGgudmlzdWFsc3R1ZGlvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALRKthafR3HU+TMDLAf1E5vI/8KCSS4t7APstEV9rYqE5ufNbHsn7zh+pSeSZh1bUvv32/AdrUU9ac5x0EjateD7CXbvW6eXoG1piM/uUb4aqDPqCnpvzCRDQjRbql4o0S0+OxUXXx94p6nXtbyZQPySRwqmDCiKRx+5KjRWHAqcK9L5PNB3Nq08i9LgVyOzagWW7VIDaMrnFjuTu0EKzzTppa/hiPGhXJBUX6Gwmgjoh/altNhbZFe+H8ARlQjYTX92tQivNfjvMRBopr1cnSP6UAOQfEKlbkI2P57TrueeR3YqwNISpGOn7BPXmQjBZlgx2dpEli44Wm8VsSM0s10CAwEAAaOBtTCBsjAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwNgYDVR0RBC8wLYIrdnN0cy12c3RzZ2hydC1naC12c28tb2F1dGgudmlzdWFsc3R1ZGlvLmNvbTAfBgNVHSMEGDAWgBQLxdObdnfWzaBcxau87tdSUtEuQjAdBgNVHQ4EFgQUC8XTm3Z31s2gXMWrvO7XUlLRLkIwDQYJKoZIhvcNAQELBQADggEBAD2Eo703wXQgB2vJn/RwTTcHGkeMkYXm0mWCxOSh4iCKVvqypBJrmLzRkMMJN0/10qIGciYWUl6EkL7yj48tpXXH01Ep0ONDdo9UYmKGp81Z4j3u3FBJTVQSdj2tnPOPZlYWaBkerIkcIeyWBRKvne1UBaobbk84epfBmUfAMFmyJEk+x+q7cqmsbjDtdrmhiWaInqCijpS2dW2MitJ5F7tBBS26SMTqLQteA2IOwIW1BMlYIPuSO3dKn/rYVS8RjL+x+MxP98vla5sichoEZwVWnXiXgFZ4n/asGqc+Da9q6ILLtInvgI5bi7kjJJ2ARTRC5/a+J/v3EL+t8SdnOO8="
+            ],
+            "x5t": "OOmzCzoCOhtyMJkhpppC_MSWxCw"
+        },
+        {
+            "kty": "RSA",
+            "alg": "RS256",
+            "use": "sig",
+            "kid": "4F3E9AD8C9A6F5EB3173006F4FA630E28F43DCE9",
+            "n": "tGevqhkBGn8NB0dKxs8Ddxhn-xZPm55svcSlkJZEOwDOXDLl_0-iVOVKNJfcHHLHvMqa6zh2DDcpAWZi2FpeBAJupsrymqwzllxOODWKWoVIoaIjOO7h1JLiF9Knwuq-o6BPtKdwOT-bOrXRzChMtQsc5C1Auex-D0Z6loObBuK1Lkm0RK9ISQsLqBEwq8g0OOupI_shU1r2rT2G0nkZ0CvxVlQeUGShFi8Mdys2s5LPqBwjC4LKwjk8moWQV32KEccbTPKxnG_539DxRglHJgHPHisSVGsfZIUXi2chtXdQHZPdVve8ZRmknCykZtkJ6K87llSUXi7oyzhCIZdiUQ",
+            "e": "AQAB",
+            "x5c": [
+                "MIIDrDCCApSgAwIBAgIQPQS35v3ITW6fNLO8GX5QBjANBgkqhkiG9w0BAQsFADA2MTQwMgYDVQQDEyt2c3RzLXZzdHNnaHJ0LWdoLXZzby1vYXV0aC52aXN1YWxzdHVkaW8uY29tMB4XDTI1MDgwNjE0MTEzMloXDTI3MDgwNjE0MjEzMlowNjE0MDIGA1UEAxMrdnN0cy12c3RzZ2hydC1naC12c28tb2F1dGgudmlzdWFsc3R1ZGlvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALRnr6oZARp/DQdHSsbPA3cYZ/sWT5uebL3EpZCWRDsAzlwy5f9PolTlSjSX3Bxyx7zKmus4dgw3KQFmYthaXgQCbqbK8pqsM5ZcTjg1ilqFSKGiIzju4dSS4hfSp8LqvqOgT7SncDk/mzq10cwoTLULHOQtQLnsfg9GepaDmwbitS5JtESvSEkLC6gRMKvINDjrqSP7IVNa9q09htJ5GdAr8VZUHlBkoRYvDHcrNrOSz6gcIwuCysI5PJqFkFd9ihHHG0zysZxv+d/Q8UYJRyYBzx4rElRrH2SFF4tnIbV3UB2T3Vb3vGUZpJwspGbZCeivO5ZUlF4u6Ms4QiGXYlECAwEAAaOBtTCBsjAOBgNVHQ8BAf8EBAMCBaAwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwNgYDVR0RBC8wLYIrdnN0cy12c3RzZ2hydC1naC12c28tb2F1dGgudmlzdWFsc3R1ZGlvLmNvbTAfBgNVHSMEGDAWgBRKoYOga736JYE15vT7b4gWjC1hwTAdBgNVHQ4EFgQUSqGDoGu9+iWBNeb0+2+IFowtYcEwDQYJKoZIhvcNAQELBQADggEBAJVZIPtoZUlvqgu+Pl0nj8WopA8iuy1m7JRg5fg+bOIGFhXFR8+mH8prpeodjUQ40q2Hq6IwnVir+G56zVwAPf2HHksqdp8be9qjkTjD0mJorPCt/lumrKoNGOVmYffYuIyr73hwsl8fN6sGjAyXLFBkozE4s5ssbeodFxiYE1A61SXnzldC00M7qWleMWjTUBixiZ+R/eroddkLNBGDv9ewDrTQv1ipNec89+Wi7Wb6SAXNxBADiC5kVlFylBgHo3oZNg3KFzZS01REyc4zdH7v1wfZzilLluI6ygTyYRYpJCsKrX5D9JW196f2PCzcs+VXMfneRDnvyfjep7Y1Pi8="
+            ],
+            "x5t": "Tz6a2Mmm9esxcwBvT6Yw4o9D3Ok"
+        }
+    ]
+}
+`
+
+// Real-world .well-known/openid-configuration extracted from a AWS Federated Web Identity endpoint.
+const awsOIDC = `
+{
+    "claims_supported": [
+        "sub",
+        "iss",
+        "aud",
+        "exp",
+        "iat",
+        "jti",
+        "https://sts.amazonaws.com/"
+    ],
+    "id_token_signing_alg_values_supported": [
+        "RS256",
+        "ES384"
+    ],
+    "issuer": "https://a103a2cc-b461-473d-84fe-6c4f6d45af88.tokens.sts.global.api.aws",
+    "jwks_uri": "https://a103a2cc-b461-473d-84fe-6c4f6d45af88.tokens.sts.global.api.aws/.well-known/jwks.json",
+    "subject_types_supported": [
+        "public"
+    ]
+}
+`
+
+// Real-world JWKS extracted from a AWS Federated Web Identity endpoint.
+const awsJWKS = `
+{
+    "keys": [
+        {
+            "e": "AQAB",
+            "kid": "RSA_0",
+            "kty": "RSA",
+            "n": "3AvB0UECoYssZEgSMTa4SYvfqstJxkhbBBSKAFRUW6f_McJ9CAXkTi6YkG0NGm77ZIRW12_gOLKZJUHWp9CMAbmk0O4sMIx8K6Ap7-6qjkt7FYvl4mkQVJd-pU-yE3SJn0S5xEbCYXulgrrGN8POysTblqN0BfrdDAYTVhWQ47rbm--3QrRcVN9XCjlMBVXYauaN6KlszKL6NTe7GWilauYBsVHw7d4ekliuEGGA6zJNGz595KD7yofRc1euFs86KgiFj0mpudCqG39jIlBJ4vZSJPw1Rsvhg8THqlxhmurVYr9TuckLJa5fpEL78xGs3Ar4GIM6w0sxLDbdY-KdCQ",
+            "use": "sig"
+        },
+        {
+            "alg": "ES384",
+            "crv": "P-384",
+            "kid": "EC384_0",
+            "kty": "EC",
+            "use": "sig",
+            "x": "ad_olFw0n3XBA114sefjlirPf2gX6bKqT-kD2lQzfQzkWW1TetKIUWah3md-UgV9",
+            "y": "w6GzW2Oen4G7Ei1bFaDkBpPSulvkSznb6YtG79NWK9UjgDqfN6am9lUs-bF8VN7v"
+        }
+    ]
+}
+`
+
+func TestParseOpenIDConfiguration(t *testing.T) {
+	t.Run("Forgejo", func(t *testing.T) {
+		var retval openIDConfiguration
+		data := []byte(forgejoOIDC)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		assert.Equal(t, "https://example.org/api/actions/.well-known/keys", retval.JwksURI)
+	})
+	t.Run("GitHub", func(t *testing.T) {
+		var retval openIDConfiguration
+		data := []byte(githubOIDC)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		assert.Equal(t, "https://token.actions.githubusercontent.com/.well-known/jwks", retval.JwksURI)
+	})
+	t.Run("AWS", func(t *testing.T) {
+		var retval openIDConfiguration
+		data := []byte(awsOIDC)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		assert.Equal(t, "https://a103a2cc-b461-473d-84fe-6c4f6d45af88.tokens.sts.global.api.aws/.well-known/jwks.json", retval.JwksURI)
+	})
+}
+
+func TestParseJSONWebKeySet(t *testing.T) {
+	t.Run("Forgejo", func(t *testing.T) {
+		var retval openIDKeys
+		data := []byte(forgejoJWKS)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		assert.Len(t, retval.Keys, 1)
+	})
+	t.Run("GitHub", func(t *testing.T) {
+		var retval openIDKeys
+		data := []byte(githubJWKS)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		assert.Len(t, retval.Keys, 4)
+	})
+	t.Run("AWS", func(t *testing.T) {
+		var retval openIDKeys
+		data := []byte(awsJWKS)
+		require.NoError(t, json.Unmarshal(data, &retval))
+		assert.Len(t, retval.Keys, 2)
+	})
+}
diff --git a/services/auth/method/authorized_integration_test.go b/services/auth/method/authorized_integration_test.go
new file mode 100644
index 0000000000..7ffd686e9b
--- /dev/null
+++ b/services/auth/method/authorized_integration_test.go
@@ -0,0 +1,1026 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/db"
+	"forgejo.org/modules/cache"
+	"forgejo.org/modules/json"
+	"forgejo.org/modules/jwtx"
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/test"
+	"forgejo.org/modules/timeutil"
+	"forgejo.org/services/auth"
+
+	mc "code.forgejo.org/go-chi/cache"
+	"github.com/golang-jwt/jwt/v5"
+	gouuid "github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCheckClaims(t *testing.T) {
+	ai := &AuthorizedIntegration{}
+	rules := func(rule ...auth_model.ClaimRule) *auth_model.ClaimRules {
+		return &auth_model.ClaimRules{Rules: rule}
+	}
+	eq := func(claim, value string) auth_model.ClaimRule {
+		return auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimEqual,
+			Value:      value,
+		}
+	}
+	in := func(claim string, values []string) auth_model.ClaimRule {
+		return auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimIn,
+			Values:     values,
+		}
+	}
+	glob := func(claim, value string) auth_model.ClaimRule {
+		return auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimGlob,
+			Value:      value,
+		}
+	}
+	globIn := func(claim string, values []string) auth_model.ClaimRule {
+		return auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimGlobIn,
+			Values:     values,
+		}
+	}
+	nest := func(claim string, inner ...auth_model.ClaimRule) auth_model.ClaimRule {
+		return auth_model.ClaimRule{
+			Claim:      claim,
+			Comparison: auth_model.ClaimNested,
+			Nested:     rules(inner...),
+		}
+	}
+
+	t.Run("nil claims", func(t *testing.T) {
+		require.NoError(t, ai.checkClaims(map[string]any{}, nil))
+	})
+
+	t.Run("flexibleClaims's fixed and other fields", func(t *testing.T) {
+		t.Run("iss", func(t *testing.T) {
+			c := &flexibleClaims{}
+			rules := rules(eq("iss", "https://example.org"))
+
+			c.Issuer = "https://example.org"
+			require.NoError(t, ai.checkClaims(c, rules))
+
+			c.Issuer = "https://other.example.org"
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"iss\" must be \"https://example.org\", but was \"https://other.example.org\"")
+		})
+
+		t.Run("sub", func(t *testing.T) {
+			c := &flexibleClaims{}
+			rules := rules(eq("sub", "my-stuff"))
+
+			c.Subject = "my-stuff"
+			require.NoError(t, ai.checkClaims(c, rules))
+
+			c.Subject = "my-other-stuff"
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"sub\" must be \"my-stuff\", but was \"my-other-stuff\"")
+		})
+
+		t.Run("jti", func(t *testing.T) {
+			c := &flexibleClaims{}
+			rules := rules(eq("jti", "7d9a2e85-6b8d-4b59-bca0-09d702476338"))
+
+			c.ID = "7d9a2e85-6b8d-4b59-bca0-09d702476338"
+			require.NoError(t, ai.checkClaims(c, rules))
+
+			c.ID = "8855d16c-cd5f-4ace-b626-5c5875e1a993"
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"jti\" must be \"7d9a2e85-6b8d-4b59-bca0-09d702476338\", but was \"8855d16c-cd5f-4ace-b626-5c5875e1a993\"")
+		})
+
+		t.Run("aud", func(t *testing.T) {
+			c := &flexibleClaims{}
+			rules := rules(eq("aud", "the-best-audience"))
+
+			c.Audience = jwt.ClaimStrings{"the-best-audience"}
+			require.NoError(t, ai.checkClaims(c, rules))
+
+			c.Audience = jwt.ClaimStrings{"something-else"}
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"aud\" must be \"the-best-audience\", but was \"something-else\"")
+
+			c.Audience = jwt.ClaimStrings{"aud1", "aud2"}
+			require.ErrorContains(t, ai.checkClaims(c, rules), "required one and only one `aud` claim, but received 2")
+		})
+
+		t.Run("arbitrary field", func(t *testing.T) {
+			c := &flexibleClaims{other: map[string]any{}}
+			rules := rules(eq("arbitrary", "abc"))
+
+			c.other["arbitrary"] = "abc"
+			require.NoError(t, ai.checkClaims(c, rules))
+
+			c.other["arbitrary"] = "123"
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must be \"abc\", but was \"123\"")
+
+			delete(c.other, "arbitrary")
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim rule on \"arbitrary\" couldn't be satisfied: claim not found")
+		})
+	})
+
+	t.Run("map[string]any input", func(t *testing.T) {
+		t.Run("arbitrary field", func(t *testing.T) {
+			c := map[string]any{}
+			rules := rules(eq("arbitrary", "abc"))
+
+			c["arbitrary"] = "abc"
+			require.NoError(t, ai.checkClaims(c, rules))
+
+			c["arbitrary"] = "123"
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must be \"abc\", but was \"123\"")
+
+			delete(c, "arbitrary")
+			require.ErrorContains(t, ai.checkClaims(c, rules), "claim rule on \"arbitrary\" couldn't be satisfied: claim not found")
+		})
+	})
+
+	t.Run("unexpected input", func(t *testing.T) {
+		c := map[string]int{}
+		rules := rules(eq("arbitrary", "abc"))
+		c["arbitrary"] = 123
+		require.ErrorContains(t, ai.checkClaims(c, rules), "unexpected incoming claims type: map[string]int")
+	})
+
+	t.Run("comparison ClaimEqual", func(t *testing.T) {
+		c := map[string]any{}
+		rules := rules(eq("arbitrary", "abc"))
+
+		c["arbitrary"] = "abc"
+		require.NoError(t, ai.checkClaims(c, rules))
+
+		c["arbitrary"] = "123"
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must be \"abc\", but was \"123\"")
+
+		c["arbitrary"] = 123
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must be a string, but was int")
+	})
+
+	t.Run("comparison ClaimIn", func(t *testing.T) {
+		c := map[string]any{}
+		rules := rules(in("arbitrary", []string{"abc", "def"}))
+
+		c["arbitrary"] = "abc"
+		require.NoError(t, ai.checkClaims(c, rules))
+		c["arbitrary"] = "def"
+		require.NoError(t, ai.checkClaims(c, rules))
+
+		c["arbitrary"] = "123"
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must be one of [\"abc\" \"def\"], but was \"123\"")
+
+		c["arbitrary"] = 123
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must be a string, but was int")
+	})
+
+	t.Run("comparison ClaimIn empty", func(t *testing.T) {
+		c := map[string]any{}
+		rules := rules(in("arbitrary", []string{}))
+
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim rule on \"arbitrary\" couldn't be satisfied: claim not found")
+
+		c["arbitrary"] = "abc"
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must be one of [], but was \"abc\"")
+	})
+
+	t.Run("comparison ClaimGlob", func(t *testing.T) {
+		c := map[string]any{}
+		r := rules(glob("arbitrary", "*c"))
+
+		c["arbitrary"] = "abc"
+		require.NoError(t, ai.checkClaims(c, r))
+
+		c["arbitrary"] = "123"
+		require.ErrorContains(t, ai.checkClaims(c, r), "claim \"arbitrary\" must match glob \"*c\", but value \"123\" did not match")
+
+		c["arbitrary"] = "this string contains a c or two but doesn't end with one" // ensure glob isn't OK w/ a partial match
+		require.ErrorContains(t, ai.checkClaims(c, r), "claim \"arbitrary\" must match glob \"*c\", but value \"this string contains a c or two but doesn't end with one\" did not match")
+
+		c["arbitrary"] = 123
+		require.ErrorContains(t, ai.checkClaims(c, r), "claim \"arbitrary\" must be a string, but was int")
+
+		r = rules(glob("arbitrary", "[abc"))
+		c["arbitrary"] = "abc"
+		require.ErrorContains(t, ai.checkClaims(c, r), "unable to parse glob for claim rule on \"arbitrary\"; glob = \"[abc\", err = unexpected end of input")
+	})
+
+	t.Run("comparison ClaimGlobIn", func(t *testing.T) {
+		c := map[string]any{}
+		r := rules(globIn("arbitrary", []string{"*c", "*def*"}))
+
+		c["arbitrary"] = "abc"
+		require.NoError(t, ai.checkClaims(c, r))
+		c["arbitrary"] = "abcdef"
+		require.NoError(t, ai.checkClaims(c, r))
+
+		c["arbitrary"] = "123"
+		require.ErrorContains(t, ai.checkClaims(c, r), "claim \"arbitrary\" must glob match one of [\"*c\" \"*def*\"], but value \"123\" did not match")
+
+		c["arbitrary"] = "this string contains a c or two but doesn't end with one" // ensure glob isn't OK w/ a partial match
+		require.ErrorContains(t, ai.checkClaims(c, r), "claim \"arbitrary\" must glob match one of [\"*c\" \"*def*\"], but value \"this string contains a c or two but doesn't end with one\" did not match")
+
+		c["arbitrary"] = 123
+		require.ErrorContains(t, ai.checkClaims(c, r), "claim \"arbitrary\" must be a string, but was int")
+
+		r = rules(globIn("arbitrary", []string{"[abc"}))
+		c["arbitrary"] = "abc"
+		require.ErrorContains(t, ai.checkClaims(c, r), "unable to parse glob for claim rule on \"arbitrary\"; glob = \"[abc\", err = unexpected end of input")
+	})
+
+	t.Run("comparison ClaimGlobIn empty", func(t *testing.T) {
+		c := map[string]any{}
+		rules := rules(globIn("arbitrary", []string{}))
+
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim rule on \"arbitrary\" couldn't be satisfied: claim not found")
+
+		c["arbitrary"] = "abc"
+		require.ErrorContains(t, ai.checkClaims(c, rules), "claim \"arbitrary\" must glob match one of [], but value \"abc\" did not match")
+	})
+
+	t.Run("comparison ClaimNested", func(t *testing.T) {
+		c := map[string]any{}
+		r := rules(nest("nest", eq("arbitrary", "abc")))
+
+		c["nest"] = map[string]any{"arbitrary": "abc"}
+		require.NoError(t, ai.checkClaims(c, r))
+
+		c["nest"] = map[string]any{"blah": "abc"}
+		require.ErrorContains(t, ai.checkClaims(c, r), "in nested claim \"nest\": claim rule on \"arbitrary\" couldn't be satisfied: claim not found")
+
+		c["nest"] = map[string]int{"blah": 123}
+		require.ErrorContains(t, ai.checkClaims(c, r), "claim \"nest\" must be a map, but was map[string]int")
+	})
+
+	t.Run("multiple rules", func(t *testing.T) {
+		c := map[string]any{
+			"arb1": "abc",
+			"arb2": "123",
+			"arb3": "def",
+		}
+		rules := rules(
+			eq("arb1", "abc"),
+			eq("arb2", "123"),
+		)
+
+		require.NoError(t, ai.checkClaims(c, rules))
+
+		delete(c, "arb1")
+		require.ErrorContains(t, ai.checkClaims(c, rules), "\"arb1\"")
+
+		c["arb1"] = "abc"
+		delete(c, "arb2")
+		require.ErrorContains(t, ai.checkClaims(c, rules), "\"arb2\"")
+	})
+}
+
+func requireOutput[K auth.MethodOutput](t *testing.T, o auth.MethodOutput) K {
+	t.Helper()
+	k, isType := o.(K)
+	require.True(t, isType, "expected Verify output to be type %T, but was %T: %v", *new(K), o, o)
+	return k
+}
+
+func TestAuthorizedIntegration(t *testing.T) {
+	t.Run("no token", func(t *testing.T) {
+		ai := &AuthorizedIntegration{}
+		aiBasic := &AuthorizedIntegration{PermitBasic: true}
+		req := httptest.NewRequest("GET", "https://example.org", nil)
+		output := ai.Verify(req, nil, nil)
+		requireOutput[*auth.AuthenticationNotAttempted](t, output)
+		output = aiBasic.Verify(req, nil, nil)
+		requireOutput[*auth.AuthenticationNotAttempted](t, output)
+	})
+
+	t.Run("not a JWT", func(t *testing.T) {
+		ai := &AuthorizedIntegration{}
+		req := httptest.NewRequest("GET", "https://example.org", nil)
+		req.Header.Set("Authorization", "Bearer abc")
+		output := ai.Verify(req, nil, nil)
+		err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+		require.ErrorContains(t, err, "parse JWT error")
+	})
+
+	t.Run("valid Bearer JWT", func(t *testing.T) {
+		ait := newAITester(t)
+		defer ait.close()
+		output := ait.bearerRequest()
+		success := requireOutput[*auth.AuthenticationSuccess](t, output)
+		res := success.Result
+		assert.EqualValues(t, 2, res.User().ID)
+		hasScope, scope := res.Scope().Get()
+		assert.True(t, hasScope)
+		assert.Equal(t, auth_model.AccessTokenScopeAll, scope)
+		assert.NotNil(t, res.Reducer())
+		hasExpiry, _ := res.ExpiresAt().Get()
+		assert.False(t, hasExpiry)
+	})
+
+	t.Run("valid Basic JWT", func(t *testing.T) {
+		t.Run("PermitBasic", func(t *testing.T) {
+			ait := newAITester(t,
+				aiTweak(func(ai *AuthorizedIntegration) {
+					ai.PermitBasic = true
+				}))
+			defer ait.close()
+			output := ait.basicRequest()
+			requireOutput[*auth.AuthenticationSuccess](t, output)
+		})
+
+		t.Run("!PermitBasic", func(t *testing.T) {
+			ait := newAITester(t,
+				aiTweak(func(ai *AuthorizedIntegration) {
+					ai.PermitBasic = false
+				}))
+			defer ait.close()
+			output := ait.basicRequest()
+			requireOutput[*auth.AuthenticationNotAttempted](t, output)
+		})
+	})
+
+	t.Run("JWT expiry", func(t *testing.T) {
+		t.Run("JWT expired", func(t *testing.T) {
+			ait := newAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.ExpiresAt = jwt.NewNumericDate(time.Date(2026, time.January, 1, 12, 0, 0, 0, time.Local))
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "token is expired")
+		})
+
+		t.Run("JWT will expire", func(t *testing.T) {
+			ait := newAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.ExpiresAt = jwt.NewNumericDate(time.Date(2026, time.January, 1, 20, 0, 0, 0, time.UTC))
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			success := requireOutput[*auth.AuthenticationSuccess](t, output)
+			res := success.Result
+			hasExpiry, expiry := res.ExpiresAt().Get()
+			assert.True(t, hasExpiry)
+			assert.Equal(t, timeutil.TimeStamp(1767297600), expiry)
+		})
+	})
+
+	t.Run("JWT issued at", func(t *testing.T) {
+		ait := newAITester(t,
+			claimTweak(func(rc *flexibleClaims) {
+				rc.IssuedAt = jwt.NewNumericDate(time.Date(2027, time.January, 1, 12, 0, 0, 0, time.Local))
+			}))
+		defer ait.close()
+		output := ait.bearerRequest()
+		err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+		require.ErrorContains(t, err, "token used before issued")
+	})
+
+	t.Run("JWT not before", func(t *testing.T) {
+		ait := newAITester(t,
+			claimTweak(func(rc *flexibleClaims) {
+				rc.NotBefore = jwt.NewNumericDate(time.Date(2027, time.January, 1, 12, 0, 0, 0, time.Local))
+			}))
+		defer ait.close()
+		output := ait.bearerRequest()
+		err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+		require.ErrorContains(t, err, "token is not valid yet")
+	})
+
+	t.Run("issuer", func(t *testing.T) {
+		t.Run("missing in claim", func(t *testing.T) {
+			ait := newAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.Issuer = ""
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "invalid `iss` claim")
+		})
+
+		t.Run("mismatch DB", func(t *testing.T) {
+			ait := newAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.Issuer = "https://whoops.example.org"
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "matching authorized_integration not found")
+		})
+
+		t.Run("mismatch openid metadata", func(t *testing.T) {
+			ait := newAITester(t,
+				openIDTweak(func(oidc *openIDConfiguration, _ *AuthorizedIntegrationTester) {
+					oidc.Issuer = "https://whoops.example.org"
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "issuer mismatch")
+		})
+
+		t.Run("non-HTTPS issuer", func(t *testing.T) {
+			ait := newAITester(t,
+				aiDBTweak(func(aiDB *auth_model.AuthorizedIntegration) {
+					aiDB.Issuer = "http://whoops.example.org"
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "unsupported URL scheme: \"http://")
+		})
+
+		t.Run("signing alg values supported doesn't include in-use alg", func(t *testing.T) {
+			ait := newAITester(t,
+				openIDTweak(func(oidc *openIDConfiguration, _ *AuthorizedIntegrationTester) {
+					oidc.IDTokenSigningAlgValuesSupported = []string{"WEIRD"}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, " issuer supports signature algorithms []string{\"WEIRD\"}, but received token with algorithm RS256")
+		})
+	})
+
+	t.Run("audience", func(t *testing.T) {
+		t.Run("missing in claim", func(t *testing.T) {
+			ait := newAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.Audience = jwt.ClaimStrings{}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "required one and only one `aud` claim, but received 0")
+		})
+
+		t.Run("multiple in claim", func(t *testing.T) {
+			ait := newAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.Audience = jwt.ClaimStrings{"abc", "def"}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "required one and only one `aud` claim, but received 2")
+		})
+
+		t.Run("mismatch DB", func(t *testing.T) {
+			ait := newAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.Audience = jwt.ClaimStrings{"abc"}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "matching authorized_integration not found")
+		})
+	})
+
+	t.Run("checks claim rules", func(t *testing.T) {
+		ait := newAITester(t,
+			claimTweak(func(rc *flexibleClaims) {
+				rc.other["custom-claim"] = "oops wrong claim"
+			}))
+		defer ait.close()
+		output := ait.bearerRequest()
+		err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+		require.ErrorContains(t, err, "claim \"custom-claim\" must be \"custom-claim-value\"")
+	})
+
+	t.Run("key algorithms", func(t *testing.T) {
+		for _, alg := range jwtx.ValidAsymmetricAlgorithms {
+			t.Run(alg, func(t *testing.T) {
+				ait := newAITester(t,
+					jwtxKeyTweak(func() jwtx.SigningKey {
+						keyPath := filepath.Join(t.TempDir(), fmt.Sprintf("jwt-%s.priv", alg))
+						jwtSigningKey, err := jwtx.InitAsymmetricSigningKey(keyPath, alg)
+						require.NoError(t, err)
+						return jwtSigningKey
+					}),
+					openIDTweak(func(oidc *openIDConfiguration, _ *AuthorizedIntegrationTester) {
+						oidc.IDTokenSigningAlgValuesSupported = []string{alg}
+					}),
+				)
+				defer ait.close()
+				output := ait.bearerRequest()
+				requireOutput[*auth.AuthenticationSuccess](t, output)
+			})
+		}
+	})
+
+	t.Run("JWKS", func(t *testing.T) {
+		t.Run("jwks_uri host mismatch", func(t *testing.T) {
+			ait := newAITester(t,
+				openIDTweak(func(oidc *openIDConfiguration, ait *AuthorizedIntegrationTester) {
+					oidc.JwksURI = "https://whoops.example.org/.keys"
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "jwks_uri host mismatch: must be the same as issuer host")
+		})
+
+		t.Run("non-HTTPS JWKS address", func(t *testing.T) {
+			ait := newAITester(t,
+				openIDTweak(func(oidc *openIDConfiguration, ait *AuthorizedIntegrationTester) {
+					oidc.JwksURI = strings.ReplaceAll(ait.testServer.URL, "https://", "http://")
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "unsupported URL scheme: \"http://")
+		})
+
+		t.Run("missing key", func(t *testing.T) {
+			ait := newAITester(t,
+				jwksTweak(func(keys *openIDKeys) {
+					keys.Keys = []map[string]any{}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "no key identified")
+		})
+
+		t.Run("alg missing", func(t *testing.T) {
+			ait := newAITester(t,
+				jwksTweak(func(keys *openIDKeys) {
+					for k := range keys.Keys {
+						delete(keys.Keys[k], "alg")
+					}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			// per RFC7517 "alg" is optional
+			requireOutput[*auth.AuthenticationSuccess](t, output)
+		})
+
+		t.Run("alg mismatch", func(t *testing.T) {
+			ait := newAITester(t,
+				jwksTweak(func(keys *openIDKeys) {
+					for k := range keys.Keys {
+						keys.Keys[k]["alg"] = "WEIRD"
+					}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "doesn't match expected algorithm RS256, was WEIRD")
+		})
+
+		t.Run("use missing", func(t *testing.T) {
+			ait := newAITester(t,
+				jwksTweak(func(keys *openIDKeys) {
+					for k := range keys.Keys {
+						delete(keys.Keys[k], "use")
+					}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			// per RFC7517 "use" is optional
+			requireOutput[*auth.AuthenticationSuccess](t, output)
+		})
+
+		t.Run("use isn't 'sig'", func(t *testing.T) {
+			ait := newAITester(t,
+				jwksTweak(func(keys *openIDKeys) {
+					for k := range keys.Keys {
+						keys.Keys[k]["use"] = "enc"
+					}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "isn't designated for signing usage, was enc")
+		})
+
+		t.Run("large JWKS document", func(t *testing.T) {
+			ait := newAITester(t,
+				jwksTweak(func(keys *openIDKeys) {
+					var keyContents map[string]any
+					for _, v := range keys.Keys {
+						keyContents = v
+					}
+					for range 128 {
+						keys.Keys = append(keys.Keys, keyContents)
+					}
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "failed to decode (response body restricted to 16384 bytes)")
+		})
+	})
+
+	t.Run("specific scopes", func(t *testing.T) {
+		ait := newAITester(t,
+			aiDBTweak(func(aiDB *auth_model.AuthorizedIntegration) {
+				aiDB.Scope = "read:repository,read:user"
+			}))
+		defer ait.close()
+		output := ait.bearerRequest()
+		success := requireOutput[*auth.AuthenticationSuccess](t, output)
+		res := success.Result
+		hasScope, scope := res.Scope().Get()
+		assert.True(t, hasScope)
+		readRepository, err := scope.HasScope(auth_model.AccessTokenScopeReadRepository)
+		require.NoError(t, err)
+		assert.True(t, readRepository, "read:repository")
+		readUser, err := scope.HasScope(auth_model.AccessTokenScopeReadUser)
+		require.NoError(t, err)
+		assert.True(t, readUser, "read:user")
+		writeAdmin, err := scope.HasScope(auth_model.AccessTokenScopeWriteAdmin)
+		require.NoError(t, err)
+		assert.False(t, writeAdmin, "write:admin")
+	})
+
+	t.Run("cache", func(t *testing.T) {
+		t.Run("miss and store", func(t *testing.T) {
+			c := cache.NewMockCache(t)
+			defer test.MockVariableValue(&getCache, func() mc.Cache { return c })()
+			defer test.MockVariableValue(&setting.AuthorizedIntegration.CacheTTL, 10*time.Minute)()
+
+			var cacheKey string
+			c.On("Get", mock.AnythingOfType("string")).
+				Run(func(args mock.Arguments) {
+					key := args.Get(0).(string)
+					assert.True(t, strings.HasPrefix(key, "auth-int-remote:https://"), "key %s should have key prefix", key)
+					cacheKey = key
+				}).Return(nil)
+			c.On("Put", mock.Anything, mock.Anything, mock.Anything).
+				Once().
+				Run(func(args mock.Arguments) {
+					putKey := args.Get(0).(string)
+					assert.Equal(t, cacheKey, putKey)
+					putContents := args.Get(1).([]byte)
+					assert.Contains(t, string(putContents), "\"issuer\":")
+					assert.Contains(t, string(putContents), "\"jwks_uri\":")
+					assert.EqualValues(t, 600, args.Get(2))
+				}).Return(nil)
+			c.On("Put", mock.Anything, mock.Anything, mock.Anything).
+				Once().
+				Run(func(args mock.Arguments) {
+					putKey := args.Get(0).(string)
+					assert.Equal(t, cacheKey, putKey)
+					putContents := args.Get(1).([]byte)
+					assert.Contains(t, string(putContents), "\"alg\":\"RS256\"")
+					assert.Contains(t, string(putContents), "\"kty\":\"RSA\"")
+					assert.EqualValues(t, 600, args.Get(2))
+				}).Return(nil)
+
+			ait := newAITester(t)
+			defer ait.close()
+			output := ait.bearerRequest()
+			requireOutput[*auth.AuthenticationSuccess](t, output)
+		})
+
+		t.Run("hit", func(t *testing.T) {
+			var oidcMetadata []byte
+			var jwksData []byte
+			ait := newAITester(t,
+				openIDTweak(func(oi *openIDConfiguration, ait *AuthorizedIntegrationTester) {
+					var err error
+					oidcMetadata, err = json.Marshal(oi)
+					require.NoError(t, err)
+				}),
+				jwksTweak(func(oi *openIDKeys) {
+					var err error
+					jwksData, err = json.Marshal(oi)
+					require.NoError(t, err)
+				}),
+			)
+			defer ait.close()
+			ait.bearerRequest() // populate oidcMetadata & jwksData by making a request
+
+			t.Run("cache returns []byte", func(t *testing.T) {
+				c := cache.NewMockCache(t)
+				defer test.MockVariableValue(&getCache, func() mc.Cache { return c })()
+
+				c.On("Get",
+					mock.MatchedBy(func(key string) bool {
+						return strings.Contains(key, ".well-known/openid-configuration")
+					})).
+					Return(oidcMetadata)
+				c.On("Get",
+					mock.MatchedBy(func(key string) bool {
+						return strings.Contains(key, ".keys")
+					})).
+					Return(jwksData)
+
+				ait.bearerRequest()
+			})
+
+			t.Run("cache returns string", func(t *testing.T) {
+				c := cache.NewMockCache(t)
+				defer test.MockVariableValue(&getCache, func() mc.Cache { return c })()
+
+				c.On("Get",
+					mock.MatchedBy(func(key string) bool {
+						return strings.Contains(key, ".well-known/openid-configuration")
+					})).
+					Return(string(oidcMetadata))
+				c.On("Get",
+					mock.MatchedBy(func(key string) bool {
+						return strings.Contains(key, ".keys")
+					})).
+					Return(string(jwksData))
+
+				ait.bearerRequest()
+			})
+		})
+	})
+
+	t.Run("internal issuer", func(t *testing.T) {
+		t.Run("success", func(t *testing.T) {
+			ait := newInternalIssuerAITester(t)
+			defer ait.close()
+			output := ait.bearerRequest()
+			requireOutput[*auth.AuthenticationSuccess](t, output)
+		})
+
+		t.Run("mismatched issuer app URL", func(t *testing.T) {
+			ait := newInternalIssuerAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.Issuer = "https://example.org/fake-jwt-issuer" // correct suffix, incorrect prefix
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "matching authorized_integration not found")
+			ait.ii.ExpectedCalls = nil // InternalIssuer should have zero calls
+		})
+
+		t.Run("mismatched issuer URL suffix", func(t *testing.T) {
+			ait := newInternalIssuerAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.Issuer = setting.AppURL + "/fake-jwt-issuer-123" // correct prefix, incorrect suffix
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "matching authorized_integration not found")
+			ait.ii.ExpectedCalls = nil // InternalIssuer should have zero calls
+		})
+
+		t.Run("mismatched DB issuer placeholder", func(t *testing.T) {
+			ait := newInternalIssuerAITester(t,
+				aiDBTweak(func(ai *auth_model.AuthorizedIntegration) {
+					ai.Issuer = "urn:forgejo:authorized-issuer:internal:bad-choice-here"
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "matching authorized_integration not found")
+			ait.ii.ExpectedCalls = nil // InternalIssuer should have zero calls
+		})
+
+		t.Run("checks claim rules", func(t *testing.T) {
+			ait := newInternalIssuerAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.other["custom-claim"] = "oops wrong claim"
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "claim \"custom-claim\" must be \"custom-claim-value\"")
+			ait.ii.ExpectedCalls = []*mock.Call{ait.ii.ExpectedCalls[0]} // drop call to SigningKey() -- won't occur due to claim mismatch
+		})
+
+		t.Run("JWT times checked", func(t *testing.T) {
+			ait := newInternalIssuerAITester(t,
+				claimTweak(func(rc *flexibleClaims) {
+					rc.ExpiresAt = jwt.NewNumericDate(time.Date(2026, time.January, 1, 12, 0, 0, 0, time.Local))
+				}))
+			defer ait.close()
+			output := ait.bearerRequest()
+			err := requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "token is expired")
+		})
+
+		t.Run("signed by incorrect JWT key", func(t *testing.T) {
+			keyPath := filepath.Join(t.TempDir(), "jwt-rsa-2048-bad-key.priv")
+			badSigningKey, err := jwtx.InitAsymmetricSigningKey(keyPath, "RS256")
+			require.NoError(t, err)
+
+			ait := newInternalIssuerAITester(t, jwtClientSignatureTweak(func() jwtx.SigningKey {
+				return badSigningKey
+			}))
+			defer ait.close()
+
+			output := ait.bearerRequest()
+			err = requireOutput[*auth.AuthenticationAttemptedIncorrectCredential](t, output).Error
+			require.ErrorContains(t, err, "crypto/rsa: verification error")
+		})
+	})
+}
+
+type AuthorizedIntegrationTester struct {
+	t               *testing.T
+	ai              *AuthorizedIntegration
+	dbAI            *auth_model.AuthorizedIntegration
+	jwtSigningKey   jwtx.SigningKey
+	testServer      *httptest.Server
+	resetHTTPClient func()
+	tweaks          []tweak
+	ii              *MockInternalIssuer
+}
+
+func newAITester(t *testing.T, tweaks ...tweak) *AuthorizedIntegrationTester {
+	fixedTime := time.Date(2026, time.January, 1, 16, 0, 0, 0, time.Local)
+	ait := &AuthorizedIntegrationTester{
+		t: t,
+		ai: &AuthorizedIntegration{
+			fixedTime: &fixedTime,
+		},
+		tweaks: tweaks,
+	}
+	for _, tweak := range ait.tweaks {
+		if aiTweak, is := tweak.(aiTweak); is {
+			aiTweak(ait.ai)
+		}
+	}
+
+	var jwtSigningKey jwtx.SigningKey
+	for _, tweak := range ait.tweaks {
+		if jwtxKeyTweak, is := tweak.(jwtxKeyTweak); is {
+			jwtSigningKey = jwtxKeyTweak()
+		}
+	}
+	if jwtSigningKey == nil {
+		var err error
+		keyPath := filepath.Join(t.TempDir(), "jwt-rsa-2048.priv")
+		jwtSigningKey, err = jwtx.InitAsymmetricSigningKey(keyPath, "RS256")
+		require.NoError(t, err)
+	}
+	ait.jwtSigningKey = jwtSigningKey
+
+	ait.testServer = httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/actions/.well-known/openid-configuration" {
+			retval := &openIDConfiguration{
+				Issuer:                           ait.dbAI.Issuer,
+				IDTokenSigningAlgValuesSupported: []string{"RS256"},
+				JwksURI:                          fmt.Sprintf("%s/.keys", ait.dbAI.Issuer),
+			}
+			for _, tweak := range ait.tweaks {
+				if tweak, is := tweak.(openIDTweak); is {
+					tweak(retval, ait)
+				}
+			}
+			err := json.NewEncoder(w).Encode(retval)
+			require.NoError(t, err)
+			return
+		}
+		if r.URL.Path == "/api/actions/.keys" {
+			jwk, err := ait.jwtSigningKey.ToJWK()
+			require.NoError(t, err)
+			jwk["use"] = "sig"
+			jwkMapAny := make(map[string]any, len(jwk))
+			for k, v := range jwk {
+				jwkMapAny[k] = v // convert map[string]string -> map[string]any
+			}
+			retval := &openIDKeys{
+				Keys: []map[string]any{jwkMapAny},
+			}
+			for _, tweak := range ait.tweaks {
+				if jwksTweak, is := tweak.(jwksTweak); is {
+					jwksTweak(retval)
+				}
+			}
+			_ = json.NewEncoder(w).Encode(retval) // no error checking -- some tests abort read
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+
+	// trust TLS cert of our mock client by inserting the test client for our test server into the global aiHTTPClient
+	ait.resetHTTPClient = test.MockVariableValue(&aiHTTPClient, ait.testServer.Client())
+	// prevent self-initialization of the HTTP client during unit testing -- this means that a real client cant' be
+	// created and aiHTTPClient will always be nil (other than when mocked), but that's fine because we don't want to do
+	// external HTTP traffic in these tests
+	initHTTPClient.Do(func() {})
+
+	ait.dbAI = &auth_model.AuthorizedIntegration{
+		UserID:   2,
+		Scope:    auth_model.AccessTokenScopeAll,
+		Issuer:   fmt.Sprintf("%s/api/actions", ait.testServer.URL),
+		Audience: fmt.Sprintf("https://forgejo.example.org/-/coolguy/authorized-integration/%s", gouuid.New().String()),
+		ClaimRules: &auth_model.ClaimRules{
+			Rules: []auth_model.ClaimRule{
+				{
+					Claim:      "custom-claim",
+					Comparison: auth_model.ClaimEqual,
+					Value:      "custom-claim-value",
+				},
+			},
+		},
+	}
+	for _, tweak := range ait.tweaks {
+		if tweak, is := tweak.(aiDBTweak); is {
+			tweak(ait.dbAI)
+		}
+	}
+	_, err := db.GetEngine(t.Context()).Insert(ait.dbAI)
+	require.NoError(t, err)
+
+	return ait
+}
+
+func newInternalIssuerAITester(t *testing.T, tweaks ...tweak) *AuthorizedIntegrationTester {
+	innerTweaks := []tweak{
+		claimTweak(func(rc *flexibleClaims) {
+			rc.Issuer = setting.AppURL + "/fake-jwt-issuer"
+		}),
+		aiDBTweak(func(ai *auth_model.AuthorizedIntegration) {
+			ai.Issuer = "urn:forgejo:authorized-issuer:internal:test1"
+		}),
+	}
+	innerTweaks = append(innerTweaks, tweaks...)
+	ait := newAITester(t, innerTweaks...)
+	ii := NewMockInternalIssuer(t)
+	internalIssuers["/fake-jwt-issuer"] = ii
+	ii.On("IssuerPlaceholder").Return("urn:forgejo:authorized-issuer:internal:test1")
+	ii.On("SigningKey").Return(ait.jwtSigningKey)
+	ait.ii = ii
+	return ait
+}
+
+func (ait *AuthorizedIntegrationTester) signedJWT() string {
+	claims := flexibleClaims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			Issuer:   ait.dbAI.Issuer,
+			Audience: jwt.ClaimStrings{ait.dbAI.Audience},
+		},
+		other: map[string]any{
+			"custom-claim": "custom-claim-value",
+		},
+	}
+	for _, tweak := range ait.tweaks {
+		if tweak, is := tweak.(claimTweak); is {
+			tweak(&claims)
+		}
+	}
+	clientSigningKey := ait.jwtSigningKey
+	for _, tweak := range ait.tweaks {
+		if tweak, is := tweak.(jwtClientSignatureTweak); is {
+			clientSigningKey = tweak()
+		}
+	}
+	signedToken, err := clientSigningKey.JWT(claims)
+	require.NoError(ait.t, err)
+	return signedToken
+}
+
+func (ait *AuthorizedIntegrationTester) bearerRequest() auth.MethodOutput {
+	signedToken := ait.signedJWT()
+	req := httptest.NewRequest("GET", "https://forgejo.example.org", nil)
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", signedToken))
+	return ait.ai.Verify(req, nil, nil)
+}
+
+func (ait *AuthorizedIntegrationTester) basicRequest() auth.MethodOutput {
+	signedToken := ait.signedJWT()
+	req := httptest.NewRequest("GET", "https://forgejo.example.org", nil)
+	req.SetBasicAuth("", signedToken)
+	return ait.ai.Verify(req, nil, nil)
+}
+
+func (ait *AuthorizedIntegrationTester) close() {
+	ait.resetHTTPClient()
+	ait.testServer.Close()
+}
+
+type tweak any
+
+type claimTweak func(*flexibleClaims)
+
+type aiTweak func(*AuthorizedIntegration)
+
+type openIDTweak func(*openIDConfiguration, *AuthorizedIntegrationTester)
+
+type jwksTweak func(*openIDKeys)
+
+type aiDBTweak func(*auth_model.AuthorizedIntegration)
+
+type jwtxKeyTweak func() jwtx.SigningKey
+
+type jwtClientSignatureTweak func() jwtx.SigningKey
diff --git a/services/auth/method/basic.go b/services/auth/method/basic.go
index 905deb0652..8385bea2fd 100644
--- a/services/auth/method/basic.go
+++ b/services/auth/method/basic.go
@@ -10,18 +10,15 @@ import (
 	"net/http"
 	"strings"
 
-	actions_model "forgejo.org/models/actions"
 	auth_model "forgejo.org/models/auth"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/base"
 	"forgejo.org/modules/log"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/util"
 	"forgejo.org/modules/web/middleware"
 	"forgejo.org/services/auth"
 	"forgejo.org/services/auth/source/db"
-	"forgejo.org/services/authz"
 )
 
 // Ensure the struct implements the interface.
@@ -34,10 +31,8 @@ var (
 // header.
 type Basic struct{}
 
-// Verify extracts and validates Basic data (username and password/token) from the
-// "Authorization" header of the request and returns the corresponding user object for that
-// name/token on successful validation.
-// Returns nil if header is empty or validation fails.
+// Verify extracts and validates Basic data (username and password/token) from the "Authorization" header of the request
+// and returns the corresponding user object for that name/token on successful validation.
 func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionStore) auth.MethodOutput {
 	// Basic authentication should only fire on API, Download or on Git or LFSPaths
 	if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) {
@@ -56,67 +51,6 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionS
 
 	uname, passwd, _ := base.BasicAuthDecode(auths[1])
 
-	// Check if username or password is a token
-	isUsernameToken := len(passwd) == 0 || passwd == "x-oauth-basic"
-	// Assume username is token
-	authToken := uname
-	if !isUsernameToken {
-		log.Trace("Basic Authorization: Attempting login for: %s", uname)
-		// Assume password is token
-		authToken = passwd
-	} else {
-		log.Trace("Basic Authorization: Attempting login with username as token")
-	}
-
-	// check oauth2 token
-	uid, grantScopes := CheckOAuthAccessToken(req.Context(), authToken)
-	if uid != 0 {
-		log.Trace("Basic Authorization: Valid OAuthAccessToken for user[%d]", uid)
-
-		u, err := user_model.GetUserByID(req.Context(), uid)
-		if err != nil {
-			return &auth.AuthenticationError{Error: fmt.Errorf("basic auth GetUserByID: %w", err)}
-		}
-
-		var scope auth_model.AccessTokenScope
-		if grantScopes != "" {
-			scope = auth_model.AccessTokenScope(grantScopes)
-		} else {
-			scope = auth_model.AccessTokenScopeAll // fallback to all
-		}
-		return &auth.AuthenticationSuccess{Result: &oAuth2JWTAuthenticationResult{user: u, scope: optional.Some(scope)}}
-	}
-
-	// check personal access token
-	token, err := auth_model.GetAccessTokenBySHA(req.Context(), authToken)
-	if err == nil {
-		log.Trace("Basic Authorization: Valid AccessToken for user[%d]", token.UID)
-		u, err := user_model.GetUserByID(req.Context(), token.UID)
-		if err != nil {
-			return &auth.AuthenticationError{Error: fmt.Errorf("basic auth GetUserByID for access token: %w", err)}
-		}
-
-		if err = token.UpdateLastUsed(req.Context()); err != nil {
-			log.Error("UpdateLastUsed:  %v", err)
-		}
-
-		reducer, err := authz.GetAuthorizationReducerForAccessToken(req.Context(), token)
-		if err != nil {
-			return &auth.AuthenticationError{Error: fmt.Errorf("basic auth GetAuthorizationReducerForAccessToken: %w", err)}
-		}
-
-		return &auth.AuthenticationSuccess{Result: &accessTokenAuthenticationResult{user: u, scope: token.Scope, reducer: reducer}}
-	} else if !auth_model.IsErrAccessTokenNotExist(err) && !auth_model.IsErrAccessTokenEmpty(err) {
-		log.Error("GetAccessTokenBySha: %v", err)
-	}
-
-	// check task token
-	task, err := actions_model.GetRunningTaskByToken(req.Context(), authToken)
-	if err == nil && task != nil {
-		log.Trace("Basic Authorization: Valid AccessToken for task[%d]", task.ID)
-		return &auth.AuthenticationSuccess{Result: &actionsTaskTokenAuthenticationResult{user: user_model.NewActionsUser(), taskID: task.ID}}
-	}
-
 	if !setting.Service.EnableBasicAuth {
 		return &auth.AuthenticationAttemptedIncorrectCredential{Error: errors.New("basic authentication by username & password is disabled")}
 	}
@@ -147,7 +81,6 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionS
 	}
 
 	log.Trace("Basic Authorization: Logged in user %-v", u)
-
 	return &auth.AuthenticationSuccess{Result: &basicPaswordAuthenticationResult{user: u}}
 }
 
diff --git a/services/auth/method/mocks_test.go b/services/auth/method/mocks_test.go
new file mode 100644
index 0000000000..46648c8cba
--- /dev/null
+++ b/services/auth/method/mocks_test.go
@@ -0,0 +1,129 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package method
+
+import (
+	"forgejo.org/modules/jwtx"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewMockInternalIssuer creates a new instance of MockInternalIssuer. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockInternalIssuer(t interface {
+	mock.TestingT
+	Cleanup(func())
+},
+) *MockInternalIssuer {
+	mock := &MockInternalIssuer{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// MockInternalIssuer is an autogenerated mock type for the InternalIssuer type
+type MockInternalIssuer struct {
+	mock.Mock
+}
+
+type MockInternalIssuer_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockInternalIssuer) EXPECT() *MockInternalIssuer_Expecter {
+	return &MockInternalIssuer_Expecter{mock: &_m.Mock}
+}
+
+// IssuerPlaceholder provides a mock function for the type MockInternalIssuer
+func (_mock *MockInternalIssuer) IssuerPlaceholder() string {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for IssuerPlaceholder")
+	}
+
+	var r0 string
+	if returnFunc, ok := ret.Get(0).(func() string); ok {
+		r0 = returnFunc()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+	return r0
+}
+
+// MockInternalIssuer_IssuerPlaceholder_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'IssuerPlaceholder'
+type MockInternalIssuer_IssuerPlaceholder_Call struct {
+	*mock.Call
+}
+
+// IssuerPlaceholder is a helper method to define mock.On call
+func (_e *MockInternalIssuer_Expecter) IssuerPlaceholder() *MockInternalIssuer_IssuerPlaceholder_Call {
+	return &MockInternalIssuer_IssuerPlaceholder_Call{Call: _e.mock.On("IssuerPlaceholder")}
+}
+
+func (_c *MockInternalIssuer_IssuerPlaceholder_Call) Run(run func()) *MockInternalIssuer_IssuerPlaceholder_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockInternalIssuer_IssuerPlaceholder_Call) Return(s string) *MockInternalIssuer_IssuerPlaceholder_Call {
+	_c.Call.Return(s)
+	return _c
+}
+
+func (_c *MockInternalIssuer_IssuerPlaceholder_Call) RunAndReturn(run func() string) *MockInternalIssuer_IssuerPlaceholder_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SigningKey provides a mock function for the type MockInternalIssuer
+func (_mock *MockInternalIssuer) SigningKey() jwtx.SigningKey {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for SigningKey")
+	}
+
+	var r0 jwtx.SigningKey
+	if returnFunc, ok := ret.Get(0).(func() jwtx.SigningKey); ok {
+		r0 = returnFunc()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(jwtx.SigningKey)
+		}
+	}
+	return r0
+}
+
+// MockInternalIssuer_SigningKey_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SigningKey'
+type MockInternalIssuer_SigningKey_Call struct {
+	*mock.Call
+}
+
+// SigningKey is a helper method to define mock.On call
+func (_e *MockInternalIssuer_Expecter) SigningKey() *MockInternalIssuer_SigningKey_Call {
+	return &MockInternalIssuer_SigningKey_Call{Call: _e.mock.On("SigningKey")}
+}
+
+func (_c *MockInternalIssuer_SigningKey_Call) Run(run func()) *MockInternalIssuer_SigningKey_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockInternalIssuer_SigningKey_Call) Return(signingKey jwtx.SigningKey) *MockInternalIssuer_SigningKey_Call {
+	_c.Call.Return(signingKey)
+	return _c
+}
+
+func (_c *MockInternalIssuer_SigningKey_Call) RunAndReturn(run func() jwtx.SigningKey) *MockInternalIssuer_SigningKey_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/services/auth/method/oauth2.go b/services/auth/method/oauth2.go
index 8e07a2ecca..9eeef6a6c1 100644
--- a/services/auth/method/oauth2.go
+++ b/services/auth/method/oauth2.go
@@ -5,25 +5,21 @@
 package method
 
 import (
-	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"slices"
 	"strings"
 	"time"
 
-	actions_model "forgejo.org/models/actions"
 	auth_model "forgejo.org/models/auth"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
-	"forgejo.org/modules/util"
 	"forgejo.org/modules/web/middleware"
-	"forgejo.org/services/actions"
 	"forgejo.org/services/auth"
 	"forgejo.org/services/auth/source/oauth2"
-	"forgejo.org/services/authz"
 )
 
 // Ensure the struct implements the interface.
@@ -70,174 +66,86 @@ func grantAdditionalScopes(grantScopes string) string {
 	return ""
 }
 
-// CheckOAuthAccessToken returns uid of user from oauth token
-// + non default openid scopes requested
-func CheckOAuthAccessToken(ctx context.Context, accessToken string) (int64, string) {
-	if !setting.OAuth2.Enabled {
-		return 0, ""
-	}
-	// JWT tokens require a "."
-	if !strings.Contains(accessToken, ".") {
-		return 0, ""
-	}
-	token, err := oauth2.ParseToken(accessToken, oauth2.DefaultSigningKey)
-	if err != nil {
-		log.Trace("oauth2.ParseToken: %v", err)
-		return 0, ""
-	}
-	var grant *auth_model.OAuth2Grant
-	if grant, err = auth_model.GetOAuth2GrantByID(ctx, token.GrantID); err != nil || grant == nil {
-		return 0, ""
-	}
-	if token.Type != oauth2.TypeAccessToken {
-		return 0, ""
-	}
-	if token.ExpiresAt.Before(time.Now()) || token.IssuedAt.After(time.Now()) {
-		return 0, ""
-	}
-	grantScopes := grantAdditionalScopes(grant.Scope)
-	return grant.UserID, grantScopes
-}
-
-// CheckTaskIsRunning verifies that the TaskID corresponds to a running task
-func CheckTaskIsRunning(ctx context.Context, taskID int64) bool {
-	// Verify the task exists
-	task, err := actions_model.GetTaskByID(ctx, taskID)
-	if err != nil {
-		return false
-	}
-
-	// Verify that it's running
-	return task.Status == actions_model.StatusRunning
-}
-
-// OAuth2 implements the Auth interface and authenticates requests
-// (API requests only) by looking for an OAuth token in query parameters or the
-// "Authorization" header.
+// OAuth2 implements the Auth interface and authenticates requests (API requests only) by looking for an OAuth token in
+// query parameters or the "Authorization" header.
 type OAuth2 struct{}
 
-// parseToken returns the token from request, and a boolean value
-// representing whether the token exists or not
-func parseToken(req *http.Request) (string, bool) {
-	_ = req.ParseForm()
-	if !setting.DisableQueryAuthToken {
-		// Check token.
-		if token := req.Form.Get("token"); token != "" {
-			return token, true
-		}
-		// Check access token.
-		if token := req.Form.Get("access_token"); token != "" {
-			return token, true
-		}
-	} else if req.Form.Get("token") != "" || req.Form.Get("access_token") != "" {
-		log.Warn("API token sent in query string but DISABLE_QUERY_AUTH_TOKEN=true")
-	}
-
-	// check header token
-	if auHead := req.Header.Get("Authorization"); auHead != "" {
-		auths := strings.Fields(auHead)
-		if len(auths) == 2 && (util.ASCIIEqualFold(auths[0], "token") || util.ASCIIEqualFold(auths[0], "bearer")) {
-			return auths[1], true
-		}
-	}
-	return "", false
-}
-
-// userIDFromToken returns the user id corresponding to the OAuth token.
-// It will set 'IsApiToken' to true if the token is an API token and
-// set 'ApiTokenScope' to the scope of the access token
-func (o *OAuth2) userIDFromToken(ctx context.Context, tokenSHA string) auth.MethodOutput {
-	if tokenSHA == "" {
-		return &auth.AuthenticationAttemptedIncorrectCredential{Error: auth_model.ErrAccessTokenEmpty{}}
-	}
-	// Let's see if token is valid.
-	if strings.Contains(tokenSHA, ".") {
-		// First attempt to decode an actions JWT, returning the actions user
-		if taskID, err := actions.TokenToTaskID(tokenSHA); err == nil {
-			if CheckTaskIsRunning(ctx, taskID) {
-				return &auth.AuthenticationSuccess{Result: &actionsTaskTokenAuthenticationResult{user: user_model.NewActionsUser(), taskID: taskID}}
-			}
-		}
-
-		// Otherwise, check if this is an OAuth access token
-		uid, grantScopes := CheckOAuthAccessToken(ctx, tokenSHA)
-		var accessTokenScope optional.Option[auth_model.AccessTokenScope]
-		if uid != 0 {
-			if grantScopes != "" {
-				accessTokenScope = optional.Some(auth_model.AccessTokenScope(grantScopes))
-			} else {
-				accessTokenScope = optional.Some(auth_model.AccessTokenScopeAll) // fallback to all
-			}
-		}
-		user, err := user_model.GetPossibleUserByID(ctx, uid)
-		if err != nil {
-			if user_model.IsErrUserNotExist(err) {
-				return &auth.AuthenticationAttemptedIncorrectCredential{Error: err}
-			}
-			return &auth.AuthenticationError{Error: fmt.Errorf("oauth2 GetPossibleUserByID: %w", err)}
-		}
-		return &auth.AuthenticationSuccess{Result: &oAuth2JWTAuthenticationResult{user: user, scope: accessTokenScope}}
-	}
-
-	t, err := auth_model.GetAccessTokenBySHA(ctx, tokenSHA)
-	if err != nil {
-		if auth_model.IsErrAccessTokenNotExist(err) {
-			// check task token
-			task, err := actions_model.GetRunningTaskByToken(ctx, tokenSHA)
-			if err == nil && task != nil {
-				log.Trace("Basic Authorization: Valid AccessToken for task[%d]", task.ID)
-				return &auth.AuthenticationSuccess{Result: &actionsTaskTokenAuthenticationResult{user: user_model.NewActionsUser(), taskID: task.ID}}
-			}
-		} else if !auth_model.IsErrAccessTokenNotExist(err) && !auth_model.IsErrAccessTokenEmpty(err) {
-			return &auth.AuthenticationError{Error: fmt.Errorf("oauth2 GetAccessTokenBySHA: %w", err)}
-		}
-		return &auth.AuthenticationAttemptedIncorrectCredential{Error: err}
-	}
-	if err := t.UpdateLastUsed(ctx); err != nil {
-		log.Error("UpdateLastUsed: %v", err)
-	}
-	if t.UID == 0 {
-		return &auth.AuthenticationAttemptedIncorrectCredential{Error: err}
-	}
-
-	reducer, err := authz.GetAuthorizationReducerForAccessToken(ctx, t)
-	if err != nil {
-		return &auth.AuthenticationError{Error: fmt.Errorf("oauth2 GetAuthorizationReducerForAccessToken: %w", err)}
-	}
-
-	u, err := user_model.GetUserByID(ctx, t.UID)
-	if err != nil {
-		return &auth.AuthenticationError{Error: fmt.Errorf("oauth2 GetUserByID: %w", err)}
-	}
-
-	return &auth.AuthenticationSuccess{Result: &accessTokenAuthenticationResult{user: u, scope: t.Scope, reducer: reducer}}
-}
-
-// Verify extracts the user ID from the OAuth token in the query parameters
-// or the "Authorization" header and returns the corresponding user object for that ID.
-// If verification is successful returns an existing user object.
-// Returns nil if verification fails.
 func (o *OAuth2) Verify(req *http.Request, w http.ResponseWriter, _ auth.SessionStore) auth.MethodOutput {
+	if !setting.OAuth2.Enabled {
+		return &auth.AuthenticationNotAttempted{}
+	}
 	// These paths are not API paths, but we still want to check for tokens because they maybe in the API returned URLs
 	if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isAuthenticatedTokenRequest(req) &&
 		!isGitRawOrAttachPath(req) && !isArchivePath(req) {
 		return &auth.AuthenticationNotAttempted{}
 	}
 
-	token, ok := parseToken(req)
-	if !ok {
+	maybeAuthToken := o.getTokenFromRequest(req)
+	if !maybeAuthToken.Has() {
 		return &auth.AuthenticationNotAttempted{}
 	}
+	_, authToken := maybeAuthToken.Get()
 
-	return o.userIDFromToken(req.Context(), token)
+	token, err := oauth2.ParseToken(authToken, oauth2.DefaultSigningKey)
+	if err != nil {
+		log.Trace("oauth2.ParseToken: %v", err)
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: err}
+	}
+
+	var grant *auth_model.OAuth2Grant
+	if grant, err = auth_model.GetOAuth2GrantByID(req.Context(), token.GrantID); err != nil {
+		return &auth.AuthenticationError{Error: fmt.Errorf("oauth2 GetOAuth2GrantByID: %w", err)}
+	} else if grant == nil {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: errors.New("oauth2 grant not found or revoked")}
+	}
+	if token.Type != oauth2.TypeAccessToken {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: errors.New("token was not an oauth2 access token")}
+	}
+	if token.ExpiresAt.Before(time.Now()) || token.IssuedAt.After(time.Now()) {
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: errors.New("token was expired")}
+	}
+	if grant.UserID == 0 {
+		return &auth.AuthenticationError{Error: errors.New("oauth2 invalid grant user id")}
+	}
+
+	var accessTokenScope optional.Option[auth_model.AccessTokenScope]
+	grantScopes := grantAdditionalScopes(grant.Scope)
+	if grantScopes != "" {
+		accessTokenScope = optional.Some(auth_model.AccessTokenScope(grantScopes))
+	} else {
+		accessTokenScope = optional.Some(auth_model.AccessTokenScopeAll) // fallback to all
+	}
+
+	user, err := user_model.GetPossibleUserByID(req.Context(), grant.UserID)
+	if err != nil {
+		if !user_model.IsErrUserNotExist(err) {
+			return &auth.AuthenticationError{Error: fmt.Errorf("oauth2 GetPossibleUserByID: %w", err)}
+		}
+		return &auth.AuthenticationAttemptedIncorrectCredential{Error: errors.New("oauth2 grant owner does not exist")}
+	}
+
+	return &auth.AuthenticationSuccess{
+		Result: &oAuth2JWTAuthenticationResult{
+			user:        user,
+			scope:       accessTokenScope,
+			grantScopes: grantScopes,
+		},
+	}
+}
+
+func (*OAuth2) getTokenFromRequest(req *http.Request) optional.Option[string] {
+	if has, token := tokenFromForm(req).Get(); has {
+		return optional.Some(token)
+	}
+	if has, token := tokenFromAuthorizationBasic(req).Get(); has {
+		return optional.Some(token)
+	}
+	if has, token := tokenFromAuthorizationBearer(req).Get(); has {
+		return optional.Some(token)
+	}
+	return optional.None[string]()
 }
 
 func isAuthenticatedTokenRequest(req *http.Request) bool {
-	switch req.URL.Path {
-	case "/login/oauth/userinfo":
-		fallthrough
-	case "/login/oauth/introspect":
-		return true
-	}
-	return false
+	return req.URL.Path == "/login/oauth/userinfo"
 }
diff --git a/services/auth/method/oauth2_test.go b/services/auth/method/oauth2_test.go
deleted file mode 100644
index 5ad103fe58..0000000000
--- a/services/auth/method/oauth2_test.go
+++ /dev/null
@@ -1,117 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package method
-
-import (
-	"net/http"
-	"testing"
-
-	actions_model "forgejo.org/models/actions"
-	"forgejo.org/models/auth"
-	"forgejo.org/models/unittest"
-	user_model "forgejo.org/models/user"
-	"forgejo.org/services/actions"
-	auth_service "forgejo.org/services/auth"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestUserIDFromToken(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	t.Run("Actions JWT", func(t *testing.T) {
-		const RunningTaskID = 47
-		task := &actions_model.ActionTask{
-			ID: RunningTaskID,
-			Job: &actions_model.ActionRunJob{
-				ID:    2,
-				RunID: 1,
-			},
-		}
-		token, err := actions.CreateAuthorizationToken(task, map[string]any{}, false)
-		require.NoError(t, err)
-
-		o := OAuth2{}
-		output := o.userIDFromToken(t.Context(), token)
-		ar, authSuccess := output.(*auth_service.AuthenticationSuccess)
-		require.True(t, authSuccess, "expected type AuthenticationSuccess, but was: %#v", output)
-		authResult := ar.Result
-		assert.Equal(t, int64(user_model.ActionsUserID), authResult.User().ID)
-		isActionsToken, authTaskID := authResult.ActionsTaskID().Get()
-		assert.True(t, isActionsToken)
-		assert.Equal(t, int64(RunningTaskID), authTaskID)
-	})
-
-	t.Run("Actions error-JWT", func(t *testing.T) {
-		cases := map[string]struct {
-			Token string
-			Error error
-		}{
-			"Empty":    {"", auth.ErrAccessTokenEmpty{}},
-			"To short": {"abc", auth.ErrAccessTokenNotExist{Token: "abc"}},
-		}
-
-		o := OAuth2{}
-		for name, c := range cases {
-			t.Run(name, func(t *testing.T) {
-				output := o.userIDFromToken(t.Context(), c.Token)
-
-				ar, authFailure := output.(*auth_service.AuthenticationAttemptedIncorrectCredential)
-				require.True(t, authFailure, "expected type AuthenticationAttemptedIncorrectCredential, but was: %#v", output)
-				err := ar.Error
-
-				require.ErrorIs(t, err, c.Error)
-			})
-		}
-	})
-}
-
-func TestCheckTaskIsRunning(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	cases := map[string]struct {
-		TaskID   int64
-		Expected bool
-	}{
-		"Running":   {TaskID: 47, Expected: true},
-		"Missing":   {TaskID: 1, Expected: false},
-		"Cancelled": {TaskID: 46, Expected: false},
-	}
-
-	for name := range cases {
-		c := cases[name]
-		t.Run(name, func(t *testing.T) {
-			actual := CheckTaskIsRunning(t.Context(), c.TaskID)
-			assert.Equal(t, c.Expected, actual)
-		})
-	}
-}
-
-func TestParseToken(t *testing.T) {
-	cases := map[string]struct {
-		Header        string
-		ExpectedToken string
-		Expected      bool
-	}{
-		"Token Uppercase":   {Header: "Token 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
-		"Token Lowercase":   {Header: "token 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
-		"Token Unicode":     {Header: "to\u212Aen 1234567890123456789012345687901325467890", ExpectedToken: "", Expected: false},
-		"Bearer Uppercase":  {Header: "Bearer 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
-		"Bearer Lowercase":  {Header: "bearer 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
-		"Missing type":      {Header: "1234567890123456789012345687901325467890", ExpectedToken: "", Expected: false},
-		"Three Parts":       {Header: "abc 1234567890 test", ExpectedToken: "", Expected: false},
-		"Token Three Parts": {Header: "Token 1234567890 test", ExpectedToken: "", Expected: false},
-	}
-
-	for name := range cases {
-		c := cases[name]
-		t.Run(name, func(t *testing.T) {
-			req, _ := http.NewRequest("GET", "/", nil)
-			req.Header.Add("Authorization", c.Header)
-			ActualToken, ActualSuccess := parseToken(req)
-			assert.Equal(t, c.ExpectedToken, ActualToken)
-			assert.Equal(t, c.Expected, ActualSuccess)
-		})
-	}
-}
diff --git a/services/auth/method/util.go b/services/auth/method/util.go
new file mode 100644
index 0000000000..8f3d2d355d
--- /dev/null
+++ b/services/auth/method/util.go
@@ -0,0 +1,71 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package method
+
+import (
+	"net/http"
+	"strings"
+
+	"forgejo.org/modules/base"
+	"forgejo.org/modules/log"
+	"forgejo.org/modules/optional"
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/util"
+)
+
+func tokenFromForm(req *http.Request) optional.Option[string] {
+	_ = req.ParseForm()
+	if !setting.DisableQueryAuthToken {
+		// Check token.
+		if token := req.Form.Get("token"); token != "" {
+			return optional.Some(token)
+		}
+		// Check access token.
+		if token := req.Form.Get("access_token"); token != "" {
+			return optional.Some(token)
+		}
+	} else if req.Form.Get("token") != "" || req.Form.Get("access_token") != "" {
+		log.Warn("API token sent in query string but DISABLE_QUERY_AUTH_TOKEN=true")
+	}
+	return optional.None[string]()
+}
+
+func tokenFromAuthorizationBearer(req *http.Request) optional.Option[string] {
+	authorization := req.Header.Get("Authorization")
+	if len(authorization) != 0 {
+		auths := strings.Fields(authorization)
+		if len(auths) == 2 && (util.ASCIIEqualFold(auths[0], "token") || util.ASCIIEqualFold(auths[0], "bearer")) {
+			return optional.Some(auths[1])
+		}
+	}
+	return optional.None[string]()
+}
+
+func tokenFromAuthorizationBasic(req *http.Request) optional.Option[string] {
+	authorization := req.Header.Get("Authorization")
+	if len(authorization) != 0 {
+		auths := strings.SplitN(authorization, " ", 2)
+		if len(auths) == 2 && strings.ToLower(auths[0]) == "basic" {
+			uname, passwd, err := base.BasicAuthDecode(auths[1])
+			if err != nil {
+				// Client provided a `Authorization: Basic ...`, but then [...] either couldn't be base64 decoded, or
+				// didn't contain a ":" for username/password separation.  If we return `None`, it'll indicate to the
+				// caller that `Authorization: Basic [...]` wasn't present and skip authentication, so intead we'll
+				// return Some with an empty token to trigger a 401 error.
+				log.Debug("unexpected error in BasicAuthDecode(%q): %s", auths[1], err)
+				return optional.Some("")
+			}
+
+			// Usually we'll use the password as the access token (or oauth token), but if the password is empty or
+			// `x-oauth-basic`, we'll use the username as a token.  This behaviour is inherited from GitHub's OAuth Git
+			// over HTTPS behaviour.
+			if len(passwd) == 0 || passwd == "x-oauth-basic" {
+				return optional.Some(uname)
+			}
+
+			return optional.Some(passwd)
+		}
+	}
+	return optional.None[string]()
+}
diff --git a/services/auth/method/util_test.go b/services/auth/method/util_test.go
new file mode 100644
index 0000000000..9183701e4f
--- /dev/null
+++ b/services/auth/method/util_test.go
@@ -0,0 +1,43 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package method
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestTokenFromAuthorizationBearer(t *testing.T) {
+	cases := map[string]struct {
+		Header        string
+		ExpectedToken string
+		Expected      bool
+	}{
+		"Token Uppercase":   {Header: "Token 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
+		"Token Lowercase":   {Header: "token 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
+		"Token Unicode":     {Header: "to\u212Aen 1234567890123456789012345687901325467890", ExpectedToken: "", Expected: false},
+		"Bearer Uppercase":  {Header: "Bearer 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
+		"Bearer Lowercase":  {Header: "bearer 1234567890123456789012345687901325467890", ExpectedToken: "1234567890123456789012345687901325467890", Expected: true},
+		"Missing type":      {Header: "1234567890123456789012345687901325467890", ExpectedToken: "", Expected: false},
+		"Three Parts":       {Header: "abc 1234567890 test", ExpectedToken: "", Expected: false},
+		"Token Three Parts": {Header: "Token 1234567890 test", ExpectedToken: "", Expected: false},
+	}
+
+	for name := range cases {
+		c := cases[name]
+		t.Run(name, func(t *testing.T) {
+			req, _ := http.NewRequest("GET", "/", nil)
+			req.Header.Add("Authorization", c.Header)
+			maybeToken := tokenFromAuthorizationBearer(req)
+			if hasToken, token := maybeToken.Get(); hasToken {
+				assert.True(t, c.Expected)
+				assert.Equal(t, c.ExpectedToken, token)
+			} else {
+				assert.False(t, c.Expected)
+			}
+		})
+	}
+}
diff --git a/services/auth/source/oauth2/init.go b/services/auth/source/oauth2/init.go
index ac7853222c..6e0714b9b5 100644
--- a/services/auth/source/oauth2/init.go
+++ b/services/auth/source/oauth2/init.go
@@ -35,7 +35,7 @@ var DefaultSigningKey jwtx.SigningKey
 // Init initializes the oauth source
 func Init(ctx context.Context) error {
 	var err error
-	DefaultSigningKey, err = jwtx.InitSigningKey(setting.GetGeneralTokenSigningSecret, setting.OAuth2.JWTSigningPrivateKeyFile, setting.OAuth2.JWTSigningAlgorithm)
+	DefaultSigningKey, err = jwtx.InitSigningKey(&setting.OAuth2.KeyCfg.Signing)
 	if err != nil {
 		return err
 	}
diff --git a/services/authz/TestGetAuthorizationReducerForAuthorizedIntegration/authorized_integ_resource_repo.yml b/services/authz/TestGetAuthorizationReducerForAuthorizedIntegration/authorized_integ_resource_repo.yml
new file mode 100644
index 0000000000..d5d55d1d67
--- /dev/null
+++ b/services/authz/TestGetAuthorizationReducerForAuthorizedIntegration/authorized_integ_resource_repo.yml
@@ -0,0 +1,5 @@
+-
+  id: 1
+  integ_id: 7
+  repo_id: 1
+  created_unix: 1772158384
diff --git a/services/authz/TestGetAuthorizationReducerForAuthorizedIntegration/authorized_integration.yml b/services/authz/TestGetAuthorizationReducerForAuthorizedIntegration/authorized_integration.yml
new file mode 100644
index 0000000000..7c173e5ea6
--- /dev/null
+++ b/services/authz/TestGetAuthorizationReducerForAuthorizedIntegration/authorized_integration.yml
@@ -0,0 +1,35 @@
+# all access
+-
+  id: 5
+  user_id: 2
+  scope: all
+  resource_all_repos: true
+  issuer: https://example.org/
+  audience: https://forgejo.example.org/-/user/integration/abcdef123
+  claim_rules: "{}"
+  created_unix: 1777153359
+  updated_unix: 1777153359
+
+# public-only
+-
+  id: 6
+  user_id: 2
+  scope: public-only,read:activitypub
+  resource_all_repos: true
+  issuer: https://example.org/
+  audience: https://forgejo.example.org/-/user/integration/abcdef1234
+  claim_rules: "{}"
+  created_unix: 1777153359
+  updated_unix: 1777153359
+
+# repo-specific
+-
+  id: 7
+  user_id: 2
+  scope: all
+  resource_all_repos: false
+  issuer: https://example.org/
+  audience: https://forgejo.example.org/-/user/integration/abcdef1235
+  claim_rules: "{}"
+  created_unix: 1777153359
+  updated_unix: 1777153359
diff --git a/services/authz/access_token.go b/services/authz/access_token.go
index 207fdd6546..5a6d876cf6 100644
--- a/services/authz/access_token.go
+++ b/services/authz/access_token.go
@@ -25,17 +25,19 @@ func GetAuthorizationReducerForAccessToken(ctx context.Context, token *auth_mode
 	if err != nil {
 		return nil, fmt.Errorf("GetRepositoriesAccessibleWithToken: %w", err)
 	}
-	return &SpecificReposAuthorizationReducer{resourceRepos: repos}, nil
+	// Cast slice into []RepoGetter
+	iface := make([]RepoGetter, len(repos))
+	for i, r := range repos {
+		iface[i] = r
+	}
+	return &SpecificReposAuthorizationReducer{resourceRepos: iface}, nil
 }
 
-// A locale lookup string for the error -- eg. `access_token.error.invalid_something`
-type AccessTokenValidationFailure string
-
 // Validate that an access token's state is valid for creation.  For example, that it doesn't have a conflicting set of
 // resources (public-only and specific repositories), and other similar checks.
 func ValidateAccessToken(token *auth_model.AccessToken, repoResources []*auth_model.AccessTokenResourceRepo) error {
 	// Other validations may be added here in the future.
-	return validateRepositoryResource(token, repoResources)
+	return validateRepositoryResource(token.ResourceAllRepos, token.Scope, len(repoResources))
 }
 
 var (
@@ -44,19 +46,19 @@ var (
 	ErrSpecifiedReposInvalidScope = errors.New("specified repository access token: invalid scope")
 )
 
-func validateRepositoryResource(token *auth_model.AccessToken, repoResources []*auth_model.AccessTokenResourceRepo) error {
+func validateRepositoryResource(resourceAllRepos bool, scope auth_model.AccessTokenScope, numRepoResources int) error {
 	// Access tokens with broad access to all resources don't have any relevant validation rules to apply.
-	if token.ResourceAllRepos {
+	if resourceAllRepos {
 		return nil
 	}
 
 	// Repo-specific access token must have at least one repository.
-	if len(repoResources) == 0 {
+	if numRepoResources == 0 {
 		return ErrSpecifiedReposNone
 	}
 
 	// Can't have public-only and specified repos -- that's a combination that doesn't make sense.
-	if publicOnly, err := token.Scope.PublicOnly(); err != nil {
+	if publicOnly, err := scope.PublicOnly(); err != nil {
 		return err
 	} else if publicOnly {
 		return ErrSpecifiedReposNoPublicOnly
@@ -66,7 +68,7 @@ func validateRepositoryResource(token *auth_model.AccessToken, repoResources []*
 	// support repositories as a resource.  For example, if you had a repo-specific token but then gave it
 	// `write:organization`, it would be able to do operations like delete an organization -- permission checks on the
 	// repository resources wouldn't be applicable to the organization resources.
-	for _, scope := range token.Scope.StringSlice() {
+	for _, scope := range scope.StringSlice() {
 		switch auth_model.AccessTokenScope(scope) {
 		case auth_model.AccessTokenScopeReadIssue,
 			auth_model.AccessTokenScopeWriteIssue,
diff --git a/services/authz/access_token_test.go b/services/authz/access_token_test.go
index 8219e2a057..2e4d9e4453 100644
--- a/services/authz/access_token_test.go
+++ b/services/authz/access_token_test.go
@@ -42,7 +42,7 @@ func TestGetAuthorizationReducerForAccessToken(t *testing.T) {
 		require.NotNil(t, specific)
 
 		require.Len(t, specific.resourceRepos, 1)
-		assert.EqualValues(t, 1, specific.resourceRepos[0].RepoID)
+		assert.EqualValues(t, 1, specific.resourceRepos[0].GetTargetRepoID())
 	})
 }
 
diff --git a/services/authz/authorization_reducer.go b/services/authz/authorization_reducer.go
index 7485f74f40..f2bc8d4f71 100644
--- a/services/authz/authorization_reducer.go
+++ b/services/authz/authorization_reducer.go
@@ -9,6 +9,8 @@ import (
 
 // Defines an API for reducing available permissions to specific resources.  Typically associated with a fine-grained
 // access tokens and provides methods to reduce authorization that the access token provides down to specific resources.
+//
+//mockery:generate: true
 type AuthorizationReducer interface {
 	// Incorporate all the methods of [RepositoryAuthorizationReducer], which allows reducing permissions related to
 	// repositories specifically.
diff --git a/services/authz/authorization_reducer_mock.go b/services/authz/authorization_reducer_mock.go
index 79562917c4..c31030b29a 100644
--- a/services/authz/authorization_reducer_mock.go
+++ b/services/authz/authorization_reducer_mock.go
@@ -1,86 +1,19 @@
-// Code generated by mockery v2.53.5. DO NOT EDIT.
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
 
 package authz
 
 import (
-	context "context"
+	"context"
 
 	"forgejo.org/models/perm"
-	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/repo"
 
 	mock "github.com/stretchr/testify/mock"
 	"xorm.io/builder"
 )
 
-// MockAuthorizationReducer is an autogenerated mock type for the AuthorizationReducer type
-type MockAuthorizationReducer struct {
-	mock.Mock
-}
-
-// AllowAdminOverride provides a mock function with no fields
-func (_m *MockAuthorizationReducer) AllowAdminOverride() bool {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for AllowAdminOverride")
-	}
-
-	var r0 bool
-	if rf, ok := ret.Get(0).(func() bool); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(bool)
-	}
-
-	return r0
-}
-
-// ReduceRepoAccess provides a mock function with given fields: ctx, repo, accessMode
-func (_m *MockAuthorizationReducer) ReduceRepoAccess(ctx context.Context, repo *repo_model.Repository, accessMode perm.AccessMode) (perm.AccessMode, error) {
-	ret := _m.Called(ctx, repo, accessMode)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ReduceRepoAccess")
-	}
-
-	var r0 perm.AccessMode
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *repo_model.Repository, perm.AccessMode) (perm.AccessMode, error)); ok {
-		return rf(ctx, repo, accessMode)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, *repo_model.Repository, perm.AccessMode) perm.AccessMode); ok {
-		r0 = rf(ctx, repo, accessMode)
-	} else {
-		r0 = ret.Get(0).(perm.AccessMode)
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, *repo_model.Repository, perm.AccessMode) error); ok {
-		r1 = rf(ctx, repo, accessMode)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// RepoFilter provides a mock function with given fields: accessMode
-func (_m *MockAuthorizationReducer) RepoReadAccessFilter() builder.Cond {
-	ret := _m.Called()
-
-	if len(ret) == 0 {
-		panic("no return value specified for AllowAdminOverride")
-	}
-
-	var r0 builder.Cond
-	if rf, ok := ret.Get(0).(func() builder.Cond); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(builder.Cond)
-	}
-
-	return r0
-}
-
 // NewMockAuthorizationReducer creates a new instance of MockAuthorizationReducer. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewMockAuthorizationReducer(t interface {
@@ -95,3 +28,178 @@ func NewMockAuthorizationReducer(t interface {
 
 	return mock
 }
+
+// MockAuthorizationReducer is an autogenerated mock type for the AuthorizationReducer type
+type MockAuthorizationReducer struct {
+	mock.Mock
+}
+
+type MockAuthorizationReducer_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockAuthorizationReducer) EXPECT() *MockAuthorizationReducer_Expecter {
+	return &MockAuthorizationReducer_Expecter{mock: &_m.Mock}
+}
+
+// AllowAdminOverride provides a mock function for the type MockAuthorizationReducer
+func (_mock *MockAuthorizationReducer) AllowAdminOverride() bool {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for AllowAdminOverride")
+	}
+
+	var r0 bool
+	if returnFunc, ok := ret.Get(0).(func() bool); ok {
+		r0 = returnFunc()
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+	return r0
+}
+
+// MockAuthorizationReducer_AllowAdminOverride_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'AllowAdminOverride'
+type MockAuthorizationReducer_AllowAdminOverride_Call struct {
+	*mock.Call
+}
+
+// AllowAdminOverride is a helper method to define mock.On call
+func (_e *MockAuthorizationReducer_Expecter) AllowAdminOverride() *MockAuthorizationReducer_AllowAdminOverride_Call {
+	return &MockAuthorizationReducer_AllowAdminOverride_Call{Call: _e.mock.On("AllowAdminOverride")}
+}
+
+func (_c *MockAuthorizationReducer_AllowAdminOverride_Call) Run(run func()) *MockAuthorizationReducer_AllowAdminOverride_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockAuthorizationReducer_AllowAdminOverride_Call) Return(b bool) *MockAuthorizationReducer_AllowAdminOverride_Call {
+	_c.Call.Return(b)
+	return _c
+}
+
+func (_c *MockAuthorizationReducer_AllowAdminOverride_Call) RunAndReturn(run func() bool) *MockAuthorizationReducer_AllowAdminOverride_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ReduceRepoAccess provides a mock function for the type MockAuthorizationReducer
+func (_mock *MockAuthorizationReducer) ReduceRepoAccess(ctx context.Context, repo1 *repo.Repository, accessMode perm.AccessMode) (perm.AccessMode, error) {
+	ret := _mock.Called(ctx, repo1, accessMode)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ReduceRepoAccess")
+	}
+
+	var r0 perm.AccessMode
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *repo.Repository, perm.AccessMode) (perm.AccessMode, error)); ok {
+		return returnFunc(ctx, repo1, accessMode)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *repo.Repository, perm.AccessMode) perm.AccessMode); ok {
+		r0 = returnFunc(ctx, repo1, accessMode)
+	} else {
+		r0 = ret.Get(0).(perm.AccessMode)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *repo.Repository, perm.AccessMode) error); ok {
+		r1 = returnFunc(ctx, repo1, accessMode)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// MockAuthorizationReducer_ReduceRepoAccess_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ReduceRepoAccess'
+type MockAuthorizationReducer_ReduceRepoAccess_Call struct {
+	*mock.Call
+}
+
+// ReduceRepoAccess is a helper method to define mock.On call
+//   - ctx context.Context
+//   - repo1 *repo.Repository
+//   - accessMode perm.AccessMode
+func (_e *MockAuthorizationReducer_Expecter) ReduceRepoAccess(ctx, repo1, accessMode any) *MockAuthorizationReducer_ReduceRepoAccess_Call {
+	return &MockAuthorizationReducer_ReduceRepoAccess_Call{Call: _e.mock.On("ReduceRepoAccess", ctx, repo1, accessMode)}
+}
+
+func (_c *MockAuthorizationReducer_ReduceRepoAccess_Call) Run(run func(ctx context.Context, repo1 *repo.Repository, accessMode perm.AccessMode)) *MockAuthorizationReducer_ReduceRepoAccess_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *repo.Repository
+		if args[1] != nil {
+			arg1 = args[1].(*repo.Repository)
+		}
+		var arg2 perm.AccessMode
+		if args[2] != nil {
+			arg2 = args[2].(perm.AccessMode)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *MockAuthorizationReducer_ReduceRepoAccess_Call) Return(accessMode1 perm.AccessMode, err error) *MockAuthorizationReducer_ReduceRepoAccess_Call {
+	_c.Call.Return(accessMode1, err)
+	return _c
+}
+
+func (_c *MockAuthorizationReducer_ReduceRepoAccess_Call) RunAndReturn(run func(ctx context.Context, repo1 *repo.Repository, accessMode perm.AccessMode) (perm.AccessMode, error)) *MockAuthorizationReducer_ReduceRepoAccess_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// RepoReadAccessFilter provides a mock function for the type MockAuthorizationReducer
+func (_mock *MockAuthorizationReducer) RepoReadAccessFilter() builder.Cond {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for RepoReadAccessFilter")
+	}
+
+	var r0 builder.Cond
+	if returnFunc, ok := ret.Get(0).(func() builder.Cond); ok {
+		r0 = returnFunc()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(builder.Cond)
+		}
+	}
+	return r0
+}
+
+// MockAuthorizationReducer_RepoReadAccessFilter_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RepoReadAccessFilter'
+type MockAuthorizationReducer_RepoReadAccessFilter_Call struct {
+	*mock.Call
+}
+
+// RepoReadAccessFilter is a helper method to define mock.On call
+func (_e *MockAuthorizationReducer_Expecter) RepoReadAccessFilter() *MockAuthorizationReducer_RepoReadAccessFilter_Call {
+	return &MockAuthorizationReducer_RepoReadAccessFilter_Call{Call: _e.mock.On("RepoReadAccessFilter")}
+}
+
+func (_c *MockAuthorizationReducer_RepoReadAccessFilter_Call) Run(run func()) *MockAuthorizationReducer_RepoReadAccessFilter_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockAuthorizationReducer_RepoReadAccessFilter_Call) Return(cond builder.Cond) *MockAuthorizationReducer_RepoReadAccessFilter_Call {
+	_c.Call.Return(cond)
+	return _c
+}
+
+func (_c *MockAuthorizationReducer_RepoReadAccessFilter_Call) RunAndReturn(run func() builder.Cond) *MockAuthorizationReducer_RepoReadAccessFilter_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/services/authz/authorized_integration.go b/services/authz/authorized_integration.go
new file mode 100644
index 0000000000..33099c7401
--- /dev/null
+++ b/services/authz/authorized_integration.go
@@ -0,0 +1,40 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package authz
+
+import (
+	"context"
+	"fmt"
+
+	auth_model "forgejo.org/models/auth"
+)
+
+func GetAuthorizationReducerForAuthorizedIntegration(ctx context.Context, ai *auth_model.AuthorizedIntegration) (AuthorizationReducer, error) {
+	if ai.ResourceAllRepos {
+		if publicOnly, err := ai.Scope.PublicOnly(); err != nil {
+			return nil, fmt.Errorf("PublicOnly: %w", err)
+		} else if publicOnly {
+			return &PublicReposAuthorizationReducer{}, nil
+		}
+		return &AllAccessAuthorizationReducer{}, nil
+	}
+
+	repos, err := auth_model.GetRepositoriesAccessibleWithIntegration(ctx, ai.ID)
+	if err != nil {
+		return nil, fmt.Errorf("GetRepositoriesAccessibleWithIntegration: %w", err)
+	}
+	// Cast slice into []RepoGetter
+	iface := make([]RepoGetter, len(repos))
+	for i, r := range repos {
+		iface[i] = r
+	}
+	return &SpecificReposAuthorizationReducer{resourceRepos: iface}, nil
+}
+
+// Validate that an authorized integration's state is valid for creation.  For example, that it doesn't have a
+// conflicting set of resources (public-only and specific repositories), and other similar checks.
+func ValidateAuthorizedIntegration(ai *auth_model.AuthorizedIntegration, repoResources []*auth_model.AuthorizedIntegResourceRepo) error {
+	// Other validations may be added here in the future.
+	return validateRepositoryResource(ai.ResourceAllRepos, ai.Scope, len(repoResources))
+}
diff --git a/services/authz/authorized_integration_test.go b/services/authz/authorized_integration_test.go
new file mode 100644
index 0000000000..cb46a2479f
--- /dev/null
+++ b/services/authz/authorized_integration_test.go
@@ -0,0 +1,99 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package authz
+
+import (
+	"strings"
+	"testing"
+
+	"forgejo.org/models/auth"
+	"forgejo.org/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetAuthorizationReducerForAuthorizedIntegration(t *testing.T) {
+	defer unittest.OverrideFixtures("services/authz/TestGetAuthorizationReducerForAuthorizedIntegration")()
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	t.Run("all access", func(t *testing.T) {
+		token := unittest.AssertExistsAndLoadBean(t, &auth.AuthorizedIntegration{ID: 5})
+		reducer, err := GetAuthorizationReducerForAuthorizedIntegration(t.Context(), token)
+		require.NoError(t, err)
+		assert.IsType(t, &AllAccessAuthorizationReducer{}, reducer)
+	})
+
+	t.Run("public resources only", func(t *testing.T) {
+		token := unittest.AssertExistsAndLoadBean(t, &auth.AuthorizedIntegration{ID: 6})
+		reducer, err := GetAuthorizationReducerForAuthorizedIntegration(t.Context(), token)
+		require.NoError(t, err)
+		assert.IsType(t, &PublicReposAuthorizationReducer{}, reducer)
+	})
+
+	t.Run("specific repos only", func(t *testing.T) {
+		token := unittest.AssertExistsAndLoadBean(t, &auth.AuthorizedIntegration{ID: 7})
+		reducer, err := GetAuthorizationReducerForAuthorizedIntegration(t.Context(), token)
+		require.NoError(t, err)
+
+		specific, ok := reducer.(*SpecificReposAuthorizationReducer)
+		require.True(t, ok)
+		require.NotNil(t, specific)
+
+		require.Len(t, specific.resourceRepos, 1)
+		assert.EqualValues(t, 1, specific.resourceRepos[0].GetTargetRepoID())
+	})
+}
+
+func TestValidateAuthorizedIntegration(t *testing.T) {
+	t.Run("valid - all access", func(t *testing.T) {
+		ai := &auth.AuthorizedIntegration{
+			ResourceAllRepos: true,
+			Scope:            auth.AccessTokenScopeReadRepository,
+		}
+		err := ValidateAuthorizedIntegration(ai, nil)
+		require.NoError(t, err)
+	})
+
+	t.Run("valid - specified repos", func(t *testing.T) {
+		ai := &auth.AuthorizedIntegration{
+			ResourceAllRepos: false,
+			Scope:            auth.AccessTokenScopeReadRepository,
+		}
+		resources := []*auth.AuthorizedIntegResourceRepo{{RepoID: 12}}
+		err := ValidateAuthorizedIntegration(ai, resources)
+		require.NoError(t, err)
+	})
+
+	t.Run("invalid - no specified repos", func(t *testing.T) {
+		ai := &auth.AuthorizedIntegration{
+			ResourceAllRepos: false,
+			Scope:            auth.AccessTokenScopeReadRepository,
+		}
+		resources := []*auth.AuthorizedIntegResourceRepo{}
+		err := ValidateAuthorizedIntegration(ai, resources)
+		require.ErrorIs(t, err, ErrSpecifiedReposNone)
+	})
+
+	t.Run("invalid - specified repos & public-only", func(t *testing.T) {
+		ai := &auth.AuthorizedIntegration{
+			ResourceAllRepos: false,
+			Scope:            auth.AccessTokenScope(strings.Join([]string{string(auth.AccessTokenScopePublicOnly), string(auth.AccessTokenScopeReadRepository)}, ",")),
+		}
+		resources := []*auth.AuthorizedIntegResourceRepo{{RepoID: 12}}
+		err := ValidateAuthorizedIntegration(ai, resources)
+		require.ErrorIs(t, err, ErrSpecifiedReposNoPublicOnly)
+	})
+
+	t.Run("invalid - specified repos unsupported scopes", func(t *testing.T) {
+		ai := &auth.AuthorizedIntegration{
+			ResourceAllRepos: false,
+			Scope:            auth.AccessTokenScopeReadAdmin,
+		}
+		resources := []*auth.AuthorizedIntegResourceRepo{{RepoID: 12}}
+		err := ValidateAuthorizedIntegration(ai, resources)
+		require.ErrorIs(t, err, ErrSpecifiedReposInvalidScope)
+		require.ErrorContains(t, err, string(auth.AccessTokenScopeReadAdmin))
+	})
+}
diff --git a/services/authz/specific_repos_reducer.go b/services/authz/specific_repos_reducer.go
index dd085189af..b4e97f2a6b 100644
--- a/services/authz/specific_repos_reducer.go
+++ b/services/authz/specific_repos_reducer.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 
-	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/perm"
 	repo_model "forgejo.org/models/repo"
 	"forgejo.org/modules/structs"
@@ -19,12 +18,16 @@ import (
 // repositories that aren't listed among the specific repos, read-only access is permitted.  For all other repos, no
 // access is permitted.
 type SpecificReposAuthorizationReducer struct {
-	resourceRepos []*auth_model.AccessTokenResourceRepo
+	resourceRepos []RepoGetter
+}
+
+type RepoGetter interface {
+	GetTargetRepoID() int64
 }
 
 func (r *SpecificReposAuthorizationReducer) ReduceRepoAccess(ctx context.Context, repo *repo_model.Repository, accessMode perm.AccessMode) (perm.AccessMode, error) {
 	for _, tokenRepo := range r.resourceRepos {
-		if tokenRepo.RepoID == repo.ID {
+		if tokenRepo.GetTargetRepoID() == repo.ID {
 			// No restrictions as this repo is within the scope of the access token.
 			return accessMode, nil
 		}
@@ -47,7 +50,7 @@ func (r *SpecificReposAuthorizationReducer) ReduceRepoAccess(ctx context.Context
 func (r *SpecificReposAuthorizationReducer) RepoReadAccessFilter() builder.Cond {
 	repoIDs := make([]int64, len(r.resourceRepos))
 	for i, tokenRepo := range r.resourceRepos {
-		repoIDs[i] = tokenRepo.RepoID
+		repoIDs[i] = tokenRepo.GetTargetRepoID()
 	}
 	targetRepos := builder.In("repository.id", repoIDs)
 
diff --git a/services/authz/specific_repos_reducer_test.go b/services/authz/specific_repos_reducer_test.go
index 5db65eeca4..a7bd1545b0 100644
--- a/services/authz/specific_repos_reducer_test.go
+++ b/services/authz/specific_repos_reducer_test.go
@@ -20,11 +20,11 @@ func TestSpecificReposAuthorizationReducer(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 
 	reducer := &SpecificReposAuthorizationReducer{
-		resourceRepos: []*auth.AccessTokenResourceRepo{
-			{
+		resourceRepos: []RepoGetter{
+			&auth.AccessTokenResourceRepo{
 				RepoID: 1,
 			},
-			{
+			&auth.AccessTokenResourceRepo{
 				RepoID: 2,
 			},
 		},
diff --git a/services/automerge/automerge.go b/services/automerge/automerge.go
index 099d048927..4c5459adf6 100644
--- a/services/automerge/automerge.go
+++ b/services/automerge/automerge.go
@@ -215,7 +215,7 @@ func handlePullRequestAutoMerge(pullID int64, sha string) {
 		return
 	}
 
-	if err := pull_service.CheckPullMergeable(ctx, doer, &perm, pr, pull_service.MergeCheckTypeGeneral, false); err != nil {
+	if err := pull_service.CheckPullMergeable(ctx, doer, &perm, pr, pull_service.MergeCheckTypeGeneral, false, scheduledPRM.MergeStyle); err != nil {
 		if errors.Is(err, pull_service.ErrUserNotAllowedToMerge) {
 			log.Info("%-v was scheduled to automerge by an unauthorized user", pr)
 			return
diff --git a/services/context/context.go b/services/context/context.go
index f5c57e82ad..af5ec26143 100644
--- a/services/context/context.go
+++ b/services/context/context.go
@@ -187,6 +187,7 @@ func Contexter() func(next http.Handler) http.Handler {
 			ctx.Data["DisableStars"] = setting.Repository.DisableStars
 			ctx.Data["DisableForks"] = setting.Repository.DisableForks
 			ctx.Data["EnableActions"] = setting.Actions.Enabled
+			ctx.Data["EnableFederation"] = setting.Federation.Enabled
 
 			ctx.Data["UnitWikiGlobalDisabled"] = unit.TypeWiki.UnitGlobalDisabled()
 			ctx.Data["UnitIssuesGlobalDisabled"] = unit.TypeIssues.UnitGlobalDisabled()
diff --git a/services/context/org.go b/services/context/org.go
index c7d06b9bcc..adc6e33494 100644
--- a/services/context/org.go
+++ b/services/context/org.go
@@ -64,6 +64,32 @@ func GetOrganizationByParams(ctx *Context) {
 	}
 }
 
+func ensureIsOrg(ctx *Context) bool {
+	switch {
+	// Getting Organization from params
+	case ctx.ContextUser == nil:
+		if ctx.Org.Organization == nil {
+			GetOrganizationByParams(ctx)
+		}
+		return !ctx.Written()
+	// Getting Organization from ContextUser
+	case ctx.ContextUser.IsOrganization():
+		if ctx.Org == nil {
+			ctx.Org = &Organization{}
+		}
+		ctx.Org.Organization = (*organization.Organization)(ctx.ContextUser)
+		return true
+	}
+	// ContextUser is an individual User
+	return false
+}
+
+func EnsureOrg() func(*Context) {
+	return func(ctx *Context) {
+		ensureIsOrg(ctx)
+	}
+}
+
 // HandleOrgAssignment handles organization assignment
 func HandleOrgAssignment(ctx *Context, args ...bool) {
 	var (
@@ -87,24 +113,9 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 
 	var err error
 
-	if ctx.ContextUser == nil {
-		// if Organization is not defined, get it from params
-		if ctx.Org.Organization == nil {
-			GetOrganizationByParams(ctx)
-			if ctx.Written() {
-				return
-			}
-		}
-	} else if ctx.ContextUser.IsOrganization() {
-		if ctx.Org == nil {
-			ctx.Org = &Organization{}
-		}
-		ctx.Org.Organization = (*organization.Organization)(ctx.ContextUser)
-	} else {
-		// ContextUser is an individual User
+	if !ensureIsOrg(ctx) {
 		return
 	}
-
 	org := ctx.Org.Organization
 
 	// Handle Visibility
diff --git a/services/convert/action.go b/services/convert/action.go
index 703c1f1261..da40ac7916 100644
--- a/services/convert/action.go
+++ b/services/convert/action.go
@@ -47,3 +47,39 @@ func ToActionRun(ctx context.Context, run *actions_model.ActionRun, doer *user_m
 		HTMLURL:           run.HTMLURL(),
 	}
 }
+
+// ToActionArtifact converts an AggregatedArtifact to an API ActionArtifact.
+// repoAPIURL is the API URL prefix for the repository (e.g. from Repository.APIURL()).
+func ToActionArtifact(repoAPIURL string, art *actions_model.AggregatedArtifact) *api.ActionArtifact {
+	return &api.ActionArtifact{
+		ID:                 art.ID,
+		Name:               art.ArtifactName,
+		SizeInBytes:        art.FileSize,
+		ArchiveDownloadURL: art.APIDownloadURL(repoAPIURL),
+		Expired:            art.Status == actions_model.ArtifactStatusExpired,
+		RunID:              art.RunID,
+		CreatedAt:          art.CreatedUnix.AsTime(),
+		UpdatedAt:          art.UpdatedUnix.AsTime(),
+		ExpiresAt:          art.ExpiredUnix.AsTime(),
+	}
+}
+
+func ToActionRunJob(job *actions_model.ActionRunJob) *api.ActionRunJob {
+	if job == nil {
+		return nil
+	}
+
+	return &api.ActionRunJob{
+		ID:      job.ID,
+		RunID:   job.RunID,
+		Attempt: job.Attempt,
+		Handle:  job.Handle,
+		RepoID:  job.RepoID,
+		OwnerID: job.OwnerID,
+		Name:    job.Name,
+		Needs:   job.Needs,
+		RunsOn:  job.RunsOn,
+		TaskID:  job.TaskID,
+		Status:  job.Status.String(),
+	}
+}
diff --git a/services/convert/activitypub_person.go b/services/convert/activitypub_person.go
index 2c05f8c1c0..e4186cf30d 100644
--- a/services/convert/activitypub_person.go
+++ b/services/convert/activitypub_person.go
@@ -16,7 +16,7 @@ import (
 func ToActivityPubPersonFeedItem(item *activities.FederatedUserActivity) ap.Note {
 	return ap.Note{
 		AttributedTo: ap.IRI(item.ActorURI),
-		Content:      ap.NaturalLanguageValues{{Value: ap.Content(item.NoteContent), Ref: ap.NilLangRef}},
+		Content:      ap.NaturalLanguageValues{ap.NilLangRef: ap.Content(item.NoteContent)},
 		ID:           ap.IRI(item.NoteURL),
 		URL:          ap.IRI(item.OriginalNote),
 	}
@@ -27,13 +27,13 @@ func ToActivityPubPerson(ctx context.Context, user *user_model.User) (*ap.Person
 	person := ap.PersonNew(ap.IRI(link))
 
 	person.Name = ap.NaturalLanguageValuesNew()
-	err := person.Name.Set("en", ap.Content(user.FullName))
+	err := person.Name.Set(ap.NilLangRef, ap.Content(user.FullName))
 	if err != nil {
 		return nil, err
 	}
 
 	person.PreferredUsername = ap.NaturalLanguageValuesNew()
-	err = person.PreferredUsername.Set("en", ap.Content(user.Name))
+	err = person.PreferredUsername.Set(ap.NilLangRef, ap.Content(user.Name))
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/convert/pull.go b/services/convert/pull.go
index 41cbcc25aa..4856c58736 100644
--- a/services/convert/pull.go
+++ b/services/convert/pull.go
@@ -177,7 +177,6 @@ func ToAPIPullRequest(ctx context.Context, pr *issues_model.PullRequest, doer *u
 		}
 		apiPullRequest.Head.RepoID = pr.BaseRepoID
 		apiPullRequest.Head.Repository = apiPullRequest.Base.Repository
-		apiPullRequest.Head.Name = ""
 	}
 
 	if pr.HeadRepo != nil && pr.Flow == issues_model.PullRequestFlowGithub {
diff --git a/services/cron/tasks_extended.go b/services/cron/tasks_extended.go
index b7db283f07..0cca72afe9 100644
--- a/services/cron/tasks_extended.go
+++ b/services/cron/tasks_extended.go
@@ -86,16 +86,6 @@ func registerRewriteAllPrincipalKeys() {
 	})
 }
 
-func registerRepositoryUpdateHook() {
-	RegisterTaskFatal("resync_all_hooks", &BaseConfig{
-		Enabled:    false,
-		RunAtStart: false,
-		Schedule:   "@every 72h",
-	}, func(ctx context.Context, _ *user_model.User, _ Config) error {
-		return repo_service.SyncRepositoryHooks(ctx)
-	})
-}
-
 func registerReinitMissingRepositories() {
 	RegisterTaskFatal("reinit_missing_repos", &BaseConfig{
 		Enabled:    false,
@@ -251,7 +241,6 @@ func initExtendedTasks() {
 	registerGarbageCollectRepositories()
 	registerRewriteAllPublicKeys()
 	registerRewriteAllPrincipalKeys()
-	registerRepositoryUpdateHook()
 	registerReinitMissingRepositories()
 	registerDeleteMissingRepositories()
 	registerRemoveRandomAvatars()
diff --git a/services/doctor/misc.go b/services/doctor/misc.go
index 9b9c96b52b..323606edf1 100644
--- a/services/doctor/misc.go
+++ b/services/doctor/misc.go
@@ -18,7 +18,6 @@ import (
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/gitrepo"
 	"forgejo.org/modules/log"
-	"forgejo.org/modules/repository"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/structs"
 	"forgejo.org/modules/util"
@@ -48,31 +47,6 @@ func checkScriptType(ctx context.Context, logger log.Logger, autofix bool) error
 	return nil
 }
 
-func checkHooks(ctx context.Context, logger log.Logger, autofix bool) error {
-	if err := iterateRepositories(ctx, func(repo *repo_model.Repository) error {
-		results, err := repository.CheckDelegateHooks(repo.RepoPath())
-		if err != nil {
-			logger.Critical("Unable to check delegate hooks for repo %-v. ERROR: %v", repo, err)
-			return fmt.Errorf("Unable to check delegate hooks for repo %-v. ERROR: %w", repo, err)
-		}
-		if len(results) > 0 && autofix {
-			logger.Warn("Regenerated hooks for %s", repo.FullName())
-			if err := repository.CreateDelegateHooks(repo.RepoPath()); err != nil {
-				logger.Critical("Unable to recreate delegate hooks for %-v. ERROR: %v", repo, err)
-				return fmt.Errorf("Unable to recreate delegate hooks for %-v. ERROR: %w", repo, err)
-			}
-		}
-		for _, result := range results {
-			logger.Warn(result)
-		}
-		return nil
-	}); err != nil {
-		logger.Critical("Errors noted whilst checking delegate hooks.")
-		return err
-	}
-	return nil
-}
-
 func checkUserStarNum(ctx context.Context, logger log.Logger, autofix bool) error {
 	if autofix {
 		if err := models.DoctorUserStarNum(ctx); err != nil {
@@ -261,13 +235,6 @@ func init() {
 		Run:       checkScriptType,
 		Priority:  5,
 	})
-	Register(&Check{
-		Title:     "Check if hook files are up-to-date and executable",
-		Name:      "hooks",
-		IsDefault: false,
-		Run:       checkHooks,
-		Priority:  6,
-	})
 	Register(&Check{
 		Title:     "Recalculate Stars number for all user",
 		Name:      "recalculate-stars-number",
diff --git a/services/federation/error.go b/services/federation/error.go
index 425035d0d5..7ba954dab6 100644
--- a/services/federation/error.go
+++ b/services/federation/error.go
@@ -42,3 +42,11 @@ func HTTPStatus(err error) int {
 		return http.StatusInternalServerError
 	}
 }
+
+type ErrKeyNotFound struct {
+	KeyID string
+}
+
+func (err ErrKeyNotFound) Error() string {
+	return fmt.Sprintf("No key found for key ID: %s", err.KeyID)
+}
diff --git a/services/federation/federation_service.go b/services/federation/federation_service.go
index d0336881a8..0b023791ea 100644
--- a/services/federation/federation_service.go
+++ b/services/federation/federation_service.go
@@ -11,7 +11,7 @@ import (
 	"strings"
 
 	"forgejo.org/models/forgefed"
-	"forgejo.org/models/user"
+	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/activitypub"
 	fm "forgejo.org/modules/forgefed"
 	"forgejo.org/modules/log"
@@ -33,65 +33,96 @@ func FindOrCreateFederationHost(ctx context.Context, actorURI string) (*forgefed
 	if err != nil {
 		return nil, err
 	}
+
 	federationHost, err := forgefed.FindFederationHostByFqdnAndPort(ctx, rawActorID.Host, rawActorID.HostPort)
 	if err != nil {
-		return nil, err
-	}
-	if federationHost == nil {
-		result, err := createFederationHostFromAP(ctx, rawActorID)
-		if err != nil {
+		if !forgefed.IsErrFederationHostNotFound(err) {
 			return nil, err
 		}
-		federationHost = result
+
+		federationHost, err = createFederationHostFromAP(ctx, rawActorID)
 	}
-	return federationHost, nil
+
+	return federationHost, err
 }
 
-func FindOrCreateFederatedUser(ctx context.Context, actorURI string) (*user.User, *user.FederatedUser, *forgefed.FederationHost, error) {
-	user, federatedUser, federationHost, err := findFederatedUser(ctx, actorURI)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	personID, err := fm.NewPersonID(actorURI, string(federationHost.NodeInfo.SoftwareName))
+func FindOrCreateFederatedUser(ctx context.Context, actorURI string) (*user_model.User, *user_model.FederatedUser, *forgefed.FederationHost, error) {
+	federationHost, personID, err := findFederationHost(ctx, actorURI)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 
-	if user != nil {
-		log.Trace("Local ActivityPub user found (actorURI: %#v, user: %#v)", actorURI, user)
-	} else {
-		log.Trace("Attempting to create new user and federatedUser for actorURI: %#v", actorURI)
-		user, federatedUser, err = createUserFromAP(ctx, personID, federationHost.ID)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		log.Trace("Created user %#v with federatedUser %#v from distant server", user, federatedUser)
+	user, federatedUser, err := findFederatedUser(ctx, actorURI)
+	if err == nil {
+		log.Trace("Found local user: %v", user.Name)
+		return user, federatedUser, federationHost, nil
 	}
-	log.Trace("Got user: %v", user.Name)
 
-	return user, federatedUser, federationHost, nil
+	if !user_model.IsErrFederatedUserNotExists(err) {
+		return nil, nil, nil, err
+	}
+
+	// Fetch the remote user
+	apUser, apFederatedUser, err := fetchUserFromAP(ctx, *personID, federationHost)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	// User is an alias, for example in newer Mastodon versions
+	// - example.com/@example
+	// - example.com/users/example
+	// have the ID
+	// - example.com/ap/users/<id>
+	user, federatedUser, err = findFederatedUser(ctx, apFederatedUser.NormalizedOriginalURL)
+	if err == nil {
+		log.Trace("Resolved alias %s to %s", actorURI, apFederatedUser.NormalizedOriginalURL)
+		return user, federatedUser, federationHost, nil
+	}
+
+	err = user_model.CreateFederatedUser(ctx, apUser, apFederatedUser)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	log.Trace("Created user %s with federatedUser %s from distant server", user.LogString(), federatedUser.LogString())
+	return apUser, apFederatedUser, federationHost, nil
 }
 
-func findFederatedUser(ctx context.Context, actorURI string) (*user.User, *user.FederatedUser, *forgefed.FederationHost, error) {
+func findFederationHost(ctx context.Context, actorURI string) (*forgefed.FederationHost, *fm.PersonID, error) {
 	federationHost, err := FindOrCreateFederationHost(ctx, actorURI)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, err
 	}
+
 	actorID, err := fm.NewPersonID(actorURI, string(federationHost.NodeInfo.SoftwareName))
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	user, federatedUser, err := user.FindFederatedUser(ctx, actorID.ID, federationHost.ID)
+	return federationHost, &actorID, nil
+}
+
+func findFederatedUser(ctx context.Context, actorURI string) (*user_model.User, *user_model.FederatedUser, error) {
+	federationHost, _, err := findFederationHost(ctx, actorURI)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, err
 	}
 
-	return user, federatedUser, federationHost, nil
+	actorID, err := fm.NewPersonID(actorURI, string(federationHost.NodeInfo.SoftwareName))
+	if err != nil {
+		return nil, nil, err
+	}
+
+	localUser, federatedUser, err := user_model.FindFederatedUser(ctx, actorID.ID, federationHost.ID)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return localUser, federatedUser, nil
 }
 
 func createFederationHostFromAP(ctx context.Context, actorID fm.ActorID) (*forgefed.FederationHost, error) {
-	actionsUser := user.NewAPServerActor()
+	actionsUser := user_model.NewAPServerActor()
 
 	clientFactory, err := activitypub.GetClientFactory(ctx)
 	if err != nil {
@@ -137,8 +168,8 @@ func createFederationHostFromAP(ctx context.Context, actorID fm.ActorID) (*forge
 	return &result, nil
 }
 
-func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID int64) (*user.User, *user.FederatedUser, error) {
-	actionsUser := user.NewAPServerActor()
+func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHost *forgefed.FederationHost) (*user_model.User, *user_model.FederatedUser, error) {
+	actionsUser := user_model.NewAPServerActor()
 	clientFactory, err := activitypub.GetClientFactory(ctx)
 	if err != nil {
 		return nil, nil, err
@@ -164,16 +195,18 @@ func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID
 		return nil, nil, err
 	}
 
-	log.Info("Fetched valid person from distant server: %q", person)
-
 	localFqdn, err := url.ParseRequestURI(setting.AppURL)
 	if err != nil {
 		return nil, nil, err
 	}
 
+	personIDFromActor, err := fm.NewPersonID(person.ID.GetLink().String(), string(federationHost.NodeInfo.SoftwareName))
+	if err != nil {
+		return nil, nil, err
+	}
 	email := fmt.Sprintf("f%v@%v", uuid.New().String(), localFqdn.Hostname())
-	loginName := personID.AsLoginName()
-	name := fmt.Sprintf("@%v%v", person.PreferredUsername.String(), personID.HostSuffix())
+	loginName := personIDFromActor.AsLoginName()
+	name := fmt.Sprintf("@%v%v", person.PreferredUsername.String(), personIDFromActor.HostSuffix())
 	fullName := person.Name.String()
 
 	if len(person.Name) == 0 {
@@ -190,7 +223,7 @@ func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID
 		return nil, nil, err
 	}
 
-	newUser := user.User{
+	newUser := user_model.User{
 		LowerName:                    strings.ToLower(name),
 		Name:                         name,
 		FullName:                     fullName,
@@ -201,15 +234,15 @@ func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID
 		Salt:                         "",
 		PasswdHashAlgo:               "",
 		LoginName:                    loginName,
-		Type:                         user.UserTypeActivityPubUser,
+		Type:                         user_model.UserTypeActivityPubUser,
 		IsAdmin:                      false,
 	}
 
-	federatedUser := user.FederatedUser{
-		ExternalID:            personID.ID,
-		FederationHostID:      federationHostID,
+	federatedUser := user_model.FederatedUser{
+		ExternalID:            personIDFromActor.ID,
+		FederationHostID:      federationHost.ID,
 		InboxPath:             inbox.Path,
-		NormalizedOriginalURL: personID.AsURI(),
+		NormalizedOriginalURL: personIDFromActor.AsURI(),
 		KeyID: sql.NullString{
 			String: person.PublicKey.ID.String(),
 			Valid:  true,
@@ -220,20 +253,6 @@ func fetchUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID
 		},
 	}
 
-	log.Info("Fetched person's %q federatedUser from distant server: %q", person, federatedUser)
+	log.Trace("Fetched person's %v federatedUser from distant server: %s", person, federatedUser.LogString())
 	return &newUser, &federatedUser, nil
 }
-
-func createUserFromAP(ctx context.Context, personID fm.PersonID, federationHostID int64) (*user.User, *user.FederatedUser, error) {
-	newUser, federatedUser, err := fetchUserFromAP(ctx, personID, federationHostID)
-	if err != nil {
-		return nil, nil, err
-	}
-	err = user.CreateFederatedUser(ctx, newUser, federatedUser)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	log.Info("Created federatedUser: %q", federatedUser)
-	return newUser, federatedUser, nil
-}
diff --git a/services/federation/person_inbox_create.go b/services/federation/person_inbox_create.go
index 2132c7ede1..9353c687d0 100644
--- a/services/federation/person_inbox_create.go
+++ b/services/federation/person_inbox_create.go
@@ -23,15 +23,11 @@ func processPersonInboxCreate(ctx context.Context, user *user.User, activity *ap
 	}
 
 	actorURI := createAct.Actor.GetLink().String()
-	federatedBaseUser, _, _, err := findFederatedUser(ctx, actorURI)
+	federatedBaseUser, _, err := findFederatedUser(ctx, actorURI)
 	if err != nil {
 		log.Error("Federated user not found (%s): %v", actorURI, err)
 		return ServiceResult{}, NewErrNotAcceptablef("federated user not found (%s): %v", actorURI, err)
 	}
-	if federatedBaseUser == nil {
-		log.Error("Federated user not found (%s): %v", actorURI, err)
-		return ServiceResult{}, NewErrNotAcceptablef("federated user not found (%s): %v", actorURI, err)
-	}
 
 	federatedUserActivity, err := activities.NewFederatedUserActivity(
 		user.ID,
diff --git a/services/federation/person_inbox_undo.go b/services/federation/person_inbox_undo.go
index 4379cf242a..c7593adace 100644
--- a/services/federation/person_inbox_undo.go
+++ b/services/federation/person_inbox_undo.go
@@ -20,27 +20,25 @@ func processPersonInboxUndo(ctx context.Context, ctxUser *user.User, activity *a
 	}
 
 	actorURI := activity.Actor.GetLink().String()
-	_, federatedUser, _, err := findFederatedUser(ctx, actorURI)
+	_, federatedUser, err := findFederatedUser(ctx, actorURI)
 	if err != nil {
 		log.Error("User not found: %v", err)
 		return ServiceResult{}, NewErrInternalf("User not found: %v", err)
 	}
 
-	if federatedUser != nil {
-		following, err := user.IsFollowingAp(ctx, ctxUser, federatedUser)
-		if err != nil {
-			log.Error("forgefed.IsFollowing: %v", err)
-			return ServiceResult{}, NewErrInternalf("forgefed.IsFollowing: %v", err)
-		}
-		if !following {
-			// The local user is not following the federated one, nothing to do.
-			log.Trace("Local user[%d] is not following federated user[%d]", ctxUser.ID, federatedUser.ID)
-			return NewServiceResultStatusOnly(http.StatusNoContent), nil
-		}
-		if err := user.RemoveFollower(ctx, ctxUser, federatedUser); err != nil {
-			log.Error("Unable to remove follower", err)
-			return ServiceResult{}, NewErrInternalf("Unable to remove follower: %v", err)
-		}
+	following, err := user.IsFollowingAp(ctx, ctxUser, federatedUser)
+	if err != nil {
+		log.Error("forgefed.IsFollowing: %v", err)
+		return ServiceResult{}, NewErrInternalf("forgefed.IsFollowing: %v", err)
+	}
+	if !following {
+		// The local user is not following the federated one, nothing to do.
+		log.Trace("Local user[%d] is not following federated user[%d]", ctxUser.ID, federatedUser.ID)
+		return NewServiceResultStatusOnly(http.StatusNoContent), nil
+	}
+	if err := user.RemoveFollower(ctx, ctxUser, federatedUser); err != nil {
+		log.Error("Unable to remove follower", err)
+		return ServiceResult{}, NewErrInternalf("Unable to remove follower: %v", err)
 	}
 
 	return NewServiceResultStatusOnly(http.StatusNoContent), nil
diff --git a/services/federation/signature_service.go b/services/federation/signature_service.go
index 25e4e270bc..cd7992605d 100644
--- a/services/federation/signature_service.go
+++ b/services/federation/signature_service.go
@@ -15,185 +15,128 @@ import (
 	"forgejo.org/models/forgefed"
 	"forgejo.org/models/user"
 	"forgejo.org/modules/activitypub"
-	fm "forgejo.org/modules/forgefed"
 	"forgejo.org/modules/log"
 
 	ap "github.com/go-ap/activitypub"
 )
 
-// Factory function for ActorID. Created struct is asserted to be valid
-func NewActorIDFromKeyID(ctx context.Context, uri string) (fm.ActorID, error) {
-	parsedURI, err := url.Parse(uri)
-	if err != nil {
-		return fm.ActorID{}, err
-	}
-
-	parsedURI.Fragment = ""
-
-	actionsUser := user.NewAPServerActor()
-	clientFactory, err := activitypub.GetClientFactory(ctx)
-	if err != nil {
-		return fm.ActorID{}, err
-	}
-
-	apClient, err := clientFactory.WithKeys(ctx, actionsUser, actionsUser.KeyID())
-	if err != nil {
-		return fm.ActorID{}, err
-	}
-
-	userResponse, err := apClient.GetBody(parsedURI.String())
-	if err != nil {
-		return fm.ActorID{}, err
-	}
-
-	var actor ap.Actor
-	err = actor.UnmarshalJSON(userResponse)
-	if err != nil {
-		return fm.ActorID{}, err
-	}
-
-	result, err := fm.NewActorID(actor.PublicKey.Owner.String())
-	return result, err
-}
-
-func FindOrCreateFederatedUserKey(ctx context.Context, keyID string) (pubKey any, err error) {
-	log.Trace("KeyID: %v", keyID)
-	var federatedUser *user.FederatedUser
-	var keyURL *url.URL
-
-	keyURL, err = url.Parse(keyID)
-	if err != nil {
-		return nil, err
-	}
-
-	// Try if the signing actor is an already known federated user
-	_, federatedUser, err = user.FindFederatedUserByKeyID(ctx, keyURL.String())
-	if err != nil {
-		return nil, err
-	}
-
-	if federatedUser == nil {
-		rawActorID, err := NewActorIDFromKeyID(ctx, keyID)
-		if err != nil {
-			return nil, err
-		}
-
-		_, federatedUser, _, err = FindOrCreateFederatedUser(ctx, rawActorID.AsURI())
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		_, err = forgefed.GetFederationHost(ctx, federatedUser.FederationHostID)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	if federatedUser.PublicKey.Valid {
-		pubKey, err := x509.ParsePKIXPublicKey(federatedUser.PublicKey.V)
-		if err != nil {
-			return nil, err
-		}
-		log.Trace("For KeyID %v found pubKey %v", keyID, pubKey)
-		return pubKey, nil
-	}
-
-	// Fetch missing public key
-	pubKey, pubKeyBytes, apPerson, err := fetchKeyFromAp(ctx, *keyURL)
-	if err != nil {
-		return nil, err
-	}
-	if apPerson.Type == ap.ActivityVocabularyType("Person") {
-		// Check federatedUser.id = person.id
-		if federatedUser.ExternalID != apPerson.ID.String() {
-			return nil, fmt.Errorf("federated user fetched (%v) does not match the stored one %v", apPerson, federatedUser)
-		}
-		// update federated user
-		federatedUser.KeyID = sql.NullString{
-			String: apPerson.PublicKey.ID.String(),
-			Valid:  true,
-		}
-		federatedUser.PublicKey = sql.Null[sql.RawBytes]{
-			V:     pubKeyBytes,
-			Valid: true,
-		}
-		err = user.UpdateFederatedUser(ctx, federatedUser)
-		if err != nil {
-			return nil, err
-		}
-		log.Trace("For %v found pubKey %v", keyID, pubKey)
-		return pubKey, nil
-	}
-	log.Trace("For %v found no pubKey", keyID)
-	return nil, nil
-}
-
-func FindOrCreateFederationHostKey(ctx context.Context, keyID string) (pubKey any, err error) {
+func FindOrCreateActorKey(ctx context.Context, keyID string) (pubKey any, err error) {
 	log.Trace("KeyID: %v", keyID)
 	keyURL, err := url.Parse(keyID)
 	if err != nil {
 		return nil, err
 	}
-	rawActorID, err := NewActorIDFromKeyID(ctx, keyID)
-	if err != nil {
-		return nil, err
-	}
 
-	// Is there an already known federation host?
-	federationHost, err := forgefed.FindFederationHostByKeyID(ctx, keyURL.String())
+	// Check for existing user key
+	_, federatedUser, err := user.FindFederatedUserByKeyID(ctx, keyURL.String())
 	if err != nil {
-		return nil, err
-	}
+		if !user.IsErrFederatedUserNotExists(err) {
+			return nil, err
+		}
 
-	if federationHost == nil {
-		federationHost, err = FindOrCreateFederationHost(ctx, rawActorID.AsURI())
+		// Check for existing federation host key
+		federationHost, err := forgefed.FindFederationHostByKeyID(ctx, keyURL.String())
+		if err != nil {
+			if !forgefed.IsErrFederationHostNotFound(err) {
+				return nil, err
+			}
+		} else if federationHost.PublicKey.Valid {
+			pubKey, err := x509.ParsePKIXPublicKey(federationHost.PublicKey.V)
+			if err != nil {
+				return nil, err
+			}
+
+			return pubKey, nil
+		}
+	} else if federatedUser.PublicKey.Valid {
+		pubKey, err := x509.ParsePKIXPublicKey(federatedUser.PublicKey.V)
 		if err != nil {
 			return nil, err
 		}
-	}
 
-	// Is there an already an key?
-	if federationHost.PublicKey.Valid {
-		pubKey, err := x509.ParsePKIXPublicKey(federationHost.PublicKey.V)
-		if err != nil {
-			return nil, err
-		}
-		log.Trace("For %v found pubKey: %v", keyID, pubKey)
 		return pubKey, nil
 	}
 
-	// If not, fetch missing public key
-	pubKey, pubKeyBytes, apPerson, err := fetchKeyFromAp(ctx, *keyURL)
+	// Fetch missing key
+	pubKey, pubKeyBytes, actor, err := fetchKeyFromAp(ctx, *keyURL)
 	if err != nil {
 		return nil, err
 	}
-	if apPerson.Type == ap.ActivityVocabularyType("Application") {
-		// Check federationhost.id = person.id
-		if federationHost.HostPort != rawActorID.HostPort || federationHost.HostFqdn != rawActorID.Host ||
-			federationHost.HostSchema != rawActorID.HostSchema {
-			return nil, fmt.Errorf("federation host fetched (%v) does not match the stored one %v", apPerson, federationHost)
-		}
-		// update federation host
-		federationHost.KeyID = sql.NullString{
-			String: apPerson.PublicKey.ID.String(),
-			Valid:  true,
-		}
-		federationHost.PublicKey = sql.Null[sql.RawBytes]{
-			V:     pubKeyBytes,
-			Valid: true,
-		}
-		err = forgefed.UpdateFederationHost(ctx, federationHost)
+
+	switch actor.Type {
+	case ap.PersonType:
+		_, federatedUser, _, err := FindOrCreateFederatedUser(ctx, actor.ID.String())
 		if err != nil {
 			return nil, err
 		}
-		log.Trace("For %v found pubKey: %v", keyID, pubKey)
-		return pubKey, nil
+
+		err = updateFederatedUserKey(ctx, federatedUser, pubKeyBytes, actor)
+		if err != nil {
+			return nil, err
+		}
+	case ap.ApplicationType:
+		federationHost, err := FindOrCreateFederationHost(ctx, actor.ID.String())
+		if err != nil {
+			return nil, err
+		}
+
+		err = updateFederationHostKey(ctx, federationHost, pubKeyBytes, actor)
+		if err != nil {
+			return nil, err
+		}
+	default:
+		return nil, fmt.Errorf("Fetched actortype (%s) is unhandled", actor.Type)
 	}
-	log.Trace("For %v found no pubKey.", keyID)
-	return nil, nil
+
+	return pubKey, nil
 }
 
-func fetchKeyFromAp(ctx context.Context, keyURL url.URL) (pubKey any, pubKeyBytes []byte, apPerson *ap.Person, err error) {
+func updateFederatedUserKey(ctx context.Context, federatedUser *user.FederatedUser, pubKeyBytes []byte, actor *ap.Actor) (err error) {
+	if actor.Type != ap.PersonType {
+		return fmt.Errorf("Fetched user type (%s) is not of user type Person", actor.Type)
+	}
+
+	if federatedUser.NormalizedOriginalURL != actor.ID.String() {
+		return fmt.Errorf("federated user (%s) does not match the stored one %s", actor.ID, federatedUser.NormalizedOriginalURL)
+	}
+
+	federatedUser.KeyID = sql.NullString{
+		String: actor.PublicKey.ID.String(),
+		Valid:  true,
+	}
+
+	federatedUser.PublicKey = sql.Null[sql.RawBytes]{
+		V:     pubKeyBytes,
+		Valid: true,
+	}
+
+	return user.UpdateFederatedUser(ctx, federatedUser)
+}
+
+func updateFederationHostKey(ctx context.Context, federationHost *forgefed.FederationHost, pubKeyBytes []byte, actor *ap.Actor) (err error) {
+	if actor.Type != ap.ApplicationType {
+		return fmt.Errorf("Fetched user type (%s) is not of user type Application", actor.Type)
+	}
+
+	federationHost.KeyID = sql.NullString{
+		String: actor.PublicKey.ID.String(),
+		Valid:  true,
+	}
+
+	federationHost.PublicKey = sql.Null[sql.RawBytes]{
+		V:     pubKeyBytes,
+		Valid: true,
+	}
+
+	err = forgefed.UpdateFederationHost(ctx, federationHost)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func fetchKeyFromAp(ctx context.Context, keyURL url.URL) (pubKey any, pubKeyBytes []byte, apPerson *ap.Actor, err error) {
 	log.Trace("keyURL %v", keyURL)
 	actionsUser := user.NewAPServerActor()
 
@@ -212,13 +155,17 @@ func fetchKeyFromAp(ctx context.Context, keyURL url.URL) (pubKey any, pubKeyByte
 		return nil, nil, nil, err
 	}
 
-	person := ap.PersonNew(ap.IRI(keyURL.String()))
-	err = person.UnmarshalJSON(b)
+	actor := ap.ActorNew(ap.IRI(keyURL.String()), ap.ActorType)
+	err = actor.UnmarshalJSON(b)
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("ActivityStreams type cannot be converted to one known to have publicKey property: %w", err)
+		return nil, nil, nil, fmt.Errorf("ActivityStreams object cannot be converted to actor: %w", err)
+	}
+
+	pubKeyFromAp := actor.PublicKey
+	if pubKeyFromAp.PublicKeyPem == "" {
+		return nil, nil, nil, ErrKeyNotFound{KeyID: keyURL.String()}
 	}
 
-	pubKeyFromAp := person.PublicKey
 	if pubKeyFromAp.ID.String() != keyURL.String() {
 		return nil, nil, nil, fmt.Errorf("cannot find publicKey with id: %v in %v", keyURL, string(b))
 	}
@@ -234,7 +181,7 @@ func fetchKeyFromAp(ctx context.Context, keyURL url.URL) (pubKey any, pubKeyByte
 	}
 
 	log.Trace("For %v fetched pubKey %v", keyURL, pubKey)
-	return pubKey, pubKeyBytes, person, err
+	return pubKey, pubKeyBytes, actor, err
 }
 
 func decodePublicKeyPem(pubKeyPem string) ([]byte, error) {
diff --git a/services/forms/repo_form.go b/services/forms/repo_form.go
index f9443b8b6c..d1a5b521f8 100644
--- a/services/forms/repo_form.go
+++ b/services/forms/repo_form.go
@@ -472,6 +472,7 @@ type CodeCommentForm struct {
 	TreePath       string `form:"path" binding:"Required"`
 	SingleReview   bool   `form:"single_review"`
 	Reply          int64  `form:"reply"`
+	BeforeCommitID string
 	LatestCommitID string
 	Files          []string
 }
diff --git a/services/gitdiff/gitdiff.go b/services/gitdiff/gitdiff.go
index c1d0bc0107..fa3c26f149 100644
--- a/services/gitdiff/gitdiff.go
+++ b/services/gitdiff/gitdiff.go
@@ -487,8 +487,8 @@ type Diff struct {
 }
 
 // LoadComments loads comments into each line
-func (diff *Diff) LoadComments(ctx context.Context, issue *issues_model.Issue, currentUser *user_model.User, showOutdatedComments bool) error {
-	allConversations, err := issues_model.FetchCodeConversations(ctx, issue, currentUser, showOutdatedComments)
+func (diff *Diff) LoadComments(ctx context.Context, issue *issues_model.Issue, currentUser *user_model.User, showOutdatedComments bool, headCommitID string) error {
+	allConversations, err := issues_model.FetchCodeConversations(ctx, issue, currentUser, showOutdatedComments, headCommitID)
 	if err != nil {
 		return err
 	}
diff --git a/services/gitdiff/gitdiff_test.go b/services/gitdiff/gitdiff_test.go
index 7ba439be35..9748bf3828 100644
--- a/services/gitdiff/gitdiff_test.go
+++ b/services/gitdiff/gitdiff_test.go
@@ -600,7 +600,7 @@ func TestDiff_LoadCommentsNoOutdated(t *testing.T) {
 	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 2})
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
 	diff := setupDefaultDiff()
-	require.NoError(t, diff.LoadComments(db.DefaultContext, issue, user, false))
+	require.NoError(t, diff.LoadComments(db.DefaultContext, issue, user, false, ""))
 	assert.Len(t, diff.Files[0].Sections[0].Lines[0].Conversations, 2)
 }
 
@@ -610,7 +610,7 @@ func TestDiff_LoadCommentsWithOutdated(t *testing.T) {
 	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 2})
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
 	diff := setupDefaultDiff()
-	require.NoError(t, diff.LoadComments(db.DefaultContext, issue, user, true))
+	require.NoError(t, diff.LoadComments(db.DefaultContext, issue, user, true, ""))
 	assert.Len(t, diff.Files[0].Sections[0].Lines[0].Conversations, 2)
 	assert.Len(t, diff.Files[0].Sections[0].Lines[0].Conversations[0], 2)
 	assert.Len(t, diff.Files[0].Sections[0].Lines[0].Conversations[1], 1)
diff --git a/services/lfs/server.go b/services/lfs/server.go
index 86e34c265f..1dfd58a3c0 100644
--- a/services/lfs/server.go
+++ b/services/lfs/server.go
@@ -579,10 +579,11 @@ func authenticate(ctx *context.Context, repository *repo_model.Repository, autho
 
 func handleLFSToken(ctx stdCtx.Context, tokenSHA string, target *repo_model.Repository, mode perm.AccessMode) (*user_model.User, error) {
 	token, err := jwt.ParseWithClaims(tokenSHA, &Claims{}, func(t *jwt.Token) (any, error) {
-		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+		k := setting.LFS.SigningKey
+		if t.Method != k.SigningMethod() {
 			return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
 		}
-		return setting.LFS.JWTSecretBytes, nil
+		return k.VerifyKey(), nil
 	})
 	if err != nil {
 		return nil, errors.New("invalid token")
diff --git a/services/lfs/server_test.go b/services/lfs/server_test.go
index d5e94df044..875a99603e 100644
--- a/services/lfs/server_test.go
+++ b/services/lfs/server_test.go
@@ -41,18 +41,23 @@ func getLFSAuthTokenWithBearer(opts authTokenOptions) (string, error) {
 		Op:     opts.Op,
 		UserID: opts.UserID,
 	}
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 
 	// Sign and get the complete encoded token as a string using the secret
-	tokenString, err := token.SignedString(setting.LFS.JWTSecretBytes)
+	tokenString, err := setting.LFS.SigningKey.JWT(claims)
 	if err != nil {
 		return "", fmt.Errorf("failed to sign LFS JWT token: %w", err)
 	}
 	return "Bearer " + tokenString, nil
 }
 
-func TestAuthenticate(t *testing.T) {
+func testAuthenticate(t *testing.T, cfg string) {
 	require.NoError(t, unittest.PrepareTestDatabase())
+	var err error
+	setting.CfgProvider, err = setting.NewConfigProviderFromData(cfg)
+	require.NoError(t, err, "Config")
+	setting.LoadCommonSettings()
+	assert.True(t, setting.LFS.StartServer, "LFS_START_SERVER = true")
+	assert.NotNil(t, setting.LFS.SigningKey, "SigningKey initialized")
 	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 
 	token2, _ := getLFSAuthTokenWithBearer(authTokenOptions{Op: "download", UserID: 2, RepoID: 1})
@@ -149,3 +154,28 @@ func TestAuthenticate(t *testing.T) {
 		assert.True(t, authenticate(ctx, repo1, prefixBearer+token2, true, false))
 	})
 }
+
+type namedCfg struct {
+	name, cfg string
+}
+
+var iniCommon = `[security]
+INSTALL_LOCK = true
+INTERNAL_TOKEN = ForgejoForgejoForgejoForgejoForgejoForgejo_	# don't use in prod
+[oauth2]
+JWT_SECRET = ForgejoForgejoForgejoForgejoForgejoForgejo_	# don't use in prod
+[server]
+LFS_START_SERVER = true
+	`
+
+var cfgVariants = []namedCfg{
+	{name: "HS256_default", cfg: `LFS_JWT_SECRET = ForgejoForgejoForgejoForgejoForgejoForgejo_`},
+	{name: "RS256", cfg: `LFS_JWT_SIGNING_ALGORITHM = RS256`},
+}
+
+func TestAuthenticate(t *testing.T) {
+	for _, v := range cfgVariants {
+		cfg := iniCommon + v.cfg
+		t.Run(v.name, func(t *testing.T) { testAuthenticate(t, cfg) })
+	}
+}
diff --git a/services/mailer/incoming/incoming_handler.go b/services/mailer/incoming/incoming_handler.go
index 7505148978..6fdf00ca59 100644
--- a/services/mailer/incoming/incoming_handler.go
+++ b/services/mailer/incoming/incoming_handler.go
@@ -12,6 +12,7 @@ import (
 	access_model "forgejo.org/models/perm/access"
 	repo_model "forgejo.org/models/repo"
 	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/gitrepo"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/util"
@@ -124,7 +125,24 @@ func (h *ReplyHandler) Handle(ctx context.Context, content *MailContent, doer *u
 				return fmt.Errorf("CreateIssueComment failed: %w", err)
 			}
 		case issues_model.CommentTypeCode:
-			_, err := pull_service.CreateCodeComment(
+			err := issue.LoadRepo(ctx)
+			if err != nil {
+				return fmt.Errorf("LoadRepo failed: %w", err)
+			}
+			err = issue.LoadPullRequest(ctx)
+			if err != nil {
+				return fmt.Errorf("LoadPullRequest failed: %w", err)
+			}
+			repo, err := gitrepo.OpenRepository(ctx, issue.Repo)
+			defer repo.Close()
+			if err != nil {
+				return fmt.Errorf("OpenRepository failed: %w", err)
+			}
+			afterCommitID, err := repo.GetRefCommitID(issue.PullRequest.GetGitRefName())
+			if err != nil {
+				return fmt.Errorf("GetRefCommitID failed: %w", err)
+			}
+			_, err = pull_service.CreateCodeComment(
 				ctx,
 				doer,
 				nil,
@@ -134,7 +152,8 @@ func (h *ReplyHandler) Handle(ctx context.Context, content *MailContent, doer *u
 				comment.TreePath,
 				false, // not pending review but a single review
 				comment.ReviewID,
-				"",
+				issue.PullRequest.MergeBase,
+				afterCommitID,
 				attachmentIDs,
 			)
 			if err != nil {
diff --git a/services/migrations/codebase_test.go b/services/migrations/codebase_test.go
index 315c7be709..5d90f7e8a2 100644
--- a/services/migrations/codebase_test.go
+++ b/services/migrations/codebase_test.go
@@ -55,12 +55,12 @@ func TestCodebaseDownloadRepo(t *testing.T) {
 	assertMilestonesEqual(t, []*base.Milestone{
 		{
 			Title:    "Milestone1",
-			Deadline: timePtr(time.Date(2021, time.September, 16, 0, 0, 0, 0, time.UTC)),
+			Deadline: new(time.Date(2021, time.September, 16, 0, 0, 0, 0, time.UTC)),
 		},
 		{
 			Title:    "Milestone2",
-			Deadline: timePtr(time.Date(2021, time.September, 17, 0, 0, 0, 0, time.UTC)),
-			Closed:   timePtr(time.Date(2021, time.September, 17, 0, 0, 0, 0, time.UTC)),
+			Deadline: new(time.Date(2021, time.September, 17, 0, 0, 0, 0, time.UTC)),
+			Closed:   new(time.Date(2021, time.September, 17, 0, 0, 0, 0, time.UTC)),
 			State:    "closed",
 		},
 	}, milestones)
diff --git a/services/migrations/gitea_downloader_test.go b/services/migrations/gitea_downloader_test.go
index a4a4f29ddb..3db81bb158 100644
--- a/services/migrations/gitea_downloader_test.go
+++ b/services/migrations/gitea_downloader_test.go
@@ -93,16 +93,16 @@ func TestGiteaDownloadRepo(t *testing.T) {
 		{
 			Title:    "V2 Finalize",
 			Created:  time.Unix(0, 0),
-			Deadline: timePtr(time.Unix(1599263999, 0)),
-			Updated:  timePtr(time.Date(2022, 11, 13, 5, 29, 15, 0, time.UTC)),
+			Deadline: new(time.Unix(1599263999, 0)),
+			Updated:  new(time.Date(2022, 11, 13, 5, 29, 15, 0, time.UTC)),
 			State:    "open",
 		},
 		{
 			Title:       "V1",
 			Description: "Generate Content",
 			Created:     time.Unix(0, 0),
-			Updated:     timePtr(time.Unix(0, 0)),
-			Closed:      timePtr(time.Unix(1598985406, 0)),
+			Updated:     new(time.Unix(0, 0)),
+			Closed:      new(time.Unix(1598985406, 0)),
 			State:       "closed",
 		},
 	}, milestones)
@@ -178,7 +178,7 @@ func TestGiteaDownloadRepo(t *testing.T) {
 					Content:  "laugh",
 				},
 			},
-			Closed: timePtr(time.Date(2020, 9, 1, 15, 49, 34, 0, time.UTC)),
+			Closed: new(time.Date(2020, 9, 1, 15, 49, 34, 0, time.UTC)),
 		},
 		{
 			Number:      2,
@@ -197,7 +197,7 @@ func TestGiteaDownloadRepo(t *testing.T) {
 				Color:       "d4c5f9",
 				Description: "",
 			}},
-			Closed: timePtr(time.Unix(1598969497, 0)),
+			Closed: new(time.Unix(1598969497, 0)),
 		},
 	}, issues)
 
@@ -244,7 +244,7 @@ func TestGiteaDownloadRepo(t *testing.T) {
 		IsLocked:    false,
 		Created:     time.Unix(1598982759, 0),
 		Updated:     time.Unix(1599023425, 0),
-		Closed:      timePtr(time.Date(2020, 9, 1, 17, 55, 33, 0, time.UTC)),
+		Closed:      new(time.Date(2020, 9, 1, 17, 55, 33, 0, time.UTC)),
 		Assignees:   []string{"techknowlogick"},
 		Base: base.PullRequestBranch{
 			CloneURL:  "",
@@ -261,7 +261,7 @@ func TestGiteaDownloadRepo(t *testing.T) {
 			OwnerName: "6543-forks",
 		},
 		Merged:         true,
-		MergedTime:     timePtr(time.Unix(1598982934, 0)),
+		MergedTime:     new(time.Unix(1598982934, 0)),
 		MergeCommitSHA: "827aa28a907853e5ddfa40c8f9bc52471a2685fd",
 		PatchURL:       server.URL + "/gitea/test_repo/pulls/12.patch",
 	}, prs[1])
diff --git a/services/migrations/github_test.go b/services/migrations/github_test.go
index 29a78f53fc..288eb4febb 100644
--- a/services/migrations/github_test.go
+++ b/services/migrations/github_test.go
@@ -163,24 +163,24 @@ func TestGitHubDownloadRepo(t *testing.T) {
 			Title:       "1.0.0",
 			Description: "Version 1",
 			Created:     time.Date(2025, 8, 7, 12, 48, 56, 0, time.UTC),
-			Updated:     timePtr(time.Date(2025, time.August, 12, 12, 34, 20, 0, time.UTC)),
+			Updated:     new(time.Date(2025, time.August, 12, 12, 34, 20, 0, time.UTC)),
 			State:       "open",
 		},
 		{
 			Title:       "0.9.0",
 			Description: "A milestone",
-			Deadline:    timePtr(time.Date(2025, 8, 1, 7, 0, 0, 0, time.UTC)),
+			Deadline:    new(time.Date(2025, 8, 1, 7, 0, 0, 0, time.UTC)),
 			Created:     time.Date(2025, 8, 7, 12, 54, 20, 0, time.UTC),
-			Updated:     timePtr(time.Date(2025, 8, 12, 11, 29, 52, 0, time.UTC)),
-			Closed:      timePtr(time.Date(2025, 8, 7, 12, 54, 38, 0, time.UTC)),
+			Updated:     new(time.Date(2025, 8, 12, 11, 29, 52, 0, time.UTC)),
+			Closed:      new(time.Date(2025, 8, 7, 12, 54, 38, 0, time.UTC)),
 			State:       "closed",
 		},
 		{
 			Title:       "1.1.0",
 			Description: "We can do that",
-			Deadline:    timePtr(time.Date(2025, 8, 31, 7, 0, 0, 0, time.UTC)),
+			Deadline:    new(time.Date(2025, 8, 31, 7, 0, 0, 0, time.UTC)),
 			Created:     time.Date(2025, 8, 7, 12, 50, 58, 0, time.UTC),
-			Updated:     timePtr(time.Date(2025, 8, 7, 12, 53, 15, 0, time.UTC)),
+			Updated:     new(time.Date(2025, 8, 7, 12, 53, 15, 0, time.UTC)),
 			State:       "open",
 		},
 	}, milestones)
@@ -372,8 +372,8 @@ func TestGitHubDownloadRepo(t *testing.T) {
 			State:      "closed",
 			Created:    time.Date(2025, time.August, 7, 13, 1, 36, 0, time.UTC),
 			Updated:    time.Date(2025, time.August, 12, 12, 47, 35, 0, time.UTC),
-			Closed:     timePtr(time.Date(2025, time.August, 7, 13, 2, 19, 0, time.UTC)),
-			MergedTime: timePtr(time.Date(2025, time.August, 7, 13, 2, 19, 0, time.UTC)),
+			Closed:     new(time.Date(2025, time.August, 7, 13, 2, 19, 0, time.UTC)),
+			MergedTime: new(time.Date(2025, time.August, 7, 13, 2, 19, 0, time.UTC)),
 			Labels: []*base.Label{
 				{
 					Name:        "bug",
diff --git a/services/migrations/gitlab_test.go b/services/migrations/gitlab_test.go
index 37fdea9475..029a4ecce1 100644
--- a/services/migrations/gitlab_test.go
+++ b/services/migrations/gitlab_test.go
@@ -57,14 +57,14 @@ func TestGitlabDownloadRepo(t *testing.T) {
 		{
 			Title:   "1.0.0",
 			Created: time.Date(2024, 9, 3, 13, 53, 8, 516000000, time.UTC),
-			Updated: timePtr(time.Date(2024, 9, 3, 20, 3, 57, 786000000, time.UTC)),
-			Closed:  timePtr(time.Date(2024, 9, 3, 20, 3, 57, 786000000, time.UTC)),
+			Updated: new(time.Date(2024, 9, 3, 20, 3, 57, 786000000, time.UTC)),
+			Closed:  new(time.Date(2024, 9, 3, 20, 3, 57, 786000000, time.UTC)),
 			State:   "closed",
 		},
 		{
 			Title:   "1.1.0",
 			Created: time.Date(2024, 9, 3, 13, 52, 48, 414000000, time.UTC),
-			Updated: timePtr(time.Date(2024, 9, 3, 14, 52, 14, 93000000, time.UTC)),
+			Updated: new(time.Date(2024, 9, 3, 14, 52, 14, 93000000, time.UTC)),
 			State:   "active",
 		},
 	}, milestones)
@@ -260,7 +260,7 @@ func TestGitlabDownloadRepo(t *testing.T) {
 					Content:  "hearts",
 				},
 			},
-			Closed: timePtr(time.Date(2024, 9, 3, 14, 43, 10, 906000000, time.UTC)),
+			Closed: new(time.Date(2024, 9, 3, 14, 43, 10, 906000000, time.UTC)),
 		},
 	}, issues)
 	issues, isEnd, err = downloader.GetIssues(2, 3)
@@ -297,7 +297,7 @@ func TestGitlabDownloadRepo(t *testing.T) {
 					Content:  "open_mouth",
 				},
 			},
-			Closed: timePtr(time.Date(2024, 9, 3, 14, 43, 10, 708000000, time.UTC)),
+			Closed: new(time.Date(2024, 9, 3, 14, 43, 10, 708000000, time.UTC)),
 		},
 	}, issues)
 
diff --git a/services/migrations/main_test.go b/services/migrations/main_test.go
index d304f345cf..44ab3f3fc8 100644
--- a/services/migrations/main_test.go
+++ b/services/migrations/main_test.go
@@ -19,10 +19,6 @@ func TestMain(m *testing.M) {
 	unittest.MainTest(m)
 }
 
-func timePtr(t time.Time) *time.Time {
-	return &t
-}
-
 func assertTimeEqual(t *testing.T, expected, actual time.Time) {
 	assert.Equal(t, expected.UTC(), actual.UTC())
 }
diff --git a/services/migrations/migrate.go b/services/migrations/migrate.go
index 61630d9c6d..6746a8c915 100644
--- a/services/migrations/migrate.go
+++ b/services/migrations/migrate.go
@@ -236,14 +236,14 @@ func migrateRepository(_ context.Context, doer *user_model.User, downloader base
 	}
 
 	log.Trace("migrating git data from %s", repo.CloneURL)
-	messenger("repo.migrate.migrating_git")
+	messenger("migrate.in_progress.git")
 	if err = uploader.CreateRepo(repo, opts); err != nil {
 		return err
 	}
 	defer uploader.Close()
 
 	log.Trace("migrating topics")
-	messenger("repo.migrate.migrating_topics")
+	messenger("migrate.in_progress.topics")
 	topics, err := downloader.GetTopics()
 	if err != nil {
 		if !base.IsErrNotSupported(err) {
@@ -259,7 +259,7 @@ func migrateRepository(_ context.Context, doer *user_model.User, downloader base
 
 	if opts.Milestones {
 		log.Trace("migrating milestones")
-		messenger("repo.migrate.migrating_milestones")
+		messenger("migrate.in_progress.milestones")
 		milestones, err := downloader.GetMilestones()
 		if err != nil {
 			if !base.IsErrNotSupported(err) {
@@ -282,7 +282,7 @@ func migrateRepository(_ context.Context, doer *user_model.User, downloader base
 
 	if opts.Labels {
 		log.Trace("migrating labels")
-		messenger("repo.migrate.migrating_labels")
+		messenger("migrate.in_progress.labels")
 		labels, err := downloader.GetLabels()
 		if err != nil {
 			if !base.IsErrNotSupported(err) {
@@ -306,7 +306,7 @@ func migrateRepository(_ context.Context, doer *user_model.User, downloader base
 
 	if opts.Releases {
 		log.Trace("migrating releases")
-		messenger("repo.migrate.migrating_releases")
+		messenger("migrate.in_progress.releases")
 		releases, err := downloader.GetReleases()
 		if err != nil {
 			if !base.IsErrNotSupported(err) {
@@ -342,7 +342,7 @@ func migrateRepository(_ context.Context, doer *user_model.User, downloader base
 
 	if opts.Issues {
 		log.Trace("migrating issues and comments")
-		messenger("repo.migrate.migrating_issues")
+		messenger("migrate.in_progress.issues")
 		issueBatchSize := uploader.MaxBatchInsertSize("issue")
 
 		for i := 1; ; i++ {
@@ -397,7 +397,7 @@ func migrateRepository(_ context.Context, doer *user_model.User, downloader base
 
 	if opts.PullRequests {
 		log.Trace("migrating pull requests and comments")
-		messenger("repo.migrate.migrating_pulls")
+		messenger("migrate.in_progress.pulls")
 		prBatchSize := uploader.MaxBatchInsertSize("pullrequest")
 		for i := 1; ; i++ {
 			prs, isEnd, err := downloader.GetPullRequests(i, prBatchSize)
diff --git a/services/migrations/pagure_test.go b/services/migrations/pagure_test.go
index bac3eb24ad..3217e10300 100644
--- a/services/migrations/pagure_test.go
+++ b/services/migrations/pagure_test.go
@@ -85,7 +85,7 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			Milestone:  "Milestone BBBB",
 			Created:    time.Date(2023, time.October, 13, 4, 1, 16, 0, time.UTC),
 			Updated:    time.Date(2025, time.June, 25, 6, 25, 57, 0, time.UTC),
-			Closed:     timePtr(time.Date(2025, time.June, 25, 6, 22, 59, 0, time.UTC)),
+			Closed:     new(time.Date(2025, time.June, 25, 6, 22, 59, 0, time.UTC)),
 			Labels: []*base.Label{
 				{
 					Name: "cccc",
@@ -111,7 +111,7 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			Milestone:  "Milestone AAAA",
 			Created:    time.Date(2023, time.October, 13, 3, 57, 42, 0, time.UTC),
 			Updated:    time.Date(2025, time.June, 25, 6, 25, 45, 0, time.UTC),
-			Closed:     timePtr(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
+			Closed:     new(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
 			Labels: []*base.Label{
 				{
 					Name: "aaaa",
@@ -219,8 +219,8 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			State:      "closed",
 			Created:    time.Date(2025, time.May, 19, 6, 12, 45, 0, time.UTC),
 			Updated:    time.Date(2025, time.May, 19, 6, 17, 11, 0, time.UTC),
-			Closed:     timePtr(time.Date(2025, time.May, 19, 6, 17, 11, 0, time.UTC)),
-			MergedTime: timePtr(time.Date(2025, time.May, 19, 6, 17, 11, 0, time.UTC)),
+			Closed:     new(time.Date(2025, time.May, 19, 6, 17, 11, 0, time.UTC)),
+			MergedTime: new(time.Date(2025, time.May, 19, 6, 17, 11, 0, time.UTC)),
 			Merged:     true,
 			PatchURL:   server.URL + "/protop2g-test-srce/pull-request/10.patch",
 			Labels: []*base.Label{
@@ -249,8 +249,8 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			State:      "closed",
 			Created:    time.Date(2025, time.May, 19, 6, 12, 41, 0, time.UTC),
 			Updated:    time.Date(2025, time.May, 19, 6, 14, 3, 0, time.UTC),
-			Closed:     timePtr(time.Date(2025, time.May, 19, 6, 14, 3, 0, time.UTC)),
-			MergedTime: timePtr(time.Date(2025, time.May, 19, 6, 14, 3, 0, time.UTC)),
+			Closed:     new(time.Date(2025, time.May, 19, 6, 14, 3, 0, time.UTC)),
+			MergedTime: new(time.Date(2025, time.May, 19, 6, 14, 3, 0, time.UTC)),
 			Merged:     true,
 			PatchURL:   server.URL + "/protop2g-test-srce/pull-request/9.patch",
 			Labels: []*base.Label{
@@ -279,8 +279,8 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			State:      "closed",
 			Created:    time.Date(2025, time.May, 5, 6, 45, 32, 0, time.UTC),
 			Updated:    time.Date(2025, time.May, 5, 6, 54, 13, 0, time.UTC),
-			Closed:     timePtr(time.Date(2025, time.May, 5, 6, 54, 13, 0, time.UTC)),
-			MergedTime: timePtr(time.Date(2025, time.May, 5, 6, 54, 13, 0, time.UTC)), // THIS IS WRONG
+			Closed:     new(time.Date(2025, time.May, 5, 6, 54, 13, 0, time.UTC)),
+			MergedTime: new(time.Date(2025, time.May, 5, 6, 54, 13, 0, time.UTC)), // THIS IS WRONG
 			Merged:     false,
 			PatchURL:   server.URL + "/protop2g-test-srce/pull-request/8.patch",
 			Labels: []*base.Label{
@@ -308,9 +308,9 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			PosterID:   -1,
 			State:      "closed",
 			Created:    time.Date(2025, time.May, 5, 6, 45, 6, 0, time.UTC),
-			Updated:    time.Date(2025, time.May, 5, 6, 54, 3, 0, time.UTC),          // IT SHOULD BE NIL
-			Closed:     timePtr(time.Date(2025, time.May, 5, 6, 54, 3, 0, time.UTC)), // IT is CLOSED, Not MERGED so SHOULD NOT BE NIL
-			MergedTime: timePtr(time.Date(2025, time.May, 5, 6, 54, 3, 0, time.UTC)), // THIS IS WRONG
+			Updated:    time.Date(2025, time.May, 5, 6, 54, 3, 0, time.UTC),      // IT SHOULD BE NIL
+			Closed:     new(time.Date(2025, time.May, 5, 6, 54, 3, 0, time.UTC)), // IT is CLOSED, Not MERGED so SHOULD NOT BE NIL
+			MergedTime: new(time.Date(2025, time.May, 5, 6, 54, 3, 0, time.UTC)), // THIS IS WRONG
 			Merged:     false,
 			PatchURL:   server.URL + "/protop2g-test-srce/pull-request/7.patch",
 			Labels: []*base.Label{
@@ -339,8 +339,8 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			State:      "open",
 			Created:    time.Date(2025, time.May, 5, 6, 44, 30, 0, time.UTC),
 			Updated:    time.Date(2025, time.May, 19, 8, 30, 50, 0, time.UTC),
-			Closed:     timePtr(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
-			MergedTime: timePtr(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
+			Closed:     new(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
+			MergedTime: new(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
 			Merged:     false,
 			PatchURL:   server.URL + "/protop2g-test-srce/pull-request/6.patch",
 			Labels: []*base.Label{
@@ -369,8 +369,8 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 			State:      "open",
 			Created:    time.Date(2025, time.May, 5, 6, 43, 57, 0, time.UTC),
 			Updated:    time.Date(2025, time.May, 19, 6, 29, 45, 0, time.UTC),
-			Closed:     timePtr(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
-			MergedTime: timePtr(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
+			Closed:     new(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
+			MergedTime: new(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
 			Merged:     false,
 			PatchURL:   server.URL + "/protop2g-test-srce/pull-request/5.patch",
 			Labels: []*base.Label{
@@ -428,22 +428,22 @@ func TestPagureDownloadRepoWithPublicIssues(t *testing.T) {
 	dict := map[string]*base.Milestone{
 		"Milestone AAAA": {
 			Title:    "Milestone AAAA",
-			Deadline: timePtr(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
+			Deadline: new(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
 			State:    "open",
 		},
 		"Milestone BBBB": {
 			Title:    "Milestone BBBB",
-			Deadline: timePtr(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
+			Deadline: new(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
 			State:    "closed",
 		},
 		"Milestone CCCC": {
 			Title:    "Milestone CCCC",
-			Deadline: timePtr(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
+			Deadline: new(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
 			State:    "open",
 		},
 		"Milestone DDDD": {
 			Title:    "Milestone DDDD",
-			Deadline: timePtr(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
+			Deadline: new(time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC)),
 			State:    "closed",
 		},
 	}
@@ -524,7 +524,7 @@ func TestPagureDownloadRepoWithPrivateIssues(t *testing.T) {
 			Milestone:  "Milestone DDDD",
 			Created:    time.Date(2023, time.November, 21, 8, 6, 56, 0, time.UTC),
 			Updated:    time.Date(2025, time.June, 25, 6, 26, 26, 0, time.UTC),
-			Closed:     timePtr(time.Date(2025, time.June, 25, 6, 23, 51, 0, time.UTC)),
+			Closed:     new(time.Date(2025, time.June, 25, 6, 23, 51, 0, time.UTC)),
 			Labels: []*base.Label{
 				{
 					Name: "gggg",
@@ -550,7 +550,7 @@ func TestPagureDownloadRepoWithPrivateIssues(t *testing.T) {
 			Milestone:  "Milestone CCCC",
 			Created:    time.Date(2023, time.November, 21, 8, 3, 57, 0, time.UTC),
 			Updated:    time.Date(2025, time.June, 25, 6, 26, 7, 0, time.UTC),
-			Closed:     timePtr(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
+			Closed:     new(time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC)),
 			Labels: []*base.Label{
 				{
 					Name: "eeee",
@@ -649,17 +649,17 @@ func TestProcessDate(t *testing.T) {
 		},
 		{
 			name:     "empty string",
-			input:    strPtr(""),
+			input:    new(""),
 			expected: time.Time{},
 		},
 		{
 			name:     "unix timestamp",
-			input:    strPtr("1609459200"),
+			input:    new("1609459200"),
 			expected: time.Unix(1609459200, 0),
 		},
 		{
 			name:     "YYYY-MM-DD format",
-			input:    strPtr("2025-12-12"),
+			input:    new("2025-12-12"),
 			expected: time.Date(2025, time.December, 12, 0, 0, 0, 0, time.UTC),
 		},
 	}
@@ -671,7 +671,3 @@ func TestProcessDate(t *testing.T) {
 		})
 	}
 }
-
-func strPtr(s string) *string {
-	return &s
-}
diff --git a/services/packages/auth.go b/services/packages/auth.go
index 205125cf8b..9b5ee9f627 100644
--- a/services/packages/auth.go
+++ b/services/packages/auth.go
@@ -13,7 +13,9 @@ import (
 	auth_model "forgejo.org/models/auth"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/log"
+	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
+	"forgejo.org/modules/timeutil"
 
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -24,12 +26,19 @@ type packageClaims struct {
 	Scope  auth_model.AccessTokenScope
 }
 
-func CreateAuthorizationToken(u *user_model.User, scope auth_model.AccessTokenScope) (string, error) {
+func CreateAuthorizationToken(u *user_model.User, scope auth_model.AccessTokenScope, maxExpiry optional.Option[timeutil.TimeStamp]) (string, error) {
 	now := time.Now()
 
+	// Don't allow package registry authentication to create a credential that exceeds the lifetime of whatever
+	// credential was used to authenticate; cap it at the incoming credential's expiry.
+	expiry := now.Add(24 * time.Hour)
+	if has, maxExp := maxExpiry.Get(); has && expiry.Unix() > maxExp.AsTime().Unix() {
+		expiry = maxExp.AsTime()
+	}
+
 	claims := packageClaims{
 		RegisteredClaims: jwt.RegisteredClaims{
-			ExpiresAt: jwt.NewNumericDate(now.Add(24 * time.Hour)),
+			ExpiresAt: jwt.NewNumericDate(expiry),
 			NotBefore: jwt.NewNumericDate(now),
 		},
 		UserID: u.ID,
diff --git a/services/pull/check.go b/services/pull/check.go
index 64bddf497c..0e74973456 100644
--- a/services/pull/check.go
+++ b/services/pull/check.go
@@ -65,7 +65,7 @@ const (
 )
 
 // CheckPullMergeable check if the pull mergeable based on all conditions (branch protection, merge options, ...)
-func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *access_model.Permission, pr *issues_model.PullRequest, mergeCheckType MergeCheckType, adminSkipProtectionCheck bool) error {
+func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *access_model.Permission, pr *issues_model.PullRequest, mergeCheckType MergeCheckType, adminSkipProtectionCheck bool, mergeStyle repo_model.MergeStyle) error {
 	return db.WithTx(stdCtx, func(ctx context.Context) error {
 		if pr.HasMerged {
 			return ErrHasMerged
@@ -136,7 +136,7 @@ func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *acc
 			}
 		}
 
-		if _, err := isSignedIfRequired(ctx, pr, doer); err != nil {
+		if _, err := isSignedIfRequired(ctx, pr, doer, mergeStyle); err != nil {
 			return err
 		}
 
@@ -151,7 +151,7 @@ func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *acc
 }
 
 // isSignedIfRequired check if merge will be signed if required
-func isSignedIfRequired(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User) (bool, error) {
+func isSignedIfRequired(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User, mergeStyle repo_model.MergeStyle) (bool, error) {
 	pb, err := git_model.GetFirstMatchProtectedBranchRule(ctx, pr.BaseRepoID, pr.BaseBranch)
 	if err != nil {
 		return false, err
@@ -161,11 +161,22 @@ func isSignedIfRequired(ctx context.Context, pr *issues_model.PullRequest, doer
 		return true, nil
 	}
 
+	if !isMergeSigningRequired(mergeStyle) {
+		return true, nil
+	}
+
 	sign, _, _, err := asymkey_service.SignMerge(ctx, pr, doer, pr.BaseRepo.RepoPath(), pr.BaseBranch, pr.GetGitRefName())
 
 	return sign, err
 }
 
+func isMergeSigningRequired(mergeStyle repo_model.MergeStyle) bool {
+	// Only fast-forward-only is guaranteed not to create a new commit. Rebase
+	// rewrites commits when the pull request is behind, and it can also amend
+	// the tip commit when a REBASE_TEMPLATE is configured.
+	return mergeStyle != repo_model.MergeStyleFastForwardOnly
+}
+
 // checkAndUpdateStatus checks if pull request is possible to leaving checking status,
 // and set to be either conflict or mergeable.
 func checkAndUpdateStatus(ctx context.Context, pr *issues_model.PullRequest) bool {
diff --git a/services/pull/check_test.go b/services/pull/check_test.go
index 9b7e1660bc..3115bb7a21 100644
--- a/services/pull/check_test.go
+++ b/services/pull/check_test.go
@@ -11,6 +11,7 @@ import (
 
 	"forgejo.org/models/db"
 	issues_model "forgejo.org/models/issues"
+	repo_model "forgejo.org/models/repo"
 	"forgejo.org/models/unittest"
 	"forgejo.org/modules/queue"
 	"forgejo.org/modules/setting"
@@ -67,3 +68,53 @@ func TestPullRequest_AddToTaskQueue(t *testing.T) {
 	prPatchCheckerQueue.ShutdownWait(5 * time.Second)
 	prPatchCheckerQueue = nil
 }
+
+func TestIsMergeSigningRequired(t *testing.T) {
+	testCases := []struct {
+		name       string
+		mergeStyle repo_model.MergeStyle
+		expected   bool
+	}{
+		{
+			name:       "fast-forward never requires signing",
+			mergeStyle: repo_model.MergeStyleFastForwardOnly,
+			expected:   false,
+		},
+		{
+			name:       "rebase requires signing even when up to date",
+			mergeStyle: repo_model.MergeStyleRebase,
+			expected:   true,
+		},
+		{
+			name:       "rebase-merge requires signing",
+			mergeStyle: repo_model.MergeStyleRebaseMerge,
+			expected:   true,
+		},
+		{
+			name:       "squash commits require signing",
+			mergeStyle: repo_model.MergeStyleSquash,
+			expected:   true,
+		},
+		{
+			name:       "merge commits require signing",
+			mergeStyle: repo_model.MergeStyleMerge,
+			expected:   true,
+		},
+		{
+			name:       "rebase-update style still requires signing",
+			mergeStyle: repo_model.MergeStyleRebaseUpdate,
+			expected:   true,
+		},
+		{
+			name:       "empty merge style requires signing",
+			mergeStyle: "",
+			expected:   true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			assert.Equal(t, testCase.expected, isMergeSigningRequired(testCase.mergeStyle))
+		})
+	}
+}
diff --git a/services/pull/pull.go b/services/pull/pull.go
index 70013d326d..7c078a0058 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -263,22 +263,17 @@ func ChangeTargetBranch(ctx context.Context, pr *issues_model.PullRequest, doer
 	return nil
 }
 
-func checkForInvalidation(ctx context.Context, requests issues_model.PullRequestList, repoID int64, doer *user_model.User, branch string) error {
+func checkForInvalidation(ctx context.Context, requests issues_model.PullRequestList, repoID int64, doer *user_model.User, newCommitID string) error {
 	repo, err := repo_model.GetRepositoryByID(ctx, repoID)
 	if err != nil {
 		return fmt.Errorf("GetRepositoryByIDCtx: %w", err)
 	}
-	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
-	if err != nil {
-		return fmt.Errorf("gitrepo.OpenRepository: %w", err)
-	}
 	go func() {
 		// FIXME: graceful: We need to tell the manager we're doing something...
-		err := InvalidateCodeComments(ctx, requests, doer, gitRepo, branch)
+		err := InvalidateCodeComments(ctx, requests, doer, repo, newCommitID)
 		if err != nil {
 			log.Error("PullRequestList.InvalidateCodeComments: %v", err)
 		}
-		gitRepo.Close()
 	}()
 	return nil
 }
@@ -340,7 +335,7 @@ func TestPullRequest(ctx context.Context, doer *user_model.User, repoID, olderTh
 		if err = requests.LoadAttributes(ctx); err != nil {
 			log.Error("PullRequestList.LoadAttributes: %v", err)
 		}
-		if invalidationErr := checkForInvalidation(ctx, requests, repoID, doer, branch); invalidationErr != nil {
+		if invalidationErr := checkForInvalidation(ctx, requests, repoID, doer, newCommitID); invalidationErr != nil {
 			log.Error("checkForInvalidation: %v", invalidationErr)
 		}
 		if err == nil {
diff --git a/services/pull/review.go b/services/pull/review.go
index 760235325d..d8e04675ea 100644
--- a/services/pull/review.go
+++ b/services/pull/review.go
@@ -42,17 +42,11 @@ func (err ErrDismissRequestOnClosedPR) Unwrap() error {
 
 // checkInvalidation checks if the line of code comment got changed by another commit.
 // If the line got changed the comment is going to be invalidated.
-func checkInvalidation(ctx context.Context, c *issues_model.Comment, repo *git.Repository, branch string) error {
-	// FIXME differentiate between previous and proposed line
-	commit, _, err := repo.LineBlame(branch, c.TreePath, c.UnsignedLine())
-	if err != nil && (errors.Is(err, git.ErrBlameFileDoesNotExist) || errors.Is(err, git.ErrBlameFileNotEnoughLines)) {
-		c.Invalidated = true
-		return issues_model.UpdateCommentInvalidate(ctx, c)
-	}
+func checkInvalidation(ctx context.Context, c *issues_model.Comment, repo *repo_model.Repository, newCommitID string) error {
+	reverseBlame, err := c.ResolveCurrentLine(ctx, repo, newCommitID)
 	if err != nil {
-		return err
-	}
-	if c.CommitSHA != "" && c.CommitSHA != commit.ID.String() {
+		log.Warn("ResolveCurrentLine failed: %s", err.Error())
+	} else if reverseBlame.CommitID != newCommitID {
 		c.Invalidated = true
 		return issues_model.UpdateCommentInvalidate(ctx, c)
 	}
@@ -60,7 +54,7 @@ func checkInvalidation(ctx context.Context, c *issues_model.Comment, repo *git.R
 }
 
 // InvalidateCodeComments will lookup the prs for code comments which got invalidated by change
-func InvalidateCodeComments(ctx context.Context, prs issues_model.PullRequestList, doer *user_model.User, repo *git.Repository, branch string) error {
+func InvalidateCodeComments(ctx context.Context, prs issues_model.PullRequestList, doer *user_model.User, repo *repo_model.Repository, newCommitID string) error {
 	if len(prs) == 0 {
 		return nil
 	}
@@ -76,7 +70,7 @@ func InvalidateCodeComments(ctx context.Context, prs issues_model.PullRequestLis
 		return fmt.Errorf("find code comments: %v", err)
 	}
 	for _, comment := range codeComments {
-		if err := checkInvalidation(ctx, comment, repo, branch); err != nil {
+		if err := checkInvalidation(ctx, comment, repo, newCommitID); err != nil {
 			return err
 		}
 	}
@@ -84,7 +78,10 @@ func InvalidateCodeComments(ctx context.Context, prs issues_model.PullRequestLis
 }
 
 // CreateCodeComment creates a comment on the code line
-func CreateCodeComment(ctx context.Context, doer *user_model.User, gitRepo *git.Repository, issue *issues_model.Issue, line int64, content, treePath string, pendingReview bool, replyReviewID int64, latestCommitID string, attachments []string) (*issues_model.Comment, error) {
+func CreateCodeComment(ctx context.Context, doer *user_model.User, gitRepo *git.Repository,
+	issue *issues_model.Issue, line int64, content, treePath string, pendingReview bool,
+	replyReviewID int64, beforeCommitID, latestCommitID string, attachments []string,
+) (*issues_model.Comment, error) {
 	var (
 		existsReview bool
 		err          error
@@ -115,6 +112,8 @@ func CreateCodeComment(ctx context.Context, doer *user_model.User, gitRepo *git.
 			issue,
 			content,
 			treePath,
+			beforeCommitID,
+			latestCommitID,
 			line,
 			replyReviewID,
 			attachments,
@@ -156,6 +155,8 @@ func CreateCodeComment(ctx context.Context, doer *user_model.User, gitRepo *git.
 		issue,
 		content,
 		treePath,
+		beforeCommitID,
+		latestCommitID,
 		line,
 		review.ID,
 		attachments,
@@ -177,7 +178,10 @@ func CreateCodeComment(ctx context.Context, doer *user_model.User, gitRepo *git.
 }
 
 // CreateCodeCommentKnownReviewID creates a plain code comment at the specified line / path
-func CreateCodeCommentKnownReviewID(ctx context.Context, doer *user_model.User, repo *repo_model.Repository, issue *issues_model.Issue, content, treePath string, line, reviewID int64, attachments []string) (*issues_model.Comment, error) {
+func CreateCodeCommentKnownReviewID(ctx context.Context, doer *user_model.User, repo *repo_model.Repository,
+	issue *issues_model.Issue, content, treePath, beforeCommitID, afterCommitID string,
+	line, reviewID int64, attachments []string,
+) (*issues_model.Comment, error) {
 	var commitID, blamedCommitID, patch string
 	blamedLine := line
 	if err := issue.LoadPullRequest(ctx); err != nil {
@@ -227,7 +231,7 @@ func CreateCodeCommentKnownReviewID(ctx context.Context, doer *user_model.User,
 			// FIXME validate treePath
 			// Get latest commit referencing the commented line
 			// No need for get commit for base branch changes
-			commit, lineres, err := gitRepo.LineBlame(head, treePath, uint64(line))
+			commit, lineres, err := gitRepo.LineBlame(afterCommitID, treePath, uint64(line))
 			if err == nil {
 				blamedCommitID = commit.ID.String()
 				blamedLine = int64(lineres)
@@ -237,6 +241,31 @@ func CreateCodeCommentKnownReviewID(ctx context.Context, doer *user_model.User,
 		} else {
 			blamedCommitID = commitID
 		}
+	} else {
+		// Commenting on a line that was removed. In this case, what we want to track in the comment is which line of
+		// code was this, in the last commit that the line of code actually existed in. We'll use a reverse git blame to
+		// identify this, from the PR base -> commit being viewed.
+		blame, err := gitRepo.ReverseLineBlame(beforeCommitID, treePath, uint64(-1*line), afterCommitID)
+		if err != nil {
+			return nil, fmt.Errorf("ReverseLineBlame[%s, %s, %d, %s]: %w", beforeCommitID, treePath, -1*line, afterCommitID, err)
+		} else if blame.CommitID == afterCommitID {
+			// Although this is a comment on the "previous" side of the diff, the reverse blame indicates that the line
+			// of code still exists in the commit being viewed (eg. it was a comment on a white line in the left-side of
+			// the diff, not a red removed line). In order to record the right information for where to place this
+			// commit, we'll convert this into a right-hand comment -- using the present line number that the reverse
+			// blame gave us:
+			commit, lineres, err := gitRepo.LineBlame(afterCommitID, treePath, blame.LineNumber)
+			if err == nil {
+				blamedCommitID = commit.ID.String()
+				blamedLine = int64(lineres)
+			} else if !errors.Is(err, git.ErrBlameFileDoesNotExist) && !errors.Is(err, git.ErrBlameFileNotEnoughLines) {
+				return nil, fmt.Errorf("LineBlame[%s, %s, %s, %d]: %w", pr.GetGitRefName(), gitRepo.Path, treePath, line, err)
+			}
+		} else {
+			blamedCommitID = blame.CommitID
+			// retain negative line numbering to identify we're commenting on the "previous" side of the diff
+			blamedLine = -1 * int64(blame.LineNumber)
+		}
 	}
 
 	// Only fetch diff if comment is review comment
@@ -256,8 +285,8 @@ func CreateCodeCommentKnownReviewID(ctx context.Context, doer *user_model.User,
 			_ = writer.Close()
 		}()
 		go func() {
-			if err := git.GetRepoRawDiffForFile(gitRepo, pr.MergeBase, commitID, git.RawDiffNormal, treePath, writer); err != nil {
-				_ = writer.CloseWithError(fmt.Errorf("GetRawDiffForLine[%s, %s, %s, %s]: %w", gitRepo.Path, pr.MergeBase, commitID, treePath, err))
+			if err := git.GetRepoRawDiffForFile(gitRepo, beforeCommitID, afterCommitID, git.RawDiffNormal, treePath, writer); err != nil {
+				_ = writer.CloseWithError(fmt.Errorf("GetRawDiffForLine[%s, %s, %s, %s]: %w", gitRepo.Path, pr.MergeBase, afterCommitID, treePath, err))
 				return
 			}
 			_ = writer.Close()
diff --git a/services/repository/adopt.go b/services/repository/adopt.go
index 3651b018e6..1949a62acf 100644
--- a/services/repository/adopt.go
+++ b/services/repository/adopt.go
@@ -117,10 +117,6 @@ func adoptRepository(ctx context.Context, repoPath string, repo *repo_model.Repo
 		return fmt.Errorf("adoptRepository: path does not already exist: %s", repoPath)
 	}
 
-	if err := repo_module.CreateDelegateHooks(repoPath); err != nil {
-		return fmt.Errorf("createDelegateHooks: %w", err)
-	}
-
 	repo.IsEmpty = false
 
 	if len(defaultBranch) > 0 {
diff --git a/services/repository/fork.go b/services/repository/fork.go
index 9d15b6207d..a51a290c05 100644
--- a/services/repository/fork.go
+++ b/services/repository/fork.go
@@ -164,10 +164,6 @@ func ForkRepositoryIfNotExists(ctx context.Context, doer, owner *user_model.User
 			return fmt.Errorf("git update-server-info: %w", err)
 		}
 
-		if err = repo_module.CreateDelegateHooks(repoPath); err != nil {
-			return fmt.Errorf("createDelegateHooks: %w", err)
-		}
-
 		gitRepo, err := gitrepo.OpenRepository(txCtx, repo)
 		if err != nil {
 			return fmt.Errorf("OpenRepository: %w", err)
diff --git a/services/repository/hooks.go b/services/repository/hooks.go
index d3021414cf..808b49212e 100644
--- a/services/repository/hooks.go
+++ b/services/repository/hooks.go
@@ -5,51 +5,13 @@ package repository
 
 import (
 	"context"
-	"fmt"
 
 	"forgejo.org/models/db"
 	repo_model "forgejo.org/models/repo"
 	"forgejo.org/models/webhook"
 	"forgejo.org/modules/gitrepo"
-	"forgejo.org/modules/log"
-	repo_module "forgejo.org/modules/repository"
-
-	"xorm.io/builder"
 )
 
-// SyncRepositoryHooks rewrites all repositories' pre-receive, update and post-receive hooks
-// to make sure the binary and custom conf path are up-to-date.
-func SyncRepositoryHooks(ctx context.Context) error {
-	log.Trace("Doing: SyncRepositoryHooks")
-
-	if err := db.Iterate(
-		ctx,
-		builder.Gt{"id": 0},
-		func(ctx context.Context, repo *repo_model.Repository) error {
-			select {
-			case <-ctx.Done():
-				return db.ErrCancelledf("before sync repository hooks for %s", repo.FullName())
-			default:
-			}
-
-			if err := repo_module.CreateDelegateHooks(repo.RepoPath()); err != nil {
-				return fmt.Errorf("SyncRepositoryHook: %w", err)
-			}
-			if repo.HasWiki() {
-				if err := repo_module.CreateDelegateHooks(repo.WikiPath()); err != nil {
-					return fmt.Errorf("SyncRepositoryHook: %w", err)
-				}
-			}
-			return nil
-		},
-	); err != nil {
-		return err
-	}
-
-	log.Trace("Finished: SyncRepositoryHooks")
-	return nil
-}
-
 // GenerateGitHooks generates git hooks from a template repository
 func GenerateGitHooks(ctx context.Context, templateRepo, generateRepo *repo_model.Repository) error {
 	generateGitRepo, err := gitrepo.OpenRepository(ctx, generateRepo)
diff --git a/services/repository/lfs_test.go b/services/repository/lfs_test.go
index e38c38e29c..969516ef5a 100644
--- a/services/repository/lfs_test.go
+++ b/services/repository/lfs_test.go
@@ -15,6 +15,7 @@ import (
 	"forgejo.org/modules/lfs"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/storage"
+	"forgejo.org/modules/test"
 	repo_service "forgejo.org/services/repository"
 
 	"github.com/stretchr/testify/assert"
@@ -24,7 +25,7 @@ import (
 func TestGarbageCollectLFSMetaObjects(t *testing.T) {
 	unittest.PrepareTestEnv(t)
 
-	setting.LFS.StartServer = true
+	defer test.MockVariableValue(&setting.LFS.StartServer, true)()
 	err := storage.Init()
 	require.NoError(t, err)
 
diff --git a/services/repository/migrate.go b/services/repository/migrate.go
index 46b48d02d3..e4c73dde8c 100644
--- a/services/repository/migrate.go
+++ b/services/repository/migrate.go
@@ -258,14 +258,6 @@ func cleanUpMigrateGitConfig(ctx context.Context, repoPath string) error {
 // CleanUpMigrateInfo finishes migrating repository and/or wiki with things that don't need to be done for mirrors.
 func CleanUpMigrateInfo(ctx context.Context, repo *repo_model.Repository) (*repo_model.Repository, error) {
 	repoPath := repo.RepoPath()
-	if err := repo_module.CreateDelegateHooks(repoPath); err != nil {
-		return repo, fmt.Errorf("createDelegateHooks: %w", err)
-	}
-	if repo.HasWiki() {
-		if err := repo_module.CreateDelegateHooks(repo.WikiPath()); err != nil {
-			return repo, fmt.Errorf("createDelegateHooks.(wiki): %w", err)
-		}
-	}
 
 	_, _, err := git.NewCommand(ctx, "remote", "rm", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil && !git.IsRemoteNotExistError(err) {
diff --git a/services/wiki/wiki.go b/services/wiki/wiki.go
index cf1477e72c..984c394f0e 100644
--- a/services/wiki/wiki.go
+++ b/services/wiki/wiki.go
@@ -42,8 +42,6 @@ func InitWiki(ctx context.Context, repo *repo_model.Repository) error {
 
 	if err := git.InitRepository(ctx, repo.WikiPath(), true, repo.ObjectFormatName); err != nil {
 		return fmt.Errorf("InitRepository: %w", err)
-	} else if err = repo_module.CreateDelegateHooks(repo.WikiPath()); err != nil {
-		return fmt.Errorf("createDelegateHooks: %w", err)
 	} else if _, _, err = git.NewCommand(ctx, "symbolic-ref", "HEAD").AddDynamicArguments(git.BranchPrefix + branch).RunStdString(&git.RunOpts{Dir: repo.WikiPath()}); err != nil {
 		return fmt.Errorf("unable to set default wiki branch to %s: %w", branch, err)
 	}
diff --git a/shell.nix b/shell.nix
index 7d457e8e73..94b5cf708e 100644
--- a/shell.nix
+++ b/shell.nix
@@ -25,5 +25,6 @@ pkgs.mkShell {
 
     # tests
     openssh
+    gnupg
   ];
 }
diff --git a/stylelint.config.js b/stylelint.config.js
index 18f9af68b7..b7cc162669 100644
--- a/stylelint.config.js
+++ b/stylelint.config.js
@@ -11,6 +11,7 @@ export default {
   plugins: [
     'stylelint-declaration-strict-value',
     'stylelint-declaration-block-no-ignored-properties',
+    'stylelint-plugin-logical-css',
     'stylelint-value-no-unknown-custom-properties',
     '@stylistic/stylelint-plugin',
   ],
@@ -173,6 +174,16 @@ export default {
     'keyframe-selector-notation': null,
     'keyframes-name-pattern': null,
     'length-zero-no-unit': [true, {ignore: ['custom-properties']}, {ignoreFunctions: ['var']}],
+    'logical-css/require-logical-keywords': true,
+    'logical-css/require-logical-properties': [true, {
+      fix: true,
+      ignore: [ // ignore properties not related to RTL support
+        'height', 'min-height', 'max-height', 'width', 'min-width', 'max-width', 'top', 'bottom',
+        'margin-bottom', 'margin-top', 'padding-bottom', 'padding-top',
+        'border-top', 'border-top-style', 'border-top-width', 'border-bottom', 'border-bottom-style', 'border-bottom-width',
+        'scroll-margin-top', 'scroll-margin-bottom', 'scroll-padding-top', 'scroll-padding-bottom'],
+      severity: 'error',
+    }],
     'max-nesting-depth': null,
     'media-feature-name-allowed-list': null,
     'media-feature-name-disallowed-list': null,
diff --git a/templates/admin/config.tmpl b/templates/admin/config.tmpl
index 0962c6bfc7..c4688922dd 100644
--- a/templates/admin/config.tmpl
+++ b/templates/admin/config.tmpl
@@ -344,6 +344,33 @@
 			</dl>
 		</div>
 
+		<h4 class="ui top attached header">
+			{{ctx.Locale.Tr "admin.config.federation"}}
+		</h4>
+		<div class="ui attached table segment">
+			<dl class="admin-dl-horizontal">
+				<dt>{{ctx.Locale.Tr "admin.config.federation.enabled"}}</dt>
+				<dd>{{if .Federation.Enabled}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.config.federation.share_user_statistics"}}</dt>
+				<dd>{{if .Federation.ShareUserStatistics}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.config.federation.max_size"}}</dt>
+				<dd>{{.FederationMaxSize}} MiB</dd>
+
+				<div class="divider"></div>
+
+				<dt>{{ctx.Locale.Tr "admin.config.federation.signature_enforced"}}</dt>
+				<dd>{{if .Federation.SignatureEnforced}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.config.federation.signature_algorithms"}}</dt>
+				<dd>{{.Federation.SignatureAlgorithms}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.config.federation.digest_algorithm"}}</dt>
+				<dd>{{.Federation.DigestAlgorithm}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.config.federation.get_headers"}}</dt>
+				<dd>{{.Federation.GetHeaders}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.config.federation.post_headers"}}</dt>
+				<dd>{{.Federation.PostHeaders}}</dd>
+			</dl>
+		</div>
+
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.config.log_config"}}
 		</h4>
diff --git a/templates/admin/federation/host.tmpl b/templates/admin/federation/host.tmpl
new file mode 100644
index 0000000000..92fbd1ee2a
--- /dev/null
+++ b/templates/admin/federation/host.tmpl
@@ -0,0 +1,39 @@
+{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin config")}}
+	<div class="admin-setting-content">
+		{{if .Host}}
+		<h4 class="ui top attached header">
+			{{ctx.Locale.Tr "admin.federation.hosts.details_panel"}}
+		</h4>
+		<div class="ui attached table segment">
+			<dl class="admin-dl-horizontal">
+				<dt>{{ctx.Locale.Tr "admin.federation.host.id"}}</dt>
+				<dd>{{.Host.ID}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.federation.host.fqdn"}}</dt>
+				<dd>{{.Host.HostFqdn}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.federation.host.port"}}</dt>
+				<dd>{{.Host.HostPort}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.federation.host.schema"}}</dt>
+				<dd>{{.Host.HostSchema}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.federation.host.software_name"}}</dt>
+				<dd>{{.Host.NodeInfo.SoftwareName}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.federation.host.created"}}</dt>
+				<dd>{{DateUtils.AbsoluteShort .Host.Created}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.federation.host.updated"}}</dt>
+				<dd>{{DateUtils.AbsoluteShort .Host.Updated}}</dd>
+				<dt>{{ctx.Locale.Tr "admin.federation.host.latest_activity"}}</dt>
+				<dd>{{DateUtils.FullTime .Host.LatestActivity}}</dd>
+			</dl>
+		</div>
+		{{end}}
+		<h4 class="ui top attached header">
+			{{ctx.Locale.Tr "admin.federation.users.manage_panel"}}
+			<div class="ui right">
+				{{.UsersTotal}}
+			</div>
+		</h4>
+		<div class="ui attached table segment">
+			{{template "admin/federation/user_list" .}}
+		</div>
+		{{template "base/paginate" .}}
+	</div>
+{{template "admin/layout_footer" .}}
diff --git a/templates/admin/federation/hosts.tmpl b/templates/admin/federation/hosts.tmpl
new file mode 100644
index 0000000000..2222873805
--- /dev/null
+++ b/templates/admin/federation/hosts.tmpl
@@ -0,0 +1,56 @@
+{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin user")}}
+	<div class="admin-setting-content">
+		<h4 class="ui top attached header">
+			{{ctx.Locale.Tr "admin.federation.hosts.manage_panel"}} ({{ctx.Locale.Tr "admin.total" .TotalCount}})
+		</h4>
+		<div class="ui attached table segment">
+			<table class="ui very basic striped table unstackable">
+				<thead>
+					<tr>
+						<th data-sortt-asc="id_asc" data-sortt-desc="id_desc">
+							{{ctx.Locale.Tr "admin.federation.host.id"}}
+							{{SortArrow "id_asc" "id_desc" .SortType true}}
+						</th>
+						<th data-sortt-asc="fqdn_asc" data-sortt-desc="fqdn_desc">
+							{{ctx.Locale.Tr "admin.federation.host.fqdn"}}
+							{{SortArrow "fqdn_asc" "fqdn_desc" .SortType false}}
+						</th>
+						<th>{{ctx.Locale.Tr "admin.federation.host.schema"}}</th>
+						<th>{{ctx.Locale.Tr "admin.federation.host.port"}}</th>
+						<th>{{ctx.Locale.Tr "admin.federation.host.software_name"}}</th>
+						<th data-sortt-asc="created_asc" data-sortt-desc="created_desc">
+							{{ctx.Locale.Tr "admin.federation.host.created"}}
+							{{SortArrow "created_asc" "created_desc" .SortType true}}
+						</th>
+						<th data-sortt-asc="activity_asc" data-sortt-desc="activity_desc">
+							{{ctx.Locale.Tr "admin.federation.host.latest_activity"}}
+							{{SortArrow "activity_asc" "activity_desc" .SortType true}}
+						</th>
+						<th></th>
+					</tr>
+				</thead>
+				<tbody>
+					{{range .Hosts}}
+						<tr>
+							<td>{{.ID}}</td>
+							<td>{{.HostFqdn}}</td>
+							<td>{{.HostSchema}}</td>
+							<td>{{.HostPort}}</td>
+							<td>{{.NodeInfo.SoftwareName}}</td>
+							<td>{{DateUtils.AbsoluteShort .Created}}</td>
+							<td>{{DateUtils.FullTime .LatestActivity}}</td>
+							<td>
+								<div class="tw-flex tw-gap-2">
+									<a href="{{$.Link}}/{{.ID}}" data-tooltip-content="{{ctx.Locale.Tr "admin.federation.hosts.show_details"}}">{{svg "octicon-server"}}</a>
+								</div>
+							</td>
+						</tr>
+					{{else}}
+						<tr><td class="tw-text-center" colspan="10">{{ctx.Locale.Tr "repo.pulls.no_results"}}</td></tr>
+					{{end}}
+				</tbody>
+			</table>
+		</div>
+		{{template "base/paginate" .}}
+	</div>
+{{template "admin/layout_footer" .}}
diff --git a/templates/admin/federation/user_list.tmpl b/templates/admin/federation/user_list.tmpl
new file mode 100644
index 0000000000..18ff34b848
--- /dev/null
+++ b/templates/admin/federation/user_list.tmpl
@@ -0,0 +1,28 @@
+<table class="ui very basic striped table unstackable">
+	<thead>
+		<tr>
+			<th>{{ctx.Locale.Tr "admin.federation.user.id"}}</th>
+			<th>{{ctx.Locale.Tr "admin.federation.user.user_id"}}</th>
+			<th>{{ctx.Locale.Tr "admin.federation.user.external_id"}}</th>
+			<th>{{ctx.Locale.Tr "admin.federation.user.inbox_path"}}</th>
+			<th></th>
+		</tr>
+	</thead>
+	<tbody>
+		{{range .Users}}
+			<tr>
+				<td>{{.ID}}</td>
+				<td>{{.UserID}}</td>
+				<td>{{.ExternalID}}</td>
+				<td>{{.InboxPath}}</td>
+				<td>
+					<div class="tw-flex tw-gap-2">
+						<a href="{{AppUrl}}admin/users/{{.UserID}}" data-tooltip-content="{{ctx.Locale.Tr "admin.federation.users.show_local_user"}}">{{svg "octicon-person"}}</a>
+					</div>
+				</td>
+			</tr>
+		{{else}}
+			<tr><td class="tw-text-center" colspan="10">{{ctx.Locale.Tr "repo.pulls.no_results"}}</td></tr>
+		{{end}}
+	</tbody>
+</table>
diff --git a/templates/admin/federation/users.tmpl b/templates/admin/federation/users.tmpl
new file mode 100644
index 0000000000..8ddcff3dad
--- /dev/null
+++ b/templates/admin/federation/users.tmpl
@@ -0,0 +1,11 @@
+{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin user")}}
+	<div class="admin-setting-content">
+		<h4 class="ui top attached header">
+			{{ctx.Locale.Tr "admin.federation.users.manage_panel"}} ({{ctx.Locale.Tr "admin.total" .TotalCount}})
+		</h4>
+		<div class="ui attached table segment">
+			{{template "admin/federation/user_list" .}}
+		</div>
+		{{template "base/paginate" .}}
+	</div>
+{{template "admin/layout_footer" .}}
diff --git a/templates/admin/navbar.tmpl b/templates/admin/navbar.tmpl
index 7ca8538bce..fa1500341d 100644
--- a/templates/admin/navbar.tmpl
+++ b/templates/admin/navbar.tmpl
@@ -77,6 +77,19 @@
 			</div>
 		</details>
 		{{end}}
+		{{if .EnableFederation}}
+		<details class="item toggleable-item" {{if or .PageIsAdminFederationHosts .PageIsAdminFederationUsers}}open{{end}}>
+			<summary>{{ctx.Locale.Tr "admin.federation.federation"}}</summary>
+			<div class="menu">
+				<a class="{{if .PageIsAdminFederationHosts}}active {{end}}item" href="{{AppSubUrl}}/admin/federation/hosts">
+					{{ctx.Locale.Tr "admin.federation.hosts"}}
+				</a>
+				<a class="{{if .PageIsAdminFederationUsers}}active {{end}}item" href="{{AppSubUrl}}/admin/federation/users">
+					{{ctx.Locale.Tr "admin.federation.users"}}
+				</a>
+			</div>
+		</details>
+		{{end}}
 		<details class="item toggleable-item" {{if or .PageIsAdminConfig}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "admin.config"}}</summary>
 			<div class="menu">
diff --git a/templates/admin/queue_manage.tmpl b/templates/admin/queue_manage.tmpl
index a793fe1350..7686755d6d 100644
--- a/templates/admin/queue_manage.tmpl
+++ b/templates/admin/queue_manage.tmpl
@@ -44,7 +44,7 @@
 			{{ctx.Locale.Tr "admin.monitor.queue.settings.title"}}
 		</h4>
 		<div class="ui attached segment">
-			<p>{{ctx.Locale.Tr "admin.monitor.queue.settings.desc"}}</p>
+			<p>{{ctx.Locale.Tr "admin.monitor.queue.settings.description"}}</p>
 			<form method="post" action="{{.Link}}/set">
 				<div class="ui form">
 					<div class="inline field">
diff --git a/templates/admin/repo/unadopted.tmpl b/templates/admin/repo/unadopted.tmpl
index d7e57c7c14..bc74f24a58 100644
--- a/templates/admin/repo/unadopted.tmpl
+++ b/templates/admin/repo/unadopted.tmpl
@@ -24,37 +24,37 @@
 								<span class="tw-flex-1"> {{svg "octicon-file-directory-fill"}} {{$dir}}</span>
 								<div>
 									<button class="ui button primary show-modal tw-p-2" data-modal="#adopt-unadopted-modal-{{$dirI}}">{{svg "octicon-plus"}} {{ctx.Locale.Tr "repo.adopt_preexisting_label"}}</button>
-									<div class="ui g-modal-confirm modal" id="adopt-unadopted-modal-{{$dirI}}">
-										<div class="header">
-											<span class="label">{{ctx.Locale.Tr "repo.adopt_preexisting"}}</span>
-										</div>
-										<div class="content">
-											<p>{{ctx.Locale.Tr "repo.adopt_preexisting_content" $dir}}</p>
-										</div>
-										<form class="ui form" method="post" action="{{AppSubUrl}}/admin/repos/unadopted">
-											<input type="hidden" name="id" value="{{$dir}}">
-											<input type="hidden" name="action" value="adopt">
-											<input type="hidden" name="q" value="{{$.Keyword}}">
-											<input type="hidden" name="page" value="{{$.CurrentPage}}">
-											{{template "base/modal_actions_confirm"}}
-										</form>
-									</div>
+									<dialog id="adopt-unadopted-modal-{{$dirI}}">
+										<article>
+											<header>{{ctx.Locale.Tr "repo.adopt_preexisting"}}</header>
+											<div class="content">
+												<p>{{ctx.Locale.Tr "repo.adopt_preexisting_content" $dir}}</p>
+											</div>
+											<form class="ui form" method="post" action="{{AppSubUrl}}/admin/repos/unadopted">
+												<input type="hidden" name="id" value="{{$dir}}">
+												<input type="hidden" name="action" value="adopt">
+												<input type="hidden" name="q" value="{{$.Keyword}}">
+												<input type="hidden" name="page" value="{{$.CurrentPage}}">
+												{{template "base/modal_actions_confirm"}}
+											</form>
+										</article>
+									</dialog>
 									<button class="ui button red show-modal tw-p-2" data-modal="#delete-unadopted-modal-{{$dirI}}">{{svg "octicon-x"}} {{ctx.Locale.Tr "repo.delete_preexisting_label"}}</button>
-									<div class="ui g-modal-confirm modal" id="delete-unadopted-modal-{{$dirI}}">
-										<div class="header">
-											<span class="label">{{ctx.Locale.Tr "repo.delete_preexisting"}}</span>
-										</div>
-										<div class="content">
-											<p>{{ctx.Locale.Tr "repo.delete_preexisting_content" $dir}}</p>
-										</div>
-										<form class="ui form" method="post" action="{{AppSubUrl}}/admin/repos/unadopted">
-											<input type="hidden" name="id" value="{{$dir}}">
-											<input type="hidden" name="action" value="delete">
-											<input type="hidden" name="q" value="{{$.Keyword}}">
-											<input type="hidden" name="page" value="{{$.CurrentPage}}">
-											{{template "base/modal_actions_confirm"}}
-										</form>
-									</div>
+									<dialog id="delete-unadopted-modal-{{$dirI}}">
+										<article>
+											<header>{{ctx.Locale.Tr "repo.delete_preexisting"}}</header>
+											<div class="content">
+												<p>{{ctx.Locale.Tr "repo.delete_preexisting_content" $dir}}</p>
+											</div>
+											<form class="ui form" method="post" action="{{AppSubUrl}}/admin/repos/unadopted">
+												<input type="hidden" name="id" value="{{$dir}}">
+												<input type="hidden" name="action" value="delete">
+												<input type="hidden" name="q" value="{{$.Keyword}}">
+												<input type="hidden" name="page" value="{{$.CurrentPage}}">
+												{{template "base/modal_actions_confirm"}}
+											</form>
+										</article>
+									</dialog>
 								</div>
 							</div>
 						{{end}}
diff --git a/templates/admin/system_status.tmpl b/templates/admin/system_status.tmpl
index d9856ccd0b..c1dd838290 100644
--- a/templates/admin/system_status.tmpl
+++ b/templates/admin/system_status.tmpl
@@ -1,62 +1,62 @@
 <dl class="admin-dl-horizontal">
-	<dt>{{ctx.Locale.Tr "admin.dashboard.server_uptime"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.server_uptime"}}</dt>
 	<dd><relative-time format="duration" datetime="{{.SysStatus.StartTime}}">{{.SysStatus.StartTime}}</relative-time></dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.current_goroutine"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.current_goroutine"}}</dt>
 	<dd>{{.SysStatus.NumGoroutine}}</dd>
 	<div class="divider"></div>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.current_memory_usage"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.current_memory_usage"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.MemAllocated}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.total_memory_allocated"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.total_memory_allocated"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.MemTotal}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.memory_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.memory_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.MemSys}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.pointer_lookup_times"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.pointer_lookup_times"}}</dt>
 	<dd>{{.SysStatus.Lookups}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.memory_allocate_times"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.memory_allocate_times"}}</dt>
 	<dd>{{.SysStatus.MemMallocs}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.memory_free_times"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.memory_free_times"}}</dt>
 	<dd>{{.SysStatus.MemFrees}}</dd>
 	<div class="divider"></div>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.current_heap_usage"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.current_heap_usage"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.HeapAlloc}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.heap_memory_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.heap_memory_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.HeapSys}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.heap_memory_idle"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.heap_memory_idle"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.HeapIdle}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.heap_memory_in_use"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.heap_memory_in_use"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.HeapInuse}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.heap_memory_released"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.heap_memory_released"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.HeapReleased}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.heap_objects"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.heap_objects"}}</dt>
 	<dd>{{.SysStatus.HeapObjects}}</dd>
 	<div class="divider"></div>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.bootstrap_stack_usage"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.bootstrap_stack_usage"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.StackInuse}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.stack_memory_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.stack_memory_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.StackSys}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.mspan_structures_usage"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.mspan_structures_usage"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.MSpanInuse}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.mspan_structures_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.mspan_structures_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.MSpanSys}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.mcache_structures_usage"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.mcache_structures_usage"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.MCacheInuse}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.mcache_structures_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.mcache_structures_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.MCacheSys}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.profiling_bucket_hash_table_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.profiling_bucket_hash_table_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.BuckHashSys}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.gc_metadata_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.gc_metadata_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.GCSys}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.other_system_allocation_obtained"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.other_system_allocation_obtained"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.OtherSys}}</dd>
 	<div class="divider"></div>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.next_gc_recycle"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.next_gc_recycle"}}</dt>
 	<dd>{{ctx.Locale.TrSize .SysStatus.NextGC}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.last_gc_time"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.last_gc_time"}}</dt>
 	<dd><relative-time format="duration" datetime="{{.SysStatus.LastGCTime}}">{{.SysStatus.LastGCTime}}</relative-time></dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.total_gc_pause"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.total_gc_pause"}}</dt>
 	<dd>{{.SysStatus.PauseTotalNs}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.last_gc_pause"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.last_gc_pause"}}</dt>
 	<dd>{{.SysStatus.PauseNs}}</dd>
-	<dt>{{ctx.Locale.Tr "admin.dashboard.gc_times"}}</dt>
+	<dt>{{ctx.Locale.Tr "admin.system_status.gc_times"}}</dt>
 	<dd>{{.SysStatus.NumGC}}</dd>
 </dl>
diff --git a/templates/admin/user/edit.tmpl b/templates/admin/user/edit.tmpl
index 1d29a991cd..f18317e694 100644
--- a/templates/admin/user/edit.tmpl
+++ b/templates/admin/user/edit.tmpl
@@ -224,24 +224,23 @@
 		</div>
 	</div>
 
-<div class="ui g-modal-confirm delete modal" id="delete-user-modal">
-	<div class="header">
-		{{svg "octicon-trash"}}
-		{{ctx.Locale.Tr "settings.delete_account_title"}}
-	</div>
-	<form class="ui form" method="post" action="./delete">
-		<div class="content">
-			<p>{{ctx.Locale.Tr "settings.delete_account_desc"}}</p>
-			<div class="field">
-				<div class="ui checkbox">
-					<label for="purge">{{ctx.Locale.Tr "admin.users.purge"}}</label>
-					<input name="purge" type="checkbox">
+<dialog id="delete-user-modal">
+	<article>
+		<header>{{svg "octicon-trash"}} {{ctx.Locale.Tr "settings.delete_account_title"}}</header>
+		<form class="ui form" method="post" action="./delete">
+			<div class="content">
+				<p>{{ctx.Locale.Tr "settings.delete_account_desc"}}</p>
+				<div class="field">
+					<div class="ui checkbox">
+						<label for="purge">{{ctx.Locale.Tr "admin.users.purge"}}</label>
+						<input name="purge" type="checkbox">
+					</div>
+					<p class="help">{{ctx.Locale.Tr "admin.users.purge_help"}}</p>
 				</div>
-				<p class="help">{{ctx.Locale.Tr "admin.users.purge_help"}}</p>
 			</div>
-		</div>
-		{{template "base/modal_actions_confirm" .}}
-	</form>
-</div>
+			{{template "base/modal_actions_confirm" .}}
+		</form>
+	</article>
+</dialog>
 
 {{template "admin/layout_footer" .}}
diff --git a/templates/base/head.tmpl b/templates/base/head.tmpl
index d31d25db46..8b4f661b57 100644
--- a/templates/base/head.tmpl
+++ b/templates/base/head.tmpl
@@ -19,6 +19,9 @@
 {{end}}
 	<link rel="icon" href="{{AssetUrlPrefix}}/img/favicon.svg" type="image/svg+xml">
 	<link rel="alternate icon" href="{{AssetUrlPrefix}}/img/favicon.png" type="image/png">
+{{if and FederationEnabled .PageIsUserProfile .ContextUser .ContextUser.IsIndividual}}
+	<link rel="alternate" type="application/activity+json" href="{{.ContextUser.APActorID}}">
+{{end}}
 	{{template "base/head_script" .}}
 	{{template "shared/user/mention_highlight" .}}
 	{{template "base/head_opengraph" .}}
diff --git a/templates/demo/modal.tmpl b/templates/demo/modal.tmpl
index 746d82b229..af4c1295ef 100644
--- a/templates/demo/modal.tmpl
+++ b/templates/demo/modal.tmpl
@@ -30,7 +30,7 @@
 	<dialog id="long-modal">
 		<article>
 			<header>Long modal</header>
-			<div class="content">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</div>
+			<div class="content">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</div>
 			<footer class="actions">
 					<button class="secondary button cancel">{{ctx.Locale.Tr "settings.cancel"}}</button>
 			</footer>
diff --git a/templates/org/member/add_org_member.tmpl b/templates/org/member/add_org_member.tmpl
new file mode 100644
index 0000000000..e2b8f1b572
--- /dev/null
+++ b/templates/org/member/add_org_member.tmpl
@@ -0,0 +1,55 @@
+<div class="ui g-modal-confirm delete modal" id="delete-label">
+	<div class="header">
+		{{svg "octicon-trash"}}
+		{{ctx.Locale.Tr "repo.issues.label_deletion"}}
+	</div>
+	<div class="content">
+		<p>{{ctx.Locale.Tr "repo.issues.label_deletion_desc"}}</p>
+	</div>
+	{{template "base/modal_actions_confirm" .}}
+</div>
+
+<dialog id="add-member-modal">
+	<article>
+		<header>{{ctx.Locale.Tr "members.add_member"}}</header>
+		<form class="ui add-member form ignore-dirty" action="{{$.OrgLink}}/members/action/add" method="post">
+			<input type="hidden" name="uid" value="{{.SignedUser.ID}}">
+			<div class="content">
+				<div class="field">
+					<label>{{ctx.Locale.Tr "members.user"}}</label>
+					<div id="search-user-box" class="ui search tw-mr-2"{{if .IsEmailInviteEnabled}} data-allow-email="true" data-allow-email-description="{{ctx.Locale.Tr "org.teams.invite_team_member" $.Team.Name}}"{{end}}>
+						<div class="ui input">
+							<input class="prompt" name="uname" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" required>
+						</div>
+					</div>
+				</div>
+
+				<div class="field">
+					<label>{{ctx.Locale.Tr "org.teams"}}</label>
+					<div class="ui negative message flash-message flash-error" id="no-team-selected-message" hidden>{{ctx.Locale.Tr "members.no_team_selected"}}</div>
+					<div class="team-list">
+						{{range .Teams}}
+						<div class="inline field">
+							<div class="ui checkbox">
+								<input name="team_{{.ID}}" id="add-member-team_{{.ID}}" type="checkbox">
+								<label for="add-member-team_{{.ID}}">{{.Name}}</label>
+							</div>
+						</div>
+						{{end}}
+						<div class="inline">
+							{{svg "octicon-plus"}} <a href="{{$.OrgLink}}/teams/new">{{ctx.Locale.Tr "org.create_new_team"}}</a>
+						</div>
+					</div>
+				</div>
+
+			</div>
+		</form>
+		<div class="actions">
+			<button class="secondary cancel button">
+				{{svg "octicon-x"}}
+				{{ctx.Locale.Tr "cancel"}}
+			</button>
+			<button class="primary ok button" type="submit">{{ctx.Locale.Tr "members.add_member"}}</button>
+		</div>
+	</article>
+</dialog>
diff --git a/templates/org/member/members.tmpl b/templates/org/member/members.tmpl
index 24d7fd09e0..08bb8b9894 100644
--- a/templates/org/member/members.tmpl
+++ b/templates/org/member/members.tmpl
@@ -4,6 +4,14 @@
 	<div class="ui container">
 		{{template "base/alert" .}}
 
+		{{if $.IsOrganizationOwner}}
+			<div class="text right">
+				<button class="primary button" id="add-org-member-button">
+				{{svg "octicon-plus"}} {{ctx.Locale.Tr "members.add_member"}}
+				</button>
+			</div>
+			<div class="divider"></div>
+		{{end}}
 		<div class="list">
 			{{range $idx, $_ := .Members}}
 				{{if ne $idx 0}}
@@ -87,5 +95,6 @@
 	</div>
 	{{template "base/modal_actions_confirm" .}}
 </div>
+{{template "org/member/add_org_member" .}}
 
 {{template "base/footer" .}}
diff --git a/templates/org/team/repositories.tmpl b/templates/org/team/repositories.tmpl
index f0f6eef0d1..782e8ca004 100644
--- a/templates/org/team/repositories.tmpl
+++ b/templates/org/team/repositories.tmpl
@@ -13,7 +13,7 @@
 						<form class="ui form ignore-dirty tw-flex-1 tw-flex" action="{{$.OrgLink}}/teams/{{$.Team.LowerName | PathEscape}}/action/repo/add" method="post">
 							<div id="search-repo-box" data-uid="{{.Org.ID}}" class="ui search">
 								<div class="ui input">
-									<input class="prompt" name="repo_name" placeholder="{{ctx.Locale.Tr "search.repo_kind"}}" autocomplete="off" required>
+									<input class="prompt" name="repo_name" placeholder="{{ctx.Locale.Tr "search.repo_kind"}}" autocomplete="off" autocorrect="off" autocapitalize="none" spellcheck="false" required>
 								</div>
 							</div>
 							<button class="ui primary button tw-ml-2">{{ctx.Locale.Tr "add"}}</button>
diff --git a/templates/package/settings.tmpl b/templates/package/settings.tmpl
index 515eddd85b..b60bb08d1e 100644
--- a/templates/package/settings.tmpl
+++ b/templates/package/settings.tmpl
@@ -53,20 +53,20 @@
 					<div class="flex-item-trailing">
 						<button class="ui basic red show-modal button" data-modal="#delete-package-modal">{{ctx.Locale.Tr "packages.settings.delete"}}</button>
 					</div>
-					<div class="ui tiny modal" id="delete-package-modal">
-						<div class="header">
-							{{ctx.Locale.Tr "packages.settings.delete"}}
-						</div>
-						<div class="content">
-							<div class="ui warning message tw-break-anywhere">
-								{{ctx.Locale.Tr "packages.settings.delete.notice" .PackageDescriptor.Package.Name .PackageDescriptor.Version.Version}}
+					<dialog id="delete-package-modal">
+						<article>
+							<header>{{ctx.Locale.Tr "packages.settings.delete"}}</header>
+							<div class="content">
+								<div class="ui warning message tw-break-anywhere">
+									{{ctx.Locale.Tr "packages.settings.delete.notice" .PackageDescriptor.Package.Name .PackageDescriptor.Version.Version}}
+								</div>
 							</div>
 							<form class="ui form" action="{{.Link}}" method="post">
 								<input type="hidden" name="action" value="delete">
 								{{template "base/modal_actions_confirm" .}}
 							</form>
-						</div>
-					</div>
+						</article>
+					</dialog>
 				</div>
 			</div>
 		</div>
diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 64def9cbca..3f7c91b35d 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -29,32 +29,31 @@
 					{{ctx.Locale.Tr "new_project_column"}}
 				</button>
 			</div>
-			<div class="ui small modal new-project-column-modal" id="new-project-column-item">
-				<div class="header">
-					{{ctx.Locale.Tr "repo.projects.column.new"}}
-				</div>
-				<div class="content">
+			<dialog id="new-project-column-item">
+				<article>
+					<header>{{ctx.Locale.Tr "repo.projects.column.new"}}</header>
 					<form class="ui form">
-						<div class="required field">
-							<label for="new_project_column">{{ctx.Locale.Tr "repo.projects.column.new_title"}}</label>
-							<input class="new-project-column" id="new_project_column" name="title" required>
-						</div>
+						<div class="content">
+							<div class="required field">
+								<label for="new_project_column">{{ctx.Locale.Tr "repo.projects.column.new_title"}}</label>
+								<input class="new-project-column" id="new_project_column" name="title" required>
+							</div>
 
-						<div class="field color-field">
-							<label for="new_project_column_color_picker">{{ctx.Locale.Tr "repo.projects.column.color"}}</label>
-							<div class="js-color-picker-input column">
-								<input maxlength="7" placeholder="#c320f6" id="new_project_column_color_picker" name="color">
-								{{template "repo/issue/label_precolors"}}
+							<div class="field color-field">
+								<label for="new_project_column_color_picker">{{ctx.Locale.Tr "repo.projects.column.color"}}</label>
+								<div class="js-color-picker-input column">
+									<input maxlength="7" placeholder="#c320f6" id="new_project_column_color_picker" name="color">
+									{{template "repo/issue/label_precolors"}}
+								</div>
 							</div>
 						</div>
-
-						<div class="text right actions">
-							<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+						<div class="actions">
+							<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
 							<button data-url="{{$.Link}}" class="ui primary button" id="new_project_column_submit">{{ctx.Locale.Tr "repo.projects.column.new_submit"}}</button>
 						</div>
 					</form>
-				</div>
-			</div>
+				</article>
+			</dialog>
 		{{end}}
 	</div>
 
@@ -101,54 +100,54 @@
 									</a>
 								{{end}}
 
-								<div class="ui small modal edit-project-column-modal" id="edit-project-column-modal-{{.ID}}">
-									<div class="header">
-										{{ctx.Locale.Tr "repo.projects.column.edit"}}
-									</div>
-									<div class="content">
+								<dialog class="edit-project-column-modal" id="edit-project-column-modal-{{.ID}}">
+									<article>
+										<header>{{ctx.Locale.Tr "repo.projects.column.edit"}}</header>
 										<form class="ui form">
-											<div class="required field">
-												<label for="new_project_column_title">{{ctx.Locale.Tr "repo.projects.column.edit_title"}}</label>
-												<input class="project-column-title-input" id="new_project_column_title" name="title" value="{{.Title}}" required>
-											</div>
-
-											<div class="field color-field">
-												<label for="new_project_column_color">{{ctx.Locale.Tr "repo.projects.column.color"}}</label>
-												<div class="js-color-picker-input column">
-													<input maxlength="7" placeholder="#c320f6" id="new_project_column_color" name="color" value="{{.Color}}">
-													{{template "repo/issue/label_precolors"}}
+											<div class="content">
+												<div class="required field">
+													<label for="new_project_column_title">{{ctx.Locale.Tr "repo.projects.column.edit_title"}}</label>
+													<input class="project-column-title-input" id="new_project_column_title" name="title" value="{{.Title}}" required>
 												</div>
-											</div>
 
-											<div class="text right actions">
-												<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+												<div class="field color-field">
+													<label for="new_project_column_color">{{ctx.Locale.Tr "repo.projects.column.color"}}</label>
+													<div class="js-color-picker-input column">
+														<input maxlength="7" placeholder="#c320f6" id="new_project_column_color" name="color" value="{{.Color}}">
+														{{template "repo/issue/label_precolors"}}
+													</div>
+												</div>
+
+											</div>
+											<div class="actions">
+												<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
 												<button data-url="{{$.Link}}/{{.ID}}" class="ui primary button edit-project-column-button">{{ctx.Locale.Tr "repo.projects.column.edit"}}</button>
 											</div>
 										</form>
-									</div>
-								</div>
+									</article>
+								</dialog>
 
-								<div class="ui g-modal-confirm modal default-project-column-modal" id="default-project-column-modal-{{.ID}}">
-									<div class="header">
-										<span id="default-project-column-header"></span>
-									</div>
-									<div class="content">
-										<label id="default-project-column-content"></label>
-									</div>
-									{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
-								</div>
+								<dialog class="default-project-column-modal" id="default-project-column-modal-{{.ID}}">
+									<article>
+										<header><span id="default-project-column-header"></span></header>
+										<div class="content">
+											<label id="default-project-column-content"></label>
+										</div>
+										{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
+									</article>
+								</dialog>
 
-								<div class="ui g-modal-confirm modal" id="delete-project-column-modal-{{.ID}}">
-									<div class="header">
-										{{ctx.Locale.Tr "repo.projects.column.delete"}}
-									</div>
-									<div class="content">
-										<label>
-											{{ctx.Locale.Tr "repo.projects.column.deletion_desc"}}
-										</label>
-									</div>
-									{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
-								</div>
+								<dialog id="delete-project-column-modal-{{.ID}}">
+									<article>
+										<header>{{ctx.Locale.Tr "repo.projects.column.delete"}}</header>
+										<div class="content">
+											<label>
+												{{ctx.Locale.Tr "repo.projects.column.deletion_desc"}}
+											</label>
+										</div>
+										{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
+									</article>
+								</dialog>
 							</div>
 						</div>
 					{{end}}
diff --git a/templates/repo/actions/view.tmpl b/templates/repo/actions/view.tmpl
index 04aced83d1..e005ee412d 100644
--- a/templates/repo/actions/view.tmpl
+++ b/templates/repo/actions/view.tmpl
@@ -17,6 +17,9 @@
 		data-locale-cancel="{{ctx.Locale.Tr "cancel"}}"
 		data-locale-rerun="{{ctx.Locale.Tr "rerun"}}"
 		data-locale-rerun-all="{{ctx.Locale.Tr "rerun_all"}}"
+		data-locale-delete="{{ctx.Locale.Tr "actions.runs.delete.button"}}"
+		data-locale-delete-error="{{ctx.Locale.Tr "actions.runs.delete.error"}}"
+		data-locale-confirm-delete="{{ctx.Locale.Tr "actions.runs.delete.confirm_action"}}"
 		data-locale-status-unknown="{{ctx.Locale.Tr "actions.status.unknown"}}"
 		data-locale-status-waiting="{{ctx.Locale.Tr "actions.status.waiting"}}"
 		data-locale-status-running="{{ctx.Locale.Tr "actions.status.running"}}"
diff --git a/templates/repo/commit_header.tmpl b/templates/repo/commit_header.tmpl
index dacbf43b59..3ccdebc5f1 100644
--- a/templates/repo/commit_header.tmpl
+++ b/templates/repo/commit_header.tmpl
@@ -55,25 +55,28 @@
 								data-modal-cherry-pick-header="{{ctx.Locale.Tr "repo.commit.cherry-pick-header" (ShortSha .CommitID)}}"
 								data-modal-cherry-pick-content="{{ctx.Locale.Tr "repo.commit.cherry-pick-content"}}"
 								data-modal-cherry-pick-submit="{{ctx.Locale.Tr "repo.commit.cherry-pick"}}">{{ctx.Locale.Tr "repo.commit.cherry-pick"}}</div>
-							<div class="ui g-modal-confirm modal" id="cherry-pick-modal">
-								<div class="header">
-									<span id="cherry-pick-header"></span>
-								</div>
-								<div class="content">
-									<p id="cherry-pick-content" class="branch-dropdown"></p>
-									{{template "repo/branch_dropdown" dict "root" .
-										"noTag" true "disableCreateBranch" true
-										"branchForm" "branch-dropdown-form"
-										"branchURLPrefix" (printf "%s/_cherrypick/%s/" $.RepoLink .CommitID) "branchURLSuffix" ""
-										"setAction" true "submitForm" true}}
+							<dialog id="cherry-pick-modal">
+								<article>
+									<header><span id="cherry-pick-header"></span></header>
+									<div class="content">
+										<p id="cherry-pick-content" class="branch-dropdown"></p>
+										{{template "repo/branch_dropdown" dict "root" .
+											"noTag" true "disableCreateBranch" true
+											"branchForm" "branch-dropdown-form"
+											"branchURLPrefix" (printf "%s/_cherrypick/%s/" $.RepoLink .CommitID) "branchURLSuffix" ""
+											"setAction" true "submitForm" true}}
+									</div>
 									<form method="get" action="{{$.RepoLink}}/_cherrypick/{{.CommitID}}/{{PathEscapeSegments $.Repository.DefaultBranch}}" id="branch-dropdown-form">
 										<input type="hidden" name="ref" value="{{$.Repository.DefaultBranch}}">
 										<input type="hidden" name="refType" value="branch">
 										<input type="hidden" id="cherry-pick-type" name="cherry-pick-type"><br>
-										<button type="submit" id="cherry-pick-submit" class="ui primary button"></button>
+										<div class="actions">
+											<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+											<button type="submit" id="cherry-pick-submit" class="ui primary button"></button>
+										</div>
 									</form>
-								</div>
-							</div>
+								</article>
+							</dialog>
 							<dialog id="create-branch-modal">
 								<article>
 									<header>{{ctx.Locale.Tr "repo.branch.new_branch"}}</header>
@@ -284,20 +287,20 @@
 				<button id="commit-notes-edit-button" class="ui tiny primary button tw-py-[6px] tw-px-[10px]">{{ctx.Locale.Tr "edit"}}</button>
 				<button class="ui tiny button red show-modal tw-py-[6px] tw-px-[10px]" data-modal="#delete-note-modal">{{ctx.Locale.Tr "remove"}}</button>
 			</div>
-			<div class="ui small modal" id="delete-note-modal">
-				<div class="header">
-					{{ctx.Locale.Tr "repo.diff.git-notes.remove-header"}}
-				</div>
-				<div class="content">
-					<p>{{ctx.Locale.Tr "repo.diff.git-notes.remove-body"}}</p>
-					<div class="text right actions">
-						<form action="{{.Link}}/notes/remove" method="post">
+			<dialog id="delete-note-modal">
+				<article>
+					<header>{{ctx.Locale.Tr "repo.diff.git-notes.remove-header"}}</header>
+					<div class="content">
+						<p>{{ctx.Locale.Tr "repo.diff.git-notes.remove-body"}}</p>
+					</div>
+					<form action="{{.Link}}/notes/remove" method="post">
+						<div class="text right actions">
 							<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
 							<button type="submit" class="ui red button">{{ctx.Locale.Tr "remove"}}</button>
-						</form>
-					</div>
-				</div>
-			</div>
+						</div>
+					</form>
+				</article>
+			</dialog>
 		{{end}}
 	</div>
 	<div id="commit-notes-display-area" class="ui bottom attached info segment git-notes">
diff --git a/templates/repo/commits.tmpl b/templates/repo/commits.tmpl
index e6efe1ff54..b9ea9c790a 100644
--- a/templates/repo/commits.tmpl
+++ b/templates/repo/commits.tmpl
@@ -10,6 +10,7 @@
 					{{svg "octicon-git-branch"}}
 					{{ctx.Locale.Tr "repo.commit_graph"}}
 				</a>
+				{{template "repo/filepath" .}}
 			</div>
 		</div>
 		{{template "repo/commits_table" .}}
diff --git a/templates/repo/commits_table.tmpl b/templates/repo/commits_table.tmpl
index be6462b269..87feb06a98 100644
--- a/templates/repo/commits_table.tmpl
+++ b/templates/repo/commits_table.tmpl
@@ -1,7 +1,7 @@
 <h4 class="ui top attached header commits-table tw-flex tw-items-center tw-justify-between">
 	<div class="commits-table-left tw-flex tw-items-center">
 		{{if or .PageIsCommits (gt .CommitCount 0)}}
-			{{ctx.Locale.TrN .CommitCount "repo.n_commit_one" "repo.n_commit_few" (ctx.Locale.PrettyNumber .CommitCount)}}
+			{{ctx.Locale.TrPluralString .CommitCount "counters.n_commits" (ctx.Locale.PrettyNumber .CommitCount)}}
 		{{else if .IsNothingToCompare}}
 			{{ctx.Locale.Tr "repo.commits.nothing_to_compare"}}
 		{{else}}
diff --git a/templates/repo/create_basic.tmpl b/templates/repo/create_basic.tmpl
index 90545c2769..72024f19c9 100644
--- a/templates/repo/create_basic.tmpl
+++ b/templates/repo/create_basic.tmpl
@@ -35,7 +35,7 @@
 </label>
 <label {{if .Err_RepoName}}class="field error"{{end}}>
 	{{ctx.Locale.Tr "repo.repo_name"}}
-	<input name="repo_name" value="{{.repo_name}}" required maxlength="100">
+	<input name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 	<span class="help">{{ctx.Locale.Tr "repo.repo_name_helper"}}</span>
 </label>
 <label>
diff --git a/templates/repo/diff/box.tmpl b/templates/repo/diff/box.tmpl
index f3c0c0989d..7577ff0921 100644
--- a/templates/repo/diff/box.tmpl
+++ b/templates/repo/diff/box.tmpl
@@ -201,7 +201,7 @@
 										{{end}}
 									</div>
 								{{else}}
-									<table class="chroma" data-new-comment-url="{{$.Issue.Link}}/files/reviews/new_comment" data-path="{{$file.Name}}">
+									<table class="chroma" data-new-comment-url="{{$.Issue.Link}}/files/reviews/new_comment?before_commit_id={{$.BeforeCommitID}}&after_commit_id={{$.AfterCommitID}}" data-path="{{$file.Name}}">
 										{{if $.IsSplitStyle}}
 											{{template "repo/diff/section_split" dict "file" . "root" $}}
 										{{else}}
diff --git a/templates/repo/diff/comment_form.tmpl b/templates/repo/diff/comment_form.tmpl
index 922f3f3d73..7b64be71a0 100644
--- a/templates/repo/diff/comment_form.tmpl
+++ b/templates/repo/diff/comment_form.tmpl
@@ -1,6 +1,7 @@
 {{if and $.root.SignedUserID (not $.Repository.IsArchived)}}
 	<form class="ui form {{if $.hidden}}tw-hidden comment-form tw-mt-2{{end}}" action="{{$.root.Issue.Link}}/files/reviews/comments" method="post">
 		<input type="hidden" name="origin" value="{{if $.root.PageIsPullFiles}}diff{{else}}timeline{{end}}">
+		<input type="hidden" name="before_commit_id" value="{{$.root.BeforeCommitID}}">
 		<input type="hidden" name="latest_commit_id" value="{{$.root.AfterCommitID}}">
 		<input type="hidden" name="side" value="{{if $.Side}}{{$.Side}}{{end}}">
 		<input type="hidden" name="line" value="{{if $.Line}}{{$.Line}}{{end}}">
diff --git a/templates/repo/editor/diff_preview.tmpl b/templates/repo/editor/diff_preview.tmpl
index e2e922be34..be36e84053 100644
--- a/templates/repo/editor/diff_preview.tmpl
+++ b/templates/repo/editor/diff_preview.tmpl
@@ -1,4 +1,4 @@
-<div class="diff-file-box">
+<div class="diff-file-box {{TabSizeClass $.Editorconfig .File.Name}}">
 	<div class="ui attached table segment">
 		<div class="file-body file-code code-diff code-diff-unified unicode-escaped">
 			<table>
diff --git a/templates/repo/filepath.tmpl b/templates/repo/filepath.tmpl
new file mode 100644
index 0000000000..6473ffd356
--- /dev/null
+++ b/templates/repo/filepath.tmpl
@@ -0,0 +1,17 @@
+{{$n := len .TreeNames}}
+{{$l := Eval $n "-" 1}}
+{{$showFilePath := (gt $n 0)}}
+{{if $showFilePath}}
+	<span class="breadcrumb repo-path tw-ml-1">
+		<a class="section" href="{{$.BranchLink}}" title="{{.Repository.Name}}">{{StringUtils.EllipsisString .Repository.Name 30}}</a>
+		{{- range $i, $v := .TreeNames -}}
+			<span class="breadcrumb-divider">/</span>
+			{{- if eq $i $l -}}
+				<span class="active section" title="{{$v}}">{{$v}}</span>
+				<button class="btn interact-fg tw-p-2" data-clipboard-text="{{$.TreePath}}" data-tooltip-content="{{ctx.Locale.Tr "copy_path"}}">{{svg "octicon-copy" 14}}</button>
+			{{- else -}}
+				{{$p := index $.Paths $i}}<span class="section"><a href="{{$.BranchLink}}/{{PathEscapeSegments $p}}" title="{{$v}}">{{$v}}</a></span>
+			{{- end -}}
+		{{- end -}}
+	</span>
+{{end}}
diff --git a/templates/repo/header_fork.tmpl b/templates/repo/header_fork.tmpl
index 0001be1025..95df5f4227 100644
--- a/templates/repo/header_fork.tmpl
+++ b/templates/repo/header_fork.tmpl
@@ -26,24 +26,24 @@
 		>
 			{{svg "octicon-repo-forked"}}<span class="text not-mobile">{{ctx.Locale.Tr "repo.fork"}}</span>
 		</a>
-		<div class="ui small modal" id="fork-repo-modal">
-			<div class="header">
-				{{ctx.Locale.Tr "repo.already_forked" .Name}}
-			</div>
-			<div class="content tw-text-left">
-				<div class="ui list">
-					{{range $.UserAndOrgForks}}
-						<div class="ui item tw-py-2">
-							<a href="{{.Link}}">{{svg "octicon-repo-forked" 16 "tw-mr-2"}}{{.FullName}}</a>
-						</div>
+		<dialog id="fork-repo-modal">
+			<article>
+				<header>{{ctx.Locale.Tr "repo.already_forked" .Name}}</header>
+				<div class="content tw-text-left">
+					<div class="ui list">
+						{{range $.UserAndOrgForks}}
+							<div class="ui item tw-py-2">
+								<a href="{{.Link}}">{{svg "octicon-repo-forked" 16 "tw-mr-2"}}{{.FullName}}</a>
+							</div>
+						{{end}}
+					</div>
+					{{if $.CanSignedUserFork}}
+					<div class="divider"></div>
+					<a href="{{$.RepoLink}}/fork">{{ctx.Locale.Tr "repo.fork_to_different_account"}}</a>
 					{{end}}
 				</div>
-				{{if $.CanSignedUserFork}}
-				<div class="divider"></div>
-				<a href="{{$.RepoLink}}/fork">{{ctx.Locale.Tr "repo.fork_to_different_account"}}</a>
-				{{end}}
-			</div>
-		</div>
+			</article>
+		</dialog>
 		<a class="ui basic label" href="{{.Link}}/forks"
 			aria-label="{{ctx.Locale.TrPluralString .NumForks "fork.n_forks" (printf "%d" .NumForks)}}"
 			>
diff --git a/templates/repo/home.tmpl b/templates/repo/home.tmpl
index eb27af5d54..601605ba44 100644
--- a/templates/repo/home.tmpl
+++ b/templates/repo/home.tmpl
@@ -102,20 +102,7 @@
 						{{ctx.Locale.Tr "repo.use_template"}}
 					</a>
 				{{end}}
-				{{if (not $isHomepage)}}
-					<span class="breadcrumb repo-path tw-ml-1">
-						<a class="section" href="{{.RepoLink}}/src/{{.BranchNameSubURL}}" title="{{.Repository.Name}}">{{StringUtils.EllipsisString .Repository.Name 30}}</a>
-						{{- range $i, $v := .TreeNames -}}
-							<span class="breadcrumb-divider">/</span>
-							{{- if eq $i $l -}}
-								<span class="active section" title="{{$v}}">{{$v}}</span>
-								<button class="btn interact-fg tw-p-2" data-clipboard-text="{{$.TreePath}}" data-tooltip-content="{{ctx.Locale.Tr "copy_path"}}">{{svg "octicon-copy" 14}}</button>
-							{{- else -}}
-								{{$p := index $.Paths $i}}<span class="section"><a href="{{$.BranchLink}}/{{PathEscapeSegments $p}}" title="{{$v}}">{{$v}}</a></span>
-							{{- end -}}
-						{{- end -}}
-					</span>
-				{{end}}
+				{{template "repo/filepath" .}}
 			</div>
 			<div class="tw-flex tw-items-center max-[390px]:tw-w-full">
 				<!-- Only show clone panel in repository home page -->
diff --git a/templates/repo/issue/new_form.tmpl b/templates/repo/issue/new_form.tmpl
index 10a5978d52..5f5820fb07 100644
--- a/templates/repo/issue/new_form.tmpl
+++ b/templates/repo/issue/new_form.tmpl
@@ -78,7 +78,7 @@
 			</div>
 		</div>
 
-		{{if .IsProjectsEnabled}}
+		{{if or .IsProjectsEnabled (and .OwnerHasProjects .IsOwnerProjectsEnabled)}}
 		<div class="divider"></div>
 
 		<input id="project_id" name="project_id" type="hidden" value="{{.project_id}}">
diff --git a/templates/repo/issue/view_content.tmpl b/templates/repo/issue/view_content.tmpl
index 08a8daade9..235112b47b 100644
--- a/templates/repo/issue/view_content.tmpl
+++ b/templates/repo/issue/view_content.tmpl
@@ -110,14 +110,14 @@
 												</span>
 											</button>
 										{{else}}
-											{{$closeTranslationKey := "repo.issues.close"}}
+											{{$closeTranslation := ctx.Locale.Tr "repo.issues.close"}}
 											{{if .Issue.IsPull}}
-												{{$closeTranslationKey = "repo.pulls.close"}}
+												{{$closeTranslation = ctx.Locale.Tr "repo.pulls.close"}}
 											{{end}}
-											<button id="status-button" class="secondary button" data-status="{{ctx.Locale.Tr $closeTranslationKey}}" data-status-and-comment="{{ctx.Locale.Tr "repo.issues.close_comment_issue"}}" name="status" value="close">
+											<button id="status-button" class="secondary button" data-status="{{$closeTranslation}}" data-status-and-comment="{{ctx.Locale.Tr "repo.issues.close_comment_issue"}}" name="status" value="close">
 												{{svg "octicon-issue-closed"}}
 												<span>
-													{{ctx.Locale.Tr $closeTranslationKey}}
+													{{$closeTranslation}}
 												</span>
 											</button>
 										{{end}}
diff --git a/templates/repo/issue/view_content/comments.tmpl b/templates/repo/issue/view_content/comments.tmpl
index bde6a0b5b2..b3de7ed155 100644
--- a/templates/repo/issue/view_content/comments.tmpl
+++ b/templates/repo/issue/view_content/comments.tmpl
@@ -129,13 +129,13 @@
 			{{if ne .RefRepoID .Issue.RepoID}}
 				{{$refFrom = ctx.Locale.Tr "repo.issues.ref_from" .RefRepo.FullName}}
 			{{end}}
-			{{$refTr := "repo.issues.ref_issue_from"}}
+			{{$refTr := "issue"}}
 			{{if .Issue.IsPull}}
-				{{$refTr = "repo.issues.ref_pull_from"}}
+				{{$refTr = "pull"}}
 			{{else if eq .RefAction 1}}
-				{{$refTr = "repo.issues.ref_closing_from"}}
+				{{$refTr = "closing"}}
 			{{else if eq .RefAction 2}}
-				{{$refTr = "repo.issues.ref_reopening_from"}}
+				{{$refTr = "reopening"}}
 			{{end}}
 			<div class="timeline-item event" id="{{.HashTag}}">
 				<span class="badge">{{svg "octicon-bookmark"}}</span>
@@ -143,7 +143,7 @@
 				{{if eq .RefAction 3}}<del>{{end}}
 				<span class="text grey muted-links">
 					{{template "shared/user/authorlink" .Poster}}
-					{{ctx.Locale.Tr $refTr $createdStr (.RefCommentLink ctx) $refFrom}}
+					{{ctx.Locale.Tr (printf "repo.issues.ref_%s_from" $refTr) $createdStr (.RefCommentLink ctx) $refFrom}}
 				</span>
 				{{if eq .RefAction 3}}</del>{{end}}
 
diff --git a/templates/repo/issue/view_content/pull.tmpl b/templates/repo/issue/view_content/pull.tmpl
index b5cce664a3..ca9b943fa2 100644
--- a/templates/repo/issue/view_content/pull.tmpl
+++ b/templates/repo/issue/view_content/pull.tmpl
@@ -1,3 +1,9 @@
+{{$prUnit := .Repository.MustGetUnit $.Context $.UnitTypePullRequests}}
+{{$prConfig := $prUnit.PullRequestsConfig}}
+{{$fastForwardStyleAllowed := and $prConfig.AllowFastForwardOnly (eq .Issue.PullRequest.CommitsBehind 0)}}
+{{$manualMergeStyleAllowed := $prConfig.AllowManualMerge}}
+{{$hasUnsignedMergeStyle := or $fastForwardStyleAllowed $manualMergeStyleAllowed}}
+{{$signingBlocksAllMergeStyles := and .AllowMerge .RequireSigned (not .WillSign) (not $hasUnsignedMergeStyle)}}
 {{if and .Issue.PullRequest.HasMerged (not .IsPullBranchDeletable)}}
 {{/* Then the merge box will not be displayed because this page already contains enough information */}}
 {{else}}
@@ -14,7 +20,7 @@
 	{{- else if .IsBlockedByChangedProtectedFiles}}red
 	{{- else if and .EnableStatusCheck (or .RequiredStatusCheckState.IsFailure .RequiredStatusCheckState.IsError)}}red
 	{{- else if and .EnableStatusCheck (or (not $.LatestCommitStatus) .RequiredStatusCheckState.IsPending .RequiredStatusCheckState.IsWarning)}}yellow
-	{{- else if and .AllowMerge .RequireSigned (not .WillSign)}}red
+	{{- else if $signingBlocksAllMergeStyles}}red
 	{{- else if .Issue.PullRequest.IsChecking}}yellow
 	{{- else if .Issue.PullRequest.IsEmpty}}grey
 	{{- else if .Issue.PullRequest.CanAutoMerge}}green
@@ -148,7 +154,7 @@
 						{{svg "octicon-x"}}
 						{{ctx.Locale.Tr "repo.pulls.required_status_check_missing"}}
 					</div>
-				{{else if and .AllowMerge .RequireSigned (not .WillSign)}}
+				{{else if $signingBlocksAllMergeStyles}}
 					<div class="item">
 						{{svg "octicon-x"}}
 						{{ctx.Locale.Tr "repo.pulls.require_signed_wont_sign"}}
@@ -162,7 +168,7 @@
 				{{$notAllOverridableChecksOk := or .IsBlockedByApprovals .IsBlockedByRejection .IsBlockedByOfficialReviewRequests .IsBlockedByOutdatedBranch .IsBlockedByChangedProtectedFiles (and .EnableStatusCheck (not .RequiredStatusCheckState.IsSuccess))}}
 
 				{{/* admin can merge without checks, writer can merge when checks succeed */}}
-				{{$canMergeNow := and (or (and $.IsRepoAdmin (not .ProtectedBranch.ApplyToAdmins)) (not $notAllOverridableChecksOk)) (or (not .AllowMerge) (not .RequireSigned) .WillSign)}}
+				{{$canMergeNow := and (or (and $.IsRepoAdmin (not .ProtectedBranch.ApplyToAdmins)) (not $notAllOverridableChecksOk)) (or (not .AllowMerge) (not $signingBlocksAllMergeStyles))}}
 				{{/* admin and writer both can make an auto merge schedule */}}
 
 				{{if $canMergeNow}}
@@ -201,8 +207,7 @@
 				{{end}}
 
 				{{if .AllowMerge}} {{/* user is allowed to merge */}}
-					{{$prUnit := .Repository.MustGetUnit $.Context $.UnitTypePullRequests}}
-					{{if or $prUnit.PullRequestsConfig.AllowMerge $prUnit.PullRequestsConfig.AllowRebase $prUnit.PullRequestsConfig.AllowRebaseMerge $prUnit.PullRequestsConfig.AllowSquash $prUnit.PullRequestsConfig.AllowFastForwardOnly $prUnit.PullRequestsConfig.AllowManualMerge}}
+					{{if or $prConfig.AllowMerge $prConfig.AllowRebase $prConfig.AllowRebaseMerge $prConfig.AllowSquash $prConfig.AllowFastForwardOnly $prConfig.AllowManualMerge}}
 						{{$hasPendingPullRequestMergeTip := ""}}
 						{{if .HasPendingPullRequestMerge}}
 							{{$createdPRMergeStr := DateUtils.TimeSince .PendingPullRequestMerge.CreatedUnix}}
@@ -231,7 +236,7 @@
 								'pullHeadCommitID': {{.PullHeadCommitID}},
 								'isPullBranchDeletable': {{.IsPullBranchDeletable}},
 								'defaultMergeStyle': {{.MergeStyle}},
-								'defaultDeleteBranchAfterMerge': {{$prUnit.PullRequestsConfig.DefaultDeleteBranchAfterMerge}},
+								'defaultDeleteBranchAfterMerge': {{$prConfig.DefaultDeleteBranchAfterMerge}},
 								'mergeMessageFieldPlaceHolder': {{ctx.Locale.Tr "repo.editor.commit_message_desc"}},
 								'defaultMergeMessage': defaultMergeMessage,
 
@@ -243,7 +248,7 @@
 							mergeForm['mergeStyles'] = [
 								{
 									'name': 'merge',
-									'allowed': {{$prUnit.PullRequestsConfig.AllowMerge}},
+									'allowed': {{and $prConfig.AllowMerge (or (not .RequireSigned) .WillSign)}},
 									'textDoMerge': {{ctx.Locale.Tr "repo.pulls.merge_pull_request"}},
 									'mergeTitleFieldText': defaultMergeTitle,
 									'mergeMessageFieldText': defaultMergeMessage,
@@ -251,14 +256,14 @@
 								},
 								{
 									'name': 'rebase',
-									'allowed': {{$prUnit.PullRequestsConfig.AllowRebase}},
+									'allowed': {{and $prConfig.AllowRebase (or (not .RequireSigned) .WillSign)}},
 									'textDoMerge': {{ctx.Locale.Tr "repo.pulls.rebase_merge_pull_request"}},
 									'hideMergeMessageTexts': true,
 									'hideAutoMerge': generalHideAutoMerge,
 								},
 								{
 									'name': 'rebase-merge',
-									'allowed': {{$prUnit.PullRequestsConfig.AllowRebaseMerge}},
+									'allowed': {{and $prConfig.AllowRebaseMerge (or (not .RequireSigned) .WillSign)}},
 									'textDoMerge': {{ctx.Locale.Tr "repo.pulls.rebase_merge_commit_pull_request"}},
 									'mergeTitleFieldText': defaultMergeTitle,
 									'mergeMessageFieldText': defaultMergeMessage,
@@ -266,7 +271,7 @@
 								},
 								{
 									'name': 'squash',
-									'allowed': {{$prUnit.PullRequestsConfig.AllowSquash}},
+									'allowed': {{and $prConfig.AllowSquash (or (not .RequireSigned) .WillSign)}},
 									'textDoMerge': {{ctx.Locale.Tr "repo.pulls.squash_merge_pull_request"}},
 									'mergeTitleFieldText': defaultSquashMergeTitle,
 									'mergeMessageFieldText': {{.GetCommitMessages}} + defaultSquashMergeMessage,
@@ -274,14 +279,14 @@
 								},
 								{
 									'name': 'fast-forward-only',
-									'allowed': {{and $prUnit.PullRequestsConfig.AllowFastForwardOnly (eq .Issue.PullRequest.CommitsBehind 0)}},
+									'allowed': {{$fastForwardStyleAllowed}},
 									'textDoMerge': {{ctx.Locale.Tr "repo.pulls.fast_forward_only_merge_pull_request"}},
 									'hideMergeMessageTexts': true,
 									'hideAutoMerge': generalHideAutoMerge,
 								},
 								{
 									'name': 'manually-merged',
-									'allowed': {{$prUnit.PullRequestsConfig.AllowManualMerge}},
+									'allowed': {{$manualMergeStyleAllowed}},
 									'textDoMerge': {{ctx.Locale.Tr "repo.pulls.merge_manually"}},
 									'hideMergeMessageTexts': true,
 									'hideAutoMerge': true,
@@ -293,7 +298,7 @@
 						{{$showGeneralMergeForm = true}}
 						<div id="pull-request-merge-form"></div>
 					{{else}}
-						{{/* no merge style was set in repo setting: not or ($prUnit.PullRequestsConfig.AllowMerge ...) */}}
+						{{/* no merge style was set in repo setting: not or ($prConfig.AllowMerge ...) */}}
 						<div class="divider"></div>
 						<div class="item text red">
 							{{svg "octicon-x"}}
@@ -349,7 +354,7 @@
 						{{svg "octicon-x"}}
 						{{ctx.Locale.Tr "repo.pulls.required_status_check_failed"}}
 					</div>
-				{{else if and .RequireSigned (not .WillSign)}}
+				{{else if $signingBlocksAllMergeStyles}}
 					<div class="item text red">
 						{{svg "octicon-x"}}
 						{{ctx.Locale.Tr "repo.pulls.require_signed_wont_sign"}}
diff --git a/templates/repo/issue/view_content/sidebar.tmpl b/templates/repo/issue/view_content/sidebar.tmpl
index 72e214c5aa..9d8db413fa 100644
--- a/templates/repo/issue/view_content/sidebar.tmpl
+++ b/templates/repo/issue/view_content/sidebar.tmpl
@@ -14,8 +14,10 @@
 	{{template "repo/issue/view_content/sidebar/milestones" .}}
 	<div class="divider"></div>
 
-	{{template "repo/issue/view_content/sidebar/projects" .}}
-	<div class="divider"></div>
+	{{if or .IsProjectsEnabled (and .OwnerHasProjects .IsOwnerProjectsEnabled)}}
+		{{template "repo/issue/view_content/sidebar/projects" .}}
+		<div class="divider"></div>
+	{{end}}
 
 	{{template "repo/issue/view_content/sidebar/assignees" dict "isExistingIssue" true "." .}}
 	<div class="divider"></div>
diff --git a/templates/repo/issue/view_content/sidebar/actions.tmpl b/templates/repo/issue/view_content/sidebar/actions.tmpl
index d9fda9b296..0147e10193 100644
--- a/templates/repo/issue/view_content/sidebar/actions.tmpl
+++ b/templates/repo/issue/view_content/sidebar/actions.tmpl
@@ -21,32 +21,32 @@
 		{{ctx.Locale.Tr "repo.issues.lock"}}
 	{{end}}
 </button>
-<div class="ui tiny modal" id="lock">
-	<div class="header">
-		{{if .Issue.IsLocked}}
-			{{ctx.Locale.Tr "repo.issues.unlock.title"}}
-		{{else}}
-			{{ctx.Locale.Tr "repo.issues.lock.title"}}
-		{{end}}
-	</div>
-	<div class="content">
-		<div class="ui warning message">
+<dialog class="tw-overflow-visible" id="lock">
+	<article>
+		<header>
 			{{if .Issue.IsLocked}}
-				{{ctx.Locale.Tr "repo.issues.unlock.notice_1"}}<br>
-				{{ctx.Locale.Tr "repo.issues.unlock.notice_2"}}<br>
+				{{ctx.Locale.Tr "repo.issues.unlock.title"}}
 			{{else}}
-				{{ctx.Locale.Tr "repo.issues.lock.notice_1"}}<br>
-				{{ctx.Locale.Tr "repo.issues.lock.notice_2"}}<br>
-				{{ctx.Locale.Tr "repo.issues.lock.notice_3"}}<br>
+				{{ctx.Locale.Tr "repo.issues.lock.title"}}
 			{{end}}
+		</header>
+		<div class="content">
+			<div class="ui warning message">
+				{{if .Issue.IsLocked}}
+					{{ctx.Locale.Tr "repo.issues.unlock.notice_1"}}<br>
+					{{ctx.Locale.Tr "repo.issues.unlock.notice_2"}}<br>
+				{{else}}
+					{{ctx.Locale.Tr "repo.issues.lock.notice_1"}}<br>
+					{{ctx.Locale.Tr "repo.issues.lock.notice_2"}}<br>
+					{{ctx.Locale.Tr "repo.issues.lock.notice_3"}}<br>
+				{{end}}
+			</div>
 		</div>
-
-		<form class="ui form form-fetch-action" action="{{.Issue.Link}}{{if .Issue.IsLocked}}/unlock{{else}}/lock{{end}}"
-			method="post">
-
+		<form class="ui form form-fetch-action" action="{{.Issue.Link}}{{if .Issue.IsLocked}}/unlock{{else}}/lock{{end}}" method="post">
+			<div class="content">
 			{{if not .Issue.IsLocked}}
 				<div class="field">
-					<strong> {{ctx.Locale.Tr "repo.issues.lock.reason"}} </strong>
+					<strong>{{ctx.Locale.Tr "repo.issues.lock.reason"}}</strong>
 				</div>
 
 				<div class="field">
@@ -70,10 +70,10 @@
 					</div>
 				</div>
 			{{end}}
-
-			<div class="text right actions">
-				<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-				<button class="ui red button">
+			</div>
+			<div class="actions">
+				<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+				<button type="submit" class="ui red button">
 					{{if .Issue.IsLocked}}
 						{{ctx.Locale.Tr "repo.issues.unlock_confirm"}}
 					{{else}}
@@ -82,30 +82,32 @@
 				</button>
 			</div>
 		</form>
-	</div>
-</div>
+	</article>
+</dialog>
 <button class="tw-mt-1 fluid ui show-modal button" data-modal="#sidebar-delete-issue">
 	{{svg "octicon-trash"}}
 	{{ctx.Locale.Tr "repo.issues.delete"}}
 </button>
-<div class="ui g-modal-confirm modal" id="sidebar-delete-issue">
-	<div class="header">
-		{{if .Issue.IsPull}}
-			{{ctx.Locale.Tr "repo.pulls.delete.title"}}
-		{{else}}
-			{{ctx.Locale.Tr "repo.issues.delete.title"}}
-		{{end}}
-	</div>
-	<div class="content">
-		<p>
+<dialog id="sidebar-delete-issue">
+	<article>
+		<header>
 			{{if .Issue.IsPull}}
-				{{ctx.Locale.Tr "repo.pulls.delete.text"}}
+				{{ctx.Locale.Tr "repo.pulls.delete.title"}}
 			{{else}}
-				{{ctx.Locale.Tr "repo.issues.delete.text"}}
+				{{ctx.Locale.Tr "repo.issues.delete.title"}}
 			{{end}}
-		</p>
-	</div>
-	<form action="{{.Issue.Link}}/delete" method="post">
-		{{template "base/modal_actions_confirm" .}}
-	</form>
-</div>
+		</header>
+		<div class="content">
+			<p>
+				{{if .Issue.IsPull}}
+					{{ctx.Locale.Tr "repo.pulls.delete.text"}}
+				{{else}}
+					{{ctx.Locale.Tr "repo.issues.delete.text"}}
+				{{end}}
+			</p>
+		</div>
+		<form action="{{.Issue.Link}}/delete" method="post">
+			{{template "base/modal_actions_confirm" .}}
+		</form>
+	</article>
+</dialog>
diff --git a/templates/repo/issue/view_content/sidebar/pull_reviewers.tmpl b/templates/repo/issue/view_content/sidebar/pull_reviewers.tmpl
index c770c95ac1..9a633a32ed 100644
--- a/templates/repo/issue/view_content/sidebar/pull_reviewers.tmpl
+++ b/templates/repo/issue/view_content/sidebar/pull_reviewers.tmpl
@@ -15,27 +15,29 @@
 								<a href="#" class="ui muted icon tw-flex tw-items-center show-modal" data-tooltip-content="{{ctx.Locale.Tr "repo.issues.dismiss_review"}}" data-modal="#dismiss-review-modal-{{.Review.ID}}">
 									{{svg "octicon-x" 20}}
 								</a>
-								<div class="ui small modal" id="dismiss-review-modal-{{.Review.ID}}">
-									<div class="header">
-										{{ctx.Locale.Tr "repo.issues.dismiss_review"}}
-									</div>
-									<div class="content">
-										<div class="ui warning message">
-											{{ctx.Locale.Tr "repo.issues.dismiss_review_warning"}}
+								<dialog id="dismiss-review-modal-{{.Review.ID}}">
+									<article>
+										<header>{{ctx.Locale.Tr "repo.issues.dismiss_review"}}</header>
+										<div class="content">
+											<div class="ui warning message">
+												{{ctx.Locale.Tr "repo.issues.dismiss_review_warning"}}
+											</div>
 										</div>
 										<form class="ui form dismiss-review-form" id="dismiss-review-{{.Review.ID}}" action="{{$.RepoLink}}/issues/dismiss_review" method="post">
-											<input type="hidden" name="review_id" value="{{.Review.ID}}">
-											<div class="field">
-												<label for="message">{{ctx.Locale.Tr "action.review_dismissed_reason"}}</label>
-												<input id="message" name="message">
+											<div class="content">
+												<input type="hidden" name="review_id" value="{{.Review.ID}}">
+												<div class="field">
+													<label for="message">{{ctx.Locale.Tr "action.review_dismissed_reason"}}</label>
+													<input id="message" name="message">
+												</div>
 											</div>
-											<div class="text right actions">
-												<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-												<button class="ui red button" type="submit">{{ctx.Locale.Tr "ok"}}</button>
+											<div class="actions">
+												<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+												<button type="submit" class="ui red button">{{ctx.Locale.Tr "ok"}}</button>
 											</div>
 										</form>
-									</div>
-								</div>
+									</article>
+								</dialog>
 							{{end}}
 							{{if .Review.Stale}}
 								<span data-tooltip-content="{{ctx.Locale.Tr "repo.issues.is_stale"}}">
diff --git a/templates/repo/migrate/codebase.tmpl b/templates/repo/migrate/codebase.tmpl
index c921a3bdbc..2a8bfff448 100644
--- a/templates/repo/migrate/codebase.tmpl
+++ b/templates/repo/migrate/codebase.tmpl
@@ -31,31 +31,31 @@
 
 					<div id="migrate_items">
 						<div class="inline field">
-							<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_merge_requests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.merge_requests"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 					</div>
@@ -88,7 +88,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/git.tmpl b/templates/repo/migrate/git.tmpl
index fc0a569add..bf35a68d9e 100644
--- a/templates/repo/migrate/git.tmpl
+++ b/templates/repo/migrate/git.tmpl
@@ -56,7 +56,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/gitbucket.tmpl b/templates/repo/migrate/gitbucket.tmpl
index eae80bccc6..78db4a1100 100644
--- a/templates/repo/migrate/gitbucket.tmpl
+++ b/templates/repo/migrate/gitbucket.tmpl
@@ -30,10 +30,10 @@
 					{{template "repo/migrate/options" .}}
 
 					<div class="inline field">
-						<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+						<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 						<div class="ui checkbox">
 							<input name="wiki" type="checkbox" {{if .wiki}}checked{{end}}>
-							<label>{{ctx.Locale.Tr "repo.migrate_items_wiki"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.wiki"}}</label>
 						</div>
 					</div>
 
@@ -43,35 +43,35 @@
 							<label></label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_pullrequests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.pull_requests"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="releases" type="checkbox" {{if .releases}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_releases"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.releases"}}</label>
 							</div>
 						</div>
 					</div>
@@ -104,7 +104,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/gitea.tmpl b/templates/repo/migrate/gitea.tmpl
index e000e3bb93..5fa2213763 100644
--- a/templates/repo/migrate/gitea.tmpl
+++ b/templates/repo/migrate/gitea.tmpl
@@ -26,10 +26,10 @@
 					{{template "repo/migrate/options" .}}
 
 					<div class="inline field">
-						<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+						<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 						<div class="ui checkbox">
 							<input name="wiki" type="checkbox" {{if .wiki}} checked{{end}}>
-							<label>{{ctx.Locale.Tr "repo.migrate_items_wiki"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.wiki"}}</label>
 						</div>
 					</div>
 
@@ -39,35 +39,35 @@
 							<label></label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_pullrequests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.pull_requests"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="releases" type="checkbox" {{if .releases}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_releases"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.releases"}}</label>
 							</div>
 						</div>
 					</div>
@@ -100,7 +100,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/github.tmpl b/templates/repo/migrate/github.tmpl
index c4ebfddd9a..719f8c4d33 100644
--- a/templates/repo/migrate/github.tmpl
+++ b/templates/repo/migrate/github.tmpl
@@ -29,10 +29,10 @@
 					{{template "repo/migrate/options" .}}
 
 					<div class="inline field">
-						<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+						<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 						<div class="ui checkbox">
 							<input name="wiki" type="checkbox" {{if .wiki}}checked{{end}}>
-							<label>{{ctx.Locale.Tr "repo.migrate_items_wiki"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.wiki"}}</label>
 						</div>
 					</div>
 					<div id="migrate_items">
@@ -41,35 +41,35 @@
 							<label></label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_pullrequests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.pull_requests"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="releases" type="checkbox" {{if .releases}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_releases"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.releases"}}</label>
 							</div>
 						</div>
 					</div>
@@ -102,7 +102,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/gitlab.tmpl b/templates/repo/migrate/gitlab.tmpl
index 13cdddb992..f945df3d52 100644
--- a/templates/repo/migrate/gitlab.tmpl
+++ b/templates/repo/migrate/gitlab.tmpl
@@ -26,10 +26,10 @@
 					{{template "repo/migrate/options" .}}
 
 					<div class="inline field">
-						<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+						<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 						<div class="ui checkbox">
 							<input name="wiki" type="checkbox" {{if .wiki}}checked{{end}}>
-							<label>{{ctx.Locale.Tr "repo.migrate_items_wiki"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.wiki"}}</label>
 						</div>
 					</div>
 					<div id="migrate_items">
@@ -38,35 +38,35 @@
 							<label></label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_merge_requests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.merge_requests"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="releases" type="checkbox" {{if .releases}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_releases"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.releases"}}</label>
 							</div>
 						</div>
 					</div>
@@ -99,7 +99,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/gogs.tmpl b/templates/repo/migrate/gogs.tmpl
index 58e3fff035..40a5969308 100644
--- a/templates/repo/migrate/gogs.tmpl
+++ b/templates/repo/migrate/gogs.tmpl
@@ -26,10 +26,10 @@
 					{{template "repo/migrate/options" .}}
 
 					<div class="inline field">
-						<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+						<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 						<div class="ui checkbox">
 							<input name="wiki" type="checkbox" {{if .wiki}} checked{{end}}>
-							<label>{{ctx.Locale.Tr "repo.migrate_items_wiki"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.wiki"}}</label>
 						</div>
 					</div>
 
@@ -39,21 +39,21 @@
 							<label></label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 						<!-- Gogs do not support it
@@ -61,11 +61,11 @@
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_merge_requests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.merge_requests"}}</label>
 							</div>
 							<div class="ui checkbox">
 								<input name="releases" type="checkbox" {{if .releases}} checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_releases"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.releases"}}</label>
 							</div>
 						</div>
 						-->
@@ -99,7 +99,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/migrate.tmpl b/templates/repo/migrate/migrate.tmpl
index 48ee678a13..f3fb53895a 100644
--- a/templates/repo/migrate/migrate.tmpl
+++ b/templates/repo/migrate/migrate.tmpl
@@ -1,7 +1,7 @@
 {{template "base/head" .}}
 <div role="main" aria-label="{{.Title}}" class="page-content repository new migrate">
 	<div class="ui container">
-		<h2 class="tw-mt-4">Migrate repository</h1>
+		<h2 class="tw-mt-4">{{ctx.Locale.Tr "migrate.select.title"}}</h1>
 		{{template "repo/migrate/helper" .}}
 		<div class="migrate-entries">
 			{{range .Services}}
diff --git a/templates/repo/migrate/migrating.tmpl b/templates/repo/migrate/migrating.tmpl
index a3a1baf57b..aec8c4dc68 100644
--- a/templates/repo/migrate/migrating.tmpl
+++ b/templates/repo/migrate/migrating.tmpl
@@ -51,49 +51,50 @@
 	</div>
 </div>
 
-<div class="ui small modal" id="delete-repo-modal">
-	<div class="header">
-		{{ctx.Locale.Tr "repo.settings.delete"}}
-	</div>
-	<div class="content">
-		<div class="ui warning message">
-			{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
-			{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName}}
-			{{if .Repository.NumForks}}<br>
-			{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
-			{{end}}
+<dialog id="delete-repo-modal">
+	<article>
+		<header>{{ctx.Locale.Tr "repo.settings.delete"}}</header>
+		<div class="content">
+			<div class="ui warning message">
+				{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
+				{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName}}
+				{{if .Repository.NumForks}}<br>
+				{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
+				{{end}}
+			</div>
 		</div>
 		<form class="ui form" action="{{.Link}}/settings" method="post">
-			<input type="hidden" name="action" value="delete">
-			<div class="field">
-				<label>
-					{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
-					<span class="text red">{{.Repository.FullName}}</span>
-				</label>
+			<div class="content">
+				<input type="hidden" name="action" value="delete">
+				<div class="field">
+					<label>
+						{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
+						<span class="text red">{{.Repository.FullName}}</span>
+					</label>
+				</div>
+				<div class="required field">
+					<label for="repo_name_to_delete">{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
+					<input id="repo_name_to_delete" name="repo_name" autocorrect="off" autocapitalize="none" spellcheck="false" required>
+				</div>
 			</div>
-			<div class="required field">
-				<label for="repo_name_to_delete">{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
-				<input id="repo_name_to_delete" name="repo_name" required>
-			</div>
-
-			<div class="text right actions">
-				<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-				<button class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_delete"}}</button>
+			<div class="actions">
+				<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+				<button type="submit" class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_delete"}}</button>
 			</div>
 		</form>
-	</div>
-</div>
+	</article>
+</dialog>
 
-<div class="ui g-modal-confirm modal" id="cancel-repo-modal">
-	<div class="header">
-		{{ctx.Locale.Tr "repo.migrate.cancel_migrating_title"}}
-	</div>
-	<form action="{{.Link}}/settings/migrate/cancel" method="post">
-		<div class="content">
-			{{ctx.Locale.Tr "repo.migrate.cancel_migrating_confirm"}}
-		</div>
-		{{template "base/modal_actions_confirm" .}}
-	</form>
-</div>
+<dialog id="cancel-repo-modal">
+	<article>
+		<header>{{ctx.Locale.Tr "migrate.cancel.title"}}</header>
+		<form action="{{.Link}}/settings/migrate/cancel" method="post">
+			<div class="content">
+				{{ctx.Locale.Tr "migrate.cancel.confirmation"}}
+			</div>
+			{{template "base/modal_actions_confirm" .}}
+		</form>
+	</article>
+</dialog>
 
 {{template "base/footer" .}}
diff --git a/templates/repo/migrate/onedev.tmpl b/templates/repo/migrate/onedev.tmpl
index 3024142648..3846286429 100644
--- a/templates/repo/migrate/onedev.tmpl
+++ b/templates/repo/migrate/onedev.tmpl
@@ -31,31 +31,31 @@
 
 					<div id="migrate_items">
 						<div class="inline field">
-							<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_pullrequests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.pull_requests"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 					</div>
@@ -88,7 +88,7 @@
 
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/migrate/pagure.tmpl b/templates/repo/migrate/pagure.tmpl
index be71827e7f..261e289d51 100644
--- a/templates/repo/migrate/pagure.tmpl
+++ b/templates/repo/migrate/pagure.tmpl
@@ -22,36 +22,36 @@
 					</div>
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100">
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					{{template "repo/migrate/options" .}}
 					<div id="migrate_items">
 						<div class="inline field">
-							<label>{{ctx.Locale.Tr "repo.migrate_items"}}</label>
+							<label>{{ctx.Locale.Tr "migrate.items.label"}}</label>
 							<div class="ui checkbox">
 								<input name="issues" type="checkbox" {{if .issues}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_issues"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.issues"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="pull_requests" type="checkbox" {{if .pull_requests}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_pullrequests"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.pull_requests"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="labels" type="checkbox" {{if .labels}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_labels"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.labels"}}</label>
 							</div>
 						</div>
 						<div class="inline field">
 							<label></label>
 							<div class="ui checkbox">
 								<input name="milestones" type="checkbox" {{if .milestones}}checked{{end}}>
-								<label>{{ctx.Locale.Tr "repo.migrate_items_milestones"}}</label>
+								<label>{{ctx.Locale.Tr "migrate.items.milestones"}}</label>
 							</div>
 						</div>
 					</div>
diff --git a/templates/repo/pulls/fork.tmpl b/templates/repo/pulls/fork.tmpl
index 52e0a61222..262c1759ee 100644
--- a/templates/repo/pulls/fork.tmpl
+++ b/templates/repo/pulls/fork.tmpl
@@ -40,7 +40,7 @@
 					</div>
 					<div class="inline required field {{if .Err_RepoName}}error{{end}}">
 						<label for="repo_name">{{ctx.Locale.Tr "repo.repo_name"}}</label>
-						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required>
+						<input id="repo_name" name="repo_name" value="{{.repo_name}}" required autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
 					<div class="inline field">
 						<label>{{ctx.Locale.Tr "repo.visibility"}}</label>
diff --git a/templates/repo/release_tag_header.tmpl b/templates/repo/release_tag_header.tmpl
index 9044bd6043..0e39076aca 100644
--- a/templates/repo/release_tag_header.tmpl
+++ b/templates/repo/release_tag_header.tmpl
@@ -4,9 +4,9 @@
 {{if $canReadReleases}}
 	<div class="list-header tw-justify-between">
 		<div class="switch">
-			<a class="{{if and .PageIsReleaseList (not .PageIsSingleTag)}}active {{end}}item" href="{{.RepoLink}}/releases{{if .Keyword}}?q={{.Keyword}}{{end}}">{{ctx.Locale.TrN .NumReleases "repo.n_release_one" "repo.n_release_few" (ctx.Locale.PrettyNumber .NumReleases)}}</a>
+			<a class="{{if and .PageIsReleaseList (not .PageIsSingleTag)}}active {{end}}item" href="{{.RepoLink}}/releases{{if .Keyword}}?q={{.Keyword}}{{end}}">{{ctx.Locale.TrPluralString .NumReleases "counters.n_releases" (ctx.Locale.PrettyNumber .NumReleases)}}</a>
 			{{if $canReadCode}}
-				<a class="{{if or .PageIsTagList .PageIsSingleTag}}active {{end}}item" href="{{.RepoLink}}/tags{{if .Keyword}}?q={{.Keyword}}{{end}}">{{ctx.Locale.TrN .NumTags "repo.n_tag_one" "repo.n_tag_few" (ctx.Locale.PrettyNumber .NumTags)}}</a>
+				<a class="{{if or .PageIsTagList .PageIsSingleTag}}active {{end}}item" href="{{.RepoLink}}/tags{{if .Keyword}}?q={{.Keyword}}{{end}}">{{ctx.Locale.TrPluralString .NumTags "counters.n_tags" (ctx.Locale.PrettyNumber .NumTags)}}</a>
 			{{end}}
 		</div>
 		{{if .ShowReleaseSearch}}
diff --git a/templates/repo/settings/lfs.tmpl b/templates/repo/settings/lfs.tmpl
index 2d17e29848..a004685c60 100644
--- a/templates/repo/settings/lfs.tmpl
+++ b/templates/repo/settings/lfs.tmpl
@@ -34,19 +34,17 @@
 		</table>
 		{{template "base/paginate" .}}
 		{{range .LFSFiles}}
-			<div class="ui g-modal-confirm modal" id="delete-{{.Oid}}">
-				<div class="header">
-					{{ctx.Locale.Tr "repo.settings.lfs_delete" .Oid}}
-				</div>
-				<div class="content">
-					<p>
-						{{ctx.Locale.Tr "repo.settings.lfs_delete_warning"}}
-					</p>
+			<dialog id="delete-{{.Oid}}">
+				<article>
+					<header>{{ctx.Locale.Tr "repo.settings.lfs_delete" .Oid}}</header>
+					<div class="content">
+						<p>{{ctx.Locale.Tr "repo.settings.lfs_delete_warning"}}</p>
+					</div>
 					<form class="ui form" action="{{$.Link}}/delete/{{.Oid}}" method="post">
 						{{template "base/modal_actions_confirm"}}
 					</form>
-				</div>
-			</div>
+				</article>
+			</dialog>
 		{{end}}
 	</div>
 {{template "repo/settings/layout_footer" .}}
diff --git a/templates/repo/settings/lfs_pointers.tmpl b/templates/repo/settings/lfs_pointers.tmpl
index fd25509e95..96eece9187 100644
--- a/templates/repo/settings/lfs_pointers.tmpl
+++ b/templates/repo/settings/lfs_pointers.tmpl
@@ -21,8 +21,8 @@
 					<tr>
 						<th class="three wide">{{ctx.Locale.Tr "repo.settings.lfs_pointers.sha"}}</th>
 						<th class="four wide">{{ctx.Locale.Tr "repo.settings.lfs_pointers.oid"}}</th>
-						<th class="two wide">{{ctx.Locale.Tr "repo.settings.lfs_pointers.inRepo"}}</th>
-						<th class="two wide">{{ctx.Locale.Tr "repo.settings.lfs_pointers.exists"}}</th>
+						<th class="two wide" data-tooltip-content="{{ctx.Locale.Tr "repo.settings.lfs_pointers.inRepo"}}">{{ctx.Locale.Tr "repo.settings.lfs_pointers.inRepo"}}</th>
+						<th class="two wide" data-tooltip-content="{{ctx.Locale.Tr "repo.settings.lfs_pointers.exists"}}">{{ctx.Locale.Tr "repo.settings.lfs_pointers.exists"}}</th>
 						<th class="two wide" data-tooltip-content="{{ctx.Locale.Tr "repo.settings.lfs_pointers.accessible"}}">{{ctx.Locale.Tr "repo.settings.lfs_pointers.accessible"}}</th>
 						<th class="three wide"></th>
 					</tr>
diff --git a/templates/repo/settings/options.tmpl b/templates/repo/settings/options.tmpl
index 137be0f334..6c8e59622f 100644
--- a/templates/repo/settings/options.tmpl
+++ b/templates/repo/settings/options.tmpl
@@ -9,7 +9,7 @@
 				<input type="hidden" name="action" value="update">
 				<div class="required field {{if .Err_RepoName}}error{{end}}">
 					<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
-					<input name="repo_name" value="{{.Repository.Name}}" data-repo-name="{{.Repository.Name}}" autofocus required>
+					<input name="repo_name" value="{{.Repository.Name}}" data-repo-name="{{.Repository.Name}}" autofocus required autocorrect="off" autocapitalize="none" spellcheck="false">
 				</div>
 				<div class="inline field">
 					<label>{{ctx.Locale.Tr "repo.repo_size"}}</label>
@@ -559,46 +559,80 @@
 
 {{if .Permission.IsOwner}}
 	{{if .Repository.IsMirror}}
-		<div class="ui small modal" id="convert-mirror-repo-modal">
-			<div class="header">
-				{{ctx.Locale.Tr "repo.settings.convert"}}
-			</div>
-			<div class="content">
-				<div class="ui warning message">
-					{{ctx.Locale.Tr "repo.settings.convert_notices_1"}}
+		<dialog id="convert-mirror-repo-modal">
+			<article>
+				<header>{{ctx.Locale.Tr "repo.settings.convert"}}</header>
+				<div class="content">
+					<div class="ui warning message">
+						{{ctx.Locale.Tr "repo.settings.convert_notices_1"}}
+					</div>
 				</div>
 				<form class="ui form" action="{{.Link}}" method="post">
-					<input type="hidden" name="action" value="convert">
-					<div class="field">
-						<label>
-							{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
-							<span class="text red">{{.Repository.FullName}}</span>
-						</label>
+					<div class="content">
+						<input type="hidden" name="action" value="convert">
+						<div class="field">
+							<label>
+								{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
+								<span class="text red">{{.Repository.FullName}}</span>
+							</label>
+						</div>
+						<div class="required field">
+							<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
+							<input name="repo_name" required maxlength="100" autocorrect="off" autocapitalize="none" spellcheck="false">
+						</div>
 					</div>
-					<div class="required field">
-						<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
-						<input name="repo_name" required maxlength="100">
-					</div>
-
-					<div class="text right actions">
-						<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-						<button class="ui red button">{{ctx.Locale.Tr "repo.settings.convert_confirm"}}</button>
+					<div class="actions">
+						<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+						<button type="submit" class="ui red button">{{ctx.Locale.Tr "repo.settings.convert_confirm"}}</button>
 					</div>
 				</form>
-			</div>
-		</div>
+			</article>
+		</dialog>
 	{{end}}
 	{{if and .Repository.IsFork .Repository.Owner.CanCreateRepo}}
-		<div class="ui small modal" id="convert-fork-repo-modal">
-			<div class="header">
-				{{ctx.Locale.Tr "repo.settings.convert_fork"}}
-			</div>
-			<div class="content">
-				<div class="ui warning message">
-					{{ctx.Locale.Tr "repo.settings.convert_fork_notices_1"}}
+		<dialog id="convert-fork-repo-modal">
+			<article>
+				<header>{{ctx.Locale.Tr "repo.settings.convert_fork"}}</header>
+				<div class="content">
+					<div class="ui warning message">
+						{{ctx.Locale.Tr "repo.settings.convert_fork_notices_1"}}
+					</div>
 				</div>
 				<form class="ui form" action="{{.Link}}" method="post">
-					<input type="hidden" name="action" value="convert_fork">
+					<div class="content">
+						<input type="hidden" name="action" value="convert_fork">
+						<div class="field">
+							<label>
+								{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
+								<span class="text red">{{.Repository.FullName}}</span>
+							</label>
+						</div>
+						<div class="required field">
+							<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
+							<input name="repo_name" required autocorrect="off" autocapitalize="none" spellcheck="false">
+						</div>
+					</div>
+					<div class="actions">
+						<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+						<button type="submit" class="ui red button">{{ctx.Locale.Tr "repo.settings.convert_fork_confirm"}}</button>
+					</div>
+				</form>
+			</article>
+		</dialog>
+	{{end}}
+	<dialog id="transfer-repo-modal">
+		<article>
+			<header>{{ctx.Locale.Tr "repo.settings.transfer.modal.title"}}</header>
+			<div class="content">
+				<div class="ui warning message">
+					{{ctx.Locale.Tr "repo.settings.transfer_notices_1"}} <br>
+					{{ctx.Locale.Tr "repo.settings.transfer_notices_2"}} <br>
+					{{ctx.Locale.Tr "repo.settings.transfer_notices_3"}}
+				</div>
+			</div>
+			<form class="ui form" action="{{.Link}}" method="post">
+				<div class="content">
+					<input type="hidden" name="action" value="transfer">
 					<div class="field">
 						<label>
 							{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
@@ -607,129 +641,68 @@
 					</div>
 					<div class="required field">
 						<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
-						<input name="repo_name" required>
+						<input name="repo_name" required autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
-
-					<div class="text right actions">
-						<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-						<button class="ui red button">{{ctx.Locale.Tr "repo.settings.convert_fork_confirm"}}</button>
+					<div class="required field">
+						<label for="new_owner_name">{{ctx.Locale.Tr "repo.settings.transfer_owner"}}</label>
+						<input id="new_owner_name" name="new_owner_name" required>
 					</div>
-				</form>
-			</div>
-		</div>
-	{{end}}
-	<div class="ui small modal" id="transfer-repo-modal">
-		<div class="header">
-			{{ctx.Locale.Tr "repo.settings.transfer.modal.title"}}
-		</div>
-		<div class="content">
-			<div class="ui warning message">
-				{{ctx.Locale.Tr "repo.settings.transfer_notices_1"}} <br>
-				{{ctx.Locale.Tr "repo.settings.transfer_notices_2"}} <br>
-				{{ctx.Locale.Tr "repo.settings.transfer_notices_3"}}
-			</div>
-			<form class="ui form" action="{{.Link}}" method="post">
-				<input type="hidden" name="action" value="transfer">
-				<div class="field">
-					<label>
-						{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
-						<span class="text red">{{.Repository.FullName}}</span>
-					</label>
 				</div>
-				<div class="required field">
-					<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
-					<input name="repo_name" required>
-				</div>
-				<div class="required field">
-					<label for="new_owner_name">{{ctx.Locale.Tr "repo.settings.transfer_owner"}}</label>
-					<input id="new_owner_name" name="new_owner_name" required>
-				</div>
-
-				<div class="text right actions">
-					<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-					<button class="ui red button">{{ctx.Locale.Tr "repo.settings.transfer_perform"}}</button>
+				<div class="actions">
+					<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+					<button type="submit" class="ui red button">{{ctx.Locale.Tr "repo.settings.transfer_perform"}}</button>
 				</div>
 			</form>
-		</div>
-	</div>
+		</article>
+	</dialog>
 
-	<div class="ui small modal" id="delete-repo-modal">
-		<div class="header">
-			{{ctx.Locale.Tr "repo.settings.delete"}}
-		</div>
-		<div class="content">
-			<div class="ui warning message">
-				{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
-				{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName}}
-				{{if .Repository.NumForks}}<br>
-				{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
-				{{end}}
+	<dialog id="delete-repo-modal">
+		<article>
+			<header>{{ctx.Locale.Tr "repo.settings.delete"}}</header>
+			<div class="content">
+				<div class="ui warning message">
+					{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
+					{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName}}
+					{{if .Repository.NumForks}}<br>
+					{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
+					{{end}}
+				</div>
 			</div>
 			<form class="ui form" action="{{.Link}}" method="post">
-				<input type="hidden" name="action" value="delete">
-				<div class="field">
-					<label>
-						{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
-						<span class="text red">{{.Repository.FullName}}</span>
-					</label>
+				<div class="content">
+					<input type="hidden" name="action" value="delete">
+					<div class="field">
+						<label>
+							{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
+							<span class="text red">{{.Repository.FullName}}</span>
+						</label>
+					</div>
+					<div class="required field">
+						<label for="repo_name_to_delete">{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
+						<input id="repo_name_to_delete" name="repo_name" autocorrect="off" autocapitalize="none" spellcheck="false" required>
+					</div>
 				</div>
-				<div class="required field">
-					<label for="repo_name_to_delete">{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
-					<input id="repo_name_to_delete" name="repo_name" required>
-				</div>
-
-				<div class="text right actions">
-					<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-					<button class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_delete"}}</button>
+				<div class="actions">
+					<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+					<button type="submit" class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_delete"}}</button>
 				</div>
 			</form>
-		</div>
-	</div>
+		</article>
+	</dialog>
 
 	{{if .Repository.UnitEnabled $.Context $.UnitTypeWiki}}
-	<div class="ui small modal" id="delete-wiki-modal">
-		<div class="header">
-			{{ctx.Locale.Tr "repo.settings.wiki_delete"}}
-		</div>
-		<div class="content">
-			<div class="ui warning message">
-				{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
-				{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name}}
-			</div>
-			<form class="ui form" action="{{.Link}}" method="post">
-				<input type="hidden" name="action" value="delete-wiki">
-				<div class="field">
-					<label>
-						{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
-						<span class="text red">{{.Repository.FullName}}</span>
-					</label>
-				</div>
-				<div class="required field">
-					<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
-					<input name="repo_name" required>
-				</div>
-
-				<div class="text right actions">
-					<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-					<button class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_wiki_delete"}}</button>
-				</div>
-			</form>
-		</div>
-	</div>
-	{{if ne $.Repository.GetWikiBranchName .DefaultWikiBranchName}}
-		<div class="ui small modal" id="rename-wiki-branch-modal">
-			<div class="header">
-				{{ctx.Locale.Tr "repo.settings.wiki_rename_branch_main"}}
-			</div>
+	<dialog id="delete-wiki-modal">
+		<article>
+			<header>{{ctx.Locale.Tr "repo.settings.wiki_delete"}}</header>
 			<div class="content">
 				<div class="ui warning message">
-					<ul>
-						<li>{{ctx.Locale.Tr "repo.settings.wiki_rename_branch_main_notices_1"}}</li>
-						<li>{{ctx.Locale.Tr "repo.settings.wiki_rename_branch_main_notices_2" .Repository.Name}}</li>
-					</ul>
+					{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
+					{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name}}
 				</div>
-				<form class="ui form" action="{{.Link}}" method="post">
-					<input type="hidden" name="action" value="rename-wiki-branch">
+			</div>
+			<form class="ui form" action="{{.Link}}" method="post">
+				<div class="content">
+					<input type="hidden" name="action" value="delete-wiki">
 					<div class="field">
 						<label>
 							{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
@@ -738,42 +711,77 @@
 					</div>
 					<div class="required field">
 						<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
-						<input name="repo_name" required>
+						<input name="repo_name" required autocorrect="off" autocapitalize="none" spellcheck="false">
 					</div>
-
-					<div class="text right actions">
-						<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-						<button class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_wiki_branch_rename"}}</button>
+				</div>
+				<div class="actions">
+					<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+					<button type="submit" class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_wiki_delete"}}</button>
+				</div>
+			</form>
+		</article>
+	</dialog>
+	{{if ne $.Repository.GetWikiBranchName .DefaultWikiBranchName}}
+		<dialog id="rename-wiki-branch-modal">
+			<article>
+				<header>{{ctx.Locale.Tr "repo.settings.wiki_rename_branch_main"}}</header>
+				<div class="content">
+					<div class="ui warning message">
+						<ul>
+							<li>{{ctx.Locale.Tr "repo.settings.wiki_rename_branch_main_notices_1"}}</li>
+							<li>{{ctx.Locale.Tr "repo.settings.wiki_rename_branch_main_notices_2" .Repository.Name}}</li>
+						</ul>
+					</div>
+				</div>
+				<form class="ui form" action="{{.Link}}" method="post">
+					<div class="content">
+						<input type="hidden" name="action" value="rename-wiki-branch">
+						<div class="field">
+							<label>
+								{{ctx.Locale.Tr "repo.settings.enter_repo_name"}}
+								<span class="text red">{{.Repository.FullName}}</span>
+							</label>
+						</div>
+						<div class="required field">
+							<label>{{ctx.Locale.Tr "repo.settings.confirmation_string"}}</label>
+							<input name="repo_name" required autocorrect="off" autocapitalize="none" spellcheck="false">
+						</div>
+					</div>
+					<div class="actions">
+						<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+						<button type="submit" class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_wiki_branch_rename"}}</button>
 					</div>
 				</form>
-			</div>
-		</div>
+			</article>
+		</dialog>
 	{{end}}
 	{{end}}
 
 	{{if not .Repository.IsMirror}}
-		<div class="ui g-modal-confirm modal" id="archive-repo-modal">
-			<div class="header">
-				{{if .Repository.IsArchived}}
-					{{ctx.Locale.Tr "repo.settings.unarchive.header"}}
-				{{else}}
-					{{ctx.Locale.Tr "repo.settings.archive.header"}}
-				{{end}}
-			</div>
-			<div class="content">
-				<div class="ui warning message">
+		<dialog id="archive-repo-modal">
+			<article>
+				<header>
 					{{if .Repository.IsArchived}}
-						{{ctx.Locale.Tr "repo.settings.unarchive.text"}}
+						{{ctx.Locale.Tr "repo.settings.unarchive.header"}}
 					{{else}}
-						{{ctx.Locale.Tr "repo.settings.archive.text"}}
+						{{ctx.Locale.Tr "repo.settings.archive.header"}}
 					{{end}}
+				</header>
+				<div class="content">
+					<div class="ui warning message">
+						{{if .Repository.IsArchived}}
+							{{ctx.Locale.Tr "repo.settings.unarchive.text"}}
+						{{else}}
+							{{ctx.Locale.Tr "repo.settings.archive.text"}}
+						{{end}}
+					</div>
 				</div>
 				<form action="{{.Link}}" method="post">
 					<input type="hidden" name="action" value="{{if .Repository.IsArchived}}unarchive{{else}}archive{{end}}">
 					<input type="hidden" name="repo_id" value="{{.Repository.ID}}">
 					<div class="text right actions">
-						<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-						<button class="ui red button">
+						<button type="button" class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
+						<button type="submit" class="ui red button">
 							{{if .Repository.IsArchived}}
 								{{ctx.Locale.Tr "repo.settings.unarchive.button"}}
 							{{else}}
@@ -781,9 +789,9 @@
 							{{end}}
 						</button>
 					</div>
-			</form>
-			</div>
-		</div>
+				</form>
+			</article>
+		</dialog>
 	{{end}}
 {{end}}
 
diff --git a/templates/repo/settings/push_mirror_sync_modal.tmpl b/templates/repo/settings/push_mirror_sync_modal.tmpl
index 441bed1abc..64e8440fff 100644
--- a/templates/repo/settings/push_mirror_sync_modal.tmpl
+++ b/templates/repo/settings/push_mirror_sync_modal.tmpl
@@ -1,29 +1,29 @@
-<div class="ui small modal" id="push-mirror-edit-modal">
-	<div class="header">
-		{{ctx.Locale.Tr "repo.settings.mirror_settings.push_mirror.edit_sync_time"}}
-	</div>
-	<div class="content">
+<dialog id="push-mirror-edit-modal">
+	<article>
+		<header>{{ctx.Locale.Tr "repo.settings.mirror_settings.push_mirror.edit_sync_time"}}</header>
 		<form class="ui form ignore-dirty" method="post">
-			<input type="hidden" name="action" value="push-mirror-update">
-			<input type="hidden" name="push_mirror_id" id="push-mirror-edit-id">
-			<div class="field">
-				<label for="name">{{ctx.Locale.Tr "repo.settings.mirror_settings.mirrored_repository"}}</label>
-				<div class="ui small input">
-					<input id="push-mirror-edit-address" readonly>
+			<div class="content">
+				<input type="hidden" name="action" value="push-mirror-update">
+				<input type="hidden" name="push_mirror_id" id="push-mirror-edit-id">
+				<div class="field">
+					<label for="name">{{ctx.Locale.Tr "repo.settings.mirror_settings.mirrored_repository"}}</label>
+					<div class="ui small input">
+						<input id="push-mirror-edit-address" readonly>
+					</div>
 				</div>
-			</div>
-			<div class="inline field">
-				<label for="push-mirror-edit-interval">{{ctx.Locale.Tr "repo.mirror_interval" .MinimumMirrorInterval}}</label>
-				<div class="ui small input">
-					<input id="push-mirror-edit-interval" name="push_mirror_interval" autofocus>
+				<div class="inline field">
+					<label for="push-mirror-edit-interval">{{ctx.Locale.Tr "repo.mirror_interval" .MinimumMirrorInterval}}</label>
+					<div class="ui small input">
+						<input id="push-mirror-edit-interval" name="push_mirror_interval" autofocus>
+					</div>
 				</div>
-			</div>
-			<div class="field">
-				<label for="push-mirror-edit-branch-filter">{{ctx.Locale.Tr "repo.settings.push_mirror.branch_filter.label"}}</label>
-				<div class="ui small input">
-					<input id="push-mirror-edit-branch-filter" name="push_mirror_branch_filter" maxlength="2048">
+				<div class="field">
+					<label for="push-mirror-edit-branch-filter">{{ctx.Locale.Tr "repo.settings.push_mirror.branch_filter.label"}}</label>
+					<div class="ui small input">
+						<input id="push-mirror-edit-branch-filter" name="push_mirror_branch_filter" maxlength="2048">
+					</div>
+					<p class="help">{{ctx.Locale.Tr "repo.settings.push_mirror.branch_filter.description" "https://forgejo.org/docs/latest/user/repo-mirror/#branch-filter" "Forgejo"}}</p>
 				</div>
-				<p class="help">{{ctx.Locale.Tr "repo.settings.push_mirror.branch_filter.description" "https://forgejo.org/docs/latest/user/repo-mirror/#branch-filter" "Forgejo"}}</p>
 			</div>
 			<div class="actions">
 				<button class="ui small basic cancel button">
@@ -36,5 +36,5 @@
 				</button>
 			</div>
 		</form>
-	</div>
-</div>
+	</article>
+</dialog>
diff --git a/templates/repo/sub_menu.tmpl b/templates/repo/sub_menu.tmpl
index 96ecfdb50c..c476df0e7a 100644
--- a/templates/repo/sub_menu.tmpl
+++ b/templates/repo/sub_menu.tmpl
@@ -3,14 +3,14 @@
 	<div class="ui segment repository-menu">
 		{{if and (.Permission.CanRead $.UnitTypeCode) (not .IsEmptyRepo)}}
 			<a class="item muted {{if .PageIsCommits}}active{{end}}" href="{{.RepoLink}}/commits/{{.BranchNameSubURL}}">
-				{{svg "octicon-history"}} {{ctx.Locale.TrN .CommitsCount "repo.n_commit_one" "repo.n_commit_few" (printf "<b>%s</b>" (ctx.Locale.PrettyNumber .CommitsCount) | TrustHTML)}}
+				{{svg "octicon-history"}} {{ctx.Locale.TrPluralString .CommitsCount "counters.n_commits" (printf "<b>%s</b>" (ctx.Locale.PrettyNumber .CommitsCount) | TrustHTML)}}
 			</a>
 			<a class="item muted {{if .PageIsBranches}}active{{end}}" href="{{.RepoLink}}/branches">
-				{{svg "octicon-git-branch"}} {{ctx.Locale.TrN .BranchesCount "repo.n_branch_one" "repo.n_branch_few" (printf "<b>%s</b>" (ctx.Locale.PrettyNumber .BranchesCount) | TrustHTML)}}
+				{{svg "octicon-git-branch"}} {{ctx.Locale.TrPluralString .BranchesCount "counters.n_branches" (printf "<b>%s</b>" (ctx.Locale.PrettyNumber .BranchesCount) | TrustHTML)}}
 			</a>
 			{{if $.Permission.CanRead $.UnitTypeCode}}
 				<a class="item muted {{if .PageIsTagList}}active{{end}}" href="{{.RepoLink}}/tags">
-					{{svg "octicon-tag"}} {{ctx.Locale.TrN .NumTags "repo.n_tag_one" "repo.n_tag_few" (printf "<b>%s</b>" (ctx.Locale.PrettyNumber .NumTags) | TrustHTML)}}
+					{{svg "octicon-tag"}} {{ctx.Locale.TrPluralString .NumTags "counters.n_tags" (printf "<b>%s</b>" (ctx.Locale.PrettyNumber .NumTags) | TrustHTML)}}
 				</a>
 			{{end}}
 			<span class="item" {{if not (eq .Repository.Size 0)}}data-tooltip-content="{{.Repository.SizeDetailsString ctx.Locale}}"{{end}}>
diff --git a/templates/repo/view_list.tmpl b/templates/repo/view_list.tmpl
index ffd8b1a515..cc583d18c7 100644
--- a/templates/repo/view_list.tmpl
+++ b/templates/repo/view_list.tmpl
@@ -1,17 +1,23 @@
 <table id="repo-files-table" class="ui single line table tw-mt-0" {{if .HasFilesWithoutLatestCommit}}hx-indicator="tr.notready td.message span" hx-trigger="load" hx-swap="morph" hx-post="{{.LastCommitLoaderURL}}"{{end}}>
-	<thead>
+	<caption class="tw-sr-only">
+		{{ctx.Locale.Tr "repo.files.caption"}}
+	</caption>
+	<thead class="tw-sr-only">
+		<th>{{ctx.Locale.Tr "repo.files.filename"}}</th>
+		<th>{{ctx.Locale.Tr "repo.files.last_commit_message"}}</th>
+		<th>{{ctx.Locale.Tr "repo.files.last_commit_date"}}</th>
+	</thead>
+	<tbody>
 		<tr class="commit-list">
-			<th class="tw-overflow-hidden" colspan="2">
+			<td class="tw-overflow-hidden repo-files-table-latest-commit-cell repo-files-table-latest-commit-left" colspan="2">
 				<div class="tw-flex">
 					<div class="latest-commit">
 						{{template "repo/latest_commit" .}}
 					</div>
 				</div>
-			</th>
-			<th class="text grey right age">{{if .LatestCommit}}{{if .LatestCommit.Committer}}{{DateUtils.TimeSince .LatestCommit.Committer.When}}{{end}}{{end}}</th>
+			</td>
+			<td class="text grey right age repo-files-table-latest-commit-cell tw-py-0">{{if .LatestCommit}}{{if .LatestCommit.Committer}}{{DateUtils.TimeSince .LatestCommit.Committer.When}}{{end}}{{end}}</td>
 		</tr>
-	</thead>
-	<tbody>
 		{{if .HasParentPath}}
 			<tr class="has-parent">
 				<td colspan="3"><a class="muted" href="{{.BranchLink}}{{if .ParentPath}}{{PathEscapeSegments .ParentPath}}{{end}}">{{svg "octicon-reply" 16 "tw-mr-2"}}..</a></td>
diff --git a/templates/shared/combomarkdowneditor.tmpl b/templates/shared/combomarkdowneditor.tmpl
index c1ec50ab70..42840a3825 100644
--- a/templates/shared/combomarkdowneditor.tmpl
+++ b/templates/shared/combomarkdowneditor.tmpl
@@ -64,55 +64,57 @@ Template Attributes:
 		{{ctx.Locale.Tr "loading"}}
 	</div>
 
-	<div class="ui small modal tw-w-fit" data-modal-name="new-markdown-table">
-		<div class="header">{{ctx.Locale.Tr "editor.table_modal.header"}}</div>
+	<dialog data-modal-name="new-markdown-table">
+		<article>
+			<header>{{ctx.Locale.Tr "editor.table_modal.header"}}</header>
 
-		<div class="ui form content" data-selector-name="form">
-			<input type="hidden" name="table-header" value="{{ctx.Locale.Tr "editor.table_modal.placeholder.header"}}" disabled>
-			<input type="hidden" name="table-content" value="{{ctx.Locale.Tr "editor.table_modal.placeholder.content"}}" disabled>
-			<table>
-				<tbody>
-					<tr>
-						<td><label>{{ctx.Locale.Tr "editor.table_modal.label.rows"}}</label></td>
-						<td><input type="number" name="table-rows" class="js-enable" min="1" value="2" disabled required></td>
-					</tr>
-					<tr>
-						<td><label>{{ctx.Locale.Tr "editor.table_modal.label.columns"}}</label></td>
-						<td><input type="number" name="table-columns" class="js-enable" min="1" value="2" disabled required></td>
-					</tr>
-				</tbody>
-			</table>
-		</div>
+			<div class="ui form content" data-selector-name="form">
+				<input type="hidden" name="table-header" value="{{ctx.Locale.Tr "editor.table_modal.placeholder.header"}}" disabled>
+				<input type="hidden" name="table-content" value="{{ctx.Locale.Tr "editor.table_modal.placeholder.content"}}" disabled>
+				<table>
+					<tbody>
+						<tr>
+							<td><label>{{ctx.Locale.Tr "editor.table_modal.label.rows"}}</label></td>
+							<td><input type="number" name="table-rows" class="js-enable" min="1" value="2" disabled required></td>
+						</tr>
+						<tr>
+							<td><label>{{ctx.Locale.Tr "editor.table_modal.label.columns"}}</label></td>
+							<td><input type="number" name="table-columns" class="js-enable" min="1" value="2" disabled required></td>
+						</tr>
+					</tbody>
+				</table>
+			</div>
 
-		<div class="text right actions">
-			<button class="ui cancel button" data-selector-name="cancel-button">{{ctx.Locale.Tr "cancel"}}</button>
-			<button class="ui primary button" data-selector-name="ok-button">{{ctx.Locale.Tr "ok"}}</button>
-		</div>
-	</div>
+			<div class="actions">
+				<button class="ui cancel button" data-selector-name="cancel-button">{{ctx.Locale.Tr "cancel"}}</button>
+				<button class="ui primary button" data-selector-name="ok-button">{{ctx.Locale.Tr "ok"}}</button>
+			</div>
+		</article>
+	</dialog>
 
-	<div class="ui small modal" data-modal-name="new-markdown-link">
-		<div class="header">{{ctx.Locale.Tr "editor.link_modal.header"}}</div>
-
-		<fieldset class="content">
+	<dialog data-modal-name="new-markdown-link">
+		<article>
+			<header>{{ctx.Locale.Tr "editor.link_modal.header"}}</header>
 			<div class="ui form" data-selector-name="form">
-				<label>
-					{{ctx.Locale.Tr "editor.link_modal.url"}}
-					<input name="link-url" class="js-enable" disabled required dir="auto" autocomplete="off">
-				</label>
-				<label>
-					{{ctx.Locale.Tr "editor.link_modal.description"}}
-					<input name="link-description" class="js-enable" disabled required dir="auto" autocomplete="off">
-				</label>
+				<div class="content">
+					<label>
+						{{ctx.Locale.Tr "editor.link_modal.url"}}
+						<input name="link-url" class="js-enable" disabled required dir="auto" autocomplete="off">
+					</label>
+					<label>
+						{{ctx.Locale.Tr "editor.link_modal.description"}}
+						<input name="link-description" class="js-enable" disabled required dir="auto" autocomplete="off">
+					</label>
 
-				<div class="help">
-					{{ctx.Locale.Tr "editor.link_modal.paste_reminder"}}
+					<div class="help">
+						{{ctx.Locale.Tr "editor.link_modal.paste_reminder"}}
+					</div>
 				</div>
-
 				<div class="text right actions">
 					<button class="ui cancel button" data-selector-name="cancel-button">{{ctx.Locale.Tr "cancel"}}</button>
 					<button class="ui primary button" data-selector-name="ok-button">{{ctx.Locale.Tr "ok"}}</button>
 				</div>
 			</div>
-		</fieldset>
-	</div>
+		</article>
+	</dialog>
 </div>
diff --git a/templates/shared/secrets/add_list.tmpl b/templates/shared/secrets/add_list.tmpl
index d4550bfb47..d2eb74b406 100644
--- a/templates/shared/secrets/add_list.tmpl
+++ b/templates/shared/secrets/add_list.tmpl
@@ -57,63 +57,63 @@
 </div>
 
 {{/* Add secret dialog */}}
-<div class="ui small modal" id="add-secret-modal">
-	<div class="header">
-		<span id="actions-modal-header"></span>
-	</div>
-	<form class="ui form form-fetch-action" method="post">
-		<fieldset class="content">
-			<div class="field">
-				{{ctx.Locale.Tr "secrets.description"}}
-			</div>
-			<div class="field">
-				<label class="required" for="secret-name">{{ctx.Locale.Tr "name"}}</label>
-				<input autofocus required
-					id="secret-name"
-					name="name"
-					value="{{.name}}"
-					pattern="^(?!FORGEJO_|GITEA_|GITHUB_)[a-zA-Z_][a-zA-Z0-9_]*$"
-				>
-				<p id="name-description" class="help">{{ctx.Locale.Tr "actions.secrets.creation.name_description"}}</p>
-			</div>
-			<div class="field">
-				<label class="required" for="secret-data">{{ctx.Locale.Tr "value"}}</label>
-				<textarea required
-					id="secret-data"
-					name="data"
-				></textarea>
-				<p id="secret-data-description" class="help">{{ctx.Locale.Tr "actions.secrets.creation.value_description"}}</p>
-			</div>
-		</fieldset>
-		{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
-	</form>
-</div>
+<dialog id="add-secret-modal">
+	<article>
+		<header><span id="actions-modal-header"></span></header>
+		<form class="ui form form-fetch-action" method="post">
+			<fieldset class="content">
+				<div class="field">
+					{{ctx.Locale.Tr "secrets.description"}}
+				</div>
+				<div class="field">
+					<label class="required" for="secret-name">{{ctx.Locale.Tr "name"}}</label>
+					<input autofocus required
+						id="secret-name"
+						name="name"
+						value="{{.name}}"
+						pattern="^(?!FORGEJO_|GITEA_|GITHUB_)[a-zA-Z_][a-zA-Z0-9_]*$"
+					>
+					<p id="name-description" class="help">{{ctx.Locale.Tr "actions.secrets.creation.name_description"}}</p>
+				</div>
+				<div class="field">
+					<label class="required" for="secret-data">{{ctx.Locale.Tr "value"}}</label>
+					<textarea required
+						id="secret-data"
+						name="data"
+					></textarea>
+					<p id="secret-data-description" class="help">{{ctx.Locale.Tr "actions.secrets.creation.value_description"}}</p>
+				</div>
+			</fieldset>
+			{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
+		</form>
+	</article>
+</dialog>
 {{/* Edit secret dialog */}}
-<div class="ui small modal" id="edit-secret-modal">
-	<div class="header">
-		<span id="actions-modal-header"></span>
-	</div>
-	<form class="ui form form-fetch-action" method="post">
-		<fieldset class="content">
-			<div class="field">
-				{{ctx.Locale.Tr "secrets.description"}}
-			</div>
-			<div class="field">
-				<label class="required" for="dialog-secret-name">{{ctx.Locale.Tr "name"}}</label>
-				<input autofocus required
-					id="dialog-secret-name"
-					name="name"
-					value="{{.name}}"
-					pattern="^(?!FORGEJO_|GITEA_|GITHUB_)[a-zA-Z_][a-zA-Z0-9_]*$"
-				>
-				<p id="name-description" class="help">{{ctx.Locale.Tr "actions.secrets.mutation.name_description"}}</p>
-			</div>
-			<div class="field">
-				<label for="dialog-secret-data">{{ctx.Locale.Tr "value"}}</label>
-				<textarea id="dialog-secret-data" name="data"></textarea>
-				<p id="secret-data-description" class="help">{{ctx.Locale.Tr "actions.secrets.mutation.value_description"}}</p>
-			</div>
-		</fieldset>
-		{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
-	</form>
-</div>
+<dialog id="edit-secret-modal">
+	<article>
+		<header><span id="actions-modal-header"></span></header>
+		<form class="ui form form-fetch-action" method="post">
+			<fieldset class="content">
+				<div class="field">
+					{{ctx.Locale.Tr "secrets.description"}}
+				</div>
+				<div class="field">
+					<label class="required" for="dialog-secret-name">{{ctx.Locale.Tr "name"}}</label>
+					<input autofocus required
+						id="dialog-secret-name"
+						name="name"
+						value="{{.name}}"
+						pattern="^(?!FORGEJO_|GITEA_|GITHUB_)[a-zA-Z_][a-zA-Z0-9_]*$"
+					>
+					<p id="name-description" class="help">{{ctx.Locale.Tr "actions.secrets.mutation.name_description"}}</p>
+				</div>
+				<div class="field">
+					<label for="dialog-secret-data">{{ctx.Locale.Tr "value"}}</label>
+					<textarea id="dialog-secret-data" name="data"></textarea>
+					<p id="secret-data-description" class="help">{{ctx.Locale.Tr "actions.secrets.mutation.value_description"}}</p>
+				</div>
+			</fieldset>
+			{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
+		</form>
+	</article>
+</dialog>
diff --git a/templates/shared/variables/variable_list.tmpl b/templates/shared/variables/variable_list.tmpl
index 82acb66d14..5f310d91a3 100644
--- a/templates/shared/variables/variable_list.tmpl
+++ b/templates/shared/variables/variable_list.tmpl
@@ -59,33 +59,34 @@
 </div>
 
 {{/** Edit variable dialog */}}
-<div class="ui small modal" id="edit-variable-modal">
-	<div class="header"></div>
-	<form class="ui form form-fetch-action" method="post">
-		<fieldset class="content">
-			<div class="field">
-				{{ctx.Locale.Tr "actions.variables.description"}}
-			</div>
-			<div class="field">
-				<label for="dialog-variable-name">{{ctx.Locale.Tr "name"}}</label>
-				<input autofocus required
-					name="name"
-					id="dialog-variable-name"
-					value="{{.name}}"
-					pattern="^(?!CI$)(?!FORGEJO_|GITEA_|GITHUB_)[a-zA-Z_][a-zA-Z0-9_]*$"
-				>
-				<p id="name-description" class="help">{{ctx.Locale.Tr "actions.variables.mutation.name_description"}}</p>
-			</div>
-			<div class="field">
-				<label for="dialog-variable-data">{{ctx.Locale.Tr "value"}}</label>
-				<textarea required
-					name="data"
-					id="dialog-variable-data"
-				></textarea>
-				<p id="data-description" class="help">{{ctx.Locale.Tr "actions.variables.mutation.value_description"}}</p>
-			</div>
-		</fieldset>
-		{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
-	</form>
-</div>
-
+<dialog id="edit-variable-modal">
+	<article>
+		<header></header>
+		<form class="ui form form-fetch-action" method="post">
+			<fieldset class="content">
+				<div class="field">
+					{{ctx.Locale.Tr "actions.variables.description"}}
+				</div>
+				<div class="field">
+					<label for="dialog-variable-name">{{ctx.Locale.Tr "name"}}</label>
+					<input autofocus required
+						name="name"
+						id="dialog-variable-name"
+						value="{{.name}}"
+						pattern="^(?!CI$)(?!FORGEJO_|GITEA_|GITHUB_)[a-zA-Z_][a-zA-Z0-9_]*$"
+					>
+					<p id="name-description" class="help">{{ctx.Locale.Tr "actions.variables.mutation.name_description"}}</p>
+				</div>
+				<div class="field">
+					<label for="dialog-variable-data">{{ctx.Locale.Tr "value"}}</label>
+					<textarea required
+						name="data"
+						id="dialog-variable-data"
+					></textarea>
+					<p id="data-description" class="help">{{ctx.Locale.Tr "actions.variables.mutation.value_description"}}</p>
+				</div>
+			</fieldset>
+			{{template "base/modal_actions_confirm" (dict "ModalButtonTypes" "confirm")}}
+		</form>
+		</article>
+</dialog>
diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl
index d45f9b2893..fa9750db72 100644
--- a/templates/swagger/v1_json.tmpl
+++ b/templates/swagger/v1_json.tmpl
@@ -1509,6 +1509,12 @@
             "name": "login_name",
             "in": "query"
           },
+          {
+            "type": "boolean",
+            "description": "whether or not to filter users with the 2fa enabled",
+            "name": "is_2fa_enabled",
+            "in": "query"
+          },
           {
             "enum": [
               "oldest",
@@ -2037,6 +2043,135 @@
         }
       }
     },
+    "/admin/users/{username}/tokens": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "admin"
+        ],
+        "summary": "List the specified user's access tokens",
+        "operationId": "adminListUserAccessTokens",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "username of user",
+            "name": "username",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "page number of results to return (1-based)",
+            "name": "page",
+            "in": "query"
+          },
+          {
+            "type": "integer",
+            "description": "page size of results",
+            "name": "limit",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/AccessTokenList"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      },
+      "post": {
+        "consumes": [
+          "application/json"
+        ],
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "admin"
+        ],
+        "summary": "Create an access token for the specified user",
+        "operationId": "adminCreateUserAccessToken",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "username of user",
+            "name": "username",
+            "in": "path",
+            "required": true
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "$ref": "#/definitions/CreateAccessTokenOption"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "$ref": "#/responses/AccessToken"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      }
+    },
+    "/admin/users/{username}/tokens/{token}": {
+      "delete": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "admin"
+        ],
+        "summary": "Delete an access token for the specified user",
+        "operationId": "adminDeleteUserAccessToken",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "username of user",
+            "name": "username",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "token to be deleted, identified by ID and if not available by name",
+            "name": "token",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "204": {
+            "$ref": "#/responses/empty"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/responses/error"
+          }
+        }
+      }
+    },
     "/gitignore/templates": {
       "get": {
         "produces": [
@@ -5454,6 +5589,209 @@
         }
       }
     },
+    "/repos/{owner}/{repo}/actions/artifacts": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "List a repository's artifacts",
+        "operationId": "ListActionArtifacts",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "filter by artifact name",
+            "name": "name",
+            "in": "query"
+          },
+          {
+            "type": "integer",
+            "description": "page number of results to return (1-based)",
+            "name": "page",
+            "in": "query"
+          },
+          {
+            "type": "integer",
+            "description": "page size of results, default maximum page size is 50",
+            "name": "limit",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ActionArtifactList"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          }
+        }
+      }
+    },
+    "/repos/{owner}/{repo}/actions/artifacts/{artifact_id}": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Get an artifact by ID",
+        "operationId": "GetActionArtifact",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "ID of the artifact",
+            "name": "artifact_id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ActionArtifact"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      },
+      "delete": {
+        "description": "Marks the artifact for deletion. Storage space will be reclaimed\nasynchronously by a background job.\n",
+        "tags": [
+          "repository"
+        ],
+        "summary": "Mark an artifact for deletion",
+        "operationId": "DeleteActionArtifact",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "ID of the artifact",
+            "name": "artifact_id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "artifact marked for deletion"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      }
+    },
+    "/repos/{owner}/{repo}/actions/artifacts/{artifact_id}/zip": {
+      "get": {
+        "produces": [
+          "application/zip"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Download an artifact",
+        "operationId": "DownloadActionArtifact",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "ID of the artifact",
+            "name": "artifact_id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "the artifact archive"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      }
+    },
     "/repos/{owner}/{repo}/actions/runners": {
       "get": {
         "produces": [
@@ -5880,6 +6218,173 @@
             "$ref": "#/responses/notFound"
           }
         }
+      },
+      "delete": {
+        "description": "Remove a particular workflow run. The workflow run must have completed (succeeded, failed, cancelled) for the operation to succeed. Otherwise, an error is returned.\n",
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Delete a completed workflow run.",
+        "operationId": "DeleteActionRun",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "id of the action run",
+            "name": "run_id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Workflow run has been removed"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      }
+    },
+    "/repos/{owner}/{repo}/actions/runs/{run_id}/artifacts": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "List artifacts of a workflow run",
+        "operationId": "ListActionRunArtifacts",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "ID of the workflow run",
+            "name": "run_id",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "filter by artifact name",
+            "name": "name",
+            "in": "query"
+          },
+          {
+            "type": "integer",
+            "description": "page number of results to return (1-based)",
+            "name": "page",
+            "in": "query"
+          },
+          {
+            "type": "integer",
+            "description": "page size of results, default maximum page size is 50",
+            "name": "limit",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ActionArtifactList"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      }
+    },
+    "/repos/{owner}/{repo}/actions/runs/{run_id}/jobs": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "List jobs of a workflow run",
+        "operationId": "ListActionRunJobs",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "ID of the workflow run",
+            "name": "run_id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ActionRunJobList"
+          },
+          "400": {
+            "$ref": "#/responses/error"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
       }
     },
     "/repos/{owner}/{repo}/actions/secrets": {
@@ -7407,7 +7912,7 @@
           },
           {
             "type": "integer",
-            "description": "page size of results (ignored if used with 'path')",
+            "description": "page size of results",
             "name": "limit",
             "in": "query"
           },
@@ -13953,6 +14458,18 @@
             "name": "poster",
             "in": "query"
           },
+          {
+            "type": "string",
+            "description": "Filter by base branch name",
+            "name": "base",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "Filter by head branch name",
+            "name": "head",
+            "in": "query"
+          },
           {
             "minimum": 1,
             "type": "integer",
@@ -19533,6 +20050,38 @@
         }
       }
     },
+    "/user/activitypub/follow": {
+      "post": {
+        "tags": [
+          "user"
+        ],
+        "summary": "Follow a remote activitypub account",
+        "operationId": "userCurrentActivityPubFollow",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "$ref": "#/definitions/APRemoteFollowOption"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "$ref": "#/responses/empty"
+          },
+          "401": {
+            "$ref": "#/responses/unauthorized"
+          },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      }
+    },
     "/user/applications/oauth2": {
       "get": {
         "produces": [
@@ -22229,6 +22778,16 @@
       },
       "x-go-package": "forgejo.org/services/context"
     },
+    "APRemoteFollowOption": {
+      "type": "object",
+      "properties": {
+        "target": {
+          "type": "string",
+          "x-go-name": "Target"
+        }
+      },
+      "x-go-package": "forgejo.org/modules/structs"
+    },
     "AccessToken": {
       "type": "object",
       "title": "AccessToken represents an API access token.",
@@ -22268,6 +22827,61 @@
       },
       "x-go-package": "forgejo.org/modules/structs"
     },
+    "ActionArtifact": {
+      "description": "ActionArtifact represents an artifact of a workflow run",
+      "type": "object",
+      "properties": {
+        "archive_download_url": {
+          "description": "the URL to download the artifact zip archive",
+          "type": "string",
+          "x-go-name": "ArchiveDownloadURL"
+        },
+        "created_at": {
+          "type": "string",
+          "format": "date-time",
+          "x-go-name": "CreatedAt"
+        },
+        "expired": {
+          "description": "whether the artifact has expired",
+          "type": "boolean",
+          "x-go-name": "Expired"
+        },
+        "expires_at": {
+          "type": "string",
+          "format": "date-time",
+          "x-go-name": "ExpiresAt"
+        },
+        "id": {
+          "description": "the artifact's ID",
+          "type": "integer",
+          "format": "int64",
+          "x-go-name": "ID"
+        },
+        "name": {
+          "description": "the artifact's name",
+          "type": "string",
+          "x-go-name": "Name"
+        },
+        "run_id": {
+          "description": "the ID of the workflow run that produced this artifact",
+          "type": "integer",
+          "format": "int64",
+          "x-go-name": "RunID"
+        },
+        "size_in_bytes": {
+          "description": "the total size of the artifact in bytes",
+          "type": "integer",
+          "format": "int64",
+          "x-go-name": "SizeInBytes"
+        },
+        "updated_at": {
+          "type": "string",
+          "format": "date-time",
+          "x-go-name": "UpdatedAt"
+        }
+      },
+      "x-go-package": "forgejo.org/modules/structs"
+    },
     "ActionRun": {
       "description": "ActionRun represents an action run",
       "type": "object",
@@ -22437,6 +23051,12 @@
           "format": "int64",
           "x-go-name": "RepoID"
         },
+        "run_id": {
+          "description": "Identifier of the workflow run this job belongs to.",
+          "type": "integer",
+          "format": "int64",
+          "x-go-name": "RunID"
+        },
         "runs_on": {
           "description": "the action run job labels to run on",
           "type": "array",
@@ -30321,12 +30941,36 @@
         }
       }
     },
+    "ActionArtifact": {
+      "description": "ActionArtifact",
+      "schema": {
+        "$ref": "#/definitions/ActionArtifact"
+      }
+    },
+    "ActionArtifactList": {
+      "description": "ActionArtifactList",
+      "schema": {
+        "type": "array",
+        "items": {
+          "$ref": "#/definitions/ActionArtifact"
+        }
+      }
+    },
     "ActionRun": {
       "description": "ActionRun",
       "schema": {
         "$ref": "#/definitions/ActionRun"
       }
     },
+    "ActionRunJobList": {
+      "description": "ActionRunJobList",
+      "schema": {
+        "type": "array",
+        "items": {
+          "$ref": "#/definitions/ActionRunJob"
+        }
+      }
+    },
     "ActionRunList": {
       "description": "ActionRunList",
       "schema": {
diff --git a/templates/user/auth/oauth_container.tmpl b/templates/user/auth/oauth_container.tmpl
index 7531320394..a50ca5f612 100644
--- a/templates/user/auth/oauth_container.tmpl
+++ b/templates/user/auth/oauth_container.tmpl
@@ -8,7 +8,7 @@
 	<div class="tw-flex tw-flex-col tw-justify-center">
 		<div id="oauth2-login-navigator-inner" class="tw-flex tw-flex-col tw-flex-wrap tw-items-center tw-gap-2">
 			{{range $provider := .OAuth2Providers}}
-				<a class="{{$provider.Name}} ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full oauth-login-link" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName}}">
+				<a class="{{$provider.Name}} ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full oauth-login-link" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName | PathEscape}}">
 					{{$provider.IconHTML 28}}
 					{{ctx.Locale.Tr "sign_in_with_provider" $provider.DisplayName}}
 				</a>
diff --git a/templates/user/auth/webauthn.tmpl b/templates/user/auth/webauthn.tmpl
index 1b84765323..00cb88621d 100644
--- a/templates/user/auth/webauthn.tmpl
+++ b/templates/user/auth/webauthn.tmpl
@@ -6,17 +6,17 @@
 			<h3 class="ui top attached header">{{ctx.Locale.Tr "twofa"}}</h3>
 			<div class="ui attached segment">
 				{{svg "octicon-key" 56}}
-				<h3>{{ctx.Locale.Tr "webauthn_insert_key"}}</h3>
+				<h3>{{ctx.Locale.Tr "webauthn.insert_key"}}</h3>
 				{{template "base/alert" .}}
-				<p>{{ctx.Locale.Tr "webauthn_sign_in"}}</p>
+				<p>{{ctx.Locale.Tr "webauthn.sign_in"}}</p>
 			</div>
 			<div class="ui attached segment tw-flex tw-items-center tw-justify-center tw-gap-1 tw-py-2">
 				<div class="is-loading tw-w-[40px] tw-h-[40px]"></div>
-				{{ctx.Locale.Tr "webauthn_press_button"}}
+				{{ctx.Locale.Tr "webauthn.press_button"}}
 			</div>
 			{{if .HasTwoFactor}}
 				<div class="ui attached segment">
-					<a href="{{AppSubUrl}}/user/two_factor">{{ctx.Locale.Tr "webauthn_use_twofa"}}</a>
+					<a href="{{AppSubUrl}}/user/two_factor">{{ctx.Locale.Tr "webauthn.use_twofa"}}</a>
 				</div>
 			{{end}}
 		</div>
diff --git a/templates/user/auth/webauthn_error.tmpl b/templates/user/auth/webauthn_error.tmpl
index 511ff7c287..db54251096 100644
--- a/templates/user/auth/webauthn_error.tmpl
+++ b/templates/user/auth/webauthn_error.tmpl
@@ -1,13 +1,13 @@
 <div id="webauthn-error" class="ui negative message tw-hidden">
-	<div class="header">{{ctx.Locale.Tr "webauthn_error"}}</div>
+	<div class="header">{{ctx.Locale.Tr "webauthn.error"}}</div>
 	<div id="webauthn-error-msg" class="tw-pt-2"></div>
 	<div class="tw-hidden">
-		<div data-webauthn-error-msg="browser">{{ctx.Locale.Tr "webauthn_unsupported_browser"}}</div>
-		<div data-webauthn-error-msg="unknown">{{ctx.Locale.Tr "webauthn_error_unknown"}}</div>
-		<div data-webauthn-error-msg="insecure">{{ctx.Locale.Tr "webauthn_error_insecure"}}</div>
-		<div data-webauthn-error-msg="unable-to-process">{{ctx.Locale.Tr "webauthn_error_unable_to_process"}}</div>
-		<div data-webauthn-error-msg="duplicated">{{ctx.Locale.Tr "webauthn_error_duplicated"}}</div>
-		<div data-webauthn-error-msg="empty">{{ctx.Locale.Tr "webauthn_error_empty"}}</div>
-		<div data-webauthn-error-msg="timeout">{{ctx.Locale.Tr "webauthn_error_timeout"}}</div>
+		<div data-webauthn-error-msg="browser">{{ctx.Locale.Tr "webauthn.unsupported_browser"}}</div>
+		<div data-webauthn-error-msg="unknown">{{ctx.Locale.Tr "webauthn.error.unknown"}}</div>
+		<div data-webauthn-error-msg="insecure">{{ctx.Locale.Tr "webauthn.error.insecure"}}</div>
+		<div data-webauthn-error-msg="unable-to-process">{{ctx.Locale.Tr "webauthn.error.unable_to_process"}}</div>
+		<div data-webauthn-error-msg="duplicated">{{ctx.Locale.Tr "webauthn.error.duplicated"}}</div>
+		<div data-webauthn-error-msg="empty">{{ctx.Locale.Tr "webauthn.error.empty"}}</div>
+		<div data-webauthn-error-msg="timeout">{{ctx.Locale.Tr "webauthn.error.timeout"}}</div>
 	</div>
 </div>
diff --git a/templates/user/dashboard/ap_feed.tmpl b/templates/user/dashboard/ap_feed.tmpl
new file mode 100644
index 0000000000..1127026139
--- /dev/null
+++ b/templates/user/dashboard/ap_feed.tmpl
@@ -0,0 +1,26 @@
+<div id="activity-feed" class="flex-list">
+	{{range .FollowingFeeds}}
+		<div class="flex-item">
+			{{if not (eq .Actor.ID 0)}}
+				<div class="flex-item-leading">
+					{{ctx.AvatarUtils.Avatar . 48}}
+				</div>
+			{{end}}
+			<div class="flex-item-main">
+				<div class="flex-item-title">
+					<a class="text muted" href="{{.ActorURI}}">{{.Actor.Name}}</a>
+				</div>
+				<div class="render-content markup">
+					{{.NoteContent | SanitizeHTMLStrict}}
+				</div>
+				{{if .NoteURL}}
+					<div class="flex-item-footer">
+						<span class="flex-text-inline">{{svg "octicon-calendar"}}{{ctx.Locale.Tr "user.activitypub_feed.posted_on" (DateUtils.TimeSince .Created)}}</span>
+						<a class="flex-text-inline" href="{{.NoteURL}}">{{svg "octicon-link-external"}}{{ctx.Locale.Tr "user.activitypub_feed.original_source"}}</a>
+					</div>
+				{{end}}
+			</div>
+		</div>
+	{{end}}
+	{{template "base/paginate" .}}
+</div>
diff --git a/templates/user/dashboard/ap_feed_guide.tmpl b/templates/user/dashboard/ap_feed_guide.tmpl
new file mode 100644
index 0000000000..a3a29abbed
--- /dev/null
+++ b/templates/user/dashboard/ap_feed_guide.tmpl
@@ -0,0 +1,6 @@
+<div id="empty-ap-feed" class="tw-text-center tw-p-8">
+	{{svg "octicon-people" 64 "tw-text-placeholder-text"}}
+	<h2>{{ctx.Locale.Tr "user.activitypub_feed.no_activity"}}</h2>
+	<p class="help">{{ctx.Locale.Tr "user.activitypub_feed.is_empty"}}</p>
+	<p class="help">{{ctx.Locale.Tr "user.activitypub_feed.hint"}}</p>
+</div>
diff --git a/templates/user/overview/header.tmpl b/templates/user/overview/header.tmpl
index ea5d8052f4..cc306cc571 100644
--- a/templates/user/overview/header.tmpl
+++ b/templates/user/overview/header.tmpl
@@ -41,6 +41,11 @@
 					{{svg "octicon-rss"}} {{ctx.Locale.Tr "user.activity"}}
 				</a>
 			{{end}}
+			{{if and FederationEnabled (eq .SignedUserID .ContextUser.ID)}}
+			<a class="{{if eq .TabName "feed"}}active {{end}}item" href="{{.ContextUser.HomeLink}}?tab=feed">
+				{{svg "fediverse-small"}} {{ctx.Locale.Tr "user.activitypub_feed.feed"}}
+			</a>
+			{{end}}
 			{{if not .DisableStars}}
 			<a class="{{if eq .TabName "stars"}}active {{end}}item" href="{{.ContextUser.HomeLink}}?tab=stars">
 				{{svg "octicon-star"}} {{ctx.Locale.Tr "user.starred"}}
diff --git a/templates/user/profile.tmpl b/templates/user/profile.tmpl
index 30210a1775..6fd533767f 100644
--- a/templates/user/profile.tmpl
+++ b/templates/user/profile.tmpl
@@ -58,6 +58,14 @@
 						{{.ProfileReadme}}
 					{{end}}
 					</div>
+				{{else if and FederationEnabled (eq .TabName "feed")}}
+					{{if eq .SignedUserID .ContextUser.ID}}
+						{{if .FollowingFeeds}}
+							{{template "user/dashboard/ap_feed" .}}
+						{{else}}
+							{{template "user/dashboard/ap_feed_guide" .}}
+						{{end}}
+					{{end}}
 				{{else}}
 					{{template "shared/repo_search" .}}
 					{{template "explore/repo_list" .}}
diff --git a/tests/e2e/admin-ui.test.e2e.ts b/tests/e2e/admin-ui.test.e2e.ts
index 8fcd3456a3..84145dd0cf 100644
--- a/tests/e2e/admin-ui.test.e2e.ts
+++ b/tests/e2e/admin-ui.test.e2e.ts
@@ -56,3 +56,29 @@ test('Admin email list', async ({page}) => {
     await expect(page.locator('[data-uid="9"] svg')).toHaveClass(/octicon-check/);
   }
 });
+
+test('Admin: delete a user', async ({page}) => {
+  const response = await page.goto('/admin/users/1/edit');
+  expect(response?.status()).toBe(200);
+
+  const modal = page.locator('#delete-user-modal');
+  const okButton = page.locator('#delete-user-modal .primary.button');
+
+  // Check that modal appears after clicking
+  await expect(modal).toBeHidden();
+  await expect(okButton).toBeHidden();
+  await page.locator('[data-modal="#delete-user-modal"]').click();
+  await expect(modal).toBeVisible();
+  await expect(okButton).toBeVisible();
+
+  // Agree with deletion
+  await okButton.click();
+
+  // Should have been redirected to /admin/users/1
+  await expect(page).toHaveURL(/\/admin\/users\/1$/);
+
+  // This test doesn't actually delete a user as it attempts to delete the doer and
+  // receives an error. This is enough to test that the request reaches the correct
+  // endpoint without causing e2e retry headache
+  await expect(page.locator('#flash-message')).toBeVisible();
+});
diff --git a/tests/e2e/clipboard-copy.test.e2e.ts b/tests/e2e/clipboard-copy.test.e2e.ts
index fd1118da2b..6cd9836316 100644
--- a/tests/e2e/clipboard-copy.test.e2e.ts
+++ b/tests/e2e/clipboard-copy.test.e2e.ts
@@ -16,8 +16,12 @@ test('copy src file path to clipboard', async ({page}) => {
   expect(response?.status()).toBe(200);
 
   await page.click('[data-clipboard-text]');
-  const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-  expect(clipboardText).toContain('README.md');
+
+  await expect(async () => {
+    const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+    expect(clipboardText).toContain('README.md');
+  }).toPass();
+
   await expect(page.getByText('Copied')).toBeVisible();
   await screenshot(page, page.getByText('Copied'), 50);
 });
@@ -27,8 +31,12 @@ test('copy diff file path to clipboard', async ({page}) => {
   expect(response?.status()).toBe(200);
 
   await page.click('[data-clipboard-text]');
-  const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-  expect(clipboardText).toContain('README.md');
+
+  await expect(async () => {
+    const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+    expect(clipboardText).toContain('README.md');
+  }).toPass();
+
   await expect(page.getByText('Copied')).toBeVisible();
   await screenshot(page, page.getByText('Copied'), 50);
 });
diff --git a/tests/e2e/debugserver_test.go b/tests/e2e/debugserver_test.go
index 8742790b14..e60fd44955 100644
--- a/tests/e2e/debugserver_test.go
+++ b/tests/e2e/debugserver_test.go
@@ -25,7 +25,7 @@ func TestDebugserver(t *testing.T) {
 	signal.Notify(done, syscall.SIGINT, syscall.SIGTERM)
 
 	onForgejoRun(t, func(*testing.T, *url.URL) {
-		defer DeclareGitRepos(t)()
+		DeclareGitRepos(t)
 		fmt.Println(setting.AppURL)
 		<-done
 	})
diff --git a/tests/e2e/declare_repos_test.go b/tests/e2e/declare_repos_test.go
index 85e3fcbda8..ce1e04bb4e 100644
--- a/tests/e2e/declare_repos_test.go
+++ b/tests/e2e/declare_repos_test.go
@@ -19,12 +19,11 @@ import (
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/indexer/stats"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/timeutil"
 	issue_service "forgejo.org/services/issue"
 	files_service "forgejo.org/services/repository/files"
 	"forgejo.org/services/wiki"
-	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -44,7 +43,7 @@ type SetupRepo func(*user_model.User, *repo_model.Repository)
 
 // put your Git repo declarations in here
 // feel free to amend the helper function below or use the raw variant directly
-func DeclareGitRepos(t *testing.T) func() {
+func DeclareGitRepos(t *testing.T) {
 	now := timeutil.TimeStampNow()
 	postIssue := func(repo *repo_model.Repository, user *user_model.User, age int64, title, content string) {
 		issue := &issues_model.Issue{
@@ -57,45 +56,45 @@ func DeclareGitRepos(t *testing.T) func() {
 		require.NoError(t, issue_service.NewIssue(db.DefaultContext, repo, issue, nil, nil, nil))
 	}
 
-	cleanupFunctions := []func(){
-		newRepo(t, 2, "diff-test", nil, []FileChanges{{
-			Filename: "testfile",
-			Versions: []string{"hello", "hallo", "hola", "native", "ubuntu-latest", "- runs-on: ubuntu-latest", "- runs-on: debian-latest"},
-		}}, nil),
-		newRepo(t, 2, "language-stats-test", nil, []FileChanges{{
-			Filename: "main.rs",
-			Versions: []string{"fn main() {", "println!(\"Hello World!\");", "}"},
-		}}, nil),
-		newRepo(t, 2, "mentions-highlighted", nil, []FileChanges{
-			{
-				Filename:  "history1.md",
-				Versions:  []string{""},
-				CommitMsg: "A commit message which mentions @user2 in the title\nand has some additional text which mentions @user1",
-			},
-			{
-				Filename:  "history2.md",
-				Versions:  []string{""},
-				CommitMsg: "Another commit which mentions @user1 in the title\nand @user2 in the text",
-			},
-		}, nil),
-		newRepo(t, 2, "file-uploads", nil, []FileChanges{{
-			Filename: "UPLOAD_TEST.md",
-			Versions: []string{"# File upload test\nUse this repo to test various file upload features in new branches."},
-		}}, nil),
-		newRepo(t, 2, "unicode-escaping", &tests.DeclarativeRepoOptions{
-			EnabledUnits: optional.Some([]unit_model.Type{unit_model.TypeCode, unit_model.TypeWiki}),
-		}, []FileChanges{{
-			Filename: "a-file",
-			Versions: []string{"{a}{а}"},
-		}}, func(user *user_model.User, repo *repo_model.Repository) {
-			wiki.InitWiki(db.DefaultContext, repo)
-			wiki.AddWikiPage(db.DefaultContext, user, repo, "Home", "{a}{а}", "{a}{а}")
-			wiki.AddWikiPage(db.DefaultContext, user, repo, "_Sidebar", "{a}{а}", "{a}{а}")
-			wiki.AddWikiPage(db.DefaultContext, user, repo, "_Footer", "{a}{а}", "{a}{а}")
-		}),
-		newRepo(t, 2, "multiple-combo-boxes", nil, []FileChanges{{
-			Filename: ".forgejo/issue_template/multi-combo-boxes.yaml",
-			Versions: []string{`
+	newRepo(t, 2, "diff-test", nil, []FileChanges{{
+		Filename: "testfile",
+		Versions: []string{"hello", "hallo", "hola", "native", "ubuntu-latest", "- runs-on: ubuntu-latest", "- runs-on: debian-latest"},
+	}}, nil)
+	newRepo(t, 2, "language-stats-test", nil, []FileChanges{{
+		Filename: "main.rs",
+		Versions: []string{"fn main() {", "println!(\"Hello World!\");", "}"},
+	}}, nil)
+	newRepo(t, 2, "mentions-highlighted", nil, []FileChanges{
+		{
+			Filename:  "history1.md",
+			Versions:  []string{""},
+			CommitMsg: "A commit message which mentions @user2 in the title\nand has some additional text which mentions @user1",
+		},
+		{
+			Filename:  "history2.md",
+			Versions:  []string{""},
+			CommitMsg: "Another commit which mentions @user1 in the title\nand @user2 in the text",
+		},
+	}, nil)
+	newRepo(t, 2, "file-uploads", nil, []FileChanges{{
+		Filename: "UPLOAD_TEST.md",
+		Versions: []string{"# File upload test\nUse this repo to test various file upload features in new branches."},
+	}}, nil)
+	newRepo(t, 2, "unicode-escaping", map[unit_model.Type]convert.Conversion{
+		unit_model.TypeCode: nil,
+		unit_model.TypeWiki: nil,
+	}, []FileChanges{{
+		Filename: "a-file",
+		Versions: []string{"{a}{а}"},
+	}}, func(user *user_model.User, repo *repo_model.Repository) {
+		wiki.InitWiki(db.DefaultContext, repo)
+		wiki.AddWikiPage(db.DefaultContext, user, repo, "Home", "{a}{а}", "{a}{а}")
+		wiki.AddWikiPage(db.DefaultContext, user, repo, "_Sidebar", "{a}{а}", "{a}{а}")
+		wiki.AddWikiPage(db.DefaultContext, user, repo, "_Footer", "{a}{а}", "{a}{а}")
+	})
+	newRepo(t, 2, "multiple-combo-boxes", nil, []FileChanges{{
+		Filename: ".forgejo/issue_template/multi-combo-boxes.yaml",
+		Versions: []string{`
 name: "Multiple combo-boxes"
 description: "To show something"
 body:
@@ -108,79 +107,70 @@ body:
   attributes:
     label: two
 `},
-		}}, nil),
-		newRepo(t, 11, "dependency-test", &tests.DeclarativeRepoOptions{
-			UnitConfig: optional.Some(map[unit_model.Type]convert.Conversion{
-				unit_model.TypeIssues: &repo_model.IssuesConfig{
-					EnableDependencies: true,
-				},
-			}),
-		}, []FileChanges{}, func(user *user_model.User, repo *repo_model.Repository) {
-			postIssue(repo, user, 500, "first issue here", "an issue created earlier")
-			postIssue(repo, user, 400, "second issue here (not 1)", "not the right issue, but in the right repo")
-			postIssue(repo, user, 300, "third issue here", "depends on things")
-			postIssue(repo, user, 200, "unrelated issue", "shrug emoji")
-			postIssue(repo, user, 100, "newest issue", "very new")
-		}),
-		newRepo(t, 11, "dependency-test-2", &tests.DeclarativeRepoOptions{
-			UnitConfig: optional.Some(map[unit_model.Type]convert.Conversion{
-				unit_model.TypeIssues: &repo_model.IssuesConfig{
-					EnableDependencies: true,
-				},
-			}),
-		}, []FileChanges{}, func(user *user_model.User, repo *repo_model.Repository) {
-			postIssue(repo, user, 450, "right issue", "an issue containing word right")
-			postIssue(repo, user, 150, "left issue", "an issue containing word left")
-		}),
-		newRepo(t, 2, "long-diff-test", nil, []FileChanges{{
-			Filename: "test-README.md",
-			Versions: []string{
-				readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/0-README.md"),
-			},
-		}}, func(user *user_model.User, repo *repo_model.Repository) {
-			commit1Sha := addCommitToBranch(t, user, repo, "main", "test-branch", "test-README.md", "",
-				readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/1-README.md"))
-			commit2Sha := addCommitToBranch(t, user, repo, "test-branch", "test-branch", "test-README.md", commit1Sha,
-				readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/2-README.md"))
-			addCommitToBranch(t, user, repo, "test-branch", "test-branch", "test-README.md", commit2Sha,
-				readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/3-README.md"))
-		}),
-		newRepo(t, 2, "huge-diff-test", nil, []FileChanges{{
-			Filename: "glossary.po",
-			Versions: []string{
-				func() string {
-					var sb strings.Builder
-					sb.Write([]byte("0"))
-					for i := 1; i < 2000; i++ {
-						sb.WriteString(strconv.Itoa(i))
-						sb.WriteByte('\n')
+	}}, nil)
+	newRepo(t, 11, "dependency-test", map[unit_model.Type]convert.Conversion{
+		unit_model.TypeIssues: &repo_model.IssuesConfig{
+			EnableDependencies: true,
+		},
+		unit_model.TypeCode: nil,
+	}, []FileChanges{}, func(user *user_model.User, repo *repo_model.Repository) {
+		postIssue(repo, user, 500, "first issue here", "an issue created earlier")
+		postIssue(repo, user, 400, "second issue here", "not the right issue, but in the right repo")
+		postIssue(repo, user, 300, "third issue here", "depends on things")
+		postIssue(repo, user, 200, "unrelated issue", "shrug emoji")
+		postIssue(repo, user, 100, "newest issue", "very new")
+	})
+	newRepo(t, 11, "dependency-test-2", map[unit_model.Type]convert.Conversion{
+		unit_model.TypeIssues: &repo_model.IssuesConfig{
+			EnableDependencies: true,
+		},
+		unit_model.TypeCode: nil,
+	}, []FileChanges{}, func(user *user_model.User, repo *repo_model.Repository) {
+		postIssue(repo, user, 450, "right issue", "an issue containing word right")
+		postIssue(repo, user, 150, "left issue", "an issue containing word left")
+	})
+	newRepo(t, 2, "long-diff-test", nil, []FileChanges{{
+		Filename: "test-README.md",
+		Versions: []string{
+			readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/0-README.md"),
+		},
+	}}, func(user *user_model.User, repo *repo_model.Repository) {
+		commit1Sha := addCommitToBranch(t, user, repo, "main", "test-branch", "test-README.md", "",
+			readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/1-README.md"))
+		commit2Sha := addCommitToBranch(t, user, repo, "test-branch", "test-branch", "test-README.md", commit1Sha,
+			readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/2-README.md"))
+		addCommitToBranch(t, user, repo, "test-branch", "test-branch", "test-README.md", commit2Sha,
+			readStringFile(t, "tests/e2e/declarative-repo/long-diff-test/3-README.md"))
+	})
+	newRepo(t, 2, "huge-diff-test", nil, []FileChanges{{
+		Filename: "glossary.po",
+		Versions: []string{
+			func() string {
+				var sb strings.Builder
+				sb.Write([]byte("0"))
+				for i := 1; i < 2000; i++ {
+					sb.WriteString(strconv.Itoa(i))
+					sb.WriteByte('\n')
+				}
+				return sb.String()
+			}(),
+		},
+	}}, func(user *user_model.User, repo *repo_model.Repository) {
+		addCommitToBranch(t, user, repo, "main", "main-2", "glossary.po", "",
+			func() string {
+				var sb strings.Builder
+				sb.Write([]byte("0"))
+				for i := 1; i < 2000; i++ {
+					sb.WriteString(strconv.Itoa(i))
+					if i%12 == 0 {
+						sb.WriteString("Blub")
 					}
-					return sb.String()
-				}(),
-			},
-		}}, func(user *user_model.User, repo *repo_model.Repository) {
-			addCommitToBranch(t, user, repo, "main", "main-2", "glossary.po", "",
-				func() string {
-					var sb strings.Builder
-					sb.Write([]byte("0"))
-					for i := 1; i < 2000; i++ {
-						sb.WriteString(strconv.Itoa(i))
-						if i%12 == 0 {
-							sb.WriteString("Blub")
-						}
-						sb.WriteByte('\n')
-					}
-					return sb.String()
-				}())
-		}),
-		// add your repo declarations here
-	}
-
-	return func() {
-		for _, cleanup := range cleanupFunctions {
-			cleanup()
-		}
-	}
+					sb.WriteByte('\n')
+				}
+				return sb.String()
+			}())
+	})
+	// add your repo declarations here
 }
 
 func readStringFile(t *testing.T, fn string) string {
@@ -189,18 +179,20 @@ func readStringFile(t *testing.T, fn string) string {
 	return string(c)
 }
 
-func newRepo(t *testing.T, userID int64, repoName string, initOpts *tests.DeclarativeRepoOptions, fileChanges []FileChanges, setup SetupRepo) func() {
+func newRepo(t *testing.T, userID int64, repoName string, enabledUnits map[unit_model.Type]convert.Conversion, fileChanges []FileChanges, setup SetupRepo) {
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: userID})
 
-	opts := tests.DeclarativeRepoOptions{}
-	if initOpts != nil {
-		opts = *initOpts
+	somerepo := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{
+		Name:  repoName,
+		Files: forgery.FilesInit{},
+	})
+	if len(enabledUnits) == 0 {
+		forgery.EnableRepoUnit(t, somerepo, unit_model.TypeCode, nil)
+		forgery.EnableRepoUnit(t, somerepo, unit_model.TypeIssues, nil)
 	}
-	opts.Name = optional.Some(repoName)
-	if !opts.EnabledUnits.Has() {
-		opts.EnabledUnits = optional.Some([]unit_model.Type{unit_model.TypeCode, unit_model.TypeIssues})
+	for unit, config := range enabledUnits {
+		forgery.EnableRepoUnit(t, somerepo, unit, config)
 	}
-	somerepo, _, cleanupFunc := tests.CreateDeclarativeRepoWithOptions(t, user, opts)
 
 	var lastCommitID string
 	for _, file := range fileChanges {
@@ -252,8 +244,6 @@ func newRepo(t *testing.T, userID int64, repoName string, initOpts *tests.Declar
 
 	err := stats.UpdateRepoIndexer(somerepo)
 	require.NoError(t, err)
-
-	return cleanupFunc
 }
 
 func addCommitToBranch(t *testing.T, user *user_model.User, repo *repo_model.Repository, oldBranch, newBranch, filename, lastSha, content string) string {
diff --git a/tests/e2e/e2e_test.go b/tests/e2e/e2e_test.go
index 9168cb8b51..5ce6029f07 100644
--- a/tests/e2e/e2e_test.go
+++ b/tests/e2e/e2e_test.go
@@ -120,7 +120,7 @@ func TestE2e(t *testing.T) {
 
 			// Default 2 minute timeout
 			onForgejoRun(t, func(*testing.T, *url.URL) {
-				defer DeclareGitRepos(t)()
+				DeclareGitRepos(t)
 				thisTest := runArgs
 				// when all tests are run, use unique artifacts directories per test to preserve artifacts from other tests
 				if testVisual {
diff --git a/tests/e2e/issue-comment-dropzone.test.e2e.ts b/tests/e2e/issue-comment-dropzone.test.e2e.ts
index 40bd238dc1..739490f6ad 100644
--- a/tests/e2e/issue-comment-dropzone.test.e2e.ts
+++ b/tests/e2e/issue-comment-dropzone.test.e2e.ts
@@ -48,8 +48,10 @@ async function assertCopy(page: Page, startWith: string) {
   const copyLink = preview.locator('.octicon-copy').locator('..');
   await copyLink.click();
 
-  const clipboardContent = await page.evaluate(() => navigator.clipboard.readText());
-  expect(clipboardContent).toContain(startWith);
+  await expect(async () => {
+    const clipboardContent = await page.evaluate(() => navigator.clipboard.readText());
+    expect(clipboardContent).toContain(startWith);
+  }).toPass();
 }
 
 test('Paste image in new comment', async ({page}) => {
diff --git a/tests/e2e/issue-sidebar.test.e2e.ts b/tests/e2e/issue-sidebar.test.e2e.ts
index cf3fe607d2..1a382c44d7 100644
--- a/tests/e2e/issue-sidebar.test.e2e.ts
+++ b/tests/e2e/issue-sidebar.test.e2e.ts
@@ -16,18 +16,18 @@ test.describe('Pull: Toggle WIP', () => {
   const prTitle = 'pull5';
 
   async function toggle_wip_to({page}: {page: Page}, should: boolean) {
-    await page.waitForLoadState('domcontentloaded');
+    const loadPromise = page.waitForEvent('load');
     if (should) {
       await page.getByText('Still in progress?').click();
     } else {
       await page.getByText('Ready for review?').click();
     }
+    await loadPromise;
   }
 
   async function check_wip({page}: {page: Page}, is: boolean) {
     const elemTitle = 'h1';
     const stateLabel = '.issue-state-label';
-    await page.waitForLoadState('domcontentloaded');
     await expect(page.locator(elemTitle)).toContainText(prTitle);
     await expect(page.locator(elemTitle)).toContainText('#5');
     const wipRegex = /(wip|\[WIP\])/i;
@@ -43,16 +43,16 @@ test.describe('Pull: Toggle WIP', () => {
   async function setTitle({page}: {page: Page}, title: string) {
     await page.locator('#issue-title-edit-show').click();
     await page.locator('#issue-title-editor input').fill(title);
+    const loadPromise = page.waitForEvent('load');
     await page.getByText('Save').click();
+    await loadPromise;
   }
 
   test.beforeEach(async ({page}) => {
     const response = await page.goto('/user2/repo1/pulls/5');
     expect(response?.status()).toBe(200); // Status OK
     // ensure original title
-    await page.locator('#issue-title-edit-show').click();
-    await page.locator('#issue-title-editor input').fill(prTitle);
-    await page.getByText('Save').click();
+    await setTitle({page}, prTitle);
     await check_wip({page}, false);
   });
 
@@ -66,11 +66,8 @@ test.describe('Pull: Toggle WIP', () => {
   });
 
   test('manual edit', async ({page}) => {
-    await page.goto('/user2/repo1/pulls/5');
     // manually edit title to another prefix
-    await page.locator('#issue-title-edit-show').click();
-    await page.locator('#issue-title-editor input').fill(`[WIP] ${prTitle}`);
-    await page.getByText('Save').click();
+    await setTitle({page}, `[WIP] ${prTitle}`);
     await check_wip({page}, true);
     // remove again
     await toggle_wip_to({page}, false);
@@ -78,12 +75,9 @@ test.describe('Pull: Toggle WIP', () => {
   });
 
   test('maximum title length', async ({page}) => {
-    await page.goto('/user2/repo1/pulls/5');
     // check maximum title length is handled gracefully
     const maxLenStr = prTitle + 'a'.repeat(240);
-    await page.locator('#issue-title-edit-show').click();
-    await page.locator('#issue-title-editor input').fill(maxLenStr);
-    await page.getByText('Save').click();
+    await setTitle({page}, maxLenStr);
     await expect(page.locator('h1')).toContainText(maxLenStr);
     await check_wip({page}, false);
     await toggle_wip_to({page}, true);
@@ -95,7 +89,6 @@ test.describe('Pull: Toggle WIP', () => {
   });
 
   test('wip prefix casing', async ({page}) => {
-    await page.goto('/user2/repo1/pulls/5');
     await setTitle({page}, `wIP:${prTitle}`);
     await expect(page.locator('h1')).toContainText(`wIP:${prTitle}`);
     await check_wip({page}, true);
@@ -380,6 +373,9 @@ test('Issue: Reference', async ({page}) => {
   );
 
   await page.getByRole('button', {name: 'Copy'}).click();
-  const reference = await page.evaluate(() => navigator.clipboard.readText());
-  expect(reference).toBe('user2/repo1#1');
+
+  await expect(async () => {
+    const reference = await page.evaluate(() => navigator.clipboard.readText());
+    expect(reference).toBe('user2/repo1#1');
+  }).toPass();
 });
diff --git a/tests/e2e/label-colorpicker.test.e2e.ts b/tests/e2e/label-colorpicker.test.e2e.ts
new file mode 100644
index 0000000000..da2dee7c92
--- /dev/null
+++ b/tests/e2e/label-colorpicker.test.e2e.ts
@@ -0,0 +1,35 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// @watch start
+// web_src/js/features/colorpicker.js
+// templates/repo/issue/labels/label_new.tmpl
+// @watch end
+
+import {expect} from '@playwright/test';
+import {test} from './utils_e2e.ts';
+
+test.use({user: 'user2'});
+
+test('Color picker is visible above the new label dialog', async ({page}) => {
+  const response = await page.goto('/user2/repo1/labels');
+  expect(response?.status()).toBe(200);
+
+  // Open the "New label" dialog
+  await page.getByRole('button', {name: 'New label'}).click();
+  const dialog = page.locator('dialog#new-label-modal');
+  await expect(dialog).toBeVisible();
+
+  // Click the color preview square to open the color picker popup
+  const colorInput = dialog.locator('.js-color-picker-input input[name="color"]');
+  await colorInput.click();
+
+  // The hex-color-picker should be visible and not hidden behind the dialog
+  const picker = dialog.locator('hex-color-picker');
+  await expect(picker).toBeVisible();
+
+  // Verify the picker tippy popup is a descendant of the dialog element,
+  // not appended to document.body (which would render below the dialog top layer)
+  const pickerInDialog = dialog.locator('.tippy-box hex-color-picker');
+  await expect(pickerInDialog).toBeVisible();
+});
diff --git a/tests/e2e/markdown-editor.test.e2e.ts b/tests/e2e/markdown-editor.test.e2e.ts
index 5274b25a73..acc7a00a24 100644
--- a/tests/e2e/markdown-editor.test.e2e.ts
+++ b/tests/e2e/markdown-editor.test.e2e.ts
@@ -367,7 +367,7 @@ test('Markdown insert table', async ({page}) => {
     const newTableButton = area.locator('button[data-md-action="new-table"]');
     await newTableButton.click();
 
-    const newTableModal = page.locator('[data-modal-name="new-markdown-table"].active');
+    const newTableModal = page.locator('[data-modal-name="new-markdown-table"][open]');
     await expect(newTableModal).toBeVisible();
     await screenshot(page);
 
@@ -417,9 +417,9 @@ test('Markdown insert link', async ({page}) => {
     const newLinkButton = area.locator('button[data-md-action="new-link"]');
     await newLinkButton.click();
 
-    const newLinkModal = page.locator('[data-modal-name="new-markdown-link"].active');
+    const newLinkModal = page.locator('[data-modal-name="new-markdown-link"][open]');
     await expect(newLinkModal).toBeVisible();
-    await accessibilityCheck({page}, ['[data-modal-name="new-markdown-link"].active'], [], []);
+    await accessibilityCheck({page}, ['[data-modal-name="new-markdown-link"][open]'], [], []);
     await screenshot(page);
 
     const urlInput = newLinkModal.locator('input[name="link-url"]');
@@ -455,9 +455,9 @@ test('Markdown insert link', async ({page}) => {
 
     await textarea.press('ControlOrMeta+KeyK');
 
-    const newLinkModal = page.locator('[data-modal-name="new-markdown-link"].active');
+    const newLinkModal = page.locator('[data-modal-name="new-markdown-link"][open]');
     await expect(newLinkModal).toBeVisible();
-    await accessibilityCheck({page}, ['[data-modal-name="new-markdown-link"].active'], [], []);
+    await accessibilityCheck({page}, ['[data-modal-name="new-markdown-link"][open]'], [], []);
     await screenshot(page);
 
     const urlInput = newLinkModal.locator('input[name="link-url"]');
@@ -579,7 +579,7 @@ test('Multiple combo markdown: insert table', async ({page}) => {
   const newTableButtonOne = page.locator('[for="_combo_markdown_editor_0"] button[data-md-action="new-table"]');
   await newTableButtonOne.click();
 
-  const newTableModalOne = page.locator('div[data-markdown-table-modal-id="0"]');
+  const newTableModalOne = page.locator('dialog[data-markdown-table-modal-id="0"]');
   await expect(newTableModalOne).toBeVisible();
 
   await newTableModalOne.locator('input[name="table-rows"]').fill('3');
@@ -601,7 +601,7 @@ test('Multiple combo markdown: insert table', async ({page}) => {
   const newTableButtonTwo = page.locator('[for="_combo_markdown_editor_1"] button[data-md-action="new-table"]');
   await newTableButtonTwo.click();
 
-  const newTableModalTwo = page.locator('div[data-markdown-table-modal-id="1"]');
+  const newTableModalTwo = page.locator('dialog[data-markdown-table-modal-id="1"]');
   await expect(newTableModalTwo).toBeVisible();
 
   await newTableModalTwo.locator('input[name="table-rows"]').fill('2');
diff --git a/tests/e2e/modal.test.e2e.ts b/tests/e2e/modal.test.e2e.ts
index 40fe33e9a6..28161a2012 100644
--- a/tests/e2e/modal.test.e2e.ts
+++ b/tests/e2e/modal.test.e2e.ts
@@ -103,27 +103,3 @@ test('Dialog modal: width', async ({page, isMobile}) => {
     expect(width).toBe(800);
   }
 });
-
-test('Dialog modal: short viewport', async ({page, isMobile}) => {
-  test.skip(isMobile);
-
-  // Small height for viewport.
-  await page.setViewportSize({
-    width: 1000,
-    height: 200,
-  });
-
-  await page.goto('/user2/repo1/settings');
-
-  // Open modal with long content
-  const deleteModal = page.locator('#delete-repo-modal');
-  await expect(deleteModal).toBeHidden();
-  await page.getByRole('button', {name: 'Delete this repository'}).click();
-  await expect(deleteModal).toBeVisible();
-
-  // Scroll to the bottom.
-  const scrollY = await page.evaluate(() => document.querySelector('.ui.dimmer').scrollHeight);
-  await page.mouse.wheel(0, scrollY);
-  const scrollTop = await page.evaluate(() => document.querySelector('.ui.dimmer').scrollTop);
-  expect(scrollTop).toBeGreaterThan(0);
-});
diff --git a/tests/e2e/org-members.test.e2e.ts b/tests/e2e/org-members.test.e2e.ts
index b5cb9bd104..c8833991bb 100644
--- a/tests/e2e/org-members.test.e2e.ts
+++ b/tests/e2e/org-members.test.e2e.ts
@@ -12,7 +12,7 @@ import {test} from './utils_e2e.ts';
 test.use({user: 'user2'});
 
 test('Toggle visibility', async ({page}) => {
-  page.goto('/org/org3/members');
+  await page.goto('/org/org3/members');
 
   // Button "Make hidden" for user2's row
   const hideUser2 = page.locator('.link-action[data-url="/org/org3/members/action/private?uid=2"]');
@@ -29,10 +29,12 @@ test('Toggle visibility', async ({page}) => {
 
   // Revert for repeatability
   await showUser2.click();
+  await expect(hideUser2).toBeVisible();
+  await expect(showUser2).toBeHidden();
 });
 
 test('Leave org', async ({page}) => {
-  page.goto('/org/org3/members');
+  await page.goto('/org/org3/members');
 
   // Button "Leave" for user2's row
   const leaveButton = page.locator('.delete-button[data-url="/org/org3/members/action/leave"]');
@@ -49,3 +51,40 @@ test('Leave org', async ({page}) => {
   // Getting error is enough to know that the correct request went though
   await expect(page.locator('.flash-error').getByText('You cannot remove the last user from the "owners" team.')).toBeVisible();
 });
+
+test('Add and remove a new member to the org', async ({page}) => {
+  await page.goto('/org/org3/members');
+
+  // Click the "Add member" button
+  const newMemberButton = page.locator('#add-org-member-button');
+  await newMemberButton.click();
+
+  // A modal dialog appears
+  await expect(page.locator('#add-member-modal')).toBeVisible();
+
+  // Fill in the name of the user to add
+  await page.locator('#search-user-box input').fill('user5');
+  // Pick the auto-complete suggestion
+  await page.locator('#search-user-box .results a.result').click();
+
+  // Choose some teams
+  await page.locator('#add-member-team_2').click();
+  await page.locator('#add-member-team_12').click();
+
+  // Click the button
+  await page.locator('#add-member-modal .actions button.ok').click();
+
+  // Verify that the user was added
+  await expect(page.locator('.organization.members .list a').getByText('user5 (User Five)')).toBeVisible();
+
+  // Revert for repeatability
+  const removeButton = page.locator('.delete-button[data-url="/org/org3/members/action/remove"][data-datauid="5"]');
+  await expect(async () => {
+    await removeButton.click();
+    // A confirmation modal will appear
+    await expect(page.locator('.modal#remove-organization-member')).toBeVisible();
+    // Proceed removing from the org
+    await page.locator('.modal#remove-organization-member .actions button.ok').click();
+    await expect(page.locator('.organization.members .list a').getByText('user5 (User Five)')).toBeHidden();
+  }).toPass();
+});
diff --git a/tests/e2e/repo-code.test.e2e.ts b/tests/e2e/repo-code.test.e2e.ts
index 7f9ca147ea..d84fb58b1a 100644
--- a/tests/e2e/repo-code.test.e2e.ts
+++ b/tests/e2e/repo-code.test.e2e.ts
@@ -148,11 +148,13 @@ test('Copy line permalink', async ({page}) => {
   const response = await page.goto('/user2/repo1/src/branch/master/README.md?display=source#L1');
   expect(response?.status()).toBe(200);
 
-  await page.locator('.code-line-button').click();
-  // eslint-disable-next-line playwright/no-force-option
-  await page.locator('.tippy-box .copy-line-permalink').click({force: true});
-  const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-  expect(clipboardText).toContain('README.md?display=source#L1');
+  await expect(async () => {
+    await page.locator('.code-line-button').click();
+    // eslint-disable-next-line playwright/no-force-option
+    await page.locator('.tippy-box .copy-line-permalink').click({force: true});
+    const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+    expect(clipboardText).toContain('README.md?display=source#L1');
+  }).toPass();
 });
 
 test('Line menu styles', async ({page}) => {
diff --git a/tests/e2e/runner-management.test.e2e.ts b/tests/e2e/runner-management.test.e2e.ts
index 1dba606a1b..02edbd6e87 100644
--- a/tests/e2e/runner-management.test.e2e.ts
+++ b/tests/e2e/runner-management.test.e2e.ts
@@ -121,13 +121,19 @@ test.describe('Runners of user2', () => {
     await expect(page).toHaveTitle(/^Set up runner runner-991301 .*/);
     await expect(page.getByRole('heading', {name: 'Set up runner runner-991301'})).toBeVisible();
 
-    await page.getByRole('button', {name: 'Copy runner UUID'}).click();
-    const runnerUUID = await page.evaluate(() => navigator.clipboard.readText());
-    expect(runnerUUID).toMatch(uuidPattern);
+    let runnerUUID;
+    await expect(async () => {
+      await page.getByRole('button', {name: 'Copy runner UUID'}).click();
+      runnerUUID = await page.evaluate(() => navigator.clipboard.readText());
+      expect(runnerUUID).toMatch(uuidPattern);
+    }).toPass();
 
-    await page.getByRole('button', {name: 'Copy runner token'}).click();
-    const runnerToken = await page.evaluate(() => navigator.clipboard.readText());
-    expect(runnerToken).toMatch(tokenPattern);
+    let runnerToken;
+    await expect(async () => {
+      await page.getByRole('button', {name: 'Copy runner token'}).click();
+      runnerToken = await page.evaluate(() => navigator.clipboard.readText());
+      expect(runnerToken).toMatch(tokenPattern);
+    }).toPass();
 
     await expect(page.getByRole('term')).toHaveText(['UUID', 'Token']);
     await expect(page.getByRole('definition')).toContainText([runnerUUID, runnerToken]);
@@ -227,14 +233,20 @@ test.describe('Runners of user2', () => {
     await expect(page).toHaveTitle(/^Set up runner runner-2 .*/);
     await expect(page.getByRole('heading', {name: 'Set up runner runner-2'})).toBeVisible();
 
-    await page.getByRole('button', {name: 'Copy runner UUID'}).click();
-    const runnerUUID = await page.evaluate(() => navigator.clipboard.readText());
-    expect(runnerUUID).toEqual('3a20ad8d-d5d6-4b7b-ba55-841ac8264c17');
+    let runnerUUID;
+    await expect(async () => {
+      await page.getByRole('button', {name: 'Copy runner UUID'}).click();
+      runnerUUID = await page.evaluate(() => navigator.clipboard.readText());
+      expect(runnerUUID).toEqual('3a20ad8d-d5d6-4b7b-ba55-841ac8264c17');
+    }).toPass();
 
-    await page.getByRole('button', {name: 'Copy runner token'}).click();
-    const runnerToken = await page.evaluate(() => navigator.clipboard.readText());
-    expect(runnerToken).not.toEqual('9730f9d2c6c731f07582788d1a1fe72a6b999a17');
-    expect(runnerToken).toMatch(tokenPattern);
+    let runnerToken;
+    await expect(async () => {
+      await page.getByRole('button', {name: 'Copy runner token'}).click();
+      runnerToken = await page.evaluate(() => navigator.clipboard.readText());
+      expect(runnerToken).not.toEqual('9730f9d2c6c731f07582788d1a1fe72a6b999a17');
+      expect(runnerToken).toMatch(tokenPattern);
+    }).toPass();
 
     await expect(page.getByRole('term')).toHaveText(['UUID', 'Token']);
     await expect(page.getByRole('definition')).toContainText([runnerUUID, runnerToken]);
@@ -424,13 +436,19 @@ test.describe('Global runners', () => {
     await expect(page).toHaveTitle(/^Set up runner runner-473465 .*/);
     await expect(page.getByRole('heading', {name: 'Set up runner runner-473465'})).toBeVisible();
 
-    await page.getByRole('button', {name: 'Copy runner UUID'}).click();
-    const runnerUUID = await page.evaluate(() => navigator.clipboard.readText());
-    expect(runnerUUID).toMatch(uuidPattern);
+    let runnerUUID;
+    await expect(async () => {
+      await page.getByRole('button', {name: 'Copy runner UUID'}).click();
+      runnerUUID = await page.evaluate(() => navigator.clipboard.readText());
+      expect(runnerUUID).toMatch(uuidPattern);
+    }).toPass();
 
-    await page.getByRole('button', {name: 'Copy runner token'}).click();
-    const runnerToken = await page.evaluate(() => navigator.clipboard.readText());
-    expect(runnerToken).toMatch(tokenPattern);
+    let runnerToken;
+    await expect(async () => {
+      await page.getByRole('button', {name: 'Copy runner token'}).click();
+      runnerToken = await page.evaluate(() => navigator.clipboard.readText());
+      expect(runnerToken).toMatch(tokenPattern);
+    }).toPass();
 
     await expect(page.getByRole('term')).toHaveText(['UUID', 'Token']);
     await expect(page.getByRole('definition')).toContainText([runnerUUID, runnerToken]);
diff --git a/tests/forgery/fs.go b/tests/forgery/fs.go
new file mode 100644
index 0000000000..f41b193702
--- /dev/null
+++ b/tests/forgery/fs.go
@@ -0,0 +1,112 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package forgery
+
+import (
+	"fmt"
+	"io"
+	"io/fs"
+	"strings"
+	"testing/fstest"
+	"time"
+
+	repo_model "forgejo.org/models/repo"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/git"
+	files_service "forgejo.org/services/repository/files"
+)
+
+type MapFS = fstest.MapFS
+
+// when a file has one of this mode, it needs specific git handling
+// other non-zero modes are rejected
+const (
+	modeSubmodule = fs.ModeNamedPipe // hacky, but
+	modeSymlink   = fs.ModeSymlink
+)
+
+func MapFile(data string) *fstest.MapFile {
+	return &fstest.MapFile{
+		Data: []byte(data),
+	}
+}
+
+func MapSymlink(target string) *fstest.MapFile {
+	return &fstest.MapFile{
+		Data: []byte(target),
+		Mode: modeSymlink,
+	}
+}
+
+func MapSubmodule(sha string) *fstest.MapFile {
+	return &fstest.MapFile{
+		Data: []byte(sha),
+		Mode: modeSubmodule,
+	}
+}
+
+func initRepo(doer *user_model.User, repo *repo_model.Repository, format git.ObjectFormat, fsys fs.FS, commitMessage string) (string, error) {
+	t, err := files_service.NewTemporaryUploadRepository(git.DefaultContext, repo)
+	if err != nil {
+		return "", err
+	}
+	defer t.Close()
+	if err := t.Init(format.Name()); err != nil {
+		return "", err
+	}
+
+	if err := fs.WalkDir(fsys, ".", func(path string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return err
+		}
+
+		var content io.Reader
+		mode := git.EntryModeBlob
+		switch d.Type() {
+		case modeSymlink:
+			target, err := fs.ReadLink(fsys, path)
+			if err != nil {
+				return err
+			}
+			content = strings.NewReader(target)
+			mode = git.EntryModeSymlink
+		case modeSubmodule:
+			mode = git.EntryModeCommit
+			fallthrough
+		case 0:
+			f, err := fsys.Open(path)
+			if err != nil {
+				return err
+			}
+			defer f.Close()
+
+			content = f
+		default:
+			return fmt.Errorf("unexpected file type in forgery.CreateRepository %s: %s", path, d.Type())
+		}
+
+		// add object to the database
+		objectHash, err := t.HashObject(content)
+		if err != nil {
+			return err
+		}
+		// Add the object to the index
+		return t.AddObjectToIndex(mode.String(), objectHash, path)
+	}); err != nil {
+		return "", err
+	}
+
+	treeHash, err := t.WriteTree()
+	if err != nil {
+		return "", err
+	}
+
+	now := time.Now()
+	commitHash, err := t.CommitTreeWithDate("", doer, doer, treeHash, commitMessage, false, now, now)
+	if err != nil {
+		return "", err
+	}
+
+	return commitHash, t.Push(doer, commitHash, repo.DefaultBranch)
+}
diff --git a/tests/forgery/repo.go b/tests/forgery/repo.go
new file mode 100644
index 0000000000..bfa0a51681
--- /dev/null
+++ b/tests/forgery/repo.go
@@ -0,0 +1,138 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package forgery
+
+import (
+	"cmp"
+	"io/fs"
+	"testing"
+
+	repo_model "forgejo.org/models/repo"
+	unit_model "forgejo.org/models/unit"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/git"
+	repo_service "forgejo.org/services/repository"
+	wiki_service "forgejo.org/services/wiki"
+
+	"github.com/stretchr/testify/require"
+	"xorm.io/xorm/convert"
+)
+
+type CreateRepositoryOptions struct {
+	Name string // if nil a unique name (derived from the test name) will be generated
+
+	// Content of the initial commit, if nil the git repo will be left uninitialized.
+	// Use [MapFS] or [FilesInit] to setup the initial files.
+	Files fs.FS
+
+	ObjectFormat git.ObjectFormat // If nil, SHA1
+	IsTemplate   bool
+	IsPrivate    bool
+
+	LatestSha   *string // if not nil, the commit sha after initializing the repo with the Files will be written to this ref
+	SkipCleanup bool    // if true the repo will not be deleted at the end of the test (can be useful to debug locally)
+}
+
+// FilesInit specifies the templates to use upon repository initialization.
+type FilesInit struct {
+	Readme     string
+	Gitignores string
+	License    string
+}
+
+func (FilesInit) Open(name string) (fs.File, error) {
+	panic("FilesInit is only a sentinel value")
+}
+
+// CreateRepository returns the repo, owner and opts can be nil
+func CreateRepository(t testing.TB, owner *user_model.User, opts *CreateRepositoryOptions) *repo_model.Repository {
+	t.Helper()
+
+	if owner == nil {
+		owner = CreateUser(t, nil) // if specific options are needed, create the owner manually
+	}
+	if opts == nil {
+		opts = &CreateRepositoryOptions{}
+	}
+
+	repoName := opts.Name
+	if repoName == "" {
+		repoName = "repo-" + uniqueSafeName(t.Name())
+	}
+
+	gitFormat := cmp.Or(opts.ObjectFormat, git.Sha1ObjectFormat)
+
+	// Create the repository
+	createOptions := repo_service.CreateRepoOptions{
+		Name:             repoName,
+		Description:      "Test Repo",
+		DefaultBranch:    "main",
+		IsTemplate:       opts.IsTemplate,
+		ObjectFormatName: gitFormat.Name(),
+		IsPrivate:        opts.IsPrivate,
+	}
+	if fi, ok := opts.Files.(FilesInit); ok {
+		createOptions.AutoInit = true
+		createOptions.Readme = cmp.Or(fi.Readme, "Default")
+		createOptions.Gitignores = fi.Gitignores
+		createOptions.License = fi.License
+	}
+	repo, err := repo_service.CreateRepositoryDirectly(t.Context(), owner, owner, createOptions)
+	require.NoError(t, err)
+	if !opts.SkipCleanup {
+		t.Cleanup(func() {
+			_ = repo_service.DeleteRepository(t.Context(), owner, repo, false)
+		})
+	}
+	require.NotEmpty(t, repo)
+
+	if !createOptions.AutoInit && opts.Files != nil {
+		sha, err := initRepo(owner, repo, gitFormat, opts.Files, "init")
+		require.NoError(t, err)
+		if opts.LatestSha != nil {
+			*opts.LatestSha = sha
+		}
+
+		// reload the repo since pushing a commit might update the model via the push_update queue (IsEmpty for instance)
+		repo, err = repo_model.GetRepositoryByID(t.Context(), repo.ID)
+		require.NoError(t, err)
+	}
+	repo.Owner = owner
+
+	return repo
+}
+
+func InitWiki(t testing.TB, repo *repo_model.Repository, branch string) {
+	// Set the wiki branch in the database first
+	repo.WikiBranch = branch
+	err := repo_model.UpdateRepositoryCols(t.Context(), repo, "wiki_branch")
+	require.NoError(t, err)
+
+	// Initialize the wiki
+	err = wiki_service.InitWiki(t.Context(), repo)
+	require.NoError(t, err)
+
+	// Add a new wiki page
+	err = wiki_service.AddWikiPage(t.Context(), repo.Owner, repo, "Home", "Welcome to the wiki!", "Add a Home page")
+	require.NoError(t, err)
+}
+
+// config may be nil
+func EnableRepoUnit(t testing.TB, repo *repo_model.Repository, unit unit_model.Type, config convert.Conversion) {
+	t.Helper()
+
+	err := repo_service.UpdateRepositoryUnits(t.Context(), repo, []repo_model.RepoUnit{{
+		RepoID: repo.ID,
+		Type:   unit,
+		Config: config,
+	}}, nil)
+	require.NoError(t, err)
+}
+
+func DisableRepoUnits(t testing.TB, repo *repo_model.Repository, units ...unit_model.Type) {
+	t.Helper()
+
+	err := repo_service.UpdateRepositoryUnits(t.Context(), repo, nil, units)
+	require.NoError(t, err)
+}
diff --git a/tests/forgery/user.go b/tests/forgery/user.go
new file mode 100644
index 0000000000..1175297497
--- /dev/null
+++ b/tests/forgery/user.go
@@ -0,0 +1,66 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package forgery
+
+import (
+	"math/rand/v2"
+	"regexp"
+	"strconv"
+	"testing"
+
+	org_model "forgejo.org/models/organization"
+	user_model "forgejo.org/models/user"
+
+	"github.com/stretchr/testify/require"
+)
+
+var nameCleaner = regexp.MustCompile(`[^a-zA-Z0-9-]+`) // exclude "_", to prevent multiple consecutive dashes
+
+// uniqueSafeName replaces specials chars with _ and appends a random hex suffix
+func uniqueSafeName(testName string) string {
+	return nameCleaner.ReplaceAllLiteralString(testName, "_") + "-" + strconv.FormatUint(uint64(rand.Uint32()), 16)
+}
+
+type CreateUserOptions struct {
+	IsAdmin bool
+}
+
+const userPassword = "password"
+
+func CreateUser(t testing.TB, opts *CreateUserOptions) *user_model.User {
+	t.Helper()
+
+	if opts == nil {
+		opts = &CreateUserOptions{}
+	}
+	u := &user_model.User{}
+
+	name := "user-" + uniqueSafeName(t.Name())
+
+	u.Name = name
+	u.Email = name + "@test.forgejo.org"
+	u.Passwd = userPassword
+	u.IsAdmin = opts.IsAdmin
+
+	err := user_model.CreateUser(t.Context(), u)
+	require.NoError(t, err)
+	return u
+}
+
+func CreateOrganisation(t testing.TB, owner *user_model.User) *org_model.Organization {
+	t.Helper()
+
+	if owner == nil {
+		owner = CreateUser(t, nil) // if specific options are needed, create the owner manually
+	}
+	o := &org_model.Organization{}
+
+	name := "org-" + uniqueSafeName(t.Name())
+
+	o.Name = name
+
+	err := org_model.CreateOrganization(t.Context(), o, owner)
+	require.NoError(t, err)
+	return o
+}
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/HEAD b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/HEAD
new file mode 100644
index 0000000000..cb089cd89a
--- /dev/null
+++ b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/HEAD
@@ -0,0 +1 @@
+ref: refs/heads/master
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/config b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/config
new file mode 100644
index 0000000000..e6da231579
--- /dev/null
+++ b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/config
@@ -0,0 +1,6 @@
+[core]
+	repositoryformatversion = 0
+	filemode = true
+	bare = true
+	ignorecase = true
+	precomposeunicode = true
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/description b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/description
new file mode 100644
index 0000000000..498b267a8c
--- /dev/null
+++ b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/description
@@ -0,0 +1 @@
+Unnamed repository; edit this file 'description' to name the repository.
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/info/exclude b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/info/exclude
new file mode 100644
index 0000000000..a5196d1be8
--- /dev/null
+++ b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/info/exclude
@@ -0,0 +1,6 @@
+# git ls-files --others --exclude-from=.git/info/exclude
+# Lines that start with '#' are comments.
+# For a project mostly in C, the following would be a good set of
+# exclude patterns (uncomment them if you want to use them):
+# *.[oa]
+# *~
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/20/ade30d25e0ecaeec84e7f542a8456900858240 b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/20/ade30d25e0ecaeec84e7f542a8456900858240
new file mode 100644
index 0000000000..9f3ffe5f27
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/20/ade30d25e0ecaeec84e7f542a8456900858240 differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/27/74debeea6dc742cc4971a92db0e08b95b60588 b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/27/74debeea6dc742cc4971a92db0e08b95b60588
new file mode 100644
index 0000000000..5d9226f7a1
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/27/74debeea6dc742cc4971a92db0e08b95b60588 differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/2a/47ca4b614a9f5a43abbd5ad851a54a616ffee6 b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/2a/47ca4b614a9f5a43abbd5ad851a54a616ffee6
new file mode 100644
index 0000000000..ca60d2314f
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/2a/47ca4b614a9f5a43abbd5ad851a54a616ffee6 differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/2f/9b22fd3159a43b7b4e5dd806fcd544edf8716f b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/2f/9b22fd3159a43b7b4e5dd806fcd544edf8716f
new file mode 100644
index 0000000000..e98d752dad
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/2f/9b22fd3159a43b7b4e5dd806fcd544edf8716f differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/d2/2b4d4daa5be07329fcef6ed458f00cf3392da0 b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/d2/2b4d4daa5be07329fcef6ed458f00cf3392da0
new file mode 100644
index 0000000000..e319f8ce34
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/d2/2b4d4daa5be07329fcef6ed458f00cf3392da0 differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/d5/6a3073c1dbb7b15963110a049d50cdb5db99fc b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/d5/6a3073c1dbb7b15963110a049d50cdb5db99fc
new file mode 100644
index 0000000000..eff3c9833e
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/d5/6a3073c1dbb7b15963110a049d50cdb5db99fc differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/ec/f0db3c1ec806522de4b491fb9a3c7457398c61 b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/ec/f0db3c1ec806522de4b491fb9a3c7457398c61
new file mode 100644
index 0000000000..ed431f70d3
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/ec/f0db3c1ec806522de4b491fb9a3c7457398c61 differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/ee/16d127df463aa491e08958120f2108b02468df b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/ee/16d127df463aa491e08958120f2108b02468df
new file mode 100644
index 0000000000..e177f69e37
Binary files /dev/null and b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/objects/ee/16d127df463aa491e08958120f2108b02468df differ
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/refs/heads/master b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/refs/heads/master
new file mode 100644
index 0000000000..ccee722d52
--- /dev/null
+++ b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/refs/heads/master
@@ -0,0 +1 @@
+2a47ca4b614a9f5a43abbd5ad851a54a616ffee6
diff --git a/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/refs/heads/test_branch b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/refs/heads/test_branch
new file mode 100644
index 0000000000..dfe0c6a128
--- /dev/null
+++ b/tests/gitea-repositories-meta/test_assign_project_org/test_assign_project_repo.git/refs/heads/test_branch
@@ -0,0 +1 @@
+d22b4d4daa5be07329fcef6ed458f00cf3392da0
diff --git a/tests/install.ini.tmpl b/tests/install.ini.tmpl
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/integration/actions_run_test.go b/tests/integration/actions_run_test.go
new file mode 100644
index 0000000000..64210f1a71
--- /dev/null
+++ b/tests/integration/actions_run_test.go
@@ -0,0 +1,123 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	actions_model "forgejo.org/models/actions"
+	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unittest"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/tests"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestActionRunDeletion(t *testing.T) {
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user2.ID})
+	user5 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+	repo62 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 62, OwnerID: user2.ID})
+
+	sessUser2 := loginUser(t, user2.Name)
+	sessUser5 := loginUser(t, user5.Name)
+
+	t.Run("Run removed", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionRunDeletion")()
+		defer tests.PrepareTestEnv(t)()
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 2)
+		runner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 41601})
+
+		requestURL := fmt.Sprintf("/%s/actions/runs/%d/delete", repo1.FullName(), run.Index)
+		request := NewRequest(t, "POST", requestURL)
+		response := sessUser2.MakeRequest(t, request, http.StatusOK)
+		assert.JSONEq(t, `{"ok":true}`, response.Body.String())
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRun{ID: run.ID})
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRunJob{ID: job.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID:  run.ID,
+			Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 2)
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRunner{ID: runner.ID})
+	})
+
+	t.Run("Error if run has not completed", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionRunDeletion")()
+		defer tests.PrepareTestEnv(t)()
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34902})
+
+		requestURL := fmt.Sprintf("/%s/actions/runs/%d/delete", repo1.FullName(), run.Index)
+		request := NewRequest(t, "POST", requestURL)
+		response := sessUser2.MakeRequest(t, request, http.StatusInternalServerError)
+		assert.JSONEq(t, `{"message":"Could not delete run."}`, response.Body.String())
+
+		// Verify that the run still exists.
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+	})
+
+	t.Run("Nothing happens if run does not belong to repository", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionRunDeletion")()
+		defer tests.PrepareTestEnv(t)()
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+
+		requestURL := fmt.Sprintf("/%s/actions/runs/%d/delete", repo62.FullName(), run.Index)
+		request := NewRequest(t, "POST", requestURL)
+		response := sessUser2.MakeRequest(t, request, http.StatusOK)
+		assert.JSONEq(t, `{"ok":true}`, response.Body.String())
+
+		// Verify that the run still exists.
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+	})
+
+	t.Run("Nothing happens if run does not exist", func(t *testing.T) {
+		defer tests.PrepareTestEnv(t)()
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRun{Index: 260871})
+
+		requestURL := fmt.Sprintf("/%s/actions/runs/%d/delete", repo1.FullName(), 260871)
+		request := NewRequest(t, "POST", requestURL)
+		response := sessUser2.MakeRequest(t, request, http.StatusOK)
+		assert.JSONEq(t, `{"ok":true}`, response.Body.String())
+	})
+
+	t.Run("Removal requires ownership", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionRunDeletion")()
+		defer tests.PrepareTestEnv(t)()
+
+		isCollaborator, err := repo_model.IsCollaborator(t.Context(), repo1.ID, user5.ID)
+		require.NoError(t, err)
+		require.True(t, isCollaborator)
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+
+		requestURL := fmt.Sprintf("/%s/actions/runs/%d/delete", repo1.FullName(), run.Index)
+		request := NewRequest(t, "POST", requestURL)
+		MakeRequest(t, request, http.StatusNotFound)
+
+		// Verify that run still exists
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+
+		request = NewRequest(t, "POST", requestURL)
+		sessUser5.MakeRequest(t, request, http.StatusNotFound)
+
+		// Verify that run still exists
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+
+		request = NewRequest(t, "POST", requestURL)
+		sessUser2.MakeRequest(t, request, http.StatusOK)
+
+		// Verify that run no longer exists
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRun{ID: run.ID})
+	})
+}
diff --git a/tests/integration/actions_trigger_test.go b/tests/integration/actions_trigger_test.go
index 914acadf14..19edb8b4ad 100644
--- a/tests/integration/actions_trigger_test.go
+++ b/tests/integration/actions_trigger_test.go
@@ -36,6 +36,7 @@ import (
 	repo_service "forgejo.org/services/repository"
 	files_service "forgejo.org/services/repository/files"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -1008,6 +1009,64 @@ func TestActionsWorkflowDispatchDynamicMatrix(t *testing.T) {
 	})
 }
 
+// Early in the job parsing, dynamic matrices may need to access workflow inputs.  Boolean inputs need special handling
+// which is what this test case covers.
+func TestActionsWorkflowDispatchDynamicMatrixBooleanInput(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+
+		// create the repo
+		repo, sha, f := tests.CreateDeclarativeRepo(t, user2, "repo-workflow-dispatch",
+			[]unit_model.Type{unit_model.TypeActions}, nil,
+			[]*files_service.ChangeRepoFile{
+				{
+					Operation: "create",
+					TreePath:  ".forgejo/workflows/dispatch.yml",
+					ContentReader: strings.NewReader(
+						"name: test\n" +
+							"on:\n" +
+							"  workflow_dispatch:\n" +
+							"    inputs:\n" +
+							"      win32:\n" +
+							"        description: 'Boolean'\n" +
+							"        required: false\n" +
+							"        type: boolean\n" +
+							"jobs:\n" +
+							"  test:\n" +
+							"    runs-on: ubuntu-latest\n" +
+							"    strategy:\n" +
+							"      matrix:\n" +
+							"        runner: ${{ fromJSON(inputs.win32 && '[\"win32\", \"win64\"]' || '[\"win64\"]') }}\n" +
+							"    steps:\n" +
+							"      - run: echo helloworld\n",
+					),
+				},
+			},
+		)
+		defer f()
+
+		gitRepo, err := gitrepo.OpenRepository(db.DefaultContext, repo)
+		require.NoError(t, err)
+		defer gitRepo.Close()
+
+		workflow, err := actions_service.GetWorkflowFromCommit(gitRepo, "main", "dispatch.yml")
+		require.NoError(t, err)
+		assert.Equal(t, "refs/heads/main", workflow.Ref)
+		assert.Equal(t, sha, workflow.Commit.ID.String())
+
+		inputGetter := func(key string) string {
+			return "false"
+		}
+
+		run, _, err := workflow.Dispatch(db.DefaultContext, inputGetter, repo, user2)
+		require.NoError(t, err)
+
+		jobs, err := actions_model.GetRunJobsByRunID(t.Context(), run.ID)
+		require.NoError(t, err)
+		assert.Len(t, jobs, 1)
+	})
+}
+
 func TestActionsWorkflowDispatchReusableWorkflow(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, u *url.URL) {
 		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
@@ -1212,17 +1271,13 @@ jobs:
 				user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 
 				// create the repo
-				repo, sha, f := tests.CreateDeclarativeRepo(t, user2, "repo-workflow-dispatch",
-					[]unit_model.Type{unit_model.TypeActions}, nil,
-					[]*files_service.ChangeRepoFile{
-						{
-							Operation:     "create",
-							TreePath:      fmt.Sprintf("%s/%s", testCase.workflowDirectory, testCase.workflowID),
-							ContentReader: strings.NewReader(testCase.workflowContent),
-						},
+				var sha string
+				repo := forgery.CreateRepository(t, user2, &forgery.CreateRepositoryOptions{
+					Files: forgery.MapFS{
+						fmt.Sprintf("%s/%s", testCase.workflowDirectory, testCase.workflowID): forgery.MapFile(testCase.workflowContent),
 					},
-				)
-				defer f()
+					LatestSha: &sha,
+				})
 
 				schedules, err := db.Find[actions_model.ActionSchedule](t.Context(), actions_model.FindScheduleOptions{RepoID: repo.ID})
 				require.NoError(t, err)
diff --git a/tests/integration/actions_view_test.go b/tests/integration/actions_view_test.go
index 5275198eff..16a79581dc 100644
--- a/tests/integration/actions_view_test.go
+++ b/tests/integration/actions_view_test.go
@@ -14,6 +14,7 @@ import (
 	"testing"
 
 	actions_model "forgejo.org/models/actions"
+	repo_model "forgejo.org/models/repo"
 	unit_model "forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
@@ -147,7 +148,7 @@ func TestActionViewsView(t *testing.T) {
 			runIndex:          187,
 			jobIndex:          0,
 			attempt:           1,
-			expectedJSON:      "{\"state\":{\"run\":{\"preExecutionError\":\"\",\"link\":\"/user5/repo4/actions/runs/187\",\"title\":\"update actions\",\"titleHTML\":\"update actions\",\"status\":\"success\",\"canCancel\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"description\":\"Commit <a href=\\\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\\\">c2d72f5484</a> pushed by <a href=\\\"/user1\\\">user1</a>\",\"done\":true,\"jobs\":[{\"id\":192,\"name\":\"job_2\",\"status\":\"success\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"c2d72f5484\",\"link\":\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\",\"pusher\":{\"displayName\":\"user1\",\"link\":\"/user1\"},\"branch\":{\"name\":\"master\",\"link\":\"/user5/repo4/src/branch/master\",\"isDeleted\":false}}},\"currentJob\":{\"title\":\"job_2\",\"details\":[\"Success\"],\"steps\":[{\"summary\":\"Set up job\",\"duration\":\"_duration_\",\"status\":\"success\"},{\"summary\":\"Complete job\",\"duration\":\"_duration_\",\"status\":\"success\"}],\"allAttempts\":[{\"number\":3,\"time_since_started_html\":\"_time_\",\"status\":\"running\",\"status_diagnostics\":[\"Running\"]},{\"number\":2,\"time_since_started_html\":\"_time_\",\"status\":\"success\",\"status_diagnostics\":[\"Success\"]},{\"number\":1,\"time_since_started_html\":\"_time_\",\"status\":\"success\",\"status_diagnostics\":[\"Success\"]}]}},\"logs\":{\"stepsLog\":[]}}\n",
+			expectedJSON:      "{\"state\":{\"run\":{\"preExecutionError\":\"\",\"link\":\"/user5/repo4/actions/runs/187\",\"title\":\"update actions\",\"titleHTML\":\"update actions\",\"status\":\"success\",\"canCancel\":false,\"canDelete\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"description\":\"Commit <a href=\\\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\\\">c2d72f5484</a> pushed by <a href=\\\"/user1\\\">user1</a>\",\"done\":true,\"jobs\":[{\"id\":192,\"name\":\"job_2\",\"status\":\"success\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"c2d72f5484\",\"link\":\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\",\"pusher\":{\"displayName\":\"user1\",\"link\":\"/user1\"},\"branch\":{\"name\":\"master\",\"link\":\"/user5/repo4/src/branch/master\",\"isDeleted\":false}}},\"currentJob\":{\"title\":\"job_2\",\"details\":[\"Success\"],\"steps\":[{\"summary\":\"Set up job\",\"duration\":\"_duration_\",\"status\":\"success\"},{\"summary\":\"Complete job\",\"duration\":\"_duration_\",\"status\":\"success\"}],\"allAttempts\":[{\"number\":3,\"time_since_started_html\":\"_time_\",\"status\":\"running\",\"status_diagnostics\":[\"Running\"]},{\"number\":2,\"time_since_started_html\":\"_time_\",\"status\":\"success\",\"status_diagnostics\":[\"Success\"]},{\"number\":1,\"time_since_started_html\":\"_time_\",\"status\":\"success\",\"status_diagnostics\":[\"Success\"]}]}},\"logs\":{\"stepsLog\":[]}}\n",
 			expectedArtifacts: "{\"artifacts\":[{\"name\":\"multi-file-download\",\"size\":2048,\"status\":\"completed\"}]}\n",
 		},
 		{
@@ -156,7 +157,7 @@ func TestActionViewsView(t *testing.T) {
 			runIndex:          209,
 			jobIndex:          0,
 			attempt:           1,
-			expectedJSON:      "{\"state\":{\"run\":{\"link\":\"/user5/repo4/actions/runs/209\",\"title\":\"A scheduled workflow\",\"titleHTML\":\"A scheduled workflow\",\"status\":\"waiting\",\"description\":\"Scheduled run of commit \\u003ca href=\\\"/user5/repo4/commit/64357baca84bfff631e7dfae5a3433b26d005646\\\"\\u003e64357baca8\\u003c/a\\u003e\",\"canCancel\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"done\":false,\"jobs\":[{\"id\":2153,\"name\":\"job_2\",\"status\":\"waiting\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"64357baca8\",\"link\":\"/user5/repo4/commit/64357baca84bfff631e7dfae5a3433b26d005646\",\"pusher\":{\"displayName\":\"forgejo-actions\",\"link\":\"/forgejo-actions\"},\"branch\":{\"name\":\"master\",\"link\":\"/user5/repo4/src/branch/master\",\"isDeleted\":false}},\"preExecutionError\":\"\"},\"currentJob\":{\"title\":\"job_2\",\"details\":[\"Waiting for a runner with the following labels: debian, gpu\"],\"steps\":[{\"summary\":\"Set up job\",\"duration\":\"_duration_\",\"status\":\"success\"},{\"summary\":\"Complete job\",\"duration\":\"_duration_\",\"status\":\"success\"}],\"allAttempts\":[{\"number\":1,\"time_since_started_html\":\"-\",\"status\":\"success\",\"status_diagnostics\":[\"Success\"]}]}},\"logs\":{\"stepsLog\":[]}}\n",
+			expectedJSON:      "{\"state\":{\"run\":{\"link\":\"/user5/repo4/actions/runs/209\",\"title\":\"A scheduled workflow\",\"titleHTML\":\"A scheduled workflow\",\"status\":\"waiting\",\"description\":\"Scheduled run of commit \\u003ca href=\\\"/user5/repo4/commit/64357baca84bfff631e7dfae5a3433b26d005646\\\"\\u003e64357baca8\\u003c/a\\u003e\",\"canCancel\":false,\"canDelete\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"done\":false,\"jobs\":[{\"id\":2153,\"name\":\"job_2\",\"status\":\"waiting\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"64357baca8\",\"link\":\"/user5/repo4/commit/64357baca84bfff631e7dfae5a3433b26d005646\",\"pusher\":{\"displayName\":\"forgejo-actions\",\"link\":\"/forgejo-actions\"},\"branch\":{\"name\":\"master\",\"link\":\"/user5/repo4/src/branch/master\",\"isDeleted\":false}},\"preExecutionError\":\"\"},\"currentJob\":{\"title\":\"job_2\",\"details\":[\"Waiting for a runner with the following labels: debian, gpu\"],\"steps\":[{\"summary\":\"Set up job\",\"duration\":\"_duration_\",\"status\":\"success\"},{\"summary\":\"Complete job\",\"duration\":\"_duration_\",\"status\":\"success\"}],\"allAttempts\":[{\"number\":1,\"time_since_started_html\":\"-\",\"status\":\"success\",\"status_diagnostics\":[\"Success\"]}]}},\"logs\":{\"stepsLog\":[]}}\n",
 			expectedArtifacts: "{\"artifacts\":[]}\n",
 		},
 		{
@@ -165,7 +166,7 @@ func TestActionViewsView(t *testing.T) {
 			runIndex:          210,
 			jobIndex:          0,
 			attempt:           1,
-			expectedJSON:      "{\"state\":{\"run\":{\"link\":\"/user5/repo4/actions/runs/210\",\"title\":\"A triggered run\",\"titleHTML\":\"A triggered run\",\"status\":\"waiting\",\"description\":\"Run of commit \\u003ca href=\\\"/user5/repo4/commit/f4100ac14112a3740490afb22b07b69b0b5d4e8b\\\"\\u003ef4100ac141\\u003c/a\\u003e triggered by \\u003ca href=\\\"/user29\\\"\\u003euser29\\u003c/a\\u003e\",\"canCancel\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"done\":false,\"jobs\":[{\"id\":2154,\"name\":\"mirror\",\"status\":\"waiting\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"f4100ac141\",\"link\":\"/user5/repo4/commit/f4100ac14112a3740490afb22b07b69b0b5d4e8b\",\"pusher\":{\"displayName\":\"user29\",\"link\":\"/user29\"},\"branch\":{\"name\":\"master\",\"link\":\"/user5/repo4/src/branch/master\",\"isDeleted\":false}},\"preExecutionError\":\"\"},\"currentJob\":{\"title\":\"mirror\",\"details\":[\"Waiting for a runner with the following label: windows\"],\"steps\":[{\"summary\":\"Set up job\",\"duration\":\"_duration_\",\"status\":\"running\"},{\"summary\":\"Complete job\",\"duration\":\"_duration_\",\"status\":\"waiting\"}],\"allAttempts\":[{\"number\":1,\"time_since_started_html\":\"-\",\"status\":\"waiting\",\"status_diagnostics\":[\"Waiting for a runner with the following label: windows\"]}]}},\"logs\":{\"stepsLog\":[]}}\n",
+			expectedJSON:      "{\"state\":{\"run\":{\"link\":\"/user5/repo4/actions/runs/210\",\"title\":\"A triggered run\",\"titleHTML\":\"A triggered run\",\"status\":\"waiting\",\"description\":\"Run of commit \\u003ca href=\\\"/user5/repo4/commit/f4100ac14112a3740490afb22b07b69b0b5d4e8b\\\"\\u003ef4100ac141\\u003c/a\\u003e triggered by \\u003ca href=\\\"/user29\\\"\\u003euser29\\u003c/a\\u003e\",\"canCancel\":false,\"canDelete\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"done\":false,\"jobs\":[{\"id\":2154,\"name\":\"mirror\",\"status\":\"waiting\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"f4100ac141\",\"link\":\"/user5/repo4/commit/f4100ac14112a3740490afb22b07b69b0b5d4e8b\",\"pusher\":{\"displayName\":\"user29\",\"link\":\"/user29\"},\"branch\":{\"name\":\"master\",\"link\":\"/user5/repo4/src/branch/master\",\"isDeleted\":false}},\"preExecutionError\":\"\"},\"currentJob\":{\"title\":\"mirror\",\"details\":[\"Waiting for a runner with the following label: windows\"],\"steps\":[{\"summary\":\"Set up job\",\"duration\":\"_duration_\",\"status\":\"running\"},{\"summary\":\"Complete job\",\"duration\":\"_duration_\",\"status\":\"waiting\"}],\"allAttempts\":[{\"number\":1,\"time_since_started_html\":\"-\",\"status\":\"waiting\",\"status_diagnostics\":[\"Waiting for a runner with the following label: windows\"]}]}},\"logs\":{\"stepsLog\":[]}}\n",
 			expectedArtifacts: "{\"artifacts\":[]}\n",
 		},
 	}
@@ -229,7 +230,7 @@ func TestActionViewsViewAttemptOutOfRange(t *testing.T) {
 		re = regexp.MustCompile(pattern)
 		actualClean = re.ReplaceAllString(actualClean, `"time_since_started_html":"_time_"`)
 
-		return assert.JSONEq(t, "{\"state\":{\"run\":{\"preExecutionError\":\"\",\"link\":\"/user5/repo4/actions/runs/190\",\"title\":\"job output\",\"titleHTML\":\"job output\",\"status\":\"success\",\"canCancel\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"description\":\"Commit <a href=\\\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\\\">c2d72f5484</a> pushed by <a href=\\\"/user1\\\">user1</a>\",\"done\":false,\"jobs\":[{\"id\":396,\"name\":\"job_2\",\"status\":\"waiting\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"c2d72f5484\",\"link\":\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\",\"pusher\":{\"displayName\":\"user1\",\"link\":\"/user1\"},\"branch\":{\"name\":\"test\",\"link\":\"/user5/repo4/src/branch/test\",\"isDeleted\":true}}},\"currentJob\":{\"title\":\"job_2\",\"details\":[\"Waiting for a runner with the following label: fedora\"],\"steps\":[],\"allAttempts\":null}},\"logs\":{\"stepsLog\":[]}}\n", actualClean)
+		return assert.JSONEq(t, "{\"state\":{\"run\":{\"preExecutionError\":\"\",\"link\":\"/user5/repo4/actions/runs/190\",\"title\":\"job output\",\"titleHTML\":\"job output\",\"status\":\"success\",\"canCancel\":false,\"canDelete\":false,\"canApprove\":false,\"canRerun\":false,\"canDeleteArtifact\":false,\"description\":\"Commit <a href=\\\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\\\">c2d72f5484</a> pushed by <a href=\\\"/user1\\\">user1</a>\",\"done\":false,\"jobs\":[{\"id\":396,\"name\":\"job_2\",\"status\":\"waiting\",\"canRerun\":false,\"duration\":\"_duration_\"}],\"commit\":{\"localeWorkflow\":\"Workflow\",\"localeAllRuns\":\"all runs\",\"shortSHA\":\"c2d72f5484\",\"link\":\"/user5/repo4/commit/c2d72f548424103f01ee1dc02889c1e2bff816b0\",\"pusher\":{\"displayName\":\"user1\",\"link\":\"/user1\"},\"branch\":{\"name\":\"test\",\"link\":\"/user5/repo4/src/branch/test\",\"isDeleted\":true}}},\"currentJob\":{\"title\":\"job_2\",\"details\":[\"Waiting for a runner with the following label: fedora\"],\"steps\":[],\"allAttempts\":null}},\"logs\":{\"stepsLog\":[]}}\n", actualClean)
 	})
 	htmlDoc.AssertAttrEqual(t, selector, "data-initial-artifacts-response", "{\"artifacts\":[]}\n")
 }
@@ -258,3 +259,62 @@ func TestActionTabAccessibleFromRepo(t *testing.T) {
 		return true
 	})
 }
+
+func TestActionViewRunDeletion(t *testing.T) {
+	defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionViewRunDeletion")()
+	defer tests.PrepareTestEnv(t)()
+
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	user5 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user2.ID})
+
+	sessionUser2 := loginUser(t, user2.Name)
+	sessionUser5 := loginUser(t, user5.Name)
+
+	isCollaborator, err := repo_model.IsCollaborator(t.Context(), repo1.ID, user5.ID)
+	require.NoError(t, err)
+	require.True(t, isCollaborator)
+
+	testCases := []struct {
+		name       string
+		sess       *TestSession
+		requestURL string
+		canDelete  bool
+	}{
+		{
+			name:       "Repo owner can delete completed run",
+			sess:       sessionUser2,
+			requestURL: fmt.Sprintf("/%s/actions/runs/3161/jobs/0/attempt/1", repo1.FullName()),
+			canDelete:  true,
+		},
+		{
+			name:       "Collaborator cannot delete completed run",
+			sess:       sessionUser5,
+			requestURL: fmt.Sprintf("/%s/actions/runs/3161/jobs/0/attempt/1", repo1.FullName()),
+			canDelete:  false,
+		},
+		{
+			name:       "Repo owner cannot delete running run",
+			sess:       sessionUser2,
+			requestURL: fmt.Sprintf("/%s/actions/runs/3162/jobs/0/attempt/1", repo1.FullName()),
+			canDelete:  false,
+		},
+		{
+			name:       "Collaborator cannot delete running run",
+			sess:       sessionUser5,
+			requestURL: fmt.Sprintf("/%s/actions/runs/3162/jobs/0/attempt/1", repo1.FullName()),
+			canDelete:  false,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			req := NewRequest(t, "GET", testCase.requestURL)
+			resp := testCase.sess.MakeRequest(t, req, http.StatusOK)
+			htmlDoc := NewHTMLParser(t, resp.Body)
+			htmlDoc.AssertAttrPredicate(t, "#repo-action-view", "data-initial-post-response", func(actual string) bool {
+				return assert.Contains(t, actual, fmt.Sprintf(`"canDelete":%t`, testCase.canDelete))
+			})
+		})
+	}
+}
diff --git a/tests/integration/admin_federation_test.go b/tests/integration/admin_federation_test.go
new file mode 100644
index 0000000000..75b94c3167
--- /dev/null
+++ b/tests/integration/admin_federation_test.go
@@ -0,0 +1,128 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	"forgejo.org/models/unittest"
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/test"
+	"forgejo.org/routers"
+	"forgejo.org/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAdminFederationViewHostsAndUsers(t *testing.T) {
+	defer unittest.OverrideFixtures("tests/integration/fixtures/TestAdminFederationViewHostsAndUsers")()
+	defer tests.PrepareTestEnv(t)()
+
+	t.Run("Federation enabled", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+		defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+		t.Run("Anonymous user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			req := NewRequest(t, "GET", "/admin/federation/hosts")
+			MakeRequest(t, req, http.StatusSeeOther)
+			req = NewRequest(t, "GET", "/admin/federation/hosts/1")
+			MakeRequest(t, req, http.StatusSeeOther)
+			req = NewRequest(t, "GET", "/admin/federation/users")
+			MakeRequest(t, req, http.StatusSeeOther)
+		})
+
+		t.Run("Normal user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			session := loginUser(t, "user2")
+
+			req := NewRequest(t, "GET", "/admin/federation/hosts")
+			session.MakeRequest(t, req, http.StatusForbidden)
+			req = NewRequest(t, "GET", "/admin/federation/hosts/1")
+			session.MakeRequest(t, req, http.StatusForbidden)
+			req = NewRequest(t, "GET", "/admin/federation/users")
+			session.MakeRequest(t, req, http.StatusForbidden)
+		})
+
+		t.Run("Admin user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			session := loginUser(t, "user1")
+
+			req := NewRequest(t, "GET", "/admin/federation/hosts")
+			resp := session.MakeRequest(t, req, http.StatusOK)
+			htmlDoc := NewHTMLParser(t, resp.Body)
+			hostRows := htmlDoc.Find(".admin-setting-content table tbody tr")
+			assert.Equal(t, 2, hostRows.Length())
+			assert.Contains(t, hostRows.Text(), "bob.example.com")
+			assert.Contains(t, hostRows.Text(), "alice.example.com")
+
+			req = NewRequest(t, "GET", "/admin/federation/users")
+			resp = session.MakeRequest(t, req, http.StatusOK)
+			htmlDoc = NewHTMLParser(t, resp.Body)
+			userRows := htmlDoc.Find(".admin-setting-content table tbody tr")
+			assert.Equal(t, 3, userRows.Length())
+			assert.Contains(t, userRows.Text(), "/api/v1/activitypub/user-id/1/inbox#bob")
+			assert.Contains(t, userRows.Text(), "/api/v1/activitypub/user-id/1/inbox#alice")
+			assert.Contains(t, userRows.Text(), "/api/v1/activitypub/user-id/2/inbox#eve")
+
+			req = NewRequest(t, "GET", "/admin/federation/hosts/1")
+			resp = session.MakeRequest(t, req, http.StatusOK)
+			htmlDoc = NewHTMLParser(t, resp.Body)
+			userRows = htmlDoc.Find(".admin-setting-content table tbody tr")
+			assert.Equal(t, 1, userRows.Length())
+			assert.Contains(t, userRows.Text(), "/api/v1/activitypub/user-id/1/inbox#bob")
+
+			req = NewRequest(t, "GET", "/admin/federation/hosts/2")
+			resp = session.MakeRequest(t, req, http.StatusOK)
+			htmlDoc = NewHTMLParser(t, resp.Body)
+			userRows = htmlDoc.Find(".admin-setting-content table tbody tr")
+			assert.Equal(t, 2, userRows.Length())
+			assert.Contains(t, userRows.Text(), "/api/v1/activitypub/user-id/1/inbox#alice")
+			assert.Contains(t, userRows.Text(), "/api/v1/activitypub/user-id/2/inbox#eve")
+		})
+	})
+
+	t.Run("Federation disabled", func(t *testing.T) {
+		t.Run("Anonymous user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			req := NewRequest(t, "GET", "/admin/federation/hosts")
+			MakeRequest(t, req, http.StatusNotFound)
+			req = NewRequest(t, "GET", "/admin/federation/hosts/1")
+			MakeRequest(t, req, http.StatusNotFound)
+			req = NewRequest(t, "GET", "/admin/federation/users")
+			MakeRequest(t, req, http.StatusNotFound)
+		})
+
+		t.Run("Normal user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			session := loginUser(t, "user2")
+
+			req := NewRequest(t, "GET", "/admin/federation/hosts")
+			session.MakeRequest(t, req, http.StatusNotFound)
+			req = NewRequest(t, "GET", "/admin/federation/hosts/1")
+			session.MakeRequest(t, req, http.StatusNotFound)
+			req = NewRequest(t, "GET", "/admin/federation/users")
+			session.MakeRequest(t, req, http.StatusNotFound)
+		})
+
+		t.Run("Admin user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			session := loginUser(t, "user1")
+
+			req := NewRequest(t, "GET", "/admin/federation/hosts")
+			session.MakeRequest(t, req, http.StatusNotFound)
+			req = NewRequest(t, "GET", "/admin/federation/hosts/1")
+			session.MakeRequest(t, req, http.StatusNotFound)
+			req = NewRequest(t, "GET", "/admin/federation/users")
+			session.MakeRequest(t, req, http.StatusNotFound)
+		})
+	})
+}
diff --git a/tests/integration/api_actions_artifact_v4_test.go b/tests/integration/api_actions_artifact_v4_test.go
index 62be33d552..707f980a07 100644
--- a/tests/integration/api_actions_artifact_v4_test.go
+++ b/tests/integration/api_actions_artifact_v4_test.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	actions_model "forgejo.org/models/actions"
+	repo_model "forgejo.org/models/repo"
 	"forgejo.org/modules/storage"
 	"forgejo.org/routers/api/actions"
 	actions_service "forgejo.org/services/actions"
@@ -43,7 +44,7 @@ func uploadArtifact(t *testing.T, body string) string {
 			RunID: 792,
 		},
 	}
-	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// acquire artifact upload url
@@ -103,7 +104,7 @@ func TestActionsArtifactV4UploadSingleFileWrongChecksum(t *testing.T) {
 			RunID: 792,
 		},
 	}
-	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// acquire artifact upload url
@@ -154,7 +155,7 @@ func TestActionsArtifactV4UploadSingleFileWithRetentionDays(t *testing.T) {
 			RunID: 792,
 		},
 	}
-	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// acquire artifact upload url
@@ -209,7 +210,7 @@ func TestActionsArtifactV4UploadSingleFileWithPotentialHarmfulBlockID(t *testing
 			RunID: 792,
 		},
 	}
-	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// acquire artifact upload url
@@ -279,7 +280,7 @@ func TestActionsArtifactV4UploadSingleFileWithChunksOutOfOrder(t *testing.T) {
 			RunID: 792,
 		},
 	}
-	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// acquire artifact upload url
@@ -351,7 +352,7 @@ func TestActionsArtifactV4DownloadSingle(t *testing.T) {
 			RunID: 792,
 		},
 	}
-	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// acquire artifact upload url
@@ -419,7 +420,7 @@ func TestActionsArtifactV4Delete(t *testing.T) {
 			RunID: 792,
 		},
 	}
-	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false)
+	token, err := actions_service.CreateAuthorizationToken(task, map[string]any{}, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// delete artifact by name
diff --git a/tests/integration/api_actions_id_token_test.go b/tests/integration/api_actions_id_token_test.go
index 53a0a5b269..d4a1657a8e 100644
--- a/tests/integration/api_actions_id_token_test.go
+++ b/tests/integration/api_actions_id_token_test.go
@@ -6,13 +6,17 @@ package integration
 import (
 	"crypto/rsa"
 	"encoding/base64"
+	"fmt"
 	"math/big"
 	"net/http"
 	"testing"
 
 	actions_model "forgejo.org/models/actions"
+	"forgejo.org/models/auth"
 	"forgejo.org/models/db"
+	repo_model "forgejo.org/models/repo"
 	"forgejo.org/modules/setting"
+	api "forgejo.org/modules/structs"
 	actions_service "forgejo.org/services/actions"
 	"forgejo.org/tests"
 
@@ -45,9 +49,9 @@ func TestActionsIDToken(t *testing.T) {
 	gitCtx, err := actions_service.GenerateGiteaContext(task.Job.Run, task.Job)
 	require.NoError(t, err)
 
-	token, err := actions_service.CreateAuthorizationToken(task, gitCtx, true)
+	token, err := actions_service.CreateAuthorizationToken(task, gitCtx, true, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
-	tokenWithoutOIDCAccess, err := actions_service.CreateAuthorizationToken(task, gitCtx, false)
+	tokenWithoutOIDCAccess, err := actions_service.CreateAuthorizationToken(task, gitCtx, false, &repo_model.ActionsConfig{})
 	require.NoError(t, err)
 
 	// get JWKs information
@@ -87,7 +91,7 @@ func TestActionsIDToken(t *testing.T) {
 			assert.Equal(t, "792", claims["run_id"])
 			assert.Equal(t, "188", claims["run_number"])
 			assert.Equal(t, "c2d72f548424103f01ee1dc02889c1e2bff816b0", claims["sha"])
-			assert.Equal(t, "repo:user5/repo4:ref:refs/heads/master", claims["sub"])
+			assert.Equal(t, "repo:user5-5/repo4-4:ref:refs/heads/master", claims["sub"])
 			assert.Equal(t, "artifact.yaml", claims["workflow"])
 			assert.Equal(t, "user5/repo4/.forgejo/workflows/artifact.yaml@refs/heads/master", claims["workflow_ref"])
 		}
@@ -154,7 +158,7 @@ func TestActionsIDToken(t *testing.T) {
 		gitCtx, err := actions_service.GenerateGiteaContext(task.Job.Run, task.Job)
 		require.NoError(t, err)
 
-		token, err := actions_service.CreateAuthorizationToken(task, gitCtx, true)
+		token, err := actions_service.CreateAuthorizationToken(task, gitCtx, true, &repo_model.ActionsConfig{})
 		require.NoError(t, err)
 
 		req = NewRequest(t, "GET", "/api/actions/_apis/pipelines/workflows/abcde/idtoken?placeholder=true&audience=testingAud").AddTokenAuth(token)
@@ -175,7 +179,7 @@ func TestActionsIDToken(t *testing.T) {
 		gitCtx, err := actions_service.GenerateGiteaContext(task.Job.Run, task.Job)
 		require.NoError(t, err)
 
-		token, err := actions_service.CreateAuthorizationToken(task, gitCtx, true)
+		token, err := actions_service.CreateAuthorizationToken(task, gitCtx, true, &repo_model.ActionsConfig{})
 		require.NoError(t, err)
 
 		req = NewRequest(t, "GET", "/api/actions/_apis/pipelines/workflows/abcde/idtoken?placeholder=true&audience=testingAud").AddTokenAuth(token)
@@ -188,4 +192,37 @@ func TestActionsIDToken(t *testing.T) {
 		resp = MakeRequest(t, req, http.StatusBadRequest)
 		assert.Contains(t, resp.Body.String(), "run-id does not match")
 	})
+
+	t.Run("authorized integration internal issuer", func(t *testing.T) {
+		// Create an Authorized Integration which is set-up to be validated with the in-memory Actions' JWT signing key:
+		ai := &auth.AuthorizedIntegration{
+			UserID: 2,
+			Scope:  auth.AccessTokenScopeAll,
+			Issuer: "urn:forgejo:authorized-integrations:actions",
+			ClaimRules: &auth.ClaimRules{
+				Rules: []auth.ClaimRule{
+					{
+						Claim:      "sub",
+						Comparison: auth.ClaimEqual,
+						Value:      "repo:user5-5/repo4-4:ref:refs/heads/master",
+					},
+				},
+			},
+			ResourceAllRepos: true,
+		}
+		require.NoError(t, auth.InsertAuthorizedIntegration(t.Context(), ai))
+
+		// Create a JWT from the Actions system:
+		var getResponse getTokenResponse
+		req = NewRequest(t, "GET", fmt.Sprintf("/api/actions/_apis/pipelines/workflows/792/idtoken?placeholder=true&audience=%s", ai.Audience)).AddTokenAuth(token)
+		resp = MakeRequest(t, req, http.StatusOK)
+		DecodeJSON(t, resp, &getResponse)
+
+		// Should be able to make a Forgejo API call with the JWT, authenticated by the Authorized Integration:
+		req := NewRequest(t, "GET", "/api/v1/user").AddTokenAuth(getResponse.Value)
+		resp := MakeRequest(t, req, http.StatusOK)
+		var user api.User
+		DecodeJSON(t, resp, &user)
+		assert.Equal(t, "user2", user.LoginName)
+	})
 }
diff --git a/tests/integration/api_actions_oidc_test.go b/tests/integration/api_actions_oidc_test.go
index 71e96d7531..8bf3336986 100644
--- a/tests/integration/api_actions_oidc_test.go
+++ b/tests/integration/api_actions_oidc_test.go
@@ -45,7 +45,12 @@ func TestActionsOIDC(t *testing.T) {
 	assert.Equal(t, setting.AppURL+"api/actions/.well-known/keys", config.JwksURI)
 	assert.Equal(t, []string{"public"}, config.SubjectTypesSupported)
 	assert.Equal(t, []string{"id_token"}, config.ResponseTypesSupported)
-	assert.Equal(t, []string{"sub", "aud", "exp", "iat", "iss", "nbf", "actor", "base_ref", "event_name", "head_ref", "ref", "ref_protected", "ref_type", "repository", "repository_owner", "run_attempt", "run_id", "run_number", "sha", "workflow", "workflow_ref"}, config.ClaimsSupported)
+	assert.Equal(t, []string{
+		"sub", "aud", "exp", "iat", "iss", "nbf", "actor", "actor_id", "base_ref", "event_name",
+		"head_ref", "ref", "ref_protected", "ref_type", "repository", "repository_id", "repository_owner",
+		"repository_owner_id", "run_attempt", "run_id", "run_number", "sha", "workflow", "workflow_ref",
+	},
+		config.ClaimsSupported)
 	assert.Equal(t, []string{"RS256"}, config.IDTokenSigningAlgValuesSupported)
 	assert.Equal(t, []string{"openid"}, config.ScopesSupported)
 
diff --git a/tests/integration/api_activitypub_actor_test.go b/tests/integration/api_activitypub_actor_test.go
index 30e8934e1b..25c55e75a8 100644
--- a/tests/integration/api_activitypub_actor_test.go
+++ b/tests/integration/api_activitypub_actor_test.go
@@ -4,19 +4,13 @@
 package integration
 
 import (
-	"fmt"
 	"io"
 	"net/http"
-	"net/url"
-	"strconv"
 	"testing"
 
-	"forgejo.org/modules/forgefed"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/test"
 	"forgejo.org/routers"
-	"forgejo.org/services/contexttest"
-	"forgejo.org/services/federation"
 	"forgejo.org/tests"
 
 	ap "github.com/go-ap/activitypub"
@@ -55,6 +49,9 @@ func TestActivityPubActor(t *testing.T) {
 	assert.Regexp(t, "^-----BEGIN PUBLIC KEY-----", pubKeyPem)
 
 	t.Run("ActorOutboxEmpty", func(t *testing.T) {
+		// /inbox and /outbox routes also require signature checks
+		defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
+
 		req := NewRequest(t, "GET", actor.Outbox.GetID().String())
 		resp := MakeRequest(t, req, http.StatusOK)
 
@@ -76,27 +73,3 @@ func TestActivityPubActor(t *testing.T) {
 		assert.Nil(t, outboxCollection.Last)
 	})
 }
-
-func TestActorNewFromKeyId(t *testing.T) {
-	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
-	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
-
-	onApplicationRun(t, func(t *testing.T, u *url.URL) {
-		ctx, _ := contexttest.MockAPIContext(t, "/api/v1/activitypub/actor")
-		sut, err := federation.NewActorIDFromKeyID(ctx.Base, fmt.Sprintf("%sapi/v1/activitypub/actor#main-key", u))
-		require.NoError(t, err)
-
-		port, err := strconv.ParseUint(u.Port(), 10, 16)
-		require.NoError(t, err)
-
-		assert.Equal(t, forgefed.ActorID{
-			ID:                 "actor",
-			HostSchema:         "http",
-			Path:               "api/v1/activitypub",
-			Host:               setting.Domain,
-			HostPort:           uint16(port),
-			UnvalidatedInput:   fmt.Sprintf("http://%s:%d/api/v1/activitypub/actor", setting.Domain, port),
-			IsPortSupplemented: false,
-		}, sut)
-	})
-}
diff --git a/tests/integration/api_activitypub_person_inbox_follow_test.go b/tests/integration/api_activitypub_person_inbox_follow_test.go
index 5a0b452447..f31e7e9011 100644
--- a/tests/integration/api_activitypub_person_inbox_follow_test.go
+++ b/tests/integration/api_activitypub_person_inbox_follow_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"forgejo.org/models/db"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/activitypub"
@@ -26,7 +27,6 @@ import (
 // Flow of this test is documented at: https://codeberg.org/forgejo-contrib/federation/src/branch/main/doc/user-activity-following.md
 func TestActivityPubPersonInboxFollow(t *testing.T) {
 	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
-	defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
 	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
 
 	federation.Init()
@@ -40,6 +40,7 @@ func TestActivityPubPersonInboxFollow(t *testing.T) {
 
 		distantURL := federatedSrv.URL
 		distantUser15URL := fmt.Sprintf("%s/api/v1/activitypub/user-id/15", distantURL)
+		distantUser15AliasURL := fmt.Sprintf("%s/api/v1/activitypub/user-id/alias15", distantURL)
 
 		localUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 		localUser2URL := localUrl.JoinPath("/api/v1/activitypub/user-id/2").String()
@@ -52,14 +53,16 @@ func TestActivityPubPersonInboxFollow(t *testing.T) {
 			`{"type":"Follow",`+
 				`"actor":"%s",`+
 				`"object":"%s"}`,
-			distantUser15URL,
+			distantUser15AliasURL,
 			localUser2URL,
 		)
+
 		cf, err := activitypub.NewClientFactoryWithTimeout(60 * time.Second)
 		require.NoError(t, err)
-		c, err := cf.WithKeysDirect(ctx, mock.ApActor.PrivKey,
-			mock.ApActor.KeyID(federatedSrv.URL))
+
+		c, err := cf.WithKeysDirect(ctx, mock.ApActor.PrivKey, mock.ApActor.KeyID(federatedSrv.URL))
 		require.NoError(t, err)
+
 		resp, err := c.Post(followActivity, localUser2Inbox)
 		require.NoError(t, err)
 		assert.Equal(t, http.StatusAccepted, resp.StatusCode)
@@ -94,9 +97,12 @@ func TestActivityPubPersonInboxFollow(t *testing.T) {
 			distantUser15URL,
 			localUser2URL,
 		)
+
 		c, err = cf.WithKeysDirect(ctx, mock.ApActor.PrivKey,
 			mock.ApActor.KeyID(federatedSrv.URL))
+
 		require.NoError(t, err)
+
 		resp, err = c.Post(undoFollowActivity, localUser2Inbox)
 		require.NoError(t, err)
 		assert.Equal(t, http.StatusNoContent, resp.StatusCode)
@@ -110,3 +116,44 @@ func TestActivityPubPersonInboxFollow(t *testing.T) {
 		)
 	})
 }
+
+func TestActivityPubFollowRefollow(t *testing.T) {
+	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+	defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
+	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+	require.NoError(t, federation.Init())
+
+	mock := test.NewFederationServerMock()
+	federatedSrv := mock.DistantServer(t)
+	defer federatedSrv.Close()
+
+	onApplicationRun(t, func(t *testing.T, localUrl *url.URL) {
+		defer test.MockVariableValue(&setting.AppURL, localUrl.String())()
+
+		distantURL := federatedSrv.URL
+		distantUser15AliasURL := fmt.Sprintf("%s/api/v1/activitypub/user-id/alias15", distantURL)
+
+		localUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		localUser2URL := localUrl.JoinPath("/api/v1/activitypub/user-id/2")
+		localUser2Inbox := localUrl.JoinPath("/api/v1/activitypub/user-id/2/inbox")
+
+		ctx := t.Context()
+
+		var follow user_model.FederatedUserFollower
+		has, err := db.GetEngine(ctx).Get(&follow)
+		require.NoError(t, err)
+		assert.False(t, has)
+
+		require.NoError(t, mock.FollowActorUnsigned(federatedSrv.URL, 15, *localUser2URL, *localUser2Inbox))
+
+		has, err = db.GetEngine(ctx).Get(&follow)
+		require.NoError(t, err)
+		assert.True(t, has)
+		assert.Equal(t, int64(2), follow.FollowedUserID)
+
+		apiCtx, _ := contexttest.MockAPIContext(t, localUser2Inbox.String())
+		err = federation.FollowRemoteActor(apiCtx, localUser, distantUser15AliasURL)
+		require.NoError(t, err)
+	})
+}
diff --git a/tests/integration/api_activitypub_person_inbox_useractivity_test.go b/tests/integration/api_activitypub_person_inbox_useractivity_test.go
index c131a03966..458627127d 100644
--- a/tests/integration/api_activitypub_person_inbox_useractivity_test.go
+++ b/tests/integration/api_activitypub_person_inbox_useractivity_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"forgejo.org/models/activities"
 	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
@@ -20,16 +21,87 @@ import (
 	"forgejo.org/routers"
 	"forgejo.org/services/contexttest"
 	"forgejo.org/services/federation"
-	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	ap "github.com/go-ap/activitypub"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestActivityPubPersonInboxNoteFromDistant(t *testing.T) {
+	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+	federation.Init()
+
+	mock := test.NewFederationServerMock()
+	federatedSrv := mock.DistantServer(t)
+	defer federatedSrv.Close()
+
+	onApplicationRun(t, func(t *testing.T, localUrl *url.URL) {
+		defer test.MockVariableValue(&setting.AppURL, localUrl.String())()
+
+		distantURL := federatedSrv.URL
+		distantUser15URL := fmt.Sprintf("%s/api/v1/activitypub/user-id/15", distantURL)
+
+		localUser2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		localUser2URL := localUrl.JoinPath("/api/v1/activitypub/user-id/2").String()
+		localUser2Inbox := localUrl.JoinPath("/api/v1/activitypub/user-id/2/inbox").String()
+		localSession2 := loginUser(t, localUser2.LoginName)
+		localSecssion2Token := getTokenForLoggedInUser(t, localSession2, auth_model.AccessTokenScopeWriteUser)
+
+		// view own empty feed on web UI
+		feedPage := NewHTMLParser(t, localSession2.MakeRequest(t, NewRequest(t, "GET", "/user2?tab=feed"), http.StatusOK).Body)
+		feedPage.AssertElement(t, "#empty-ap-feed", true)
+
+		// follow (local follows distant)
+		req := NewRequestWithJSON(t, "POST",
+			"/api/v1/user/activitypub/follow",
+			&structs.APRemoteFollowOption{
+				Target: distantUser15URL,
+			}).
+			AddTokenAuth(localSecssion2Token)
+		MakeRequest(t, req, http.StatusNoContent)
+
+		// send note (distant -> local)
+		distantNoteURL := fmt.Sprintf("%s/api/v1/activitypub/note/104", distantURL)
+
+		userActivity := fmt.Appendf(
+			[]byte{},
+			`{"type":"Create",`+
+				`"actor":"%s",`+
+				`"to": ["https://www.w3.org/ns/activitystreams#Public"],`+
+				`"cc": ["%s"],`+
+				`"object": {"type":"Note","content":"The Content!",`+
+				`"url":"%s"}}`,
+			distantUser15URL,
+			localUser2URL,
+			distantNoteURL,
+		)
+
+		ctx, _ := contexttest.MockAPIContext(t, localUser2Inbox)
+		cf, err := activitypub.NewClientFactoryWithTimeout(60 * time.Second)
+		require.NoError(t, err)
+
+		c, err := cf.WithKeysDirect(ctx, mock.ApActor.PrivKey, mock.ApActor.KeyID(federatedSrv.URL))
+		require.NoError(t, err)
+
+		resp, err := c.Post(userActivity, localUser2Inbox)
+		require.NoError(t, err)
+
+		assert.Equal(t, http.StatusNoContent, resp.StatusCode)
+
+		// check whether user activity exists in local instance
+		unittest.AssertExistsAndLoadBean(t, &activities.FederatedUserActivity{NoteURL: distantNoteURL})
+
+		// view own non-empty feed on web UI
+		feedPage = NewHTMLParser(t, localSession2.MakeRequest(t, NewRequest(t, "GET", "/user2?tab=feed"), http.StatusOK).Body)
+		feedPage.AssertElement(t, "#empty-ap-feed", false)
+	})
+}
+
 func TestActivityPubPersonInboxNoteToDistant(t *testing.T) {
 	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
-	defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
 	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
 
 	federation.Init()
@@ -50,8 +122,7 @@ func TestActivityPubPersonInboxNoteToDistant(t *testing.T) {
 		localSession2 := loginUser(t, localUser2.LoginName)
 		localSecssion2Token := getTokenForLoggedInUser(t, localSession2, auth_model.AccessTokenScopeWriteIssue)
 
-		repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, localUser2, tests.DeclarativeRepoOptions{})
-		defer f()
+		repo := forgery.CreateRepository(t, localUser2, nil)
 
 		// follow (distant follows local)
 		followActivity := fmt.Appendf(nil,
@@ -61,14 +132,17 @@ func TestActivityPubPersonInboxNoteToDistant(t *testing.T) {
 			distantUser15URL,
 			localUser2URL,
 		)
+
 		ctx, _ := contexttest.MockAPIContext(t, localUser2Inbox)
 		cf, err := activitypub.NewClientFactoryWithTimeout(60 * time.Second)
 		require.NoError(t, err)
-		c, err := cf.WithKeysDirect(ctx, mock.ApActor.PrivKey,
-			mock.ApActor.KeyID(federatedSrv.URL))
+
+		c, err := cf.WithKeysDirect(ctx, mock.ApActor.PrivKey, mock.ApActor.KeyID(federatedSrv.URL))
 		require.NoError(t, err)
+
 		resp, err := c.Post(followActivity, localUser2Inbox)
 		require.NoError(t, err)
+
 		assert.Equal(t, http.StatusAccepted, resp.StatusCode)
 
 		// local action which triggers a user activity
diff --git a/tests/integration/api_activitypub_person_test.go b/tests/integration/api_activitypub_person_test.go
index c0f297a7d3..75746d1a17 100644
--- a/tests/integration/api_activitypub_person_test.go
+++ b/tests/integration/api_activitypub_person_test.go
@@ -80,6 +80,7 @@ func TestActivityPubPerson(t *testing.T) {
 func TestActivityPubMissingPerson(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+	defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
 	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
 
 	req := NewRequest(t, "GET", "/api/v1/activitypub/user-id/999999999")
diff --git a/tests/integration/api_admin_actions_test.go b/tests/integration/api_admin_actions_test.go
index 173e22ca91..67fc643761 100644
--- a/tests/integration/api_admin_actions_test.go
+++ b/tests/integration/api_admin_actions_test.go
@@ -46,6 +46,7 @@ func TestAPIAdminActionsGetJobs(t *testing.T) {
 
 		expected := api.ActionRunJob{
 			ID:      393,
+			RunID:   891,
 			Attempt: 1,
 			Handle:  "18e9cf40-c2f6-409f-b832-b945ea7dc79b",
 			RepoID:  1,
diff --git a/tests/integration/api_admin_test.go b/tests/integration/api_admin_test.go
index 70a921a0a4..e3cab38d9d 100644
--- a/tests/integration/api_admin_test.go
+++ b/tests/integration/api_admin_test.go
@@ -169,6 +169,38 @@ func TestAPIListUsers(t *testing.T) {
 	assert.Len(t, users, numberOfUsers)
 }
 
+func TestAPIListUsersNo2FA(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	adminUsername := "user1"
+	token := getUserToken(t, adminUsername, auth_model.AccessTokenScopeReadAdmin)
+
+	req := NewRequest(t, "GET", "/api/v1/admin/users?is_2fa_enabled=0").
+		AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+	total := resp.Header().Get("X-Total-Count")
+
+	numberOfUsers := "28"
+
+	assert.Equal(t, numberOfUsers, total)
+}
+
+func TestAPIListUsers2FA(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	adminUsername := "user1"
+	token := getUserToken(t, adminUsername, auth_model.AccessTokenScopeReadAdmin)
+
+	req := NewRequest(t, "GET", "/api/v1/admin/users?is_2fa_enabled=1").
+		AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+	total := resp.Header().Get("X-Total-Count")
+
+	numberOfUsers := "2"
+
+	assert.Equal(t, numberOfUsers, total)
+}
+
 func TestAPIListUsersNotLoggedIn(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 	req := NewRequest(t, "GET", "/api/v1/admin/users")
@@ -394,11 +426,11 @@ func TestAPICron(t *testing.T) {
 			AddTokenAuth(token)
 		resp := MakeRequest(t, req, http.StatusOK)
 
-		assert.Equal(t, "31", resp.Header().Get("X-Total-Count"))
+		assert.Equal(t, "30", resp.Header().Get("X-Total-Count"))
 
 		var crons []api.Cron
 		DecodeJSON(t, resp, &crons)
-		assert.Len(t, crons, 31)
+		assert.Len(t, crons, 30)
 	})
 
 	t.Run("Execute", func(t *testing.T) {
diff --git a/tests/integration/api_admin_user_token_test.go b/tests/integration/api_admin_user_token_test.go
new file mode 100644
index 0000000000..5f9f26208b
--- /dev/null
+++ b/tests/integration/api_admin_user_token_test.go
@@ -0,0 +1,330 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/unittest"
+	user_model "forgejo.org/models/user"
+	api "forgejo.org/modules/structs"
+	"forgejo.org/tests"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAPIAdminCreateUserAccessToken(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})
+	targetUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user2"})
+
+	token := getUserToken(t, adminUser.Name, auth_model.AccessTokenScopeWriteAdmin)
+
+	t.Run("Create token for another user", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		urlStr := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "admin-created-token",
+			Scopes: []string{"all"},
+		}).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusCreated)
+
+		var newToken api.AccessToken
+		DecodeJSON(t, resp, &newToken)
+
+		assert.Equal(t, "admin-created-token", newToken.Name)
+		assert.NotEmpty(t, newToken.Token)
+		assert.NotEmpty(t, newToken.TokenLastEight)
+		assert.Contains(t, newToken.Scopes, "all")
+
+		// Verify the token exists in DB
+		unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{
+			ID:   newToken.ID,
+			Name: newToken.Name,
+			UID:  targetUser.ID,
+		})
+	})
+
+	t.Run("Create token with duplicate name", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		urlStr := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "admin-created-token",
+			Scopes: []string{"all"},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusBadRequest)
+	})
+
+	t.Run("Create token without scopes", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		urlStr := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "empty-scope-token",
+			Scopes: []string{},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusBadRequest)
+	})
+
+	t.Run("Create token with invalid scope", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		urlStr := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "invalid-scope-token",
+			Scopes: []string{"invalid-scope"},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusBadRequest)
+	})
+
+	t.Run("Create token for nonexistent user", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		urlStr := "/api/v1/admin/users/nonexistentuser/tokens"
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "some-token",
+			Scopes: []string{"all"},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("Non-admin cannot create token", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		normalToken := getUserToken(t, "user2", auth_model.AccessTokenScopeWriteAdmin)
+		urlStr := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "unauthorized-token",
+			Scopes: []string{"all"},
+		}).AddTokenAuth(normalToken)
+		MakeRequest(t, req, http.StatusForbidden)
+	})
+}
+
+func TestAPIAdminListUserAccessTokens(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})
+	targetUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user2"})
+
+	token := getUserToken(t, adminUser.Name, auth_model.AccessTokenScopeWriteAdmin)
+
+	// First, create a token for the target user
+	createURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+	req := NewRequestWithJSON(t, "POST", createURL, api.CreateAccessTokenOption{
+		Name:   "list-test-token",
+		Scopes: []string{"all"},
+	}).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusCreated)
+
+	t.Run("List tokens for user", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		listURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequest(t, "GET", listURL).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusOK)
+
+		var tokens []*api.AccessToken
+		DecodeJSON(t, resp, &tokens)
+
+		// user2 has at least the token we just created plus any fixture tokens
+		require.NotEmpty(t, tokens)
+
+		found := false
+		for _, tk := range tokens {
+			if tk.Name == "list-test-token" {
+				found = true
+				assert.NotEmpty(t, tk.TokenLastEight)
+				break
+			}
+		}
+		assert.True(t, found, "should find the admin-created token in the list")
+	})
+
+	t.Run("Non-admin cannot list tokens", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		normalToken := getUserToken(t, "user2", auth_model.AccessTokenScopeWriteAdmin)
+		listURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequest(t, "GET", listURL).AddTokenAuth(normalToken)
+		MakeRequest(t, req, http.StatusForbidden)
+	})
+}
+
+func TestAPIAdminCreateRepoSpecificToken(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})
+	targetUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user2"})
+
+	token := getUserToken(t, adminUser.Name, auth_model.AccessTokenScopeWriteAdmin)
+
+	t.Run("Create repo-specific token", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		urlStr := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "admin-repo-specific-token",
+			Scopes: []string{string(auth_model.AccessTokenScopeReadRepository)},
+			Repositories: []*api.RepoTargetOption{
+				{
+					Owner: "user2",
+					Name:  "repo2",
+				},
+			},
+		}).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusCreated)
+
+		var newToken api.AccessToken
+		DecodeJSON(t, resp, &newToken)
+
+		assert.Equal(t, "admin-repo-specific-token", newToken.Name)
+		assert.NotEmpty(t, newToken.Token)
+		assert.NotEmpty(t, newToken.Repositories)
+	})
+
+	t.Run("Create token targeting invalid repo", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		urlStr := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", urlStr, api.CreateAccessTokenOption{
+			Name:   "admin-invalid-repo-token",
+			Scopes: []string{string(auth_model.AccessTokenScopeReadRepository)},
+			Repositories: []*api.RepoTargetOption{
+				{
+					Owner: "user10000",
+					Name:  "repo70000",
+				},
+			},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusBadRequest)
+	})
+
+	t.Run("List repo-specific token returns repositories", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		// Create a repo-specific token
+		createURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", createURL, api.CreateAccessTokenOption{
+			Name:   "admin-list-repo-token",
+			Scopes: []string{string(auth_model.AccessTokenScopeReadRepository)},
+			Repositories: []*api.RepoTargetOption{
+				{
+					Owner: "user2",
+					Name:  "repo2",
+				},
+			},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusCreated)
+
+		// List tokens and verify repositories are returned
+		listURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req = NewRequest(t, "GET", listURL).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusOK)
+
+		var tokens []*api.AccessToken
+		DecodeJSON(t, resp, &tokens)
+
+		found := false
+		for _, tk := range tokens {
+			if tk.Name == "admin-list-repo-token" {
+				found = true
+				assert.NotEmpty(t, tk.Repositories, "admin-listed token should have repositories populated")
+				break
+			}
+		}
+		assert.True(t, found, "should find the repo-specific token in the admin list")
+	})
+}
+
+func TestAPIAdminDeleteUserAccessToken(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})
+	targetUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user2"})
+
+	token := getUserToken(t, adminUser.Name, auth_model.AccessTokenScopeWriteAdmin)
+
+	t.Run("Delete token by ID", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		// Create a token first
+		createURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", createURL, api.CreateAccessTokenOption{
+			Name:   "delete-by-id-token",
+			Scopes: []string{"all"},
+		}).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusCreated)
+
+		var newToken api.AccessToken
+		DecodeJSON(t, resp, &newToken)
+
+		// Delete it
+		deleteURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens/%d", targetUser.Name, newToken.ID)
+		req = NewRequest(t, "DELETE", deleteURL).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNoContent)
+
+		// Verify it's gone
+		unittest.AssertNotExistsBean(t, &auth_model.AccessToken{ID: newToken.ID})
+	})
+
+	t.Run("Delete token by name", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		// Create a token first
+		createURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", createURL, api.CreateAccessTokenOption{
+			Name:   "delete-by-name-token",
+			Scopes: []string{"all"},
+		}).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusCreated)
+
+		var newToken api.AccessToken
+		DecodeJSON(t, resp, &newToken)
+
+		// Delete by name
+		deleteURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens/%s", targetUser.Name, "delete-by-name-token")
+		req = NewRequest(t, "DELETE", deleteURL).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNoContent)
+
+		// Verify it's gone
+		unittest.AssertNotExistsBean(t, &auth_model.AccessToken{ID: newToken.ID})
+	})
+
+	t.Run("Delete nonexistent token", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		deleteURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens/%d", targetUser.Name, 999999)
+		req := NewRequest(t, "DELETE", deleteURL).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("Non-admin cannot delete token", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		// Create a token as admin
+		createURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens", targetUser.Name)
+		req := NewRequestWithJSON(t, "POST", createURL, api.CreateAccessTokenOption{
+			Name:   "non-admin-delete-token",
+			Scopes: []string{"all"},
+		}).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusCreated)
+
+		var newToken api.AccessToken
+		DecodeJSON(t, resp, &newToken)
+
+		// Try to delete as non-admin
+		normalToken := getUserToken(t, "user2", auth_model.AccessTokenScopeWriteAdmin)
+		deleteURL := fmt.Sprintf("/api/v1/admin/users/%s/tokens/%d", targetUser.Name, newToken.ID)
+		req = NewRequest(t, "DELETE", deleteURL).AddTokenAuth(normalToken)
+		MakeRequest(t, req, http.StatusForbidden)
+	})
+}
diff --git a/tests/integration/api_federation_httpsig_test.go b/tests/integration/api_federation_httpsig_test.go
index 5003f691d4..431676acee 100644
--- a/tests/integration/api_federation_httpsig_test.go
+++ b/tests/integration/api_federation_httpsig_test.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 	"testing"
 	"time"
 
@@ -19,8 +20,8 @@ import (
 	"forgejo.org/modules/test"
 	"forgejo.org/routers"
 	"forgejo.org/services/contexttest"
-	"forgejo.org/services/federation"
 
+	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -42,12 +43,29 @@ func TestFederationHttpSigValidation(t *testing.T) {
 		apClient, err := clientFactory.WithKeys(ctx, user1, user1.KeyID())
 		require.NoError(t, err)
 
+		// HACK HACK HACK: the host part of the URL gets set to which IP forgejo is
+		// listening on, NOT localhost, which is the Domain given to forgejo which
+		// is then used for eg. the keyID all requests
+		applicationKeyID := fmt.Sprintf("%sapi/v1/activitypub/actor#main-key", setting.AppURL)
+		actorKeyID := fmt.Sprintf("%sapi/v1/activitypub/user-id/1#main-key", setting.AppURL)
+
 		// Unsigned request
 		t.Run("UnsignedRequest", func(t *testing.T) {
 			req := NewRequest(t, "GET", userURL)
 			MakeRequest(t, req, http.StatusBadRequest)
 		})
 
+		// Check for missing public keys
+		t.Run("ValidateEmptyCaches", func(t *testing.T) {
+			_, err := forgefed.FindFederationHostByKeyID(db.DefaultContext, applicationKeyID)
+			require.Error(t, err)
+			assert.True(t, forgefed.IsErrFederationHostNotFound(err))
+
+			_, _, err = user.FindFederatedUserByKeyID(db.DefaultContext, actorKeyID)
+			require.Error(t, err)
+			assert.True(t, user.IsErrFederatedUserNotExists(err))
+		})
+
 		// Signed request
 		t.Run("SignedRequest", func(t *testing.T) {
 			resp, err := apClient.Get(userURL)
@@ -55,12 +73,6 @@ func TestFederationHttpSigValidation(t *testing.T) {
 			assert.Equal(t, http.StatusOK, resp.StatusCode)
 		})
 
-		// HACK HACK HACK: the host part of the URL gets set to which IP forgejo is
-		// listening on, NOT localhost, which is the Domain given to forgejo which
-		// is then used for eg. the keyID all requests
-		applicationKeyID := fmt.Sprintf("%sapi/v1/activitypub/actor#main-key", setting.AppURL)
-		actorKeyID := fmt.Sprintf("%sapi/v1/activitypub/user-id/1#main-key", setting.AppURL)
-
 		// Check for cached public keys
 		t.Run("ValidateCaches", func(t *testing.T) {
 			host, err := forgefed.FindFederationHostByKeyID(db.DefaultContext, applicationKeyID)
@@ -74,14 +86,6 @@ func TestFederationHttpSigValidation(t *testing.T) {
 			assert.True(t, user.PublicKey.Valid)
 		})
 
-		t.Run("ValidateActorFromKeyID", func(t *testing.T) {
-			_, err := federation.NewActorIDFromKeyID(ctx, actorKeyID)
-			require.NoError(t, err)
-
-			_, err = federation.NewActorIDFromKeyID(ctx, "http://bad.url/%^&")
-			require.Error(t, err)
-		})
-
 		// Disable signature validation
 		defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
 
@@ -92,3 +96,54 @@ func TestFederationHttpSigValidation(t *testing.T) {
 		})
 	})
 }
+
+func TestFederationAllRoutesCovered(t *testing.T) {
+	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+	routes := routers.NormalRoutes().R.Routes()
+
+	var r *chi.Route
+	for _, route := range routes {
+		if route.Pattern == "/api/v1/*" {
+			r = &route
+			break
+		}
+	}
+
+	require.NotNil(t, r)
+
+	ranOne := false
+	for _, route := range r.SubRoutes.Routes() {
+		if !strings.HasPrefix(route.Pattern, "/activitypub/") {
+			continue
+		}
+
+		ranOne = true
+		if route.Pattern == "/activitypub/actor" {
+			// unsigned request to the actor should always succed
+			req := NewRequest(t, "GET", fmt.Sprintf("%sapi/v1/activitypub/actor", setting.AppURL))
+			MakeRequest(t, req, http.StatusOK)
+		} else {
+			// this just puts in something for the replacements to be able to make a request
+			url := fmt.Sprintf("%sapi/v1%s", setting.AppURL, route.Pattern)
+			for strings.Contains(url, "{") {
+				before, after, _ := strings.Cut(url, "/{")
+				_, after, _ = strings.Cut(after, "}/")
+				url = fmt.Sprintf("%s/1/%s", before, after)
+			}
+
+			var req *RequestWrapper
+			if strings.Contains(route.Pattern, "inbox") {
+				req = NewRequestWithJSON(t, "POST", url, "{}")
+			} else {
+				req = NewRequest(t, "GET", url)
+			}
+
+			resp := MakeRequest(t, req, http.StatusBadRequest)
+			assert.Contains(t, resp.Body.String(), "request signature verification failed")
+		}
+	}
+
+	require.True(t, ranOne)
+}
diff --git a/tests/integration/api_issue_config_test.go b/tests/integration/api_issue_config_test.go
index 99b2829fbf..eecf00e406 100644
--- a/tests/integration/api_issue_config_test.go
+++ b/tests/integration/api_issue_config_test.go
@@ -7,6 +7,7 @@ package integration
 import (
 	"fmt"
 	"net/http"
+	"net/url"
 	"testing"
 
 	repo_model "forgejo.org/models/repo"
@@ -44,169 +45,169 @@ func getIssueConfig(t *testing.T, owner, repo string) api.IssueConfig {
 }
 
 func TestAPIRepoGetIssueConfig(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
+	onApplicationRun(t, func(t *testing.T, _ *url.URL) {
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 49})
+		owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
 
-	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 49})
-	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+		t.Run("Default", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
 
-	t.Run("Default", func(t *testing.T) {
-		defer tests.PrintCurrentTest(t)()
+			issueConfig := getIssueConfig(t, owner.Name, repo.Name)
 
-		issueConfig := getIssueConfig(t, owner.Name, repo.Name)
+			assert.True(t, issueConfig.BlankIssuesEnabled)
+			assert.Empty(t, issueConfig.ContactLinks)
+		})
 
-		assert.True(t, issueConfig.BlankIssuesEnabled)
-		assert.Empty(t, issueConfig.ContactLinks)
-	})
+		t.Run("DisableBlankIssues", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
 
-	t.Run("DisableBlankIssues", func(t *testing.T) {
-		defer tests.PrintCurrentTest(t)()
+			config := make(map[string]any)
+			config["blank_issues_enabled"] = false
 
-		config := make(map[string]any)
-		config["blank_issues_enabled"] = false
+			createIssueConfig(t, owner, repo, config)
 
-		createIssueConfig(t, owner, repo, config)
+			issueConfig := getIssueConfig(t, owner.Name, repo.Name)
 
-		issueConfig := getIssueConfig(t, owner.Name, repo.Name)
+			assert.False(t, issueConfig.BlankIssuesEnabled)
+			assert.Empty(t, issueConfig.ContactLinks)
+		})
 
-		assert.False(t, issueConfig.BlankIssuesEnabled)
-		assert.Empty(t, issueConfig.ContactLinks)
-	})
+		t.Run("ContactLinks", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
 
-	t.Run("ContactLinks", func(t *testing.T) {
-		defer tests.PrintCurrentTest(t)()
+			contactLink := make(map[string]string)
+			contactLink["name"] = "TestName"
+			contactLink["url"] = "https://example.com"
+			contactLink["about"] = "TestAbout"
 
-		contactLink := make(map[string]string)
-		contactLink["name"] = "TestName"
-		contactLink["url"] = "https://example.com"
-		contactLink["about"] = "TestAbout"
+			config := make(map[string]any)
+			config["contact_links"] = []map[string]string{contactLink}
 
-		config := make(map[string]any)
-		config["contact_links"] = []map[string]string{contactLink}
+			createIssueConfig(t, owner, repo, config)
 
-		createIssueConfig(t, owner, repo, config)
+			issueConfig := getIssueConfig(t, owner.Name, repo.Name)
 
-		issueConfig := getIssueConfig(t, owner.Name, repo.Name)
+			assert.True(t, issueConfig.BlankIssuesEnabled)
+			assert.Len(t, issueConfig.ContactLinks, 1)
 
-		assert.True(t, issueConfig.BlankIssuesEnabled)
-		assert.Len(t, issueConfig.ContactLinks, 1)
+			assert.Equal(t, "TestName", issueConfig.ContactLinks[0].Name)
+			assert.Equal(t, "https://example.com", issueConfig.ContactLinks[0].URL)
+			assert.Equal(t, "TestAbout", issueConfig.ContactLinks[0].About)
+		})
 
-		assert.Equal(t, "TestName", issueConfig.ContactLinks[0].Name)
-		assert.Equal(t, "https://example.com", issueConfig.ContactLinks[0].URL)
-		assert.Equal(t, "TestAbout", issueConfig.ContactLinks[0].About)
-	})
+		t.Run("Full", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
 
-	t.Run("Full", func(t *testing.T) {
-		defer tests.PrintCurrentTest(t)()
+			contactLink := make(map[string]string)
+			contactLink["name"] = "TestName"
+			contactLink["url"] = "https://example.com"
+			contactLink["about"] = "TestAbout"
 
-		contactLink := make(map[string]string)
-		contactLink["name"] = "TestName"
-		contactLink["url"] = "https://example.com"
-		contactLink["about"] = "TestAbout"
+			config := make(map[string]any)
+			config["blank_issues_enabled"] = false
+			config["contact_links"] = []map[string]string{contactLink}
 
-		config := make(map[string]any)
-		config["blank_issues_enabled"] = false
-		config["contact_links"] = []map[string]string{contactLink}
+			createIssueConfig(t, owner, repo, config)
 
-		createIssueConfig(t, owner, repo, config)
+			issueConfig := getIssueConfig(t, owner.Name, repo.Name)
 
-		issueConfig := getIssueConfig(t, owner.Name, repo.Name)
+			assert.False(t, issueConfig.BlankIssuesEnabled)
+			assert.Len(t, issueConfig.ContactLinks, 1)
 
-		assert.False(t, issueConfig.BlankIssuesEnabled)
-		assert.Len(t, issueConfig.ContactLinks, 1)
-
-		assert.Equal(t, "TestName", issueConfig.ContactLinks[0].Name)
-		assert.Equal(t, "https://example.com", issueConfig.ContactLinks[0].URL)
-		assert.Equal(t, "TestAbout", issueConfig.ContactLinks[0].About)
+			assert.Equal(t, "TestName", issueConfig.ContactLinks[0].Name)
+			assert.Equal(t, "https://example.com", issueConfig.ContactLinks[0].URL)
+			assert.Equal(t, "TestAbout", issueConfig.ContactLinks[0].About)
+		})
 	})
 }
 
 func TestAPIRepoIssueConfigPaths(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
+	onApplicationRun(t, func(t *testing.T, _ *url.URL) {
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 49})
+		owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
 
-	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 49})
-	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
-
-	templateConfigCandidates := []string{
-		".forgejo/ISSUE_TEMPLATE/config",
-		".forgejo/issue_template/config",
-		".gitea/ISSUE_TEMPLATE/config",
-		".gitea/issue_template/config",
-		".github/ISSUE_TEMPLATE/config",
-		".github/issue_template/config",
-		"docs/issue_template/config",
-	}
-
-	for _, candidate := range templateConfigCandidates {
-		for _, extension := range []string{".yaml", ".yml"} {
-			fullPath := candidate + extension
-			t.Run(fullPath, func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				configMap := make(map[string]any)
-				configMap["blank_issues_enabled"] = false
-
-				configData, err := yaml.Marshal(configMap)
-				require.NoError(t, err)
-
-				_, err = createFileInBranch(owner, repo, fullPath, repo.DefaultBranch, string(configData))
-				require.NoError(t, err)
-
-				issueConfig := getIssueConfig(t, owner.Name, repo.Name)
-
-				assert.False(t, issueConfig.BlankIssuesEnabled)
-				assert.Empty(t, issueConfig.ContactLinks)
-
-				err = deleteFileInBranch(owner, repo, fullPath, repo.DefaultBranch)
-				require.NoError(t, err)
-			})
+		templateConfigCandidates := []string{
+			".forgejo/ISSUE_TEMPLATE/config",
+			".forgejo/issue_template/config",
+			".gitea/ISSUE_TEMPLATE/config",
+			".gitea/issue_template/config",
+			".github/ISSUE_TEMPLATE/config",
+			".github/issue_template/config",
+			"docs/issue_template/config",
 		}
-	}
+
+		for _, candidate := range templateConfigCandidates {
+			for _, extension := range []string{".yaml", ".yml"} {
+				fullPath := candidate + extension
+				t.Run(fullPath, func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					configMap := make(map[string]any)
+					configMap["blank_issues_enabled"] = false
+
+					configData, err := yaml.Marshal(configMap)
+					require.NoError(t, err)
+
+					_, err = createFileInBranch(owner, repo, fullPath, repo.DefaultBranch, string(configData))
+					require.NoError(t, err)
+
+					issueConfig := getIssueConfig(t, owner.Name, repo.Name)
+
+					assert.False(t, issueConfig.BlankIssuesEnabled)
+					assert.Empty(t, issueConfig.ContactLinks)
+
+					err = deleteFileInBranch(owner, repo, fullPath, repo.DefaultBranch)
+					require.NoError(t, err)
+				})
+			}
+		}
+	})
 }
 
 func TestAPIRepoValidateIssueConfig(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
+	onApplicationRun(t, func(t *testing.T, _ *url.URL) {
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 49})
+		owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
 
-	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 49})
-	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+		urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issue_config/validate", owner.Name, repo.Name)
 
-	urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issue_config/validate", owner.Name, repo.Name)
+		t.Run("Valid", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
 
-	t.Run("Valid", func(t *testing.T) {
-		defer tests.PrintCurrentTest(t)()
+			req := NewRequest(t, "GET", urlStr)
+			resp := MakeRequest(t, req, http.StatusOK)
 
-		req := NewRequest(t, "GET", urlStr)
-		resp := MakeRequest(t, req, http.StatusOK)
+			var issueConfigValidation api.IssueConfigValidation
+			DecodeJSON(t, resp, &issueConfigValidation)
 
-		var issueConfigValidation api.IssueConfigValidation
-		DecodeJSON(t, resp, &issueConfigValidation)
+			assert.True(t, issueConfigValidation.Valid)
+			assert.Empty(t, issueConfigValidation.Message)
+		})
 
-		assert.True(t, issueConfigValidation.Valid)
-		assert.Empty(t, issueConfigValidation.Message)
-	})
+		t.Run("Invalid", func(t *testing.T) {
+			dirs := []string{".gitea", ".forgejo", "docs"}
+			for _, dir := range dirs {
+				t.Run(dir, func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					defer func() {
+						deleteFileInBranch(owner, repo, fmt.Sprintf("%s/ISSUE_TEMPLATE/config.yaml", dir), repo.DefaultBranch)
+					}()
 
-	t.Run("Invalid", func(t *testing.T) {
-		dirs := []string{".gitea", ".forgejo", "docs"}
-		for _, dir := range dirs {
-			t.Run(dir, func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-				defer func() {
-					deleteFileInBranch(owner, repo, fmt.Sprintf("%s/ISSUE_TEMPLATE/config.yaml", dir), repo.DefaultBranch)
-				}()
+					config := make(map[string]any)
+					config["blank_issues_enabled"] = "Test"
 
-				config := make(map[string]any)
-				config["blank_issues_enabled"] = "Test"
+					createIssueConfigInDirectory(t, owner, repo, dir, config)
 
-				createIssueConfigInDirectory(t, owner, repo, dir, config)
+					req := NewRequest(t, "GET", urlStr)
+					resp := MakeRequest(t, req, http.StatusOK)
 
-				req := NewRequest(t, "GET", urlStr)
-				resp := MakeRequest(t, req, http.StatusOK)
+					var issueConfigValidation api.IssueConfigValidation
+					DecodeJSON(t, resp, &issueConfigValidation)
 
-				var issueConfigValidation api.IssueConfigValidation
-				DecodeJSON(t, resp, &issueConfigValidation)
-
-				assert.False(t, issueConfigValidation.Valid)
-				assert.NotEmpty(t, issueConfigValidation.Message)
-			})
-		}
+					assert.False(t, issueConfigValidation.Valid)
+					assert.NotEmpty(t, issueConfigValidation.Message)
+				})
+			}
+		})
 	})
 }
diff --git a/tests/integration/api_issue_test.go b/tests/integration/api_issue_test.go
index 7f601fa303..512ebf56e4 100644
--- a/tests/integration/api_issue_test.go
+++ b/tests/integration/api_issue_test.go
@@ -20,15 +20,14 @@ import (
 	"forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"xorm.io/xorm/convert"
 )
 
 func TestAPIListIssues(t *testing.T) {
@@ -752,35 +751,28 @@ func TestAPISearchIssuesAccessTokenResources(t *testing.T) {
 func TestAPIInternalAndExternalIssueTracker(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	otherUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+	repoOptions := &forgery.CreateRepositoryOptions{
+		Files: forgery.FilesInit{}, // some tests will fail with 404 if the repository is empty
+	}
+	user := forgery.CreateUser(t, &forgery.CreateUserOptions{
+		IsAdmin: true,
+	})
+	otherUser := forgery.CreateUser(t, nil)
 	token := getUserToken(t, user.Name, auth_model.AccessTokenScopeAll)
 
-	internalIssueRepo, _, reset := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-		Name:          optional.Some("internal-issues"),
-		EnabledUnits:  optional.Some([]unit.Type{unit.TypeIssues}),
-		DisabledUnits: optional.Some([]unit.Type{unit.TypeExternalTracker}),
-		UnitConfig: optional.Some(map[unit.Type]convert.Conversion{
-			unit.TypeIssues: &repo_model.IssuesConfig{
-				EnableTimetracker:  true,
-				EnableDependencies: true,
-			},
-		}),
+	internalIssueRepo := forgery.CreateRepository(t, user, repoOptions)
+	forgery.DisableRepoUnits(t, internalIssueRepo, unit.TypeExternalTracker)
+	forgery.EnableRepoUnit(t, internalIssueRepo, unit.TypeIssues, &repo_model.IssuesConfig{
+		EnableTimetracker:  true,
+		EnableDependencies: true,
 	})
-	defer reset()
 
-	externalIssueRepo, _, reset := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-		Name:          optional.Some("external-issues"),
-		EnabledUnits:  optional.Some([]unit.Type{unit.TypeExternalTracker}),
-		DisabledUnits: optional.Some([]unit.Type{unit.TypeIssues}),
-	})
-	defer reset()
+	externalIssueRepo := forgery.CreateRepository(t, user, repoOptions)
+	forgery.DisableRepoUnits(t, externalIssueRepo, unit.TypeIssues)
+	forgery.EnableRepoUnit(t, internalIssueRepo, unit.TypeExternalTracker, nil)
 
-	disabledIssueRepo, _, reset := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-		Name:          optional.Some("disabled-issues"),
-		DisabledUnits: optional.Some([]unit.Type{unit.TypeIssues, unit.TypeExternalTracker}),
-	})
-	defer reset()
+	disabledIssueRepo := forgery.CreateRepository(t, user, repoOptions)
+	forgery.DisableRepoUnits(t, disabledIssueRepo, unit.TypeIssues, unit.TypeExternalTracker)
 
 	runTest := func(t *testing.T, repo *repo_model.Repository, requestAllowed bool) {
 		t.Helper()
@@ -937,15 +929,13 @@ func TestAPIIssueDependencyPermissions(t *testing.T) {
 	actingUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
 	token := getUserToken(t, actingUser.Name, auth_model.AccessTokenScopeAll)
 
-	actingUserRepo, _, reset := tests.CreateDeclarativeRepoWithOptions(t, actingUser, tests.DeclarativeRepoOptions{})
-	defer reset()
+	actingUserRepo := forgery.CreateRepository(t, actingUser, nil)
 	actingUserIssue := createIssue(t, actingUser, actingUserRepo, "source issue", "some content")
 
 	otherUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	otherUserRepo, _, reset := tests.CreateDeclarativeRepoWithOptions(t, otherUser, tests.DeclarativeRepoOptions{
-		IsPrivate: optional.Some(true),
+	otherUserRepo := forgery.CreateRepository(t, otherUser, &forgery.CreateRepositoryOptions{
+		IsPrivate: true,
 	})
-	defer reset()
 	otherUserIssue := createIssue(t, otherUser, otherUserRepo, "target issue", "some content")
 
 	apiEndpoint := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/dependencies", actingUserRepo.OwnerName, actingUserRepo.Name, actingUserIssue.Index)
diff --git a/tests/integration/api_org_actions_test.go b/tests/integration/api_org_actions_test.go
index 08de84cdf2..eb96435a45 100644
--- a/tests/integration/api_org_actions_test.go
+++ b/tests/integration/api_org_actions_test.go
@@ -37,6 +37,7 @@ func TestActionsAPISearchActionJobs_OrgRunner(t *testing.T) {
 
 	job395 := api.ActionRunJob{
 		ID:      395,
+		RunID:   891,
 		Attempt: 1,
 		Handle:  "40317a2f-2f00-4a82-8cc4-57347989a493",
 		RepoID:  1,
diff --git a/tests/integration/api_org_variables_test.go b/tests/integration/api_org_variables_test.go
index 982c2f8fa5..0f0347f1fd 100644
--- a/tests/integration/api_org_variables_test.go
+++ b/tests/integration/api_org_variables_test.go
@@ -10,10 +10,9 @@ import (
 
 	actions_model "forgejo.org/models/actions"
 	auth_model "forgejo.org/models/auth"
-	org_model "forgejo.org/models/organization"
-	"forgejo.org/models/unittest"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -22,8 +21,9 @@ import (
 func TestAPIOrgVariablesCreateOrganizationVariable(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{Name: "org3"})
-	session := loginUser(t, "user2")
+	owner := forgery.CreateUser(t, nil)
+	org := forgery.CreateOrganisation(t, owner)
+	session := loginUser(t, owner.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteOrganization)
 
 	cases := []struct {
@@ -98,8 +98,9 @@ func TestAPIOrgVariablesCreateOrganizationVariable(t *testing.T) {
 func TestAPIOrgVariablesUpdateOrganizationVariable(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{Name: "org3"})
-	session := loginUser(t, "user2")
+	owner := forgery.CreateUser(t, nil)
+	org := forgery.CreateOrganisation(t, owner)
+	session := loginUser(t, owner.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteOrganization)
 
 	variableName := "test_update_var"
@@ -194,10 +195,12 @@ func TestAPIOrgVariablesUpdateOrganizationVariable(t *testing.T) {
 func TestAPIOrgVariablesDeleteOrganizationVariable(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{Name: "org3"})
+	owner := forgery.CreateUser(t, nil)
+	org := forgery.CreateOrganisation(t, owner)
+
 	variable, err := actions_model.InsertVariable(t.Context(), org.ID, 0, "FORGEJO_FORBIDDEN", "illegal")
 	require.NoError(t, err)
-	session := loginUser(t, "user2")
+	session := loginUser(t, owner.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteOrganization)
 
 	variableName := "test_delete_var"
@@ -226,8 +229,9 @@ func TestAPIOrgVariablesDeleteOrganizationVariable(t *testing.T) {
 func TestAPIOrgVariablesGetSingleOrganizationVariable(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{Name: "org3"})
-	session := loginUser(t, "user2")
+	owner := forgery.CreateUser(t, nil)
+	org := forgery.CreateOrganisation(t, owner)
+	session := loginUser(t, owner.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteOrganization)
 
 	name := "some_variable"
@@ -258,8 +262,9 @@ func TestAPIOrgVariablesGetSingleOrganizationVariable(t *testing.T) {
 func TestAPIOrgVariablesGetAllOrganizationVariables(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{Name: "org3"})
-	session := loginUser(t, "user2")
+	owner := forgery.CreateUser(t, nil)
+	org := forgery.CreateOrganisation(t, owner)
+	session := loginUser(t, owner.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteOrganization)
 
 	variables := map[string]string{"second": "Dolor sit amet", "first": "Lorem ipsum"}
diff --git a/tests/integration/api_packages_conan_test.go b/tests/integration/api_packages_conan_test.go
index 0e4e4a75e3..4184762e71 100644
--- a/tests/integration/api_packages_conan_test.go
+++ b/tests/integration/api_packages_conan_test.go
@@ -563,6 +563,45 @@ func TestPackageConan(t *testing.T) {
 			})
 		})
 
+		t.Run("Authorized Integration Authentication", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			testCase := func(t *testing.T, scope auth_model.AccessTokenScope, expectedStatusCode int) {
+				t.Helper()
+
+				ait := newAITester(t, func(ai *auth_model.AuthorizedIntegration) {
+					ai.Scope = scope
+				})
+				defer ait.close()
+				token := ait.signedJWT()
+
+				req := NewRequest(t, "GET", fmt.Sprintf("%s/v2/users/authenticate", url)).
+					AddTokenAuth(token)
+				resp := MakeRequest(t, req, http.StatusOK)
+
+				body := resp.Body.String()
+				assert.NotEmpty(t, body)
+
+				recipeURL := fmt.Sprintf("%s/v2/conans/%s/%s/%s/%s/revisions/%s", url, "TestScope", version1, "testing", channel1, revision1)
+
+				req = NewRequestWithBody(t, "PUT", fmt.Sprintf("%s/files/%s", recipeURL, conanfileName), strings.NewReader("Doesn't need to be valid")).
+					AddTokenAuth("Bearer " + body)
+				MakeRequest(t, req, expectedStatusCode)
+			}
+
+			t.Run("Read permission", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				testCase(t, auth_model.AccessTokenScopeReadPackage, http.StatusUnauthorized)
+			})
+
+			t.Run("Write permission", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				testCase(t, auth_model.AccessTokenScopeWritePackage, http.StatusCreated)
+			})
+		})
+
 		t.Run("Authenticate", func(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
 
diff --git a/tests/integration/api_packages_container_test.go b/tests/integration/api_packages_container_test.go
index 70e3f40d6c..550436990a 100644
--- a/tests/integration/api_packages_container_test.go
+++ b/tests/integration/api_packages_container_test.go
@@ -198,6 +198,28 @@ func TestPackageContainer(t *testing.T) {
 
 			assert.Empty(t, resp.Header().Get("WWW-Authenticate"))
 		})
+
+		t.Run("Basic authentication w/ Authorized Integration", func(t *testing.T) {
+			ait := newAITester(t, func(ai *auth_model.AuthorizedIntegration) {
+				ai.Scope = auth_model.AccessTokenScopeReadPackage
+			})
+			defer ait.close()
+			token := ait.signedJWT()
+
+			req := NewRequest(t, "GET", fmt.Sprintf("%sv2/token", setting.AppURL))
+			req.SetBasicAuth(user.Name, token)
+
+			resp := MakeRequest(t, req, http.StatusOK)
+
+			tokenResponse := &TokenResponse{}
+			DecodeJSON(t, resp, &tokenResponse)
+
+			assert.NotEmpty(t, tokenResponse.Token)
+
+			req = NewRequest(t, "GET", fmt.Sprintf("%sv2", setting.AppURL)).
+				AddTokenAuth(fmt.Sprintf("Bearer %s", tokenResponse.Token))
+			MakeRequest(t, req, http.StatusOK)
+		})
 	})
 
 	t.Run("DetermineSupport", func(t *testing.T) {
diff --git a/tests/integration/api_packages_pypi_test.go b/tests/integration/api_packages_pypi_test.go
index f025f8e577..45aa41c573 100644
--- a/tests/integration/api_packages_pypi_test.go
+++ b/tests/integration/api_packages_pypi_test.go
@@ -17,6 +17,7 @@ import (
 	"forgejo.org/models/packages"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/json"
 	"forgejo.org/modules/packages/pypi"
 	"forgejo.org/tests"
 
@@ -211,19 +212,20 @@ func TestPackagePyPI(t *testing.T) {
 		assert.Equal(t, int64(2), pvs[0].DownloadCount)
 	})
 
-	t.Run("PackageMetadata", func(t *testing.T) {
+	hrefMatcher := regexp.MustCompile(fmt.Sprintf(`%s/files/%s/%s/test\..+#sha256=%s`, root, regexp.QuoteMeta(packageName), regexp.QuoteMeta(packageVersion), hashSHA256))
+
+	t.Run("PackageMetadataHTML", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 
 		req := NewRequest(t, "GET", fmt.Sprintf("%s/simple/%s", root, packageName)).
 			AddBasicAuth(user.Name)
+		req.Header["Accept"] = []string{"application/vnd.pypi.simple.v1+html"}
 		resp := MakeRequest(t, req, http.StatusOK)
 
 		htmlDoc := NewHTMLParser(t, resp.Body)
 		nodes := htmlDoc.doc.Find("a").Nodes
 		assert.Len(t, nodes, 2)
 
-		hrefMatcher := regexp.MustCompile(fmt.Sprintf(`%s/files/%s/%s/test\..+#sha256=%s`, root, regexp.QuoteMeta(packageName), regexp.QuoteMeta(packageVersion), hashSHA256))
-
 		for _, a := range nodes {
 			for _, att := range a.Attr {
 				switch att.Key {
@@ -237,4 +239,24 @@ func TestPackagePyPI(t *testing.T) {
 			}
 		}
 	})
+
+	t.Run("PackageMetadataJSON", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		req := NewRequest(t, "GET", fmt.Sprintf("%s/simple/%s", root, packageName)).
+			AddBasicAuth(user.Name)
+		req.Header["Accept"] = []string{"application/vnd.pypi.simple.v1+json"}
+		resp := MakeRequest(t, req, http.StatusOK)
+		assert.Greater(t, resp.Body.Len(), 3)
+		txt := make([]byte, resp.Body.Len())
+		resp.Body.Read(txt)
+		var obj pypi.PackageJSON
+		require.NoError(t, json.Unmarshal(txt, &obj))
+		assert.Equal(t, packageName, obj.Name)
+		assert.Equal(t, pypi.PackageMetaJSON{APIVersion: "1.4"}, obj.Meta)
+		for _, filed := range obj.Files {
+			hrefMatcher = regexp.MustCompile(fmt.Sprintf(`%s/files/%s/%s/test\.(tar\.gz)|(whl)`, root, regexp.QuoteMeta(packageName), regexp.QuoteMeta(packageVersion)))
+			assert.Regexp(t, hrefMatcher, filed.URL[21:])
+		}
+	})
 }
diff --git a/tests/integration/api_packages_test.go b/tests/integration/api_packages_test.go
index f4cd42784a..44c0057941 100644
--- a/tests/integration/api_packages_test.go
+++ b/tests/integration/api_packages_test.go
@@ -417,9 +417,44 @@ func TestPackageAccess(t *testing.T) {
 			{limitedOrgNoMember, http.StatusOK},
 			{publicOrgNoMember, http.StatusOK},
 		} {
-			req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/packages/%s", target.Owner.Name)).
-				AddTokenAuth(tokenReadPackage)
-			MakeRequest(t, req, target.ExpectedStatus)
+			t.Run(target.Owner.Name, func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+				req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/packages/%s", target.Owner.Name)).
+					AddTokenAuth(tokenReadPackage)
+				MakeRequest(t, req, target.ExpectedStatus)
+			})
+		}
+	})
+
+	t.Run("Authorized Integration", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		ait := newAITester(t, func(ai *auth_model.AuthorizedIntegration) {
+			ai.Scope = auth_model.AccessTokenScopeReadPackage
+			ai.UserID = user.ID
+		})
+		defer ait.close()
+		token := ait.signedJWT()
+
+		for _, target := range []Target{
+			{admin, http.StatusOK},
+			{inactive, http.StatusOK},
+			{user, http.StatusOK},
+			{limitedUser, http.StatusOK},
+			{privateUser, http.StatusForbidden},
+			{privateOrgMember, http.StatusOK},
+			{limitedOrgMember, http.StatusOK},
+			{publicOrgMember, http.StatusOK},
+			{privateOrgNoMember, http.StatusForbidden},
+			{limitedOrgNoMember, http.StatusOK},
+			{publicOrgNoMember, http.StatusOK},
+		} {
+			t.Run(target.Owner.Name, func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+				req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/packages/%s", target.Owner.Name)).
+					AddTokenAuth(token)
+				MakeRequest(t, req, target.ExpectedStatus)
+			})
 		}
 	})
 }
diff --git a/tests/integration/api_private_serv_test.go b/tests/integration/api_private_serv_test.go
index dd45f54c36..738925172c 100644
--- a/tests/integration/api_private_serv_test.go
+++ b/tests/integration/api_private_serv_test.go
@@ -17,7 +17,7 @@ import (
 	"forgejo.org/modules/private"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/test"
-	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -167,8 +167,7 @@ func TestAPIPrivateServAndNoServWithRequiredTwoFactor(t *testing.T) {
 
 		runTest := func(t *testing.T, user *user_model.User, useTOTP, servAllowed bool) {
 			t.Helper()
-			repo, _, reset := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{})
-			defer reset()
+			repo := forgery.CreateRepository(t, user, nil)
 
 			pubKey, err := asymkey_model.AddPublicKey(ctx, user.ID, "tmp-key-"+user.Name, "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGXEEzWmm1dxb+57RoK5KVCL0w2eNv9cqJX2AGGVlkFsVDhOXHzsadS3LTK4VlEbbrDMJdoti9yM8vclA8IeRacAAAAEc3NoOg== nocomment", 0)
 			require.NoError(t, err)
diff --git a/tests/integration/api_pull_review_test.go b/tests/integration/api_pull_review_test.go
index 5ff8bd4adf..0ec229f554 100644
--- a/tests/integration/api_pull_review_test.go
+++ b/tests/integration/api_pull_review_test.go
@@ -112,8 +112,10 @@ func TestAPIPullReviewCreateDeleteComment(t *testing.T) {
 				DecodeJSON(t, resp, &reviewComment)
 				assert.Equal(t, review.ID, reviewComment.ReviewID)
 				assert.Equal(t, newCommentBody, reviewComment.Body)
-				assert.EqualValues(t, reviewLine, reviewComment.OldLineNum)
-				assert.EqualValues(t, 0, reviewComment.LineNum)
+				// we sent OldLineNum: 1, but that line of code isn't modified in this PR, triggering the PR's logic
+				// which standardizes comments on non-modified lines of code to be on the right-hand-side of the diff:
+				assert.EqualValues(t, 0, reviewComment.OldLineNum)
+				assert.EqualValues(t, reviewLine, reviewComment.LineNum)
 				assert.Equal(t, path, reviewComment.Path)
 			}
 
diff --git a/tests/integration/api_pull_test.go b/tests/integration/api_pull_test.go
index c1b64cdb39..17fab07f9e 100644
--- a/tests/integration/api_pull_test.go
+++ b/tests/integration/api_pull_test.go
@@ -178,6 +178,59 @@ func TestAPIPullsFiles(t *testing.T) {
 	})
 }
 
+func TestAPIViewPullsFilterByBaseHead(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+
+	ctx := NewAPITestContext(t, "user2", repo.Name, auth_model.AccessTokenScopeReadRepository)
+
+	t.Run("FilterByBase", func(t *testing.T) {
+		req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/pulls?state=all&base=master", repo.OwnerName, repo.Name).
+			AddTokenAuth(ctx.Token)
+		resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+
+		var pulls []*api.PullRequest
+		DecodeJSON(t, resp, &pulls)
+		assert.Len(t, pulls, 2)
+		for _, pr := range pulls {
+			assert.Equal(t, "master", pr.Base.Name)
+		}
+	})
+
+	t.Run("FilterByHead", func(t *testing.T) {
+		req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/pulls?state=all&head=branch2", repo.OwnerName, repo.Name).
+			AddTokenAuth(ctx.Token)
+		resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+
+		var pulls []*api.PullRequest
+		DecodeJSON(t, resp, &pulls)
+		assert.Len(t, pulls, 1)
+		assert.Equal(t, "branch2", pulls[0].Head.Name)
+	})
+
+	t.Run("FilterByBaseAndHead", func(t *testing.T) {
+		req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/pulls?state=all&base=master&head=branch2", repo.OwnerName, repo.Name).
+			AddTokenAuth(ctx.Token)
+		resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+
+		var pulls []*api.PullRequest
+		DecodeJSON(t, resp, &pulls)
+		assert.Len(t, pulls, 1)
+		assert.Equal(t, "master", pulls[0].Base.Name)
+		assert.Equal(t, "branch2", pulls[0].Head.Name)
+	})
+
+	t.Run("FilterByBaseNoMatch", func(t *testing.T) {
+		req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/pulls?state=all&base=nonexistent", repo.OwnerName, repo.Name).
+			AddTokenAuth(ctx.Token)
+		resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+
+		var pulls []*api.PullRequest
+		DecodeJSON(t, resp, &pulls)
+		assert.Empty(t, pulls)
+	})
+}
+
 func TestAPIViewPullsByBaseHead(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
diff --git a/tests/integration/api_push_mirror_test.go b/tests/integration/api_push_mirror_test.go
index b31c5cc766..8abaa1b919 100644
--- a/tests/integration/api_push_mirror_test.go
+++ b/tests/integration/api_push_mirror_test.go
@@ -26,7 +26,6 @@ import (
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/test"
@@ -34,6 +33,7 @@ import (
 	mirror_service "forgejo.org/services/mirror"
 	repo_service "forgejo.org/services/repository"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -313,12 +313,7 @@ func TestAPIPushMirrorSSH(t *testing.T) {
 		assert.False(t, srcRepo.HasWiki())
 		session := loginUser(t, user.Name)
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
-		pushToRepo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			Name:         optional.Some("push-mirror-test"),
-			AutoInit:     optional.Some(false),
-			EnabledUnits: optional.Some([]unit.Type{unit.TypeCode}),
-		})
-		defer f()
+		pushToRepo := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{})
 
 		sshURL := fmt.Sprintf("ssh://%s@%s/%s.git", setting.SSH.User, net.JoinHostPort(setting.SSH.ListenHost, strconv.Itoa(setting.SSH.ListenPort)), pushToRepo.FullName())
 
diff --git a/tests/integration/api_quota_use_test.go b/tests/integration/api_quota_use_test.go
index 1ca44cc17e..97d5cab6a2 100644
--- a/tests/integration/api_quota_use_test.go
+++ b/tests/integration/api_quota_use_test.go
@@ -22,7 +22,6 @@ import (
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/migration"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/test"
@@ -31,6 +30,7 @@ import (
 	"forgejo.org/services/forms"
 	repo_service "forgejo.org/services/repository"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -281,9 +281,10 @@ func prepareQuotaEnv(t *testing.T, username string) *quotaEnv {
 	env.cleanups = append(env.cleanups, userCleanup)
 
 	// Create a repository
-	repo, _, repoCleanup := tests.CreateDeclarativeRepoWithOptions(t, env.User.User, tests.DeclarativeRepoOptions{})
+	repo := forgery.CreateRepository(t, env.User.User, &forgery.CreateRepositoryOptions{
+		Files: forgery.FilesInit{}, // some tests will fail with 404 if the repository is empty
+	})
 	env.Repo = repo
-	env.cleanups = append(env.cleanups, repoCleanup)
 
 	return &env
 }
@@ -476,10 +477,9 @@ func testAPIQuotaEnforcement(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 
 		// Create a template repository
-		template, _, cleanup := tests.CreateDeclarativeRepoWithOptions(t, env.User.User, tests.DeclarativeRepoOptions{
-			IsTemplate: optional.Some(true),
+		template := forgery.CreateRepository(t, env.User.User, &forgery.CreateRepositoryOptions{
+			IsTemplate: true,
 		})
-		defer cleanup()
 
 		// Drop the quota to 0
 		defer env.SetRuleLimit(t, "all", 0)()
@@ -513,8 +513,7 @@ func testAPIQuotaEnforcement(t *testing.T) {
 
 	t.Run("#/repos/{username}/{reponame}", func(t *testing.T) {
 		// Lets create a new repo to play with.
-		repo, _, repoCleanup := tests.CreateDeclarativeRepoWithOptions(t, env.User.User, tests.DeclarativeRepoOptions{})
-		defer repoCleanup()
+		repo := forgery.CreateRepository(t, env.User.User, nil)
 
 		// Drop the quota to 0
 		defer env.SetRuleLimit(t, "all", 0)()
@@ -1198,8 +1197,7 @@ func testAPIQuotaEnforcement(t *testing.T) {
 				defer tests.PrintCurrentTest(t)()
 
 				// Create a repository to transfer
-				repo, _, cleanup := tests.CreateDeclarativeRepoWithOptions(t, env.User.User, tests.DeclarativeRepoOptions{})
-				defer cleanup()
+				repo := forgery.CreateRepository(t, env.User.User, nil)
 
 				// Initiate repo transfer
 				req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/transfer", env.User.User.Name, repo.Name), api.TransferRepoOption{
@@ -1233,8 +1231,7 @@ func testAPIQuotaEnforcement(t *testing.T) {
 				defer env.SetRuleLimit(t, "deny-all", -1)()
 
 				// Create a repository to transfer
-				repo, _, cleanup := tests.CreateDeclarativeRepoWithOptions(t, env.User.User, tests.DeclarativeRepoOptions{})
-				defer cleanup()
+				repo := forgery.CreateRepository(t, env.User.User, nil)
 
 				// Initiate repo transfer
 				req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/transfer", env.User.User.Name, repo.Name), api.TransferRepoOption{
diff --git a/tests/integration/api_repo_action_artifact_test.go b/tests/integration/api_repo_action_artifact_test.go
new file mode 100644
index 0000000000..f6486557cf
--- /dev/null
+++ b/tests/integration/api_repo_action_artifact_test.go
@@ -0,0 +1,285 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	auth_model "forgejo.org/models/auth"
+	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unittest"
+	user_model "forgejo.org/models/user"
+	api "forgejo.org/modules/structs"
+	"forgejo.org/tests"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAPIListActionArtifacts(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+	token := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadRepository)
+
+	t.Run("ListRepoArtifacts", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+
+		res := MakeRequest(t, req, http.StatusOK)
+		var entries []*api.ActionArtifact
+		DecodeJSON(t, res, &entries)
+
+		// Fixture has 2 logical artifacts with confirmed status:
+		// "multi-file-download" (run 791, ids 19+20) and "artifact-v4-download" (run 792, id 22)
+		assert.Equal(t, "2", res.Header().Get("X-Total-Count"))
+		require.Len(t, entries, 2)
+
+		names := make([]string, len(entries))
+		for i, a := range entries {
+			names[i] = a.Name
+			assert.False(t, a.Expired)
+			assert.NotZero(t, a.SizeInBytes)
+			assert.Contains(t, a.ArchiveDownloadURL, "/actions/artifacts/")
+			assert.Contains(t, a.ArchiveDownloadURL, "/zip")
+		}
+		assert.ElementsMatch(t, []string{"multi-file-download", "artifact-v4-download"}, names)
+	})
+
+	t.Run("ListRepoArtifactsWithNameFilter", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts?name=multi-file-download", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+
+		res := MakeRequest(t, req, http.StatusOK)
+		var entries []*api.ActionArtifact
+		DecodeJSON(t, res, &entries)
+
+		assert.Equal(t, "1", res.Header().Get("X-Total-Count"))
+		require.Len(t, entries, 1)
+		assert.Equal(t, "multi-file-download", entries[0].Name)
+		// multi-file-download has 2 rows of 1024 bytes each
+		assert.Equal(t, int64(2048), entries[0].SizeInBytes)
+	})
+
+	t.Run("ListRunArtifacts", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/runs/791/artifacts", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+
+		res := MakeRequest(t, req, http.StatusOK)
+		var entries []*api.ActionArtifact
+		DecodeJSON(t, res, &entries)
+
+		// run 791 has only "multi-file-download" (id=1 is pending, not listed)
+		assert.Equal(t, "1", res.Header().Get("X-Total-Count"))
+		require.Len(t, entries, 1)
+		assert.Equal(t, "multi-file-download", entries[0].Name)
+	})
+
+	t.Run("ListRunArtifactsNotFound", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/runs/99999/artifacts", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+}
+
+func TestAPIGetActionArtifact(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+	token := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadRepository)
+
+	t.Run("GetV1V3Artifact", func(t *testing.T) {
+		// id=19 is the MIN(id) for "multi-file-download" group
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/19", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+
+		res := MakeRequest(t, req, http.StatusOK)
+		var art api.ActionArtifact
+		DecodeJSON(t, res, &art)
+
+		assert.Equal(t, int64(19), art.ID)
+		assert.Equal(t, "multi-file-download", art.Name)
+		assert.Equal(t, int64(2048), art.SizeInBytes)
+		assert.Equal(t, int64(791), art.RunID)
+		assert.False(t, art.Expired)
+	})
+
+	t.Run("GetV4Artifact", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/22", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+
+		res := MakeRequest(t, req, http.StatusOK)
+		var art api.ActionArtifact
+		DecodeJSON(t, res, &art)
+
+		assert.Equal(t, int64(22), art.ID)
+		assert.Equal(t, "artifact-v4-download", art.Name)
+		assert.Equal(t, int64(1024), art.SizeInBytes)
+		assert.Equal(t, int64(792), art.RunID)
+		assert.False(t, art.Expired)
+	})
+
+	t.Run("GetNonCanonicalID", func(t *testing.T) {
+		// id=20 is part of "multi-file-download" but is NOT the MIN(id), so it should 404
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/20", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("GetPendingArtifact", func(t *testing.T) {
+		// id=1 has status=1 (upload pending), should not be accessible
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/1", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("GetNonExistent", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/99999", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("GetFromWrongRepository", func(t *testing.T) {
+		// artifact id=22 belongs to user5/repo4; requesting it through a repo
+		// the caller can access but that doesn't own the artifact must 404 —
+		// this is the load-bearing check that caller-side RepoID was replaced
+		// by a query-side constraint.
+		otherRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+		otherUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: otherRepo.OwnerID})
+		otherToken := getUserToken(t, otherUser.LowerName, auth_model.AccessTokenScopeReadRepository)
+
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/22", otherRepo.OwnerName, otherRepo.Name),
+		)
+		req.AddTokenAuth(otherToken)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+}
+
+func TestAPIActionArtifactsRequireRepoScope(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+	wrongScopeToken := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadNotification)
+
+	endpoints := []struct {
+		name string
+		path string
+	}{
+		{"list repo", fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts", repo.OwnerName, repo.Name)},
+		{"list run", fmt.Sprintf("/api/v1/repos/%s/%s/actions/runs/791/artifacts", repo.OwnerName, repo.Name)},
+		{"get", fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/19", repo.OwnerName, repo.Name)},
+		{"download", fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/19/zip", repo.OwnerName, repo.Name)},
+	}
+
+	for _, ep := range endpoints {
+		t.Run(ep.name, func(t *testing.T) {
+			req := NewRequest(t, http.MethodGet, ep.path)
+			req.AddTokenAuth(wrongScopeToken)
+			MakeRequest(t, req, http.StatusForbidden)
+		})
+	}
+}
+
+func TestAPIDownloadActionArtifact(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	tests.PrepareArtifactsStorage(t)
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+	token := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadRepository)
+
+	t.Run("DownloadV1V3Artifact", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/19/zip", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+
+		res := MakeRequest(t, req, http.StatusOK)
+		assert.Contains(t, res.Header().Get("Content-Disposition"), "multi-file-download.zip")
+	})
+
+	t.Run("DownloadV4Artifact", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/22/zip", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+
+		res := MakeRequest(t, req, http.StatusOK)
+		assert.Equal(t, "bytes", res.Header().Get("Accept-Ranges"))
+	})
+
+	t.Run("DownloadPendingArtifact", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/1/zip", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+}
+
+func TestAPIDeleteActionArtifact(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+
+	t.Run("DeleteRequiresWritePermission", func(t *testing.T) {
+		readToken := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadRepository)
+		req := NewRequest(t, http.MethodDelete,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/22", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(readToken)
+		MakeRequest(t, req, http.StatusForbidden)
+	})
+
+	t.Run("DeleteArtifact", func(t *testing.T) {
+		writeToken := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeWriteRepository)
+		req := NewRequest(t, http.MethodDelete,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/22", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(writeToken)
+		MakeRequest(t, req, http.StatusNoContent)
+
+		// Verify the artifact is no longer accessible
+		readToken := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadRepository)
+		req = NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/22", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(readToken)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("DeleteNonExistent", func(t *testing.T) {
+		writeToken := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeWriteRepository)
+		req := NewRequest(t, http.MethodDelete,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/artifacts/99999", repo.OwnerName, repo.Name),
+		)
+		req.AddTokenAuth(writeToken)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+}
diff --git a/tests/integration/api_repo_actions_test.go b/tests/integration/api_repo_actions_test.go
index fa56346a27..1331ba0959 100644
--- a/tests/integration/api_repo_actions_test.go
+++ b/tests/integration/api_repo_actions_test.go
@@ -4,6 +4,7 @@
 package integration
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"net/http"
@@ -51,6 +52,7 @@ func TestActionsAPISearchActionJobs_RepoRunner(t *testing.T) {
 
 	job393 := api.ActionRunJob{
 		ID:      393,
+		RunID:   891,
 		Attempt: 1,
 		Handle:  "18e9cf40-c2f6-409f-b832-b945ea7dc79b",
 		RepoID:  1,
@@ -668,3 +670,226 @@ func TestAPIRepoActionsRunnerOperations(t *testing.T) {
 		MakeRequest(t, request, http.StatusNotFound)
 	})
 }
+
+func TestActionsAPIDeleteActionRun(t *testing.T) {
+	t.Run("Run removed", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionsAPIDeleteActionRun")()
+		defer tests.PrepareTestEnv(t)()
+
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user2.ID})
+		session := loginUser(t, user2.Name)
+		writeToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 2)
+		runner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 41601})
+
+		requestURL := fmt.Sprintf("/api/v1/repos/%s/actions/runs/%d", repo1.FullName(), run.ID)
+		request := NewRequest(t, "DELETE", requestURL)
+		request.AddTokenAuth(writeToken)
+		MakeRequest(t, request, http.StatusNoContent)
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRun{ID: run.ID})
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRunJob{ID: job.ID})
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID:  run.ID,
+			Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 2)
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRunner{ID: runner.ID})
+	})
+
+	t.Run("Error if run has not completed", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionsAPIDeleteActionRun")()
+		defer tests.PrepareTestEnv(t)()
+
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user2.ID})
+		session := loginUser(t, user2.Name)
+		writeToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34902})
+
+		requestURL := fmt.Sprintf("/api/v1/repos/%s/actions/runs/%d", repo1.FullName(), run.ID)
+		request := NewRequest(t, "DELETE", requestURL)
+		request.AddTokenAuth(writeToken)
+		MakeRequest(t, request, http.StatusInternalServerError)
+
+		// Verify that the run still exists.
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+	})
+
+	t.Run("Not found if run does not belong to repository", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionsAPIDeleteActionRun")()
+		defer tests.PrepareTestEnv(t)()
+
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		repo62 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 62, OwnerID: user2.ID})
+		session := loginUser(t, user2.Name)
+		writeToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+
+		requestURL := fmt.Sprintf("/api/v1/repos/%s/actions/runs/%d", repo62.FullName(), run.ID)
+		request := NewRequest(t, "DELETE", requestURL)
+		request.AddTokenAuth(writeToken)
+		MakeRequest(t, request, http.StatusNotFound)
+
+		// Verify that the run still exists.
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+	})
+
+	t.Run("No found if run does not exist", func(t *testing.T) {
+		defer tests.PrepareTestEnv(t)()
+
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user2.ID})
+		session := loginUser(t, user2.Name)
+		writeToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRun{ID: 260871})
+
+		requestURL := fmt.Sprintf("/api/v1/repos/%s/actions/runs/260871", repo1.FullName())
+		request := NewRequest(t, "DELETE", requestURL)
+		request.AddTokenAuth(writeToken)
+		MakeRequest(t, request, http.StatusNotFound)
+	})
+
+	t.Run("Run removal requires write token", func(t *testing.T) {
+		defer unittest.OverrideFixtures("tests/integration/fixtures/TestActionsAPIDeleteActionRun")()
+		defer tests.PrepareTestEnv(t)()
+
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user2.ID})
+		session := loginUser(t, user2.Name)
+		readToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository)
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 34901})
+
+		requestURL := fmt.Sprintf("/api/v1/repos/%s/actions/runs/%d", repo1.FullName(), run.ID)
+		request := NewRequest(t, "DELETE", requestURL)
+		request.AddTokenAuth(readToken)
+		response := MakeRequest(t, request, http.StatusForbidden)
+
+		type errorResponse struct {
+			Message string `json:"message"`
+		}
+
+		var errorMessage *errorResponse
+		DecodeJSON(t, response, &errorMessage)
+
+		assert.Equal(t, "token does not have at least one of required scope(s): [write:repository]", errorMessage.Message)
+
+		// Verify that the run still exists.
+		unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+	})
+}
+
+func TestActionsAPIListActionRunJobs(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	t.Run("Jobs", func(t *testing.T) {
+		for _, setup := range []struct {
+			runID, repoID int64
+		}{
+			{793, 4},
+			{895, 4},
+		} {
+			repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: setup.repoID})
+			user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+			token := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadRepository)
+			req := NewRequest(t, http.MethodGet,
+				fmt.Sprintf("/api/v1/repos/%s/%s/actions/runs/%d/jobs",
+					repo.OwnerName, repo.Name, setup.runID,
+				),
+			).AddTokenAuth(token)
+			res := MakeRequest(t, req, http.StatusOK)
+			var jobList []*api.ActionRunJob
+			DecodeJSON(t, res, &jobList)
+
+			correctJobList, err := actions_model.GetRunJobsByRunID(context.Background(), setup.runID)
+			require.NoError(t, err, "GetRunJobsByRunID")
+			assert.Len(t, jobList, len(correctJobList))
+
+			for i := range jobList {
+				expected := correctJobList[i]
+				actual := jobList[i]
+				assert.Equal(t, expected.ID, actual.ID)
+				assert.Equal(t, expected.Attempt, actual.Attempt)
+				assert.Equal(t, expected.Handle, actual.Handle)
+				assert.Equal(t, expected.RepoID, actual.RepoID)
+				assert.Equal(t, expected.OwnerID, actual.OwnerID)
+				assert.Equal(t, expected.Name, actual.Name)
+				assert.Equal(t, expected.Needs, actual.Needs)
+				assert.Equal(t, expected.RunsOn, actual.RunsOn)
+				assert.Equal(t, expected.TaskID, actual.TaskID)
+				assert.Equal(t, expected.Status.String(), actual.Status)
+
+				if expected.ID == 195 {
+					assert.Equal(t, &api.ActionRunJob{
+						ID:      195,
+						RunID:   793,
+						Attempt: 1,
+						Handle:  "",
+						RepoID:  4,
+						OwnerID: 1,
+						Name:    "job1 (2)",
+						Needs:   nil,
+						RunsOn:  nil,
+						TaskID:  50,
+						Status:  "success",
+					}, actual)
+				} else if expected.ID == 197 {
+					assert.Equal(t, &api.ActionRunJob{
+						ID:      197,
+						RunID:   895,
+						Attempt: 0,
+						Handle:  "",
+						RepoID:  4,
+						OwnerID: 1,
+						Name:    "job1 (1)",
+						Needs:   nil,
+						RunsOn:  []string{"postmarketOS"},
+						TaskID:  54,
+						Status:  "failure",
+					}, actual)
+				}
+			}
+		}
+	})
+
+	repoID := int64(4)
+	runID := int64(793)
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: repoID})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+	token := getUserToken(t, user.LowerName, auth_model.AccessTokenScopeReadRepository)
+
+	t.Run("Wrong Run ID", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/runs/%d/jobs",
+				repo.OwnerName, repo.Name, runID+9999,
+			),
+		).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("Wrong Repo Name", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/runs/%d/jobs",
+				repo.OwnerName, repo.Name+"_wrong_repo", runID,
+			),
+		).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+
+	t.Run("Wrong Owner", func(t *testing.T) {
+		req := NewRequest(t, http.MethodGet,
+			fmt.Sprintf("/api/v1/repos/%s/%s/actions/runs/%d/jobs",
+				repo.OwnerName+"_wrong_owner", repo.Name, runID,
+			),
+		).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusNotFound)
+	})
+}
diff --git a/tests/integration/api_repo_activities_test.go b/tests/integration/api_repo_activities_test.go
index 08e10ad79e..43e813ba83 100644
--- a/tests/integration/api_repo_activities_test.go
+++ b/tests/integration/api_repo_activities_test.go
@@ -9,10 +9,10 @@ import (
 	"testing"
 
 	auth_model "forgejo.org/models/auth"
-	"forgejo.org/models/unittest"
-	user_model "forgejo.org/models/user"
 	api "forgejo.org/modules/structs"
+	notify_service "forgejo.org/services/notify"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -20,9 +20,9 @@ import (
 func TestAPIRepoActivityFeeds(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, owner, tests.DeclarativeRepoOptions{})
-	defer f()
+	repo := forgery.CreateRepository(t, nil, nil)
+	owner := repo.Owner
+	notify_service.CreateRepository(t.Context(), owner, owner, repo)
 
 	feedURL := fmt.Sprintf("/api/v1/repos/%s/activities/feeds", repo.FullName())
 	assertAndReturnActivities := func(t *testing.T, length int) []api.Activity {
@@ -66,7 +66,7 @@ func TestAPIRepoActivityFeeds(t *testing.T) {
 	t.Run("a new watcher, no new activities", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 
-		watcher := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		watcher := forgery.CreateUser(t, nil)
 		watcherSession := loginUser(t, watcher.Name)
 		watcherToken := getTokenForLoggedInUser(t, watcherSession, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeReadUser)
 
diff --git a/tests/integration/api_twofa_test.go b/tests/integration/api_twofa_test.go
index ab173fc9f9..867dfe1e56 100644
--- a/tests/integration/api_twofa_test.go
+++ b/tests/integration/api_twofa_test.go
@@ -6,6 +6,7 @@ package integration
 import (
 	"fmt"
 	"net/http"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -82,7 +83,7 @@ func TestAPIWebAuthn(t *testing.T) {
 
 	DecodeJSON(t, resp, &userParsed)
 
-	assert.Equal(t, "Basic authorization is not allowed while having security keys enrolled", userParsed.Message)
+	assert.Contains(t, userParsed.Message, "Basic authorization is not allowed while having security keys enrolled\n")
 }
 
 func TestAPIWithRequiredTwoFactor(t *testing.T) {
@@ -144,7 +145,14 @@ func TestAPIWithRequiredTwoFactor(t *testing.T) {
 			var response userResponse
 			DecodeJSON(t, resp, &response)
 
-			assert.True(t, strings.HasPrefix(response.Message, messagePrefix))
+			assert.True(t,
+				slices.ContainsFunc(
+					strings.Split(response.Message, "\n"),
+					func(msg string) bool {
+						return strings.HasPrefix(msg, messagePrefix)
+					},
+				),
+				"expected prefix %q, but response message was %q", messagePrefix, response.Message)
 		}
 	}
 
diff --git a/tests/integration/api_user_actions_test.go b/tests/integration/api_user_actions_test.go
index b9a0b16ab4..91bd8c4be1 100644
--- a/tests/integration/api_user_actions_test.go
+++ b/tests/integration/api_user_actions_test.go
@@ -38,6 +38,7 @@ func TestActionsAPISearchActionJobs_UserRunner(t *testing.T) {
 
 	job394 := api.ActionRunJob{
 		ID:      394,
+		RunID:   891,
 		Attempt: 2,
 		Handle:  "a723d3e3-49a1-4e6b-947f-e987e60bfbd6",
 		RepoID:  1,
diff --git a/tests/integration/api_user_follow_federation_test.go b/tests/integration/api_user_follow_federation_test.go
new file mode 100644
index 0000000000..e3dc72b264
--- /dev/null
+++ b/tests/integration/api_user_follow_federation_test.go
@@ -0,0 +1,55 @@
+// Copyright 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/forgefed"
+	"forgejo.org/models/unittest"
+	"forgejo.org/models/user"
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/structs"
+	"forgejo.org/modules/test"
+	"forgejo.org/routers"
+	"forgejo.org/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestActivityPubFollowFederated(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+	mock := test.NewFederationServerMock()
+	federatedSrv := mock.DistantServer(t)
+	defer federatedSrv.Close()
+
+	localUser10Name := "user10"
+	localSession10 := loginUser(t, localUser10Name)
+	localSecssion10Token := getTokenForLoggedInUser(t, localSession10, auth_model.AccessTokenScopeWriteUser)
+
+	distantURL := federatedSrv.URL
+	distantUser15URL := fmt.Sprintf("%s/api/v1/activitypub/user-id/15", distantURL)
+
+	// local user follow distant
+	req := NewRequestWithJSON(t, "POST",
+		"/api/v1/user/activitypub/follow",
+		&structs.APRemoteFollowOption{
+			Target: distantUser15URL,
+		}).
+		AddTokenAuth(localSecssion10Token)
+	MakeRequest(t, req, http.StatusNoContent)
+
+	// check: federated actors now exist local
+	federationHost := unittest.AssertExistsAndLoadBean(t, &forgefed.FederationHost{HostFqdn: "127.0.0.1"})
+	unittest.AssertExistsAndLoadBean(t, &user.FederatedUser{ExternalID: "15", FederationHostID: federationHost.ID})
+
+	// check: follow request arrived at distant
+	assert.Contains(t, mock.LastPost, "\"object\":\"http://DISTANT_FEDERATION_HOST/api/v1/activitypub/user-id/15\"")
+}
diff --git a/tests/integration/api_wiki_test.go b/tests/integration/api_wiki_test.go
index d1a4102060..9639621591 100644
--- a/tests/integration/api_wiki_test.go
+++ b/tests/integration/api_wiki_test.go
@@ -16,10 +16,10 @@ import (
 	unit_model "forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
-	"forgejo.org/modules/optional"
 	api "forgejo.org/modules/structs"
 	repo_service "forgejo.org/services/repository"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -342,11 +342,7 @@ func TestAPISetWikiGlobalEditability(t *testing.T) {
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
 
 	// Create a new repository for testing purposes
-	repo, _, f := tests.CreateDeclarativeRepo(t, user, "", []unit_model.Type{
-		unit_model.TypeCode,
-		unit_model.TypeWiki,
-	}, nil, nil)
-	defer f()
+	repo := forgery.CreateRepository(t, user, nil)
 	urlStr := fmt.Sprintf("/api/v1/repos/%s", repo.FullName())
 
 	assertGlobalEditability := func(t *testing.T, editability bool) {
@@ -433,11 +429,8 @@ func TestAPIListPageRevisions(t *testing.T) {
 
 func TestAPIWikiNonMasterBranch(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, _ *url.URL) {
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-		repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			WikiBranch: optional.Some("main"),
-		})
-		defer f()
+		repo := forgery.CreateRepository(t, nil, nil)
+		forgery.InitWiki(t, repo, "main")
 
 		uris := []string{
 			"revisions/Home",
diff --git a/tests/integration/auth_authorized_integration_test.go b/tests/integration/auth_authorized_integration_test.go
new file mode 100644
index 0000000000..668abc2630
--- /dev/null
+++ b/tests/integration/auth_authorized_integration_test.go
@@ -0,0 +1,122 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	auth_model "forgejo.org/models/auth"
+	"forgejo.org/models/db"
+	api "forgejo.org/modules/structs"
+	"forgejo.org/tests"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAPIAuthWithAuthorizedIntegration(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	t.Run("all access authorized integration", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		ait := newAITester(t)
+		defer ait.close()
+		token := ait.signedJWT()
+
+		req := NewRequest(t, "GET", "/api/v1/user").AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusOK)
+		var user api.User
+		DecodeJSON(t, resp, &user)
+		assert.Equal(t, "user2", user.LoginName)
+
+		req = NewRequest(t, "GET", "/api/v1/repos/user2/repo1").AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusOK)
+	})
+
+	t.Run("scope-limited authorized integration", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		ait := newAITester(t, func(ai *auth_model.AuthorizedIntegration) {
+			ai.Scope = auth_model.AccessTokenScopeReadUser
+		})
+		defer ait.close()
+		token := ait.signedJWT()
+
+		req := NewRequest(t, "GET", "/api/v1/user").AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusOK)
+		var user api.User
+		DecodeJSON(t, resp, &user)
+		assert.Equal(t, "user2", user.LoginName)
+
+		req = NewRequest(t, "GET", "/api/v1/repos/user2/repo1").AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusForbidden)
+	})
+
+	// Clone of TestAPICompareCommitsAccessTokenResources, but using an authorized integration rather than an access
+	// token, to test its application of an authorization reducer for public-only and repo-specific access. Any API test
+	// that uses repo-specific tokens could serve as a test here; this one is just relatively simple and succinct for
+	// the number of things being tested.
+	t.Run("authorization reducer", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		// Using the compare API, will be testing that the base repo's security checks implement fine-grained access
+		// controls (and baselines with all and public-only).
+		testCase := func(t *testing.T, repo, token string, expectedStatus int) {
+			req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/compare/master...master", repo)).AddTokenAuth(token)
+			MakeRequest(t, req, expectedStatus)
+		}
+
+		t.Run("all access token", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			ait := newAITester(t, func(ai *auth_model.AuthorizedIntegration) {
+				ai.Scope = auth_model.AccessTokenScopeReadRepository
+			})
+			defer ait.close()
+			allToken := ait.signedJWT()
+
+			testCase(t, "user2/repo1", allToken, http.StatusOK)  // public user2/repo1
+			testCase(t, "org3/repo3", allToken, http.StatusOK)   // private org3/repo3
+			testCase(t, "user2/repo20", allToken, http.StatusOK) // private user2/repo20
+		})
+
+		t.Run("public-only access token", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			ait := newAITester(t, func(ai *auth_model.AuthorizedIntegration) {
+				ai.Scope = auth_model.AccessTokenScope(fmt.Sprintf("%s,%s", auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeReadRepository))
+			})
+			defer ait.close()
+			publicOnlyToken := ait.signedJWT()
+
+			testCase(t, "user2/repo1", publicOnlyToken, http.StatusOK)        // public user2/repo1
+			testCase(t, "org3/repo3", publicOnlyToken, http.StatusNotFound)   // private org3/repo3
+			testCase(t, "user2/repo20", publicOnlyToken, http.StatusNotFound) // private user2/repo20
+		})
+
+		t.Run("specific repo access token", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			ait := newAITester(t, func(ai *auth_model.AuthorizedIntegration) {
+				ai.Scope = auth_model.AccessTokenScopeReadRepository
+				ai.ResourceAllRepos = false
+			})
+			defer ait.close()
+
+			_, err := db.GetEngine(t.Context()).Insert(&auth_model.AuthorizedIntegResourceRepo{
+				IntegID: ait.authorizedIntegration.ID,
+				RepoID:  3,
+			})
+			require.NoError(t, err)
+			repo3OnlyToken := ait.signedJWT()
+
+			testCase(t, "user2/repo1", repo3OnlyToken, http.StatusOK)        // public user2/repo1
+			testCase(t, "org3/repo3", repo3OnlyToken, http.StatusOK)         // private org3/repo3
+			testCase(t, "user2/repo20", repo3OnlyToken, http.StatusNotFound) // private user2/repo20, outside of fine-grain
+		})
+	})
+}
diff --git a/tests/integration/comment_roles_test.go b/tests/integration/comment_roles_test.go
index df1c5b1188..f9eebf34ff 100644
--- a/tests/integration/comment_roles_test.go
+++ b/tests/integration/comment_roles_test.go
@@ -4,6 +4,7 @@
 package integration
 
 import (
+	"fmt"
 	"net/http"
 	"net/url"
 	"path"
@@ -188,16 +189,23 @@ func testEasyLeavePRComment(t *testing.T, session *TestSession, user, repo, id,
 // testEasyLeavePRReviewComment is used to add review comments to specific lines of changed files in the diff of the PR.
 func testEasyLeavePRReviewComment(t *testing.T, session *TestSession, user, repo, id, file, line, message, replyID string) {
 	t.Helper()
+	req := NewRequestf(t, "GET", "/%s/%s/pulls/%s/files/reviews/new_comment", user, repo, id)
+	resp := session.MakeRequest(t, req, http.StatusOK)
+	doc := NewHTMLParser(t, resp.Body)
 	values := map[string]string{
-		"origin":        "diff",
-		"side":          "proposed",
-		"line":          line,
-		"path":          file,
-		"content":       message,
-		"single_review": "true",
+		"origin":           doc.GetInputValueByName("origin"),
+		"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+		"side":             "proposed",
+		"line":             line,
+		"path":             file,
+		"diff_start_cid":   doc.GetInputValueByName("diff_start_cid"),
+		"diff_end_cid":     doc.GetInputValueByName("diff_end_cid"),
+		"diff_base_cid":    doc.GetInputValueByName("diff_base_cid"),
+		"content":          message,
+		"single_review":    "true",
 	}
 	if len(replyID) > 0 {
 		values["reply"] = replyID
 	}
-	session.MakeRequest(t, NewRequestWithValues(t, "POST", path.Join(user, repo, "pulls", id, "files/reviews/comments"), values), http.StatusOK)
+	session.MakeRequest(t, NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/pulls/%s/files/reviews/comments", user, repo, id), values), http.StatusOK)
 }
diff --git a/tests/integration/compare_test.go b/tests/integration/compare_test.go
index 070f7e1b20..57c31a0dca 100644
--- a/tests/integration/compare_test.go
+++ b/tests/integration/compare_test.go
@@ -15,13 +15,11 @@ import (
 	repo_model "forgejo.org/models/repo"
 	unit_model "forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
-	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/gitrepo"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/test"
 	repo_service "forgejo.org/services/repository"
-	files_service "forgejo.org/services/repository/files"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -343,22 +341,16 @@ func TestCompareCrossRepo(t *testing.T) {
 
 func TestCompareCodeExpand(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, u *url.URL) {
-		owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-
 		// Create a new repository, with a file that has many lines
-		repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, owner, tests.DeclarativeRepoOptions{
-			Files: optional.Some([]*files_service.ChangeRepoFile{
-				{
-					Operation:     "create",
-					TreePath:      "docs.md",
-					ContentReader: strings.NewReader("01\n02\n03\n04\n05\n06\n07\n08\n09\n0a\n0b\n0c\n0d\n0e\n0f\n10\n11\n12\n12\n13\n14\n15\n16\n17\n18\n19\n1a\n1b\n1c\n1d\n1e\n1f\n20\n"),
-				},
-			}),
+		repo := forgery.CreateRepository(t, nil, &forgery.CreateRepositoryOptions{
+			Files: forgery.MapFS{
+				"docs.md": forgery.MapFile("01\n02\n03\n04\n05\n06\n07\n08\n09\n0a\n0b\n0c\n0d\n0e\n0f\n10\n11\n12\n12\n13\n14\n15\n16\n17\n18\n19\n1a\n1b\n1c\n1d\n1e\n1f\n20\n"),
+			},
 		})
-		defer f()
+		owner := repo.Owner
 
 		// Fork the repository
-		forker := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		forker := forgery.CreateUser(t, nil)
 		session := loginUser(t, forker.Name)
 		testRepoFork(t, session, owner.Name, repo.Name, forker.Name, repo.Name+"-copy")
 		testCreateBranch(t, session, forker.Name, repo.Name+"-copy", "branch/main", "code-expand", http.StatusSeeOther)
diff --git a/tests/integration/empty_repo_test.go b/tests/integration/empty_repo_test.go
index 67be6a29a5..fe7c131331 100644
--- a/tests/integration/empty_repo_test.go
+++ b/tests/integration/empty_repo_test.go
@@ -10,6 +10,7 @@ import (
 	"io"
 	"mime/multipart"
 	"net/http"
+	"net/url"
 	"testing"
 
 	auth_model "forgejo.org/models/auth"
@@ -44,96 +45,96 @@ func TestEmptyRepo(t *testing.T) {
 }
 
 func TestEmptyRepoAddFile(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user30")
+		req := NewRequest(t, "GET", "/user30/empty/_new/"+setting.Repository.DefaultBranch)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body).Find(`input[name="commit_choice"]`)
+		assert.Empty(t, doc.AttrOr("checked", "_no_"))
+		req = NewRequestWithValues(t, "POST", "/user30/empty/_new/"+setting.Repository.DefaultBranch, map[string]string{
+			"commit_choice":  "direct",
+			"tree_path":      "test-file.md",
+			"content":        "newly-added-test-file",
+			"commit_mail_id": "32",
+		})
 
-	session := loginUser(t, "user30")
-	req := NewRequest(t, "GET", "/user30/empty/_new/"+setting.Repository.DefaultBranch)
-	resp := session.MakeRequest(t, req, http.StatusOK)
-	doc := NewHTMLParser(t, resp.Body).Find(`input[name="commit_choice"]`)
-	assert.Empty(t, doc.AttrOr("checked", "_no_"))
-	req = NewRequestWithValues(t, "POST", "/user30/empty/_new/"+setting.Repository.DefaultBranch, map[string]string{
-		"commit_choice":  "direct",
-		"tree_path":      "test-file.md",
-		"content":        "newly-added-test-file",
-		"commit_mail_id": "32",
+		resp = session.MakeRequest(t, req, http.StatusSeeOther)
+		redirect := test.RedirectURL(resp)
+		assert.Equal(t, "/user30/empty/src/branch/"+setting.Repository.DefaultBranch+"/test-file.md", redirect)
+
+		req = NewRequest(t, "GET", redirect)
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		assert.Contains(t, resp.Body.String(), "newly-added-test-file")
 	})
-
-	resp = session.MakeRequest(t, req, http.StatusSeeOther)
-	redirect := test.RedirectURL(resp)
-	assert.Equal(t, "/user30/empty/src/branch/"+setting.Repository.DefaultBranch+"/test-file.md", redirect)
-
-	req = NewRequest(t, "GET", redirect)
-	resp = session.MakeRequest(t, req, http.StatusOK)
-	assert.Contains(t, resp.Body.String(), "newly-added-test-file")
 }
 
 func TestEmptyRepoUploadFile(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user30")
+		req := NewRequest(t, "GET", "/user30/empty/_new/"+setting.Repository.DefaultBranch)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body).Find(`input[name="commit_choice"]`)
+		assert.Empty(t, doc.AttrOr("checked", "_no_"))
 
-	session := loginUser(t, "user30")
-	req := NewRequest(t, "GET", "/user30/empty/_new/"+setting.Repository.DefaultBranch)
-	resp := session.MakeRequest(t, req, http.StatusOK)
-	doc := NewHTMLParser(t, resp.Body).Find(`input[name="commit_choice"]`)
-	assert.Empty(t, doc.AttrOr("checked", "_no_"))
+		body := &bytes.Buffer{}
+		mpForm := multipart.NewWriter(body)
+		file, _ := mpForm.CreateFormFile("file", "uploaded-file.txt")
+		_, _ = io.Copy(file, bytes.NewBufferString("newly-uploaded-test-file"))
+		_ = mpForm.Close()
 
-	body := &bytes.Buffer{}
-	mpForm := multipart.NewWriter(body)
-	file, _ := mpForm.CreateFormFile("file", "uploaded-file.txt")
-	_, _ = io.Copy(file, bytes.NewBufferString("newly-uploaded-test-file"))
-	_ = mpForm.Close()
+		req = NewRequestWithBody(t, "POST", "/user30/empty/upload-file", body)
+		req.Header.Add("Content-Type", mpForm.FormDataContentType())
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		respMap := map[string]string{}
+		require.NoError(t, json.Unmarshal(resp.Body.Bytes(), &respMap))
+		filesFullpathKey := fmt.Sprintf("files_fullpath[%s]", respMap["uuid"])
+		req = NewRequestWithValues(t, "POST", "/user30/empty/_upload/"+setting.Repository.DefaultBranch, map[string]string{
+			"commit_choice":  "direct",
+			"files":          respMap["uuid"],
+			filesFullpathKey: "uploaded-file.txt",
+			"tree_path":      "",
+			"commit_mail_id": "-1",
+		})
+		resp = session.MakeRequest(t, req, http.StatusSeeOther)
+		redirect := test.RedirectURL(resp)
+		assert.Equal(t, "/user30/empty/src/branch/"+setting.Repository.DefaultBranch+"/", redirect)
 
-	req = NewRequestWithBody(t, "POST", "/user30/empty/upload-file", body)
-	req.Header.Add("Content-Type", mpForm.FormDataContentType())
-	resp = session.MakeRequest(t, req, http.StatusOK)
-	respMap := map[string]string{}
-	require.NoError(t, json.Unmarshal(resp.Body.Bytes(), &respMap))
-	filesFullpathKey := fmt.Sprintf("files_fullpath[%s]", respMap["uuid"])
-	req = NewRequestWithValues(t, "POST", "/user30/empty/_upload/"+setting.Repository.DefaultBranch, map[string]string{
-		"commit_choice":  "direct",
-		"files":          respMap["uuid"],
-		filesFullpathKey: "uploaded-file.txt",
-		"tree_path":      "",
-		"commit_mail_id": "-1",
+		req = NewRequest(t, "GET", redirect)
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		assert.Contains(t, resp.Body.String(), "uploaded-file.txt")
 	})
-	resp = session.MakeRequest(t, req, http.StatusSeeOther)
-	redirect := test.RedirectURL(resp)
-	assert.Equal(t, "/user30/empty/src/branch/"+setting.Repository.DefaultBranch+"/", redirect)
-
-	req = NewRequest(t, "GET", redirect)
-	resp = session.MakeRequest(t, req, http.StatusOK)
-	assert.Contains(t, resp.Body.String(), "uploaded-file.txt")
 }
 
 func TestEmptyRepoAddFileByAPI(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
+	onApplicationRun(t, func(t *testing.T, _ *url.URL) {
+		session := loginUser(t, "user30")
+		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
 
-	session := loginUser(t, "user30")
-	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+		req := NewRequestWithJSON(t, "POST", "/api/v1/repos/user30/empty/contents/new-file.txt", &api.CreateFileOptions{
+			FileOptions: api.FileOptions{
+				NewBranchName: "new_branch",
+				Message:       "init",
+			},
+			ContentBase64: base64.StdEncoding.EncodeToString([]byte("newly-added-api-file")),
+		}).AddTokenAuth(token)
 
-	req := NewRequestWithJSON(t, "POST", "/api/v1/repos/user30/empty/contents/new-file.txt", &api.CreateFileOptions{
-		FileOptions: api.FileOptions{
-			NewBranchName: "new_branch",
-			Message:       "init",
-		},
-		ContentBase64: base64.StdEncoding.EncodeToString([]byte("newly-added-api-file")),
-	}).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusCreated)
+		var fileResponse api.FileResponse
+		DecodeJSON(t, resp, &fileResponse)
+		expectedHTMLURL := setting.AppURL + "user30/empty/src/branch/new_branch/new-file.txt"
+		assert.Equal(t, expectedHTMLURL, *fileResponse.Content.HTMLURL)
 
-	resp := MakeRequest(t, req, http.StatusCreated)
-	var fileResponse api.FileResponse
-	DecodeJSON(t, resp, &fileResponse)
-	expectedHTMLURL := setting.AppURL + "user30/empty/src/branch/new_branch/new-file.txt"
-	assert.Equal(t, expectedHTMLURL, *fileResponse.Content.HTMLURL)
+		req = NewRequest(t, "GET", "/user30/empty/src/branch/new_branch/new-file.txt")
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		assert.Contains(t, resp.Body.String(), "newly-added-api-file")
 
-	req = NewRequest(t, "GET", "/user30/empty/src/branch/new_branch/new-file.txt")
-	resp = session.MakeRequest(t, req, http.StatusOK)
-	assert.Contains(t, resp.Body.String(), "newly-added-api-file")
-
-	req = NewRequest(t, "GET", "/api/v1/repos/user30/empty").
-		AddTokenAuth(token)
-	resp = session.MakeRequest(t, req, http.StatusOK)
-	var apiRepo api.Repository
-	DecodeJSON(t, resp, &apiRepo)
-	assert.Equal(t, "new_branch", apiRepo.DefaultBranch)
+		req = NewRequest(t, "GET", "/api/v1/repos/user30/empty").
+			AddTokenAuth(token)
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		var apiRepo api.Repository
+		DecodeJSON(t, resp, &apiRepo)
+		assert.Equal(t, "new_branch", apiRepo.DefaultBranch)
+	})
 }
 
 func TestEmptyRepoAPIRequestsReturn404(t *testing.T) {
diff --git a/tests/integration/federation_home_template_test.go b/tests/integration/federation_home_template_test.go
new file mode 100644
index 0000000000..806fe31b7b
--- /dev/null
+++ b/tests/integration/federation_home_template_test.go
@@ -0,0 +1,53 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/test"
+	"forgejo.org/routers"
+	"forgejo.org/tests"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/html"
+)
+
+func getLinks(t *testing.T, url string) []*html.Node {
+	req := NewRequest(t, "GET", url)
+	resp := MakeRequest(t, req, http.StatusOK)
+
+	htmlDoc := NewHTMLParser(t, resp.Body)
+	links := htmlDoc.doc.Find("link[type=\"application/activity+json\"]").Nodes
+
+	return links
+}
+
+func TestFederationBaseHead(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+	t.Run("Federation disabled", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.Federation.Enabled, false)()
+
+		links := getLinks(t, "/user1")
+		assert.Empty(t, links)
+	})
+
+	t.Run("Federation enabled", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+
+		links := getLinks(t, "/user1")
+		assert.Len(t, links, 1)
+	})
+
+	t.Run("Organization", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+
+		links := getLinks(t, "/org3")
+		assert.Empty(t, links)
+	})
+}
diff --git a/tests/integration/fixtures/TestActionRunDeletion/action_artifact.yml b/tests/integration/fixtures/TestActionRunDeletion/action_artifact.yml
new file mode 100644
index 0000000000..73697d9d69
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/action_artifact.yml
@@ -0,0 +1,9 @@
+- id: 19401
+  run_id: 34901
+  status: 2 # ArtifactStatusUploadConfirmed
+- id: 19402
+  run_id: 34901
+  status: 1 # ArtifactStatusUploadPending
+- id: 19403
+  run_id: 34902
+  status: 2 # ArtifactStatusUploadConfirmed
diff --git a/tests/integration/fixtures/TestActionRunDeletion/action_run.yml b/tests/integration/fixtures/TestActionRunDeletion/action_run.yml
new file mode 100644
index 0000000000..b097261695
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/action_run.yml
@@ -0,0 +1,11 @@
+- id: 34901
+  repo_id: 1
+  owner_id: 2
+  index: 3161
+  status: 2 # StatusFailure
+
+- id: 34902
+  repo_id: 1
+  owner_id: 2
+  index: 3162
+  status: 5 # StatusWaiting
diff --git a/tests/integration/fixtures/TestActionRunDeletion/action_run_job.yml b/tests/integration/fixtures/TestActionRunDeletion/action_run_job.yml
new file mode 100644
index 0000000000..3cc196d9fe
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/action_run_job.yml
@@ -0,0 +1,7 @@
+- id: 47301
+  run_id: 34901
+  status: 2 # StatusFailure
+
+- id: 47302
+  run_id: 34902
+  status: 5 # StatusWaiting
diff --git a/tests/integration/fixtures/TestActionRunDeletion/action_runner.yml b/tests/integration/fixtures/TestActionRunDeletion/action_runner.yml
new file mode 100644
index 0000000000..5462b8e0ec
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/action_runner.yml
@@ -0,0 +1,5 @@
+- id: 41601
+  owner_id: 0
+  repo_id: 1
+  uuid: 61a71de6-8127-40c9-a30e-63647e93edad
+  ephemeral: true
\ No newline at end of file
diff --git a/tests/integration/fixtures/TestActionRunDeletion/action_task.yml b/tests/integration/fixtures/TestActionRunDeletion/action_task.yml
new file mode 100644
index 0000000000..746486e834
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/action_task.yml
@@ -0,0 +1,12 @@
+- id: 87601
+  job_id: 47301
+  log_filename: somebody/somerepo/15631/87601.log.zst
+  log_in_storage: false
+  status: 2 # StatusFailure
+  runner_id: 41601
+
+- id: 87602
+  job_id: 47302
+  log_filename: somebody/somerepo/15632/87602.log.zst
+  log_in_storage: false
+  status: 5 # StatusWaiting
diff --git a/tests/integration/fixtures/TestActionRunDeletion/action_task_output.yml b/tests/integration/fixtures/TestActionRunDeletion/action_task_output.yml
new file mode 100644
index 0000000000..6244bc9405
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/action_task_output.yml
@@ -0,0 +1,14 @@
+- id: 90041
+  task_id: 87601
+  output_key: one
+  output_value: a
+
+- id: 90042
+  task_id: 87601
+  output_key: two
+  output_value: b
+
+- id: 90043
+  task_id: 87602
+  output_key: three
+  output_value: c
diff --git a/tests/integration/fixtures/TestActionRunDeletion/action_task_step.yml b/tests/integration/fixtures/TestActionRunDeletion/action_task_step.yml
new file mode 100644
index 0000000000..e001b9f3a9
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/action_task_step.yml
@@ -0,0 +1,9 @@
+- id: 98801
+  name: echo OK
+  task_id: 87601
+  status: 2 # StatusFailure
+
+- id: 98802
+  name: echo OK
+  task_id: 87602
+  status: 5 # StatusWaiting
diff --git a/tests/integration/fixtures/TestActionRunDeletion/collaboration.yml b/tests/integration/fixtures/TestActionRunDeletion/collaboration.yml
new file mode 100644
index 0000000000..117d26490b
--- /dev/null
+++ b/tests/integration/fixtures/TestActionRunDeletion/collaboration.yml
@@ -0,0 +1,4 @@
+- id: 393701
+  repo_id: 1
+  user_id: 5
+  mode: 2 # write
diff --git a/tests/integration/fixtures/TestActionViewRunDeletion/action_run.yml b/tests/integration/fixtures/TestActionViewRunDeletion/action_run.yml
new file mode 100644
index 0000000000..325aeb38c2
--- /dev/null
+++ b/tests/integration/fixtures/TestActionViewRunDeletion/action_run.yml
@@ -0,0 +1,11 @@
+- id: 34901
+  repo_id: 1
+  owner_id: 2
+  index: 3161
+  status: 1 # StatusSuccess
+
+- id: 34902
+  repo_id: 1
+  owner_id: 2
+  index: 3162
+  status: 6 # StatusRunning
diff --git a/tests/integration/fixtures/TestActionViewRunDeletion/action_run_job.yml b/tests/integration/fixtures/TestActionViewRunDeletion/action_run_job.yml
new file mode 100644
index 0000000000..79e5cd1502
--- /dev/null
+++ b/tests/integration/fixtures/TestActionViewRunDeletion/action_run_job.yml
@@ -0,0 +1,7 @@
+- id: 47301
+  run_id: 34901
+  status: 1 # StatusSuccess
+
+- id: 47302
+  run_id: 34902
+  status: 6 # StatusRunning
diff --git a/tests/integration/fixtures/TestActionViewRunDeletion/action_task.yml b/tests/integration/fixtures/TestActionViewRunDeletion/action_task.yml
new file mode 100644
index 0000000000..1a86ffd28e
--- /dev/null
+++ b/tests/integration/fixtures/TestActionViewRunDeletion/action_task.yml
@@ -0,0 +1,11 @@
+- id: 87601
+  job_id: 47301
+  log_filename: somebody/somerepo/15631/87601.log.zst
+  log_in_storage: false
+  status: 1 # StatusSuccess
+
+- id: 87602
+  job_id: 47302
+  log_filename: somebody/somerepo/15632/87602.log.zst
+  log_in_storage: false
+  status: 6 # StatusRunning
diff --git a/tests/integration/fixtures/TestActionViewRunDeletion/action_task_step.yml b/tests/integration/fixtures/TestActionViewRunDeletion/action_task_step.yml
new file mode 100644
index 0000000000..b438f959ba
--- /dev/null
+++ b/tests/integration/fixtures/TestActionViewRunDeletion/action_task_step.yml
@@ -0,0 +1,9 @@
+- id: 98801
+  name: echo OK
+  task_id: 87601
+  status: 1 # StatusSuccess
+
+- id: 98802
+  name: echo OK
+  task_id: 87602
+  status: 6 # StatusRunning
diff --git a/tests/integration/fixtures/TestActionViewRunDeletion/collaboration.yml b/tests/integration/fixtures/TestActionViewRunDeletion/collaboration.yml
new file mode 100644
index 0000000000..117d26490b
--- /dev/null
+++ b/tests/integration/fixtures/TestActionViewRunDeletion/collaboration.yml
@@ -0,0 +1,4 @@
+- id: 393701
+  repo_id: 1
+  user_id: 5
+  mode: 2 # write
diff --git a/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_artifact.yml b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_artifact.yml
new file mode 100644
index 0000000000..73697d9d69
--- /dev/null
+++ b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_artifact.yml
@@ -0,0 +1,9 @@
+- id: 19401
+  run_id: 34901
+  status: 2 # ArtifactStatusUploadConfirmed
+- id: 19402
+  run_id: 34901
+  status: 1 # ArtifactStatusUploadPending
+- id: 19403
+  run_id: 34902
+  status: 2 # ArtifactStatusUploadConfirmed
diff --git a/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_run.yml b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_run.yml
new file mode 100644
index 0000000000..c388610d33
--- /dev/null
+++ b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_run.yml
@@ -0,0 +1,9 @@
+- id: 34901
+  repo_id: 1
+  owner_id: 2
+  status: 2 # StatusFailure
+
+- id: 34902
+  repo_id: 1
+  owner_id: 2
+  status: 5 # StatusWaiting
diff --git a/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_run_job.yml b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_run_job.yml
new file mode 100644
index 0000000000..3cc196d9fe
--- /dev/null
+++ b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_run_job.yml
@@ -0,0 +1,7 @@
+- id: 47301
+  run_id: 34901
+  status: 2 # StatusFailure
+
+- id: 47302
+  run_id: 34902
+  status: 5 # StatusWaiting
diff --git a/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_runner.yml b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_runner.yml
new file mode 100644
index 0000000000..5462b8e0ec
--- /dev/null
+++ b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_runner.yml
@@ -0,0 +1,5 @@
+- id: 41601
+  owner_id: 0
+  repo_id: 1
+  uuid: 61a71de6-8127-40c9-a30e-63647e93edad
+  ephemeral: true
\ No newline at end of file
diff --git a/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task.yml b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task.yml
new file mode 100644
index 0000000000..746486e834
--- /dev/null
+++ b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task.yml
@@ -0,0 +1,12 @@
+- id: 87601
+  job_id: 47301
+  log_filename: somebody/somerepo/15631/87601.log.zst
+  log_in_storage: false
+  status: 2 # StatusFailure
+  runner_id: 41601
+
+- id: 87602
+  job_id: 47302
+  log_filename: somebody/somerepo/15632/87602.log.zst
+  log_in_storage: false
+  status: 5 # StatusWaiting
diff --git a/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task_output.yml b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task_output.yml
new file mode 100644
index 0000000000..6244bc9405
--- /dev/null
+++ b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task_output.yml
@@ -0,0 +1,14 @@
+- id: 90041
+  task_id: 87601
+  output_key: one
+  output_value: a
+
+- id: 90042
+  task_id: 87601
+  output_key: two
+  output_value: b
+
+- id: 90043
+  task_id: 87602
+  output_key: three
+  output_value: c
diff --git a/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task_step.yml b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task_step.yml
new file mode 100644
index 0000000000..b438f959ba
--- /dev/null
+++ b/tests/integration/fixtures/TestActionsAPIDeleteActionRun/action_task_step.yml
@@ -0,0 +1,9 @@
+- id: 98801
+  name: echo OK
+  task_id: 87601
+  status: 1 # StatusSuccess
+
+- id: 98802
+  name: echo OK
+  task_id: 87602
+  status: 6 # StatusRunning
diff --git a/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/federated_user.yml b/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/federated_user.yml
new file mode 100644
index 0000000000..be6299fd2c
--- /dev/null
+++ b/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/federated_user.yml
@@ -0,0 +1,17 @@
+- id: 1
+  user_id: 1001
+  external_id: "1"
+  federation_host_id: 1
+  inbox_path: /api/v1/activitypub/user-id/1/inbox#bob
+
+- id: 2
+  user_id: 1002
+  external_id: "1"
+  federation_host_id: 2
+  inbox_path: /api/v1/activitypub/user-id/1/inbox#alice
+
+- id: 3
+  user_id: 1003
+  external_id: "2"
+  federation_host_id: 2
+  inbox_path: /api/v1/activitypub/user-id/2/inbox#eve
diff --git a/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/federation_host.yml b/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/federation_host.yml
new file mode 100644
index 0000000000..4fb334ee70
--- /dev/null
+++ b/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/federation_host.yml
@@ -0,0 +1,13 @@
+- id: 1
+  host_fqdn: bob.example.com
+  host_port: 80
+  host_schema: http
+  software_name: forgejo
+  latest_activity: 2023-01-01T00:00:00Z
+
+- id: 2
+  host_fqdn: alice.example.com
+  host_port: 443
+  host_schema: https
+  software_name: gitea
+  latest_activity: 2023-01-01T00:00:00Z
diff --git a/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/user.yml b/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/user.yml
new file mode 100644
index 0000000000..45460029e9
--- /dev/null
+++ b/tests/integration/fixtures/TestAdminFederationViewHostsAndUsers/user.yml
@@ -0,0 +1,107 @@
+- id: 1001
+  lower_name: "@bob@bob.example.com"
+  name: "@bob@bob.example.com"
+  full_name: "@bob@bob.example.com"
+  email: bob@bob.example.com
+  keep_email_private: false
+  email_notifications_preference: enabled
+  passwd: ZogKvWdyEx:password
+  passwd_hash_algo: dummy
+  must_change_password: false
+  login_source: 0
+  login_name: bob
+  type: 0
+  salt: ZogKvWdyEx
+  max_repo_creation: -1
+  is_active: true
+  is_admin: false
+  is_restricted: false
+  allow_git_hook: false
+  allow_import_local: false
+  allow_create_organization: true
+  prohibit_login: false
+  avatar: avatar1001
+  avatar_email: bob@bob.example.com
+  use_custom_avatar: false
+  num_followers: 0
+  num_following: 0
+  num_stars: 0
+  num_repos: 0
+  num_teams: 0
+  num_members: 0
+  visibility: 0
+  repo_admin_change_team_access: false
+  theme: ""
+  keep_activity_private: false
+
+- id: 1002
+  lower_name: "@alice@alice.example.com"
+  name: "@alice@alice.example.com"
+  full_name: "@alice@alice.example.com"
+  email: alice@alice.example.com
+  keep_email_private: false
+  email_notifications_preference: enabled
+  passwd: ZogKvWdyEx:password
+  passwd_hash_algo: dummy
+  must_change_password: false
+  login_source: 0
+  login_name: alice
+  type: 0
+  salt: ZogKvWdyEx
+  max_repo_creation: -1
+  is_active: true
+  is_admin: false
+  is_restricted: false
+  allow_git_hook: false
+  allow_import_local: false
+  allow_create_organization: true
+  prohibit_login: false
+  avatar: avatar1002
+  avatar_email: alice@alice.example.com
+  use_custom_avatar: false
+  num_followers: 0
+  num_following: 0
+  num_stars: 0
+  num_repos: 0
+  num_teams: 0
+  num_members: 0
+  visibility: 0
+  repo_admin_change_team_access: false
+  theme: ""
+  keep_activity_private: false
+
+- id: 1003
+  lower_name: "@eve@alice.example.com"
+  name: "@eve@alice.example.com"
+  full_name: "@eve@alice.example.com"
+  email: eve@alice.example.com
+  keep_email_private: false
+  email_notifications_preference: enabled
+  passwd: ZogKvWdyEx:password
+  passwd_hash_algo: dummy
+  must_change_password: false
+  login_source: 0
+  login_name: eve
+  type: 0
+  salt: ZogKvWdyEx
+  max_repo_creation: -1
+  is_active: true
+  is_admin: false
+  is_restricted: false
+  allow_git_hook: false
+  allow_import_local: false
+  allow_create_organization: true
+  prohibit_login: false
+  avatar: avatar1003
+  avatar_email: eve@alice.example.com
+  use_custom_avatar: false
+  num_followers: 0
+  num_following: 0
+  num_stars: 0
+  num_repos: 0
+  num_teams: 0
+  num_members: 0
+  visibility: 0
+  repo_admin_change_team_access: false
+  theme: ""
+  keep_activity_private: false
diff --git a/tests/integration/fixtures/TestAssignProject/access.yml b/tests/integration/fixtures/TestAssignProject/access.yml
new file mode 100644
index 0000000000..9dec50f0ac
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/access.yml
@@ -0,0 +1,5 @@
+-
+  id: 1001
+  user_id: 5
+  repo_id: 1001
+  mode: 2
diff --git a/tests/integration/fixtures/TestAssignProject/collaboration.yml b/tests/integration/fixtures/TestAssignProject/collaboration.yml
new file mode 100644
index 0000000000..a26149d60e
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/collaboration.yml
@@ -0,0 +1,5 @@
+-
+  id: 1001
+  repo_id: 1001
+  user_id: 5
+  mode: 2
diff --git a/tests/integration/fixtures/TestAssignProject/project.yml b/tests/integration/fixtures/TestAssignProject/project.yml
new file mode 100644
index 0000000000..20b75ddb69
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/project.yml
@@ -0,0 +1,51 @@
+# team 1001 projects
+-
+  id: 1001
+  title: project1001
+  owner_id: 3
+  repo_id: 0
+  is_closed: false
+  board_type: 0
+  type: 3
+  creator_id: 5
+  created_unix: 1688973030
+  updated_unix: 1688973030
+
+# team 1002 projects
+-
+  id: 1002
+  title: project1002
+  owner_id: 0
+  repo_id: 1001
+  is_closed: false
+  board_type: 0
+  type: 2
+  creator_id: 5
+  created_unix: 1688973030
+  updated_unix: 1688973030
+
+# user 5 project
+-
+  id: 1003
+  title: project1003
+  owner_id: 5
+  repo_id: 0
+  is_closed: false
+  board_type: 0
+  type: 1
+  creator_id: 5
+  created_unix: 1688973030
+  updated_unix: 1688973030
+
+# org 1001 disabled project
+-
+  id: 1004
+  title: project1004
+  owner_id: 1001
+  repo_id: 0
+  is_closed: false
+  board_type: 0
+  type: 3
+  creator_id: 5
+  created_unix: 1688973030
+  updated_unix: 1688973030
diff --git a/tests/integration/fixtures/TestAssignProject/repo_unit.yml b/tests/integration/fixtures/TestAssignProject/repo_unit.yml
new file mode 100644
index 0000000000..d3fad496aa
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/repo_unit.yml
@@ -0,0 +1,35 @@
+-
+  id: 1001
+  repo_id: 3
+  type: 8
+  created_unix: 946684810
+
+-
+  id: 1002
+  repo_id: 3
+  type: 2
+  created_unix: 946684810
+
+-
+  id: 1003
+  repo_id: 3
+  type: 3
+  created_unix: 946684810
+
+-
+  id: 1004
+  repo_id: 1001
+  type: 8
+  created_unix: 946684810
+
+-
+  id: 1005
+  repo_id: 1001
+  type: 2
+  created_unix: 946684810
+
+-
+  id: 1006
+  repo_id: 1001
+  type: 3
+  created_unix: 946684810
diff --git a/tests/integration/fixtures/TestAssignProject/repository.yml b/tests/integration/fixtures/TestAssignProject/repository.yml
new file mode 100644
index 0000000000..3a2d6d637a
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/repository.yml
@@ -0,0 +1,30 @@
+-
+  id: 1001
+  owner_id: 1001
+  owner_name: test_assign_project_org
+  lower_name: test_assign_project_repo
+  name: test_assign_project_repo
+  default_branch: master
+  num_watches: 4
+  num_stars: 0
+  num_forks: 0
+  num_milestones: 3
+  num_closed_milestones: 1
+  num_projects: 1
+  num_closed_projects: 0
+  is_private: false
+  is_empty: false
+  is_archived: false
+  is_mirror: false
+  status: 0
+  is_fork: false
+  fork_id: 0
+  is_template: false
+  template_id: 0
+  size: 7597
+  is_fsck_enabled: true
+  close_issues_via_commit_in_any_branch: false
+  created_unix: 1731254961
+  updated_unix: 1731254961
+  topics: '[]'
+
diff --git a/tests/integration/fixtures/TestAssignProject/team.yml b/tests/integration/fixtures/TestAssignProject/team.yml
new file mode 100644
index 0000000000..6f295a3c65
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/team.yml
@@ -0,0 +1,32 @@
+-
+  id: 1001
+  org_id: 3
+  lower_name: writers
+  name: Writers
+  authorize: 2 # writer
+  num_repos: 3
+  num_members: 1
+  includes_all_repositories: false
+  can_create_org_repo: true
+
+-
+  id: 1002
+  org_id: 1001
+  lower_name: writers
+  name: Writers
+  authorize: 2 # writer
+  num_repos: 1
+  num_members: 1
+  includes_all_repositories: false
+  can_create_org_repo: true
+
+-
+  id: 1003
+  org_id: 1001
+  lower_name: owners
+  name: Owners
+  authorize: 4
+  num_repos: 0
+  num_members: 1
+  includes_all_repositories: false
+  can_create_org_repo: true
diff --git a/tests/integration/fixtures/TestAssignProject/team_repo.yml b/tests/integration/fixtures/TestAssignProject/team_repo.yml
new file mode 100644
index 0000000000..9b34a817d9
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/team_repo.yml
@@ -0,0 +1,11 @@
+-
+  id: 1001
+  org_id: 3
+  team_id: 1001
+  repo_id: 3
+
+-
+  id: 1002
+  org_id: 1001
+  team_id: 1002
+  repo_id: 1001
diff --git a/tests/integration/fixtures/TestAssignProject/team_unit.yml b/tests/integration/fixtures/TestAssignProject/team_unit.yml
new file mode 100644
index 0000000000..d156983090
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/team_unit.yml
@@ -0,0 +1,35 @@
+-
+  id: 1001
+  team_id: 1001
+  type: 8
+  access_mode: 2
+
+-
+  id: 1002
+  team_id: 1002
+  type: 8
+  access_mode: 1
+
+-
+  id: 1003
+  team_id: 1001
+  type: 2
+  access_mode: 2
+
+-
+  id: 1004
+  team_id: 1001
+  type: 3
+  access_mode: 2
+
+-
+  id: 1005
+  team_id: 1002
+  type: 2
+  access_mode: 2
+
+-
+  id: 1006
+  team_id: 1002
+  type: 3
+  access_mode: 2
diff --git a/tests/integration/fixtures/TestAssignProject/team_user.yml b/tests/integration/fixtures/TestAssignProject/team_user.yml
new file mode 100644
index 0000000000..8061f1b9d8
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/team_user.yml
@@ -0,0 +1,11 @@
+-
+  id: 1001
+  org_id: 3
+  team_id: 1001
+  uid: 5
+
+-
+  id: 1002
+  org_id: 23
+  team_id: 1002
+  uid: 5
diff --git a/tests/integration/fixtures/TestAssignProject/user.yml b/tests/integration/fixtures/TestAssignProject/user.yml
new file mode 100644
index 0000000000..8ad7bd0e67
--- /dev/null
+++ b/tests/integration/fixtures/TestAssignProject/user.yml
@@ -0,0 +1,37 @@
+-
+  id: 1001
+  lower_name: test_assign_project_org
+  name: test_assign_project_org
+  full_name: ' <<<< >> >> > >> > >>> >> '
+  email: org1001@example.com
+  keep_email_private: false
+  email_notifications_preference: onmention
+  passwd: ZogKvWdyEx:password
+  passwd_hash_algo: dummy
+  must_change_password: false
+  login_source: 0
+  login_name: test_assign_project_org
+  type: 1
+  salt: ZogKvWdyEx
+  max_repo_creation: 1000
+  is_active: false
+  is_admin: false
+  is_restricted: false
+  allow_git_hook: false
+  allow_import_local: false
+  allow_create_organization: true
+  prohibit_login: false
+  avatar: ""
+  avatar_email: org1001@example.com
+  use_custom_avatar: true
+  num_followers: 0
+  num_following: 0
+  num_stars: 0
+  num_repos: 1
+  num_teams: 1
+  num_members: 1
+  visibility: 0
+  repo_admin_change_team_access: false
+  theme: ""
+  keep_activity_private: false
+  created_unix: 1672578020
diff --git a/tests/integration/git_hooks_test.go b/tests/integration/git_hooks_test.go
new file mode 100644
index 0000000000..05d2223aee
--- /dev/null
+++ b/tests/integration/git_hooks_test.go
@@ -0,0 +1,99 @@
+// Copyright 2026 The Forgejo Authors c/o Codeberg e.V.. All rights reserved.
+// SPDX-License-Identifier: MIT
+package integration
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"path"
+	"testing"
+
+	"forgejo.org/models/auth"
+	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unittest"
+	user_model "forgejo.org/models/user"
+	"forgejo.org/modules/git"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomGitHooks(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+		owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+
+		httpContext := NewAPITestContext(t, owner.Name, repo.Name, auth.AccessTokenScopeReadRepository)
+
+		dstPath := t.TempDir()
+
+		u.Path = httpContext.GitPath()
+		u.User = url.UserPassword(owner.Name, userPassword)
+
+		doGitClone(dstPath, u)(t)
+
+		customHooksDir := path.Join(repo.RepoPath(), "hooks")
+
+		hookNames := []string{"pre-receive", "update", "post-receive"}
+
+		for _, hookName := range hookNames {
+			customPath := path.Join(customHooksDir, hookName+".d")
+			err := os.MkdirAll(customPath, 0x755)
+			require.NoError(t, err)
+
+			err = os.WriteFile(path.Join(customPath, "append-proof"), customGitHookTpl(hookName), 0x755)
+			require.NoError(t, err)
+
+			// The legacy, already existing gitea script might be there in the hooks directory in old installations,
+			// here it's ensured that these scripts filtered out when custom hooks run
+			err = os.WriteFile(path.Join(customPath, "gitea"), customGitHookGiteaTpl(), 0x755)
+			require.NoError(t, err)
+		}
+
+		fd, err := os.Create(path.Join(dstPath, "hooks-test.txt"))
+		require.NoError(t, err)
+
+		err = fd.Close()
+		require.NoError(t, err)
+
+		_, _, err = git.NewCommand(git.DefaultContext, "checkout", "master").RunStdString(&git.RunOpts{Dir: dstPath})
+		require.NoError(t, err)
+
+		err = os.WriteFile(path.Join(dstPath, "hooks-test.txt"), []byte("test"), 0x644)
+		require.NoError(t, err)
+
+		_, _, err = git.NewCommand(git.DefaultContext, "add", "hooks-test.txt").RunStdString(&git.RunOpts{Dir: dstPath})
+		require.NoError(t, err)
+
+		_, _, err = git.NewCommand(git.DefaultContext, "commit", "-m", "Add hooks-test.txt").RunStdString(&git.RunOpts{Dir: dstPath})
+		require.NoError(t, err)
+
+		_, _, err = git.NewCommand(git.DefaultContext, "push", "origin", "master").RunStdString(&git.RunOpts{Dir: dstPath})
+		require.NoError(t, err)
+
+		data, err := os.ReadFile(path.Join(customHooksDir, "hooks-proof.txt"))
+		require.NoError(t, err)
+
+		require.Equal(t, `pre-receive
+update
+post-receive
+`, string(data))
+	})
+}
+
+func customGitHookTpl(hookName string) []byte {
+	hookStr := fmt.Sprintf(`#!/usr/bin/env sh
+echo "%s" >> $(dirname $0)/../hooks-proof.txt
+`, hookName)
+
+	return []byte(hookStr)
+}
+
+func customGitHookGiteaTpl() []byte {
+	hookStr := `#!/usr/bin/env sh
+echo "legacy gitea script shouldn't be called!"
+exit 1
+`
+
+	return []byte(hookStr)
+}
diff --git a/tests/integration/git_test.go b/tests/integration/git_test.go
index a5a242b912..83853883c1 100644
--- a/tests/integration/git_test.go
+++ b/tests/integration/git_test.go
@@ -201,8 +201,12 @@ func standardCommitAndPushTest(t *testing.T, dstPath string) (little, big string
 func lfsCommitAndPushTest(t *testing.T, dstPath string) (littleLFS, bigLFS string) {
 	t.Run("LFS", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
+
+		err := git.NewCommand(git.DefaultContext, "config", "core.hooksPath", "$GIT/.hooks").AddArguments("--local").Run(&git.RunOpts{Dir: dstPath})
+		require.NoError(t, err)
+
 		prefix := "lfs-data-file-"
-		err := git.NewCommand(git.DefaultContext, "lfs").AddArguments("install").Run(&git.RunOpts{Dir: dstPath})
+		err = git.NewCommand(git.DefaultContext, "lfs").AddArguments("install").Run(&git.RunOpts{Dir: dstPath})
 		require.NoError(t, err)
 		_, _, err = git.NewCommand(git.DefaultContext, "lfs").AddArguments("track").AddDynamicArguments(prefix + "*").RunStdString(&git.RunOpts{Dir: dstPath})
 		require.NoError(t, err)
@@ -231,6 +235,7 @@ func lfsCommitAndPushTest(t *testing.T, dstPath string) (littleLFS, bigLFS strin
 			lockTest(t, dstPath)
 		})
 	})
+
 	return littleLFS, bigLFS
 }
 
@@ -855,6 +860,7 @@ func doCreateAgitFlowPull(dstPath string, ctx *APITestContext, headBranch string
 			assert.False(t, prMsg.HasMerged)
 			assert.Contains(t, "Testing commit 1", prMsg.Body)
 			assert.Equal(t, commit, prMsg.Head.Sha)
+			assert.Equal(t, "user2/"+headBranch, prMsg.Head.Name)
 
 			_, _, err = git.NewCommand(git.DefaultContext, "push", "origin").AddDynamicArguments("HEAD:refs/for/master/test/" + headBranch).RunStdString(&git.RunOpts{Dir: dstPath})
 			require.NoError(t, err)
@@ -873,6 +879,7 @@ func doCreateAgitFlowPull(dstPath string, ctx *APITestContext, headBranch string
 			prMsg = doAPIGetPullRequest(*ctx, ctx.Username, ctx.Reponame, pr2.Index)(t)
 
 			assert.Equal(t, "user2/test/"+headBranch, pr2.HeadBranch)
+			assert.Equal(t, "user2/test/"+headBranch, prMsg.Head.Name)
 			assert.False(t, prMsg.HasMerged)
 		})
 
diff --git a/tests/integration/integration_test.go b/tests/integration/integration_test.go
index 6cde9be4df..a75768bbaa 100644
--- a/tests/integration/integration_test.go
+++ b/tests/integration/integration_test.go
@@ -33,13 +33,16 @@ import (
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/graceful"
 	"forgejo.org/modules/json"
+	"forgejo.org/modules/jwtx"
 	"forgejo.org/modules/keying"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/setting"
+	"forgejo.org/modules/test"
 	"forgejo.org/modules/testlogger"
 	"forgejo.org/modules/util"
 	"forgejo.org/modules/web"
 	"forgejo.org/routers"
+	auth_method "forgejo.org/services/auth/method"
 	"forgejo.org/services/auth/source/remote"
 	app_context "forgejo.org/services/context"
 	"forgejo.org/services/mailer"
@@ -47,6 +50,8 @@ import (
 	"forgejo.org/tests"
 
 	"github.com/PuerkitoBio/goquery"
+	"github.com/golang-jwt/jwt/v5"
+	gouuid "github.com/google/uuid"
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/gothic"
 	goth_github "github.com/markbates/goth/providers/github"
@@ -708,7 +713,7 @@ func logUnexpectedResponse(t testing.TB, recorder *httptest.ResponseRecorder) {
 		}
 
 		return
-	} else if len(respBytes) < 500 {
+	} else if len(respBytes) < 2048 {
 		// if body is short, just log the whole thing
 		t.Log("Response: ", string(respBytes))
 		return
@@ -779,3 +784,98 @@ func SortMailerMessages(msgs []*mailer.Message) {
 		return strings.Compare(b.To, a.To)
 	})
 }
+
+type AuthorizedIntegrationTester struct {
+	t                       *testing.T
+	authorizedIntegration   *auth.AuthorizedIntegration
+	jwtSigningKey           jwtx.SigningKey
+	testServer              *httptest.Server
+	resetHTTPClient         func()
+	resetAllowLocalNetworks func()
+}
+
+func newAITester(t *testing.T, setupAI ...func(*auth.AuthorizedIntegration)) *AuthorizedIntegrationTester {
+	ait := &AuthorizedIntegrationTester{
+		t: t,
+	}
+
+	var jwtSigningKey jwtx.SigningKey
+	keyPath := filepath.Join(t.TempDir(), "jwt-rsa-2048.priv")
+	jwtSigningKey, err := jwtx.InitAsymmetricSigningKey(keyPath, "RS256")
+	require.NoError(t, err)
+	ait.jwtSigningKey = jwtSigningKey
+
+	ait.testServer = httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/actions/.well-known/openid-configuration" {
+			retval := map[string]any{
+				"issuer":                                ait.authorizedIntegration.Issuer,
+				"jwks_uri":                              fmt.Sprintf("%s/.keys", ait.authorizedIntegration.Issuer),
+				"id_token_signing_alg_values_supported": []string{"RS256"},
+			}
+			err := json.NewEncoder(w).Encode(retval)
+			require.NoError(t, err)
+			return
+		}
+		if r.URL.Path == "/api/actions/.keys" {
+			jwk, err := ait.jwtSigningKey.ToJWK()
+			require.NoError(t, err)
+			jwk["use"] = "sig"
+			retval := map[string]any{
+				"keys": []map[string]string{jwk},
+			}
+			_ = json.NewEncoder(w).Encode(retval) // no error checking -- some tests abort read
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+
+	// trust TLS cert of our NewTLSServer  by inserting the test client for our test server in as the HTTP client to use
+	ait.resetHTTPClient = test.MockVariableValue(
+		&auth_method.GetAuthorizedIntegrationHTTPClient,
+		func() *http.Client {
+			return ait.testServer.Client()
+		})
+
+	ait.authorizedIntegration = &auth.AuthorizedIntegration{
+		UserID:   2,
+		Scope:    auth.AccessTokenScopeAll,
+		Issuer:   fmt.Sprintf("%s/api/actions", ait.testServer.URL),
+		Audience: fmt.Sprintf("https://forgejo.example.org/-/coolguy/authorized-integration/%s", gouuid.New().String()),
+		ClaimRules: &auth.ClaimRules{
+			Rules: []auth.ClaimRule{
+				{
+					Claim:      "custom-claim",
+					Comparison: auth.ClaimEqual,
+					Value:      "custom-claim-value",
+				},
+			},
+		},
+		ResourceAllRepos: true,
+	}
+	for _, setup := range setupAI {
+		setup(ait.authorizedIntegration)
+	}
+	_, err = db.GetEngine(t.Context()).Insert(ait.authorizedIntegration)
+	require.NoError(t, err)
+
+	ait.resetAllowLocalNetworks = test.MockVariableValue(&setting.AuthorizedIntegration.AllowLocalNetworks, true)
+
+	return ait
+}
+
+func (ait *AuthorizedIntegrationTester) signedJWT() string {
+	claims := jwt.MapClaims{
+		"iss":          ait.authorizedIntegration.Issuer,
+		"aud":          ait.authorizedIntegration.Audience,
+		"custom-claim": "custom-claim-value",
+	}
+	signedToken, err := ait.jwtSigningKey.JWT(claims)
+	require.NoError(ait.t, err)
+	return signedToken
+}
+
+func (ait *AuthorizedIntegrationTester) close() {
+	ait.resetAllowLocalNetworks()
+	ait.resetHTTPClient()
+	ait.testServer.Close()
+}
diff --git a/tests/integration/issue_test.go b/tests/integration/issue_test.go
index d764870bab..5285e83df6 100644
--- a/tests/integration/issue_test.go
+++ b/tests/integration/issue_test.go
@@ -19,21 +19,22 @@ import (
 	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/db"
 	issues_model "forgejo.org/models/issues"
+	org_model "forgejo.org/models/organization"
 	project_model "forgejo.org/models/project"
 	repo_model "forgejo.org/models/repo"
 	unit_model "forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/indexer/issues"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/references"
 	"forgejo.org/modules/setting"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/test"
 	"forgejo.org/modules/translation"
-	files_service "forgejo.org/services/repository/files"
+	repo_service "forgejo.org/services/repository"
 	user_service "forgejo.org/services/user"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -487,8 +488,7 @@ func TestIssueDependencies(t *testing.T) {
 	session := loginUser(t, owner.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
 
-	repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, owner, tests.DeclarativeRepoOptions{})
-	defer f()
+	repo := forgery.CreateRepository(t, owner, nil)
 
 	createIssue := func(t *testing.T, title string) api.Issue {
 		t.Helper()
@@ -1357,13 +1357,9 @@ func TestIssueForm(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, u *url.URL) {
 		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 		session := loginUser(t, user2.Name)
-		repo, _, f := tests.CreateDeclarativeRepo(t, user2, "",
-			[]unit_model.Type{unit_model.TypeCode, unit_model.TypeIssues}, nil,
-			[]*files_service.ChangeRepoFile{
-				{
-					Operation: "create",
-					TreePath:  ".forgejo/issue_template/test.yaml",
-					ContentReader: strings.NewReader(`name: Test
+		repo := forgery.CreateRepository(t, user2, &forgery.CreateRepositoryOptions{
+			Files: forgery.MapFS{
+				".forgejo/issue_template/test.yaml": forgery.MapFile(`name: Test
 about: Hello World
 body:
   - type: checkboxes
@@ -1373,10 +1369,8 @@ body:
       options:
         - label: This is a label
 `),
-				},
 			},
-		)
-		defer f()
+		})
 
 		t.Run("Choose list", func(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
@@ -1405,10 +1399,7 @@ body:
 func TestIssueUnsubscription(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, u *url.URL) {
 		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-		repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			AutoInit: optional.Some(false),
-		})
-		defer f()
+		repo := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{})
 		session := loginUser(t, user.Name)
 
 		issueURL := testNewIssue(t, session, user.Name, repo.Name, "Issue title", "Description")
@@ -1661,3 +1652,113 @@ func TestIssueUrlHandling(t *testing.T) {
 		MakeRequest(t, req, http.StatusNotFound)
 	})
 }
+
+func TestIssueProjectSidebarMissing(t *testing.T) {
+	const (
+		repoID = 4
+		userID = 5
+	)
+	defer unittest.OverrideFixtures("tests/integration/fixtures/TestAssignProject/")()
+	defer tests.PrepareTestEnv(t)()
+
+	ctx := t.Context()
+
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: userID})
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: repoID})
+	session := loginUser(t, user.Name)
+
+	issueURL := testNewIssue(t, session, user.Name, repo.Name, "Hello", "World")
+	t.Run("Sidebar showing - user project available", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		req := NewRequest(t, "GET", issueURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".select-project.dropdown", true)
+	})
+
+	// Enable repository's project unit
+	projectUnit := repo_model.RepoUnit{
+		RepoID: repo.ID,
+		Type:   unit_model.TypeProjects,
+	}
+	require.NoError(t, repo_service.UpdateRepositoryUnits(db.DefaultContext, repo, []repo_model.RepoUnit{projectUnit}, nil))
+
+	t.Run("Sidebar showing - repository project unit on", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		req := NewRequest(t, "GET", issueURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".select-project.dropdown", true)
+	})
+
+	project_model.DeleteProjectByID(ctx, 1003)
+	// Disable repository's project unit
+	require.NoError(t, repo_service.UpdateRepositoryUnits(db.DefaultContext, repo, nil, []unit_model.Type{unit_model.TypeProjects}))
+	t.Run("Sidebar missing", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		req := NewRequest(t, "GET", issueURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".select-project.dropdown", false)
+	})
+
+	// Team with project available
+	team := unittest.AssertExistsAndLoadBean(t, &org_model.Team{ID: 1001})
+	require.NoError(t, team.LoadMembers(ctx))
+	require.NoError(t, team.LoadRepositories(ctx))
+
+	user = team.Members[0]
+	repo = team.Repos[0]
+	org := team.GetOrg(ctx)
+	session = loginUser(t, user.Name)
+
+	issueURL = testNewIssue(t, session, org.Name, repo.Name, "Hello", "World")
+	t.Run("Sidebar showing - org on & repo on", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		req := NewRequest(t, "GET", issueURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".select-project.dropdown", true)
+	})
+
+	// Disable repository project unit
+	require.NoError(t, repo_service.UpdateRepositoryUnits(ctx, repo, nil, []unit_model.Type{unit_model.TypeProjects}))
+	t.Run("Sidebar showing - org on & repo off", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		req := NewRequest(t, "GET", issueURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".select-project.dropdown", true)
+	})
+
+	// Team with project disabled
+	team = unittest.AssertExistsAndLoadBean(t, &org_model.Team{ID: 1002})
+	require.NoError(t, team.LoadMembers(ctx))
+	require.NoError(t, team.LoadRepositories(ctx))
+
+	user = team.Members[0]
+	repo = team.Repos[0]
+	org = team.GetOrg(ctx)
+	session = loginUser(t, user.Name)
+
+	require.NoError(t, project_model.DeleteProjectByID(db.DefaultContext, 1004))
+
+	issueURL = testNewIssue(t, session, org.Name, repo.Name, "Hello", "World")
+	t.Run("Sidebar showing - org off & repo on", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		req := NewRequest(t, "GET", issueURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".select-project.dropdown", true)
+	})
+
+	// Disable repository project unit
+	require.NoError(t, repo_service.UpdateRepositoryUnits(ctx, repo, nil, []unit_model.Type{unit_model.TypeProjects}))
+	t.Run("Sidebar missing - org off & repo off", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		req := NewRequest(t, "GET", issueURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".select-project.dropdown", false)
+	})
+}
diff --git a/tests/integration/migrate_test.go b/tests/integration/migrate_test.go
index 7d244ce60f..8f609a2bfe 100644
--- a/tests/integration/migrate_test.go
+++ b/tests/integration/migrate_test.go
@@ -20,13 +20,13 @@ import (
 	"forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/structs"
 	"forgejo.org/modules/test"
 	"forgejo.org/modules/translation"
 	"forgejo.org/services/migrations"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -196,11 +196,9 @@ func TestMigrateWithWiki(t *testing.T) {
 		defer test.MockVariableValue(&setting.AppVer, "1.16.0")()
 		require.NoError(t, migrations.Init())
 
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
-		repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			WikiBranch: optional.Some("obscure-name"),
-		})
-		defer f()
+		repo := forgery.CreateRepository(t, nil, nil)
+		forgery.InitWiki(t, repo, "obscure-name")
+		user := repo.Owner
 
 		session := loginUser(t, user.Name)
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeReadMisc)
diff --git a/tests/integration/mirror_pull_test.go b/tests/integration/mirror_pull_test.go
index 9a520ae5a5..9b831f4beb 100644
--- a/tests/integration/mirror_pull_test.go
+++ b/tests/integration/mirror_pull_test.go
@@ -22,7 +22,6 @@ import (
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/gitrepo"
 	"forgejo.org/modules/migration"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/process"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/structs"
@@ -34,6 +33,7 @@ import (
 	repo_service "forgejo.org/services/repository"
 	files_service "forgejo.org/services/repository/files"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/google/uuid"
@@ -183,19 +183,14 @@ func TestMirrorPull(t *testing.T) {
 					user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 
 					// Create the source repository that will be mirrored.
-					sourceRepo, sourceRepoSha, cleanupSource := tests.CreateDeclarativeRepoWithOptions(t, user2,
-						tests.DeclarativeRepoOptions{
-							IsPrivate: optional.Some(mc.privateSource),
-							Files: optional.Some([]*files_service.ChangeRepoFile{
-								{
-									Operation:     "create",
-									TreePath:      "docs.md",
-									ContentReader: strings.NewReader("hello, world"),
-								},
-							}),
+					var sourceRepoSha string
+					sourceRepo := forgery.CreateRepository(t, user2, &forgery.CreateRepositoryOptions{
+						IsPrivate: mc.privateSource,
+						Files: forgery.MapFS{
+							"docs.md": forgery.MapFile("hello, world"),
 						},
-					)
-					defer cleanupSource()
+						LatestSha: &sourceRepoSha,
+					})
 					require.NotEmpty(t, sourceRepoSha)
 
 					// Create pull mirror
@@ -239,10 +234,7 @@ func TestMirrorPull(t *testing.T) {
 
 		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 
-		mirrorRepo, _, cleanupMirror := tests.CreateDeclarativeRepoWithOptions(t, user2,
-			tests.DeclarativeRepoOptions{},
-		)
-		defer cleanupMirror()
+		mirrorRepo := forgery.CreateRepository(t, user2, nil)
 
 		// Write to the repo a config file that would have plausibly existed before EncryptedRemoteAddress was
 		// introduced:
@@ -343,8 +335,8 @@ func createPullMirrorViaWeb(t *testing.T, sourceRepo *repo_model.Repository, aut
 			body := resp.Body.String()
 			lastBody = body
 			// Looking for the repo page to be fully populated indicating that the migration is complete:
-			// Check that the first commit message is present:
-			if !strings.Contains(body, "Initial commit") {
+			// Check that the committed file is present:
+			if !strings.Contains(body, "docs.md") {
 				return false
 			}
 			// Check that the fork button is present:
diff --git a/tests/integration/mirror_push_test.go b/tests/integration/mirror_push_test.go
index 3f5a8223c8..95981c9ce6 100644
--- a/tests/integration/mirror_push_test.go
+++ b/tests/integration/mirror_push_test.go
@@ -21,12 +21,10 @@ import (
 	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/db"
 	repo_model "forgejo.org/models/repo"
-	"forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/gitrepo"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/test"
@@ -37,6 +35,7 @@ import (
 	mirror_service "forgejo.org/services/mirror"
 	repo_service "forgejo.org/services/repository"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -228,12 +227,7 @@ func TestSSHPushMirror(t *testing.T) {
 		assert.False(t, srcRepo.HasWiki())
 		sess := loginUser(t, user.Name)
 
-		pushToRepo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			Name:         optional.Some("push-mirror-misc-test"),
-			AutoInit:     optional.Some(false),
-			EnabledUnits: optional.Some([]unit.Type{unit.TypeCode}),
-		})
-		defer f()
+		pushToRepo := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{})
 		sshURL := fmt.Sprintf("ssh://%s@%s/%s.git", setting.SSH.User, net.JoinHostPort(setting.SSH.ListenHost, strconv.Itoa(setting.SSH.ListenPort)), pushToRepo.FullName())
 
 		t.Run("Mutual exclusive", func(t *testing.T) {
@@ -286,12 +280,7 @@ func TestSSHPushMirror(t *testing.T) {
 		testMirrorPush := func(t *testing.T, srcRepo *repo_model.Repository, expectedSHA string) {
 			t.Helper()
 
-			pushToRepo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-				Name:         optional.Some("push-mirror-test"),
-				AutoInit:     optional.Some(false),
-				EnabledUnits: optional.Some([]unit.Type{unit.TypeCode}),
-			})
-			defer f()
+			pushToRepo := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{})
 			sshURL := fmt.Sprintf("ssh://%s@%s/%s.git", setting.SSH.User, net.JoinHostPort(setting.SSH.ListenHost, strconv.Itoa(setting.SSH.ListenPort)), pushToRepo.FullName())
 
 			var pushMirror *repo_model.PushMirror
@@ -404,8 +393,7 @@ func TestPushMirrorBranchFilterWebUI(t *testing.T) {
 		srcRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 		sess := loginUser(t, user.Name)
 
-		mirrorRepo, _, f := tests.CreateDeclarativeRepo(t, user, "", []unit.Type{unit.TypeCode}, nil, nil)
-		defer f()
+		mirrorRepo := forgery.CreateRepository(t, user, nil)
 
 		ctx := NewAPITestContext(t, user.LowerName, srcRepo.Name, auth_model.AccessTokenScopeReadRepository)
 		ctx.Session = sess
@@ -595,12 +583,8 @@ func TestPushMirrorSettings(t *testing.T) {
 		srcRepo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
 		assert.False(t, srcRepo.HasWiki())
 		sess := loginUser(t, user.Name)
-		pushToRepo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			Name:         optional.Some("push-mirror-test"),
-			AutoInit:     optional.Some(false),
-			EnabledUnits: optional.Some([]unit.Type{unit.TypeCode}),
-		})
-		defer f()
+
+		pushToRepo := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{})
 
 		t.Run("Adding", func(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
@@ -904,8 +888,7 @@ func TestPushMirrorWebUIToAPIIntegration(t *testing.T) {
 		session := loginUser(t, user.Name)
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeAll)
 
-		mirrorRepo, _, f := tests.CreateDeclarativeRepo(t, user, "", []unit.Type{unit.TypeCode}, nil, nil)
-		defer f()
+		mirrorRepo := forgery.CreateRepository(t, user, nil)
 
 		ctx := NewAPITestContext(t, user.LowerName, srcRepo.Name, auth_model.AccessTokenScopeReadRepository)
 		ctx.Session = session
@@ -941,8 +924,7 @@ func TestPushMirrorWebUIToAPIIntegration(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
 
 			// Create another mirror repo for this test
-			mirrorRepo2, _, f := tests.CreateDeclarativeRepo(t, user, "", []unit.Type{unit.TypeCode}, nil, nil)
-			defer f()
+			mirrorRepo2 := forgery.CreateRepository(t, user, nil)
 			remoteAddress2 := fmt.Sprintf("%s%s/%s", u.String(), url.PathEscape(user.Name), url.PathEscape(mirrorRepo2.Name))
 
 			// Create push mirror with empty branch filter via web UI
@@ -967,8 +949,7 @@ func TestPushMirrorWebUIToAPIIntegration(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
 
 			// Create another mirror repo for this test
-			mirrorRepo3, _, f := tests.CreateDeclarativeRepo(t, user, "", []unit.Type{unit.TypeCode}, nil, nil)
-			defer f()
+			mirrorRepo3 := forgery.CreateRepository(t, user, nil)
 			remoteAddress3 := fmt.Sprintf("%s%s/%s", u.String(), url.PathEscape(user.Name), url.PathEscape(mirrorRepo3.Name))
 
 			// Create push mirror with complex branch filter via web UI
@@ -994,8 +975,7 @@ func TestPushMirrorWebUIToAPIIntegration(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
 
 			// Create another mirror repo for this test
-			mirrorRepo4, _, f := tests.CreateDeclarativeRepo(t, user, "", []unit.Type{unit.TypeCode}, nil, nil)
-			defer f()
+			mirrorRepo4 := forgery.CreateRepository(t, user, nil)
 			remoteAddress4 := fmt.Sprintf("%s%s/%s", u.String(), url.PathEscape(user.Name), url.PathEscape(mirrorRepo4.Name))
 
 			// First create a push mirror via API with initial branch filter
diff --git a/tests/integration/org_members_test.go b/tests/integration/org_members_test.go
index e51850126f..b0cdb2f3f0 100644
--- a/tests/integration/org_members_test.go
+++ b/tests/integration/org_members_test.go
@@ -4,12 +4,19 @@
 package integration
 
 import (
+	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 
+	"forgejo.org/models/db"
+	"forgejo.org/models/organization"
+	"forgejo.org/models/unittest"
+	user_model "forgejo.org/models/user"
 	"forgejo.org/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestOrgMembersPage(t *testing.T) {
@@ -24,6 +31,8 @@ func TestOrgMembersPage(t *testing.T) {
 		/* No interactive buttons - though such evaluation is easy to break in rename */
 		assert.Equal(t, 0, doc.Find(".members .list .link-action").Length())
 		assert.Equal(t, 0, doc.Find(".members .list .delete-button").Length())
+		/* Guests cannot add members to organizations */
+		doc.AssertElement(t, "#add-org-member-button", false)
 	})
 
 	t.Run("Member PoV", func(t *testing.T) {
@@ -34,6 +43,8 @@ func TestOrgMembersPage(t *testing.T) {
 		/* Interactive buttons are only available for own entry in the list */
 		assert.Equal(t, 1, doc.Find(".members .list .link-action").Length())
 		assert.Equal(t, 1, doc.Find(".members .list .delete-button").Length())
+		/* Adding new members is not possible, as the member isn't an owner */
+		doc.AssertElement(t, "#add-org-member-button", false)
 	})
 
 	t.Run("Owner PoV", func(t *testing.T) {
@@ -44,5 +55,169 @@ func TestOrgMembersPage(t *testing.T) {
 		/* Interactive buttons are available for all entries in the list (> 2) */
 		assert.Less(t, 2, doc.Find(".members .list .link-action").Length())
 		assert.Less(t, 2, doc.Find(".members .list .delete-button").Length())
+		/* Adding new members is possible */
+		doc.AssertElement(t, "#add-org-member-button", true)
 	})
 }
+
+func TestOrgAddMember(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
+	team1 := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 1})
+	team2 := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+
+	isMember, err := organization.IsTeamMember(db.DefaultContext, team1.OrgID, team1.ID, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isMember)
+	isMember, err = organization.IsTeamMember(db.DefaultContext, team2.OrgID, team2.ID, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isMember)
+
+	session := loginUser(t, "user2")
+
+	teamURL := fmt.Sprintf("/org/%s/members", org.Name)
+	req := NewRequestWithValues(t, "POST", teamURL+"/action/add", map[string]string{
+		"uid":    "2",
+		"uname":  user.LoginName,
+		"team_1": "on",
+		"team_2": "on",
+	})
+	resp := session.MakeRequest(t, req, http.StatusSeeOther)
+	assert.Equal(t, teamURL, resp.Header().Get("Location"))
+
+	user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+	isMember, err = organization.IsTeamMember(db.DefaultContext, team1.OrgID, team1.ID, user.ID)
+	require.NoError(t, err)
+	assert.True(t, isMember)
+	isMember, err = organization.IsTeamMember(db.DefaultContext, team2.OrgID, team2.ID, user.ID)
+	require.NoError(t, err)
+	assert.True(t, isMember)
+}
+
+func TestOrgAddMemberToNoTeam(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+
+	isOrgMember, err := org.IsOrgMember(db.DefaultContext, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isOrgMember)
+
+	session := loginUser(t, "user2")
+
+	teamURL := fmt.Sprintf("/org/%s/members", org.Name)
+	resp := session.MakeRequest(t, NewRequestWithValues(t, "POST", teamURL+"/action/add", map[string]string{
+		"uid":   "2",
+		"uname": user.LoginName,
+	}), http.StatusSeeOther)
+	assert.Equal(t, teamURL, resp.Header().Get("Location"))
+
+	doc := NewHTMLParser(t, session.MakeRequest(t, NewRequest(t, "GET", teamURL), http.StatusOK).Body)
+	assert.Contains(t, strings.TrimSpace(doc.Find(".flash-error").Text()), "Organization members must belong to at least one team.")
+
+	isOrgMember, err = org.IsOrgMember(db.DefaultContext, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isOrgMember)
+}
+
+func TestOrgAddMemberToForeignTeam(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
+	foreignTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 5})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+
+	isOrgMember, err := org.IsOrgMember(db.DefaultContext, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isOrgMember)
+
+	isForeignTeamMember, err := organization.IsTeamMember(db.DefaultContext, foreignTeam.OrgID, foreignTeam.ID, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isForeignTeamMember)
+
+	session := loginUser(t, "user2")
+
+	teamURL := fmt.Sprintf("/org/%s/members", org.Name)
+	// This test scenario is here for security purposes as the UI will not offer adding the user to
+	// a foreign team in the first place (but a malicious request could be performed in other ways).
+	resp := session.MakeRequest(t, NewRequestWithValues(t, "POST", teamURL+"/action/add", map[string]string{
+		"uid":    "2",
+		"uname":  user.LoginName,
+		"team_5": "on",
+	}), http.StatusSeeOther)
+	assert.Equal(t, teamURL, resp.Header().Get("Location"))
+
+	doc := NewHTMLParser(t, session.MakeRequest(t, NewRequest(t, "GET", teamURL), http.StatusOK).Body)
+	// This error message isn't specific to this "exploit" attempt, but shows that no action was taken.
+	assert.Contains(t, strings.TrimSpace(doc.Find(".flash-error").Text()), "Organization members must belong to at least one team.")
+
+	isOrgMember, err = org.IsOrgMember(db.DefaultContext, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isOrgMember)
+
+	isForeignTeamMember, err = organization.IsTeamMember(db.DefaultContext, foreignTeam.OrgID, foreignTeam.ID, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isForeignTeamMember)
+}
+
+func TestOrgAddMemberWithoutProperRights(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+
+	isOrgMember, err := org.IsOrgMember(db.DefaultContext, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isOrgMember)
+
+	session := loginUser(t, user.Name) // user5 is not a member of this org, so it cannot add anyone to it
+
+	teamURL := fmt.Sprintf("/org/%s/members", org.Name)
+	req := NewRequestWithValues(t, "POST", teamURL+"/action/add", map[string]string{
+		"uid":    "5",
+		"uname":  user.LoginName,
+		"team_2": "on",
+	})
+	session.MakeRequest(t, req, http.StatusNotFound)
+}
+
+func TestOrgAddExistingMemberFails(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
+	team := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
+
+	members, _, err := organization.FindOrgMembers(db.DefaultContext, &organization.FindOrgMembersOpts{
+		OrgID: org.ID,
+	})
+	require.NoError(t, err)
+	assert.Len(t, members, 2)
+	isOrgMember, err := org.IsOrgMember(db.DefaultContext, user.ID)
+	require.NoError(t, err)
+	assert.True(t, isOrgMember)
+	isTeamMember, err := organization.IsTeamMember(db.DefaultContext, team.OrgID, team.ID, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isTeamMember)
+
+	session := loginUser(t, "user2")
+
+	teamURL := fmt.Sprintf("/org/%s/members", org.Name)
+	req := NewRequestWithValues(t, "POST", teamURL+"/action/add", map[string]string{
+		"uid":    "2",
+		"uname":  user.LoginName,
+		"team_2": "on",
+	})
+	resp := session.MakeRequest(t, req, http.StatusSeeOther)
+	assert.Equal(t, teamURL, resp.Header().Get("Location"))
+	doc := NewHTMLParser(t, session.MakeRequest(t, NewRequest(t, "GET", teamURL), http.StatusOK).Body)
+	assert.Contains(t, strings.TrimSpace(doc.Find(".flash-error").Text()), "This user is already a member of the organization.")
+
+	user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
+	isTeamMember, err = organization.IsTeamMember(db.DefaultContext, team.OrgID, team.ID, user.ID)
+	require.NoError(t, err)
+	assert.False(t, isTeamMember)
+}
diff --git a/tests/integration/patch_status_test.go b/tests/integration/patch_status_test.go
index 9ada94bfc0..1acce03d6b 100644
--- a/tests/integration/patch_status_test.go
+++ b/tests/integration/patch_status_test.go
@@ -10,22 +10,19 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"
 
 	issues_model "forgejo.org/models/issues"
 	repo_model "forgejo.org/models/repo"
-	unit_model "forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/test"
 	pull_service "forgejo.org/services/pull"
-	files_service "forgejo.org/services/repository/files"
 	shared_automerge "forgejo.org/services/shared/automerge"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -36,24 +33,17 @@ func TestPatchStatus(t *testing.T) {
 		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 		session := loginUser(t, user2.Name)
 
-		var objectFormat optional.Option[string]
+		var objectFormat git.ObjectFormat
 		if git.SupportHashSha256 {
-			objectFormat = optional.Some("sha256")
+			objectFormat = git.Sha256ObjectFormat
 		}
 
-		repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user2, tests.DeclarativeRepoOptions{
-			AutoInit:     optional.Some(true),
-			EnabledUnits: optional.Some([]unit_model.Type{unit_model.TypeCode}),
+		repo := forgery.CreateRepository(t, user2, &forgery.CreateRepositoryOptions{
+			Files: forgery.MapFS{
+				".spokeperson": forgery.MapFile("n0toose"),
+			},
 			ObjectFormat: objectFormat,
-			Files: optional.Some([]*files_service.ChangeRepoFile{
-				{
-					Operation:     "create",
-					TreePath:      ".spokeperson",
-					ContentReader: strings.NewReader("n0toose"),
-				},
-			}),
 		})
-		defer f()
 
 		testAutomergeQueued := func(t *testing.T, pr *issues_model.PullRequest, expected issues_model.PullRequestStatus) {
 			t.Helper()
diff --git a/tests/integration/project_test.go b/tests/integration/project_test.go
index 629793602b..7583075b5f 100644
--- a/tests/integration/project_test.go
+++ b/tests/integration/project_test.go
@@ -7,12 +7,20 @@ package integration
 import (
 	"fmt"
 	"net/http"
+	"path"
+	"strconv"
+	"strings"
 	"testing"
 
 	"forgejo.org/models/db"
+	issues_model "forgejo.org/models/issues"
+	org_model "forgejo.org/models/organization"
 	project_model "forgejo.org/models/project"
 	repo_model "forgejo.org/models/repo"
+	unit_model "forgejo.org/models/unit"
 	"forgejo.org/models/unittest"
+	user_model "forgejo.org/models/user"
+	repo_service "forgejo.org/services/repository"
 	"forgejo.org/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -160,3 +168,117 @@ func TestChangeStatusProject(t *testing.T) {
 		})
 	})
 }
+
+func TestAssignProject(t *testing.T) {
+	defer unittest.OverrideFixtures("tests/integration/fixtures/TestAssignProject/")()
+	defer tests.PrepareTestEnv(t)()
+
+	ctx := t.Context()
+
+	newTestIssue := func(t *testing.T, session *TestSession, owner *user_model.User, repo *repo_model.Repository) (*issues_model.Issue, string, string) {
+		t.Helper()
+
+		issueURL := testNewIssue(t, session, owner.Name, repo.Name, "Hello", "World")
+		indexStr := issueURL[strings.LastIndexByte(issueURL, '/')+1:]
+		index, err := strconv.Atoi(indexStr)
+		require.NoError(t, err, "Invalid issue href: %s", issueURL)
+
+		issue := &issues_model.Issue{RepoID: repo.ID, Index: int64(index)}
+		unittest.AssertExistsAndLoadBean(t, issue)
+
+		issueID := strconv.FormatInt(issue.ID, 10)
+		return issue, indexStr, issueID
+	}
+
+	updateIssueProject := func(t *testing.T, session *TestSession, projectID, issueID, owner, repo string, expectedStatus int) {
+		t.Helper()
+
+		req := NewRequestWithValues(t, "POST", path.Join(owner, repo, "issues", "projects"), map[string]string{
+			"issue_ids": issueID,
+			"id":        projectID,
+		})
+		session.MakeRequest(t, req, expectedStatus)
+	}
+
+	// User
+	t.Run("UserProjectOn+RepoProjectOff", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+
+		session := loginUser(tt, user.Name)
+		issue, _, issueID := newTestIssue(tt, session, user, repo)
+
+		updateIssueProject(tt, session, "1003", issueID, user.Name, repo.Name, http.StatusOK)
+		require.NoError(tt, issue.LoadProject(db.DefaultContext))
+		require.NotNil(tt, issue.Project)
+		require.Equal(tt, int64(1003), issue.Project.ID)
+	})
+
+	// Team 1001 - enabled project unit
+	team := unittest.AssertExistsAndLoadBean(t, &org_model.Team{ID: 1001})
+	require.NoError(t, team.LoadMembers(ctx))
+	require.NoError(t, team.LoadRepositories(ctx))
+
+	user := team.Members[0]
+	repo := team.Repos[0]
+	org := team.GetOrg(ctx)
+
+	session := loginUser(t, user.Name)
+
+	t.Run("OrgProjectOn+RepoProjectOn", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		issue, _, issueID := newTestIssue(tt, session, org.AsUser(), repo)
+
+		updateIssueProject(tt, session, "1001", issueID, org.Name, repo.Name, http.StatusOK)
+
+		require.NoError(tt, issue.LoadProject(db.DefaultContext))
+		require.NotNil(tt, issue.Project)
+		require.Equal(tt, int64(1001), issue.Project.ID)
+	})
+
+	// Disable repository project unit
+	require.NoError(t, repo_service.UpdateRepositoryUnits(ctx, repo, nil, []unit_model.Type{unit_model.TypeProjects}))
+	t.Run("OrgProjectOn+RepoProjectOff", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		issue, _, issueID := newTestIssue(tt, session, org.AsUser(), repo)
+
+		updateIssueProject(tt, session, "1001", issueID, org.Name, repo.Name, http.StatusOK)
+		require.NoError(tt, issue.LoadProject(db.DefaultContext))
+		require.NotNil(tt, issue.Project)
+		require.Equal(tt, int64(1001), issue.Project.ID)
+	})
+
+	// Team 1002 - disabled project unit
+	team = unittest.AssertExistsAndLoadBean(t, &org_model.Team{ID: 1002})
+	require.NoError(t, team.LoadMembers(ctx))
+	require.NoError(t, team.LoadRepositories(ctx))
+
+	user = team.Members[0]
+	repo = team.Repos[0]
+	org = team.GetOrg(ctx)
+
+	session = loginUser(t, user.Name)
+
+	t.Run("OrgProjectOff+RepoProjectOn", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		issue, _, issueID := newTestIssue(tt, session, org.AsUser(), repo)
+
+		updateIssueProject(tt, session, "1002", issueID, org.Name, repo.Name, http.StatusOK)
+		require.NoError(tt, issue.LoadProject(db.DefaultContext))
+		require.NotNil(tt, issue.Project)
+		require.Equal(tt, int64(1002), issue.Project.ID)
+	})
+
+	// Disable repository project unit
+	require.NoError(t, repo_service.UpdateRepositoryUnits(ctx, repo, nil, []unit_model.Type{unit_model.TypeProjects}))
+	t.Run("OrgProjectOff+RepoProjectOff", func(tt *testing.T) {
+		defer tests.PrintCurrentTest(tt)()
+		issue, _, issueID := newTestIssue(tt, session, org.AsUser(), repo)
+
+		updateIssueProject(tt, session, "1002", issueID, org.Name, repo.Name, http.StatusOK)
+		require.NoError(tt, issue.LoadProject(db.DefaultContext))
+		require.NotNil(tt, issue.Project)
+		require.Equal(tt, int64(1002), issue.Project.ID)
+	})
+}
diff --git a/tests/integration/pull_review_test.go b/tests/integration/pull_review_test.go
index 69628e08b5..3c0f4344f1 100644
--- a/tests/integration/pull_review_test.go
+++ b/tests/integration/pull_review_test.go
@@ -6,6 +6,7 @@ package integration
 
 import (
 	"bytes"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"net/http"
@@ -13,11 +14,13 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"slices"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 
+	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/db"
 	issues_model "forgejo.org/models/issues"
 	repo_model "forgejo.org/models/repo"
@@ -26,17 +29,22 @@ import (
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/gitrepo"
+	"forgejo.org/modules/optional"
 	repo_module "forgejo.org/modules/repository"
+	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/test"
 	issue_service "forgejo.org/services/issue"
 	"forgejo.org/services/mailer"
 	repo_service "forgejo.org/services/repository"
 	files_service "forgejo.org/services/repository/files"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/PuerkitoBio/goquery"
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/net/html"
 )
 
 func TestPullView_ReviewerMissed(t *testing.T) {
@@ -207,27 +215,27 @@ func TestPullView_ResolveInvalidatedReviewComment(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 		req := NewRequest(t, "GET", "/user2/repo1/pulls/3/files/reviews/new_comment")
 		resp := session.MakeRequest(t, req, http.StatusOK)
-		doc := NewHTMLParser(t, resp.Body)
+		newCommentForm := NewHTMLParser(t, resp.Body)
 
 		var firstReviewID int64
 		{
 			// first (outdated) review
 			req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/3/files/reviews/comments", map[string]string{
-				"origin":           doc.GetInputValueByName("origin"),
-				"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+				"origin":           newCommentForm.GetInputValueByName("origin"),
+				"latest_commit_id": newCommentForm.GetInputValueByName("latest_commit_id"),
 				"side":             "proposed",
 				"line":             "2",
 				"path":             "iso-8859-1.txt",
-				"diff_start_cid":   doc.GetInputValueByName("diff_start_cid"),
-				"diff_end_cid":     doc.GetInputValueByName("diff_end_cid"),
-				"diff_base_cid":    doc.GetInputValueByName("diff_base_cid"),
+				"diff_start_cid":   newCommentForm.GetInputValueByName("diff_start_cid"),
+				"diff_end_cid":     newCommentForm.GetInputValueByName("diff_end_cid"),
+				"diff_base_cid":    newCommentForm.GetInputValueByName("diff_base_cid"),
 				"content":          "nitpicking comment",
 				"pending_review":   "",
 			})
 			session.MakeRequest(t, req, http.StatusOK)
 
 			req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/3/files/reviews/submit", map[string]string{
-				"commit_id": doc.GetInputValueByName("latest_commit_id"),
+				"commit_id": newCommentForm.GetInputValueByName("latest_commit_id"),
 				"content":   "looks good",
 				"type":      "comment",
 			})
@@ -236,7 +244,7 @@ func TestPullView_ResolveInvalidatedReviewComment(t *testing.T) {
 			// retrieve comment_id by reloading the comment page
 			req = NewRequest(t, "GET", "/user2/repo1/pulls/3")
 			resp = session.MakeRequest(t, req, http.StatusOK)
-			doc = NewHTMLParser(t, resp.Body)
+			doc := NewHTMLParser(t, resp.Body)
 			commentID, ok := doc.Find(`[data-action="Resolve"]`).Attr("data-comment-id")
 			assert.True(t, ok)
 
@@ -259,21 +267,21 @@ func TestPullView_ResolveInvalidatedReviewComment(t *testing.T) {
 			// second (up-to-date) review on the same line
 			// make a second review
 			req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/3/files/reviews/comments", map[string]string{
-				"origin":           doc.GetInputValueByName("origin"),
-				"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+				"origin":           newCommentForm.GetInputValueByName("origin"),
+				"latest_commit_id": newCommentForm.GetInputValueByName("latest_commit_id"),
 				"side":             "proposed",
 				"line":             "2",
 				"path":             "iso-8859-1.txt",
-				"diff_start_cid":   doc.GetInputValueByName("diff_start_cid"),
-				"diff_end_cid":     doc.GetInputValueByName("diff_end_cid"),
-				"diff_base_cid":    doc.GetInputValueByName("diff_base_cid"),
+				"diff_start_cid":   newCommentForm.GetInputValueByName("diff_start_cid"),
+				"diff_end_cid":     newCommentForm.GetInputValueByName("diff_end_cid"),
+				"diff_base_cid":    newCommentForm.GetInputValueByName("diff_base_cid"),
 				"content":          "nitpicking comment",
 				"pending_review":   "",
 			})
 			session.MakeRequest(t, req, http.StatusOK)
 
 			req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/3/files/reviews/submit", map[string]string{
-				"commit_id": doc.GetInputValueByName("latest_commit_id"),
+				"commit_id": newCommentForm.GetInputValueByName("latest_commit_id"),
 				"content":   "looks better",
 				"type":      "comment",
 			})
@@ -282,7 +290,7 @@ func TestPullView_ResolveInvalidatedReviewComment(t *testing.T) {
 			// retrieve comment_id by reloading the comment page
 			req = NewRequest(t, "GET", "/user2/repo1/pulls/3")
 			resp = session.MakeRequest(t, req, http.StatusOK)
-			doc = NewHTMLParser(t, resp.Body)
+			doc := NewHTMLParser(t, resp.Body)
 
 			commentIDs := doc.Find(`[data-action="Resolve"]`).Map(func(i int, elt *goquery.Selection) string {
 				v, _ := elt.Attr("data-comment-id")
@@ -311,7 +319,7 @@ func TestPullView_ResolveInvalidatedReviewComment(t *testing.T) {
 
 		// even on template error, the page returns HTTP 200
 		// count the comments to ensure success.
-		doc = NewHTMLParser(t, resp.Body)
+		doc := NewHTMLParser(t, resp.Body)
 		comments := doc.Find(`.comment-code-cloud > .comment`)
 		assert.Len(t, comments.Nodes, 1) // the outdated comment belongs to another review and should not be shown
 	})
@@ -667,13 +675,17 @@ func TestPullRequestReplyMail(t *testing.T) {
 
 		review := unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: 1002}, "type = 0")
 
-		req := NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
-			"origin":  "diff",
-			"content": "Just a comment!",
-			"side":    "proposed",
-			"line":    "4",
-			"path":    "README.md",
-			"reply":   strconv.FormatInt(review.ID, 10),
+		req := NewRequest(t, "GET", "/user2/repo1/pulls/2/files/reviews/new_comment")
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body)
+		req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
+			"origin":           "diff",
+			"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+			"content":          "Just a comment!",
+			"side":             "proposed",
+			"line":             "4",
+			"path":             "README.md",
+			"reply":            strconv.FormatInt(review.ID, 10),
 		})
 		session.MakeRequest(t, req, http.StatusOK)
 
@@ -689,12 +701,16 @@ func TestPullRequestReplyMail(t *testing.T) {
 			called = true
 		})()
 
-		req := NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
-			"origin":  "diff",
-			"content": "Notification time 2!",
-			"side":    "proposed",
-			"line":    "2",
-			"path":    "README.md",
+		req := NewRequest(t, "GET", "/user2/repo1/pulls/2/files/reviews/new_comment")
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body)
+		req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
+			"origin":           "diff",
+			"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+			"content":          "Notification time 2!",
+			"side":             "proposed",
+			"line":             "2",
+			"path":             "README.md",
 		})
 		session.MakeRequest(t, req, http.StatusOK)
 
@@ -718,13 +734,17 @@ func TestPullRequestReplyMail(t *testing.T) {
 
 			review := unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: 1001, Type: issues_model.ReviewTypeComment})
 
-			req := NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
-				"origin":  "diff",
-				"content": "Notification time!",
-				"side":    "proposed",
-				"line":    "3",
-				"path":    "README.md",
-				"reply":   strconv.FormatInt(review.ID, 10),
+			req := NewRequest(t, "GET", "/user2/repo1/pulls/2/files/reviews/new_comment")
+			resp := session.MakeRequest(t, req, http.StatusOK)
+			doc := NewHTMLParser(t, resp.Body)
+			req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
+				"origin":           "diff",
+				"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+				"content":          "Notification time!",
+				"side":             "proposed",
+				"line":             "3",
+				"path":             "README.md",
+				"reply":            strconv.FormatInt(review.ID, 10),
 			})
 			session.MakeRequest(t, req, http.StatusOK)
 
@@ -744,13 +764,17 @@ func TestPullRequestReplyMail(t *testing.T) {
 				called = true
 			})()
 
-			req := NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
-				"origin":        "diff",
-				"content":       "Notification time 2!",
-				"side":          "proposed",
-				"line":          "5",
-				"path":          "README.md",
-				"single_review": "true",
+			req := NewRequest(t, "GET", "/user2/repo1/pulls/2/files/reviews/new_comment")
+			resp := session.MakeRequest(t, req, http.StatusOK)
+			doc := NewHTMLParser(t, resp.Body)
+			req = NewRequestWithValues(t, "POST", "/user2/repo1/pulls/2/files/reviews/comments", map[string]string{
+				"origin":           "diff",
+				"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+				"content":          "Notification time 2!",
+				"side":             "proposed",
+				"line":             "5",
+				"path":             "README.md",
+				"single_review":    "true",
 			})
 			session.MakeRequest(t, req, http.StatusOK)
 
@@ -1048,3 +1072,1077 @@ func TestPullRequestStaleReview(t *testing.T) {
 		})
 	})
 }
+
+func TestPullRequestCommentPlacement(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		t.Run("comment directly on change in PR", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			commitSHA := tester.changeFile("file1.md",
+				strings.Replace(tester.fileContent, "Line 50\n", "Line 50--modified\n", 1))
+			tester.createPR()
+
+			comment := tester.commentFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -48,3 +48,3 @@
+ Line 48
+ Line 49
+-Line 50
++Line 50--modified`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 50, comment.Line)
+			assert.Equal(t, commitSHA, comment.CommitSHA)
+
+			diff := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff)
+			tester.assertCommitDiff(commitSHA, diff)
+		})
+
+		t.Run("comment lands on blame from commit within PR", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify an earlier part of the file in one commit, and a later part of the file in a second commit.
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 25\n", "Line 25--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			content = strings.Replace(content, "Line 75\n", "Line 75--modified\n", 1)
+			commit2 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// Comment on the earlier change, from the "Files changed" view; this should "git blame" and be asociated
+			// with the first commit where that change was made, therefore appearing on the commit-specific diff later:
+			comment := tester.commentFromFilesChanged("file1.md", 25)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -23,3 +23,3 @@
+ Line 23
+ Line 24
+-Line 25
++Line 25--modified`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 25, comment.Line)
+			assert.Equal(t, commit1, comment.CommitSHA)
+
+			diff25 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 24"},
+				{rowType: RowDelCode, code: "Line 25"},
+				{rowType: RowAddCode, code: "Line 25--modified"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 26"},
+			}
+			tester.assertFilesChangedDiff(diff25)
+			tester.assertCommitDiff(commit1, diff25)
+
+			diff75 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 74"},
+				{rowType: RowDelCode, code: "Line 75"},
+				{rowType: RowAddCode, code: "Line 75--modified"},
+				{rowType: RowHasCode, code: "Line 76"},
+			}
+			tester.assertFilesChangedDiff(diff75)
+			tester.assertCommitDiff(commit2, diff75)
+		})
+
+		t.Run("comment lands on blame commit from before PR", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify line 50...
+			commitSHA := tester.changeFile("file1.md",
+				strings.Replace(tester.fileContent, "Line 50\n", "Line 50--modified\n", 1))
+			tester.createPR()
+
+			// But while viewing line 50's diff, place a comment on line 49.  This will "git blame" to a commit outside
+			// of this PR, but that's fine...
+			comment := tester.commentFromFilesChanged("file1.md", 49)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,7 @@ Line 46
+ Line 47
+ Line 48
+ Line 49`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 49, comment.Line)
+			assert.NotEqual(t, commitSHA, comment.CommitSHA)
+
+			diff := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 48"},
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff)
+			tester.assertCommitDiff(commitSHA, diff)
+		})
+
+		t.Run("comment on line moves due to a following commit", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify line 50
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "Line 50--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// Place a comment on "Line 50--modified"
+			comment := tester.commentFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -48,3 +48,3 @@
+ Line 48
+ Line 49
+-Line 50
++Line 50--modified`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 50, comment.Line)
+			assert.Equal(t, commit1, comment.CommitSHA)
+
+			// Add a second commit to the PR which removes  "Line 1" - "Line 10".
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			commit2 := tester.changeFile("file1.md", content)
+
+			diff2 := []diffTableRow{
+				{rowType: RowDelCode, code: "Line 9"},
+				{rowType: RowDelCode, code: "Line 10"},
+				{rowType: RowHasCode, code: "Line 11"},
+			}
+			tester.assertFilesChangedDiff(diff2, "checking commit2 contents in full PR diff")
+			tester.assertCommitDiff(commit2, diff2, "checking commit2 contents in single-commit diff")
+
+			diff1 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff1, "checking commit1 contents in full PR diff")
+			tester.assertCommitDiff(commit1, diff1, "checking commit1 contents in single-commit diff")
+		})
+
+		t.Run("comment on line moves due to a following commit, following commit is rewritten and force-push'd", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify line 50
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "Line 50--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// Place a comment on "Line 50--modified"
+			comment := tester.commentFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -48,3 +48,3 @@
+ Line 48
+ Line 49
+-Line 50
++Line 50--modified`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 50, comment.Line)
+			assert.Equal(t, commit1, comment.CommitSHA)
+			assert.False(t, comment.Invalidated)
+
+			// Add a second commit to the PR which removes  "Line 1" - "Line 10".
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			tester.changeFile("file1.md", content)
+
+			// Now amend commit2v1 with an additional change, causing a force push of the branch
+			tester.withBranchCheckout(func(repoPath string) {
+				content = strings.Replace(content, "Line 11\n", "", 1) // Remove Line 11 as well
+				require.NoError(t, os.WriteFile(path.Join(repoPath, "file1.md"), []byte(content), 0o644))
+				require.NoError(t, git.NewCommand(t.Context(), "commit", "-a", "--amend", "--no-edit").Run(&git.RunOpts{Dir: repoPath}))
+				require.NoError(t, git.NewCommand(t.Context(), "push", "--force").Run(&git.RunOpts{Dir: repoPath}))
+			})
+
+			diff2 := []diffTableRow{
+				{rowType: RowDelCode, code: "Line 10"},
+				{rowType: RowDelCode, code: "Line 11"},
+				{rowType: RowHasCode, code: "Line 12"},
+			}
+			tester.assertFilesChangedDiff(diff2, "checking commit2 (force push) contents in full PR diff")
+
+			diff1 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff1, "checking commit1 contents in full PR diff")
+			tester.assertCommitDiff(commit1, diff1, "checking commit1 contents in single-commit diff")
+
+			// This comment can still be located in the diff, so it should not be marked as Invalidated/Outdated --
+			// which is kinda guaranteed by it being loaded in the diff, but for test sanity assert specifically.
+			commentReloaded := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: comment.ID})
+			assert.False(t, commentReloaded.Invalidated)
+		})
+
+		t.Run("comment on line commit is rewritten and force-push'd", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify line 50
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "Line 50--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// Place a comment on "Line 50--modified"
+			comment := tester.commentFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -48,3 +48,3 @@
+ Line 48
+ Line 49
+-Line 50
++Line 50--modified`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 50, comment.Line)
+			assert.Equal(t, commit1, comment.CommitSHA)
+			assert.False(t, comment.Invalidated)
+
+			// Add a second commit to the PR which removes  "Line 1" - "Line 10".
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			commit2 := tester.changeFile("file1.md", content)
+
+			// Now, reorganize these commits, so that it's main->commit2->commit1 on the branch, rather than
+			// main->commit1->commit2. Then force push the branch.
+			tester.withBranchCheckout(func(repoPath string) {
+				// move commit2 onto main, off commit1
+				require.NoError(t,
+					git.NewCommand(t.Context(), "rebase").
+						AddArguments("--onto").AddDynamicArguments(tester.initialSHA).
+						AddDynamicArguments(commit1).
+						AddDynamicArguments(commit2).
+						Run(&git.RunOpts{Dir: repoPath}))
+				// move commit1 onto HEAD, off main
+				require.NoError(t,
+					git.NewCommand(t.Context(), "rebase").
+						AddArguments("--onto").AddDynamicArguments("HEAD").
+						AddDynamicArguments(tester.initialSHA).
+						AddDynamicArguments(commit1).
+						Run(&git.RunOpts{Dir: repoPath}))
+
+				// delete branch for the PR
+				has, branch := tester.branch.Get()
+				require.True(t, has)
+				require.NoError(t,
+					git.NewCommand(t.Context(), "branch").
+						AddArguments("-D").AddDynamicArguments(branch).
+						Run(&git.RunOpts{Dir: repoPath}))
+				// call HEAD as the branch
+				require.NoError(t,
+					git.NewCommand(t.Context(), "branch").
+						AddDynamicArguments(branch).
+						Run(&git.RunOpts{Dir: repoPath}))
+
+				// force push the rebuilt branch
+				require.NoError(t, git.NewCommand(t.Context(), "push", "--force", "origin").AddDynamicArguments(branch).Run(&git.RunOpts{Dir: repoPath}))
+			})
+
+			diff2 := []diffTableRow{
+				{rowType: RowDelCode, code: "Line 10"},
+				{rowType: RowHasCode, code: "Line 11"},
+			}
+			tester.assertFilesChangedDiff(diff2, "checking commit2 (force push) contents in full PR diff")
+
+			diff1 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				// no comment visible anymore; force push has lost its place at this time
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff1, "checking commit1 contents in full PR diff")
+
+			// After the force push, the comment we originally left should be marked as invalidated since it can no
+			// longer be resolved to a code location in the PR head. The above tests validate that it no longer appears
+			// in the diff, but this will also happen because of the diff-side check for the correct location -- so
+			// let's check that it's invalidated as well, indicating that it will be shown in the UI as "Outdated". This
+			// usually passes on the first check but is wrapped in Eventually because the async goroutine used in the
+			// pull request testing when the branch is pushed may not be immediately complete.
+			assert.EventuallyWithT(t, func(t *assert.CollectT) {
+				commentReloaded := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: comment.ID})
+				assert.True(t, commentReloaded.Invalidated)
+			}, 1*time.Second, 50*time.Millisecond)
+		})
+
+		t.Run("comment lands on blame with original line number varying from current", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Remove "Line 1" - "Line 10", on the base branch. If you "git blame" Line 50 at that point, it will have
+			// an original line number 50, but actually be appearing at line number index 40, causing wrong outputs.
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			tester.changeFileOnBase("file1.md", content)
+
+			// Now modify "Line 51" in a PR:
+			commitSHA := tester.changeFile("file1.md", strings.Replace(content, "Line 51\n", "Line 51--modified\n", 1))
+			tester.createPR()
+
+			// Place a comment on "Line 50", which would "git blame" to the original commit and line number 50, even
+			// though it's now actually at line number 40.
+			comment := tester.commentFromFilesChanged("file1.md", lineNumber(content, "Line 50"))
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -38,7 +38,7 @@ Line 47
+ Line 48
+ Line 49
+ Line 50`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 50, comment.Line)
+			assert.Equal(t, tester.initialSHA, comment.CommitSHA)
+
+			diff := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowHasCode, code: "Line 50"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowDelCode, code: "Line 51"},
+				{rowType: RowAddCode, code: "Line 51--modified"},
+				{rowType: RowHasCode, code: "Line 52"},
+			}
+			tester.assertFilesChangedDiff(diff)
+			tester.assertCommitDiff(commitSHA, diff)
+		})
+
+		t.Run("comment on specific commit adjusts correctly to later changes in the PR", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify an earlier part of the file in one commit, and then change line numbers in a second commit by
+			// removing some content from the file earlier than the first commit
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "Line 50--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			commit2 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// Create a comment on commit1's "Line 50" change, from the commit-specific view:
+			comment := tester.commentFromSpecificCommit(commit1, "file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -48,3 +48,3 @@
+ Line 48
+ Line 49
+-Line 50
++Line 50--modified`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide())
+			assert.EqualValues(t, 50, comment.Line)
+			assert.Equal(t, commit1, comment.CommitSHA)
+
+			diff50 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff50)
+			tester.assertCommitDiff(commit1, diff50)
+
+			diff10 := []diffTableRow{
+				{rowType: RowDelCode, code: "Line 9"},
+				{rowType: RowDelCode, code: "Line 10"},
+				{rowType: RowHasCode, code: "Line 11"},
+			}
+			tester.assertFilesChangedDiff(diff10)
+			tester.assertCommitDiff(commit2, diff10)
+		})
+
+		t.Run("comment on removed line", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Remove line 50, place a comment on the removed line.
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "", 1)
+			commit := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			comment := tester.commentOnPreviousFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50`, comment.PatchQuoted)
+			assert.Equal(t, "previous", comment.DiffSide())
+			assert.EqualValues(t, -50, comment.Line)
+			assert.Equal(t, tester.initialSHA, comment.CommitSHA) // tracked back to the previous commit where it was line num 50
+
+			diff50 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff50)
+			tester.assertCommitDiff(commit, diff50)
+		})
+
+		t.Run("comment on removed line moves due to a following commit", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Remove line 50, place a comment on the removed line.
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			comment := tester.commentOnPreviousFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50`, comment.PatchQuoted)
+			assert.Equal(t, "previous", comment.DiffSide())
+			assert.EqualValues(t, -50, comment.Line)
+			assert.Equal(t, tester.initialSHA, comment.CommitSHA) // tracked back to the previous commit where it was line num 50
+
+			// Add a second commit to the PR which removes "Line 1" - "Line 10".
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			commit2 := tester.changeFile("file1.md", content)
+
+			diff2 := []diffTableRow{
+				{rowType: RowDelCode, code: "Line 9"},
+				{rowType: RowDelCode, code: "Line 10"},
+				{rowType: RowHasCode, code: "Line 11"},
+			}
+			tester.assertFilesChangedDiff(diff2, "checking commit2 contents in full PR diff")
+			tester.assertCommitDiff(commit2, diff2, "checking commit2 contents in single-commit diff")
+
+			diff1 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff1, "checking commit1 contents in full PR diff")
+			tester.assertCommitDiff(commit1, diff1, "checking commit1 contents in single-commit diff")
+
+			// This comment can still be located in the diff, so it should not be marked as Invalidated/Outdated --
+			// which is kinda guaranteed by it being loaded in the diff, but for test sanity assert specifically.
+			commentReloaded := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: comment.ID})
+			assert.False(t, commentReloaded.Invalidated)
+		})
+
+		t.Run("comment on previous side line unchanged by PR appears", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Change line 50
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "Line 50--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// While viewing the PR, the reviewer made a comment on the previous side on a line of code that wasn't
+			// actually changed in the PR:
+			comment := tester.commentOnPreviousFromFilesChanged("file1.md", 49)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +37,7 @@ Line 46
+ Line 47
+ Line 48
+ Line 49`, comment.PatchQuoted)
+			assert.Equal(t, "proposed", comment.DiffSide()) // will be moved from previous(LHS)->proposed(RHS) because it wasn't a comment on a change in the PR
+			assert.EqualValues(t, 49, comment.Line)
+			assert.Equal(t, tester.initialSHA, comment.CommitSHA)
+
+			diff := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff, "checking commit1 contents in full PR diff")
+			tester.assertCommitDiff(commit1, diff, "checking commit1 contents in single-commit diff")
+		})
+
+		t.Run("comment on first line of file removed", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Remove the first line of the file which will then be commented on, as an edge-case
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 1\n", "", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			comment := tester.commentOnPreviousFromSpecificCommit(commit1, "file1.md", 1)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -1,4 +1,3 @@
+-Line 1`, comment.PatchQuoted)
+			assert.Equal(t, "previous", comment.DiffSide())
+			assert.EqualValues(t, -1, comment.Line)
+			assert.Equal(t, tester.initialSHA, comment.CommitSHA)
+
+			diff := []diffTableRow{
+				{rowType: RowDelCode, code: "Line 1"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 2"},
+			}
+			tester.assertFilesChangedDiff(diff, "checking commit1 contents in full PR diff")
+			tester.assertCommitDiff(commit1, diff, "checking commit1 contents in single-commit diff")
+		})
+
+		t.Run("comment on removed line moves due to a following commit, following commit is rewritten and force-push'd", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify line 50
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "Line 50--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// Place a comment on "Line 50" (removed side)
+			comment := tester.commentOnPreviousFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,7 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50`, comment.PatchQuoted)
+			assert.Equal(t, "previous", comment.DiffSide())
+			assert.EqualValues(t, -50, comment.Line)
+			assert.Equal(t, tester.initialSHA, comment.CommitSHA)
+			assert.False(t, comment.Invalidated)
+
+			// Add a second commit to the PR which removes  "Line 1" - "Line 10".
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			tester.changeFile("file1.md", content)
+
+			// Now amend commit2v1 with an additional change, causing a force push of the branch
+			tester.withBranchCheckout(func(repoPath string) {
+				content = strings.Replace(content, "Line 11\n", "", 1) // Remove Line 11 as well
+				require.NoError(t, os.WriteFile(path.Join(repoPath, "file1.md"), []byte(content), 0o644))
+				require.NoError(t, git.NewCommand(t.Context(), "commit", "-a", "--amend", "--no-edit").Run(&git.RunOpts{Dir: repoPath}))
+				require.NoError(t, git.NewCommand(t.Context(), "push", "--force").Run(&git.RunOpts{Dir: repoPath}))
+			})
+
+			diff2 := []diffTableRow{
+				{rowType: RowDelCode, code: "Line 10"},
+				{rowType: RowDelCode, code: "Line 11"},
+				{rowType: RowHasCode, code: "Line 12"},
+			}
+			tester.assertFilesChangedDiff(diff2, "checking commit2 (force push) contents in full PR diff")
+
+			diff1 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff1, "checking commit1 contents in full PR diff")
+			tester.assertCommitDiff(commit1, diff1, "checking commit1 contents in single-commit diff")
+
+			// This comment can still be located in the diff, so it should not be marked as Invalidated/Outdated --
+			// which is kinda guaranteed by it being loaded in the diff, but for test sanity assert specifically.
+			commentReloaded := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: comment.ID})
+			assert.False(t, commentReloaded.Invalidated)
+		})
+
+		t.Run("comment on removed line invalidated due to force push", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// Modify line 50
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "", 1)
+			tester.changeFile("file1.md", content)
+			tester.createPR()
+
+			// Place a comment on "Line 50" (removed side)
+			comment := tester.commentOnPreviousFromFilesChanged("file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50`, comment.PatchQuoted)
+			assert.Equal(t, "previous", comment.DiffSide())
+			assert.EqualValues(t, -50, comment.Line)
+			assert.Equal(t, tester.initialSHA, comment.CommitSHA)
+			assert.False(t, comment.Invalidated)
+
+			// Now amend commit1 with an additional change that undoes the earlier change, changes something else instead
+			tester.withBranchCheckout(func(repoPath string) {
+				content = strings.Replace(content, "Line 49\n", "Line 49\nLine 50\n", 1)
+				content = strings.Replace(content, "Line 52\n", "", 1)
+				require.NoError(t, os.WriteFile(path.Join(repoPath, "file1.md"), []byte(content), 0o644))
+				require.NoError(t, git.NewCommand(t.Context(), "commit", "-a", "--amend", "--no-edit").Run(&git.RunOpts{Dir: repoPath}))
+				require.NoError(t, git.NewCommand(t.Context(), "push", "--force").Run(&git.RunOpts{Dir: repoPath}))
+			})
+
+			diff := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowHasCode, code: "Line 50"},
+				{rowType: RowHasCode, code: "Line 51"},
+				{rowType: RowDelCode, code: "Line 52"},
+				{rowType: RowHasCode, code: "Line 53"},
+			}
+			tester.assertFilesChangedDiff(diff, "checking commit2 (force push) contents in full PR diff")
+
+			// The comment on "Line 50" can't be valid anymore since that's not in the diff:
+			assert.EventuallyWithT(t, func(t *assert.CollectT) {
+				commentReloaded := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: comment.ID})
+				assert.True(t, commentReloaded.Invalidated)
+			}, 1*time.Second, 50*time.Millisecond)
+		})
+
+		t.Run("comment on removed line in specific commit adjusts to correct location", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			tester := newPullRequestCommentPlacementTester(t)
+
+			// 3 commits: modify line 50, remove line 50, remove some earlier lines
+			content := tester.fileContent
+			content = strings.Replace(content, "Line 50\n", "Line 50--modified\n", 1)
+			commit1 := tester.changeFile("file1.md", content)
+			t.Logf("commit1 = %q", commit1)
+			content = strings.Replace(content, "Line 50--modified\n", "", 1)
+			commit2 := tester.changeFile("file1.md", content)
+			t.Logf("commit2 = %q", commit2)
+			content = strings.Replace(content, "Line 1\nLine 2\nLine 3\nLine 4\nLine 5\nLine 6\nLine 7\nLine 8\nLine 9\nLine 10\n", "", 1)
+			commit3 := tester.changeFile("file1.md", content)
+			t.Logf("commit3 = %q", commit3)
+			tester.createPR()
+
+			comment := tester.commentOnPreviousFromSpecificCommit(commit2, "file1.md", 50)
+			assert.Equal(t, `diff --git a/file1.md b/file1.md
+--- a/file1.md
++++ b/file1.md
+@@ -47,7 +47,6 @@ Line 46
+ Line 47
+ Line 48
+ Line 49
+-Line 50--modified`, comment.PatchQuoted)
+			assert.Equal(t, "previous", comment.DiffSide())
+			assert.EqualValues(t, -50, comment.Line)
+			assert.Equal(t, commit1, comment.CommitSHA)
+
+			diff1 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				{rowType: RowAddCode, code: "Line 50--modified"},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertCommitDiff(commit1, diff1, "checking commit1 contents in single-commit diff")
+
+			diff2 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50--modified"},
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertCommitDiff(commit2, diff2, "checking commit2 contents in single-commit diff")
+
+			diff3 := []diffTableRow{
+				{rowType: RowHasCode, code: "Line 49"},
+				{rowType: RowDelCode, code: "Line 50"},
+				// This is a small bug -- the comment was placed on the code "Line 50--modified" in commit1, which was
+				// later amended by commit2. This comment should be marked out-of-date and not appear here. But the
+				// comment's `ResolveCurrentLine` doesn't quite detect this case correctly -- as the comment's CommitSHA
+				// is commit1, it performs a diff commit1..PR-HEAD, not mergebase..PR-HEAD, and it believes that this
+				// line of code still exists because it exists in that diff range. It's a rare edge case that is defered
+				// for future repair.
+				{rowType: RowComment, commentID: comment.ID},
+				{rowType: RowHasCode, code: "Line 51"},
+			}
+			tester.assertFilesChangedDiff(diff3, "checking overall contents in full PR diff")
+		})
+	})
+}
+
+type PullRequestCommentPlacementTester struct {
+	t           *testing.T
+	user        *user_model.User
+	session     *TestSession
+	apiToken    string
+	fileContent string
+	repo        *repo_model.Repository
+	initialSHA  string
+	branch      optional.Option[string]
+	pr          *api.PullRequest
+}
+
+func newPullRequestCommentPlacementTester(t *testing.T) *PullRequestCommentPlacementTester {
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteIssue)
+	session := loginUser(t, user2.Name)
+
+	var content strings.Builder
+	for i := range 100 {
+		content.WriteString(fmt.Sprintf("Line %d\n", i+1)) // +1 -> make "Line N" appear on the Nth line and avoid off-by-one confusions
+	}
+
+	var initialSHA string
+	repo := forgery.CreateRepository(t, user2, &forgery.CreateRepositoryOptions{
+		Files: forgery.MapFS{
+			"file1.md": forgery.MapFile(content.String()),
+			"file2.md": forgery.MapFile(content.String()),
+		},
+		LatestSha: &initialSHA,
+	})
+
+	return &PullRequestCommentPlacementTester{
+		t:           t,
+		user:        user2,
+		session:     session,
+		apiToken:    token,
+		fileContent: content.String(),
+		repo:        repo,
+		initialSHA:  initialSHA,
+	}
+}
+
+func (tester *PullRequestCommentPlacementTester) changeFileOnBranch(sourceBranch, targetBranch string, targetBranchIsNew bool, filename, newContent string) string {
+	req := NewRequest(tester.t,
+		"GET",
+		fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?ref=%s", tester.repo.OwnerName, tester.repo.Name, filename, sourceBranch)).
+		AddTokenAuth(tester.apiToken)
+	resp := MakeRequest(tester.t, req, http.StatusOK)
+	var existingFile api.ContentsResponse
+	DecodeJSON(tester.t, resp, &existingFile)
+
+	opts := api.UpdateFileOptions{
+		DeleteFileOptions: api.DeleteFileOptions{
+			SHA: existingFile.SHA,
+		},
+		ContentBase64: base64.StdEncoding.EncodeToString([]byte(newContent)),
+	}
+	if targetBranchIsNew {
+		opts.DeleteFileOptions.FileOptions.NewBranchName = targetBranch
+	} else {
+		opts.DeleteFileOptions.FileOptions.BranchName = targetBranch
+	}
+	req = NewRequestWithJSON(tester.t,
+		"PUT",
+		fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s", tester.repo.OwnerName, tester.repo.Name, filename),
+		opts).AddTokenAuth(tester.apiToken)
+	resp = MakeRequest(tester.t, req, http.StatusOK)
+	var updateFileResponse api.FileResponse
+	DecodeJSON(tester.t, resp, &updateFileResponse)
+
+	return updateFileResponse.Commit.SHA
+}
+
+func (tester *PullRequestCommentPlacementTester) changeFileOnBase(filename, newContent string) string {
+	return tester.changeFileOnBranch(tester.repo.DefaultBranch, tester.repo.DefaultBranch, false, filename, newContent)
+}
+
+func (tester *PullRequestCommentPlacementTester) changeFile(filename, newContent string) string {
+	var sourceBranch string // where to get the file's last SHA from
+	branchExists, branch := tester.branch.Get()
+	if !branchExists {
+		branch = fmt.Sprintf("branch-%s", uuid.New().String())
+		tester.branch = optional.Some(branch)
+		sourceBranch = tester.repo.DefaultBranch
+	} else {
+		sourceBranch = branch
+	}
+	return tester.changeFileOnBranch(sourceBranch, branch, !branchExists, filename, newContent)
+}
+
+func (tester *PullRequestCommentPlacementTester) createPR() {
+	branchExists, branch := tester.branch.Get()
+	require.True(tester.t, branchExists)
+	req := NewRequestWithJSON(tester.t, "POST",
+		fmt.Sprintf("/api/v1/repos/%s/%s/pulls", tester.repo.OwnerName, tester.repo.Name),
+		&api.CreatePullRequestOption{
+			Head:  branch,
+			Base:  tester.repo.DefaultBranch,
+			Title: fmt.Sprintf("PR from branch %s", tester.branch),
+		}).AddTokenAuth(tester.apiToken)
+	resp := MakeRequest(tester.t, req, http.StatusCreated)
+	var pr api.PullRequest
+	DecodeJSON(tester.t, resp, &pr)
+	tester.pr = &pr
+}
+
+func (tester *PullRequestCommentPlacementTester) commentFromFilesChanged(filename string, line int) *issues_model.Comment {
+	req := NewRequest(tester.t, "GET",
+		// omit after_commit_id -- new_comment form defaults to fetching the PR head
+		fmt.Sprintf("/%s/%s/pulls/%d/files/reviews/new_comment", tester.repo.OwnerName, tester.repo.Name, tester.pr.Index))
+	resp := tester.session.MakeRequest(tester.t, req, http.StatusOK)
+	return tester.commentFromNewCommentForm(resp, filename, line, "proposed")
+}
+
+func (tester *PullRequestCommentPlacementTester) commentOnPreviousFromFilesChanged(filename string, line int) *issues_model.Comment {
+	req := NewRequest(tester.t, "GET",
+		// omit after_commit_id -- new_comment form defaults to fetching the PR head
+		fmt.Sprintf("/%s/%s/pulls/%d/files/reviews/new_comment", tester.repo.OwnerName, tester.repo.Name, tester.pr.Index))
+	resp := tester.session.MakeRequest(tester.t, req, http.StatusOK)
+	return tester.commentFromNewCommentForm(resp, filename, line, "previous")
+}
+
+func (tester *PullRequestCommentPlacementTester) getCommitParent(commitID string) string {
+	repo, err := gitrepo.OpenRepository(tester.t.Context(), tester.repo)
+	require.NoError(tester.t, err)
+	defer repo.Close()
+	commit, err := repo.GetCommit(commitID)
+	require.NoError(tester.t, err)
+	require.Len(tester.t, commit.Parents, 1)
+	return commit.Parents[0].String()
+}
+
+func (tester *PullRequestCommentPlacementTester) commentFromSpecificCommit(commitID, filename string, line int) *issues_model.Comment {
+	beforeCommitID := tester.getCommitParent(commitID)
+	req := NewRequest(tester.t, "GET",
+		fmt.Sprintf("/%s/%s/pulls/%d/files/reviews/new_comment?before_commit_id=%s&after_commit_id=%s", tester.repo.OwnerName, tester.repo.Name, tester.pr.Index, beforeCommitID, commitID))
+	resp := tester.session.MakeRequest(tester.t, req, http.StatusOK)
+	return tester.commentFromNewCommentForm(resp, filename, line, "proposed")
+}
+
+func (tester *PullRequestCommentPlacementTester) commentOnPreviousFromSpecificCommit(commitID, filename string, line int) *issues_model.Comment {
+	beforeCommitID := tester.getCommitParent(commitID)
+	tester.t.Logf("beforeCommitID(%q) = %q", commitID, beforeCommitID)
+	req := NewRequest(tester.t, "GET",
+		fmt.Sprintf("/%s/%s/pulls/%d/files/reviews/new_comment?before_commit_id=%s&after_commit_id=%s", tester.repo.OwnerName, tester.repo.Name, tester.pr.Index, beforeCommitID, commitID))
+	resp := tester.session.MakeRequest(tester.t, req, http.StatusOK)
+	return tester.commentFromNewCommentForm(resp, filename, line, "previous")
+}
+
+func (tester *PullRequestCommentPlacementTester) commentFromNewCommentForm(resp *httptest.ResponseRecorder, filename string, line int, side string) *issues_model.Comment {
+	commentContent := uuid.New().String()
+	doc := NewHTMLParser(tester.t, resp.Body)
+	tester.t.Logf("doc.before = %q", doc.GetInputValueByName("before_commit_id"))
+	tester.t.Logf("doc.latest = %q", doc.GetInputValueByName("latest_commit_id"))
+	req := NewRequestWithValues(tester.t, "POST",
+		fmt.Sprintf("/%s/%s/pulls/%d/files/reviews/comments", tester.repo.OwnerName, tester.repo.Name, tester.pr.Index),
+		map[string]string{
+			"origin":           doc.GetInputValueByName("origin"),
+			"before_commit_id": doc.GetInputValueByName("before_commit_id"),
+			"latest_commit_id": doc.GetInputValueByName("latest_commit_id"),
+			"side":             side, // "proposed" (RHS) or "previous" (LHS)
+			"line":             strconv.Itoa(line),
+			"path":             filename,
+			"diff_start_cid":   doc.GetInputValueByName("diff_start_cid"),
+			"diff_end_cid":     doc.GetInputValueByName("diff_end_cid"),
+			"diff_base_cid":    doc.GetInputValueByName("diff_base_cid"),
+			"content":          commentContent,
+			"single_review":    "true",
+		})
+	tester.session.MakeRequest(tester.t, req, http.StatusOK)
+
+	comment := unittest.AssertExistsAndLoadBean(tester.t, &issues_model.Comment{Content: commentContent})
+	return comment
+}
+
+func (tester *PullRequestCommentPlacementTester) withBranchCheckout(action func(string)) {
+	dstPath := tester.t.TempDir()
+	cloneURL, _ := url.Parse(tester.repo.CloneLink().HTTPS)
+	cloneURL.User = url.UserPassword(tester.user.LoginName, userPassword)
+	require.NoError(tester.t, git.CloneWithArgs(tester.t.Context(), nil, cloneURL.String(), dstPath, git.CloneRepoOptions{}))
+	doGitSetRemoteURL(dstPath, "origin", cloneURL)(tester.t)
+
+	branchExists, branch := tester.branch.Get()
+	require.True(tester.t, branchExists)
+	require.NoError(tester.t, git.NewCommand(tester.t.Context(), "checkout").AddDynamicArguments(branch).Run(&git.RunOpts{Dir: dstPath}))
+
+	action(dstPath)
+}
+
+func (tester *PullRequestCommentPlacementTester) assertFilesChangedDiff(rowAssertions []diffTableRow, note ...string) {
+	req := NewRequest(tester.t, "GET",
+		fmt.Sprintf("/%s/%s/pulls/%d/files", tester.repo.OwnerName, tester.repo.Name, tester.pr.Index))
+	resp := tester.session.MakeRequest(tester.t, req, http.StatusOK)
+	doc := NewHTMLParser(tester.t, resp.Body)
+	var testNote string
+	if len(note) == 0 {
+		testNote = "contents in single-commit diff"
+	} else {
+		testNote = note[0]
+	}
+	assertDiffTable(tester.t, doc, rowAssertions, testNote)
+}
+
+func (tester *PullRequestCommentPlacementTester) assertCommitDiff(commitSHA string, rowAssertions []diffTableRow, note ...string) {
+	req := NewRequest(tester.t, "GET",
+		fmt.Sprintf("/%s/%s/pulls/%d/commits/%s", tester.repo.OwnerName, tester.repo.Name, tester.pr.Index, commitSHA))
+	resp := tester.session.MakeRequest(tester.t, req, http.StatusOK)
+	doc := NewHTMLParser(tester.t, resp.Body)
+	var testNote string
+	if len(note) == 0 {
+		testNote = "contents in full PR diff"
+	} else {
+		testNote = note[0]
+	}
+	assertDiffTable(tester.t, doc, rowAssertions, testNote)
+}
+
+func lineNumber(content, line string) int {
+	return slices.Index(strings.Split(content, "\n"), line) + 1
+}
+
+type diffTableRowType int
+
+const (
+	RowHasCode diffTableRowType = iota
+	RowAddCode
+	RowDelCode
+	RowComment
+)
+
+type diffTableRow struct {
+	rowType diffTableRowType
+	// RowHasCode, RowAddCode, RowDelCode
+	code string
+	// RowComment
+	commentID int64
+}
+
+func nodeText(node *html.Node) string {
+	if node.Type == html.TextNode {
+		return node.Data
+	}
+	var builder strings.Builder
+	for child := range node.ChildNodes() {
+		childText := strings.TrimSpace(nodeText(child))
+		builder.WriteString(childText)
+	}
+	return builder.String()
+}
+
+func nodeAttr(node *html.Node, key string) string {
+	for _, attr := range node.Attr {
+		if attr.Key == key {
+			return attr.Val
+		}
+	}
+	return ""
+}
+
+func checkDiffTableRow(t *testing.T, tableRow *html.Node, rowAssertion diffTableRow) string {
+	switch rowAssertion.rowType {
+	case RowHasCode:
+		text := nodeText(tableRow)
+		if text != rowAssertion.code {
+			return fmt.Sprintf("wanted diff %q, but found diff %q", rowAssertion.code, text)
+		}
+	case RowDelCode:
+		dataLineType := nodeAttr(tableRow, "data-line-type")
+		if dataLineType != "del" {
+			return fmt.Sprintf("wanted delete code in diff, but found data-line-type=%q", dataLineType)
+		}
+		text := nodeText(tableRow)
+		if text != rowAssertion.code {
+			return fmt.Sprintf("wanted delete code with line %q, but found diff %q", rowAssertion.code, text)
+		}
+	case RowAddCode:
+		dataLineType := nodeAttr(tableRow, "data-line-type")
+		if dataLineType != "add" {
+			return fmt.Sprintf("wanted add code in diff, but found data-line-type=%q", dataLineType)
+		}
+		text := nodeText(tableRow)
+		if text != rowAssertion.code {
+			return fmt.Sprintf("wanted add code with line %q, but found diff %q", rowAssertion.code, text)
+		}
+	case RowComment:
+		class := nodeAttr(tableRow, "class")
+		if class != "add-comment" {
+			return fmt.Sprintf("wanted comment in diff, but found class=%q", class)
+		}
+		found := false
+		for desc := range tableRow.Descendants() {
+			descID := nodeAttr(desc, "id")
+			if descID == fmt.Sprintf("code-comments-%d", rowAssertion.commentID) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return fmt.Sprintf("wanted comment with ID %d, but could not be identified", rowAssertion.commentID)
+		}
+	}
+	return ""
+}
+
+func assertDiffTable(t *testing.T, doc *HTMLDoc, rowAssertions []diffTableRow, note string) {
+	require.NotEmpty(t, rowAssertions)
+
+	diffTable := doc.Find("table.chroma")
+	require.Equal(t, 1, diffTable.Length())
+
+	rows := diffTable.Find("tbody > tr[data-line-type]") // [data-line-type] is used to avoid matching tables within comment boxes
+
+	// Find the first row to match rowAssertions[0], and then we'll iterate from there matching each row exactly.
+	tableFirstRowIndex := 0
+	foundFirst := false
+	firstRowMismatches := []string{}
+	for ; tableFirstRowIndex < rows.Length(); tableFirstRowIndex++ {
+		mismatch := checkDiffTableRow(t, rows.Get(tableFirstRowIndex), rowAssertions[0])
+		if mismatch == "" {
+			foundFirst = true
+			break
+		}
+		firstRowMismatches = append(firstRowMismatches, mismatch)
+	}
+	if !foundFirst {
+		// We're going to fail because we couldn't find the first row in rowAssertions -- this can be tricky to debug so
+		// help out by outputting all the rows we looked at that didn't match:
+		t.Log("first row mismatches:")
+		for _, mm := range firstRowMismatches {
+			t.Logf("\t%s", mm)
+		}
+		require.Failf(t, "unable to find first row", "test %s: failed to find first row assertion", note)
+	}
+
+	for idx, assertion := range rowAssertions {
+		if idx == 0 { // skip first row assertion, already checked to find tableFirstRowIndex
+			continue
+		}
+
+		tableIdx := tableFirstRowIndex + idx
+		if tableIdx >= rows.Length() {
+			require.Failf(t, "ran out of table rows", "test %s: row assertion at index %d couldn't be satisfied", note, idx)
+		}
+
+		tableRow := rows.Get(tableIdx)
+		check := checkDiffTableRow(t, tableRow, assertion)
+		if check != "" {
+			assert.Failf(t, check, "test %s: row assertion at index %d couldn't be satisfied", note, idx)
+		}
+	}
+}
diff --git a/tests/integration/quota_use_test.go b/tests/integration/quota_use_test.go
index dd5afd1aed..fb9619adee 100644
--- a/tests/integration/quota_use_test.go
+++ b/tests/integration/quota_use_test.go
@@ -19,7 +19,6 @@ import (
 	org_model "forgejo.org/models/organization"
 	quota_model "forgejo.org/models/quota"
 	repo_model "forgejo.org/models/repo"
-	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/setting"
@@ -29,8 +28,8 @@ import (
 	app_context "forgejo.org/services/context"
 	repo_service "forgejo.org/services/repository"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
-	gouuid "github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1025,13 +1024,13 @@ func createQuotaWebEnv(t *testing.T) *quotaWebEnv {
 		user := quotaWebEnvUser{}
 
 		// Create the user
-		userName := gouuid.NewString()
-		apiCreateUser(t, userName)
-		user.User = unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: userName})
-		user.Session = loginUser(t, userName)
+		user.User = forgery.CreateUser(t, nil)
+		user.Session = loginUser(t, user.User.Name)
 
 		// Create a repository for the user
-		repo, _, _ := tests.CreateDeclarativeRepoWithOptions(t, user.User, tests.DeclarativeRepoOptions{})
+		repo := forgery.CreateRepository(t, user.User, &forgery.CreateRepositoryOptions{
+			Files: forgery.FilesInit{},
+		})
 		user.Repo = repo
 
 		return user
@@ -1072,25 +1071,21 @@ func createQuotaWebEnv(t *testing.T) *quotaWebEnv {
 		org := quotaWebEnvOrg{}
 
 		// Create the org
-		userName := gouuid.NewString()
-		org.Org = &org_model.Organization{
-			Name: userName,
-		}
-		err := org_model.CreateOrganization(db.DefaultContext, org.Org, owner)
-		require.NoError(t, err)
+		org.Org = forgery.CreateOrganisation(t, owner)
 
 		// Create a repository for the org
-		orgUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: org.Org.ID})
-		repo, _, _ := tests.CreateDeclarativeRepoWithOptions(t, orgUser, tests.DeclarativeRepoOptions{})
+		repo := forgery.CreateRepository(t, org.Org.AsUser(), &forgery.CreateRepositoryOptions{
+			Files: forgery.FilesInit{},
+		})
 		org.Repo = repo
 
 		// Create a quota group for them
-		group, err := quota_model.CreateGroup(db.DefaultContext, userName)
+		group, err := quota_model.CreateGroup(db.DefaultContext, org.Org.Name)
 		require.NoError(t, err)
 		org.QuotaGroup = group
 
 		// Create a rule
-		rule, err := quota_model.CreateRule(db.DefaultContext, userName, limit, quota_model.LimitSubjects{quota_model.LimitSubjectSizeAll})
+		rule, err := quota_model.CreateRule(db.DefaultContext, org.Org.Name, limit, quota_model.LimitSubjects{quota_model.LimitSubjectSizeAll})
 		require.NoError(t, err)
 		org.QuotaRule = rule
 
diff --git a/tests/integration/repo_archive_text_test.go b/tests/integration/repo_archive_text_test.go
index f0e88a8343..5a76e1e47b 100644
--- a/tests/integration/repo_archive_text_test.go
+++ b/tests/integration/repo_archive_text_test.go
@@ -63,7 +63,7 @@ func testRepoArchiveElements(t *testing.T, tr translation.Locale, doc *HTMLDoc,
 
 	// Test modal
 	modal := doc.Find("#archive-repo-modal")
-	testRepoArchiveElement(t, tr, modal, ".header", opType+".header")
+	testRepoArchiveElement(t, tr, modal, "header", opType+".header")
 	testRepoArchiveElement(t, tr, modal, ".message", opType+".text")
 	testRepoArchiveElement(t, tr, modal, ".button.red", opType+".button")
 }
diff --git a/tests/integration/repo_commits_search_test.go b/tests/integration/repo_commits_search_test.go
index 5d7d215678..30ee0e55ef 100644
--- a/tests/integration/repo_commits_search_test.go
+++ b/tests/integration/repo_commits_search_test.go
@@ -24,6 +24,7 @@ func testRepoCommitsSearch(t *testing.T, query, commit string) {
 	doc := NewHTMLParser(t, resp.Body)
 	sel := doc.doc.Find("#commits-table tbody tr td.sha a")
 	assert.Equal(t, commit, strings.TrimSpace(sel.Text()))
+	doc.AssertElement(t, ".repo-path", false)
 }
 
 func TestRepoCommitsSearch(t *testing.T) {
diff --git a/tests/integration/repo_commits_test.go b/tests/integration/repo_commits_test.go
index d2bb4e8849..26522fe481 100644
--- a/tests/integration/repo_commits_test.go
+++ b/tests/integration/repo_commits_test.go
@@ -34,6 +34,7 @@ func TestRepoCommits(t *testing.T) {
 	commitURL, exists := doc.doc.Find("#commits-table tbody tr td.sha a").Attr("href")
 	assert.True(t, exists)
 	assert.NotEmpty(t, commitURL)
+	doc.AssertElement(t, ".repo-path", false)
 }
 
 func doTestRepoCommitWithStatus(t *testing.T, state string, classes ...string) {
diff --git a/tests/integration/repo_forgefed_test.go b/tests/integration/repo_forgefed_test.go
new file mode 100644
index 0000000000..dbad115082
--- /dev/null
+++ b/tests/integration/repo_forgefed_test.go
@@ -0,0 +1,219 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"net/url"
+	"testing"
+
+	"forgejo.org/models/db"
+	"forgejo.org/models/forgefed"
+	"forgejo.org/models/unittest"
+	"forgejo.org/models/user"
+	"forgejo.org/modules/setting"
+	"forgejo.org/modules/test"
+	"forgejo.org/routers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestForgefedRepositoryCreateHostValid(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		// Arrange
+		ctx := t.Context()
+
+		// Act
+		err := forgefed.CreateFederationHost(ctx, &forgefed.FederationHost{
+			HostFqdn:   "forgejo.example.com",
+			HostPort:   80,
+			HostSchema: "http",
+			NodeInfo: forgefed.NodeInfo{
+				SoftwareName: "forgejo",
+			},
+		})
+
+		// Assert
+		require.NoError(t, err)
+		unittest.AssertExistsAndLoadBean(t, &forgefed.FederationHost{HostFqdn: "forgejo.example.com"})
+	})
+}
+
+func TestForgefedRepositoryCreateHostInvalid(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		// Arrange
+		ctx := t.Context()
+
+		// Act
+		err := forgefed.CreateFederationHost(ctx, &forgefed.FederationHost{
+			// invalid
+		})
+
+		// Assert
+		require.Error(t, err)
+		unittest.AssertNotExistsBean(t, &forgefed.FederationHost{HostFqdn: "forgejo.example.com"})
+	})
+}
+
+func TestForgefedRepositoryCreateUserValid(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		// Arrange
+		ctx := t.Context()
+
+		err := forgefed.CreateFederationHost(ctx, &forgefed.FederationHost{
+			HostFqdn:   "forgejo.example.com",
+			HostPort:   80,
+			HostSchema: "http",
+			NodeInfo: forgefed.NodeInfo{
+				SoftwareName: "forgejo",
+			},
+		})
+		require.NoError(t, err)
+
+		// Act
+		err = user.CreateFederatedUser(ctx, &user.User{
+			Name:  "@bob@forgejo.example.com",
+			Email: "bob@forgejo.example.com",
+		}, &user.FederatedUser{
+			ExternalID:       "1",
+			FederationHostID: 1,
+			InboxPath:        "/inbox",
+		})
+
+		// Assert
+		require.NoError(t, err)
+		localUser := unittest.AssertExistsAndLoadBean(t, &user.User{Name: "@bob@forgejo.example.com", Email: "bob@forgejo.example.com"})
+		unittest.AssertExistsAndLoadBean(t, &user.FederatedUser{UserID: localUser.ID, FederationHostID: 1})
+	})
+}
+
+func TestForgefedRepositoryCreateUserInvalid(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		// Arrange
+		ctx := t.Context()
+
+		err := forgefed.CreateFederationHost(ctx, &forgefed.FederationHost{
+			HostFqdn:   "forgejo.example.com",
+			HostPort:   80,
+			HostSchema: "http",
+			NodeInfo: forgefed.NodeInfo{
+				SoftwareName: "forgejo",
+			},
+		})
+		require.NoError(t, err)
+
+		// Act
+		err = user.CreateFederatedUser(ctx, &user.User{
+			Name:  "@bob@forgejo.example.com",
+			Email: "bob@forgejo.example.com",
+		}, &user.FederatedUser{
+			// invalid
+		})
+
+		// Assert
+		require.Error(t, err)
+		unittest.AssertNotExistsBean(t, &user.User{Email: "bob@forgejo.example.com"})
+		unittest.AssertNotExistsBean(t, &user.FederatedUser{FederationHostID: 1})
+	})
+}
+
+func TestForgefedRepositoryFindHostsAndUsers(t *testing.T) {
+	defer test.MockVariableValue(&setting.Federation.Enabled, true)()
+	defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
+	defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		// Arrange
+		ctx := t.Context()
+
+		err := forgefed.CreateFederationHost(ctx, &forgefed.FederationHost{
+			HostFqdn:   "bob.example.com",
+			HostPort:   80,
+			HostSchema: "http",
+			NodeInfo: forgefed.NodeInfo{
+				SoftwareName: "forgejo",
+			},
+		})
+		require.NoError(t, err)
+
+		err = forgefed.CreateFederationHost(ctx, &forgefed.FederationHost{
+			HostFqdn:   "alice.example.com",
+			HostPort:   443,
+			HostSchema: "https",
+			NodeInfo: forgefed.NodeInfo{
+				SoftwareName: "gitea",
+			},
+		})
+		require.NoError(t, err)
+
+		err = user.CreateFederatedUser(ctx, &user.User{
+			Name:  "@bob@bob.example.com",
+			Email: "bob@bob.example.com",
+		}, &user.FederatedUser{
+			ExternalID:       "1",
+			FederationHostID: 1,
+			InboxPath:        "/inbox",
+		})
+		require.NoError(t, err)
+
+		err = user.CreateFederatedUser(ctx, &user.User{
+			Name:  "@alice@alice.example.com",
+			Email: "alice@alice.example.com",
+		}, &user.FederatedUser{
+			ExternalID:       "1",
+			FederationHostID: 2,
+			InboxPath:        "/inbox",
+		})
+		require.NoError(t, err)
+
+		err = user.CreateFederatedUser(ctx, &user.User{
+			Name:  "@eve@alice.example.com",
+			Email: "eve@alice.example.com",
+		}, &user.FederatedUser{
+			ExternalID:       "2",
+			FederationHostID: 2,
+			InboxPath:        "/inbox",
+		})
+		require.NoError(t, err)
+
+		// Act & Assert
+		hosts, err := forgefed.FindFederationHosts(ctx, db.ListOptions{PageSize: 100, Page: 1})
+		require.NoError(t, err)
+		assert.Len(t, hosts, 2)
+		hostFqdns := []string{hosts[0].HostFqdn, hosts[1].HostFqdn}
+		assert.Contains(t, hostFqdns, "bob.example.com")
+		assert.Contains(t, hostFqdns, "alice.example.com")
+
+		count, err := forgefed.CountFederationHosts(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, int64(2), count)
+
+		users, err := user.FindFederatedUsers(ctx, db.ListOptions{PageSize: 100, Page: 1})
+		require.NoError(t, err)
+		assert.Len(t, users, 3) // Bob, Alice and Eve
+
+		count, err = user.CountFederatedUsers(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, int64(3), count)
+
+		users, err = user.FindFederatedUsersByHostID(ctx, 1, db.ListOptions{PageSize: 100, Page: 1})
+		require.NoError(t, err)
+		assert.Len(t, users, 1) // Only Bob belongs to the host with ID 1
+		assert.Equal(t, int64(1), users[0].FederationHostID)
+
+		count, err = user.CountFederatedUsersByHostID(ctx, 1)
+		require.NoError(t, err)
+		assert.Equal(t, int64(1), count)
+
+		users, err = user.FindFederatedUsersByHostID(ctx, 2, db.ListOptions{PageSize: 100, Page: 1})
+		require.NoError(t, err)
+		assert.Len(t, users, 2) // Alice and Eve belong to the host with ID 2
+		assert.Equal(t, int64(2), users[0].FederationHostID)
+		assert.Equal(t, int64(2), users[1].FederationHostID)
+
+		count, err = user.CountFederatedUsersByHostID(ctx, 2)
+		require.NoError(t, err)
+		assert.Equal(t, int64(2), count)
+	})
+}
diff --git a/tests/integration/repo_generate_test.go b/tests/integration/repo_generate_test.go
index 637f0a478d..aec2a89719 100644
--- a/tests/integration/repo_generate_test.go
+++ b/tests/integration/repo_generate_test.go
@@ -17,12 +17,11 @@ import (
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	"forgejo.org/modules/test"
 	"forgejo.org/modules/translation"
-	files_service "forgejo.org/services/repository/files"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -243,40 +242,27 @@ func TestRepoGenerateTemplating(t *testing.T) {
 		expected := `# %s
 	This is a Repo By %s
 	ThisIsThe%sInAnInlineWay`
-		templateName := "my_template"
-		generatedName := "my_generated"
 
-		userName := "user1"
-		session := loginUser(t, userName)
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: userName})
-
-		template, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			Name:       optional.Some(templateName),
-			IsTemplate: optional.Some(true),
-			Files: optional.Some([]*files_service.ChangeRepoFile{
-				{
-					Operation:     "create",
-					TreePath:      ".forgejo/template",
-					ContentReader: strings.NewReader("**/Readme.md"),
-				},
-				{
-					Operation:     "create",
-					TreePath:      "dira-${REPO_NAME}/dirb-${REPO_NAME}/Readme.md",
-					ContentReader: strings.NewReader(input),
-				},
-			}),
+		template := forgery.CreateRepository(t, nil, &forgery.CreateRepositoryOptions{
+			IsTemplate: true,
+			Files: forgery.MapFS{
+				".forgejo/template":                             forgery.MapFile("**/Readme.md"),
+				"dira-${REPO_NAME}/dirb-${REPO_NAME}/Readme.md": forgery.MapFile(input),
+			},
 		})
-		defer f()
+		user := template.Owner
+		session := loginUser(t, user.Name)
 
 		// The repo.TemplateID field is not initialized. Luckily, the ID field holds the expected value
 		templateID := strconv.FormatInt(template.ID, 10)
+		generatedName := "my_generated"
 
 		testRepoGenerateSuccess(
 			t,
 			session,
 			templateID,
 			user.Name,
-			templateName,
+			template.Name,
 			user,
 			user,
 			generatedName,
@@ -310,9 +296,10 @@ func TestRepoGenerateTemplating(t *testing.T) {
 
 func TestRepoGenerateTemplatingSymlink(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, u *url.URL) {
-		userName := "user1"
-		session := loginUser(t, userName)
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: userName})
+		user := forgery.CreateUser(t, &forgery.CreateUserOptions{
+			IsAdmin: true, // required to see the detailed error message on the error response
+		})
+		session := loginUser(t, user.Name)
 
 		testCases := []struct {
 			name          string
@@ -337,34 +324,18 @@ func TestRepoGenerateTemplatingSymlink(t *testing.T) {
 
 		for i, tc := range testCases {
 			t.Run(tc.name, func(t *testing.T) {
-				templateName := fmt.Sprintf("my_template-%d", i)
-				generatedName := fmt.Sprintf("my_generated-%d", i)
-				template, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-					Name:       optional.Some(templateName),
-					IsTemplate: optional.Some(true),
-					Files: optional.Some([]*files_service.ChangeRepoFile{
-						{
-							Operation:     "create",
-							TreePath:      ".forgejo/template",
-							ContentReader: strings.NewReader("**/Readme.md"),
-						},
-						{
-							Operation:     "create",
-							TreePath:      "actual-contents.txt",
-							ContentReader: strings.NewReader("Here are some contents. $REPO_NAME"),
-						},
-						{
-							Operation:     "create",
-							TreePath:      "problem/Readme.md",
-							ContentReader: strings.NewReader(tc.symlinkTarget),
-							Options:       files_service.RepoFileOptionMode(git.EntryModeSymlink),
-						},
-					}),
+				template := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{
+					IsTemplate: true,
+					Files: forgery.MapFS{
+						".forgejo/template":   forgery.MapFile("**/Readme.md"),
+						"actual-contents.txt": forgery.MapFile("Here are some contents. $REPO_NAME"),
+						"problem/Readme.md":   forgery.MapSymlink(tc.symlinkTarget),
+					},
 				})
-				defer f()
 
 				// The repo.TemplateID field is not initialized. Luckily, the ID field holds the expected value
 				templateID := strconv.FormatInt(template.ID, 10)
+				generatedName := fmt.Sprintf("my_generated-%d", i)
 
 				if tc.expectedError != "" {
 					resp := testRepoGenerateFailure(
@@ -372,7 +343,7 @@ func TestRepoGenerateTemplatingSymlink(t *testing.T) {
 						session,
 						templateID,
 						user.Name,
-						templateName,
+						template.Name,
 						user,
 						user,
 						generatedName,
@@ -384,7 +355,7 @@ func TestRepoGenerateTemplatingSymlink(t *testing.T) {
 						session,
 						templateID,
 						user.Name,
-						templateName,
+						template.Name,
 						user,
 						user,
 						generatedName,
@@ -419,36 +390,28 @@ func TestRepoGenerateTemplatingSymlink(t *testing.T) {
 
 func TestRepoGenerateTemplatingSymlinkGlobFile(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, u *url.URL) {
-		templateName := "my_template"
-		generatedName := "my_generated"
-
-		userName := "user1"
-		session := loginUser(t, userName)
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: userName})
-
-		template, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			Name:       optional.Some(templateName),
-			IsTemplate: optional.Some(true),
-			Files: optional.Some([]*files_service.ChangeRepoFile{
-				{
-					Operation:     "create",
-					TreePath:      ".forgejo/template",
-					ContentReader: strings.NewReader("/etc/passwd"),
-					Options:       files_service.RepoFileOptionMode(git.EntryModeSymlink),
-				},
-			}),
+		user := forgery.CreateUser(t, &forgery.CreateUserOptions{
+			IsAdmin: true, // required to see the detailed error message on the error response
+		})
+		session := loginUser(t, user.Name)
+
+		template := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{
+			IsTemplate: true,
+			Files: forgery.MapFS{
+				".forgejo/template": forgery.MapSymlink("/etc/passwd"),
+			},
 		})
-		defer f()
 
 		// The repo.TemplateID field is not initialized. Luckily, the ID field holds the expected value
 		templateID := strconv.FormatInt(template.ID, 10)
+		generatedName := "my_generated"
 
 		resp := testRepoGenerateFailure(
 			t,
 			session,
 			templateID,
 			user.Name,
-			templateName,
+			template.Name,
 			user,
 			user,
 			generatedName,
diff --git a/tests/integration/repo_mergecommit_revert_test.go b/tests/integration/repo_mergecommit_revert_test.go
index 9ddf39eaaa..8cbe8a8142 100644
--- a/tests/integration/repo_mergecommit_revert_test.go
+++ b/tests/integration/repo_mergecommit_revert_test.go
@@ -5,29 +5,29 @@ package integration
 
 import (
 	"net/http"
+	"net/url"
 	"testing"
 
-	"forgejo.org/tests"
-
 	"github.com/stretchr/testify/assert"
 )
 
 func TestRepoMergeCommitRevert(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
-	session := loginUser(t, "user2")
+	onApplicationRun(t, func(t *testing.T, _ *url.URL) {
+		session := loginUser(t, "user2")
 
-	req := NewRequestWithValues(t, "POST", "/user2/test_commit_revert/_cherrypick/deebcbc752e540bab4ce3ee713d3fc8fdc35b2f7/main", map[string]string{
-		"last_commit":     "deebcbc752e540bab4ce3ee713d3fc8fdc35b2f7",
-		"page_has_posted": "true",
-		"revert":          "true",
-		"commit_summary":  "reverting test commit",
-		"commit_message":  "test message",
-		"commit_choice":   "direct",
-		"new_branch_name": "test-revert-branch-1",
-		"commit_mail_id":  "-1",
+		req := NewRequestWithValues(t, "POST", "/user2/test_commit_revert/_cherrypick/deebcbc752e540bab4ce3ee713d3fc8fdc35b2f7/main", map[string]string{
+			"last_commit":     "deebcbc752e540bab4ce3ee713d3fc8fdc35b2f7",
+			"page_has_posted": "true",
+			"revert":          "true",
+			"commit_summary":  "reverting test commit",
+			"commit_message":  "test message",
+			"commit_choice":   "direct",
+			"new_branch_name": "test-revert-branch-1",
+			"commit_mail_id":  "-1",
+		})
+		resp := session.MakeRequest(t, req, http.StatusSeeOther)
+
+		// A successful revert redirects to the main branch
+		assert.Equal(t, "/user2/test_commit_revert/src/branch/main", resp.Header().Get("Location"))
 	})
-	resp := session.MakeRequest(t, req, http.StatusSeeOther)
-
-	// A successful revert redirects to the main branch
-	assert.Equal(t, "/user2/test_commit_revert/src/branch/main", resp.Header().Get("Location"))
 }
diff --git a/tests/integration/repo_star_federation_test.go b/tests/integration/repo_star_federation_test.go
index d6f31ed246..3b5fc0d802 100644
--- a/tests/integration/repo_star_federation_test.go
+++ b/tests/integration/repo_star_federation_test.go
@@ -18,6 +18,8 @@ import (
 	"forgejo.org/modules/test"
 	"forgejo.org/modules/validation"
 	"forgejo.org/tests"
+
+	ap "github.com/go-ap/activitypub"
 )
 
 func TestActivityPubRepoFollowing(t *testing.T) {
@@ -69,7 +71,7 @@ func TestActivityPubRepoFollowing(t *testing.T) {
 		}
 		activityType := like.Type
 		object := like.Object.GetLink().String()
-		isLikeType := activityType == "Like"
+		isLikeType := activityType == ap.LikeType
 		isCorrectObject := strings.HasSuffix(object, "/api/v1/activitypub/repository-id/1")
 		if !isLikeType || !isCorrectObject {
 			t.Error("Activity is not a like for this repo")
diff --git a/tests/integration/repo_test.go b/tests/integration/repo_test.go
index 1b4a574f13..16dc7cd483 100644
--- a/tests/integration/repo_test.go
+++ b/tests/integration/repo_test.go
@@ -24,7 +24,6 @@ import (
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
-	"forgejo.org/modules/optional"
 	"forgejo.org/modules/setting"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/test"
@@ -32,6 +31,7 @@ import (
 	repo_service "forgejo.org/services/repository"
 	files_service "forgejo.org/services/repository/files"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -70,7 +70,7 @@ func testViewRepo(t *testing.T) {
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	htmlDoc := NewHTMLParser(t, resp.Body)
-	files := htmlDoc.doc.Find("#repo-files-table  > TBODY > TR")
+	files := htmlDoc.doc.Find("#repo-files-table > tbody > tr:not(.commit-list)")
 
 	type file struct {
 		fileName   string
@@ -1039,7 +1039,7 @@ func TestRepoFilesList(t *testing.T) {
 		resp := MakeRequest(t, req, http.StatusOK)
 
 		htmlDoc := NewHTMLParser(t, resp.Body)
-		filesList := htmlDoc.Find("#repo-files-table tbody tr").Map(func(_ int, s *goquery.Selection) string {
+		filesList := htmlDoc.Find("#repo-files-table tbody tr:not(.commit-list)").Map(func(_ int, s *goquery.Selection) string {
 			return s.AttrOr("data-entryname", "")
 		})
 
@@ -1079,7 +1079,7 @@ func TestRepoFollowSymlink(t *testing.T) {
 
 	t.Run("Normal", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
-		assertCase(t, "/user2/readme-test/src/branch/symlink/up/back/down/down/README.md", "/user2/readme-test/src/branch/symlink/down/side/../left/right/../reelmein", true)
+		assertCase(t, "/user2/readme-test/src/branch/symlink/up/back/down/down/README.md", "/user2/readme-test/src/branch/symlink/up/down/left/reelmein", true)
 	})
 
 	t.Run("Broken symlink", func(t *testing.T) {
@@ -1369,21 +1369,17 @@ func TestInitInstructions(t *testing.T) {
 
 	forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
 		defer tests.PrintCurrentTest(t)()
-		name := objectFormat.Name()
+
 		var init string
-		if name == "sha1" {
+		if objectFormat == git.Sha1ObjectFormat {
 			init = "git init"
 		} else {
-			init = fmt.Sprintf("git init --object-format=%s", name)
+			init = fmt.Sprintf("git init --object-format=%s", objectFormat.Name())
 		}
 
-		repo, _, f := tests.CreateDeclarativeRepoWithOptions(t, user, tests.DeclarativeRepoOptions{
-			Name:         optional.Some(name + "-instruction"),
-			AutoInit:     optional.Some(false),
-			EnabledUnits: optional.Some([]unit_model.Type{unit_model.TypeCode}),
-			ObjectFormat: optional.Some(name),
+		repo := forgery.CreateRepository(t, user, &forgery.CreateRepositoryOptions{
+			ObjectFormat: objectFormat,
 		})
-		defer f()
 
 		portMatcher := regexp.MustCompile(`localhost:\d+`)
 		resp := session.MakeRequest(t, NewRequest(t, "GET", "/"+repo.FullName()), http.StatusOK)
@@ -1394,7 +1390,7 @@ func TestInitInstructions(t *testing.T) {
 git switch -c main
 git add README.md
 git commit -m "first commit"
-git remote add origin http://localhost/user2/%s-instruction.git
-git push -u origin main`, init, name), portMatcher.ReplaceAllString(htmlDoc.Find(".empty-repo-guide code").First().Text(), "localhost"))
+git remote add origin http://localhost/user2/%s.git
+git push -u origin main`, init, repo.Name), portMatcher.ReplaceAllString(htmlDoc.Find(".empty-repo-guide code").First().Text(), "localhost"))
 	})
 }
diff --git a/tests/integration/signin_test.go b/tests/integration/signin_test.go
index c9b2d6ed1c..0367bedd6e 100644
--- a/tests/integration/signin_test.go
+++ b/tests/integration/signin_test.go
@@ -97,6 +97,36 @@ func TestSigninWithRememberMe(t *testing.T) {
 	session.MakeRequest(t, req, http.StatusOK)
 }
 
+func TestProviderDisplayNameIsPathEscaped(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	testCases := []string{
+		"sla/shed",
+		"per%cent",
+		"que?ry=string",
+		"ha#sh",
+		"spa ce",     // doesn't break the path
+		"pl+us",      // unchanged by url.PathEscape
+		"amper&sand", // unchanged by url.PathEscape
+	}
+
+	for _, testCase := range testCases {
+		// GitLab is only used here for convenience.
+		addAuthSource(t, authSourcePayloadGitLabCustom(testCase))
+	}
+
+	request := NewRequest(t, "GET", "/user/login")
+	response := MakeRequest(t, request, http.StatusOK)
+	htmlDoc := NewHTMLParser(t, response.Body)
+
+	for _, testCase := range testCases {
+		t.Run(testCase, func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			htmlDoc.AssertElement(t, fmt.Sprintf("a.oauth-login-link[href='/user/oauth2/%s']", url.PathEscape(testCase)), true)
+		})
+	}
+}
+
 func TestDisableSignin(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 	// Mock alternative auth ways as enabled
diff --git a/tests/integration/view_test.go b/tests/integration/view_test.go
index bc858e71e8..fee9393409 100644
--- a/tests/integration/view_test.go
+++ b/tests/integration/view_test.go
@@ -139,7 +139,7 @@ func TestCommitListActions(t *testing.T) {
 			[]*files_service.ChangeRepoFile{
 				{
 					Operation:     "create",
-					TreePath:      "test.sh",
+					TreePath:      "test/test.sh",
 					ContentReader: strings.NewReader("Hello there!"),
 				},
 			},
@@ -162,7 +162,7 @@ func TestCommitListActions(t *testing.T) {
 			htmlDoc.AssertElement(t, fmt.Sprintf(".commit-list a[href^='/%s/src/commit/']", repo.FullName()), false)
 		})
 
-		fileDiffSelector := fmt.Sprintf(".commit-list a[href='/%s/commit/%s?files=test.sh']", repo.FullName(), commitID)
+		fileDiffSelector := fmt.Sprintf(".commit-list a[href='/%s/commit/%s?files=test/test.sh']", repo.FullName(), commitID)
 		t.Run("Commit list", func(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
 
@@ -177,12 +177,19 @@ func TestCommitListActions(t *testing.T) {
 		t.Run("File history", func(t *testing.T) {
 			defer tests.PrintCurrentTest(t)()
 
-			req := NewRequest(t, "GET", repo.Link()+"/commits/branch/main/test.sh")
+			req := NewRequest(t, "GET", repo.Link()+"/commits/branch/main/test/test.sh")
 			resp := session.MakeRequest(t, req, http.StatusOK)
 			htmlDoc := NewHTMLParser(t, resp.Body)
 
-			htmlDoc.AssertElement(t, fmt.Sprintf(".commit-list a[href='/%s/src/commit/%s/test.sh']", repo.FullName(), commitID), true)
+			htmlDoc.AssertElement(t, fmt.Sprintf(".commit-list a[href='/%s/src/commit/%s/test/test.sh']", repo.FullName(), commitID), true)
 			htmlDoc.AssertElement(t, fileDiffSelector, true)
+
+			htmlDoc.AssertElement(t, ".repo-path", true)
+			htmlDoc.AssertElement(t, fmt.Sprintf(".repo-path a[href='/%s/src/branch/main'][title='%s']", repo.FullName(), repo.Name), true)
+			assert.Equal(t, 2, htmlDoc.Find(".repo-path .breadcrumb-divider").Length())
+			htmlDoc.AssertElement(t, fmt.Sprintf(".repo-path .section a[href='/%s/src/branch/main/test'][title='test']", repo.FullName()), true)
+			htmlDoc.AssertElement(t, ".repo-path .active[title='test.sh']", true)
+			htmlDoc.AssertElement(t, ".repo-path button[data-clipboard-text='test/test.sh']", true)
 		})
 	})
 }
diff --git a/tests/integration/wiki_test.go b/tests/integration/wiki_test.go
index 1fd9378852..efccd20ef8 100644
--- a/tests/integration/wiki_test.go
+++ b/tests/integration/wiki_test.go
@@ -20,10 +20,10 @@ import (
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/git"
-	"forgejo.org/modules/optional"
 	api "forgejo.org/modules/structs"
 	"forgejo.org/modules/util"
 	"forgejo.org/tests"
+	"forgejo.org/tests/forgery"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/google/uuid"
@@ -95,11 +95,10 @@ func doRepoWikiGitOperation(t *testing.T, serverURL *url.URL, method RepoWikiMet
 	repo := "repo1"
 	if target == RepoWikiPrivate {
 		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
-		privateRepo, _, reset := tests.CreateDeclarativeRepoWithOptions(t, user2, tests.DeclarativeRepoOptions{
-			IsPrivate:    optional.Some(true),
-			EnabledUnits: optional.Some([]unit_model.Type{unit_model.TypeWiki}),
+		privateRepo := forgery.CreateRepository(t, user2, &forgery.CreateRepositoryOptions{
+			IsPrivate: true,
 		})
-		defer reset()
+		forgery.EnableRepoUnit(t, privateRepo, unit_model.TypeWiki, nil)
 
 		session := loginUser(t, user2.LoginName)
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
diff --git a/tests/test_utils.go b/tests/test_utils.go
index 5e5b04c860..8314e8c58a 100644
--- a/tests/test_utils.go
+++ b/tests/test_utils.go
@@ -15,10 +15,10 @@ import (
 	"path"
 	"path/filepath"
 	"runtime"
-	"slices"
 	"strings"
 	"sync/atomic"
 	"testing"
+	"testing/fstest"
 	"time"
 
 	"forgejo.org/models/db"
@@ -29,10 +29,9 @@ import (
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/base"
 	"forgejo.org/modules/git"
-	"forgejo.org/modules/gitrepo"
 	"forgejo.org/modules/graceful"
 	"forgejo.org/modules/log"
-	"forgejo.org/modules/optional"
+	"forgejo.org/modules/options"
 	"forgejo.org/modules/process"
 	repo_module "forgejo.org/modules/repository"
 	"forgejo.org/modules/setting"
@@ -40,12 +39,10 @@ import (
 	"forgejo.org/modules/testlogger"
 	"forgejo.org/modules/util"
 	"forgejo.org/routers"
-	repo_service "forgejo.org/services/repository"
+	"forgejo.org/services/notify"
 	files_service "forgejo.org/services/repository/files"
-	wiki_service "forgejo.org/services/wiki"
+	"forgejo.org/tests/forgery"
 
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"xorm.io/xorm/convert"
 
@@ -386,169 +383,74 @@ func Printf(format string, args ...any) {
 	testlogger.Printf(format, args...)
 }
 
-type DeclarativeRepoOptions struct {
-	Name          optional.Option[string]
-	EnabledUnits  optional.Option[[]unit_model.Type]
-	DisabledUnits optional.Option[[]unit_model.Type]
-	UnitConfig    optional.Option[map[unit_model.Type]convert.Conversion]
-	Files         optional.Option[[]*files_service.ChangeRepoFile]
-	WikiBranch    optional.Option[string]
-	AutoInit      optional.Option[bool]
-	IsTemplate    optional.Option[bool]
-	ObjectFormat  optional.Option[string]
-	IsPrivate     optional.Option[bool]
-}
-
-func CreateDeclarativeRepoWithOptions(t *testing.T, owner *user_model.User, opts DeclarativeRepoOptions) (*repo_model.Repository, string, func()) {
-	t.Helper()
-
-	// Not using opts.Name.ValueOrDefault() here to avoid unnecessarily
-	// generating an UUID when a name is specified.
-	var repoName string
-	if has, value := opts.Name.Get(); has {
-		repoName = value
-	} else {
-		repoName = uuid.NewString()
-	}
-
-	var autoInit bool
-	if has, value := opts.AutoInit.Get(); has {
-		autoInit = value
-	} else {
-		autoInit = true
-	}
-
-	// Create the repository
-	repo, err := repo_service.CreateRepository(db.DefaultContext, owner, owner, repo_service.CreateRepoOptions{
-		Name:             repoName,
-		Description:      "Temporary Repo",
-		AutoInit:         autoInit,
-		Gitignores:       "",
-		License:          "WTFPL",
-		Readme:           "Default",
-		DefaultBranch:    "main",
-		IsTemplate:       opts.IsTemplate.ValueOrZeroValue(),
-		ObjectFormatName: opts.ObjectFormat.ValueOrZeroValue(),
-		IsPrivate:        opts.IsPrivate.ValueOrZeroValue(),
-	})
-	require.NoError(t, err)
-	assert.NotEmpty(t, repo)
-
-	// Populate `enabledUnits` if we have any enabled.
-	var enabledUnits []repo_model.RepoUnit
-	if has, units := opts.EnabledUnits.Get(); has {
-		enabledUnits = make([]repo_model.RepoUnit, len(units))
-
-		for i, unitType := range units {
-			var config convert.Conversion
-			if cfg, ok := opts.UnitConfig.ValueOrZeroValue()[unitType]; ok {
-				config = cfg
-			}
-			enabledUnits[i] = repo_model.RepoUnit{
-				RepoID: repo.ID,
-				Type:   unitType,
-				Config: config,
-			}
-		}
-	}
-
-	// Adjust the repo units according to our parameters.
-	if opts.EnabledUnits.Has() || opts.DisabledUnits.Has() {
-		err := repo_service.UpdateRepositoryUnits(db.DefaultContext, repo, enabledUnits, opts.DisabledUnits.ValueOrDefault(nil))
-		require.NoError(t, err)
-	}
-
-	// Add files, if any.
-	var sha string
-	if has, files := opts.Files.Get(); has {
-		assert.True(t, autoInit, "Files cannot be specified if AutoInit is disabled")
-
-		commitID, err := gitrepo.GetBranchCommitID(git.DefaultContext, repo, "main")
-		require.NoError(t, err)
-
-		resp, err := files_service.ChangeRepoFiles(git.DefaultContext, repo, owner, &files_service.ChangeRepoFilesOptions{
-			Files:     files,
-			Message:   "add files",
-			OldBranch: "main",
-			NewBranch: "main",
-			Author: &files_service.IdentityOptions{
-				Name:  owner.Name,
-				Email: owner.Email,
-			},
-			Committer: &files_service.IdentityOptions{
-				Name:  owner.Name,
-				Email: owner.Email,
-			},
-			Dates: &files_service.CommitDateOptions{
-				Author:    time.Now(),
-				Committer: time.Now(),
-			},
-			LastCommitID: commitID,
-		})
-		require.NoError(t, err)
-		assert.NotEmpty(t, resp)
-
-		sha = resp.Commit.SHA
-	}
-
-	// If there's a Wiki branch specified, create a wiki, and a default wiki page.
-	if has, value := opts.WikiBranch.Get(); has {
-		// Set the wiki branch in the database first
-		repo.WikiBranch = value
-		err := repo_model.UpdateRepositoryCols(db.DefaultContext, repo, "wiki_branch")
-		require.NoError(t, err)
-
-		// Initialize the wiki
-		err = wiki_service.InitWiki(db.DefaultContext, repo)
-		require.NoError(t, err)
-
-		// Add a new wiki page
-		err = wiki_service.AddWikiPage(db.DefaultContext, owner, repo, "Home", "Welcome to the wiki!", "Add a Home page")
-		require.NoError(t, err)
-	}
-
-	// Return the repo, the top commit, and a defer-able function to delete the
-	// repo.
-	return repo, sha, func() {
-		_ = repo_service.DeleteRepository(db.DefaultContext, owner, repo, false)
-	}
-}
-
+// Deprecated: use forgery.CreateRepository instead
 func CreateDeclarativeRepo(t *testing.T, owner *user_model.User, name string, enabledUnits, disabledUnits []unit_model.Type, files []*files_service.ChangeRepoFile) (*repo_model.Repository, string, func()) {
 	t.Helper()
 
-	var opts DeclarativeRepoOptions
-
-	if name != "" {
-		opts.Name = optional.Some(name)
+	opts := &forgery.CreateRepositoryOptions{
+		LatestSha: new(string),
+		Name:      name,
 	}
-	if enabledUnits != nil {
-		opts.EnabledUnits = optional.Some(enabledUnits)
 
-		if slices.Contains(enabledUnits, unit_model.TypePullRequests) {
-			opts.UnitConfig = optional.Some(map[unit_model.Type]convert.Conversion{
-				unit_model.TypePullRequests: &repo_model.PullRequestsConfig{
-					AllowMerge:           true,
-					AllowRebase:          true,
-					AllowRebaseMerge:     true,
-					AllowSquash:          true,
-					AllowFastForwardOnly: true,
-					AllowManualMerge:     true,
-					AllowRebaseUpdate:    true,
-					DefaultMergeStyle:    repo_model.MergeStyleMerge,
-					DefaultUpdateStyle:   repo_model.UpdateStyleMerge,
-				},
-			})
+	if len(files) > 0 {
+		licenseData, err := options.License("CC0-1.0")
+		require.NoError(t, err)
+		mfs := forgery.MapFS{
+			"README.md": forgery.MapFile("# " + t.Name() + "\n\nThis is a test repo created via test_utils"),
+			"LICENSE":   &fstest.MapFile{Data: licenseData},
 		}
+		for _, f := range files {
+			require.Empty(t, f.FromTreePath, f.TreePath)
+			if f.Operation != "create" {
+				require.Equal(t, "README.md", f.TreePath, "%q operation only expected on README.md", f.Operation)
+				if f.Operation == "delete" {
+					delete(mfs, f.TreePath)
+					continue
+				}
+				require.Equal(t, "update", f.Operation, "only update/delete operations are supported on README.md")
+			}
+			if f.SHA != "" {
+				require.Nil(t, f.ContentReader, f.TreePath)
+				mfs[f.TreePath] = forgery.MapSubmodule(f.SHA)
+			} else {
+				require.Nil(t, f.Options, f.TreePath)
+
+				data, err := io.ReadAll(f.ContentReader)
+				require.NoError(t, err)
+				mfs[f.TreePath] = &fstest.MapFile{
+					Data: data,
+				}
+			}
+		}
+		opts.Files = mfs
+	} else {
+		opts.Files = forgery.FilesInit{}
+	}
+
+	repo := forgery.CreateRepository(t, owner, opts)
+	notify.CreateRepository(t.Context(), owner, owner, repo) // CreateDeclarativeRepoWithOptions didn't call CreateRepositoryDirectly; notify manually to keep the same behavior
+
+	for _, unitType := range enabledUnits {
+		var config convert.Conversion
+		if unitType == unit_model.TypePullRequests {
+			config = &repo_model.PullRequestsConfig{
+				AllowMerge:           true,
+				AllowRebase:          true,
+				AllowRebaseMerge:     true,
+				AllowSquash:          true,
+				AllowFastForwardOnly: true,
+				AllowManualMerge:     true,
+				AllowRebaseUpdate:    true,
+				DefaultMergeStyle:    repo_model.MergeStyleMerge,
+				DefaultUpdateStyle:   repo_model.UpdateStyleMerge,
+			}
+		}
+		forgery.EnableRepoUnit(t, repo, unitType, config)
 	}
 	if disabledUnits != nil {
-		opts.DisabledUnits = optional.Some(disabledUnits)
+		forgery.DisableRepoUnits(t, repo, disabledUnits...)
 	}
-	if files != nil {
-		opts.Files = optional.Some(files)
-	}
-
-	return CreateDeclarativeRepoWithOptions(t, owner, opts)
+	return repo, *opts.LatestSha, func() {}
 }
 
 func WriteImageBody(t *testing.T, buff bytes.Buffer, filename string, body *bytes.Buffer) string {
diff --git a/tests/unittest.ini.tmpl b/tests/unittest.ini.tmpl
new file mode 100644
index 0000000000..a2925b42e7
--- /dev/null
+++ b/tests/unittest.ini.tmpl
@@ -0,0 +1,2 @@
+[security]
+INSTALL_LOCK = true
diff --git a/web_src/css/actions.css b/web_src/css/actions.css
index cb96bdeac6..82149378b9 100644
--- a/web_src/css/actions.css
+++ b/web_src/css/actions.css
@@ -3,11 +3,11 @@
 }
 
 .runner-container .ui.table.segment {
-  overflow-x: auto;
+  overflow-inline: auto;
 }
 
 .runner-container .runner-ops > a {
-  margin-left: 0.5em;
+  margin-inline-start: 0.5em;
 }
 
 .runner-container .runner-ops-delete {
@@ -124,7 +124,7 @@
   flex: none;
   font-weight: var(--font-weight-medium);
   width: 12rem;
-  padding-right: 1.5rem;
+  padding-inline-end: 1.5rem;
 }
 
 .runner-container dl dd {
@@ -178,12 +178,11 @@
 }
 #workflow_dispatch_dropdown .menu {
   max-height: 500px;
-  overflow-x: auto;
+  overflow-inline: auto;
 }
 @media (max-width: 640px) or (767.98px < width < 854px) {
   #workflow_dispatch_dropdown .menu {
-    left: auto;
-    right: 0;
+    inset-inline: auto 0;
   }
 }
 
@@ -210,7 +209,7 @@
 .ui.vertical.menu.actions-menu .item .error {
   display: flex;
   align-items: center;
-  margin-left: 1rem;
+  margin-inline-start: 1rem;
 }
 
 .ui.vertical.menu.actions-menu .item .label {
diff --git a/web_src/css/admin.css b/web_src/css/admin.css
index 873b1bf91e..1c041dd6f0 100644
--- a/web_src/css/admin.css
+++ b/web_src/css/admin.css
@@ -24,7 +24,7 @@
 }
 
 .admin dl.admin-dl-horizontal dd {
-  margin-left: auto;
+  margin-inline-start: auto;
   width: calc(100% - 300px - 1em);
   min-width: 100px;
 }
@@ -36,7 +36,7 @@
 }
 
 .admin .ui.table.segment {
-  overflow-x: auto; /* if the screen width is small, many wide tables (eg: user list) need scroll bars */
+  overflow-inline: auto; /* if the screen width is small, many wide tables (eg: user list) need scroll bars */
 }
 
 .admin .table th {
diff --git a/web_src/css/base.css b/web_src/css/base.css
index 68b5c7b323..0f1b122fa6 100644
--- a/web_src/css/base.css
+++ b/web_src/css/base.css
@@ -74,7 +74,7 @@ body {
   tab-size: var(--tab-size);
   display: flex;
   flex-direction: column;
-  overflow-x: visible;
+  overflow-inline: visible;
   overflow-wrap: break-word;
   text-autospace: normal;
   text-spacing-trim: normal;
@@ -361,6 +361,11 @@ a.label,
   background: var(--color-hover);
 }
 
+.ui.search > .results .content {
+  padding: 0;
+  background: none;
+}
+
 .inline-code-block {
   padding: 2px 4px;
   border-radius: .24em;
@@ -385,7 +390,7 @@ a.label,
 }
 
 .ui.menu .item > .svg {
-  margin-right: 0.35em;
+  margin-inline-end: 0.35em;
 }
 
 .ui.menu .dropdown.item:hover,
@@ -474,7 +479,7 @@ a.label,
   margin-bottom: -0.25rem;
 }
 .ui.dropdown .menu > .item > svg {
-  margin-right: .78rem; /* use the same margin as for <img> */
+  margin-inline-end: .78rem; /* use the same margin as for <img> */
 }
 
 .ui.selection.dropdown .menu > .item {
@@ -503,9 +508,8 @@ a.label,
 
 /* extend fomantic style '.ui.dropdown > .text > img' to include svg.img */
 .ui.dropdown > .text > .img {
-  margin-left: 0;
+  margin-inline: 0 0.78571429rem;
   float: none;
-  margin-right: 0.78571429rem;
 }
 
 .ui.dropdown > .text > .description,
@@ -516,13 +520,11 @@ a.label,
 /* replace item margin on secondary menu items with gap and remove both the
    negative margins on the menu as well as margin on the items */
 .ui.secondary.menu {
-  margin-left: 0;
-  margin-right: 0;
+  margin-inline: 0;
   gap: .35714286em;
 }
 .ui.secondary.menu .item {
-  margin-left: 0;
-  margin-right: 0;
+  margin-inline: 0;
 }
 
 .ui.secondary.menu .dropdown.item:hover,
@@ -764,15 +766,15 @@ img.ui.avatar,
 }
 
 .ui .text.left {
-  text-align: left !important;
+  text-align: start !important;
 }
 
 .ui .text.right {
-  text-align: right !important;
+  text-align: end !important;
 }
 
 .ui .text.truncate {
-  overflow-x: hidden;
+  overflow-inline: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
   display: inline-block;
@@ -783,14 +785,13 @@ img.ui.avatar,
 }
 
 .ui .message > ul {
-  margin-left: auto;
-  margin-right: auto;
+  margin-inline: auto;
   display: table;
-  text-align: left;
+  text-align: start;
 }
 
 .ui .header > i + .content {
-  padding-left: 0.75rem;
+  padding-inline-start: 0.75rem;
   vertical-align: middle;
 }
 
@@ -803,7 +804,7 @@ img.ui.avatar,
 }
 
 .ui .form .sub.field {
-  margin-left: 25px;
+  margin-inline-start: 25px;
 }
 
 .ui .button.truncate {
@@ -813,11 +814,11 @@ img.ui.avatar,
   text-overflow: ellipsis;
   vertical-align: top;
   white-space: nowrap;
-  margin-right: 6px;
+  margin-inline-end: 6px;
 }
 
 .ui.status.buttons .svg {
-  margin-right: 4px;
+  margin-inline-end: 4px;
 }
 
 .ui.inline.delete-button {
@@ -897,14 +898,13 @@ img.ui.avatar,
 }
 
 .ui.pagination.menu.narrow .item {
-  padding-left: 8px;
-  padding-right: 8px;
+  padding-inline: 8px;
   min-width: 1em;
   text-align: center;
 }
 
 .ui.pagination.menu.narrow .item .icon {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 
 .ui.floating.dropdown .overflow.menu .scrolling.menu.items {
@@ -928,7 +928,7 @@ img.ui.avatar,
 
 .color-preview {
   display: inline-block;
-  margin-left: 0.4em;
+  margin-inline-start: 0.4em;
   height: 0.67em;
   width: 0.67em;
   border-radius: var(--border-radius);
@@ -944,35 +944,35 @@ img.ui.avatar,
 }
 
 blockquote.attention-note {
-  border-left-color: var(--color-blue-dark-1);
+  border-inline-start-color: var(--color-blue-dark-1);
 }
 strong.attention-note, svg.attention-note {
   color: var(--color-blue-dark-1);
 }
 
 blockquote.attention-tip {
-  border-left-color: var(--color-success-text);
+  border-inline-start-color: var(--color-success-text);
 }
 strong.attention-tip, svg.attention-tip {
   color: var(--color-success-text);
 }
 
 blockquote.attention-important {
-  border-left-color: var(--color-violet-dark-1);
+  border-inline-start-color: var(--color-violet-dark-1);
 }
 strong.attention-important, svg.attention-important {
   color: var(--color-violet-dark-1);
 }
 
 blockquote.attention-warning {
-  border-left-color: var(--color-warning-text);
+  border-inline-start-color: var(--color-warning-text);
 }
 strong.attention-warning, svg.attention-warning {
   color: var(--color-warning-text);
 }
 
 blockquote.attention-caution {
-  border-left-color: var(--color-red-dark-1);
+  border-inline-start-color: var(--color-red-dark-1);
 }
 strong.attention-caution, svg.attention-caution {
   color: var(--color-red-dark-1);
@@ -985,7 +985,7 @@ strong.attention-caution, svg.attention-caution {
 overflow-menu {
   border-bottom: 1px solid var(--color-secondary) !important;
   display: flex;
-  overflow-x: auto;
+  overflow-inline: auto;
 }
 
 overflow-menu .overflow-menu-items {
@@ -1003,7 +1003,7 @@ overflow-menu .overflow-menu-items .item > .svg {
 }
 
 overflow-menu .ui.label {
-  margin-left: 7px !important; /* save some space */
+  margin-inline-start: 7px !important; /* save some space */
 }
 
 .activity-bar-graph {
@@ -1053,7 +1053,7 @@ overflow-menu .ui.label {
 
 .lines-num {
   padding: 0 8px;
-  text-align: right !important;
+  text-align: end !important;
   color: var(--color-text-light-2);
   width: 1%;
   font-family: var(--fonts-monospace);
@@ -1100,7 +1100,7 @@ overflow-menu .ui.label {
 .lines-code ol li {
   display: block;
   width: calc(100% - 1ch);
-  padding-left: 1ch;
+  padding-inline-start: 1ch;
 }
 
 .code-inner {
@@ -1151,7 +1151,7 @@ overflow-menu .ui.label {
 .blame-avatar {
   display: flex;
   align-items: center;
-  margin-right: 4px;
+  margin-inline-end: 4px;
 }
 
 .top-line-blame {
@@ -1196,7 +1196,7 @@ table th[data-sortt-desc]:hover {
 
 table th[data-sortt-asc] .svg,
 table th[data-sortt-desc] .svg {
-  margin-left: 0.25rem;
+  margin-inline-start: 0.25rem;
 }
 
 .ui.dropdown .menu .item {
@@ -1286,7 +1286,7 @@ table th[data-sortt-desc] .svg {
 .flash-error details code,
 .flash-warning details code {
   display: block;
-  text-align: left;
+  text-align: start;
 }
 
 .truncated-item-container {
@@ -1315,7 +1315,7 @@ table th[data-sortt-desc] .svg {
   display: flex;
   flex-direction: column;
   justify-content: center;
-  margin-left: 1em;
+  margin-inline-start: 1em;
 }
 
 .precolors .color {
@@ -1336,13 +1336,13 @@ table th[data-sortt-desc] .svg {
 
 .ui.dropdown.mini.button,
 .ui.dropdown.tiny.button {
-  padding-right: 20px;
+  padding-inline-end: 20px;
 }
 .ui.dropdown.button {
-  padding-right: 22px;
+  padding-inline-end: 22px;
 }
 .ui.dropdown.large.button {
-  padding-right: 24px;
+  padding-inline-end: 24px;
 }
 
 /* Gitea uses SVG images instead of Fomantic builtin "<i>" font icons, so we need to reset the icon styles */
@@ -1365,11 +1365,11 @@ table th[data-sortt-desc] .svg {
 }
 
 .ui.ui.dropdown > .dropdown.icon {
-  right: 0.5em;
+  inset-inline-end: 0.5em;
 }
 
 .ui.ui.dropdown > .remove.icon {
-  right: 2em;
+  inset-inline-end: 2em;
 }
 
 .btn,
diff --git a/web_src/css/chroma/base.css b/web_src/css/chroma/base.css
index bce13332f8..deac36063b 100644
--- a/web_src/css/chroma/base.css
+++ b/web_src/css/chroma/base.css
@@ -25,13 +25,13 @@
 
 /* LineNumbersTable */
 .chroma .lnt {
-  margin-right: 0.4em;
+  margin-inline-end: 0.4em;
   padding: 0 0.4em;
 }
 
 /* LineNumbers */
 .chroma .ln {
-  margin-right: 0.4em;
+  margin-inline-end: 0.4em;
   padding: 0 0.4em;
 }
 
diff --git a/web_src/css/codemirror/base.css b/web_src/css/codemirror/base.css
index aedf7d8560..556639e71f 100644
--- a/web_src/css/codemirror/base.css
+++ b/web_src/css/codemirror/base.css
@@ -15,7 +15,7 @@
 }
 
 .EasyMDEContainer .CodeMirror.CodeMirror-fullscreen.CodeMirror-focused {
-  border-right: 1px solid var(--color-primary) !important;
+  border-inline-end: 1px solid var(--color-primary) !important;
 }
 
 .CodeMirror-cursor {
diff --git a/web_src/css/dashboard.css b/web_src/css/dashboard.css
index 9c81ccc38a..44f56efaf9 100644
--- a/web_src/css/dashboard.css
+++ b/web_src/css/dashboard.css
@@ -17,7 +17,7 @@
 
 .dashboard.feeds .filter.menu .item,
 .dashboard.issues .filter.menu .item {
-  text-align: left;
+  text-align: start;
   display: flex;
   align-items: center;
   justify-content: space-between;
@@ -32,15 +32,14 @@
 .dashboard.feeds .filter.menu .jump.item,
 .dashboard.issues .filter.menu .jump.item {
   margin: 1px;
-  padding-right: 0;
+  padding-inline-end: 0;
 }
 
 .dashboard.feeds .filter.menu .menu,
 .dashboard.issues .filter.menu .menu {
   max-height: 300px;
-  overflow-x: auto;
-  right: 0 !important;
-  left: auto !important;
+  overflow-inline: auto;
+  inset-inline: auto 0 !important;
 }
 
 @media (max-width: 767.98px) {
@@ -64,11 +63,11 @@
 }
 
 .dashboard .secondary-nav .right.menu div.item {
-  padding-left: 0.5rem;
+  padding-inline-start: 0.5rem;
 }
 
 .dashboard .secondary-nav .org-visibility .label {
-  margin-left: 5px;
+  margin-inline-start: 5px;
 }
 
 .dashboard .secondary-nav .ui.dropdown {
diff --git a/web_src/css/editor/combomarkdowneditor.css b/web_src/css/editor/combomarkdowneditor.css
index 77af4cb87b..2a1593b091 100644
--- a/web_src/css/editor/combomarkdowneditor.css
+++ b/web_src/css/editor/combomarkdowneditor.css
@@ -47,7 +47,7 @@
   display: block;
   width: 100%;
   max-height: calc(100vh - var(--min-height-textarea));
-  resize: vertical;
+  resize: block;
 }
 
 .combo-markdown-editor .CodeMirror-scroll {
@@ -127,7 +127,7 @@ text-expander .suggestions li:hover {
 
 text-expander .suggestions .fullname {
   font-weight: var(--font-weight-normal);
-  margin-left: 4px;
+  margin-inline-start: 4px;
   color: var(--color-text-light-1);
 }
 
@@ -140,5 +140,5 @@ text-expander .suggestions li[aria-selected="true"] span {
 text-expander .suggestions img {
   width: 24px;
   height: 24px;
-  margin-right: 8px;
+  margin-inline-end: 8px;
 }
diff --git a/web_src/css/editor/fileeditor.css b/web_src/css/editor/fileeditor.css
index 444ee8c7e7..287a4c7caa 100644
--- a/web_src/css/editor/fileeditor.css
+++ b/web_src/css/editor/fileeditor.css
@@ -7,8 +7,8 @@
 }
 
 .repository.file.editor .tab[data-tab="write"] .CodeMirror {
-  border-left: 0;
-  border-right: 0;
+  border-inline-start: 0;
+  border-inline-end: 0;
   border-bottom: 0;
 }
 
@@ -36,8 +36,8 @@
 }
 
 .editor-toolbar i.separator {
-  border-left: none;
-  border-right-color: var(--color-secondary);
+  border-inline-start: none;
+  border-inline-end-color: var(--color-secondary);
 }
 
 .editor-toolbar button:hover {
diff --git a/web_src/css/explore.css b/web_src/css/explore.css
index 5cdee823c0..0a09592eeb 100644
--- a/web_src/css/explore.css
+++ b/web_src/css/explore.css
@@ -5,7 +5,7 @@
 .explore .secondary-nav .svg {
   width: 16px;
   text-align: center;
-  margin-right: 5px;
+  margin-inline-end: 5px;
 }
 
 .ui.repository.branches .info {
@@ -27,5 +27,5 @@
 
 /* fix alignment of PR popup in branches table */
 .ui.repository.branches table .ui.popup {
-  text-align: left;
+  text-align: start;
 }
diff --git a/web_src/css/features/codeeditor.css b/web_src/css/features/codeeditor.css
index afa6637654..9b45e4e669 100644
--- a/web_src/css/features/codeeditor.css
+++ b/web_src/css/features/codeeditor.css
@@ -16,7 +16,7 @@
   #editor-bar {
     gap: var(--button-spacing);
     .switch {
-      overflow-x: scroll;
+      overflow-inline: scroll;
     }
   }
 }
@@ -24,7 +24,7 @@
 .cm-panel.fj-search {
   position: absolute;
   top: 0;
-  right: 0;
+  inset-inline-end: 0;
   background-color: var(--color-body);
   box-shadow: 0 6px 18px var(--color-shadow);
   border-radius: 0.3rem;
diff --git a/web_src/css/features/colorpicker.css b/web_src/css/features/colorpicker.css
index b7436783df..30b6bc7cc2 100644
--- a/web_src/css/features/colorpicker.css
+++ b/web_src/css/features/colorpicker.css
@@ -6,14 +6,14 @@
 .js-color-picker-input input {
   padding-top: 8px !important;
   padding-bottom: 8px !important;
-  padding-left: 32px !important;
+  padding-inline-start: 32px !important;
 }
 
 .js-color-picker-input .preview-square {
   position: absolute;
   aspect-ratio: 1;
   height: 16px;
-  left: 10px;
+  inset-inline-start: 10px;
   top: 50%;
   transform: translateY(-50%);
   border-radius: 2px;
diff --git a/web_src/css/features/gitgraph.css b/web_src/css/features/gitgraph.css
index 9f44e884b7..1ba09118d8 100644
--- a/web_src/css/features/gitgraph.css
+++ b/web_src/css/features/gitgraph.css
@@ -1,5 +1,5 @@
 #git-graph-content {
-  overflow-x: auto;
+  overflow-inline: auto;
   width: 100%;
   min-height: 250px;
 }
@@ -25,7 +25,7 @@
   }
 
   #git-graph-heading-left {
-    margin-right: 1rem;
+    margin-inline-end: 1rem;
   }
 
   #git-graph-heading h2 {
@@ -102,8 +102,8 @@
 
 #git-graph-container #rel-container {
   max-width: 30%;
-  overflow-x: auto;
-  float: left;
+  overflow-inline: auto;
+  float: inline-start;
 }
 
 #git-graph-container #rev-list {
@@ -117,7 +117,7 @@
 
 #git-graph-container #rev-list .commit-refs .button {
   padding: 2px 4px;
-  margin-right: 0.25em;
+  margin-inline-end: 0.25em;
   display: inline-block;
   max-width: 200px;
   overflow: hidden;
diff --git a/web_src/css/features/heatmap.css b/web_src/css/features/heatmap.css
index c064590c46..f2b0609186 100644
--- a/web_src/css/features/heatmap.css
+++ b/web_src/css/features/heatmap.css
@@ -40,19 +40,19 @@
   font-size: 11px;
   position: absolute;
   bottom: 0;
-  left: 25px;
+  inset-inline-start: 25px;
 }
 
 @media (max-width: 1200px) {
   #user-heatmap .total-contributions {
-    left: 21px;
+    inset-inline-start: 21px;
   }
 }
 
 @media (max-width: 1000px) {
   #user-heatmap .total-contributions {
     font-size: 10px;
-    left: 17px;
+    inset-inline-start: 17px;
     bottom: -4px;
   }
 }
diff --git a/web_src/css/features/imagediff.css b/web_src/css/features/imagediff.css
index c8ead2ba4a..95ff384f19 100644
--- a/web_src/css/features/imagediff.css
+++ b/web_src/css/features/imagediff.css
@@ -54,28 +54,28 @@
 
 .image-diff-container .diff-swipe .swipe-frame .swipe-container {
   position: absolute;
-  right: 0;
+  inset-inline-end: 0;
   display: block;
-  border-left: 2px solid var(--color-secondary-dark-8);
+  border-inline-start: 2px solid var(--color-secondary-dark-8);
   height: 100%;
   overflow: hidden;
 }
 
 .image-diff-container .diff-swipe .swipe-frame .swipe-container .after-container {
   position: absolute;
-  right: 0;
+  inset-inline-end: 0;
 }
 
 .image-diff-container .diff-swipe .swipe-frame .swipe-bar {
   position: absolute;
   height: 100%;
   top: 0;
-  left: 0;
+  inset-inline-start: 0;
 }
 
 .image-diff-container .diff-swipe .swipe-frame .swipe-bar .handle {
   background: var(--color-secondary-dark-8);
-  left: -5px;
+  inset-inline-start: -5px;
   height: 12px;
   width: 12px;
   position: absolute;
diff --git a/web_src/css/features/projects.css b/web_src/css/features/projects.css
index 3a1808dfe3..939357d429 100644
--- a/web_src/css/features/projects.css
+++ b/web_src/css/features/projects.css
@@ -2,7 +2,7 @@
   display: flex;
   flex-direction: row;
   flex-wrap: nowrap;
-  overflow-x: auto;
+  overflow-inline: auto;
   margin: 0 0.5em;
 }
 
@@ -15,7 +15,7 @@
   width: 320px;
   height: calc(100vh - 450px);
   min-height: 60vh;
-  overflow-y: scroll;
+  overflow-block: scroll;
   flex: 0 0 auto;
   overflow: visible;
   display: flex;
@@ -57,7 +57,7 @@
   padding: 0 !important;
   flex-wrap: nowrap !important;
   flex-direction: column;
-  overflow-x: auto;
+  overflow-inline: auto;
   gap: .25rem;
 }
 
@@ -68,11 +68,11 @@
 }
 
 .project-column:first-child {
-  margin-left: auto !important;
+  margin-inline-start: auto !important;
 }
 
 .project-column:last-child {
-  margin-right: auto !important;
+  margin-inline-end: auto !important;
 }
 
 .card-attachment-images {
@@ -87,8 +87,8 @@
   display: inline-block;
   max-height: 50px;
   border-radius: var(--border-radius);
-  text-align: left;
-  margin-right: 2px;
+  text-align: start;
+  margin-inline-end: 2px;
   aspect-ratio: 1;
 }
 
diff --git a/web_src/css/features/tribute.css b/web_src/css/features/tribute.css
index bd843675e1..f18d2bfea2 100644
--- a/web_src/css/features/tribute.css
+++ b/web_src/css/features/tribute.css
@@ -17,7 +17,7 @@
 .tribute-container li span.fullname {
   font-weight: var(--font-weight-normal);
   font-size: 0.8rem;
-  margin-left: 3px;
+  margin-inline-start: 3px;
 }
 
 .tribute-container li.highlight,
@@ -33,7 +33,7 @@
 
 .tribute-item .emoji,
 .tribute-item img[src*="/avatar/"] {
-  margin-right: 0.5rem;
+  margin-inline-end: 0.5rem;
 }
 
 .tribute-container img {
diff --git a/web_src/css/form.css b/web_src/css/form.css
index 5263d61d5d..b870d3ec0a 100644
--- a/web_src/css/form.css
+++ b/web_src/css/form.css
@@ -47,7 +47,7 @@ fieldset label + .ui.dropdown {
 
 fieldset label > input[type="checkbox"],
 fieldset label > input[type="radio"] {
-  margin-right: 0.75em;
+  margin-inline-end: 0.75em;
   margin-top: 0 !important;
   vertical-align: initial !important; /* overrides a semantic.css rule, remove when obsolete */
 }
@@ -298,7 +298,7 @@ input:-webkit-autofill:active,
   .h-captcha-style {
     margin: 0 auto !important;
     width: 304px;
-    padding-left: 30px;
+    padding-inline-start: 30px;
   }
   .g-recaptcha-style iframe,
   .h-captcha-style iframe {
@@ -351,10 +351,10 @@ input:-webkit-autofill:active,
   .user.link-account form .header,
   .user.signin form .header,
   .user.signup form .header {
-    padding-left: 280px !important;
+    padding-inline-start: 280px !important;
   }
   .user.activate form .inline.field > label {
-    text-align: right;
+    text-align: end;
     width: 250px !important;
     word-wrap: break-word;
   }
@@ -364,7 +364,7 @@ input:-webkit-autofill:active,
   .user.link-account form .help,
   .user.signin form .help,
   .user.signup form .help {
-    margin-left: 265px !important;
+    margin-inline-start: 265px !important;
   }
   .user.activate form .optional .title,
   .user.forgot.password form .optional .title,
@@ -372,7 +372,7 @@ input:-webkit-autofill:active,
   .user.link-account form .optional .title,
   .user.signin form .optional .title,
   .user.signup form .optional .title {
-    margin-left: 250px !important;
+    margin-inline-start: 250px !important;
   }
 }
 
@@ -383,7 +383,7 @@ input:-webkit-autofill:active,
   .user.link-account form .optional .title,
   .user.signin form .optional .title,
   .user.signup form .optional .title {
-    margin-left: 15px;
+    margin-inline-start: 15px;
   }
   .user.activate form .inline.field > label,
   .user.forgot.password form .inline.field > label,
@@ -401,7 +401,7 @@ input:-webkit-autofill:active,
 .user.link-account form .header,
 .user.signin form .header,
 .user.signup form .header {
-  padding-left: 0 !important;
+  padding-inline-start: 0 !important;
   text-align: center;
 }
 
@@ -474,22 +474,22 @@ input:-webkit-autofill:active,
   .repository.new.repo form .header,
   .repository.new.migrate form .header,
   .repository.new.fork form .header {
-    padding-left: 280px !important;
+    padding-inline-start: 280px !important;
   }
   .repository.new.migrate form .inline.field > label,
   .repository.new.fork form .inline.field > label {
-    text-align: right;
+    text-align: end;
     width: 250px !important;
     word-wrap: break-word;
   }
   .repository.new.migrate form .help,
   .repository.new.fork form .help {
-    margin-left: 265px !important;
+    margin-inline-start: 265px !important;
   }
   .repository.new.repo form .optional .title,
   .repository.new.migrate form .optional .title,
   .repository.new.fork form .optional .title {
-    margin-left: 250px !important;
+    margin-inline-start: 250px !important;
   }
   .repository.new.migrate form .inline.field > input,
   .repository.new.fork form .inline.field > input,
@@ -503,7 +503,7 @@ input:-webkit-autofill:active,
   .repository.new.repo form .optional .title,
   .repository.new.migrate form .optional .title,
   .repository.new.fork form .optional .title {
-    margin-left: 15px;
+    margin-inline-start: 15px;
   }
   .repository.new.repo form .inline.field > label,
   .repository.new.migrate form .inline.field > label,
@@ -514,14 +514,14 @@ input:-webkit-autofill:active,
 
 .repository.new.migrate form .dropdown .text,
 .repository.new.fork form .dropdown .text {
-  margin-right: 0 !important;
+  margin-inline-end: 0 !important;
 }
 
 .moderation.new-report form .header,
 .repository.new.repo form .header,
 .repository.new.migrate form .header,
 .repository.new.fork form .header {
-  padding-left: 0 !important;
+  padding-inline-start: 0 !important;
   text-align: center;
 }
 
@@ -557,7 +557,7 @@ input:-webkit-autofill:active,
 
 @media (min-width: 768px) {
   .repository.new.repo .ui.form #auto-init {
-    margin-left: 265px !important;
+    margin-inline-start: 265px !important;
   }
 }
 
diff --git a/web_src/css/home.css b/web_src/css/home.css
index 84dd793612..462a1fb6a5 100644
--- a/web_src/css/home.css
+++ b/web_src/css/home.css
@@ -68,14 +68,14 @@
 }
 
 .page-footer .right-links > a {
-  border-left: 1px solid var(--color-secondary-dark-1);
-  padding-left: 8px;
-  margin-left: 8px;
+  border-inline-start: 1px solid var(--color-secondary-dark-1);
+  padding-inline-start: 8px;
+  margin-inline-start: 8px;
 }
 
 .page-footer .ui.dropdown.language .menu {
   max-height: min(500px, calc(100vh - 60px));
-  overflow-y: auto;
+  overflow-block: auto;
   margin-bottom: 10px;
 }
 
diff --git a/web_src/css/install.css b/web_src/css/install.css
index df2a7cb53f..eea8db43a9 100644
--- a/web_src/css/install.css
+++ b/web_src/css/install.css
@@ -4,16 +4,16 @@
 }
 
 .page-content.install form.ui.form .inline.field > label {
-  text-align: right;
+  text-align: end;
   width: 30%;
-  padding-right: 10px;
-  margin-right: 0;
+  padding-inline-end: 10px;
+  margin-inline-end: 0;
 }
 
 .page-content.install .ui.form .field > .help,
 .page-content.install .ui.form .field > .ui.checkbox:first-child,
 .page-content.install .ui.form .field > .right-content {
-  margin-left: calc(30% + 5px);
+  margin-inline-start: calc(30% + 5px);
   width: auto;
 }
 
@@ -34,20 +34,20 @@
 }
 
 .page-content.install form.ui.form .field {
-  text-align: left;
+  text-align: start;
 }
 
 .page-content.install .ui .reinstall-message {
   width: 70%;
   margin: 20px auto;
   color: var(--color-red);
-  text-align: left;
+  text-align: start;
   font-weight: var(--font-weight-semibold);
 }
 
 .page-content.install .ui .reinstall-confirm {
   width: 70%;
-  text-align: left;
+  text-align: start;
   margin: 10px auto;
 }
 
diff --git a/web_src/css/issues.css b/web_src/css/issues.css
index 28539e5eb3..9d5301b58d 100644
--- a/web_src/css/issues.css
+++ b/web_src/css/issues.css
@@ -9,7 +9,7 @@
 .menu .item:has(> .label-filter-item) .label-exclude-item-btn {
   opacity: 0;
   position: absolute;
-  right: 0;
+  inset-inline-end: 0;
   height: 100%;
   width: 40px;
   background: none;
@@ -34,13 +34,13 @@
   max-width: 288px;
 
   @media (any-hover: none) {
-    padding-right: 50px !important;
+    padding-inline-end: 50px !important;
   }
 
   &:hover,
   &.selected,
   &:has(.label-exclude-item-btn.active) {
-    padding-right: 50px !important;
+    padding-inline-end: 50px !important;
 
     .label-exclude-item-btn {
       opacity: 1;
@@ -51,7 +51,7 @@
 .menu:has(> .item[data-selected])
 .item:not([data-selected])
 > .label-filter-item {
-  padding-left: 27px;
+  padding-inline-start: 27px;
 }
 
 .menu .item .label-filter-item {
diff --git a/web_src/css/markup/codecopy.css b/web_src/css/markup/codecopy.css
index e3017ae962..665413d717 100644
--- a/web_src/css/markup/codecopy.css
+++ b/web_src/css/markup/codecopy.css
@@ -6,7 +6,7 @@
 .markup .code-copy {
   position: absolute;
   top: 8px;
-  right: 6px;
+  inset-inline-end: 6px;
   padding: 9px;
   visibility: hidden;
   animation: fadeout 0.2s both;
@@ -14,7 +14,7 @@
 
 /* adjustments for comment content having only 14px font size */
 .repository.view.issue .comment-list .comment .markup .code-copy {
-  right: 5px;
+  inset-inline-end: 5px;
   padding: 8px;
 }
 
diff --git a/web_src/css/markup/content.css b/web_src/css/markup/content.css
index 931f33d064..bc1f4bca78 100644
--- a/web_src/css/markup/content.css
+++ b/web_src/css/markup/content.css
@@ -23,9 +23,9 @@
 }
 
 .markup .anchor {
-  float: left;
-  padding-right: 4px;
-  margin-left: -20px;
+  float: inline-start;
+  padding-inline-end: 4px;
+  margin-inline-start: -20px;
   color: inherit;
 }
 
@@ -144,7 +144,7 @@
 
 .markup ul,
 .markup ol {
-  padding-left: 2em;
+  padding-inline-start: 2em;
 }
 
 .markup ul.no-list,
@@ -167,11 +167,11 @@
 }
 
 .markup ol .task-list-item input[type="checkbox"] {
-  margin-left: 0;
+  margin-inline-start: 0;
 }
 
 .markup .task-list-item input[type="checkbox"] + p {
-  margin-left: -0.2em;
+  margin-inline-start: -0.2em;
   display: inline;
 }
 
@@ -267,10 +267,10 @@
 }
 
 .markup blockquote {
-  margin-left: 0;
+  margin-inline-start: 0;
   padding: 0 15px;
   color: var(--color-text-light-2);
-  border-left: 0.25em solid var(--color-secondary);
+  border-inline-start: 0.25em solid var(--color-secondary);
 }
 
 .markup blockquote > :first-child {
@@ -328,12 +328,12 @@
 
 .markup img[align="right"],
 .markup video[align="right"] {
-  padding-left: 20px;
+  padding-inline-start: 20px;
 }
 
 .markup img[align="left"],
 .markup video[align="left"] {
-  padding-right: 28px;
+  padding-inline-end: 28px;
 }
 
 .markup .emoji {
@@ -347,7 +347,7 @@
 
 .markup span.frame > span {
   display: block;
-  float: left;
+  float: inline-start;
   width: auto;
   padding: 7px;
   margin: 13px 0 0;
@@ -358,7 +358,7 @@
 .markup span.frame span img,
 .markup span.frame span video {
   display: block;
-  float: left;
+  float: inline-start;
 }
 
 .markup span.frame span span {
@@ -397,19 +397,19 @@
   display: block;
   margin: 13px 0 0;
   overflow: hidden;
-  text-align: right;
+  text-align: end;
 }
 
 .markup span.align-right span img,
 .markup span.align-right span video {
   margin: 0;
-  text-align: right;
+  text-align: end;
 }
 
 .markup span.float-left {
   display: block;
-  float: left;
-  margin-right: 13px;
+  float: inline-start;
+  margin-inline-end: 13px;
   overflow: hidden;
 }
 
@@ -419,8 +419,8 @@
 
 .markup span.float-right {
   display: block;
-  float: right;
-  margin-left: 13px;
+  float: inline-end;
+  margin-inline-start: 13px;
   overflow: hidden;
 }
 
@@ -428,7 +428,7 @@
   display: block;
   margin: 13px auto 0;
   overflow: hidden;
-  text-align: right;
+  text-align: end;
 }
 
 .markup code,
@@ -508,15 +508,15 @@
 .markup .ui.list .list,
 .markup ol.ui.list ol,
 .markup ul.ui.list ul {
-  padding-left: 2em;
+  padding-inline-start: 2em;
 }
 
 .file-revisions-btn {
   display: block;
-  float: left;
+  float: inline-start;
   margin-bottom: 2px !important;
   padding: 11px !important;
-  margin-right: 10px !important;
+  margin-inline-end: 10px !important;
 }
 
 .file-revisions-btn i {
@@ -538,20 +538,20 @@
   display: block !important; /* override fomantic .ui.form .error.message {display: none} */
   border: none !important;
   margin-bottom: 0 !important;
-  border-bottom-left-radius: 0 !important;
-  border-bottom-right-radius: 0 !important;
+  border-bottom-left-radius: 0 !important; /* stylelint-disable-line logical-css/require-logical-properties */
+  border-bottom-right-radius: 0 !important; /* stylelint-disable-line logical-css/require-logical-properties */
   box-shadow: none !important;
   font-size: 85% !important;
   white-space: pre-wrap !important;
   padding: 0.5rem 1rem !important;
-  text-align: left !important;
+  text-align: start !important;
 }
 
 .markup-block-error + pre {
   border-top: none !important;
   margin-top: 0 !important;
-  border-top-left-radius: 0 !important;
-  border-top-right-radius: 0 !important;
+  border-top-left-radius: 0 !important; /* stylelint-disable-line logical-css/require-logical-properties */
+  border-top-right-radius: 0 !important; /* stylelint-disable-line logical-css/require-logical-properties */
 }
 
 .file-view.markup {
diff --git a/web_src/css/markup/filepreview.css b/web_src/css/markup/filepreview.css
index d2ec16ea8b..1c0fad5170 100644
--- a/web_src/css/markup/filepreview.css
+++ b/web_src/css/markup/filepreview.css
@@ -18,7 +18,7 @@
 
 .markup .file-preview-box .header {
   padding: .5rem;
-  padding-left: 1rem;
+  padding-inline-start: 1rem;
   border: 1px solid var(--color-secondary);
   border-bottom: none;
   border-radius: 0.28571429rem 0.28571429rem 0 0;
diff --git a/web_src/css/modules/animations.css b/web_src/css/modules/animations.css
index a820787b16..8efea4d959 100644
--- a/web_src/css/modules/animations.css
+++ b/web_src/css/modules/animations.css
@@ -28,7 +28,7 @@ lazy-webc::after,
   content: "";
   position: absolute;
   display: block;
-  left: 50%;
+  inset-inline-start: 50%;
   top: 50%;
   height: min(4em, 66.6%);
   width: fit-content; /* compat: safari - https://bugs.webkit.org/show_bug.cgi?id=267625 */
diff --git a/web_src/css/modules/button-legacy.css b/web_src/css/modules/button-legacy.css
index 8683d9ed58..f0451dec99 100644
--- a/web_src/css/modules/button-legacy.css
+++ b/web_src/css/modules/button-legacy.css
@@ -60,7 +60,7 @@ And the default buttons always have borders now (not the same as Fomantic UI's d
 It needs some tricks to tweak the left/right borders with active state */
 
 .ui.buttons .button {
-  border-right: none;
+  border-inline-end: none;
 }
 
 .ui.buttons .button:hover {
@@ -68,27 +68,27 @@ It needs some tricks to tweak the left/right borders with active state */
 }
 
 .ui.buttons .button:hover + .button {
-  border-left: 1px solid var(--color-secondary-dark-2);
+  border-inline-start: 1px solid var(--color-secondary-dark-2);
 }
 
 /* TODO: these "tw-hidden" selectors are only used by "blame.tmpl" buttons: Raw/Normal View/History/Unescape, need to be refactored to a clear solution later */
 .ui.buttons .button:first-child,
 .ui.buttons .button.tw-hidden:first-child + .button {
-  border-left: 1px solid var(--color-light-border);
+  border-inline-start: 1px solid var(--color-light-border);
 }
 
 .ui.buttons .button:last-child,
 .ui.buttons .button:nth-last-child(2):has(+ .button.tw-hidden) {
-  border-right: 1px solid var(--color-light-border);
+  border-inline-end: 1px solid var(--color-light-border);
 }
 
 .ui.buttons .button.active {
-  border-left: 1px solid var(--color-light-border);
-  border-right: 1px solid var(--color-light-border);
+  border-inline-start: 1px solid var(--color-light-border);
+  border-inline-end: 1px solid var(--color-light-border);
 }
 
 .ui.buttons .button.active + .button {
-  border-left: none;
+  border-inline-start: none;
 }
 
 .ui.basic.buttons .button,
diff --git a/web_src/css/modules/button.css b/web_src/css/modules/button.css
index 011e89c32f..07152b4d99 100644
--- a/web_src/css/modules/button.css
+++ b/web_src/css/modules/button.css
@@ -100,7 +100,7 @@
 /* Fomantic buttons have annoying margins to set distance between elements. In
  * the button-row/sequence helpers this is set by flex+gap */
 .button-row .ui.button {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 .button-sequence .ui.button {
   margin: 0 !important;
diff --git a/web_src/css/modules/card.css b/web_src/css/modules/card.css
index 2406def681..e71a90cdf8 100644
--- a/web_src/css/modules/card.css
+++ b/web_src/css/modules/card.css
@@ -119,16 +119,14 @@ a.ui.card:hover {
 .ui.cards > .card > .extra,
 .ui.card > .extra {
   color: var(--color-text);
-  border-top-color: var(--color-secondary-light-1) !important;
+  border-block-start-color: var(--color-secondary-light-1) !important;
 }
 
 .ui.three.cards {
-  margin-left: -1em;
-  margin-right: -1em;
+  margin-inline: -1em;
 }
 
 .ui.three.cards > .card {
   width: calc(33.33333333333333% - 2em);
-  margin-left: 1em;
-  margin-right: 1em;
+  margin-inline: 1em;
 }
diff --git a/web_src/css/modules/checkbox.css b/web_src/css/modules/checkbox.css
index 8d73573bfa..ab0fdf9348 100644
--- a/web_src/css/modules/checkbox.css
+++ b/web_src/css/modules/checkbox.css
@@ -21,7 +21,7 @@ input[type="radio"] {
 .ui.checkbox input[type="radio"] {
   position: absolute;
   top: 1px;
-  left: 0;
+  inset-inline-start: 0;
   width: var(--checkbox-size);
   height: var(--checkbox-size);
 }
@@ -41,7 +41,7 @@ input[type="radio"] {
 
 .ui.checkbox label,
 .ui.radio.checkbox label {
-  margin-left: 1.85714em;
+  margin-inline-start: 1.85714em;
 }
 
 .ui.checkbox + label {
@@ -72,7 +72,7 @@ input[type="radio"] {
 }
 .ui.toggle.checkbox label {
   min-height: 1.5rem;
-  padding-left: 4.5rem;
+  padding-inline-start: 4.5rem;
   padding-top: 0.15em;
 }
 .ui.toggle.checkbox label::before {
@@ -84,7 +84,7 @@ input[type="radio"] {
   width: 49px;
   height: 21px;
   border-radius: 500rem;
-  left: 0;
+  inset-inline-start: 0;
 }
 .ui.toggle.checkbox label::after {
   background: var(--color-white);
@@ -96,15 +96,15 @@ input[type="radio"] {
   width: 18px;
   height: 18px;
   top: 1.5px;
-  left: 1.5px;
+  inset-inline-start: 1.5px;
   border-radius: 500rem;
   transition: background 0.3s ease, left 0.3s ease;
 }
 .ui.toggle.checkbox input ~ label::after {
-  left: 1.5px;
+  inset-inline-start: 1.5px;
 }
 .ui.toggle.checkbox input:checked ~ label::after {
-  left: 29px;
+  inset-inline-start: 29px;
 }
 .ui.toggle.checkbox input:focus ~ label::before,
 .ui.toggle.checkbox label::before {
diff --git a/web_src/css/modules/comment.css b/web_src/css/modules/comment.css
index 799eeb8574..0a470eda71 100644
--- a/web_src/css/modules/comment.css
+++ b/web_src/css/modules/comment.css
@@ -36,7 +36,7 @@
 .ui.comments .comment > .comments::before {
   position: absolute;
   top: 0;
-  left: 0;
+  inset-inline-start: 0;
 }
 
 .ui.comments .comment > .comments .comment {
@@ -46,7 +46,7 @@
 }
 
 .ui.comments .comment .avatar {
-  float: left;
+  float: inline-start;
   width: 2.5em;
 }
 
@@ -55,7 +55,7 @@
 }
 
 .ui.comments .comment > .avatar ~ .content {
-  margin-left: 3.5em;
+  margin-inline-start: 3.5em;
 }
 
 .ui.comments .comment .author {
@@ -69,7 +69,7 @@
 
 .ui.comments .comment .metadata {
   display: inline-block;
-  margin-left: 0.5em;
+  margin-inline-start: 0.5em;
   font-size: 0.875em;
 }
 
@@ -79,7 +79,7 @@
 }
 
 .ui.comments .comment .metadata > :last-child {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 
 .ui.comments .comment .text {
diff --git a/web_src/css/modules/container.css b/web_src/css/modules/container.css
index 95c71b207f..057c8c1be9 100644
--- a/web_src/css/modules/container.css
+++ b/web_src/css/modules/container.css
@@ -11,8 +11,7 @@
   .ui.ui.ui.container:not(.fluid) {
     --container-width: auto;
     width: var(--container-width);
-    margin-left: 1em;
-    margin-right: 1em;
+    margin-inline: 1em;
   }
 }
 
@@ -20,8 +19,7 @@
   .ui.ui.ui.container:not(.fluid) {
     --container-width: 723px;
     width: var(--container-width);
-    margin-left: auto;
-    margin-right: auto;
+    margin-inline: auto;
   }
 }
 
@@ -29,8 +27,7 @@
   .ui.ui.ui.container:not(.fluid) {
     --container-width: 933px;
     width: var(--container-width);
-    margin-left: auto;
-    margin-right: auto;
+    margin-inline: auto;
   }
 }
 
@@ -38,8 +35,7 @@
   .ui.ui.ui.container:not(.fluid) {
     --container-width: 1127px;
     width: var(--container-width);
-    margin-left: auto;
-    margin-right: auto;
+    margin-inline: auto;
   }
 }
 
@@ -57,8 +53,7 @@
   --container-width: 1280px;
   width: var(--container-width);
   max-width: calc(100% - calc(2 * var(--page-margin-x)));
-  margin-left: auto;
-  margin-right: auto;
+  margin-inline: auto;
 }
 
 .ui.container.fluid.padded {
diff --git a/web_src/css/modules/dialog.css b/web_src/css/modules/dialog.css
index 3f9a1a44bf..e80acdf2a8 100644
--- a/web_src/css/modules/dialog.css
+++ b/web_src/css/modules/dialog.css
@@ -6,7 +6,7 @@ dialog {
   align-items: center;
   justify-content: center;
   position: fixed;
-  text-align: left;
+  text-align: start;
   border: none;
   background: var(--color-body);
   box-shadow:
@@ -57,8 +57,8 @@ dialog header {
   margin: 0;
   padding: 1.25rem 1.5rem;
   box-shadow: none;
-  border-top-left-radius: var(--border-radius);
-  border-top-right-radius: var(--border-radius);
+  border-top-left-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
+  border-top-right-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
   border-bottom: 1px solid var(--color-secondary);
 }
 
@@ -89,8 +89,8 @@ dialog .actions {
 }
 
 dialog footer {
-  border-bottom-left-radius: var(--border-radius);
-  border-bottom-right-radius: var(--border-radius);
+  border-bottom-left-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
+  border-bottom-right-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
 }
 
 /* positive/negative action buttons */
@@ -98,7 +98,7 @@ dialog .actions .ui.button {
   display: inline-flex;
   align-items: center;
   padding: 10px 12px;
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 
 dialog .actions .ui.button.danger {
@@ -109,5 +109,5 @@ dialog .actions .ui.button.danger {
 }
 
 dialog .actions .ui.button .svg {
-  margin-right: 5px;
+  margin-inline-end: 5px;
 }
diff --git a/web_src/css/modules/divider.css b/web_src/css/modules/divider.css
index acc8408f37..9cba544569 100644
--- a/web_src/css/modules/divider.css
+++ b/web_src/css/modules/divider.css
@@ -30,11 +30,11 @@ h4.divider {
 }
 
 .divider.divider-text::before {
-  margin-right: .75em;
+  margin-inline-end: .75em;
 }
 
 .divider.divider-text::after {
-  margin-left: .75em;
+  margin-inline-start: .75em;
 }
 
 .ui.dropdown .menu > .divider {
diff --git a/web_src/css/modules/grid.css b/web_src/css/modules/grid.css
index 1df9a116f7..9b64b414ad 100644
--- a/web_src/css/modules/grid.css
+++ b/web_src/css/modules/grid.css
@@ -22,12 +22,10 @@
 }
 
 .ui.relaxed.grid {
-  margin-left: -1.5rem;
-  margin-right: -1.5rem;
+  margin-inline: -1.5rem;
 }
 .ui[class*="very relaxed"].grid {
-  margin-left: -2.5rem;
-  margin-right: -2.5rem;
+  margin-inline: -2.5rem;
 }
 
 .ui.grid + .grid {
@@ -39,13 +37,11 @@
   position: relative;
   display: inline-block;
   width: 6.25%;
-  padding-left: 1rem;
-  padding-right: 1rem;
+  padding-inline: 1rem;
   vertical-align: top;
 }
 .ui.grid > * {
-  padding-left: 1rem;
-  padding-right: 1rem;
+  padding-inline: 1rem;
 }
 
 .ui.grid > .row {
@@ -103,46 +99,36 @@
 @media only screen and (max-width: 767.98px) {
   .ui.page.grid {
     width: auto;
-    padding-left: 0;
-    padding-right: 0;
-    margin-left: 0;
-    margin-right: 0;
+    padding-inline: 0;
+    margin-inline: 0;
   }
 }
 @media only screen and (min-width: 768px) and (max-width: 991.98px) {
   .ui.page.grid {
     width: auto;
-    margin-left: 0;
-    margin-right: 0;
-    padding-left: 2em;
-    padding-right: 2em;
+    margin-inline: 0;
+    padding-inline: 2em;
   }
 }
 @media only screen and (min-width: 992px) and (max-width: 1199.98px) {
   .ui.page.grid {
     width: auto;
-    margin-left: 0;
-    margin-right: 0;
-    padding-left: 3%;
-    padding-right: 3%;
+    margin-inline: 0;
+    padding-inline: 3%;
   }
 }
 @media only screen and (min-width: 1200px) and (max-width: 1919.98px) {
   .ui.page.grid {
     width: auto;
-    margin-left: 0;
-    margin-right: 0;
-    padding-left: 15%;
-    padding-right: 15%;
+    margin-inline: 0;
+    padding-inline: 15%;
   }
 }
 @media only screen and (min-width: 1920px) {
   .ui.page.grid {
     width: auto;
-    margin-left: 0;
-    margin-right: 0;
-    padding-left: 23%;
-    padding-right: 23%;
+    margin-inline: 0;
+    padding-inline: 23%;
   }
 }
 
@@ -371,37 +357,32 @@
 .ui.centered.grid > .column:not(.aligned):not(.justified):not(.row),
 .ui.centered.grid > .row > .column:not(.aligned):not(.justified),
 .ui.grid .centered.row > .column:not(.aligned):not(.justified) {
-  text-align: left;
+  text-align: start;
 }
 .ui.grid > .centered.column,
 .ui.grid > .row > .centered.column {
   display: block;
-  margin-left: auto;
-  margin-right: auto;
+  margin-inline: auto;
 }
 
 .ui.relaxed.grid > .column:not(.row),
 .ui.relaxed.grid > .row > .column,
 .ui.grid > .relaxed.row > .column {
-  padding-left: 1.5rem;
-  padding-right: 1.5rem;
+  padding-inline: 1.5rem;
 }
 .ui[class*="very relaxed"].grid > .column:not(.row),
 .ui[class*="very relaxed"].grid > .row > .column,
 .ui.grid > [class*="very relaxed"].row > .column {
-  padding-left: 2.5rem;
-  padding-right: 2.5rem;
+  padding-inline: 2.5rem;
 }
 
 .ui.relaxed.grid .row + .ui.divider,
 .ui.grid .relaxed.row + .ui.divider {
-  margin-left: 1.5rem;
-  margin-right: 1.5rem;
+  margin-inline: 1.5rem;
 }
 .ui[class*="very relaxed"].grid .row + .ui.divider,
 .ui.grid [class*="very relaxed"].row + .ui.divider {
-  margin-left: 2.5rem;
-  margin-right: 2.5rem;
+  margin-inline: 2.5rem;
 }
 
 .ui[class*="middle aligned"].grid > .column:not(.row),
@@ -419,7 +400,7 @@
 .ui.grid > [class*="left aligned"].row > .column,
 .ui.grid > [class*="left aligned"].column.column,
 .ui.grid > .row > [class*="left aligned"].column.column {
-  text-align: left;
+  text-align: start;
   align-self: inherit;
 }
 
@@ -440,7 +421,7 @@
 .ui.grid > [class*="right aligned"].row > .column,
 .ui.grid > [class*="right aligned"].column.column,
 .ui.grid > .row > [class*="right aligned"].column.column {
-  text-align: right;
+  text-align: end;
   align-self: inherit;
 }
 
@@ -470,8 +451,7 @@
 @media only screen and (max-width: 767.98px) {
   .ui.stackable.grid {
     width: auto;
-    margin-left: 0 !important;
-    margin-right: 0 !important;
+    margin-inline: 0 !important;
   }
   .ui.stackable.grid > .row > .wide.column,
   .ui.stackable.grid > .wide.column,
@@ -492,25 +472,21 @@
 
   .ui.container > .ui.stackable.grid > .column,
   .ui.container > .ui.stackable.grid > .row > .column {
-    padding-left: 0 !important;
-    padding-right: 0 !important;
+    padding-inline: 0 !important;
   }
 
   .ui.grid .ui.stackable.grid,
   .ui.segment:not(.vertical) .ui.stackable.page.grid {
-    margin-left: -1rem !important;
-    margin-right: -1rem !important;
+    margin-inline: -1rem !important;
   }
 }
 
 .ui.ui.ui.compact.grid > .column:not(.row),
 .ui.ui.ui.compact.grid > .row > .column {
-  padding-left: 0.5rem;
-  padding-right: 0.5rem;
+  padding-inline: 0.5rem;
 }
 .ui.ui.ui.compact.grid > * {
-  padding-left: 0.5rem;
-  padding-right: 0.5rem;
+  padding-inline: 0.5rem;
 }
 
 .ui.ui.ui.compact.grid > .row {
diff --git a/web_src/css/modules/hashbox.css b/web_src/css/modules/hashbox.css
index 316ac1f655..1095862716 100644
--- a/web_src/css/modules/hashbox.css
+++ b/web_src/css/modules/hashbox.css
@@ -31,9 +31,9 @@
   color: var(--color-text);
   background: var(--color-light);
   padding: 0.25rem 0.33rem;
-  border-left: 1px solid var(--color-light-border);
-  border-top-right-radius: inherit;
-  border-bottom-right-radius: inherit;
+  border-inline-start: 1px solid var(--color-light-border);
+  border-start-end-radius: inherit;
+  border-end-end-radius: inherit;
 }
 
 .sha.label .signature-author {
@@ -53,7 +53,7 @@
 }
 
 .sha.label.isSigned.isWarning .signature {
-  border-left: 1px solid var(--color-red-badge);
+  border-inline-start: 1px solid var(--color-red-badge);
   color: var(--color-red-badge);
 }
 
@@ -67,7 +67,7 @@
 }
 
 .sha.label.isSigned.isVerified .signature {
-  border-left: 1px solid var(--color-green-badge);
+  border-inline-start: 1px solid var(--color-green-badge);
   color: var(--color-green-badge);
 }
 
@@ -81,7 +81,7 @@
 }
 
 .sha.label.isSigned.isVerifiedUntrusted .signature {
-  border-left: 1px solid var(--color-yellow-badge);
+  border-inline-start: 1px solid var(--color-yellow-badge);
   color: var(--color-yellow-badge);
 }
 
@@ -95,7 +95,7 @@
 }
 
 .sha.label.isSigned.isVerifiedUnmatched .signature {
-  border-left: 1px solid var(--color-orange-badge);
+  border-inline-start: 1px solid var(--color-orange-badge);
   color: var(--color-orange-badge);
 }
 
diff --git a/web_src/css/modules/header.css b/web_src/css/modules/header.css
index f45e970018..308960031b 100644
--- a/web_src/css/modules/header.css
+++ b/web_src/css/modules/header.css
@@ -20,7 +20,7 @@
 }
 
 .ui.header .ui.label {
-  margin-left: 0.25rem;
+  margin-inline-start: 0.25rem;
   vertical-align: middle;
 }
 
@@ -49,7 +49,7 @@
 .ui.header > i.icon:only-child {
   display: inline-block;
   padding: 0;
-  margin-right: 0.75rem;
+  margin-inline-end: 0.75rem;
 }
 
 .ui.header + p {
@@ -120,7 +120,7 @@ h4.ui.header .sub.header {
 /* fix misaligned right buttons on box headers */
 .ui.attached.header > .ui.right {
   position: absolute;
-  right: 0.78571429rem;
+  inset-inline-end: 0.78571429rem;
   top: 0;
   bottom: 0;
   display: flex;
@@ -136,8 +136,7 @@ h4.ui.header .sub.header {
 
 /* open dropdown menus to the left in right-attached headers */
 .ui.attached.header > .ui.right .ui.dropdown .menu {
-  right: 0;
-  left: auto;
+  inset-inline: auto 0;
 }
 
 /* if a .top.attached.header is followed by a .segment, add some margin */
@@ -147,7 +146,7 @@ h4.ui.header .sub.header {
 }
 
 .ui.dividing.header {
-  border-bottom-color: var(--color-secondary);
+  border-block-end-color: var(--color-secondary);
 }
 
 .ui.dividing.header .sub.header {
diff --git a/web_src/css/modules/input.css b/web_src/css/modules/input.css
index 18b785ac82..64a8b68685 100644
--- a/web_src/css/modules/input.css
+++ b/web_src/css/modules/input.css
@@ -49,7 +49,7 @@
   position: absolute;
   text-align: center;
   top: 0;
-  right: 0;
+  inset-inline-end: 0;
   margin: 0;
   height: 100%;
   width: 2.67142857em;
@@ -71,29 +71,26 @@
 
 .ui.ui.ui.ui.icon.input > textarea,
 .ui.ui.ui.ui.icon.input > input {
-  padding-right: 2.67142857em;
+  padding-inline-end: 2.67142857em;
 }
 .ui.icon.input > i.link.icon {
   cursor: pointer;
 }
 .ui.icon.input > i.circular.icon {
   top: 0.35em;
-  right: 0.5em;
+  inset-inline-end: 0.5em;
 }
 
 .ui[class*="left icon"].input > i.icon {
-  right: auto;
-  left: 1px;
+  inset-inline: 1px auto;
   border-radius: 0.28571429rem 0 0 0.28571429rem;
 }
 .ui[class*="left icon"].input > i.circular.icon {
-  right: auto;
-  left: 0.5em;
+  inset-inline: 0.5em auto;
 }
 .ui.ui.ui.ui[class*="left icon"].input > textarea,
 .ui.ui.ui.ui[class*="left icon"].input > input {
-  padding-left: 2.67142857em;
-  padding-right: 1em;
+  padding-inline: 2.67142857em 1em;
 }
 
 .ui.icon.input > textarea:focus ~ .icon,
@@ -125,9 +122,9 @@
 }
 
 .ui.action.input:not([class*="left action"]) > input {
-  border-top-right-radius: 0;
-  border-bottom-right-radius: 0;
-  border-right-color: transparent;
+  border-start-end-radius: 0;
+  border-end-end-radius: 0;
+  border-inline-end-color: transparent;
 }
 
 .ui.action.input > .dropdown:first-child,
@@ -171,18 +168,18 @@
   min-width: 10em;
 }
 .ui.action.input:not([class*="left action"]) > .ui.dropdown.selection:not(:focus) {
-  border-right: none;
+  border-inline-end: none;
 }
 .ui.action.input:not([class*="left action"]) > .ui.dropdown.selection:not(.active):hover {
   border-color: var(--color-input-border);
 }
 .ui.action.input:not([class*="left action"]) .ui.dropdown.selection.upward.visible {
-  border-bottom-left-radius: 0 !important;
-  border-bottom-right-radius: 0 !important;
+  border-bottom-left-radius: 0 !important; /* stylelint-disable-line logical-css/require-logical-properties */
+  border-bottom-right-radius: 0 !important; /* stylelint-disable-line logical-css/require-logical-properties */
 }
 .ui.action.input:not([class*="left action"]) > input,
 .ui.action.input:not([class*="left action"]) > input:hover {
-  border-right: none;
+  border-inline-end: none;
 }
 .ui.action.input:not([class*="left action"]) > input:focus + .ui.dropdown.selection,
 .ui.action.input:not([class*="left action"]) > input:focus + .ui.dropdown.selection:hover,
@@ -190,8 +187,8 @@
 .ui.action.input:not([class*="left action"]) > input:focus + .button:hover,
 .ui.action.input:not([class*="left action"]) > input:focus + .icon + .button,
 .ui.action.input:not([class*="left action"]) > input:focus + .icon + .button:hover {
-  border-left-color: var(--color-primary);
+  border-inline-start-color: var(--color-primary);
 }
 .ui.action.input:not([class*="left action"]) > input:focus {
-  border-right-color: var(--color-primary);
+  border-inline-end-color: var(--color-primary);
 }
diff --git a/web_src/css/modules/label.css b/web_src/css/modules/label.css
index 4dc469631d..689577a8a6 100644
--- a/web_src/css/modules/label.css
+++ b/web_src/css/modules/label.css
@@ -19,10 +19,10 @@
 }
 
 .ui.label:first-child {
-  margin-left: 0;
+  margin-inline-start: 0;
 }
 .ui.label:last-child {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 
 a.ui.label {
@@ -45,7 +45,7 @@ a.ui.label {
 }
 
 .ui.label > .color-icon {
-  margin-left: 0;
+  margin-inline-start: 0;
 }
 
 .ui.label > .icon {
@@ -57,7 +57,7 @@ a.ui.label {
   display: inline-block;
   vertical-align: top;
   font-weight: var(--font-weight-medium);
-  margin-left: 1em;
+  margin-inline-start: 1em;
   opacity: 0.8;
 }
 .ui.label > .detail .icon {
diff --git a/web_src/css/modules/list.css b/web_src/css/modules/list.css
index 32c71e802b..f9e3186ce3 100644
--- a/web_src/css/modules/list.css
+++ b/web_src/css/modules/list.css
@@ -51,7 +51,7 @@
   min-width: 1.55em;
   padding-top: 0;
   transition: color 0.1s ease;
-  padding-right: 0.28571429em;
+  padding-inline-end: 0.28571429em;
   vertical-align: top;
 }
 .ui.list .list > .item > i.icon:only-child,
@@ -69,7 +69,7 @@
 }
 .ui.list .list > .item > .image:not(:only-child):not(img),
 .ui.list > .item > .image:not(:only-child):not(img) {
-  padding-right: 0.5em;
+  padding-inline-end: 0.5em;
 }
 .ui.list .list > .item > .image img,
 .ui.list > .item > .image img {
@@ -102,8 +102,8 @@
 }
 .ui.list .list > .item > .content > .list,
 .ui.list > .item > .content > .list {
-  margin-left: 0;
-  padding-left: 0;
+  margin-inline-start: 0;
+  padding-inline-start: 0;
 }
 
 .ui.list .list > .item .header,
@@ -128,7 +128,7 @@
 
 .ui.list .list > .item [class*="right floated"],
 .ui.list > .item [class*="right floated"] {
-  float: right;
+  float: inline-end;
   margin: 0 0 0 1em;
 }
 
diff --git a/web_src/css/modules/message.css b/web_src/css/modules/message.css
index c62dbddd25..91b9ed9976 100644
--- a/web_src/css/modules/message.css
+++ b/web_src/css/modules/message.css
@@ -23,8 +23,7 @@
 .ui.attached.message {
   margin-bottom: -1px;
   border-radius: var(--border-radius) var(--border-radius) 0 0;
-  margin-left: -1px;
-  margin-right: -1px;
+  margin-inline: -1px;
 }
 
 .ui.attached + .ui.attached.message:not(.top):not(.bottom) {
@@ -105,7 +104,7 @@
   cursor: pointer;
   position: absolute;
   top: 9px;
-  right: 9px;
+  inset-inline-end: 9px;
   opacity: .7;
 }
 
diff --git a/web_src/css/modules/modal.css b/web_src/css/modules/modal.css
index 54a4ef81ca..e1b5f11236 100644
--- a/web_src/css/modules/modal.css
+++ b/web_src/css/modules/modal.css
@@ -20,8 +20,8 @@
   color: var(--color-text-dark);
   background: var(--color-body);
   border-color: var(--color-secondary);
-  border-top-left-radius: var(--border-radius);
-  border-top-right-radius: var(--border-radius);
+  border-top-left-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
+  border-top-right-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
   vertical-align: middle;
 }
 
@@ -58,12 +58,12 @@ These inconsistent layouts should be refactored to simple ones.
   background: var(--color-secondary-bg);
   border-color: var(--color-secondary);
   padding: 1rem;
-  text-align: right;
+  text-align: end;
 }
 
 .ui.modal .content > .actions {
   padding-top: 1em; /* if the "actions" is in the "content", some paddings are already added by the "content" */
-  text-align: right;
+  text-align: end;
 }
 
 /* positive/negative action buttons */
@@ -71,7 +71,7 @@ These inconsistent layouts should be refactored to simple ones.
   display: inline-flex;
   align-items: center;
   padding: 10px 12px 10px 10px;
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 
 .ui.modal .actions > .ui.button.danger {
@@ -82,5 +82,5 @@ These inconsistent layouts should be refactored to simple ones.
 }
 
 .ui.modal .actions > .ui.button .svg {
-  margin-right: 5px;
+  margin-inline-end: 5px;
 }
diff --git a/web_src/css/modules/navbar.css b/web_src/css/modules/navbar.css
index 0c58441dfe..bf9752fd8a 100644
--- a/web_src/css/modules/navbar.css
+++ b/web_src/css/modules/navbar.css
@@ -41,7 +41,7 @@
 
 #navbar .secondary.menu > .item > .svg,
 #navbar .right.menu > .item > .svg {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 
 /* icon with notification counter - positioned relative container */
@@ -69,7 +69,7 @@
   }
   #navbar .navbar-mobile-right {
     display: flex;
-    margin-left: auto !important;
+    margin-inline-start: auto !important;
     width: auto !important;
   }
   #navbar .navbar-mobile-right > .item {
@@ -119,7 +119,7 @@
     min-height: 48px;
   }
   #navbar #mobile-notifications-icon {
-    margin-right: 6px !important;
+    margin-inline-end: 6px !important;
   }
 }
 
@@ -151,7 +151,7 @@
   background: var(--color-primary);
   border: 2px solid var(--color-nav-bg);
   position: absolute;
-  left: 6px;
+  inset-inline-start: 6px;
   top: -9px;
   min-width: 17px;
   height: 17px;
diff --git a/web_src/css/modules/segment.css b/web_src/css/modules/segment.css
index 76638cb639..b54db40d90 100644
--- a/web_src/css/modules/segment.css
+++ b/web_src/css/modules/segment.css
@@ -103,14 +103,14 @@
   border-radius: 0;
   border: none;
   box-shadow: none;
-  border-left: 1px solid var(--color-secondary);
+  border-inline-start: 1px solid var(--color-secondary);
 }
 
 .ui.segments > .horizontal.segments:first-child {
   border-top: none;
 }
 .ui.horizontal.segments:not(.stackable) > .segment:first-child {
-  border-left: none;
+  border-inline-start: none;
 }
 .ui.horizontal.segments > .segment:first-child {
   border-radius: 0.28571429rem 0 0 0.28571429rem;
@@ -126,7 +126,7 @@
 }
 
 .ui[class*="left aligned"].segment {
-  text-align: left;
+  text-align: start;
 }
 .ui[class*="center aligned"].segment {
   text-align: center;
@@ -190,8 +190,7 @@
   padding-bottom: 0;
 }
 .ui.fitted.segment:not(.vertically) {
-  padding-left: 0;
-  padding-right: 0;
+  padding-inline: 0;
 }
 
 .ui.segments .segment,
diff --git a/web_src/css/modules/select.css b/web_src/css/modules/select.css
index 1d7d749d4a..7b4b88ada7 100644
--- a/web_src/css/modules/select.css
+++ b/web_src/css/modules/select.css
@@ -11,7 +11,7 @@
 .gitea-select::after {
   position: absolute;
   top: 12px;
-  right: 8px;
+  inset-inline-end: 8px;
   pointer-events: none;
   content: "";
   width: 14px;
diff --git a/web_src/css/modules/switch.css b/web_src/css/modules/switch.css
index dee30f4ca3..c2bea9cef2 100644
--- a/web_src/css/modules/switch.css
+++ b/web_src/css/modules/switch.css
@@ -41,7 +41,7 @@
 
   &.active {
     z-index: 2;
-    padding-left: var(--switch-padding-inline);
+    padding-inline-start: var(--switch-padding-inline);
     background: var(--color-active);
     outline: 1px solid var(--color-input-border);
   }
@@ -55,12 +55,12 @@
 /* Corner rounding aid: item that has to crawl under it's active neighbor,
 so when it is hovered, there are no ugly unpainted v/^ shapes between them */
 .switch > .item:has(+ .active.item) { /* Active neighbor is next item */
-  margin-right: calc(-1 * var(--border-radius));
-  padding-right: calc(var(--switch-padding-inline) + var(--border-radius));
+  margin-inline-end: calc(-1 * var(--border-radius));
+  padding-inline-end: calc(var(--switch-padding-inline) + var(--border-radius));
 }
 .switch > .active.item + .item { /* Active neighbor is previous item */
-  margin-left: calc(-1 * var(--border-radius));
-  padding-left: calc(var(--switch-padding-inline) + var(--border-radius));
+  margin-inline-start: calc(-1 * var(--border-radius));
+  padding-inline-start: calc(var(--switch-padding-inline) + var(--border-radius));
 }
 
 /* Make counters embedded into items more visible on brighter backgrounds */
diff --git a/web_src/css/modules/table.css b/web_src/css/modules/table.css
index 801a58d84d..39787be15a 100644
--- a/web_src/css/modules/table.css
+++ b/web_src/css/modules/table.css
@@ -35,10 +35,10 @@
   vertical-align: inherit;
   font-weight: var(--font-weight-normal);
   border-bottom: 1px solid var(--color-secondary);
-  border-left: none;
+  border-inline-start: none;
 }
 .ui.table > thead > tr > th:first-child {
-  border-left: none;
+  border-inline-start: none;
 }
 .ui.table > thead > tr:first-child > th:first-child {
   border-radius: 0.28571429rem 0 0;
@@ -62,7 +62,7 @@
 }
 .ui.table > tfoot > tr > th:first-child,
 .ui.table > tfoot > tr > td:first-child {
-  border-left: none;
+  border-inline-start: none;
 }
 .ui.table > tfoot > tr:first-child > th:first-child,
 .ui.table > tfoot > tr:first-child > td:first-child {
@@ -154,7 +154,7 @@
 
 .ui.table[class*="left aligned"],
 .ui.table [class*="left aligned"] {
-  text-align: left;
+  text-align: start;
 }
 
 .ui.table[class*="center aligned"],
@@ -164,7 +164,7 @@
 
 .ui.table[class*="right aligned"],
 .ui.table [class*="right aligned"] {
-  text-align: right;
+  text-align: end;
 }
 
 .ui.table[class*="top aligned"],
@@ -301,7 +301,7 @@
 .ui.basic.table > tfoot > tr > th,
 .ui.basic.table > tr > th {
   background: transparent;
-  border-left: none;
+  border-inline-start: none;
 }
 .ui.basic.table > tbody > tr {
   border-bottom: 1px solid var(--color-secondary);
@@ -325,7 +325,7 @@
 .ui[class*="very basic"].table:not(.striped) > tr > td:first-child,
 .ui[class*="very basic"].table:not(.striped) > tbody > tr > td:first-child,
 .ui[class*="very basic"].table:not(.striped) > tfoot > tr > td:first-child {
-  padding-left: 0;
+  padding-inline-start: 0;
 }
 .ui[class*="very basic"].table:not(.striped) > tr > th:last-child,
 .ui[class*="very basic"].table:not(.striped) > thead > tr > th:last-child,
@@ -334,7 +334,7 @@
 .ui[class*="very basic"].table:not(.striped) > tr > td:last-child,
 .ui[class*="very basic"].table:not(.striped) > tbody > tr > td:last-child,
 .ui[class*="very basic"].table:not(.striped) > tfoot > tr > td:last-child {
-  padding-right: 0;
+  padding-inline-end: 0;
 }
 .ui[class*="very basic"].table:not(.striped) > thead > tr:first-child > th {
   padding-top: 0;
@@ -347,7 +347,7 @@
 .ui.celled.table > tr > td,
 .ui.celled.table > tbody > tr > td,
 .ui.celled.table > tfoot > tr > td {
-  border-left: 1px solid var(--color-secondary-alpha-50);
+  border-inline-start: 1px solid var(--color-secondary-alpha-50);
 }
 .ui.celled.table > tr > th:first-child,
 .ui.celled.table > thead > tr > th:first-child,
@@ -356,15 +356,14 @@
 .ui.celled.table > tr > td:first-child,
 .ui.celled.table > tbody > tr > td:first-child,
 .ui.celled.table > tfoot > tr > td:first-child {
-  border-left: none;
+  border-inline-start: none;
 }
 
 .ui.compact.table > tr > th,
 .ui.compact.table > thead > tr > th,
 .ui.compact.table > tbody > tr > th,
 .ui.compact.table > tfoot > tr > th {
-  padding-left: 0.7em;
-  padding-right: 0.7em;
+  padding-inline: 0.7em;
 }
 .ui.compact.table > tr > td,
 .ui.compact.table > tbody > tr > td,
@@ -376,10 +375,10 @@
 .ui.table > thead > tr > th:first-of-type,
 .ui.table > tbody > tr > td:first-of-type,
 .ui.table > tr > td:first-of-type {
-  padding-left: 10px;
+  padding-inline-start: 10px;
 }
 .ui.table > thead > tr > th:last-of-type,
 .ui.table > tbody > tr > td:last-of-type,
 .ui.table > tr > td:last-of-type {
-  padding-right: 10px;
+  padding-inline-end: 10px;
 }
diff --git a/web_src/css/modules/tippy.css b/web_src/css/modules/tippy.css
index ab894d46c5..a44b10674a 100644
--- a/web_src/css/modules/tippy.css
+++ b/web_src/css/modules/tippy.css
@@ -140,25 +140,25 @@
 }
 
 .tippy-box[data-placement^="left"] > .tippy-svg-arrow {
-  right: 0;
+  inset-inline-end: 0;
 }
 
 .tippy-box[data-placement^="left"] > .tippy-svg-arrow::after,
 .tippy-box[data-placement^="left"] > .tippy-svg-arrow > svg {
   transform: rotate(90deg);
   top: calc(50% - 3px);
-  left: 11px;
+  inset-inline-start: 11px;
 }
 
 .tippy-box[data-placement^="right"] > .tippy-svg-arrow {
-  left: 0;
+  inset-inline-start: 0;
 }
 
 .tippy-box[data-placement^="right"] > .tippy-svg-arrow::after,
 .tippy-box[data-placement^="right"] > .tippy-svg-arrow > svg {
   transform: rotate(-90deg);
   top: calc(50% - 3px);
-  right: 11px;
+  inset-inline-end: 11px;
 }
 
 .tippy-svg-arrow {
diff --git a/web_src/css/modules/toast.css b/web_src/css/modules/toast.css
index 2a9f78e017..25b21c46b2 100644
--- a/web_src/css/modules/toast.css
+++ b/web_src/css/modules/toast.css
@@ -44,11 +44,11 @@
 }
 
 .toastify-right {
-  right: 15px;
+  inset-inline-end: 15px;
 }
 
 .toastify-left {
-  left: 15px;
+  inset-inline-start: 15px;
 }
 
 .toastify-top {
@@ -60,18 +60,14 @@
 }
 
 .toastify-center {
-  margin-left: auto;
-  margin-right: auto;
-  left: 0;
-  right: 0;
+  margin-inline: auto;
+  inset-inline: 0;
 }
 
 @media (max-width: 360px) {
   .toastify-right, .toastify-left {
-    margin-left: auto;
-    margin-right: auto;
-    left: 0;
-    right: 0;
+    margin-inline: auto;
+    inset-inline: 0;
     max-width: fit-content;
   }
 }
diff --git a/web_src/css/modules/user-cards.css b/web_src/css/modules/user-cards.css
index d89ea4588c..f545c7d2db 100644
--- a/web_src/css/modules/user-cards.css
+++ b/web_src/css/modules/user-cards.css
@@ -41,7 +41,7 @@
 .user-cards .card .avatar {
   width: 48px;
   height: 48px;
-  margin-right: 14px;
+  margin-inline-end: 14px;
 }
 
 .user-cards .card .name {
diff --git a/web_src/css/org.css b/web_src/css/org.css
index 240ed5c98e..1ea22dcdbb 100644
--- a/web_src/css/org.css
+++ b/web_src/css/org.css
@@ -15,18 +15,18 @@
     width: 800px !important;
   }
   .organization.new.org form .header {
-    padding-left: 280px !important;
+    padding-inline-start: 280px !important;
   }
   .organization.new.org form .inline.field > label {
-    text-align: right;
+    text-align: end;
     width: 250px !important;
     word-wrap: break-word;
   }
   .organization.new.org form .help {
-    margin-left: 265px !important;
+    margin-inline-start: 265px !important;
   }
   .organization.new.org form .optional .title {
-    margin-left: 250px !important;
+    margin-inline-start: 250px !important;
   }
   .organization.new.org form .inline.field > input,
   .organization.new.org form .inline.field > textarea {
@@ -36,7 +36,7 @@
 
 @media (max-width: 767.98px) {
   .organization.new.org form .optional .title {
-    margin-left: 15px;
+    margin-inline-start: 15px;
   }
   .organization.new.org form .inline.field > label {
     display: block;
@@ -44,7 +44,7 @@
 }
 
 .organization.new.org form .header {
-  padding-left: 0 !important;
+  padding-inline-start: 0 !important;
   text-align: center;
 }
 
@@ -151,7 +151,7 @@
 .page-content.organization .members .ui.avatar {
   width: 48px;
   height: 48px;
-  margin-right: 5px;
+  margin-inline-end: 5px;
   margin-bottom: 5px;
 }
 
@@ -161,12 +161,12 @@
 }
 
 .organization.invite #invite-box #search-user-box input {
-  margin-left: 0;
+  margin-inline-start: 0;
   width: 300px;
 }
 
 .organization.invite #invite-box .ui.button {
-  margin-left: 5px;
+  margin-inline-start: 5px;
   margin-top: -3px;
 }
 
@@ -202,3 +202,8 @@
 .org-team-navbar .active.item {
   background: var(--color-box-body) !important;
 }
+
+#add-member-modal .team-list {
+  max-height: 300px;
+  overflow-block: auto;
+}
diff --git a/web_src/css/repo.css b/web_src/css/repo.css
index 00f159f33b..85158b4d6e 100644
--- a/web_src/css/repo.css
+++ b/web_src/css/repo.css
@@ -71,13 +71,13 @@
 .repository .issue-content-right #deadlineForm input {
   width: 12.8rem;
   border-radius: var(--border-radius) 0 0 var(--border-radius);
-  border-right: 0;
+  border-inline-end: 0;
   white-space: nowrap;
 }
 
 .repository .issue-content-right .filter.menu {
   max-height: 500px;
-  overflow-x: auto;
+  overflow-inline: auto;
 }
 
 .repository .filter.menu .label-filter .menu .info {
@@ -86,9 +86,8 @@
   font-size: 12px;
   width: 100%;
   white-space: nowrap;
-  margin-left: 10px;
-  margin-right: 8px;
-  text-align: left;
+  margin-inline: 10px 8px;
+  text-align: start;
 }
 
 .repository .filter.menu .label-filter .menu .info code {
@@ -102,20 +101,19 @@
 .repository .filter.menu .ui.dropdown .menu {
   max-height: 500px;
   max-width: 300px;
-  overflow-x: hidden;
-  right: 0;
-  left: auto;
+  overflow-inline: hidden;
+  inset-inline: auto 0;
 }
 
 /* the label-filter is the first dropdown, it shouldn't be shown leftward, otherwise it may go out the viewport (left side) */
 .repository .filter.menu .ui.dropdown.label-filter .menu {
   min-width: max-content;
-  right: unset;
-  left: 0;
+  inset-inline-end: unset;
+  inset-inline-start: 0;
 }
 
 .repository .select-label .desc {
-  padding-left: 23px;
+  padding-inline-start: 23px;
   white-space: normal;
   display: block;
   margin-top: 2px;
@@ -152,7 +150,7 @@
 
 .repository .ui.action.input.clone-panel > button + button,
 .repository .ui.action.input.clone-panel > button + input {
-  margin-left: -1px; /* make the borders overlap to avoid double borders */
+  margin-inline-start: -1px; /* make the borders overlap to avoid double borders */
 }
 
 .repository .clone-panel > button:first-of-type {
@@ -166,8 +164,7 @@
 /* Dropdown alignment */
 .repository .clone-panel .dropdown .menu,
 .repository .folder-actions .dropdown .menu {
-  right: 0 !important;
-  left: auto !important;
+  inset-inline: auto 0 !important;
 }
 
 .repository.file.list .repo-description {
@@ -215,7 +212,7 @@ td .commit-summary {
 }
 
 .latest-commit .commit-status {
-  margin-right: 0.25em;
+  margin-inline-end: 0.25em;
 }
 
 @media (max-width: 767.98px) {
@@ -223,7 +220,7 @@ td .commit-summary {
     display: none;
   }
   .latest-commit .commit-summary {
-    margin-left: 8px;
+    margin-inline-start: 8px;
   }
 }
 
@@ -233,21 +230,40 @@ td .commit-summary {
 }
 
 /* this is what limits the commit table width to a value that works on all viewport sizes */
-#repo-files-table th:first-of-type {
+.repo-files-table-latest-commit-left {
   max-width: calc(calc(min(100vw, 1280px)) - 145px - calc(2 * var(--page-margin-x)));
 }
 
-.repository.file.list #repo-files-table thead th {
+.repo-files-table-latest-commit-cell {
   font-weight: var(--font-weight-normal);
+  background: var(--color-box-header);
+  text-align: inherit;
+  color: var(--color-text);
+  vertical-align: inherit;
+  border-inline-start: none;
+  padding: 6px 5px 6px 10px;
+}
+
+.latest-commit .commit-summary {
+  white-space: nowrap;
 }
 
 .repository.file.list #repo-files-table tbody .svg {
-  margin-left: 3px;
-  margin-right: 5px;
+  margin-inline: 3px 5px;
+}
+
+@media (min-width: 767.98px) {
+  #repo-files-table tbody > tr.commit-list td {
+    border-bottom: 1px solid var(--color-secondary);
+  }
+
+  #repo-files-table tbody > tr:is(.entry, .has-parent):nth-child(2) td {
+    border-top: none;
+  }
 }
 
 .repository.file.list #repo-files-table tbody .svg.octicon-reply {
-  margin-right: 10px;
+  margin-inline-end: 10px;
 }
 
 .repository.file.list #repo-files-table tbody .svg.octicon-file-directory-fill,
@@ -262,7 +278,7 @@ td .commit-summary {
   color: var(--color-secondary-dark-7);
 }
 
-.repository.file.list #repo-files-table td {
+.repository.file.list #repo-files-table td:not(.repo-files-table-latest-commit-cell) {
   padding-top: 0;
   padding-bottom: 0;
   overflow: initial;
@@ -328,14 +344,13 @@ td .commit-summary {
   padding-bottom: 8px;
 }
 
-.repository.file.list #repo-files-table td a {
+.repository.file.list #repo-files-table td a:not(.sha, .author-wrapper) {
   padding-top: 8px;
   padding-bottom: 8px;
 }
 
 .repository.file.list #repo-files-table td .at {
-  margin-left: 3px;
-  margin-right: 3px;
+  margin-inline: 3px;
 }
 
 .repository.file.list #repo-files-table td > * {
@@ -347,11 +362,11 @@ td .commit-summary {
 }
 
 .repository.file.list #repo-files-table tr:last-of-type td:first-child {
-  border-bottom-left-radius: var(--border-radius);
+  border-end-start-radius: var(--border-radius);
 }
 
 .repository.file.list #repo-files-table tr:last-of-type td:last-child {
-  border-bottom-right-radius: var(--border-radius);
+  border-end-end-radius: var(--border-radius);
 }
 
 .repository.file.list #repo-files-table tr:hover {
@@ -399,8 +414,8 @@ td .commit-summary {
 }
 
 .code-search + #repo-files-table {
-  border-top-left-radius: 0;
-  border-top-right-radius: 0;
+  border-top-left-radius: 0; /* stylelint-disable-line logical-css/require-logical-properties */
+  border-top-right-radius: 0; /* stylelint-disable-line logical-css/require-logical-properties */
 }
 
 .view-raw {
@@ -456,7 +471,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository.file.list .non-diff-file-content .csv {
-  overflow-x: auto;
+  overflow-inline: auto;
   padding: 0 !important;
 }
 
@@ -473,7 +488,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository.file.list .sidebar {
-  padding-left: 0;
+  padding-inline-start: 0;
 }
 
 .repository.file.list .sidebar .svg {
@@ -488,20 +503,20 @@ citation-information .tab:not(.active) {
   vertical-align: middle !important;
   width: auto !important;
   padding: 7px 8px !important;
-  margin-right: 5px !important;
+  margin-inline-end: 5px !important;
 }
 
 .repository.file.editor .tabular.menu .svg {
-  margin-right: 5px;
+  margin-inline-end: 5px;
 }
 
 .repository.file.editor .commit-form-wrapper {
-  padding-left: 64px;
+  padding-inline-start: 64px;
 }
 
 .repository.file.editor .commit-form-wrapper .commit-avatar {
-  float: left;
-  margin-left: -64px;
+  float: inline-start;
+  margin-inline-start: -64px;
   width: 3em;
   height: auto;
 }
@@ -517,7 +532,7 @@ citation-information .tab:not(.active) {
 
 .repository.file.editor .commit-form-wrapper .commit-form::before,
 .repository.file.editor .commit-form-wrapper .commit-form::after {
-  right: 100%;
+  inset-inline-end: 100%;
   top: 20px;
   border: solid transparent;
   content: " ";
@@ -528,13 +543,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.file.editor .commit-form-wrapper .commit-form::before {
-  border-right-color: var(--color-secondary);
+  border-inline-end-color: var(--color-secondary);
   border-width: 9px;
   margin-top: -9px;
 }
 
 .repository.file.editor .commit-form-wrapper .commit-form::after {
-  border-right-color: var(--color-box-body);
+  border-inline-end-color: var(--color-box-body);
   border-width: 8px;
   margin-top: -8px;
 }
@@ -551,18 +566,18 @@ citation-information .tab:not(.active) {
 
 .repository.file.editor .commit-form-wrapper .commit-form .quick-pull-choice .new-branch-name-input {
   position: relative;
-  margin-left: 25px;
+  margin-inline-start: 25px;
 }
 
 .repository.file.editor .commit-form-wrapper .commit-form .quick-pull-choice .new-branch-name-input input {
   width: 240px !important;
-  padding-left: 26px !important;
+  padding-inline-start: 26px !important;
 }
 
 .repository.file.editor .commit-form-wrapper .commit-form .quick-pull-choice .octicon-git-branch {
   position: absolute;
   top: 9px;
-  left: 10px;
+  inset-inline-start: 10px;
   color: var(--color-grey);
 }
 
@@ -576,12 +591,12 @@ citation-information .tab:not(.active) {
 }
 
 .repository.new.issue .comment.form .content {
-  margin-left: 4em;
+  margin-inline-start: 4em;
 }
 
 .repository.new.issue .comment.form .content::before,
 .repository.new.issue .comment.form .content::after {
-  right: 100%;
+  inset-inline-end: 100%;
   top: 20px;
   border: solid transparent;
   content: " ";
@@ -592,13 +607,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.new.issue .comment.form .content::before {
-  border-right-color: var(--color-secondary);
+  border-inline-end-color: var(--color-secondary);
   border-width: 9px;
   margin-top: -9px;
 }
 
 .repository.new.issue .comment.form .content::after {
-  border-right-color: var(--color-box-body);
+  border-inline-end-color: var(--color-box-body);
   border-width: 8px;
   margin-top: -8px;
 }
@@ -640,7 +655,7 @@ citation-information .tab:not(.active) {
     display: none;
   }
   .comment.form .issue-content-left .content {
-    margin-left: 0 !important;
+    margin-inline-start: 0 !important;
   }
   .comment.form .issue-content-left .content::before,
   .comment.form .issue-content-left .content::after,
@@ -650,7 +665,7 @@ citation-information .tab:not(.active) {
   }
 
   .repository.view.issue .issue-title.edit-active h1 {
-    padding-right: 0;
+    padding-inline-end: 0;
   }
 }
 
@@ -669,7 +684,7 @@ citation-information .tab:not(.active) {
   font-size: 32px;
   line-height: 40px;
   margin: 0;
-  padding-right: 0.5rem;
+  padding-inline-end: 0.5rem;
 }
 
 .repository.view.issue .issue-title .ui.input {
@@ -686,7 +701,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .issue-title .label {
-  margin-right: 10px;
+  margin-inline-end: 10px;
 }
 
 .issue-state-label {
@@ -699,7 +714,7 @@ citation-information .tab:not(.active) {
 }
 
 .issue-state-label .svg {
-  margin-right: 4px;
+  margin-inline-end: 4px;
 }
 
 .repository.view.issue .pull-desc code {
@@ -714,7 +729,7 @@ citation-information .tab:not(.active) {
   vertical-align: middle;
   position: relative;
   top: -2px;
-  right: 1px;
+  inset-inline-end: 1px;
 }
 
 .repository.view.issue .pull.tabs.container {
@@ -724,12 +739,12 @@ citation-information .tab:not(.active) {
 
 .repository.view.issue .pull.tabular.menu {
   margin-bottom: 0;
-  overflow-x: auto;
-  overflow-y: hidden;
+  overflow-inline: auto;
+  overflow-block: hidden;
 }
 
 .repository.view.issue .pull.tabular.menu .svg {
-  margin-right: 5px;
+  margin-inline-end: 5px;
 }
 
 .repository.view.issue .merge.box .branch-update.grid .row {
@@ -748,7 +763,7 @@ citation-information .tab:not(.active) {
   margin-bottom: 14px;
   top: 0;
   bottom: 0;
-  left: 96px;
+  inset-inline-start: 96px;
   width: 2px;
   background-color: var(--color-timeline);
   z-index: -1;
@@ -757,8 +772,8 @@ citation-information .tab:not(.active) {
 .repository.view.issue .comment-list .timeline {
   position: relative;
   display: block;
-  margin-left: 40px;
-  padding-left: 16px;
+  margin-inline-start: 40px;
+  padding-inline-start: 16px;
 }
 
 .repository.view.issue .comment-list .timeline::before { /* ciara */
@@ -769,7 +784,7 @@ citation-information .tab:not(.active) {
   margin-bottom: 14px;
   top: 0;
   bottom: 0;
-  left: 30px;
+  inset-inline-start: 30px;
   width: 2px;
   background-color: var(--color-timeline);
   z-index: -1;
@@ -790,13 +805,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .timeline-item {
-  margin-left: 16px;
+  margin-inline-start: 16px;
   position: relative;
 }
 
 .repository.view.issue .comment-list .timeline-item .timeline-avatar {
   position: absolute;
-  left: -68px;
+  inset-inline-start: -68px;
 }
 
 /* Don't show the mobile oriented avatar ".inline-timeline-avatar" on desktop. Desktop uses the avatar with class ".timeline-avatar" */
@@ -823,9 +838,8 @@ citation-information .tab:not(.active) {
   background-color: var(--color-timeline);
   border-radius: var(--border-radius-full);
   display: flex;
-  float: left;
-  margin-left: -33px;
-  margin-right: 8px;
+  float: inline-start;
+  margin-inline: -33px 8px;
   color: var(--color-text);
   align-items: center;
   justify-content: center;
@@ -842,7 +856,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .timeline-item.comment > .content {
-  margin-left: -16px;
+  margin-inline-start: -16px;
 }
 
 .repository.view.issue .comment-list .timeline-item.event > .text {
@@ -851,13 +865,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .timeline-item.commits-list {
-  padding-left: 15px;
+  padding-inline-start: 15px;
   padding-top: 0;
 }
 
 .repository.view.issue .comment-list .timeline-item.commits-list .ui.avatar,
 .repository.view.issue .comment-list .timeline-item.event .ui.avatar {
-  margin-right: 0.25em;
+  margin-inline-end: 0.25em;
 }
 
 .repository.view.issue .comment-list .timeline-item .aggregated-actions .badge {
@@ -911,7 +925,7 @@ citation-information .tab:not(.active) {
 
 @media (max-width: 767.98px) {
   .repository.view.issue .comment-list .timeline-item .ui.segments {
-    margin-left: -2rem;
+    margin-inline-start: -2rem;
   }
 }
 
@@ -920,13 +934,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .comment > .content > div:first-child {
-  border-top-left-radius: 4px;
-  border-top-right-radius: 4px;
+  border-top-left-radius: 4px; /* stylelint-disable-line logical-css/require-logical-properties */
+  border-top-right-radius: 4px; /* stylelint-disable-line logical-css/require-logical-properties */
 }
 
 .repository.view.issue .comment-list .comment > .content > div:last-child {
-  border-bottom-left-radius: 4px;
-  border-bottom-right-radius: 4px;
+  border-bottom-left-radius: 4px; /* stylelint-disable-line logical-css/require-logical-properties */
+  border-bottom-right-radius: 4px; /* stylelint-disable-line logical-css/require-logical-properties */
 }
 
 .repository.view.issue .comment-list .comment .comment-container {
@@ -948,13 +962,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .comment .merge-section .divider {
-  margin-left: -1rem;
+  margin-inline-start: -1rem;
   width: calc(100% + 2rem);
 }
 
 .repository.view.issue .comment-list .comment .merge-section.no-header::before,
 .repository.view.issue .comment-list .comment .merge-section.no-header::after {
-  right: 100%;
+  inset-inline-end: 100%;
   top: 20px;
   border: solid transparent;
   content: " ";
@@ -965,13 +979,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .comment .merge-section.no-header::before {
-  border-right-color: var(--color-secondary);
+  border-inline-end-color: var(--color-secondary);
   border-width: 9px;
   margin-top: -9px;
 }
 
 .repository.view.issue .comment-list .comment .merge-section.no-header::after {
-  border-right-color: var(--color-box-body);
+  border-inline-end-color: var(--color-box-body);
   border-width: 8px;
   margin-top: -8px;
 }
@@ -1040,7 +1054,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .code-comment .comment-content {
-  margin-left: calc(20px + 0.5rem);
+  margin-inline-start: calc(20px + 0.5rem);
 }
 
 .repository.view.issue .comment-list .code-comment .add-reaction {
@@ -1067,14 +1081,14 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .comment > .avatar ~ .content {
-  margin-left: 42px;
+  margin-inline-start: 42px;
 }
 
 .repository.view.issue .comment-list .comment-code-cloud .segment.reactions {
   gap: var(--button-spacing);
   flex-wrap: wrap;
   width: unset !important;
-  margin-left: calc(20px + 0.5rem) !important;
+  margin-inline-start: calc(20px + 0.5rem) !important;
   margin-top: 1rem !important;
   margin-bottom: -1rem !important;
   border-top: none !important;
@@ -1103,12 +1117,12 @@ citation-information .tab:not(.active) {
 }
 
 .repository.view.issue .comment-list .event {
-  padding-left: 15px;
+  padding-inline-start: 15px;
 }
 
 .repository.view.issue .comment-list .event .detail {
   margin-top: 4px;
-  margin-left: 15px;
+  margin-inline-start: 15px;
 }
 
 .repository.view.issue .comment-list .event .detail .text {
@@ -1137,7 +1151,7 @@ citation-information .tab:not(.active) {
 
 .repository .comment.form .content .form::before,
 .repository .comment.form .content .form::after {
-  right: 100%;
+  inset-inline-end: 100%;
   top: 20px;
   border: solid transparent;
   content: " ";
@@ -1148,13 +1162,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository .comment.form .content .form::before {
-  border-right-color: var(--color-secondary);
+  border-inline-end-color: var(--color-secondary);
   border-width: 9px;
   margin-top: -9px;
 }
 
 .repository .comment.form .content .form::after {
-  border-right-color: var(--color-box-body);
+  border-inline-end-color: var(--color-box-body);
   border-width: 8px;
   margin-top: -8px;
 }
@@ -1169,7 +1183,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository.compare.pull .show-form-container {
-  text-align: left;
+  text-align: start;
 }
 
 .repository .choose.branch {
@@ -1200,7 +1214,7 @@ citation-information .tab:not(.active) {
 
 .repository.compare.pull .comment.form .content::before,
 .repository.compare.pull .comment.form .content::after {
-  right: 100%;
+  inset-inline-end: 100%;
   top: 20px;
   border: solid transparent;
   content: " ";
@@ -1211,13 +1225,13 @@ citation-information .tab:not(.active) {
 }
 
 .repository.compare.pull .comment.form .content::before {
-  border-right-color: var(--color-secondary);
+  border-inline-end-color: var(--color-secondary);
   border-width: 9px;
   margin-top: -9px;
 }
 
 .repository.compare.pull .comment.form .content::after {
-  border-right-color: var(--color-box-body);
+  border-inline-end-color: var(--color-box-body);
   border-width: 8px;
   margin-top: -8px;
 }
@@ -1241,14 +1255,14 @@ citation-information .tab:not(.active) {
 
 .repository.branches .commit-divergence .bar-group {
   position: relative;
-  float: left;
+  float: inline-start;
   padding-bottom: 6px;
   width: 50%;
   max-width: 90px;
 }
 
 .repository.branches .commit-divergence .bar-group:last-child {
-  border-left: 1px solid var(--color-secondary-dark-2);
+  border-inline-start: 1px solid var(--color-secondary-dark-2);
 }
 
 .repository.branches .commit-divergence .count {
@@ -1256,11 +1270,11 @@ citation-information .tab:not(.active) {
 }
 
 .repository.branches .commit-divergence .count.count-ahead {
-  text-align: left;
+  text-align: start;
 }
 
 .repository.branches .commit-divergence .count.count-behind {
-  text-align: right;
+  text-align: end;
 }
 
 .repository.branches .commit-divergence .bar {
@@ -1270,11 +1284,11 @@ citation-information .tab:not(.active) {
 }
 
 .repository.branches .commit-divergence .bar.bar-behind {
-  right: 0;
+  inset-inline-end: 0;
 }
 
 .repository.branches .commit-divergence .bar.bar-ahead {
-  left: 0;
+  inset-inline-start: 0;
 }
 
 .repository.commits .header .search input {
@@ -1314,7 +1328,7 @@ citation-information .tab:not(.active) {
   padding: 5px !important;
   overflow: hidden;
   font-size: 12px;
-  text-align: left;
+  text-align: start;
   white-space: nowrap;
   border: 1px solid var(--color-secondary);
 }
@@ -1328,10 +1342,10 @@ citation-information .tab:not(.active) {
   border-bottom: none !important;
 }
 .repository .data-table tr :is(td,th):first-child {
-  border-left: none !important;
+  border-inline-start: none !important;
 }
 .repository .data-table tr :is(td,th):last-child {
-  border-right: none !important;
+  border-inline-end: none !important;
 }
 
 .repository .data-table td {
@@ -1375,7 +1389,7 @@ citation-information .tab:not(.active) {
   white-space: nowrap;
   vertical-align: top;
   cursor: pointer;
-  text-align: right;
+  text-align: end;
   background: var(--color-body);
   border: 0;
 }
@@ -1399,8 +1413,7 @@ citation-information .tab:not(.active) {
   }
 }
 .repository .diff-detail-box .diff-detail-stats strong {
-  margin-left: 0.25rem;
-  margin-right: 0.25rem;
+  margin-inline: 0.25rem;
 }
 
 /* Because the translations contain the <strong> we need to style with nth-of-type */
@@ -1431,15 +1444,14 @@ citation-information .tab:not(.active) {
 
 .diff-detail-actions > *,
 .diff-detail-actions .button {
-  margin-left: 0 !important;
-  margin-right: 0 !important;
+  margin-inline: 0 !important;
 }
 
 .repository .diff-detail-box span.status {
   display: inline-block;
   width: 12px;
   height: 12px;
-  margin-right: 8px;
+  margin-inline-end: 8px;
   vertical-align: middle;
 }
 
@@ -1479,7 +1491,7 @@ citation-information .tab:not(.active) {
 .repository .diff-box .header:not(.resolved-placeholder) .button {
   padding: 0 1.125em;
   flex: 0 0 auto;
-  margin-right: 0;
+  margin-inline-end: 0;
   height: 30px;
 }
 
@@ -1505,7 +1517,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository .diff-file-box .file-body.file-code .lines-num {
-  text-align: right;
+  text-align: end;
   width: 1%;
   min-width: 50px;
 }
@@ -1545,7 +1557,7 @@ citation-information .tab:not(.active) {
 
 .repository .diff-file-box .code-diff tbody tr [data-line-num]::before {
   content: attr(data-line-num);
-  text-align: right;
+  text-align: end;
 }
 
 .repository .diff-file-box .code-diff tbody tr .lines-type-marker {
@@ -1555,12 +1567,12 @@ citation-information .tab:not(.active) {
 
 .repository .diff-file-box .code-diff tbody tr [data-type-marker]::before {
   content: attr(data-type-marker);
-  text-align: right;
+  text-align: end;
   display: inline-block;
 }
 
 .repository .diff-file-box .code-diff-split .tag-code .lines-code code.code-inner {
-  padding-left: 10px !important;
+  padding-inline-start: 10px !important;
 }
 
 .repository .diff-file-box .code-diff-split table,
@@ -1569,7 +1581,7 @@ citation-information .tab:not(.active) {
 }
 
 .repository .diff-file-box.file-content {
-  clear: right;
+  clear: inline-end;
 }
 
 .repository .diff-file-box.file-content .image-diff img {
@@ -1663,7 +1675,7 @@ details.repo-search-result summary::marker {
 /* if the element is for a checkbox, then it should have a padding-left to align to the checkbox's text */
 .repository.settings.branches .branch-protection .ui.checkbox .help,
 .repository.settings.branches .branch-protection .checkbox-sub-item {
-  padding-left: 26px;
+  padding-inline-start: 26px;
 }
 
 .repository.settings.branches .branch-protection .status-check-matched-mark {
@@ -1672,8 +1684,8 @@ details.repo-search-result summary::marker {
 }
 
 .repository .ui.attached.isSigned.isWarning {
-  border-left: 1px solid var(--color-error-border);
-  border-right: 1px solid var(--color-error-border);
+  border-inline-start: 1px solid var(--color-error-border);
+  border-inline-end: 1px solid var(--color-error-border);
 }
 
 .repository .ui.attached.isSigned.isWarning.top,
@@ -1697,8 +1709,8 @@ details.repo-search-result summary::marker {
 }
 
 .repository .ui.attached.isSigned.isVerified {
-  border-left: 1px solid var(--color-success-border);
-  border-right: 1px solid var(--color-success-border);
+  border-inline-start: 1px solid var(--color-success-border);
+  border-inline-end: 1px solid var(--color-success-border);
 }
 
 .repository .ui.attached.isSigned.isVerified.top,
@@ -1723,8 +1735,8 @@ details.repo-search-result summary::marker {
 
 .repository .ui.attached.isSigned.isVerifiedUntrusted,
 .repository .ui.attached.isSigned.isVerifiedUnmatched {
-  border-left: 1px solid var(--color-warning-border);
-  border-right: 1px solid var(--color-warning-border);
+  border-inline-start: 1px solid var(--color-warning-border);
+  border-inline-end: 1px solid var(--color-warning-border);
 }
 
 .repository .ui.attached.isSigned.isVerifiedUntrusted.top,
@@ -1755,8 +1767,7 @@ details.repo-search-result summary::marker {
 
 .repository .segment.reactions.dropdown .menu,
 .repository .select-reaction.dropdown .menu {
-  right: 0 !important;
-  left: auto !important;
+  inset-inline: auto 0 !important;
   min-width: 170px;
 }
 
@@ -1767,7 +1778,7 @@ details.repo-search-result summary::marker {
 
 .repository .segment.reactions.dropdown .menu > .item,
 .repository .select-reaction.dropdown .menu > .item {
-  float: left;
+  float: inline-start;
   margin: 4px;
   font-size: 20px;
   width: 34px;
@@ -1796,7 +1807,7 @@ details.repo-search-result summary::marker {
   display: flex !important;
   align-items: center;
   border: 0;
-  border-right: 1px solid;
+  border-inline-end: 1px solid;
   border-radius: 0;
   margin: 0;
   font-size: 12px;
@@ -1806,7 +1817,7 @@ details.repo-search-result summary::marker {
 }
 
 .repository .segment.reactions .ui.label:first-of-type {
-  border-bottom-left-radius: 3px;
+  border-end-start-radius: 3px;
 }
 
 .repository .segment.reactions .ui.label.disabled {
@@ -1825,7 +1836,7 @@ details.repo-search-result summary::marker {
 }
 
 .repository .segment.reactions .reaction-count {
-  margin-left: 0.5rem;
+  margin-inline-start: 0.5rem;
 }
 
 .repository .segment.reactions .select-reaction {
@@ -1892,7 +1903,7 @@ details.repo-search-result summary::marker {
 
 #search-user-box .results .result .image {
   order: 0;
-  margin-right: 12px;
+  margin-inline-end: 12px;
   width: 2em;
   height: 2em;
   min-width: 2em;
@@ -1985,7 +1996,7 @@ details.repo-search-result summary::marker {
 }
 
 .comment:target .header::before {
-  border-right-color: var(--color-primary) !important;
+  border-inline-end-color: var(--color-primary) !important;
   filter: drop-shadow(-3px 0 0 var(--color-primary-alpha-30)) !important;
 }
 
@@ -2021,7 +2032,7 @@ details.repo-search-result summary::marker {
 
 .comment-header::before,
 .comment-header::after {
-  right: 100%;
+  inset-inline-end: 100%;
   top: 20px;
   border: solid transparent;
   content: " ";
@@ -2032,13 +2043,13 @@ details.repo-search-result summary::marker {
 }
 
 .comment-header::before {
-  border-right-color: var(--color-secondary);
+  border-inline-end-color: var(--color-secondary);
   border-width: 9px;
   margin-top: -9px;
 }
 
 .comment-header::after {
-  border-right-color: var(--color-box-header);
+  border-inline-end-color: var(--color-box-header);
   border-width: 8px;
   margin-top: -8px;
 }
@@ -2050,12 +2061,12 @@ details.repo-search-result summary::marker {
 
 .comment-header.arrow-top::before {
   top: -9px;
-  left: 6px;
+  inset-inline-start: 6px;
 }
 
 .comment-header.arrow-top::after {
   top: -8px;
-  left: 7px;
+  inset-inline-start: 7px;
 }
 
 .comment-header-right.actions a:not(.label) {
@@ -2100,13 +2111,13 @@ details.repo-search-result summary::marker {
 }
 
 .stats-table .table-cell:first-child {
-  border-top-left-radius: 4px;
-  border-bottom-left-radius: 4px;
+  border-start-start-radius: 4px;
+  border-end-start-radius: 4px;
 }
 
 .stats-table .table-cell:last-child {
-  border-top-right-radius: 4px;
-  border-bottom-right-radius: 4px;
+  border-start-end-radius: 4px;
+  border-end-end-radius: 4px;
 }
 
 .labels-list {
@@ -2130,15 +2141,15 @@ details.repo-search-result summary::marker {
 }
 
 .ui.label.scope-left {
-  border-bottom-right-radius: 0;
-  border-top-right-radius: 0;
-  margin-right: 0;
+  border-end-end-radius: 0;
+  border-start-end-radius: 0;
+  margin-inline-end: 0;
 }
 
 .ui.label.scope-right {
-  border-bottom-left-radius: 0;
-  border-top-left-radius: 0;
-  margin-left: 0;
+  border-end-start-radius: 0;
+  border-start-start-radius: 0;
+  margin-inline-start: 0;
 }
 
 .archived-label {
@@ -2160,7 +2171,7 @@ details.repo-search-result summary::marker {
 }
 
 .repo-button-row .button.dropdown:not(.icon) {
-  padding-right: 22px !important; /* normal buttons have !important paddings, so we need to override it for dropdown (Add File) icons */
+  padding-inline-end: 22px !important; /* normal buttons have !important paddings, so we need to override it for dropdown (Add File) icons */
 }
 
 .repo-button-row .button strong {
@@ -2237,14 +2248,14 @@ tbody.commit-list {
 }
 
 .git-notes.top {
-  text-align: left;
+  text-align: start;
 }
 
 .comment-diff-data {
   background: var(--color-code-bg);
   min-height: 12em;
   max-height: calc(100vh - 10.5rem);
-  overflow-y: auto;
+  overflow-block: auto;
   tab-size: 4;
 }
 
@@ -2275,14 +2286,14 @@ tbody.commit-list {
 }
 
 .repo-topics .repo-topic:last-of-type {
-  margin-right: 0.5rem;
+  margin-inline-end: 0.5rem;
 }
 
 #new-dependency-drop-list.ui.selection.dropdown {
   min-width: 0;
   width: 100%;
   border-radius: var(--border-radius) 0 0 var(--border-radius);
-  border-right: 0;
+  border-inline-end: 0;
   white-space: nowrap;
 }
 
@@ -2329,7 +2340,7 @@ tbody.commit-list {
   align-items: center;
   display: flex;
   justify-content: space-between;
-  overflow-x: auto;
+  overflow-inline: auto;
   padding: 6px 12px !important;
   font-size: 13px !important;
   min-height: 46px;
@@ -2347,9 +2358,9 @@ tbody.commit-list {
 }
 
 .file-info-entry + .file-info-entry {
-  border-left: 1px solid currentcolor;
-  margin-left: 8px;
-  padding-left: 8px;
+  border-inline-start: 1px solid currentcolor;
+  margin-inline-start: 8px;
+  padding-inline-start: 8px;
 }
 
 #diff-container {
@@ -2386,7 +2397,7 @@ tbody.commit-list {
   top: 47px;
   max-height: calc(100vh - 47px);
   height: 100%;
-  overflow-y: auto;
+  overflow-block: auto;
 }
 
 .ui.message.unicode-escape-prompt {
@@ -2398,8 +2409,8 @@ tbody.commit-list {
 
 /* fomantic's last-child selector does not work with hidden last child */
 .ui.buttons .unescape-button {
-  border-top-right-radius: 0.28571429rem;
-  border-bottom-right-radius: 0.28571429rem;
+  border-start-end-radius: 0.28571429rem;
+  border-end-end-radius: 0.28571429rem;
 }
 
 .webhook-info {
@@ -2447,7 +2458,7 @@ tbody.commit-list {
 }
 
 .diff-file-name .ui.label {
-  margin-left: 0 !important;
+  margin-inline-start: 0 !important;
 }
 
 .diff-stats-bar {
@@ -2463,8 +2474,7 @@ tbody.commit-list {
 }
 
 .ui.form .right .ui.button {
-  margin-left: 0.25em;
-  margin-right: 0;
+  margin-inline: 0.25em 0;
 }
 
 .removed-code {
@@ -2512,7 +2522,7 @@ tbody.commit-list {
 
 .code-diff-split tbody tr td:nth-child(5),
 .code-diff-split tbody tr td.add-comment-right {
-  border-left: 1px solid var(--color-secondary);
+  border-inline-start: 1px solid var(--color-secondary);
 }
 
 .commits-table .commits-table-right form {
@@ -2535,7 +2545,7 @@ tbody.commit-list {
   .repository.file.list #repo-files-table .commit-list td.age,
   .repository.file.list #repo-files-table .entry th.age,
   .repository.file.list #repo-files-table .commit-list th.age {
-    margin-left: auto;
+    margin-inline-start: auto;
   }
   .repository.file.list #repo-files-table .entry td.message,
   .repository.file.list #repo-files-table .commit-list td.message,
@@ -2545,19 +2555,18 @@ tbody.commit-list {
   }
   .repository.view.issue .comment-list .timeline,
   .repository.view.issue .comment-list .timeline-item {
-    margin-left: 0;
+    margin-inline-start: 0;
   }
   .repository.view.issue .comment-list .timeline::before {
-    left: 14px;
+    inset-inline-start: 14px;
   }
   .repository.view.issue .comment-list .timeline .inline-timeline-avatar {
     display: flex;
     margin-bottom: auto;
-    margin-left: 6px;
-    margin-right: 2px;
+    margin-inline: 6px 2px;
   }
   .repository.view.issue .comment-list .timeline .comment-header {
-    padding-left: 4px;
+    padding-inline-start: 4px;
   }
   .repository.view.issue .comment-list .timeline .comment-header::before,
   .repository.view.issue .comment-list .timeline .comment-header::after {
@@ -2571,7 +2580,7 @@ tbody.commit-list {
   }
   .commit-header-row .ui.horizontal.list {
     width: 100%;
-    overflow-x: auto;
+    overflow-inline: auto;
     margin-top: 2px;
   }
   .commit-header-row .ui.horizontal.list .item {
@@ -2601,7 +2610,7 @@ tbody.commit-list {
     order: 2; /* the "search" button */
   }
   .commit-table {
-    overflow-x: auto;
+    overflow-inline: auto;
   }
   .commit-table td.sha,
   .commit-table th.sha {
@@ -2614,7 +2623,7 @@ tbody.commit-list {
     flex-wrap: wrap;
   }
   .comment-header .comment-header-right {
-    margin-left: auto;
+    margin-inline-start: auto;
   }
 }
 
@@ -2646,7 +2655,7 @@ tbody.commit-list {
 
 .commit-status-list {
   max-height: 240px; /* fit exactly 6 items, commit-status-item.height * 6 */
-  overflow-x: hidden;
+  overflow-inline: hidden;
   transition: max-height .2s;
 }
 
@@ -2679,7 +2688,7 @@ tbody.commit-list {
 }
 
 .commit-status-item .status-details > span {
-  padding-right: 0.5em; /* To avoid scrollbar occlusion */
+  padding-inline-end: 0.5em; /* To avoid scrollbar occlusion */
 }
 
 .search-fullname {
@@ -2722,8 +2731,8 @@ tbody.commit-list {
 .repository .issue-content .issue-content-right .ui.grid .column.muted .text.black {
   border-color: var(--color-secondary);
   background: var(--color-menu);
-  border-top-left-radius: var(--border-radius);
-  border-top-right-radius: var(--border-radius);
+  border-top-left-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
+  border-top-right-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
 }
 .repository .issue-content .issue-content-right .ui.dropdown  .scrolling.menu {
   border-top: none;
diff --git a/web_src/css/repo/file-view.css b/web_src/css/repo/file-view.css
index 2ce7f3ec0f..4f967744db 100644
--- a/web_src/css/repo/file-view.css
+++ b/web_src/css/repo/file-view.css
@@ -8,7 +8,7 @@
 }
 
 .lines-code {
-  padding-left: 5px;
+  padding-inline-start: 5px;
 }
 
 .file-view tr.active .lines-num,
@@ -18,7 +18,7 @@
 }
 
 .file-view tr.active:last-of-type .lines-code {
-  border-bottom-right-radius: var(--border-radius);
+  border-end-end-radius: var(--border-radius);
 }
 
 .file-view tr.active .lines-num {
@@ -32,7 +32,7 @@
 .file-view tr.active .lines-num::before {
   content: "";
   position: absolute;
-  left: 0;
+  inset-inline-start: 0;
   width: 2px;
   height: 100%;
   background: var(--color-highlight-fg);
diff --git a/web_src/css/repo/issue-label.css b/web_src/css/repo/issue-label.css
index 9b4b144a00..ed34116bbd 100644
--- a/web_src/css/repo/issue-label.css
+++ b/web_src/css/repo/issue-label.css
@@ -34,7 +34,7 @@
 
 .issue-label-list .item a {
   font-size: 12px;
-  padding-right: 10px;
+  padding-inline-end: 10px;
   color: var(--color-text-light);
 }
 
@@ -47,6 +47,6 @@
 }
 
 .archived-label-hint {
-  float: right;
+  float: inline-end;
   margin: -12px;
 }
diff --git a/web_src/css/repo/issue-list.css b/web_src/css/repo/issue-list.css
index 7f1b8c31cd..24bcb68afa 100644
--- a/web_src/css/repo/issue-list.css
+++ b/web_src/css/repo/issue-list.css
@@ -18,7 +18,7 @@
 }
 
 .issue-list-new.button {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 
 .list-header-issues {
@@ -31,7 +31,7 @@
   }
   .issue-list-new {
     order: 1;
-    margin-left: auto !important;
+    margin-inline-start: auto !important;
   }
   .issue-list-search {
     order: 2 !important;
@@ -44,8 +44,8 @@
    **/
   .issue-list-toolbar-right .filter.menu {
     flex-wrap: nowrap;
-    overflow-x: auto;
-    overflow-y: hidden;
+    overflow-inline: auto;
+    overflow-block: hidden;
   }
 
   /* The following few CSS was created with care and built with the information
@@ -89,7 +89,7 @@
 }
 
 #issue-list .issue-meta .checklist progress {
-  margin-left: 2px;
+  margin-inline-start: 2px;
   width: 80px;
   height: 6px;
   display: inline-block;
@@ -104,7 +104,7 @@
 }
 
 .archived-label-filter {
-  margin-left: 10px;
+  margin-inline-start: 10px;
   font-size: 12px;
   display: flex !important;
   margin-bottom: 8px;
diff --git a/web_src/css/repo/linebutton.css b/web_src/css/repo/linebutton.css
index d32899a06b..d46b8787dc 100644
--- a/web_src/css/repo/linebutton.css
+++ b/web_src/css/repo/linebutton.css
@@ -9,7 +9,7 @@
   padding: 1px 4px !important;
   position: absolute;
   font-family: var(--fonts-regular);
-  left: 0;
+  inset-inline-start: 0;
   transform: translateX(calc(-50% + 6px));
   cursor: pointer;
 }
diff --git a/web_src/css/repo/list-header.css b/web_src/css/repo/list-header.css
index 4f8e39db64..6acc4df668 100644
--- a/web_src/css/repo/list-header.css
+++ b/web_src/css/repo/list-header.css
@@ -8,8 +8,7 @@
 .list-header-sort {
   display: flex;
   align-items: center;
-  padding-left: 1rem;
-  padding-right: 1rem;
+  padding-inline: 1rem;
 }
 
 .list-header-search {
@@ -35,6 +34,6 @@
   }
   .list-header-sort {
     order: 2;
-    margin-left: auto;
+    margin-inline-start: auto;
   }
 }
diff --git a/web_src/css/repo/release-tag.css b/web_src/css/repo/release-tag.css
index b421b13562..713a268594 100644
--- a/web_src/css/repo/release-tag.css
+++ b/web_src/css/repo/release-tag.css
@@ -1,6 +1,6 @@
 #release-list {
   margin-top: 10px; /* Overriding browser default for <ul>, same value as divider */
-  padding-left: 0; /* Unset browser default */
+  padding-inline-start: 0; /* Unset browser default */
 }
 
 #release-list > li {
@@ -24,7 +24,7 @@
       grid-column: 1;
       grid-row: 1 / span 2;
       flex-direction: column;
-      text-align: right;
+      text-align: end;
 
       /* Align contents of meta column with release name */
       padding-top: 11px;
@@ -37,7 +37,7 @@
     }
     :is(.detail, .release-title-wrap) {
       /* Line separating columns on wide screen */
-      border-left: 1px solid var(--color-secondary);
+      border-inline-start: 1px solid var(--color-secondary);
       padding-inline-start: 1rem;
       margin-inline-start: 1rem;
     }
@@ -75,7 +75,7 @@
     order: 2 !important;
   }
   .release-list-buttons {
-    margin-left: auto;
+    margin-inline-start: auto;
   }
 }
 
@@ -104,7 +104,7 @@
 /* List of downloads */
 #release-list > li .detail .download .list {
   /* Override <ul> default */
-  padding-left: 0;
+  padding-inline-start: 0;
   /* Compensate emptiness that opener provides when <details> is closed */
   padding-block-end: 1rem;
 
@@ -124,14 +124,14 @@
 
   :is(li:first-child, .start-gap + hr + li) {
     border-top: 1px solid var(--color-secondary);
-    border-top-left-radius: var(--border-radius);
-    border-top-right-radius: var(--border-radius);
+    border-top-left-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
+    border-top-right-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
   }
 
   :is(li:last-child, .start-gap) {
     border-bottom: 1px solid var(--color-secondary);
-    border-bottom-left-radius: var(--border-radius);
-    border-bottom-right-radius: var(--border-radius);
+    border-bottom-left-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
+    border-bottom-right-radius: var(--border-radius); /* stylelint-disable-line logical-css/require-logical-properties */
   }
 }
 
@@ -156,8 +156,7 @@
 }
 
 .repository.new.release .target .at {
-  margin-left: -5px;
-  margin-right: 5px;
+  margin-inline: -5px 5px;
 }
 
 .repository.new.release .target .selection.dropdown {
@@ -174,7 +173,7 @@
 }
 
 .ui.ui.ui.tag-label {
-  margin-left: 0.25rem;
+  margin-inline-start: 0.25rem;
   padding: 0.2rem 0.4rem;
   gap: 0.3rem;
 }
@@ -194,7 +193,7 @@
 
 .repository .release-tag-name .ui.label.isSigned .avatar,
 .repository .release-title-wrap .ui.label.isSigned .avatar {
-  margin-left: .5rem;
+  margin-inline-start: .5rem;
 }
 
 .repository .release-tag-name .ui.label.isSigned.isVerified,
diff --git a/web_src/css/repo/wiki.css b/web_src/css/repo/wiki.css
index 3246e64634..11f1b09ab5 100644
--- a/web_src/css/repo/wiki.css
+++ b/web_src/css/repo/wiki.css
@@ -3,7 +3,7 @@
 }
 
 .repository.wiki .wiki-pages-list .wiki-git-entry {
-  margin-left: 10px;
+  margin-inline-start: 10px;
   display: none;
 }
 
@@ -33,13 +33,13 @@
 }
 
 .repository.wiki .wiki-content-main.with-sidebar {
-  float: left;
+  float: inline-start;
   width: 80%;
   max-width: calc(100% - 150px - 1em); /* match the min-width of .wiki-content-sidebar */
 }
 
 .repository.wiki .wiki-content-sidebar {
-  float: right;
+  float: inline-end;
   width: calc(20% - 1em);
   min-width: 150px;
 }
@@ -59,8 +59,8 @@
 }
 
 .repository.wiki .wiki-content-toc ul ul {
-  border-left:  1px var(--color-secondary);
-  border-left-style: dashed;
+  border-inline-start:  1px var(--color-secondary);
+  border-inline-start-style: dashed;
 }
 
 @media (max-width: 767.98px) {
diff --git a/web_src/css/review.css b/web_src/css/review.css
index 5e3b6734c4..b8df53daf3 100644
--- a/web_src/css/review.css
+++ b/web_src/css/review.css
@@ -15,7 +15,7 @@
 .ui.button.add-code-comment {
   padding: 2px;
   position: absolute;
-  margin-left: -22px;
+  margin-inline-start: -22px;
   z-index: 5;
   opacity: 0;
   transition: transform 0.1s ease-in-out;
@@ -36,7 +36,7 @@
 }
 
 .repository .diff-file-box .code-diff td.lines-escape {
-  padding-left: 0 !important;
+  padding-inline-start: 0 !important;
 }
 
 .diff-file-box .lines-code:hover .ui.button.add-code-comment {
@@ -52,8 +52,7 @@
 .repository .diff-file-box .code-diff .add-code-comment .add-comment-left,
 .repository .diff-file-box .code-diff .add-code-comment .add-comment-right,
 .repository .diff-file-box .code-diff .add-code-comment .lines-type-marker {
-  padding-left: 0 !important;
-  padding-right: 0 !important;
+  padding-inline: 0 !important;
 }
 
 .add-comment-left.add-comment-right .ui.attached.header {
@@ -86,7 +85,7 @@
 }
 
 .add-comment .comment-code-cloud form {
-  margin-left: 42px;
+  margin-inline-start: 42px;
 }
 
 @media (max-width: 767.98px) {
@@ -109,13 +108,13 @@
     flex-shrink: 0;
   }
   .comment-code-cloud .comments .comment .avatar ~ .content {
-    margin-left: 1em;
+    margin-inline-start: 1em;
   }
   .comment-code-cloud .comments .comment img.avatar {
     margin: 0 !important;
   }
   .comment-code-cloud .comments .comment .comment-content {
-    margin-left: 0 !important;
+    margin-inline-start: 0 !important;
   }
   .comment-code-cloud .comments .comment.code-comment {
     padding: 0 0 0.5rem !important;
@@ -180,7 +179,7 @@
 }
 
 .diff-file-body .comment-form {
-  margin-left: 3em;
+  margin-inline-start: 3em;
 }
 
 .diff-file-body.binary {
@@ -271,7 +270,7 @@
 }
 
 .viewed-file-form input {
-  margin-right: 4px;
+  margin-inline-end: 4px;
 }
 
 .viewed-file-checked-form {
diff --git a/web_src/css/shared/repoorg.css b/web_src/css/shared/repoorg.css
index 5573ae47b8..71720cb00f 100644
--- a/web_src/css/shared/repoorg.css
+++ b/web_src/css/shared/repoorg.css
@@ -2,7 +2,7 @@
 .organization .head .ui.header .text {
   vertical-align: middle;
   font-size: 1.6rem;
-  margin-left: 15px;
+  margin-inline-start: 15px;
 }
 
 .repository .ui.tabs.container,
@@ -13,6 +13,6 @@
 
 .repository .head .ui.header .org-visibility .label,
 .organization .head .ui.header .org-visibility .label {
-  margin-left: 5px;
+  margin-inline-start: 5px;
   margin-top: 5px;
 }
diff --git a/web_src/css/standalone/swagger.css b/web_src/css/standalone/swagger.css
index c32e392036..34241a2d91 100644
--- a/web_src/css/standalone/swagger.css
+++ b/web_src/css/standalone/swagger.css
@@ -14,7 +14,7 @@ body {
   text-decoration: none;
   position: absolute;
   top: 1rem;
-  right: 1.5rem;
+  inset-inline-end: 1.5rem;
   display: flex;
   align-items: center;
 }
@@ -26,7 +26,7 @@ body {
 .swagger-back-link svg {
   color: inherit;
   fill: currentcolor;
-  margin-right: 0.5rem;
+  margin-inline-end: 0.5rem;
 }
 
 @media (prefers-color-scheme: dark) {
diff --git a/web_src/css/themes/theme-forgejo-dark.css b/web_src/css/themes/theme-forgejo-dark.css
index 974f920158..33d1674587 100644
--- a/web_src/css/themes/theme-forgejo-dark.css
+++ b/web_src/css/themes/theme-forgejo-dark.css
@@ -336,7 +336,7 @@ i.grey.icon.icon.icon.icon {
 #review-box .review-comments-counter {
   background-color: var(--color-shadow) !important;
   color: var(--color-white) !important;
-  margin-left: 0.5em;
+  margin-inline-start: 0.5em;
 }
 .ui.basic.labels .primary.label,
 .ui.ui.ui.basic.primary.label {
diff --git a/web_src/css/themes/theme-forgejo-light.css b/web_src/css/themes/theme-forgejo-light.css
index da89f0db73..e41a7b1aca 100644
--- a/web_src/css/themes/theme-forgejo-light.css
+++ b/web_src/css/themes/theme-forgejo-light.css
@@ -307,7 +307,7 @@
 }
 #review-box .review-comments-counter {
   background-color: var(--color-label-bg) !important;
-  margin-left: 0.5em;
+  margin-inline-start: 0.5em;
 }
 .ui.basic.labels .primary.label,
 .ui.ui.ui.basic.primary.label {
diff --git a/web_src/css/user.css b/web_src/css/user.css
index 71ac2b364b..b71c270804 100644
--- a/web_src/css/user.css
+++ b/web_src/css/user.css
@@ -75,7 +75,7 @@
 }
 
 .user.settings .iconFloat {
-  float: left;
+  float: inline-start;
 }
 
 .user-orgs {
diff --git a/web_src/fomantic/package-lock.json b/web_src/fomantic/package-lock.json
index b8f6c9e298..9d6dadbfb6 100644
--- a/web_src/fomantic/package-lock.json
+++ b/web_src/fomantic/package-lock.json
@@ -91,12 +91,12 @@
       }
     },
     "node_modules/@isaacs/cliui/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -136,6 +136,7 @@
       "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
       "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/auth-token": "^6.0.0",
         "@octokit/graphql": "^9.0.3",
@@ -154,15 +155,17 @@
       "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
       "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 20"
       }
     },
     "node_modules/@octokit/core/node_modules/@octokit/endpoint": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
-      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
+      "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/types": "^16.0.0",
         "universal-user-agent": "^7.0.2"
@@ -175,18 +178,21 @@
       "version": "27.0.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
       "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@octokit/core/node_modules/@octokit/request": {
-      "version": "10.0.7",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
-      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
+      "version": "10.0.8",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.8.tgz",
+      "integrity": "sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
-        "@octokit/endpoint": "^11.0.2",
+        "@octokit/endpoint": "^11.0.3",
         "@octokit/request-error": "^7.0.2",
         "@octokit/types": "^16.0.0",
         "fast-content-type-parse": "^3.0.0",
+        "json-with-bigint": "^3.5.3",
         "universal-user-agent": "^7.0.2"
       },
       "engines": {
@@ -198,6 +204,7 @@
       "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
       "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/types": "^16.0.0"
       },
@@ -210,6 +217,7 @@
       "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
       "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/openapi-types": "^27.0.0"
       }
@@ -218,13 +226,15 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
       "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
-      "license": "Apache-2.0"
+      "license": "Apache-2.0",
+      "peer": true
     },
     "node_modules/@octokit/core/node_modules/universal-user-agent": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
       "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/@octokit/endpoint": {
       "version": "6.0.12",
@@ -248,6 +258,7 @@
       "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
       "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/request": "^10.0.6",
         "@octokit/types": "^16.0.0",
@@ -258,10 +269,11 @@
       }
     },
     "node_modules/@octokit/graphql/node_modules/@octokit/endpoint": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
-      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
+      "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/types": "^16.0.0",
         "universal-user-agent": "^7.0.2"
@@ -274,18 +286,21 @@
       "version": "27.0.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
       "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@octokit/graphql/node_modules/@octokit/request": {
-      "version": "10.0.7",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
-      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
+      "version": "10.0.8",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.8.tgz",
+      "integrity": "sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
-        "@octokit/endpoint": "^11.0.2",
+        "@octokit/endpoint": "^11.0.3",
         "@octokit/request-error": "^7.0.2",
         "@octokit/types": "^16.0.0",
         "fast-content-type-parse": "^3.0.0",
+        "json-with-bigint": "^3.5.3",
         "universal-user-agent": "^7.0.2"
       },
       "engines": {
@@ -297,6 +312,7 @@
       "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
       "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/types": "^16.0.0"
       },
@@ -309,6 +325,7 @@
       "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
       "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/openapi-types": "^27.0.0"
       }
@@ -317,7 +334,8 @@
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
       "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/@octokit/openapi-types": {
       "version": "12.11.0",
@@ -478,12 +496,12 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "25.0.10",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.0.10.tgz",
-      "integrity": "sha512-zWW5KPngR/yvakJgGOmZ5vTBemDoSqF3AcV/LrO5u5wTWyEAVVh+IT39G4gtyAkh3CtTZs8aX/yRM82OfzHJRg==",
+      "version": "25.6.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.0.tgz",
+      "integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~7.16.0"
+        "undici-types": "~7.19.0"
       }
     },
     "node_modules/@types/vinyl": {
@@ -1014,12 +1032,15 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.18",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.18.tgz",
-      "integrity": "sha512-e23vBV1ZLfjb9apvfPk4rHVu2ry6RIr2Wfs+O324okSidrX7pTAnEJPCh/O5BtRlr7QtZI7ktOP3vsqr7Z5XoA==",
+      "version": "2.10.27",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.27.tgz",
+      "integrity": "sha512-zEs/ufmZoUd7WftKpKyXaT6RFxpQ5Qm9xytKRHvJfxFV9DFJkZph9RvJ1LcOUi0Z1ZVijMte65JbILeV+8QQEA==",
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/beeper": {
@@ -1079,9 +1100,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -1110,9 +1131,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "version": "4.28.2",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
+      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
       "funding": [
         {
           "type": "opencollective",
@@ -1128,13 +1149,12 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "baseline-browser-mapping": "^2.9.0",
-        "caniuse-lite": "^1.0.30001759",
-        "electron-to-chromium": "^1.5.263",
-        "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.2.0"
+        "baseline-browser-mapping": "^2.10.12",
+        "caniuse-lite": "^1.0.30001782",
+        "electron-to-chromium": "^1.5.328",
+        "node-releases": "^2.0.36",
+        "update-browserslist-db": "^1.2.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1188,14 +1208,14 @@
       }
     },
     "node_modules/call-bind": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
-      "integrity": "sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.9.tgz",
+      "integrity": "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==",
       "license": "MIT",
       "dependencies": {
-        "call-bind-apply-helpers": "^1.0.0",
-        "es-define-property": "^1.0.0",
-        "get-intrinsic": "^1.2.4",
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "get-intrinsic": "^1.3.0",
         "set-function-length": "^1.2.2"
       },
       "engines": {
@@ -1244,9 +1264,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001766",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001766.tgz",
-      "integrity": "sha512-4C0lfJ0/YPjJQHagaE9x2Elb69CIqEPZeG0anQt9SIvIoOH4a4uaRl73IavyO+0qZh6MDLH//DrXThEYKHkmYA==",
+      "version": "1.0.30001791",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001791.tgz",
+      "integrity": "sha512-yk0l/YSrOnFZk3UROpDLQD9+kC1l4meK/wed583AXrzoarMGJcbRi2Q4RaUYbKxYAsZ8sWmaSa/DsLmdBeI1vQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -1946,14 +1966,14 @@
       "license": "MIT"
     },
     "node_modules/editorconfig": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/editorconfig/-/editorconfig-1.0.4.tgz",
-      "integrity": "sha512-L9Qe08KWTlqYMVvMcTIvMAdl1cDUubzRNYL+WfA4bLDMHe4nemKkpmYzkznE1FwLKu0EEmy6obgQKzMJrg4x9Q==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/editorconfig/-/editorconfig-1.0.7.tgz",
+      "integrity": "sha512-e0GOtq/aTQhVdNyDU9e02+wz9oDDM+SIOQxWME2QRjzRX5yyLAuHDE+0aE8vHb9XRC8XD37eO2u57+F09JqFhw==",
       "license": "MIT",
       "dependencies": {
         "@one-ini/wasm": "0.1.1",
         "commander": "^10.0.0",
-        "minimatch": "9.0.1",
+        "minimatch": "^9.0.1",
         "semver": "^7.5.3"
       },
       "bin": {
@@ -1964,21 +1984,21 @@
       }
     },
     "node_modules/editorconfig/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
       }
     },
     "node_modules/editorconfig/node_modules/minimatch": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.1.tgz",
-      "integrity": "sha512-0jWhJpD/MdhPXwPuiRkCbfYfSKp2qnn2eOc279qI7f+osl/l+prKSrvhg157zSYvx/1nmgn2NqdT6k2Z7zSH9w==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -1988,9 +2008,9 @@
       }
     },
     "node_modules/editorconfig/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -2000,9 +2020,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.278",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.278.tgz",
-      "integrity": "sha512-dQ0tM1svDRQOwxnXxm+twlGTjr9Upvt8UFWAgmLsxEzFQxhbti4VwxmMjsDxVC51Zo84swW7FVCXEV+VAkhuPw==",
+      "version": "1.5.349",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.349.tgz",
+      "integrity": "sha512-QsWVGyRuY07Aqb234QytTfwd5d9AJlfNIQ5wIOl1L+PZDzI9d9+Fn0FRale/QYlFxt/bUnB0/nLd1jFPGxGK1A==",
       "license": "ISC"
     },
     "node_modules/emoji-regex": {
@@ -2341,7 +2361,8 @@
           "url": "https://opencollective.com/fastify"
         }
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/fast-levenshtein": {
       "version": "1.1.4",
@@ -2781,9 +2802,9 @@
       }
     },
     "node_modules/get-stream/node_modules/pump": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
-      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
       "license": "MIT",
       "dependencies": {
         "end-of-stream": "^1.1.0",
@@ -2803,7 +2824,7 @@
       "version": "7.2.3",
       "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
       "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "license": "ISC",
       "dependencies": {
         "fs.realpath": "^1.0.0",
@@ -2977,7 +2998,6 @@
       "resolved": "https://registry.npmjs.org/gulp/-/gulp-4.0.2.tgz",
       "integrity": "sha512-dvEs27SCZt2ibF29xYgmnwwCYZxdxhQ/+LFWlbAW8y7jt68L/65402Lz3+CKy0Ov4rOs+NERmDq7YlZaDqUIfA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "glob-watcher": "^5.0.3",
         "gulp-cli": "^2.2.0",
@@ -3630,15 +3650,15 @@
       }
     },
     "node_modules/gulp-header": {
-      "version": "2.0.9",
-      "resolved": "https://registry.npmjs.org/gulp-header/-/gulp-header-2.0.9.tgz",
-      "integrity": "sha512-LMGiBx+qH8giwrOuuZXSGvswcIUh0OiioNkUpLhNyvaC6/Ga8X6cfAeme2L5PqsbXMhL8o8b/OmVqIQdxprhcQ==",
+      "version": "2.0.12",
+      "resolved": "https://registry.npmjs.org/gulp-header/-/gulp-header-2.0.12.tgz",
+      "integrity": "sha512-7PFW56tRISOroZ3N5R+f1Bn4wvdtE5LZXfZqz4ubEAXLEsLS7kSifgsk/lF26hSqnYO786GniQCxCuLxQZ0SoA==",
       "license": "MIT",
       "dependencies": {
         "concat-with-sourcemaps": "^1.1.0",
-        "lodash.template": "^4.5.0",
-        "map-stream": "0.0.7",
-        "through2": "^2.0.0"
+        "lodash": "^4.17.21",
+        "map-stream": "^0.0.7",
+        "through2": "^4.0.2"
       }
     },
     "node_modules/gulp-header/node_modules/map-stream": {
@@ -3647,14 +3667,27 @@
       "integrity": "sha512-C0X0KQmGm3N2ftbTGBhSyuydQ+vV1LC3f3zPvT3RXHXNZrvfPZcoXp/N5DOa8vedX/rTMm2CjTtivFg2STJMRQ==",
       "license": "MIT"
     },
-    "node_modules/gulp-header/node_modules/through2": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/through2/-/through2-2.0.5.tgz",
-      "integrity": "sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==",
+    "node_modules/gulp-header/node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "license": "MIT",
       "dependencies": {
-        "readable-stream": "~2.3.6",
-        "xtend": "~4.0.1"
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/gulp-header/node_modules/through2": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/through2/-/through2-4.0.2.tgz",
+      "integrity": "sha512-iOqSav00cVxEEICeD7TjLB1sueEL+81Wpzp2bY17uZjZN0pWZPuo4suZ/61VujxmqSGFfgOcNuTZ85QJwNZQpw==",
+      "license": "MIT",
+      "dependencies": {
+        "readable-stream": "3"
       }
     },
     "node_modules/gulp-if": {
@@ -4421,9 +4454,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -5014,9 +5047,9 @@
       }
     },
     "node_modules/js-beautify/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -5026,6 +5059,7 @@
       "version": "10.5.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
       "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "license": "ISC",
       "dependencies": {
         "foreground-child": "^3.1.0",
@@ -5043,12 +5077,12 @@
       }
     },
     "node_modules/js-beautify/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -5072,6 +5106,13 @@
       "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
       "license": "MIT"
     },
+    "node_modules/json-with-bigint": {
+      "version": "3.5.8",
+      "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.8.tgz",
+      "integrity": "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw==",
+      "license": "MIT",
+      "peer": true
+    },
     "node_modules/just-debounce": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/just-debounce/-/just-debounce-1.1.0.tgz",
@@ -5227,9 +5268,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "license": "MIT"
     },
     "node_modules/lodash._baseassign": {
@@ -5448,9 +5489,9 @@
       "license": "MIT"
     },
     "node_modules/lodash.template": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.template/-/lodash.template-4.5.0.tgz",
-      "integrity": "sha512-84vYFxIkmidUiFxidA/KjjH9pAycqW+h980j7Fuz5qxRtO9pgB7MDFTdys1N7A5mcucRiDyEq4fusljItR1T/A==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash.template/-/lodash.template-4.18.1.tgz",
+      "integrity": "sha512-5urZrLnV/VD6zHK5KsVtZgt7H19v51mIzoS0aBNH8yp3I8tbswrEjOABOPY8m8uB7NuibubLrMX+Y0PXsU9X+w==",
       "deprecated": "This package is deprecated. Use https://socket.dev/npm/package/eta instead.",
       "license": "MIT",
       "dependencies": {
@@ -5736,9 +5777,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -5757,10 +5798,10 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "license": "ISC",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
@@ -5845,9 +5886,9 @@
       "license": "ISC"
     },
     "node_modules/nan": {
-      "version": "2.25.0",
-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.25.0.tgz",
-      "integrity": "sha512-0M90Ag7Xn5KMLLZ7zliPWP3rT90P6PN+IzVFS0VqmnPktBk3700xUVv8Ikm9EUaUE5SDWdp/BIxdENzVznpm1g==",
+      "version": "2.26.2",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.26.2.tgz",
+      "integrity": "sha512-0tTvBTYkt3tdGw22nrAy50x7gpbGCCFH3AFcyS5WiUu7Eu4vWlri1woE6qHBSfy11vksDqkiwjOnlR7WV8G1Hw==",
       "license": "MIT",
       "optional": true
     },
@@ -5972,9 +6013,9 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.27",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+      "version": "2.0.38",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.38.tgz",
+      "integrity": "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw==",
       "license": "MIT"
     },
     "node_modules/node.extend": {
@@ -6928,11 +6969,12 @@
       "license": "ISC"
     },
     "node_modules/resolve": {
-      "version": "1.22.11",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
-      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
+      "version": "1.22.12",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
+      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
       "license": "MIT",
       "dependencies": {
+        "es-errors": "^1.3.0",
         "is-core-module": "^2.16.1",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
@@ -7029,7 +7071,7 @@
       "version": "5.0.15",
       "resolved": "https://registry.npmjs.org/glob/-/glob-5.0.15.tgz",
       "integrity": "sha512-c9IPMazfRITpmAAKi22dK1VKxGDX9ehhqfABDriL/lzO92xcUKEJPQHrVA/2YHSNFB4iFlykVmWvwo48nr3OxA==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "license": "ISC",
       "dependencies": {
         "inflight": "^1.0.4",
@@ -7504,9 +7546,9 @@
       }
     },
     "node_modules/spdx-license-ids": {
-      "version": "3.0.22",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.22.tgz",
-      "integrity": "sha512-4PRT4nh1EImPbt2jASOKHX7PB7I+e4IWNLvkKFDxNhJlfjbYlleYQh285Z/3mPTHSAK/AvdMmw5BNNuYH8ShgQ==",
+      "version": "3.0.23",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
+      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
       "license": "CC0-1.0"
     },
     "node_modules/split-string": {
@@ -8221,9 +8263,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "version": "7.19.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz",
+      "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
       "license": "MIT"
     },
     "node_modules/union-value": {
diff --git a/web_src/js/components/ActionJobStep.vue b/web_src/js/components/ActionJobStep.vue
index 600f1ce344..af2bf49afe 100644
--- a/web_src/js/components/ActionJobStep.vue
+++ b/web_src/js/components/ActionJobStep.vue
@@ -235,7 +235,7 @@ export default {
 }
 
 .job-step-summary .step-summary-duration {
-  margin-left: 16px;
+  margin-inline-start: 16px;
 }
 
 .job-step-summary.selected {
@@ -263,7 +263,7 @@ export default {
   flex: 1;
   word-break: break-all;
   white-space: break-spaces;
-  margin-left: 10px;
+  margin-inline-start: 10px;
   overflow-wrap: anywhere;
   color: var(--color-console-fg);
 }
@@ -281,7 +281,7 @@ export default {
 .job-log-line .line-num, .log-time-seconds {
   width: 48px;
   color: var(--color-text-light-3);
-  text-align: right;
+  text-align: end;
   user-select: none;
 }
 
@@ -291,13 +291,13 @@ export default {
 }
 
 .log-time-seconds {
-  padding-right: 2px;
+  padding-inline-end: 2px;
 }
 
 .job-log-line .log-time,
 .log-time-stamp {
   color: var(--color-text-light-3);
-  margin-left: 10px;
+  margin-inline-start: 10px;
   white-space: nowrap;
 }
 
diff --git a/web_src/js/components/DashboardRepoList.vue b/web_src/js/components/DashboardRepoList.vue
index 9bc655df32..3dcfeb2c73 100644
--- a/web_src/js/components/DashboardRepoList.vue
+++ b/web_src/js/components/DashboardRepoList.vue
@@ -466,7 +466,7 @@ export default {
 ul {
   list-style: none;
   margin: 0;
-  padding-left: 0;
+  padding-inline-start: 0;
 }
 
 ul li {
@@ -487,8 +487,7 @@ ul li:not(:last-child) {
 }
 
 .repos-filter .item {
-  padding-left: 6px !important;
-  padding-right: 6px !important;
+  padding-inline: 6px !important;
 }
 
 .repo-list-link {
@@ -505,15 +504,14 @@ ul li:not(:last-child) {
 
 .repo-list-icon {
   min-width: 16px;
-  margin-right: 2px;
+  margin-inline-end: 2px;
 }
 
 /* octicon-mirror has no padding inside the SVG */
 .repo-list-icon.octicon-mirror {
   width: 14px;
   min-width: 14px;
-  margin-left: 1px;
-  margin-right: 3px;
+  margin-inline: 1px 3px;
 }
 
 .repo-owner-name-list li.active {
diff --git a/web_src/js/components/DiffCommitSelector.vue b/web_src/js/components/DiffCommitSelector.vue
index bf388de5c4..d6715b0015 100644
--- a/web_src/js/components/DiffCommitSelector.vue
+++ b/web_src/js/components/DiffCommitSelector.vue
@@ -275,7 +275,7 @@ export default {
   }
 
   #diff-commit-selector-menu {
-    overflow-x: hidden;
+    overflow-inline: hidden;
     max-height: 450px;
   }
 
diff --git a/web_src/js/components/DiffFileTree.vue b/web_src/js/components/DiffFileTree.vue
index cddfee1e04..94c74d724d 100644
--- a/web_src/js/components/DiffFileTree.vue
+++ b/web_src/js/components/DiffFileTree.vue
@@ -139,6 +139,6 @@ export default {
   display: flex;
   flex-direction: column;
   gap: 1px;
-  margin-right: .5rem;
+  margin-inline-end: .5rem;
 }
 </style>
diff --git a/web_src/js/components/DiffFileTreeItem.vue b/web_src/js/components/DiffFileTreeItem.vue
index 0f6e54363f..2087b26fd1 100644
--- a/web_src/js/components/DiffFileTreeItem.vue
+++ b/web_src/js/components/DiffFileTreeItem.vue
@@ -61,12 +61,12 @@ a, a:hover {
   display: flex;
   flex-direction: column;
   gap: 1px;
-  margin-left: 13px;
-  border-left: 1px solid var(--color-secondary);
+  margin-inline-start: 13px;
+  border-inline-start: 1px solid var(--color-secondary);
 }
 
 .sub-items .item-file {
-  padding-left: 18px;
+  padding-inline-start: 18px;
 }
 
 .item-file.selected {
diff --git a/web_src/js/components/PullRequestMergeForm.test.js b/web_src/js/components/PullRequestMergeForm.test.js
index 7b856e0b88..86402eebc6 100644
--- a/web_src/js/components/PullRequestMergeForm.test.js
+++ b/web_src/js/components/PullRequestMergeForm.test.js
@@ -32,3 +32,35 @@ test('renders escaped branch name', async () => {
   mergeform = await renderMergeForm('<script class="evil">alert("evil message");</script>');
   expect(mergeform.get('label[for="delete-branch-after-merge"]').text()).toBe('Delete branch "<script class="evil">alert("evil message");</script>"');
 });
+
+test('hides merge controls when no merge style is allowed', () => {
+  window.config.pageData.pullRequestMergeForm = {
+    textDeleteBranch: 'Delete branch',
+    textAutoMergeButtonWhenSucceed: 'when checks succeed',
+    textAutoMergeWhenSucceed: 'Auto merge when checks succeed',
+    textAutoMergeCancelSchedule: 'Cancel schedule',
+    textCancel: 'Cancel',
+    defaultDeleteBranchAfterMerge: false,
+    defaultMergeMessage: '',
+    defaultMergeStyle: 'merge',
+    emptyCommit: false,
+    hasPendingPullRequestMerge: false,
+    hasPendingPullRequestMergeTip: '',
+    isPullBranchDeletable: false,
+    canMergeNow: true,
+    allOverridableChecksOk: true,
+    pullHeadCommitID: 'abc123',
+    mergeStyles: [{
+      name: 'merge',
+      allowed: false,
+      textDoMerge: 'Merge',
+      mergeTitleFieldText: '',
+      mergeMessageFieldText: '',
+      hideAutoMerge: false,
+    }],
+  };
+
+  const mergeform = mount(PullRequestMergeForm);
+  expect(mergeform.find('.merge-button').exists()).toBe(false);
+  expect(mergeform.find('form.form-fetch-action').exists()).toBe(false);
+});
diff --git a/web_src/js/components/PullRequestMergeForm.vue b/web_src/js/components/PullRequestMergeForm.vue
index df123f5e2f..d37aeafa9a 100644
--- a/web_src/js/components/PullRequestMergeForm.vue
+++ b/web_src/js/components/PullRequestMergeForm.vue
@@ -38,7 +38,8 @@ export default {
   },
   watch: {
     mergeStyle(val) {
-      this.mergeStyleDetail = this.mergeForm.mergeStyles.find((e) => e.name === val);
+      const mergeStyleDetail = this.mergeForm.mergeStyles.find((e) => e.name === val);
+      if (mergeStyleDetail) this.mergeStyleDetail = mergeStyleDetail;
       for (const elem of document.querySelectorAll('[data-pull-merge-style]')) {
         toggleElem(elem, elem.getAttribute('data-pull-merge-style') === val);
       }
@@ -49,6 +50,7 @@ export default {
 
     let mergeStyle = this.mergeForm.mergeStyles.find((e) => e.allowed && e.name === this.mergeForm.defaultMergeStyle)?.name;
     if (!mergeStyle) mergeStyle = this.mergeForm.mergeStyles.find((e) => e.allowed)?.name;
+    if (!mergeStyle) return;
     this.switchMergeStyle(mergeStyle, !this.mergeForm.canMergeNow);
   },
   mounted() {
@@ -62,6 +64,7 @@ export default {
       this.showMergeStyleMenu = false;
     },
     toggleActionForm(show) {
+      if (show && this.mergeStyleAllowedCount === 0) return;
       this.showActionForm = show;
       if (!show) return;
       this.deleteBranchAfterMerge = this.mergeForm.defaultDeleteBranchAfterMerge;
@@ -134,7 +137,7 @@ export default {
       </div>
     </form>
 
-    <div v-if="!showActionForm" class="tw-flex">
+    <div v-if="!showActionForm && mergeStyleAllowedCount > 0" class="tw-flex">
       <!-- the merge button -->
       <div class="ui buttons merge-button" :class="[mergeForm.emptyCommit ? 'grey' : mergeForm.allOverridableChecksOk ? 'primary' : 'red']" @click="toggleActionForm(true)">
         <button class="ui button">
@@ -146,7 +149,7 @@ export default {
             </template>
           </span>
         </button>
-        <div class="ui dropdown icon button" @click.stop="showMergeStyleMenu = !showMergeStyleMenu" v-if="mergeStyleAllowedCount>1">
+        <div class="ui dropdown icon button" @click.stop="showMergeStyleMenu = !showMergeStyleMenu" v-if="mergeStyleAllowedCount > 1">
           <svg-icon name="octicon-triangle-down" :size="14"/>
           <div class="menu" :class="{'show':showMergeStyleMenu}">
             <template v-for="msd in mergeForm.mergeStyles">
@@ -200,8 +203,7 @@ export default {
   position: static;
 }
 .ui.merge-button > .ui.dropdown:last-child > .menu:not(.left) {
-  left: 0;
-  right: auto;
+  inset-inline: 0 auto;
 }
 .ui.merge-button .ui.dropdown .menu > .item {
   display: flex;
@@ -224,7 +226,7 @@ export default {
 }
 .auto-merge-small .auto-merge-tip {
   display: none;
-  left: 38px;
+  inset-inline-start: 38px;
   top: -0.5px;
   bottom: -1px;
   position: absolute;
@@ -232,8 +234,8 @@ export default {
   color: var(--color-info-text);
   background-color: var(--color-info-bg);
   border: 1px solid var(--color-info-border);
-  border-left: none;
-  padding-right: 1rem;
+  border-inline-start: none;
+  padding-inline-end: 1rem;
 }
 
 .menu .item:has(.auto-merge-small:hover) {
diff --git a/web_src/js/components/RepoActionView.test.js b/web_src/js/components/RepoActionView.test.js
index fb6af25dd0..574be2992b 100644
--- a/web_src/js/components/RepoActionView.test.js
+++ b/web_src/js/components/RepoActionView.test.js
@@ -6,6 +6,8 @@ const testLocale = {
   approve: 'Locale Approve',
   cancel: 'Locale Cancel',
   rerun: 'Locale Re-run',
+  delete: 'Locale Delete',
+  confirmDelete: '',
   artifactsTitle: 'artifactTitleHere',
   areYouSure: '',
   confirmDeleteArtifact: '',
@@ -168,6 +170,7 @@ function configureForMultipleAttemptTests({viewHistorical}) {
       canApprove: true,
       canCancel: true,
       canRerun: true,
+      canDelete: false,
       status: 'success',
       commit: {
         pusher: {},
diff --git a/web_src/js/components/RepoActionView.vue b/web_src/js/components/RepoActionView.vue
index 5c00eecc6b..5550d84c85 100644
--- a/web_src/js/components/RepoActionView.vue
+++ b/web_src/js/components/RepoActionView.vue
@@ -4,6 +4,7 @@ import ActionRunStatus from './ActionRunStatus.vue';
 import ActionJobStepList from './ActionJobStepList.vue';
 import {toggleElem} from '../utils/dom.js';
 import {GET, POST, DELETE} from '../modules/fetch.js';
+import {showErrorToast} from '../modules/toast.js';
 
 export default {
   name: 'RepoActionView',
@@ -86,6 +87,7 @@ export default {
         canCancel: false,
         canApprove: false,
         canRerun: false,
+        canDelete: false,
         done: false,
         preExecutionError: '',
         jobs: [
@@ -237,6 +239,21 @@ export default {
       }
     },
 
+    async deleteRun() {
+      if (!window.confirm(this.locale.confirmDelete)) {
+        return;
+      }
+
+      const response = await POST(`${this.run.link}/delete`);
+
+      if (response.ok) {
+        window.location.href = this.workflowURL;
+        return;
+      }
+
+      showErrorToast(this.locale.deleteError, {duration: 5000});
+    },
+
     // cancel a run
     cancelRun() {
       POST(`${this.run.link}/cancel`);
@@ -474,6 +491,9 @@ export default {
           {{ locale.approve }}
         </button>
         <div class="action-info-summary-actions" v-else>
+          <button id="delete-run" class="ui basic small compact button red" @click="deleteRun()" v-if="run.canDelete">
+            {{ locale.delete }}
+          </button>
           <button class="ui basic small compact button red" @click="cancelRun()" v-if="canCancel">
             {{ locale.cancel }}
           </button>
@@ -638,7 +658,7 @@ export default {
   display: flex;
   align-items: center;
   gap: var(--button-spacing);
-  margin-left: auto;
+  margin-inline-start: auto;
 }
 
 .action-info-summary-actions > button {
@@ -656,12 +676,12 @@ export default {
   display: flex;
   flex-wrap: wrap;
   gap: 5px;
-  margin-left: 28px;
+  margin-inline-start: 28px;
 }
 
 @media (max-width: 767.98px) {
   .action-commit-summary {
-    margin-left: 0;
+    margin-inline-start: 0;
     margin-top: 8px;
   }
 }
@@ -675,7 +695,7 @@ export default {
   position: sticky;
   top: 12px;
   max-height: 100vh;
-  overflow-y: auto;
+  overflow-block: auto;
   background: var(--color-body);
   z-index: 2; /* above .job-info-header */
 }
@@ -701,12 +721,12 @@ export default {
 }
 
 .job-artifacts-list {
-  padding-left: 12px;
+  padding-inline-start: 12px;
   list-style: none;
 }
 
 .job-artifacts-icon {
-  padding-right: 3px;
+  padding-inline-end: 3px;
 }
 
 .job-brief-list {
@@ -827,7 +847,7 @@ export default {
 }
 
 .action-view-right .ui.dropdown.dark-dropdown .menu > .divider {
-  border-top-color: var(--color-console-menu-border);
+  border-block-start-color: var(--color-console-menu-border);
 }
 
 .action-view-right .ui.pointing.dropdown.dark-dropdown > .menu:not(.hidden)::after {
diff --git a/web_src/js/components/RepoBranchTagSelector.vue b/web_src/js/components/RepoBranchTagSelector.vue
index bee9cfb8e5..5f81f49dbc 100644
--- a/web_src/js/components/RepoBranchTagSelector.vue
+++ b/web_src/js/components/RepoBranchTagSelector.vue
@@ -287,8 +287,8 @@ export default {
 .branch-tag-item.active {
   border-color: var(--color-secondary);
   background: var(--color-menu);
-  border-top-left-radius: var(--border-radius);
-  border-top-right-radius: var(--border-radius);
+  border-start-start-radius: var(--border-radius);
+  border-start-end-radius: var(--border-radius);
 }
 
 .branch-tag-divider {
diff --git a/web_src/js/features/add-org-member.ts b/web_src/js/features/add-org-member.ts
new file mode 100644
index 0000000000..fbb8c12423
--- /dev/null
+++ b/web_src/js/features/add-org-member.ts
@@ -0,0 +1,24 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+import {showModal} from '../modules/modal.ts';
+
+export function initAddOrgMemberButton() {
+  const addMemberButton = document.querySelector('#add-org-member-button');
+  addMemberButton?.addEventListener('click', () => {
+    showModal('add-member-modal', () => {
+      const form: HTMLFormElement = document.querySelector('.add-member.form');
+      if (!form.checkValidity()) {
+        form.reportValidity();
+        return false;
+      }
+      const selectedTeamCount = document.querySelectorAll('.add-member.form input[type=checkbox]:checked').length;
+      const noTeamSelectedMessage : HTMLElement = document.querySelector('#no-team-selected-message');
+      noTeamSelectedMessage.hidden = (selectedTeamCount !== 0);
+      if (selectedTeamCount === 0) {
+        return false;
+      }
+      form.requestSubmit();
+    });
+    return false;
+  });
+}
diff --git a/web_src/js/features/codemirror.ts b/web_src/js/features/codemirror.ts
index f61449dccf..6c5bbd9217 100644
--- a/web_src/js/features/codemirror.ts
+++ b/web_src/js/features/codemirror.ts
@@ -188,7 +188,7 @@ export async function createCodemirror(
       codemirrorAutocomplete.autocompletion(),
       codemirrorCommands.history(),
       tabSize.of(
-        codemirrorState.EditorState.tabSize.of(editorOpts.tabSize || 4),
+        codemirrorState.EditorState.tabSize.of(editorOpts.indentSize || 4),
       ),
       wordWrap.of(
         editorOpts.wordWrap ? codemirrorView.EditorView.lineWrapping : [],
diff --git a/web_src/js/features/colorpicker.js b/web_src/js/features/colorpicker.js
index 6d00d908c9..33aa86375f 100644
--- a/web_src/js/features/colorpicker.js
+++ b/web_src/js/features/colorpicker.js
@@ -49,6 +49,7 @@ function initPicker(el) {
     content: picker,
     placement: 'bottom-start',
     interactive: true,
+    appendTo: input.closest('dialog') ?? document.body,
     onShow() {
       updatePicker(picker, input.value);
     },
diff --git a/web_src/js/features/common-global.js b/web_src/js/features/common-global.js
index 93a970caa0..fe644e099e 100644
--- a/web_src/js/features/common-global.js
+++ b/web_src/js/features/common-global.js
@@ -13,6 +13,7 @@ import {showErrorToast} from '../modules/toast.js';
 import {request, POST, GET} from '../modules/fetch.js';
 import '../htmx.js';
 import {initTab} from '../modules/tab.ts';
+import {initGlobalShowModal} from './show-modal.ts';
 
 const {appUrl, appSubUrl, i18n} = window.config;
 
@@ -439,53 +440,6 @@ export function initGlobalLinkActions() {
   });
 }
 
-export function initGlobalShowModal() {
-  // A ".show-modal" button will show a modal dialog defined by its "data-modal" attribute.
-  // Each "data-modal-{target}" attribute will be filled to target element's value or text-content.
-  // * First, try to query '#target'
-  // * Then, try to query '.target'
-  // * Then, try to query 'target' as HTML tag
-  // If there is a ".{attr}" part like "data-modal-form.action", then the form's "action" attribute will be set.
-  $('.show-modal').on('click', function (e) {
-    e.preventDefault();
-    const modalSelector = this.getAttribute('data-modal');
-    const $modal = $(modalSelector);
-    if (!$modal.length) {
-      throw new Error('no modal for this action');
-    }
-    const modalAttrPrefix = 'data-modal-';
-    for (const attrib of this.attributes) {
-      if (!attrib.name.startsWith(modalAttrPrefix)) {
-        continue;
-      }
-
-      const attrTargetCombo = attrib.name.substring(modalAttrPrefix.length);
-      const [attrTargetName, attrTargetAttr] = attrTargetCombo.split('.');
-      // try to find target by: "#target" -> ".target" -> "target tag"
-      let $attrTarget = $modal.find(`#${attrTargetName}`);
-      if (!$attrTarget.length) $attrTarget = $modal.find(`.${attrTargetName}`);
-      if (!$attrTarget.length) $attrTarget = $modal.find(`${attrTargetName}`);
-      if (!$attrTarget.length) continue; // TODO: show errors in dev mode to remind developers that there is a bug
-
-      if (attrTargetAttr) {
-        $attrTarget[0][attrTargetAttr] = attrib.value;
-      } else if ($attrTarget[0].matches('input, textarea')) {
-        $attrTarget.val(attrib.value); // FIXME: add more supports like checkbox
-      } else {
-        $attrTarget.text(attrib.value); // FIXME: it should be more strict here, only handle div/span/p
-      }
-    }
-
-    $modal.modal('setting', {
-      onApprove: () => {
-        // "form-fetch-action" can handle network errors gracefully,
-        // so keep the modal dialog to make users can re-submit the form if anything wrong happens.
-        if ($modal.find('.form-fetch-action').length) return false;
-      },
-    }).modal('show');
-  });
-}
-
 export function initGlobalButtons() {
   // There are many "cancel button" elements in modal dialogs, Fomantic UI expects they are button-like elements but never submit a form.
   // However, Gitea misuses the modal dialog and put the cancel buttons inside forms, so we must prevent the form submission.
diff --git a/web_src/js/features/comp/ComboMarkdownEditor.js b/web_src/js/features/comp/ComboMarkdownEditor.js
index b4bc443c0e..b42d054ae9 100644
--- a/web_src/js/features/comp/ComboMarkdownEditor.js
+++ b/web_src/js/features/comp/ComboMarkdownEditor.js
@@ -96,8 +96,8 @@ class ComboMarkdownEditor {
     this.textareaMarkdownToolbar.querySelector('button[data-md-action="unindent"]')?.addEventListener('click', () => {
       this.indentSelection(true, false);
     });
-    this.textareaMarkdownToolbar.querySelector('button[data-md-action="new-table"]')?.setAttribute('data-modal', `div[data-markdown-table-modal-id="${this.elementIdSuffix}"]`);
-    this.textareaMarkdownToolbar.querySelector('button[data-md-action="new-link"]')?.setAttribute('data-modal', `div[data-markdown-link-modal-id="${this.elementIdSuffix}"]`);
+    this.textareaMarkdownToolbar.querySelector('button[data-md-action="new-table"]')?.setAttribute('data-modal', `dialog[data-markdown-table-modal-id="${this.elementIdSuffix}"]`);
+    this.textareaMarkdownToolbar.querySelector('button[data-md-action="new-link"]')?.setAttribute('data-modal', `dialog[data-markdown-link-modal-id="${this.elementIdSuffix}"]`);
 
     // Find all data-md-ctrl-shortcut elements in the markdown toolbar.
     const shortcutKeys = new Map();
@@ -263,7 +263,7 @@ class ComboMarkdownEditor {
 
   addNewTable(event) {
     const elementId = event.target.getAttribute('data-element-id');
-    const newTableModal = document.querySelector(`div[data-markdown-table-modal-id="${elementId}"]`);
+    const newTableModal = document.querySelector(`dialog[data-markdown-table-modal-id="${elementId}"]`);
     const form = newTableModal.querySelector('div[data-selector-name="form"]');
 
     // Validate input fields
@@ -295,8 +295,9 @@ class ComboMarkdownEditor {
   }
 
   setupTableInserter() {
-    const newTableModal = this.container.querySelector('div[data-modal-name="new-markdown-table"]');
+    const newTableModal = this.container.querySelector('dialog[data-modal-name="new-markdown-table"]');
     newTableModal.setAttribute('data-markdown-table-modal-id', this.elementIdSuffix);
+    document.body.append(newTableModal); // Contains form elements, avoid conflict with form of comment editor.
 
     const button = newTableModal.querySelector('button[data-selector-name="ok-button"]');
     button.setAttribute('data-element-id', this.elementIdSuffix);
@@ -305,7 +306,7 @@ class ComboMarkdownEditor {
 
   addNewLink(event) {
     const elementId = event.target.getAttribute('data-element-id');
-    const newLinkModal = document.querySelector(`div[data-markdown-link-modal-id="${elementId}"]`);
+    const newLinkModal = document.querySelector(`dialog[data-markdown-link-modal-id="${elementId}"]`);
     const form = newLinkModal.querySelector('div[data-selector-name="form"]');
 
     // Validate input fields
@@ -330,25 +331,22 @@ class ComboMarkdownEditor {
   }
 
   setupLinkInserter() {
-    const newLinkModal = this.container.querySelector('div[data-modal-name="new-markdown-link"]');
+    const newLinkModal = this.container.querySelector('dialog[data-modal-name="new-markdown-link"]');
     newLinkModal.setAttribute('data-markdown-link-modal-id', this.elementIdSuffix);
     const textarea = document.getElementById(`_combo_markdown_editor_${this.elementIdSuffix}`);
+    document.body.append(newLinkModal); // Contains form elements, avoid conflict with form of comment editor.
 
-    $(newLinkModal).modal({
-      // Pre-fill the description field from the selection to create behavior similar
-      // to pasting an URL over selected text.
-      onShow: () => {
-        const start = textarea.selectionStart;
-        const end = textarea.selectionEnd;
+    newLinkModal.$modal = {onShow: () => {
+      const start = textarea.selectionStart;
+      const end = textarea.selectionEnd;
 
-        if (start !== end) {
-          const selection = textarea.value.slice(start ?? undefined, end ?? undefined);
-          newLinkModal.querySelector('input[name="link-description"]').value = selection;
-        } else {
-          newLinkModal.querySelector('input[name="link-description"]').value = '';
-        }
-      },
-    });
+      if (start !== end) {
+        const selection = textarea.value.slice(start ?? undefined, end ?? undefined);
+        newLinkModal.querySelector('input[name="link-description"]').value = selection;
+      } else {
+        newLinkModal.querySelector('input[name="link-description"]').value = '';
+      }
+    }};
 
     const button = newLinkModal.querySelector('button[data-selector-name="ok-button"]');
     button.setAttribute('data-element-id', this.elementIdSuffix);
diff --git a/web_src/js/features/repo-action-view.ts b/web_src/js/features/repo-action-view.ts
index 946927bf06..34cce9edc4 100644
--- a/web_src/js/features/repo-action-view.ts
+++ b/web_src/js/features/repo-action-view.ts
@@ -29,6 +29,9 @@ export async function initRepositoryActionView() {
       approve: el.getAttribute('data-locale-approve'),
       cancel: el.getAttribute('data-locale-cancel'),
       rerun: el.getAttribute('data-locale-rerun'),
+      delete: el.getAttribute('data-locale-delete'),
+      confirmDelete: el.getAttribute('data-locale-confirm-delete'),
+      deleteError: el.getAttribute('data-locale-delete-error'),
       artifactsTitle: el.getAttribute('data-locale-artifacts-title'),
       areYouSure: el.getAttribute('data-locale-are-you-sure'),
       confirmDeleteArtifact: el.getAttribute('data-locale-confirm-delete-artifact'),
diff --git a/web_src/js/features/repo-legacy.js b/web_src/js/features/repo-legacy.js
index 523ce555c4..e0d4daebef 100644
--- a/web_src/js/features/repo-legacy.js
+++ b/web_src/js/features/repo-legacy.js
@@ -27,7 +27,7 @@ import {attachRefIssueContextPopup} from './contextpopup.js';
 import {POST} from '../modules/fetch.js';
 import {MarkdownQuote} from '@github/quote-selection';
 import {toAbsoluteUrl} from '../utils.js';
-import {initDropzone, initGlobalShowModal, initDisabledInputs} from './common-global.js';
+import {initDropzone, initDisabledInputs} from './common-global.js';
 
 export function initRepoCommentForm() {
   const $commentForm = $('.comment.form');
@@ -386,8 +386,6 @@ async function onEditContent(event) {
     tabEditor?.click();
   }
 
-  initGlobalShowModal();
-
   // Show write/preview tab and copy raw content as needed
   showElem(editContentZone);
   hideElem(renderContent);
diff --git a/web_src/js/features/show-modal.ts b/web_src/js/features/show-modal.ts
new file mode 100644
index 0000000000..9f58b83479
--- /dev/null
+++ b/web_src/js/features/show-modal.ts
@@ -0,0 +1,54 @@
+// Copyright 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+import {showModal} from '../modules/modal.ts';
+
+// Initialize all elements that have the `show-modal` class. The modal ID that
+// is specified in the `data-modal` attribute will be shown. The shown modal
+// can be modified by adding more attributes:
+// * `data-modal-$TARGET="$VALUE"`, If $TARGET contains a dot then its split
+// as $TARGET and $ATTR. $TARGET will first be queried as an identifier, then as
+// a classname and then as an element tag name in the modal element. If $ATTR
+// exists then the target element will have attribute $ATTR set to value $VALUE,
+// otherwise if the element is of type input or textarea then the value is set
+// to $VALUE otherwise the textContent of that element is set to $VALUE.
+export function initGlobalShowModal() {
+  document.addEventListener('click', (e) => {
+    if (!(e.target instanceof Element)) {
+      return;
+    }
+    const target = e.target.closest('.show-modal');
+    if (!target) {
+      return;
+    }
+    e.preventDefault();
+
+    const modal = document.querySelector<HTMLDialogElement>(target.getAttribute('data-modal'));
+    if (!modal) {
+      throw new Error('No modal found for this action');
+    }
+
+    const modalAttrPrefix = 'data-modal-';
+    for (const attrib of (target as HTMLElement).attributes) {
+      if (!attrib.name.startsWith(modalAttrPrefix)) {
+        continue;
+      }
+
+      const attrTargetCombo = attrib.name.substring(modalAttrPrefix.length);
+      const [attrTargetName, attrTargetAttr] = attrTargetCombo.split('.');
+
+      // try to find target by: "#target" -> ".target" -> "target tag"
+      const attrTarget = modal.querySelector(`#${attrTargetName}, .${attrTargetName}, ${attrTargetName}`);
+
+      if (attrTargetAttr) {
+        attrTarget.setAttribute(attrTargetAttr, attrib.value);
+      } else if (attrTarget instanceof HTMLInputElement || attrTarget instanceof HTMLTextAreaElement) {
+        attrTarget.value = attrib.value; // FIXME: add more supports like checkbox
+      } else {
+        attrTarget.textContent = attrib.value; // FIXME: it should be more strict here, only handle div/span/p
+      }
+    }
+
+    showModal(modal, undefined);
+  });
+}
diff --git a/web_src/js/index.js b/web_src/js/index.js
index a3dabeacc0..c187780364 100644
--- a/web_src/js/index.js
+++ b/web_src/js/index.js
@@ -64,6 +64,7 @@ import {initOrgTeamSearchRepoBox} from './features/org-team.js';
 import {initUserAuthWebAuthn, initUserAuthWebAuthnRegister} from './features/user-auth-webauthn.js';
 import {initRepoRelease, initRepoReleaseNew} from './features/repo-release.js';
 import {initRepoEditor} from './features/repo-editor.js';
+import {initAddOrgMemberButton} from './features/add-org-member.ts';
 import {initCompSearchUserBox} from './features/comp/SearchUserBox.js';
 import {initInstall} from './features/install.js';
 import {initCompWebHookEditor} from './features/comp/WebHookEditor.js';
@@ -152,6 +153,7 @@ onDomReady(() => {
   initRepoEllipsisButton();
   initRepoDiffCommitBranchesAndTags();
   initRepoEditor();
+  initAddOrgMemberButton();
   initRepoGraphGit();
   initRepoIssueContentHistory();
   initRepoIssueDue();
diff --git a/web_src/js/modules/modal.ts b/web_src/js/modules/modal.ts
index b6fef12b2b..f82239ed95 100644
--- a/web_src/js/modules/modal.ts
+++ b/web_src/js/modules/modal.ts
@@ -3,8 +3,14 @@
 
 // showModal will show the given modal and run `onApprove` if the approve/ok/yes
 // button is pressed.
-export function showModal(modalID: string, onApprove: () => void) {
-  const modal = document.getElementById(modalID) as HTMLDialogElement;
+export function showModal(modalID: string | HTMLDialogElement, onApprove: () => void) {
+  let modal: HTMLDialogElement;
+  if (typeof modalID === 'string') {
+    modal = document.getElementById(modalID) as HTMLDialogElement;
+  } else {
+    modal = modalID;
+  }
+
   // Move the modal to `<body>`, to avoid inheriting any bad CSS or if the
   // parent becomes `display: hidden`.
   document.body.append(modal);
@@ -15,6 +21,9 @@ export function showModal(modalID: string, onApprove: () => void) {
   }, {once: true, passive: true});
   modal.querySelector('.ok')?.addEventListener('click', onApprove, {passive: true});
 
+  // Call a `onShow` callback if one is registered for this element.
+  modal?.$modal?.onShow();
+
   // The modal is ready to be shown.
   modal.showModal();
 }
diff --git a/web_src/js/types.d.ts b/web_src/js/types.d.ts
index d464f25fe9..3d3e83f465 100644
--- a/web_src/js/types.d.ts
+++ b/web_src/js/types.d.ts
@@ -14,3 +14,9 @@ type CodeMirrorLanguage = typeof import('@codemirror/language');
 type CodeMirrorSearch = typeof import('@codemirror/search');
 type CodeMirrorState = typeof import('@codemirror/state');
 type CodeMirrorView = typeof import('@codemirror/view');
+
+interface HTMLDialogElement {
+  $modal?: {
+    onShow?: () => void;
+  }
+}
diff --git a/web_src/svg/fediverse-small.svg b/web_src/svg/fediverse-small.svg
new file mode 100644
index 0000000000..43baee480e
--- /dev/null
+++ b/web_src/svg/fediverse-small.svg
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   width="24"
+   height="24"
+   viewBox="0 0 6.3499999 6.35"
+   version="1.1"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <metadata
+    xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+    xmlns:cc="http://creativecommons.org/ns#"
+    xmlns:dc="http://purl.org/dc/elements/1.1/"
+  >
+    <rdf:RDF>
+      <cc:Work rdf:about="https://codeberg.org/forgejo/forgejo/src/web_src/svg/fediverse-small.svg">
+        <dc:title>Forgejo small Fediverse icon</dc:title>
+        <cc:attributionName>The Forgejo Authors</cc:attributionName>
+        <cc:license>MIT</cc:license>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <path
+     style="stroke-linecap:round"
+     d="M 3.5898438,1.1601562 A 0.203686,0.203686 0 0 0 3.3496094,1.3203125 0.203686,0.203686 0 0 0 3.5078125,1.5605469 c 0.1072344,0.021943 0.2100638,0.054028 0.3085938,0.095703 0.1970601,0.08335 0.3741719,0.2042501 0.5234374,0.3535156 0.2985315,0.2985315 0.4843751,0.7096169 0.484375,1.1660157 0,0.2281995 -0.04751,0.4435652 -0.1308593,0.640625 a 0.203686,0.203686 0 0 0 0.109375,0.2675781 0.203686,0.203686 0 0 0 0.265625,-0.109375 C 5.1724517,3.7285087 5.2304688,3.4590205 5.2304687,3.1757813 5.2304687,2.6093024 5.0006974,2.0924942 4.6289062,1.7207031 4.4430106,1.5348075 4.2207091,1.3853417 3.9746094,1.28125 3.8515589,1.2292038 3.7237416,1.1875557 3.5898438,1.1601562 Z M 1.546875,2.265625 A 0.203686,0.203686 0 0 0 1.28125,2.375 C 1.1771594,2.6210999 1.1191406,2.8925415 1.1191406,3.1757813 c 0,0.5664787 0.2297714,1.0813338 0.6015625,1.4531249 0.1858956,0.1858957 0.408197,0.3353614 0.6542969,0.4394532 0.1230501,0.052046 0.2528205,0.093694 0.3867188,0.1210937 A 0.203686,0.203686 0 0 0 3.0019531,5.03125 0.203686,0.203686 0 0 0 2.8417969,4.7890625 C 2.7345627,4.7671193 2.6317332,4.7350342 2.5332031,4.6933594 2.3361428,4.6100096 2.1590312,4.4891093 2.0097656,4.3398437 1.7112341,4.0413123 1.5273438,3.6321799 1.5273437,3.1757813 c 0,-0.2281991 0.045557,-0.4455169 0.1289063,-0.6425782 A 0.203686,0.203686 0 0 0 1.546875,2.265625 Z"
+     transform="matrix(1.2870397,0,0,1.3110209,-0.91132678,-0.98749822)" />
+  <path
+     d="m 1.984375,0.921875 c -0.467452,2e-8 -0.8496094,0.3841105 -0.8496094,0.8515625 0,0.467452 0.3821574,0.8496094 0.8496094,0.8496094 0.467452,0 0.8496094,-0.3821574 0.8496094,-0.8496094 0,-0.467452 -0.3821574,-0.85156248 -0.8496094,-0.8515625 z m 0,0.3789062 c 0.2631744,10e-8 0.4726562,0.2094819 0.4726563,0.4726563 -1e-7,0.2631744 -0.2094819,0.4726562 -0.4726563,0.4726563 -0.2631744,-1e-7 -0.4726562,-0.2094819 -0.4726563,-0.4726563 10e-8,-0.2631744 0.2094819,-0.4726562 0.4726563,-0.4726563 z"
+     transform="matrix(1.3999375,0,0,1.4000066,-1.0582509,-1.0265909)" />
+  <path
+     d="m 4.6308594,3.7050781 c -0.6544307,10e-8 -1.1914062,0.5350214 -1.1914063,1.1894531 10e-8,0.6544318 0.5369756,1.1914062 1.1914063,1.1914063 0.6544307,0 1.1894531,-0.5369745 1.1894531,-1.1914063 0,-0.6544317 -0.5350224,-1.1894531 -1.1894531,-1.1894531 z m 0,0.5273438 c 0.3684464,0 0.6601562,0.2936593 0.6601562,0.6621093 0,0.3684501 -0.2917098,0.6621094 -0.6601562,0.6621094 -0.3684464,0 -0.6621094,-0.2936593 -0.6621094,-0.6621094 0,-0.36845 0.293663,-0.6621093 0.6621094,-0.6621093 z" />
+</svg>
\ No newline at end of file