docs: Changelog for 1.27.0-rc0 (#38247 )

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2026-09-09 06:23:24 +09:00 · 2026-06-29 21:06:07 +02:00
285 changed files with 2874 additions and 6412 deletions
@@ -9,10 +9,10 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
    - name: Build regular image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -20,7 +20,7 @@ runs:
        file: Dockerfile
        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
    - name: Build rootless image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -16,34 +16,34 @@ runs:
  using: composite
  steps:
    - if: ${{ github.workflow == 'cache-seeder' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/go-build
        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/go-build
        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/golangci-lint
        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/golangci-lint
        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
@@ -13,10 +13,10 @@ runs:
    - if: ${{ inputs.cache == 'true' }}
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 26
+        node-version: 24
        cache: pnpm
        cache-dependency-path: pnpm-lock.yaml
    - if: ${{ inputs.cache != 'true' }}
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 26
+        node-version: 24
@@ -21,12 +21,12 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: renovatebot/github-action@b50d2ba2bd928235abdcc14d06dfafc217f1c565 # v46.1.18
+      - uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg|generate-codemirror-languages)$"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
@@ -50,7 +50,7 @@ jobs:
      shell: ${{ steps.changes.outputs.shell }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
          filters: |
@@ -42,7 +42,7 @@ jobs:
      - run: make lint-spell

      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: 3.14
      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
@@ -131,7 +131,7 @@ jobs:
        ports:
          - "7700:7700"
      redis:
-        image: redis:latest@sha256:5d2c689b4b55fc3fab4b0cc8aaa950f85b508c76c1e0f35a90d8f411d55a8b2b
+        image: redis:latest@sha256:c904002d182255b6db3cbe3a1e8ce6c187d15390c39500b59fc07181aabff7bf
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -17,7 +17,7 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          sync-labels: true

@@ -35,7 +35,7 @@ jobs:
          ref: ${{ github.event.pull_request.base.sha }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version: 26
+          node-version: 24
      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
      - run: node ./tools/ci-tools.ts lint-pr-title
        env:
@@ -6,30 +6,40 @@ on:
      - main
  workflow_dispatch:

-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
  contents: read

 jobs:
  build-and-publish:
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.runner }}
+    runs-on: ubuntu-latest
+
+    env:
+      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 0
-      - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
-        id: build
-      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0
-        env:
-          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
-        with:
-          snap: ${{ steps.build.outputs.snap }}
-          release: latest/edge
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Authenticate snapcraft
+        shell: bash
+        run: snapcraft login --with <(printf '%s' "$SNAPCRAFT_STORE_CREDENTIALS")
+
+      - name: Remote build
+        run: |
+          snapcraft remote-build \
+            --launchpad-accept-public-upload \
+            --build-for=amd64,arm64,armhf
+
+      - name: List built snaps
+        run: find . -maxdepth 1 -type f -name '*.snap' -print
+
+      - name: Upload and release snapcraft nightly build
+        run: |
+          set -euo pipefail
+
+          for snap in ./*.snap; do
+            echo "Uploading $snap to edge"
+            snapcraft upload --release="latest/edge" "$snap"
+          done
@@ -23,7 +23,12 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -56,7 +61,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -78,8 +83,8 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -87,7 +92,7 @@ jobs:
        run: |
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -97,7 +102,7 @@ jobs:
            type=raw,value=${{ steps.clean_name.outputs.branch }}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -111,18 +116,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -132,7 +137,7 @@ jobs:
          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
      - name: build rootless docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -24,7 +24,12 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -57,7 +62,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -89,9 +94,9 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -104,7 +109,7 @@ jobs:
            type=semver,pattern={{version}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -120,18 +125,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -139,7 +144,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -27,7 +27,12 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -60,7 +65,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -92,9 +97,9 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -111,7 +116,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -132,18 +137,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -151,7 +156,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -4,6 +4,274 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

+## [1.27.0-rc0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0-rc0) - 2026-06-28
+
+* BREAKING
+  * Feat(actions)!: improve support for reusable workflows (#37478)
+  * Use Content-Security-Policy: script nonce (#37232)
+
+* SECURITY
+  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
+  * Fix(oauth): restrict introspection to the token's client (#38042)
+  * Fix(api): don't expose private org membership via public_members (#38145)
+  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
+  * Fix(migrations): prevent path traversal in repository restore (#38215)
+
+* FEATURES
+  * Feat(actions): add workflow status badge modal (#38196)
+  * Feat(actions): support owner-level and global scoped workflows (#38154)
+  * Feat(api): support ref suffixes in compare (#38148)
+  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
+  * Feat(actions): show run status on browser tab favicon (#38071)
+  * Feat(api): add token introspection and self-deletion endpoint (#37995)
+  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
+  * Feat(repo): split repository creation limit into user and org scopes (#37872)
+  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
+  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
+  * Feat(org): add team visibility so org members can discover teams (#37680)
+  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
+  * Feat: Add avatar stacks (#37594)
+  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
+  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
+  * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
+  * Feat(orgs): Add search bar for organization members tab page (#37347)
+  * Feat(api): Add assignees APIs (#37330)
+  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
+  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
+  * Add project column picker to issue and pull request sidebar (#37037)
+  * Allow multiple projects per issue and pull requests (#36784)
+  * Feat(ui): add "follow rename" to file commit history list (#34994)
+  * Feat(ssh): auto generate additional ssh keys (#33974)
+
+* ENHANCEMENTS
+  * Enhance: allow builtin default git config options to be overridden (#38172)
+  * Enhance: allow MathML core elements (#38034)
+  * Enhance(markup): improve issue title rendering (#37908)
+  * Enhance(actions): set descriptive browser tab title on run view (#37870)
+  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
+  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
+  * Feat(actions): add before/after to PR synchronize event payload (#37827)
+  * Enhance(actions): add branch filters to run list (#37826)
+  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
+  * Feat: add copy button to action step header, improve other copy buttons (#37744)
+  * Fix(icon): use repo-forked icon to display forks count (#37731)
+  * Feat(api): add sort and order query parameters to job list endpoints (#37672)
+  * Feat(api): add last_sync to repository API (#37566)
+  * Enhance: Adjust Workflow Graph styling (#37497)
+  * Improve code editor text selection and clean up lint enablement (#37474)
+  * Add mirror auth updates to repo edit API and settings (#37468)
+  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
+  * Feat: Add default PR branch update style setting (#37410)
+  * Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
+  * Allow fast-forward-only merge when signed commits are required (#37335)
+  * Enhance styling in actions page (#37323)
+  * Fix: improve actions status icons and texts (#37206)
+  * Make Markdown fenced code block work with more syntaxes (#37154)
+  * Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
+  * Add API endpoint to reply to pull request review comments (#36683)
+
+* PERFORMANCE
+  * Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
+  * Perf: Various performance regression fixes (#38078)
+  * Perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076)
+  * Batch-load related data in actions run, job, and task API endpoints (#37032)
+
+* BUGFIXES
+  * Fix: update npm dependencies, fix misc issues (#38257)
+  * Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
+  * Fix: codemirror regressions (#38248)
+  * Fix(api): support HEAD requests on all API GET endpoints (#38245)
+  * Fix(actions): Cleanup workflow status badge code (#38241)
+  * Fix(web): Correctly align the "disabled" label on larger workflow names (#38240)
+  * Fix(actions): don't swallow HTML entities into linkified URLs (#38239)
+  * Fix(packages): accept npm "repository" and "bin" in string form (#38236)
+  * Fix(actions): fix 500 error when canceling a canceling task (#38223)
+  * Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
+  * Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
+  * Fix(api): deny private org member enumeration via /members (#38213)
+  * Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
+  * Fix(deps): update go dependencies (#38194)
+  * Fix(deps): update npm dependencies (#38193)
+  * Fix(cli): default must-change-password to false for bot users (#38175)
+  * Fix(actions): show run index in run view and fix summary graph height (#38165)
+  * Fix: csp (#38162)
+  * Fix(deps): update npm dependencies (#38123)
+  * Fix(mssql): expand legacy issue and comment long-text columns (#38120)
+  * Fix(packages): validate debian distribution and component names (#38116)
+  * Fix(packages): validate module version in goproxy ParsePackage (#38104)
+  * Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
+  * Fix: git push hook post receive (#38089)
+  * Fix(ui): prevent commit status popup overflowing its row (#38081)
+  * Fix: validate gem name in rubygems parseMetadataFile (#38061)
+  * Fix: commit display name (#38057)
+  * Fix: csp regressions (#38047)
+  * Fix: api error message (#38031)
+  * Fix(deps): update npm dependencies (#38029)
+  * Fix: pgsql lint (#38022)
+  * Fix(indexer): fix assignee filters in issue search (#38021)
+  * Fix: various dropdown problems (#38020)
+  * Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
+  * Fix: raise git required version to 2.13 (#37996)
+  * Fix: remove "no-transfrom" from the cache-control header (#37985)
+  * Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
+  * Fix: use committer time where ever possible as default (#37969)
+  * Fix(deps): update npm dependencies, remove nolyfill (#37968)
+  * Fix(deps): update go dependencies (#37967)
+  * Fix(pull): preserve squash message trailers and additional commit messages (#37954)
+  * Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
+  * Fix: support ##[command] log prefix in action run UI (#37882)
+  * Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
+  * Fix(deps): update npm dependencies (#37844)
+  * Fix(deps): update go dependencies (#37841)
+  * Fix(frontend): resolve Vite assets by manifest source path (#37836)
+  * Fix(locales): Replace hardcoded strings (#37788)
+  * Fix(packages): render markdown links relative to linked repo (#37676)
+  * Fix: persist mirror repository metadata (#37519)
+  * Fix cmd tests by mocking builtin paths (#37369)
+  * Add `form-fetch-action` to some forms, fix "fetch action" resp bug (#37305)
+  * Feat: execute post run cleanup when workflow is cancelled (#37275)
+  * Fix `relative-time` error and improve global error handler (#37241)
+  * Refactor flash message and remove SanitizeHTML template func (#37179)
+
+* TESTING
+  * Test: speed up two tests (#37905)
+  * Test: Fix random failure test (#37887)
+  * Test: fix flaky `issue-comment` close test (#37880)
+  * Test: enable WAL for sqlite integration tests (#37861)
+  * Test: fix flaky `TestResourceIndex` and reduce its runtime (#37847)
+  * Test: run `TestAPIRepoMigrate` offline via a local clone source (#37817)
+  * Ci: shard tests and reduce redundant work (#37618)
+  * Test(e2e): run playwright via container (#37300)
+  * Remove external service dependencies in migration tests (#36866)
+
+* BUILD
+  * Fix(actions): authenticate snapcraft before nightly remote build (#38252)
+  * Ci: cap Elasticsearch heap in db-tests (#37816)
+  * Build(snap): publish nightly version to snapcraft via actions (#37814)
+  * Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
+  * Ci: narrow files-changed frontend filter (#37749)
+  * Ci: add `zizmor` to `lint-actions` (#37720)
+  * Chore: clean up "contrib" dir (#37690)
+  * Fix: snap build (main branch) (#37685)
+  * Ci: Also lint json5 files (#37659)
+  * Feat(editor): broaden language detection in web code editor (#37619)
+  * Build: update pnpm to v11 (#37591)
+  * Refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (#37557)
+  * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543)
+  * Update go js py dependencies (#37525)
+  * Ci: lint PR titles with commitlint (#37498)
+  * Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
+  * Update GitHub Actions to latest major versions (#37313)
+  * Update go js dependencies (#37312)
+  * Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
+  * Remove htmx (#37224)
+  * Replace custom Go formatter with `golangci-lint fmt` (#37194)
+  * Refactor htmx and fetch-action related code (#37186)
+  * Integrate renovate bot for all dependency updates (#37050)
+  * Build(sign): move to sigstore (#38250)
+
+* DOCS
+  * Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
+  * Docs: fix duplicated word in foreachref doc comment (#38161)
+  * Docs: Clarify criteria for becoming a merger (#38113)
+  * Docs: Publish TOC Election Result 2026 (#38111)
+  * Docs: mark openapi3 as autogenerated in attributes (#37963)
+  * Docs: add development setup guide (#37960)
+
+* MISC
+  * Revert(sign): restore gpg (#38251)
+  * Refactor: replace legacy `delete-button` with `link-action` (#38143)
+  * Refactor(actions): read runner capabilities from proto field (#38068)
+  * Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
+  * Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
+  * Fix(deps): update go dependencies (#37851)
+  * Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
+  * Ci: tweak `files-changed`, add `free-disk-space` (#37819)
+  * Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
+  * Test(e2e): add comment, release, star, PR and fork tests (#37800)
+  * Chore: simplify issue and pull request templates (#37799)
+  * Chore: Update giteabot to fix failure when backport (#37789)
+  * Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
+  * Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
+  * Ci: split giteabot workflow (#37770)
+  * Fix(deps): update npm dependencies (#37768)
+  * Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
+  * Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
+  * Ci: fix cache-related issues (#37761)
+  * Chore: fix tests (#37760)
+  * Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
+  * Fix(deps): update npm dependencies (#37753)
+  * Fix(deps): update go dependencies (#37752)
+  * Chore(deps): update action dependencies (#37751)
+  * Fix(markup): wrap indented code blocks for the code-copy button (#37748)
+  * Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
+  * Feat(web): also display PR counts in repo list (#37739)
+  * Refactor(glob): use strings.Builder for regexp compilation (#37730)
+  * Chore(doctor): remove four obsolete doctor check implementations (#37728)
+  * Refactor(org): simplify owner-team org repo creation logic (#37727)
+  * Refactor: move `workflowpattern` into `modules/actions` (#37717)
+  * Chore: clean up tests (#37715)
+  * Style: misc UI fixes (#37691)
+  * Ci: add shellcheck linter (#37682)
+  * Fix: catch and fix more lint problems (#37674)
+  * Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
+  * Fix(deps): update npm dependencies (#37647)
+  * Ci(renovate): update Go import paths on major bumps (#37641)
+  * Fix(deps): update go dependencies (major) (#37639)
+  * Chore(deps): update action dependencies (major) (#37638)
+  * Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
+  * Fix(deps): update npm dependencies (#37636)
+  * Refactor(log): replace log.Critical with log.Error (#37624)
+  * Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
+  * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
+  * Chore(deps): update action dependencies (#37603)
+  * Ci: allow `chore` type in PR title lint (#37575)
+  * Refactor: only reset a database table when the table's data was changed (#37573)
+  * Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
+  * Refactor: use modernc sqlite driver as default (#37562)
+  * Docs: fix 4 typos in CHANGELOG.md (#37549)
+  * Fix(deps): update go dependencies (#37541)
+  * Chore(deps): update action dependencies (#37540)
+  * Refactor pull request view (6) (#37522)
+  * Fix: redirect early CLI console logger to stderr (#37507)
+  * Refactor "flex-list" to "flex-divided-list" (#37505)
+  * Refactor compare diff/pull page (1) (#37481)
+  * Refactor pull request view (4) (#37451)
+  * Update 1.26.1 changelog in main (#37442)
+  * Refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (#37441)
+  * Refactor: serve site manifest via `/assets/site-manifest.json` endpoint (#37405)
+  * Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
+  * Update `Block a user` form (#37359)
+  * Move review request functions to a standalone file (#37358)
+  * Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
+  * Enable strict TypeScript, add `errorMessage` helper (#37292)
+  * Refactor frontend `tw-justify-between` layouts to `flex-left-right` (#37291)
+  * Update Nix flake (#37284)
+  * Fix Repository transferring page (#37277)
+  * Remove `SubmitEvent` polyfill (#37276)
+  * Remove dead code identified by `deadcode` tool (#37271)
+  * Upgrade go-git to v5.18.0 (#37268)
+  * Don't add useless labels which will bother changelog generation (#37267)
+  * Move heatmap to first-party code (#37262)
+  * Tests/integration: simplify code (#37249)
+  * Add pagination and search box to org teams list (#37245)
+  * Remove error returns from crypto random helpers and callers (#37240)
+  * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229)
+  * Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
+  * Refactor "htmx" to "fetch action" (#37208)
+  * Update go js py dependencies (#37204)
+  * Add comment for the design of "user activity time" (#37195)
+  * Remove outdated RunUser logic (#37180)
+  * Models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150)
+  * Update javascript dependencies (#37142)
+  * Update go dependencies (#37141)
+  * Frontport changelog of v1.26.0-rc0 (#37138)
+  * Introduce `ActionRunAttempt` to represent each execution of a run (#37119)
+  * Workflow Artifact Info Hover (#37100)
+  * Extend issue context popup beyond markdown content (#36908)
+  * Add bulk repository deletion for organizations (#36763)
+  * Feat: Add bypass allowlist for branch protection (#36514)
+
 ## [1.26.4](https://github.com/go-gitea/gitea/releases/tag/1.26.4) - 2026-06-21

 * SECURITY
@@ -41,6 +41,7 @@ Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
+Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)
@@ -12,13 +12,13 @@ COMMA := ,
 XGO_VERSION := go-1.26.x

 AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.8.0 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
 GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.35.0 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.1 # renovate: datasource=go
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.5.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.4.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
 SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker

@@ -231,9 +231,7 @@ endif
 generate-swagger: $(SWAGGER_SPEC) $(OPENAPI3_SPEC) ## generate the swagger spec from code comments

 $(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
-	@output="$$($(GO) run $(SWAGGER_PACKAGE) generate spec --enable-allof-compounding --skip-enum-desc --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)' 2>&1)" || { printf '%s\n' "$$output" >&2; exit 1; }; \
-	warnings="$$(printf '%s\n' "$$output" | grep -v '^go: ')"; \
-	if [ -n "$$warnings" ]; then printf '%s\n' "$$warnings" >&2; exit 1; fi
+	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'

 .PHONY: swagger-check
 swagger-check: generate-swagger
@@ -248,11 +246,9 @@ swagger-check: generate-swagger
 swagger-validate: ## check if the swagger spec is valid
 	@# swagger "validate" requires that the "basePath" must start with a slash, but we are using Golang template "{{...}}"
 	@$(SED_INPLACE) -E -e 's|"basePath":( *)"(.*)"|"basePath":\1"/\2"|g' './$(SWAGGER_SPEC)' # add a prefix slash to basePath
-	@output="$$($(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)' 2>&1)"; status=$$?; \
-	$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)'; \
-	printf '%s\n' "$$output" | grep -v '^go: '; \
-	[ $$status -eq 0 ] || exit $$status; \
-	case "$$output" in *WARNING:*) exit 1;; esac
+	@# FIXME: there are some warnings
+	$(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)'
+	@$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)' # remove the prefix slash from basePath

 .PHONY: generate-openapi3
 generate-openapi3: $(OPENAPI3_SPEC) ## generate the OpenAPI 3.0 spec from the Swagger 2.0 spec
@@ -436,7 +436,6 @@
      "jsonl",
      "mcmeta",
      "sarif",
-      "slnlaunch",
      "tact",
      "tfstate",
      "topojson",
@@ -692,17 +691,10 @@
    "extensions": [
      "ini",
      "cnf",
-      "container",
      "dof",
      "lektorproject",
-      "mount",
-      "network",
      "prefs",
      "properties",
-      "service",
-      "socket",
-      "target",
-      "timer",
      "url",
      "conf"
    ],
@@ -18,7 +18,6 @@ func newUserCommand() *cli.Command {
 			microcmdUserDelete(),
 			newUserGenerateAccessTokenCommand(),
 			microcmdUserMustChangePassword(),
-			microcmdUserDisableTwoFactor(),
 		},
 	}
 }
@@ -1,72 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-
-	auth_model "gitea.dev/models/auth"
-	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/setting"
-
-	"github.com/urfave/cli/v3"
-)
-
-func microcmdUserDisableTwoFactor() *cli.Command {
-	return &cli.Command{
-		Name:  "disable-2fa",
-		Usage: "Disable two-factor authentication for a user",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "username",
-				Aliases: []string{"u"},
-				Usage:   "Username of the user to disable 2FA for",
-			},
-			&cli.Int64Flag{
-				Name:  "id",
-				Usage: "ID of the user to disable 2FA for",
-			},
-		},
-		Action: runDisableTwoFactor,
-	}
-}
-
-func runDisableTwoFactor(ctx context.Context, c *cli.Command) error {
-	if !c.IsSet("id") && !c.IsSet("username") {
-		return errors.New("either --id or --username must be provided")
-	}
-
-	if !setting.IsInTesting {
-		if err := initDB(ctx); err != nil {
-			return err
-		}
-	}
-
-	var user *user_model.User
-	var err error
-	if c.IsSet("id") {
-		user, err = user_model.GetUserByID(ctx, c.Int64("id"))
-	} else {
-		user, err = user_model.GetUserByName(ctx, c.String("username"))
-	}
-	if err != nil {
-		return err
-	}
-
-	// When both selectors are given, make sure they refer to the same user.
-	if c.IsSet("id") && c.IsSet("username") && user.LowerName != strings.ToLower(strings.TrimSpace(c.String("username"))) {
-		return fmt.Errorf("the user with id %d is %q, which does not match the provided username %q", user.ID, user.Name, c.String("username"))
-	}
-
-	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, user.ID)
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("Disabled 2FA for user %q (removed %d TOTP and %d WebAuthn credential(s))\n", user.Name, totp, webAuthn)
-	return nil
-}
@@ -1,119 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"io"
-	"strconv"
-	"testing"
-
-	auth_model "gitea.dev/models/auth"
-	"gitea.dev/models/db"
-	"gitea.dev/models/unittest"
-	user_model "gitea.dev/models/user"
-
-	"github.com/go-webauthn/webauthn/webauthn"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDisableTwoFactorCommand(t *testing.T) {
-	ctx := t.Context()
-
-	defer func() {
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}, &auth_model.TwoFactor{}, &auth_model.WebAuthnCredential{}))
-	}()
-
-	t.Run("disable TOTP and WebAuthn", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "tfuser", "--email", "tfuser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "tfuser"})
-
-		// Enroll TOTP.
-		tf := &auth_model.TwoFactor{UID: user.ID}
-		require.NoError(t, tf.SetSecret("test-secret"))
-		_, err := tf.GenerateScratchToken()
-		require.NoError(t, err)
-		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
-
-		// Register a WebAuthn credential.
-		_, err = auth_model.CreateCredential(ctx, user.ID, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
-		require.NoError(t, err)
-
-		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		require.True(t, has)
-
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "tfuser"}))
-
-		// Both factors must be gone afterwards.
-		has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		assert.False(t, has)
-	})
-
-	t.Run("disable by id", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "iduser", "--email", "iduser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "iduser"})
-
-		tf := &auth_model.TwoFactor{UID: user.ID}
-		require.NoError(t, tf.SetSecret("test-secret"))
-		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
-
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", strconv.FormatInt(user.ID, 10)}))
-
-		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		assert.False(t, has)
-	})
-
-	t.Run("no enrollment is a no-op", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "plainuser", "--email", "plainuser@gitea.local", "--random-password"}))
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "plainuser"}))
-	})
-
-	t.Run("id and username must match when both given", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "matchuser", "--email", "matchuser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "matchuser"})
-		id := strconv.FormatInt(user.ID, 10)
-
-		// Matching id + username is accepted.
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", id, "--username", "matchuser"}))
-
-		// Mismatched id + username is rejected.
-		cmd := microcmdUserDisableTwoFactor()
-		cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
-		err := cmd.Run(ctx, []string{"disable-2fa", "--id", id, "--username", "someotheruser"})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "does not match the provided username")
-	})
-
-	t.Run("failure cases", func(t *testing.T) {
-		testCases := []struct {
-			name        string
-			args        []string
-			expectedErr string
-		}{
-			{
-				name:        "user does not exist",
-				args:        []string{"disable-2fa", "--username", "nonexistentuser"},
-				expectedErr: "user does not exist",
-			},
-			{
-				name:        "neither id nor username",
-				args:        []string{"disable-2fa"},
-				expectedErr: "either --id or --username must be provided",
-			},
-		}
-
-		for _, tc := range testCases {
-			t.Run(tc.name, func(t *testing.T) {
-				cmd := microcmdUserDisableTwoFactor()
-				cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
-				err := cmd.Run(ctx, tc.args)
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tc.expectedErr)
-			})
-		}
-	})
-}
@@ -536,13 +536,6 @@ INTERNAL_TOKEN =
 ;; Leave it empty to apply the default policy, or set it to "unset" to disable Content-Security-Policy.
 ;CONTENT_SECURITY_POLICY_GENERAL =

-;; Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
-;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
-;; CIDR list: 1.2.3.0/8, 2001:db8::/32
-;; Wildcard hosts: *.mydomain.com, 192.168.100.*
-;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
-;ALLOWED_HOST_LIST = external
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [camo]
@@ -1198,7 +1191,6 @@ LEVEL = Info
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
-;; "branch-name" always uses the PR's branch name.
 ;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
@@ -1762,6 +1754,13 @@ LEVEL = Info
 ;; Deliver timeout in seconds
 ;DELIVER_TIMEOUT = 5
 ;;
+;; Webhook can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
+;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
+;; CIDR list: 1.2.3.0/8, 2001:db8::/32
+;; Wildcard hosts: *.mydomain.com, 192.168.100.*
+;; Since 1.15.7. Default to * for 1.15.x, external for 1.16 and later
+;ALLOWED_HOST_LIST = external
+;;
 ;; Allow insecure certification
 ;SKIP_TLS_VERIFY = false
 ;;
@@ -3009,10 +3008,6 @@ LEVEL = Info
 ;SCOPED_WORKFLOW_DIRS = .gitea/scoped_workflows
 ;; Maximum number of attempts a single workflow run can have. Default value is 50.
 ;MAX_RERUN_ATTEMPTS = 50
-;; Maximum number of runners that may run the task-assignment query concurrently, per Gitea instance.
-;; Caps this instance's DB load when many runners poll at once; excess runners retry on their next poll.
-;; In a multi-instance deployment the cluster-wide limit is this value times the number of instances. Default value is 16.
-;MAX_CONCURRENT_TASK_PICKS = 16

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -95,15 +95,8 @@ However, if there are no objections from maintainers, the PR can be merged with
 ### Commit messages

 Mergers are required to rewrite the PR title and the first comment (the summary) when necessary so the squash commit message is clear.
-Usually the Pull Request description and commit message body should not be empty, unless the title is already clear enough or the description would be a copy of the comments in code.

-The final commit message:
-
- should match the code changes.
- should only keep true co-authors, false-positive co-authors should be removed.
- should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
- should not contain hidden information like `<!-- -->` or extra information after the description's divider `----`.
- should not contain unrelated contents (e.g.: Release Notes, Configuration, etc.) from a Renovate update PR.
+The final commit message should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.

 #### PR Co-authors

@@ -165,16 +158,9 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:

 - Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
- Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
-  In particular, mergers should edit the PR description.\
-  Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.
+- Rewriting the PR title and summary so the squash [commit message](#commit-messages) is clear, removing false-positive co-authors while keeping every true co-author.
 - Assigning the correct labels (including `type/…`) needed for changelog and backport decisions.
 - Agreeing, together with the owners, on when a release is ready (see [release management](release-management.md)).
- Merging a PR also means the PR looks good to the merger and is approved by the merger.
-
-If a merger violates these merge guides more than 3 times in the past 365 days
-(e.g.: merge with unresolved reviews without TOC decision to ignore the review, merge with garbage commit messages),
-they may lose their merging privileges for at least three months.

 #### Becoming a merger

@@ -214,20 +200,20 @@ random.seed("Gitea TOC <YEAR> Election")
 random.choice([<CANDIDATE_1>, <CANDIDATE_2>, ...])
 ```

-The result of this script needs then to be published in the TOC election issue to ensure transparency of the process.
+The result of this script needs then to be published in the TOC election issue to ensure transparency of the process. 

 ### Current TOC members

 - 2026-06-14 ~ 2026-12-31
  - Company
-    - [Yu Tian](https://gitea.com/Zettat123) <zettat123@gmail.com>
+    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
  - Community
    - [bircni](https://gitea.com/bircni) <bircni@icloud.com>
    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
    - [TheFox0x7](https://gitea.com/TheFox0x7) <thefox0x7@gmail.com>
-
+    

 ### Previous TOC/owners members

@@ -241,7 +227,7 @@ Here's the history of the owners and the time they served:
 - [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
 - [6543](https://gitea.com/6543) - 2023, 2025
 - [John Olheiser](https://gitea.com/jolheiser) - 2023, 2024
- [Jason Song](https://gitea.com/wolfogre) - 2023, 2025
+- [Jason Song](https://gitea.com/wolfogre) - 2023

 ## Governance Compensation

@@ -1,4 +1,6 @@
+import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
+import deMorgan from 'eslint-plugin-de-morgan';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
 import playwright from 'eslint-plugin-playwright';
@@ -13,6 +15,7 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
+import type {ESLint} from 'eslint';

 import unescapedHtmlLiteral from './tools/eslint-rules/unescaped-html-literal.ts';

@@ -61,8 +64,10 @@ export default defineConfig([
      '@eslint-community/eslint-comments': comments,
      '@stylistic': stylistic,
      '@typescript-eslint': typescriptPlugin.plugin,
+      'array-func': arrayFunc,
+      'de-morgan': deMorgan,
      'gitea': {rules: {'unescaped-html-literal': unescapedHtmlLiteral}},
-      'import-x': importPlugin,
+      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
      regexp,
      sonarjs,
      unicorn,
@@ -273,6 +278,12 @@ export default defineConfig([
      '@typescript-eslint/unified-signatures': [2],
      'accessor-pairs': [2],
      'array-callback-return': [2, {checkForEach: true}],
+      'array-func/avoid-reverse': [2],
+      'array-func/from-map': [2],
+      'array-func/no-unnecessary-this-arg': [2],
+      'array-func/prefer-array-from': [2],
+      'array-func/prefer-flat-map': [0], // handled by unicorn/prefer-array-flat-map
+      'array-func/prefer-flat': [0], // handled by unicorn/prefer-array-flat
      'arrow-body-style': [0],
      'block-scoped-var': [2],
      'camelcase': [0],
@@ -283,6 +294,8 @@ export default defineConfig([
      'consistent-this': [0],
      'constructor-super': [2],
      'curly': [0],
+      'de-morgan/no-negated-conjunction': [2],
+      'de-morgan/no-negated-disjunction': [2],
      'default-case-last': [2],
      'default-case': [0],
      'default-param-last': [0],
@@ -732,7 +745,6 @@ export default defineConfig([
      'unicorn/consistent-json-file-read': [2],
      'unicorn/consistent-optional-chaining': [2],
      'unicorn/consistent-template-literal-escape': [2],
-      'unicorn/consistent-tuple-labels': [2],
      'unicorn/custom-error-definition': [0],
      'unicorn/default-export-style': [2],
      'unicorn/dom-node-dataset': [2, {preferAttributes: true}],
@@ -766,7 +778,6 @@ export default defineConfig([
      'unicorn/no-array-sort-for-min-max': [2],
      'unicorn/no-array-splice': [0],
      'unicorn/no-asterisk-prefix-in-documentation-comments': [0],
-      'unicorn/no-async-promise-finally': [2],
      'unicorn/no-await-expression-member': [0],
      'unicorn/no-await-in-promise-methods': [2],
      'unicorn/no-blob-to-file': [2],
@@ -803,10 +814,8 @@ export default defineConfig([
      'unicorn/no-invalid-fetch-options': [2],
      'unicorn/no-invalid-file-input-accept': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
-      'unicorn/no-invalid-well-known-symbol-methods': [2],
      'unicorn/no-keyword-prefix': [0],
      'unicorn/no-late-current-target-access': [2],
-      'unicorn/no-late-event-control': [2],
      'unicorn/no-lonely-if': [2],
      'unicorn/no-loop-iterable-mutation': [2],
      'unicorn/no-magic-array-flat-depth': [0],
@@ -843,11 +852,9 @@ export default defineConfig([
      'unicorn/no-uncalled-method': [2],
      'unicorn/no-undeclared-class-members': [2],
      'unicorn/no-unnecessary-array-flat-depth': [2],
-      'unicorn/no-unnecessary-array-flat-map': [2],
      'unicorn/no-unnecessary-array-splice-count': [2],
      'unicorn/no-unnecessary-await': [2],
      'unicorn/no-unnecessary-boolean-comparison': [2],
-      'unicorn/no-unnecessary-fetch-options': [0],
      'unicorn/no-unnecessary-global-this': [0],
      'unicorn/no-unnecessary-nested-ternary': [2],
      'unicorn/no-unnecessary-polyfills': [2],
@@ -860,7 +867,6 @@ export default defineConfig([
      'unicorn/no-unreadable-object-destructuring': [0],
      'unicorn/no-unsafe-buffer-conversion': [2],
      'unicorn/no-unsafe-dom-html': [0],
-      'unicorn/no-unsafe-promise-all-settled-values': [2],
      'unicorn/no-unsafe-property-key': [0],
      'unicorn/no-unsafe-string-replacement': [0],
      'unicorn/no-unused-array-method-return': [2],
@@ -890,17 +896,13 @@ export default defineConfig([
      'unicorn/number-literal-case': [0],
      'unicorn/numeric-separators-style': [0],
      'unicorn/operator-assignment': [2],
-      'unicorn/prefer-abort-signal-any': [2],
-      'unicorn/prefer-abort-signal-timeout': [2],
      'unicorn/prefer-add-event-listener': [2],
      'unicorn/prefer-add-event-listener-options': [2],
-      'unicorn/prefer-aggregate-error': [2],
      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
      'unicorn/prefer-array-from-async': [2],
      'unicorn/prefer-array-from-map': [2],
-      'unicorn/prefer-array-from-range': [2],
      'unicorn/prefer-array-index-of': [2],
      'unicorn/prefer-array-iterable-methods': [2],
      'unicorn/prefer-array-last-methods': [2],
@@ -910,7 +912,6 @@ export default defineConfig([
      'unicorn/prefer-await': [2],
      'unicorn/prefer-bigint-literals': [2],
      'unicorn/prefer-blob-reading-methods': [2],
-      'unicorn/prefer-block-statement-over-iife': [2],
      'unicorn/prefer-boolean-return': [2],
      'unicorn/prefer-class-fields': [2],
      'unicorn/prefer-classlist-toggle': [2],
@@ -923,18 +924,15 @@ export default defineConfig([
      'unicorn/prefer-dom-node-append': [2],
      'unicorn/prefer-dom-node-html-methods': [0],
      'unicorn/prefer-dom-node-remove': [2],
-      'unicorn/prefer-dom-node-replace-children': [2],
      'unicorn/prefer-dom-node-text-content': [2],
      'unicorn/prefer-early-return': [0],
      'unicorn/prefer-else-if': [2],
-      'unicorn/prefer-error-is-error': [0],
      'unicorn/prefer-event-target': [2],
      'unicorn/prefer-export-from': [0],
      'unicorn/prefer-flat-math-min-max': [2],
      'unicorn/prefer-get-or-insert-computed': [2],
      'unicorn/prefer-global-number-constants': [2],
      'unicorn/prefer-global-this': [0],
-      'unicorn/prefer-group-by': [2],
      'unicorn/prefer-has-check': [2],
      'unicorn/prefer-hoisting-branch-code': [2],
      'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
@@ -944,7 +942,6 @@ export default defineConfig([
      'unicorn/prefer-includes-over-repeated-comparisons': [0], // too opinionated
      'unicorn/prefer-iterable-in-constructor': [2],
      'unicorn/prefer-iterator-concat': [0], // too opinionated
-      'unicorn/prefer-iterator-helpers': [2],
      'unicorn/prefer-iterator-to-array': [2],
      'unicorn/prefer-iterator-to-array-at-end': [2],
      'unicorn/prefer-keyboard-event-key': [2],
@@ -969,11 +966,9 @@ export default defineConfig([
      'unicorn/prefer-object-destructuring-defaults': [2],
      'unicorn/prefer-object-from-entries': [2],
      'unicorn/prefer-object-iterable-methods': [2],
-      'unicorn/prefer-observer-apis': [2],
      'unicorn/prefer-optional-catch-binding': [2],
      'unicorn/prefer-path2d': [2],
      'unicorn/prefer-private-class-fields': [0],
-      'unicorn/prefer-promise-try': [2],
      'unicorn/prefer-promise-with-resolvers': [2],
      'unicorn/prefer-prototype-methods': [0],
      'unicorn/prefer-query-selector': [2],
@@ -984,12 +979,10 @@ export default defineConfig([
      'unicorn/prefer-response-static-json': [2],
      'unicorn/prefer-scoped-selector': [0],
      'unicorn/prefer-set-has': [0],
-      'unicorn/prefer-set-methods': [0],
      'unicorn/prefer-set-size': [2],
      'unicorn/prefer-short-arrow-method': [2],
      'unicorn/prefer-simple-condition-first': [0],
      'unicorn/prefer-simple-sort-comparator': [2],
-      'unicorn/prefer-simplified-conditions': [2],
      'unicorn/prefer-single-array-predicate': [2],
      'unicorn/prefer-single-call': [2],
      'unicorn/prefer-single-object-destructuring': [2],
@@ -1009,7 +1002,6 @@ export default defineConfig([
      'unicorn/prefer-switch': [0],
      'unicorn/prefer-temporal': [0],
      'unicorn/prefer-ternary': [0],
-      'unicorn/prefer-toggle-attribute': [2],
      'unicorn/prefer-top-level-await': [0],
      'unicorn/prefer-type-error': [0],
      'unicorn/prefer-type-literal-last': [0],
@@ -1018,7 +1010,6 @@ export default defineConfig([
      'unicorn/prefer-unicode-code-point-escapes': [0],
      'unicorn/prefer-url-can-parse': [2],
      'unicorn/prefer-url-href': [2],
-      'unicorn/prefer-url-search-parameters': [2],
      'unicorn/prefer-while-loop-condition': [2],
      'unicorn/prevent-abbreviations': [0],
      'unicorn/relative-url-style': [2],
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1782723713,
-        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
+        "lastModified": 1776877367,
+        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
+        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
        "type": "github"
      },
      "original": {
@@ -34,7 +34,7 @@

              # only bump toolchain versions here
              go = pkgs.go_1_26;
-              nodejs = pkgs.nodejs_26;
+              nodejs = pkgs.nodejs_24;
              python3 = pkgs.python314;
              pnpm = pkgs.pnpm_10;

@@ -13,7 +13,7 @@ require (
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
 	gitea.dev/actions-proto-go v0.6.0
-	gitea.dev/sdk v1.2.0
+	gitea.dev/sdk v1.1.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
@@ -24,8 +24,8 @@ require (
 	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
 	github.com/alecthomas/chroma/v2 v2.27.0
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.25
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
@@ -57,7 +57,7 @@ require (
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v89 v89.0.0
+	github.com/google/go-github/v88 v88.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
 	github.com/google/pprof v0.0.0-20260604005048-7023385849c0
 	github.com/google/uuid v1.6.0
@@ -68,8 +68,8 @@ require (
 	github.com/huandu/xstrings v1.5.0
 	github.com/jhillyerd/enmime/v2 v2.4.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.19.0
-	github.com/klauspost/cpuid/v2 v2.4.0
+	github.com/klauspost/compress v1.18.6
+	github.com/klauspost/cpuid/v2 v2.3.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.22
@@ -78,7 +78,7 @@ require (
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.10.0
-	github.com/minio/minio-go/v7 v7.2.1
+	github.com/minio/minio-go/v7 v7.2.0
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/opencontainers/go-digest v1.0.0
@@ -96,12 +96,12 @@ require (
 	github.com/tstranex/u2f v1.0.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.10.1
+	github.com/urfave/cli/v3 v3.10.0
 	github.com/wneessen/go-mail v0.7.3
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.44.0
+	gitlab.com/gitlab-org/api/client-go/v2 v2.42.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
 	golang.org/x/crypto v0.53.0
 	golang.org/x/image v0.43.0
@@ -111,14 +111,14 @@ require (
 	golang.org/x/sync v0.21.0
 	golang.org/x/sys v0.46.0
 	golang.org/x/text v0.38.0
-	google.golang.org/grpc v1.82.0
+	google.golang.org/grpc v1.81.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.3
 	modernc.org/sqlite v1.53.0
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.4.1
+	xorm.io/xorm v1.3.11
 )

 require (
@@ -28,8 +28,8 @@ gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGq
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
 gitea.dev/actions-proto-go v0.6.0 h1:gjllYQ5vmwlkqOeofTQu5qKTZpmf7kWsafoHvoPCSzY=
 gitea.dev/actions-proto-go v0.6.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
-gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
-gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
+gitea.dev/sdk v1.1.0 h1:wLlz03WkLEiXa2bQpO1JQBTlYf7tQI2neYtZK1kU+TE=
+gitea.dev/sdk v1.1.0/go.mod h1:Zfl+EZXdsGGCLkryDfsmvYrQo6GKMl4U3BJA8Beu+cs=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -94,14 +94,14 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
 github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.25 h1:TzPVjfUZ1hsKafvYE+DIzKXIik2KufQxsPHanlkttbo=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.25/go.mod h1:K4hw0buguVvtC74HnVfTRr0LzQQHAWPqJbBU9QGk2Pg=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 h1:f3vKqSo13fhTYb+JEcXwXefZQE26I1FB5eTSniU67ko=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29/go.mod h1:MzoLFUArKGpGD+ukmPiTPG1X5x4o6M2kq4v2dr1FiEc=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJagbOyotl/cxoLY4xviKuE7p2GY=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5 h1:mY0qCJuWfbRxok5sRkGxehMGshSYAVIskDvPE4zIZwM=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4 h1:Uu+wqrOXozYYvaxcNIqjFsMTjoIJIZDN3R0f70ZIjyQ=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
 github.com/aws/smithy-go v1.27.2 h1:y9NPmSE6am6LjEFPfqHqG/jJk7AauQvhCJONKh7kpzk=
 github.com/aws/smithy-go v1.27.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
@@ -376,8 +376,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
-github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
+github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
+github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -413,6 +413,8 @@ github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pw
 github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
+github.com/graph-gophers/graphql-go v1.10.2 h1:HXu6Wu5klCH4ALn1fQHVI20cjEIa4wftavHIgbLA4Fo=
+github.com/graph-gophers/graphql-go v1.10.2/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -469,12 +471,12 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
-github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -532,8 +534,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.2.1 h1:PfBfwvKB/MmqyN8Vb1G9voWisaM9OrLv+WwOvMwS9Dw=
-github.com/minio/minio-go/v7 v7.2.1/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
+github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
+github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/minio/minlz v1.1.1 h1:OGmft1V6AnI/Wme332U6bhG54nxEan+VFgkD7lat4KM=
 github.com/minio/minlz v1.1.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -707,8 +709,8 @@ github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.10.1 h1:7Kx9H50hrHbRbyxgO1KP6/BcbiGRz0uYh5YyQ30JEEY=
-github.com/urfave/cli/v3 v3.10.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.10.0 h1:0aU8yOObVDMkM13Cj4G+zb4P0PdeJMec65f81Ak1ioM=
+github.com/urfave/cli/v3 v3.10.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
 github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
@@ -738,8 +740,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.44.0 h1:Vtv2WKC8p9BAygu5VCZlZUwDhTQ7UMlS3PErXyjUmeY=
-gitlab.com/gitlab-org/api/client-go/v2 v2.44.0/go.mod h1:pTbeBowtVA+0/ZExWEZYUGOrpu5qlRN5ZyOUf27BnVY=
+gitlab.com/gitlab-org/api/client-go/v2 v2.42.0 h1:Bq5YIYgUJVbt4Hbh7ibBwNR4SNEafsyDVhIXl7dXDdg=
+gitlab.com/gitlab-org/api/client-go/v2 v2.42.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -896,8 +898,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
-google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -962,5 +964,5 @@ strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab h1:3IZDVyI
 strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
-xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.3.11 h1:i4tlVUASogb0ZZFJHA7dZqoRU2pUpUsutnNdaOlFyMI=
+xorm.io/xorm v1.3.11/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
@@ -121,7 +121,7 @@ func (run *ActionRun) PrettyRef() string {
 	return refName.ShortName()
 }

-// RefTooltip return a tooltip of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
+// RefTooltip return a tooltop of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
 func (run *ActionRun) RefTooltip() string {
 	payload, err := run.GetPullRequestEventPayload()
 	if err == nil && payload != nil && payload.PullRequest != nil {
@@ -277,12 +277,6 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }

-func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
-	var runs []*ActionRun
-	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
-	return runs, err
-}
-
 func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
 	run, has, err := db.Get[ActionRun](ctx, builder.Eq{"repo_id": repoID, "`index`": runIndex})
 	if err != nil {
@@ -99,10 +99,6 @@ type FindRunJobOptions struct {
 	UpdatedBefore    timeutil.TimeStamp
 	ConcurrencyGroup string
 	OrderBy          db.SearchOrderBy
-	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
-	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
-	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
-	AccessibleRepoIDsSubQuery *builder.Builder
 }

 var JobOrderByMap = map[string]map[string]db.SearchOrderBy{
@@ -136,9 +132,6 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 		}
 		cond = cond.And(builder.Eq{"`action_run_job`.concurrency_group": opts.ConcurrencyGroup})
 	}
-	if opts.AccessibleRepoIDsSubQuery != nil {
-		cond = cond.And(builder.In("`action_run_job`.repo_id", opts.AccessibleRepoIDsSubQuery))
-	}
 	return cond
 }

@@ -70,10 +70,6 @@ type FindRunOptions struct {
 	Status           []Status
 	ConcurrencyGroup string
 	CommitSHA        string
-	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
-	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
-	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
-	AccessibleRepoIDsSubQuery *builder.Builder
 }

 func (opts FindRunOptions) ToConds() builder.Cond {
@@ -105,9 +101,6 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.CommitSHA != "" {
 		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
 	}
-	if opts.AccessibleRepoIDsSubQuery != nil {
-		cond = cond.And(builder.In("`action_run`.repo_id", opts.AccessibleRepoIDsSubQuery))
-	}
 	return cond
 }

@@ -142,8 +135,8 @@ type StatusInfo struct {

 // GetStatusInfoList returns a slice of StatusInfo
 func GetStatusInfoList(ctx context.Context, lang translation.Locale) []StatusInfo {
-	// same as those in aggregateJobStatus (StatusUnknown excluded; it's the "shouldn't happen" fallback)
-	allStatus := []Status{StatusSuccess, StatusFailure, StatusCancelled, StatusSkipped, StatusWaiting, StatusRunning, StatusBlocked, StatusCancelling}
+	// same as those in aggregateJobStatus
+	allStatus := []Status{StatusSuccess, StatusFailure, StatusWaiting, StatusRunning, StatusCancelling}
 	statusInfoList := make([]StatusInfo, 0, len(allStatus))
 	for _, s := range allStatus {
 		statusInfoList = append(statusInfoList, StatusInfo{
@@ -73,11 +73,8 @@ func TestGetStatusInfoList(t *testing.T) {
 	assert.Equal(t, []StatusInfo{
 		{Status: int(StatusSuccess), StatusName: StatusSuccess.String(), DisplayedStatus: "actions.status.success"},
 		{Status: int(StatusFailure), StatusName: StatusFailure.String(), DisplayedStatus: "actions.status.failure"},
-		{Status: int(StatusCancelled), StatusName: StatusCancelled.String(), DisplayedStatus: "actions.status.cancelled"},
-		{Status: int(StatusSkipped), StatusName: StatusSkipped.String(), DisplayedStatus: "actions.status.skipped"},
 		{Status: int(StatusWaiting), StatusName: StatusWaiting.String(), DisplayedStatus: "actions.status.waiting"},
 		{Status: int(StatusRunning), StatusName: StatusRunning.String(), DisplayedStatus: "actions.status.running"},
-		{Status: int(StatusBlocked), StatusName: StatusBlocked.String(), DisplayedStatus: "actions.status.blocked"},
 		{Status: int(StatusCancelling), StatusName: StatusCancelling.String(), DisplayedStatus: "actions.status.cancelling"},
 	}, statusInfoList)
 }
@@ -75,28 +75,8 @@ type ActionRunner struct {
 const (
 	RunnerOfflineTime = time.Minute
 	RunnerIdleTime    = 10 * time.Second
-	// RunnerHeartbeatInterval is how often last_online is persisted on poll.
-	// Must stay well below RunnerOfflineTime so runners don't flap to offline.
-	RunnerHeartbeatInterval = 30 * time.Second
-	// RunnerActiveInterval is how often last_active is persisted while a runner
-	// streams task updates and logs. Must stay well below RunnerIdleTime so a
-	// busy runner keeps showing ACTIVE without a DB write on every RPC.
-	RunnerActiveInterval = 5 * time.Second
 )

-// ShouldPersistLastOnline reports whether last_online is stale enough to be
-// worth writing back. Avoids a DB write on every runner poll.
-func ShouldPersistLastOnline(last timeutil.TimeStamp, now time.Time) bool {
-	return now.Sub(last.AsTime()) >= RunnerHeartbeatInterval
-}
-
-// ShouldPersistLastActive reports whether last_active is stale enough to be
-// worth writing back. Avoids a DB write on every UpdateTask/UpdateLog RPC while
-// a runner is actively streaming logs.
-func ShouldPersistLastActive(last timeutil.TimeStamp, now time.Time) bool {
-	return now.Sub(last.AsTime()) >= RunnerActiveInterval
-}
-
 // BelongsToOwnerName before calling, should guarantee that all attributes are loaded
 func (r *ActionRunner) BelongsToOwnerName() string {
 	if r.RepoID != 0 {
@@ -271,24 +251,21 @@ func (opts FindRunnerOptions) ToConds() builder.Cond {
 }

 func (opts FindRunnerOptions) ToOrders() string {
-	// A unique tiebreaker (id) is appended so that runners sharing the same
-	// last_online or name keep a deterministic order across paginated queries,
-	// otherwise the same runner may appear on more than one page.
 	switch opts.Sort {
 	case "online":
-		return "last_online DESC, id ASC"
+		return "last_online DESC"
 	case "offline":
-		return "last_online ASC, id ASC"
+		return "last_online ASC"
 	case "alphabetically":
-		return "name ASC, id ASC"
+		return "name ASC"
 	case "reversealphabetically":
-		return "name DESC, id ASC"
+		return "name DESC"
 	case "newest":
 		return "id DESC"
 	case "oldest":
 		return "id ASC"
 	}
-	return "last_online DESC, id ASC"
+	return "last_online DESC"
 }

 // GetRunnerByUUID returns a runner via uuid
@@ -1,149 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"fmt"
-	"testing"
-	"time"
-
-	"gitea.dev/models/db"
-	"gitea.dev/models/unittest"
-	"gitea.dev/modules/timeutil"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestShouldPersistLastOnline(t *testing.T) {
-	now := time.Now()
-	tests := []struct {
-		name string
-		last timeutil.TimeStamp
-		want bool
-	}{
-		{
-			name: "fresh, skip write",
-			last: timeutil.TimeStamp(now.Add(-5 * time.Second).Unix()),
-			want: false,
-		},
-		{
-			name: "exactly at interval, write",
-			last: timeutil.TimeStamp(now.Add(-RunnerHeartbeatInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "stale, write",
-			last: timeutil.TimeStamp(now.Add(-2 * RunnerHeartbeatInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "zero (never seen), write",
-			last: 0,
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ShouldPersistLastOnline(tt.last, now))
-		})
-	}
-}
-
-func TestShouldPersistLastActive(t *testing.T) {
-	now := time.Now()
-	tests := []struct {
-		name string
-		last timeutil.TimeStamp
-		want bool
-	}{
-		{
-			name: "fresh, skip write",
-			last: timeutil.TimeStamp(now.Add(-1 * time.Second).Unix()),
-			want: false,
-		},
-		{
-			name: "exactly at interval, write",
-			last: timeutil.TimeStamp(now.Add(-RunnerActiveInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "stale, write",
-			last: timeutil.TimeStamp(now.Add(-2 * RunnerActiveInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "zero (never seen), write",
-			last: 0,
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ShouldPersistLastActive(tt.last, now))
-		})
-	}
-}
-
-func TestFindRunnerOptions_ToOrders_StableTiebreaker(t *testing.T) {
-	// Sorts on a non-unique column must end with the unique id tiebreaker so
-	// pagination is deterministic; without it, runners sharing the same
-	// last_online or name can appear on more than one page. Sorts already on
-	// the unique id need no tiebreaker.
-	expected := map[string]string{
-		"":                      "last_online DESC, id ASC",
-		"online":                "last_online DESC, id ASC",
-		"offline":               "last_online ASC, id ASC",
-		"alphabetically":        "name ASC, id ASC",
-		"reversealphabetically": "name DESC, id ASC",
-		"newest":                "id DESC",
-		"oldest":                "id ASC",
-	}
-	for sort, want := range expected {
-		assert.Equal(t, want, FindRunnerOptions{Sort: sort}.ToOrders(), "sort %q", sort)
-	}
-}
-
-func TestFindRunners_PaginationNoDuplicates(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	ctx := t.Context()
-
-	// Create several runners that all share the same last_online value so the
-	// primary sort key (last_online) is tied for all of them.
-	const ownerID = 1000
-	const count = 6
-	for i := range count {
-		runner := &ActionRunner{
-			Name:       "paginated-runner",
-			UUID:       fmt.Sprintf("PAGINATE-TEST-0000-0000-00000000000%d", i),
-			TokenHash:  fmt.Sprintf("paginate-test-token-hash-%d", i),
-			OwnerID:    ownerID,
-			RepoID:     0,
-			LastOnline: 42,
-		}
-		require.NoError(t, db.Insert(ctx, runner))
-	}
-
-	// Page through the runners and ensure every id is returned exactly once.
-	seen := make(map[int64]int)
-	const pageSize = 2
-	for page := 1; ; page++ {
-		runners, err := db.Find[ActionRunner](ctx, FindRunnerOptions{
-			ListOptions: db.ListOptions{Page: page, PageSize: pageSize},
-			OwnerID:     ownerID,
-		})
-		require.NoError(t, err)
-		if len(runners) == 0 {
-			break
-		}
-		for _, r := range runners {
-			seen[r.ID]++
-		}
-	}
-
-	assert.Len(t, seen, count, "each runner should be returned exactly once across all pages")
-	for id, n := range seen {
-		assert.Equal(t, 1, n, "runner %d appeared on %d pages", id, n)
-	}
-}
@@ -16,7 +16,6 @@ import (
 	"gitea.dev/models/db"
 	"gitea.dev/models/unit"
 	"gitea.dev/modules/actions/jobparser"
-	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/timeutil"
@@ -232,11 +231,6 @@ func makeTaskStepDisplayName(step *jobparser.Step, limit int) (name string) {
 // another runner won the optimistic-lock race; it is never returned to callers.
 var errJobAlreadyClaimed = errors.New("job already claimed by another runner")

-// pickTaskBatchSize bounds how many waiting jobs each CreateTaskForRunner query loads,
-// so a large backlog is not fetched into memory on every runner poll.
-// It is a var only so tests can shrink it to exercise pagination cheaply.
-var pickTaskBatchSize = 100
-
 // CreateTaskForRunner finds a waiting job that matches the runner's labels and
 // atomically claims it. It iterates through all matching jobs so that a
 // concurrent claim by another runner (which would lose the optimistic lock on
@@ -255,51 +249,31 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 			Join("INNER", "repo_unit", "`repository`.id = `repo_unit`.repo_id").
 			Where(builder.Eq{"`repository`.owner_id": runner.OwnerID, "`repo_unit`.type": unit.TypeActions}))
 	}
-	baseCond := builder.Eq{"task_id": 0, "status": StatusWaiting, "is_reusable_caller": false}.And(jobCond)
+	if jobCond.IsValid() {
+		jobCond = builder.In("run_id", builder.Select("id").From("action_run").Where(jobCond))
+	}
+
+	var jobs []*ActionRunJob
+	if err := e.Where("task_id=? AND status=? AND is_reusable_caller=?", 0, StatusWaiting, false).And(jobCond).Asc("updated", "id").Find(&jobs); err != nil {
+		return nil, false, err
+	}

 	// TODO: a more efficient way to filter labels
 	log.Trace("runner labels: %v", runner.AgentLabels)
-
-	// Page through the waiting jobs oldest-first instead of loading the whole backlog into memory on every poll.
-	// Keyset pagination on (updated, id) is safe under concurrent claims:
-	// updated only moves forward, so the advancing cursor never skips a still-waiting job even as claimed jobs drop out.
-	var cursorUpdated timeutil.TimeStamp
-	var cursorID int64
-	for {
-		cond := baseCond
-		if cursorID > 0 {
-			cond = cond.And(builder.Or(
-				builder.Gt{"updated": cursorUpdated},
-				builder.And(builder.Eq{"updated": cursorUpdated}, builder.Gt{"id": cursorID}),
-			))
+	for _, v := range jobs {
+		if !runner.CanMatchLabels(v.RunsOn) {
+			continue
 		}
-
-		var jobs []*ActionRunJob
-		if err := e.Where(cond).Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
+		task, ok, err := claimJobForRunner(ctx, runner, v)
+		if err != nil {
 			return nil, false, err
 		}
-
-		for _, v := range jobs {
-			if !runner.CanMatchLabels(v.RunsOn) {
-				continue
-			}
-			task, ok, err := claimJobForRunner(ctx, runner, v)
-			if err != nil {
-				return nil, false, err
-			}
-			if ok {
-				return task, true, nil
-			}
-			// Another runner claimed this job concurrently; try the next one.
+		if ok {
+			return task, true, nil
 		}
-
-		// A short page means no waiting jobs remain beyond it.
-		if len(jobs) < pickTaskBatchSize {
-			return nil, false, nil
-		}
-		last := jobs[len(jobs)-1]
-		cursorUpdated, cursorID = last.Updated, last.ID
+		// Another runner claimed this job concurrently; try the next one.
 	}
+	return nil, false, nil
 }

 // claimJobForRunner attempts to atomically claim job for runner inside its own
@@ -439,18 +413,6 @@ func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
 	return err
 }

-func getRunIDByTaskID(ctx context.Context, taskID int64) (runID int64, _ error) {
-	if has, err := db.GetEngine(ctx).Cols("action_run_job.run_id").
-		Table("action_task").
-		Join("INNER", "action_run_job", "action_run_job.id = action_task.job_id").
-		Where(builder.Eq{"action_task.id": taskID}).Get(&runID); err != nil {
-		return runID, err
-	} else if !has {
-		return runID, util.ErrNotExist
-	}
-	return runID, nil
-}
-
 // UpdateTaskByState updates the task by the state.
 // It will always update the task if the state is not final, even there is no change.
 // So it will update ActionTask.Updated to avoid the task being judged as a zombie task.
@@ -460,26 +422,21 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 		stepStates[v.Id] = v
 	}

-	// Only one request can update the task because the final state needs to be calculated with all job states.
-	// Otherwise, concurrent requests with transaction will make the SQL read stale job state and result in wrong final state.
-	taskID := state.Id
-	runID, err := getRunIDByTaskID(ctx, taskID)
-	if err != nil {
-		return nil, err
-	}
-	task := &ActionTask{}
-	err = globallock.LockAndDo(ctx, fmt.Sprintf("UpdateTaskByState-run-%d", runID), func(ctx context.Context) error {
-		if has, err := db.GetEngine(ctx).ID(taskID).Get(task); err != nil {
-			return err
+	return db.WithTx2(ctx, func(ctx context.Context) (*ActionTask, error) {
+		e := db.GetEngine(ctx)
+
+		task := &ActionTask{}
+		if has, err := e.ID(state.Id).Get(task); err != nil {
+			return nil, err
 		} else if !has {
-			return util.ErrNotExist
+			return nil, util.ErrNotExist
 		} else if runnerID != task.RunnerID {
-			return errors.New("invalid runner for task")
+			return nil, errors.New("invalid runner for task")
 		}

 		if task.Status.IsDone() {
 			// the state is final, do nothing
-			return nil
+			return task, nil
 		}

 		// state.Result is not unspecified means the task is finished
@@ -492,7 +449,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			}
 			task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
 			if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
-				return err
+				return nil, err
 			}
 			if _, err := UpdateRunJob(ctx, &ActionRunJob{
 				ID:      task.JobID,
@@ -500,18 +457,18 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 				Status:  task.Status,
 				Stopped: task.Stopped,
 			}, nil, "status", "stopped"); err != nil {
-				return err
+				return nil, err
 			}
 		} else {
 			// Force update ActionTask.Updated to avoid the task being judged as a zombie task
 			task.Updated = timeutil.TimeStampNow()
 			if err := UpdateTask(ctx, task, "updated"); err != nil {
-				return err
+				return nil, err
 			}
 		}

 		if err := task.LoadAttributes(ctx); err != nil {
-			return err
+			return nil, err
 		}

 		for _, step := range task.Steps {
@@ -528,13 +485,13 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			} else if step.Started != 0 {
 				step.Status = StatusRunning
 			}
-			if _, err := db.GetEngine(ctx).ID(step.ID).Update(step); err != nil {
-				return err
+			if _, err := e.ID(step.ID).Update(step); err != nil {
+				return nil, err
 			}
 		}
-		return nil
+
+		return task, nil
 	})
-	return task, err
 }

 func StopTask(ctx context.Context, taskID int64, status Status) error {
@@ -371,74 +371,3 @@ func TestReleaseTaskForRunner(t *testing.T) {
 	unittest.AssertNotExistsBean(t, &ActionTask{ID: task.ID})
 	unittest.AssertNotExistsBean(t, &ActionTaskStep{TaskID: task.ID})
 }
-
-// TestCreateTaskForRunnerPagination verifies that a job sitting beyond the first page is still claimed
-func TestCreateTaskForRunnerPagination(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	defer func(orig int) { pickTaskBatchSize = orig }(pickTaskBatchSize)
-	pickTaskBatchSize = 2
-
-	run := &ActionRun{
-		Title:         "pagination-test-run",
-		RepoID:        1,
-		OwnerID:       2,
-		WorkflowID:    "test.yaml",
-		Index:         9903,
-		TriggerUserID: 2,
-		Ref:           "refs/heads/main",
-		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-		Event:         "push",
-		TriggerEvent:  "push",
-		Status:        StatusWaiting,
-	}
-	require.NoError(t, db.Insert(t.Context(), run))
-
-	// Five waiting jobs the runner cannot run, then one it can.
-	// With a page size of 2 the matching job only appears on the third page.
-	for i := range 5 {
-		mismatch := &ActionRunJob{
-			RunID:     run.ID,
-			RepoID:    run.RepoID,
-			OwnerID:   run.OwnerID,
-			CommitSHA: run.CommitSHA,
-			Name:      "mismatch-" + string(rune('a'+i)),
-			Attempt:   1,
-			JobID:     "mismatch-" + string(rune('a'+i)),
-			Status:    StatusWaiting,
-			RunsOn:    []string{"windows-latest"},
-		}
-		require.NoError(t, db.Insert(t.Context(), mismatch))
-	}
-
-	target := &ActionRunJob{
-		RunID:           run.ID,
-		RepoID:          run.RepoID,
-		OwnerID:         run.OwnerID,
-		CommitSHA:       run.CommitSHA,
-		Name:            "target-job",
-		Attempt:         1,
-		JobID:           "target-job",
-		Status:          StatusWaiting,
-		RunsOn:          []string{"ubuntu-latest"},
-		WorkflowPayload: []byte("on: push\njobs:\n  target-job:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hi\n"),
-	}
-	require.NoError(t, db.Insert(t.Context(), target))
-
-	runner := &ActionRunner{
-		UUID:        "pagination-runner-uuid",
-		Name:        "pagination-runner",
-		AgentLabels: []string{"ubuntu-latest"},
-	}
-	runner.GenerateAndFillToken()
-	require.NoError(t, db.Insert(t.Context(), runner))
-
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
-	require.NoError(t, err)
-	require.True(t, ok)
-	require.NotNil(t, task)
-
-	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: target.ID})
-	assert.Equal(t, StatusRunning, claimed.Status)
-	assert.Equal(t, task.ID, claimed.TaskID)
-}
@@ -36,18 +36,7 @@ import (

 const ssh2keyStart = "---- BEGIN SSH2 PUBLIC KEY ----"

-const (
-	// the longest RSA key ssh-keygen allows to generate is 16384 bits (2048 bytes), we still relax the limit a little here
-	maxKeyBinaryBytes        = 4096
-	maxKeyContentBase64Bytes = maxKeyBinaryBytes * 4 / 3
-	maxKeyContentExtraBytes  = 4 * 1024 // header, footer, comment
-	maxKeyContentBytes       = maxKeyContentBase64Bytes + maxKeyContentExtraBytes
-)
-
 func extractTypeFromBase64Key(key string) (string, error) {
-	if len(key) > maxKeyContentBase64Bytes {
-		return "", util.NewInvalidArgumentErrorf("SSH public key base64 is too long")
-	}
 	b, err := base64.StdEncoding.DecodeString(key)
 	if err != nil || len(b) < 4 {
 		return "", fmt.Errorf("invalid key format: %w", err)
@@ -63,10 +52,6 @@ func extractTypeFromBase64Key(key string) (string, error) {

 // parseKeyString parses any key string in OpenSSH or SSH2 format to clean OpenSSH string (RFC4253).
 func parseKeyString(content string) (string, error) {
-	if len(content) > maxKeyContentBytes {
-		return "", util.NewInvalidArgumentErrorf("SSH public key content is too long")
-	}
-
 	// remove whitespace at start and end
 	content = strings.TrimSpace(content)

@@ -78,8 +63,6 @@ func parseKeyString(content string) (string, error) {
 		// Transform all legal line endings to a single "\n".
 		content = strings.NewReplacer("\r\n", "\n", "\r", "\n").Replace(content)

-		var b strings.Builder
-		b.Grow(len(content))
 		lines := strings.Split(content, "\n")
 		continuationLine := false

@@ -91,10 +74,9 @@ func parseKeyString(content string) (string, error) {
 			if continuationLine || strings.ContainsAny(line, ":-") {
 				continuationLine = strings.HasSuffix(line, "\\")
 			} else {
-				b.WriteString(line)
+				keyContent += line
 			}
 		}
-		keyContent = b.String()

 		t, err := extractTypeFromBase64Key(keyContent)
 		if err != nil {
@@ -473,20 +473,10 @@ func runErr(t *testing.T, stdin []byte, args ...string) {
 	}
 }

-func TestPublicKeysAreExternallyManaged(t *testing.T) {
+func Test_PublicKeysAreExternallyManaged(t *testing.T) {
 	key1 := unittest.AssertExistsAndLoadBean(t, &PublicKey{ID: 1})
 	externals, err := PublicKeysAreExternallyManaged(t.Context(), []*PublicKey{key1})
 	assert.NoError(t, err)
 	assert.Len(t, externals, 1)
 	assert.False(t, externals[0])
 }
-
-// TestCheckPublicKeyStringOversized tests if oversized SSH2 public key strings are rejected before triggering costly operations.
-func TestCheckPublicKeyStringOversized(t *testing.T) {
-	_, err := parseKeyString(strings.Repeat("a", maxKeyContentBytes+1))
-	assert.ErrorContains(t, err, "SSH public key content is too long")
-
-	content := "---- BEGIN SSH2 PUBLIC KEY ----\n" + strings.Repeat("a", maxKeyContentBase64Bytes+1) + "\n--- END SSH2 PUBLIC KEY ----"
-	_, err = parseKeyString(content)
-	assert.ErrorContains(t, err, "SSH public key base64 is too long")
-}
@@ -304,36 +304,6 @@ func (s AccessTokenScope) PublicOnly() (bool, error) {
 	return bitmap.hasScope(AccessTokenScopePublicOnly)
 }

-// CanCreateChildScope reports whether a request authenticated by this (parent) scope may mint a token
-// carrying the child scope. It rejects any grantable scope the parent does not hold, closing the
-// scope-escalation path. public-only is a restriction rather than a grantable permission, so it is
-// ignored here (a child may always be public-only); EnforcePublicOnlyFrom handles carrying it down.
-func (s AccessTokenScope) CanCreateChildScope(child AccessTokenScope) (bool, error) {
-	requested := child.StringSlice()
-	scopes := make([]AccessTokenScope, 0, len(requested))
-	for _, sc := range requested {
-		childScope := AccessTokenScope(sc)
-		if childScope == AccessTokenScopePublicOnly {
-			continue
-		}
-		scopes = append(scopes, childScope)
-	}
-	return s.HasScope(scopes...)
-}
-
-// EnforcePublicOnlyFrom adds the public-only restriction to s when the authorizing parent scope is
-// public-only, so a public-only token cannot mint a child token that drops the restriction.
-func (s AccessTokenScope) EnforcePublicOnlyFrom(parent AccessTokenScope) (AccessTokenScope, error) {
-	publicOnly, err := parent.PublicOnly()
-	if err != nil {
-		return "", err
-	}
-	if !publicOnly {
-		return s, nil
-	}
-	return AccessTokenScope(string(s) + "," + string(AccessTokenScopePublicOnly)).Normalize()
-}
-
 // HasScope returns true if the string has the given scope
 func (s AccessTokenScope) HasScope(scopes ...AccessTokenScope) (bool, error) {
 	bitmap, err := s.parse()
@@ -89,26 +89,3 @@ func TestAccessTokenScope_HasScope(t *testing.T) {
 		})
 	}
 }
-
-func TestAccessTokenScope_EnforcePublicOnlyFrom(t *testing.T) {
-	tests := []struct {
-		in     AccessTokenScope
-		parent AccessTokenScope
-		out    AccessTokenScope
-	}{
-		// public-only parent forces the restriction onto the minted scope
-		{"write:user", "write:user,public-only", "public-only,write:user"},
-		// already public-only stays public-only
-		{"public-only,read:user", "public-only", "public-only,read:user"},
-		// non-public-only parent leaves the scope untouched
-		{"write:user", "write:user", "write:user"},
-		{"all", "all", "all"},
-	}
-	for _, test := range tests {
-		t.Run(string(test.parent)+"->"+string(test.in), func(t *testing.T) {
-			got, err := test.in.EnforcePublicOnlyFrom(test.parent)
-			assert.NoError(t, err)
-			assert.Equal(t, test.out, got)
-		})
-	}
-}
@@ -195,18 +195,3 @@ func HasTwoFactorOrWebAuthn(ctx context.Context, id int64) (bool, error) {
 	}
 	return HasWebAuthnRegistrationsByUID(ctx, id)
 }
-
-// DisableTwoFactor removes every two-factor method of the given user atomically,
-// returning the number of TOTP records and WebAuthn credentials removed.
-// It is a no-op for a user that has no 2FA enrolled.
-func DisableTwoFactor(ctx context.Context, uid int64) (totp, webAuthn int64, err error) {
-	err = db.WithTx(ctx, func(ctx context.Context) error {
-		var e error
-		if totp, e = db.GetEngine(ctx).Where("uid = ?", uid).Delete(&TwoFactor{}); e != nil {
-			return e
-		}
-		webAuthn, e = db.GetEngine(ctx).Where("user_id = ?", uid).Delete(&WebAuthnCredential{})
-		return e
-	})
-	return totp, webAuthn, err
-}
@@ -10,7 +10,6 @@ import (
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/unittest"

-	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pquerna/otp/totp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -46,37 +45,3 @@ func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
 	require.NoError(t, err)
 	assert.False(t, ok)
 }
-
-func TestDisableTwoFactor(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	ctx := t.Context()
-
-	const uid = 1000 // a uid with no user/2FA fixtures
-
-	// Enroll TOTP and register a WebAuthn credential.
-	tfa := &auth_model.TwoFactor{UID: uid}
-	require.NoError(t, tfa.SetSecret("test-secret"))
-	require.NoError(t, auth_model.NewTwoFactor(ctx, tfa))
-	_, err := auth_model.CreateCredential(ctx, uid, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
-	require.NoError(t, err)
-
-	has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
-	require.NoError(t, err)
-	require.True(t, has)
-
-	// Both records are removed and counted separately.
-	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, uid)
-	require.NoError(t, err)
-	assert.EqualValues(t, 1, totp)
-	assert.EqualValues(t, 1, webAuthn)
-
-	has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
-	require.NoError(t, err)
-	assert.False(t, has)
-
-	// A second call on a user without 2FA is a no-op.
-	totp, webAuthn, err = auth_model.DisableTwoFactor(ctx, uid)
-	require.NoError(t, err)
-	assert.EqualValues(t, 0, totp)
-	assert.EqualValues(t, 0, webAuthn)
-}
@@ -27,7 +27,6 @@ import (
 	"gitea.dev/modules/markup"
 	"gitea.dev/modules/optional"
 	"gitea.dev/modules/references"
-	"gitea.dev/modules/setting"
 	"gitea.dev/modules/structs"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/translation"
@@ -627,18 +626,11 @@ func UpdateCommentAttachments(ctx context.Context, c *Comment, uuids []string) e
 		return nil
 	}
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		issue, err := GetIssueByID(ctx, c.IssueID)
-		if err != nil {
-			return err
-		}
 		attachments, err := repo_model.GetAttachmentsByUUIDs(ctx, uuids)
 		if err != nil {
 			return fmt.Errorf("getAttachmentsByUUIDs [uuids: %v]: %w", uuids, err)
 		}
 		for i := range attachments {
-			if err := validateAttachmentForIssue(ctx, issue, attachments[i]); err != nil {
-				return err
-			}
 			attachments[i].IssueID = c.IssueID
 			attachments[i].CommentID = c.ID
 			if err := repo_model.UpdateAttachment(ctx, attachments[i]); err != nil {
@@ -651,18 +643,36 @@ func UpdateCommentAttachments(ctx context.Context, c *Comment, uuids []string) e
 }

 // LoadAssigneeUserAndTeam if comment.Type is CommentTypeAssignees, then load assignees
-func (c *Comment) LoadAssigneeUserAndTeam(ctx context.Context) (err error) {
+func (c *Comment) LoadAssigneeUserAndTeam(ctx context.Context) error {
+	var err error
+
 	if c.AssigneeID > 0 && c.Assignee == nil {
-		_, c.Assignee, err = user_model.GetPossibleUserByID(ctx, c.AssigneeID)
+		c.Assignee, err = user_model.GetUserByID(ctx, c.AssigneeID)
 		if err != nil {
+			if !user_model.IsErrUserNotExist(err) {
+				return err
+			}
+			c.Assignee = user_model.NewGhostUser()
+		}
+	} else if c.AssigneeTeamID > 0 && c.AssigneeTeam == nil {
+		if err = c.LoadIssue(ctx); err != nil {
 			return err
 		}
-	}
-	if c.AssigneeTeamID > 0 && c.AssigneeTeam == nil {
-		_, c.AssigneeTeam, err = organization.GetPossibleTeamByID(ctx, c.AssigneeTeamID)
-		if err != nil {
+
+		if err = c.Issue.LoadRepo(ctx); err != nil {
 			return err
 		}
+
+		if err = c.Issue.Repo.LoadOwner(ctx); err != nil {
+			return err
+		}
+
+		if c.Issue.Repo.Owner.IsOrganization() {
+			c.AssigneeTeam, err = organization.GetTeamByID(ctx, c.AssigneeTeamID)
+			if err != nil && !organization.IsErrTeamNotExist(err) {
+				return err
+			}
+		}
 	}
 	return nil
 }
@@ -785,7 +795,8 @@ func (c *Comment) MetaSpecialDoerTr(locale translation.Locale) template.HTML {
 }

 func (c *Comment) TimelineRequestedReviewTr(locale translation.Locale, createdStr template.HTML) template.HTML {
-	if c.Assignee != nil {
+	if c.AssigneeID > 0 {
+		// it guarantees LoadAssigneeUserAndTeam has been called, and c.Assignee is Ghost user but not nil if the user doesn't exist
 		if c.RemovedAssignee {
 			if c.PosterID == c.AssigneeID {
 				return locale.Tr("repo.issues.review.remove_review_request_self", createdStr)
@@ -794,20 +805,14 @@ func (c *Comment) TimelineRequestedReviewTr(locale translation.Locale, createdSt
 		}
 		return locale.Tr("repo.issues.review.add_review_request", c.Assignee.GetDisplayName(), createdStr)
 	}
+	teamName := "Ghost Team"
 	if c.AssigneeTeam != nil {
-		if c.RemovedAssignee {
-			return locale.Tr("repo.issues.review.remove_review_request", c.AssigneeTeam.Name, createdStr)
-		}
-		return locale.Tr("repo.issues.review.add_review_request", c.AssigneeTeam.Name, createdStr)
+		teamName = c.AssigneeTeam.Name
 	}
-
-	// impossible fallback
-	assigneePrompt := fmt.Sprintf("(AssigneeID=%d, AssigneeTeamID=%d)", c.AssigneeID, c.AssigneeTeam.ID)
-	setting.PanicInDevOrTesting("unknown timeline pull request review event comment: id=%d, %s", c.ID, assigneePrompt)
 	if c.RemovedAssignee {
-		return locale.Tr("repo.issues.review.remove_review_request", assigneePrompt, createdStr)
+		return locale.Tr("repo.issues.review.remove_review_request", teamName, createdStr)
 	}
-	return locale.Tr("repo.issues.review.add_review_request", assigneePrompt, createdStr)
+	return locale.Tr("repo.issues.review.add_review_request", teamName, createdStr)
 }

 // CreateComment creates comment with context
@@ -45,27 +45,12 @@ func TestCreateComment(t *testing.T) {
 	unittest.AssertInt64InRange(t, now, then, int64(updatedIssue.UpdatedUnix))
 }

-func TestLoadAssigneeUserAndTeam_DeletedTeamBecomesGhostTeam(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 15})
-	comment := &issues_model.Comment{
-		Type:           issues_model.CommentTypeAssignees,
-		IssueID:        issue.ID,
-		AssigneeTeamID: 999999, // non-existing team ID
-	}
-	assert.NoError(t, comment.LoadAssigneeUserAndTeam(t.Context()))
-	assert.NotNil(t, comment.AssigneeTeam)
-	assert.EqualValues(t, -1, comment.AssigneeTeam.ID)
-}
-
 func Test_UpdateCommentAttachment(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())

 	comment := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: 1})
-	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: comment.IssueID})
 	attachment := repo_model.Attachment{
-		RepoID: issue.RepoID, // must match the comment's repo, else the cross-repo guard rejects it
-		Name:   "test.txt",
+		Name: "test.txt",
 	}
 	assert.NoError(t, db.Insert(t.Context(), &attachment))

@@ -263,46 +263,14 @@ func AddDeletePRBranchComment(ctx context.Context, doer *user_model.User, repo *
 	return err
 }

-// validateAttachmentForIssue rejects a foreign or already-linked attachment before it is linked to
-// issue: a known UUID could otherwise re-link (and expose) another repo's private attachment. A
-// legacy attachment predating repo_id-on-upload is adopted into the issue's repo.
-func validateAttachmentForIssue(ctx context.Context, issue *Issue, attachment *repo_model.Attachment) error {
-	if attachment.RepoID == 0 && attachment.CreatedUnix < repo_model.LegacyAttachmentMissingRepoIDCutoff {
-		attachment.RepoID = issue.RepoID
-		if err := repo_model.UpdateAttachmentByUUID(ctx, attachment, "repo_id"); err != nil {
-			return fmt.Errorf("update attachment repo_id [id: %d]: %w", attachment.ID, err)
-		}
-	}
-	if attachment.RepoID != issue.RepoID {
-		return util.NewPermissionDeniedErrorf("attachment belongs to a different repository")
-	}
-	if attachment.IssueID != 0 && attachment.IssueID != issue.ID {
-		return util.NewPermissionDeniedErrorf("attachment is already linked to another issue")
-	}
-	if attachment.ReleaseID != 0 {
-		return util.NewPermissionDeniedErrorf("attachment is already linked to a release")
-	}
-	return nil
-}
-
 // UpdateIssueAttachments update attachments by UUIDs for the issue
 func UpdateIssueAttachments(ctx context.Context, issueID int64, uuids []string) (err error) {
-	if len(uuids) == 0 {
-		return nil
-	}
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		issue, err := GetIssueByID(ctx, issueID)
-		if err != nil {
-			return err
-		}
 		attachments, err := repo_model.GetAttachmentsByUUIDs(ctx, uuids)
 		if err != nil {
 			return fmt.Errorf("getAttachmentsByUUIDs [uuids: %v]: %w", uuids, err)
 		}
 		for i := range attachments {
-			if err := validateAttachmentForIssue(ctx, issue, attachments[i]); err != nil {
-				return err
-			}
 			attachments[i].IssueID = issueID
 			if err := repo_model.UpdateAttachment(ctx, attachments[i]); err != nil {
 				return fmt.Errorf("update attachment [id: %d]: %w", attachments[i].ID, err)
@@ -1,33 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package issues_test
-
-import (
-	"testing"
-
-	issues_model "gitea.dev/models/issues"
-	repo_model "gitea.dev/models/repo"
-	"gitea.dev/models/unittest"
-	"gitea.dev/modules/util"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestUpdateIssueAttachmentsCrossRepo(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	// attachment id 2 belongs to repo 2 / issue 4; issue 1 lives in repo 1
-	issue1 := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1})
-	foreign := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 2})
-	require.NotEqual(t, issue1.RepoID, foreign.RepoID)
-
-	// re-linking a foreign repo's attachment by UUID must be rejected
-	err := issues_model.UpdateIssueAttachments(t.Context(), issue1.ID, []string{foreign.UUID})
-	assert.ErrorIs(t, err, util.ErrPermissionDenied)
-
-	// the foreign attachment must be left untouched
-	reloaded := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 2})
-	assert.Equal(t, foreign.IssueID, reloaded.IssueID)
-}
@@ -6,7 +6,6 @@ package issues

 import (
 	"context"
-	"errors"
 	"fmt"
 	"slices"
 	"strconv"
@@ -28,6 +27,12 @@ type ErrRepoLabelNotExist struct {
 	RepoID  int64
 }

+// IsErrRepoLabelNotExist checks if an error is a RepoErrLabelNotExist.
+func IsErrRepoLabelNotExist(err error) bool {
+	_, ok := err.(ErrRepoLabelNotExist)
+	return ok
+}
+
 func (err ErrRepoLabelNotExist) Error() string {
 	return fmt.Sprintf("label does not exist [label_id: %d, repo_id: %d]", err.LabelID, err.RepoID)
 }
@@ -307,18 +312,6 @@ func GetLabelInRepoByName(ctx context.Context, repoID int64, labelName string) (
 	return l, nil
 }

-// GetLabelInRepoOrOrgByID returns the label with labelID scoped to the repo, falling back to the
-// repo's owning organization when ownerIsOrg is set. It returns ErrRepoLabelNotExist /
-// ErrOrgLabelNotExist when the label is in neither scope, so a foreign-but-existing label ID is
-// indistinguishable from a nonexistent one (no cross-repo enumeration oracle).
-func GetLabelInRepoOrOrgByID(ctx context.Context, repoID, ownerID int64, ownerIsOrg bool, labelID int64) (*Label, error) {
-	label, err := GetLabelInRepoByID(ctx, repoID, labelID)
-	if err != nil && errors.Is(err, util.ErrNotExist) && ownerIsOrg {
-		return GetLabelInOrgByID(ctx, ownerID, labelID)
-	}
-	return label, err
-}
-
 // GetLabelInRepoByID returns a label by ID in given repository.
 func GetLabelInRepoByID(ctx context.Context, repoID, labelID int64) (*Label, error) {
 	if labelID <= 0 || repoID <= 0 {
@@ -12,7 +12,6 @@ import (
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/timeutil"
-	"gitea.dev/modules/util"

 	"github.com/stretchr/testify/assert"
 )
@@ -95,10 +94,10 @@ func TestGetLabelInRepoByName(t *testing.T) {
 	assert.Equal(t, "label1", label.Name)

 	_, err = issues_model.GetLabelInRepoByName(t.Context(), 1, "")
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))

 	_, err = issues_model.GetLabelInRepoByName(t.Context(), unittest.NonexistentID, "nonexistent")
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
 }

 func TestGetLabelInRepoByNames(t *testing.T) {
@@ -132,10 +131,10 @@ func TestGetLabelInRepoByID(t *testing.T) {
 	assert.EqualValues(t, 1, label.ID)

 	_, err = issues_model.GetLabelInRepoByID(t.Context(), 1, -1)
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))

 	_, err = issues_model.GetLabelInRepoByID(t.Context(), unittest.NonexistentID, unittest.NonexistentID)
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
 }

 func TestGetLabelsInRepoByIDs(t *testing.T) {
@@ -324,59 +324,6 @@ func IsOfficialReviewerTeam(ctx context.Context, issue *Issue, team *organizatio
 	return slices.Contains(pb.ApprovalsWhitelistTeamIDs, team.ID), nil
 }

-// RecalculateReviewsOfficial re-evaluates the "official" flag of the latest approve
-// and reject reviews of an issue against its pull request's current base branch.
-// It must be called whenever the target branch changes, otherwise an approval that
-// was official on the previous (possibly unprotected) branch would keep satisfying
-// the new branch's protection rules.
-func RecalculateReviewsOfficial(ctx context.Context, issue *Issue) error {
-	if err := issue.LoadPullRequest(ctx); err != nil {
-		return err
-	}
-
-	// Clearing and restoring the official flags must happen atomically, otherwise a
-	// failure in between would leave the reviews without any official flag set.
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		// Only the latest approve/reject review of each reviewer counts as official, so
-		// clear the flag on all of them first and restore it only where it still applies.
-		if _, err := db.GetEngine(ctx).
-			Where("issue_id = ?", issue.ID).
-			In("type", ReviewTypeApprove, ReviewTypeReject).
-			Cols("official").
-			Update(&Review{Official: false}); err != nil {
-			return err
-		}
-
-		reviews, err := FindLatestReviews(ctx, FindReviewOptions{
-			Types:   []ReviewType{ReviewTypeApprove, ReviewTypeReject},
-			IssueID: issue.ID,
-		})
-		if err != nil {
-			return err
-		}
-
-		for _, review := range reviews {
-			if err := review.LoadReviewer(ctx); err != nil {
-				return err
-			}
-			if review.Reviewer == nil {
-				continue
-			}
-			official, err := IsOfficialReviewer(ctx, issue, review.Reviewer)
-			if err != nil {
-				return err
-			}
-			if official {
-				if _, err := db.GetEngine(ctx).ID(review.ID).Cols("official").Update(&Review{Official: true}); err != nil {
-					return err
-				}
-			}
-		}
-
-		return nil
-	})
-}
-
 // CreateReview creates a new review based on opts
 func CreateReview(ctx context.Context, opts CreateReviewOptions) (*Review, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Review, error) {
@@ -6,8 +6,6 @@ package issues_test
 import (
 	"testing"

-	"gitea.dev/models/db"
-	git_model "gitea.dev/models/git"
 	issues_model "gitea.dev/models/issues"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
@@ -388,45 +386,3 @@ func TestAddReviewRequest(t *testing.T) {
 	assert.NotNil(t, comment.CommentMetaData)
 	assert.Equal(t, issues_model.SpecialDoerNameCodeOwners, comment.CommentMetaData.SpecialDoerName)
 }
-
-func TestRecalculateReviewsOfficial(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	// PR #2 targets repo1's "master" branch. Simulate an approval that became
-	// official while the PR targeted an unprotected branch.
-	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 3})
-	reviewer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
-	review, err := issues_model.CreateReview(t.Context(), issues_model.CreateReviewOptions{
-		Type:     issues_model.ReviewTypeApprove,
-		Issue:    issue,
-		Reviewer: reviewer,
-		Official: true,
-	})
-	assert.NoError(t, err)
-
-	// Protect the (now current) target branch with an approvals whitelist that
-	// does not include the reviewer, mirroring a retarget onto a protected branch.
-	rule := &git_model.ProtectedBranch{
-		RepoID:                    issue.RepoID,
-		RuleName:                  "master",
-		EnableApprovalsWhitelist:  true,
-		ApprovalsWhitelistUserIDs: []int64{2},
-		RequiredApprovals:         1,
-	}
-	assert.NoError(t, db.Insert(t.Context(), rule))
-
-	// Re-evaluating must strip the stale official flag, otherwise the approval
-	// would still satisfy the protected branch's required approvals.
-	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
-	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
-	assert.False(t, review.Official)
-
-	// Once the reviewer is whitelisted, re-evaluating restores the official flag.
-	rule.ApprovalsWhitelistUserIDs = []int64{2, reviewer.ID}
-	_, err = db.GetEngine(t.Context()).ID(rule.ID).Cols("approvals_whitelist_user_i_ds").Update(rule)
-	assert.NoError(t, err)
-
-	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
-	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
-	assert.True(t, review.Official)
-}
@@ -6,7 +6,6 @@ package organization

 import (
 	"context"
-	"errors"
 	"fmt"
 	"strings"

@@ -93,15 +92,6 @@ func (t *Team) IsPublic() bool  { return t.Visibility.IsPublic() }
 func (t *Team) IsLimited() bool { return t.Visibility.IsLimited() }
 func (t *Team) IsPrivate() bool { return t.Visibility.IsPrivate() }

-const (
-	ghostTeamID   = -1
-	ghostTeamName = "(deleted team)"
-)
-
-func newGhostTeam() *Team {
-	return &Team{ID: ghostTeamID, Name: ghostTeamName, LowerName: ghostTeamName}
-}
-
 // CanNonMemberReadMeta reports whether a non-member, non-owner doer may read
 // the team's metadata, based on the team's visibility tier and the parent org's
 // visibility. Privileged callers (site admins, org owners, team members) are
@@ -280,17 +270,6 @@ func GetTeamByID(ctx context.Context, teamID int64) (*Team, error) {
 	return t, nil
 }

-func GetPossibleTeamByID(ctx context.Context, teamID int64) (int64, *Team, error) {
-	t, err := GetTeamByID(ctx, teamID)
-	if errors.Is(err, util.ErrNotExist) {
-		t = newGhostTeam()
-		return t.ID, t, nil
-	} else if err != nil {
-		return 0, nil, err
-	}
-	return t.ID, t, nil
-}
-
 // IncrTeamRepoNum increases the number of repos for the given team by 1
 func IncrTeamRepoNum(ctx context.Context, teamID int64) error {
 	_, err := db.GetEngine(ctx).Incr("num_repos").ID(teamID).Update(new(Team))
@@ -31,28 +31,18 @@ func GetOrgRepositoryIDs(ctx context.Context, orgID int64) (repoIDs []int64, _ e
 type SearchTeamRepoOptions struct {
 	db.ListOptions
 	TeamID int64
-	// PublicOnly restricts the result (and count) to non-private repositories.
-	PublicOnly bool
-}
-
-func (opts *SearchTeamRepoOptions) toCond() builder.Cond {
-	cond := builder.NewCond()
-	if opts.TeamID > 0 {
-		cond = cond.And(builder.In("id",
-			builder.Select("repo_id").
-				From("team_repo").
-				Where(builder.Eq{"team_id": opts.TeamID}),
-		))
-	}
-	if opts.PublicOnly {
-		cond = cond.And(builder.Eq{"is_private": false})
-	}
-	return cond
 }

 // GetTeamRepositories returns paginated repositories in team of organization.
 func GetTeamRepositories(ctx context.Context, opts *SearchTeamRepoOptions) (RepositoryList, error) {
-	sess := db.GetEngine(ctx).Where(opts.toCond())
+	sess := db.GetEngine(ctx)
+	if opts.TeamID > 0 {
+		sess = sess.In("id",
+			builder.Select("repo_id").
+				From("team_repo").
+				Where(builder.Eq{"team_id": opts.TeamID}),
+		)
+	}
 	if opts.PageSize > 0 {
 		sess.Limit(opts.PageSize, (opts.Page-1)*opts.PageSize)
 	}
@@ -61,11 +51,6 @@ func GetTeamRepositories(ctx context.Context, opts *SearchTeamRepoOptions) (Repo
 		Find(&repos)
 }

-// CountTeamRepositories returns the number of repositories in team of organization matching opts.
-func CountTeamRepositories(ctx context.Context, opts *SearchTeamRepoOptions) (int64, error) {
-	return db.GetEngine(ctx).Where(opts.toCond()).Count(new(Repository))
-}
-
 // AccessibleReposEnvironment operations involving the repositories that are
 // accessible to a particular user
 type AccessibleReposEnvironment interface {
@@ -310,17 +310,11 @@ func userOrgTeamRepoBuilder(userID int64) *builder.Builder {
 }

 // userOrgTeamUnitRepoBuilder returns repo ids where user's teams can access the special unit.
-// A team grants the unit either through an explicit team_unit row (access_mode > none) or by being an
-// admin/owner team (team.authorize >= admin), which grants every unit regardless of team_unit rows —
-// mirroring the HasAdminAccess() short-circuit in access.GetIndividualUserRepoPermission.
 func userOrgTeamUnitRepoBuilder(userID int64, unitType unit.Type) *builder.Builder {
 	return userOrgTeamRepoBuilder(userID).
-		Join("INNER", "team", "`team`.id = `team_repo`.team_id").
-		Join("LEFT", "team_unit", builder.Expr("`team_unit`.team_id = `team_repo`.team_id AND `team_unit`.`type` = ?", unitType)).
-		Where(builder.Or(
-			builder.Gte{"`team`.authorize": int(perm.AccessModeAdmin)},
-			builder.Gt{"`team_unit`.`access_mode`": int(perm.AccessModeNone)},
-		))
+		Join("INNER", "team_unit", "`team_unit`.team_id = `team_repo`.team_id").
+		Where(builder.Eq{"`team_unit`.`type`": unitType}).
+		And(builder.Gt{"`team_unit`.`access_mode`": int(perm.AccessModeNone)})
 }

 // userOrgTeamUnitRepoCond returns a condition to select repo ids where user's teams can access the special unit.
@@ -332,7 +326,7 @@ func userOrgTeamUnitRepoCond(idStr string, userID int64, unitType unit.Type) bui
 func UserOrgUnitRepoCond(idStr string, userID, orgID int64, unitType unit.Type) builder.Cond {
 	return builder.In(idStr,
 		userOrgTeamUnitRepoBuilder(userID, unitType).
-			And(builder.Eq{"`team`.org_id": orgID}),
+			And(builder.Eq{"`team_unit`.org_id": orgID}),
 	)
 }

@@ -761,40 +755,6 @@ func FindUserCodeAccessibleOwnerRepoIDs(ctx context.Context, ownerID int64, user
 	))
 }

-// PublicRepoUnderPublicOwnerCond restricts to public repos whose owner is publicly visible: the
-// "genuinely public" set a public-only token or an anonymous caller may see (a public repo under a
-// limited/private owner is not publicly reachable and must be excluded).
-func PublicRepoUnderPublicOwnerCond() builder.Cond {
-	return builder.And(
-		builder.Eq{"`repository`.is_private": false},
-		builder.In("`repository`.owner_id", builder.Select("id").From("`user`").Where(builder.Eq{"visibility": structs.VisibleTypePublic})),
-	)
-}
-
-// UserActionsAccessibleOwnerRepoCond selects the repos owned by ownerID whose Actions `user` may read.
-// It is used to list an org/user's Actions runs and jobs (see the callers in routers/api/v1/shared).
-//   - owner_id = ownerID: only that owner's repos.
-//   - AccessibleRepositoryCondition(user, TypeActions): only repos whose Actions the user can read
-//     (admin/owner teams are handled inside it; a site admin is not, callers must skip the filter for one).
-//   - publicOnly (a public-only token): additionally limit to public repos under a public owner.
-func UserActionsAccessibleOwnerRepoCond(ownerID int64, user *user_model.User, publicOnly bool) builder.Cond {
-	cond := builder.NewCond().And(
-		builder.Eq{"`repository`.owner_id": ownerID},
-		AccessibleRepositoryCondition(user, unit.TypeActions),
-	)
-	if publicOnly {
-		cond = cond.And(PublicRepoUnderPublicOwnerCond())
-	}
-	return cond
-}
-
-// FindUserActionsAccessibleOwnerRepoIDsSubQuery returns a subquery selecting the repository IDs the user
-// can see for the given owner. Callers embed it in an `IN (...)` condition so that a large owner does not
-// materialize every repo ID into the SQL statement, which could exceed database parameter limits.
-func FindUserActionsAccessibleOwnerRepoIDsSubQuery(ownerID int64, user *user_model.User, publicOnly bool) *builder.Builder {
-	return builder.Select("id").From("repository").Where(UserActionsAccessibleOwnerRepoCond(ownerID, user, publicOnly))
-}
-
 // GetUserRepositories returns a list of repositories of given user.
 func GetUserRepositories(ctx context.Context, opts SearchRepoOptions) (RepositoryList, int64, error) {
 	if len(opts.OrderBy) == 0 {
@@ -9,7 +9,6 @@ import (

 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
-	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/optional"
@@ -467,50 +466,3 @@ func TestSearchRepositoryByTopicName(t *testing.T) {
 		})
 	}
 }
-
-func TestFindUserActionsAccessibleOwnerRepoIDs(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	// user2 is on org3's owner team, so it can access org3's private repo3 (which has the actions unit)
-	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
-
-	// org3 is a public org owning repo3 (private) and repo32 (public), both with the actions unit
-	const orgID = 3
-
-	all, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, user, false))
-	require.NoError(t, err)
-	assert.Contains(t, all, int64(3), "without public-only the private repo's actions are listed")
-
-	publicOnly, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, user, true))
-	require.NoError(t, err)
-	assert.NotContains(t, publicOnly, int64(3), "a public-only token must not list a private repo's actions")
-	assert.Contains(t, publicOnly, int64(32), "a public repo under a public owner stays listed")
-}
-
-// TestUserOrgUnitRepoCondTeamAuthorize pins the team.authorize behavior of userOrgTeamUnitRepoBuilder
-// (exercised through UserOrgUnitRepoCond): an admin/owner team grants every unit even without an explicit
-// team_unit row, while a non-admin team only grants a unit it has an explicit row for. This guards both
-// directions — hiding repos from admin-team members, and over-broadening a plain team's access.
-func TestUserOrgUnitRepoCondTeamAuthorize(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	accessibleRepoIDs := func(userID, orgID int64, unitType unit.Type) []int64 {
-		ids, err := repo_model.SearchRepositoryIDsByCondition(t.Context(),
-			repo_model.UserOrgUnitRepoCond("`repository`.id", userID, orgID, unitType))
-		require.NoError(t, err)
-		return ids
-	}
-
-	// Case A: user18 is only on org17's owner team (team5, authorize=owner), linked to the private repo24
-	// but with no Actions team_unit row. The owner authorize must still grant it, mirroring the runtime
-	// HasAdminAccess() short-circuit in access.GetIndividualUserRepoPermission.
-	assert.Contains(t, accessibleRepoIDs(18, 17, unit.TypeActions), int64(24),
-		"an owner team grants a unit it has no explicit team_unit row for")
-
-	// Cases B and C share one subject so the team_unit row is the only difference: user4 is only on org3's
-	// write team (team2, authorize=write, non-admin), linked to the private repo3. team2 has an explicit
-	// Projects row but none for Actions.
-	assert.Contains(t, accessibleRepoIDs(4, 3, unit.TypeProjects), int64(3),
-		"a non-admin team grants a unit it has an explicit team_unit row for")
-	assert.NotContains(t, accessibleRepoIDs(4, 3, unit.TypeActions), int64(3),
-		"a non-admin team must NOT grant a unit it has no team_unit row for")
-}
@@ -22,9 +22,6 @@ type StarredReposOptions struct {
 	StarrerID      int64
 	RepoOwnerID    int64
 	IncludePrivate bool
-	// Actor is the user the private repositories are gated on: a private repo is only
-	// returned when Actor still has access to it, even if it was starred while access was granted.
-	Actor *user_model.User
 }

 func (opts *StarredReposOptions) ApplyPublicOnly(publicOnly bool) {
@@ -42,12 +39,10 @@ func (opts *StarredReposOptions) ToConds() builder.Cond {
 			"repository.owner_id": opts.RepoOwnerID,
 		})
 	}
-	if opts.IncludePrivate {
-		// only include private repos the actor can still access, so metadata does not leak after access revocation
-		cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
-	} else {
-		// a public repo under a limited/private owner is not publicly reachable, so exclude it too
-		cond = cond.And(PublicRepoUnderPublicOwnerCond())
+	if !opts.IncludePrivate {
+		cond = cond.And(builder.Eq{
+			"repository.is_private": false,
+		})
 	}
 	return cond
 }
@@ -71,9 +66,6 @@ type WatchedReposOptions struct {
 	WatcherID      int64
 	RepoOwnerID    int64
 	IncludePrivate bool
-	// Actor is the user the private repositories are gated on: a private repo is only
-	// returned when Actor still has access to it, even if it was watched while access was granted.
-	Actor *user_model.User
 }

 func (opts *WatchedReposOptions) ApplyPublicOnly(publicOnly bool) {
@@ -91,12 +83,10 @@ func (opts *WatchedReposOptions) ToConds() builder.Cond {
 			"repository.owner_id": opts.RepoOwnerID,
 		})
 	}
-	if opts.IncludePrivate {
-		// only include private repos the actor can still access, so metadata does not leak after access revocation
-		cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
-	} else {
-		// a public repo under a limited/private owner is not publicly reachable, so exclude it too
-		cond = cond.And(PublicRepoUnderPublicOwnerCond())
+	if !opts.IncludePrivate {
+		cond = cond.And(builder.Eq{
+			"repository.is_private": false,
+		})
 	}
 	return cond.And(builder.Neq{
 		"watch.mode": WatchModeDont,
@@ -84,40 +84,3 @@ func testUserRepoGetIssuePostersWithSearch(t *testing.T) {
 	require.Len(t, users, 1)
 	assert.Equal(t, "user2", users[0].Name)
 }
-
-func TestStarredWatchedReposExcludeNonPublicOwners(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	const viewerID = 2
-	// repo1: public repo under a public owner; repo38: public repo under a limited org (not publicly reachable)
-	const publicOwnerRepo, limitedOwnerRepo = 1, 38
-
-	require.NoError(t, db.Insert(t.Context(), &repo_model.Star{UID: viewerID, RepoID: publicOwnerRepo}))
-	require.NoError(t, db.Insert(t.Context(), &repo_model.Star{UID: viewerID, RepoID: limitedOwnerRepo}))
-	require.NoError(t, db.Insert(t.Context(), &repo_model.Watch{UserID: viewerID, RepoID: publicOwnerRepo, Mode: repo_model.WatchModeNormal}))
-	require.NoError(t, db.Insert(t.Context(), &repo_model.Watch{UserID: viewerID, RepoID: limitedOwnerRepo, Mode: repo_model.WatchModeNormal}))
-
-	listOpts := db.ListOptions{Page: 1, PageSize: 50}
-
-	starred, err := repo_model.GetStarredRepos(t.Context(), &repo_model.StarredReposOptions{
-		ListOptions: listOpts, StarrerID: viewerID, IncludePrivate: false,
-	})
-	require.NoError(t, err)
-	assert.NotContains(t, repoIDs(starred), int64(limitedOwnerRepo), "a public repo under a limited owner must be hidden from a public star listing")
-	assert.Contains(t, repoIDs(starred), int64(publicOwnerRepo), "a public repo under a public owner stays visible")
-
-	watched, _, err := repo_model.GetWatchedRepos(t.Context(), &repo_model.WatchedReposOptions{
-		ListOptions: listOpts, WatcherID: viewerID, IncludePrivate: false,
-	})
-	require.NoError(t, err)
-	assert.NotContains(t, repoIDs(watched), int64(limitedOwnerRepo), "a public repo under a limited owner must be hidden from a public watch listing")
-	assert.Contains(t, repoIDs(watched), int64(publicOwnerRepo), "a public repo under a public owner stays visible")
-}
-
-func repoIDs(repos []*repo_model.Repository) []int64 {
-	ids := make([]int64, len(repos))
-	for i, r := range repos {
-		ids[i] = r.ID
-	}
-	return ids
-}
@@ -55,34 +55,29 @@ func ParseScopedWorkflows(sourceCommit *git.Commit) ([]*ParsedScopedWorkflow, er
 	return parsed, nil
 }

-// MatchScopedWorkflows evaluates already-parsed scoped workflows against one consuming event.
-// It returns the workflows whose `on:` matches, and those that matched the event but were excluded by a branch/paths filter (filtered).
+// MatchScopedWorkflows evaluates already-parsed scoped workflows against one consuming event, returning those whose `on:` matches.
 func MatchScopedWorkflows(
 	parsed []*ParsedScopedWorkflow,
 	consumerGitRepo *git.Repository,
 	consumerCommit *git.Commit,
 	triggedEvent webhook_module.HookEventType,
 	payload api.Payloader,
-) (matched, filtered []*DetectedWorkflow) {
+) []*DetectedWorkflow {
+	workflows := make([]*DetectedWorkflow, 0, len(parsed))
 	for _, p := range parsed {
 		for _, evt := range p.Events {
 			if evt.IsSchedule() {
 				// schedule is a non-target for scoped workflows
 				continue
 			}
-			dwf := &DetectedWorkflow{
-				EntryName:    p.EntryName,
-				TriggerEvent: evt,
-				Content:      p.Content,
-			}
-			switch detectWorkflowMatch(consumerGitRepo, consumerCommit, triggedEvent, payload, evt) {
-			case detectMatched:
-				matched = append(matched, dwf)
-			case detectFilteredOut:
-				filtered = append(filtered, dwf)
-			case detectNotApplicable:
+			if detectMatched(consumerGitRepo, consumerCommit, triggedEvent, payload, evt) {
+				workflows = append(workflows, &DetectedWorkflow{
+					EntryName:    p.EntryName,
+					TriggerEvent: evt,
+					Content:      p.Content,
+				})
 			}
 		}
 	}
-	return matched, filtered
+	return workflows
 }
@@ -30,14 +30,6 @@ type DetectedWorkflow struct {
 	Content      []byte
 }

-type detectResult int
-
-const (
-	detectMatched       detectResult = iota // event matched; run normally
-	detectNotApplicable                     // event/type doesn't apply; create nothing
-	detectFilteredOut                       // matched but excluded by a branch/paths filter; posts a skipped commit status when the context is a required check
-)
-
 func init() {
 	model.OnDecodeNodeError = func(node yaml.Node, out any, err error) {
 		// Log the error instead of panic or fatal.
@@ -180,16 +172,18 @@ func DetectWorkflows(
 	triggedEvent webhook_module.HookEventType,
 	payload api.Payloader,
 	detectSchedule bool,
-) (workflows, schedules, filtered []*DetectedWorkflow, err error) {
+) ([]*DetectedWorkflow, []*DetectedWorkflow, error) {
 	_, entries, err := ListWorkflows(commit)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, err
 	}

+	workflows := make([]*DetectedWorkflow, 0, len(entries))
+	schedules := make([]*DetectedWorkflow, 0, len(entries))
 	for _, entry := range entries {
 		content, err := GetContentFromEntry(entry)
 		if err != nil {
-			return nil, nil, nil, err
+			return nil, nil, err
 		}

 		// one workflow may have multiple events
@@ -209,24 +203,18 @@ func DetectWorkflows(
 					}
 					schedules = append(schedules, dwf)
 				}
-			} else {
+			} else if detectMatched(gitRepo, commit, triggedEvent, payload, evt) {
 				dwf := &DetectedWorkflow{
 					EntryName:    entry.Name(),
 					TriggerEvent: evt,
 					Content:      content,
 				}
-				switch detectWorkflowMatch(gitRepo, commit, triggedEvent, payload, evt) {
-				case detectMatched:
-					workflows = append(workflows, dwf)
-				case detectFilteredOut:
-					filtered = append(filtered, dwf)
-				case detectNotApplicable:
-				}
+				workflows = append(workflows, dwf)
 			}
 		}
 	}

-	return workflows, schedules, filtered, nil
+	return workflows, schedules, nil
 }

 func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*DetectedWorkflow, error) {
@@ -264,9 +252,9 @@ func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*D
 	return wfs, nil
 }

-func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEvent webhook_module.HookEventType, payload api.Payloader, evt *jobparser.Event) detectResult {
+func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent webhook_module.HookEventType, payload api.Payloader, evt *jobparser.Event) bool {
 	if !canGithubEventMatch(evt.Name, triggedEvent) {
-		return detectNotApplicable
+		return false
 	}

 	switch triggedEvent {
@@ -280,7 +268,7 @@ func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEve
 			log.Warn("Ignore unsupported %s event arguments %v", triggedEvent, evt.Acts())
 		}
 		// no special filter parameters for these events, just return true if name matched
-		return detectMatched
+		return true

 	case // push
 		webhook_module.HookEventPush:
@@ -291,20 +279,14 @@ func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEve
 		webhook_module.HookEventIssueAssign,
 		webhook_module.HookEventIssueLabel,
 		webhook_module.HookEventIssueMilestone:
-		if matchIssuesEvent(payload.(*api.IssuePayload), evt) {
-			return detectMatched
-		}
-		return detectNotApplicable
+		return matchIssuesEvent(payload.(*api.IssuePayload), evt)

 	case // issue_comment
 		webhook_module.HookEventIssueComment,
 		// `pull_request_comment` is same as `issue_comment`
 		// See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_comment-use-issue_comment
 		webhook_module.HookEventPullRequestComment:
-		if matchIssueCommentEvent(payload.(*api.IssueCommentPayload), evt) {
-			return detectMatched
-		}
-		return detectNotApplicable
+		return matchIssueCommentEvent(payload.(*api.IssueCommentPayload), evt)

 	case // pull_request
 		webhook_module.HookEventPullRequest,
@@ -318,49 +300,34 @@ func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEve
 	case // pull_request_review
 		webhook_module.HookEventPullRequestReviewApproved,
 		webhook_module.HookEventPullRequestReviewRejected:
-		if matchPullRequestReviewEvent(payload.(*api.PullRequestPayload), evt) {
-			return detectMatched
-		}
-		return detectNotApplicable
+		return matchPullRequestReviewEvent(payload.(*api.PullRequestPayload), evt)

 	case // pull_request_review_comment
 		webhook_module.HookEventPullRequestReviewComment:
-		if matchPullRequestReviewCommentEvent(payload.(*api.PullRequestPayload), evt) {
-			return detectMatched
-		}
-		return detectNotApplicable
+		return matchPullRequestReviewCommentEvent(payload.(*api.PullRequestPayload), evt)

 	case // release
 		webhook_module.HookEventRelease:
-		if matchReleaseEvent(payload.(*api.ReleasePayload), evt) {
-			return detectMatched
-		}
-		return detectNotApplicable
+		return matchReleaseEvent(payload.(*api.ReleasePayload), evt)

 	case // registry_package
 		webhook_module.HookEventPackage:
-		if matchPackageEvent(payload.(*api.PackagePayload), evt) {
-			return detectMatched
-		}
-		return detectNotApplicable
+		return matchPackageEvent(payload.(*api.PackagePayload), evt)

 	case // workflow_run
 		webhook_module.HookEventWorkflowRun:
-		if matchWorkflowRunEvent(payload.(*api.WorkflowRunPayload), evt) {
-			return detectMatched
-		}
-		return detectNotApplicable
+		return matchWorkflowRunEvent(payload.(*api.WorkflowRunPayload), evt)

 	default:
 		log.Warn("unsupported event %q", triggedEvent)
-		return detectNotApplicable
+		return false
 	}
 }

-func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) detectResult {
+func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) bool {
 	// with no special filter parameters
 	if len(evt.Acts()) == 0 {
-		return detectMatched
+		return true
 	}

 	matchTimes := 0
@@ -426,14 +393,14 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
-				return detectNotApplicable
-			}
-			patterns, err := workflowpattern.CompilePatterns(vals...)
-			if err != nil {
-				break
-			}
-			if !workflowpattern.Skip(patterns, filesChanged) {
-				matchTimes++
+			} else {
+				patterns, err := workflowpattern.CompilePatterns(vals...)
+				if err != nil {
+					break
+				}
+				if !workflowpattern.Skip(patterns, filesChanged) {
+					matchTimes++
+				}
 			}
 		case "paths-ignore":
 			if refName.IsTag() {
@@ -443,14 +410,14 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
-				return detectNotApplicable
-			}
-			patterns, err := workflowpattern.CompilePatterns(vals...)
-			if err != nil {
-				break
-			}
-			if !workflowpattern.Filter(patterns, filesChanged) {
-				matchTimes++
+			} else {
+				patterns, err := workflowpattern.CompilePatterns(vals...)
+				if err != nil {
+					break
+				}
+				if !workflowpattern.Filter(patterns, filesChanged) {
+					matchTimes++
+				}
 			}
 		default:
 			log.Warn("push event unsupported condition %q", cond)
@@ -460,10 +427,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 	if hasBranchFilter && hasTagFilter {
 		matchTimes++
 	}
-	if matchTimes == len(evt.Acts()) {
-		return detectMatched
-	}
-	return detectFilteredOut
+	return matchTimes == len(evt.Acts())
 }

 func matchIssuesEvent(issuePayload *api.IssuePayload, evt *jobparser.Event) bool {
@@ -514,7 +478,7 @@ func matchIssuesEvent(issuePayload *api.IssuePayload, evt *jobparser.Event) bool
 	return matchTimes == len(evt.Acts())
 }

-func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayload *api.PullRequestPayload, evt *jobparser.Event) detectResult {
+func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayload *api.PullRequestPayload, evt *jobparser.Event) bool {
 	acts := evt.Acts()
 	activityTypeMatched := false
 	matchTimes := 0
@@ -561,7 +525,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 		headCommit, err = gitRepo.GetCommit(prPayload.PullRequest.Head.Sha)
 		if err != nil {
 			log.Error("GetCommit [ref: %s]: %v", prPayload.PullRequest.Head.Sha, err)
-			return detectNotApplicable
+			return false
 		}
 	}

@@ -593,39 +557,33 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
-				return detectNotApplicable
-			}
-			patterns, err := workflowpattern.CompilePatterns(vals...)
-			if err != nil {
-				break
-			}
-			if !workflowpattern.Skip(patterns, filesChanged) {
-				matchTimes++
+			} else {
+				patterns, err := workflowpattern.CompilePatterns(vals...)
+				if err != nil {
+					break
+				}
+				if !workflowpattern.Skip(patterns, filesChanged) {
+					matchTimes++
+				}
 			}
 		case "paths-ignore":
 			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
-				return detectNotApplicable
-			}
-			patterns, err := workflowpattern.CompilePatterns(vals...)
-			if err != nil {
-				break
-			}
-			if !workflowpattern.Filter(patterns, filesChanged) {
-				matchTimes++
+			} else {
+				patterns, err := workflowpattern.CompilePatterns(vals...)
+				if err != nil {
+					break
+				}
+				if !workflowpattern.Filter(patterns, filesChanged) {
+					matchTimes++
+				}
 			}
 		default:
 			log.Warn("pull request event unsupported condition %q", cond)
 		}
 	}
-	if !activityTypeMatched {
-		return detectNotApplicable
-	}
-	if matchTimes != len(evt.Acts()) {
-		return detectFilteredOut
-	}
-	return detectMatched
+	return activityTypeMatched && matchTimes == len(evt.Acts())
 }

 func matchIssueCommentEvent(issueCommentPayload *api.IssueCommentPayload, evt *jobparser.Event) bool {
@@ -101,49 +101,49 @@ func TestDetectMatched(t *testing.T) {
 		triggedEvent webhook_module.HookEventType
 		payload      api.Payloader
 		yamlOn       string
-		expected     detectResult
+		expected     bool
 	}{
 		{
 			desc:         "HookEventCreate(create) matches GithubEventCreate(create)",
 			triggedEvent: webhook_module.HookEventCreate,
 			payload:      nil,
 			yamlOn:       "on: create",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventIssues(issues) `opened` action matches GithubEventIssues(issues)",
 			triggedEvent: webhook_module.HookEventIssues,
 			payload:      &api.IssuePayload{Action: api.HookIssueOpened},
 			yamlOn:       "on: issues",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventIssues(issues) `milestoned` action matches GithubEventIssues(issues)",
 			triggedEvent: webhook_module.HookEventIssues,
 			payload:      &api.IssuePayload{Action: api.HookIssueMilestoned},
 			yamlOn:       "on: issues",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventPullRequestSync(pull_request_sync) matches GithubEventPullRequest(pull_request)",
 			triggedEvent: webhook_module.HookEventPullRequestSync,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueSynchronized},
 			yamlOn:       "on: pull_request",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `label_updated` action doesn't match GithubEventPullRequest(pull_request) with no activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueLabelUpdated},
 			yamlOn:       "on: pull_request",
-			expected:     detectNotApplicable,
+			expected:     false,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `closed` action doesn't match GithubEventPullRequest(pull_request) with no activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueClosed},
 			yamlOn:       "on: pull_request",
-			expected:     detectNotApplicable,
+			expected:     false,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `closed` action doesn't match GithubEventPullRequest(pull_request) with branches",
@@ -155,56 +155,56 @@ func TestDetectMatched(t *testing.T) {
 				},
 			},
 			yamlOn:   "on:\n  pull_request:\n    branches: [main]",
-			expected: detectNotApplicable,
+			expected: false,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `label_updated` action matches GithubEventPullRequest(pull_request) with `label` activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueLabelUpdated},
 			yamlOn:       "on:\n  pull_request:\n    types: [labeled]",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventPullRequestReviewComment(pull_request_review_comment) matches GithubEventPullRequestReviewComment(pull_request_review_comment)",
 			triggedEvent: webhook_module.HookEventPullRequestReviewComment,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueReviewed},
 			yamlOn:       "on:\n  pull_request_review_comment:\n    types: [created]",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventPullRequestReviewRejected(pull_request_review_rejected) doesn't match GithubEventPullRequestReview(pull_request_review) with `dismissed` activity type (we don't support `dismissed` at present)",
 			triggedEvent: webhook_module.HookEventPullRequestReviewRejected,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueReviewed},
 			yamlOn:       "on:\n  pull_request_review:\n    types: [dismissed]",
-			expected:     detectNotApplicable,
+			expected:     false,
 		},
 		{
 			desc:         "HookEventRelease(release) `published` action matches GithubEventRelease(release) with `published` activity type",
 			triggedEvent: webhook_module.HookEventRelease,
 			payload:      &api.ReleasePayload{Action: api.HookReleasePublished},
 			yamlOn:       "on:\n  release:\n    types: [published]",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventPackage(package) `created` action doesn't match GithubEventRegistryPackage(registry_package) with `updated` activity type",
 			triggedEvent: webhook_module.HookEventPackage,
 			payload:      &api.PackagePayload{Action: api.HookPackageCreated},
 			yamlOn:       "on:\n  registry_package:\n    types: [updated]",
-			expected:     detectNotApplicable,
+			expected:     false,
 		},
 		{
 			desc:         "HookEventWiki(wiki) matches GithubEventGollum(gollum)",
 			triggedEvent: webhook_module.HookEventWiki,
 			payload:      nil,
 			yamlOn:       "on: gollum",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "HookEventSchedule(schedule) matches GithubEventSchedule(schedule)",
 			triggedEvent: webhook_module.HookEventSchedule,
 			payload:      nil,
 			yamlOn:       "on: schedule",
-			expected:     detectMatched,
+			expected:     true,
 		},
 		{
 			desc:         "push to tag matches workflow with paths condition (should skip paths check)",
@@ -222,19 +222,7 @@ func TestDetectMatched(t *testing.T) {
 			},
 			commit:   nil,
 			yamlOn:   "on:\n  push:\n    paths:\n      - src/**",
-			expected: detectMatched,
-		},
-		{
-			desc:         "push branch filter excludes -> filtered out",
-			triggedEvent: webhook_module.HookEventPush,
-			payload: &api.PushPayload{
-				Ref:     "refs/heads/feature/x",
-				Before:  "0000000",
-				Commits: []*api.PayloadCommit{{ID: "abc", Added: []string{"a.go"}, Message: "x"}},
-			},
-			commit:   nil,
-			yamlOn:   "on:\n  push:\n    branches: [main]",
-			expected: detectFilteredOut,
+			expected: true,
 		},
 	}

@@ -243,7 +231,7 @@ func TestDetectMatched(t *testing.T) {
 			evts, err := GetEventsFromContent(fullWorkflowContent(tc.yamlOn))
 			assert.NoError(t, err)
 			assert.Len(t, evts, 1)
-			assert.Equal(t, tc.expected, detectWorkflowMatch(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
+			assert.Equal(t, tc.expected, detectMatched(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
 		})
 	}
 }
@@ -4,14 +4,8 @@
 package openid

 import (
-	"net/http"
-	"sync"
 	"time"

-	"gitea.dev/modules/hostmatcher"
-	"gitea.dev/modules/proxy"
-	"gitea.dev/modules/setting"
-
 	"github.com/yohcop/openid-go"
 )

@@ -25,23 +19,11 @@ import (
 var (
 	nonceStore     = openid.NewSimpleNonceStore()
 	discoveryCache = newTimedDiscoveryCache(24 * time.Hour)
-
-	// openIDInstance does discovery/verification via an SSRF-protected client, so a user-supplied
-	// OpenID identifier can't reach internal/loopback/reserved addresses. It honors the operator's
-	// [security] ALLOWED_HOST_LIST (empty defaults to "external"), matching the avatar/webhook/migration
-	// clients, and validates the proxy path too. Lazy: reads proxy/settings once.
-	openIDInstance = sync.OnceValue(func() *openid.OpenID {
-		allowList := hostmatcher.ParseHostMatchList("security.ALLOWED_HOST_LIST", setting.Security.AllowedHostList)
-		return openid.NewOpenID(&http.Client{
-			Timeout:   30 * time.Second,
-			Transport: hostmatcher.NewHTTPTransport("openid", allowList, nil, proxy.Proxy(), setting.Proxy.ProxyURLFixed, nil),
-		})
-	})
 )

 // Verify handles response from OpenID provider
 func Verify(fullURL string) (id string, err error) {
-	return openIDInstance().Verify(fullURL, discoveryCache, nonceStore)
+	return openid.Verify(fullURL, discoveryCache, nonceStore)
 }

 // Normalize normalizes an OpenID URI
@@ -51,5 +33,5 @@ func Normalize(url string) (id string, err error) {

 // RedirectURL redirects browser
 func RedirectURL(id, callbackURL, realm string) (string, error) {
-	return openIDInstance().RedirectURL(id, callbackURL, realm)
+	return openid.RedirectURL(id, callbackURL, realm)
 }
@@ -1,29 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package openid
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"sync/atomic"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestOpenIDDiscoveryBlocksInternalHost(t *testing.T) {
-	var reached atomic.Bool
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		reached.Store(true)
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	// RedirectURL performs server-side discovery of the identifier URL; a loopback URL
-	// must be refused at dial time instead of reaching the internal server
-	_, err := RedirectURL(srv.URL, "http://example.com/callback", "http://example.com/")
-	require.Error(t, err)
-	assert.False(t, reached.Load(), "OpenID discovery must not reach an internal/loopback host")
-}
@@ -10,22 +10,16 @@ import (
 	"sync"

 	"gitea.dev/modules/charset"
+	"gitea.dev/modules/container"
 	"gitea.dev/modules/util"
 )

 // CoAuthoredByTrailer is the canonical token for the `Co-authored-by:` git trailer.
 const CoAuthoredByTrailer = "Co-authored-by"

-const (
-	commitIdentityRoleAuthor    = 1
-	commitIdentityRoleCommitter = 2
-	commitIdentityRoleCoAuthor  = 3
-)
-
 type CommitIdentity struct {
 	Name  string
 	Email string
-	role  int
 }

 // CommitMessageTrailerValues keys are all in lower-case
@@ -39,9 +33,7 @@ type CommitMessage struct {

 	trailerValues CommitMessageTrailerValues

-	allParticipants      []*CommitIdentity
-	committerCoAuthorIdx int
-	committerCoAuthor    *CommitIdentity
+	allParticipants []*CommitIdentity
 }

 func (c *CommitMessage) MessageUTF8() string {
@@ -113,57 +105,29 @@ func (c *Commit) AllParticipantIdentities() []*CommitIdentity {
 		return c.allParticipants
 	}

-	exclude := map[string]int{}
-	addParticipant := func(name, email string, role int) (existingRole int) {
+	exclude := container.Set[string]{}
+	c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: c.Author.Name, Email: c.Author.Email})
+	exclude.Add(strings.ToLower(c.Author.Email))
+
+	addParticipant := func(name, email string) {
 		if name == "" && email == "" {
-			return 0
+			return
 		}
 		emailLower := strings.ToLower(email)
-		if existingRole = exclude[emailLower]; emailLower != "" && existingRole != 0 {
-			return existingRole
+		if emailLower != "" && exclude.Contains(emailLower) {
+			return
 		}
-		c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: name, Email: email, role: role})
-		exclude[emailLower] = role
-		return 0
+		c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: name, Email: email})
+		exclude.Add(emailLower)
 	}
-
-	c.committerCoAuthorIdx = -1
-	addParticipant(c.Author.Name, c.Author.Email, commitIdentityRoleAuthor)
-	addParticipant(c.Committer.Name, c.Committer.Email, commitIdentityRoleCommitter)
+	addParticipant(c.Committer.Name, c.Committer.Email)
 	for _, coAuthorValue := range c.MessageTrailer()["co-authored-by"] {
 		addr, err := mail.ParseAddress(coAuthorValue)
-		coAuthorName, coAuthorEmail := coAuthorValue, ""
 		if err == nil {
-			coAuthorName, coAuthorEmail = addr.Name, addr.Address
-		}
-		existingRole := addParticipant(coAuthorName, coAuthorEmail, commitIdentityRoleCoAuthor)
-		if existingRole == commitIdentityRoleCommitter && c.committerCoAuthorIdx == -1 {
-			c.committerCoAuthorIdx = len(c.allParticipants)
-			c.committerCoAuthor = &CommitIdentity{coAuthorName, coAuthorEmail, commitIdentityRoleCoAuthor}
+			addParticipant(addr.Name, addr.Address)
+		} else {
+			addParticipant(coAuthorValue, "")
 		}
 	}
 	return c.allParticipants
 }
-
-// CoAuthorIdentities returns co-author identities defined by "Co-authored-by:" in the git message trailer
-// Only the commit's author is excluded. If committer is declared as co-author, it will be included in the result.
-// * Author & Co-author: they changed the code (attribution)
-// * Committer: they submitted the commit but didn't change the code (e.g.: maintainer signed a commit)
-// So, a committer can also be a co-author if they changed the code.
-func (c *Commit) CoAuthorIdentities() (coAuthors []*CommitIdentity) {
-	all := c.AllParticipantIdentities()
-	if len(all) <= 1 {
-		return nil // no co-author list
-	}
-	if all[1].role != commitIdentityRoleCommitter {
-		return all[1:] // no committer, so all after author are co-authors
-	}
-	if c.committerCoAuthorIdx == -1 {
-		return all[2:] // the committer is not in the co-author list, so just return the co-author list
-	}
-	// the committer is in the co-author list but de-duplicated, so include them as co-author again
-	coAuthors = append(coAuthors, all[2:c.committerCoAuthorIdx]...)
-	coAuthors = append(coAuthors, c.committerCoAuthor)
-	coAuthors = append(coAuthors, all[c.committerCoAuthorIdx:]...)
-	return coAuthors
-}
@@ -47,83 +47,36 @@ func TestCommitMessageTrailer(t *testing.T) {
 	}
 }

-func TestCommitMessageParticipants(t *testing.T) {
+func TestCommitMessageAllParticipantIdentities(t *testing.T) {
 	sig := func(n, e string) *Signature { return &Signature{Name: n, Email: e} }
-	idt := func(n, e string, r int) *CommitIdentity { return &CommitIdentity{n, e, r} }
-	roleAuthor, roleCommitter, roleCoAuthor := commitIdentityRoleAuthor, commitIdentityRoleCommitter, commitIdentityRoleCoAuthor
-	type testCase struct {
-		name       string
-		commit     *Commit
-		identities []*CommitIdentity
+	idt := func(n, e string) *CommitIdentity { return &CommitIdentity{Name: n, Email: e} }
+	cases := []struct {
+		commit      *Commit
+		participant []*CommitIdentity
+	}{
+		{
+			&Commit{
+				Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
+				CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: x@m.com"},
+			},
+			[]*CommitIdentity{idt("a", "a@m.com"), idt("c", "c@m.com"), idt("", "x@m.com")},
+		},
+		{
+			&Commit{
+				Author: sig("a", "a@m.com"), Committer: sig("a", "A@M.com"),
+				CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: a@m.com"},
+			},
+			[]*CommitIdentity{idt("a", "a@m.com")},
+		},
+		{
+			&Commit{
+				Author: sig("a", "a@m.com"), Committer: sig("", ""),
+				CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: Full Name <X@M.com>"},
+			},
+			[]*CommitIdentity{idt("a", "a@m.com"), idt("Full Name", "X@M.com")},
+		},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.participant, c.commit.AllParticipantIdentities())
 	}
-	t.Run("AllParticipants", func(t *testing.T) {
-		cases := []testCase{
-			{
-				"DifferentUsers",
-				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: x@m.com"},
-				},
-				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor), idt("c", "c@m.com", roleCommitter), idt("", "x@m.com", roleCoAuthor)},
-			},
-			{
-				"SameUser",
-				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("a", "A@M.com"),
-					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: a@m.com"},
-				},
-				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor)},
-			},
-			{
-				"NoCommitter",
-				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("", ""),
-					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: Full Name <X@M.com>"},
-				},
-				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor), idt("Full Name", "X@M.com", roleCoAuthor)},
-			},
-		}
-		for _, c := range cases {
-			assert.Equal(t, c.identities, c.commit.AllParticipantIdentities(), "case: %s", c.name)
-		}
-	})
-	t.Run("CoAuthors", func(t *testing.T) {
-		cases := []testCase{
-			{
-				"GenuineCoAuthor",
-				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: x <x@m.com>"},
-				},
-				[]*CommitIdentity{idt("x", "x@m.com", roleCoAuthor)},
-			},
-			{
-				"CoAuthorIsCommitter",
-				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: c <c@m.com>"},
-				},
-				[]*CommitIdentity{idt("c", "c@m.com", roleCoAuthor)},
-			},
-			{
-				"CoAuthorIsAuthor",
-				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: a <a@m.com>"},
-				},
-				[]*CommitIdentity{},
-			},
-			{
-				"CoAuthorCommitterNameWithIndex", // restore the committer co-author to the co-author list by the index with correct name
-				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: x <x@m.com>\nCo-authored-by: c-other <c@m.com>\nCo-authored-by: y <y@m.com>"},
-				},
-				[]*CommitIdentity{idt("x", "x@m.com", roleCoAuthor), idt("c-other", "c@m.com", roleCoAuthor), idt("y", "y@m.com", roleCoAuthor)},
-			},
-		}
-		for _, c := range cases {
-			assert.Equal(t, c.identities, c.commit.CoAuthorIdentities(), "case: %s", c.name)
-		}
-	})
 }
@@ -10,10 +10,10 @@ import (
 	"strconv"
 )

-// sha1Pattern can be used to determine if a string is a valid sha
+// sha1Pattern can be used to determine if a string is an valid sha
 var sha1Pattern = regexp.MustCompile(`^[0-9a-f]{4,40}$`)

-// sha256Pattern can be used to determine if a string is a valid sha
+// sha256Pattern can be used to determine if a string is an valid sha
 var sha256Pattern = regexp.MustCompile(`^[0-9a-f]{4,64}$`)

 type ObjectFormat interface {
@@ -21,6 +21,19 @@ func TestCommitsCount(t *testing.T) {
 	assert.Equal(t, int64(3), commitsCount)
 }

+func TestCommitsCountWithoutBase(t *testing.T) {
+	bareRepo1 := &mockRepository{path: "repo1_bare"}
+
+	commitsCount, err := CommitsCount(t.Context(), bareRepo1,
+		CommitsCountOptions{
+			Not:      "master",
+			Revision: []string{"branch1"},
+		})
+
+	assert.NoError(t, err)
+	assert.Equal(t, int64(2), commitsCount)
+}
+
 func TestCommitsCountWithSinceUntil(t *testing.T) {
 	bareRepo1 := &mockRepository{path: "repo1_bare"}
 	revision := []string{"8006ff9adbf0cb94da7dad9e537e53817f9fa5c0"}
@@ -52,19 +65,6 @@ func TestCommitsCountWithSinceUntil(t *testing.T) {
 	}
 }

-func TestCommitsCountWithoutBase(t *testing.T) {
-	bareRepo1 := &mockRepository{path: "repo1_bare"}
-
-	commitsCount, err := CommitsCount(t.Context(), bareRepo1,
-		CommitsCountOptions{
-			Not:      "master",
-			Revision: []string{"branch1"},
-		})
-
-	assert.NoError(t, err)
-	assert.Equal(t, int64(2), commitsCount)
-}
-
 func TestGetLatestCommitTime(t *testing.T) {
 	bareRepo1 := &mockRepository{path: "repo1_bare"}
 	lct, err := GetLatestCommitTime(t.Context(), bareRepo1)
@@ -5,10 +5,8 @@ package hostmatcher

 import (
 	"context"
-	"crypto/tls"
 	"fmt"
 	"net"
-	"net/http"
 	"net/url"
 	"syscall"
 	"time"
@@ -65,17 +63,3 @@ func NewDialContext(usage string, allowList, blockList *HostMatchList, proxy *ur
 		return dialer.DialContext(ctx, network, addrOrHost)
 	}
 }
-
-// NewHTTPTransport builds an http.Transport that validates the request target against the allow/block
-// lists on the direct-dial path (DialContext). When an HTTP proxy is configured the proxy resolves and
-// dials the target itself, so restricting the proxied target is the proxy server's responsibility, not
-// Gitea's. proxyFunc selects the proxy URL per request (the http.Transport.Proxy selector, e.g.
-// proxy.Proxy()); proxyURLFixed is the fixed proxy address the dialer must always permit; tlsConfig may
-// be nil. blockList may be nil for callers that only maintain an allow-list.
-func NewHTTPTransport(usage string, allowList, blockList *HostMatchList, proxyFunc func(*http.Request) (*url.URL, error), proxyURLFixed *url.URL, tlsConfig *tls.Config) *http.Transport {
-	return &http.Transport{
-		TLSClientConfig: tlsConfig,
-		Proxy:           proxyFunc,
-		DialContext:     NewDialContext(usage, allowList, blockList, proxyURLFixed),
-	}
-}
@@ -167,7 +167,7 @@ func validateOptions(field *api.IssueFormField, idx int) error {

 	options, ok := field.Attributes["options"].([]any)
 	if !ok || len(options) == 0 {
-		return position.Errorf("'options' is required and should be an array")
+		return position.Errorf("'options' is required and should be a array")
 	}

 	for optIdx, option := range options {
@@ -270,7 +270,7 @@ func validateDropdownDefault(position errorPosition, attributes map[string]any)
 	options, ok := attributes["options"].([]any)
 	if !ok {
 		// should not happen
-		return position.Errorf("'options' is required and should be an array")
+		return position.Errorf("'options' is required and should be a array")
 	}
 	if defaultValue < 0 || defaultValue >= len(options) {
 		return position.Errorf("the value of 'default' is out of range")
@@ -268,7 +268,7 @@ body:
    attributes:
      label: "a"
 `,
-			wantErr: "body[0](dropdown): 'options' is required and should be an array",
+			wantErr: "body[0](dropdown): 'options' is required and should be a array",
 		},
 		{
 			name: "dropdown invalid options",
@@ -51,7 +51,7 @@ var globalVars = sync.OnceValue(func() *globalVarsType {
 	v := &globalVarsType{}
 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and leads to false positives.
+	// While fast, this is also incorrect and lead to false positives.
 	// TODO: fix invalid linking issue (update: stale TODO, what issues? maybe no TODO anymore)

 	// valid chars in encoded path and parameter: [-+~_%.a-zA-Z0-9/]
@@ -54,7 +54,7 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 	// Allow 'color' and 'background-color' properties for the style attribute on text elements.
 	policy.AllowStyles("color", "background-color").OnElements("div", "span", "p", "tr", "th", "td")

-	policy.AllowAttrs("src", "autoplay", "controls", "muted", "loop", "playsinline").OnElements("video")
+	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")

 	// Native support of "<picture><source media=... srcset=...><img src=...></picture>"
 	// ATTENTION: it only works with "auto" theme, because "media" query doesn't work with the theme chosen by end user manually.
@@ -13,7 +13,6 @@ import (
 	"strconv"
 	"strings"

-	"gitea.dev/modules/packages"
 	"gitea.dev/modules/util"
 	"gitea.dev/modules/validation"

@@ -47,11 +46,6 @@ var (
 	namePattern = regexp.MustCompile(`\A[a-zA-Z0-9@._+-]+\z`)
 	// (epoch:pkgver-pkgrel)
 	versionPattern = regexp.MustCompile(`\A(?:\d:)?[\w.+~]+(?:-[-\w.+~]+)?\z`)
-
-	// caps on the accumulated package file list (vars so tests can lower them); far above
-	// any legitimate package, but low enough to stop metadata amplification
-	maxFileEntries   = 100000
-	maxFileNameBytes = 16 * 1024 * 1024
 )

 type Package struct {
@@ -130,7 +124,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 	}

 	var p *Package
-	files := packages.NewBoundedFileList(maxFileEntries, maxFileNameBytes)
+	files := make([]string, 0, 10)

 	tr := tar.NewReader(inner)
 	for {
@@ -153,9 +147,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 				return nil, err
 			}
 		} else if !strings.HasPrefix(filename, ".") {
-			if err := files.Add(hd.Name); err != nil {
-				return nil, err
-			}
+			files = append(files, hd.Name)
 		}
 	}

@@ -163,7 +155,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 		return nil, ErrMissingPKGINFOFile
 	}

-	p.FileMetadata.Files = files.Files()
+	p.FileMetadata.Files = files
 	p.FileCompressionExtension = compressionType

 	return p, nil
@@ -10,9 +10,6 @@ import (
 	"io"
 	"testing"

-	"gitea.dev/modules/test"
-	"gitea.dev/modules/util"
-
 	"github.com/klauspost/compress/zstd"
 	"github.com/stretchr/testify/assert"
 	"github.com/ulikunitz/xz"
@@ -170,25 +167,3 @@ func TestParsePackageInfo(t *testing.T) {
 		assert.ElementsMatch(t, []string{"usr/bin/paket1"}, p.FileMetadata.Backup)
 	})
 }
-
-// TestParsePackageTooManyFiles ensures the accumulated file list is bounded to prevent
-// metadata amplification from a package with a huge number of (tiny) file entries.
-func TestParsePackageTooManyFiles(t *testing.T) {
-	defer test.MockVariableValue(&maxFileEntries, 3)()
-	buf := test.WriteTarCompression(func(w io.Writer) io.WriteCloser { return gzip.NewWriter(w) }, map[string]string{
-		"file1":    "content1",
-		".PKGINFO": string(createPKGINFOContent(packageName, packageVersion)),
-	})
-	_, err := ParsePackage(buf)
-	assert.NoError(t, err)
-
-	buf = test.WriteTarCompression(func(w io.Writer) io.WriteCloser { return gzip.NewWriter(w) }, map[string]string{
-		"file1":    "content1",
-		"file2":    "content2",
-		"file3":    "content3",
-		"file4":    "content4",
-		".PKGINFO": string(createPKGINFOContent(packageName, packageVersion)),
-	})
-	_, err = ParsePackage(buf)
-	assert.ErrorIs(t, err, util.ErrInvalidArgument)
-}
@@ -135,10 +135,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 				return nil, GlobalVars().ErrUnsupportedCompression
 			}

-			// bound the decompressed control archive: it holds only the small control file
-			// and maintainer scripts, so a much larger stream is a decompression bomb
-			const maxControlTarSize = 32 * 1024 * 1024
-			tr := tar.NewReader(io.LimitReader(inner, maxControlTarSize))
+			tr := tar.NewReader(inner)
 			for {
 				hd, err := tr.Next()
 				if err == io.EOF {
@@ -171,7 +168,6 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 	key := ""
 	var depends strings.Builder
 	var control strings.Builder
-	var description strings.Builder

 	// https://www.debian.org/doc/debian-policy/ch-controlfields.html#syntax-of-control-files
 	s := bufio.NewScanner(r)
@@ -193,13 +189,10 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 		control.WriteString(line)
 		control.WriteByte('\n')

-		// a leading space or tab marks a folded continuation line that belongs to the previous field
-		// (identified by key), not a new "Key: value" pair; only the multi-line fields append here.
-		// Continuation lines may themselves contain a colon, so they must not be re-split on ":".
 		if line[0] == ' ' || line[0] == '\t' {
 			switch key {
 			case "Description":
-				description.WriteString(line)
+				p.Metadata.Description += line
 			case "Depends":
 				depends.WriteString(trimmed)
 			}
@@ -226,8 +219,7 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 					p.Metadata.Maintainer = a.Name
 				}
 			case "Description":
-				description.Reset()
-				description.WriteString(value)
+				p.Metadata.Description = value
 			case "Depends":
 				depends.WriteString(value)
 			case "Homepage":
@@ -251,8 +243,6 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 		return nil, GlobalVars().ErrInvalidArchitecture
 	}

-	p.Metadata.Description = description.String()
-
 	dependencies := strings.Split(depends.String(), ",")
 	for i := range dependencies {
 		dependencies[i] = strings.TrimSpace(dependencies[i])
@@ -232,15 +232,3 @@ func TestValidateDistributionOrComponent(t *testing.T) {
 		assert.True(t, IsValidDistributionOrComponent(name), "good=%q", name)
 	}
 }
-
-// TestParseControlFileMultilineDescription verifies a multi-line Description is assembled in order
-// (the parser accumulates it in a strings.Builder); it guards the assembled value, not its timing.
-func TestParseControlFileMultilineDescription(t *testing.T) {
-	var buf bytes.Buffer
-	buf.WriteString("Package: testpkg\nVersion: 1.0\nArchitecture: amd64\nDescription: short summary\n more details\n even more\n")
-
-	p, err := ParseControlFile(&buf)
-	assert.NoError(t, err)
-	assert.NotNil(t, p)
-	assert.Equal(t, "short summary more details even more", p.Metadata.Description)
-}
@@ -1,37 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package packages
-
-import "gitea.dev/modules/util"
-
-// BoundedFileList accumulates file names from a package archive while enforcing caps on the number of
-// entries and their total name length, returning an error once either cap would be exceeded.
-type BoundedFileList struct {
-	files     []string
-	nameBytes int
-	maxFiles  int
-	maxBytes  int
-}
-
-// NewBoundedFileList creates a BoundedFileList with the given caps; a non-positive cap falls back to the
-// corresponding default.
-func NewBoundedFileList(maxFiles, maxNameBytes int) *BoundedFileList {
-	return &BoundedFileList{maxFiles: maxFiles, maxBytes: maxNameBytes}
-}
-
-// Add appends name, returning util.ErrInvalidArgument once the entry count or accumulated byte length
-// would exceed the configured cap.
-func (b *BoundedFileList) Add(name string) error {
-	if len(b.files) >= b.maxFiles || b.nameBytes+len(name) > b.maxBytes {
-		return util.NewInvalidArgumentErrorf("package contains too many file entries")
-	}
-	b.nameBytes += len(name)
-	b.files = append(b.files, name)
-	return nil
-}
-
-// Files returns the accumulated file names.
-func (b *BoundedFileList) Files() []string {
-	return b.files
-}
@@ -8,7 +8,6 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
-	"net/url"
 	"os"
 	"strings"
 	"sync"
@@ -54,37 +53,12 @@ func dialContextInternalAPI(ctx context.Context, network, address string) (conn
 	return conn, nil
 }

-// internalAPIConnectionIsLocal reports whether the internal API transport connects to a local target,
-// where the self-signed local certificate cannot be verified so skipping verification is safe. It mirrors
-// what dialContextInternalAPI actually dials: a unix socket whenever Protocol is HTTPUnix (always local,
-// whatever LOCAL_ROOT_URL says), otherwise the LOCAL_ROOT_URL host directly. A non-loopback LOCAL_ROOT_URL
-// is a real network hop, so its certificate must be verified, else the internal token can be MITM'd. An
-// unparseable LOCAL_ROOT_URL is a hard misconfiguration and fails closed (verify).
-func internalAPIConnectionIsLocal(protocol setting.Scheme, localURL string) bool {
-	if protocol == setting.HTTPUnix {
-		return true
-	}
-	u, err := url.Parse(localURL)
-	if err != nil {
-		return false
-	}
-	host := u.Hostname()
-	if host == "localhost" {
-		return true
-	}
-	ip := net.ParseIP(host)
-	return ip != nil && ip.IsLoopback()
-}
-
 var internalAPITransport = sync.OnceValue(func() http.RoundTripper {
 	return &http.Transport{
 		DialContext: dialContextInternalAPI,
 		TLSClientConfig: &tls.Config{
-			// Skip verification only for a local target (unix socket, or a loopback LOCAL_ROOT_URL), where the
-			// self-signed local cert can't be verified anyway; a non-loopback LOCAL_ROOT_URL is a real network
-			// hop and must be verified so the internal token can't be MITM'd. When verifying, Go's default
-			// ServerName (the dialed LOCAL_ROOT_URL host) is already correct, so it is not overridden.
-			InsecureSkipVerify: internalAPIConnectionIsLocal(setting.Protocol, setting.LocalURL),
+			InsecureSkipVerify: true,
+			ServerName:         setting.Domain,
 		},
 	}
 })
@@ -1,37 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package private
-
-import (
-	"testing"
-
-	"gitea.dev/modules/setting"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestInternalAPIConnectionIsLocal(t *testing.T) {
-	cases := []struct {
-		name     string
-		protocol setting.Scheme
-		localURL string
-		want     bool
-	}{
-		// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
-		{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
-		{"localhost", setting.HTTP, "http://localhost:3000/", true},
-		{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
-		{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
-		// a non-loopback LOCAL_ROOT_URL is a real network hop and must be verified
-		{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
-		{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
-		// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
-		{"invalid url", setting.HTTPS, "://bad", false},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			assert.Equal(t, c.want, internalAPIConnectionIsLocal(c.protocol, c.localURL))
-		})
-	}
-}
@@ -24,7 +24,7 @@ var (

 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and leads to false positives.
+	// While fast, this is also incorrect and lead to false positives.
 	// TODO: fix invalid linking issue

 	// mentionPattern matches all mentions in the form of "@user" or "@org/team"
@@ -14,8 +14,6 @@ import (

 const defaultMaxRerunAttempts = 50

-const defaultMaxConcurrentTaskPicks = 16
-
 // Actions settings
 var (
 	Actions = struct {
@@ -33,18 +31,13 @@ var (
 		WorkflowDirs          []string          `ini:"WORKFLOW_DIRS"`
 		ScopedWorkflowDirs    []string          `ini:"SCOPED_WORKFLOW_DIRS"`
 		MaxRerunAttempts      int64             `ini:"MAX_RERUN_ATTEMPTS"`
-		// MaxConcurrentTaskPicks bounds how many runners may run the task-assignment
-		// transaction at once per Gitea instance, to avoid a thundering herd when many
-		// runners poll together. It is a per-process limit, not a cluster-wide one.
-		MaxConcurrentTaskPicks int `ini:"MAX_CONCURRENT_TASK_PICKS"`
 	}{
-		Enabled:                true,
-		DefaultActionsURL:      defaultActionsURLGitHub,
-		SkipWorkflowStrings:    []string{"[skip ci]", "[ci skip]", "[no ci]", "[skip actions]", "[actions skip]"},
-		WorkflowDirs:           []string{".gitea/workflows", ".github/workflows"},
-		ScopedWorkflowDirs:     []string{".gitea/scoped_workflows"},
-		MaxRerunAttempts:       defaultMaxRerunAttempts,
-		MaxConcurrentTaskPicks: defaultMaxConcurrentTaskPicks,
+		Enabled:             true,
+		DefaultActionsURL:   defaultActionsURLGitHub,
+		SkipWorkflowStrings: []string{"[skip ci]", "[ci skip]", "[no ci]", "[skip actions]", "[actions skip]"},
+		WorkflowDirs:        []string{".gitea/workflows", ".github/workflows"},
+		ScopedWorkflowDirs:  []string{".gitea/scoped_workflows"},
+		MaxRerunAttempts:    defaultMaxRerunAttempts,
 	}
 )

@@ -135,10 +128,6 @@ func loadActionsFrom(rootCfg ConfigProvider) error {
 		Actions.MaxRerunAttempts = defaultMaxRerunAttempts
 	}

-	if Actions.MaxConcurrentTaskPicks <= 0 {
-		Actions.MaxConcurrentTaskPicks = defaultMaxConcurrentTaskPicks
-	}
-
 	if !Actions.LogCompression.IsValid() {
 		return fmt.Errorf("invalid [actions] LOG_COMPRESSION: %q", Actions.LogCompression)
 	}
@@ -22,7 +22,6 @@ const (
 const (
 	RepoPRTitleSourceFirstCommit = "first-commit"
 	RepoPRTitleSourceAuto        = "auto"
-	RepoPRTitleSourceBranchName  = "branch-name"
 )

 // ItemsPerPage maximum items per page in forks, watchers and stars of a repo
@@ -20,11 +20,9 @@ var Security = struct {
 	XContentTypeOptions string

 	ContentSecurityPolicyGeneral string // it only supports empty (default policy) or "unset", maybe it can support more in the future
-	AllowedHostList              string
 }{
 	XFrameOptions:       "SAMEORIGIN",
 	XContentTypeOptions: "nosniff",
-	AllowedHostList:     "external",
 }

 var (
@@ -10,20 +10,13 @@ import (
 )

 func TestLoadSecurityFrom(t *testing.T) {
-	assert.Equal(t, "SAMEORIGIN", Security.XFrameOptions)
-	assert.Equal(t, "nosniff", Security.XContentTypeOptions)
-	assert.Equal(t, "external", Security.AllowedHostList)
-
 	cfg, err := NewConfigProviderFromData(`[security]
 X_FRAME_OPTIONS = DENY
 X_CONTENT_TYPE_OPTIONS = unset
-ALLOWED_HOST_LIST = foo
-CONTENT_SECURITY_POLICY_GENERAL = "script-src *; foo"
-`)
+CONTENT_SECURITY_POLICY_GENERAL = "script-src *; foo"`)
 	assert.NoError(t, err)
 	loadSecurityFrom(cfg)
 	assert.Equal(t, "DENY", Security.XFrameOptions)
 	assert.Equal(t, "unset", Security.XContentTypeOptions)
-	assert.Equal(t, "foo", Security.AllowedHostList)
 	assert.Equal(t, `"script-src *`, Security.ContentSecurityPolicyGeneral) // holy shit ini package bug
 }
@@ -34,10 +34,7 @@ func loadWebhookFrom(rootCfg ConfigProvider) {
 	Webhook.QueueLength = sec.Key("QUEUE_LENGTH").MustInt(1000)
 	Webhook.DeliverTimeout = sec.Key("DELIVER_TIMEOUT").MustInt(5)
 	Webhook.SkipTLSVerify = sec.Key("SKIP_TLS_VERIFY").MustBool()
-
-	deprecatedSetting(rootCfg, "webhook", "ALLOWED_HOST_LIST", "security", "ALLOWED_HOST_LIST", "v28.0.0")
-	Webhook.AllowedHostList = sec.Key("ALLOWED_HOST_LIST").MustString(Security.AllowedHostList)
-
+	Webhook.AllowedHostList = sec.Key("ALLOWED_HOST_LIST").MustString("")
 	Webhook.Types = []string{"gitea", "gogs", "slack", "discord", "dingtalk", "telegram", "msteams", "feishu", "matrix", "wechatwork", "packagist"}
 	Webhook.PagingNum = sec.Key("PAGING_NUM").MustInt(10)
 	Webhook.ProxyURL = sec.Key("PROXY_URL").MustString("")
@@ -73,18 +73,17 @@ func TestInitKeys(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, keyFiles, len(keyTypes))

-	// Record file contents so regeneration can be detected
-	content := map[string][]byte{}
+	metadata := map[string]os.FileInfo{}
 	for _, keyType := range keyTypes {
 		privKeyPath := filepath.Join(tempDir, "gitea."+keyType)
 		pubKeyPath := filepath.Join(tempDir, "gitea."+keyType+".pub")
-		data, err := os.ReadFile(privKeyPath)
+		info, err := os.Stat(privKeyPath)
 		require.NoError(t, err)
-		content[privKeyPath] = data
+		metadata[privKeyPath] = info

-		data, err = os.ReadFile(pubKeyPath)
+		info, err = os.Stat(pubKeyPath)
 		require.NoError(t, err)
-		content[pubKeyPath] = data
+		metadata[pubKeyPath] = info
 	}

 	// Test recreation on missing private key and noop for missing pub key
@@ -99,26 +98,26 @@ func TestInitKeys(t *testing.T) {
 		privKeyPath := filepath.Join(tempDir, "gitea."+keyType)
 		pubKeyPath := filepath.Join(tempDir, "gitea."+keyType+".pub")

-		dataPriv, err := os.ReadFile(privKeyPath)
+		infoPriv, err := os.Stat(privKeyPath)
 		require.NoError(t, err)

 		switch keyType {
 		case "rsa":
 			// No modification to RSA key
-			dataPub, err := os.ReadFile(pubKeyPath)
+			infoPub, err := os.Stat(pubKeyPath)
 			require.NoError(t, err)
-			assert.Equal(t, content[privKeyPath], dataPriv)
-			assert.Equal(t, content[pubKeyPath], dataPub)
+			assert.Equal(t, metadata[privKeyPath], infoPriv)
+			assert.Equal(t, metadata[pubKeyPath], infoPub)
 		case "ecdsa":
 			// ECDSA public key should be missing, private unchanged
-			assert.Equal(t, content[privKeyPath], dataPriv)
+			assert.Equal(t, metadata[privKeyPath], infoPriv)
 			assert.NoFileExists(t, pubKeyPath)
 		case "ed25519":
 			// ed25519 private key was removed, so both keys regenerated
-			dataPub, err := os.ReadFile(pubKeyPath)
+			infoPub, err := os.Stat(pubKeyPath)
 			require.NoError(t, err)
-			assert.NotEqual(t, content[privKeyPath], dataPriv)
-			assert.NotEqual(t, content[pubKeyPath], dataPub)
+			assert.NotEqual(t, metadata[privKeyPath], infoPriv)
+			assert.NotEqual(t, metadata[pubKeyPath], infoPub)
 		}
 	}
 }
@@ -6,7 +6,6 @@ package storage
 import (
 	"context"
 	"crypto/tls"
-	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -48,42 +47,40 @@ type MinioStorage struct {
 	basePath string
 }

-func convertMinioErr(err error, optMsg ...string) error {
+func convertMinioErr(err error) error {
 	if err == nil {
 		return nil
 	}
-
-	wrapErr := func(err error) error {
-		if len(optMsg) == 0 {
-			return err
-		}
-		return fmt.Errorf("%s: %w", optMsg[0], err)
-	}
-
-	errResp, ok := errors.AsType[minio.ErrorResponse](err)
+	errResp, ok := err.(minio.ErrorResponse)
 	if !ok {
-		return wrapErr(err)
+		return err
 	}

 	// Convert two responses to standard analogues
 	switch errResp.Code {
 	case "NoSuchKey":
-		return wrapErr(os.ErrNotExist)
+		return os.ErrNotExist
 	case "AccessDenied":
-		return wrapErr(os.ErrPermission)
+		return os.ErrPermission
 	}

-	return wrapErr(err)
+	return err
+}
+
+var getBucketVersioning = func(ctx context.Context, minioClient *minio.Client, bucket string) error {
+	_, err := minioClient.GetBucketVersioning(ctx, bucket)
+	return err
 }

 // NewMinioStorage returns a minio storage
 func NewMinioStorage(ctx context.Context, cfg *setting.Storage) (ObjectStorage, error) {
 	config := cfg.MinioConfig
-	log.Info("Creating minio storage at %s:%s with base path %s", config.Endpoint, config.Bucket, config.BasePath)
 	if config.ChecksumAlgorithm != "" && config.ChecksumAlgorithm != "default" && config.ChecksumAlgorithm != "md5" {
 		return nil, fmt.Errorf("invalid minio checksum algorithm: %s", config.ChecksumAlgorithm)
 	}

+	log.Info("Creating Minio storage at %s:%s with base path %s", config.Endpoint, config.Bucket, config.BasePath)
+
 	var lookup minio.BucketLookupType
 	switch config.BucketLookUpType {
 	case "auto", "":
@@ -96,13 +93,6 @@ func NewMinioStorage(ctx context.Context, cfg *setting.Storage) (ObjectStorage,
 		return nil, fmt.Errorf("invalid minio bucket lookup type: %s", config.BucketLookUpType)
 	}

-	// The request error message is something like:
-	// * "The request signature we calculated does not match the signature you provided. Check your key and signing method."
-	// It doesn't contain useful information to site admin, so here we wrap the error with our error message
-	// to tell the site admin what is the problem.
-	makeErrMsg := func(hint string) string {
-		return fmt.Sprintf("ObjectStorage.%s: endpoint=%s, location=%s, bucket=%s", hint, config.Endpoint, config.Location, config.Bucket)
-	}
 	minioClient, err := minio.New(config.Endpoint, &minio.Options{
 		Creds:        buildMinioCredentials(config),
 		Secure:       config.UseSSL,
@@ -111,21 +101,37 @@ func NewMinioStorage(ctx context.Context, cfg *setting.Storage) (ObjectStorage,
 		BucketLookup: lookup,
 	})
 	if err != nil {
-		return nil, convertMinioErr(err, makeErrMsg("NewClient"))
+		return nil, convertMinioErr(err)
+	}
+
+	// The GetBucketVersioning is only used for checking whether the Object Storage parameters are generally good. It doesn't need to succeed.
+	// The assumption is that if the API returns the HTTP code 400, then the parameters could be incorrect.
+	// Otherwise even if the request itself fails (403, 404, etc), the code should still continue because the parameters seem "good" enough.
+	// Keep in mind that GetBucketVersioning requires "owner" to really succeed, so it can't be used to check the existence.
+	// Not using "BucketExists (HeadBucket)" because it doesn't include detailed failure reasons.
+	err = getBucketVersioning(ctx, minioClient, config.Bucket)
+	if err != nil {
+		errResp, ok := err.(minio.ErrorResponse)
+		if !ok {
+			return nil, err
+		}
+		if errResp.StatusCode == http.StatusBadRequest {
+			log.Error("S3 storage connection failure at %s:%s with base path %s and region: %s", config.Endpoint, config.Bucket, config.Location, errResp.Message)
+			return nil, err
+		}
 	}

 	// Check to see if we already own this bucket
 	exists, err := minioClient.BucketExists(ctx, config.Bucket)
 	if err != nil {
-		return nil, convertMinioErr(err, makeErrMsg("BucketExists"))
+		return nil, convertMinioErr(err)
 	}

-	// If the bucket doesn't exist, try to create one
 	if !exists {
 		if err := minioClient.MakeBucket(ctx, config.Bucket, minio.MakeBucketOptions{
 			Region: config.Location,
 		}); err != nil {
-			return nil, convertMinioErr(err, makeErrMsg("MakeBucket"))
+			return nil, convertMinioErr(err)
 		}
 	}

@@ -4,13 +4,16 @@
 package storage

 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"

 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"

+	"github.com/minio/minio-go/v7"
 	"github.com/stretchr/testify/assert"
 )

@@ -81,18 +84,31 @@ func TestMinioStoragePath(t *testing.T) {
 }

 func TestS3StorageBadRequest(t *testing.T) {
-	endpoint := test.ExternalServiceHTTP(t, "TEST_MINIO_ENDPOINT", "minio:9000")
+	if os.Getenv("CI") == "" {
+		t.Skip("S3Storage not present outside of CI")
+		return
+	}
 	cfg := &setting.Storage{
 		MinioConfig: setting.MinioStorageConfig{
-			Endpoint:        endpoint,
+			Endpoint:        "minio:9000",
 			AccessKeyID:     "123456",
-			SecretAccessKey: "invalid-secret",
+			SecretAccessKey: "12345678",
 			Bucket:          "bucket",
 			Location:        "us-east-1",
 		},
 	}
+	message := "ERROR"
+	old := getBucketVersioning
+	defer func() { getBucketVersioning = old }()
+	getBucketVersioning = func(ctx context.Context, minioClient *minio.Client, bucket string) error {
+		return minio.ErrorResponse{
+			StatusCode: http.StatusBadRequest,
+			Code:       "FixtureError",
+			Message:    message,
+		}
+	}
 	_, err := NewStorage(setting.MinioStorageType, cfg)
-	assert.ErrorContains(t, err, "ObjectStorage.BucketExists: endpoint="+endpoint)
+	assert.ErrorContains(t, err, message)
 }

 func TestMinioCredentials(t *testing.T) {
@@ -19,6 +19,7 @@ type CreateUserOption struct {
 	// The full display name of the user
 	FullName string `json:"full_name" binding:"MaxSize(100)"`
 	// required: true
+	// swagger:strfmt email
 	Email string `json:"email" binding:"Required;Email;MaxSize(254)"`
 	// The plain text password for the user
 	Password string `json:"password" binding:"MaxSize(255)"`
@@ -133,6 +133,7 @@ type IssueAssigneesOption struct {
 // EditDeadlineOption options for creating a deadline
 type EditDeadlineOption struct {
 	// required:true
+	// swagger:strfmt date-time
 	Deadline *time.Time `json:"due_date"`
 }

@@ -68,7 +68,7 @@ const (
 type NotifySubjectType string

 const (
-	// NotifySubjectIssue an issue is subject of a notification
+	// NotifySubjectIssue a issue is subject of an notification
 	NotifySubjectIssue NotifySubjectType = "Issue"
 	// NotifySubjectPull a pull is subject of an notification
 	NotifySubjectPull NotifySubjectType = "Pull"
@@ -54,10 +54,10 @@ type CreateTeamOption struct {
 	// Whether the team has access to all repositories in the organization
 	IncludesAllRepositories bool                `json:"includes_all_repositories"`
 	Permission              RepoWritePermission `json:"permission"`
-	// example: ["repo.actions","repo.packages","repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"]
+	// example: ["repo.actions","repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.ext_wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"]
 	// Deprecated: This variable should be replaced by UnitsMap and will be dropped in later versions.
 	Units []string `json:"units"`
-	// example: {"repo.actions":"read","repo.packages":"read","repo.code":"read","repo.issues":"write","repo.ext_issues":"none","repo.wiki":"admin","repo.pulls":"owner","repo.releases":"none","repo.projects":"none","repo.ext_wiki":"none"}
+	// example: {"repo.actions","repo.packages","repo.code":"read","repo.issues":"write","repo.ext_issues":"none","repo.wiki":"admin","repo.pulls":"owner","repo.releases":"none","repo.projects":"none","repo.ext_wiki":"none"}
 	UnitsMap map[string]string `json:"units_map"`
 	// Whether the team can create repositories in the organization
 	CanCreateOrgRepo bool `json:"can_create_org_repo"`
@@ -92,12 +92,9 @@ func TestTemplateEscape(t *testing.T) {
 	}

 	t.Run("Golang URL Escape", func(t *testing.T) {
-		// HINT: GOLANG-HTML-TEMPLATE-URL-ESCAPING: demo cases (html/template/attr.go):
-		// Golang template considers "href", "data-href", "*src*", "*uri*", "*url*" (and more) ... attributes as contentTypeURL and does auto-escaping
+		// Golang template considers "href", "*src*", "*uri*", "*url*" (and more) ... attributes as contentTypeURL and does auto-escaping
 		actual := execTmpl(`<a href="?a={{"%"}}"></a>`)
 		assert.Equal(t, `<a href="?a=%25"></a>`, actual)
-		actual = execTmpl(`<a data-href="?a={{"%"}}"></a>`)
-		assert.Equal(t, `<a data-href="?a=%25"></a>`, actual)
 		actual = execTmpl(`<a data-xxx-url="?a={{"%"}}"></a>`)
 		assert.Equal(t, `<a data-xxx-url="?a=%25"></a>`, actual)
 	})
@@ -105,10 +102,6 @@ func TestTemplateEscape(t *testing.T) {
 		// non-URL content isn't auto-escaped
 		actual := execTmpl(`<a data-link="?a={{"%"}}"></a>`)
 		assert.Equal(t, `<a data-link="?a=%"></a>`, actual)
-		// the attr names like "data-href" and "data-action" are treated as URL (as the "data-" prefix is stripped)
-		// but "data-xxx-href" and "data-xxx-action" are not, so no escaping.
-		actual = execTmpl(`<a data-xxx-href="?a={{"%"}}"></a>`)
-		assert.Equal(t, `<a data-xxx-href="?a=%"></a>`, actual)
 	})
 	t.Run("QueryBuild", func(t *testing.T) {
 		actual := execTmpl(`<a href="{{QueryBuild "?" "a" "%"}}"></a>`)
@@ -12,20 +12,9 @@ import (
 	"strings"

 	"gitea.dev/modules/json"
-	"gitea.dev/modules/proxy"
 	"gitea.dev/modules/setting"
-	"gitea.dev/modules/util"
 )

-// httpClient returns an HTTP client that honors Gitea's proxy configuration.
-var httpClient = util.OnceValue[*http.Client]{
-	Func: func() *http.Client {
-		transport := http.DefaultTransport.(*http.Transport).Clone()
-		transport.Proxy = proxy.Proxy()
-		return &http.Client{Transport: transport}
-	},
-}
-
 // Response is the structure of JSON returned from API
 type Response struct {
 	Success     bool        `json:"success"`
@@ -51,7 +40,7 @@ func Verify(ctx context.Context, response string) (bool, error) {
 	}
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

-	resp, err := httpClient.Value().Do(req)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return false, fmt.Errorf("Failed to send CAPTCHA response: %w", err)
 	}
@@ -1,38 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package turnstile
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"testing"
-
-	"gitea.dev/modules/setting"
-	"gitea.dev/modules/test"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestHTTPClientHonorsProxy(t *testing.T) {
-	proxyURL, err := url.Parse("http://proxy.example.com:3128")
-	require.NoError(t, err)
-
-	defer test.MockVariableValue(&setting.Proxy.Enabled, true)()
-	defer test.MockVariableValue(&setting.Proxy.ProxyURL, proxyURL.String())()
-	defer test.MockVariableValue(&setting.Proxy.ProxyURLFixed, proxyURL)()
-	defer test.MockVariableValue(&setting.Proxy.ProxyHosts, []string{"**"})()
-	httpClient.Reset()
-	transport, ok := httpClient.Value().Transport.(*http.Transport)
-	require.True(t, ok)
-	require.NotNil(t, transport.Proxy)
-
-	// The Turnstile verification request must be routed through the configured proxy.
-	req := httptest.NewRequest(http.MethodPost, "https://any.example.com", nil)
-	got, err := transport.Proxy(req)
-	require.NoError(t, err)
-	require.NotNil(t, got)
-	assert.Equal(t, proxyURL.String(), got.String())
-}
@@ -23,21 +23,13 @@ func (e ErrURISchemeNotSupported) Error() string {

 // Open open a local file or a remote file
 func Open(uriStr string) (io.ReadCloser, error) {
-	return OpenWithClient(uriStr, http.DefaultClient)
-}
-
-// OpenWithClient opens a local file or a remote file, using the given (non-nil) HTTP client
-// for http/https URLs. Callers that must confine remote access (e.g. to defeat SSRF via
-// redirects) should pass a client whose transport validates the peer at dial time; Open
-// passes http.DefaultClient.
-func OpenWithClient(uriStr string, client *http.Client) (io.ReadCloser, error) {
 	u, err := url.Parse(uriStr)
 	if err != nil {
 		return nil, err
 	}
 	switch strings.ToLower(u.Scheme) {
 	case "http", "https":
-		f, err := client.Get(uriStr)
+		f, err := http.Get(uriStr)
 		if err != nil {
 			return nil, err
 		}
@@ -4,18 +4,10 @@
 package uri

 import (
-	"context"
-	"errors"
-	"net"
-	"net/http"
-	"net/http/httptest"
 	"path/filepath"
-	"strings"
-	"sync/atomic"
 	"testing"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestReadURI(t *testing.T) {
@@ -25,45 +17,3 @@ func TestReadURI(t *testing.T) {
 	assert.NoError(t, err)
 	defer f.Close()
 }
-
-// TestOpenWithClientValidatesRedirectTarget verifies OpenWithClient routes the
-// whole request chain (including redirects) through the provided client, so a
-// client whose transport refuses to dial an internal target blocks a redirect to
-// it — whereas the default client (old Open behavior) follows it.
-func TestOpenWithClientValidatesRedirectTarget(t *testing.T) {
-	var internalHit atomic.Bool
-	internal := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		internalHit.Store(true)
-		_, _ = w.Write([]byte("secret"))
-	}))
-	defer internal.Close()
-
-	front := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Redirect(w, r, internal.URL, http.StatusFound)
-	}))
-	defer front.Close()
-
-	internalAddr := strings.TrimPrefix(internal.URL, "http://")
-
-	// a client that refuses to dial the internal target, mimicking the migration
-	// hostmatcher dialer that re-validates every hop
-	blockingClient := &http.Client{Transport: &http.Transport{
-		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
-			if addr == internalAddr {
-				return nil, errors.New("blocked internal address")
-			}
-			return (&net.Dialer{}).DialContext(ctx, network, addr)
-		},
-	}}
-
-	_, err := OpenWithClient(front.URL, blockingClient)
-	require.Error(t, err)
-	assert.False(t, internalHit.Load(), "the redirect target must not be reached through the validating client")
-
-	// the default client (the previous behavior) follows the redirect to the internal target
-	internalHit.Store(false)
-	rc, err := Open(front.URL)
-	require.NoError(t, err)
-	_ = rc.Close()
-	assert.True(t, internalHit.Load(), "sanity check: the default client follows the redirect")
-}
@@ -1,51 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package util
-
-import (
-	"sync"
-	"sync/atomic"
-)
-
-type onceValueResult[T any] struct {
-	value T
-	panic any
-}
-
-// OnceValue is similar to Golang's "sync.OnceValue", but can be reset.
-type OnceValue[T any] struct {
-	Func func() T
-	mu   sync.Mutex
-	res  atomic.Pointer[onceValueResult[T]]
-}
-
-func (o *OnceValue[T]) Value() T {
-	res := o.res.Load()
-	if res == nil {
-		o.mu.Lock()
-		defer o.mu.Unlock()
-		res = o.res.Load()
-		if res == nil {
-			res = &onceValueResult[T]{}
-			defer func() {
-				res.panic = recover()
-				o.res.Store(res)
-				if res.panic != nil {
-					panic(res.panic)
-				}
-			}()
-			res.value = o.Func()
-		}
-	}
-	if res.panic != nil {
-		panic(res.panic)
-	}
-	return res.value
-}
-
-func (o *OnceValue[T]) Reset() {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	o.res.Store(nil)
-}
@@ -1,49 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package util
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestOnceValue(t *testing.T) {
-	t.Run("RepeatCall", func(t *testing.T) {
-		callCount := 0
-		o := OnceValue[int]{Func: func() int {
-			callCount++
-			return 42
-		}}
-		assert.Equal(t, 42, o.Value())
-		assert.Equal(t, 42, o.Value())
-		assert.Equal(t, 1, callCount)
-		o.Reset()
-		assert.Equal(t, 42, o.Value())
-		assert.Equal(t, 2, callCount)
-		assert.Equal(t, 42, o.Value())
-		assert.Equal(t, 2, callCount)
-	})
-
-	t.Run("Panic", func(t *testing.T) {
-		callCount := 0
-		doPanic := true
-		o := OnceValue[int]{Func: func() int {
-			callCount++
-			if doPanic {
-				panic("some error")
-			}
-			return 42
-		}}
-		assert.PanicsWithValue(t, "some error", func() { o.Value() })
-		assert.PanicsWithValue(t, "some error", func() { o.Value() })
-		assert.Equal(t, 1, callCount)
-		doPanic = false
-		o.Reset()
-		assert.Equal(t, 42, o.Value())
-		assert.Equal(t, 2, callCount)
-		assert.Equal(t, 42, o.Value())
-		assert.Equal(t, 2, callCount)
-	})
-}
@@ -40,7 +40,6 @@ var timeStrGlobalVars = sync.OnceValue(func() *timeStrGlobalVarsType {
 })

 func TimeEstimateParse(timeStr string) (int64, error) {
-	timeStr = strings.TrimSpace(timeStr)
 	if timeStr == "" {
 		return 0, nil
 	}
@@ -52,13 +51,7 @@ func TimeEstimateParse(timeStr string) (int64, error) {
 	if matches[0][0] != 0 || matches[len(matches)-1][1] != len(timeStr) {
 		return 0, fmt.Errorf("invalid time string: %s", timeStr)
 	}
-	prevEnd := 0
 	for _, match := range matches {
-		// only whitespace may separate two units, otherwise the string contains invalid content like "1h x 2m"
-		if strings.TrimSpace(timeStr[prevEnd:match[0]]) != "" {
-			return 0, fmt.Errorf("invalid time string: %s", timeStr)
-		}
-		prevEnd = match[1]
 		amount, err := strconv.ParseInt(timeStr[match[2]:match[3]], 10, 64)
 		if err != nil {
 			return 0, fmt.Errorf("invalid time string: %v", err)
@@ -22,9 +22,6 @@ func TestTimeStr(t *testing.T) {
 			{"1s", 1, false},
 			{"1h 1m 1s", 3600 + 60 + 1, false},
 			{"1d1x", 0, true},
-			{"1h 2x 3m", 0, true},
-			{"1h_2m", 0, true},
-			{"1h,1m", 0, true},
 		}
 		for _, test := range tests {
 			t.Run(test.input, func(t *testing.T) {
@@ -12,24 +12,6 @@ import (
 	"golang.org/x/text/language"
 )

-// maxAcceptLanguageLen bounds the Accept-Language header before it reaches
-// language.ParseAcceptLanguage. That parser has quadratic-time behavior on long
-// malformed inputs, and its built-in guard only counts "-" separators while the
-// scanner treats "_" as an alias for "-", so a "_"-heavy header slips past the
-// guard and burns CPU. Only the leading (highest-priority) languages are used, so
-// truncating a longer header is safe.
-const maxAcceptLanguageLen = 200
-
-// parseAcceptLanguage parses the Accept-Language header after bounding its length
-// to avoid a quadratic-time DoS on attacker-controlled input.
-func parseAcceptLanguage(header string) []language.Tag {
-	if len(header) > maxAcceptLanguageLen {
-		header = header[:maxAcceptLanguageLen]
-	}
-	tags, _, _ := language.ParseAcceptLanguage(header)
-	return tags
-}
-
 // Locale handle locale
 func Locale(resp http.ResponseWriter, req *http.Request) translation.Locale {
 	// 1. Check URL arguments.
@@ -53,7 +35,7 @@ func Locale(resp http.ResponseWriter, req *http.Request) translation.Locale {
 	// 3. Get language information from 'Accept-Language'.
 	// The first element in the list is chosen to be the default language automatically.
 	if len(lang) == 0 {
-		tags := parseAcceptLanguage(req.Header.Get("Accept-Language"))
+		tags, _, _ := language.ParseAcceptLanguage(req.Header.Get("Accept-Language"))
 		tag := translation.Match(tags...)
 		lang = tag.String()
 	}
@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package middleware
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestParseAcceptLanguage(t *testing.T) {
-	// a normal header is parsed and its leading language preserved
-	tags := parseAcceptLanguage("de-DE,de;q=0.9,en;q=0.8")
-	assert.NotEmpty(t, tags)
-	assert.Equal(t, "de-DE", tags[0].String())
-
-	// an oversized "_"-separated header would drive ParseAcceptLanguage into its
-	// quadratic-time path (the built-in guard only counts "-"); the length bound
-	// keeps the input passed to the parser small so it cannot be used for a DoS.
-	malicious := strings.Repeat("_aaaaaaaaa", 1<<16) // ~640 KiB, zero "-" characters
-	assert.Greater(t, len(malicious), maxAcceptLanguageLen)
-	tags = parseAcceptLanguage(malicious)
-	// no panic / hang, and nothing meaningful is parsed out of the garbage
-	assert.Empty(t, tags)
-}
--- a/Show More
+++ b/Show More