fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] (#38623)

- enable `skip-initialism-name-checks`, so names like `sessionUid` are
allowed
- replace removed `skip-package-name-checks` option with new
`package-naming` with fitting rules for gitea
- drop dead exclusion paths

.golangci.yml

@@ -87,6 +87,11 @@ linters:
         - name: increment-decrement
         - name: modifies-value-receiver
         - name: package-comments
+        - name: package-naming
+          arguments:
+            - convention-name-check-regex: '^[a-z][a-z0-9_]*$' # underscores are used by migration packages
+              skip-default-bad-name-check: true
+              skip-collision-with-common-std: true
         - name: redefines-builtin-id
         - name: superfluous-else
         - name: time-naming
@@ -96,7 +101,7 @@ linters:
           arguments:
             - [] # AllowList - do not remove as args for the rule are positional and won't work without lists first
             - [] # DenyList
-            - - skip-package-name-checks: true # supress errors from underscore in migration packages
+            - - skip-initialism-name-checks: true
     staticcheck:
       checks:
         - all
@@ -158,9 +163,6 @@ linters:
       - .venv
       - public
       - web_src
-      - third_party$
-      - builtin$
-      - examples$
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0

assets/codemirror-languages.json

@@ -453,6 +453,7 @@
       ".htmlhintrc",
       ".imgbotconfig",
       ".nycrc",
+      ".secrets.baseline",
       ".tern-config",
       ".tern-project",
       ".watchmanconfig",

go.mod

@@ -43,7 +43,7 @@ require (
 	github.com/ethantkoenig/rupture v1.0.1
 	github.com/felixge/fgprof v0.9.5
 	github.com/fsnotify/fsnotify v1.10.1
-	github.com/getkin/kin-openapi v0.142.0
+	github.com/getkin/kin-openapi v0.144.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/go-chi/cors v1.2.2

go.sum

@@ -272,8 +272,8 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
 github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/getkin/kin-openapi v0.142.0 h1:izj0vBdFprMhitfzaX8sTqztsEQyvwhssBoB6n8NO7w=
-github.com/getkin/kin-openapi v0.142.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
+github.com/getkin/kin-openapi v0.144.0 h1:hIRcTH+KjLfkLpYU6bSSfdFpi0fZi1fp+hSPi4aQu9Y=
+github.com/getkin/kin-openapi v0.144.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 h1:mtDjlmloH7ytdblogrMz1/8Hqua1y8B4ID+bh3rvod0=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1/go.mod h1:fenKRzpXDjNpsIBhuhUzvjCKlDjKam0boRAenTE0Q6A=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

modules/templates/util_json.go

@@ -9,11 +9,11 @@ import (
 	"gitea.dev/modules/json"
 )
 
-type JsonUtils struct{} //nolint:revive // variable naming triggers on Json, wants JSON
+type JsonUtils struct{}
 
 var jsonUtils = JsonUtils{}
 
-func NewJsonUtils() *JsonUtils { //nolint:revive // variable naming triggers on Json, wants JSON
+func NewJsonUtils() *JsonUtils {
 	return &jsonUtils
 }
 

modules/templates/util_render.go

@@ -186,7 +186,7 @@ func reactionToEmoji(reaction string) template.HTML {
 	return template.HTML(fmt.Sprintf(`<img alt=":%s:" src="%s/assets/img/emoji/%s.png"></img>`, reaction, setting.StaticURLPrefix, url.PathEscape(reaction)))
 }
 
-func (ut *RenderUtils) MarkdownToHtml(input string) template.HTML { //nolint:revive // variable naming triggers on Html, wants HTML
+func (ut *RenderUtils) MarkdownToHtml(input string) template.HTML {
 	output, err := markdown.RenderString(markup.NewRenderContext(ut.ctx).WithMetas(markup.ComposeSimpleDocumentMetas()), input)
 	if err != nil {
 		log.Error("RenderString: %v", err)

modules/util/string.go

@@ -120,7 +120,7 @@ func asciiLower(b byte) byte {
 
 // AsciiEqualFold is from Golang https://cs.opensource.google/go/go/+/refs/tags/go1.24.4:src/net/http/internal/ascii/print.go
 // ASCII only. In most cases for protocols, we should only use this but not [strings.EqualFold]
-func AsciiEqualFold(s, t string) bool { //nolint:revive // PascalCase
+func AsciiEqualFold(s, t string) bool {
 	if len(s) != len(t) {
 		return false
 	}

package.json

@@ -50,7 +50,7 @@
     "esbuild": "0.28.1",
     "idiomorph": "0.7.4",
     "jquery": "4.0.0",
-    "js-yaml": "5.2.1",
+    "js-yaml": "5.2.2",
     "katex": "0.17.0",
     "mermaid": "11.16.0",
     "online-3d-viewer": "0.18.0",

pnpm-lock.yaml

@@ -141,8 +141,8 @@ importers:
         specifier: 4.0.0
         version: 4.0.0
       js-yaml:
-        specifier: 5.2.1
-        version: 5.2.1
+        specifier: 5.2.2
+        version: 5.2.2
       katex:
         specifier: 0.17.0
         version: 0.17.0
@@ -3027,8 +3027,8 @@ packages:
     resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
     hasBin: true
 
-  js-yaml@5.2.1:
-    resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==}
+  js-yaml@5.2.2:
+    resolution: {integrity: sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==}
     hasBin: true
 
   jsdoc-type-pratt-parser@7.2.0:
@@ -7506,7 +7506,7 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  js-yaml@5.2.1:
+  js-yaml@5.2.2:
     dependencies:
       argparse: 2.0.1
 
@@ -7689,7 +7689,7 @@ snapshots:
       commander: 15.0.0
       deep-extend: 0.6.0
       ignore: 7.0.6
-      js-yaml: 5.2.1
+      js-yaml: 5.2.2
       jsonc-parser: 3.3.1
       jsonpointer: 5.0.1
       markdown-it: 14.3.0

tools/ci-tools.ts

@@ -37,6 +37,7 @@ const typeLabels: Partial<Record<CommitType, string>> = {
   fix: 'type/bug',
   docs: 'type/docs',
   test: 'type/testing',
+  refactor: 'type/refactoring',
 };
 
 // Non-type labels, removed only when the previous title implied them.