docs: Changelog for 1.27.0-rc0 (#38247 )

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2026-08-29 09:09:39 +09:00 · 2026-06-29 21:06:07 +02:00
1839 changed files with 19906 additions and 43795 deletions
@@ -11,7 +11,7 @@ include_file = ["main.go"]
 include_dir = ["cmd", "models", "modules", "options", "routers", "services"]
 exclude_dir = [
  "models/fixtures",
-  "modelmigration/fixtures",
+  "models/migrations/fixtures",
  "modules/avatar/identicon/testdata",
  "modules/avatar/testdata",
  "modules/git/tests",
@@ -18,10 +18,13 @@ indent_style = tab
 [templates/custom/*.tmpl]
 insert_final_newline = false

-[templates/swagger/*.generated.json]
+[templates/swagger/*_json.tmpl]
 indent_style = space
 insert_final_newline = false

+[templates/user/auth/oidc_wellknown.tmpl]
+indent_style = space
+
 [templates/shared/actions/runner_badge_*.tmpl]
 # editconfig lint requires these XML-like files to have charset defined, but the files don't have.
 charset = unset
@@ -3,7 +3,8 @@
 *.pb.go linguist-generated
 /assets/*.json linguist-generated
 /public/assets/img/svg/*.svg linguist-generated
-/templates/swagger/*.generated.json linguist-generated
+/templates/swagger/v1_json.tmpl linguist-generated
+/templates/swagger/v1_openapi3_json.tmpl linguist-generated
 /options/fileicon/** linguist-generated
 /vendor/** -text -eol linguist-vendored
 /web_src/js/vendor/** -text -eol linguist-vendored
@@ -9,10 +9,10 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
    - name: Build regular image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -20,7 +20,7 @@ runs:
        file: Dockerfile
        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
    - name: Build rootless image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -7,11 +7,6 @@ runs:
  steps:
    - shell: bash
      run: |
-        avail=$(df --output=avail -BG / | tr -dc '0-9')
-        if [ "$avail" -ge 50 ]; then
-          echo "skipping cleanup, ${avail}G free"
-          exit 0
-        fi
        echo "free space before cleanup:"
        df -h /
        for dir in /usr/local/lib/android /usr/local/.ghcup /opt/ghc /usr/share/dotnet; do
@@ -2,18 +2,12 @@ name: go-caches
 description: Restore the go module, build, and golangci-lint caches. Save only on the cache-seeder workflow.

 # Only the cache-seeder workflow saves; rename requires updating cache-seeder.yml.
-# The lint job restores but does not save the gobuild and gomod caches, so every key
-# has a single writer and there is no contention on it.
+# The lint job restores but does not save the gobuild cache, so only one writer
+# (the gobuild job) populates it and there is no contention on the cache key.
 # Seeder restores by exact key only (no restore-keys) so each go.sum seeds a clean
 # cache and size stays bounded; do not add restore-keys here. PR runs keep them.
-# The go version is part of the gobuild and golint keys because a toolchain bump
-# invalidates every entry in them, so a cross-version fallback would restore
-# gigabytes that no build can use. The module cache is version-independent.

 inputs:
-  go-version:
-    description: Go version the build caches belong to
-    required: true
  lint-cache:
    description: Restore (and save in cache-seeder) ~/.cache/golangci-lint
    default: "false"
@@ -21,36 +15,36 @@ inputs:
 runs:
  using: composite
  steps:
-    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    - if: ${{ github.workflow == 'cache-seeder' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    - if: ${{ github.workflow != 'cache-seeder' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/go-build
-        key: gobuild-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum') }}
+        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/go-build
-        key: gobuild-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum') }}
-        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-
+        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/golangci-lint
-        key: golint-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/golangci-lint
-        key: golint-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
-        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}
@@ -13,8 +13,7 @@ runs:
  using: composite
  steps:
    - uses: ./.github/actions/free-disk-space
-    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-      id: setup-go
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
      with:
        go-version-file: go.mod
        check-latest: true
@@ -22,5 +21,4 @@ runs:
    - if: ${{ inputs.cache == 'true' }}
      uses: ./.github/actions/go-cache
      with:
-        go-version: ${{ steps.setup-go.outputs.go-version }}
        lint-cache: ${{ inputs.lint-cache }}
@@ -9,14 +9,14 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
    - if: ${{ inputs.cache == 'true' }}
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 26
+        node-version: 24
        cache: pnpm
        cache-dependency-path: pnpm-lock.yaml
    - if: ${{ inputs.cache != 'true' }}
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 26
+        node-version: 24
@@ -1,38 +0,0 @@
-name: cache-prune
-
-# Keeps the repository's total cache size below a fixed limit, so that GitHub never
-# rejects a save for being over the allowance.
-
-on:
-  schedule:
-    - cron: "37 2 * * *" # every day at 02:37 UTC
-  workflow_dispatch:
-  workflow_call:
-
-permissions: {}
-
-concurrency:
-  group: cache-prune
-
-jobs:
-  prune:
-    runs-on: ubuntu-latest
-    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      actions: write # to delete caches
-    env:
-      GH_TOKEN: ${{ github.token }}
-      GH_REPO: ${{ github.repository }}
-    steps:
-      # Deletes least recently used first, the order GitHub itself evicts in, which takes
-      # superseded generations first as those stop being restored once a newer one exists.
-      - name: delete caches over the size limit
-        run: |
-          caches=$(gh cache list --limit 1000 --sort last_accessed_at --order asc --json id,key,sizeInBytes)
-          size=$(jq '[.[].sizeInBytes] | add // 0' <<< "$caches")
-          echo "cache usage: $((size / 1000000)) MB"
-          while [ "$size" -gt 6500000000 ] && read -r id bytes key; do
-            echo "deleting $key"
-            gh cache delete "$id"
-            size=$((size - bytes))
-          done <<< "$(jq -r '.[] | "\(.id) \(.sizeInBytes) \(.key)"' <<< "$caches")"
@@ -8,12 +8,10 @@
 name: cache-seeder

 on:
-  workflow_dispatch:
  push:
    branches:
      - main
    paths:
-      - "go.mod" # a toolchain bump invalidates the build caches
      - "go.sum"
      - ".golangci.yml"
      - ".github/actions/go-cache/action.yml"
@@ -31,7 +29,7 @@ jobs:
  gobuild:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: TAGS="bindata" make backend
@@ -61,7 +59,7 @@ jobs:
        include:
          - { tags: "bindata", target: "lint-backend" }
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
        with:
          lint-cache: "true"
@@ -69,14 +67,6 @@ jobs:
      - run: make generate-go
        env:
          TAGS: ${{ matrix.tags }}
-      - run: make "$TARGET"
+      - run: make ${{ matrix.target }}
        env:
          TAGS: ${{ matrix.tags }}
-          TARGET: ${{ matrix.target }}
-
-  # reclaims the caches this run superseded, so the next save still fits in the allowance
-  prune:
-    needs: [gobuild, lint]
-    permissions:
-      actions: write
-    uses: ./.github/workflows/cache-prune.yml
@@ -5,8 +5,6 @@ on:
  #   - cron: "7 0 * * 1" # every Monday at 00:07 UTC
  workflow_dispatch:

-permissions: {}
-
 jobs:
  cron-licenses:
    runs-on: ubuntu-latest
@@ -14,12 +12,11 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
      - run: make generate-gitignore
        timeout-minutes: 40
      - name: push translations to repo
@@ -20,13 +20,13 @@ jobs:
    if: github.repository == 'go-gitea/gitea' # prevent running on forks
    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: renovatebot/github-action@316d7cd859606d6039a2182b7d69199e9b036835 # v46.2.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg|generate-codemirror-languages)$"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
@@ -5,8 +5,6 @@ on:
    - cron: "7 0 * * *" # every day at 00:07 UTC
  workflow_dispatch:

-permissions: {}
-
 jobs:
  crowdin-pull:
    runs-on: ubuntu-latest
@@ -14,8 +12,8 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
        with:
          upload_sources: true
          upload_translations: false
@@ -49,8 +49,8 @@ jobs:
      e2e: ${{ steps.changes.outputs.e2e }}
      shell: ${{ steps.changes.outputs.shell }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
          filters: |
@@ -113,7 +113,8 @@ jobs:
              - "Dockerfile.rootless"

            swagger:
-              - "templates/swagger/*.json"
+              - "templates/swagger/v1_json.tmpl"
+              - "templates/swagger/v1_input.json"
              - "Makefile"
              - "package.json"
              - "pnpm-lock.yaml"
@@ -19,7 +19,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
-      - uses: go-gitea/giteabot@1d822239e9110b50c36192edb3c85883cf12efb3 # v1.0.5
+      - uses: go-gitea/giteabot@912675d47455ac93be82d8bda4667a02b20a6fe4 # v1.0.4
        with:
          github_token: ${{ secrets.GITEABOT_TOKEN }}
          gitea_fork: giteabot/gitea
@@ -40,7 +40,11 @@ on:
        required: false
        default: labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions

-permissions: {}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  statuses: write

 concurrency:
  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
@@ -51,15 +55,10 @@ jobs:
    if: github.repository == 'go-gitea/gitea'
    runs-on: ubuntu-latest
    timeout-minutes: 30
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write
-      statuses: write
    steps:
      # pull_request_review runs without repository secrets on fork PRs, so fall
      # back to the workflow token for the non-backport checks handled here.
-      - uses: go-gitea/giteabot@1d822239e9110b50c36192edb3c85883cf12efb3 # v1.0.5
+      - uses: go-gitea/giteabot@912675d47455ac93be82d8bda4667a02b20a6fe4 # v1.0.4
        with:
          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
@@ -19,7 +19,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
        with:
          lint-cache: "true"
@@ -31,7 +31,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
        with:
          cache: "false"
@@ -42,7 +42,7 @@ jobs:
      - run: make lint-spell

      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: 3.14
      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
@@ -62,7 +62,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: make --always-make checks-backend # ensure the "go-licenses" make target runs
@@ -72,7 +72,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
      - run: make lint-frontend
@@ -85,27 +85,25 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - run: make deps-backend generate-go
      # no frontend build here as backend should be able to build, even without any frontend files
      # CGO is not used when cross-compile, so these steps also test if the code is compatible with CGO disabled
      - name: build-backend-arm64
-        run: go build -ldflags '-s -w' -o gitea-linux-arm64
+        run: go build -o gitea_linux_arm64
        env:
          GOOS: linux
          GOARCH: arm64
          TAGS: bindata gogit
      - name: build-backend-windows
-        run: go build -ldflags '-s -w' -o gitea-windows
+        run: go build -o gitea_windows
        env:
          GOOS: windows
          GOARCH: amd64
          TAGS: bindata gogit
      - name: build-backend-386
-        run: go build -ldflags '-s -w' -o gitea-linux-386
+        run: go build -o gitea_linux_386
        env:
          GOOS: linux
          GOARCH: 386
-      - name: binary-sizes
-        run: ls -l gitea-*
@@ -21,7 +21,7 @@ jobs:
    timeout-minutes: 50
    services:
      pgsql:
-        image: postgres:14@sha256:2f439458ab6a57a925825ae14f9d06910e4fe4a41c8d4a0ae06397e65b707e1b
+        image: postgres:14
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
@@ -35,14 +35,14 @@ jobs:
      minio:
        # as github actions doesn't support "entrypoint", we need to use a non-official image
        # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2025.7.23@sha256:8935e75fa5d11295c17171e4aa49efe390a1193cd7f12e4d21b92af9ffef09d7
+        image: bitnamilegacy/minio:2025.7.23
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/pgsql-shard
        with:
@@ -57,7 +57,7 @@ jobs:
    timeout-minutes: 50
    services:
      pgsql:
-        image: postgres:14@sha256:2f439458ab6a57a925825ae14f9d06910e4fe4a41c8d4a0ae06397e65b707e1b
+        image: postgres:14
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
@@ -71,14 +71,14 @@ jobs:
      minio:
        # as github actions doesn't support "entrypoint", we need to use a non-official image
        # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2025.7.23@sha256:8935e75fa5d11295c17171e4aa49efe390a1193cd7f12e4d21b92af9ffef09d7
+        image: bitnamilegacy/minio:2025.7.23
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/pgsql-shard
        with:
@@ -90,7 +90,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - run: make deps-backend
      - run: make backend
@@ -115,7 +115,7 @@ jobs:
    runs-on: ubuntu-latest
    services:
      elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15@sha256:aeda96cd85b0cadeb3a3b900789f3b85e902c994052dadbaf8dd99a539e2ef93
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
        env:
          discovery.type: single-node
          xpack.security.enabled: false
@@ -125,13 +125,13 @@ jobs:
        ports:
          - "9200:9200"
      meilisearch:
-        image: getmeili/meilisearch:v1@sha256:d36e713e8f89483af1ab0d72011bbd503f5ab100b68ccbfad51c39e3f0a0567d
+        image: getmeili/meilisearch:v1
        env:
          MEILI_ENV: development # disable auth
        ports:
          - "7700:7700"
      redis:
-        image: redis:latest@sha256:52334768d4a6594d8969f51a1a6fee3ffa7545f6359a4877229cdc754d2def82
+        image: redis:latest@sha256:c904002d182255b6db3cbe3a1e8ce6c187d15390c39500b59fc07181aabff7bf
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -140,18 +140,18 @@ jobs:
        ports:
          - 6379:6379
      minio:
-        image: bitnamilegacy/minio:2025.7.23@sha256:8935e75fa5d11295c17171e4aa49efe390a1193cd7f12e4d21b92af9ffef09d7
+        image: bitnamilegacy/minio:2025.7.23
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:d5bb99496dc82ef0e34401ced6726d2f5d8fcbdf48670ba067ee3b394884cc3a
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
@@ -182,7 +182,7 @@ jobs:
    services:
      mysql:
        # the bitnami mysql image has more options than the official one, it's easier to customize
-        image: bitnamilegacy/mysql:8.4@sha256:7089d796fc9b4629a628bd445e4afabe607351ee665444c3197bdeaed812ea65
+        image: bitnamilegacy/mysql:8.4
        env:
          ALLOW_EMPTY_PASSWORD: true
          MYSQL_DATABASE: testgitea
@@ -191,7 +191,7 @@ jobs:
        options: >-
          --mount type=tmpfs,destination=/bitnami/mysql/data
      elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15@sha256:aeda96cd85b0cadeb3a3b900789f3b85e902c994052dadbaf8dd99a539e2ef93
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
        env:
          discovery.type: single-node
          xpack.security.enabled: false
@@ -208,7 +208,7 @@ jobs:
          - "587:587"
          - "993:993"
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
@@ -229,7 +229,7 @@ jobs:
    runs-on: ubuntu-latest
    services:
      mssql:
-        image: mcr.microsoft.com/mssql/server:2019-latest@sha256:46f719fd3457d4e7e8e5845fe00c35c20e7bae7ff1e8b9fe595f2a81029f5ba8
+        image: mcr.microsoft.com/mssql/server:2019-latest
        env:
          ACCEPT_EULA: Y
          MSSQL_PID: Standard
@@ -237,11 +237,11 @@ jobs:
        ports:
          - "1433:1433"
      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:d5bb99496dc82ef0e34401ced6726d2f5d8fcbdf48670ba067ee3b394884cc3a
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
@@ -21,7 +21,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/amd64
@@ -31,7 +31,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/arm64
@@ -41,7 +41,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/riscv64
@@ -19,7 +19,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
@@ -10,8 +10,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

-permissions: {}
-
 jobs:
  labeler:
    runs-on: ubuntu-latest
@@ -19,7 +17,7 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          sync-labels: true

@@ -32,12 +30,12 @@ jobs:
      pull-requests: write
    steps:
      # Base-branch checkout only: pull_request_target runs with elevated token; never run PR-head code here.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event.pull_request.base.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version: 26
+          node-version: 24
      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
      - run: node ./tools/ci-tools.ts lint-pr-title
        env:
@@ -45,6 +43,5 @@ jobs:
      - run: node ./tools/ci-tools.ts set-pr-labels
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_TITLE_BEFORE: ${{ github.event.changes.title.from }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ github.token }}
@@ -6,36 +6,40 @@ on:
      - main
  workflow_dispatch:

-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
  contents: read

 jobs:
  build-and-publish:
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.runner }}
+    runs-on: ubuntu-latest
+
+    env:
+      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
-        id: build
-      # retry snapcraft uploads which can be flaky
-      - name: Publish snap
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Authenticate snapcraft
+        shell: bash
+        run: snapcraft login --with <(printf '%s' "$SNAPCRAFT_STORE_CREDENTIALS")
+
+      - name: Remote build
        run: |
-          for attempt in 1 2 3 4 5; do
-            snapcraft upload "$SNAP" --release latest/edge && exit 0
-            echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
-            sleep 15
+          snapcraft remote-build \
+            --launchpad-accept-public-upload \
+            --build-for=amd64,arm64,armhf
+
+      - name: List built snaps
+        run: find . -maxdepth 1 -type f -name '*.snap' -print
+
+      - name: Upload and release snapcraft nightly build
+        run: |
+          set -euo pipefail
+
+          for snap in ./*.snap; do
+            echo "Uploading $snap to edge"
+            snapcraft upload --release="latest/edge" "$snap"
          done
-          exit 1
-        env:
-          SNAP: ${{ steps.build.outputs.snap }}
-          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
@@ -8,8 +8,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

-permissions: {}
-
 jobs:
  nightly-binary:
    runs-on: namespace-profile-gitea-release-binary
@@ -17,16 +15,20 @@ jobs:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -59,7 +61,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -70,18 +72,6 @@ jobs:
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          AWS_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress

  nightly-container:
    runs-on: namespace-profile-gitea-release-docker
@@ -89,12 +79,12 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -102,7 +92,7 @@ jobs:
        run: |
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -112,7 +102,7 @@ jobs:
            type=raw,value=${{ steps.clean_name.outputs.branch }}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -126,18 +116,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -147,7 +137,7 @@ jobs:
          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
      - name: build rootless docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -9,8 +9,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

-permissions: {}
-
 jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
@@ -18,16 +16,20 @@ jobs:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -60,7 +62,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -71,18 +73,6 @@ jobs:
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          AWS_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
      - name: Install GH CLI
        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
@@ -100,13 +90,13 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -119,7 +109,7 @@ jobs:
            type=semver,pattern={{version}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -135,18 +125,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -154,7 +144,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -11,8 +11,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

-permissions: {}
-
 jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
@@ -21,16 +19,20 @@ jobs:
      packages: write # to publish to ghcr.io
      id-token: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -63,7 +65,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -74,18 +76,6 @@ jobs:
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          AWS_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
      - name: Install GH CLI
        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
@@ -103,13 +93,13 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -126,7 +116,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -147,18 +137,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -166,7 +156,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -1,7 +0,0 @@
-rules:
-  anonymous-definition:
-    disable: true
-  undocumented-permissions:
-    disable: true
-  concurrency-limits:
-    disable: true
@@ -11,7 +11,6 @@ linters:
    - dupl
    - errcheck
    - forbidigo
-    - forcetypeassert
    - gocheckcompilerdirectives
    - gocritic
    - govet
@@ -54,12 +53,12 @@ linters:
              desc: use builtin errors package instead
        migrations:
          files:
-            - '**/modelmigration/**/*.go'
+            - '**/models/migrations/**/*.go'
          deny:
-            - pkg: gitea.dev/models
-              desc: "migrations must not depend on the models package. HINT: MIGRATION-STRUCT-FROZEN"
+            - pkg: gitea.dev/models$
+              desc: migrations must not depend on the models package
            - pkg: gitea.dev/modules/structs
-              desc: "migrations must not depend on modules/structs. HINT: MIGRATION-STRUCT-FROZEN"
+              desc: migrations must not depend on modules/structs (API structures change over time)
    nolintlint:
      allow-unused: false
      require-explanation: true
@@ -88,11 +87,6 @@ linters:
        - name: increment-decrement
        - name: modifies-value-receiver
        - name: package-comments
-        - name: package-naming
-          arguments:
-            - convention-name-check-regex: '^[a-z][a-z0-9_]*$' # underscores are used by migration packages
-              skip-default-bad-name-check: true
-              skip-collision-with-common-std: true
        - name: redefines-builtin-id
        - name: superfluous-else
        - name: time-naming
@@ -102,7 +96,7 @@ linters:
          arguments:
            - [] # AllowList - do not remove as args for the rule are positional and won't work without lists first
            - [] # DenyList
-            - - skip-initialism-name-checks: true
+            - - skip-package-name-checks: true # supress errors from underscore in migration packages
    staticcheck:
      checks:
        - all
@@ -140,7 +134,8 @@ linters:
        path: _test\.go
      - linters:
          - dupl
-        path: modelmigration/v
+          - errcheck
+        path: models/migrations/v
      - linters:
          - forbidigo
        path: cmd
@@ -164,6 +159,9 @@ linters:
      - .venv
      - public
      - web_src
+      - third_party$
+      - builtin$
+      - examples$
 issues:
  max-issues-per-linter: 0
  max-same-issues: 0
@@ -4,4 +4,9 @@ rules:
  info-contact: off
  oas2-api-host: off
  oas2-parameter-description: off
+  oas2-schema: off
+  oas2-valid-schema-example: off
+  openapi-tags: off
  operation-description: off
+  operation-singular-tag: off
+  operation-tag-defined: off
@@ -1,20 +1,20 @@
- Never assume, verify before claiming
- List development targets with `make help`
- Read relevant developer documentation in the `docs` folder
- PR descriptions: minimal, only what and why, no task or file listings. Include screenshots for UI changes, before and after when modifying existing UI. Aim for less than 1000 characters
- Reference issues and PRs by full URL, not by number
- Use Conventional Commits for commit messages and PR titles, plus Gitea's `enhance` type for user-facing enhancements
- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` trailer to commit messages, never `Co-Authored-By` or `Signed-off-by`
- Attribute agent authorship on one trailing line in issue and PR comments, never as a PR description section
- Never rewrite git history unless asked, update PRs with new commits and normal push
- Comments: write almost none, short and preferably same-line, explaining why for a future reader. Never narrate code, the change or the prompt. Preserve existing ones that still apply. If you need to write a paragraph-long comment, rethink your implementation, it is likely too complicated
- Add the current year to copyright headers of new `.go` files
- In `options/locale`, only edit `locale_en-US.json`, other locales are synced automatically
- In TS, use `!` instead of `?.`/`??` when a value always exists
- In Go, prefer to use modern language features wherever possible
- Prefer `tw-*` utilities over inline `style` and `flex-*` helpers over per-child `tw-ml-*`/`tw-mr-*` margins, falling back to `tw-*` where specificity requires `!important`
- Run `make fmt` after `.go` edits, `make tidy` after `go.mod` edits, `make generate-swagger` after API changes, and lint what changed with `make lint-go`, `lint-js`, `lint-css` or `lint-templates`
- Fix the cause rather than disabling a linter or weakening a test. Where unavoidable, use the narrowest scope with a trailing comment giving the reason
- Run single tests with `go test -run '^TestName$' ./modulepath/` for Go, `pnpm exec vitest <path-filter>` for TS and `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e` for e2e
- Write the fewest, fastest tests covering the behavior, extending an existing one where possible. Prefer unit tests where logic is testable in isolation
- Aim for sub-2s per integration test and sub-4s per e2e test. Wait on a deterministic condition rather than `sleep`, and prefer semantic locators in e2e tests
+- Use `make help` to find available development targets
+- Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
+- Run `make lint-js` to lint `.ts` files
+- Run `make tidy` after any `go.mod` changes
+- Run single go tests with `go test -run '^TestName$' ./modulepath/`
+- Run single js test files with `pnpm exec vitest <path-filter>`
+- Run single playwright e2e test files with `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e`
+- Add the current year into the copyright header of new `.go` files
+- Ensure no trailing whitespace in edited files
+- Use Conventional Commits for commit messages and PR titles, e.g. `type(scope): subject`; `!` before the colon if breaking. Use `test` type for test-only changes.
+- Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
+- Preserve existing code comments, do not remove or rewrite comments that are still relevant
+- Keep comments short, prefer same-line, explain why, never narrate code
+- Prefer unit tests over integration tests when logic is testable in isolation
+- Aim for sub-2s local runtime for integration and e2e tests
+- In TypeScript, use `!` (non-null assertion) instead of `?.`/`??` when a value is known to always exist
+- For CSS layout, prefer `flex-*` helpers over per-child `tw-ml-*` / `tw-mr-*` margins; fall back to `tw-*` utilities when specificity requires `!important`
+- Include authorship attribution in issue and pull request comments
+- Always add `Assisted-By` trailers to commit messages in format `Assisted-by: AGENT_NAME:MODEL_VERSION`
+- Never add `Co-Authored-By` `Signed-off-by` trailer to commit messages. Sign off must be done by a human.
@@ -4,88 +4,18 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.27.1](https://github.com/go-gitea/gitea/releases/tag/v1.27.1) - 2026-07-27
-
-* SECURITY
-  * Fix: orgmode render include path (#38642) (#38645)
-  * Fix: git patch apply (#38637) (#38638)
-  * Fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
-
-* API
-  * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
-
-* ENHANCEMENTS
-  * enhance: improve diff contrast in light and dark themes (#37477) (#38574)
-
-* BUGFIXES
-  * fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
-  * fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
-  * fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
-  * fix(actions): skip already-approved runs in `ApproveRuns` (#38653) (#38654)
-  * fix: orgmode render include path (#38642) (#38645)
-  * fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
-  * fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
-  * fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
-  * fix(actions): correctness and hardening fixes (#38518) (#38631)
-  * fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
-  * fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
-  * fix(webhook): remove slack channel name check (#38608) (#38612)
-  * fix: download dropdown menu clipped on the branches page (#38604) (#38609)
-  * fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
-  * fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
-  * fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
-  * fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
-  * fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
-  * fix: branch protection user list (#38570) (#38584)
-  * fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
-  * fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
-  * fix(actions): support `matrix` when evaluating workflow `if` expression (#38474) (#38557)
-  * fix(actions): align status icon span for Safari rendering (#38558) (#38562)
-  * fix: revert git clone http redirection forbidden (#38530) (#38545)
-  * fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
-  * fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
-  * fix: make the merge box button red if some checks fail (#38508) (#38516)
-  * fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
-  * fix: make commit message merge correctly (#38490) (#38502)
-  * fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
-  * fix(actions): make `cancelled()` work in job `if` evaluation (#38495) (#38497)
-  * fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
-  * fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
-  * fix: full file highlighting for git diff with CR char (#38484) (#38491)
-  * fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
-  * fix: 500 error when updating user visibility (#38480) (#38483)
-  * fix(actions): make job list item fully clickable (#38462) (#38471)
-  * fix: mail template for push event (#38467) (#38468)
-  * fix: make "test push webhook" always work (#38425) (#38455)
-  * fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
-  * fix(org): align follow button and wrap description (#38448) (#38454)
-  * fix(actions): populate `github.event` for scheduled runs (#38446) (#38452)
-
-* MISC
-  * refactor: git patch apply (#38637) (#38638)
-
-## [1.27.0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0) - 2026-07-13
+## [1.27.0-rc0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0-rc0) - 2026-06-28

 * BREAKING
  * Feat(actions)!: improve support for reusable workflows (#37478)
  * Use Content-Security-Policy: script nonce (#37232)

 * SECURITY
-  * Fix: various security fixes (#38406) (#38426)
-  * Fix(security): harden access checks and migration validation (#38324) (#38400)
-  * Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
-  * Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
-  * Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
-  * Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
-  * Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
-  * Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
-  * Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
  * Fix(oauth): restrict introspection to the token's client (#38042)
  * Fix(api): don't expose private org membership via public_members (#38145)
  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
  * Fix(migrations): prevent path traversal in repository restore (#38215)
-  * Feat(security): set X-Content-Type-Options: nosniff by default (#37354)

 * FEATURES
  * Feat(actions): add workflow status badge modal (#38196)
@@ -94,12 +24,12 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
  * Feat(actions): show run status on browser tab favicon (#38071)
  * Feat(api): add token introspection and self-deletion endpoint (#37995)
+  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
  * Feat(repo): split repository creation limit into user and org scopes (#37872)
  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
  * Feat(org): add team visibility so org members can discover teams (#37680)
  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
-  * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
  * Feat: Add avatar stacks (#37594)
  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
@@ -107,77 +37,46 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Feat(orgs): Add search bar for organization members tab page (#37347)
  * Feat(api): Add assignees APIs (#37330)
  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
-  * Introduce `ActionRunAttempt` to represent each execution of a run (#37119)
  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
  * Add project column picker to issue and pull request sidebar (#37037)
  * Allow multiple projects per issue and pull requests (#36784)
-  * Add bulk repository deletion for organizations (#36763)
-  * Add API endpoint to reply to pull request review comments (#36683)
-  * Feat: Add bypass allowlist for branch protection (#36514)
  * Feat(ui): add "follow rename" to file commit history list (#34994)
  * Feat(ssh): auto generate additional ssh keys (#33974)

 * ENHANCEMENTS
-  * Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
  * Enhance: allow builtin default git config options to be overridden (#38172)
  * Enhance: allow MathML core elements (#38034)
-  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
  * Enhance(markup): improve issue title rendering (#37908)
  * Enhance(actions): set descriptive browser tab title on run view (#37870)
+  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
  * Feat(actions): add before/after to PR synchronize event payload (#37827)
  * Enhance(actions): add branch filters to run list (#37826)
  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
  * Feat: add copy button to action step header, improve other copy buttons (#37744)
-  * Feat(web): also display PR counts in repo list (#37739)
  * Fix(icon): use repo-forked icon to display forks count (#37731)
  * Feat(api): add sort and order query parameters to job list endpoints (#37672)
  * Feat(api): add last_sync to repository API (#37566)
  * Enhance: Adjust Workflow Graph styling (#37497)
  * Improve code editor text selection and clean up lint enablement (#37474)
  * Add mirror auth updates to repo edit API and settings (#37468)
+  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
  * Feat: Add default PR branch update style setting (#37410)
  * Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
  * Allow fast-forward-only merge when signed commits are required (#37335)
  * Enhance styling in actions page (#37323)
-  * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229)
  * Fix: improve actions status icons and texts (#37206)
  * Make Markdown fenced code block work with more syntaxes (#37154)
  * Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
-  * Add pagination and search box to org teams list (#37245)
-  * Workflow Artifact Info Hover (#37100)
-  * Feat(editor): broaden language detection in web code editor (#37619)
+  * Add API endpoint to reply to pull request review comments (#36683)

 * PERFORMANCE
-  * Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)
  * Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
  * Perf: Various performance regression fixes (#38078)
  * Perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076)
  * Batch-load related data in actions run, job, and task API endpoints (#37032)

 * BUGFIXES
-  * Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
-  * Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)
-  * Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)
-  * Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)
-  * Fix: actions task state concurrent update (#38405) (#38409)
-  * Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)
-  * Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)
-  * Fix: co-author detection (#38392) (#38397)
-  * Fix: incorrect co-author detection on commit page (#38386) (#38387)
-  * Fix(ui): restore commits table column widths (#38379) (#38383)
-  * Fix: golang html template url escaping (#38363) (#38369)
-  * Fix: minio init check (#38355) (#38361)
-  * Fix: org project view assignee list (#38357) (#38360)
-  * Fix(actions): release claimed task if context is cancelled during `FetchTask` (#38343) (#38347)
-  * Fix(actions): make runner list pagination order deterministic (#38313) (#38327)
-  * Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)
-  * Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)
-  * Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
-  * Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)
-  * Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)
-  * Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)
-  * Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)
  * Fix: update npm dependencies, fix misc issues (#38257)
  * Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
  * Fix: codemirror regressions (#38248)
@@ -233,11 +132,8 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Feat: execute post run cleanup when workflow is cancelled (#37275)
  * Fix `relative-time` error and improve global error handler (#37241)
  * Refactor flash message and remove SanitizeHTML template func (#37179)
-  * Fix Repository transferring page (#37277)

 * TESTING
-  * Test(e2e): fix race in pdf file render test (#38380) (#38381)
-  * Test: compare key file contents instead of `FileInfo` in `TestInitKeys` (#38330) (#38331)
  * Test: speed up two tests (#37905)
  * Test: Fix random failure test (#37887)
  * Test: fix flaky `issue-comment` close test (#37880)
@@ -247,10 +143,8 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Ci: shard tests and reduce redundant work (#37618)
  * Test(e2e): run playwright via container (#37300)
  * Remove external service dependencies in migration tests (#36866)
-  * Refactor: only reset a database table when the table's data was changed (#37573)

 * BUILD
-  * Refactor: use modernc sqlite driver as default (#37562)
  * Fix(actions): authenticate snapcraft before nightly remote build (#38252)
  * Ci: cap Elasticsearch heap in db-tests (#37816)
  * Build(snap): publish nightly version to snapcraft via actions (#37814)
@@ -260,21 +154,24 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Chore: clean up "contrib" dir (#37690)
  * Fix: snap build (main branch) (#37685)
  * Ci: Also lint json5 files (#37659)
+  * Feat(editor): broaden language detection in web code editor (#37619)
  * Build: update pnpm to v11 (#37591)
  * Refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (#37557)
+  * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543)
  * Update go js py dependencies (#37525)
  * Ci: lint PR titles with commitlint (#37498)
  * Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
  * Update GitHub Actions to latest major versions (#37313)
  * Update go js dependencies (#37312)
  * Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
+  * Remove htmx (#37224)
  * Replace custom Go formatter with `golangci-lint fmt` (#37194)
+  * Refactor htmx and fetch-action related code (#37186)
  * Integrate renovate bot for all dependency updates (#37050)
  * Build(sign): move to sigstore (#38250)

 * DOCS
  * Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
-  * Update 1.26.1 changelog in main (#37442)
  * Docs: fix duplicated word in foreachref doc comment (#38161)
  * Docs: Clarify criteria for becoming a merger (#38113)
  * Docs: Publish TOC Election Result 2026 (#38111)
@@ -282,15 +179,11 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Docs: add development setup guide (#37960)

 * MISC
-  * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543)
-  * Remove htmx (#37224)
-  * Refactor htmx and fetch-action related code (#37186)
  * Revert(sign): restore gpg (#38251)
  * Refactor: replace legacy `delete-button` with `link-action` (#38143)
  * Refactor(actions): read runner capabilities from proto field (#38068)
  * Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
  * Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
-  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
  * Fix(deps): update go dependencies (#37851)
  * Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
  * Ci: tweak `files-changed`, add `free-disk-space` (#37819)
@@ -312,6 +205,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Chore(deps): update action dependencies (#37751)
  * Fix(markup): wrap indented code blocks for the code-copy button (#37748)
  * Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
+  * Feat(web): also display PR counts in repo list (#37739)
  * Refactor(glob): use strings.Builder for regexp compilation (#37730)
  * Chore(doctor): remove four obsolete doctor check implementations (#37728)
  * Refactor(org): simplify owner-team org repo creation logic (#37727)
@@ -329,9 +223,12 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Fix(deps): update npm dependencies (#37636)
  * Refactor(log): replace log.Critical with log.Error (#37624)
  * Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
+  * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
  * Chore(deps): update action dependencies (#37603)
  * Ci: allow `chore` type in PR title lint (#37575)
+  * Refactor: only reset a database table when the table's data was changed (#37573)
  * Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
+  * Refactor: use modernc sqlite driver as default (#37562)
  * Docs: fix 4 typos in CHANGELOG.md (#37549)
  * Fix(deps): update go dependencies (#37541)
  * Chore(deps): update action dependencies (#37540)
@@ -340,22 +237,26 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Refactor "flex-list" to "flex-divided-list" (#37505)
  * Refactor compare diff/pull page (1) (#37481)
  * Refactor pull request view (4) (#37451)
+  * Update 1.26.1 changelog in main (#37442)
  * Refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (#37441)
-  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
  * Refactor: serve site manifest via `/assets/site-manifest.json` endpoint (#37405)
  * Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
  * Update `Block a user` form (#37359)
  * Move review request functions to a standalone file (#37358)
+  * Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
  * Enable strict TypeScript, add `errorMessage` helper (#37292)
  * Refactor frontend `tw-justify-between` layouts to `flex-left-right` (#37291)
  * Update Nix flake (#37284)
+  * Fix Repository transferring page (#37277)
  * Remove `SubmitEvent` polyfill (#37276)
  * Remove dead code identified by `deadcode` tool (#37271)
  * Upgrade go-git to v5.18.0 (#37268)
  * Don't add useless labels which will bother changelog generation (#37267)
  * Move heatmap to first-party code (#37262)
  * Tests/integration: simplify code (#37249)
+  * Add pagination and search box to org teams list (#37245)
  * Remove error returns from crypto random helpers and callers (#37240)
+  * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229)
  * Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
  * Refactor "htmx" to "fetch action" (#37208)
  * Update go js py dependencies (#37204)
@@ -365,7 +266,11 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Update javascript dependencies (#37142)
  * Update go dependencies (#37141)
  * Frontport changelog of v1.26.0-rc0 (#37138)
+  * Introduce `ActionRunAttempt` to represent each execution of a run (#37119)
+  * Workflow Artifact Info Hover (#37100)
  * Extend issue context popup beyond markdown content (#36908)
+  * Add bulk repository deletion for organizations (#36763)
+  * Feat: Add bypass allowlist for branch protection (#36514)

 ## [1.26.4](https://github.com/go-gitea/gitea/releases/tag/1.26.4) - 2026-06-21

@@ -111,7 +111,7 @@ If further discussion is needed, we encourage you to open a new issue instead an

 ## Building Gitea

-See [docs/build-setup.md](docs/build-setup.md) for prerequisites and [docs/development.md](docs/development.md)
+See [docs/setup.md](docs/setup.md) for prerequisites and [docs/development.md](docs/development.md)
 for building Gitea and the development workflow.

 ## Styleguide
@@ -41,6 +41,7 @@ Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
+Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)
@@ -11,14 +11,14 @@ COMMA := ,

 XGO_VERSION := go-1.26.x

-AIR_PACKAGE ?= github.com/air-verse/air@v1.67.4 # renovate: datasource=go
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.9.0 # renovate: datasource=go
+AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
 GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.16 # renovate: datasource=go
+GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.36.1 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.1 # renovate: datasource=go
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.6.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.4.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
 SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker

@@ -113,8 +113,8 @@ LDFLAGS := $(LDFLAGS) -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"

 LINUX_ARCHS ?= linux/amd64,linux/386,linux/arm-5,linux/arm-6,linux/arm64,linux/riscv64

-GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list gitea.dev/modelmigration/...) gitea.dev/tests/integration/migration-test gitea.dev/tests gitea.dev/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
-MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list gitea.dev/modelmigration/...)
+GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list gitea.dev/models/migrations/...) gitea.dev/tests/integration/migration-test gitea.dev/tests gitea.dev/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
+MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list gitea.dev/models/migrations/...)

 FRONTEND_SOURCES := $(shell find web_src/js web_src/css -type f)
 FRONTEND_CONFIGS := vite.config.ts tailwind.config.ts
@@ -148,12 +148,11 @@ GO_SOURCES += $(shell find $(GO_DIRS) -type f -name "*.go")
 GO_SOURCES += $(GENERATED_GO_DEST)

 ESLINT_CONCURRENCY ?= 2
-ESLINT_ARGS := --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY)

+SWAGGER_SPEC := templates/swagger/v1_json.tmpl
+SWAGGER_SPEC_INPUT := templates/swagger/v1_input.json
 SWAGGER_EXCLUDE := gitea.dev/sdk
-SWAGGER_SPEC_INPUT := templates/swagger/v1-input.json
-SWAGGER_SPEC := templates/swagger/v1-swagger.generated.json
-OPENAPI3_SPEC := templates/swagger/v1-openapi3.generated.json
+OPENAPI3_SPEC := templates/swagger/v1_openapi3_json.tmpl

 TEST_MYSQL_HOST ?= mysql:3306
 TEST_MYSQL_DBNAME ?= testgitea
@@ -212,7 +211,7 @@ fmt: ## format the Go and template code

 .PHONY: fmt-check
 fmt-check: fmt
-	@diff=$$(git diff --color=always $(GO_SOURCES) templates); \
+	@diff=$$(git diff --color=always $(GO_SOURCES) templates $(WEB_DIRS)); \
 	if [ -n "$$diff" ]; then \
 	  echo "Please run 'make fmt' and commit the result:"; \
 	  printf "%s" "$${diff}"; \
@@ -232,9 +231,7 @@ endif
 generate-swagger: $(SWAGGER_SPEC) $(OPENAPI3_SPEC) ## generate the swagger spec from code comments

 $(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
-	@output="$$($(GO) run $(SWAGGER_PACKAGE) generate spec --enable-allof-compounding --skip-enum-desc --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)' 2>&1)" || { printf '%s\n' "$$output" >&2; exit 1; }; \
-	warnings="$$(printf '%s\n' "$$output" | grep -v '^go: ')"; \
-	if [ -n "$$warnings" ]; then printf '%s\n' "$$warnings" >&2; exit 1; fi
+	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'

 .PHONY: swagger-check
 swagger-check: generate-swagger
@@ -247,10 +244,11 @@ swagger-check: generate-swagger

 .PHONY: swagger-validate
 swagger-validate: ## check if the swagger spec is valid
-	@# ensure no warnings
-	@output="$$($(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)' 2>&1)"; status=$$?; \
-	printf '%s\n' "$$output" | grep -v '^go: '; \
-	case "$$output" in *WARNING:*) exit 1;; esac; exit $$status
+	@# swagger "validate" requires that the "basePath" must start with a slash, but we are using Golang template "{{...}}"
+	@$(SED_INPLACE) -E -e 's|"basePath":( *)"(.*)"|"basePath":\1"/\2"|g' './$(SWAGGER_SPEC)' # add a prefix slash to basePath
+	@# FIXME: there are some warnings
+	$(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)'
+	@$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)' # remove the prefix slash from basePath

 .PHONY: generate-openapi3
 generate-openapi3: $(OPENAPI3_SPEC) ## generate the OpenAPI 3.0 spec from the Swagger 2.0 spec
@@ -296,12 +294,12 @@ lint-backend-fix: lint-go-fix lint-editorconfig ## lint backend files and fix is

 .PHONY: lint-js
 lint-js: node_modules ## lint js and ts files
-	pnpm exec eslint $(ESLINT_ARGS) $(ESLINT_FILES)
+	pnpm exec eslint --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) $(ESLINT_FILES)
 	pnpm exec vue-tsc

 .PHONY: lint-js-fix
 lint-js-fix: node_modules ## lint js and ts files and fix issues
-	pnpm exec eslint $(ESLINT_ARGS) $(ESLINT_FILES) --fix
+	pnpm exec eslint --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) $(ESLINT_FILES) --fix
 	pnpm exec vue-tsc

 .PHONY: lint-css
@@ -314,7 +312,7 @@ lint-css-fix: node_modules ## lint css files and fix issues

 .PHONY: lint-swagger
 lint-swagger: node_modules ## lint swagger files
-	pnpm exec spectral lint -q -F hint $(SWAGGER_SPEC) $(OPENAPI3_SPEC)
+	pnpm exec spectral lint -q -F hint $(SWAGGER_SPEC)

 .PHONY: lint-md
 lint-md: node_modules ## lint markdown files
@@ -348,7 +346,7 @@ lint-editorconfig:
 .PHONY: lint-actions
 lint-actions: .venv ## lint action workflow files
 	@$(GO) run $(ACTIONLINT_PACKAGE)
-	@uv run --frozen zizmor --quiet --persona=pedantic --min-confidence=medium .github
+	@uv run --frozen zizmor --quiet --min-confidence=medium .github

 .PHONY: lint-shell
 lint-shell: ## lint shell scripts
@@ -365,11 +363,11 @@ lint-yaml: .venv ## lint yaml files

 .PHONY: lint-json
 lint-json: node_modules ## lint json files
-	pnpm exec eslint -c eslint.json.config.ts $(ESLINT_ARGS)
+	pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY)

 .PHONY: lint-json-fix
 lint-json-fix: node_modules ## lint and fix json files
-	pnpm exec eslint -c eslint.json.config.ts $(ESLINT_ARGS) --fix
+	pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) --fix

 .PHONY: watch
 watch: ## watch everything and continuously rebuild
@@ -423,12 +421,7 @@ unit-test-coverage:
 .PHONY: tidy
 tidy: ## run go mod tidy
 	$(eval MIN_GO_VERSION := $(shell grep -Eo '^go\s+[0-9]+\.[0-9.]+' go.mod | cut -d' ' -f2))
-	$(eval GO_TOOLCHAIN := $(shell grep -Eo '^toolchain\s+go[0-9.]+' go.mod | cut -d' ' -f2))
 	$(GO) mod tidy -compat=$(MIN_GO_VERSION)
-	@# workaround https://github.com/golang/go/issues/75331: restore toolchain if tidy dropped it
-	@if [ -n "$(GO_TOOLCHAIN)" ] && ! grep -qE '^toolchain\s' go.mod; then \
-		$(GO) mod edit -toolchain=$(GO_TOOLCHAIN); \
-	fi
 	@$(MAKE) --no-print-directory $(GO_LICENSE_FILE)

 vendor: go.mod go.sum
@@ -480,7 +473,7 @@ migrations.individual.test:

 .PHONY: migrations.individual.test\#%
 migrations.individual.test\#%:
-	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/modelmigration/$*
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/models/migrations/$*

 .PHONY: playwright
 playwright: deps-frontend
@@ -602,6 +595,28 @@ node_modules: pnpm-lock.yaml
 	uv sync
 	@touch .venv

+.PHONY: update
+update: update-go update-js update-py ## update dependencies
+
+.PHONY: update-go
+update-go: ## update go dependencies
+	$(GO) get -u ./...
+	$(MAKE) tidy
+
+.PHONY: update-js
+update-js: node_modules ## update js dependencies
+	pnpm exec updates -u -f package.json
+	rm -rf node_modules pnpm-lock.yaml
+	pnpm install
+	@touch node_modules
+
+.PHONY: update-py
+update-py: node_modules ## update py dependencies
+	pnpm exec updates -u -f pyproject.toml
+	rm -rf .venv uv.lock
+	uv sync
+	@touch .venv
+
 .PHONY: vite
 vite: $(FRONTEND_DEST) ## build vite files

@@ -2,6 +2,7 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
 [![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
@@ -68,7 +69,7 @@ Get more information from [documentation](https://docs.gitea.com/contributing/lo

 ## Official and Third-Party Projects

-We provide an official [go-sdk](https://gitea.com/gitea/go-sdk), a CLI tool called [tea](https://gitea.com/gitea/tea) and an [action runner](https://gitea.com/gitea/runner) for Gitea Action.
+We provide an official [go-sdk](https://gitea.com/gitea/go-sdk), a CLI tool called [tea](https://gitea.com/gitea/tea) and an [action runner](https://gitea.com/gitea/act_runner) for Gitea Action.

 We maintain a list of Gitea-related projects at [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea), where you can discover more third-party projects, including SDKs, plugins, themes, and more.

@@ -2,6 +2,7 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
 [![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
@@ -76,7 +77,7 @@

 ## 官方和第三方项目

-我们提供了一个官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一个名为 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一个 Gitea Action 的 [action runner](https://gitea.com/gitea/runner)。
+我们提供了一个官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一个名为 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一个 Gitea Action 的 [action runner](https://gitea.com/gitea/act_runner)。

 我们在 [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea) 维护了一个 Gitea 相关项目的列表，您可以在那里发现更多的第三方项目，包括 SDK、插件、主题等。

@@ -2,6 +2,7 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
 [![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
@@ -76,7 +77,7 @@

 ## 官方和第三方項目

-我們提供了一個官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一個名為 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一個 Gitea Action 的 [action runner](https://gitea.com/gitea/runner)。
+我們提供了一個官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一個名為 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一個 Gitea Action 的 [action runner](https://gitea.com/gitea/act_runner)。

 我們在 [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea) 維護了一個 Gitea 相關項目的列表，您可以在那裡發現更多的第三方項目，包括 SDK、插件、主題等。

@@ -6,30 +6,20 @@ If you discover a security issue, please bring it to their attention right away!

 Previous vulnerabilities are listed at https://about.gitea.com/security.

-## Supported Versions
-
-Security fixes follow our [support policy](docs/release-management.md#end-of-life-eol): only the most recent major release and the `main` branch receive them.
-
-Reports must be filed against a supported version. Before reporting, verify that the issue reproduces on a supported version; any report that only affects an unsupported version will be closed as out of scope.
-
 ## Reporting a Vulnerability

-Please **DO NOT** file a public issue. Instead, report the vulnerability privately by opening a [GitHub security advisory](https://github.com/go-gitea/gitea/security/advisories/new), or optionally by sending your report to `security@gitea.io`.
-If reporting via GitHub, open an advisory per found issue. You can group the found issues if they relate to a single area (same feature, same fault present in multiple routes) but do not group unrelated reports into one as it makes it much harder to assess and track for duplicates.
-Do not use LLM to write the reports. It's meant for people to read so take your time and use your own words to write it. If you have used LLM to find the bug, be transparent about it and verify that it is not hallucination before submitting the report.
-
-If your report turns out to be a duplicate, you will be credited in the original report.
+Please **DO NOT** file a public issue, instead send your report privately to `security@gitea.io`.

 ## Protecting Security Information

 Due to the sensitive nature of security information, you can use the below GPG public key to encrypt your mail body.

-The PGP key is valid until July 23, 2027.
+The PGP key is valid until July 4, 2026.

 ```
 Key ID: 6FCD2D5B
 Key Type: RSA
-Expires: 7/23/2027
+Expires: 7/4/2026
 Key Size: 4096/4096
 Fingerprint: 3DE0 3D1E 144A 7F06 9359 99DC AAFD 2381 6FCD 2D5B
 ```
@@ -52,18 +42,18 @@ lzpAjnN9/KLtQroutrm+Ft0mdjDiJUeFVl1cOHDhoyfCsQh62HumoyZoZvqzQd6e
 AbN11nq6aViMe2Q3je1AbiBnRnQSHxt1Tc8X4IshO3MQK1Sk7oPI6LA5oQARAQAB
 tCJHaXRlYSBTZWN1cml0eSA8c2VjdXJpdHlAZ2l0ZWEuaW8+iQJXBBMBCABBAhsD
 BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAFiEEPeA9HhRKfwaTWZncqv0jgW/N
-LVsFAmpi3IkFCQmOqAsACgkQqv0jgW/NLVsgyxAAuTyj4+PImOFr7ZkEJcseWUy+
-gWQrJDagj+Ks2SKGneVroJ63q5Vngx44b7JNabauKel4IJJCScLdwA7k0DKFHPOM
-rUS6aavW5+961CMQxJ13vWz7qxLxhI4FXle255xFSXgOo9T1W7+wtm/wtze8+sws
-8XKAVBZGuVI1/KzVpE6bWxpIIYK79DC07NWGDAZzMbuO92TFHBRblXsicPWExBjC
-/oFmT70YMcA0wOwU/YKYMg2eK2XYUr5+uYX6FnP7iUhDj1vZmwkF33Cj9v9D3Hv9
-NzAquj97uLht4wL2sqsIgZd4Vc37uipPDFaddzTb/lon7lPbJPMLObcd4HjSTkIo
-nEMM0wdOQZU7mIIgRM9o3mr/gyVigl3uARmUKaP9PhBaOGTjkni0nrv90hSHBHeu
-ayM76vl2tzAB2KpDxHIHbI2SEdytV28l/rxWrsbk2kG7s7QB6VKiThTatYevh1kg
-6Ujgl2xNSntG6t6PWjQ65OMSq5Iiwe7RfOZkNmPRGP/rbzMbgWXB3iCR2gVQvsxA
-ctYdDZdUYAeQ5g6xSKJBloygDQdLzk9m0hqNUyl6gxhRNRw69hqp9E4mxFF3L1Gi
-Z2LspLX1ZZWMh0bp0AniWzZuzLuNI0KYhlok6fnshjidJ1qYM/lbz5eJTYWxoJZW
-rczn8gB3+MZbULc/iiO5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
+LVsFAmhoHmkFCQeT6esACgkQqv0jgW/NLVuFLRAAmjBQSKRAgs2bFIEj7HLAbDp4
+f+XkdH+GsT3jRPOZ9QZgmtM+TfoE4yNgIVfOl+s4RdjM/W4QzqZuPQ55hbEHd056
+cJmm7B+6GsHFcdrPmh65sOCEIyh4+t45dUfeWpFsDPqm9j1UHXAJQIpB8vDEVAPH
+t+3wLCk8GMPJs1o5tIyMmaO23ngvkwn8eG7KgY+rp2PzObrb5g7ppci0ILzILkrp
+HVjZsEfUWRgSVF7LuU5ppqDKrlcqwUpQq6n3kGMZcLrCp6ACKP04TBmTfUxNwdL7
+I0N7apI2Pbct9T1Gv/lYAUFWyU2c3gh/EBLbO6BukaLOFRQHrtNfdJV/YnMPlcXr
+LUJjK9K4eAH9DsrZqrisz/LthsC2BaNIN3KRMTk5YTYgmIh8GXzSgihORmtDFELC
+RroID3pTuS0zjXh+wpY9GuPTh7UW23p42Daxca4fAT4k5EclvDRUrL21xMopPMiL
+HuNdELz4FVchRTy05PjzKVyjVInDNojE2KUxnjxZDzYJ6aT/g+coD5yfntYm8BEj
+ZzL0ndZES54hzKLpv7zwBQwFzam68clZYmDPILOPTflQDfpGEWmJK4undFU5obz
+ZsQRz0R3ulspChATbZxO0d5LX2obLpKO9X3b5VoO1KF+R8Vjw1Y0KxrNZ6rIcfqH
+Z50QVQKSe9dm08K0ON+5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
 T+p07yCSSoSlmnJHCQmwh4vfg1blyz0zZ4vkIhtpHsEgc+ZAG+WQXSsJ2iRz+eSN
 GwoOQl4XC3n+QWkc1ws+btr48+6UqXIQU+F8TPQyx/PIgi2nZXJB7f5+mjCqsk46
 XvH4nTr4kJjuqMSR/++wvre2qNQRa/q/dTsK0OaN/mJsdX6Oi+aGNaQJUhIG7F+E
@@ -75,20 +65,21 @@ s+GsP9I3cmWWQcKYxWHtE8xTXnNCVPFZQj2nwhJzae8ypfOtulBRA3dUKWGKuDH/
 axFENhUsT397aOU3qkP/od4a64JyNIEo4CTTSPVeWd7njsGqli2U3A4xL2CcyYvt
 D/MWcMBGEoLSNTswwKdom4FaJpn5KThnK/T0bQcmJblJhoCtppXisbexZnCpuS0x
 Zdlm2T14KJ3LABEBAAGJAjwEGAEIACYCGwwWIQQ94D0eFEp/BpNZmdyq/SOBb80t
-WwUCamLcngUJCY6oIAAKCRCq/SOBb80tWxilD/41xF1pwD2lGqjWLmlXcd0Ok5xm
-67TSGiKiFZUgI3ftkRVlqmeJqjVmRjpc2dLfCuVBzlaP0Oyv5Jn+2CPqgmWIk5tw
-pqlxqmsXiIZ9Uv2wWItxrXIwQ6DHc1qcIOu7feTnt1HVhxp2GqlXl3tA/+MTTDmn
-4rqrHffI7ps9eCbK/SfSuoQk3+x/x4GPqWDbsNw1E9dDjPPhsKfdwzZ6dFR2Yhzu
-2U0GDc2aeBA0Gjy6VFBj1ksmGxQCL3TqtGEHOonoPpTIjmDd35Xq6BSu119onOQS
-THZ7+3JQRpizBVrIklKf33UOikZy9WHuffFddP46m8qC2Alh1aB7xcD8K3P9gzd5
-OJO9Zr8JR+rvi8eOsCHvJqGhe0JMMf9bgXKjQ1tMTDTe6r0Jnw7HbkDghjpj9xG7
-GYmDB0CL4kP5nAZ1OPfIasIu3Llhcy6mS52ECw0X6PNwUINwBn7F6EKAiciw8/OS
-CXoGJDI5alwNhh+3DL4oBH1aq1lnmxmhFNpwpRDvtbRGmZeeASTeC4LMAtqP85Er
-8W9ulIgQ4Ub8QuoxvE5hzWEB1QUkJgozI8vO4DoGlrsz7P8cPzrOT7WqUfUPTYE6
-oZEfEYDSj1IZHnPYPS+yLBJMJ/Lc1h8OCetmbJZx4QWaX3Fgar7Zks8FfJQOTN6i
-HnOlrsaMDYNyO76uBQ==
-=4kVJ
+WwUCaGgeJAUJB5PppgAKCRCq/SOBb80tW/NWEACB6Jrf0gWlk7e+hNCdnbM0ZVWU
+f2sHNFfXxxsdhpcDgKbNHtkZb8nZgv8AX+5fTtUwMVa3vKcdw30xFiIM5N7cCIPV
+vg/5z5BtfEaitnabEUG2iiVDIy8IHXIcK10rX+7BosA3QDl2PsiBHwyi5G13lRk8
+zGTSNDuOalug33h5/lr2dPigamkq74Aoy29q8Rjad6GfWHipL2bFimgtY+Zdi0BH
+NLk4EJXxj1SgVx5dtkQzWJReBA5M+FQ4QYQZBO+f4TDoOLmjui152uhkoLBQbGAa
+WWJFTVxm0bG5MXloEL3gA8DfU7XDwuW/sHJC5pBko8RpQViooOhckMepZV3Y83DK
+bwLYa3JmPgj2rEv4993dvrJbQhpGd082HOxOsllCs8pgNq1SnXpWYfcGTgGKC3ts
+U8YZUUJUQ7mi2L8Tv3ix20c9EiGmA30JAmA8eZTC3cWup91ZkkVBFRml2czTXajd
+RWZ6GbHV5503ueDQcB8yBVgF3CSixs67+dGSbD3p86OqGrjAcJzM5TFbNKcnGLdE
+kGbZpNwAISy750lXzXKmyrh5RTCeTOQerbwCMBvHZO+HAevA/LXDTw2OAiSIQlP5
+sYA4sFYLQ30OAkgJcmdp/pSgVj/erNtSN07ClrOpDb/uFpQymO6K2h0Pst3feNVK
+9M2VbqL9C51z/wyHLg==
+=SfZA
 -----END PGP PUBLIC KEY BLOCK-----
+
 ```

 Security reports are greatly appreciated and we will publicly thank you for it, although we keep your name confidential if you request it.
@@ -436,7 +436,6 @@
      "jsonl",
      "mcmeta",
      "sarif",
-      "slnlaunch",
      "tact",
      "tfstate",
      "topojson",
@@ -692,17 +691,10 @@
    "extensions": [
      "ini",
      "cnf",
-      "container",
      "dof",
      "lektorproject",
-      "mount",
-      "network",
      "prefs",
      "properties",
-      "service",
-      "socket",
-      "target",
-      "timer",
      "url",
      "conf"
    ],
@@ -10,7 +10,7 @@
 // cleaner SDK output with proper enum types instead of anonymous strings.
 //
 // Run: go run build/generate-openapi.go
-// Output: templates/swagger/v1-openapi3.generated.json
+// Output: templates/swagger/v1_openapi3_json.tmpl

 //go:build ignore

@@ -21,21 +21,35 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"regexp"
 	"sort"
 	"strings"

 	"gitea.dev/build/openapi3gen"
+
+	"github.com/getkin/kin-openapi/openapi3"
 )

 const (
-	swaggerSpecPath = "templates/swagger/v1-swagger.generated.json"
-	openapi3OutPath = "templates/swagger/v1-openapi3.generated.json"
+	swaggerSpecPath = "templates/swagger/v1_json.tmpl"
+	openapi3OutPath = "templates/swagger/v1_openapi3_json.tmpl"
+
+	appSubUrlVar = "{{.SwaggerAppSubUrl}}"
+	appVerVar    = "{{.SwaggerAppVer}}"
+
+	appSubUrlPlaceholder = "GITEA_APP_SUB_URL_PLACEHOLDER"
+	appVerPlaceholder    = "0.0.0-gitea-placeholder"
 )

-var enumScanDirs = []string{
-	"modules/structs",
-	"modules/commitstatus",
-}
+var (
+	appSubUrlRe = regexp.MustCompile(regexp.QuoteMeta(appSubUrlVar))
+	appVerRe    = regexp.MustCompile(regexp.QuoteMeta(appVerVar))
+
+	enumScanDirs = []string{
+		"modules/structs",
+		"modules/commitstatus",
+	}
+)

 func main() {
 	astEnumMap, err := openapi3gen.ScanSwaggerEnumTypes(enumScanDirs)
@@ -54,17 +68,28 @@ func main() {
 		log.Fatalf("reading swagger spec: %v", err)
 	}

-	oas3, err := openapi3gen.Convert(data, astEnumMap)
+	cleaned := appSubUrlRe.ReplaceAll(data, []byte(appSubUrlPlaceholder))
+	cleaned = appVerRe.ReplaceAll(cleaned, []byte(appVerPlaceholder))
+
+	oas3, err := openapi3gen.Convert(cleaned, astEnumMap)
 	if err != nil {
 		log.Fatalf("converting to openapi 3.0: %v", err)
 	}

+	oas3.Servers = openapi3.Servers{
+		{URL: appSubUrlPlaceholder + "/api/v1"},
+	}
+
 	out, err := json.MarshalIndent(oas3, "", "  ")
 	if err != nil {
 		log.Fatalf("marshaling openapi 3.0: %v", err)
 	}

-	if err := os.WriteFile(openapi3OutPath, out, 0o644); err != nil {
+	result := strings.ReplaceAll(string(out), appSubUrlPlaceholder, appSubUrlVar)
+	result = strings.ReplaceAll(result, appVerPlaceholder, appVerVar)
+	result = strings.TrimSpace(result)
+
+	if err := os.WriteFile(openapi3OutPath, []byte(result), 0o644); err != nil {
 		log.Fatalf("writing openapi 3.0 spec: %v", err)
 	}

@@ -23,8 +23,8 @@ import (
 var rxDeprecated = regexp.MustCompile(`(?i)(?:^|[\n.;])\s*deprecated\b`)

 // Convert parses a Swagger 2.0 spec and returns an OAS3 spec, applying
-// Gitea-specific post-processing: server URL, file-schema fixups, URI
-// formats, deprecated flags, and shared-enum extraction.
+// Gitea-specific post-processing: file-schema fixups, URI formats,
+// deprecated flags, and shared-enum extraction.
 //
 // astEnumMap is a value-set-key → Go-type-name(s) map (built by
 // ScanSwaggerEnumTypes). When a value set is shared by multiple Go types,
@@ -42,7 +42,6 @@ func Convert(swaggerJSON []byte, astEnumMap map[string][]string) (*openapi3.T, e
 		return nil, fmt.Errorf("converting to openapi 3.0: %w", err)
 	}

-	oas3.Servers = openapi3.Servers{{URL: swagger2.BasePath}}
 	fixFileSchemas(oas3)
 	addURIFormats(oas3)
 	addDeprecatedFlags(oas3)
@@ -11,6 +11,7 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
 	"gitea.dev/modules/log"
 	repo_module "gitea.dev/modules/repository"

@@ -127,8 +128,8 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 		}
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
-			log.Trace("Synchronizing repo %s", repo.FullName())
-			gitRepo, err := git.OpenRepository(ctx, repo)
+			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RelativePath())
+			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
 				continue
@@ -354,10 +354,13 @@ func findLdapSecurityProtocolByName(name string) (ldap.SecurityProtocol, bool) {
 	return 0, false
 }

-// getAuthSourceOfType gets the login source by id.
-// It returns an error if the id does not match any source or if the source is not of the expected type.
-func (a *authService) getAuthSourceOfType(ctx context.Context, id int64, authType auth.Type) (*auth.Source, error) {
-	authSource, err := a.getAuthSourceByID(ctx, id)
+// getAuthSource gets the login source by its id defined in the command line flags.
+// It returns an error if the id is not set, does not match any source or if the source is not of expected type.
+func (a *authService) getAuthSource(ctx context.Context, c *cli.Command, authType auth.Type) (*auth.Source, error) {
+	if err := argsSet(c, "id"); err != nil {
+		return nil, err
+	}
+	authSource, err := a.getAuthSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return nil, err
 	}
@@ -369,15 +372,6 @@ func (a *authService) getAuthSourceOfType(ctx context.Context, id int64, authTyp
 	return authSource, nil
 }

-// getAuthSource gets the login source by its id defined in the command line flags.
-// It returns an error if the id is not set, does not match any source or if the source is not of expected type.
-func (a *authService) getAuthSource(ctx context.Context, c *cli.Command, authType auth.Type) (*auth.Source, error) {
-	if err := argsSet(c, "id"); err != nil {
-		return nil, err
-	}
-	return a.getAuthSourceOfType(ctx, c.Int64("id"), authType)
-}
-
 // addLdapBindDn adds a new LDAP via Bind DN authentication source.
 func (a *authService) addLdapBindDn(ctx context.Context, c *cli.Command) error {
 	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-search-base", "user-filter", "email-attribute"); err != nil {
@@ -387,17 +381,16 @@ func (a *authService) addLdapBindDn(ctx context.Context, c *cli.Command) error {
 		return err
 	}

-	ldapConfig := &ldap.Source{
-		Enabled: true, // always true
-	}
 	authSource := &auth.Source{
 		Type:     auth.LDAP,
 		IsActive: true, // active by default
-		Cfg:      ldapConfig,
+		Cfg: &ldap.Source{
+			Enabled: true, // always true
+		},
 	}

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -414,10 +407,9 @@ func (a *authService) updateLdapBindDn(ctx context.Context, c *cli.Command) erro
 	if err != nil {
 		return err
 	}
-	ldapConfig := auth.MustSourceCfg[*ldap.Source](authSource)

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -434,17 +426,16 @@ func (a *authService) addLdapSimpleAuth(ctx context.Context, c *cli.Command) err
 		return err
 	}

-	ldapConfig := &ldap.Source{
-		Enabled: true, // always true
-	}
 	authSource := &auth.Source{
 		Type:     auth.DLDAP,
 		IsActive: true, // active by default
-		Cfg:      ldapConfig,
+		Cfg: &ldap.Source{
+			Enabled: true, // always true
+		},
 	}

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -461,10 +452,9 @@ func (a *authService) updateLdapSimpleAuth(ctx context.Context, c *cli.Command)
 	if err != nil {
 		return err
 	}
-	ldapConfig := auth.MustSourceCfg[*ldap.Source](authSource)

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -221,11 +221,12 @@ func (a *authService) runUpdateOauth(ctx context.Context, c *cli.Command) error
 		return err
 	}

-	source, err := a.getAuthSourceOfType(ctx, c.Int64("id"), auth_model.OAuth2)
+	source, err := a.getAuthSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return err
 	}
-	oAuth2Config := auth_model.MustSourceCfg[*oauth2.Source](source)
+
+	oAuth2Config := source.Cfg.(*oauth2.Source)

 	if c.IsSet("name") {
 		source.Name = c.String("name")
@@ -175,11 +175,12 @@ func (a *authService) runUpdateSMTP(ctx context.Context, c *cli.Command) error {
 		return err
 	}

-	source, err := a.getAuthSourceOfType(ctx, c.Int64("id"), auth_model.SMTP)
+	source, err := a.getAuthSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return err
 	}
-	smtpConfig := auth_model.MustSourceCfg[*smtp.Source](source)
+
+	smtpConfig := source.Cfg.(*smtp.Source)

 	if err := parseSMTPConfig(c, smtpConfig); err != nil {
 		return err
@@ -18,7 +18,6 @@ func newUserCommand() *cli.Command {
 			microcmdUserDelete(),
 			newUserGenerateAccessTokenCommand(),
 			microcmdUserMustChangePassword(),
-			microcmdUserDisableTwoFactor(),
 		},
 	}
 }
@@ -1,72 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-
-	auth_model "gitea.dev/models/auth"
-	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/setting"
-
-	"github.com/urfave/cli/v3"
-)
-
-func microcmdUserDisableTwoFactor() *cli.Command {
-	return &cli.Command{
-		Name:  "disable-2fa",
-		Usage: "Disable two-factor authentication for a user",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "username",
-				Aliases: []string{"u"},
-				Usage:   "Username of the user to disable 2FA for",
-			},
-			&cli.Int64Flag{
-				Name:  "id",
-				Usage: "ID of the user to disable 2FA for",
-			},
-		},
-		Action: runDisableTwoFactor,
-	}
-}
-
-func runDisableTwoFactor(ctx context.Context, c *cli.Command) error {
-	if !c.IsSet("id") && !c.IsSet("username") {
-		return errors.New("either --id or --username must be provided")
-	}
-
-	if !setting.IsInTesting {
-		if err := initDB(ctx); err != nil {
-			return err
-		}
-	}
-
-	var user *user_model.User
-	var err error
-	if c.IsSet("id") {
-		user, err = user_model.GetUserByID(ctx, c.Int64("id"))
-	} else {
-		user, err = user_model.GetUserByName(ctx, c.String("username"))
-	}
-	if err != nil {
-		return err
-	}
-
-	// When both selectors are given, make sure they refer to the same user.
-	if c.IsSet("id") && c.IsSet("username") && user.LowerName != strings.ToLower(strings.TrimSpace(c.String("username"))) {
-		return fmt.Errorf("the user with id %d is %q, which does not match the provided username %q", user.ID, user.Name, c.String("username"))
-	}
-
-	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, user.ID)
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("Disabled 2FA for user %q (removed %d TOTP and %d WebAuthn credential(s))\n", user.Name, totp, webAuthn)
-	return nil
-}
@@ -1,119 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"io"
-	"strconv"
-	"testing"
-
-	auth_model "gitea.dev/models/auth"
-	"gitea.dev/models/db"
-	"gitea.dev/models/unittest"
-	user_model "gitea.dev/models/user"
-
-	"github.com/go-webauthn/webauthn/webauthn"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDisableTwoFactorCommand(t *testing.T) {
-	ctx := t.Context()
-
-	defer func() {
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}, &auth_model.TwoFactor{}, &auth_model.WebAuthnCredential{}))
-	}()
-
-	t.Run("disable TOTP and WebAuthn", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "tfuser", "--email", "tfuser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "tfuser"})
-
-		// Enroll TOTP.
-		tf := &auth_model.TwoFactor{UID: user.ID}
-		require.NoError(t, tf.SetSecret("test-secret"))
-		_, err := tf.GenerateScratchToken()
-		require.NoError(t, err)
-		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
-
-		// Register a WebAuthn credential.
-		_, err = auth_model.CreateCredential(ctx, user.ID, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
-		require.NoError(t, err)
-
-		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		require.True(t, has)
-
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "tfuser"}))
-
-		// Both factors must be gone afterwards.
-		has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		assert.False(t, has)
-	})
-
-	t.Run("disable by id", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "iduser", "--email", "iduser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "iduser"})
-
-		tf := &auth_model.TwoFactor{UID: user.ID}
-		require.NoError(t, tf.SetSecret("test-secret"))
-		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
-
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", strconv.FormatInt(user.ID, 10)}))
-
-		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		assert.False(t, has)
-	})
-
-	t.Run("no enrollment is a no-op", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "plainuser", "--email", "plainuser@gitea.local", "--random-password"}))
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "plainuser"}))
-	})
-
-	t.Run("id and username must match when both given", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "matchuser", "--email", "matchuser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "matchuser"})
-		id := strconv.FormatInt(user.ID, 10)
-
-		// Matching id + username is accepted.
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", id, "--username", "matchuser"}))
-
-		// Mismatched id + username is rejected.
-		cmd := microcmdUserDisableTwoFactor()
-		cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
-		err := cmd.Run(ctx, []string{"disable-2fa", "--id", id, "--username", "someotheruser"})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "does not match the provided username")
-	})
-
-	t.Run("failure cases", func(t *testing.T) {
-		testCases := []struct {
-			name        string
-			args        []string
-			expectedErr string
-		}{
-			{
-				name:        "user does not exist",
-				args:        []string{"disable-2fa", "--username", "nonexistentuser"},
-				expectedErr: "user does not exist",
-			},
-			{
-				name:        "neither id nor username",
-				args:        []string{"disable-2fa"},
-				expectedErr: "either --id or --username must be provided",
-			},
-		}
-
-		for _, tc := range testCases {
-			t.Run(tc.name, func(t *testing.T) {
-				cmd := microcmdUserDisableTwoFactor()
-				cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
-				err := cmd.Run(ctx, tc.args)
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tc.expectedErr)
-			})
-		}
-	})
-}
@@ -12,9 +12,9 @@ import (
 	"strings"
 	"text/tabwriter"

-	"gitea.dev/modelmigration"
-	"gitea.dev/modelmigration/base"
 	"gitea.dev/models/db"
+	"gitea.dev/models/migrations"
+	migrate_base "gitea.dev/models/migrations/base"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -129,10 +129,10 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	if err != nil {
 		return err
 	}
-	recreateTables := base.RecreateTables(beans...)
+	recreateTables := migrate_base.RecreateTables(beans...)

 	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x db.EngineMigration) error {
-		if err := modelmigration.EnsureUpToDate(ctx, x); err != nil {
+		if err := migrations.EnsureUpToDate(ctx, x); err != nil {
 			return err
 		}
 		return recreateTables(x)
@@ -198,7 +198,7 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 		}
 		defer func() {
 			_ = dbDump.Close()
-			if err := os.Remove(dbDump.Name()); err != nil {
+			if err := util.Remove(dbDump.Name()); err != nil {
 				log.Warn("Unable to remove temporary file: %s: Error: %v", dbDump.Name(), err)
 			}
 		}()
@@ -18,6 +18,7 @@ import (
 	"gitea.dev/modules/public"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"

 	"github.com/urfave/cli/v3"
 )
@@ -254,7 +255,7 @@ func extractAsset(d string, a assetFile, overwrite, rename bool) error {
 	} else if !fi.Mode().IsRegular() {
 		return fmt.Errorf("%s already exists, but it's not a regular file", dest)
 	} else if rename {
-		if err := os.Rename(dest, dest+".bak"); err != nil {
+		if err := util.Rename(dest, dest+".bak"); err != nil {
 			return fmt.Errorf("error creating backup for %s: %w", dest, err)
 		}
 		// Attempt to respect file permissions mask (even if user:group will be set anew)
@@ -201,27 +201,35 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		return fail(ctx, "Too few arguments", "Too few arguments in cmd: %s", cmd)
 	}

-	var reqOwnerName, reqRepoName string
-	{
-		var ok bool
-		reqRepoPath := strings.TrimPrefix(sshCmdArgs[1], "/")
-		reqOwnerName, reqRepoName, ok = strings.Cut(reqRepoPath, "/")
-		if !ok {
-			return fail(ctx, "Invalid repository path", "Invalid repository path: %v", reqRepoPath)
-		}
-		reqRepoName = strings.TrimSuffix(reqRepoName, ".git") // "the-repo-name" or "the-repo-name.wiki"
+	repoPath := strings.TrimPrefix(sshCmdArgs[1], "/")
+	repoPathFields := strings.SplitN(repoPath, "/", 2)
+	if len(repoPathFields) != 2 {
+		return fail(ctx, "Invalid repository path", "Invalid repository path: %v", repoPath)
 	}

-	if !repo_model.IsValidSSHAccessRepoName(reqRepoName) {
-		return fail(ctx, "Invalid repo name", "Invalid repo name: %s", reqRepoName)
+	username := repoPathFields[0]
+	reponame := strings.TrimSuffix(repoPathFields[1], ".git") // “the-repo-name" or "the-repo-name.wiki"
+
+	if !repo_model.IsValidSSHAccessRepoName(reponame) {
+		return fail(ctx, "Invalid repo name", "Invalid repo name: %s", reponame)
 	}

 	if c.Bool("enable-pprof") {
-		stopProfiler, err := pprof.DumpPprofForUsername(setting.PprofDataPath, reqOwnerName)
-		if err != nil {
-			return fail(ctx, "Unable to start pprof profiler", "Unable to start pprof profile: %v", err)
+		if err := os.MkdirAll(setting.PprofDataPath, os.ModePerm); err != nil {
+			return fail(ctx, "Error while trying to create PPROF_DATA_PATH", "Error while trying to create PPROF_DATA_PATH: %v", err)
 		}
-		defer stopProfiler()
+
+		stopCPUProfiler, err := pprof.DumpCPUProfileForUsername(setting.PprofDataPath, username)
+		if err != nil {
+			return fail(ctx, "Unable to start CPU profiler", "Unable to start CPU profile: %v", err)
+		}
+		defer func() {
+			stopCPUProfiler()
+			err := pprof.DumpMemProfileForUsername(setting.PprofDataPath, username)
+			if err != nil {
+				_ = fail(ctx, "Unable to dump Mem profile", "Unable to dump Mem Profile: %v", err)
+			}
+		}()
 	}

 	verb, lfsVerb := sshCmdArgs[0], ""
@@ -246,29 +254,30 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		return fail(ctx, "Unknown git command", "Unknown git command %s %s", verb, lfsVerb)
 	}

-	results, extra := private.ServCommand(ctx, keyID, reqOwnerName, reqRepoName, requestedMode, verb, lfsVerb)
+	results, extra := private.ServCommand(ctx, keyID, username, reponame, requestedMode, verb, lfsVerb)
 	if extra.HasError() {
 		return fail(ctx, extra.UserMsg, "ServCommand failed: %s", extra.Error)
 	}

+	// because the original repoPath maybe redirected, we need to use the returned actual repository information
+	if results.IsWiki {
+		repoPath = repo_model.RelativeWikiPath(results.OwnerName, results.RepoName)
+	} else {
+		repoPath = repo_model.RelativePath(results.OwnerName, results.RepoName)
+	}
+
 	// LFS SSH protocol
 	if verb == git.CmdVerbLfsTransfer {
-		if results.IsWiki {
-			return fail(ctx, "LFS Transfer is not supported for wikis", "")
-		}
 		token, err := lfs.GetLFSAuthTokenWithBearer(lfs.AuthTokenOptions{Op: lfsVerb, UserID: results.UserID, RepoID: results.RepoID})
 		if err != nil {
 			return err
 		}
-		return lfstransfer.Main(ctx, results.OwnerName, results.RepoName, lfsVerb, token)
+		return lfstransfer.Main(ctx, repoPath, lfsVerb, token)
 	}

 	// LFS token authentication
 	if verb == git.CmdVerbLfsAuthenticate {
-		if results.IsWiki {
-			return fail(ctx, "LFS Authenticate is not supported for wikis", "")
-		}
-		lfsTokenHref := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, url.PathEscape(results.OwnerName), url.PathEscape(results.RepoName))
+		url := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, url.PathEscape(results.OwnerName), url.PathEscape(results.RepoName))

 		token, err := lfs.GetLFSAuthTokenWithBearer(lfs.AuthTokenOptions{Op: lfsVerb, UserID: results.UserID, RepoID: results.RepoID})
 		if err != nil {
@@ -277,7 +286,7 @@ func runServ(ctx context.Context, c *cli.Command) error {

 		tokenAuthentication := &git_model.LFSTokenResponse{
 			Header: make(map[string]string),
-			Href:   lfsTokenHref,
+			Href:   url,
 		}
 		tokenAuthentication.Header["Authorization"] = token

@@ -298,12 +307,12 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		verbFields := strings.SplitN(verb, "-", 2)
 		if len(verbFields) == 2 {
 			// use git binary with the sub-command part: "C:\...\bin\git.exe", "upload-pack", ...
-			command = exec.CommandContext(ctx, gitcmd.GitExecutable, verbFields[1], results.RepoStoragePath)
+			command = exec.CommandContext(ctx, gitcmd.GitExecutable, verbFields[1], repoPath)
 		}
 	}
 	if command == nil {
 		// by default, use the verb (it has been checked above by allowedCommands)
-		command = exec.CommandContext(ctx, gitBinVerb, results.RepoStoragePath)
+		command = exec.CommandContext(ctx, gitBinVerb, repoPath)
 	}

 	process.SetSysProcAttribute(command)
@@ -244,8 +244,7 @@ func servePprof() {
 	_, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true)
 	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it.
 	log.Info("Starting pprof server on localhost:6060")
-	server := &http.Server{Addr: "localhost:6060", Handler: mux, ReadHeaderTimeout: 10 * time.Second}
-	log.Info("Stopped pprof server: %v", server.ListenAndServe())
+	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", mux))
 	finished()
 }

@@ -6,7 +6,6 @@ package cmd
 import (
 	"crypto/x509"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -94,25 +93,31 @@ func runACME(listenAddr string, m http.Handler) error {
 	myACME := certmagic.NewACMEIssuer(magic, certmagic.DefaultACME)
 	magic.Issuers = []certmagic.Issuer{myACME}

-	// Obtain certificates or renew them if necessary. ManageSync fails closed on
-	// renewal errors even when a still-valid certificate is already on disk, which
-	// takes HTTPS down on restart (https://github.com/go-gitea/gitea/issues/38519).
-	// Prefer keeping the existing cert and retrying renewals asynchronously.
-	ctx := graceful.GetManager().ShutdownContext()
-	err := magic.ManageSync(ctx, []string{setting.Domain})
+	// this obtains certificates or renews them if necessary
+	err := magic.ManageSync(graceful.GetManager().HammerContext(), []string{setting.Domain})
 	if err != nil {
-		cert, cacheErr := magic.CacheManagedCertificate(ctx, setting.Domain)
-		if cacheErr != nil || cert.Expired() {
-			return errors.Join(err, cacheErr)
-		}
-		log.Error("ACME certificate manage failed; continuing with existing certificate: %v", err)
-		if err := magic.ManageAsync(ctx, []string{setting.Domain}); err != nil {
-			log.Error("Failed to start async ACME management: %v", err)
-		}
+		return err
 	}

-	// certmagic only advertises its own ACME challenge protocol, applyTLSSettings appends ours
-	tlsConfig := applyTLSSettings(magic.TLSConfig())
+	tlsConfig := magic.TLSConfig()
+	tlsConfig.NextProtos = append(tlsConfig.NextProtos, "h2")
+
+	if version := toTLSVersion(setting.SSLMinimumVersion); version != 0 {
+		tlsConfig.MinVersion = version
+	}
+	if version := toTLSVersion(setting.SSLMaximumVersion); version != 0 {
+		tlsConfig.MaxVersion = version
+	}
+
+	// Set curve preferences
+	if curves := toCurvePreferences(setting.SSLCurvePreferences); len(curves) > 0 {
+		tlsConfig.CurvePreferences = curves
+	}
+
+	// Set cipher suites
+	if ciphers := toTLSCiphers(setting.SSLCipherSuites); len(ciphers) > 0 {
+		tlsConfig.CipherSuites = ciphers
+	}

 	if enableHTTPChallenge {
 		go func() {
@@ -12,81 +12,122 @@ import (
 	"gitea.dev/modules/graceful"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
+
+	"github.com/klauspost/cpuid/v2"
 )

 var tlsVersionStringMap = map[string]uint16{
+	"":        tls.VersionTLS12, // Default to tls.VersionTLS12
 	"tlsv1.0": tls.VersionTLS10,
 	"tlsv1.1": tls.VersionTLS11,
 	"tlsv1.2": tls.VersionTLS12,
 	"tlsv1.3": tls.VersionTLS13,
 }

-// toTLSVersion returns 0 when unset or unknown, which keeps the crypto/tls default
 func toTLSVersion(version string) uint16 {
-	version = strings.TrimSpace(strings.ToLower(version))
-	tlsVersion, ok := tlsVersionStringMap[version]
-	if !ok && version != "" {
+	tlsVersion, ok := tlsVersionStringMap[strings.TrimSpace(strings.ToLower(version))]
+	if !ok {
 		log.Warn("Unknown tls version: %s", version)
+		return 0
 	}
 	return tlsVersion
 }

 var curveStringMap = map[string]tls.CurveID{
-	"x25519":             tls.X25519,
-	"p256":               tls.CurveP256,
-	"p384":               tls.CurveP384,
-	"p521":               tls.CurveP521,
-	"x25519mlkem768":     tls.X25519MLKEM768,
-	"secp256r1mlkem768":  tls.SecP256r1MLKEM768,
-	"secp384r1mlkem1024": tls.SecP384r1MLKEM1024,
+	"x25519": tls.X25519,
+	"p256":   tls.CurveP256,
+	"p384":   tls.CurveP384,
+	"p521":   tls.CurveP521,
 }

-// lookupAll resolves configured names, warning about and skipping the ones crypto/tls does not know
-func lookupAll[T comparable](names []string, table map[string]T, kind string) []T {
-	values := make([]T, 0, len(names))
-	for _, name := range names {
-		value, ok := table[strings.TrimSpace(strings.ToLower(name))]
+func toCurvePreferences(preferences []string) []tls.CurveID {
+	ids := make([]tls.CurveID, 0, len(preferences))
+	for _, pref := range preferences {
+		id, ok := curveStringMap[strings.TrimSpace(strings.ToLower(pref))]
 		if !ok {
-			log.Warn("Unknown %s: %s", kind, name)
-			continue
+			log.Warn("Unknown curve: %s", pref)
+		}
+		if id != 0 {
+			ids = append(ids, id)
 		}
-		values = append(values, value)
 	}
-	return values
+	return ids
 }

-// cipherStringMap is derived from crypto/tls so that suites Go adds or removes are picked up automatically
-var cipherStringMap = buildCipherStringMap()
+var cipherStringMap = map[string]uint16{
+	"rsa_with_rc4_128_sha":                      tls.TLS_RSA_WITH_RC4_128_SHA,
+	"rsa_with_3des_ede_cbc_sha":                 tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+	"rsa_with_aes_128_cbc_sha":                  tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+	"rsa_with_aes_256_cbc_sha":                  tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+	"rsa_with_aes_128_cbc_sha256":               tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
+	"rsa_with_aes_128_gcm_sha256":               tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+	"rsa_with_aes_256_gcm_sha384":               tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+	"ecdhe_ecdsa_with_rc4_128_sha":              tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+	"ecdhe_ecdsa_with_aes_128_cbc_sha":          tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+	"ecdhe_ecdsa_with_aes_256_cbc_sha":          tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+	"ecdhe_rsa_with_rc4_128_sha":                tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
+	"ecdhe_rsa_with_3des_ede_cbc_sha":           tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+	"ecdhe_rsa_with_aes_128_cbc_sha":            tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+	"ecdhe_rsa_with_aes_256_cbc_sha":            tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+	"ecdhe_ecdsa_with_aes_128_cbc_sha256":       tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+	"ecdhe_rsa_with_aes_128_cbc_sha256":         tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+	"ecdhe_rsa_with_aes_128_gcm_sha256":         tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	"ecdhe_ecdsa_with_aes_128_gcm_sha256":       tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	"ecdhe_rsa_with_aes_256_gcm_sha384":         tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+	"ecdhe_ecdsa_with_aes_256_gcm_sha384":       tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+	"ecdhe_rsa_with_chacha20_poly1305_sha256":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+	"ecdhe_ecdsa_with_chacha20_poly1305_sha256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+	"ecdhe_rsa_with_chacha20_poly1305":          tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+	"ecdhe_ecdsa_with_chacha20_poly1305":        tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+	"aes_128_gcm_sha256":                        tls.TLS_AES_128_GCM_SHA256,
+	"aes_256_gcm_sha384":                        tls.TLS_AES_256_GCM_SHA384,
+	"chacha20_poly1305_sha256":                  tls.TLS_CHACHA20_POLY1305_SHA256,
+}

-func buildCipherStringMap() map[string]uint16 {
-	ciphers := map[string]uint16{
-		// aliases for the two suites Go later renamed with a _SHA256 suffix
-		"ecdhe_rsa_with_chacha20_poly1305":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-		"ecdhe_ecdsa_with_chacha20_poly1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-	}
-	for _, cipher := range append(tls.CipherSuites(), tls.InsecureCipherSuites()...) {
-		ciphers[strings.ToLower(strings.TrimPrefix(cipher.Name, "TLS_"))] = cipher.ID
+func toTLSCiphers(cipherStrings []string) []uint16 {
+	ciphers := make([]uint16, 0, len(cipherStrings))
+	for _, cipherString := range cipherStrings {
+		cipher, ok := cipherStringMap[strings.TrimSpace(strings.ToLower(cipherString))]
+		if !ok {
+			log.Warn("Unknown cipher: %s", cipherString)
+		}
+		if cipher != 0 {
+			ciphers = append(ciphers, cipher)
+		}
 	}
+
 	return ciphers
 }

-// applyTLSSettings applies the configured [server] TLS options. Every option
-// left unset keeps the crypto/tls default, which Go keeps current.
-func applyTLSSettings(tlsConfig *tls.Config) *tls.Config {
-	// the listener is already TLS wrapped when it reaches http.Server, so it never sets ALPN for us
-	tlsConfig.NextProtos = append(tlsConfig.NextProtos, "h2", "http/1.1")
-	tlsConfig.MinVersion = toTLSVersion(setting.SSLMinimumVersion)
-	tlsConfig.MaxVersion = toTLSVersion(setting.SSLMaximumVersion)
-
-	if curves := lookupAll(setting.SSLCurvePreferences, curveStringMap, "curve"); len(curves) > 0 {
-		tlsConfig.CurvePreferences = curves
+// defaultCiphers uses hardware support to check if AES is specifically
+// supported by the CPU.
+//
+// If AES is supported AES ciphers will be preferred over ChaCha based ciphers
+// (This code is directly inspired by the certmagic code.)
+func defaultCiphers() []uint16 {
+	if cpuid.CPU.Supports(cpuid.AESNI) {
+		return defaultCiphersAESfirst
 	}
-	if ciphers := lookupAll(setting.SSLCipherSuites, cipherStringMap, "cipher suite"); len(ciphers) > 0 {
-		tlsConfig.CipherSuites = ciphers
-	}
-	return tlsConfig
+	return defaultCiphersChaChaFirst
 }

+var (
+	defaultCiphersAES = []uint16{
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	}
+
+	defaultCiphersChaCha = []uint16{
+		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+	}
+
+	defaultCiphersAESfirst    = append(defaultCiphersAES, defaultCiphersChaCha...)
+	defaultCiphersChaChaFirst = append(defaultCiphersChaCha, defaultCiphersAES...)
+)
+
 // runHTTPS listens on the provided network address and then calls
 // Serve to handle requests on incoming TLS connections.
 //
@@ -95,7 +136,33 @@ func applyTLSSettings(tlsConfig *tls.Config) *tls.Config {
 // certFile should be the concatenation of the server's certificate followed by the
 // CA's certificate.
 func runHTTPS(network, listenAddr, name, certFile, keyFile string, m http.Handler, useProxyProtocol, proxyProtocolTLSBridging bool) error {
-	tlsConfig := applyTLSSettings(&tls.Config{})
+	tlsConfig := &tls.Config{}
+	if tlsConfig.NextProtos == nil {
+		tlsConfig.NextProtos = []string{"h2", "http/1.1"}
+	}
+
+	if version := toTLSVersion(setting.SSLMinimumVersion); version != 0 {
+		tlsConfig.MinVersion = version
+	}
+	if version := toTLSVersion(setting.SSLMaximumVersion); version != 0 {
+		tlsConfig.MaxVersion = version
+	}
+
+	// Set curve preferences
+	tlsConfig.CurvePreferences = []tls.CurveID{
+		tls.X25519,
+		tls.CurveP256,
+	}
+	if curves := toCurvePreferences(setting.SSLCurvePreferences); len(curves) > 0 {
+		tlsConfig.CurvePreferences = curves
+	}
+
+	// Set cipher suites
+	tlsConfig.CipherSuites = defaultCiphers()
+	if ciphers := toTLSCiphers(setting.SSLCipherSuites); len(ciphers) > 0 {
+		tlsConfig.CipherSuites = ciphers
+	}
+
 	tlsConfig.Certificates = make([]tls.Certificate, 1)

 	certPEMBlock, err := os.ReadFile(certFile)
@@ -1,109 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"crypto/tls"
-	"math"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"gitea.dev/modules/setting"
-	"gitea.dev/modules/test"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestToTLSVersion(t *testing.T) {
-	assert.Zero(t, toTLSVersion(""), "unset must keep the crypto/tls default")
-	assert.Zero(t, toTLSVersion("unknown"))
-	assert.Equal(t, uint16(tls.VersionTLS12), toTLSVersion(" TLSV1.2 "))
-}
-
-func unsetTLSSettings(t *testing.T) {
-	t.Helper()
-	t.Cleanup(test.MockVariableValue(&setting.SSLMinimumVersion, ""))
-	t.Cleanup(test.MockVariableValue(&setting.SSLMaximumVersion, ""))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCurvePreferences, nil))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCipherSuites, nil))
-}
-
-// TestApplyTLSSettingsUnsetKeepsGoDefaults guards against reintroducing hardcoded defaults,
-// which is how the server ended up capped at TLS 1.2 and without post-quantum key exchange.
-// It asserts the fields are left alone rather than which algorithms Go then picks, so a new
-// Go release changing its preferences does not fail this test.
-func TestApplyTLSSettingsUnsetKeepsGoDefaults(t *testing.T) {
-	unsetTLSSettings(t)
-
-	tlsConfig := applyTLSSettings(&tls.Config{})
-	assert.Zero(t, tlsConfig.MinVersion)
-	assert.Zero(t, tlsConfig.MaxVersion)
-	assert.Nil(t, tlsConfig.CurvePreferences)
-	assert.Nil(t, tlsConfig.CipherSuites)
-	assert.Equal(t, []string{"h2", "http/1.1"}, tlsConfig.NextProtos)
-}
-
-func TestApplyTLSSettingsConfigured(t *testing.T) {
-	t.Cleanup(test.MockVariableValue(&setting.SSLMinimumVersion, "tlsv1.2"))
-	t.Cleanup(test.MockVariableValue(&setting.SSLMaximumVersion, "tlsv1.3"))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCurvePreferences, []string{"p384"}))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCipherSuites, []string{"ecdhe_rsa_with_aes_256_gcm_sha384"}))
-
-	tlsConfig := applyTLSSettings(&tls.Config{})
-	assert.Equal(t, uint16(tls.VersionTLS12), tlsConfig.MinVersion)
-	assert.Equal(t, uint16(tls.VersionTLS13), tlsConfig.MaxVersion)
-	assert.Equal(t, []tls.CurveID{tls.CurveP384}, tlsConfig.CurvePreferences)
-	assert.Equal(t, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384}, tlsConfig.CipherSuites)
-}
-
-func TestHTTPSServesTLS13(t *testing.T) {
-	unsetTLSSettings(t)
-
-	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-	server.TLS = applyTLSSettings(&tls.Config{})
-	server.EnableHTTP2 = true
-	server.StartTLS()
-	defer server.Close()
-
-	conn, err := tls.Dial("tcp", strings.TrimPrefix(server.URL, "https://"), &tls.Config{InsecureSkipVerify: true})
-	require.NoError(t, err)
-	defer conn.Close()
-	assert.Equal(t, uint16(tls.VersionTLS13), conn.ConnectionState().Version)
-}
-
-// TestCurveStringMapCoversGoCurves fails when Go gains a curve the map does not name, so the
-// config vocabulary cannot silently go stale the way it did for the post-quantum key exchanges
-func TestCurveStringMapCoversGoCurves(t *testing.T) {
-	for id := range math.MaxUint16 + 1 {
-		name := tls.CurveID(id).String()
-		if strings.HasPrefix(name, "CurveID(") {
-			continue // crypto/tls has no name for this ID, so it supports no such curve
-		}
-		assert.Contains(t, curveStringMap, strings.TrimPrefix(strings.ToLower(name), "curve"), "curve %s", name)
-	}
-}
-
-// TestCipherStringMapCoversLegacyNames pins the names accepted before the map was derived
-// from crypto/tls, so no existing SSL_CIPHER_SUITES config silently stops resolving
-func TestCipherStringMapCoversLegacyNames(t *testing.T) {
-	for _, name := range []string{
-		"rsa_with_rc4_128_sha", "rsa_with_3des_ede_cbc_sha", "rsa_with_aes_128_cbc_sha",
-		"rsa_with_aes_256_cbc_sha", "rsa_with_aes_128_cbc_sha256", "rsa_with_aes_128_gcm_sha256",
-		"rsa_with_aes_256_gcm_sha384", "ecdhe_ecdsa_with_rc4_128_sha", "ecdhe_ecdsa_with_aes_128_cbc_sha",
-		"ecdhe_ecdsa_with_aes_256_cbc_sha", "ecdhe_rsa_with_rc4_128_sha", "ecdhe_rsa_with_3des_ede_cbc_sha",
-		"ecdhe_rsa_with_aes_128_cbc_sha", "ecdhe_rsa_with_aes_256_cbc_sha", "ecdhe_ecdsa_with_aes_128_cbc_sha256",
-		"ecdhe_rsa_with_aes_128_cbc_sha256", "ecdhe_rsa_with_aes_128_gcm_sha256", "ecdhe_ecdsa_with_aes_128_gcm_sha256",
-		"ecdhe_rsa_with_aes_256_gcm_sha384", "ecdhe_ecdsa_with_aes_256_gcm_sha384",
-		"ecdhe_rsa_with_chacha20_poly1305_sha256", "ecdhe_ecdsa_with_chacha20_poly1305_sha256",
-		"ecdhe_rsa_with_chacha20_poly1305", "ecdhe_ecdsa_with_chacha20_poly1305",
-		"aes_128_gcm_sha256", "aes_256_gcm_sha384", "chacha20_poly1305_sha256",
-	} {
-		assert.NotZero(t, cipherStringMap[name], "cipher %q", name)
-	}
-}
@@ -112,17 +112,15 @@
 ;;
 ;; expect PROXY protocol header on connections to https redirector, defaults to USE_PROXY_PROTOCOL
 ;REDIRECTOR_USE_PROXY_PROTOCOL =
-;; Minimum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
-;SSL_MIN_VERSION=
-;;
-;; Maximum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
+;; Minimum and maximum supported TLS versions
+;SSL_MIN_VERSION=TLSv1.2
 ;SSL_MAX_VERSION=
 ;;
-;; Comma-separated list of SSL curve preferences. Unset uses Go's default.
-;SSL_CURVE_PREFERENCES=
+;; SSL Curve Preferences
+;SSL_CURVE_PREFERENCES=X25519,P256
 ;;
-;; Comma-separated list of SSL cipher suites. Unset uses Go's default.
-;SSL_CIPHER_SUITES=
+;; SSL Cipher Suites
+;SSL_CIPHER_SUITES=; Will default to "ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305" if aes is supported by hardware, otherwise chacha will be first.
 ;;
 ;; Timeout for any write to the connection. (Set to -1 to disable all timeouts.)
 ;PER_WRITE_TIMEOUT = 30s
@@ -538,13 +536,6 @@ INTERNAL_TOKEN =
 ;; Leave it empty to apply the default policy, or set it to "unset" to disable Content-Security-Policy.
 ;CONTENT_SECURITY_POLICY_GENERAL =

-;; Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
-;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
-;; CIDR list: 1.2.3.0/8, 2001:db8::/32
-;; Wildcard hosts: *.mydomain.com, 192.168.100.*
-;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
-;ALLOWED_HOST_LIST = external
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [camo]
@@ -608,8 +599,7 @@ ENABLED = true
 ;; * https://github.com/hickford/git-credential-oauth
 ;; * https://github.com/git-ecosystem/git-credential-manager
 ;; * https://gitea.com/gitea/tea
-;; * Gitea App (the official Gitea mobile app)
-;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app
+;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea
 ;;
 ;; By default, OAuth2 applications can only use "http" and "https" as their redirect URI schemes.
 ;; If you need to use other schemes (e.g. for desktop applications), you can specify them here as a comma-separated list.
@@ -1112,9 +1102,6 @@ LEVEL = Info
 ;; The default branch name of new repositories
 ;DEFAULT_BRANCH = main
 ;;
-;; The default Git object format of new repositories. Available values: sha1, sha256.
-;DEFAULT_OBJECT_FORMAT = sha1
-;;
 ;; Allow adoption of unadopted repositories
 ;ALLOW_ADOPTION_OF_UNADOPTED_REPOSITORIES = false
 ;;
@@ -1204,7 +1191,6 @@ LEVEL = Info
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
-;; "branch-name" always uses the PR's branch name.
 ;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
@@ -1318,21 +1304,6 @@ LEVEL = Info
 ;PROJECT_BOARD_BASIC_KANBAN_TYPE = To Do, In Progress, Done
 ;PROJECT_BOARD_BUG_TRIAGE_TYPE = Needs Triage, High Priority, Low Priority, Closed

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[websocket]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;
-;; Backend used to fan out websocket events (notification count, stopwatch, logout).
-;; "memory" works for a single process, use "redis" when running multiple Gitea processes.
-;PUBSUB_TYPE = memory
-;;
-;; Redis connection string, used when PUBSUB_TYPE = redis
-;; e.g. redis://127.0.0.1:6379/0
-;; When PUBSUB_TYPE is `redis` and this is left empty, it falls back to the shared [redis] CONN_STR.
-;PUBSUB_CONN_STR =
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[cors]
@@ -1492,6 +1463,10 @@ LEVEL = Info
 ;MIN_TIMEOUT = 10s
 ;MAX_TIMEOUT = 60s
 ;TIMEOUT_STEP = 10s
+;;
+;; This setting determines how often the db is queried to get the latest notification counts.
+;; If the browser client supports EventSource and SharedWorker, a SharedWorker will be used in preference to polling notification. Set to -1 to disable the EventSource
+;EVENT_SOURCE_UPDATE_TIME = 10s

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1620,19 +1595,6 @@ LEVEL = Info
 ;; If you'd like to enable it, you can set it to a value between 0 and 2.
 ;TYPE_BLEVE_MAX_FUZZINESS = 0

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[redis]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;
-;; Shared redis connection, used as the default for every redis-backed subsystem
-;; (cache, session, queue, global lock, etc.) whose own connection string is left empty.
-;; A per-subsystem connection value always takes precedence over this shared default.
-;; When left empty, each subsystem keeps its previous behavior (no shared default).
-;; e.g. `redis://127.0.0.1:6379/0` (or `redis+cluster://127.0.0.1:6379/0` for a Redis cluster)
-;CONN_STR =
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[queue]
@@ -1658,10 +1620,10 @@ LEVEL = Info
 ;; Batch size to send for batched queues
 ;BATCH_LENGTH = 20
 ;;
+;; Connection string for redis queues this will store the redis (or Redis cluster) connection string.
 ;; When `TYPE` is `persistable-channel`, this provides a directory for the underlying leveldb
 ;; or additional options of the form `leveldb://path/to/db?option=value&....`, and will override `DATADIR`.
-;; When `TYPE` is `redis` and this is left empty, it falls back to the shared [redis] CONN_STR.
-;CONN_STR =
+;CONN_STR = "redis://127.0.0.1:6379/0"
 ;;
 ;; Provides the suffix of the default redis/disk queue name - specific queues can be overridden within in their [queue.name] sections.
 ;QUEUE_NAME = "_queue"
@@ -1792,6 +1754,13 @@ LEVEL = Info
 ;; Deliver timeout in seconds
 ;DELIVER_TIMEOUT = 5
 ;;
+;; Webhook can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
+;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
+;; CIDR list: 1.2.3.0/8, 2001:db8::/32
+;; Wildcard hosts: *.mydomain.com, 192.168.100.*
+;; Since 1.15.7. Default to * for 1.15.x, external for 1.16 and later
+;ALLOWED_HOST_LIST = external
+;;
 ;; Allow insecure certification
 ;SKIP_TLS_VERIFY = false
 ;;
@@ -1959,7 +1928,7 @@ LEVEL = Info
 ;INTERVAL = 60
 ;;
 ;; For "redis" and "memcache", connection host address
-;; redis: default to shared [redis] CONN_STR
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
 ;; memcache: `127.0.0.1:11211`
 ;; twoqueue: `{"size":50000,"recent_ratio":0.25,"ghost_ratio":0.5}` or `50000`
 ;HOST =
@@ -1979,6 +1948,9 @@ LEVEL = Info
 ;; Time to keep items in cache if not used, default is 8760 hours.
 ;; Setting it to -1 disables caching
 ;ITEM_TTL = 8760h
+;;
+;; Only enable the cache when repository's commits count great than
+;COMMITS_COUNT = 1000

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1992,10 +1964,10 @@ LEVEL = Info
 ;;
 ;; Provider config options
 ;; memory: doesn't have any config yet
-;; file: session file path, e.g. `data/sessions`, relative paths will be made absolute against _`AppWorkPath`_.
-;; redis: default to [redis] CONN_STR
+;; file: session file path, e.g. `data/sessions`
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
 ;; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
-;PROVIDER_CONFIG =
+;PROVIDER_CONFIG = data/sessions ; Relative paths will be made absolute against _`AppWorkPath`_.
 ;;
 ;; Session cookie name
 ;COOKIE_NAME = i_like_gitea
@@ -2042,7 +2014,8 @@ LEVEL = Info
 ;; If the uploaded file is not larger than this byte size, the image will be used as is, without resizing/converting.
 ;AVATAR_MAX_ORIGIN_SIZE = 262144
 ;;
-;; "gravatar", "libravatar", or any other Gravatar-compatible source, like: https://cn.gravatar.com/avatar/
+;; Chinese users can choose "duoshuo"
+;; or a custom avatar source, like: http://cn.gravatar.com/avatar/
 ;GRAVATAR_SOURCE = gravatar
 ;;
 ;; Deprecated, see Web UI Admin Panel -> Config -> Settings
@@ -3035,10 +3008,6 @@ LEVEL = Info
 ;SCOPED_WORKFLOW_DIRS = .gitea/scoped_workflows
 ;; Maximum number of attempts a single workflow run can have. Default value is 50.
 ;MAX_RERUN_ATTEMPTS = 50
-;; Maximum number of runners that may run the task-assignment query concurrently, per Gitea instance.
-;; Caps this instance's DB load when many runners poll at once; excess runners retry on their next poll.
-;; In a multi-instance deployment the cluster-wide limit is this value times the number of instances. Default value is 16.
-;MAX_CONCURRENT_TASK_PICKS = 16

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -3053,5 +3022,5 @@ LEVEL = Info
 ;[global_lock]
 ;; Lock service type, could be memory or redis
 ;SERVICE_TYPE = memory
-;; Ignored for the "memory" type. For "redis", default to [redis] CONN_STR.
+;; Ignored for the "memory" type. For "redis" use something like `redis://127.0.0.1:6379/0`
 ;SERVICE_CONN_STR =
@@ -53,10 +53,10 @@ For packagers who need to use paths like `/etc/gitea/app.ini`,
 they should define these values at build time for `make build` by environment variable like
 `LDFLAGS='-X "module.Var1=Value1" -X "module.Var2=Value2"' TAGS="bindata" make build`.

- _`CustomConf`_: `-X "gitea.dev/modules/setting.CustomConf=/etc/gitea/app.ini"`
- _`AppWorkPath`_: `-X "gitea.dev/modules/setting.AppWorkPath=/var/lib/gitea"`
- _`CustomPath`_: `-X "gitea.dev/modules/setting.CustomPath=/var/lib/gitea/custom"`
- Default PID file location: `-X "gitea.dev/cmd.PIDFile=/run/gitea.pid"`
+- _`CustomConf`_: `-X "code.gitea.io/gitea/modules/setting.CustomConf=/etc/gitea/app.ini"`
+- _`AppWorkPath`_: `-X "code.gitea.io/gitea/modules/setting.AppWorkPath=/var/lib/gitea"`
+- _`CustomPath`_: `-X "code.gitea.io/gitea/modules/setting.CustomPath=/var/lib/gitea/custom"`
+- Default PID file location: `-X "code.gitea.io/gitea/cmd.PIDFile=/run/gitea.pid"`

 Add as many of the strings with their preceding `-X` to the `LDFLAGS` variable and run `make build`
 with the appropriate `TAGS` as above.
@@ -95,15 +95,8 @@ However, if there are no objections from maintainers, the PR can be merged with
 ### Commit messages

 Mergers are required to rewrite the PR title and the first comment (the summary) when necessary so the squash commit message is clear.
-Usually the Pull Request description and commit message body should not be empty, unless the title is already clear enough or the description would be a copy of the comments in code.

-The final commit message:
-
- should match the code changes.
- should only keep true co-authors, false-positive co-authors should be removed.
- should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
- should not contain hidden information like `<!-- -->` or extra information after the description's divider `----`.
- should not contain unrelated contents (e.g.: Release Notes, Configuration, etc.) from a Renovate update PR.
+The final commit message should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.

 #### PR Co-authors

@@ -165,16 +158,9 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:

 - Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
- Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
-  In particular, mergers should edit the PR description.\
-  Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.
+- Rewriting the PR title and summary so the squash [commit message](#commit-messages) is clear, removing false-positive co-authors while keeping every true co-author.
 - Assigning the correct labels (including `type/…`) needed for changelog and backport decisions.
 - Agreeing, together with the owners, on when a release is ready (see [release management](release-management.md)).
- Merging a PR also means the PR looks good to the merger and is approved by the merger.
-
-If a merger violates these merge guides more than 3 times in the past 365 days
-(e.g.: merge with unresolved reviews without TOC decision to ignore the review, merge with garbage commit messages),
-they may lose their merging privileges for at least three months.

 #### Becoming a merger

@@ -214,20 +200,20 @@ random.seed("Gitea TOC <YEAR> Election")
 random.choice([<CANDIDATE_1>, <CANDIDATE_2>, ...])
 ```

-The result of this script needs then to be published in the TOC election issue to ensure transparency of the process.
+The result of this script needs then to be published in the TOC election issue to ensure transparency of the process. 

 ### Current TOC members

 - 2026-06-14 ~ 2026-12-31
  - Company
-    - [Yu Tian](https://gitea.com/Zettat123) <zettat123@gmail.com>
+    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
  - Community
    - [bircni](https://gitea.com/bircni) <bircni@icloud.com>
    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
    - [TheFox0x7](https://gitea.com/TheFox0x7) <thefox0x7@gmail.com>
-
+    

 ### Previous TOC/owners members

@@ -241,7 +227,7 @@ Here's the history of the owners and the time they served:
 - [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
 - [6543](https://gitea.com/6543) - 2023, 2025
 - [John Olheiser](https://gitea.com/jolheiser) - 2023, 2024
- [Jason Song](https://gitea.com/wolfogre) - 2023, 2025
+- [Jason Song](https://gitea.com/wolfogre) - 2023

 ## Governance Compensation

@@ -109,7 +109,7 @@ which lives in the [documentation repository](https://gitea.com/gitea/docs).
 ## Database migrations

 If you make breaking changes to a database-persisted struct under `models/`, add a
-new migration in `modelmigration/`. See [testing.md](testing.md#migration-tests)
+new migration in `models/migrations/`. See [testing.md](testing.md#migration-tests)
 for running the migration tests.

 ## Testing
@@ -23,7 +23,7 @@ The backend is split into top-level packages, each with a focused responsibility
  dependencies to a minimum
  - `models/db`: core database operations
  - `models/fixtures`: sample data used by tests
- `modelmigration`: schema migration scripts
+  - `models/migrations`: schema migration scripts
 - `modules`: standalone functionality with few dependencies
  - `modules/setting`: configuration handling
  - `modules/git`: interaction with the Git command line
@@ -83,24 +83,6 @@ be touched by pull requests whose sole purpose is updating dependencies. Run
 Any `go.mod` / `go.sum` update must be justified in the PR description and must be
 verified by reviewers and the merger to reference an existing upstream commit.

-## Golang HTML template
-
-Gitea uses Go's built-in HTML template engine which is dynamically & weakly typed.
-To make template code maintainable:
-
- Go code should take over complex logic and prepare template data as much as possible, templates only render the data.
- Prefer struct types provided by Go code instead of map types for template data.
- Avoid using single word names for non-local variables.
- Avoid passing `"root" $` or `"." .` to sub-templates, instead pass the specific data needed by the sub-template.
- Use explicit variable names instead of `.` to access data: ``{{range $item := $.TargetItems}}{{ $item.Name }}{{end}}``
- Use Go code to implement render helpers if the render logic is too complex.
-
-Using a modern and statically & strongly typed template engine to replace Golang HTML template might be good,
-but the challenge is huge, the requisites are:
-
- A working and maintainable proof-of-concept for the most complex templates (like "PR View" and "PR Diff").
- A firm commitment of sufficient engineering resources.
-
 ## API v1

 The API is documented with [Swagger](https://gitea.com/api/swagger) and is modelled
@@ -138,7 +120,7 @@ In general, choose HTTP methods as follows:
 - **POST** creates a new object (e.g. a user) and returns **201 Created** with the
  created object.
 - **PUT** adds or assigns an existing object (e.g. a user to a team) and returns
-  **204 No Content** with no response body.
+  **204 No Content** with no body.
 - **PATCH** edits an existing object and returns the changed object with **200 OK**.
 - **DELETE** removes an object and returns **204 No Content** with no body.

@@ -136,7 +136,7 @@ Useful environment variables:
 ## Migration tests

 If you change a database-persisted struct under `models/` you will usually need a
-new migration in `modelmigration`. Run the migration tests with:
+new migration in `models/migrations/`. Run the migration tests with:

 ```bash
 make test-migration
@@ -1,8 +1,11 @@
+import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
+import deMorgan from 'eslint-plugin-de-morgan';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
 import playwright from 'eslint-plugin-playwright';
 import regexp from 'eslint-plugin-regexp';
+import sonarjs from 'eslint-plugin-sonarjs';
 import stylistic from '@stylistic/eslint-plugin';
 import typescriptParser from '@typescript-eslint/parser';
 import typescriptPlugin from 'typescript-eslint';
@@ -12,6 +15,7 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
+import type {ESLint} from 'eslint';

 import unescapedHtmlLiteral from './tools/eslint-rules/unescaped-html-literal.ts';

@@ -60,9 +64,12 @@ export default defineConfig([
      '@eslint-community/eslint-comments': comments,
      '@stylistic': stylistic,
      '@typescript-eslint': typescriptPlugin.plugin,
+      'array-func': arrayFunc,
+      'de-morgan': deMorgan,
      'gitea': {rules: {'unescaped-html-literal': unescapedHtmlLiteral}},
-      'import-x': importPlugin,
+      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
      regexp,
+      sonarjs,
      unicorn,
      wc,
    },
@@ -91,17 +98,14 @@ export default defineConfig([
      '@stylistic/comma-spacing': [2, {before: false, after: true}],
      '@stylistic/comma-style': [2, 'last'],
      '@stylistic/computed-property-spacing': [2, 'never'],
-      '@stylistic/curly-newline': [0],
      '@stylistic/dot-location': [2, 'property'],
      '@stylistic/eol-last': [2],
-      '@stylistic/exp-list-style': [0],
      '@stylistic/function-call-argument-newline': [0],
      '@stylistic/function-call-spacing': [2, 'never'],
      '@stylistic/function-paren-newline': [0],
      '@stylistic/generator-star-spacing': [0],
      '@stylistic/implicit-arrow-linebreak': [0],
      '@stylistic/indent': [2, 2, {ignoreComments: true, SwitchCase: 1}],
-      '@stylistic/indent-binary-ops': [0],
      '@stylistic/key-spacing': [2],
      '@stylistic/keyword-spacing': [2],
      '@stylistic/line-comment-position': [0],
@@ -110,7 +114,6 @@ export default defineConfig([
      '@stylistic/lines-between-class-members': [0],
      '@stylistic/max-len': [0],
      '@stylistic/max-statements-per-line': [0],
-      '@stylistic/member-delimiter-style': [0],
      '@stylistic/multiline-comment-style': [0],
      '@stylistic/multiline-ternary': [0],
      '@stylistic/new-parens': [2],
@@ -149,9 +152,6 @@ export default defineConfig([
      '@stylistic/switch-colon-spacing': [2],
      '@stylistic/template-curly-spacing': [2, 'never'],
      '@stylistic/template-tag-spacing': [2, 'never'],
-      '@stylistic/type-annotation-spacing': [0],
-      '@stylistic/type-generic-spacing': [0],
-      '@stylistic/type-named-tuple-spacing': [0],
      '@stylistic/wrap-iife': [2, 'inside'],
      '@stylistic/wrap-regex': [0],
      '@stylistic/yield-star-spacing': [2, 'after'],
@@ -206,7 +206,6 @@ export default defineConfig([
      '@typescript-eslint/no-meaningless-void-operator': [0],
      '@typescript-eslint/no-misused-new': [2],
      '@typescript-eslint/no-misused-promises': [2, {checksVoidReturn: {attributes: false, arguments: false}}],
-      '@typescript-eslint/no-misused-spread': [0], // false-positives
      '@typescript-eslint/no-mixed-enums': [0],
      '@typescript-eslint/no-namespace': [2],
      '@typescript-eslint/no-non-null-asserted-nullish-coalescing': [0],
@@ -221,14 +220,12 @@ export default defineConfig([
      '@typescript-eslint/no-this-alias': [0], // handled by unicorn/no-this-assignment
      '@typescript-eslint/no-unnecessary-boolean-literal-compare': [0],
      '@typescript-eslint/no-unnecessary-condition': [0],
-      '@typescript-eslint/no-unnecessary-parameter-property-assignment': [2],
      '@typescript-eslint/no-unnecessary-qualifier': [0],
      '@typescript-eslint/no-unnecessary-template-expression': [0],
      '@typescript-eslint/no-unnecessary-type-arguments': [2],
      '@typescript-eslint/no-unnecessary-type-assertion': [2],
      '@typescript-eslint/no-unnecessary-type-constraint': [2],
      '@typescript-eslint/no-unnecessary-type-conversion': [2],
-      '@typescript-eslint/no-unnecessary-type-parameters': [0],
      '@typescript-eslint/no-unsafe-argument': [0],
      '@typescript-eslint/no-unsafe-assignment': [0],
      '@typescript-eslint/no-unsafe-call': [0],
@@ -237,7 +234,6 @@ export default defineConfig([
      '@typescript-eslint/no-unsafe-function-type': [2],
      '@typescript-eslint/no-unsafe-member-access': [0],
      '@typescript-eslint/no-unsafe-return': [0],
-      '@typescript-eslint/no-unsafe-type-assertion': [0],
      '@typescript-eslint/no-unsafe-unary-minus': [2],
      '@typescript-eslint/no-unused-expressions': [2],
      '@typescript-eslint/no-unused-private-class-members': [2],
@@ -269,7 +265,6 @@ export default defineConfig([
      '@typescript-eslint/prefer-return-this-type': [0],
      '@typescript-eslint/prefer-string-starts-ends-with': [2, {allowSingleElementEquality: 'always'}],
      '@typescript-eslint/promise-function-async': [0],
-      '@typescript-eslint/related-getter-setter-pairs': [2],
      '@typescript-eslint/require-array-sort-compare': [0],
      '@typescript-eslint/require-await': [0],
      '@typescript-eslint/restrict-plus-operands': [2],
@@ -281,9 +276,14 @@ export default defineConfig([
      '@typescript-eslint/triple-slash-reference': [2],
      '@typescript-eslint/unbound-method': [0], // too many false-positives
      '@typescript-eslint/unified-signatures': [2],
-      '@typescript-eslint/use-unknown-in-catch-callback-variable': [0],
      'accessor-pairs': [2],
      'array-callback-return': [2, {checkForEach: true}],
+      'array-func/avoid-reverse': [2],
+      'array-func/from-map': [2],
+      'array-func/no-unnecessary-this-arg': [2],
+      'array-func/prefer-array-from': [2],
+      'array-func/prefer-flat-map': [0], // handled by unicorn/prefer-array-flat-map
+      'array-func/prefer-flat': [0], // handled by unicorn/prefer-array-flat
      'arrow-body-style': [0],
      'block-scoped-var': [2],
      'camelcase': [0],
@@ -294,6 +294,8 @@ export default defineConfig([
      'consistent-this': [0],
      'constructor-super': [2],
      'curly': [0],
+      'de-morgan/no-negated-conjunction': [2],
+      'de-morgan/no-negated-disjunction': [2],
      'default-case-last': [2],
      'default-case': [0],
      'default-param-last': [0],
@@ -328,7 +330,6 @@ export default defineConfig([
      'import-x/no-cycle': [2, {ignoreExternal: true, maxDepth: 1}],
      'import-x/no-default-export': [0],
      'import-x/no-deprecated': [0],
-      'import-x/no-duplicates': [2],
      'import-x/no-dynamic-require': [0],
      'import-x/no-empty-named-blocks': [2],
      'import-x/no-extraneous-dependencies': [2],
@@ -343,7 +344,6 @@ export default defineConfig([
      'import-x/no-nodejs-modules': [0],
      'import-x/no-relative-packages': [0],
      'import-x/no-relative-parent-imports': [0],
-      'import-x/no-rename-default': [0],
      'import-x/no-restricted-paths': [0],
      'import-x/no-self-import': [2],
      'import-x/no-unassigned-import': [0],
@@ -353,7 +353,6 @@ export default defineConfig([
      'import-x/no-webpack-loader-syntax': [2],
      'import-x/order': [0],
      'import-x/prefer-default-export': [0],
-      'import-x/prefer-namespace-import': [0],
      'import-x/unambiguous': [0],
      'init-declarations': [0],
      'logical-assignment-operators': [0],
@@ -570,7 +569,6 @@ export default defineConfig([
      'no-unreachable': [2],
      'no-unsafe-finally': [2],
      'no-unsafe-negation': [2],
-      'no-unsafe-optional-chaining': [2],
      'no-unused-expressions': [0], // handled by @typescript-eslint/no-unused-expressions
      'no-unused-labels': [2],
      'no-unused-private-class-members': [0], // handled by @typescript-eslint/no-unused-private-class-members
@@ -585,7 +583,7 @@ export default defineConfig([
      'no-useless-constructor': [2],
      'no-useless-escape': [2],
      'no-useless-rename': [2],
-      'no-useless-return': [2],
+      'no-useless-return': [0], // handled by sonarjs/no-redundant-jump
      'no-var': [2],
      'no-void': [2],
      'no-warning-comments': [0],
@@ -610,7 +608,6 @@ export default defineConfig([
      'radix': [0],
      'regexp/confusing-quantifier': [2],
      'regexp/control-character-escape': [2],
-      'regexp/grapheme-string-literal': [0],
      'regexp/hexadecimal-escape': [0],
      'regexp/letter-case': [0],
      'regexp/match-any': [2],
@@ -681,19 +678,48 @@ export default defineConfig([
      'regexp/prefer-unicode-codepoint-escapes': [2],
      'regexp/prefer-w': [0],
      'regexp/require-unicode-regexp': [0],
-      'regexp/require-unicode-sets-regexp': [0],
      'regexp/simplify-set-operations': [2],
      'regexp/sort-alternatives': [0],
      'regexp/sort-character-class-elements': [0],
      'regexp/sort-flags': [0],
      'regexp/strict': [2],
      'regexp/unicode-escape': [0],
-      'regexp/unicode-property': [0],
      'regexp/use-ignore-case': [0],
      'require-atomic-updates': [0],
      'require-await': [0], // handled by @typescript-eslint/require-await
      'require-unicode-regexp': [0],
      'require-yield': [2],
+      'sonarjs/cognitive-complexity': [0],
+      'sonarjs/elseif-without-else': [0],
+      'sonarjs/max-switch-cases': [0],
+      'sonarjs/no-all-duplicated-branches': [2],
+      'sonarjs/no-collapsible-if': [0],
+      'sonarjs/no-collection-size-mischeck': [2],
+      'sonarjs/no-duplicate-string': [0],
+      'sonarjs/no-duplicated-branches': [0],
+      'sonarjs/no-element-overwrite': [2],
+      'sonarjs/no-empty-collection': [2],
+      'sonarjs/no-extra-arguments': [2],
+      'sonarjs/no-gratuitous-expressions': [2],
+      'sonarjs/no-identical-conditions': [0], // handled by no-dupe-else-if
+      'sonarjs/no-identical-expressions': [2],
+      'sonarjs/no-identical-functions': [2, 5],
+      'sonarjs/no-ignored-return': [2],
+      'sonarjs/no-inverted-boolean-check': [2],
+      'sonarjs/no-nested-switch': [0],
+      'sonarjs/no-nested-template-literals': [0],
+      'sonarjs/no-redundant-boolean': [2],
+      'sonarjs/no-redundant-jump': [2],
+      'sonarjs/no-same-line-conditional': [2],
+      'sonarjs/no-small-switch': [0],
+      'sonarjs/no-unused-collection': [2],
+      'sonarjs/no-use-of-empty-return-value': [2],
+      'sonarjs/no-useless-catch': [0], // handled by no-useless-catch
+      'sonarjs/non-existent-operator': [2],
+      'sonarjs/prefer-immediate-return': [0],
+      'sonarjs/prefer-object-literal': [0],
+      'sonarjs/prefer-single-boolean-return': [0],
+      'sonarjs/prefer-while': [2],
      'sort-imports': [0],
      'sort-keys': [0],
      'sort-vars': [0],
@@ -704,7 +730,6 @@ export default defineConfig([
      'unicorn/catch-error-name': [0],
      'unicorn/class-reference-in-static-methods': [2],
      'unicorn/comment-content': [0],
-      'unicorn/consistent-arrow-return-style': [0],
      'unicorn/consistent-assert': [0],
      'unicorn/consistent-boolean-name': [0],
      'unicorn/consistent-class-member-order': [0],
@@ -720,7 +745,6 @@ export default defineConfig([
      'unicorn/consistent-json-file-read': [2],
      'unicorn/consistent-optional-chaining': [2],
      'unicorn/consistent-template-literal-escape': [2],
-      'unicorn/consistent-tuple-labels': [2],
      'unicorn/custom-error-definition': [0],
      'unicorn/default-export-style': [2],
      'unicorn/dom-node-dataset': [2, {preferAttributes: true}],
@@ -734,7 +758,6 @@ export default defineConfig([
      'unicorn/id-match': [2],
      'unicorn/import-style': [0],
      'unicorn/isolated-functions': [2, {functions: []}],
-      'unicorn/iteration-fallback-style': [2, 'fallback'],
      'unicorn/logical-assignment-operators': [0],
      'unicorn/max-nested-calls': [0],
      'unicorn/name-replacements': [0],
@@ -755,10 +778,8 @@ export default defineConfig([
      'unicorn/no-array-sort-for-min-max': [2],
      'unicorn/no-array-splice': [0],
      'unicorn/no-asterisk-prefix-in-documentation-comments': [0],
-      'unicorn/no-async-promise-finally': [2],
      'unicorn/no-await-expression-member': [0],
      'unicorn/no-await-in-promise-methods': [2],
-      'unicorn/no-barrel-files': [0],
      'unicorn/no-blob-to-file': [2],
      'unicorn/no-boolean-sort-comparator': [2],
      'unicorn/no-break-in-nested-loop': [0],
@@ -793,18 +814,14 @@ export default defineConfig([
      'unicorn/no-invalid-fetch-options': [2],
      'unicorn/no-invalid-file-input-accept': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
-      'unicorn/no-invalid-well-known-symbol-methods': [2],
      'unicorn/no-keyword-prefix': [0],
      'unicorn/no-late-current-target-access': [2],
-      'unicorn/no-late-event-control': [2],
      'unicorn/no-lonely-if': [2],
      'unicorn/no-loop-iterable-mutation': [2],
      'unicorn/no-magic-array-flat-depth': [0],
      'unicorn/no-manually-wrapped-comments': [0], // too opinionated
      'unicorn/no-mismatched-map-key': [2],
      'unicorn/no-misrefactored-assignment': [2],
-      'unicorn/no-missing-local-resource': [0], // only applies to html/css/markdown languages
-      'unicorn/no-multiple-promise-resolver-calls': [2],
      'unicorn/no-named-default': [2],
      'unicorn/no-negated-array-predicate': [2],
      'unicorn/no-negated-comparison': [2],
@@ -823,7 +840,6 @@ export default defineConfig([
      'unicorn/no-redundant-comparison': [2],
      'unicorn/no-return-array-push': [2],
      'unicorn/no-selector-as-dom-name': [2],
-      'unicorn/no-shorthand-property-overrides': [0], // only applies to css language
      'unicorn/no-single-promise-in-promise-methods': [2],
      'unicorn/no-static-only-class': [2],
      'unicorn/no-subtraction-comparison': [2],
@@ -832,22 +848,18 @@ export default defineConfig([
      'unicorn/no-this-outside-of-class': [0], // gitea uses `this` in non-class functions
      'unicorn/no-top-level-assignment-in-function': [0],
      'unicorn/no-top-level-side-effects': [0],
-      'unicorn/no-transition-all': [2],
      'unicorn/no-typeof-undefined': [2],
      'unicorn/no-uncalled-method': [2],
      'unicorn/no-undeclared-class-members': [2],
      'unicorn/no-unnecessary-array-flat-depth': [2],
-      'unicorn/no-unnecessary-array-flat-map': [2],
      'unicorn/no-unnecessary-array-splice-count': [2],
      'unicorn/no-unnecessary-await': [2],
      'unicorn/no-unnecessary-boolean-comparison': [2],
-      'unicorn/no-unnecessary-fetch-options': [0],
      'unicorn/no-unnecessary-global-this': [0],
      'unicorn/no-unnecessary-nested-ternary': [2],
      'unicorn/no-unnecessary-polyfills': [2],
      'unicorn/no-unnecessary-slice-end': [2],
      'unicorn/no-unnecessary-splice': [2],
-      'unicorn/no-unnecessary-string-trim': [2],
      'unicorn/no-unreadable-array-destructuring': [0],
      'unicorn/no-unreadable-for-of-expression': [0],
      'unicorn/no-unreadable-iife': [0],
@@ -855,9 +867,7 @@ export default defineConfig([
      'unicorn/no-unreadable-object-destructuring': [0],
      'unicorn/no-unsafe-buffer-conversion': [2],
      'unicorn/no-unsafe-dom-html': [0],
-      'unicorn/no-unsafe-promise-all-settled-values': [2],
      'unicorn/no-unsafe-property-key': [0],
-      'unicorn/no-unsafe-sqlite-interpolation': [2],
      'unicorn/no-unsafe-string-replacement': [0],
      'unicorn/no-unused-array-method-return': [2],
      'unicorn/no-unused-properties': [2],
@@ -876,7 +886,6 @@ export default defineConfig([
      'unicorn/no-useless-logical-operand': [2],
      'unicorn/no-useless-override': [2],
      'unicorn/no-useless-promise-resolve-reject': [2],
-      'unicorn/no-useless-re-export': [2],
      'unicorn/no-useless-recursion': [0],
      'unicorn/no-useless-spread': [2],
      'unicorn/no-useless-switch-case': [2],
@@ -887,17 +896,13 @@ export default defineConfig([
      'unicorn/number-literal-case': [0],
      'unicorn/numeric-separators-style': [0],
      'unicorn/operator-assignment': [2],
-      'unicorn/prefer-abort-signal-any': [2],
-      'unicorn/prefer-abort-signal-timeout': [2],
      'unicorn/prefer-add-event-listener': [2],
      'unicorn/prefer-add-event-listener-options': [2],
-      'unicorn/prefer-aggregate-error': [2],
      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
      'unicorn/prefer-array-from-async': [2],
      'unicorn/prefer-array-from-map': [2],
-      'unicorn/prefer-array-from-range': [2],
      'unicorn/prefer-array-index-of': [2],
      'unicorn/prefer-array-iterable-methods': [2],
      'unicorn/prefer-array-last-methods': [2],
@@ -907,7 +912,6 @@ export default defineConfig([
      'unicorn/prefer-await': [2],
      'unicorn/prefer-bigint-literals': [2],
      'unicorn/prefer-blob-reading-methods': [2],
-      'unicorn/prefer-block-statement-over-iife': [2],
      'unicorn/prefer-boolean-return': [2],
      'unicorn/prefer-class-fields': [2],
      'unicorn/prefer-classlist-toggle': [2],
@@ -920,19 +924,15 @@ export default defineConfig([
      'unicorn/prefer-dom-node-append': [2],
      'unicorn/prefer-dom-node-html-methods': [0],
      'unicorn/prefer-dom-node-remove': [2],
-      'unicorn/prefer-dom-node-replace-children': [2],
      'unicorn/prefer-dom-node-text-content': [2],
      'unicorn/prefer-early-return': [0],
      'unicorn/prefer-else-if': [2],
-      'unicorn/prefer-error-is-error': [0],
      'unicorn/prefer-event-target': [2],
-      'unicorn/prefer-explicit-viewport-units': [0], // only applies to css language
      'unicorn/prefer-export-from': [0],
      'unicorn/prefer-flat-math-min-max': [2],
      'unicorn/prefer-get-or-insert-computed': [2],
      'unicorn/prefer-global-number-constants': [2],
      'unicorn/prefer-global-this': [0],
-      'unicorn/prefer-group-by': [2],
      'unicorn/prefer-has-check': [2],
      'unicorn/prefer-hoisting-branch-code': [2],
      'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
@@ -942,7 +942,6 @@ export default defineConfig([
      'unicorn/prefer-includes-over-repeated-comparisons': [0], // too opinionated
      'unicorn/prefer-iterable-in-constructor': [2],
      'unicorn/prefer-iterator-concat': [0], // too opinionated
-      'unicorn/prefer-iterator-helpers': [2],
      'unicorn/prefer-iterator-to-array': [2],
      'unicorn/prefer-iterator-to-array-at-end': [2],
      'unicorn/prefer-keyboard-event-key': [2],
@@ -967,11 +966,9 @@ export default defineConfig([
      'unicorn/prefer-object-destructuring-defaults': [2],
      'unicorn/prefer-object-from-entries': [2],
      'unicorn/prefer-object-iterable-methods': [2],
-      'unicorn/prefer-observer-apis': [2],
      'unicorn/prefer-optional-catch-binding': [2],
      'unicorn/prefer-path2d': [2],
      'unicorn/prefer-private-class-fields': [0],
-      'unicorn/prefer-promise-try': [2],
      'unicorn/prefer-promise-with-resolvers': [2],
      'unicorn/prefer-prototype-methods': [0],
      'unicorn/prefer-query-selector': [2],
@@ -982,12 +979,10 @@ export default defineConfig([
      'unicorn/prefer-response-static-json': [2],
      'unicorn/prefer-scoped-selector': [0],
      'unicorn/prefer-set-has': [0],
-      'unicorn/prefer-set-methods': [0],
      'unicorn/prefer-set-size': [2],
      'unicorn/prefer-short-arrow-method': [2],
      'unicorn/prefer-simple-condition-first': [0],
      'unicorn/prefer-simple-sort-comparator': [2],
-      'unicorn/prefer-simplified-conditions': [2],
      'unicorn/prefer-single-array-predicate': [2],
      'unicorn/prefer-single-call': [2],
      'unicorn/prefer-single-object-destructuring': [2],
@@ -1007,8 +1002,6 @@ export default defineConfig([
      'unicorn/prefer-switch': [0],
      'unicorn/prefer-temporal': [0],
      'unicorn/prefer-ternary': [0],
-      'unicorn/prefer-then-catch': [2],
-      'unicorn/prefer-toggle-attribute': [2],
      'unicorn/prefer-top-level-await': [0],
      'unicorn/prefer-type-error': [0],
      'unicorn/prefer-type-literal-last': [0],
@@ -1017,20 +1010,18 @@ export default defineConfig([
      'unicorn/prefer-unicode-code-point-escapes': [0],
      'unicorn/prefer-url-can-parse': [2],
      'unicorn/prefer-url-href': [2],
-      'unicorn/prefer-url-search-parameters': [2],
      'unicorn/prefer-while-loop-condition': [2],
+      'unicorn/prevent-abbreviations': [0],
      'unicorn/relative-url-style': [2],
      'unicorn/require-array-join-separator': [2],
      'unicorn/require-array-sort-compare': [0],
      'unicorn/require-css-escape': [2],
-      'unicorn/require-frontmatter-fields': [0], // only applies to markdown language
      'unicorn/require-module-attributes': [2],
      'unicorn/require-module-specifiers': [0],
      'unicorn/require-number-to-fixed-digits-argument': [2],
      'unicorn/require-passive-events': [2],
      'unicorn/require-post-message-target-origin': [0],
      'unicorn/require-proxy-trap-boolean-return': [2],
-      'unicorn/single-line-block-comment-style': [0],
      'unicorn/string-content': [0],
      'unicorn/switch-case-braces': [0],
      'unicorn/switch-case-break-position': [2],
@@ -1084,7 +1075,7 @@ export default defineConfig([
    },
    extends: [
      vue.configs['flat/recommended'],
-      vueScopedCss.configs.recommended,
+      vueScopedCss.configs.recommended as any,
    ],
    rules: {
      'vue/attributes-order': [0],
@@ -1101,12 +1092,9 @@ export default defineConfig([
    rules: {
      'gitea/unescaped-html-literal': [0],
      'unicorn/no-error-property-assignment': [0],
-      'vitest/consistent-each-for': [0],
      'vitest/consistent-test-filename': [0],
      'vitest/consistent-test-it': [0],
-      'vitest/consistent-vitest-vi': [0],
      'vitest/expect-expect': [0],
-      'vitest/hoisted-apis-on-top': [0],
      'vitest/max-expects': [0],
      'vitest/max-nested-describe': [0],
      'vitest/no-alias-methods': [0],
@@ -1119,69 +1107,41 @@ export default defineConfig([
      'vitest/no-focused-tests': [2],
      'vitest/no-hooks': [0],
      'vitest/no-identical-title': [2],
-      'vitest/no-import-node-test': [0],
-      'vitest/no-importing-vitest-globals': [2],
      'vitest/no-interpolation-in-snapshots': [0],
      'vitest/no-large-snapshots': [0],
      'vitest/no-mocks-import': [0],
+      'vitest/no-importing-vitest-globals': [2],
      'vitest/no-restricted-matchers': [0],
      'vitest/no-restricted-vi-methods': [0],
      'vitest/no-standalone-expect': [0],
      'vitest/no-test-prefixes': [0],
      'vitest/no-test-return-statement': [0],
-      'vitest/no-unneeded-async-expect-function': [2],
-      'vitest/padding-around-after-all-blocks': [0],
-      'vitest/padding-around-after-each-blocks': [0],
-      'vitest/padding-around-all': [0],
-      'vitest/padding-around-before-all-blocks': [0],
-      'vitest/padding-around-before-each-blocks': [0],
-      'vitest/padding-around-describe-blocks': [0],
-      'vitest/padding-around-expect-groups': [0],
-      'vitest/padding-around-test-blocks': [0],
-      'vitest/prefer-called-exactly-once-with': [0],
-      'vitest/prefer-called-once': [0],
-      'vitest/prefer-called-times': [0],
      'vitest/prefer-called-with': [0],
      'vitest/prefer-comparison-matcher': [0],
-      'vitest/prefer-describe-function-title': [0],
      'vitest/prefer-each': [0],
      'vitest/prefer-equality-matcher': [0],
-      'vitest/prefer-expect-assertions': [0],
      'vitest/prefer-expect-resolves': [0],
-      'vitest/prefer-expect-type-of': [0],
      'vitest/prefer-hooks-in-order': [0],
      'vitest/prefer-hooks-on-top': [2],
-      'vitest/prefer-import-in-mock': [0],
-      'vitest/prefer-importing-vitest-globals': [0],
      'vitest/prefer-lowercase-title': [0],
      'vitest/prefer-mock-promise-shorthand': [0],
-      'vitest/prefer-mock-return-shorthand': [0],
      'vitest/prefer-snapshot-hint': [0],
      'vitest/prefer-spy-on': [0],
-      'vitest/prefer-strict-boolean-matchers': [0],
      'vitest/prefer-strict-equal': [0],
      'vitest/prefer-to-be': [0],
      'vitest/prefer-to-be-falsy': [0],
      'vitest/prefer-to-be-object': [0],
      'vitest/prefer-to-be-truthy': [0],
      'vitest/prefer-to-contain': [0],
-      'vitest/prefer-to-have-been-called-times': [0],
      'vitest/prefer-to-have-length': [0],
      'vitest/prefer-todo': [0],
-      'vitest/prefer-vi-mocked': [0],
-      'vitest/require-awaited-expect-poll': [0],
      'vitest/require-hook': [0],
-      'vitest/require-local-test-context-for-concurrent-snapshots': [0],
-      'vitest/require-mock-type-parameters': [0],
-      'vitest/require-test-timeout': [0],
      'vitest/require-to-throw-message': [0],
      'vitest/require-top-level-describe': [0],
-      'vitest/unbound-method': [0],
      'vitest/valid-describe-callback': [2],
      'vitest/valid-expect': [2, {maxArgs: 2}],
      'vitest/valid-expect-in-promise': [2],
      'vitest/valid-title': [2],
-      'vitest/warn-todo': [0],
    },
  },
  {
@@ -3,10 +3,9 @@ import json from '@eslint/json';

 export default defineConfig([
  globalIgnores([
-    'public',
-    'custom/public',
-    'data',
-    '.venv',
+    '**/.venv',
+    '**/node_modules',
+    '**/public',
  ]),
  {
    files: ['**/*.json'],
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1786106723,
-        "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
+        "lastModified": 1776877367,
+        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
+        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
        "type": "github"
      },
      "original": {
@@ -34,9 +34,9 @@

              # only bump toolchain versions here
              go = pkgs.go_1_26;
-              nodejs = pkgs.nodejs_26;
+              nodejs = pkgs.nodejs_24;
              python3 = pkgs.python314;
-              pnpm = pkgs.pnpm_11;
+              pnpm = pkgs.pnpm_10;

              # Platform-specific dependencies
              linuxOnlyInputs = lib.optionals pkgs.stdenv.isLinux [
@@ -1,19 +1,19 @@
 module gitea.dev

-go 1.26.0
-
-toolchain go1.26.5
+go 1.26.4

 require (
+	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
 	connectrpc.com/connect v1.20.0
+	gitea.com/gitea/runner v1.0.8
 	gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
-	gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6
+	gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
-	gitea.dev/actionslib v0.7.0
-	gitea.dev/sdk v1.2.0
+	gitea.dev/actions-proto-go v0.6.0
+	gitea.dev/sdk v1.1.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
@@ -24,17 +24,16 @@ require (
 	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
 	github.com/alecthomas/chroma/v2 v2.27.0
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.33
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.36.3
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
-	github.com/buildkite/terminal-to-html/v3 v3.17.1
+	github.com/buildkite/terminal-to-html/v3 v3.16.8
 	github.com/caddyserver/certmagic v0.25.4
 	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635
 	github.com/chi-middleware/proxy v1.1.1
-	github.com/coder/websocket v1.8.15
-	github.com/dlclark/regexp2/v2 v2.5.2
+	github.com/dlclark/regexp2/v2 v2.2.2
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/dustin/go-humanize v1.0.1
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.4
@@ -43,23 +42,24 @@ require (
 	github.com/ethantkoenig/rupture v1.0.1
 	github.com/felixge/fgprof v0.9.5
 	github.com/fsnotify/fsnotify v1.10.1
-	github.com/getkin/kin-openapi v0.146.0
-	github.com/go-chi/chi/v5 v5.3.1
+	github.com/getkin/kin-openapi v0.140.0
+	github.com/gliderlabs/ssh v0.3.8
+	github.com/go-chi/chi/v5 v5.3.0
 	github.com/go-chi/cors v1.2.2
-	github.com/go-co-op/gocron/v2 v2.22.0
+	github.com/go-co-op/gocron/v2 v2.21.2
 	github.com/go-enry/go-enry/v2 v2.9.6
-	github.com/go-git/go-billy/v5 v5.9.1
-	github.com/go-git/go-git/v5 v5.19.2
-	github.com/go-ldap/ldap/v3 v3.4.14
-	github.com/go-redsync/redsync/v4 v4.17.0
+	github.com/go-git/go-billy/v5 v5.9.0
+	github.com/go-git/go-git/v5 v5.19.1
+	github.com/go-ldap/ldap/v3 v3.4.13
+	github.com/go-redsync/redsync/v4 v4.16.0
 	github.com/go-sql-driver/mysql v1.10.0
 	github.com/go-webauthn/webauthn v0.17.4
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v89 v89.0.0
+	github.com/google/go-github/v88 v88.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
-	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3
+	github.com/google/pprof v0.0.0-20260604005048-7023385849c0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
@@ -68,56 +68,57 @@ require (
 	github.com/huandu/xstrings v1.5.0
 	github.com/jhillyerd/enmime/v2 v2.4.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.19.1
+	github.com/klauspost/compress v1.18.6
+	github.com/klauspost/cpuid/v2 v2.3.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
-	github.com/mattn/go-isatty v0.0.24
-	github.com/mattn/go-sqlite3 v1.14.49
+	github.com/mattn/go-isatty v0.0.22
+	github.com/mattn/go-sqlite3 v1.14.47
 	github.com/meilisearch/meilisearch-go v0.36.3
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.10.0
-	github.com/minio/minio-go/v7 v7.2.1
+	github.com/minio/minio-go/v7 v7.2.0
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pquerna/otp v1.5.0
-	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_golang v1.23.2
 	github.com/quasoft/websspi v1.1.2
-	github.com/redis/go-redis/v9 v9.22.0
-	github.com/rhysd/actionlint v1.7.12
+	github.com/redis/go-redis/v9 v9.21.0
 	github.com/robfig/cron/v3 v3.0.1
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/sassoftware/go-rpmutils v0.4.0
 	github.com/sergi/go-diff v1.4.0
 	github.com/stretchr/testify v1.11.1
 	github.com/syndtr/goleveldb v1.0.0
 	github.com/tstranex/u2f v1.0.0
-	github.com/ulikunitz/xz v0.5.16
+	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.10.1
-	github.com/wneessen/go-mail v0.8.1
+	github.com/urfave/cli/v3 v3.10.0
+	github.com/wneessen/go-mail v0.7.3
 	github.com/yohcop/openid-go v1.0.1
-	github.com/yuin/goldmark v1.8.5
+	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.55.1
+	gitlab.com/gitlab-org/api/client-go/v2 v2.42.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
-	golang.org/x/crypto v0.54.0
-	golang.org/x/image v0.44.0
-	golang.org/x/mod v0.38.0
-	golang.org/x/net v0.57.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/image v0.43.0
+	golang.org/x/mod v0.37.0
+	golang.org/x/net v0.56.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
-	golang.org/x/text v0.40.0
-	google.golang.org/grpc v1.83.0
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
+	golang.org/x/text v0.38.0
+	google.golang.org/grpc v1.81.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.3
-	modernc.org/sqlite v1.56.0
+	modernc.org/sqlite v1.53.0
 	mvdan.cc/xurls/v2 v2.6.0
+	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.4.1
+	xorm.io/xorm v1.3.11
 )

 require (
@@ -131,10 +132,11 @@ require (
 	github.com/STARRY-S/zip v0.2.3 // indirect
 	github.com/andybalholm/brotli v1.2.1 // indirect
 	github.com/andybalholm/cascadia v1.3.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.43.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.34 // indirect
-	github.com/aws/smithy-go v1.27.6 // indirect
+	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
+	github.com/aws/aws-sdk-go-v2 v1.42.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
+	github.com/aws/smithy-go v1.27.2 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.5 // indirect
@@ -179,7 +181,7 @@ require (
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-openapi/jsonpointer v0.23.1 // indirect
@@ -197,14 +199,15 @@ require (
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/inbucket/html2text v1.0.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/libdns/libdns v1.1.1 // indirect
@@ -225,8 +228,8 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/nwaples/rardecode/v2 v2.2.3 // indirect
-	github.com/oasdiff/yaml v0.1.1 // indirect
-	github.com/oasdiff/yaml3 v0.0.14 // indirect
+	github.com/oasdiff/yaml v0.1.0 // indirect
+	github.com/oasdiff/yaml3 v0.0.13 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.3.0 // indirect
 	github.com/olekukonko/ll v0.1.8 // indirect
@@ -238,9 +241,10 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/common v0.68.1 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rhysd/actionlint v1.7.12 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
@@ -250,7 +254,6 @@ require (
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
 	github.com/stangelandcl/ppmd v0.1.1 // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/unknwon/com v1.0.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -266,11 +269,11 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.74.4 // indirect
+	modernc.org/libc v1.73.4 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 )
@@ -2,30 +2,34 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
 code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
+codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570 h1:TXbikPqa7YRtfU9vS6QJBg77pUvbEb6StRdZO8t1bEY=
+codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570/go.mod h1:IIAjsijsd8q1isWX8MACefDEgTQslQ4stk2AeeTt3kM=
 connectrpc.com/connect v1.20.0 h1:6TNDAB+WeNd2uolWNlYczB5E0KNNaVMNUEx8JEUsPmQ=
 connectrpc.com/connect v1.20.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+gitea.com/gitea/runner v1.0.8 h1:zKfC4+zyyGIDagqhII3WVw52P+A9iAa63It0lniN4SI=
+gitea.com/gitea/runner v1.0.8/go.mod h1:AGLQXo8ELz9WPzNJ5W1SvnCik8ZX3jF0o6yCPCmwLtM=
 gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a h1:JHoBrfuTSF9Ke9aNfSYj1XRPBHjKPgCApVprnt2Am0M=
 gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a/go.mod h1:FOsLJIMdpiHzBp3Vby6Wfkdw2ppGscrjgU1IC7E4/zQ=
 gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
 gitea.com/go-chi/cache v0.2.1/go.mod h1:Qic0HZ8hOHW62ETGbonpwz8WYypj9NieU9659wFUJ8Q=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098 h1:p2ki+WK0cIeNQuqjR98IP2KZQKRzJJiV7aTeMAFwaWo=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098/go.mod h1:LjzIOHlRemuUyO7WR12fmm18VZIlCAaOt9L3yKw40pk=
-gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6 h1:YWzVGeC/8SZThrJS48ZmQYLkzssdeABxHPhbdnxPDIU=
-gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
+gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e h1:4bugwPyGMLvblEm3pZ8fZProSPVxE4l0UXF2Kv6IJoY=
+gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:VyMQP6ue6MKHM8UsOXfNfuMKD0oSAWZdXVcpHIN2yaY=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHqdhS7keYWioqfmxdnfblFDTGoOwcZ+o=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGqTOXqu2aRi/XEQxDCBwM8yJtE6s=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
-gitea.dev/actionslib v0.7.0 h1:JCV8eeIGwjlXcuSr7ojEdQC22VoE2466+K+D9vuQWKQ=
-gitea.dev/actionslib v0.7.0/go.mod h1:DI3Lqp+8TrycM7/semMdqsDQOHaBskjIAuMn+SXfZJ0=
-gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
-gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
+gitea.dev/actions-proto-go v0.6.0 h1:gjllYQ5vmwlkqOeofTQu5qKTZpmf7kWsafoHvoPCSzY=
+gitea.dev/actions-proto-go v0.6.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
+gitea.dev/sdk v1.1.0 h1:wLlz03WkLEiXa2bQpO1JQBTlYf7tQI2neYtZK1kU+TE=
+gitea.dev/sdk v1.1.0/go.mod h1:Zfl+EZXdsGGCLkryDfsmvYrQo6GKMl4U3BJA8Beu+cs=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -88,18 +92,18 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuW
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.43.3 h1:XJIcfv8uDs2ukdQsoAC8/Ebu1ejxwzlayl2ZsiFns2A=
-github.com/aws/aws-sdk-go-v2 v1.43.3/go.mod h1:70vwSy16txshwG+g55WkpgPKDIByzHI8ccBsOteo3bQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.33 h1:/e5V3EWfeDiW6cuRxHsC8gbwko4/vvVYPJR2afBKFFY=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.33/go.mod h1:ZxAmkcyOM9beY/WO9oxp2oVPXiP3rq5N1/p4NbenJdE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.34 h1:vuIfjzoeqhQMGJyOBU3t0ZEjn2jrN8Bbg1N4CgjzM5Q=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.34/go.mod h1:hP28cN4CPJLZHirdQPrZR50JcLN4ApRJP2tzG8cRlhY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.34 h1:9faHsnqxJ1vDvB4wMZy/ajIDyz5QhllQjjc72RJpXAw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.34/go.mod h1:Yp6nIyejpa23nzlB/LhT63KTla9Jdi06nv/HH/OkAH8=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.36.3 h1:0y4NzpyfbufOOZkJ54zJHJl/IC/tj/ACd6E8ViCIZZM=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.36.3/go.mod h1:38Fc43+yPVnGM70Bqh8N7tbUVssQDVwnnFU+49sanPQ=
-github.com/aws/smithy-go v1.27.6 h1:0zjT8jgK3jbrTT7JJ3EE6JsMhX8JTrZ+f1sEndYDXrA=
-github.com/aws/smithy-go v1.27.6/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
+github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 h1:f3vKqSo13fhTYb+JEcXwXefZQE26I1FB5eTSniU67ko=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29/go.mod h1:MzoLFUArKGpGD+ukmPiTPG1X5x4o6M2kq4v2dr1FiEc=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJagbOyotl/cxoLY4xviKuE7p2GY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4 h1:Uu+wqrOXozYYvaxcNIqjFsMTjoIJIZDN3R0f70ZIjyQ=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
+github.com/aws/smithy-go v1.27.2 h1:y9NPmSE6am6LjEFPfqHqG/jJk7AauQvhCJONKh7kpzk=
+github.com/aws/smithy-go v1.27.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -181,8 +185,8 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
-github.com/buildkite/terminal-to-html/v3 v3.17.1 h1:gs9WhKUwxK27YHf3hijj4tG4wuDLfCANYbRPd5ltMdI=
-github.com/buildkite/terminal-to-html/v3 v3.17.1/go.mod h1:0pv+Z75FC+NvIju2o+Cw+YHIDkueeudIoeyfVm8i8GQ=
+github.com/buildkite/terminal-to-html/v3 v3.16.8 h1:QN/daUob6cmK8GcdKnwn9+YTlPr1vNj+oeAIiJK6fPc=
+github.com/buildkite/terminal-to-html/v3 v3.16.8/go.mod h1:+k1KVKROZocrTLsEQ9PEf9A+8+X8uaVV5iO1ZIOwKYM=
 github.com/caddyserver/certmagic v0.25.4 h1:8eIXh0HC3MsGnNo8One+BCxMGTbe5zb/oz+2KsxBFQg=
 github.com/caddyserver/certmagic v0.25.4/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
 github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
@@ -207,8 +211,6 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
-github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
-github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
@@ -238,8 +240,8 @@ github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55k
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2/v2 v2.5.2 h1:HAsucWRhsqcDzl6Ua9aR8JwYOTzrZyPrF0/FNxJVAI0=
-github.com/dlclark/regexp2/v2 v2.5.2/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/dlclark/regexp2/v2 v2.2.2 h1:MYWvNYw8okuqNhwTYO587EZMiDruVa2vhV6fsGpfya0=
+github.com/dlclark/regexp2/v2 v2.2.2/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
@@ -272,39 +274,39 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
 github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/getkin/kin-openapi v0.146.0 h1:RA/1RdxrSJW4oc1+6IfnYB6AO9CaGy8GTKPh0k4Ordo=
-github.com/getkin/kin-openapi v0.146.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
+github.com/getkin/kin-openapi v0.140.0 h1:JFn675aXRFjyiZKa/BFWploGldQlI0gobp4J5k0EZ2g=
+github.com/getkin/kin-openapi v0.140.0/go.mod h1:lISrB64F0CPcuDJ3LdtPTMJBY8VENjR9wJBdrcT6J3g=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 h1:mtDjlmloH7ytdblogrMz1/8Hqua1y8B4ID+bh3rvod0=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1/go.mod h1:fenKRzpXDjNpsIBhuhUzvjCKlDjKam0boRAenTE0Q6A=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/glycerine/go-unsnap-stream v0.0.0-20181221182339-f9677308dec2/go.mod h1:/20jfyN9Y5QPEAprSgKAUr+glWDY39ZiUEAYOEv5dsE=
 github.com/glycerine/goconvey v0.0.0-20190410193231-58a59202ab31/go.mod h1:Ogl1Tioa0aV7gstGFO7KhffUsb9M4ydbEbbxpcEDc24=
-github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
-github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-chi/chi/v5 v5.0.1/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
-github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
+github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
-github.com/go-co-op/gocron/v2 v2.22.0 h1:uEuH2F7k7VoESb1BYSaffuuV+T0kkpzsC0aXk7/z79I=
-github.com/go-co-op/gocron/v2 v2.22.0/go.mod h1:hiH/U9RMhTi1BBZJmef9s3KC9QwhpBF6PFrvUKaXY9M=
+github.com/go-co-op/gocron/v2 v2.21.2 h1:bD8/YwkojYHgXFr3iEulL148KBdTbKVxUZzFKpXcdbY=
+github.com/go-co-op/gocron/v2 v2.21.2/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
 github.com/go-enry/go-enry/v2 v2.9.6 h1:np63eOtMV56zfYDHnFVgpEVOk8fr2kmylcMnAZUDbSs=
 github.com/go-enry/go-enry/v2 v2.9.6/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
 github.com/go-enry/go-oniguruma v1.2.1/go.mod h1:bWDhYP+S6xZQgiRL7wlTScFYBe023B6ilRZbCAD5Hf4=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryLCdA=
-github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
-github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
-github.com/go-ldap/ldap/v3 v3.4.14/go.mod h1:S4eJUMUNjDkE0ZJtIZdybwyb03sGGLW6gxXT1Hs8VKA=
+github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
+github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
 github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
 github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
@@ -317,8 +319,8 @@ github.com/go-redis/redis/v7 v7.4.1 h1:PASvf36gyUpr2zdOUS/9Zqc80GbM+9BDyiJSJDDOr
 github.com/go-redis/redis/v7 v7.4.1/go.mod h1:JDNMw23GTyLNC4GZu9njt15ctBQVn7xjRfnwdHj/Dcg=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-redsync/redsync/v4 v4.17.0 h1:FFJ+uxZs44y4Sq10//IFKic9T94AYl+u3Sog98AHzBo=
-github.com/go-redsync/redsync/v4 v4.17.0/go.mod h1:CKVA6qwT07S/916i+Yd9h1/8YFQhCCpPYTQhvvYytJo=
+github.com/go-redsync/redsync/v4 v4.16.0 h1:bNcOzeHH9d3s6pghU9NJFMPrQa41f5Nx3L4YKr3BdEU=
+github.com/go-redsync/redsync/v4 v4.16.0/go.mod h1:V4gagqgyASWBZuwx4xGzu72aZNb/6Mo05byUa3mVmKQ=
 github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
 github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
@@ -374,8 +376,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
-github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
+github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
+github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -388,8 +390,8 @@ github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/licenseclassifier/v2 v2.0.0 h1:1Y57HHILNf4m0ABuMVb6xk4vAJYEUO0gDxNpog0pyeA=
 github.com/google/licenseclassifier/v2 v2.0.0/go.mod h1:cOjbdH0kyC9R22sdQbYsFkto4NGCAc+ZSwbeThazEtM=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/pprof v0.0.0-20260604005048-7023385849c0 h1:h1QTMDl6q9wDvDCJVpKQSjgleGFYnd2fOxmg2K+6BGE=
+github.com/google/pprof v0.0.0-20260604005048-7023385849c0/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
@@ -411,10 +413,17 @@ github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pw
 github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
+github.com/graph-gophers/graphql-go v1.10.2 h1:HXu6Wu5klCH4ALn1fQHVI20cjEIa4wftavHIgbLA4Fo=
+github.com/graph-gophers/graphql-go v1.10.2/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
@@ -462,12 +471,12 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
-github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -499,14 +508,14 @@ github.com/markbates/goth v1.82.0 h1:8j/c34AjBSTNzO7zTsOyP5IYCQCMBTRBHAbBt/PI0bQ
 github.com/markbates/goth v1.82.0/go.mod h1:/DRlcq0pyqkKToyZjsL2KgiA1zbF1HIjE7u2uC79rUk=
 github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
 github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.13 h1:DC0OMEpGjm6LfNFU4ckYcvbQKyp2vE8atyFGXNtDcf4=
 github.com/mattn/go-shellwords v1.0.13/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.49 h1:B8jBHC3xhxZgxztrgruTuLucebnULQnx4W7cF7SAE9w=
-github.com/mattn/go-sqlite3 v1.14.49/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/mattn/go-sqlite3 v1.14.47 h1:jOBI62gS7nKeZv+as1oGEy0+1qISgXwH/QBlR6KbfIo=
+github.com/mattn/go-sqlite3 v1.14.47/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
 github.com/meilisearch/meilisearch-go v0.36.3 h1:Yx1aTY5jDgtbStPVkhJTDoLnZTy5sejQSPyjfNMy6e4=
 github.com/meilisearch/meilisearch-go v0.36.3/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
 github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
@@ -525,8 +534,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.2.1 h1:PfBfwvKB/MmqyN8Vb1G9voWisaM9OrLv+WwOvMwS9Dw=
-github.com/minio/minio-go/v7 v7.2.1/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
+github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
+github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/minio/minlz v1.1.1 h1:OGmft1V6AnI/Wme332U6bhG54nxEan+VFgkD7lat4KM=
 github.com/minio/minlz v1.1.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -554,10 +563,10 @@ github.com/nwaples/rardecode/v2 v2.2.3/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsR
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oasdiff/yaml v0.1.1 h1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=
-github.com/oasdiff/yaml v0.1.1/go.mod h1:EYJNoyktvWMJ0Hmhx+6qTaqMOsalUaRGT8Sj1hNcegU=
-github.com/oasdiff/yaml3 v0.0.14 h1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=
-github.com/oasdiff/yaml3 v0.0.14/go.mod h1:csto2xfDjYccdUn/yw/bPjj/cYTdp6HtFA0J4TWG+gg=
+github.com/oasdiff/yaml v0.1.0 h1:0bqZjfKc/8S9urj4JuwepX41WX9EoA6ifhU3SV06cXg=
+github.com/oasdiff/yaml v0.1.0/go.mod h1:kOlRmMdL2X3vucLCEQO5u61SU22RysnfXvcttrZA1O0=
+github.com/oasdiff/yaml3 v0.0.13 h1:06svmvOHOVBqF81+sY2EUScvUI/iS/vl2VIeUUxZQwg=
+github.com/oasdiff/yaml3 v0.0.13/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
 github.com/olekukonko/errors v1.3.0 h1:teJvgLGUEqMzBUms+Dj3/3szNqCG/Jdw9iDbum8fR6U=
@@ -598,23 +607,23 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
-github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/common v0.68.1 h1:omjRRl4QP4komogpXuhfeOiisQg7xdy8VM1UY+pStaY=
+github.com/prometheus/common v0.68.1/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/quasoft/websspi v1.1.2 h1:/mA4w0LxWlE3novvsoEL6BBA1WnjJATbjkh1kFrTidw=
 github.com/quasoft/websspi v1.1.2/go.mod h1:HmVdl939dQ0WIXZhyik+ARdI03M6bQzaSEKcgpFmewk=
 github.com/rcrowley/go-metrics v0.0.0-20190826022208-cac0b30c2563/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
-github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
-github.com/redis/rueidis v1.0.76 h1:RdDWuvlYBSp+bTrBvaXqJnNEL3VVzsnjo+0psPFgLc4=
-github.com/redis/rueidis v1.0.76/go.mod h1:UsfHPSbomB6QAVMk4iiFkzRy0nh9o7scDGa+SitvBY4=
-github.com/redis/rueidis/rueidiscompat v1.0.76 h1:7LikbiqCQqCsZXeZ+akgZMnjIV/J0VHih9PIX4gGZC4=
-github.com/redis/rueidis/rueidiscompat v1.0.76/go.mod h1:UatQQLVj4QMIsZtpvRWY28qm6r2d72idhcS+C/RM+Zg=
+github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAtL9E=
+github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/redis/rueidis v1.0.71 h1:pODtnAR5GAB7j4ekhldZ29HKOxe4Hph0GTDGk1ayEQY=
+github.com/redis/rueidis v1.0.71/go.mod h1:lfdcZzJ1oKGKL37vh9fO3ymwt+0TdjkkUCJxbgpmcgQ=
+github.com/redis/rueidis/rueidiscompat v1.0.71 h1:wNZ//kEjMZgBM0KCk7ncOX8KmAgROU2kDdDNpwheG4w=
+github.com/redis/rueidis/rueidiscompat v1.0.71/go.mod h1:esmCLJvaRzZoKlgB82G1bY7Iky5TnO9Rz+NlhbEccFI=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rhysd/actionlint v1.7.12 h1:vQ4GeJN86C0QH+gTUQcs8McmK62OLT3kmakPMtEWYnY=
@@ -629,8 +638,8 @@ github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sassoftware/go-rpmutils v0.4.0 h1:ojND82NYBxgwrV+mX1CWsd5QJvvEZTKddtCdFLPWhpg=
 github.com/sassoftware/go-rpmutils v0.4.0/go.mod h1:3goNWi7PGAT3/dlql2lv3+MSN5jNYPjT5mVcQcIsYzI=
 github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
@@ -694,17 +703,17 @@ github.com/tstranex/u2f v1.0.0 h1:HhJkSzDDlVSVIVt7pDJwCHQj67k7A5EeBgPmeD+pVsQ=
 github.com/tstranex/u2f v1.0.0/go.mod h1:eahSLaqAS0zsIEv80+vXT7WanXs7MQQDg3j3wGBSayo=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
-github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
+github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
+github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.10.1 h1:7Kx9H50hrHbRbyxgO1KP6/BcbiGRz0uYh5YyQ30JEEY=
-github.com/urfave/cli/v3 v3.10.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.10.0 h1:0aU8yOObVDMkM13Cj4G+zb4P0PdeJMec65f81Ak1ioM=
+github.com/urfave/cli/v3 v3.10.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
-github.com/wneessen/go-mail v0.8.1 h1:tVcncj02/QySVFw3zr/kXOzZcuFQqBNT6K+Rbgm/pcM=
-github.com/wneessen/go-mail v0.8.1/go.mod h1:dWZ61zadzCIyvB4y1/YzC5O7MrbbzBfPkARmbosdf8w=
+github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
+github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
@@ -719,8 +728,8 @@ github.com/yohcop/openid-go v1.0.1/go.mod h1:b/AvD03P0KHj4yuihb+VtLD6bYYgsy0zqBz
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.8.5 h1:r6N5afV5qj/5S4UTch8agZHJ8UxNCMwX7WjkkJam2NA=
-github.com/yuin/goldmark v1.8.5/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
+github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
@@ -731,8 +740,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.55.1 h1:eX0iBhJ9GWP2XqQOH/pkmSvPosFS3rcyFcup/3kHL2k=
-gitlab.com/gitlab-org/api/client-go/v2 v2.55.1/go.mod h1:6GcBiCVrZBtOvl6HiahZ3nq5eBs7JMUARJeLN4/RgZU=
+gitlab.com/gitlab-org/api/client-go/v2 v2.42.0 h1:Bq5YIYgUJVbt4Hbh7ibBwNR4SNEafsyDVhIXl7dXDdg=
+gitlab.com/gitlab-org/api/client-go/v2 v2.42.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -767,12 +776,12 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
-golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
-golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -781,8 +790,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -798,8 +807,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -813,8 +822,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181221143128-b4a75ba826a6/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -845,8 +854,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -856,8 +865,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -868,8 +877,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -881,16 +890,16 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
-google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -919,20 +928,20 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
-modernc.org/cc/v4 v4.29.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
-modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
+modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c=
+modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws=
+modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
-modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
+modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
-modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
+modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA=
+modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -941,8 +950,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.56.0 h1:/D8e2RfFqoy/Zc6PuC76U28zFwmI/sYx1Kjm4yEn9e0=
-modernc.org/sqlite v1.56.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
+modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
+modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -951,7 +960,9 @@ mvdan.cc/xurls/v2 v2.6.0 h1:3NTZpeTxYVWNSokW3MKeyVkz/j7uYXYiMtXRUfmjbgI=
 mvdan.cc/xurls/v2 v2.6.0/go.mod h1:bCvEZ1XvdA6wDnxY7jPPjEmigDtvtvPXAD/Exa9IMSk=
 pgregory.net/rapid v0.4.2 h1:lsi9jhvZTYvzVpeG93WWgimPRmiJQfGFRNTEZh1dtY0=
 pgregory.net/rapid v0.4.2/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
+strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab h1:3IZDVyI8uBmZko6pwm39f7mE0aTY7LViNdQHMeH7U60=
+strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
-xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.3.11 h1:i4tlVUASogb0ZZFJHA7dZqoRU2pUpUsutnNdaOlFyMI=
+xorm.io/xorm v1.3.11/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
@@ -1,25 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package base
-
-import (
-	"gitea.dev/models/db" //nolint:depguard // allow to access db in migration
-	"gitea.dev/modules/git/gitrepo"
-)
-
-// HINT: MIGRATION-STRUCT-FROZEN: the structs used in migrations should not be affected by the changes happen in the future,
-// because the details can be different in different releases.
-// e.g. if one migration uses "User" model, it works in the early releases,
-// then one day, when the User model changes, the existing migration will break because it will use the new (incorrect) User model,
-// it should only use the old User model.
-//
-// Related: "models", "modules/structs", git repo directory layout on the disk, etc.
-//
-// If changes happen, the old migrations need to use a snapshot struct/function (copy the code and freeze)
-
-type ResourceIndex = db.ResourceIndex
-
-func LocalCodeGitRepo(ownerName, repoName string) gitrepo.RepositoryFacade {
-	return gitrepo.CodeRepoByName(ownerName, repoName)
-}
@@ -1,14 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_14
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-)
-
-func RecreateUserTableToFixDefaultValues(_ context.Context, _ base.EngineMigration) error {
-	return nil
-}
@@ -1,15 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_16
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-)
-
-func UseBase32HexForCredIDInWebAuthnCredential(_ context.Context, x base.EngineMigration) error {
-	// noop
-	return nil
-}
@@ -1,24 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_17
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-	"gitea.dev/modules/timeutil"
-)
-
-func AddReviewViewedFiles(_ context.Context, x base.EngineMigration) error {
-	type ReviewState struct {
-		ID           int64              `xorm:"pk autoincr"`
-		UserID       int64              `xorm:"NOT NULL UNIQUE(pull_commit_user)"`
-		PullID       int64              `xorm:"NOT NULL INDEX UNIQUE(pull_commit_user) DEFAULT 0"`
-		CommitSHA    string             `xorm:"NOT NULL VARCHAR(40) UNIQUE(pull_commit_user)"`
-		UpdatedFiles map[string]uint8   `xorm:"NOT NULL LONGTEXT JSON"`
-		UpdatedUnix  timeutil.TimeStamp `xorm:"updated"`
-	}
-
-	return x.Sync(new(ReviewState))
-}
@@ -1,18 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_20
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-)
-
-func AddVersionToActionRunner(_ context.Context, x base.EngineMigration) error {
-	type ActionRunner struct {
-		Version string `xorm:"VARCHAR(64)"` // the version of the runner
-	}
-
-	return x.Sync(new(ActionRunner))
-}
@@ -1,14 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"testing"
-
-	"gitea.dev/modelmigration/migrationtest"
-)
-
-func TestMain(m *testing.M) {
-	migrationtest.MainTest(m)
-}
@@ -1,24 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-
-	"xorm.io/xorm"
-)
-
-func AddMaxParallelToActionRunJob(_ context.Context, x base.EngineMigration) error {
-	type ActionRunJob struct {
-		MaxParallel int `xorm:"NOT NULL DEFAULT 0"`
-	}
-
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreConstrains:  true,
-		IgnoreDropIndices: true,
-	}, new(ActionRunJob))
-	return err
-}
@@ -1,37 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"testing"
-
-	"gitea.dev/modelmigration/migrationtest"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestAddMaxParallelToActionRunJob(t *testing.T) {
-	type ActionRunJob struct {
-		ID   int64  `xorm:"pk autoincr"`
-		Name string `xorm:"VARCHAR(255)"`
-	}
-
-	x, deferable := migrationtest.PrepareTestEnv(t, 0, new(ActionRunJob))
-	defer deferable()
-	if x == nil || t.Failed() {
-		return
-	}
-
-	_, err := x.Insert(&ActionRunJob{Name: "job-a"})
-	require.NoError(t, err)
-
-	require.NoError(t, AddMaxParallelToActionRunJob(t.Context(), x))
-
-	// pre-existing rows must default to unlimited
-	var maxParallel int
-	has, err := x.SQL("SELECT max_parallel FROM action_run_job WHERE id = ?", 1).Get(&maxParallel)
-	require.NoError(t, err)
-	require.True(t, has)
-	require.Equal(t, 0, maxParallel)
-}
@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-
-	"xorm.io/xorm"
-)
-
-// AddDeferredMatrixColumnsToActionRunJob adds the columns backing deferred (dynamic) matrix expansion
-func AddDeferredMatrixColumnsToActionRunJob(_ context.Context, x base.EngineMigration) error {
-	type ActionRunJob struct {
-		// IsMatrixDeferred marks jobs whose matrix depends on other jobs' outputs and is therefore expanded only once those jobs finish;
-		IsMatrixDeferred bool `xorm:"NOT NULL DEFAULT FALSE"`
-		// DeferredMatrixPayload preserves the raw, unevaluated payload across expansion so a rerun can re-derive the matrix
-		DeferredMatrixPayload []byte `xorm:"LONGBLOB"`
-	}
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreDropIndices: true,
-		IgnoreConstrains:  true,
-	}, new(ActionRunJob))
-	return err
-}
@@ -1,25 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-
-	"xorm.io/xorm"
-)
-
-// AddBlockOnCodeownerReviews adds block on codeowner reviews branch protection
-func AddBlockOnCodeownerReviews(_ context.Context, x base.EngineMigration) error {
-	type ProtectedBranch struct {
-		BlockOnCodeownerReviews bool `xorm:"NOT NULL DEFAULT false"`
-	}
-
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreConstrains:  true,
-		IgnoreDropIndices: true,
-	}, new(ProtectedBranch))
-	return err
-}
@@ -1,52 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-
-	"xorm.io/xorm"
-	"xorm.io/xorm/schemas"
-)
-
-func AddLicensePathToRepoLicense(ctx context.Context, x base.EngineMigration) error {
-	// Drop the old 2-column UNIQUE(s) index on (repo_id, license) and, on
-	// re-runs, the index created under the new name.
-	// xorm Sync cannot reliably update an index when its column set changes.
-	indexes, err := x.Dialect().GetIndexes(x.DB(), ctx, "repo_license")
-	if err != nil {
-		return err
-	}
-	for _, idx := range indexes {
-		if idx.Name == "s" || idx.Name == "path" {
-			if _, err := x.Exec(x.Dialect().DropIndexSQL("repo_license", idx)); err != nil {
-				return err
-			}
-		}
-	}
-
-	// Add license_path column. The DEFAULT backfills existing rows: all repos
-	// created before this migration used the single LICENSE file convention.
-	type RepoLicense struct {
-		LicensePath string `xorm:"VARCHAR(255) NOT NULL DEFAULT 'LICENSE'"`
-	}
-	if _, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreDropIndices: true,
-		IgnoreConstrains:  true,
-	}, new(RepoLicense)); err != nil {
-		return err
-	}
-
-	// Create new 3-column UNIQUE(path) index on (repo_id, license, license_path);
-	// xorm prefixes the name to UQE_repo_license_path.
-	newIndex := schemas.NewIndex("path", schemas.UniqueType)
-	newIndex.AddColumn("repo_id", "license", "license_path")
-	if _, err := x.Exec(x.Dialect().CreateIndexSQL("repo_license", newIndex)); err != nil {
-		return err
-	}
-
-	return nil
-}
@@ -1,80 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"context"
-	"testing"
-
-	"gitea.dev/modelmigration/migrationtest"
-	"gitea.dev/modules/timeutil"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"xorm.io/xorm/schemas"
-)
-
-// repoLicenseBeforeV345 mirrors the pre-migration repo_license table: no
-// license_path column and a 2-column UNIQUE(s) index on (repo_id, license).
-type repoLicenseBeforeV345 struct {
-	ID          int64 `xorm:"pk autoincr"`
-	RepoID      int64 `xorm:"UNIQUE(s) NOT NULL"`
-	CommitID    string
-	License     string             `xorm:"VARCHAR(255) UNIQUE(s) NOT NULL"`
-	CreatedUnix timeutil.TimeStamp `xorm:"created"`
-	UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
-}
-
-func (repoLicenseBeforeV345) TableName() string { return "repo_license" }
-
-func Test_AddLicensePathToRepoLicense(t *testing.T) {
-	x, deferable := migrationtest.PrepareTestEnv(t, 0, new(repoLicenseBeforeV345))
-	defer deferable()
-
-	_, err := x.Insert(&repoLicenseBeforeV345{RepoID: 1, CommitID: "c1", License: "MIT"})
-	require.NoError(t, err)
-	_, err = x.Insert(&repoLicenseBeforeV345{RepoID: 1, CommitID: "c1", License: "Apache-2.0"})
-	require.NoError(t, err)
-	_, err = x.Insert(&repoLicenseBeforeV345{RepoID: 2, CommitID: "c2", License: "MIT"})
-	require.NoError(t, err)
-
-	indexes, err := x.Dialect().GetIndexes(x.DB(), context.Background(), "repo_license")
-	require.NoError(t, err)
-	oldIdx, ok := indexes["s"] // GetIndexes strips the UQE_repo_license_ prefix
-	require.True(t, ok, "old 2-column unique s index should exist before migration")
-	assert.Equal(t, schemas.UniqueType, oldIdx.Type)
-	assert.Equal(t, []string{"repo_id", "license"}, oldIdx.Cols)
-
-	require.NoError(t, AddLicensePathToRepoLicense(t.Context(), x))
-	require.NoError(t, AddLicensePathToRepoLicense(t.Context(), x)) // idempotent
-
-	indexes, err = x.Dialect().GetIndexes(x.DB(), context.Background(), "repo_license")
-	require.NoError(t, err)
-	assert.NotContains(t, indexes, "s", "old 2-column unique s index should be gone after migration")
-	newIdx, ok := indexes["path"] // GetIndexes strips the UQE_repo_license_ prefix
-	require.True(t, ok, "new index must be named path (UQE_repo_license_path)")
-	assert.Equal(t, schemas.UniqueType, newIdx.Type)
-	assert.Equal(t, []string{"repo_id", "license", "license_path"}, newIdx.Cols)
-
-	// pre-existing rows must default to the LICENSE path
-	type licenseRow struct {
-		RepoID      int64
-		License     string
-		LicensePath string
-	}
-	var rows []licenseRow
-	require.NoError(t, x.SQL("SELECT repo_id, license, license_path FROM repo_license ORDER BY id").Find(&rows))
-	require.Len(t, rows, 3)
-	for _, r := range rows {
-		assert.Equal(t, "LICENSE", r.LicensePath)
-	}
-
-	// the new index is unique per (repo_id, license, license_path): the exact
-	// duplicate must be rejected, while a second path for the same license
-	// in the same repo is allowed
-	_, err = x.Exec("INSERT INTO repo_license (repo_id, commit_id, license, license_path) VALUES (1, 'c1', 'MIT', 'LICENSE')")
-	require.Error(t, err)
-	_, err = x.Exec("INSERT INTO repo_license (repo_id, commit_id, license, license_path) VALUES (1, 'c1', 'MIT', 'LICENSES/MIT.txt')")
-	require.NoError(t, err)
-}
@@ -1,25 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-
-	"xorm.io/xorm"
-)
-
-func AddWatchOptions(_ context.Context, x base.EngineMigration) error {
-	type Watch struct {
-		PullRequests bool `xorm:"NOT NULL DEFAULT true"`
-		Issues       bool `xorm:"NOT NULL DEFAULT true"`
-		Releases     bool `xorm:"NOT NULL DEFAULT true"`
-	}
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreConstrains: true,
-		IgnoreIndices:    true,
-	}, new(Watch))
-	return err
-}
@@ -1,24 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-)
-
-func RecreateEmailHashTable(_ context.Context, x base.EngineMigration) error {
-	// the rows are unreachable MD5 hashes and their UNIQUE email index would reject the SHA256 replacements
-	if err := x.DropTables("email_hash"); err != nil {
-		return err
-	}
-
-	type EmailHash struct {
-		Hash     string `xorm:"pk varchar(64)"`
-		Email    string `xorm:"UNIQUE(email_hashtype) NOT NULL"`
-		HashType string `xorm:"UNIQUE(email_hashtype) NOT NULL varchar(16)"`
-	}
-	return x.Sync(new(EmailHash))
-}
@@ -1,38 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v28
-
-import (
-	"strings"
-	"testing"
-
-	"gitea.dev/modelmigration/migrationtest"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestRecreateEmailHashTable(t *testing.T) {
-	type EmailHash struct {
-		Hash  string `xorm:"pk varchar(32)"`
-		Email string `xorm:"UNIQUE NOT NULL"`
-	}
-
-	x, deferable := migrationtest.PrepareTestEnv(t, 0, new(EmailHash))
-	defer deferable()
-	if x == nil || t.Failed() {
-		return
-	}
-
-	_, err := x.Insert(&EmailHash{Hash: strings.Repeat("a", 32), Email: "gitea@example.com"})
-	require.NoError(t, err)
-
-	require.NoError(t, RecreateEmailHashTable(t.Context(), x))
-
-	count, err := x.Count(new(EmailHash))
-	require.NoError(t, err)
-	require.EqualValues(t, 0, count, "the unreachable MD5 rows must be gone")
-
-	_, err = x.Exec("INSERT INTO email_hash (hash, email, hash_type) VALUES (?, ?, ?)", strings.Repeat("b", 64), "gitea@example.com", "sha256")
-	require.NoError(t, err, "the new schema must hold a SHA256 hash")
-}
@@ -9,10 +9,10 @@ package actions
 import (
 	"context"
 	"errors"
-	"slices"
 	"time"

 	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"

@@ -147,7 +147,7 @@ type FindArtifactsOptions struct {
 	db.ListOptions
 	RepoID               int64
 	RunID                int64
-	RunAttemptIDs        []int64 // empty means every attempt; pass 0 to target legacy artifacts, which have run_attempt_id=0
+	RunAttemptID         optional.Option[int64] // use optional to allow filtering by zero (legacy artifacts have run_attempt_id=0)
 	ArtifactName         string
 	Status               int
 	FinalizedArtifactsV4 bool
@@ -167,8 +167,8 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	if opts.RunID > 0 {
 		cond = cond.And(builder.Eq{"run_id": opts.RunID})
 	}
-	if len(opts.RunAttemptIDs) > 0 {
-		cond = cond.And(builder.In("run_attempt_id", opts.RunAttemptIDs))
+	if opts.RunAttemptID.Has() {
+		cond = cond.And(builder.Eq{"run_attempt_id": opts.RunAttemptID.Value()})
 	}
 	if opts.ArtifactName != "" {
 		cond = cond.And(builder.Eq{"artifact_name": opts.ArtifactName})
@@ -185,27 +185,6 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	return cond
 }

-// FindReadableArtifacts returns the artifacts of opts.RunAttemptIDs, only keeps the ones from a newer attempt.
-func FindReadableArtifacts(ctx context.Context, opts FindArtifactsOptions) ([]*ActionArtifact, error) {
-	arts, err := db.Find[ActionArtifact](ctx, opts)
-	if err != nil || len(opts.RunAttemptIDs) <= 1 {
-		return arts, err
-	}
-	return keepLatestAttemptArtifacts(arts), nil
-}
-
-// keepLatestAttemptArtifacts keeps, per name, only the artifacts of the newest attempt that has it.
-// A v3 artifact is one row per uploaded file, so the whole group of the winning attempt is kept.
-func keepLatestAttemptArtifacts(arts []*ActionArtifact) []*ActionArtifact {
-	latest := make(map[string]int64)
-	for _, art := range arts {
-		latest[art.ArtifactName] = max(latest[art.ArtifactName], art.RunAttemptID)
-	}
-	return slices.DeleteFunc(arts, func(art *ActionArtifact) bool {
-		return art.RunAttemptID != latest[art.ArtifactName]
-	})
-}
-
 // ActionArtifactMeta is the meta-data of an artifact
 type ActionArtifactMeta struct {
 	ArtifactName string
@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestKeepLatestAttemptArtifacts(t *testing.T) {
-	arts := []*ActionArtifact{
-		{ID: 1, RunAttemptID: 1, ArtifactName: "inherited"},
-		{ID: 2, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "a.txt"},
-		{ID: 3, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "b.txt"},
-		{ID: 4, RunAttemptID: 2, ArtifactName: "shadowed", ArtifactPath: "c.txt"},
-		{ID: 5, RunAttemptID: 2, ArtifactName: "own"},
-	}
-
-	// the whole "shadowed" group of attempt 1 is dropped, its multi-file rows must not mix with attempt 2
-	var ids []int64
-	for _, art := range keepLatestAttemptArtifacts(arts) {
-		ids = append(ids, art.ID)
-	}
-	assert.Equal(t, []int64{1, 4, 5}, ids)
-}
@@ -92,13 +92,6 @@ func (run *ActionRun) Link() string {
 	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.Link(), run.ID)
 }

-func (run *ActionRun) APIURL(ctx context.Context) string {
-	if run.Repo == nil {
-		return ""
-	}
-	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.APIURL(ctx), run.ID)
-}
-
 func (run *ActionRun) WorkflowLink() string {
 	if run.Repo == nil {
 		return ""
@@ -128,7 +121,7 @@ func (run *ActionRun) PrettyRef() string {
 	return refName.ShortName()
 }

-// RefTooltip return a tooltip of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
+// RefTooltip return a tooltop of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
 func (run *ActionRun) RefTooltip() string {
 	payload, err := run.GetPullRequestEventPayload()
 	if err == nil && payload != nil && payload.PullRequest != nil {
@@ -284,12 +277,6 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }

-func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
-	var runs []*ActionRun
-	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
-	return runs, err
-}
-
 func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
 	run, has, err := db.Get[ActionRun](ctx, builder.Eq{"repo_id": repoID, "`index`": runIndex})
 	if err != nil {
@@ -404,5 +391,5 @@ func CancelPreviousJobsByRunConcurrency(ctx context.Context, attempt *ActionRunA
 		jobsToCancel = append(jobsToCancel, jobs...)
 	}

-	return CancelJobs(ctx, jobsToCancel, false)
+	return CancelJobs(ctx, jobsToCancel)
 }
@@ -11,7 +11,6 @@ import (

 	"gitea.dev/models/db"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
@@ -63,16 +62,14 @@ func (attempt *ActionRunAttempt) LoadAttributes(ctx context.Context) (err error)
 		attempt.Run = run
 	}

-	return attempt.LoadTriggerUser(ctx)
-}
-
-// LoadTriggerUser loads the attempt's trigger user if not already loaded.
-func (attempt *ActionRunAttempt) LoadTriggerUser(ctx context.Context) (err error) {
-	if attempt.TriggerUser != nil {
-		return nil
+	if attempt.TriggerUser == nil {
+		attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
+		if err != nil {
+			return err
+		}
 	}
-	attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
-	return err
+
+	return nil
 }

 func GetRunAttemptByRepoAndID(ctx context.Context, repoID, attemptID int64) (*ActionRunAttempt, error) {
@@ -97,56 +94,6 @@ func GetRunAttemptByRunIDAndAttemptNum(ctx context.Context, runID, attemptNum in
 	return &attempt, nil
 }

-// GetArtifactAttemptIDs returns the IDs of the attempts whose artifacts the job may read, newest first,
-// always including the job's own attempt.
-// An attempt that re-ran only some of the run's jobs keeps the artifacts of the attempt it re-ran from,
-// because the jobs it passed through never upload them again; a rerun of the whole run starts over.
-func GetArtifactAttemptIDs(ctx context.Context, job *ActionRunJob) ([]int64, error) {
-	if job.Attempt <= 1 || job.RunAttemptID == 0 {
-		return []int64{job.RunAttemptID}, nil
-	}
-
-	attempts, err := ListRunAttemptsByRunID(ctx, job.RunID)
-	if err != nil {
-		return nil, err
-	}
-	// a newer attempt is never readable, and attempt 1 has nothing older to continue into
-	candidateIDs := container.FilterSlice(attempts, func(a *ActionRunAttempt) (int64, bool) {
-		return a.ID, a.Attempt > 1 && a.Attempt <= job.Attempt
-	})
-	passThroughAttemptIDs, err := findPassThroughAttemptIDs(ctx, candidateIDs)
-	if err != nil {
-		return nil, err
-	}
-
-	ids := make([]int64, 0, len(attempts))
-	for _, attempt := range attempts {
-		if attempt.Attempt > job.Attempt {
-			continue
-		}
-		ids = append(ids, attempt.ID)
-		if !slices.Contains(passThroughAttemptIDs, attempt.ID) {
-			// stops at the first attempt that passed no job through
-			break
-		}
-	}
-	return ids, nil
-}
-
-// findPassThroughAttemptIDs narrows the given attempts to those that were a rerun of selected jobs:
-// only such a rerun clones jobs carrying a source task.
-// TODO: best-effort. Needs a better way to distinguish between "partial re-run" and "full re-run".
-func findPassThroughAttemptIDs(ctx context.Context, attemptIDs []int64) ([]int64, error) {
-	passThroughAttemptIDs := make([]int64, 0, len(attemptIDs))
-	return passThroughAttemptIDs, db.GetEngine(ctx).
-		Table("action_run_job").
-		Cols("run_attempt_id").
-		In("run_attempt_id", attemptIDs).
-		Where("source_task_id <> 0").
-		Distinct("run_attempt_id").
-		Find(&passThroughAttemptIDs)
-}
-
 // FindConcurrentRunAttempts returns attempts in the given concurrency group and status set.
 // Results are unordered; callers must not depend on any particular row order.
 func FindConcurrentRunAttempts(ctx context.Context, repoID int64, concurrencyGroup string, statuses []Status) ([]*ActionRunAttempt, error) {
@@ -13,7 +13,6 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/modules/actions/jobparser"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
@@ -70,20 +69,6 @@ type ActionRunJob struct {
 	// Org/repo clamps are enforced when the token is used at runtime.
 	// It is JSON-encoded repo_model.ActionsTokenPermissions and may be empty if not specified.
 	TokenPermissions *repo_model.ActionsTokenPermissions `xorm:"JSON TEXT"`
-	// MaxParallel is strategy.max-parallel, shared by all matrix jobs with the same JobID (0 = unlimited).
-	MaxParallel int `xorm:"NOT NULL DEFAULT 0"`
-
-	// IsMatrixDeferred marks a placeholder for a job whose matrix references `needs.*.outputs.*` and so
-	// could not be expanded at planning time. Its WorkflowPayload still carries the raw, unevaluated
-	// matrix; the job emitter expands it once the needs finish. Only a successful expansion clears the flag:
-	// it survives a terminal status (skipped, cancelled, failed expansion) so a rerun can recognize
-	// the row as unexpanded and re-derive the matrix instead of dispatching the raw payload.
-	IsMatrixDeferred bool `xorm:"NOT NULL DEFAULT FALSE"`
-
-	// DeferredMatrixPayload preserves a deferred-matrix placeholder's original WorkflowPayload (the raw, unevaluated matrix).
-	// A rerun whose needs re-run collapses the combinations back into a single placeholder built from this payload,
-	// so the matrix is re-derived from the fresh outputs.
-	DeferredMatrixPayload []byte `xorm:"LONGBLOB"`

 	// RunAttemptID identifies the ActionRunAttempt this job belongs to.
 	// A value of 0 indicates a legacy job created before ActionRunAttempt existed.
@@ -192,16 +177,6 @@ func (job *ActionRunJob) LoadAttributes(ctx context.Context) error {

 // ParseJob parses the job structure from the ActionRunJob.WorkflowPayload
 func (job *ActionRunJob) ParseJob() (*jobparser.Job, error) {
-	if job.IsMatrixDeferred {
-		// The needs were erased before the placeholder was persisted, so jobparser.Parse no longer
-		// recognises the raw matrix it still carries and would re-expand it: see ParseRawSingleWorkflow.
-		_, workflowJob, err := jobparser.ParseRawSingleWorkflow(job.WorkflowPayload)
-		if err != nil {
-			return nil, fmt.Errorf("job %d deferred matrix placeholder: unable to parse: %w", job.ID, err)
-		}
-		return workflowJob, nil
-	}
-
 	// job.WorkflowPayload is a SingleWorkflow created from an ActionRun's workflow, which exactly contains this job's YAML definition.
 	// Ideally it shouldn't be called "Workflow", it is just a job with global workflow fields + trigger
 	parsedWorkflows, err := jobparser.Parse(job.WorkflowPayload)
@@ -261,16 +236,12 @@ func GetLatestAttemptJobsByRepoAndRunID(ctx context.Context, repoID, runID int64
 	if err != nil {
 		return nil, err
 	}
-	return GetLatestAttemptJobsByRun(ctx, run)
-}
-
-func GetLatestAttemptJobsByRun(ctx context.Context, run *ActionRun) (ActionJobList, error) {
 	if run.LatestAttemptID > 0 {
-		return GetRunJobsByRunAndAttemptID(ctx, run.ID, run.LatestAttemptID)
+		return GetRunJobsByRunAndAttemptID(ctx, runID, run.LatestAttemptID)
 	}

 	var jobs []*ActionRunJob
-	if err := db.GetEngine(ctx).Where("repo_id=? AND run_id=? AND run_attempt_id=0", run.RepoID, run.ID).OrderBy("id").Find(&jobs); err != nil {
+	if err := db.GetEngine(ctx).Where("repo_id=? AND run_id=? AND run_attempt_id=0", repoID, runID).OrderBy("id").Find(&jobs); err != nil {
 		return nil, err
 	}
 	return jobs, nil
@@ -350,53 +321,6 @@ func GetPriorAttemptChildrenByParent(ctx context.Context, runID, currentAttemptI
 	return nil, nil //nolint:nilnil // every prior attempt skipped this caller
 }

-// GetPriorAttemptMatrixCombos returns the most recent prior attempt's combination rows of the given
-// dynamic-matrix job, indexed by Name, so re-expansion keeps AttemptJobIDs stable across attempts.
-func GetPriorAttemptMatrixCombos(ctx context.Context, runID, currentAttemptID, parentAttemptJobID int64, jobID string) (map[string]*ActionRunJob, error) {
-	// An unexpanded placeholder is not a combination, so it is skipped and the search looks further
-	// back past it. Only the columns the scope check and the result need are read: the rows carry
-	// two payload blobs, and every prior attempt of the job is a candidate.
-	var candidates []*ActionRunJob
-	if err := db.GetEngine(ctx).
-		Where("run_id = ? AND job_id = ? AND run_attempt_id < ? AND is_matrix_deferred = ?", runID, jobID, currentAttemptID, false).
-		Cols("id", "name", "attempt_job_id", "run_attempt_id", "parent_job_id").
-		Desc("run_attempt_id").
-		Find(&candidates); err != nil {
-		return nil, fmt.Errorf("find prior matrix combos: %w", err)
-	}
-
-	// Every combination of one attempt shares a parent, so dedupe before the lookup.
-	parentIDs := container.FilterSlice(candidates, func(c *ActionRunJob) (int64, bool) {
-		return c.ParentJobID, c.ParentJobID > 0
-	})
-	parentAttemptIDByRowID := make(map[int64]int64, len(parentIDs))
-	if len(parentIDs) > 0 {
-		var parents []*ActionRunJob
-		if err := db.GetEngine(ctx).In("id", parentIDs).Cols("id", "attempt_job_id").Find(&parents); err != nil {
-			return nil, fmt.Errorf("find prior matrix combo parents: %w", err)
-		}
-		for _, p := range parents {
-			parentAttemptIDByRowID[p.ID] = p.AttemptJobID
-		}
-	}
-
-	// Rows arrive newest-attempt-first, so the first in-scope row fixes the attempt to take.
-	combos := map[string]*ActionRunJob{}
-	newestAttemptID := int64(0)
-	for _, c := range candidates {
-		if parentAttemptIDByRowID[c.ParentJobID] != parentAttemptJobID {
-			continue
-		}
-		if newestAttemptID == 0 {
-			newestAttemptID = c.RunAttemptID
-		} else if c.RunAttemptID != newestAttemptID {
-			break
-		}
-		combos[c.Name] = c
-	}
-	return combos, nil
-}
-
 // GetDirectChildJobsByParent returns the direct child jobs of a parent job (e.g. a reusable workflow caller).
 func GetDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) (ActionJobList, error) {
 	var jobs []*ActionRunJob
@@ -409,14 +333,6 @@ func GetDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) (A
 	return jobs, nil
 }

-// DeleteDirectChildJobsByParent deletes the direct child jobs of a parent job.
-func DeleteDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) error {
-	_, err := db.GetEngine(ctx).
-		Where("run_id=? AND parent_job_id=?", parentJob.RunID, parentJob.ID).
-		Delete(new(ActionRunJob))
-	return err
-}
-
 // CollectAllDescendantJobs returns every job in `allJobs` that lives under parent's subtree (recursively), excluding `parent` itself
 func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*ActionRunJob {
 	parents := map[int64]bool{parent.ID: true}
@@ -524,74 +440,58 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		return affected, RefreshReusableCallerStatus(ctx, parent)
 	}

-	if err := refreshRunStatus(ctx, job.RepoID, job.RunID, job.RunAttemptID, StatusUnknown); err != nil {
-		return 0, err
+	{
+		// Other goroutines may aggregate the status of the attempt/run and update it too.
+		// So we need to load the current jobs before updating the aggregate state.
+		if job.RunAttemptID > 0 {
+			attempt, err := GetRunAttemptByRepoAndID(ctx, job.RepoID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetRunJobsByRunAndAttemptID(ctx, job.RunID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			attempt.Status = AggregateJobStatus(jobs)
+			if attempt.Started.IsZero() && attempt.Status.IsRunning() {
+				attempt.Started = timeutil.TimeStampNow()
+			}
+			if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
+				attempt.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
+			}
+		} else {
+			// TODO: Remove this fallback in the future.
+			// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
+			// This path keeps those runs' status consistent when their jobs finish, including:
+			//   - jobs created before migration v331 and complete on the new version starts
+			//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
+			run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetLatestAttemptJobsByRepoAndRunID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			run.Status = AggregateJobStatus(jobs)
+			if run.Started.IsZero() && run.Status.IsRunning() {
+				run.Started = timeutil.TimeStampNow()
+			}
+			if run.Stopped.IsZero() && run.Status.IsDone() {
+				run.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run %d: %w", run.ID, err)
+			}
+		}
 	}

 	return affected, nil
 }

-// refreshRunStatus recomputes the status of an attempt from the jobs currently stored and persists it.
-// The latest attempt propagates its status to its run, an older one only updates itself.
-// noJobsStatus settles an attempt without any job, which AggregateJobStatus cannot conclude on its own.
-func refreshRunStatus(ctx context.Context, repoID, runID, runAttemptID int64, noJobsStatus Status) error {
-	// Other goroutines may aggregate the status of the attempt/run and update it too.
-	// So we need to load the current jobs before updating the aggregate state.
-	if runAttemptID > 0 {
-		attempt, err := GetRunAttemptByRepoAndID(ctx, repoID, runAttemptID)
-		if err != nil {
-			return err
-		}
-		jobs, err := GetRunJobsByRunAndAttemptID(ctx, runID, runAttemptID)
-		if err != nil {
-			return err
-		}
-		attempt.Status = AggregateJobStatus(jobs)
-		if len(jobs) == 0 {
-			attempt.Status = noJobsStatus
-		}
-		if attempt.Started.IsZero() && attempt.Status.IsRunning() {
-			attempt.Started = timeutil.TimeStampNow()
-		}
-		if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
-			attempt.Stopped = timeutil.TimeStampNow()
-		}
-		if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
-			return fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
-		}
-		return nil
-	}
-
-	// TODO: Remove this fallback in the future.
-	// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
-	// This path keeps those runs' status consistent when their jobs finish, including:
-	//   - jobs created before migration v331 and complete on the new version starts
-	//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
-	//   - cancelling a legacy run whose jobs are all already done
-	run, err := GetRunByRepoAndID(ctx, repoID, runID)
-	if err != nil {
-		return err
-	}
-	jobs, err := GetLatestAttemptJobsByRun(ctx, run)
-	if err != nil {
-		return err
-	}
-	run.Status = AggregateJobStatus(jobs)
-	if len(jobs) == 0 {
-		run.Status = noJobsStatus
-	}
-	if run.Started.IsZero() && run.Status.IsRunning() {
-		run.Started = timeutil.TimeStampNow()
-	}
-	if run.Stopped.IsZero() && run.Status.IsDone() {
-		run.Stopped = timeutil.TimeStampNow()
-	}
-	if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
-		return fmt.Errorf("update run %d: %w", run.ID, err)
-	}
-	return nil
-}
-
 // RefreshReusableCallerStatus recomputes a reusable workflow caller's Status, Started and Stopped from its current direct children and persists the change.
 // No-op if caller is not a reusable caller.
 //
@@ -703,7 +603,7 @@ func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID strin
 			return cancelledJobs, err
 		}

-		cjs, err := CancelJobs(ctx, jobs, false)
+		cjs, err := CancelJobs(ctx, jobs)
 		if err != nil {
 			return cancelledJobs, err
 		}
@@ -749,18 +649,15 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 		jobsToCancel = append(jobsToCancel, jobs...)
 	}

-	return CancelJobs(ctx, jobsToCancel, false)
+	return CancelJobs(ctx, jobsToCancel)
 }

-// CancelJobs cancels every cancellable job it is given, force skipping the graceful cancelling
-// handshake so a running task is marked cancelled without waiting for its runner. It leaves the
-// status of a run it cancelled nothing in untouched, SettleRunAfterCancel gives such a run a final one.
-func CancelJobs(ctx context.Context, jobs []*ActionRunJob, force bool) ([]*ActionRunJob, error) {
+func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
 	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))

 	for _, job := range jobs {
 		if job.IsReusableCaller {
-			sub, err := cancelReusableCaller(ctx, job, force)
+			sub, err := cancelReusableCaller(ctx, job)
 			if err != nil {
 				return cancelledJobs, err
 			}
@@ -768,7 +665,7 @@ func CancelJobs(ctx context.Context, jobs []*ActionRunJob, force bool) ([]*Actio
 			continue
 		}

-		c, err := cancelOneJob(ctx, job, force)
+		c, err := cancelOneJob(ctx, job)
 		if err != nil {
 			return cancelledJobs, err
 		}
@@ -779,18 +676,8 @@ func CancelJobs(ctx context.Context, jobs []*ActionRunJob, force bool) ([]*Actio
 	return cancelledJobs, nil
 }

-// SettleRunAfterCancel gives a run a final status when cancelling it updated no job at all.
-// A run's status is otherwise only ever written as a side effect of a job update, so a run whose
-// jobs are all done already, or that has no job at all, would stay unfinished forever.
-func SettleRunAfterCancel(ctx context.Context, run *ActionRun) error {
-	if run.Status.IsDone() {
-		return nil
-	}
-	return refreshRunStatus(ctx, run.RepoID, run.ID, run.LatestAttemptID, StatusCancelled)
-}
-
 // cancelOneJob cancels a single job and returns the post-cancel row
-func cancelOneJob(ctx context.Context, job *ActionRunJob, force bool) (*ActionRunJob, error) {
+func cancelOneJob(ctx context.Context, job *ActionRunJob) (*ActionRunJob, error) {
 	if job.Status.IsDone() {
 		return nil, nil //nolint:nilnil // signal "nothing to cancel; not an error"
 	}
@@ -809,8 +696,7 @@ func cancelOneJob(ctx context.Context, job *ActionRunJob, force bool) (*ActionRu
 		return job, nil
 	}
 	// Has a task: stop the task and re-read the row.
-	stopStatus := util.Iif(force, StatusCancelled, StatusCancelling)
-	if err := StopTask(ctx, job.TaskID, stopStatus); err != nil {
+	if err := StopTask(ctx, job.TaskID, StatusCancelling); err != nil {
 		return nil, err
 	}
 	updated, err := GetRunJobByRunAndID(ctx, job.RunID, job.ID)
@@ -821,7 +707,7 @@ func cancelOneJob(ctx context.Context, job *ActionRunJob, force bool) (*ActionRu
 }

 // cancelReusableCaller cancels `caller` and all its child jobs
-func cancelReusableCaller(ctx context.Context, caller *ActionRunJob, force bool) ([]*ActionRunJob, error) {
+func cancelReusableCaller(ctx context.Context, caller *ActionRunJob) ([]*ActionRunJob, error) {
 	cancelledJobs := make([]*ActionRunJob, 0)

 	attemptJobs, err := GetRunJobsByRunAndAttemptID(ctx, caller.RunID, caller.RunAttemptID)
@@ -836,7 +722,7 @@ func cancelReusableCaller(ctx context.Context, caller *ActionRunJob, force bool)
 	slices.SortFunc(descendants, func(a, b *ActionRunJob) int { return cmp.Compare(b.ID, a.ID) })

 	for _, c := range descendants {
-		cancelled, err := cancelOneJob(ctx, c, force)
+		cancelled, err := cancelOneJob(ctx, c)
 		if err != nil {
 			return cancelledJobs, err
 		}
@@ -845,7 +731,7 @@ func cancelReusableCaller(ctx context.Context, caller *ActionRunJob, force bool)
 		}
 	}

-	if c, err := cancelOneJob(ctx, caller, force); err != nil {
+	if c, err := cancelOneJob(ctx, caller); err != nil {
 		return cancelledJobs, err
 	} else if c != nil {
 		cancelledJobs = append(cancelledJobs, c)
@@ -99,10 +99,6 @@ type FindRunJobOptions struct {
 	UpdatedBefore    timeutil.TimeStamp
 	ConcurrencyGroup string
 	OrderBy          db.SearchOrderBy
-	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
-	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
-	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
-	AccessibleRepoIDsSubQuery *builder.Builder
 }

 var JobOrderByMap = map[string]map[string]db.SearchOrderBy{
@@ -136,9 +132,6 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 		}
 		cond = cond.And(builder.Eq{"`action_run_job`.concurrency_group": opts.ConcurrencyGroup})
 	}
-	if opts.AccessibleRepoIDsSubQuery != nil {
-		cond = cond.And(builder.In("`action_run_job`.repo_id", opts.AccessibleRepoIDsSubQuery))
-	}
 	return cond
 }

@@ -159,12 +152,3 @@ func (opts FindRunJobOptions) ToOrders() string {
 }

 var _ db.FindOptionsOrder = FindRunJobOptions{}
-
-// CountRunJobsByRunAndAttemptID counts the jobs belonging to the given run attempt.
-// It is used to enforce MaxJobNumPerRun when reusable-workflow expansion inserts new jobs.
-func CountRunJobsByRunAndAttemptID(ctx context.Context, runID, runAttemptID int64) (int64, error) {
-	return db.Count[ActionRunJob](ctx, FindRunJobOptions{
-		RunID:        runID,
-		RunAttemptID: optional.Some(runAttemptID),
-	})
-}
@@ -4,12 +4,10 @@
 package actions

 import (
-	"fmt"
 	"testing"

 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
-	"gitea.dev/modules/timeutil"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -187,7 +185,7 @@ func TestCancelJobs_NestedBlockedReusableCaller(t *testing.T) {
 	// Cancel all jobs of the attempt, ordered by id (parent before child).
 	jobs, err := GetRunJobsByRunAndAttemptID(ctx, run.ID, attempt.ID)
 	require.NoError(t, err)
-	_, err = CancelJobs(ctx, jobs, false)
+	_, err = CancelJobs(ctx, jobs)
 	require.NoError(t, err)

 	for _, j := range []*ActionRunJob{outer, inner} {
@@ -199,205 +197,3 @@ func TestCancelJobs_NestedBlockedReusableCaller(t *testing.T) {
 	gotRun := unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID})
 	assert.Equal(t, StatusCancelled, gotRun.Status, "run must aggregate to Cancelled, not stay Blocked")
 }
-
-func TestSettleRunAfterCancel(t *testing.T) {
-	// A run that cancelling updates no job in, because its jobs all reached a final status already
-	// or because it has none at all. Its own row has to be settled explicitly, or the run can never
-	// finish and can never be deleted either.
-
-	newStuckRun := func(t *testing.T, withAttempt, withJob bool) (*ActionRun, []*ActionRunJob) {
-		t.Helper()
-		ctx := t.Context()
-
-		run := &ActionRun{
-			Title:         "stuck-waiting",
-			RepoID:        4,
-			Index:         9801,
-			OwnerID:       1,
-			WorkflowID:    "test.yaml",
-			TriggerUserID: 1,
-			Ref:           "refs/heads/master",
-			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-			Event:         "push",
-			TriggerEvent:  "push",
-			EventPayload:  "{}",
-			Status:        StatusWaiting,
-		}
-		require.NoError(t, db.Insert(ctx, run))
-
-		var runAttemptID int64
-		if withAttempt {
-			attempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 1, TriggerUserID: 1, Status: StatusWaiting}
-			require.NoError(t, db.Insert(ctx, attempt))
-			run.LatestAttemptID = attempt.ID
-			require.NoError(t, UpdateRun(ctx, run, "latest_attempt_id"))
-			runAttemptID = attempt.ID
-		}
-
-		if !withJob {
-			return run, nil
-		}
-		job := &ActionRunJob{
-			RunID:        run.ID,
-			RunAttemptID: runAttemptID,
-			RepoID:       run.RepoID,
-			OwnerID:      run.OwnerID,
-			CommitSHA:    run.CommitSHA,
-			Name:         "job1",
-			JobID:        "job1",
-			Attempt:      1,
-			Status:       StatusSuccess,
-			Stopped:      timeutil.TimeStampNow(),
-		}
-		require.NoError(t, db.Insert(ctx, job))
-		return run, []*ActionRunJob{job}
-	}
-
-	cases := []struct {
-		name        string
-		withAttempt bool
-		withJob     bool
-		want        Status
-	}{
-		{"done job", true, true, StatusSuccess},
-		// Runs created before migration v331 have no attempt, their status lives on the run row itself.
-		{"done job on a legacy run without attempt", false, true, StatusSuccess},
-		// Aggregation cannot reach a final status without any job, so cancelling has to end the run itself.
-		{"no job at all", true, false, StatusCancelled},
-		{"no job at all on a legacy run without attempt", false, false, StatusCancelled},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			require.NoError(t, unittest.PrepareTestDatabase())
-			run, jobs := newStuckRun(t, tc.withAttempt, tc.withJob)
-
-			// mirrors what the CancelRun service does
-			cancelled, err := CancelJobs(t.Context(), jobs, false)
-			require.NoError(t, err)
-			assert.Empty(t, cancelled, "nothing is cancellable, so the run row has to be settled explicitly")
-			require.NoError(t, SettleRunAfterCancel(t.Context(), run))
-
-			if tc.withAttempt {
-				gotAttempt := unittest.AssertExistsAndLoadBean(t, &ActionRunAttempt{ID: run.LatestAttemptID})
-				assert.Equal(t, tc.want, gotAttempt.Status)
-			}
-			gotRun := unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID})
-			assert.Equal(t, tc.want, gotRun.Status)
-			assert.NotZero(t, gotRun.Stopped)
-		})
-	}
-}
-
-func TestParseJobDeferredMatrixPlaceholder(t *testing.T) {
-	// A placeholder is persisted with the raw matrix and without its needs, so routing its payload
-	// through jobparser.Parse re-expands that matrix. The job emitter reads `if:` (and so ParseJob)
-	// before it can expand the placeholder, and it only logs a parse failure: getting this wrong
-	// leaves the job Blocked on every pass, the run never finishes and its concurrency group is
-	// never released.
-	payload := func(matrix string) []byte {
-		return fmt.Appendf(nil, `name: test
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        %s
-    steps:
-      - run: echo
-`, matrix)
-	}
-
-	// The shape Parse happens to survive, so only the name tells the two paths apart. What Parse makes
-	// of every other shape is asserted in TestParseRawSingleWorkflowRoundTripsDeferredPlaceholder.
-	t.Run("a placeholder is read back, not re-expanded", func(t *testing.T) {
-		job := &ActionRunJob{ID: 1, JobID: "build", IsMatrixDeferred: true, WorkflowPayload: payload("version: ${{ fromJson(needs.setup.outputs.m) }}")}
-		parsed, err := job.ParseJob()
-		require.NoError(t, err)
-		require.NotNil(t, parsed)
-		assert.Equal(t, "build", parsed.Name)
-	})
-
-	t.Run("an expanded job still goes through the full parse", func(t *testing.T) {
-		job := &ActionRunJob{ID: 1, JobID: "build", WorkflowPayload: payload("version: [1]")}
-		parsed, err := job.ParseJob()
-		require.NoError(t, err)
-		require.NotNil(t, parsed)
-		// Parse bakes the combination into the name, ParseRawSingleWorkflow would not.
-		assert.Equal(t, "build (1)", parsed.Name)
-	})
-}
-
-func TestForceCancelJobs(t *testing.T) {
-	assertCancelled := func(t *testing.T, task *ActionTask, job *ActionRunJob) {
-		t.Helper()
-
-		taskAfter := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-		assert.Equal(t, StatusCancelled, taskAfter.Status)
-		assert.NotZero(t, taskAfter.Stopped)
-
-		jobAfter := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
-		assert.Equal(t, StatusCancelled, jobAfter.Status)
-		assert.NotZero(t, jobAfter.Stopped)
-	}
-
-	// A running task is force-cancelled directly, without trying the graceful cancel first.
-	t.Run("running task", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "force-cancel-job", true)
-
-		cancelledJobs, err := CancelJobs(t.Context(), []*ActionRunJob{job}, true)
-		require.NoError(t, err)
-		require.Len(t, cancelledJobs, 1)
-		assert.Equal(t, StatusCancelled, cancelledJobs[0].Status)
-		assertCancelled(t, task, job)
-	})
-
-	// A task already in the cancelling handshake whose runner never finishes the cleanup.
-	t.Run("cancelling task", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "force-cancel-cancelling-job", true)
-
-		cancelling, err := CancelJobs(t.Context(), []*ActionRunJob{job}, false)
-		require.NoError(t, err)
-		require.Len(t, cancelling, 1)
-		assert.Equal(t, StatusCancelling, cancelling[0].Status)
-
-		job = unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
-		cancelled, err := CancelJobs(t.Context(), []*ActionRunJob{job}, true)
-		require.NoError(t, err)
-		require.Len(t, cancelled, 1)
-		assertCancelled(t, task, job)
-	})
-
-	// A caller is cancelled through its descendants, so the force has to reach their tasks too.
-	t.Run("reusable caller", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, child := newRunningTaskForCancelling(t, "force-cancel-child", true)
-
-		caller := &ActionRunJob{
-			RunID:            child.RunID,
-			RepoID:           child.RepoID,
-			OwnerID:          child.OwnerID,
-			CommitSHA:        child.CommitSHA,
-			Name:             "force-cancel-caller",
-			JobID:            "force-cancel-caller",
-			Attempt:          1,
-			Status:           StatusRunning,
-			IsReusableCaller: true,
-			IsExpanded:       true,
-		}
-		require.NoError(t, db.Insert(t.Context(), caller))
-		child.ParentJobID = caller.ID
-		_, err := UpdateRunJob(t.Context(), child, nil, "parent_job_id")
-		require.NoError(t, err)
-
-		cancelled, err := CancelJobs(t.Context(), []*ActionRunJob{caller}, true)
-		require.NoError(t, err)
-		require.Len(t, cancelled, 2)
-		assertCancelled(t, task, child)
-
-		callerAfter := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: caller.ID})
-		assert.Equal(t, StatusCancelled, callerAfter.Status)
-	})
-}
@@ -70,10 +70,6 @@ type FindRunOptions struct {
 	Status           []Status
 	ConcurrencyGroup string
 	CommitSHA        string
-	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
-	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
-	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
-	AccessibleRepoIDsSubQuery *builder.Builder
 }

 func (opts FindRunOptions) ToConds() builder.Cond {
@@ -105,16 +101,13 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.CommitSHA != "" {
 		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
 	}
-	if opts.AccessibleRepoIDsSubQuery != nil {
-		cond = cond.And(builder.In("`action_run`.repo_id", opts.AccessibleRepoIDsSubQuery))
-	}
 	return cond
 }

 func (opts FindRunOptions) ToJoins() []db.JoinFunc {
 	if opts.OwnerID > 0 {
 		return []db.JoinFunc{func(sess db.Engine) error {
-			sess.Join("INNER", "repository", "repository.id = action_run.repo_id AND repository.owner_id = ?", opts.OwnerID)
+			sess.Join("INNER", "repository", "repository.id = repo_id AND repository.owner_id = ?", opts.OwnerID)
 			return nil
 		}}
 	}
@@ -142,8 +135,8 @@ type StatusInfo struct {

 // GetStatusInfoList returns a slice of StatusInfo
 func GetStatusInfoList(ctx context.Context, lang translation.Locale) []StatusInfo {
-	// same as those in aggregateJobStatus (StatusUnknown excluded; it's the "shouldn't happen" fallback)
-	allStatus := []Status{StatusSuccess, StatusFailure, StatusCancelled, StatusSkipped, StatusWaiting, StatusRunning, StatusBlocked, StatusCancelling}
+	// same as those in aggregateJobStatus
+	allStatus := []Status{StatusSuccess, StatusFailure, StatusWaiting, StatusRunning, StatusCancelling}
 	statusInfoList := make([]StatusInfo, 0, len(allStatus))
 	for _, s := range allStatus {
 		statusInfoList = append(statusInfoList, StatusInfo{
@@ -73,11 +73,8 @@ func TestGetStatusInfoList(t *testing.T) {
 	assert.Equal(t, []StatusInfo{
 		{Status: int(StatusSuccess), StatusName: StatusSuccess.String(), DisplayedStatus: "actions.status.success"},
 		{Status: int(StatusFailure), StatusName: StatusFailure.String(), DisplayedStatus: "actions.status.failure"},
-		{Status: int(StatusCancelled), StatusName: StatusCancelled.String(), DisplayedStatus: "actions.status.cancelled"},
-		{Status: int(StatusSkipped), StatusName: StatusSkipped.String(), DisplayedStatus: "actions.status.skipped"},
 		{Status: int(StatusWaiting), StatusName: StatusWaiting.String(), DisplayedStatus: "actions.status.waiting"},
 		{Status: int(StatusRunning), StatusName: StatusRunning.String(), DisplayedStatus: "actions.status.running"},
-		{Status: int(StatusBlocked), StatusName: StatusBlocked.String(), DisplayedStatus: "actions.status.blocked"},
 		{Status: int(StatusCancelling), StatusName: StatusCancelling.String(), DisplayedStatus: "actions.status.cancelling"},
 	}, statusInfoList)
 }
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"

-	runnerv1 "gitea.dev/actionslib/runner/v1"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/shared/types"
@@ -58,7 +58,7 @@ type ActionRunner struct {
 	LastOnline timeutil.TimeStamp `xorm:"index"`
 	LastActive timeutil.TimeStamp `xorm:"index"`

-	// Store labels defined in state file (default: .runner file) of the `runner`
+	// Store labels defined in state file (default: .runner file) of `act_runner`
 	AgentLabels []string `xorm:"TEXT"`
 	// Store if this is a runner that only ever get one single job assigned
 	Ephemeral bool `xorm:"ephemeral NOT NULL DEFAULT false"`
@@ -75,28 +75,8 @@ type ActionRunner struct {
 const (
 	RunnerOfflineTime = time.Minute
 	RunnerIdleTime    = 10 * time.Second
-	// RunnerHeartbeatInterval is how often last_online is persisted on poll.
-	// Must stay well below RunnerOfflineTime so runners don't flap to offline.
-	RunnerHeartbeatInterval = 30 * time.Second
-	// RunnerActiveInterval is how often last_active is persisted while a runner
-	// streams task updates and logs. Must stay well below RunnerIdleTime so a
-	// busy runner keeps showing ACTIVE without a DB write on every RPC.
-	RunnerActiveInterval = 5 * time.Second
 )

-// ShouldPersistLastOnline reports whether last_online is stale enough to be
-// worth writing back. Avoids a DB write on every runner poll.
-func ShouldPersistLastOnline(last timeutil.TimeStamp, now time.Time) bool {
-	return now.Sub(last.AsTime()) >= RunnerHeartbeatInterval
-}
-
-// ShouldPersistLastActive reports whether last_active is stale enough to be
-// worth writing back. Avoids a DB write on every UpdateTask/UpdateLog RPC while
-// a runner is actively streaming logs.
-func ShouldPersistLastActive(last timeutil.TimeStamp, now time.Time) bool {
-	return now.Sub(last.AsTime()) >= RunnerActiveInterval
-}
-
 // BelongsToOwnerName before calling, should guarantee that all attributes are loaded
 func (r *ActionRunner) BelongsToOwnerName() string {
 	if r.RepoID != 0 {
@@ -270,41 +250,22 @@ func (opts FindRunnerOptions) ToConds() builder.Cond {
 	return cond
 }

-// runnerStatusOrderExpr builds an ORDER BY fragment that ranks runners by their
-// computed status (see ActionRunner.Status): active (0), idle (1), offline (2).
-// The thresholds are evaluated against the current time, mirroring ToConds, so
-// sorting by status groups active and idle runners instead of interleaving them
-// by raw last_online.
-func runnerStatusOrderExpr() string {
-	now := time.Now()
-	offlineThreshold := now.Add(-RunnerOfflineTime).Unix()
-	idleThreshold := now.Add(-RunnerIdleTime).Unix()
-	return fmt.Sprintf("CASE WHEN last_online <= %d THEN 2 WHEN last_active <= %d THEN 1 ELSE 0 END", offlineThreshold, idleThreshold)
-}
-
 func (opts FindRunnerOptions) ToOrders() string {
-	// A unique tiebreaker (id) is appended so that runners sharing the same
-	// status, last_online or name keep a deterministic order across paginated
-	// queries, otherwise the same runner may appear on more than one page.
-	statusRank := runnerStatusOrderExpr()
 	switch opts.Sort {
 	case "online":
-		// Rank by computed status first so idle runners are not interleaved with
-		// active ones; disabled runners sink to the bottom of their status group
-		// (is_disabled ASC), then last_online breaks ties within a group.
-		return statusRank + " ASC, is_disabled ASC, last_online DESC, id ASC"
+		return "last_online DESC"
 	case "offline":
-		return statusRank + " DESC, is_disabled ASC, last_online ASC, id ASC"
+		return "last_online ASC"
 	case "alphabetically":
-		return "name ASC, id ASC"
+		return "name ASC"
 	case "reversealphabetically":
-		return "name DESC, id ASC"
+		return "name DESC"
 	case "newest":
 		return "id DESC"
 	case "oldest":
 		return "id ASC"
 	}
-	return statusRank + " ASC, is_disabled ASC, last_online DESC, id ASC"
+	return "last_online DESC"
 }

 // GetRunnerByUUID returns a runner via uuid
@@ -1,83 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"testing"
-	"time"
-
-	"gitea.dev/modules/timeutil"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestShouldPersistLastOnline(t *testing.T) {
-	now := time.Now()
-	tests := []struct {
-		name string
-		last timeutil.TimeStamp
-		want bool
-	}{
-		{
-			name: "fresh, skip write",
-			last: timeutil.TimeStamp(now.Add(-5 * time.Second).Unix()),
-			want: false,
-		},
-		{
-			name: "exactly at interval, write",
-			last: timeutil.TimeStamp(now.Add(-RunnerHeartbeatInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "stale, write",
-			last: timeutil.TimeStamp(now.Add(-2 * RunnerHeartbeatInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "zero (never seen), write",
-			last: 0,
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ShouldPersistLastOnline(tt.last, now))
-		})
-	}
-}
-
-func TestShouldPersistLastActive(t *testing.T) {
-	now := time.Now()
-	tests := []struct {
-		name string
-		last timeutil.TimeStamp
-		want bool
-	}{
-		{
-			name: "fresh, skip write",
-			last: timeutil.TimeStamp(now.Add(-1 * time.Second).Unix()),
-			want: false,
-		},
-		{
-			name: "exactly at interval, write",
-			last: timeutil.TimeStamp(now.Add(-RunnerActiveInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "stale, write",
-			last: timeutil.TimeStamp(now.Add(-2 * RunnerActiveInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "zero (never seen), write",
-			last: 0,
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ShouldPersistLastActive(tt.last, now))
-		})
-	}
-}
@@ -6,7 +6,7 @@ package actions
 import (
 	"slices"

-	runnerv1 "gitea.dev/actionslib/runner/v1"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
 	"gitea.dev/modules/translation"
 )

@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"

-	runnerv1 "gitea.dev/actionslib/runner/v1"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"

 	"github.com/stretchr/testify/assert"
 )
@@ -11,12 +11,11 @@ import (
 	"strings"
 	"time"

-	runnerv1 "gitea.dev/actionslib/runner/v1"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/db"
 	"gitea.dev/models/unit"
 	"gitea.dev/modules/actions/jobparser"
-	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/timeutil"
@@ -60,12 +59,6 @@ type ActionTask struct {
 	Updated timeutil.TimeStamp `xorm:"updated index"`
 }

-// taskReportTimeout is how long a task may go without contact from its runner before the
-// runner is assumed gone. Runners report state and stream logs every few seconds, both of
-// which refresh ActionTask.Updated. Shorter than setting.Actions.ZombieTaskTimeout because
-// it only decides whether the runner is reachable, not whether the task should be killed.
-const taskReportTimeout = time.Minute
-
 var successfulTokenTaskCache *lru.Cache[string, any]

 func init() {
@@ -91,15 +84,11 @@ func (task *ActionTask) IsStopped() bool {
 	return task.Stopped > 0
 }

-func (task *ActionTask) GetRunJobLink() string {
-	// Run.Repo can be nil when the repository was deleted while task/run rows remain
-	// (TaskList.LoadAttributes copies job.Repo into run.Repo, leaving it nil on a miss).
-	// Run.Link() already returns "" in that case, so guard here to avoid emitting a
-	// broken relative "/jobs/N" link from the Sprintf below.
-	if task.Job == nil || task.Job.Run == nil || task.Job.Run.Repo == nil {
+func (task *ActionTask) GetRunLink() string {
+	if task.Job == nil || task.Job.Run == nil {
 		return ""
 	}
-	return fmt.Sprintf("%s/jobs/%d", task.Job.Run.Link(), task.Job.ID)
+	return task.Job.Run.Link()
 }

 func (task *ActionTask) GetCommitLink() string {
@@ -171,15 +160,6 @@ func GetTaskByID(ctx context.Context, id int64) (*ActionTask, error) {
 	return &task, nil
 }

-// GetTasksMapByIDs returns the found tasks keyed by ID, silently omitting IDs that no longer exist.
-func GetTasksMapByIDs(ctx context.Context, ids []int64) (map[int64]*ActionTask, error) {
-	tasks := make(map[int64]*ActionTask, len(ids))
-	if len(ids) == 0 {
-		return tasks, nil
-	}
-	return tasks, db.GetEngine(ctx).In("id", ids).Find(&tasks)
-}
-
 func GetRunningTaskByToken(ctx context.Context, token string) (*ActionTask, error) {
 	errNotExist := fmt.Errorf("task with token %q: %w", token, util.ErrNotExist)
 	if token == "" {
@@ -251,11 +231,6 @@ func makeTaskStepDisplayName(step *jobparser.Step, limit int) (name string) {
 // another runner won the optimistic-lock race; it is never returned to callers.
 var errJobAlreadyClaimed = errors.New("job already claimed by another runner")

-// pickTaskBatchSize bounds how many waiting jobs each CreateTaskForRunner query loads,
-// so a large backlog is not fetched into memory on every runner poll.
-// It is a var only so tests can shrink it to exercise pagination cheaply.
-var pickTaskBatchSize = 100
-
 // CreateTaskForRunner finds a waiting job that matches the runner's labels and
 // atomically claims it. It iterates through all matching jobs so that a
 // concurrent claim by another runner (which would lose the optimistic lock on
@@ -274,51 +249,31 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 			Join("INNER", "repo_unit", "`repository`.id = `repo_unit`.repo_id").
 			Where(builder.Eq{"`repository`.owner_id": runner.OwnerID, "`repo_unit`.type": unit.TypeActions}))
 	}
-	baseCond := builder.Eq{"task_id": 0, "status": StatusWaiting, "is_reusable_caller": false}.And(jobCond)
+	if jobCond.IsValid() {
+		jobCond = builder.In("run_id", builder.Select("id").From("action_run").Where(jobCond))
+	}
+
+	var jobs []*ActionRunJob
+	if err := e.Where("task_id=? AND status=? AND is_reusable_caller=?", 0, StatusWaiting, false).And(jobCond).Asc("updated", "id").Find(&jobs); err != nil {
+		return nil, false, err
+	}

 	// TODO: a more efficient way to filter labels
 	log.Trace("runner labels: %v", runner.AgentLabels)
-
-	// Page through the waiting jobs oldest-first instead of loading the whole backlog into memory on every poll.
-	// Keyset pagination on (updated, id) is safe under concurrent claims:
-	// updated only moves forward, so the advancing cursor never skips a still-waiting job even as claimed jobs drop out.
-	var cursorUpdated timeutil.TimeStamp
-	var cursorID int64
-	for {
-		cond := baseCond
-		if cursorID > 0 {
-			cond = cond.And(builder.Or(
-				builder.Gt{"updated": cursorUpdated},
-				builder.And(builder.Eq{"updated": cursorUpdated}, builder.Gt{"id": cursorID}),
-			))
+	for _, v := range jobs {
+		if !runner.CanMatchLabels(v.RunsOn) {
+			continue
 		}
-
-		var jobs []*ActionRunJob
-		if err := e.Where(cond).Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
+		task, ok, err := claimJobForRunner(ctx, runner, v)
+		if err != nil {
 			return nil, false, err
 		}
-
-		for _, v := range jobs {
-			if !runner.CanMatchLabels(v.RunsOn) {
-				continue
-			}
-			task, ok, err := claimJobForRunner(ctx, runner, v)
-			if err != nil {
-				return nil, false, err
-			}
-			if ok {
-				return task, true, nil
-			}
-			// Another runner claimed this job concurrently; try the next one.
+		if ok {
+			return task, true, nil
 		}
-
-		// A short page means no waiting jobs remain beyond it.
-		if len(jobs) < pickTaskBatchSize {
-			return nil, false, nil
-		}
-		last := jobs[len(jobs)-1]
-		cursorUpdated, cursorID = last.Updated, last.ID
+		// Another runner claimed this job concurrently; try the next one.
 	}
+	return nil, false, nil
 }

 // claimJobForRunner attempts to atomically claim job for runner inside its own
@@ -458,18 +413,6 @@ func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
 	return err
 }

-func getRunIDByTaskID(ctx context.Context, taskID int64) (runID int64, _ error) {
-	if has, err := db.GetEngine(ctx).Cols("action_run_job.run_id").
-		Table("action_task").
-		Join("INNER", "action_run_job", "action_run_job.id = action_task.job_id").
-		Where(builder.Eq{"action_task.id": taskID}).Get(&runID); err != nil {
-		return runID, err
-	} else if !has {
-		return runID, util.ErrNotExist
-	}
-	return runID, nil
-}
-
 // UpdateTaskByState updates the task by the state.
 // It will always update the task if the state is not final, even there is no change.
 // So it will update ActionTask.Updated to avoid the task being judged as a zombie task.
@@ -479,26 +422,21 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 		stepStates[v.Id] = v
 	}

-	// Only one request can update the task because the final state needs to be calculated with all job states.
-	// Otherwise, concurrent requests with transaction will make the SQL read stale job state and result in wrong final state.
-	taskID := state.Id
-	runID, err := getRunIDByTaskID(ctx, taskID)
-	if err != nil {
-		return nil, err
-	}
-	task := &ActionTask{}
-	applyState := func(ctx context.Context) error {
-		if has, err := db.GetEngine(ctx).ID(taskID).Get(task); err != nil {
-			return err
+	return db.WithTx2(ctx, func(ctx context.Context) (*ActionTask, error) {
+		e := db.GetEngine(ctx)
+
+		task := &ActionTask{}
+		if has, err := e.ID(state.Id).Get(task); err != nil {
+			return nil, err
 		} else if !has {
-			return util.ErrNotExist
+			return nil, util.ErrNotExist
 		} else if runnerID != task.RunnerID {
-			return errors.New("invalid runner for task")
+			return nil, errors.New("invalid runner for task")
 		}

 		if task.Status.IsDone() {
 			// the state is final, do nothing
-			return nil
+			return task, nil
 		}

 		// state.Result is not unspecified means the task is finished
@@ -511,7 +449,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			}
 			task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
 			if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
-				return err
+				return nil, err
 			}
 			if _, err := UpdateRunJob(ctx, &ActionRunJob{
 				ID:      task.JobID,
@@ -519,18 +457,18 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 				Status:  task.Status,
 				Stopped: task.Stopped,
 			}, nil, "status", "stopped"); err != nil {
-				return err
+				return nil, err
 			}
 		} else {
 			// Force update ActionTask.Updated to avoid the task being judged as a zombie task
 			task.Updated = timeutil.TimeStampNow()
 			if err := UpdateTask(ctx, task, "updated"); err != nil {
-				return err
+				return nil, err
 			}
 		}

 		if err := task.LoadAttributes(ctx); err != nil {
-			return err
+			return nil, err
 		}

 		for _, step := range task.Steps {
@@ -547,17 +485,13 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			} else if step.Started != 0 {
 				step.Status = StatusRunning
 			}
-			if _, err := db.GetEngine(ctx).ID(step.ID).Update(step); err != nil {
-				return err
+			if _, err := e.ID(step.ID).Update(step); err != nil {
+				return nil, err
 			}
 		}
-		return nil
-	}
-	err = globallock.LockAndDo(ctx, fmt.Sprintf("UpdateTaskByState-run-%d", runID), func(ctx context.Context) error {
-		// A half-written report leaves the task done with a running job, which no retry repairs.
-		return db.WithTx(ctx, applyState)
+
+		return task, nil
 	})
-	return task, err
 }

 func StopTask(ctx context.Context, taskID int64, status Status) error {
@@ -586,10 +520,6 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 			status = StatusCancelled
 		} else if !runner.HasCancellingSupport {
 			status = StatusCancelled
-		} else if task.Updated.AddDuration(taskReportTimeout) < now {
-			// A runner that stopped reporting will never acknowledge the cancellation either,
-			// so skip the handshake instead of waiting for the zombie task cleanup.
-			status = StatusCancelled
 		}
 	}

@@ -604,10 +534,7 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 			return err
 		}

-		// NoAutoTime keeps "updated" at the runner's last contact: re-cancelling an already
-		// cancelling task must not defer the timeout above or the zombie task cleanup.
-		_, err := e.ID(task.ID).Cols("status").NoAutoTime().Update(task)
-		return err
+		return UpdateTask(ctx, task, "status")
 	}

 	task.Status = status
@@ -4,15 +4,11 @@
 package actions

 import (
-	"context"
-	"errors"
 	"strings"
-	"sync/atomic"
 	"testing"

-	runnerv1 "gitea.dev/actionslib/runner/v1"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
 	"gitea.dev/models/db"
-	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/timeutil"
@@ -20,24 +16,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/timestamppb"
-	"xorm.io/xorm/contexts"
 )

-func TestActionTask_GetRunJobLink(t *testing.T) {
-	repo := &repo_model.Repository{OwnerName: "org", Name: "consumer"}
-	run := &ActionRun{ID: 10, Repo: repo}
-	job := &ActionRunJob{ID: 42, Run: run}
-
-	// a task with a loaded job links to that specific job, not just the run
-	task := &ActionTask{Job: job}
-	assert.Equal(t, run.Link()+"/jobs/42", task.GetRunJobLink())
-
-	// missing job, run or repo yields an empty link instead of a broken URL
-	assert.Empty(t, (&ActionTask{}).GetRunJobLink())
-	assert.Empty(t, (&ActionTask{Job: &ActionRunJob{ID: 42}}).GetRunJobLink())
-	assert.Empty(t, (&ActionTask{Job: &ActionRunJob{ID: 42, Run: &ActionRun{ID: 10}}}).GetRunJobLink())
-}
-
 func TestMakeTaskStepDisplayName(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -103,11 +83,68 @@ func TestMakeTaskStepDisplayName(t *testing.T) {
 }

 func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
+	newRunningTask := func(t *testing.T) (*ActionTask, *ActionRunJob) {
+		t.Helper()
+
+		run := &ActionRun{
+			Title:         "cancelling-test-run",
+			RepoID:        1,
+			OwnerID:       2,
+			WorkflowID:    "test.yaml",
+			Index:         999,
+			TriggerUserID: 2,
+			Ref:           "refs/heads/master",
+			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+			Event:         "push",
+			TriggerEvent:  "push",
+			Status:        StatusRunning,
+			Started:       timeutil.TimeStampNow(),
+		}
+		require.NoError(t, db.Insert(t.Context(), run))
+
+		job := &ActionRunJob{
+			RunID:     run.ID,
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+			Name:      "cancelling-finalization-job",
+			Attempt:   1,
+			JobID:     "cancelling-finalization-job",
+			Status:    StatusRunning,
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+
+		runner := &ActionRunner{
+			UUID:                 "runner-cancelling-supported",
+			Name:                 "runner-cancelling-supported",
+			HasCancellingSupport: true,
+		}
+		require.NoError(t, db.Insert(t.Context(), runner))
+
+		task := &ActionTask{
+			JobID:     job.ID,
+			Attempt:   1,
+			RunnerID:  runner.ID,
+			Status:    StatusRunning,
+			Started:   timeutil.TimeStampNow(),
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+		}
+		require.NoError(t, db.Insert(t.Context(), task))
+
+		job.TaskID = task.ID
+		_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+		require.NoError(t, err)
+
+		return task, job
+	}
+
 	testResult := func(t *testing.T, result runnerv1.Result) {
 		t.Helper()
 		require.NoError(t, unittest.PrepareTestDatabase())

-		task, job := newRunningTaskForCancelling(t, "cancelling-finalization-job", true)
+		task, job := newRunningTask(t)
 		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))

 		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
@@ -137,92 +174,137 @@ func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
 	})
 }

-// TestStopTaskCancellingFallsBackToCancelled covers the cases where the cancelling handshake can
-// never complete, so StopTask must cancel right away instead of waiting for the zombie task cleanup.
-func TestStopTaskCancellingFallsBackToCancelled(t *testing.T) {
-	assertCancelled := func(t *testing.T, task *ActionTask, job *ActionRunJob) {
-		t.Helper()
-
-		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-		assert.Equal(t, StatusCancelled, taskAfterStop.Status)
-		assert.NotZero(t, taskAfterStop.Stopped)
-
-		jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
-		assert.Equal(t, StatusCancelled, jobAfterStop.Status)
-		assert.NotZero(t, jobAfterStop.Stopped)
-	}
-
-	// A runner too old to know the cancelling state can only be stopped by a final status.
-	t.Run("legacy runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "legacy-cancelling-job", false)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-	})
-
-	// The runner is gone, e.g. an ephemeral runner was cleaned up, so nobody can acknowledge.
-	t.Run("missing runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "missing-runner-cancelling-job", true)
-
-		_, err := db.DeleteByID[ActionRunner](t.Context(), task.RunnerID)
-		require.NoError(t, err)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-	})
-
-	// The runner went silent, e.g. it gave up while Gitea was restarting, so it never picks up the request.
-	t.Run("silent runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "silent-runner-cancelling-job", true)
-
-		// NoAutoTime because the point of the test is an "updated" older than xorm would write
-		task.Updated = timeutil.TimeStampNow().AddDuration(-2 * taskReportTimeout)
-		_, err := db.GetEngine(t.Context()).ID(task.ID).Cols("updated").NoAutoTime().Update(task)
-		require.NoError(t, err)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-
-		// A runner coming back still learns the outcome from the UpdateTask response,
-		// and its late result does not overwrite the cancellation.
-		late, err := UpdateTaskByState(t.Context(), task.RunnerID, &runnerv1.TaskState{
-			Id:        task.ID,
-			Result:    runnerv1.Result_RESULT_SUCCESS,
-			StoppedAt: timestamppb.Now(),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, StatusCancelled, late.Status)
-		assert.Equal(t, runnerv1.Result_RESULT_CANCELLED, late.Status.AsResult())
-	})
-}
-
-// TestStopTaskCancellingKeepsReportTime makes sure persisting the cancelling status does not refresh
-// "updated": re-cancelling would otherwise defer both the fallback to cancelled and the zombie task
-// cleanup, no matter how long the runner has been silent.
-func TestStopTaskCancellingKeepsReportTime(t *testing.T) {
+func TestStopTaskCancellingFallsBackForLegacyRunner(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
-	task, _ := newRunningTaskForCancelling(t, "repeated-cancelling-job", true)

-	// NoAutoTime because the point of the test is an "updated" older than xorm would write
-	lastReport := timeutil.TimeStampNow().AddDuration(-taskReportTimeout / 2)
-	task.Updated = lastReport
-	_, err := db.GetEngine(t.Context()).ID(task.ID).Cols("updated").NoAutoTime().Update(task)
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "legacy-cancelling-job",
+		Attempt:   1,
+		JobID:     "legacy-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-legacy-no-cancelling",
+		Name:                 "runner-legacy-no-cancelling",
+		HasCancellingSupport: false,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
 	require.NoError(t, err)

-	// the runner reported recently enough, so the task waits for it to acknowledge
 	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-	assert.Equal(t, StatusCancelling, taskAfterStop.Status)
-	assert.Equal(t, lastReport, taskAfterStop.Updated)

-	// cancelling it again does not reset the clock either
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
+}
+
+func TestStopTaskCancellingFallsBackForMissingRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "missing-runner-cancelling-job",
+		Attempt:   1,
+		JobID:     "missing-runner-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-cleaned-up-before-cancel",
+		Name:                 "runner-cleaned-up-before-cancel",
+		HasCancellingSupport: true,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+	require.NoError(t, err)
+
+	_, err = db.DeleteByID[ActionRunner](t.Context(), runner.ID)
+	require.NoError(t, err)
+
 	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-	taskAfterSecondStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-	assert.Equal(t, StatusCancelling, taskAfterSecondStop.Status)
-	assert.Equal(t, lastReport, taskAfterSecondStop.Updated)
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
 }

 // TestReleaseTaskForRunner verifies that releasing a freshly-claimed task returns
@@ -289,162 +371,3 @@ func TestReleaseTaskForRunner(t *testing.T) {
 	unittest.AssertNotExistsBean(t, &ActionTask{ID: task.ID})
 	unittest.AssertNotExistsBean(t, &ActionTaskStep{TaskID: task.ID})
 }
-
-// TestCreateTaskForRunnerPagination verifies that a job sitting beyond the first page is still claimed
-func TestCreateTaskForRunnerPagination(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	defer func(orig int) { pickTaskBatchSize = orig }(pickTaskBatchSize)
-	pickTaskBatchSize = 2
-
-	run := &ActionRun{
-		Title:         "pagination-test-run",
-		RepoID:        1,
-		OwnerID:       2,
-		WorkflowID:    "test.yaml",
-		Index:         9903,
-		TriggerUserID: 2,
-		Ref:           "refs/heads/main",
-		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-		Event:         "push",
-		TriggerEvent:  "push",
-		Status:        StatusWaiting,
-	}
-	require.NoError(t, db.Insert(t.Context(), run))
-
-	// Five waiting jobs the runner cannot run, then one it can.
-	// With a page size of 2 the matching job only appears on the third page.
-	for i := range 5 {
-		mismatch := &ActionRunJob{
-			RunID:     run.ID,
-			RepoID:    run.RepoID,
-			OwnerID:   run.OwnerID,
-			CommitSHA: run.CommitSHA,
-			Name:      "mismatch-" + string(rune('a'+i)),
-			Attempt:   1,
-			JobID:     "mismatch-" + string(rune('a'+i)),
-			Status:    StatusWaiting,
-			RunsOn:    []string{"windows-latest"},
-		}
-		require.NoError(t, db.Insert(t.Context(), mismatch))
-	}
-
-	target := &ActionRunJob{
-		RunID:           run.ID,
-		RepoID:          run.RepoID,
-		OwnerID:         run.OwnerID,
-		CommitSHA:       run.CommitSHA,
-		Name:            "target-job",
-		Attempt:         1,
-		JobID:           "target-job",
-		Status:          StatusWaiting,
-		RunsOn:          []string{"ubuntu-latest"},
-		WorkflowPayload: []byte("on: push\njobs:\n  target-job:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hi\n"),
-	}
-	require.NoError(t, db.Insert(t.Context(), target))
-
-	runner := &ActionRunner{
-		UUID:        "pagination-runner-uuid",
-		Name:        "pagination-runner",
-		AgentLabels: []string{"ubuntu-latest"},
-	}
-	runner.GenerateAndFillToken()
-	require.NoError(t, db.Insert(t.Context(), runner))
-
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
-	require.NoError(t, err)
-	require.True(t, ok)
-	require.NotNil(t, task)
-
-	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: target.ID})
-	assert.Equal(t, StatusRunning, claimed.Status)
-	assert.Equal(t, task.ID, claimed.TaskID)
-}
-
-type failFirstStepWrite struct{ fired atomic.Bool }
-
-func (h *failFirstStepWrite) BeforeProcess(c *contexts.ContextHook) (context.Context, error) {
-	if !h.fired.Load() && strings.HasPrefix(c.SQL, "UPDATE") && strings.Contains(c.SQL, "action_task_step") {
-		h.fired.Store(true)
-		return nil, errors.New("interrupted")
-	}
-	return c.Ctx, nil
-}
-
-func (*failFirstStepWrite) AfterProcess(*contexts.ContextHook) error { return nil }
-
-// TestUpdateTaskByStateIsAtomic checks that an interrupted report writes nothing: a surviving task or
-// job write would hit the "state is final" early return, which no retry or cleanup repairs.
-func TestUpdateTaskByStateIsAtomic(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	task, job := newRunningTaskForCancelling(t, "atomic-report-job", true)
-	require.NoError(t, db.Insert(t.Context(), &ActionTaskStep{TaskID: task.ID, RepoID: task.RepoID, Status: StatusRunning}))
-	unittest.GetXORMEngine().AddHook(&failFirstStepWrite{})
-	finalState := &runnerv1.TaskState{Id: task.ID, Result: runnerv1.Result_RESULT_SUCCESS, StoppedAt: timestamppb.Now()}
-	_, err := UpdateTaskByState(t.Context(), task.RunnerID, finalState)
-	require.Error(t, err)
-	assert.Equal(t, StatusRunning, unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID}).Status)
-	assert.Equal(t, StatusRunning, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status)
-	_, err = UpdateTaskByState(t.Context(), task.RunnerID, finalState)
-	require.NoError(t, err)
-	assert.Equal(t, StatusSuccess, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status)
-}
-
-// newRunningTaskForCancelling inserts a running run/job/task assigned to a fresh runner,
-// which is the state every cancellation test starts from.
-func newRunningTaskForCancelling(t *testing.T, name string, hasCancellingSupport bool) (*ActionTask, *ActionRunJob) {
-	t.Helper()
-
-	run := &ActionRun{
-		Title:         "cancelling-test-run",
-		RepoID:        1,
-		OwnerID:       2,
-		WorkflowID:    "test.yaml",
-		Index:         999,
-		TriggerUserID: 2,
-		Ref:           "refs/heads/master",
-		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-		Event:         "push",
-		TriggerEvent:  "push",
-		Status:        StatusRunning,
-		Started:       timeutil.TimeStampNow(),
-	}
-	require.NoError(t, db.Insert(t.Context(), run))
-
-	job := &ActionRunJob{
-		RunID:     run.ID,
-		RepoID:    run.RepoID,
-		OwnerID:   run.OwnerID,
-		CommitSHA: run.CommitSHA,
-		Name:      name,
-		Attempt:   1,
-		JobID:     name,
-		Status:    StatusRunning,
-	}
-	require.NoError(t, db.Insert(t.Context(), job))
-
-	runner := &ActionRunner{
-		UUID:                 name,
-		Name:                 name,
-		HasCancellingSupport: hasCancellingSupport,
-	}
-	require.NoError(t, db.Insert(t.Context(), runner))
-
-	task := &ActionTask{
-		JobID:     job.ID,
-		Attempt:   1,
-		RunnerID:  runner.ID,
-		Status:    StatusRunning,
-		Started:   timeutil.TimeStampNow(),
-		RepoID:    run.RepoID,
-		OwnerID:   run.OwnerID,
-		CommitSHA: run.CommitSHA,
-	}
-	require.NoError(t, db.Insert(t.Context(), task))
-
-	job.TaskID = task.ID
-	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
-	require.NoError(t, err)
-
-	return task, job
-}
@@ -336,33 +336,30 @@ func GetUIDsAndNotificationCounts(ctx context.Context, since, until timeutil.Tim
 	return res, db.GetEngine(ctx).SQL(sql, NotificationStatusUnread, since, until).Find(&res)
 }

-// SetIssueReadBy sets issue to be read by given user. The bool result is true
-// when the unread count actually decreased, so callers can skip a push on no-op.
-func SetIssueReadBy(ctx context.Context, issueID, userID int64) (bool, error) {
+// SetIssueReadBy sets issue to be read by given user.
+func SetIssueReadBy(ctx context.Context, issueID, userID int64) error {
 	if err := issues_model.UpdateIssueUserByRead(ctx, userID, issueID); err != nil {
-		return false, err
+		return err
 	}

 	return setIssueNotificationStatusReadIfUnread(ctx, userID, issueID)
 }

-func setIssueNotificationStatusReadIfUnread(ctx context.Context, userID, issueID int64) (bool, error) {
+func setIssueNotificationStatusReadIfUnread(ctx context.Context, userID, issueID int64) error {
 	notification, err := GetIssueNotification(ctx, userID, issueID)
 	// ignore if not exists
 	if err != nil {
-		return false, nil
+		return nil
 	}

 	if notification.Status != NotificationStatusUnread {
-		return false, nil
+		return nil
 	}

 	notification.Status = NotificationStatusRead

-	if _, err := db.GetEngine(ctx).ID(notification.ID).Cols("status").Update(notification); err != nil {
-		return false, err
-	}
-	return true, nil
+	_, err = db.GetEngine(ctx).ID(notification.ID).Cols("status").Update(notification)
+	return err
 }

 // SetRepoReadBy sets repo to be visited by given user.
@@ -410,13 +407,12 @@ func GetNotificationByID(ctx context.Context, notificationID int64) (*Notificati
 	return notification, nil
 }

-// UpdateNotificationStatuses updates the statuses of all of a user's notifications
-// that are of the currentStatus type to the desiredStatus. Returns the number of
-// rows actually changed so callers can skip downstream work on a no-op.
-func UpdateNotificationStatuses(ctx context.Context, user *user_model.User, currentStatus, desiredStatus NotificationStatus) (int64, error) {
+// UpdateNotificationStatuses updates the statuses of all of a user's notifications that are of the currentStatus type to the desiredStatus
+func UpdateNotificationStatuses(ctx context.Context, user *user_model.User, currentStatus, desiredStatus NotificationStatus) error {
 	n := &Notification{Status: desiredStatus, UpdatedBy: user.ID}
-	return db.GetEngine(ctx).
+	_, err := db.GetEngine(ctx).
 		Where("user_id = ? AND status = ?", user.ID, currentStatus).
 		Cols("status", "updated_by", "updated_unix").
 		Update(n)
+	return err
 }
@@ -69,30 +69,25 @@ func (opts FindNotificationOptions) ToOrders() string {
 // CreateOrUpdateIssueNotifications creates an issue notification
 // for each watcher, or updates it if already exists
 // receiverID > 0 just send to receiver, else send to all watcher
-// Returns the set of user IDs whose notification rows were created or updated.
-func CreateOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) ([]int64, error) {
-	var notifiedIDs []int64
-	err := db.WithTx(ctx, func(ctx context.Context) error {
-		var innerErr error
-		notifiedIDs, innerErr = createOrUpdateIssueNotifications(ctx, issueID, commentID, notificationAuthorID, receiverID)
-		return innerErr
+func CreateOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		return createOrUpdateIssueNotifications(ctx, issueID, commentID, notificationAuthorID, receiverID)
 	})
-	return notifiedIDs, err
 }

-func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) ([]int64, error) {
+func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) error {
 	// init
 	var toNotify container.Set[int64]
 	notifications, err := db.Find[Notification](ctx, FindNotificationOptions{
 		IssueID: issueID,
 	})
 	if err != nil {
-		return nil, err
+		return err
 	}

 	issue, err := issues_model.GetIssueByID(ctx, issueID)
 	if err != nil {
-		return nil, err
+		return err
 	}

 	if receiverID > 0 {
@@ -102,62 +97,40 @@ func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, n
 		toNotify = make(container.Set[int64], 32)
 		issueWatches, err := issues_model.GetIssueWatchersIDs(ctx, issueID, true)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		toNotify.AddMultiple(issueWatches...)
 		if !(issue.IsPull && issues_model.HasWorkInProgressPrefix(issue.Title)) {
-			watchType := util.Iif(issue.IsPull, repo_model.WatchPullRequests, repo_model.WatchIssues)
-			repoWatches, err := repo_model.GetRepoWatchersIDs(ctx, issue.RepoID, watchType)
+			repoWatches, err := repo_model.GetRepoWatchersIDs(ctx, issue.RepoID)
 			if err != nil {
-				return nil, err
+				return err
 			}
 			toNotify.AddMultiple(repoWatches...)
 		}
 		issueParticipants, err := issue.GetParticipantIDsByIssue(ctx)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		toNotify.AddMultiple(issueParticipants...)
-		issueAssignees, err := issues_model.GetAssigneeIDsByIssue(ctx, issueID)
-		if err != nil {
-			return nil, err
-		}
-		toNotify.AddMultiple(issueAssignees...)
-		if issue.IsPull {
-			issueReviewers, err := issues_model.GetPullRequestRequestedReviewerIDs(ctx, issueID)
-			if err != nil {
-				return nil, err
-			}
-			toNotify.AddMultiple(issueReviewers...)
-		}

 		// don't notify user who cause notification
 		delete(toNotify, notificationAuthorID)
 		// explicit unwatch on issue
 		issueUnWatches, err := issues_model.GetIssueWatchersIDs(ctx, issueID, false)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		for _, id := range issueUnWatches {
 			toNotify.Remove(id)
 		}
 	}

-	// muting the repository outranks every other source, including mentions
-	ignorers, err := repo_model.GetRepoIgnorersIDs(ctx, issue.RepoID)
+	err = issue.LoadRepo(ctx)
 	if err != nil {
-		return nil, err
-	}
-	for _, id := range ignorers {
-		toNotify.Remove(id)
-	}
-
-	if err := issue.LoadRepo(ctx); err != nil {
-		return nil, err
+		return err
 	}

 	// notify
-	notifiedIDs := make([]int64, 0, len(toNotify))
 	for userID := range toNotify {
 		issue.Repo.Units = nil
 		user, err := user_model.GetUserByID(ctx, userID)
@@ -166,7 +139,7 @@ func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, n
 				continue
 			}

-			return nil, err
+			return err
 		}
 		if issue.IsPull && !access_model.CheckRepoUnitUser(ctx, issue.Repo, user, unit.TypePullRequests) {
 			continue
@@ -176,16 +149,16 @@ func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, n
 		}

 		if notificationExists(notifications, issue.ID, userID) {
-			err = updateIssueNotification(ctx, userID, issue.ID, commentID, notificationAuthorID)
-		} else {
-			err = createIssueNotification(ctx, userID, issue, commentID, notificationAuthorID)
+			if err = updateIssueNotification(ctx, userID, issue.ID, commentID, notificationAuthorID); err != nil {
+				return err
+			}
+			continue
 		}
-		if err != nil {
-			return nil, err
+		if err = createIssueNotification(ctx, userID, issue, commentID, notificationAuthorID); err != nil {
+			return err
 		}
-		notifiedIDs = append(notifiedIDs, userID)
 	}
-	return notifiedIDs, nil
+	return nil
 }

 // NotificationList contains a list of notifications
--- a/Show More
+++ b/Show More