FIXME

fix: re-check branch write permission for every ref in a push
The pre-receive hook cached the result of CanWriteCode() after the first ref in a batch push, but CanMaintainerWriteToBranch depends on the current branch name. A user holding a per-branch maintainer-edit grant (an open PR with "allow edits from maintainers") could batch that branch with protected branches or tags and have the cached approval reused, escalating to full repository write. Evaluate the permission fresh for every ref; the pusher and base permission remain cached via loadPusherAndPermission. Assisted-by: Claude:claude-opus-4-8
2026-09-09 06:23:24 +09:00 · 2026-06-15 14:22:38 +08:00 · 2026-06-13 18:38:06 +02:00 · 2026-06-13 18:38:06 +02:00 · 2026-06-13 18:38:06 +02:00 · 2026-06-13 17:36:35 +02:00
2472 changed files with 35165 additions and 72869 deletions
@@ -11,7 +11,7 @@ include_file = ["main.go"]
 include_dir = ["cmd", "models", "modules", "options", "routers", "services"]
 exclude_dir = [
  "models/fixtures",
-  "modelmigration/fixtures",
+  "models/migrations/fixtures",
  "modules/avatar/identicon/testdata",
  "modules/avatar/testdata",
  "modules/git/tests",
@@ -18,10 +18,13 @@ indent_style = tab
 [templates/custom/*.tmpl]
 insert_final_newline = false

-[templates/swagger/*.generated.json]
+[templates/swagger/*_json.tmpl]
 indent_style = space
 insert_final_newline = false

+[templates/user/auth/oidc_wellknown.tmpl]
+indent_style = space
+
 [templates/shared/actions/runner_badge_*.tmpl]
 # editconfig lint requires these XML-like files to have charset defined, but the files don't have.
 charset = unset
@@ -3,8 +3,10 @@
 *.pb.go linguist-generated
 /assets/*.json linguist-generated
 /public/assets/img/svg/*.svg linguist-generated
-/templates/swagger/*.generated.json linguist-generated
+/templates/swagger/v1_json.tmpl linguist-generated
+/templates/swagger/v1_openapi3_json.tmpl linguist-generated
 /options/fileicon/** linguist-generated
 /vendor/** -text -eol linguist-vendored
+/web_src/js/vendor/** -text -eol linguist-vendored
 Dockerfile.* linguist-language=Dockerfile
 Makefile.* linguist-language=Makefile
@@ -9,12 +9,10 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
-      with:
-        cache-image: false
-    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
    - name: Build regular image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -22,7 +20,7 @@ runs:
        file: Dockerfile
        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
    - name: Build rootless image
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -7,11 +7,6 @@ runs:
  steps:
    - shell: bash
      run: |
-        avail=$(df --output=avail -BG / | tr -dc '0-9')
-        if [ "$avail" -ge 50 ]; then
-          echo "skipping cleanup, ${avail}G free"
-          exit 0
-        fi
        echo "free space before cleanup:"
        df -h /
        for dir in /usr/local/lib/android /usr/local/.ghcup /opt/ghc /usr/share/dotnet; do
@@ -2,18 +2,12 @@ name: go-caches
 description: Restore the go module, build, and golangci-lint caches. Save only on the cache-seeder workflow.

 # Only the cache-seeder workflow saves; rename requires updating cache-seeder.yml.
-# The lint job restores but does not save the gobuild and gomod caches, so every key
-# has a single writer and there is no contention on it.
+# The lint job restores but does not save the gobuild cache, so only one writer
+# (the gobuild job) populates it and there is no contention on the cache key.
 # Seeder restores by exact key only (no restore-keys) so each go.sum seeds a clean
 # cache and size stays bounded; do not add restore-keys here. PR runs keep them.
-# The go version is part of the gobuild and golint keys because a toolchain bump
-# invalidates every entry in them, so a cross-version fallback would restore
-# gigabytes that no build can use. The module cache is version-independent.

 inputs:
-  go-version:
-    description: Go version the build caches belong to
-    required: true
  lint-cache:
    description: Restore (and save in cache-seeder) ~/.cache/golangci-lint
    default: "false"
@@ -21,36 +15,36 @@ inputs:
 runs:
  using: composite
  steps:
-    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    - if: ${{ github.workflow == 'cache-seeder' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    - if: ${{ github.workflow != 'cache-seeder' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}-
+        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/go-build
-        key: gobuild-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum') }}
+        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/go-build
-        key: gobuild-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum') }}
-        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-
+        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/golangci-lint
-        key: golint-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/golangci-lint
-        key: golint-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
-        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}
@@ -13,8 +13,7 @@ runs:
  using: composite
  steps:
    - uses: ./.github/actions/free-disk-space
-    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-      id: setup-go
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: go.mod
        check-latest: true
@@ -22,5 +21,4 @@ runs:
    - if: ${{ inputs.cache == 'true' }}
      uses: ./.github/actions/go-cache
      with:
-        go-version: ${{ steps.setup-go.outputs.go-version }}
        lint-cache: ${{ inputs.lint-cache }}
@@ -1,30 +1,22 @@
 name: node-setup
-description: Set up pnpm and node and restore the pnpm store cache
+description: Set up pnpm and node and restore caches

 inputs:
  cache:
-    description: Restore the pnpm store cache
+    description: Cache pnpm downloads
    default: "true"

 runs:
  using: composite
  steps:
-    - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-      with:
-        node-version: 26
+    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
    - if: ${{ inputs.cache == 'true' }}
-      id: store
-      shell: bash
-      run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
-    - if: ${{ inputs.cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        path: ${{ steps.store.outputs.path }}
-        key: pnpm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml') }}
-    - if: ${{ inputs.cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        node-version: 24
+        cache: pnpm
+        cache-dependency-path: pnpm-lock.yaml
+    - if: ${{ inputs.cache != 'true' }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        path: ${{ steps.store.outputs.path }}
-        key: pnpm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml') }}
-        restore-keys: pnpm-${{ runner.os }}-${{ runner.arch }}-
+        node-version: 24
@@ -1,10 +0,0 @@
-name: python-setup
-description: Set up uv and python and restore the uv cache
-
-runs:
-  using: composite
-  steps:
-    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-      with:
-        python-version: 3.14
-        save-cache: ${{ github.workflow == 'cache-seeder' }}
@@ -1,48 +0,0 @@
-name: cache-prune
-
-# Keeps the repository's total cache size below a fixed limit, so that GitHub never
-# rejects a save for being over the allowance.
-
-on:
-  schedule:
-    - cron: "37 */6 * * *" # every six hours at :37
-  workflow_dispatch:
-  workflow_call:
-
-permissions: {}
-
-concurrency:
-  group: cache-prune
-
-jobs:
-  prune:
-    runs-on: ubuntu-latest
-    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      actions: write # to delete caches
-    env:
-      GH_TOKEN: ${{ github.token }}
-      GH_REPO: ${{ github.repository }}
-    steps:
-      # Keep the newest generation per key, restores never reach the older ones.
-      - name: delete superseded caches
-        run: |
-          gh cache list --limit 1000 --json id,key,ref,createdAt |
-            jq -r 'group_by([.ref, (.key | sub("(-go[0-9.]+)?-[0-9a-f]{40,64}(-[0-9]+-[0-9]+)?$"; ""))])[]
-              | sort_by(.createdAt)[:-1][] | "\(.id) \(.key)"' |
-            while read -r id key; do
-              echo "deleting $key"
-              gh cache delete "$id" || true
-            done
-
-      # Deletes least recently used first, the order GitHub itself evicts in.
-      - name: delete caches over the size limit
-        run: |
-          caches=$(gh cache list --limit 1000 --sort last_accessed_at --order asc --json id,key,sizeInBytes)
-          size=$(jq '[.[].sizeInBytes] | add // 0' <<< "$caches")
-          echo "cache usage: $((size / 1000000)) MB"
-          while [ "$size" -gt 6000000000 ] && read -r id bytes key; do
-            echo "deleting $key"
-            gh cache delete "$id" || true
-            size=$((size - bytes))
-          done <<< "$(jq -r '.[] | "\(.id) \(.sizeInBytes) \(.key)"' <<< "$caches")"
@@ -1,25 +1,21 @@
-# Populates main's cache scope so PR runs warm-start from it. Caches are ref-scoped:
-# PR runs read their own scope then fall back to the base branch, and only this
-# workflow saves, so push-to-main is the only chance to populate the fallback scope.
+# Populates main's cache scope so PR runs warm-start from it. Saves the go
+# module, go build (incl. test compile), and golangci-lint caches.
+#
+# Caches are ref-scoped: PR runs read their own scope then fall back to the
+# base branch. Per .github/actions/go-cache/action.yml, PRs are restore-only,
+# so push-to-main is the only opportunity to populate the fallback scope.

 name: cache-seeder

 on:
-  workflow_dispatch:
  push:
    branches:
      - main
    paths:
-      - "go.mod" # a toolchain bump invalidates the build caches
      - "go.sum"
      - ".golangci.yml"
-      - "pnpm-lock.yaml"
-      - "pyproject.toml"
-      - "uv.lock"
      - ".github/actions/go-cache/action.yml"
      - ".github/actions/go-setup/action.yml"
-      - ".github/actions/node-setup/action.yml"
-      - ".github/actions/python-setup/action.yml"
      - ".github/workflows/cache-seeder.yml"

 concurrency:
@@ -33,11 +29,11 @@ jobs:
  gobuild:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: TAGS="bindata" make backend
-      - run: TAGS="bindata gogit" make backend
+      - run: TAGS="bindata gogit" GOEXPERIMENT="" make backend
      - name: warm test compile cache (bindata)
        env:
          TAGS: bindata
@@ -46,12 +42,13 @@ jobs:
      - name: warm test compile cache (bindata gogit)
        env:
          TAGS: bindata gogit
+          GOEXPERIMENT:
          GOTEST_FLAGS: -race -list=^$$ -count=1
        run: make test-backend
      - name: warm integration compile cache
        run: |
          TAGS="bindata" make test-integration-compile
-          TAGS="bindata gogit" make test-integration-compile
+          TAGS="bindata gogit" GOEXPERIMENT="" make test-integration-compile
          TAGS="bindata gogit" GOTEST_FLAGS="-race" make test-integration-compile

  lint:
@@ -62,7 +59,7 @@ jobs:
        include:
          - { tags: "bindata", target: "lint-backend" }
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
        with:
          lint-cache: "true"
@@ -70,28 +67,6 @@ jobs:
      - run: make generate-go
        env:
          TAGS: ${{ matrix.tags }}
-      - run: make "$TARGET"
+      - run: make ${{ matrix.target }}
        env:
          TAGS: ${{ matrix.tags }}
-          TARGET: ${{ matrix.target }}
-
-  frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: ./.github/actions/node-setup
-      - run: make deps-frontend
-
-  python:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: ./.github/actions/python-setup
-      - run: make deps-py
-
-  # reclaims the caches this run superseded, so the next save still fits in the allowance
-  prune:
-    needs: [gobuild, lint, frontend, python]
-    permissions:
-      actions: write
-    uses: ./.github/workflows/cache-prune.yml
@@ -5,8 +5,6 @@ on:
  #   - cron: "7 0 * * 1" # every Monday at 00:07 UTC
  workflow_dispatch:

-permissions: {}
-
 jobs:
  cron-licenses:
    runs-on: ubuntu-latest
@@ -14,12 +12,11 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
      - run: make generate-gitignore
        timeout-minutes: 40
      - name: push translations to repo
@@ -20,13 +20,13 @@ jobs:
    if: github.repository == 'go-gitea/gitea' # prevent running on forks
    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: renovatebot/github-action@39b914146caeff8cd512e61c8992f1d5913af85c # v46.2.5
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg|generate-codemirror-languages)$"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
@@ -5,8 +5,6 @@ on:
    - cron: "7 0 * * *" # every day at 00:07 UTC
  workflow_dispatch:

-permissions: {}
-
 jobs:
  crowdin-pull:
    runs-on: ubuntu-latest
@@ -14,8 +12,8 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: crowdin/github-action@71fdb8814261dd703be4ca7c6450d21b1868da4b # v3.0.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
        with:
          upload_sources: true
          upload_translations: false
@@ -49,8 +49,8 @@ jobs:
      e2e: ${{ steps.changes.outputs.e2e }}
      shell: ${{ steps.changes.outputs.shell }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
          filters: |
@@ -73,9 +73,8 @@ jobs:
            frontend:
              - "*.ts"
              - "web_src/**"
-              - "tools/**/*.ts"
-              - "tools/**/*.json"
-              - "tools/playwright.sh"
+              - "tools/generate-svg.ts"
+              - "tools/generate-svg-vscode-extensions.json"
              - "tsconfig.json"
              - "assets/emoji.json"
              - "package.json"
@@ -114,7 +113,8 @@ jobs:
              - "Dockerfile.rootless"

            swagger:
-              - "templates/swagger/*.json"
+              - "templates/swagger/v1_json.tmpl"
+              - "templates/swagger/v1_input.json"
              - "Makefile"
              - "package.json"
              - "pnpm-lock.yaml"
@@ -135,7 +135,6 @@ jobs:
            e2e:
              - "tests/e2e/**"
              - "tools/test-e2e.sh"
-              - "tools/playwright.sh"
              - "playwright.config.ts"

            shell:
@@ -19,7 +19,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
-      - uses: go-gitea/giteabot@c214e4be0efc926a2d6ce93b7a3911fe7fa65ab1 # v1.0.6
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
        with:
          github_token: ${{ secrets.GITEABOT_TOKEN }}
          gitea_fork: giteabot/gitea
@@ -1,16 +1,9 @@
 name: giteabot

 on:
-  # When main advances, rerun merge queue maintenance so the oldest
-  # reviewed/wait-merge PR can be updated against the new base promptly.
-  push:
-    branches:
-      - main
  # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
  # forks, which the bot needs to write labels, statuses and comments. Safe here
  # because the job only runs a pinned action and never checks out PR HEAD.
-  # These PR lifecycle events drive label maintenance, queue maintenance, and
-  # explicit bot actions triggered by relevant label changes.
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    types:
      - opened
@@ -20,19 +13,13 @@ on:
      - closed
      - review_requested
      - review_request_removed
-  # Review events keep review-derived state such as lgtm labels and status checks
-  # in sync after approvals, edits, or dismissals.
  pull_request_review:
    types:
      - submitted
      - edited
      - dismissed
-  # Periodic maintenance is still useful as a backstop for queue cleanup and
-  # other housekeeping, even though main pushes now trigger it promptly.
  schedule:
    - cron: "15 3 * * *"
-  # Allow maintainers to rerun selected checks manually when debugging bot
-  # behavior without waiting for another repository event.
  workflow_dispatch:
    inputs:
      checks:
@@ -40,7 +27,11 @@ on:
        required: false
        default: labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions

-permissions: {}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  statuses: write

 concurrency:
  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
@@ -51,15 +42,10 @@ jobs:
    if: github.repository == 'go-gitea/gitea'
    runs-on: ubuntu-latest
    timeout-minutes: 30
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write
-      statuses: write
    steps:
      # pull_request_review runs without repository secrets on fork PRs, so fall
      # back to the workflow token for the non-backport checks handled here.
-      - uses: go-gitea/giteabot@c214e4be0efc926a2d6ce93b7a3911fe7fa65ab1 # v1.0.6
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
        with:
          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
@@ -19,18 +19,19 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
        with:
          lint-cache: "true"
      - run: make deps-backend deps-tools
-      - run: TAGS="bindata" make generate-go lint-backend # lint-go can lint with "bindata" tags
+      - run: TAGS="bindata" make generate-go # lint-go also lints with "bindata" tags which requires "_bindata.go"
+      - run: make lint-backend

  lint-on-demand:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
        with:
          cache: "false"
@@ -41,7 +42,9 @@ jobs:
      - run: make lint-spell

      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: ./.github/actions/python-setup
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          python-version: 3.14
      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
        run: make deps-py lint-templates lint-yaml

@@ -59,7 +62,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: make --always-make checks-backend # ensure the "go-licenses" make target runs
@@ -69,12 +72,11 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
      - run: make lint-frontend
      - run: make checks-frontend
-      - run: make playwright
      - run: make test-frontend
      - run: make frontend

@@ -83,27 +85,25 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend generate-go
      # no frontend build here as backend should be able to build, even without any frontend files
      # CGO is not used when cross-compile, so these steps also test if the code is compatible with CGO disabled
      - name: build-backend-arm64
-        run: go build -ldflags '-s -w' -o gitea-linux-arm64
+        run: go build -o gitea_linux_arm64
        env:
          GOOS: linux
          GOARCH: arm64
          TAGS: bindata gogit
      - name: build-backend-windows
-        run: go build -ldflags '-s -w' -o gitea-windows
+        run: go build -o gitea_windows
        env:
          GOOS: windows
          GOARCH: amd64
          TAGS: bindata gogit
      - name: build-backend-386
-        run: go build -ldflags '-s -w' -o gitea-linux-386
+        run: go build -o gitea_linux_386
        env:
          GOOS: linux
          GOARCH: 386
-      - name: binary-sizes
-        run: ls -l gitea-*
@@ -21,7 +21,7 @@ jobs:
    timeout-minutes: 50
    services:
      pgsql:
-        image: postgres:14@sha256:156f0b253fd61366d5fc2107ad45955027d5612f695a8436ce20167f3fa79bff
+        image: postgres:14
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
@@ -35,14 +35,14 @@ jobs:
      minio:
        # as github actions doesn't support "entrypoint", we need to use a non-official image
        # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2025.7.23@sha256:8935e75fa5d11295c17171e4aa49efe390a1193cd7f12e4d21b92af9ffef09d7
+        image: bitnamilegacy/minio:2025.7.23
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/pgsql-shard
        with:
@@ -57,7 +57,7 @@ jobs:
    timeout-minutes: 50
    services:
      pgsql:
-        image: postgres:14@sha256:156f0b253fd61366d5fc2107ad45955027d5612f695a8436ce20167f3fa79bff
+        image: postgres:14
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
@@ -71,14 +71,14 @@ jobs:
      minio:
        # as github actions doesn't support "entrypoint", we need to use a non-official image
        # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2025.7.23@sha256:8935e75fa5d11295c17171e4aa49efe390a1193cd7f12e4d21b92af9ffef09d7
+        image: bitnamilegacy/minio:2025.7.23
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/pgsql-shard
        with:
@@ -90,12 +90,13 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend
      - run: make backend
        env:
          TAGS: bindata gogit
+          GOEXPERIMENT:
      - run: GITEA_TEST_DATABASE=sqlite make test-migration
        env:
          TAGS: bindata gogit
@@ -106,6 +107,7 @@ jobs:
          # sqlite driver can contain large amount of Golang code, so don't use race detector for it, otherwise, extremely slow
          GOTEST_FLAGS: -timeout=40m
          TAGS: bindata gogit
+          GOEXPERIMENT:

  test-unit:
    if: needs.files-changed.outputs.backend == 'true'
@@ -113,7 +115,7 @@ jobs:
    runs-on: ubuntu-latest
    services:
      elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15@sha256:aeda96cd85b0cadeb3a3b900789f3b85e902c994052dadbaf8dd99a539e2ef93
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
        env:
          discovery.type: single-node
          xpack.security.enabled: false
@@ -123,13 +125,13 @@ jobs:
        ports:
          - "9200:9200"
      meilisearch:
-        image: getmeili/meilisearch:v1@sha256:8d6643d86d71fad6ad3cba92cde7ccfce9e4d6c384bda67598eb553571c32431
+        image: getmeili/meilisearch:v1
        env:
          MEILI_ENV: development # disable auth
        ports:
          - "7700:7700"
      redis:
-        image: redis:latest@sha256:76961cd2a0f40ef6fdd334b6b1b3a76a2bad1848d89f3030ca30a7521d4a9493
+        image: redis:latest@sha256:e74c9b933d78e2829583d88f92793f4524752a15ac59c8baff2dd5ed000b7432
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -138,18 +140,18 @@ jobs:
        ports:
          - 6379:6379
      minio:
-        image: bitnamilegacy/minio:2025.7.23@sha256:8935e75fa5d11295c17171e4aa49efe390a1193cd7f12e4d21b92af9ffef09d7
+        image: bitnamilegacy/minio:2025.7.23
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:f9791d0a0613e93057c06ae31f7ac0c0222f0530590e67e020b0986c66a36fa6
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
@@ -168,6 +170,7 @@ jobs:
        env:
          GOTEST_FLAGS: -race -timeout=20m
          TAGS: bindata gogit
+          GOEXPERIMENT:
          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
          GITEA_TEST_CI_SKIP_EXTERNAL: true
      - run: make test-check
@@ -179,7 +182,7 @@ jobs:
    services:
      mysql:
        # the bitnami mysql image has more options than the official one, it's easier to customize
-        image: bitnamilegacy/mysql:8.4@sha256:7089d796fc9b4629a628bd445e4afabe607351ee665444c3197bdeaed812ea65
+        image: bitnamilegacy/mysql:8.4
        env:
          ALLOW_EMPTY_PASSWORD: true
          MYSQL_DATABASE: testgitea
@@ -188,7 +191,7 @@ jobs:
        options: >-
          --mount type=tmpfs,destination=/bitnami/mysql/data
      elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15@sha256:aeda96cd85b0cadeb3a3b900789f3b85e902c994052dadbaf8dd99a539e2ef93
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
        env:
          discovery.type: single-node
          xpack.security.enabled: false
@@ -205,7 +208,7 @@ jobs:
          - "587:587"
          - "993:993"
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
@@ -226,7 +229,7 @@ jobs:
    runs-on: ubuntu-latest
    services:
      mssql:
-        image: mcr.microsoft.com/mssql/server:2019-latest@sha256:46f719fd3457d4e7e8e5845fe00c35c20e7bae7ff1e8b9fe595f2a81029f5ba8
+        image: mcr.microsoft.com/mssql/server:2019-latest
        env:
          ACCEPT_EULA: Y
          MSSQL_PID: Standard
@@ -234,11 +237,11 @@ jobs:
        ports:
          - "1433:1433"
      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:f9791d0a0613e93057c06ae31f7ac0c0222f0530590e67e020b0986c66a36fa6
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
@@ -21,7 +21,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/amd64
@@ -31,7 +31,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/arm64
@@ -41,7 +41,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/riscv64
@@ -19,7 +19,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
@@ -10,8 +10,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

-permissions: {}
-
 jobs:
  labeler:
    runs-on: ubuntu-latest
@@ -19,7 +17,7 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          sync-labels: true

@@ -32,12 +30,12 @@ jobs:
      pull-requests: write
    steps:
      # Base-branch checkout only: pull_request_target runs with elevated token; never run PR-head code here.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.pull_request.base.sha }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version: 26
+          node-version: 24
      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
      - run: node ./tools/ci-tools.ts lint-pr-title
        env:
@@ -45,6 +43,5 @@ jobs:
      - run: node ./tools/ci-tools.ts set-pr-labels
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_TITLE_BEFORE: ${{ github.event.changes.title.from }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ github.token }}
@@ -6,43 +6,36 @@ on:
      - main
  workflow_dispatch:

-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
  contents: read

 jobs:
  build-and-publish:
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.runner }}
+    runs-on: ubuntu-latest
+
+    env:
+      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - name: Build snap
-        id: build
-        env:
-          SNAPCRAFT_IMAGE_INFO: '{"build_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}'
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Remote build
        run: |
-          # snapcraft installs build-snaps and apt packages system-wide, which needs root
-          sudo snap install --classic snapcraft
-          sudo SNAPCRAFT_BUILD_INFO=1 SNAPCRAFT_IMAGE_INFO="$SNAPCRAFT_IMAGE_INFO" snapcraft pack --destructive-mode
-          echo "snap=$(ls ./*.snap)" >> "$GITHUB_OUTPUT"
-      # retry snapcraft uploads which can be flaky
-      - name: Publish snap
+          snapcraft remote-build \
+            --launchpad-accept-public-upload \
+            --build-for=amd64,arm64,armhf
+
+      - name: List built snaps
+        run: find . -maxdepth 1 -type f -name '*.snap' -print
+
+      - name: Upload and release snapcraft nightly build
        run: |
-          for attempt in 1 2 3 4 5; do
-            snapcraft upload "$SNAP" --release latest/edge && exit 0
-            echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
-            sleep 15
+          set -euo pipefail
+
+          for snap in ./*.snap; do
+            echo "Uploading $snap to edge"
+            snapcraft upload --release="latest/edge" "$snap"
          done
-          exit 1
-        env:
-          SNAP: ${{ steps.build.outputs.snap }}
-          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
@@ -8,29 +8,31 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

-permissions: {}
-
 jobs:
  nightly-binary:
    runs-on: namespace-profile-gitea-release-binary
    permissions:
      contents: read
-      id-token: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
+      # xgo build
      - run: make release
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        env:
+          TAGS: bindata
      - name: import gpg key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -43,10 +45,9 @@ jobs:
          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
-      # clean branch name to get the folder name in the object storage
+      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -55,16 +56,18 @@ jobs:
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
+      - name: configure aws
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      - name: upload binaries to s3
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress

  nightly-container:
    runs-on: namespace-profile-gitea-release-docker
@@ -72,14 +75,12 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
-        with:
-          cache-image: false
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -87,7 +88,7 @@ jobs:
        run: |
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -97,7 +98,7 @@ jobs:
            type=raw,value=${{ steps.clean_name.outputs.branch }}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -111,18 +112,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -132,7 +133,7 @@ jobs:
          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
      - name: build rootless docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -9,29 +9,31 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

-permissions: {}
-
 jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
    permissions:
      contents: read
-      id-token: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
+      # xgo build
      - run: make release
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        env:
+          TAGS: bindata
      - name: import gpg key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -44,10 +46,9 @@ jobs:
          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
-      # clean branch name to get the folder name in the object storage
+      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -56,18 +57,20 @@ jobs:
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
+      - name: configure aws
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      - name: upload binaries to s3
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
+        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
          gh-cli-version: 2.39.1
      - name: create github release
@@ -83,15 +86,13 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
-        with:
-          cache-image: false
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -104,7 +105,7 @@ jobs:
            type=semver,pattern={{version}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -120,18 +121,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -139,7 +140,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -11,30 +11,32 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

-permissions: {}
-
 jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
    permissions:
      contents: read
      packages: write # to publish to ghcr.io
-      id-token: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
+      # xgo build
      - run: make release
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        env:
+          TAGS: bindata
      - name: import gpg key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -47,10 +49,9 @@ jobs:
          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
-      # clean branch name to get the folder name in the object storage
+      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -59,18 +60,20 @@ jobs:
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
+      - name: configure aws
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      - name: upload binaries to s3
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
+        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
          gh-cli-version: 2.39.1
      - name: create github release
@@ -86,15 +89,13 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
-        with:
-          cache-image: false
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -111,7 +112,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -132,18 +133,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -151,7 +152,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -1,9 +0,0 @@
-rules:
-  anonymous-definition:
-    disable: true
-  undocumented-permissions:
-    disable: true
-  concurrency-limits:
-    disable: true
-  self-repository:
-    disable: true # actionlint rejects "$/" uses, https://github.com/rhysd/actionlint/issues/711
@@ -11,7 +11,6 @@ linters:
    - dupl
    - errcheck
    - forbidigo
-    - forcetypeassert
    - gocheckcompilerdirectives
    - gocritic
    - govet
@@ -52,23 +51,14 @@ linters:
              desc: do not use the go-chi cache package, use gitea's cache system
            - pkg: github.com/pkg/errors
              desc: use builtin errors package instead
-            - pkg: gitea.com/go-chi/binding
-              desc: use our wrapper
        migrations:
          files:
-            - '**/modelmigration/**/*.go'
+            - '**/models/migrations/**/*.go'
          deny:
-            - pkg: gitea.dev/models
-              desc: "migrations must not depend on the models package. HINT: MIGRATION-STRUCT-FROZEN"
+            - pkg: gitea.dev/models$
+              desc: migrations must not depend on the models package
            - pkg: gitea.dev/modules/structs
-              desc: "migrations must not depend on modules/structs. HINT: MIGRATION-STRUCT-FROZEN"
-    forbidigo:
-      forbid:
-        - pattern: '^(fmt\.Print(|f|ln)|print|println)$' # default
-        - pattern: '^exec\.CommandContext$' # use our wrapper for graceful termination
-    modernize:
-      disable:
-        - embedlit
+              desc: migrations must not depend on modules/structs (API structures change over time)
    nolintlint:
      allow-unused: false
      require-explanation: true
@@ -97,11 +87,6 @@ linters:
        - name: increment-decrement
        - name: modifies-value-receiver
        - name: package-comments
-        - name: package-naming
-          arguments:
-            - convention-name-check-regex: '^[a-z][a-z0-9_]*$' # underscores are used by migration packages
-              skip-default-bad-name-check: true
-              skip-collision-with-common-std: true
        - name: redefines-builtin-id
        - name: superfluous-else
        - name: time-naming
@@ -111,7 +96,7 @@ linters:
          arguments:
            - [] # AllowList - do not remove as args for the rule are positional and won't work without lists first
            - [] # DenyList
-            - - skip-initialism-name-checks: true
+            - - skip-package-name-checks: true # supress errors from underscore in migration packages
    staticcheck:
      checks:
        - all
@@ -122,7 +107,6 @@ linters:
        - -QF1008
    testifylint:
      disable:
-        - empty
        - go-require
        - require-error
    usetesting:
@@ -144,13 +128,16 @@ linters:
      - linters:
          - dupl
          - errcheck
-          - forbidigo
          - staticcheck
          - unparam
        path: _test\.go
      - linters:
          - dupl
-        path: modelmigration/v
+          - errcheck
+        path: models/migrations/v
+      - linters:
+          - forbidigo
+        path: cmd
      - linters:
          - dupl
        text: (?i)webhook
@@ -167,10 +154,13 @@ linters:
          - gocritic
        text: '(?i)exitAfterDefer:'
    paths:
-      - ^node_modules/
-      - ^\.venv/
-      - ^public/
-      - ^web_src/
+      - node_modules
+      - .venv
+      - public
+      - web_src
+      - third_party$
+      - builtin$
+      - examples$
 issues:
  max-issues-per-linter: 0
  max-same-issues: 0
@@ -187,15 +177,14 @@ formatters:
        - blank
        - default
    gofumpt:
-      extra:
-        group-params: true
+      extra-rules: true
  exclusions:
    generated: lax
    paths:
-      - ^node_modules/
-      - ^\.venv/
-      - ^public/
-      - ^web_src/
+      - node_modules
+      - .venv
+      - public
+      - web_src

 run:
  timeout: 10m
@@ -1,2 +1 @@
-# SC2153: false-alert "Possible misspelling: TAGS may not be assigned. Did you mean tags?". We already use strict mode.
-disable=SC1091,SC2001,SC2002,SC2016,SC2028,SC2046,SC2124,SC2128,SC2129,SC2153,SC2154,SC2155,SC2164,SC2181,SC2207
+disable=SC1091,SC2001,SC2002,SC2016,SC2028,SC2046,SC2124,SC2128,SC2129,SC2154,SC2155,SC2164,SC2181,SC2207
@@ -4,4 +4,9 @@ rules:
  info-contact: off
  oas2-api-host: off
  oas2-parameter-description: off
+  oas2-schema: off
+  oas2-valid-schema-example: off
+  openapi-tags: off
  operation-description: off
+  operation-singular-tag: off
+  operation-tag-defined: off
@@ -1,20 +1,20 @@
- Never assume, verify before claiming
- List development targets with `make help`
- Read relevant developer documentation in the `docs` folder
- PR descriptions: minimal, only what and why, no task or file listings. Include screenshots for UI changes, before and after when modifying existing UI. Aim for less than 1000 characters
- Reference issues and PRs by full URL, not by number
- Use Conventional Commits for commit messages and PR titles, plus Gitea's `enhance` type for user-facing enhancements
- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` trailer to commit messages, never `Co-Authored-By` or `Signed-off-by`
- Attribute agent authorship on one trailing line in issue and PR comments, never as a PR description section
- Never rewrite git history unless asked, update PRs with new commits and normal push
- Comments: write almost none, short and preferably same-line, explaining why for a future reader. Never narrate code, the change or the prompt. Preserve existing ones that still apply. If you need to write a paragraph-long comment, rethink your implementation, it is likely too complicated
- Add the current year to copyright headers of new `.go` files
- In `options/locale`, only edit `locale_en-US.json`, other locales are synced automatically
- In TS, use `!` instead of `?.`/`??` when a value always exists
- In Go, prefer to use modern language features wherever possible
- Prefer `tw-*` utilities over inline `style` and `flex-*` helpers over per-child `tw-ml-*`/`tw-mr-*` margins, falling back to `tw-*` where specificity requires `!important`
- Run `make fmt` after `.go` edits, `make tidy` after `go.mod` edits, `make generate-swagger` after API changes, and lint what changed with `make lint-go`, `lint-js`, `lint-css` or `lint-templates`
- Fix the cause rather than disabling a linter or weakening a test. Where unavoidable, use the narrowest scope with a trailing comment giving the reason
- Run single tests with `go test -run '^TestName$' ./modulepath/` for Go, `pnpm exec vitest <path-filter>` for TS and `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e` for e2e
- Write the fewest, fastest tests covering the behavior, extending an existing one where possible. Prefer unit tests where logic is testable in isolation
- Aim for sub-2s per integration test and sub-4s per e2e test. Wait on a deterministic condition rather than `sleep`, and prefer semantic locators in e2e tests
+- Use `make help` to find available development targets
+- Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
+- Run `make lint-js` to lint `.ts` files
+- Run `make tidy` after any `go.mod` changes
+- Run single go tests with `go test -run '^TestName$' ./modulepath/`
+- Run single js test files with `pnpm exec vitest <path-filter>`
+- Run single playwright e2e test files with `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e`
+- Add the current year into the copyright header of new `.go` files
+- Ensure no trailing whitespace in edited files
+- Use Conventional Commits for commit messages and PR titles, e.g. `type(scope): subject`; `!` before the colon if breaking. Use `test` type for test-only changes.
+- Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
+- Preserve existing code comments, do not remove or rewrite comments that are still relevant
+- Keep comments short, prefer same-line, explain why, never narrate code
+- Prefer unit tests over integration tests when logic is testable in isolation
+- Aim for sub-2s local runtime for integration and e2e tests
+- In TypeScript, use `!` (non-null assertion) instead of `?.`/`??` when a value is known to always exist
+- For CSS layout, prefer `flex-*` helpers over per-child `tw-ml-*` / `tw-mr-*` margins; fall back to `tw-*` utilities when specificity requires `!important`
+- Include authorship attribution in issue and pull request comments
+- Always add `Assisted-By` trailers to commit messages in format `Assisted-by: AGENT_NAME:MODEL_VERSION`
+- Never add `Co-Authored-By` `Signed-off-by` trailer to commit messages. Sign off must be done by a human.
@@ -4,506 +4,6 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.27.3](https://github.com/go-gitea/gitea/releases/tag/v1.27.3) - 2026-08-29
-
-* SECURITY
-  * fix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058)
-  * fix(attachments): enforce owning repository path (#39048) (#39077)
-  * fix(markup): enforce same-repository issue access (#39045) (#39054)
-  * fix(actions): verify raw artifact signatures first (#39049) (#39053)
-  * fix(api): hide limited users from restricted viewers (#39004) (#39039)
-  * fix(repo): limit gitignore template selections (#39027) (#39040)
-  * fix(migrations): cancel GitLab version probes (#39023) (#39035)
-  * fix(packages): limit Swift package manifests (#39025) (#39032)
-  * fix(migrations): bound OneDev version responses (#39024) (#39033)
-  * fix(packages): limit Maven checksum uploads (#39028) (#39031)
-  * fix(packages): bound Alpine metadata entries (#39026) (#39029)
-  * fix(actions): enforce fork pull request trust boundaries (#39005) (#39018)
-  * fix(git): restrict hook permissions (#39008) (#39016)
-  * fix(api): enforce repository creation token authorization (#39007) (#39014)
-  * fix(api): enforce public-only scope for compare heads (#39006) (#39013)
-  * fix(repo): hide repositories of hidden owners (#39009) (#39012)
-  * fix: avoid enumerating every public repository in issue search (#38992) (#39000)
-  * refactor: private endpoints (#38964) (#38965)
-* ENHANCEMENTS
-  * enhance: add permalinks to pull request reviews (#38849) (#39036)
-* BUGFIXES
-  * fix: add missing query parameters on runner list page (#39163)
-  * fix(actions): keep step-level continue-on-error expressions unevaluated (#39141) (#39148)
-  * fix(packages): preserve SemVer prerelease identifiers in Swift Registry (#39156) (#39158)
-  * fix(repo): prevent MarkAsBrokenEmpty when repository is being migrated (#39091) (#39092)
-  * fix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086)
-  * fix(pull): keep the merged state in sync with git (#39062) (#39118)
-  * fix(pull): name the head repository in default compare links (#39075) (#39079)
-  * fix(git): parse co-author trailers that are not RFC 5322 addresses (#39076) (#39081)
-  * fix(actions): show "Complete job" logs when the last step is skipped (#38939) (#39003)
-  * fix(actions): Fix how jobs in matrixes are grouped (#38980) (#38998)
-  * fix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996)
-  * fix: honor environment variables during install (#38974) (#38976)
-  * fix: grant limited-org unit read access to authenticated non-members (#38871) (#38963)
-  * fix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956) (#38961)
-  * fix(actions): drop wrapper span around the action status icon (#38957) (#38959)
-  * fix(issues): sort scoped labels by exclusive order in dropdowns (#38893) (#38954)
-  * fix(indexer): correct bleve indexer token filters (#38853) (#38951)
-  * fix: make "login_name" field optional for API edit user (#38917) (#38945)
-  * fix(actions): reject non-mapping matrix include/exclude (#38933)
-  * fix(ui): respect FEED_PAGING_NUM on the dashboard feed (#38935) (#38936)
-* MISC
-  * chore: repo compare link (#39088) (#39119)
-  * ci: remove AWS S3 uploads from release workflows (#38928) (#38929)
-  * chore: Pre-register a builtin OAuth2 application for the official Gitea mobile app (#38880) (#38922)
-
-## [1.27.2](https://github.com/go-gitea/gitea/releases/tag/v1.27.2) - 2026-08-14
-
-* SECURITY
-  * Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
-  * Refactor: external render (#38885) (#38898)
-  * Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
-  * Refactor: markup render (#38864) (#38869)
-  * Fix(deps): update dependency mermaid to v11.16.1 (#38816)
-  * Fix(auth): set WebAuthn user verification per request (#38805) (#38810)
-  * Fix: render highlight language (#38793) (#38795)
-
-* ENHANCEMENTS
-  * enhance: add missing npm package metadata properties (#38826) (#38831)
-
-* BUGFIXES
-  * fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
-  * fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901)
-  * fix(lfs): accept successful transfer responses (#38866) (#38875)
-  * fix(packages): ignore nested Package.swift (#38788) (#38836)
-  * fix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
-  * fix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
-  * fix(migration): migration deletion returned json redirection (#38796) (#38825)
-  * fix(ui): change underlines to default browser style (#38819) (#38823)
-  * fix(actions): allow cancelling runs without running jobs (#35842) (#38812)
-  * fix(actions): evaluate each `${{ }}` part on its own (#38754) (#38797)
-  * fix(actions): write an action task report in one transaction (#38792) (#38794)
-  * fix: markup link (#38764) (#38765)
-  * fix: set a minio part size when the content size is unknown (#38753) (#38755)
-  * fix: bad path escape in subpath archive download (#38749) (#38750)
-  * fix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744)
-  * fix(markdown): fix double strikethough on code (#38707) (#38729)
-  * fix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722)
-  * fix: correct full url when using sub-path (#38712) (#38716)
-  * fix: avoid markup render panic (#38698) (#38703)
-  * fix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
-  * fix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)
-  * fix(migrations): use all configured GitHub tokens (#38841) (#38846)
-
-## [1.27.1](https://github.com/go-gitea/gitea/releases/tag/v1.27.1) - 2026-07-27
-
-* SECURITY
-  * Fix: orgmode render include path (#38642) (#38645)
-  * Fix: git patch apply (#38637) (#38638)
-  * Fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
-
-* API
-  * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
-
-* ENHANCEMENTS
-  * enhance: improve diff contrast in light and dark themes (#37477) (#38574)
-
-* BUGFIXES
-  * fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
-  * fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
-  * fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
-  * fix(actions): skip already-approved runs in `ApproveRuns` (#38653) (#38654)
-  * fix: orgmode render include path (#38642) (#38645)
-  * fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
-  * fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
-  * fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
-  * fix(actions): correctness and hardening fixes (#38518) (#38631)
-  * fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
-  * fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
-  * fix(webhook): remove slack channel name check (#38608) (#38612)
-  * fix: download dropdown menu clipped on the branches page (#38604) (#38609)
-  * fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
-  * fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
-  * fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
-  * fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
-  * fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
-  * fix: branch protection user list (#38570) (#38584)
-  * fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
-  * fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
-  * fix(actions): support `matrix` when evaluating workflow `if` expression (#38474) (#38557)
-  * fix(actions): align status icon span for Safari rendering (#38558) (#38562)
-  * fix: revert git clone http redirection forbidden (#38530) (#38545)
-  * fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
-  * fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
-  * fix: make the merge box button red if some checks fail (#38508) (#38516)
-  * fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
-  * fix: make commit message merge correctly (#38490) (#38502)
-  * fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
-  * fix(actions): make `cancelled()` work in job `if` evaluation (#38495) (#38497)
-  * fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
-  * fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
-  * fix: full file highlighting for git diff with CR char (#38484) (#38491)
-  * fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
-  * fix: 500 error when updating user visibility (#38480) (#38483)
-  * fix(actions): make job list item fully clickable (#38462) (#38471)
-  * fix: mail template for push event (#38467) (#38468)
-  * fix: make "test push webhook" always work (#38425) (#38455)
-  * fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
-  * fix(org): align follow button and wrap description (#38448) (#38454)
-  * fix(actions): populate `github.event` for scheduled runs (#38446) (#38452)
-
-* MISC
-  * refactor: git patch apply (#38637) (#38638)
-
-## [1.27.0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0) - 2026-07-13
-
-* BREAKING
-  * Feat(actions)!: improve support for reusable workflows (#37478)
-  * Use Content-Security-Policy: script nonce (#37232)
-
-* SECURITY
-  * Fix: various security fixes (#38406) (#38426)
-  * Fix(security): harden access checks and migration validation (#38324) (#38400)
-  * Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
-  * Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
-  * Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
-  * Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
-  * Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
-  * Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
-  * Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
-  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
-  * Fix(oauth): restrict introspection to the token's client (#38042)
-  * Fix(api): don't expose private org membership via public_members (#38145)
-  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
-  * Fix(migrations): prevent path traversal in repository restore (#38215)
-  * Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
-
-* FEATURES
-  * Feat(actions): add workflow status badge modal (#38196)
-  * Feat(actions): support owner-level and global scoped workflows (#38154)
-  * Feat(api): support ref suffixes in compare (#38148)
-  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
-  * Feat(actions): show run status on browser tab favicon (#38071)
-  * Feat(api): add token introspection and self-deletion endpoint (#37995)
-  * Feat(repo): split repository creation limit into user and org scopes (#37872)
-  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
-  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
-  * Feat(org): add team visibility so org members can discover teams (#37680)
-  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
-  * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
-  * Feat: Add avatar stacks (#37594)
-  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
-  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
-  * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
-  * Feat(orgs): Add search bar for organization members tab page (#37347)
-  * Feat(api): Add assignees APIs (#37330)
-  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
-  * Introduce `ActionRunAttempt` to represent each execution of a run (#37119)
-  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
-  * Add project column picker to issue and pull request sidebar (#37037)
-  * Allow multiple projects per issue and pull requests (#36784)
-  * Add bulk repository deletion for organizations (#36763)
-  * Add API endpoint to reply to pull request review comments (#36683)
-  * Feat: Add bypass allowlist for branch protection (#36514)
-  * Feat(ui): add "follow rename" to file commit history list (#34994)
-  * Feat(ssh): auto generate additional ssh keys (#33974)
-
-* ENHANCEMENTS
-  * Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
-  * Enhance: allow builtin default git config options to be overridden (#38172)
-  * Enhance: allow MathML core elements (#38034)
-  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
-  * Enhance(markup): improve issue title rendering (#37908)
-  * Enhance(actions): set descriptive browser tab title on run view (#37870)
-  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
-  * Feat(actions): add before/after to PR synchronize event payload (#37827)
-  * Enhance(actions): add branch filters to run list (#37826)
-  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
-  * Feat: add copy button to action step header, improve other copy buttons (#37744)
-  * Feat(web): also display PR counts in repo list (#37739)
-  * Fix(icon): use repo-forked icon to display forks count (#37731)
-  * Feat(api): add sort and order query parameters to job list endpoints (#37672)
-  * Feat(api): add last_sync to repository API (#37566)
-  * Enhance: Adjust Workflow Graph styling (#37497)
-  * Improve code editor text selection and clean up lint enablement (#37474)
-  * Add mirror auth updates to repo edit API and settings (#37468)
-  * Feat: Add default PR branch update style setting (#37410)
-  * Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
-  * Allow fast-forward-only merge when signed commits are required (#37335)
-  * Enhance styling in actions page (#37323)
-  * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229)
-  * Fix: improve actions status icons and texts (#37206)
-  * Make Markdown fenced code block work with more syntaxes (#37154)
-  * Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
-  * Add pagination and search box to org teams list (#37245)
-  * Workflow Artifact Info Hover (#37100)
-  * Feat(editor): broaden language detection in web code editor (#37619)
-
-* PERFORMANCE
-  * Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)
-  * Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
-  * Perf: Various performance regression fixes (#38078)
-  * Perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076)
-  * Batch-load related data in actions run, job, and task API endpoints (#37032)
-
-* BUGFIXES
-  * Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
-  * Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)
-  * Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)
-  * Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)
-  * Fix: actions task state concurrent update (#38405) (#38409)
-  * Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)
-  * Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)
-  * Fix: co-author detection (#38392) (#38397)
-  * Fix: incorrect co-author detection on commit page (#38386) (#38387)
-  * Fix(ui): restore commits table column widths (#38379) (#38383)
-  * Fix: golang html template url escaping (#38363) (#38369)
-  * Fix: minio init check (#38355) (#38361)
-  * Fix: org project view assignee list (#38357) (#38360)
-  * Fix(actions): release claimed task if context is cancelled during `FetchTask` (#38343) (#38347)
-  * Fix(actions): make runner list pagination order deterministic (#38313) (#38327)
-  * Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)
-  * Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)
-  * Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
-  * Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)
-  * Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)
-  * Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)
-  * Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)
-  * Fix: update npm dependencies, fix misc issues (#38257)
-  * Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
-  * Fix: codemirror regressions (#38248)
-  * Fix(api): support HEAD requests on all API GET endpoints (#38245)
-  * Fix(actions): Cleanup workflow status badge code (#38241)
-  * Fix(web): Correctly align the "disabled" label on larger workflow names (#38240)
-  * Fix(actions): don't swallow HTML entities into linkified URLs (#38239)
-  * Fix(packages): accept npm "repository" and "bin" in string form (#38236)
-  * Fix(actions): fix 500 error when canceling a canceling task (#38223)
-  * Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
-  * Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
-  * Fix(api): deny private org member enumeration via /members (#38213)
-  * Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
-  * Fix(deps): update go dependencies (#38194)
-  * Fix(deps): update npm dependencies (#38193)
-  * Fix(cli): default must-change-password to false for bot users (#38175)
-  * Fix(actions): show run index in run view and fix summary graph height (#38165)
-  * Fix: csp (#38162)
-  * Fix(deps): update npm dependencies (#38123)
-  * Fix(mssql): expand legacy issue and comment long-text columns (#38120)
-  * Fix(packages): validate debian distribution and component names (#38116)
-  * Fix(packages): validate module version in goproxy ParsePackage (#38104)
-  * Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
-  * Fix: git push hook post receive (#38089)
-  * Fix(ui): prevent commit status popup overflowing its row (#38081)
-  * Fix: validate gem name in rubygems parseMetadataFile (#38061)
-  * Fix: commit display name (#38057)
-  * Fix: csp regressions (#38047)
-  * Fix: api error message (#38031)
-  * Fix(deps): update npm dependencies (#38029)
-  * Fix: pgsql lint (#38022)
-  * Fix(indexer): fix assignee filters in issue search (#38021)
-  * Fix: various dropdown problems (#38020)
-  * Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
-  * Fix: raise git required version to 2.13 (#37996)
-  * Fix: remove "no-transfrom" from the cache-control header (#37985)
-  * Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
-  * Fix: use committer time where ever possible as default (#37969)
-  * Fix(deps): update npm dependencies, remove nolyfill (#37968)
-  * Fix(deps): update go dependencies (#37967)
-  * Fix(pull): preserve squash message trailers and additional commit messages (#37954)
-  * Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
-  * Fix: support ##[command] log prefix in action run UI (#37882)
-  * Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
-  * Fix(deps): update npm dependencies (#37844)
-  * Fix(deps): update go dependencies (#37841)
-  * Fix(frontend): resolve Vite assets by manifest source path (#37836)
-  * Fix(locales): Replace hardcoded strings (#37788)
-  * Fix(packages): render markdown links relative to linked repo (#37676)
-  * Fix: persist mirror repository metadata (#37519)
-  * Fix cmd tests by mocking builtin paths (#37369)
-  * Add `form-fetch-action` to some forms, fix "fetch action" resp bug (#37305)
-  * Feat: execute post run cleanup when workflow is cancelled (#37275)
-  * Fix `relative-time` error and improve global error handler (#37241)
-  * Refactor flash message and remove SanitizeHTML template func (#37179)
-  * Fix Repository transferring page (#37277)
-
-* TESTING
-  * Test(e2e): fix race in pdf file render test (#38380) (#38381)
-  * Test: compare key file contents instead of `FileInfo` in `TestInitKeys` (#38330) (#38331)
-  * Test: speed up two tests (#37905)
-  * Test: Fix random failure test (#37887)
-  * Test: fix flaky `issue-comment` close test (#37880)
-  * Test: enable WAL for sqlite integration tests (#37861)
-  * Test: fix flaky `TestResourceIndex` and reduce its runtime (#37847)
-  * Test: run `TestAPIRepoMigrate` offline via a local clone source (#37817)
-  * Ci: shard tests and reduce redundant work (#37618)
-  * Test(e2e): run playwright via container (#37300)
-  * Remove external service dependencies in migration tests (#36866)
-  * Refactor: only reset a database table when the table's data was changed (#37573)
-
-* BUILD
-  * Refactor: use modernc sqlite driver as default (#37562)
-  * Fix(actions): authenticate snapcraft before nightly remote build (#38252)
-  * Ci: cap Elasticsearch heap in db-tests (#37816)
-  * Build(snap): publish nightly version to snapcraft via actions (#37814)
-  * Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
-  * Ci: narrow files-changed frontend filter (#37749)
-  * Ci: add `zizmor` to `lint-actions` (#37720)
-  * Chore: clean up "contrib" dir (#37690)
-  * Fix: snap build (main branch) (#37685)
-  * Ci: Also lint json5 files (#37659)
-  * Build: update pnpm to v11 (#37591)
-  * Refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (#37557)
-  * Update go js py dependencies (#37525)
-  * Ci: lint PR titles with commitlint (#37498)
-  * Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
-  * Update GitHub Actions to latest major versions (#37313)
-  * Update go js dependencies (#37312)
-  * Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
-  * Replace custom Go formatter with `golangci-lint fmt` (#37194)
-  * Integrate renovate bot for all dependency updates (#37050)
-  * Build(sign): move to sigstore (#38250)
-
-* DOCS
-  * Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
-  * Update 1.26.1 changelog in main (#37442)
-  * Docs: fix duplicated word in foreachref doc comment (#38161)
-  * Docs: Clarify criteria for becoming a merger (#38113)
-  * Docs: Publish TOC Election Result 2026 (#38111)
-  * Docs: mark openapi3 as autogenerated in attributes (#37963)
-  * Docs: add development setup guide (#37960)
-
-* MISC
-  * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543)
-  * Remove htmx (#37224)
-  * Refactor htmx and fetch-action related code (#37186)
-  * Revert(sign): restore gpg (#38251)
-  * Refactor: replace legacy `delete-button` with `link-action` (#38143)
-  * Refactor(actions): read runner capabilities from proto field (#38068)
-  * Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
-  * Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
-  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
-  * Fix(deps): update go dependencies (#37851)
-  * Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
-  * Ci: tweak `files-changed`, add `free-disk-space` (#37819)
-  * Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
-  * Test(e2e): add comment, release, star, PR and fork tests (#37800)
-  * Chore: simplify issue and pull request templates (#37799)
-  * Chore: Update giteabot to fix failure when backport (#37789)
-  * Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
-  * Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
-  * Ci: split giteabot workflow (#37770)
-  * Fix(deps): update npm dependencies (#37768)
-  * Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
-  * Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
-  * Ci: fix cache-related issues (#37761)
-  * Chore: fix tests (#37760)
-  * Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
-  * Fix(deps): update npm dependencies (#37753)
-  * Fix(deps): update go dependencies (#37752)
-  * Chore(deps): update action dependencies (#37751)
-  * Fix(markup): wrap indented code blocks for the code-copy button (#37748)
-  * Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
-  * Refactor(glob): use strings.Builder for regexp compilation (#37730)
-  * Chore(doctor): remove four obsolete doctor check implementations (#37728)
-  * Refactor(org): simplify owner-team org repo creation logic (#37727)
-  * Refactor: move `workflowpattern` into `modules/actions` (#37717)
-  * Chore: clean up tests (#37715)
-  * Style: misc UI fixes (#37691)
-  * Ci: add shellcheck linter (#37682)
-  * Fix: catch and fix more lint problems (#37674)
-  * Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
-  * Fix(deps): update npm dependencies (#37647)
-  * Ci(renovate): update Go import paths on major bumps (#37641)
-  * Fix(deps): update go dependencies (major) (#37639)
-  * Chore(deps): update action dependencies (major) (#37638)
-  * Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
-  * Fix(deps): update npm dependencies (#37636)
-  * Refactor(log): replace log.Critical with log.Error (#37624)
-  * Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
-  * Chore(deps): update action dependencies (#37603)
-  * Ci: allow `chore` type in PR title lint (#37575)
-  * Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
-  * Docs: fix 4 typos in CHANGELOG.md (#37549)
-  * Fix(deps): update go dependencies (#37541)
-  * Chore(deps): update action dependencies (#37540)
-  * Refactor pull request view (6) (#37522)
-  * Fix: redirect early CLI console logger to stderr (#37507)
-  * Refactor "flex-list" to "flex-divided-list" (#37505)
-  * Refactor compare diff/pull page (1) (#37481)
-  * Refactor pull request view (4) (#37451)
-  * Refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (#37441)
-  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
-  * Refactor: serve site manifest via `/assets/site-manifest.json` endpoint (#37405)
-  * Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
-  * Update `Block a user` form (#37359)
-  * Move review request functions to a standalone file (#37358)
-  * Enable strict TypeScript, add `errorMessage` helper (#37292)
-  * Refactor frontend `tw-justify-between` layouts to `flex-left-right` (#37291)
-  * Update Nix flake (#37284)
-  * Remove `SubmitEvent` polyfill (#37276)
-  * Remove dead code identified by `deadcode` tool (#37271)
-  * Upgrade go-git to v5.18.0 (#37268)
-  * Don't add useless labels which will bother changelog generation (#37267)
-  * Move heatmap to first-party code (#37262)
-  * Tests/integration: simplify code (#37249)
-  * Remove error returns from crypto random helpers and callers (#37240)
-  * Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
-  * Refactor "htmx" to "fetch action" (#37208)
-  * Update go js py dependencies (#37204)
-  * Add comment for the design of "user activity time" (#37195)
-  * Remove outdated RunUser logic (#37180)
-  * Models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150)
-  * Update javascript dependencies (#37142)
-  * Update go dependencies (#37141)
-  * Frontport changelog of v1.26.0-rc0 (#37138)
-  * Extend issue context popup beyond markdown content (#36908)
-
-## [1.26.4](https://github.com/go-gitea/gitea/releases/tag/1.26.4) - 2026-06-21
-
-* SECURITY
-  * fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)
-
-* BUGFIXES
-  * fix: walk git log context error handling (#38182) (#38185)
-
-## [1.26.3](https://github.com/go-gitea/gitea/releases/tag/1.26.3) - 2026-06-18
-
-* BREAKING
-  * fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)
-
-* SECURITY
-  * fix(hostmatcher): patch incorrect private list (#38170) (#38173)
-  * fix: Various security fixes (#38103) (#38151)
-  * fix: Various sec fixes (#38108) (#38147)
-  * fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
-  * fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
-  * fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
-  * fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
-  * fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
-  * fix: bound CODEOWNERS regex match time (#38011) (#38025)
-  * fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
-  * fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)
-
-* API
-  * feat(api): add Link header in ListForks (#38052) (#38063)
-
-* BUGFIXES
-  * fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
-  * fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
-  * fix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
-  * fix: parse HEAD ref (#38119)
-  * fix: git cmd (#38084) (#38087)
-  * fix(releases): generate notes for initial tag (#37697) (#37986)
-  * fix(actions): return 404 when job log blob is missing (#38003) (#38004)
-  * fix(actions): exclude `workflow_call` from workflow trigger detection (#37894) (#37899)
-  * fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
-  * fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
-  * fix(actions): ack re-sent `UpdateLog` finalize idempotently (#37885) (#37892)
-  * fix: http content file render (#37850) (#37856)
-  * fix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
-  * fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)
-
-* BUILD
-  * fix(deps): update `@playwright/test` to 1.60.0 (#38144)
-  * ci: add `tools/ci-tools.ts` for the PR labeler workflow (#37831)
-  * fix(build): swagger css import (#37801) (#37803)
-
 ## [1.26.2](https://github.com/go-gitea/gitea/releases/tag/1.26.2) - 2026-05-20

 * SECURITY
@@ -2,17 +2,12 @@

 This document explains how to contribute changes to the Gitea project. Topic-specific guides live in separate files so the essentials are easier to find.

-| Topic                  | Document                                                         |
-|:-----------------------|:-----------------------------------------------------------------|
-| Setup and requirements | [docs/build-setup.md](docs/build-setup.md)                       |
-| Development workflow   | [docs/development.md](docs/development.md)                       |
-| Build from source      | [docs/build-source.md](docs/build-source.md)                     |
-| Running the tests      | [docs/testing.md](docs/testing.md)                               |
-| Frontend guidelines    | [docs/guidelines-frontend.md](docs/guidelines-frontend.md)       |
-| Backend guidelines     | [docs/guidelines-backend.md](docs/guidelines-backend.md)         |
-| Refactoring            | [docs/guidelines-refactoring.md](docs/guidelines-refactoring.md) |
-| Community Governance   | [docs/community-governance.md](docs/community-governance.md)     |
-| Release management     | [docs/release-management.md](docs/release-management.md)         |
+| Topic | Document |
+| :---- | :------- |
+| Backend (Go modules, API v1) | [docs/guideline-backend.md](docs/guideline-backend.md) |
+| Frontend (npm, UI guidelines) | [docs/guideline-frontend.md](docs/guideline-frontend.md) |
+| Maintainers, TOC, labels, merge queue, commit format for mergers | [docs/community-governance.md](docs/community-governance.md) |
+| Release cycle, backports, tagging releases | [docs/release-management.md](docs/release-management.md) |

 <details><summary>Table of Contents</summary>

@@ -48,7 +43,7 @@ This document explains how to contribute changes to the Gitea project. Topic-spe
 It assumes you have followed the [installation instructions](https://docs.gitea.com/category/installation). \
 Sensitive security-related issues should be reported to [security@gitea.io](mailto:security@gitea.io).

-For configuring IDEs for Gitea development, see the [IDE setup notes](docs/development.md#ide-configuration) and the [contributed configurations](contrib/development/).
+For configuring IDEs for Gitea development, see the [contributed IDE configurations](contrib/ide/).

 ## AI Contribution Policy

@@ -111,8 +106,7 @@ If further discussion is needed, we encourage you to open a new issue instead an

 ## Building Gitea

-See [docs/build-setup.md](docs/build-setup.md) for prerequisites and [docs/development.md](docs/development.md)
-for building Gitea and the development workflow.
+See the [development setup instructions](https://docs.gitea.com/development/hacking-on-gitea).

 ## Styleguide

@@ -131,7 +125,33 @@ Afterwards, copyright should only be modified when the copyright author changes.

 ## Testing

-Before submitting a pull request, run the linters (`make lint`, or the scoped `make lint-backend` / `make lint-frontend`) and the tests to make sure your changes don't cause a regression elsewhere. See [docs/testing.md](docs/testing.md) for how to run the unit, integration, end-to-end, and migration tests.
+Before submitting a pull request, run all tests to make sure your changes don't cause a regression elsewhere.
+
+Here's how to run the test suite:
+
+- code lint
+
+|                       |                                                                              |
+| :-------------------- | :--------------------------------------------------------------------------- |
+|``make lint``          | lint everything (not needed if you only change the front- **or** backend)    |
+|``make lint-frontend`` | lint frontend files                                                          |
+|``make lint-backend``  | lint backend files                                                           |
+
+- run tests (we suggest running them on Linux)
+
+| Command                                       | Action                                               |                                             |
+|:----------------------------------------------|:-----------------------------------------------------| ------------------------------------------- |
+| ``make test-backend[\#SpecificTestName]``     | run unit test(s)                                     |                                             |
+| ``make test-integration[\#SpecificTestName]`` | run [integration](tests/integration) test(s)         | [More details](tests/integration/README.md) |
+| ``make test-e2e``                             | run [end-to-end](tests/e2e) test(s) using Playwright |                                             |
+
+- E2E test environment variables
+
+| Variable                          | Description                                                 |
+| :-------------------------------- | :---------------------------------------------------------- |
+| ``GITEA_TEST_E2E_DEBUG``          | When set, show Gitea server output                          |
+| ``GITEA_TEST_E2E_FLAGS``          | Additional flags passed to Playwright, for example ``--ui`` |
+| ``GITEA_TEST_E2E_TIMEOUT_FACTOR`` | Timeout multiplier (default: 4 on CI, 1 locally)            |

 ## Translation

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # Build frontend on the native platform to avoid QEMU-related issues with nodejs ecosystem
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.27-alpine3.24 AS frontend-build
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
 RUN apk --no-cache add build-base git nodejs pnpm
 WORKDIR /src
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
@@ -9,7 +9,7 @@ COPY --exclude=.git/ . .
 RUN make frontend

 # Build backend for each target platform
-FROM docker.io/library/golang:1.27-alpine3.24 AS build-env
+FROM docker.io/library/golang:1.26-alpine3.23 AS build-env

 ARG GITEA_VERSION
 ARG TAGS=""
@@ -44,7 +44,7 @@ RUN chmod 755 /tmp/local/usr/bin/entrypoint \
              /tmp/local/etc/s6/.s6-svscan/* \
              /go/src/gitea.dev/gitea

-FROM docker.io/library/alpine:3.24 AS gitea
+FROM docker.io/library/alpine:3.23 AS gitea

 EXPOSE 22 3000

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # Build frontend on the native platform to avoid QEMU-related issues with nodejs ecosystem
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.27-alpine3.24 AS frontend-build
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
 RUN apk --no-cache add build-base git nodejs pnpm
 WORKDIR /src
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
@@ -9,7 +9,7 @@ COPY --exclude=.git/ . .
 RUN make frontend

 # Build backend for each target platform
-FROM docker.io/library/golang:1.27-alpine3.24 AS build-env
+FROM docker.io/library/golang:1.26-alpine3.23 AS build-env

 ARG GITEA_VERSION
 ARG TAGS=""
@@ -39,7 +39,7 @@ COPY docker/rootless /tmp/local
 RUN chmod 755 /tmp/local/usr/local/bin/* \
              /go/src/gitea.dev/gitea

-FROM docker.io/library/alpine:3.24 AS gitea-rootless
+FROM docker.io/library/alpine:3.23 AS gitea-rootless

 EXPOSE 2222 3000

@@ -41,6 +41,7 @@ Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
+Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)
@@ -64,4 +65,3 @@ Christopher Homberger <christopher.homberger@web.de> (@ChristopherHX)
 Tobias Balle-Petersen <tobiasbp@gmail.com> (@tobiasbp)
 TheFox <thefox0x7@gmail.com> (@TheFox0x7)
 Nicolas <bircni@icloud.com> (@bircni)
-Minjie Fang <wingsallen@gmail.com> (@wingsallen)
@@ -1,24 +1,29 @@
 DIST := dist
 DIST_DIRS := $(DIST)/binaries $(DIST)/release

+# By default use go's 1.25 experimental json v2 library when building
+# TODO: remove when no longer experimental
+export GOEXPERIMENT ?= jsonv2
+
 GO ?= go
 SHASUM ?= shasum -a 256
+COMMA := ,

-AIR_PACKAGE ?= github.com/air-verse/air@v1.67.4 # renovate: datasource=go
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.11.2 # renovate: datasource=go
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 # renovate: datasource=go
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.16 # renovate: datasource=go
+XGO_VERSION := go-1.26.x
+
+AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
+GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.36.5 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.7.0 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.0 # renovate: datasource=go
+XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.3.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
 SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker

 CONTAINER_RUNTIME ?= $(shell hash docker >/dev/null 2>&1 && echo docker || echo podman)

-PLAYWRIGHT_BROWSERS ?= chromium firefox
-PLAYWRIGHT_FLAGS ?=
-
 HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
 ifeq ($(HAS_GO), yes)
 	CGO_EXTRA_CFLAGS := -DSQLITE_MAX_VARIABLE_NUMBER=32766
@@ -37,13 +42,18 @@ endif

 TAGS ?=
 TAGS_EVIDENCE := $(MAKE_EVIDENCE_DIR)/tags
-CGO_TAGS := sqlite_mattn pam

 CGO_ENABLED ?= 0
-ifneq ($(strip $(filter $(CGO_TAGS),$(TAGS))),)
+ifneq (,$(findstring sqlite_mattn,$(TAGS))$(findstring pam,$(TAGS)))
 	CGO_ENABLED = 1
 endif

+STATIC ?=
+EXTLDFLAGS ?=
+ifneq ($(STATIC),)
+	EXTLDFLAGS = -extldflags "-static"
+endif
+
 ifeq ($(GOOS),windows)
 	IS_WINDOWS := yes
 else ifeq ($(patsubst Windows%,Windows,$(OS)),Windows)
@@ -52,13 +62,14 @@ else ifeq ($(patsubst Windows%,Windows,$(OS)),Windows)
 	endif
 endif

+# GOFLAGS and EXTRA_GOFLAGS are for the 'go build' command only
 ifeq ($(IS_WINDOWS),yes)
+	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= gitea.exe
 else
+	GOFLAGS := -v
 	EXECUTABLE ?= gitea
 endif
-
-# EXTRA_GOFLAGS is for the 'go build' command only
 EXTRA_GOFLAGS ?=

 ifeq ($(shell sed --version 2>/dev/null | grep -q GNU && echo gnu),gnu)
@@ -75,20 +86,14 @@ STORED_VERSION_FILE := VERSION
 GITHUB_REF_TYPE ?= branch
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)

-# VERSION: the branch name for the build and filenames, e.g.: "feature/foo-bar", "main"
-#          branch name "release/v1.27.2" is stripped to "1.27.2".
-# GITEA_VERSION: the Gitea's internal version for display, e.g. "1.28.0+dev-356-ge47d0b66ea"
-ifeq ($(GITHUB_REF_TYPE),tag)
-	# convert tag "v1.2.3" to "1.2.3"
+ifneq ($(GITHUB_REF_TYPE),branch)
 	VERSION ?= $(subst v,,$(GITHUB_REF_NAME))
 	GITEA_VERSION ?= $(VERSION)
-else ifeq ($(GITHUB_REF_TYPE),branch)
+else
 	ifneq ($(GITHUB_REF_NAME),)
-		# convert branch "release/v1.2" to "1.2-nightly"
 		VERSION ?= $(subst release/v,,$(GITHUB_REF_NAME))-nightly
 	else
-		# no branch name info, use git ref name "HEAD" instead
-		VERSION ?= HEAD
+		VERSION ?= main
 	endif

 	STORED_VERSION=$(shell cat $(STORED_VERSION_FILE) 2>/dev/null)
@@ -97,20 +102,19 @@ else ifeq ($(GITHUB_REF_TYPE),branch)
 	else
 		GITEA_VERSION ?= $(shell git describe --tags --always | sed 's/-/+/' | sed 's/^v//')
 	endif
-else
-	$(error unsupported ref type $(GITHUB_REF_TYPE))
 endif

-# if version == "main" then add "-nightly" to the version for nightly builds: "main-nightly"
+# if version = "main" then update version to "nightly"
 ifeq ($(VERSION),main)
 	VERSION := main-nightly
 endif

 LDFLAGS := $(LDFLAGS) -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"
-RELEASE_ENV = GO="$(GO)" TAGS="$(TAGS)" LDFLAGS="$(LDFLAGS)" DIST="$(DIST)" VERSION="$(VERSION)"

-GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list gitea.dev/modelmigration/...) gitea.dev/tests/integration/migration-test gitea.dev/tests gitea.dev/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
-MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list gitea.dev/modelmigration/...)
+LINUX_ARCHS ?= linux/amd64,linux/386,linux/arm-5,linux/arm-6,linux/arm64,linux/riscv64
+
+GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list gitea.dev/models/migrations/...) gitea.dev/tests/integration/migration-test gitea.dev/tests gitea.dev/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
+MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list gitea.dev/models/migrations/...)

 FRONTEND_SOURCES := $(shell find web_src/js web_src/css -type f)
 FRONTEND_CONFIGS := vite.config.ts tailwind.config.ts
@@ -123,7 +127,6 @@ BINDATA_DEST_WILDCARD := modules/migration/bindata.* modules/public/bindata.* mo
 GENERATED_GO_DEST := modules/charset/invisible_gen.go modules/charset/ambiguous_gen.go

 SVG_DEST_DIR := public/assets/img/svg
-SVG_DEST_DIRS := $(SVG_DEST_DIR) options/fileicon

 AIR_TMP_DIR := .air

@@ -131,7 +134,7 @@ GO_LICENSE_FILE := assets/go-licenses.json

 TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR)

-GO_DIRS := build cmd modelmigration models modules routers services tests tools
+GO_DIRS := build cmd models modules routers services tests tools
 WEB_DIRS := web_src/js web_src/css

 ESLINT_FILES := web_src/js tools *.ts tests/e2e
@@ -144,12 +147,11 @@ GO_SOURCES += $(shell find $(GO_DIRS) -type f -name "*.go")
 GO_SOURCES += $(GENERATED_GO_DEST)

 ESLINT_CONCURRENCY ?= 2
-ESLINT_ARGS := --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY)

+SWAGGER_SPEC := templates/swagger/v1_json.tmpl
+SWAGGER_SPEC_INPUT := templates/swagger/v1_input.json
 SWAGGER_EXCLUDE := gitea.dev/sdk
-SWAGGER_SPEC_INPUT := templates/swagger/v1-input.json
-SWAGGER_SPEC := templates/swagger/v1-swagger.generated.json
-OPENAPI3_SPEC := templates/swagger/v1-openapi3.generated.json
+OPENAPI3_SPEC := templates/swagger/v1_openapi3_json.tmpl

 TEST_MYSQL_HOST ?= mysql:3306
 TEST_MYSQL_DBNAME ?= testgitea
@@ -208,7 +210,7 @@ fmt: ## format the Go and template code

 .PHONY: fmt-check
 fmt-check: fmt
-	@diff=$$(git diff --color=always $(GO_SOURCES) templates); \
+	@diff=$$(git diff --color=always $(GO_SOURCES) templates $(WEB_DIRS)); \
 	if [ -n "$$diff" ]; then \
 	  echo "Please run 'make fmt' and commit the result:"; \
 	  printf "%s" "$${diff}"; \
@@ -228,9 +230,7 @@ endif
 generate-swagger: $(SWAGGER_SPEC) $(OPENAPI3_SPEC) ## generate the swagger spec from code comments

 $(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
-	@output="$$($(GO) run $(SWAGGER_PACKAGE) generate spec --enable-allof-compounding --skip-enum-desc --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)' 2>&1)" || { printf '%s\n' "$$output" >&2; exit 1; }; \
-	warnings="$$(printf '%s\n' "$$output" | grep -v '^go: ')"; \
-	if [ -n "$$warnings" ]; then printf '%s\n' "$$warnings" >&2; exit 1; fi
+	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'

 .PHONY: swagger-check
 swagger-check: generate-swagger
@@ -243,10 +243,11 @@ swagger-check: generate-swagger

 .PHONY: swagger-validate
 swagger-validate: ## check if the swagger spec is valid
-	@# ensure no warnings
-	@output="$$($(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)' 2>&1)"; status=$$?; \
-	printf '%s\n' "$$output" | grep -v '^go: '; \
-	case "$$output" in *WARNING:*) exit 1;; esac; exit $$status
+	@# swagger "validate" requires that the "basePath" must start with a slash, but we are using Golang template "{{...}}"
+	@$(SED_INPLACE) -E -e 's|"basePath":( *)"(.*)"|"basePath":\1"/\2"|g' './$(SWAGGER_SPEC)' # add a prefix slash to basePath
+	@# FIXME: there are some warnings
+	$(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)'
+	@$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)' # remove the prefix slash from basePath

 .PHONY: generate-openapi3
 generate-openapi3: $(OPENAPI3_SPEC) ## generate the OpenAPI 3.0 spec from the Swagger 2.0 spec
@@ -292,12 +293,12 @@ lint-backend-fix: lint-go-fix lint-editorconfig ## lint backend files and fix is

 .PHONY: lint-js
 lint-js: node_modules ## lint js and ts files
-	pnpm exec eslint $(ESLINT_ARGS) $(ESLINT_FILES)
+	pnpm exec eslint --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) $(ESLINT_FILES)
 	pnpm exec vue-tsc

 .PHONY: lint-js-fix
 lint-js-fix: node_modules ## lint js and ts files and fix issues
-	pnpm exec eslint $(ESLINT_ARGS) $(ESLINT_FILES) --fix
+	pnpm exec eslint --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) $(ESLINT_FILES) --fix
 	pnpm exec vue-tsc

 .PHONY: lint-css
@@ -310,7 +311,7 @@ lint-css-fix: node_modules ## lint css files and fix issues

 .PHONY: lint-swagger
 lint-swagger: node_modules ## lint swagger files
-	pnpm exec spectral lint -q -F hint $(SWAGGER_SPEC) $(OPENAPI3_SPEC)
+	pnpm exec spectral lint -q -F hint $(SWAGGER_SPEC)

 .PHONY: lint-md
 lint-md: node_modules ## lint markdown files
@@ -344,7 +345,7 @@ lint-editorconfig:
 .PHONY: lint-actions
 lint-actions: .venv ## lint action workflow files
 	@$(GO) run $(ACTIONLINT_PACKAGE)
-	@uv run --frozen zizmor --quiet --persona=pedantic --min-confidence=medium .github
+	@uv run --frozen zizmor --quiet --min-confidence=medium .github

 .PHONY: lint-shell
 lint-shell: ## lint shell scripts
@@ -361,11 +362,11 @@ lint-yaml: .venv ## lint yaml files

 .PHONY: lint-json
 lint-json: node_modules ## lint json files
-	pnpm exec eslint -c eslint.json.config.ts $(ESLINT_ARGS)
+	pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY)

 .PHONY: lint-json-fix
 lint-json-fix: node_modules ## lint and fix json files
-	pnpm exec eslint -c eslint.json.config.ts $(ESLINT_ARGS) --fix
+	pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) --fix

 .PHONY: watch
 watch: ## watch everything and continuously rebuild
@@ -385,7 +386,7 @@ test-backend: ## test backend files
 	@$(GO) test $(GOTEST_FLAGS) -tags='$(TAGS)' $(GO_TEST_PACKAGES)

 .PHONY: test-frontend
-test-frontend: playwright ## test frontend files
+test-frontend: node_modules ## test frontend files
 	pnpm exec vitest

 .PHONY: test-check
@@ -419,12 +420,7 @@ unit-test-coverage:
 .PHONY: tidy
 tidy: ## run go mod tidy
 	$(eval MIN_GO_VERSION := $(shell grep -Eo '^go\s+[0-9]+\.[0-9.]+' go.mod | cut -d' ' -f2))
-	$(eval GO_TOOLCHAIN := $(shell grep -Eo '^toolchain\s+go[0-9.]+' go.mod | cut -d' ' -f2))
 	$(GO) mod tidy -compat=$(MIN_GO_VERSION)
-	@# workaround https://github.com/golang/go/issues/75331: restore toolchain if tidy dropped it
-	@if [ -n "$(GO_TOOLCHAIN)" ] && ! grep -qE '^toolchain\s' go.mod; then \
-		$(GO) mod edit -toolchain=$(GO_TOOLCHAIN); \
-	fi
 	@$(MAKE) --no-print-directory $(GO_LICENSE_FILE)

 vendor: go.mod go.sum
@@ -447,7 +443,7 @@ $(GO_LICENSE_FILE): go.mod go.sum
 	GO=$(GO) $(GO) run build/generate-go-licenses.go $(GO_LICENSE_FILE)

 .PHONY: test-integration
-test-integration: $(EXECUTABLE)
+test-integration:
 	@# Use a compiled binary: testlogger forwards gitea logs to t.Log, so `go test -v`
 	@# would flood output per passing test. testcache can't help these tests anyway —
 	@# they mutate the work directory, so cache inputs change between runs.
@@ -459,7 +455,7 @@ test-integration-compile:
 	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -c -o /dev/null gitea.dev/tests/integration

 .PHONY: test-integration\#%
-test-integration\#%: $(EXECUTABLE)
+test-integration\#%:
 	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -run $(subst .,/,$*) gitea.dev/tests/integration

 .PHONY: test-migration
@@ -476,15 +472,15 @@ migrations.individual.test:

 .PHONY: migrations.individual.test\#%
 migrations.individual.test\#%:
-	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/modelmigration/$*
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/models/migrations/$*

 .PHONY: playwright
 playwright: deps-frontend
-	@./tools/playwright.sh $(PLAYWRIGHT_FLAGS) $(PLAYWRIGHT_BROWSERS)
+	@CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) ./tools/test-e2e.sh install

 .PHONY: test-e2e
 test-e2e: playwright frontend backend
-	@CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) EXECUTABLE=$(EXECUTABLE) ./tools/test-e2e.sh $(GITEA_TEST_E2E_FLAGS)
+	@CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) EXECUTABLE=$(EXECUTABLE) ./tools/test-e2e.sh run $(GITEA_TEST_E2E_FLAGS)

 .PHONY: build
 build: frontend backend ## build everything
@@ -509,38 +505,38 @@ generate-go: $(TAGS_PREREQ)

 .PHONY: security-check
 security-check:
-	go run $(GOVULNCHECK_PACKAGE) -show color ./... || true
+	GOEXPERIMENT= go run $(GOVULNCHECK_PACKAGE) -show color ./... || true

 $(EXECUTABLE): $(GO_SOURCES) $(TAGS_PREREQ)
-	CGO_ENABLED="$(CGO_ENABLED)" CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build -v $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(LDFLAGS)' -o $@
+ifneq ($(and $(STATIC),$(findstring pam,$(TAGS))),)
+  $(error pam support set via TAGS does not support static builds)
+endif
+	CGO_ENABLED="$(CGO_ENABLED)" CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@
+
+.PHONY: release
+release: frontend generate release-windows release-linux release-darwin release-freebsd release-copy release-compress vendor release-sources release-check

 $(DIST_DIRS):
 	mkdir -p $(DIST_DIRS)

-# Release builds always use Go's native cross compilation. To cross-compile with CGO,
-# use "build" target with proper TAGS/LDFLAGS/CGO_CFLAGS to make "$(EXECUTABLE)" target run the "go build" command.
-.PHONY: release
-release: frontend release-binaries release-copy release-compress vendor release-sources release-check
-
-.PHONY: release-binaries
-release-binaries: | $(DIST_DIRS)
-	@$(RELEASE_ENV) ./tools/build-release.sh
-
 .PHONY: release-windows
 release-windows: | $(DIST_DIRS)
-	@$(RELEASE_ENV) ./tools/build-release.sh windows
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -buildmode exe -dest $(DIST)/binaries -tags 'osusergo $(TAGS)' -ldflags '-s -w -linkmode external -extldflags "-static" $(LDFLAGS)' -targets 'windows/*' -out gitea-$(VERSION) .
+ifeq (,$(findstring gogit,$(TAGS)))
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -buildmode exe -dest $(DIST)/binaries -tags 'osusergo gogit $(TAGS)' -ldflags '-s -w -linkmode external -extldflags "-static" $(LDFLAGS)' -targets 'windows/*' -out gitea-$(VERSION)-gogit .
+endif

 .PHONY: release-linux
 release-linux: | $(DIST_DIRS)
-	@$(RELEASE_ENV) ./tools/build-release.sh linux
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w -linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(LINUX_ARCHS)' -out gitea-$(VERSION) .

 .PHONY: release-darwin
 release-darwin: | $(DIST_DIRS)
-	@$(RELEASE_ENV) ./tools/build-release.sh darwin
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w $(LDFLAGS)' -targets 'darwin-10.12/amd64,darwin-10.12/arm64' -out gitea-$(VERSION) .

 .PHONY: release-freebsd
 release-freebsd: | $(DIST_DIRS)
-	@$(RELEASE_ENV) ./tools/build-release.sh freebsd
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w $(LDFLAGS)' -targets 'freebsd/amd64' -out gitea-$(VERSION) .

 .PHONY: release-copy
 release-copy: | $(DIST_DIRS)
@@ -560,7 +556,7 @@ release-sources: | $(DIST_DIRS)
 # bsdtar needs a ^ to prevent matching subdirectories
 	$(eval EXCL := --exclude=$(shell tar --help | grep -q bsdtar && echo "^")./)
 # use transform to a add a release-folder prefix; in bsdtar the transform parameter equivalent is -s
-	$(eval TRANSFORM := $(shell tar --help | grep -q bsdtar && echo "-s '|^./|gitea-src-$(VERSION)/|'" || echo "--transform 's|^./|gitea-src-$(VERSION)/|'"))
+	$(eval TRANSFORM := $(shell tar --help | grep -q bsdtar && echo "-s '/^./gitea-src-$(VERSION)/'" || echo "--transform 's|^./|gitea-src-$(VERSION)/|'"))
 	tar $(addprefix $(EXCL),$(TAR_EXCLUDES)) $(TRANSFORM) -czf $(DIST)/release/gitea-src-$(VERSION).tar.gz .
 	rm -f $(STORED_VERSION_FILE)

@@ -585,6 +581,7 @@ deps-tools: ## install tool dependencies
 	$(GO) install $(GXZ_PACKAGE) & \
 	$(GO) install $(MISSPELL_PACKAGE) & \
 	$(GO) install $(SWAGGER_PACKAGE) & \
+	$(GO) install $(XGO_PACKAGE) & \
 	$(GO) install $(GOVULNCHECK_PACKAGE) & \
 	$(GO) install $(ACTIONLINT_PACKAGE) & \
 	wait
@@ -597,6 +594,28 @@ node_modules: pnpm-lock.yaml
 	uv sync
 	@touch .venv

+.PHONY: update
+update: update-go update-js update-py ## update dependencies
+
+.PHONY: update-go
+update-go: ## update go dependencies
+	$(GO) get -u ./...
+	$(MAKE) tidy
+
+.PHONY: update-js
+update-js: node_modules ## update js dependencies
+	pnpm exec updates -u -f package.json
+	rm -rf node_modules pnpm-lock.yaml
+	pnpm install
+	@touch node_modules
+
+.PHONY: update-py
+update-py: node_modules ## update py dependencies
+	pnpm exec updates -u -f pyproject.toml
+	rm -rf .venv uv.lock
+	uv sync
+	@touch .venv
+
 .PHONY: vite
 vite: $(FRONTEND_DEST) ## build vite files

@@ -614,10 +633,10 @@ svg: node_modules ## build svg files

 .PHONY: svg-check
 svg-check: svg
-	@git add $(SVG_DEST_DIRS)
-	@diff=$$(git diff --color=always --cached $(SVG_DEST_DIRS)); \
+	@git add $(SVG_DEST_DIR)
+	@diff=$$(git diff --color=always --cached $(SVG_DEST_DIR)); \
 	if [ -n "$$diff" ]; then \
-		echo "Please run 'make svg' and 'git add $(SVG_DEST_DIRS)' and commit the result:"; \
+		echo "Please run 'make svg' and 'git add $(SVG_DEST_DIR)' and commit the result:"; \
 		printf "%s" "$${diff}"; \
 		exit 1; \
 	fi
@@ -2,6 +2,7 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
 [![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
@@ -13,21 +14,21 @@

 ## Purpose

-The goal of Gitea is to make the easiest, fastest, and most painless way of
-setting up a self-hosted all-in-one software development service,
-including Git hosting, code management, code review, issue tracking, project kanban, wiki,
-team collaboration, package registry and CI/CD which can reuse GitHub Actions.
+The goal of this project is to make the easiest, fastest, and most
+painless way of setting up a self-hosted Git service.

 As Gitea is written in Go, it works across **all** the platforms and
-architectures that are supported by Go, including Linux, macOS, FreeBSD/OpenBSD and Windows
-on x86, amd64, ARM, RISC-V 64 and PowerPC architectures.
+architectures that are supported by Go, including Linux, macOS, and
+Windows on x86, amd64, ARM and PowerPC architectures.
+This project has been
+[forked](https://blog.gitea.com/welcome-to-gitea/) from
+[Gogs](https://gogs.io) since November of 2016, but a lot has changed.

 For online demonstrations, you can visit [demo.gitea.com](https://demo.gitea.com).

 For accessing free Gitea service (with a limited number of repositories), you can visit [gitea.com](https://gitea.com/user/login).

-To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at [cloud.gitea.com](https://cloud.gitea.com),
-or use container (docker/podman/etc) to deploy on your own server with the [official image](https://hub.docker.com/r/gitea/gitea).
+To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at [cloud.gitea.com](https://cloud.gitea.com).

 ## Documentation

@@ -39,12 +40,27 @@ If you have any suggestions or would like to contribute to it, you can visit the

 ## Building

-See [docs/build-setup.md](docs/build-setup.md) for prerequisites
-and [docs/development.md](docs/development.md) for setting up a local development environment, linting, and testing.
+From the root of the source tree, run:

-If you'd like to build from source or make a distribution package, see [docs/build-source.md](docs/build-source.md) for more information.
+    TAGS="bindata" make build

-After building, you can run `./gitea web` to start the server, or `./gitea help` to see all available commands.
+The `build` target is split into two sub-targets:
+
+- `make backend` which requires [Go Stable](https://go.dev/dl/), the required version is defined in [go.mod](/go.mod).
+- `make frontend` which requires [Node.js LTS](https://nodejs.org/en/download/) or greater and [pnpm](https://pnpm.io/installation).
+
+Internet connectivity is required to download the go and npm modules. When building from the official source tarballs which include pre-built frontend files, the `frontend` target will not be triggered, making it possible to build without Node.js.
+
+More info: https://docs.gitea.com/installation/install-from-source
+
+## Using
+
+After building, a binary file named `gitea` will be generated in the root of the source tree by default. To run it, use:
+
+    ./gitea web
+
+> [!NOTE]
+> If you're interested in using our APIs, we have experimental support with [documentation](https://docs.gitea.com/api).

 ## Contributing

@@ -53,8 +69,7 @@ Expected workflow is: Fork -> Patch -> Push -> Pull Request
 > [!NOTE]
 >
 > 1. **YOU MUST READ THE [CONTRIBUTORS GUIDE](CONTRIBUTING.md) BEFORE STARTING TO WORK ON A PULL REQUEST.**
-> 2. New to the codebase? The [development guide](docs/development.md) walks through setting up a local environment and building from source.
-> 3. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!
+> 2. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!

 ## Translating

@@ -62,13 +77,13 @@ Expected workflow is: Fork -> Patch -> Push -> Pull Request

 Translations are done through [Crowdin](https://translate.gitea.com). If you want to translate to a new language, ask one of the managers in the Crowdin project to add a new language there.

-You can also just create an issue for adding a language or ask on Discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord.
+You can also just create an issue for adding a language or ask on Discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty, but we hope to fill it as questions pop up.

-Get more information from [the translation section of our contributing guide](CONTRIBUTING.md#translation).
+Get more information from [documentation](https://docs.gitea.com/contributing/localization).

 ## Official and Third-Party Projects

-We provide an official [go-sdk](https://gitea.com/gitea/go-sdk), a CLI tool called [tea](https://gitea.com/gitea/tea) and an [action runner](https://gitea.com/gitea/runner) for Gitea Action.
+We provide an official [go-sdk](https://gitea.com/gitea/go-sdk), a CLI tool called [tea](https://gitea.com/gitea/tea) and an [action runner](https://gitea.com/gitea/act_runner) for Gitea Action.

 We maintain a list of Gitea-related projects at [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea), where you can discover more third-party projects, including SDKs, plugins, themes, and more.

@@ -111,19 +126,14 @@ Support this project by becoming a sponsor. Your logo will show up here with a l

 Gitea is pronounced [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY) as in "gi-tea" with a hard g.

-**How do I configure Gitea?**
+**Why is this not hosted on a Gitea instance?**

-For dynamic config options, you can change it on your admin panel's configuration section.
-
-For static config options, you can edit your `app.ini` file and restart the instance.
-See [app.example.ini](https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini) or [configuration documentation](https://docs.gitea.com/administration/config-cheat-sheet) for more details.
+We're [working on it](https://github.com/go-gitea/gitea/issues/1029).

 **Where can I find the security patches?**

 In the [release log](https://github.com/go-gitea/gitea/releases) or the [change log](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md), search for the keyword `SECURITY` to find the security patches.

-(more FAQs are listed in [FAQ documentation](https://docs.gitea.com/help/faq))
-
 ## License

 This project is licensed under the MIT License.
@@ -133,7 +143,7 @@ for the full license text.
 ## Further information

 <details>
-<summary>Looking for an overview of the interface? Check it out the screenshots!</summary>
+<summary>Looking for an overview of the interface? Check it out!</summary>

 ### Login/Register Page

@@ -2,6 +2,7 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
 [![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
@@ -72,11 +73,11 @@

 您也可以创建一个 issue 来添加语言，或者在 discord 的 #translation 频道上询问。如果您需要上下文或发现一些翻译问题，可以在字符串上留言或在 Discord 上询问。对于一般的翻译问题，文档中有一个部分。目前有点空，但我们希望随着问题的出现而填充它。

-更多信息请参阅 [文件](https://docs.gitea.com/zh-cn/contributing/localization)。
+更多信息请参阅 [文件](https://docs.gitea.com/contributing/localization)。

 ## 官方和第三方项目

-我们提供了一个官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一个名为 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一个 Gitea Action 的 [action runner](https://gitea.com/gitea/runner)。
+我们提供了一个官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一个名为 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一个 Gitea Action 的 [action runner](https://gitea.com/gitea/act_runner)。

 我们在 [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea) 维护了一个 Gitea 相关项目的列表，您可以在那里发现更多的第三方项目，包括 SDK、插件、主题等。

@@ -2,6 +2,7 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
 [![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
@@ -72,11 +73,11 @@

 您也可以創建一個 issue 來添加語言，或者在 discord 的 #translation 頻道上詢問。如果您需要上下文或發現一些翻譯問題，可以在字符串上留言或在 Discord 上詢問。對於一般的翻譯問題，文檔中有一個部分。目前有點空，但我們希望隨著問題的出現而填充它。

-更多信息請參閱 [文件](https://docs.gitea.com/zh-tw/contributing/localization)。
+更多信息請參閱 [文件](https://docs.gitea.com/contributing/localization)。

 ## 官方和第三方項目

-我們提供了一個官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一個名為 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一個 Gitea Action 的 [action runner](https://gitea.com/gitea/runner)。
+我們提供了一個官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一個名為 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一個 Gitea Action 的 [action runner](https://gitea.com/gitea/act_runner)。

 我們在 [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea) 維護了一個 Gitea 相關項目的列表，您可以在那裡發現更多的第三方項目，包括 SDK、插件、主題等。

@@ -6,30 +6,20 @@ If you discover a security issue, please bring it to their attention right away!

 Previous vulnerabilities are listed at https://about.gitea.com/security.

-## Supported Versions
-
-Security fixes follow our [support policy](docs/release-management.md#end-of-life-eol): only the most recent major release and the `main` branch receive them.
-
-Reports must be filed against a supported version. Before reporting, verify that the issue reproduces on a supported version; any report that only affects an unsupported version will be closed as out of scope.
-
 ## Reporting a Vulnerability

-Please **DO NOT** file a public issue. Instead, report the vulnerability privately by opening a [GitHub security advisory](https://github.com/go-gitea/gitea/security/advisories/new), or optionally by sending your report to `security@gitea.io`.
-If reporting via GitHub, open an advisory per found issue. You can group the found issues if they relate to a single area (same feature, same fault present in multiple routes) but do not group unrelated reports into one as it makes it much harder to assess and track for duplicates.
-Do not use LLM to write the reports. It's meant for people to read so take your time and use your own words to write it. If you have used LLM to find the bug, be transparent about it and verify that it is not hallucination before submitting the report.
-
-If your report turns out to be a duplicate, you will be credited in the original report.
+Please **DO NOT** file a public issue, instead send your report privately to `security@gitea.io`.

 ## Protecting Security Information

 Due to the sensitive nature of security information, you can use the below GPG public key to encrypt your mail body.

-The PGP key is valid until July 23, 2027.
+The PGP key is valid until July 4, 2026.

 ```
 Key ID: 6FCD2D5B
 Key Type: RSA
-Expires: 7/23/2027
+Expires: 7/4/2026
 Key Size: 4096/4096
 Fingerprint: 3DE0 3D1E 144A 7F06 9359 99DC AAFD 2381 6FCD 2D5B
 ```
@@ -52,18 +42,18 @@ lzpAjnN9/KLtQroutrm+Ft0mdjDiJUeFVl1cOHDhoyfCsQh62HumoyZoZvqzQd6e
 AbN11nq6aViMe2Q3je1AbiBnRnQSHxt1Tc8X4IshO3MQK1Sk7oPI6LA5oQARAQAB
 tCJHaXRlYSBTZWN1cml0eSA8c2VjdXJpdHlAZ2l0ZWEuaW8+iQJXBBMBCABBAhsD
 BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAFiEEPeA9HhRKfwaTWZncqv0jgW/N
-LVsFAmpi3IkFCQmOqAsACgkQqv0jgW/NLVsgyxAAuTyj4+PImOFr7ZkEJcseWUy+
-gWQrJDagj+Ks2SKGneVroJ63q5Vngx44b7JNabauKel4IJJCScLdwA7k0DKFHPOM
-rUS6aavW5+961CMQxJ13vWz7qxLxhI4FXle255xFSXgOo9T1W7+wtm/wtze8+sws
-8XKAVBZGuVI1/KzVpE6bWxpIIYK79DC07NWGDAZzMbuO92TFHBRblXsicPWExBjC
-/oFmT70YMcA0wOwU/YKYMg2eK2XYUr5+uYX6FnP7iUhDj1vZmwkF33Cj9v9D3Hv9
-NzAquj97uLht4wL2sqsIgZd4Vc37uipPDFaddzTb/lon7lPbJPMLObcd4HjSTkIo
-nEMM0wdOQZU7mIIgRM9o3mr/gyVigl3uARmUKaP9PhBaOGTjkni0nrv90hSHBHeu
-ayM76vl2tzAB2KpDxHIHbI2SEdytV28l/rxWrsbk2kG7s7QB6VKiThTatYevh1kg
-6Ujgl2xNSntG6t6PWjQ65OMSq5Iiwe7RfOZkNmPRGP/rbzMbgWXB3iCR2gVQvsxA
-ctYdDZdUYAeQ5g6xSKJBloygDQdLzk9m0hqNUyl6gxhRNRw69hqp9E4mxFF3L1Gi
-Z2LspLX1ZZWMh0bp0AniWzZuzLuNI0KYhlok6fnshjidJ1qYM/lbz5eJTYWxoJZW
-rczn8gB3+MZbULc/iiO5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
+LVsFAmhoHmkFCQeT6esACgkQqv0jgW/NLVuFLRAAmjBQSKRAgs2bFIEj7HLAbDp4
+f+XkdH+GsT3jRPOZ9QZgmtM+TfoE4yNgIVfOl+s4RdjM/W4QzqZuPQ55hbEHd056
+cJmm7B+6GsHFcdrPmh65sOCEIyh4+t45dUfeWpFsDPqm9j1UHXAJQIpB8vDEVAPH
+t+3wLCk8GMPJs1o5tIyMmaO23ngvkwn8eG7KgY+rp2PzObrb5g7ppci0ILzILkrp
+HVjZsEfUWRgSVF7LuU5ppqDKrlcqwUpQq6n3kGMZcLrCp6ACKP04TBmTfUxNwdL7
+I0N7apI2Pbct9T1Gv/lYAUFWyU2c3gh/EBLbO6BukaLOFRQHrtNfdJV/YnMPlcXr
+LUJjK9K4eAH9DsrZqrisz/LthsC2BaNIN3KRMTk5YTYgmIh8GXzSgihORmtDFELC
+RroID3pTuS0zjXh+wpY9GuPTh7UW23p42Daxca4fAT4k5EclvDRUrL21xMopPMiL
+HuNdELz4FVchRTy05PjzKVyjVInDNojE2KUxnjxZDzYJ6aT/g+coD5yfntYm8BEj
+ZzL0ndZES54hzKLpv7zwBQwFzam68clZYmDPILOPTflQDfpGEWmJK4undFU5obz
+ZsQRz0R3ulspChATbZxO0d5LX2obLpKO9X3b5VoO1KF+R8Vjw1Y0KxrNZ6rIcfqH
+Z50QVQKSe9dm08K0ON+5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
 T+p07yCSSoSlmnJHCQmwh4vfg1blyz0zZ4vkIhtpHsEgc+ZAG+WQXSsJ2iRz+eSN
 GwoOQl4XC3n+QWkc1ws+btr48+6UqXIQU+F8TPQyx/PIgi2nZXJB7f5+mjCqsk46
 XvH4nTr4kJjuqMSR/++wvre2qNQRa/q/dTsK0OaN/mJsdX6Oi+aGNaQJUhIG7F+E
@@ -75,20 +65,21 @@ s+GsP9I3cmWWQcKYxWHtE8xTXnNCVPFZQj2nwhJzae8ypfOtulBRA3dUKWGKuDH/
 axFENhUsT397aOU3qkP/od4a64JyNIEo4CTTSPVeWd7njsGqli2U3A4xL2CcyYvt
 D/MWcMBGEoLSNTswwKdom4FaJpn5KThnK/T0bQcmJblJhoCtppXisbexZnCpuS0x
 Zdlm2T14KJ3LABEBAAGJAjwEGAEIACYCGwwWIQQ94D0eFEp/BpNZmdyq/SOBb80t
-WwUCamLcngUJCY6oIAAKCRCq/SOBb80tWxilD/41xF1pwD2lGqjWLmlXcd0Ok5xm
-67TSGiKiFZUgI3ftkRVlqmeJqjVmRjpc2dLfCuVBzlaP0Oyv5Jn+2CPqgmWIk5tw
-pqlxqmsXiIZ9Uv2wWItxrXIwQ6DHc1qcIOu7feTnt1HVhxp2GqlXl3tA/+MTTDmn
-4rqrHffI7ps9eCbK/SfSuoQk3+x/x4GPqWDbsNw1E9dDjPPhsKfdwzZ6dFR2Yhzu
-2U0GDc2aeBA0Gjy6VFBj1ksmGxQCL3TqtGEHOonoPpTIjmDd35Xq6BSu119onOQS
-THZ7+3JQRpizBVrIklKf33UOikZy9WHuffFddP46m8qC2Alh1aB7xcD8K3P9gzd5
-OJO9Zr8JR+rvi8eOsCHvJqGhe0JMMf9bgXKjQ1tMTDTe6r0Jnw7HbkDghjpj9xG7
-GYmDB0CL4kP5nAZ1OPfIasIu3Llhcy6mS52ECw0X6PNwUINwBn7F6EKAiciw8/OS
-CXoGJDI5alwNhh+3DL4oBH1aq1lnmxmhFNpwpRDvtbRGmZeeASTeC4LMAtqP85Er
-8W9ulIgQ4Ub8QuoxvE5hzWEB1QUkJgozI8vO4DoGlrsz7P8cPzrOT7WqUfUPTYE6
-oZEfEYDSj1IZHnPYPS+yLBJMJ/Lc1h8OCetmbJZx4QWaX3Fgar7Zks8FfJQOTN6i
-HnOlrsaMDYNyO76uBQ==
-=4kVJ
+WwUCaGgeJAUJB5PppgAKCRCq/SOBb80tW/NWEACB6Jrf0gWlk7e+hNCdnbM0ZVWU
+f2sHNFfXxxsdhpcDgKbNHtkZb8nZgv8AX+5fTtUwMVa3vKcdw30xFiIM5N7cCIPV
+vg/5z5BtfEaitnabEUG2iiVDIy8IHXIcK10rX+7BosA3QDl2PsiBHwyi5G13lRk8
+zGTSNDuOalug33h5/lr2dPigamkq74Aoy29q8Rjad6GfWHipL2bFimgtY+Zdi0BH
+NLk4EJXxj1SgVx5dtkQzWJReBA5M+FQ4QYQZBO+f4TDoOLmjui152uhkoLBQbGAa
+WWJFTVxm0bG5MXloEL3gA8DfU7XDwuW/sHJC5pBko8RpQViooOhckMepZV3Y83DK
+bwLYa3JmPgj2rEv4993dvrJbQhpGd082HOxOsllCs8pgNq1SnXpWYfcGTgGKC3ts
+U8YZUUJUQ7mi2L8Tv3ix20c9EiGmA30JAmA8eZTC3cWup91ZkkVBFRml2czTXajd
+RWZ6GbHV5503ueDQcB8yBVgF3CSixs67+dGSbD3p86OqGrjAcJzM5TFbNKcnGLdE
+kGbZpNwAISy750lXzXKmyrh5RTCeTOQerbwCMBvHZO+HAevA/LXDTw2OAiSIQlP5
+sYA4sFYLQ30OAkgJcmdp/pSgVj/erNtSN07ClrOpDb/uFpQymO6K2h0Pst3feNVK
+9M2VbqL9C51z/wyHLg==
+=SfZA
 -----END PGP PUBLIC KEY BLOCK-----
+
 ```

 Security reports are greatly appreciated and we will publicly thank you for it, although we keep your name confidential if you request it.
@@ -436,7 +436,6 @@
      "jsonl",
      "mcmeta",
      "sarif",
-      "slnlaunch",
      "tact",
      "tfstate",
      "topojson",
@@ -453,8 +452,6 @@
      ".htmlhintrc",
      ".imgbotconfig",
      ".nycrc",
-      ".releaserc",
-      ".secrets.baseline",
      ".tern-config",
      ".tern-project",
      ".watchmanconfig",
@@ -694,17 +691,10 @@
    "extensions": [
      "ini",
      "cnf",
-      "container",
      "dof",
      "lektorproject",
-      "mount",
-      "network",
      "prefs",
      "properties",
-      "service",
-      "socket",
-      "target",
-      "timer",
      "url",
      "conf"
    ],
@@ -712,7 +702,6 @@
      ".buckconfig",
      ".coveragerc",
      ".flake8",
-      ".gitreview",
      ".pylintrc",
      "HOSTS",
      "buildozer.spec",
@@ -787,12 +776,9 @@
    "extensions": [
      "r",
      "rd",
-      "rhistory",
      "rsx"
    ],
    "filenames": [
-      ".Rapp.history",
-      ".Rhistory",
      ".Rprofile",
      "expr-dist"
    ]
@@ -912,7 +898,6 @@
      "bats",
      "command",
      "ksh",
-      "pacscript",
      "sbatch",
      "slurm",
      "tmux",
@@ -1176,7 +1161,6 @@
      "kml",
      "launch",
      "mdpolicy",
-      "meta4",
      "mjml",
      "mod",
      "mojo",
@@ -1197,7 +1181,6 @@
      "pt",
      "pubxml",
      "qhelp",
-      "rbxmx",
      "rdf",
      "res",
      "resx",
@@ -1284,9 +1267,7 @@
      ".clang-format",
      ".clang-tidy",
      ".clangd",
-      ".eslintrc",
      ".gemrc",
-      ".releaserc",
      "CITATION.cff",
      "glide.lock",
      "pixi.lock",
@@ -10,7 +10,7 @@
 // cleaner SDK output with proper enum types instead of anonymous strings.
 //
 // Run: go run build/generate-openapi.go
-// Output: templates/swagger/v1-openapi3.generated.json
+// Output: templates/swagger/v1_openapi3_json.tmpl

 //go:build ignore

@@ -21,21 +21,35 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"regexp"
 	"sort"
 	"strings"

 	"gitea.dev/build/openapi3gen"
+
+	"github.com/getkin/kin-openapi/openapi3"
 )

 const (
-	swaggerSpecPath = "templates/swagger/v1-swagger.generated.json"
-	openapi3OutPath = "templates/swagger/v1-openapi3.generated.json"
+	swaggerSpecPath = "templates/swagger/v1_json.tmpl"
+	openapi3OutPath = "templates/swagger/v1_openapi3_json.tmpl"
+
+	appSubUrlVar = "{{.SwaggerAppSubUrl}}"
+	appVerVar    = "{{.SwaggerAppVer}}"
+
+	appSubUrlPlaceholder = "GITEA_APP_SUB_URL_PLACEHOLDER"
+	appVerPlaceholder    = "0.0.0-gitea-placeholder"
 )

-var enumScanDirs = []string{
-	"modules/structs",
-	"modules/commitstatus",
-}
+var (
+	appSubUrlRe = regexp.MustCompile(regexp.QuoteMeta(appSubUrlVar))
+	appVerRe    = regexp.MustCompile(regexp.QuoteMeta(appVerVar))
+
+	enumScanDirs = []string{
+		"modules/structs",
+		"modules/commitstatus",
+	}
+)

 func main() {
 	astEnumMap, err := openapi3gen.ScanSwaggerEnumTypes(enumScanDirs)
@@ -43,8 +57,8 @@ func main() {
 		log.Fatalf("scanning swagger:enum annotations: %v", err)
 	}
 	names := make([]string, 0, len(astEnumMap))
-	for _, ns := range astEnumMap {
-		names = append(names, ns...)
+	for _, n := range astEnumMap {
+		names = append(names, n)
 	}
 	sort.Strings(names)
 	fmt.Fprintf(os.Stderr, "discovered %d swagger:enum types: %s\n", len(names), strings.Join(names, ", "))
@@ -54,17 +68,28 @@ func main() {
 		log.Fatalf("reading swagger spec: %v", err)
 	}

-	oas3, err := openapi3gen.Convert(data, astEnumMap)
+	cleaned := appSubUrlRe.ReplaceAll(data, []byte(appSubUrlPlaceholder))
+	cleaned = appVerRe.ReplaceAll(cleaned, []byte(appVerPlaceholder))
+
+	oas3, err := openapi3gen.Convert(cleaned, astEnumMap)
 	if err != nil {
 		log.Fatalf("converting to openapi 3.0: %v", err)
 	}

+	oas3.Servers = openapi3.Servers{
+		{URL: appSubUrlPlaceholder + "/api/v1"},
+	}
+
 	out, err := json.MarshalIndent(oas3, "", "  ")
 	if err != nil {
 		log.Fatalf("marshaling openapi 3.0: %v", err)
 	}

-	if err := os.WriteFile(openapi3OutPath, out, 0o644); err != nil {
+	result := strings.ReplaceAll(string(out), appSubUrlPlaceholder, appSubUrlVar)
+	result = strings.ReplaceAll(result, appVerPlaceholder, appVerVar)
+	result = strings.TrimSpace(result)
+
+	if err := os.WriteFile(openapi3OutPath, []byte(result), 0o644); err != nil {
 		log.Fatalf("writing openapi 3.0 spec: %v", err)
 	}

@@ -6,7 +6,6 @@ package openapi3gen
 import (
 	"fmt"
 	"regexp"
-	"sort"
 	"strings"

 	"gitea.dev/modules/json"
@@ -23,15 +22,13 @@ import (
 var rxDeprecated = regexp.MustCompile(`(?i)(?:^|[\n.;])\s*deprecated\b`)

 // Convert parses a Swagger 2.0 spec and returns an OAS3 spec, applying
-// Gitea-specific post-processing: server URL, file-schema fixups, URI
-// formats, deprecated flags, and shared-enum extraction.
+// Gitea-specific post-processing: file-schema fixups, URI formats,
+// deprecated flags, and shared-enum extraction.
 //
-// astEnumMap is a value-set-key → Go-type-name(s) map (built by
-// ScanSwaggerEnumTypes). When a value set is shared by multiple Go types,
-// per-property disambiguation uses the x-go-enum-desc extension. If a shared
-// enum in the spec has no matching entry, Convert returns an error — no
-// fallback naming.
-func Convert(swaggerJSON []byte, astEnumMap map[string][]string) (*openapi3.T, error) {
+// astEnumMap is a value-set-key → Go-type-name map (built by
+// ScanSwaggerEnumTypes). If a shared enum in the spec has no entry in the
+// map, Convert returns an error — no fallback naming.
+func Convert(swaggerJSON []byte, astEnumMap map[string]string) (*openapi3.T, error) {
 	var swagger2 openapi2.T
 	if err := json.Unmarshal(swaggerJSON, &swagger2); err != nil {
 		return nil, fmt.Errorf("parsing swagger 2.0: %w", err)
@@ -42,7 +39,6 @@ func Convert(swaggerJSON []byte, astEnumMap map[string][]string) (*openapi3.T, e
 		return nil, fmt.Errorf("converting to openapi 3.0: %w", err)
 	}

-	oas3.Servers = openapi3.Servers{{URL: swagger2.BasePath}}
 	fixFileSchemas(oas3)
 	addURIFormats(oas3)
 	addDeprecatedFlags(oas3)
@@ -180,24 +176,12 @@ type enumUsage struct {
 // If the derived enum name collides with an existing component schema, or
 // no // swagger:enum annotation matches the value set, generation aborts
 // with an actionable error — there are no silent fallbacks.
-func extractSharedEnums(doc *openapi3.T, astEnumMap map[string][]string) error {
+func extractSharedEnums(doc *openapi3.T, astEnumMap map[string]string) error {
 	if doc.Components == nil {
 		return nil
 	}

-	type groupKey struct {
-		valueSet string
-		typeName string
-	}
-	enumGroups := map[groupKey][]enumUsage{}
-	groupOrder := []groupKey{} // deterministic iteration
-
-	addUsage := func(key groupKey, u enumUsage) {
-		if _, seen := enumGroups[key]; !seen {
-			groupOrder = append(groupOrder, key)
-		}
-		enumGroups[key] = append(enumGroups[key], u)
-	}
+	enumGroups := map[string][]enumUsage{}

 	for schemaName, schemaRef := range doc.Components.Schemas {
 		if schemaRef.Value == nil {
@@ -208,31 +192,24 @@ func extractSharedEnums(doc *openapi3.T, astEnumMap map[string][]string) error {
 				continue
 			}
 			if len(propRef.Value.Enum) > 1 && propRef.Value.Type.Is("string") {
-				key := groupKey{
-					valueSet: EnumKey(propRef.Value.Enum),
-					typeName: extractEnumTypeName(propRef.Value, astEnumMap),
-				}
-				addUsage(key, enumUsage{schemaName, propName, propRef, false})
+				key := EnumKey(propRef.Value.Enum)
+				enumGroups[key] = append(enumGroups[key], enumUsage{schemaName, propName, propRef, false})
 			}
 			if propRef.Value.Type.Is("array") && propRef.Value.Items != nil &&
 				propRef.Value.Items.Value != nil && propRef.Value.Items.Ref == "" &&
 				len(propRef.Value.Items.Value.Enum) > 1 && propRef.Value.Items.Value.Type.Is("string") {
-				key := groupKey{
-					valueSet: EnumKey(propRef.Value.Items.Value.Enum),
-					typeName: extractEnumTypeName(propRef.Value.Items.Value, astEnumMap),
-				}
-				addUsage(key, enumUsage{schemaName, propName, propRef, true})
+				key := EnumKey(propRef.Value.Items.Value.Enum)
+				enumGroups[key] = append(enumGroups[key], enumUsage{schemaName, propName, propRef, true})
 			}
 		}
 	}

-	for _, key := range groupOrder {
-		usages := enumGroups[key]
+	for key, usages := range enumGroups {
 		if len(usages) < 2 {
 			continue
 		}

-		enumName, err := deriveEnumName(key.valueSet, key.typeName, usages, astEnumMap)
+		enumName, err := deriveEnumName(key, usages, astEnumMap)
 		if err != nil {
 			return err
 		}
@@ -280,17 +257,12 @@ func extractSharedEnums(doc *openapi3.T, astEnumMap map[string][]string) error {
 	return nil
 }

-// deriveEnumName looks up a shared enum's Go type name. If typeName is
-// non-empty (because we recovered it from x-go-enum-desc), it is used
-// directly. Otherwise the value-set must map to exactly one known type. On
-// failure, returns an error identifying the offending properties.
-func deriveEnumName(key, typeName string, usages []enumUsage, astEnumMap map[string][]string) (string, error) {
-	if typeName != "" {
-		return typeName, nil
-	}
-	names := astEnumMap[key]
-	if len(names) == 1 {
-		return names[0], nil
+// deriveEnumName looks up a shared enum's Go type name from astEnumMap by
+// value-set key. If no annotation matches, returns an error identifying the
+// offending properties and the fix.
+func deriveEnumName(key string, usages []enumUsage, astEnumMap map[string]string) (string, error) {
+	if name, ok := astEnumMap[key]; ok {
+		return name, nil
 	}

 	props := map[string]bool{}
@@ -301,87 +273,9 @@ func deriveEnumName(key, typeName string, usages []enumUsage, astEnumMap map[str
 	for p := range props {
 		propList = append(propList, p)
 	}
-	if len(names) > 1 {
-		return "", fmt.Errorf(
-			"value-set %q is shared by multiple swagger:enum types %v and could not be disambiguated for properties: %v; "+
-				"ensure go-swagger emits x-go-enum-desc for those properties",
-			key, names, propList,
-		)
-	}
 	return "", fmt.Errorf(
 		"no swagger:enum annotation matches value-set %q used by %d properties: %v; "+
 			"fix by adding a named string type with // swagger:enum to modules/structs or modules/commitstatus",
 		key, len(usages), propList,
 	)
 }
-
-// extractEnumTypeName recovers the Go type name a schema's enum came from by
-// parsing the property's x-go-enum-desc extension. go-swagger emits one line
-// per value as "<value> <ConstName>[ <free text>]"; the type is the longest
-// common prefix of the const names, narrowed to the candidate set in
-// astEnumMap. Returns "" if extraction is inconclusive.
-func extractEnumTypeName(s *openapi3.Schema, astEnumMap map[string][]string) string {
-	if s == nil || s.Extensions == nil {
-		return ""
-	}
-	raw, ok := s.Extensions["x-go-enum-desc"]
-	if !ok {
-		return ""
-	}
-	desc, ok := raw.(string)
-	if !ok {
-		return ""
-	}
-	candidates := astEnumMap[EnumKey(s.Enum)]
-	if len(candidates) == 0 {
-		return ""
-	}
-	// Collect the const names (second whitespace-separated field per line).
-	var consts []string
-	for line := range strings.SplitSeq(desc, "\n") {
-		fields := strings.Fields(line)
-		if len(fields) >= 2 {
-			consts = append(consts, fields[1])
-		}
-	}
-	if len(consts) == 0 {
-		return ""
-	}
-	// A candidate matches when it is a prefix of every const name AND the
-	// first character after the prefix is an uppercase ASCII letter — this
-	// rejects e.g. "Alpha" matching "Alphabet" (suffix "bet" starts lower)
-	// while still accepting both "Alpha" and "AlphaPlus" against "AlphaPlusX"
-	// (both prefixes valid). The most specific (longest) wins; ties return
-	// "" so deriveEnumName surfaces the ambiguity rather than silently
-	// picking a winner.
-	ordered := append([]string(nil), candidates...)
-	sort.Slice(ordered, func(i, j int) bool { return len(ordered[i]) > len(ordered[j]) })
-	var matches []string
-	for _, name := range ordered {
-		ok := true
-		for _, c := range consts {
-			if !strings.HasPrefix(c, name) {
-				ok = false
-				break
-			}
-			suffix := c[len(name):]
-			// Empty suffix means the const name exactly equals the type name — valid exact match.
-			// A non-empty suffix must begin with an uppercase letter to reject incidental
-			// prefix matches (e.g. "Alpha" should not match "Alphabet").
-			if len(suffix) > 0 && (suffix[0] < 'A' || suffix[0] > 'Z') {
-				ok = false
-				break
-			}
-		}
-		if ok {
-			matches = append(matches, name)
-		}
-	}
-	if len(matches) == 0 {
-		return ""
-	}
-	if len(matches) > 1 && len(matches[0]) == len(matches[1]) {
-		return ""
-	}
-	return matches[0]
-}
@@ -12,9 +12,9 @@ import (

 func TestDeriveEnumName_hit(t *testing.T) {
 	key := EnumKey([]any{"red", "green", "blue"})
-	astMap := map[string][]string{key: {"Color"}}
+	astMap := map[string]string{key: "Color"}
 	usages := []enumUsage{{schemaName: "Paint", propName: "color"}}
-	got, err := deriveEnumName(key, "", usages, astMap)
+	got, err := deriveEnumName(key, usages, astMap)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -26,7 +26,7 @@ func TestDeriveEnumName_hit(t *testing.T) {
 func TestDeriveEnumName_miss(t *testing.T) {
 	key := EnumKey([]any{"x", "y"})
 	usages := []enumUsage{{schemaName: "Thing", propName: "kind"}}
-	_, err := deriveEnumName(key, "", usages, map[string][]string{})
+	_, err := deriveEnumName(key, usages, map[string]string{})
 	if err == nil {
 		t.Fatal("expected miss error, got nil")
 	}
@@ -64,7 +64,7 @@ func TestExtractSharedEnums_usesASTMap(t *testing.T) {
 			},
 		},
 	}
-	astMap := map[string][]string{EnumKey([]any{"red", "green", "blue"}): {"Color"}}
+	astMap := map[string]string{EnumKey([]any{"red", "green", "blue"}): "Color"}
 	if err := extractSharedEnums(doc, astMap); err != nil {
 		t.Fatalf("extractSharedEnums: %v", err)
 	}
@@ -139,54 +139,6 @@ func TestFixFileSchemas_recursesIntoNested(t *testing.T) {
 	}
 }

-func TestExtractEnumTypeName_TeamVisibility(t *testing.T) {
-	enum := []any{"public", "limited", "private"}
-	key := EnumKey(enum)
-	astMap := map[string][]string{key: {"UserVisibility", "TeamVisibility"}}
-	schema := &openapi3.Schema{
-		Type: &openapi3.Types{"string"},
-		Enum: enum,
-		Extensions: map[string]any{
-			"x-go-enum-desc": "public TeamVisibilityPublic\nlimited TeamVisibilityLimited\nprivate TeamVisibilityPrivate",
-		},
-	}
-	if got := extractEnumTypeName(schema, astMap); got != "TeamVisibility" {
-		t.Fatalf("got %q, want %q", got, "TeamVisibility")
-	}
-}
-
-func TestExtractEnumTypeName_ambiguousPrefixTie(t *testing.T) {
-	enum := []any{"one", "two"}
-	key := EnumKey(enum)
-	astMap := map[string][]string{key: {"AB", "AC"}}
-	schema := &openapi3.Schema{
-		Type: &openapi3.Types{"string"},
-		Enum: enum,
-		Extensions: map[string]any{
-			"x-go-enum-desc": "one ABOne\ntwo ACTwo",
-		},
-	}
-	if got := extractEnumTypeName(schema, astMap); got != "" {
-		t.Fatalf("got %q, want empty string for ambiguous tie", got)
-	}
-}
-
-func TestExtractEnumTypeName_rejectsIncidentalPrefix(t *testing.T) {
-	enum := []any{"a", "b"}
-	key := EnumKey(enum)
-	astMap := map[string][]string{key: {"Alpha", "Alphabet"}}
-	schema := &openapi3.Schema{
-		Type: &openapi3.Types{"string"},
-		Enum: enum,
-		Extensions: map[string]any{
-			"x-go-enum-desc": "a AlphabetA\nb AlphabetB",
-		},
-	}
-	if got := extractEnumTypeName(schema, astMap); got != "Alphabet" {
-		t.Fatalf("got %q, want %q", got, "Alphabet")
-	}
-}
-
 func TestExtractSharedEnums_missReturnsError(t *testing.T) {
 	doc := &openapi3.T{
 		Components: &openapi3.Components{
@@ -212,7 +164,7 @@ func TestExtractSharedEnums_missReturnsError(t *testing.T) {
 			},
 		},
 	}
-	if err := extractSharedEnums(doc, map[string][]string{}); err == nil {
+	if err := extractSharedEnums(doc, map[string]string{}); err == nil {
 		t.Fatal("expected miss error")
 	}
 }
@@ -34,16 +34,13 @@ func EnumKey(values []any) string {
 var rxSwaggerEnum = regexp.MustCompile(`swagger:enum\s+(\w+)`)

 // ScanSwaggerEnumTypes walks .go files under each dir and returns a map from
-// a canonical value-set key (see EnumKey) to the Go type names declared with
-// // swagger:enum TypeName. Multiple type names per key are allowed (e.g.
-// distinct enum types that happen to share a value set such as
-// {public, limited, private}); callers must disambiguate per-usage (typically
-// by parsing the property's x-go-enum-desc extension to recover the const
-// type prefix).
+// a canonical value-set key (see EnumKey) to the Go type name declared with
+// // swagger:enum TypeName.
 //
-// Returns an error on parse failure or on an annotation for a type whose
-// constants can't be extracted.
-func ScanSwaggerEnumTypes(dirs []string) (map[string][]string, error) {
+// Returns an error on parse failure, on an annotation for a type whose
+// constants can't be extracted, or on value-set collisions between two
+// different enum types.
+func ScanSwaggerEnumTypes(dirs []string) (map[string]string, error) {
 	fset := token.NewFileSet()
 	parsed := []*ast.File{}

@@ -95,18 +92,17 @@ func ScanSwaggerEnumTypes(dirs []string) (map[string][]string, error) {
 		}
 	}

-	result := map[string][]string{}
+	result := map[string]string{}
 	for typeName := range enumTypes {
 		values, ok := enumValues[typeName]
 		if !ok || len(values) == 0 {
 			return nil, fmt.Errorf("swagger:enum %s has no const block with typed string values", typeName)
 		}
 		key := EnumKey(values)
-		result[key] = append(result[key], typeName)
-	}
-	for key, names := range result {
-		sort.Strings(names)
-		result[key] = names
+		if existing, ok := result[key]; ok && existing != typeName {
+			return nil, fmt.Errorf("swagger:enum value-set collision: %s and %s both use %q", existing, typeName, key)
+		}
+		result[key] = typeName
 	}
 	return result, nil
 }
@@ -6,19 +6,10 @@ package openapi3gen
 import (
 	"os"
 	"path/filepath"
-	"slices"
 	"strings"
 	"testing"
 )

-func single(got map[string][]string, key string) string {
-	v := got[key]
-	if len(v) != 1 {
-		return ""
-	}
-	return v[0]
-}
-
 func TestEnumKey_sortsAndJoins(t *testing.T) {
 	key := EnumKey([]any{"b", "a", "c"})
 	if key != "a|b|c" {
@@ -56,7 +47,7 @@ const (
 		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
 	}
 	wantKey := EnumKey([]any{"red", "green", "blue"})
-	if single(got, wantKey) != "Color" {
+	if got[wantKey] != "Color" {
 		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Color")
 	}
 }
@@ -107,14 +98,13 @@ const (
 		t.Fatal(err)
 	}

-	got, err := ScanSwaggerEnumTypes([]string{dir})
-	if err != nil {
-		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
+	_, err := ScanSwaggerEnumTypes([]string{dir})
+	if err == nil {
+		t.Fatal("expected collision error, got nil")
 	}
-	key := EnumKey([]any{"x", "y"})
-	names := got[key]
-	if !slices.Equal(names, []string{"Alpha", "Beta"}) {
-		t.Fatalf("map[%q] = %v, want [Alpha Beta]", key, names)
+	msg := err.Error()
+	if !strings.Contains(msg, "Alpha") || !strings.Contains(msg, "Beta") {
+		t.Fatalf("error %q should mention both Alpha and Beta", msg)
 	}
 }

@@ -178,7 +168,7 @@ type Hue string
 		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
 	}
 	wantKey := EnumKey([]any{"a", "b"})
-	if single(got, wantKey) != "Hue" {
+	if got[wantKey] != "Hue" {
 		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Hue")
 	}
 }
@@ -204,7 +194,7 @@ type Shade string
 		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
 	}
 	wantKey := EnumKey([]any{"dark", "light"})
-	if single(got, wantKey) != "Shade" {
+	if got[wantKey] != "Shade" {
 		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Shade")
 	}
 }
@@ -240,10 +230,10 @@ const (
 	}
 	colorKey := EnumKey([]any{"red", "blue"})
 	shadeKey := EnumKey([]any{"dark", "light"})
-	if single(got, colorKey) != "Color" {
+	if got[colorKey] != "Color" {
 		t.Fatalf("Color: map[%q] = %q, want %q", colorKey, got[colorKey], "Color")
 	}
-	if single(got, shadeKey) != "Shade" {
+	if got[shadeKey] != "Shade" {
 		t.Fatalf("Shade: map[%q] = %q, want %q", shadeKey, got[shadeKey], "Shade")
 	}
 }
@@ -5,6 +5,7 @@ package cmd

 import (
 	"context"
+	"fmt"

 	"gitea.dev/modules/private"
 	"gitea.dev/modules/setting"
@@ -48,6 +49,6 @@ func runGenerateActionsRunnerToken(ctx context.Context, c *cli.Command) error {
 	if extra.HasError() {
 		return handleCliResponseExtra(extra)
 	}
-	cprintln(c, respText.Text)
+	_, _ = fmt.Printf("%s\n", respText.Text)
 	return nil
 }
@@ -11,6 +11,7 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
 	"gitea.dev/modules/log"
 	repo_module "gitea.dev/modules/repository"

@@ -127,8 +128,8 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 		}
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
-			log.Trace("Synchronizing repo %s", repo.FullName())
-			gitRepo, err := git.OpenRepository(ctx, repo)
+			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RelativePath())
+			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
 				continue
@@ -354,10 +354,13 @@ func findLdapSecurityProtocolByName(name string) (ldap.SecurityProtocol, bool) {
 	return 0, false
 }

-// getAuthSourceOfType gets the login source by id.
-// It returns an error if the id does not match any source or if the source is not of the expected type.
-func (a *authService) getAuthSourceOfType(ctx context.Context, id int64, authType auth.Type) (*auth.Source, error) {
-	authSource, err := a.getAuthSourceByID(ctx, id)
+// getAuthSource gets the login source by its id defined in the command line flags.
+// It returns an error if the id is not set, does not match any source or if the source is not of expected type.
+func (a *authService) getAuthSource(ctx context.Context, c *cli.Command, authType auth.Type) (*auth.Source, error) {
+	if err := argsSet(c, "id"); err != nil {
+		return nil, err
+	}
+	authSource, err := a.getAuthSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return nil, err
 	}
@@ -369,15 +372,6 @@ func (a *authService) getAuthSourceOfType(ctx context.Context, id int64, authTyp
 	return authSource, nil
 }

-// getAuthSource gets the login source by its id defined in the command line flags.
-// It returns an error if the id is not set, does not match any source or if the source is not of expected type.
-func (a *authService) getAuthSource(ctx context.Context, c *cli.Command, authType auth.Type) (*auth.Source, error) {
-	if err := argsSet(c, "id"); err != nil {
-		return nil, err
-	}
-	return a.getAuthSourceOfType(ctx, c.Int64("id"), authType)
-}
-
 // addLdapBindDn adds a new LDAP via Bind DN authentication source.
 func (a *authService) addLdapBindDn(ctx context.Context, c *cli.Command) error {
 	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-search-base", "user-filter", "email-attribute"); err != nil {
@@ -387,17 +381,16 @@ func (a *authService) addLdapBindDn(ctx context.Context, c *cli.Command) error {
 		return err
 	}

-	ldapConfig := &ldap.Source{
-		Enabled: true, // always true
-	}
 	authSource := &auth.Source{
 		Type:     auth.LDAP,
 		IsActive: true, // active by default
-		Cfg:      ldapConfig,
+		Cfg: &ldap.Source{
+			Enabled: true, // always true
+		},
 	}

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -414,10 +407,9 @@ func (a *authService) updateLdapBindDn(ctx context.Context, c *cli.Command) erro
 	if err != nil {
 		return err
 	}
-	ldapConfig := auth.MustSourceCfg[*ldap.Source](authSource)

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -434,17 +426,16 @@ func (a *authService) addLdapSimpleAuth(ctx context.Context, c *cli.Command) err
 		return err
 	}

-	ldapConfig := &ldap.Source{
-		Enabled: true, // always true
-	}
 	authSource := &auth.Source{
 		Type:     auth.DLDAP,
 		IsActive: true, // active by default
-		Cfg:      ldapConfig,
+		Cfg: &ldap.Source{
+			Enabled: true, // always true
+		},
 	}

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -461,10 +452,9 @@ func (a *authService) updateLdapSimpleAuth(ctx context.Context, c *cli.Command)
 	if err != nil {
 		return err
 	}
-	ldapConfig := auth.MustSourceCfg[*ldap.Source](authSource)

 	parseAuthSourceLdap(c, authSource)
-	if err := parseLdapConfig(c, ldapConfig); err != nil {
+	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
 		return err
 	}

@@ -221,11 +221,12 @@ func (a *authService) runUpdateOauth(ctx context.Context, c *cli.Command) error
 		return err
 	}

-	source, err := a.getAuthSourceOfType(ctx, c.Int64("id"), auth_model.OAuth2)
+	source, err := a.getAuthSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return err
 	}
-	oAuth2Config := auth_model.MustSourceCfg[*oauth2.Source](source)
+
+	oAuth2Config := source.Cfg.(*oauth2.Source)

 	if c.IsSet("name") {
 		source.Name = c.String("name")
@@ -175,11 +175,12 @@ func (a *authService) runUpdateSMTP(ctx context.Context, c *cli.Command) error {
 		return err
 	}

-	source, err := a.getAuthSourceOfType(ctx, c.Int64("id"), auth_model.SMTP)
+	source, err := a.getAuthSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return err
 	}
-	smtpConfig := auth_model.MustSourceCfg[*smtp.Source](source)
+
+	smtpConfig := source.Cfg.(*smtp.Source)

 	if err := parseSMTPConfig(c, smtpConfig); err != nil {
 		return err
@@ -18,7 +18,6 @@ func newUserCommand() *cli.Command {
 			microcmdUserDelete(),
 			newUserGenerateAccessTokenCommand(),
 			microcmdUserMustChangePassword(),
-			microcmdUserDisableTwoFactor(),
 		},
 	}
 }
@@ -73,6 +73,6 @@ func runChangePassword(ctx context.Context, c *cli.Command) error {
 		}
 	}

-	cprintf(c, "%s's password has been successfully updated!\n", user.Name)
+	fmt.Printf("%s's password has been successfully updated!\n", user.Name)
 	return nil
 }
@@ -152,14 +152,13 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 			return err
 		}
 		// codeql[disable-next-line=go/clear-text-logging]
-		cprintf(c, "generated random password is '%s'\n", password)
+		fmt.Printf("generated random password is '%s'\n", password)
 	} else if userType == user_model.UserTypeIndividual {
 		return errors.New("must set either password or random-password flag")
 	}

 	isAdmin := c.Bool("admin")
-	// Only local, existing, regular users should be forced to update their password. Bot users for example are non-interactive
-	mustChangePassword := userType == user_model.UserTypeIndividual
+	mustChangePassword := true // always default to true
 	if c.IsSet("must-change-password") {
 		if userType != user_model.UserTypeIndividual {
 			return errors.New("must-change-password flag can only be set for individual users")
@@ -228,7 +227,7 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 	if err := user_model.CreateUser(ctx, u, &user_model.Meta{}, overwriteDefault); err != nil {
 		return fmt.Errorf("CreateUser: %w", err)
 	}
-	cprintf(c, "New user '%s' has been successfully created!\n", username)
+	fmt.Printf("New user '%s' has been successfully created!\n", username)

 	// create the access token
 	if accessTokenScope != "" {
@@ -236,7 +235,7 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 		if err := auth_model.NewAccessToken(ctx, t); err != nil {
 			return err
 		}
-		cprintf(c, "Access token was successfully created... %s\n", t.Token)
+		fmt.Printf("Access token was successfully created... %s\n", t.Token)
 	}
 	return nil
 }
@@ -63,7 +63,6 @@ func TestAdminUserCreate(t *testing.T) {
 		u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "u"})
 		assert.Equal(t, user_model.UserTypeBot, u.Type)
 		assert.Empty(t, u.Passwd)
-		assert.False(t, u.MustChangePassword, "bot users should not be forced to change password")
 	})

 	t.Run("AccessToken", func(t *testing.T) {
@@ -1,72 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-
-	auth_model "gitea.dev/models/auth"
-	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/setting"
-
-	"github.com/urfave/cli/v3"
-)
-
-func microcmdUserDisableTwoFactor() *cli.Command {
-	return &cli.Command{
-		Name:  "disable-2fa",
-		Usage: "Disable two-factor authentication for a user",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "username",
-				Aliases: []string{"u"},
-				Usage:   "Username of the user to disable 2FA for",
-			},
-			&cli.Int64Flag{
-				Name:  "id",
-				Usage: "ID of the user to disable 2FA for",
-			},
-		},
-		Action: runDisableTwoFactor,
-	}
-}
-
-func runDisableTwoFactor(ctx context.Context, c *cli.Command) error {
-	if !c.IsSet("id") && !c.IsSet("username") {
-		return errors.New("either --id or --username must be provided")
-	}
-
-	if !setting.IsInTesting {
-		if err := initDB(ctx); err != nil {
-			return err
-		}
-	}
-
-	var user *user_model.User
-	var err error
-	if c.IsSet("id") {
-		user, err = user_model.GetUserByID(ctx, c.Int64("id"))
-	} else {
-		user, err = user_model.GetUserByName(ctx, c.String("username"))
-	}
-	if err != nil {
-		return err
-	}
-
-	// When both selectors are given, make sure they refer to the same user.
-	if c.IsSet("id") && c.IsSet("username") && user.LowerName != strings.ToLower(strings.TrimSpace(c.String("username"))) {
-		return fmt.Errorf("the user with id %d is %q, which does not match the provided username %q", user.ID, user.Name, c.String("username"))
-	}
-
-	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, user.ID)
-	if err != nil {
-		return err
-	}
-
-	cprintf(c, "Disabled 2FA for user %q (removed %d TOTP and %d WebAuthn credential(s))\n", user.Name, totp, webAuthn)
-	return nil
-}
@@ -1,119 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"io"
-	"strconv"
-	"testing"
-
-	auth_model "gitea.dev/models/auth"
-	"gitea.dev/models/db"
-	"gitea.dev/models/unittest"
-	user_model "gitea.dev/models/user"
-
-	"github.com/go-webauthn/webauthn/webauthn"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDisableTwoFactorCommand(t *testing.T) {
-	ctx := t.Context()
-
-	defer func() {
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}, &auth_model.TwoFactor{}, &auth_model.WebAuthnCredential{}))
-	}()
-
-	t.Run("disable TOTP and WebAuthn", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "tfuser", "--email", "tfuser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "tfuser"})
-
-		// Enroll TOTP.
-		tf := &auth_model.TwoFactor{UID: user.ID}
-		require.NoError(t, tf.SetSecret("test-secret"))
-		_, err := tf.GenerateScratchToken()
-		require.NoError(t, err)
-		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
-
-		// Register a WebAuthn credential.
-		_, err = auth_model.CreateCredential(ctx, user.ID, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
-		require.NoError(t, err)
-
-		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		require.True(t, has)
-
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "tfuser"}))
-
-		// Both factors must be gone afterwards.
-		has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		assert.False(t, has)
-	})
-
-	t.Run("disable by id", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "iduser", "--email", "iduser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "iduser"})
-
-		tf := &auth_model.TwoFactor{UID: user.ID}
-		require.NoError(t, tf.SetSecret("test-secret"))
-		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
-
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", strconv.FormatInt(user.ID, 10)}))
-
-		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
-		require.NoError(t, err)
-		assert.False(t, has)
-	})
-
-	t.Run("no enrollment is a no-op", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "plainuser", "--email", "plainuser@gitea.local", "--random-password"}))
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "plainuser"}))
-	})
-
-	t.Run("id and username must match when both given", func(t *testing.T) {
-		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "matchuser", "--email", "matchuser@gitea.local", "--random-password"}))
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "matchuser"})
-		id := strconv.FormatInt(user.ID, 10)
-
-		// Matching id + username is accepted.
-		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", id, "--username", "matchuser"}))
-
-		// Mismatched id + username is rejected.
-		cmd := microcmdUserDisableTwoFactor()
-		cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
-		err := cmd.Run(ctx, []string{"disable-2fa", "--id", id, "--username", "someotheruser"})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "does not match the provided username")
-	})
-
-	t.Run("failure cases", func(t *testing.T) {
-		testCases := []struct {
-			name        string
-			args        []string
-			expectedErr string
-		}{
-			{
-				name:        "user does not exist",
-				args:        []string{"disable-2fa", "--username", "nonexistentuser"},
-				expectedErr: "user does not exist",
-			},
-			{
-				name:        "neither id nor username",
-				args:        []string{"disable-2fa"},
-				expectedErr: "either --id or --username must be provided",
-			},
-		}
-
-		for _, tc := range testCases {
-			t.Run(tc.name, func(t *testing.T) {
-				cmd := microcmdUserDisableTwoFactor()
-				cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
-				err := cmd.Run(ctx, tc.args)
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tc.expectedErr)
-			})
-		}
-	})
-}
@@ -88,9 +88,9 @@ func runGenerateAccessToken(ctx context.Context, c *cli.Command) error {
 	}

 	if c.Bool("raw") {
-		cprintln(c, t.Token)
+		fmt.Printf("%s\n", t.Token)
 	} else {
-		cprintf(c, "Access token was successfully created: %s\n", t.Token)
+		fmt.Printf("Access token was successfully created: %s\n", t.Token)
 	}

 	return nil
@@ -6,6 +6,7 @@ package cmd
 import (
 	"context"
 	"errors"
+	"fmt"

 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
@@ -58,6 +59,6 @@ func runMustChangePassword(ctx context.Context, c *cli.Command) error {
 	}

 	// codeql[disable-next-line=go/clear-text-logging]
-	cprintf(c, "Updated %d users setting MustChangePassword to %t\n", n, mustChangePassword)
+	fmt.Printf("Updated %d users setting MustChangePassword to %t\n", n, mustChangePassword)
 	return nil
 }
@@ -203,7 +203,7 @@ func TestCliCmdError(t *testing.T) {
 	assert.Error(t, err)
 	assert.Equal(t, 1, r.ExitCode)
 	assert.Empty(t, r.Stdout)
-	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n", r.Stderr)
+	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n\n", r.Stderr)

 	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return nil }})
 	r, err = runTestApp(app, "./gitea", "test-cmd")
@@ -235,14 +235,3 @@ func TestCliCmdBefore(t *testing.T) {
 	assert.Equal(t, "/tmp/any.ini", configValues["before"], "BeforeFunc must be called before preparing config")
 	assert.Equal(t, "/dev/null", configValues["action"])
 }
-
-func TestCliCmdCompletion(t *testing.T) {
-	app := newTestApp(cli.Command{
-		Action: func(ctx context.Context, cmd *cli.Command) error { return nil },
-	})
-	res, err := runTestApp(app, "./gitea", "completion", "bash", "--nonexist")
-	assert.Error(t, err)
-	assert.Equal(t, 1, res.ExitCode)
-	assert.Equal(t, "", res.Stdout)
-	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -nonexist\n", res.Stderr)
-}
@@ -12,9 +12,9 @@ import (
 	"strings"
 	"text/tabwriter"

-	"gitea.dev/modelmigration"
-	"gitea.dev/modelmigration/base"
 	"gitea.dev/models/db"
+	"gitea.dev/models/migrations"
+	migrate_base "gitea.dev/models/migrations/base"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -114,8 +114,8 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {

 	setting.Database.LogSQL = debug
 	if err := db.InitEngine(ctx); err != nil {
-		cprintln(cmd, err)
-		cprintln(cmd, "Check if you are using the right config file. You can use a --config directive to specify one.")
+		fmt.Println(err)
+		fmt.Println("Check if you are using the right config file. You can use a --config directive to specify one.")
 		return nil
 	}

@@ -129,10 +129,10 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	if err != nil {
 		return err
 	}
-	recreateTables := base.RecreateTables(beans...)
+	recreateTables := migrate_base.RecreateTables(beans...)

 	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x db.EngineMigration) error {
-		if err := modelmigration.EnsureUpToDate(ctx, x); err != nil {
+		if err := migrations.EnsureUpToDate(ctx, x); err != nil {
 			return err
 		}
 		return recreateTables(x)
@@ -5,6 +5,7 @@ package cmd

 import (
 	"context"
+	"fmt"

 	"gitea.dev/models/db"
 	"gitea.dev/modules/log"
@@ -39,15 +40,15 @@ func runDoctorConvert(ctx context.Context, cmd *cli.Command) error {
 			log.Fatal("Failed to convert database & table: %v", err)
 			return err
 		}
-		cprintln(cmd, "Converted successfully, please confirm your database's character set is now utf8mb4")
+		fmt.Println("Converted successfully, please confirm your database's character set is now utf8mb4")
 	case setting.Database.Type.IsMSSQL():
 		if err := db.ConvertVarcharToNVarchar(); err != nil {
 			log.Fatal("Failed to convert database from varchar to nvarchar: %v", err)
 			return err
 		}
-		cprintln(cmd, "Converted successfully, please confirm your database's all columns character is NVARCHAR now")
+		fmt.Println("Converted successfully, please confirm your database's all columns character is NVARCHAR now")
 	default:
-		cprintln(cmd, "This command can only be used with a MySQL or MSSQL database")
+		fmt.Println("This command can only be used with a MySQL or MSSQL database")
 	}

 	return nil
@@ -198,7 +198,7 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 		}
 		defer func() {
 			_ = dbDump.Close()
-			if err := os.Remove(dbDump.Name()); err != nil {
+			if err := util.Remove(dbDump.Name()); err != nil {
 				log.Warn("Unable to remove temporary file: %s: Error: %v", dbDump.Name(), err)
 			}
 		}()
@@ -18,6 +18,7 @@ import (
 	"gitea.dev/modules/public"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"

 	"github.com/urfave/cli/v3"
 )
@@ -150,7 +151,7 @@ func runListDo(c *cli.Command) error {
 	}

 	for _, a := range matchedAssetFiles {
-		cprintln(c, a.path)
+		fmt.Println(a.path)
 	}

 	return nil
@@ -194,7 +195,7 @@ func runExtractDo(c *cli.Command) error {
 		destdir = c.String("destination")
 	} else if c.Bool("custom") {
 		destdir = setting.CustomPath
-		cprintln(c, "Using app.ini at", setting.CustomConf)
+		fmt.Println("Using app.ini at", setting.CustomConf)
 	}

 	fi, err := os.Stat(destdir)
@@ -213,13 +214,13 @@ func runExtractDo(c *cli.Command) error {
 		return fmt.Errorf("destination %q is not a directory", destdir)
 	}

-	cprintf(c, "Extracting to %s:\n", destdir)
+	fmt.Printf("Extracting to %s:\n", destdir)

 	overwrite := c.Bool("overwrite")
 	rename := c.Bool("rename")

 	for _, a := range matchedAssetFiles {
-		if err := extractAsset(c, destdir, a, overwrite, rename); err != nil {
+		if err := extractAsset(destdir, a, overwrite, rename); err != nil {
 			// Non-fatal error
 			_, _ = fmt.Fprintf(os.Stderr, "%s: %v\n", a.path, err)
 		}
@@ -228,7 +229,7 @@ func runExtractDo(c *cli.Command) error {
 	return nil
 }

-func extractAsset(c *cli.Command, d string, a assetFile, overwrite, rename bool) error {
+func extractAsset(d string, a assetFile, overwrite, rename bool) error {
 	dest := filepath.Join(d, filepath.FromSlash(a.path))
 	dir := filepath.Dir(dest)

@@ -249,12 +250,12 @@ func extractAsset(c *cli.Command, d string, a assetFile, overwrite, rename bool)
 			return fmt.Errorf("%s: %w", dest, err)
 		}
 	} else if !overwrite && !rename {
-		cprintf(c, "%s already exists; skipped.\n", dest)
+		fmt.Printf("%s already exists; skipped.\n", dest)
 		return nil
 	} else if !fi.Mode().IsRegular() {
 		return fmt.Errorf("%s already exists, but it's not a regular file", dest)
 	} else if rename {
-		if err := os.Rename(dest, dest+".bak"); err != nil {
+		if err := util.Rename(dest, dest+".bak"); err != nil {
 			return fmt.Errorf("error creating backup for %s: %w", dest, err)
 		}
 		// Attempt to respect file permissions mask (even if user:group will be set anew)
@@ -271,7 +272,7 @@ func extractAsset(c *cli.Command, d string, a assetFile, overwrite, rename bool)
 		return fmt.Errorf("%s: %w", dest, err)
 	}

-	cprintln(c, dest)
+	fmt.Println(dest)

 	return nil
 }
@@ -306,7 +307,7 @@ func compileCollectPatterns(args []string) (_ []glob.Glob, err error) {
 	pat := make([]glob.Glob, len(args))
 	for i := range args {
 		if pat[i], err = glob.Compile(args[i], '/'); err != nil {
-			return nil, fmt.Errorf("invalid glob pattern %q: %w", args[i], err)
+			return nil, fmt.Errorf("invalid glob patterh %q: %w", args[i], err)
 		}
 	}
 	return pat, nil
@@ -106,10 +106,10 @@ func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 		return err
 	}

-	cprintf(c, "%s", internalToken)
+	fmt.Printf("%s", internalToken)

 	if isatty.IsTerminal(os.Stdout.Fd()) {
-		cprintf(c, "\n")
+		fmt.Printf("\n")
 	}

 	return nil
@@ -117,10 +117,10 @@ func runGenerateInternalToken(_ context.Context, c *cli.Command) error {

 func runGenerateLfsJwtSecret(_ context.Context, c *cli.Command) error {
 	_, jwtSecretBase64 := generate.NewJwtSecretWithBase64()
-	cprintf(c, "%s", jwtSecretBase64)
+	fmt.Printf("%s", jwtSecretBase64)

 	if isatty.IsTerminal(os.Stdout.Fd()) {
-		cprintf(c, "\n")
+		fmt.Printf("\n")
 	}

 	return nil
@@ -133,10 +133,10 @@ func runGenerateSecretKey(_ context.Context, c *cli.Command) error {
 	}

 	// codeql[disable-next-line=go/clear-text-logging]
-	cprintf(c, "%s", secretKey)
+	fmt.Printf("%s", secretKey)

 	if isatty.IsTerminal(os.Stdout.Fd()) {
-		cprintf(c, "\n")
+		fmt.Printf("\n")
 	}

 	return nil
@@ -168,14 +168,14 @@ func runGenerateKeyPair(_ context.Context, c *cli.Command) error {
 	// Check if file exists to prevent overwriting
 	if _, err := os.Stat(file); err == nil {
 		if !confirm(c.Reader, c.Writer, "%s already exists.\nOverwrite (y/n)? ", file) {
-			cprintln(c, "Aborting")
+			fmt.Println("Aborting")
 			return nil
 		}
 	}
 	bits := c.Int("bits")
 	err := ssh.GenKeyPair(file, generate.SSHKeyType(keyType), bits)
 	if err == nil {
-		cprintf(c, "Your SSH key has been saved in %s\n", file)
+		fmt.Printf("Your SSH key has been saved in %s\n", file)
 	}
 	return err
 }
@@ -1,6 +1,8 @@
 // Copyright 2018 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT

+// Package cmd provides subcommands to the gitea binary - such as "web" or
+// "admin".
 package cmd

 import (
@@ -20,8 +22,8 @@ import (
 	"github.com/urfave/cli/v3"
 )

-// argsSet checks that all the required arguments are set.
-// args is a list of arguments that must be set in the command context.
+// argsSet checks that all the required arguments are set. args is a list of
+// arguments that must be set in the passed Context.
 func argsSet(c *cli.Command, args ...string) error {
 	for _, a := range args {
 		if !c.IsSet(a) {
@@ -139,11 +141,3 @@ func isValidDefaultSubCommand(cmd *cli.Command) (string, bool) {
 	}
 	return "", true
 }
-
-func cprintf(c *cli.Command, format string, args ...any) {
-	_, _ = fmt.Fprintf(c.Writer, format, args...)
-}
-
-func cprintln(c *cli.Command, args ...any) {
-	_, _ = fmt.Fprintln(c.Writer, args...)
-}
@@ -186,24 +186,23 @@ Gitea or set your environment appropriately.`, "")

 	// the environment is set by serv command
 	isWiki, _ := strconv.ParseBool(os.Getenv(repo_module.EnvRepoIsWiki))
-	ownerName := os.Getenv(repo_module.EnvRepoUsername)
-	repoName := os.Getenv(repo_module.EnvRepoName)
+	username := os.Getenv(repo_module.EnvRepoUsername)
+	reponame := os.Getenv(repo_module.EnvRepoName)
 	userID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
 	prID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPRID), 10, 64)
+	deployKeyID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvDeployKeyID), 10, 64)
+	actionsTaskID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvActionsTaskID), 10, 64)

 	hookOptions := private.HookOptions{
-		IsWiki: isWiki,
-
+		UserID:                          userID,
 		GitAlternativeObjectDirectories: os.Getenv(private.GitAlternativeObjectDirectories),
 		GitObjectDirectory:              os.Getenv(private.GitObjectDirectory),
 		GitQuarantinePath:               os.Getenv(private.GitQuarantinePath),
 		GitPushOptions:                  pushOptions(),
-
-		PullRequestID: prID,
-
-		UserID:          userID,
-		UserName:        os.Getenv(repo_module.EnvPusherName),
-		UserExtDoerData: os.Getenv(repo_module.EnvPusherExtDoerData),
+		PullRequestID:                   prID,
+		DeployKeyID:                     deployKeyID,
+		ActionsTaskID:                   actionsTaskID,
+		IsWiki:                          isWiki,
 	}

 	scanner := bufio.NewScanner(os.Stdin)
@@ -258,7 +257,7 @@ Gitea or set your environment appropriately.`, "")
 				hookOptions.OldCommitIDs = oldCommitIDs
 				hookOptions.NewCommitIDs = newCommitIDs
 				hookOptions.RefFullNames = refFullNames
-				extra := private.HookPreReceive(ctx, ownerName, repoName, hookOptions)
+				extra := private.HookPreReceive(ctx, username, reponame, hookOptions)
 				if extra.HasError() {
 					return fail(ctx, extra.UserMsg, "HookPreReceive(batch) failed: %v", extra.Error)
 				}
@@ -284,7 +283,7 @@ Gitea or set your environment appropriately.`, "")

 		fmt.Fprintf(out, " Checking %d references\n", count)

-		extra := private.HookPreReceive(ctx, ownerName, repoName, hookOptions)
+		extra := private.HookPreReceive(ctx, username, reponame, hookOptions)
 		if extra.HasError() {
 			return fail(ctx, extra.UserMsg, "HookPreReceive(last) failed: %v", extra.Error)
 		}
@@ -354,21 +353,18 @@ Gitea or set your environment appropriately.`, "")
 	repoName := os.Getenv(repo_module.EnvRepoName)
 	pusherID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
 	prID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPRID), 10, 64)
+	pusherName := os.Getenv(repo_module.EnvPusherName)

 	hookOptions := private.HookOptions{
-		IsWiki: isWiki,
-
+		UserName:                        pusherName,
+		UserID:                          pusherID,
 		GitAlternativeObjectDirectories: os.Getenv(private.GitAlternativeObjectDirectories),
 		GitObjectDirectory:              os.Getenv(private.GitObjectDirectory),
 		GitQuarantinePath:               os.Getenv(private.GitQuarantinePath),
 		GitPushOptions:                  pushOptions(),
-
-		PullRequestID: prID,
-		PushTrigger:   repo_module.PushTrigger(os.Getenv(repo_module.EnvPushTrigger)),
-
-		UserID:          pusherID,
-		UserName:        os.Getenv(repo_module.EnvPusherName),
-		UserExtDoerData: os.Getenv(repo_module.EnvPusherExtDoerData),
+		PullRequestID:                   prID,
+		PushTrigger:                     repo_module.PushTrigger(os.Getenv(repo_module.EnvPushTrigger)),
+		IsWiki:                          isWiki,
 	}

 	oldCommitIDs := make([]string, 0, hookBatchSize)
@@ -485,6 +481,7 @@ Gitea or set your environment appropriately.`, "")
 	isWiki, _ := strconv.ParseBool(os.Getenv(repo_module.EnvRepoIsWiki))
 	repoName := os.Getenv(repo_module.EnvRepoName)
 	pusherID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
+	pusherName := os.Getenv(repo_module.EnvPusherName)

 	// 1. Version and features negotiation.
 	// S: PKT-LINE(version=1\0push-options atomic...) / PKT-LINE(version=1\n)
@@ -556,13 +553,10 @@ Gitea or set your environment appropriately.`, "")
 	// S: ... ...
 	// S: flush-pkt
 	hookOptions := private.HookOptions{
-		IsWiki: isWiki,
-
+		UserName:       pusherName,
+		UserID:         pusherID,
 		GitPushOptions: make(map[string]string),
-
-		UserID:          pusherID,
-		UserName:        os.Getenv(repo_module.EnvPusherName),
-		UserExtDoerData: os.Getenv(repo_module.EnvPusherExtDoerData),
+		IsWiki:         isWiki,
 	}
 	hookOptions.OldCommitIDs = make([]string, 0, hookBatchSize)
 	hookOptions.NewCommitIDs = make([]string, 0, hookBatchSize)
@@ -758,7 +752,7 @@ func writeFlushPktLine(ctx context.Context, out io.Writer) error {
 func writeDataPktLine(ctx context.Context, out io.Writer, data []byte) error {
 	hexchar := []byte("0123456789abcdef")
 	hex := func(n uint64) byte {
-		return hexchar[n&15]
+		return hexchar[(n)&15]
 	}

 	length := uint64(len(data) + 4)
@@ -5,6 +5,7 @@ package cmd

 import (
 	"context"
+	"fmt"

 	"gitea.dev/modules/private"
 	"gitea.dev/modules/setting"
@@ -21,11 +22,11 @@ func runSendMail(ctx context.Context, c *cli.Command) error {

 	if !confirmSkipped {
 		if len(body) == 0 {
-			cprintln(c, "warning: Content is empty")
+			fmt.Println("warning: Content is empty")
 		}

 		if !confirm(c.Reader, c.Writer, "Proceed with sending email? [Y/n] ") {
-			cprintln(c, "The mail was not sent")
+			fmt.Println("The mail was not sent")
 			return nil
 		}
 	}
@@ -34,6 +35,6 @@ func runSendMail(ctx context.Context, c *cli.Command) error {
 	if extra.HasError() {
 		return handleCliResponseExtra(extra)
 	}
-	cprintf(c, "Sent %s email(s) to all users\n", respText.Text)
+	_, _ = fmt.Printf("Sent %s email(s) to all users\n", respText.Text)
 	return nil
 }
@@ -5,10 +5,10 @@ package cmd

 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"os"
+	"strings"

 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -154,37 +154,16 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 	return app
 }

-// usageErr marks a usage error already reported by cliOnUsageError, so RunMainApp does not print it again.
-type usageErr struct{ err error }
-
-func (e usageErr) Error() string { return e.err.Error() }
-func (e usageErr) Unwrap() error { return e.err }
-
-// cliOnUsageError reports usage errors itself instead of letting urfave/cli dump the full help to stdout (since urfave/cli v3.10).
-func cliOnUsageError(_ context.Context, cmd *cli.Command, err error, _ bool) error {
-	_, _ = fmt.Fprintf(cmd.Root().ErrWriter, "Incorrect Usage: %s\n", err.Error())
-	return usageErr{err}
-}
-
-func setCLIOnUsageError(cmd *cli.Command) {
-	_ = cmd.Walk(func(c *cli.Command) error {
-		c.OnUsageError = cliOnUsageError
-		return nil
-	})
-}
-
 func RunMainApp(app *cli.Command, args ...string) error {
 	ctx, cancel := installSignals()
 	defer cancel()
-	setCLIOnUsageError(app)
-	// the completion subcommands are built during app.Run, after the Walk above, so cover them via this hook
-	app.ConfigureShellCompletionCommand = setCLIOnUsageError
 	err := app.Run(ctx, args)
 	if err == nil {
 		return nil
 	}
-	if _, ok := errors.AsType[usageErr](err); ok {
-		cli.OsExiter(1) // cliOnUsageError already reported it
+	if strings.HasPrefix(err.Error(), "flag provided but not defined:") {
+		// the cli package should already have output the error message, so just exit
+		cli.OsExiter(1)
 		return err
 	}
 	_, _ = fmt.Fprintf(app.ErrWriter, "Command error: %v\n", err)
@@ -5,14 +5,60 @@ package cmd

 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"

+	"gitea.dev/modules/log"
 	"gitea.dev/modules/private"

 	"github.com/urfave/cli/v3"
 )

+func defaultLoggingFlags() []cli.Flag {
+	return []cli.Flag{
+		&cli.StringFlag{
+			Name:  "logger",
+			Usage: `Logger name - will default to "default"`,
+		},
+		&cli.StringFlag{
+			Name:  "writer",
+			Usage: "Name of the log writer - will default to mode",
+		},
+		&cli.StringFlag{
+			Name:  "level",
+			Usage: "Logging level for the new logger",
+		},
+		&cli.StringFlag{
+			Name:    "stacktrace-level",
+			Aliases: []string{"L"},
+			Usage:   "Stacktrace logging level",
+		},
+		&cli.StringFlag{
+			Name:    "flags",
+			Aliases: []string{"F"},
+			Usage:   "Flags for the logger",
+		},
+		&cli.StringFlag{
+			Name:    "expression",
+			Aliases: []string{"e"},
+			Usage:   "Matching expression for the logger",
+		},
+		&cli.StringFlag{
+			Name:    "prefix",
+			Aliases: []string{"p"},
+			Usage:   "Prefix for the logger",
+		},
+		&cli.BoolFlag{
+			Name:  "color",
+			Usage: "Use color in the logs",
+		},
+		&cli.BoolFlag{
+			Name: "debug",
+		},
+	}
+}
+
 func newLoggingCommand() *cli.Command {
 	return &cli.Command{
 		Name:  "logging",
@@ -45,6 +91,92 @@ func newLoggingCommand() *cli.Command {
 					},
 				},
 				Action: runReleaseReopenLogging,
+			}, {
+				Name:      "remove",
+				Usage:     "Remove a logger",
+				ArgsUsage: "[name] Name of logger to remove",
+				Flags: []cli.Flag{
+					&cli.BoolFlag{
+						Name: "debug",
+					}, &cli.StringFlag{
+						Name:  "logger",
+						Usage: `Logger name - will default to "default"`,
+					},
+				},
+				Action: runRemoveLogger,
+			}, {
+				Name:  "add",
+				Usage: "Add a logger",
+				Commands: []*cli.Command{
+					{
+						Name:  "file",
+						Usage: "Add a file logger",
+						Flags: append(defaultLoggingFlags(), []cli.Flag{
+							&cli.StringFlag{
+								Name:    "filename",
+								Aliases: []string{"f"},
+								Usage:   "Filename for the logger - this must be set.",
+							},
+							&cli.BoolFlag{
+								Name:    "rotate",
+								Aliases: []string{"r"},
+								Usage:   "Rotate logs",
+							},
+							&cli.Int64Flag{
+								Name:    "max-size",
+								Aliases: []string{"s"},
+								Usage:   "Maximum size in bytes before rotation",
+							},
+							&cli.BoolFlag{
+								Name:    "daily",
+								Aliases: []string{"d"},
+								Usage:   "Rotate logs daily",
+							},
+							&cli.IntFlag{
+								Name:    "max-days",
+								Aliases: []string{"D"},
+								Usage:   "Maximum number of daily logs to keep",
+							},
+							&cli.BoolFlag{
+								Name:    "compress",
+								Aliases: []string{"z"},
+								Usage:   "Compress rotated logs",
+							},
+							&cli.IntFlag{
+								Name:    "compression-level",
+								Aliases: []string{"Z"},
+								Usage:   "Compression level to use",
+							},
+						}...),
+						Action: runAddFileLogger,
+					}, {
+						Name:  "conn",
+						Usage: "Add a net conn logger",
+						Flags: append(defaultLoggingFlags(), []cli.Flag{
+							&cli.BoolFlag{
+								Name:    "reconnect-on-message",
+								Aliases: []string{"R"},
+								Usage:   "Reconnect to host for every message",
+							},
+							&cli.BoolFlag{
+								Name:    "reconnect",
+								Aliases: []string{"r"},
+								Usage:   "Reconnect to host when connection is dropped",
+							},
+							&cli.StringFlag{
+								Name:    "protocol",
+								Aliases: []string{"P"},
+								Usage:   "Set protocol to use: tcp, unix, or udp (defaults to tcp)",
+							},
+							&cli.StringFlag{
+								Name:    "address",
+								Aliases: []string{"a"},
+								Usage:   "Host address and port to connect to (defaults to :7020)",
+							},
+						}...),
+						Action: runAddConnLogger,
+					},
+				},
 			}, {
 				Name:  "log-sql",
 				Usage: "Set LogSQL",
@@ -63,6 +195,107 @@ func newLoggingCommand() *cli.Command {
 	}
 }

+func runRemoveLogger(ctx context.Context, c *cli.Command) error {
+	setup(ctx, c.Bool("debug"))
+	logger := c.String("logger")
+	if len(logger) == 0 {
+		logger = log.DEFAULT
+	}
+	writer := c.Args().First()
+
+	extra := private.RemoveLogger(ctx, logger, writer)
+	return handleCliResponseExtra(extra)
+}
+
+func runAddConnLogger(ctx context.Context, c *cli.Command) error {
+	setup(ctx, c.Bool("debug"))
+	vals := map[string]any{}
+	mode := "conn"
+	vals["net"] = "tcp"
+	if c.IsSet("protocol") {
+		switch c.String("protocol") {
+		case "udp":
+			vals["net"] = "udp"
+		case "unix":
+			vals["net"] = "unix"
+		}
+	}
+	if c.IsSet("address") {
+		vals["address"] = c.String("address")
+	} else {
+		vals["address"] = ":7020"
+	}
+	if c.IsSet("reconnect") {
+		vals["reconnect"] = c.Bool("reconnect")
+	}
+	if c.IsSet("reconnect-on-message") {
+		vals["reconnectOnMsg"] = c.Bool("reconnect-on-message")
+	}
+	return commonAddLogger(ctx, c, mode, vals)
+}
+
+func runAddFileLogger(ctx context.Context, c *cli.Command) error {
+	setup(ctx, c.Bool("debug"))
+	vals := map[string]any{}
+	mode := "file"
+	if c.IsSet("filename") {
+		vals["filename"] = c.String("filename")
+	} else {
+		return errors.New("filename must be set when creating a file logger")
+	}
+	if c.IsSet("rotate") {
+		vals["rotate"] = c.Bool("rotate")
+	}
+	if c.IsSet("max-size") {
+		vals["maxsize"] = c.Int64("max-size")
+	}
+	if c.IsSet("daily") {
+		vals["daily"] = c.Bool("daily")
+	}
+	if c.IsSet("max-days") {
+		vals["maxdays"] = c.Int("max-days")
+	}
+	if c.IsSet("compress") {
+		vals["compress"] = c.Bool("compress")
+	}
+	if c.IsSet("compression-level") {
+		vals["compressionLevel"] = c.Int("compression-level")
+	}
+	return commonAddLogger(ctx, c, mode, vals)
+}
+
+func commonAddLogger(ctx context.Context, c *cli.Command, mode string, vals map[string]any) error {
+	if len(c.String("level")) > 0 {
+		vals["level"] = log.LevelFromString(c.String("level")).String()
+	}
+	if len(c.String("stacktrace-level")) > 0 {
+		vals["stacktraceLevel"] = log.LevelFromString(c.String("stacktrace-level")).String()
+	}
+	if len(c.String("expression")) > 0 {
+		vals["expression"] = c.String("expression")
+	}
+	if len(c.String("prefix")) > 0 {
+		vals["prefix"] = c.String("prefix")
+	}
+	if len(c.String("flags")) > 0 {
+		vals["flags"] = log.FlagsFromString(c.String("flags"))
+	}
+	if c.IsSet("color") {
+		vals["colorize"] = c.Bool("color")
+	}
+	logger := log.DEFAULT
+	if c.IsSet("logger") {
+		logger = c.String("logger")
+	}
+	writer := mode
+	if c.IsSet("writer") {
+		writer = c.String("writer")
+	}
+
+	extra := private.AddLogger(ctx, logger, writer, mode, vals)
+	return handleCliResponseExtra(extra)
+}
+
 func runPauseLogging(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))
 	userMsg := private.PauseLogging(ctx)
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -28,7 +29,6 @@ import (
 	"gitea.dev/modules/process"
 	repo_module "gitea.dev/modules/repository"
 	"gitea.dev/modules/setting"
-	"gitea.dev/services/agit"
 	"gitea.dev/services/lfs"

 	"github.com/kballard/go-shellquote"
@@ -139,13 +139,13 @@ func runServ(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))

 	if setting.SSH.Disabled {
-		cprintln(c, "Gitea: SSH has been disabled")
+		println("Gitea: SSH has been disabled")
 		return nil
 	}

 	if c.NArg() < 1 {
 		if err := cli.ShowSubcommandHelp(c); err != nil {
-			cprintf(c, "error showing subcommand help: %v\n", err)
+			fmt.Printf("error showing subcommand help: %v\n", err)
 		}
 		return nil
 	}
@@ -171,19 +171,15 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		if err != nil {
 			return fail(ctx, "Key check failed", "Failed to check provided key: %v", err)
 		}
-		var authSuccessMsg string
 		switch key.Type {
 		case asymkey_model.KeyTypeDeploy:
-			authSuccessMsg = "Hi there! You've successfully authenticated with an SSH deploy key."
+			println("Hi there! You've successfully authenticated with the deploy key named " + key.Name + ", but Gitea does not provide shell access.")
 		case asymkey_model.KeyTypePrincipal:
-			authSuccessMsg = "Hi there! You've successfully authenticated with the SSH principal " + key.Content + "."
+			println("Hi there! You've successfully authenticated with the principal " + key.Content + ", but Gitea does not provide shell access.")
 		default:
-			authSuccessMsg = "Hi there, " + user.Name + "! You've successfully authenticated with the SSH key named " + key.Name + "."
+			println("Hi there, " + user.Name + "! You've successfully authenticated with the key named " + key.Name + ", but Gitea does not provide shell access.")
 		}
-		_, _ = fmt.Fprintf(c.ErrWriter, "%s\n%s",
-			authSuccessMsg,
-			"Gitea does not provide shell access. If this is unexpected, please setup Gitea under another SSH user or use container to deploy.",
-		)
+		println("If this is unexpected, please log in with password and setup Gitea under another user.")
 		return nil
 	} else if c.Bool("debug") {
 		log.Debug("SSH_ORIGINAL_COMMAND: %s", os.Getenv("SSH_ORIGINAL_COMMAND"))
@@ -198,34 +194,42 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		if git.DefaultFeatures().SupportProcReceive {
 			// for AGit Flow
 			if cmd == "ssh_info" {
-				cprintf(c, "%s", agit.SshInfoJson)
+				fmt.Print(`{"type":"agit","version":1}`)
 				return nil
 			}
 		}
 		return fail(ctx, "Too few arguments", "Too few arguments in cmd: %s", cmd)
 	}

-	var reqOwnerName, reqRepoName string
-	{
-		var ok bool
-		reqRepoPath := strings.TrimPrefix(sshCmdArgs[1], "/")
-		reqOwnerName, reqRepoName, ok = strings.Cut(reqRepoPath, "/")
-		if !ok {
-			return fail(ctx, "Invalid repository path", "Invalid repository path: %v", reqRepoPath)
-		}
-		reqRepoName = strings.TrimSuffix(reqRepoName, ".git") // "the-repo-name" or "the-repo-name.wiki"
+	repoPath := strings.TrimPrefix(sshCmdArgs[1], "/")
+	repoPathFields := strings.SplitN(repoPath, "/", 2)
+	if len(repoPathFields) != 2 {
+		return fail(ctx, "Invalid repository path", "Invalid repository path: %v", repoPath)
 	}

-	if !repo_model.IsValidSSHAccessRepoName(reqRepoName) {
-		return fail(ctx, "Invalid repo name", "Invalid repo name: %s", reqRepoName)
+	username := repoPathFields[0]
+	reponame := strings.TrimSuffix(repoPathFields[1], ".git") // “the-repo-name" or "the-repo-name.wiki"
+
+	if !repo_model.IsValidSSHAccessRepoName(reponame) {
+		return fail(ctx, "Invalid repo name", "Invalid repo name: %s", reponame)
 	}

 	if c.Bool("enable-pprof") {
-		stopProfiler, err := pprof.DumpPprofForUsername(setting.PprofDataPath, reqOwnerName)
-		if err != nil {
-			return fail(ctx, "Unable to start pprof profiler", "Unable to start pprof profile: %v", err)
+		if err := os.MkdirAll(setting.PprofDataPath, os.ModePerm); err != nil {
+			return fail(ctx, "Error while trying to create PPROF_DATA_PATH", "Error while trying to create PPROF_DATA_PATH: %v", err)
 		}
-		defer stopProfiler()
+
+		stopCPUProfiler, err := pprof.DumpCPUProfileForUsername(setting.PprofDataPath, username)
+		if err != nil {
+			return fail(ctx, "Unable to start CPU profiler", "Unable to start CPU profile: %v", err)
+		}
+		defer func() {
+			stopCPUProfiler()
+			err := pprof.DumpMemProfileForUsername(setting.PprofDataPath, username)
+			if err != nil {
+				_ = fail(ctx, "Unable to dump Mem profile", "Unable to dump Mem Profile: %v", err)
+			}
+		}()
 	}

 	verb, lfsVerb := sshCmdArgs[0], ""
@@ -250,38 +254,39 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		return fail(ctx, "Unknown git command", "Unknown git command %s %s", verb, lfsVerb)
 	}

-	results, extra := private.ServCommand(ctx, keyID, reqOwnerName, reqRepoName, requestedMode, verb, lfsVerb)
+	results, extra := private.ServCommand(ctx, keyID, username, reponame, requestedMode, verb, lfsVerb)
 	if extra.HasError() {
 		return fail(ctx, extra.UserMsg, "ServCommand failed: %s", extra.Error)
 	}

+	// because the original repoPath maybe redirected, we need to use the returned actual repository information
+	if results.IsWiki {
+		repoPath = repo_model.RelativeWikiPath(results.OwnerName, results.RepoName)
+	} else {
+		repoPath = repo_model.RelativePath(results.OwnerName, results.RepoName)
+	}
+
 	// LFS SSH protocol
 	if verb == git.CmdVerbLfsTransfer {
-		if results.IsWiki {
-			return fail(ctx, "LFS Transfer is not supported for wikis", "")
-		}
-		token, err := lfs.GetLFSAuthTokenWithBearer(lfs.AuthTokenOptions{Op: lfsVerb, UserID: results.UserID, UserExtDoerData: results.UserExtDoerData, RepoID: results.RepoID})
+		token, err := lfs.GetLFSAuthTokenWithBearer(lfs.AuthTokenOptions{Op: lfsVerb, UserID: results.UserID, RepoID: results.RepoID})
 		if err != nil {
 			return err
 		}
-		return lfstransfer.Main(ctx, results.OwnerName, results.RepoName, lfsVerb, token)
+		return lfstransfer.Main(ctx, repoPath, lfsVerb, token)
 	}

 	// LFS token authentication
 	if verb == git.CmdVerbLfsAuthenticate {
-		if results.IsWiki {
-			return fail(ctx, "LFS Authenticate is not supported for wikis", "")
-		}
-		lfsTokenHref := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, url.PathEscape(results.OwnerName), url.PathEscape(results.RepoName))
+		url := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, url.PathEscape(results.OwnerName), url.PathEscape(results.RepoName))

-		token, err := lfs.GetLFSAuthTokenWithBearer(lfs.AuthTokenOptions{Op: lfsVerb, UserID: results.UserID, UserExtDoerData: results.UserExtDoerData, RepoID: results.RepoID})
+		token, err := lfs.GetLFSAuthTokenWithBearer(lfs.AuthTokenOptions{Op: lfsVerb, UserID: results.UserID, RepoID: results.RepoID})
 		if err != nil {
 			return err
 		}

 		tokenAuthentication := &git_model.LFSTokenResponse{
 			Header: make(map[string]string),
-			Href:   lfsTokenHref,
+			Href:   url,
 		}
 		tokenAuthentication.Header["Authorization"] = token

@@ -293,7 +298,7 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		return nil
 	}

-	var command *process.Cmd
+	var command *exec.Cmd
 	gitBinPath := filepath.Dir(gitcmd.GitExecutable) // e.g. /usr/bin
 	gitBinVerb := filepath.Join(gitBinPath, verb)    // e.g. /usr/bin/git-upload-pack
 	if _, err := os.Stat(gitBinVerb); err != nil {
@@ -302,14 +307,15 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		verbFields := strings.SplitN(verb, "-", 2)
 		if len(verbFields) == 2 {
 			// use git binary with the sub-command part: "C:\...\bin\git.exe", "upload-pack", ...
-			command = process.CommandContext(ctx, gitcmd.GitExecutable, verbFields[1], results.RepoStoragePath)
+			command = exec.CommandContext(ctx, gitcmd.GitExecutable, verbFields[1], repoPath)
 		}
 	}
 	if command == nil {
 		// by default, use the verb (it has been checked above by allowedCommands)
-		command = process.CommandContext(ctx, gitBinVerb, results.RepoStoragePath)
+		command = exec.CommandContext(ctx, gitBinVerb, repoPath)
 	}

+	process.SetSysProcAttribute(command)
 	command.Dir = setting.RepoRootPath
 	command.Stdout = os.Stdout
 	command.Stdin = os.Stdin
@@ -317,20 +323,15 @@ func runServ(ctx context.Context, c *cli.Command) error {
 	command.Env = append(command.Env, os.Environ()...)
 	command.Env = append(command.Env,
 		repo_module.EnvRepoIsWiki+"="+strconv.FormatBool(results.IsWiki),
-
-		repo_module.EnvRepoUsername+"="+results.OwnerName,
 		repo_module.EnvRepoName+"="+results.RepoName,
-		repo_module.EnvRepoID+"="+strconv.FormatInt(results.RepoID, 10),
-
-		repo_module.EnvKeyID+"="+strconv.FormatInt(results.PublicKeyID, 10),
-
-		repo_module.EnvPusherID+"="+strconv.FormatInt(results.UserID, 10),
+		repo_module.EnvRepoUsername+"="+results.OwnerName,
 		repo_module.EnvPusherName+"="+results.UserName,
 		repo_module.EnvPusherEmail+"="+results.UserEmail,
-		repo_module.EnvPusherExtDoerData+"="+results.UserExtDoerData,
-
+		repo_module.EnvPusherID+"="+strconv.FormatInt(results.UserID, 10),
+		repo_module.EnvRepoID+"="+strconv.FormatInt(results.RepoID, 10),
 		repo_module.EnvPRID+"="+strconv.Itoa(0),
-
+		repo_module.EnvDeployKeyID+"="+strconv.FormatInt(results.DeployKeyID, 10),
+		repo_module.EnvKeyID+"="+strconv.FormatInt(results.KeyID, 10),
 		repo_module.EnvAppURL+"="+setting.AppURL,
 	)
 	// to avoid breaking, here only use the minimal environment variables for the "gitea serv" command.
@@ -342,8 +343,8 @@ func runServ(ctx context.Context, c *cli.Command) error {
 	}

 	// Update user key activity.
-	if results.PublicKeyID > 0 {
-		if err = private.UpdatePublicKeyInRepo(ctx, results.PublicKeyID, results.RepoID); err != nil {
+	if results.KeyID > 0 {
+		if err = private.UpdatePublicKeyInRepo(ctx, results.KeyID, results.RepoID); err != nil {
 			return fail(ctx, "Failed to update public key", "UpdatePublicKeyInRepo: %v", err)
 		}
 	}
@@ -244,8 +244,7 @@ func servePprof() {
 	_, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true)
 	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it.
 	log.Info("Starting pprof server on localhost:6060")
-	server := &http.Server{Addr: "localhost:6060", Handler: mux, ReadHeaderTimeout: 10 * time.Second}
-	log.Info("Stopped pprof server: %v", server.ListenAndServe())
+	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", mux))
 	finished()
 }

@@ -6,7 +6,6 @@ package cmd
 import (
 	"crypto/x509"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -94,25 +93,31 @@ func runACME(listenAddr string, m http.Handler) error {
 	myACME := certmagic.NewACMEIssuer(magic, certmagic.DefaultACME)
 	magic.Issuers = []certmagic.Issuer{myACME}

-	// Obtain certificates or renew them if necessary. ManageSync fails closed on
-	// renewal errors even when a still-valid certificate is already on disk, which
-	// takes HTTPS down on restart (https://github.com/go-gitea/gitea/issues/38519).
-	// Prefer keeping the existing cert and retrying renewals asynchronously.
-	ctx := graceful.GetManager().ShutdownContext()
-	err := magic.ManageSync(ctx, []string{setting.Domain})
+	// this obtains certificates or renews them if necessary
+	err := magic.ManageSync(graceful.GetManager().HammerContext(), []string{setting.Domain})
 	if err != nil {
-		cert, cacheErr := magic.CacheManagedCertificate(ctx, setting.Domain)
-		if cacheErr != nil || cert.Expired() {
-			return errors.Join(err, cacheErr)
-		}
-		log.Error("ACME certificate manage failed; continuing with existing certificate: %v", err)
-		if err := magic.ManageAsync(ctx, []string{setting.Domain}); err != nil {
-			log.Error("Failed to start async ACME management: %v", err)
-		}
+		return err
 	}

-	// certmagic only advertises its own ACME challenge protocol, applyTLSSettings appends ours
-	tlsConfig := applyTLSSettings(magic.TLSConfig())
+	tlsConfig := magic.TLSConfig()
+	tlsConfig.NextProtos = append(tlsConfig.NextProtos, "h2")
+
+	if version := toTLSVersion(setting.SSLMinimumVersion); version != 0 {
+		tlsConfig.MinVersion = version
+	}
+	if version := toTLSVersion(setting.SSLMaximumVersion); version != 0 {
+		tlsConfig.MaxVersion = version
+	}
+
+	// Set curve preferences
+	if curves := toCurvePreferences(setting.SSLCurvePreferences); len(curves) > 0 {
+		tlsConfig.CurvePreferences = curves
+	}
+
+	// Set cipher suites
+	if ciphers := toTLSCiphers(setting.SSLCipherSuites); len(ciphers) > 0 {
+		tlsConfig.CipherSuites = ciphers
+	}

 	if enableHTTPChallenge {
 		go func() {
@@ -12,82 +12,122 @@ import (
 	"gitea.dev/modules/graceful"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
+
+	"github.com/klauspost/cpuid/v2"
 )

 var tlsVersionStringMap = map[string]uint16{
+	"":        tls.VersionTLS12, // Default to tls.VersionTLS12
 	"tlsv1.0": tls.VersionTLS10,
 	"tlsv1.1": tls.VersionTLS11,
 	"tlsv1.2": tls.VersionTLS12,
 	"tlsv1.3": tls.VersionTLS13,
 }

-// toTLSVersion returns 0 when unset or unknown, which keeps the crypto/tls default
 func toTLSVersion(version string) uint16 {
-	version = strings.TrimSpace(strings.ToLower(version))
-	tlsVersion, ok := tlsVersionStringMap[version]
-	if !ok && version != "" {
+	tlsVersion, ok := tlsVersionStringMap[strings.TrimSpace(strings.ToLower(version))]
+	if !ok {
 		log.Warn("Unknown tls version: %s", version)
+		return 0
 	}
 	return tlsVersion
 }

 var curveStringMap = map[string]tls.CurveID{
-	"x25519":             tls.X25519,
-	"p256":               tls.CurveP256,
-	"p384":               tls.CurveP384,
-	"p521":               tls.CurveP521,
-	"mlkem1024":          tls.MLKEM1024,
-	"x25519mlkem768":     tls.X25519MLKEM768,
-	"secp256r1mlkem768":  tls.SecP256r1MLKEM768,
-	"secp384r1mlkem1024": tls.SecP384r1MLKEM1024,
+	"x25519": tls.X25519,
+	"p256":   tls.CurveP256,
+	"p384":   tls.CurveP384,
+	"p521":   tls.CurveP521,
 }

-// lookupAll resolves configured names, warning about and skipping the ones crypto/tls does not know
-func lookupAll[T comparable](names []string, table map[string]T, kind string) []T {
-	values := make([]T, 0, len(names))
-	for _, name := range names {
-		value, ok := table[strings.TrimSpace(strings.ToLower(name))]
+func toCurvePreferences(preferences []string) []tls.CurveID {
+	ids := make([]tls.CurveID, 0, len(preferences))
+	for _, pref := range preferences {
+		id, ok := curveStringMap[strings.TrimSpace(strings.ToLower(pref))]
 		if !ok {
-			log.Warn("Unknown %s: %s", kind, name)
-			continue
+			log.Warn("Unknown curve: %s", pref)
+		}
+		if id != 0 {
+			ids = append(ids, id)
 		}
-		values = append(values, value)
 	}
-	return values
+	return ids
 }

-// cipherStringMap is derived from crypto/tls so that suites Go adds or removes are picked up automatically
-var cipherStringMap = buildCipherStringMap()
+var cipherStringMap = map[string]uint16{
+	"rsa_with_rc4_128_sha":                      tls.TLS_RSA_WITH_RC4_128_SHA,
+	"rsa_with_3des_ede_cbc_sha":                 tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+	"rsa_with_aes_128_cbc_sha":                  tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+	"rsa_with_aes_256_cbc_sha":                  tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+	"rsa_with_aes_128_cbc_sha256":               tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
+	"rsa_with_aes_128_gcm_sha256":               tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+	"rsa_with_aes_256_gcm_sha384":               tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+	"ecdhe_ecdsa_with_rc4_128_sha":              tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+	"ecdhe_ecdsa_with_aes_128_cbc_sha":          tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+	"ecdhe_ecdsa_with_aes_256_cbc_sha":          tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+	"ecdhe_rsa_with_rc4_128_sha":                tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
+	"ecdhe_rsa_with_3des_ede_cbc_sha":           tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+	"ecdhe_rsa_with_aes_128_cbc_sha":            tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+	"ecdhe_rsa_with_aes_256_cbc_sha":            tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+	"ecdhe_ecdsa_with_aes_128_cbc_sha256":       tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+	"ecdhe_rsa_with_aes_128_cbc_sha256":         tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+	"ecdhe_rsa_with_aes_128_gcm_sha256":         tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	"ecdhe_ecdsa_with_aes_128_gcm_sha256":       tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	"ecdhe_rsa_with_aes_256_gcm_sha384":         tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+	"ecdhe_ecdsa_with_aes_256_gcm_sha384":       tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+	"ecdhe_rsa_with_chacha20_poly1305_sha256":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+	"ecdhe_ecdsa_with_chacha20_poly1305_sha256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+	"ecdhe_rsa_with_chacha20_poly1305":          tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+	"ecdhe_ecdsa_with_chacha20_poly1305":        tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+	"aes_128_gcm_sha256":                        tls.TLS_AES_128_GCM_SHA256,
+	"aes_256_gcm_sha384":                        tls.TLS_AES_256_GCM_SHA384,
+	"chacha20_poly1305_sha256":                  tls.TLS_CHACHA20_POLY1305_SHA256,
+}

-func buildCipherStringMap() map[string]uint16 {
-	ciphers := map[string]uint16{
-		// aliases for the two suites Go later renamed with a _SHA256 suffix
-		"ecdhe_rsa_with_chacha20_poly1305":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-		"ecdhe_ecdsa_with_chacha20_poly1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-	}
-	for _, cipher := range append(tls.CipherSuites(), tls.InsecureCipherSuites()...) {
-		ciphers[strings.ToLower(strings.TrimPrefix(cipher.Name, "TLS_"))] = cipher.ID
+func toTLSCiphers(cipherStrings []string) []uint16 {
+	ciphers := make([]uint16, 0, len(cipherStrings))
+	for _, cipherString := range cipherStrings {
+		cipher, ok := cipherStringMap[strings.TrimSpace(strings.ToLower(cipherString))]
+		if !ok {
+			log.Warn("Unknown cipher: %s", cipherString)
+		}
+		if cipher != 0 {
+			ciphers = append(ciphers, cipher)
+		}
 	}
+
 	return ciphers
 }

-// applyTLSSettings applies the configured [server] TLS options. Every option
-// left unset keeps the crypto/tls default, which Go keeps current.
-func applyTLSSettings(tlsConfig *tls.Config) *tls.Config {
-	// the listener is already TLS wrapped when it reaches http.Server, so it never sets ALPN for us
-	tlsConfig.NextProtos = append(tlsConfig.NextProtos, "h2", "http/1.1")
-	tlsConfig.MinVersion = toTLSVersion(setting.SSLMinimumVersion)
-	tlsConfig.MaxVersion = toTLSVersion(setting.SSLMaximumVersion)
-
-	if curves := lookupAll(setting.SSLCurvePreferences, curveStringMap, "curve"); len(curves) > 0 {
-		tlsConfig.CurvePreferences = curves
+// defaultCiphers uses hardware support to check if AES is specifically
+// supported by the CPU.
+//
+// If AES is supported AES ciphers will be preferred over ChaCha based ciphers
+// (This code is directly inspired by the certmagic code.)
+func defaultCiphers() []uint16 {
+	if cpuid.CPU.Supports(cpuid.AESNI) {
+		return defaultCiphersAESfirst
 	}
-	if ciphers := lookupAll(setting.SSLCipherSuites, cipherStringMap, "cipher suite"); len(ciphers) > 0 {
-		tlsConfig.CipherSuites = ciphers
-	}
-	return tlsConfig
+	return defaultCiphersChaChaFirst
 }

+var (
+	defaultCiphersAES = []uint16{
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	}
+
+	defaultCiphersChaCha = []uint16{
+		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+	}
+
+	defaultCiphersAESfirst    = append(defaultCiphersAES, defaultCiphersChaCha...)
+	defaultCiphersChaChaFirst = append(defaultCiphersChaCha, defaultCiphersAES...)
+)
+
 // runHTTPS listens on the provided network address and then calls
 // Serve to handle requests on incoming TLS connections.
 //
@@ -96,7 +136,33 @@ func applyTLSSettings(tlsConfig *tls.Config) *tls.Config {
 // certFile should be the concatenation of the server's certificate followed by the
 // CA's certificate.
 func runHTTPS(network, listenAddr, name, certFile, keyFile string, m http.Handler, useProxyProtocol, proxyProtocolTLSBridging bool) error {
-	tlsConfig := applyTLSSettings(&tls.Config{})
+	tlsConfig := &tls.Config{}
+	if tlsConfig.NextProtos == nil {
+		tlsConfig.NextProtos = []string{"h2", "http/1.1"}
+	}
+
+	if version := toTLSVersion(setting.SSLMinimumVersion); version != 0 {
+		tlsConfig.MinVersion = version
+	}
+	if version := toTLSVersion(setting.SSLMaximumVersion); version != 0 {
+		tlsConfig.MaxVersion = version
+	}
+
+	// Set curve preferences
+	tlsConfig.CurvePreferences = []tls.CurveID{
+		tls.X25519,
+		tls.CurveP256,
+	}
+	if curves := toCurvePreferences(setting.SSLCurvePreferences); len(curves) > 0 {
+		tlsConfig.CurvePreferences = curves
+	}
+
+	// Set cipher suites
+	tlsConfig.CipherSuites = defaultCiphers()
+	if ciphers := toTLSCiphers(setting.SSLCipherSuites); len(ciphers) > 0 {
+		tlsConfig.CipherSuites = ciphers
+	}
+
 	tlsConfig.Certificates = make([]tls.Certificate, 1)

 	certPEMBlock, err := os.ReadFile(certFile)
@@ -1,109 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"crypto/tls"
-	"math"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"gitea.dev/modules/setting"
-	"gitea.dev/modules/test"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestToTLSVersion(t *testing.T) {
-	assert.Zero(t, toTLSVersion(""), "unset must keep the crypto/tls default")
-	assert.Zero(t, toTLSVersion("unknown"))
-	assert.Equal(t, uint16(tls.VersionTLS12), toTLSVersion(" TLSV1.2 "))
-}
-
-func unsetTLSSettings(t *testing.T) {
-	t.Helper()
-	t.Cleanup(test.MockVariableValue(&setting.SSLMinimumVersion, ""))
-	t.Cleanup(test.MockVariableValue(&setting.SSLMaximumVersion, ""))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCurvePreferences, nil))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCipherSuites, nil))
-}
-
-// TestApplyTLSSettingsUnsetKeepsGoDefaults guards against reintroducing hardcoded defaults,
-// which is how the server ended up capped at TLS 1.2 and without post-quantum key exchange.
-// It asserts the fields are left alone rather than which algorithms Go then picks, so a new
-// Go release changing its preferences does not fail this test.
-func TestApplyTLSSettingsUnsetKeepsGoDefaults(t *testing.T) {
-	unsetTLSSettings(t)
-
-	tlsConfig := applyTLSSettings(&tls.Config{})
-	assert.Zero(t, tlsConfig.MinVersion)
-	assert.Zero(t, tlsConfig.MaxVersion)
-	assert.Nil(t, tlsConfig.CurvePreferences)
-	assert.Nil(t, tlsConfig.CipherSuites)
-	assert.Equal(t, []string{"h2", "http/1.1"}, tlsConfig.NextProtos)
-}
-
-func TestApplyTLSSettingsConfigured(t *testing.T) {
-	t.Cleanup(test.MockVariableValue(&setting.SSLMinimumVersion, "tlsv1.2"))
-	t.Cleanup(test.MockVariableValue(&setting.SSLMaximumVersion, "tlsv1.3"))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCurvePreferences, []string{"p384"}))
-	t.Cleanup(test.MockVariableValue(&setting.SSLCipherSuites, []string{"ecdhe_rsa_with_aes_256_gcm_sha384"}))
-
-	tlsConfig := applyTLSSettings(&tls.Config{})
-	assert.Equal(t, uint16(tls.VersionTLS12), tlsConfig.MinVersion)
-	assert.Equal(t, uint16(tls.VersionTLS13), tlsConfig.MaxVersion)
-	assert.Equal(t, []tls.CurveID{tls.CurveP384}, tlsConfig.CurvePreferences)
-	assert.Equal(t, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384}, tlsConfig.CipherSuites)
-}
-
-func TestHTTPSServesTLS13(t *testing.T) {
-	unsetTLSSettings(t)
-
-	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-	server.TLS = applyTLSSettings(&tls.Config{})
-	server.EnableHTTP2 = true
-	server.StartTLS()
-	defer server.Close()
-
-	conn, err := tls.Dial("tcp", strings.TrimPrefix(server.URL, "https://"), &tls.Config{InsecureSkipVerify: true})
-	require.NoError(t, err)
-	defer conn.Close()
-	assert.Equal(t, uint16(tls.VersionTLS13), conn.ConnectionState().Version)
-}
-
-// TestCurveStringMapCoversGoCurves fails when Go gains a curve the map does not name, so the
-// config vocabulary cannot silently go stale the way it did for the post-quantum key exchanges
-func TestCurveStringMapCoversGoCurves(t *testing.T) {
-	for id := range math.MaxUint16 + 1 {
-		name := tls.CurveID(id).String()
-		if strings.HasPrefix(name, "CurveID(") {
-			continue // crypto/tls has no name for this ID, so it supports no such curve
-		}
-		assert.Contains(t, curveStringMap, strings.TrimPrefix(strings.ToLower(name), "curve"), "curve %s", name)
-	}
-}
-
-// TestCipherStringMapCoversLegacyNames pins the names accepted before the map was derived
-// from crypto/tls, so no existing SSL_CIPHER_SUITES config silently stops resolving
-func TestCipherStringMapCoversLegacyNames(t *testing.T) {
-	for _, name := range []string{
-		"rsa_with_rc4_128_sha", "rsa_with_3des_ede_cbc_sha", "rsa_with_aes_128_cbc_sha",
-		"rsa_with_aes_256_cbc_sha", "rsa_with_aes_128_cbc_sha256", "rsa_with_aes_128_gcm_sha256",
-		"rsa_with_aes_256_gcm_sha384", "ecdhe_ecdsa_with_rc4_128_sha", "ecdhe_ecdsa_with_aes_128_cbc_sha",
-		"ecdhe_ecdsa_with_aes_256_cbc_sha", "ecdhe_rsa_with_rc4_128_sha", "ecdhe_rsa_with_3des_ede_cbc_sha",
-		"ecdhe_rsa_with_aes_128_cbc_sha", "ecdhe_rsa_with_aes_256_cbc_sha", "ecdhe_ecdsa_with_aes_128_cbc_sha256",
-		"ecdhe_rsa_with_aes_128_cbc_sha256", "ecdhe_rsa_with_aes_128_gcm_sha256", "ecdhe_ecdsa_with_aes_128_gcm_sha256",
-		"ecdhe_rsa_with_aes_256_gcm_sha384", "ecdhe_ecdsa_with_aes_256_gcm_sha384",
-		"ecdhe_rsa_with_chacha20_poly1305_sha256", "ecdhe_ecdsa_with_chacha20_poly1305_sha256",
-		"ecdhe_rsa_with_chacha20_poly1305", "ecdhe_ecdsa_with_chacha20_poly1305",
-		"aes_128_gcm_sha256", "aes_256_gcm_sha384", "chacha20_poly1305_sha256",
-	} {
-		assert.NotZero(t, cipherStringMap[name], "cipher %q", name)
-	}
-}
@@ -1,14 +1,12 @@
 # IDE and code editor configuration

 ## Table of Contents
-
 - [IDE and code editor configuration](#ide-and-code-editor-configuration)
  - [Microsoft Visual Studio Code](#microsoft-visual-studio-code)

 ## Microsoft Visual Studio Code
-
 Download Microsoft Visual Studio Code at https://code.visualstudio.com/ and follow instructions at https://code.visualstudio.com/docs/languages/go to setup Go extension for it.

-Create new directory `.vscode` in Gitea root folder and copy contents of folder [contrib/development/vscode](vscode/) to it. You can now use `Ctrl`+`Shift`+`B` to build gitea executable and `F5` to run it in debug mode.
+Create new directory `.vscode` in Gitea root folder and copy contents of folder [contrib/ide/vscode](vscode/) to it. You can now use `Ctrl`+`Shift`+`B` to build gitea executable and `F5` to run it in debug mode.

 Supported on Debian, Ubuntu, Red Hat, Fedora, SUSE Linux, MacOS and Microsoft Windows.
@@ -112,17 +112,15 @@
 ;;
 ;; expect PROXY protocol header on connections to https redirector, defaults to USE_PROXY_PROTOCOL
 ;REDIRECTOR_USE_PROXY_PROTOCOL =
-;; Minimum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
-;SSL_MIN_VERSION=
-;;
-;; Maximum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
+;; Minimum and maximum supported TLS versions
+;SSL_MIN_VERSION=TLSv1.2
 ;SSL_MAX_VERSION=
 ;;
-;; Comma-separated list of SSL curve preferences. Unset uses Go's default.
-;SSL_CURVE_PREFERENCES=
+;; SSL Curve Preferences
+;SSL_CURVE_PREFERENCES=X25519,P256
 ;;
-;; Comma-separated list of SSL cipher suites. Unset uses Go's default.
-;SSL_CIPHER_SUITES=
+;; SSL Cipher Suites
+;SSL_CIPHER_SUITES=; Will default to "ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305" if aes is supported by hardware, otherwise chacha will be first.
 ;;
 ;; Timeout for any write to the connection. (Set to -1 to disable all timeouts.)
 ;PER_WRITE_TIMEOUT = 30s
@@ -538,13 +536,6 @@ INTERNAL_TOKEN =
 ;; Leave it empty to apply the default policy, or set it to "unset" to disable Content-Security-Policy.
 ;CONTENT_SECURITY_POLICY_GENERAL =

-;; Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
-;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
-;; CIDR list: 1.2.3.0/8, 2001:db8::/32
-;; Wildcard hosts: *.mydomain.com, 192.168.100.*
-;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
-;ALLOWED_HOST_LIST = external
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [camo]
@@ -608,8 +599,7 @@ ENABLED = true
 ;; * https://github.com/hickford/git-credential-oauth
 ;; * https://github.com/git-ecosystem/git-credential-manager
 ;; * https://gitea.com/gitea/tea
-;; * Gitea App (the official Gitea mobile app)
-;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app
+;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea
 ;;
 ;; By default, OAuth2 applications can only use "http" and "https" as their redirect URI schemes.
 ;; If you need to use other schemes (e.g. for desktop applications), you can specify them here as a comma-separated list.
@@ -772,12 +762,7 @@ LEVEL = Info

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Git config options
-;; The format is `some.configKey = value`.
-;; These options will be written into the gitconfig file under "[git] HOME_PATH" when Gitea web starts.
-;; ATTENTION:
-;; * It only does "set" config, a removed config key from this section won't be removed from git config automatically.
-;; * Some config options might affect the behavior of git and fail Gitea's git operation,
-;;   make sure you know what you are doing before making changes.
+;; This section only does "set" config, a removed config key from this section won't be removed from git config automatically. The format is `some.configKey = value`.
 ;[git.config]
 ;diff.algorithm = histogram
 ;core.logAllRefUpdates = true
@@ -1029,7 +1014,7 @@ LEVEL = Info
 ;; If the charsets have equal confidence, tie-breaking will be done by order in this list
 ;; with charsets earlier in the list chosen in preference to those later.
 ;; Adding "defaults" will place the unused charsets at that position.
-;DETECTED_CHARSETS_ORDER = UTF-8, UTF-16BE, UTF-16LE, UTF-32BE, UTF-32LE, ISO-8859, windows-1252, ISO-8859, windows-1250, ISO-8859, ISO-8859, ISO-8859, windows-1253, ISO-8859, windows-1255, ISO-8859, windows-1251, windows-1256, KOI8-R, ISO-8859, windows-1254, Shift_JIS, GB18030, EUC-JP, EUC-KR, Big5, ISO-2022, ISO-2022, ISO-2022
+;DETECTED_CHARSETS_ORDER = UTF-8, UTF-16BE, UTF-16LE, UTF-32BE, UTF-32LE, ISO-8859, windows-1252, ISO-8859, windows-1250, ISO-8859, ISO-8859, ISO-8859, windows-1253, ISO-8859, windows-1255, ISO-8859, windows-1251, windows-1256, KOI8-R, ISO-8859, windows-1254, Shift_JIS, GB18030, EUC-JP, EUC-KR, Big5, ISO-2022, ISO-2022, ISO-2022, IBM424_rtl, IBM424_ltr, IBM420_rtl, IBM420_ltr
 ;;
 ;; Default ANSI charset to override non-UTF-8 charsets to
 ;ANSI_CHARSET =
@@ -1112,9 +1097,6 @@ LEVEL = Info
 ;; The default branch name of new repositories
 ;DEFAULT_BRANCH = main
 ;;
-;; The default Git object format of new repositories. Available values: sha1, sha256.
-;DEFAULT_OBJECT_FORMAT = sha1
-;;
 ;; Allow adoption of unadopted repositories
 ;ALLOW_ADOPTION_OF_UNADOPTED_REPOSITORIES = false
 ;;
@@ -1128,6 +1110,7 @@ LEVEL = Info
 ;ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT = true

 ;; Allow to fork repositories into the same owner (user or organization)
+;; This feature is experimental, not fully tested, and may be changed in the future
 ;ALLOW_FORK_INTO_SAME_OWNER = false

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1203,7 +1186,6 @@ LEVEL = Info
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
-;; "branch-name" always uses the PR's branch name.
 ;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
@@ -1317,21 +1299,6 @@ LEVEL = Info
 ;PROJECT_BOARD_BASIC_KANBAN_TYPE = To Do, In Progress, Done
 ;PROJECT_BOARD_BUG_TRIAGE_TYPE = Needs Triage, High Priority, Low Priority, Closed

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[websocket]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;
-;; Backend used to fan out websocket events (notification count, stopwatch, logout).
-;; "memory" works for a single process, use "redis" when running multiple Gitea processes.
-;PUBSUB_TYPE = memory
-;;
-;; Redis connection string, used when PUBSUB_TYPE = redis
-;; e.g. redis://127.0.0.1:6379/0
-;; When PUBSUB_TYPE is `redis` and this is left empty, it falls back to the shared [redis] CONN_STR.
-;PUBSUB_CONN_STR =
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[cors]
@@ -1491,6 +1458,10 @@ LEVEL = Info
 ;MIN_TIMEOUT = 10s
 ;MAX_TIMEOUT = 60s
 ;TIMEOUT_STEP = 10s
+;;
+;; This setting determines how often the db is queried to get the latest notification counts.
+;; If the browser client supports EventSource and SharedWorker, a SharedWorker will be used in preference to polling notification. Set to -1 to disable the EventSource
+;EVENT_SOURCE_UPDATE_TIME = 10s

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1619,19 +1590,6 @@ LEVEL = Info
 ;; If you'd like to enable it, you can set it to a value between 0 and 2.
 ;TYPE_BLEVE_MAX_FUZZINESS = 0

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[redis]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;
-;; Shared redis connection, used as the default for every redis-backed subsystem
-;; (cache, session, queue, global lock, etc.) whose own connection string is left empty.
-;; A per-subsystem connection value always takes precedence over this shared default.
-;; When left empty, each subsystem keeps its previous behavior (no shared default).
-;; e.g. `redis://127.0.0.1:6379/0` (or `redis+cluster://127.0.0.1:6379/0` for a Redis cluster)
-;CONN_STR =
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[queue]
@@ -1657,10 +1615,10 @@ LEVEL = Info
 ;; Batch size to send for batched queues
 ;BATCH_LENGTH = 20
 ;;
+;; Connection string for redis queues this will store the redis (or Redis cluster) connection string.
 ;; When `TYPE` is `persistable-channel`, this provides a directory for the underlying leveldb
 ;; or additional options of the form `leveldb://path/to/db?option=value&....`, and will override `DATADIR`.
-;; When `TYPE` is `redis` and this is left empty, it falls back to the shared [redis] CONN_STR.
-;CONN_STR =
+;CONN_STR = "redis://127.0.0.1:6379/0"
 ;;
 ;; Provides the suffix of the default redis/disk queue name - specific queues can be overridden within in their [queue.name] sections.
 ;QUEUE_NAME = "_queue"
@@ -1791,6 +1749,13 @@ LEVEL = Info
 ;; Deliver timeout in seconds
 ;DELIVER_TIMEOUT = 5
 ;;
+;; Webhook can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
+;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
+;; CIDR list: 1.2.3.0/8, 2001:db8::/32
+;; Wildcard hosts: *.mydomain.com, 192.168.100.*
+;; Since 1.15.7. Default to * for 1.15.x, external for 1.16 and later
+;ALLOWED_HOST_LIST = external
+;;
 ;; Allow insecure certification
 ;SKIP_TLS_VERIFY = false
 ;;
@@ -1958,7 +1923,7 @@ LEVEL = Info
 ;INTERVAL = 60
 ;;
 ;; For "redis" and "memcache", connection host address
-;; redis: default to shared [redis] CONN_STR
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
 ;; memcache: `127.0.0.1:11211`
 ;; twoqueue: `{"size":50000,"recent_ratio":0.25,"ghost_ratio":0.5}` or `50000`
 ;HOST =
@@ -1978,6 +1943,9 @@ LEVEL = Info
 ;; Time to keep items in cache if not used, default is 8760 hours.
 ;; Setting it to -1 disables caching
 ;ITEM_TTL = 8760h
+;;
+;; Only enable the cache when repository's commits count great than
+;COMMITS_COUNT = 1000

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1991,10 +1959,10 @@ LEVEL = Info
 ;;
 ;; Provider config options
 ;; memory: doesn't have any config yet
-;; file: session file path, e.g. `data/sessions`, relative paths will be made absolute against _`AppWorkPath`_.
-;; redis: default to [redis] CONN_STR
+;; file: session file path, e.g. `data/sessions`
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
 ;; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
-;PROVIDER_CONFIG =
+;PROVIDER_CONFIG = data/sessions ; Relative paths will be made absolute against _`AppWorkPath`_.
 ;;
 ;; Session cookie name
 ;COOKIE_NAME = i_like_gitea
@@ -2041,7 +2009,8 @@ LEVEL = Info
 ;; If the uploaded file is not larger than this byte size, the image will be used as is, without resizing/converting.
 ;AVATAR_MAX_ORIGIN_SIZE = 262144
 ;;
-;; "gravatar", "libravatar", or any other Gravatar-compatible source, like: https://cn.gravatar.com/avatar/
+;; Chinese users can choose "duoshuo"
+;; or a custom avatar source, like: http://cn.gravatar.com/avatar/
 ;GRAVATAR_SOURCE = gravatar
 ;;
 ;; Deprecated, see Web UI Admin Panel -> Config -> Settings
@@ -2287,18 +2256,6 @@ LEVEL = Info
 ;RUN_AT_START = true
 ;SCHEDULE = @midnight

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Delete action runs older than RUN_RETENTION_DAYS
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.cleanup_action_runs]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Deletes nothing while RUN_RETENTION_DAYS is 0
-;ENABLED = true
-;RUN_AT_START = false
-;SCHEDULE = @midnight
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Clean-up deleted branches
@@ -3019,20 +2976,16 @@ LEVEL = Info
 ;;
 ;; Default platform to get action plugins, `github` for `https://github.com`, `self` for the current Gitea instance.
 ;DEFAULT_ACTIONS_URL = github
+;; Logs retention time in days. Old logs will be deleted after this period.
+;LOG_RETENTION_DAYS = 365
 ;; Log compression type, `none` for no compression, `zstd` for zstd compression.
 ;; Other compression types like `gzip` are NOT supported, since seekable stream is required for log view.
 ;; It's always recommended to use compression when using local disk as log storage if CPU or memory is not a bottleneck.
 ;; And for object storage services like S3, which is billed for requests, it would cause extra 2 times of get requests for each log view.
 ;; But it will save storage space and network bandwidth, so it's still recommended to use compression.
 ;LOG_COMPRESSION = zstd
-;; Days to keep logs. Old logs will be deleted after this period. 0 means keep forever.
-;LOG_RETENTION_DAYS = 365
-;; Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever.
-;; Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded.
-;; Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
+;; Default artifact retention time in days. Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
 ;ARTIFACT_RETENTION_DAYS = 90
-;; Days to keep completed runs. Old runs and everything under them will be deleted after this period. 0 means keep forever.
-;RUN_RETENTION_DAYS = 400
 ;; Timeout to stop the task which have running status, but haven't been updated for a long time
 ;ZOMBIE_TASK_TIMEOUT = 10m
 ;; Timeout to stop the tasks which have running status and continuous updates, but don't end for a long time
@@ -3044,16 +2997,8 @@ LEVEL = Info
 ;; Comma-separated list of workflow directories, the first one to exist
 ;; in a repo is used to find Actions workflow files
 ;WORKFLOW_DIRS = .gitea/workflows,.github/workflows
-;; Comma-separated list of scoped workflow directories in a source repository, the first one to exist is used.
-;; Files here are picked up only when the repo is registered as a scoped-workflow source; in any other repo they neither run repo-level nor scope-level.
-;; Must not overlap with WORKFLOW_DIRS. Leave empty so no directory is scanned; no scoped workflows are found or run.
-;SCOPED_WORKFLOW_DIRS = .gitea/scoped_workflows
 ;; Maximum number of attempts a single workflow run can have. Default value is 50.
 ;MAX_RERUN_ATTEMPTS = 50
-;; Maximum number of runners that may run the task-assignment query concurrently, per Gitea instance.
-;; Caps this instance's DB load when many runners poll at once; excess runners retry on their next poll.
-;; In a multi-instance deployment the cluster-wide limit is this value times the number of instances. Default value is 16.
-;MAX_CONCURRENT_TASK_PICKS = 16

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -3068,5 +3013,5 @@ LEVEL = Info
 ;[global_lock]
 ;; Lock service type, could be memory or redis
 ;SERVICE_TYPE = memory
-;; Ignored for the "memory" type. For "redis", default to [redis] CONN_STR.
+;; Ignored for the "memory" type. For "redis" use something like `redis://127.0.0.1:6379/0`
 ;SERVICE_CONN_STR =
@@ -1,67 +0,0 @@
-# Setup and requirements
-
-This document lists the tools you need to build Gitea from source and how to get
-the code. Once your environment is ready, see [development.md](development.md) for
-the build and development workflow, and [testing.md](testing.md) for running tests.
-
-For the contribution workflow and review process, see [CONTRIBUTING.md](../CONTRIBUTING.md).
-
-## Requirements
-
-### Go
-
-[Install Go](https://go.dev/doc/install) and set up your Go environment. The
-required version is the one declared in [`go.mod`](../go.mod); installing the same
-version your continuous integration uses avoids `gofmt` differences between Go
-releases.
-
-> [!NOTE]
-> Some `make` tasks build external Go tools on demand (for example `make
-> watch-backend`). To use them, the `"$GOPATH"/bin` directory must be on your
-> executable `PATH`; otherwise you have to manage those tools yourself.
-
-### Node.js and pnpm
-
-[Install Node.js](https://nodejs.org/en/download/) to build the JavaScript and CSS
-files. The minimum supported version is the one declared in
-[`package.json`](../package.json) (`engines.node`); the latest LTS is recommended.
-
-Gitea manages frontend dependencies with [pnpm](https://pnpm.io/). The `make`
-targets invoke it for you, so installing pnpm manually is only needed if you want
-to run `pnpm` commands directly.
-
-### Make
-
-Gitea uses [Make](https://www.gnu.org/software/make/) to drive builds, linting, and
-tests. On Windows it can be installed via [MSYS2](https://www.msys2.org/) or
-[Chocolatey](https://chocolatey.org/packages/make).
-
-### Python with uv (optional)
-
-Linting the templates, workflow files, and YAML requires Python tooling that Gitea
-runs through [uv](https://docs.astral.sh/uv/). After installing uv, `make` creates
-the environment automatically (`uv sync`); you only need this if you run
-`make lint-templates`, `make lint-yaml`, or `make lint-actions` locally.
-
-### Git LFS
-
-The integration tests require [Git LFS](https://git-lfs.com/) to be installed.
-
-## Getting the source code
-
-Clone the repository:
-
-```bash
-git clone https://github.com/go-gitea/gitea
-```
-
-To contribute changes, [fork the repository](https://github.com/go-gitea/gitea) on
-GitHub and add your fork as a git remote so you can push branches and open pull
-requests. See GitHub's [working with forks](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks)
-documentation for the details.
-
-## Installing dependencies
-
-Most build and test targets install the dependencies they need on their own. To
-fetch everything up front, run `make deps` (or the per-group `make deps-frontend`,
-`make deps-backend`, `make deps-tools`, `make deps-py`).
@@ -1,92 +0,0 @@
-# Prepare build environment
-
-Complete the steps in [build-setup.md](build-setup.md) to prepare your environment for building Gitea from source.
-
-## Choose a branch
-
-By default, the cloned repository is on main branch (the current development branch for next major release, aka: main nightly).
-
-You can switch to a versioned branch (the branch for the next minor stable release, aka: stable nightly )
-or a versioned tag (matches the official releases with version numbers)
-
-To test a Pull Request, you can fetch its code by its Pull Request number (take `PR #123456` as example):
-
-```bash
-git fetch origin pull/123456/head:pr-123456
-```
-
-# Build
-
-Various [make tasks](https://github.com/go-gitea/gitea/blob/main/Makefile)
-are provided to keep the build process as simple as possible.
-
-Depending on requirements, the following build tags can be included.
-
- `bindata`: Build a single monolithic binary, with all assets included. Required for distribution and production build.
- `pam`: Enable support for PAM (Linux Pluggable Authentication Modules).
-  Can be used to authenticate local users or extend authentication to methods available to PAM.
- `gogit`: (EXPERIMENTAL) Use go-git variants of Git commands.
-
-To include all assets, use the `bindata` tag:
-
-```bash
-TAGS="bindata" make build
-```
-
-Tag `gogit` is used to try to resolve some Windows-specific performance problems, POSIX systems don't need it.
-You can build a Windows binary by:
-
-```bash
-GOOS=windows TAGS="bindata gogit" make build
-```
-
-## Changing default paths
-
-Gitea will search for a number of things from the _`CustomPath`_.
-By default, this is the `custom/` directory in the current working directory when running Gitea.
-It will also look for its configuration file _`CustomConf`_ in `$(CustomPath)/conf/app.ini`,
-and will use the current working directory as the relative base path _`AppWorkPath`_.
-
-These values, although useful when developing, may conflict with downstream users preferences.
-
-For packagers who need to use paths like `/etc/gitea/app.ini`,
-they should define these values at build time for `make build` by environment variable like
-`LDFLAGS='-X "module.Var1=Value1" -X "module.Var2=Value2"' TAGS="bindata" make build`.
-
- _`CustomConf`_: `-X "gitea.dev/modules/setting.CustomConf=/etc/gitea/app.ini"`
- _`AppWorkPath`_: `-X "gitea.dev/modules/setting.AppWorkPath=/var/lib/gitea"`
- _`CustomPath`_: `-X "gitea.dev/modules/setting.CustomPath=/var/lib/gitea/custom"`
- Default PID file location: `-X "gitea.dev/cmd.PIDFile=/run/gitea.pid"`
-
-Add as many of the strings with their preceding `-X` to the `LDFLAGS` variable and run `make build`
-with the appropriate `TAGS` as above.
-
-Running `gitea help` will allow you to review what the computed settings will be for your `gitea`.
-
-## Cross Build
-
-Gitea use's Golang's toolchain variables for cross-building.
-
-For example, to cross build for Linux ARM64:
-
-```
-GOOS=linux GOARCH=arm64 TAGS="bindata" make build
-```
-
-### Adding shell autocompletion
-
-Shell completion can be generated directly from binary with:
-```sh
-gitea completion <shell>
-```
-
-Supported values for `<shell>` are `bash`, `fish`, `pwsh` and `zsh`.
-Details on how to load the completion for your shell can be found in the completion command help.
-
-## Source Maps
-
-By default, gitea generates reduced source maps for frontend files to conserve space. This can be controlled with the `ENABLE_SOURCEMAP` environment variable:
-
- `ENABLE_SOURCEMAP=true` generates all source maps, the default for development builds
- `ENABLE_SOURCEMAP=reduced` generates limited source maps, the default for production builds
- `ENABLE_SOURCEMAP=false` generates no source maps
@@ -95,15 +95,8 @@ However, if there are no objections from maintainers, the PR can be merged with
 ### Commit messages

 Mergers are required to rewrite the PR title and the first comment (the summary) when necessary so the squash commit message is clear.
-Usually the Pull Request description and commit message body should not be empty, unless the title is already clear enough or the description would be a copy of the comments in code.

-The final commit message:
-
- should match the code changes.
- should only keep true co-authors, false-positive co-authors should be removed.
- should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
- should not contain hidden information like `<!-- -->` or extra information after the description's divider `----`.
- should not contain unrelated contents (e.g.: Release Notes, Configuration, etc.) from a Renovate update PR.
+The final commit message should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.

 #### PR Co-authors

@@ -165,25 +158,13 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:

 - Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
- Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
-  In particular, mergers should edit the PR description.\
-  Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.
+- Rewriting the PR title and summary so the squash [commit message](#commit-messages) is clear, removing false-positive co-authors while keeping every true co-author.
 - Assigning the correct labels (including `type/…`) needed for changelog and backport decisions.
 - Agreeing, together with the owners, on when a release is ready (see [release management](release-management.md)).
- Merging a PR also means the PR looks good to the merger and is approved by the merger.
-
-If a merger violates these merge guides more than 3 times in the past 365 days
-(e.g.: merge with unresolved reviews without TOC decision to ignore the review, merge with garbage commit messages),
-they may lose their merging privileges for at least three months.

 #### Becoming a merger

-A merger must already be a Gitea maintainer.
-To apply, use the [Discord](https://discord.gg/Gitea) `#maintainers` channel.
-The minimum requirement for applications to become a merger is to have participated actively in the community for at least four months before applying.
-Ultimately, regardless of previous participation, you can only become a merger if the TOC votes in your favor.
-
-You may also be invited by the TOC to become a merger.
+A merger should already be a Gitea maintainer. To apply, use the [Discord](https://discord.gg/Gitea) `#maintainers` channel. Mergers teams may also invite contributors.

 ### Technical Oversight Committee (TOC)

@@ -204,30 +185,17 @@ As long as seats are empty in the TOC, members of the previous TOC can fill them

 If an elected member that accepts the seat does not have 2FA configured yet, they will be temporarily counted as `answer pending` until they manage to configure 2FA, thus leaving their seat empty for this duration.

-If multiple persons have the same amount of votes, a random draw will be used to determine the order of the candidates with the same amount of votes, and thus who gets the seat first.
-The candidates will be placed in the list in an alphabetical insensitive order by their username.
-We use this script to determine the order of candidates with the same amount of votes:
-
-```python
-import random
-random.seed("Gitea TOC <YEAR> Election")
-random.choice([<CANDIDATE_1>, <CANDIDATE_2>, ...])
-```
-
-The result of this script needs then to be published in the TOC election issue to ensure transparency of the process.
-
 ### Current TOC members

- 2026-06-14 ~ 2026-12-31
+- 2025-01-01 ~ 2026-06-14
  - Company
-    - [Yu Tian](https://gitea.com/Zettat123) <zettat123@gmail.com>
+    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
  - Community
-    - [bircni](https://gitea.com/bircni) <bircni@icloud.com>
+    - [6543](https://gitea.com/6543) <6543@obermui.de>
    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
-    - [TheFox0x7](https://gitea.com/TheFox0x7) <thefox0x7@gmail.com>
-
+    - [lafriks](https://gitea.com/lafriks) <lauris@nix.lv>

 ### Previous TOC/owners members

@@ -236,12 +204,12 @@ Here's the history of the owners and the time they served:
 - [Lunny Xiao](https://gitea.com/lunny) - 2016, 2017, [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
 - [Kim Carlbäcker](https://github.com/bkcsoft) - 2016, 2017
 - [Thomas Boerger](https://gitea.com/tboerger) - 2016, 2017
- [Lauris Bukšis](https://gitea.com/lafriks) - [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), 2025
+- [Lauris Bukšis-Haberkorns](https://gitea.com/lafriks) - [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801)
 - [Matti Ranta](https://gitea.com/techknowlogick) - [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
 - [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [6543](https://gitea.com/6543) - 2023, 2025
+- [6543](https://gitea.com/6543) - 2023
 - [John Olheiser](https://gitea.com/jolheiser) - 2023, 2024
- [Jason Song](https://gitea.com/wolfogre) - 2023, 2025
+- [Jason Song](https://gitea.com/wolfogre) - 2023

 ## Governance Compensation

@@ -1,141 +0,0 @@
-# Development
-
-This document describes how to build Gitea from source and the day-to-day
-development workflow. For prerequisites and how to obtain the code, see
-[build-setup.md](build-setup.md). For running tests, see [testing.md](testing.md). For the
-contribution workflow and review process, see [CONTRIBUTING.md](../CONTRIBUTING.md).
-
-Area-specific guidelines:
-
- [Backend development guidelines](guidelines-backend.md)
- [Frontend development guidelines](guidelines-frontend.md)
- [Refactoring guidelines](guidelines-refactoring.md)
-
-## Building
-
-To build Gitea for development, run:
-
-```bash
-make build
-```
-
-No build tags are required: SQLite support is compiled in by default, which is
-enough for local development. The `build` target runs two sub-targets, `frontend`
-and `backend`. The `bindata` tag embeds the frontend assets into the binary and is
-only needed when packaging a self-contained build, so leave it out during
-development.
-
-See `make help` for all available targets, and the workflows in
-[`.github/workflows`](https://github.com/go-gitea/gitea/tree/main/.github/workflows)
-to see how continuous integration builds and checks Gitea.
-
-## Building continuously
-
-To rebuild automatically when source files change:
-
-```bash
-# watch both frontend and backend
-make watch
-
-# or watch only the frontend (starts the Vite dev server)
-make watch-frontend
-
-# or watch only the backend (Go)
-make watch-backend
-```
-
-Watching all backend source files may hit the default open-files limit on macOS or
-Linux; raise it with `ulimit -n 12288` for the current shell, or in your shell
-startup file to make it permanent.
-
-## Formatting, linting and checks
-
-Continuous integration rejects pull requests that fail formatting, linting, or
-consistency checks. Format your code first:
-
-```bash
-make fmt
-```
-
-Then lint:
-
-```bash
-# lint everything
-make lint
-# or only one side
-make lint-backend
-make lint-frontend
-```
-
-Many linters can fix issues automatically with `make lint-fix` (or the scoped
-`make lint-backend-fix` / `make lint-frontend-fix`). The combined consistency
-checks that CI runs are available as `make checks`.
-
-## Building and adding SVGs
-
-SVG icons are built with `make svg`, which compiles the icon sources into
-`public/assets/img/svg`. Custom icons can be added under `web_src/svg`.
-
-## Updating the API
-
-When you create or change API routes, you **must** update the
-[Swagger](https://swagger.io/docs/specification/2-0/what-is-swagger/) documentation
-using [go-swagger](https://goswagger.io/) comments. See the
-[backend development guidelines](guidelines-backend.md) for how API routes,
-request/response structs, and swagger definitions fit together.
-
-Regenerate and validate the spec after changing an endpoint, then commit the
-updated JSON:
-
-```bash
-make generate-swagger
-make swagger-validate
-```
-
-CI verifies the committed spec is up to date with:
-
-```bash
-make swagger-check
-```
-
-## Creating new configuration options
-
-When adding configuration options it is not enough to add them to the
-`modules/setting` files. Also update
-[`custom/conf/app.example.ini`](../custom/conf/app.example.ini), and document them in
-the [configuration cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet),
-which lives in the [documentation repository](https://gitea.com/gitea/docs).
-
-## Database migrations
-
-If you make breaking changes to a database-persisted struct under `models/`, add a
-new migration in `modelmigration/`. See [testing.md](testing.md#migration-tests)
-for running the migration tests.
-
-## Testing
-
-For unit, integration, end-to-end, and migration tests, see [testing.md](testing.md).
-
-## IDE configuration
-
-### Visual Studio Code
-
-A `launch.json` and `tasks.json` are provided in
-[`contrib/development/vscode`](../contrib/development/vscode). See
-[`contrib/development/README.md`](../contrib/development/README.md) for details.
-
-### GoLand
-
-Clicking the `Run Application` arrow on `func main()` in `/main.go` starts a
-debuggable Gitea instance.
-
-The `Output Directory` in `Run/Debug Configuration` **must** be set to the Gitea
-project directory (the one containing `main.go` and `go.mod`). Otherwise the working
-directory is a GoLand temporary directory, which prevents Gitea from loading dynamic
-resources (such as templates) in development.
-
-## Submitting your changes
-
-Push your branch and open a pull request. See [CONTRIBUTING.md](../CONTRIBUTING.md)
-for the review process and PR requirements. For help, join the `#Develop` channel on
-[Discord](https://discord.gg/gitea).
@@ -0,0 +1,63 @@
+# Backend development
+
+This document covers backend-specific contribution expectations. For general contribution workflow, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+For coding style and architecture, see also the [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend) on the documentation site.
+
+## Dependencies
+
+Go dependencies are managed using [Go Modules](https://go.dev/cmd/go/#hdr-Module_maintenance). \
+You can find more details in the [go mod documentation](https://go.dev/ref/mod) and the [Go Modules Wiki](https://github.com/golang/go/wiki/Modules).
+
+Pull requests should only modify `go.mod` and `go.sum` where it is related to your change, be it a bugfix or a new feature. \
+Apart from that, these files should only be modified by Pull Requests whose only purpose is to update dependencies.
+
+The `go.mod`, `go.sum` update needs to be justified as part of the PR description,
+and must be verified by the reviewers and/or merger to always reference
+an existing upstream commit.
+
+## API v1
+
+The API is documented by [swagger](https://gitea.com/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).
+
+### GitHub API compatibility
+
+Gitea's API should use the same endpoints and fields as the GitHub API as far as possible, unless there are good reasons to deviate. \
+If Gitea provides functionality that GitHub does not, a new endpoint can be created. \
+If information is provided by Gitea that is not provided by the GitHub API, a new field can be used that doesn't collide with any GitHub fields. \
+Updating an existing API should not remove existing fields unless there is a really good reason to do so. \
+The same applies to status responses. If you notice a problem, feel free to leave a comment in the code for future refactoring to API v2 (which is currently not planned).
+
+### Adding/Maintaining API routes
+
+All expected results (errors, success, fail messages) must be documented ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L319-L327)). \
+All JSON input types must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L76-L91)) \
+and referenced in [routers/api/v1/swagger/options.go](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/options.go). \
+They can then be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L318). \
+All JSON responses must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L36-L68)) \
+and referenced in its category in [routers/api/v1/swagger/](routers/api/v1/swagger/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/issue.go#L11-L16)) \
+They can be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L277-L279).
+
+### When to use what HTTP method
+
+In general, HTTP methods are chosen as follows:
+
+- **GET** endpoints return the requested object(s) and status **OK (200)**
+- **DELETE** endpoints return the status **No Content (204)** and no content either
+- **POST** endpoints are used to **create** new objects (e.g. a User) and return the status **Created (201)** and the created object
+- **PUT** endpoints are used to **add/assign** existing Objects (e.g. a user to a team) and return the status **No Content (204)** and no content either
+- **PATCH** endpoints are used to **edit/change** an existing object and return the changed object and the status **OK (200)**
+
+### Requirements for API routes
+
+All parameters of endpoints changing/editing an object must be optional (except the ones to identify the object, which are required).
+
+Endpoints returning lists must
+
+- support pagination (`page` & `limit` options in query)
+- set `X-Total-Count` header via **SetTotalCountHeader** ([example](https://github.com/go-gitea/gitea/blob/7aae98cc5d4113f1e9918b7ee7dd09f67c189e3e/routers/api/v1/repo/issue.go#L444))
+
+### Knowledge
+
+- Partially database table migration must use `SyncWithOptions(IgnoreDrop...)`
+- Template variables with "camelCase" or "snake_case" are used for restoring the form values from a submitted form
@@ -0,0 +1,17 @@
+# Frontend development
+
+This document covers frontend-specific contribution expectations. For general contribution workflow, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+## Dependencies
+
+For the frontend, we use [npm](https://www.npmjs.com/).
+
+The same restrictions apply for frontend dependencies as for [backend dependencies](guideline-backend.md#dependencies), with the exceptions that the files for it are `package.json` and `package-lock.json`, and that new versions must always reference an existing version.
+
+## Design guideline
+
+Depending on your change, please read the
+
+- [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend)
+- [frontend development guideline](https://docs.gitea.com/contributing/guidelines-frontend)
+- [refactoring guideline](https://docs.gitea.com/contributing/guidelines-refactoring)
@@ -1,150 +0,0 @@
-# Backend development guidelines
-
-This document covers backend-specific architecture and contribution expectations.
-For the general workflow see [CONTRIBUTING.md](../CONTRIBUTING.md), and for building
-and testing see [development.md](development.md) and [testing.md](testing.md).
-
-## Background
-
-The backend is written in Go. Web routing is handled by
-[chi](https://github.com/go-chi/chi) and database access goes through the
-[XORM](https://xorm.io/) ORM. Understanding how the packages depend on each other is
-essential before contributing backend code.
-
-## Package design
-
-### Package layout
-
-The backend is split into top-level packages, each with a focused responsibility:
-
- `build`: helper scripts used at compile time
- `cmd`: subcommands such as `web`, `serv`, `hooks`, `doctor`, and admin utilities
- `models`: data structures and database operations (XORM); keeps external
-  dependencies to a minimum
-  - `models/db`: core database operations
-  - `models/fixtures`: sample data used by tests
- `modelmigration`: schema migration scripts
- `modules`: standalone functionality with few dependencies
-  - `modules/setting`: configuration handling
-  - `modules/git`: interaction with the Git command line
- `routers`: request handlers, split into `api`, `web`, `install`, and `private`
- `services`: business logic that ties routers and models together
- `templates`: Go HTML templates
- `public`: compiled frontend assets
- `tests`: integration and end-to-end test helpers
-
-### Dependency direction
-
-Dependencies only flow in one direction:
-
-```text
-cmd → routers → services → models → modules
-```
-
-A package on the left may import a package on its right, but never the reverse.
-
-### Naming conventions
-
- Top-level packages use the plural form: `services`, `models`, `routers`.
- Subpackages use the singular form: `services/user`, `models/repository`.
-
-When packages from different layers share a name, use a snake_case import alias to
-disambiguate:
-
-```go
-import user_service "gitea.dev/services/user"
-```
-
-### Database transactions
-
-Operations that must roll back together should run inside `db.WithTx()` (or
-`db.WithTx2()` when a value must be returned), defined in `models/db/context.go`.
-Functions that participate in a transaction take a `context.Context` as their first
-parameter so the transaction can be propagated.
-
-### XORM gotchas
-
- Never call `x.Update(exemplar)` without an explicit `WHERE` clause — it updates
-  every row in the table.
- Partial table migrations must use `SyncWithOptions(IgnoreDrop...)` rather than a
-  plain `Sync`.
- When inserting rows with preset IDs, MSSQL requires `SET IDENTITY_INSERT` to be
-  enabled and PostgreSQL requires the sequence to be updated afterwards.
-
-## Dependencies
-
-Go dependencies are managed with [Go Modules](https://go.dev/ref/mod).
-
-Pull requests should only modify `go.mod` and `go.sum` where it relates to the
-change at hand, be it a bug fix or a new feature. Otherwise, these files should only
-be touched by pull requests whose sole purpose is updating dependencies. Run
-`make tidy` after any change to `go.mod`.
-
-Any `go.mod` / `go.sum` update must be justified in the PR description and must be
-verified by reviewers and the merger to reference an existing upstream commit.
-
-## Golang HTML template
-
-Gitea uses Go's built-in HTML template engine which is dynamically & weakly typed.
-To make template code maintainable:
-
- Go code should take over complex logic and prepare template data as much as possible, templates only render the data.
- Prefer struct types provided by Go code instead of map types for template data.
- Avoid using single word names for non-local variables.
- Avoid passing `"root" $` or `"." .` to sub-templates, instead pass the specific data needed by the sub-template.
- Use explicit variable names instead of `.` to access data: ``{{range $item := $.TargetItems}}{{ $item.Name }}{{end}}``
- Use Go code to implement render helpers if the render logic is too complex.
-
-Using a modern and statically & strongly typed template engine to replace Golang HTML template might be good,
-but the challenge is huge, the requisites are:
-
- A working and maintainable proof-of-concept for the most complex templates (like "PR View" and "PR Diff").
- A firm commitment of sufficient engineering resources.
-
-## API v1
-
-The API is documented with [Swagger](https://gitea.com/api/swagger) and is modelled
-on [the GitHub API](https://docs.github.com/en/rest).
-
-### GitHub API compatibility
-
-Gitea's API should use the same endpoints and fields as the GitHub API where
-possible, unless there is a good reason to deviate.
-
- If Gitea offers functionality GitHub does not, a new endpoint may be added.
- If Gitea exposes information the GitHub API does not, a new field may be added as
-  long as it does not collide with a GitHub field.
- Existing fields should not be removed unless there is a strong reason; the same
-  applies to status responses.
-
-If you notice a problem that would require a breaking change, leave a comment in the
-code for a future refactor to API v2 (which is currently not planned) rather than
-breaking v1.
-
-### Adding and maintaining API routes
-
- All possible results (errors, success, and failure messages) must be documented in
-  the swagger comments on the route.
- Every JSON request body must be defined as a struct in `modules/structs/` and
-  registered in [`routers/api/v1/swagger/options.go`](../routers/api/v1/swagger/options.go).
- Every JSON response must be defined as a struct in `modules/structs/` and
-  registered with its category under [`routers/api/v1/swagger/`](../routers/api/v1/swagger).
-
-### HTTP methods and status codes
-
-In general, choose HTTP methods as follows:
-
- **GET** returns the requested object(s) with status **200 OK**.
- **POST** creates a new object (e.g. a user) and returns **201 Created** with the
-  created object.
- **PUT** adds or assigns an existing object (e.g. a user to a team) and returns
-  **204 No Content** with no response body.
- **PATCH** edits an existing object and returns the changed object with **200 OK**.
- **DELETE** removes an object and returns **204 No Content** with no body.
-
-### Requirements for API routes
-
- All parameters of endpoints that edit an object must be optional, except those
-  needed to identify the object, which are required.
- Endpoints returning lists must support pagination (`page` and `limit` query
-  options) and set the `X-Total-Count` header via `ctx.SetTotalCountHeader(...)`.
@@ -1,101 +0,0 @@
-# Frontend development guidelines
-
-This document covers frontend-specific architecture and contribution expectations.
-For the general workflow see [CONTRIBUTING.md](../CONTRIBUTING.md), and for building
-and testing see [development.md](development.md) and [testing.md](testing.md).
-
-## Background
-
-The frontend uses [Vue 3](https://vuejs.org/), hard-forked Fomantic-UI (built on jQuery)
-and [Tailwind CSS](https://tailwindcss.com/). Pages are rendered with Go HTML templates.
-Source files live in:
-
- `web_src/css/`: CSS styles
- `web_src/js/`: JavaScript and TypeScript
- `web_src/js/components/`: Vue components
- `web_src/js/features/`: feature modules wired up at page load
- `templates/`: Go HTML templates
-
-## Dependencies
-
-Frontend dependencies are managed with [pnpm](https://pnpm.io/). The same rules as
-for [backend dependencies](guidelines-backend.md#dependencies) apply, except the
-relevant files are `package.json` and `pnpm-lock.yaml`, and new versions must always
-reference an existing published version.
-
-## Framework usage
-
-Mixing frameworks arbitrarily makes code hard to maintain. Recommended combinations:
-
- Vue3
- Vanilla JavaScript
- Fomantic-UI (jQuery), deprecated, we vendored a specific version with a lot of changes.
-
-Avoid combinations such as Vue with Fomantic-UI.
-Vue components may reuse Fomantic-UI CSS classes for visual consistency.
-Use Go templates for simple or SEO-relevant pages and Vue for complex, interactive pages.
-Gitea uses Vue 3 **without** JSX to keep HTML and JavaScript separate.
-
-> [!NOTE]
-> Fomantic-UI is not an accessibility-friendly framework. Gitea patches some ARIA
-> behavior, but accessibility work is ongoing — prefer semantic HTML and test
-> keyboard/screen-reader behavior where you can.
-
-## Gitea-specific conventions
-
- Keep features in their own files or directories.
- Use kebab-case for HTML `id`s and classes with 2-3 feature keywords.
- Prefix classes to avoid short-name conflicts between different frameworks.
- Our framework can automatically link "input" and "label" if they are the children of a `.field` element,
-  no need to write `id`/`for` attributes for them unless there are reasons to do so.
- Create a new class name when overriding framework styles instead of editing the framework's own classes,
-  or fix the framework's source to fix all cases.
- Prefer semantic elements such as `<button>` over generic `<div>`s.
- Avoid `!important`; when it is unavoidable, document why.
- Prefix custom DOM events with `ce-`.
-
-## CSS
-
-Prefer Tailwind utility classes with the `tw-` prefix, and the `flex-*` layout
-helpers over per-child margins. Gitea also ships a small set of custom helpers:
-`gt-` for general helpers and `g-` for framework-level helpers (see
-`web_src/css/helpers.css`); use these only when a Tailwind utility does not exist.
-
-Write class attributes as a single readable unit in templates:
-
-```html
-<div class="flex-text-inline {{if .IsFoo}}tw-hidden{{end}}"></div>
-```
-
-## TypeScript
-
- Use `import type` for type-only imports.
- Use the `!` non-null assertion (rather than `?.`/`??`) when a value is known to always exist.
- Only mark a function `async` when it actually uses `await` or returns a `Promise`.
-  Avoid async event listeners; if unavoidable, call `e.preventDefault()` before the first `await`.
-
-## Data fetching
-
-Use the `GET`, `POST`, `PUT`, `PATCH`, and `DELETE` wrappers from
-[`web_src/js/modules/fetch.ts`](../web_src/js/modules/fetch.ts).
-
-Prefer to use our [`fetch-action.ts`](../web_src/js/modules/fetch-action.ts) framework
-for form submissions, button clicks and network requests, which provides a consistent UX and error handling.
-
-## DOM attributes
-
-Avoid `node.dataset` because of its camel-casing behavior; use `node.getAttribute`
-in new code. Never bind user-provided data directly onto DOM nodes.
-
-## Showing and hiding elements
-
- In Vue, use `v-if` and `v-show`. If an element contains unmanaged DOM, use `v-show` to avoid losing the DOM state.
- In Go templates and plain JavaScript, use the `.tw-hidden` class together with the
-  `showElem()`, `hideElem()`, and `toggleElem()` helpers from
-  [`web_src/js/utils/dom.ts`](../web_src/js/utils/dom.ts).
-
-## UI component gallery
-
-When running Gitea in development mode, standardized UI components are available at
-`/devtest` (for example `http://localhost:3000/devtest`). These pages are also used
-by the e2e tests.
@@ -1,38 +0,0 @@
-# Refactoring guidelines
-
-This document covers expectations for refactoring work. For the general workflow see
-[CONTRIBUTING.md](../CONTRIBUTING.md).
-
-## Background
-
-Gitea is a large, long-lived project. Over time the codebase has accumulated
-outdated mechanisms, mixed frameworks, and legacy code that can cause bugs or slow
-down new features. Refactoring keeps the codebase maintainable, but it needs to be
-done carefully so it improves things without introducing regressions.
-
-## Writing a refactoring PR
-
- Be forward-looking: address the root cause, not just the immediate symptom.
- Aim to reduce ambiguity and conflicts and to improve maintainability.
- Explain the rationale in the PR description: why the refactor is necessary, how it
-  resolves the legacy problem, and its advantages and disadvantages.
- Keep the scope tight: preserve existing behavior where feasible and avoid bundling
-  unrelated changes.
- Break large refactors into intermediate steps across multiple PRs so each one is
-  easy to review.
- Include tests that verify the behavior stays correct.
- Prefer scheduling non-bugfix refactoring early in a milestone, so any issues
-  surface well before a release.
- If there is disagreement about a refactor, escalate to the Technical Oversight
-  Committee (TOC) for a decision.
-
-## Reviewing and merging
-
- Keep refactoring PRs short-lived (typically no more than 7 days) with quick review
-  cycles, and merge them promptly so they do not block on unrelated work.
- A non-author core member may approve and merge a refactoring PR after 7 days if the
-  TOC has raised no objection.
- Accept imperfect intermediate implementations as long as the final result improves
-  the codebase.
- A temporary regression caused by a necessary refactor is acceptable if it is fixed
-  promptly afterwards.
@@ -1,151 +0,0 @@
-# Testing
-
-Gitea has four kinds of automated tests: backend unit tests, integration tests,
-end-to-end (e2e) tests, and migration tests. Local runs default to SQLite, so no
-extra services are required to get started.
-
-For prerequisites see [build-setup.md](build-setup.md); for the build workflow see
-[development.md](development.md).
-
-## Unit tests
-
-Backend unit tests live in `*_test.go` files next to the code they cover. Set
-`GITEA_TEST_LOG_SQL=1` to log all SQL statements executed during the tests.
-
-```bash
-make test-backend
-```
-
-To run a single backend test, use `go test` directly or the `#` selector:
-
-```bash
-go test -run '^TestName$' ./modulepath/
-make test-backend#TestName
-```
-
-Frontend unit tests run with [Vitest](https://vitest.dev/) browser mode:
-
-```bash
-make test-frontend
-# single file:
-pnpm exec vitest <path-filter>
-```
-
-## Integration tests
-
-Integration tests exercise Gitea against a real database. They live in
-`tests/integration/` and require [Git LFS](https://git-lfs.com/) to be installed.
-The database is selected with `GITEA_TEST_DATABASE`; an empty value defaults to
-SQLite, which needs no external service:
-
-```bash
-make test-integration
-```
-
-Run a single integration test with the `#` selector:
-
-```bash
-make test-integration#TestName
-```
-
-If you hit errors such as a mismatched database version or SSH push failures, try a
-clean rebuild first:
-
-```bash
-make clean build
-```
-
-### Running against other databases
-
-Set `GITEA_TEST_DATABASE` together with the matching `TEST_*` connection variables.
-The commands below start a throwaway database container (press `Ctrl-C` to stop and
-remove it) and then run the tests against it.
-
-#### MySQL
-
-```bash
-docker run -e "MYSQL_DATABASE=test" -e "MYSQL_ALLOW_EMPTY_PASSWORD=yes" -p 3306:3306 --rm --name mysql mysql:latest
-```
-
-```bash
-GITEA_TEST_DATABASE=mysql TEST_MYSQL_HOST=localhost:3306 TEST_MYSQL_DBNAME=test TEST_MYSQL_USERNAME=root TEST_MYSQL_PASSWORD='' make test-integration
-```
-
-#### PostgreSQL
-
-PostgreSQL tests also use a MinIO container for object storage:
-
-```bash
-docker run -e "POSTGRES_DB=test" -e "POSTGRES_USER=postgres" -e "POSTGRES_PASSWORD=postgres" -p 5432:5432 --rm --name pgsql postgres:latest
-docker run --rm -p 9000:9000 -e MINIO_ROOT_USER=123456 -e MINIO_ROOT_PASSWORD=12345678 --name minio bitnamilegacy/minio:2023.8.31
-```
-
-```bash
-GITEA_TEST_DATABASE=pgsql TEST_MINIO_ENDPOINT=localhost:9000 TEST_PGSQL_HOST=localhost:5432 TEST_PGSQL_DBNAME=postgres TEST_PGSQL_USERNAME=postgres TEST_PGSQL_PASSWORD=postgres make test-integration
-```
-
-#### MSSQL
-
-```bash
-docker run -e "ACCEPT_EULA=Y" -e "MSSQL_PID=Standard" -e "SA_PASSWORD=MwantsaSecurePassword1" -p 1433:1433 --rm --name mssql microsoft/mssql-server-linux:latest
-```
-
-```bash
-GITEA_TEST_DATABASE=mssql TEST_MSSQL_HOST=localhost:1433 TEST_MSSQL_DBNAME=gitea_test TEST_MSSQL_USERNAME=sa TEST_MSSQL_PASSWORD=MwantsaSecurePassword1 make test-integration
-```
-
-### Running the database test workflow with Gitea Runner
-
-The CI database test jobs can be run locally with
-[Gitea Runner](https://gitea.com/gitea/runner). Running every job is
-resource-intensive and not recommended:
-
-```bash
-gitea-runner exec -W ./.github/workflows/pull-db-tests.yml --event=pull_request --default-actions-url="https://github.com" -i catthehacker/ubuntu:runner-latest
-```
-
-List the available job names, then run a single one:
-
-```bash
-gitea-runner exec -W ./.github/workflows/pull-db-tests.yml --event=pull_request --default-actions-url="https://github.com" -i catthehacker/ubuntu:runner-latest -l
-gitea-runner exec -W ./.github/workflows/pull-db-tests.yml --event=pull_request --default-actions-url="https://github.com" -i catthehacker/ubuntu:runner-latest -j <job_name>
-```
-
-## End-to-end tests
-
-End-to-end tests drive a running Gitea instance with [Playwright](https://playwright.dev/):
-
-```bash
-make test-e2e
-```
-
-To run a single e2e test file, pass it via `GITEA_TEST_E2E_FLAGS`:
-
-```bash
-GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e
-```
-
-Useful environment variables:
-
-| Variable | Description |
-| :--- | :--- |
-| `GITEA_TEST_E2E_DEBUG` | When set, show the Gitea server output. |
-| `GITEA_TEST_E2E_FLAGS` | Additional flags passed to Playwright, e.g. `--ui`. |
-| `GITEA_TEST_E2E_TIMEOUT_FACTOR` | Timeout multiplier (default: 4 on CI, 1 locally). |
-
-## Migration tests
-
-If you change a database-persisted struct under `models/` you will usually need a
-new migration in `modelmigration`. Run the migration tests with:
-
-```bash
-make test-migration
-```
-
-## Continuous integration
-
-CI runs the unit tests, runs the integration tests against every supported database,
-and tests migration from several recent Gitea versions. Please submit your pull
-request with additional unit and integration tests as appropriate. Prefer unit tests
-when the logic can be tested in isolation, and keep local integration and e2e tests
-fast (aim for sub-2s runtime).
@@ -1,8 +1,12 @@
+import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
+import deMorgan from 'eslint-plugin-de-morgan';
+import github from 'eslint-plugin-github';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
 import playwright from 'eslint-plugin-playwright';
 import regexp from 'eslint-plugin-regexp';
+import sonarjs from 'eslint-plugin-sonarjs';
 import stylistic from '@stylistic/eslint-plugin';
 import typescriptParser from '@typescript-eslint/parser';
 import typescriptPlugin from 'typescript-eslint';
@@ -12,6 +16,7 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
+import type {ESLint} from 'eslint';

 import unescapedHtmlLiteral from './tools/eslint-rules/unescaped-html-literal.ts';

@@ -32,6 +37,7 @@ const restrictedProperties = [

 export default defineConfig([
  globalIgnores([
+    'web_src/js/vendor',
    'web_src/fomantic',
    'public/assets/js',
  ]),
@@ -59,10 +65,14 @@ export default defineConfig([
      '@eslint-community/eslint-comments': comments,
      '@stylistic': stylistic,
      '@typescript-eslint': typescriptPlugin.plugin,
+      'array-func': arrayFunc,
+      'de-morgan': deMorgan,
      'gitea': {rules: {'unescaped-html-literal': unescapedHtmlLiteral}},
-      'import-x': importPlugin,
+      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
      regexp,
+      sonarjs,
      unicorn,
+      github,
      wc,
    },
    settings: {
@@ -76,9 +86,10 @@ export default defineConfig([
      '@eslint-community/eslint-comments/no-duplicate-disable': [2],
      '@eslint-community/eslint-comments/no-restricted-disable': [0],
      '@eslint-community/eslint-comments/no-unlimited-disable': [2],
+      '@eslint-community/eslint-comments/no-unused-disable': [2],
      '@eslint-community/eslint-comments/no-unused-enable': [2],
      '@eslint-community/eslint-comments/no-use': [0],
-      '@eslint-community/eslint-comments/require-description': [2, {ignore: ['eslint', 'eslint-enable', 'eslint-env', 'exported', 'global', 'globals']}],
+      '@eslint-community/eslint-comments/require-description': [0],
      '@stylistic/array-bracket-newline': [0],
      '@stylistic/array-bracket-spacing': [2, 'never'],
      '@stylistic/array-element-newline': [0],
@@ -90,17 +101,14 @@ export default defineConfig([
      '@stylistic/comma-spacing': [2, {before: false, after: true}],
      '@stylistic/comma-style': [2, 'last'],
      '@stylistic/computed-property-spacing': [2, 'never'],
-      '@stylistic/curly-newline': [0],
      '@stylistic/dot-location': [2, 'property'],
      '@stylistic/eol-last': [2],
-      '@stylistic/exp-list-style': [0],
      '@stylistic/function-call-argument-newline': [0],
      '@stylistic/function-call-spacing': [2, 'never'],
      '@stylistic/function-paren-newline': [0],
      '@stylistic/generator-star-spacing': [0],
      '@stylistic/implicit-arrow-linebreak': [0],
      '@stylistic/indent': [2, 2, {ignoreComments: true, SwitchCase: 1}],
-      '@stylistic/indent-binary-ops': [0],
      '@stylistic/key-spacing': [2],
      '@stylistic/keyword-spacing': [2],
      '@stylistic/line-comment-position': [0],
@@ -109,7 +117,6 @@ export default defineConfig([
      '@stylistic/lines-between-class-members': [0],
      '@stylistic/max-len': [0],
      '@stylistic/max-statements-per-line': [0],
-      '@stylistic/member-delimiter-style': [0],
      '@stylistic/multiline-comment-style': [0],
      '@stylistic/multiline-ternary': [0],
      '@stylistic/new-parens': [2],
@@ -148,9 +155,6 @@ export default defineConfig([
      '@stylistic/switch-colon-spacing': [2],
      '@stylistic/template-curly-spacing': [2, 'never'],
      '@stylistic/template-tag-spacing': [2, 'never'],
-      '@stylistic/type-annotation-spacing': [0],
-      '@stylistic/type-generic-spacing': [0],
-      '@stylistic/type-named-tuple-spacing': [0],
      '@stylistic/wrap-iife': [2, 'inside'],
      '@stylistic/wrap-regex': [0],
      '@stylistic/yield-star-spacing': [2, 'after'],
@@ -189,6 +193,7 @@ export default defineConfig([
      '@typescript-eslint/no-duplicate-type-constituents': [2, {ignoreUnions: true}],
      '@typescript-eslint/no-dynamic-delete': [0],
      '@typescript-eslint/no-empty-function': [0],
+      '@typescript-eslint/no-empty-interface': [0],
      '@typescript-eslint/no-empty-object-type': [2],
      '@typescript-eslint/no-explicit-any': [0],
      '@typescript-eslint/no-extra-non-null-assertion': [2],
@@ -201,11 +206,11 @@ export default defineConfig([
      '@typescript-eslint/no-invalid-this': [0],
      '@typescript-eslint/no-invalid-void-type': [0],
      '@typescript-eslint/no-loop-func': [0],
+      '@typescript-eslint/no-loss-of-precision': [0],
      '@typescript-eslint/no-magic-numbers': [0],
      '@typescript-eslint/no-meaningless-void-operator': [0],
      '@typescript-eslint/no-misused-new': [2],
      '@typescript-eslint/no-misused-promises': [2, {checksVoidReturn: {attributes: false, arguments: false}}],
-      '@typescript-eslint/no-misused-spread': [0], // false-positives
      '@typescript-eslint/no-mixed-enums': [0],
      '@typescript-eslint/no-namespace': [2],
      '@typescript-eslint/no-non-null-asserted-nullish-coalescing': [0],
@@ -220,23 +225,20 @@ export default defineConfig([
      '@typescript-eslint/no-this-alias': [0], // handled by unicorn/no-this-assignment
      '@typescript-eslint/no-unnecessary-boolean-literal-compare': [0],
      '@typescript-eslint/no-unnecessary-condition': [0],
-      '@typescript-eslint/no-unnecessary-parameter-property-assignment': [2],
      '@typescript-eslint/no-unnecessary-qualifier': [0],
      '@typescript-eslint/no-unnecessary-template-expression': [0],
      '@typescript-eslint/no-unnecessary-type-arguments': [2],
      '@typescript-eslint/no-unnecessary-type-assertion': [2],
      '@typescript-eslint/no-unnecessary-type-constraint': [2],
      '@typescript-eslint/no-unnecessary-type-conversion': [2],
-      '@typescript-eslint/no-unnecessary-type-parameters': [0],
      '@typescript-eslint/no-unsafe-argument': [0],
      '@typescript-eslint/no-unsafe-assignment': [0],
      '@typescript-eslint/no-unsafe-call': [0],
      '@typescript-eslint/no-unsafe-declaration-merging': [2],
-      '@typescript-eslint/no-unsafe-enum-comparison': [0],
+      '@typescript-eslint/no-unsafe-enum-comparison': [2],
      '@typescript-eslint/no-unsafe-function-type': [2],
      '@typescript-eslint/no-unsafe-member-access': [0],
      '@typescript-eslint/no-unsafe-return': [0],
-      '@typescript-eslint/no-unsafe-type-assertion': [0],
      '@typescript-eslint/no-unsafe-unary-minus': [2],
      '@typescript-eslint/no-unused-expressions': [2],
      '@typescript-eslint/no-unused-private-class-members': [2],
@@ -257,7 +259,7 @@ export default defineConfig([
      '@typescript-eslint/prefer-function-type': [2],
      '@typescript-eslint/prefer-includes': [2],
      '@typescript-eslint/prefer-literal-enum-member': [0],
-      '@typescript-eslint/prefer-namespace-keyword': [0], // handled by @typescript-eslint/no-namespace
+      '@typescript-eslint/prefer-namespace-keyword': [2],
      '@typescript-eslint/prefer-nullish-coalescing': [0],
      '@typescript-eslint/prefer-optional-chain': [2, {requireNullish: true}],
      '@typescript-eslint/prefer-promise-reject-errors': [2],
@@ -268,7 +270,6 @@ export default defineConfig([
      '@typescript-eslint/prefer-return-this-type': [0],
      '@typescript-eslint/prefer-string-starts-ends-with': [2, {allowSingleElementEquality: 'always'}],
      '@typescript-eslint/promise-function-async': [0],
-      '@typescript-eslint/related-getter-setter-pairs': [2],
      '@typescript-eslint/require-array-sort-compare': [0],
      '@typescript-eslint/require-await': [0],
      '@typescript-eslint/restrict-plus-operands': [2],
@@ -278,11 +279,17 @@ export default defineConfig([
      '@typescript-eslint/strict-void-return': [0],
      '@typescript-eslint/switch-exhaustiveness-check': [0],
      '@typescript-eslint/triple-slash-reference': [2],
+      '@typescript-eslint/typedef': [0],
      '@typescript-eslint/unbound-method': [0], // too many false-positives
      '@typescript-eslint/unified-signatures': [2],
-      '@typescript-eslint/use-unknown-in-catch-callback-variable': [0],
      'accessor-pairs': [2],
      'array-callback-return': [2, {checkForEach: true}],
+      'array-func/avoid-reverse': [2],
+      'array-func/from-map': [2],
+      'array-func/no-unnecessary-this-arg': [2],
+      'array-func/prefer-array-from': [2],
+      'array-func/prefer-flat-map': [0], // handled by unicorn/prefer-array-flat-map
+      'array-func/prefer-flat': [0], // handled by unicorn/prefer-array-flat
      'arrow-body-style': [0],
      'block-scoped-var': [2],
      'camelcase': [0],
@@ -293,6 +300,8 @@ export default defineConfig([
      'consistent-this': [0],
      'constructor-super': [2],
      'curly': [0],
+      'de-morgan/no-negated-conjunction': [2],
+      'de-morgan/no-negated-disjunction': [2],
      'default-case-last': [2],
      'default-case': [0],
      'default-param-last': [0],
@@ -303,9 +312,32 @@ export default defineConfig([
      'func-names': [0],
      'func-style': [0],
      'getter-return': [2],
+      'github/a11y-aria-label-is-well-formatted': [0],
+      'github/a11y-no-title-attribute': [0],
+      'github/a11y-no-visually-hidden-interactive-element': [0],
+      'github/a11y-role-supports-aria-props': [0],
+      'github/a11y-svg-has-accessible-name': [0],
+      'github/array-foreach': [0],
+      'github/async-currenttarget': [2],
+      'github/async-preventdefault': [0], // https://github.com/github/eslint-plugin-github/issues/599
+      'github/authenticity-token': [0],
+      'github/get-attribute': [0],
+      'github/js-class-name': [0],
+      'github/no-blur': [0],
+      'github/no-d-none': [0],
+      'github/no-dataset': [2],
+      'github/no-dynamic-script-tag': [2],
+      'github/no-implicit-buggy-globals': [2],
+      'github/no-inner-html': [0],
+      'github/no-innerText': [2],
+      'github/no-then': [2],
+      'github/no-useless-passive': [2],
+      'github/prefer-observers': [0],
+      'github/require-passive-events': [2],
+      'gitea/unescaped-html-literal': [2],
      'grouped-accessor-pairs': [2],
      'guard-for-in': [0],
-      'id-denylist': [0],
+      'id-blacklist': [0],
      'id-length': [0],
      'id-match': [0],
      'import-x/consistent-type-specifier-style': [0],
@@ -327,7 +359,6 @@ export default defineConfig([
      'import-x/no-cycle': [2, {ignoreExternal: true, maxDepth: 1}],
      'import-x/no-default-export': [0],
      'import-x/no-deprecated': [0],
-      'import-x/no-duplicates': [2],
      'import-x/no-dynamic-require': [0],
      'import-x/no-empty-named-blocks': [2],
      'import-x/no-extraneous-dependencies': [2],
@@ -342,7 +373,6 @@ export default defineConfig([
      'import-x/no-nodejs-modules': [0],
      'import-x/no-relative-packages': [0],
      'import-x/no-relative-parent-imports': [0],
-      'import-x/no-rename-default': [0],
      'import-x/no-restricted-paths': [0],
      'import-x/no-self-import': [2],
      'import-x/no-unassigned-import': [0],
@@ -352,9 +382,9 @@ export default defineConfig([
      'import-x/no-webpack-loader-syntax': [2],
      'import-x/order': [0],
      'import-x/prefer-default-export': [0],
-      'import-x/prefer-namespace-import': [0],
      'import-x/unambiguous': [0],
      'init-declarations': [0],
+      'line-comment-position': [0],
      'logical-assignment-operators': [0],
      'max-classes-per-file': [0],
      'max-depth': [0],
@@ -363,12 +393,14 @@ export default defineConfig([
      'max-nested-callbacks': [0],
      'max-params': [0],
      'max-statements': [0],
+      'multiline-comment-style': [0],
      'new-cap': [0],
      'no-alert': [0],
      'no-array-constructor': [0], // handled by @typescript-eslint/no-array-constructor
      'no-async-promise-executor': [0],
      'no-await-in-loop': [0],
      'no-bitwise': [0],
+      'no-buffer-constructor': [0],
      'no-caller': [2],
      'no-case-declarations': [2],
      'no-class-assign': [2],
@@ -525,13 +557,14 @@ export default defineConfig([
      'no-nested-ternary': [0],
      'no-new-func': [0], // handled by @typescript-eslint/no-implied-eval
      'no-new-native-nonconstructor': [2],
+      'no-new-object': [2],
+      'no-new-symbol': [0], // handled by no-new-native-nonconstructor
      'no-new-wrappers': [2],
      'no-new': [0],
      'no-nonoctal-decimal-escape': [2],
      'no-obj-calls': [2],
-      'no-object-constructor': [2],
-      'no-octal-escape': [0], // parse error under strict mode
-      'no-octal': [0], // parse error under strict mode
+      'no-octal-escape': [2],
+      'no-octal': [2],
      'no-param-reassign': [0],
      'no-plusplus': [0],
      'no-promise-executor-return': [0],
@@ -569,7 +602,6 @@ export default defineConfig([
      'no-unreachable': [2],
      'no-unsafe-finally': [2],
      'no-unsafe-negation': [2],
-      'no-unsafe-optional-chaining': [2],
      'no-unused-expressions': [0], // handled by @typescript-eslint/no-unused-expressions
      'no-unused-labels': [2],
      'no-unused-private-class-members': [0], // handled by @typescript-eslint/no-unused-private-class-members
@@ -580,18 +612,20 @@ export default defineConfig([
      'no-useless-call': [2],
      'no-useless-catch': [2],
      'no-useless-computed-key': [2],
-      'no-useless-concat': [0], // handled by unicorn/no-useless-concat
+      'no-useless-concat': [2],
      'no-useless-constructor': [2],
      'no-useless-escape': [2],
      'no-useless-rename': [2],
-      'no-useless-return': [2],
+      'no-useless-return': [0], // handled by sonarjs/no-redundant-jump
      'no-var': [2],
      'no-void': [2],
      'no-warning-comments': [0],
      'no-with': [0], // handled by no-restricted-syntax
      'object-shorthand': [2, 'always'],
+      'one-var-declaration-per-line': [0],
      'one-var': [0],
-      'operator-assignment': [0], // handled by unicorn/operator-assignment
+      'operator-assignment': [2, 'always'],
+      'operator-linebreak': [0], // handled by @stylistic/operator-linebreak
      'prefer-arrow-callback': [2, {allowNamedFunctions: true, allowUnboundThis: true}],
      'prefer-const': [2, {destructuring: 'all', ignoreReadBeforeAssign: true}],
      'prefer-destructuring': [0],
@@ -609,7 +643,6 @@ export default defineConfig([
      'radix': [0],
      'regexp/confusing-quantifier': [2],
      'regexp/control-character-escape': [2],
-      'regexp/grapheme-string-literal': [0],
      'regexp/hexadecimal-escape': [0],
      'regexp/letter-case': [0],
      'regexp/match-any': [2],
@@ -680,363 +713,187 @@ export default defineConfig([
      'regexp/prefer-unicode-codepoint-escapes': [2],
      'regexp/prefer-w': [0],
      'regexp/require-unicode-regexp': [0],
-      'regexp/require-unicode-sets-regexp': [0],
      'regexp/simplify-set-operations': [2],
      'regexp/sort-alternatives': [0],
      'regexp/sort-character-class-elements': [0],
      'regexp/sort-flags': [0],
      'regexp/strict': [2],
      'regexp/unicode-escape': [0],
-      'regexp/unicode-property': [0],
      'regexp/use-ignore-case': [0],
      'require-atomic-updates': [0],
      'require-await': [0], // handled by @typescript-eslint/require-await
      'require-unicode-regexp': [0],
      'require-yield': [2],
+      'sonarjs/cognitive-complexity': [0],
+      'sonarjs/elseif-without-else': [0],
+      'sonarjs/max-switch-cases': [0],
+      'sonarjs/no-all-duplicated-branches': [2],
+      'sonarjs/no-collapsible-if': [0],
+      'sonarjs/no-collection-size-mischeck': [2],
+      'sonarjs/no-duplicate-string': [0],
+      'sonarjs/no-duplicated-branches': [0],
+      'sonarjs/no-element-overwrite': [2],
+      'sonarjs/no-empty-collection': [2],
+      'sonarjs/no-extra-arguments': [2],
+      'sonarjs/no-gratuitous-expressions': [2],
+      'sonarjs/no-identical-conditions': [0], // handled by no-dupe-else-if
+      'sonarjs/no-identical-expressions': [2],
+      'sonarjs/no-identical-functions': [2, 5],
+      'sonarjs/no-ignored-return': [2],
+      'sonarjs/no-inverted-boolean-check': [2],
+      'sonarjs/no-nested-switch': [0],
+      'sonarjs/no-nested-template-literals': [0],
+      'sonarjs/no-redundant-boolean': [2],
+      'sonarjs/no-redundant-jump': [2],
+      'sonarjs/no-same-line-conditional': [2],
+      'sonarjs/no-small-switch': [0],
+      'sonarjs/no-unused-collection': [2],
+      'sonarjs/no-use-of-empty-return-value': [2],
+      'sonarjs/no-useless-catch': [0], // handled by no-useless-catch
+      'sonarjs/non-existent-operator': [2],
+      'sonarjs/prefer-immediate-return': [0],
+      'sonarjs/prefer-object-literal': [0],
+      'sonarjs/prefer-single-boolean-return': [0],
+      'sonarjs/prefer-while': [2],
      'sort-imports': [0],
      'sort-keys': [0],
      'sort-vars': [0],
      'strict': [0],
      'symbol-description': [2],
      'unicode-bom': [2, 'never'],
-      'unicorn/better-dom-traversing': [2],
+      'unicorn/better-regex': [0],
      'unicorn/catch-error-name': [0],
-      'unicorn/class-reference-in-static-methods': [2],
-      'unicorn/comment-content': [0],
-      'unicorn/consistent-arrow-return-style': [0],
-      'unicorn/consistent-assert': [0],
-      'unicorn/consistent-boolean-name': [0],
-      'unicorn/consistent-class-member-order': [0],
-      'unicorn/consistent-compound-words': [0], // too opinionated
-      'unicorn/consistent-conditional-object-spread': [2],
-      'unicorn/consistent-date-clone': [2],
      'unicorn/consistent-destructuring': [2],
      'unicorn/consistent-empty-array-spread': [2],
-      'unicorn/consistent-existence-index-check': [0],
-      'unicorn/consistent-export-decorator-position': [2],
-      'unicorn/consistent-function-scoping': [0],
-      'unicorn/consistent-function-style': [2],
-      'unicorn/consistent-json-file-read': [2],
-      'unicorn/consistent-optional-chaining': [2],
      'unicorn/consistent-template-literal-escape': [2],
-      'unicorn/consistent-tuple-labels': [2],
+      'unicorn/consistent-existence-index-check': [0],
+      'unicorn/consistent-function-scoping': [0],
      'unicorn/custom-error-definition': [0],
-      'unicorn/default-export-style': [2],
-      'unicorn/dom-node-dataset': [2, {preferAttributes: true}],
      'unicorn/empty-brace-spaces': [2],
      'unicorn/error-message': [0],
      'unicorn/escape-case': [0],
      'unicorn/expiring-todo-comments': [0],
      'unicorn/explicit-length-check': [0],
-      'unicorn/explicit-timer-delay': [2],
      'unicorn/filename-case': [0],
-      'unicorn/id-match': [2],
+      'unicorn/import-index': [0],
      'unicorn/import-style': [0],
      'unicorn/isolated-functions': [2, {functions: []}],
-      'unicorn/iteration-fallback-style': [2, 'fallback'],
-      'unicorn/logical-assignment-operators': [0],
-      'unicorn/max-nested-calls': [0],
-      'unicorn/name-replacements': [0],
      'unicorn/new-for-builtins': [2],
      'unicorn/no-abusive-eslint-disable': [0],
-      'unicorn/no-accessor-recursion': [2],
-      'unicorn/no-accidental-bitwise-operator': [2],
      'unicorn/no-anonymous-default-export': [0],
      'unicorn/no-array-callback-reference': [0],
-      'unicorn/no-array-concat-in-loop': [2],
-      'unicorn/no-array-fill-with-reference-type': [2],
-      'unicorn/no-array-from-fill': [2],
-      'unicorn/no-array-front-mutation': [0],
+      'unicorn/no-array-for-each': [2],
      'unicorn/no-array-method-this-argument': [2],
+      'unicorn/no-array-push-push': [2],
      'unicorn/no-array-reduce': [2],
-      'unicorn/no-array-reverse': [0],
-      'unicorn/no-array-sort': [0],
-      'unicorn/no-array-sort-for-min-max': [2],
-      'unicorn/no-array-splice': [0],
-      'unicorn/no-asterisk-prefix-in-documentation-comments': [0],
-      'unicorn/no-async-promise-finally': [2],
      'unicorn/no-await-expression-member': [0],
      'unicorn/no-await-in-promise-methods': [2],
-      'unicorn/no-barrel-files': [0],
-      'unicorn/no-blob-to-file': [2],
-      'unicorn/no-boolean-sort-comparator': [2],
-      'unicorn/no-break-in-nested-loop': [0],
-      'unicorn/no-canvas-to-image': [2],
-      'unicorn/no-chained-comparison': [2],
-      'unicorn/no-collection-bracket-access': [2],
-      'unicorn/no-computed-property-existence-check': [0],
-      'unicorn/no-confusing-array-splice': [2],
-      'unicorn/no-confusing-array-with': [2],
      'unicorn/no-console-spaces': [0],
-      'unicorn/no-constant-zero-expression': [2],
-      'unicorn/no-declarations-before-early-exit': [0],
      'unicorn/no-document-cookie': [2],
-      'unicorn/no-double-comparison': [2],
-      'unicorn/no-duplicate-if-branches': [2],
-      'unicorn/no-duplicate-logical-operands': [2],
-      'unicorn/no-duplicate-loops': [0],
-      'unicorn/no-duplicate-set-values': [2],
      'unicorn/no-empty-file': [2],
-      'unicorn/no-error-property-assignment': [2],
-      'unicorn/no-exports-in-scripts': [2],
-      'unicorn/no-for-each': [2],
      'unicorn/no-for-loop': [0],
-      'unicorn/no-global-object-property-assignment': [0],
+      'unicorn/no-hex-escape': [0],
      'unicorn/no-immediate-mutation': [0],
-      'unicorn/no-impossible-length-comparison': [2],
-      'unicorn/no-incorrect-query-selector': [2],
-      'unicorn/no-incorrect-template-string-interpolation': [0],
-      'unicorn/no-instanceof-builtins': [2],
-      'unicorn/no-invalid-argument-count': [0],
-      'unicorn/no-invalid-character-comparison': [2],
+      'unicorn/no-instanceof-array': [0],
      'unicorn/no-invalid-fetch-options': [2],
-      'unicorn/no-invalid-file-input-accept': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
-      'unicorn/no-invalid-well-known-symbol-methods': [2],
      'unicorn/no-keyword-prefix': [0],
-      'unicorn/no-late-current-target-access': [2],
-      'unicorn/no-late-event-control': [2],
+      'unicorn/no-length-as-slice-end': [2],
      'unicorn/no-lonely-if': [2],
-      'unicorn/no-loop-iterable-mutation': [2],
      'unicorn/no-magic-array-flat-depth': [0],
-      'unicorn/no-manually-wrapped-comments': [0], // too opinionated
-      'unicorn/no-mismatched-map-key': [2],
-      'unicorn/no-misrefactored-assignment': [2],
-      'unicorn/no-missing-local-resource': [0], // only applies to html/css/markdown languages
-      'unicorn/no-multiple-promise-resolver-calls': [2],
-      'unicorn/no-named-default': [2],
-      'unicorn/no-negated-array-predicate': [2],
-      'unicorn/no-negated-comparison': [2],
      'unicorn/no-negated-condition': [0],
      'unicorn/no-negation-in-equality-check': [2],
      'unicorn/no-nested-ternary': [0],
      'unicorn/no-new-array': [0],
      'unicorn/no-new-buffer': [0],
-      'unicorn/no-non-function-verb-prefix': [0],
-      'unicorn/no-nonstandard-builtin-properties': [2],
      'unicorn/no-null': [0],
      'unicorn/no-object-as-default-parameter': [0],
-      'unicorn/no-object-methods-with-collections': [2],
-      'unicorn/no-optional-chaining-on-undeclared-variable': [2],
      'unicorn/no-process-exit': [0],
-      'unicorn/no-redundant-comparison': [2],
-      'unicorn/no-return-array-push': [2],
-      'unicorn/no-selector-as-dom-name': [2],
-      'unicorn/no-shorthand-property-overrides': [0], // only applies to css language
      'unicorn/no-single-promise-in-promise-methods': [2],
      'unicorn/no-static-only-class': [2],
-      'unicorn/no-subtraction-comparison': [2],
      'unicorn/no-thenable': [2],
      'unicorn/no-this-assignment': [2],
-      'unicorn/no-this-outside-of-class': [0], // gitea uses `this` in non-class functions
-      'unicorn/no-top-level-assignment-in-function': [0],
-      'unicorn/no-top-level-side-effects': [0],
-      'unicorn/no-transition-all': [2],
      'unicorn/no-typeof-undefined': [2],
-      'unicorn/no-uncalled-method': [2],
-      'unicorn/no-undeclared-class-members': [2],
-      'unicorn/no-unnecessary-array-flat-depth': [2],
-      'unicorn/no-unnecessary-array-flat-map': [2],
-      'unicorn/no-unnecessary-array-splice-count': [2],
      'unicorn/no-unnecessary-await': [2],
-      'unicorn/no-unnecessary-boolean-comparison': [2],
-      'unicorn/no-unnecessary-fetch-options': [0],
-      'unicorn/no-unnecessary-global-this': [0],
-      'unicorn/no-unnecessary-nested-ternary': [2],
      'unicorn/no-unnecessary-polyfills': [2],
-      'unicorn/no-unnecessary-slice-end': [2],
-      'unicorn/no-unnecessary-splice': [2],
-      'unicorn/no-unnecessary-string-trim': [2],
      'unicorn/no-unreadable-array-destructuring': [0],
-      'unicorn/no-unreadable-for-of-expression': [0],
      'unicorn/no-unreadable-iife': [0],
-      'unicorn/no-unreadable-new-expression': [0],
-      'unicorn/no-unreadable-object-destructuring': [0],
-      'unicorn/no-unsafe-buffer-conversion': [2],
-      'unicorn/no-unsafe-dom-html': [0],
-      'unicorn/no-unsafe-promise-all-settled-values': [2],
-      'unicorn/no-unsafe-property-key': [0],
-      'unicorn/no-unsafe-sqlite-interpolation': [2],
-      'unicorn/no-unsafe-string-replacement': [0],
-      'unicorn/no-unused-array-method-return': [2],
      'unicorn/no-unused-properties': [2],
-      'unicorn/no-useless-boolean-cast': [2],
-      'unicorn/no-useless-coercion': [2],
      'unicorn/no-useless-collection-argument': [2],
-      'unicorn/no-useless-compound-assignment': [2],
-      'unicorn/no-useless-concat': [2],
-      'unicorn/no-useless-continue': [2],
-      'unicorn/no-useless-delete-check': [2],
-      'unicorn/no-useless-else': [0],
-      'unicorn/no-useless-error-capture-stack-trace': [2],
      'unicorn/no-useless-fallback-in-spread': [2],
      'unicorn/no-useless-iterator-to-array': [2],
      'unicorn/no-useless-length-check': [2],
-      'unicorn/no-useless-logical-operand': [2],
-      'unicorn/no-useless-override': [2],
      'unicorn/no-useless-promise-resolve-reject': [2],
-      'unicorn/no-useless-re-export': [2],
-      'unicorn/no-useless-recursion': [0],
      'unicorn/no-useless-spread': [2],
      'unicorn/no-useless-switch-case': [2],
-      'unicorn/no-useless-template-literals': [2],
      'unicorn/no-useless-undefined': [0],
-      'unicorn/no-xor-as-exponentiation': [2],
      'unicorn/no-zero-fractions': [2],
      'unicorn/number-literal-case': [0],
      'unicorn/numeric-separators-style': [0],
-      'unicorn/operator-assignment': [2],
-      'unicorn/prefer-abort-signal-any': [2],
-      'unicorn/prefer-abort-signal-timeout': [2],
      'unicorn/prefer-add-event-listener': [2],
-      'unicorn/prefer-add-event-listener-options': [2],
-      'unicorn/prefer-aggregate-error': [2],
      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
-      'unicorn/prefer-array-from-async': [2],
-      'unicorn/prefer-array-from-map': [2],
-      'unicorn/prefer-array-from-range': [2],
      'unicorn/prefer-array-index-of': [2],
-      'unicorn/prefer-array-iterable-methods': [2],
-      'unicorn/prefer-array-last-methods': [2],
-      'unicorn/prefer-array-slice': [2],
      'unicorn/prefer-array-some': [2],
      'unicorn/prefer-at': [0],
-      'unicorn/prefer-await': [2],
-      'unicorn/prefer-bigint-literals': [2],
      'unicorn/prefer-blob-reading-methods': [2],
-      'unicorn/prefer-block-statement-over-iife': [2],
-      'unicorn/prefer-boolean-return': [2],
-      'unicorn/prefer-class-fields': [2],
-      'unicorn/prefer-classlist-toggle': [2],
      'unicorn/prefer-code-point': [0],
-      'unicorn/prefer-continue': [0],
      'unicorn/prefer-date-now': [2],
      'unicorn/prefer-default-parameters': [0],
-      'unicorn/prefer-direct-iteration': [2],
-      'unicorn/prefer-dispose': [2],
      'unicorn/prefer-dom-node-append': [2],
-      'unicorn/prefer-dom-node-html-methods': [0],
+      'unicorn/prefer-dom-node-dataset': [0],
      'unicorn/prefer-dom-node-remove': [2],
-      'unicorn/prefer-dom-node-replace-children': [2],
      'unicorn/prefer-dom-node-text-content': [2],
-      'unicorn/prefer-early-return': [0],
-      'unicorn/prefer-else-if': [2],
-      'unicorn/prefer-error-is-error': [0],
      'unicorn/prefer-event-target': [2],
-      'unicorn/prefer-explicit-viewport-units': [0], // only applies to css language
      'unicorn/prefer-export-from': [0],
-      'unicorn/prefer-flat-math-min-max': [2],
-      'unicorn/prefer-get-or-insert-computed': [2],
-      'unicorn/prefer-global-number-constants': [2],
      'unicorn/prefer-global-this': [0],
-      'unicorn/prefer-group-by': [2],
-      'unicorn/prefer-has-check': [2],
-      'unicorn/prefer-hoisting-branch-code': [2],
-      'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
-      'unicorn/prefer-identifier-import-export-specifiers': [2],
-      'unicorn/prefer-import-meta-properties': [2],
      'unicorn/prefer-includes': [0], // handled by @typescript-eslint/prefer-includes
-      'unicorn/prefer-includes-over-repeated-comparisons': [0], // too opinionated
-      'unicorn/prefer-iterable-in-constructor': [2],
-      'unicorn/prefer-iterator-concat': [0], // too opinionated
-      'unicorn/prefer-iterator-helpers': [2],
-      'unicorn/prefer-iterator-to-array': [2],
-      'unicorn/prefer-iterator-to-array-at-end': [2],
+      'unicorn/prefer-json-parse-buffer': [0],
      'unicorn/prefer-keyboard-event-key': [2],
-      'unicorn/prefer-location-assign': [2],
      'unicorn/prefer-logical-operator-over-ternary': [2],
-      'unicorn/prefer-map-from-entries': [0],
-      'unicorn/prefer-math-abs': [2],
-      'unicorn/prefer-math-constants': [2],
      'unicorn/prefer-math-min-max': [2],
      'unicorn/prefer-math-trunc': [2],
-      'unicorn/prefer-minimal-ternary': [0],
      'unicorn/prefer-modern-dom-apis': [0],
      'unicorn/prefer-modern-math-apis': [2],
      'unicorn/prefer-module': [2],
      'unicorn/prefer-native-coercion-functions': [2],
      'unicorn/prefer-negative-index': [2],
      'unicorn/prefer-node-protocol': [2],
-      'unicorn/prefer-number-coercion': [0],
-      'unicorn/prefer-number-is-safe-integer': [0],
      'unicorn/prefer-number-properties': [0],
-      'unicorn/prefer-object-define-properties': [2],
-      'unicorn/prefer-object-destructuring-defaults': [2],
      'unicorn/prefer-object-from-entries': [2],
-      'unicorn/prefer-object-iterable-methods': [2],
-      'unicorn/prefer-observer-apis': [2],
+      'unicorn/prefer-object-has-own': [0],
      'unicorn/prefer-optional-catch-binding': [2],
-      'unicorn/prefer-path2d': [2],
-      'unicorn/prefer-private-class-fields': [0],
-      'unicorn/prefer-promise-try': [2],
-      'unicorn/prefer-promise-with-resolvers': [2],
      'unicorn/prefer-prototype-methods': [0],
      'unicorn/prefer-query-selector': [2],
-      'unicorn/prefer-queue-microtask': [2],
      'unicorn/prefer-reflect-apply': [0],
-      'unicorn/prefer-regexp-escape': [0],
      'unicorn/prefer-regexp-test': [2],
      'unicorn/prefer-response-static-json': [2],
-      'unicorn/prefer-scoped-selector': [0],
      'unicorn/prefer-set-has': [0],
-      'unicorn/prefer-set-methods': [0],
      'unicorn/prefer-set-size': [2],
-      'unicorn/prefer-short-arrow-method': [2],
      'unicorn/prefer-simple-condition-first': [0],
-      'unicorn/prefer-simple-sort-comparator': [2],
-      'unicorn/prefer-simplified-conditions': [2],
-      'unicorn/prefer-single-array-predicate': [2],
-      'unicorn/prefer-single-call': [2],
-      'unicorn/prefer-single-object-destructuring': [2],
-      'unicorn/prefer-single-replace': [2],
-      'unicorn/prefer-smaller-scope': [2],
-      'unicorn/prefer-split-limit': [0], // too opinionated
      'unicorn/prefer-spread': [0],
-      'unicorn/prefer-string-match-all': [2],
-      'unicorn/prefer-string-pad-start-end': [2],
      'unicorn/prefer-string-raw': [0],
-      'unicorn/prefer-string-repeat': [2],
      'unicorn/prefer-string-replace-all': [0],
      'unicorn/prefer-string-slice': [0],
      'unicorn/prefer-string-starts-ends-with': [0], // handled by @typescript-eslint/prefer-string-starts-ends-with
      'unicorn/prefer-string-trim-start-end': [2],
      'unicorn/prefer-structured-clone': [2],
      'unicorn/prefer-switch': [0],
-      'unicorn/prefer-temporal': [0],
      'unicorn/prefer-ternary': [0],
-      'unicorn/prefer-then-catch': [2],
-      'unicorn/prefer-toggle-attribute': [2],
      'unicorn/prefer-top-level-await': [0],
      'unicorn/prefer-type-error': [0],
-      'unicorn/prefer-type-literal-last': [0],
-      'unicorn/prefer-uint8array-base64': [0],
-      'unicorn/prefer-unary-minus': [2],
-      'unicorn/prefer-unicode-code-point-escapes': [0],
-      'unicorn/prefer-url-can-parse': [2],
-      'unicorn/prefer-url-href': [2],
-      'unicorn/prefer-url-search-parameters': [2],
-      'unicorn/prefer-while-loop-condition': [2],
+      'unicorn/prevent-abbreviations': [0],
      'unicorn/relative-url-style': [2],
      'unicorn/require-array-join-separator': [2],
-      'unicorn/require-array-sort-compare': [0],
-      'unicorn/require-css-escape': [2],
-      'unicorn/require-frontmatter-fields': [0], // only applies to markdown language
-      'unicorn/require-module-attributes': [2],
-      'unicorn/require-module-specifiers': [0],
      'unicorn/require-number-to-fixed-digits-argument': [2],
-      'unicorn/require-passive-events': [2],
      'unicorn/require-post-message-target-origin': [0],
-      'unicorn/require-proxy-trap-boolean-return': [2],
-      'unicorn/single-line-block-comment-style': [0],
      'unicorn/string-content': [0],
      'unicorn/switch-case-braces': [0],
      'unicorn/switch-case-break-position': [2],
      'unicorn/template-indent': [2],
      'unicorn/text-encoding-identifier-case': [0],
      'unicorn/throw-new-error': [2],
-      'unicorn/try-complexity': [0],
      'use-isnan': [2],
      'valid-typeof': [2, {requireStringLiterals: true}],
      'vars-on-top': [0],
@@ -1083,7 +940,7 @@ export default defineConfig([
    },
    extends: [
      vue.configs['flat/recommended'],
-      vueScopedCss.configs.recommended,
+      vueScopedCss.configs.recommended as any,
    ],
    rules: {
      'vue/attributes-order': [0],
@@ -1094,19 +951,14 @@ export default defineConfig([
    },
  },
  {
-    files: ['**/*.test.ts', 'web_src/js/vitest.setup.ts'],
-    ignores: ['tests/e2e/**'],
+    files: ['**/*.test.ts', 'web_src/js/test/setup.ts'],
    plugins: {vitest},
    languageOptions: {globals: globals.vitest},
    rules: {
      'gitea/unescaped-html-literal': [0],
-      'unicorn/no-error-property-assignment': [0],
-      'vitest/consistent-each-for': [0],
      'vitest/consistent-test-filename': [0],
      'vitest/consistent-test-it': [0],
-      'vitest/consistent-vitest-vi': [0],
      'vitest/expect-expect': [0],
-      'vitest/hoisted-apis-on-top': [0],
      'vitest/max-expects': [0],
      'vitest/max-nested-describe': [0],
      'vitest/no-alias-methods': [0],
@@ -1115,73 +967,46 @@ export default defineConfig([
      'vitest/no-conditional-in-test': [0],
      'vitest/no-conditional-tests': [0],
      'vitest/no-disabled-tests': [0],
+      'vitest/no-done-callback': [0],
      'vitest/no-duplicate-hooks': [0],
      'vitest/no-focused-tests': [2],
      'vitest/no-hooks': [0],
      'vitest/no-identical-title': [2],
-      'vitest/no-import-node-test': [0],
-      'vitest/no-importing-vitest-globals': [2],
      'vitest/no-interpolation-in-snapshots': [0],
      'vitest/no-large-snapshots': [0],
      'vitest/no-mocks-import': [0],
+      'vitest/no-importing-vitest-globals': [2],
      'vitest/no-restricted-matchers': [0],
      'vitest/no-restricted-vi-methods': [0],
      'vitest/no-standalone-expect': [0],
      'vitest/no-test-prefixes': [0],
      'vitest/no-test-return-statement': [0],
-      'vitest/no-unneeded-async-expect-function': [2],
-      'vitest/padding-around-after-all-blocks': [0],
-      'vitest/padding-around-after-each-blocks': [0],
-      'vitest/padding-around-all': [0],
-      'vitest/padding-around-before-all-blocks': [0],
-      'vitest/padding-around-before-each-blocks': [0],
-      'vitest/padding-around-describe-blocks': [0],
-      'vitest/padding-around-expect-groups': [0],
-      'vitest/padding-around-test-blocks': [0],
-      'vitest/prefer-called-exactly-once-with': [0],
-      'vitest/prefer-called-once': [0],
-      'vitest/prefer-called-times': [0],
      'vitest/prefer-called-with': [0],
      'vitest/prefer-comparison-matcher': [0],
-      'vitest/prefer-describe-function-title': [0],
      'vitest/prefer-each': [0],
      'vitest/prefer-equality-matcher': [0],
-      'vitest/prefer-expect-assertions': [0],
      'vitest/prefer-expect-resolves': [0],
-      'vitest/prefer-expect-type-of': [0],
      'vitest/prefer-hooks-in-order': [0],
      'vitest/prefer-hooks-on-top': [2],
-      'vitest/prefer-import-in-mock': [0],
-      'vitest/prefer-importing-vitest-globals': [0],
      'vitest/prefer-lowercase-title': [0],
      'vitest/prefer-mock-promise-shorthand': [0],
-      'vitest/prefer-mock-return-shorthand': [0],
      'vitest/prefer-snapshot-hint': [0],
      'vitest/prefer-spy-on': [0],
-      'vitest/prefer-strict-boolean-matchers': [0],
      'vitest/prefer-strict-equal': [0],
      'vitest/prefer-to-be': [0],
      'vitest/prefer-to-be-falsy': [0],
      'vitest/prefer-to-be-object': [0],
      'vitest/prefer-to-be-truthy': [0],
      'vitest/prefer-to-contain': [0],
-      'vitest/prefer-to-have-been-called-times': [0],
      'vitest/prefer-to-have-length': [0],
      'vitest/prefer-todo': [0],
-      'vitest/prefer-vi-mocked': [0],
-      'vitest/require-awaited-expect-poll': [0],
      'vitest/require-hook': [0],
-      'vitest/require-local-test-context-for-concurrent-snapshots': [0],
-      'vitest/require-mock-type-parameters': [0],
-      'vitest/require-test-timeout': [0],
      'vitest/require-to-throw-message': [0],
      'vitest/require-top-level-describe': [0],
-      'vitest/unbound-method': [0],
      'vitest/valid-describe-callback': [2],
      'vitest/valid-expect': [2, {maxArgs: 2}],
      'vitest/valid-expect-in-promise': [2],
      'vitest/valid-title': [2],
-      'vitest/warn-todo': [0],
    },
  },
  {
@@ -3,10 +3,9 @@ import json from '@eslint/json';

 export default defineConfig([
  globalIgnores([
-    'public',
-    'custom/public',
-    'data',
-    '.venv',
+    '**/.venv',
+    '**/node_modules',
+    '**/public',
  ]),
  {
    files: ['**/*.json'],
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1786106723,
-        "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
+        "lastModified": 1776877367,
+        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
+        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
        "type": "github"
      },
      "original": {
@@ -34,9 +34,9 @@

              # only bump toolchain versions here
              go = pkgs.go_1_26;
-              nodejs = pkgs.nodejs_26;
+              nodejs = pkgs.nodejs_24;
              python3 = pkgs.python314;
-              pnpm = pkgs.pnpm_11;
+              pnpm = pkgs.pnpm_10;

              # Platform-specific dependencies
              linuxOnlyInputs = lib.optionals pkgs.stdenv.isLinux [
@@ -1,19 +1,19 @@
 module gitea.dev

-go 1.27
-
-toolchain go1.27.1
+go 1.26.4

 require (
+	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
 	connectrpc.com/connect v1.20.0
-	gitea.com/go-chi/binding v0.0.0-20260819122636-082915a69981
+	gitea.com/gitea/runner v1.0.8
+	gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
-	gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6
+	gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
-	gitea.dev/actionslib v0.7.0
-	gitea.dev/sdk v1.2.0
+	gitea.dev/actions-proto-go v0.6.0
+	gitea.dev/sdk v1.1.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
@@ -21,44 +21,46 @@ require (
 	github.com/Azure/go-ntlmssp v0.1.1
 	github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347
 	github.com/ProtonMail/go-crypto v1.4.1
-	github.com/PuerkitoBio/goquery v1.13.0
+	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
-	github.com/alecthomas/chroma/v2 v2.27.0
-	github.com/aws/aws-sdk-go-v2/credentials v1.20.2
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.41.0
+	github.com/alecthomas/chroma/v2 v2.26.1
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/blevesearch/bleve/v2 v2.6.1
+	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
-	github.com/buildkite/terminal-to-html/v3 v3.17.1
-	github.com/caddyserver/certmagic v0.25.4
-	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260812203852-971c0284dc33
+	github.com/buildkite/terminal-to-html/v3 v3.16.8
+	github.com/caddyserver/certmagic v0.25.3
+	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635
 	github.com/chi-middleware/proxy v1.1.1
-	github.com/coder/websocket v1.8.15
-	github.com/dlclark/regexp2/v2 v2.7.1
+	github.com/dlclark/regexp2/v2 v2.2.1
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/dustin/go-humanize v1.0.1
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.4
 	github.com/emersion/go-imap v1.2.1
 	github.com/emirpasic/gods v1.18.1
+	github.com/ethantkoenig/rupture v1.0.1
 	github.com/felixge/fgprof v0.9.5
 	github.com/fsnotify/fsnotify v1.10.1
-	github.com/getkin/kin-openapi v0.149.0
-	github.com/go-chi/chi/v5 v5.3.2
+	github.com/getkin/kin-openapi v0.140.0
+	github.com/gliderlabs/ssh v0.3.8
+	github.com/go-chi/chi/v5 v5.3.0
 	github.com/go-chi/cors v1.2.2
-	github.com/go-co-op/gocron/v2 v2.22.0
+	github.com/go-co-op/gocron/v2 v2.21.2
 	github.com/go-enry/go-enry/v2 v2.9.6
-	github.com/go-git/go-billy/v5 v5.9.1
-	github.com/go-git/go-git/v5 v5.19.2
-	github.com/go-ldap/ldap/v3 v3.4.14
-	github.com/go-redsync/redsync/v4 v4.17.0
+	github.com/go-git/go-billy/v5 v5.9.0
+	github.com/go-git/go-git/v5 v5.19.1
+	github.com/go-ldap/ldap/v3 v3.4.13
+	github.com/go-redsync/redsync/v4 v4.16.0
 	github.com/go-sql-driver/mysql v1.10.0
-	github.com/go-webauthn/webauthn v0.18.0
+	github.com/go-webauthn/webauthn v0.17.4
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v89 v89.0.0
+	github.com/google/go-github/v88 v88.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
-	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3
+	github.com/google/pprof v0.0.0-20260604005048-7023385849c0
+	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
 	github.com/hashicorp/go-version v1.9.0
@@ -66,55 +68,56 @@ require (
 	github.com/huandu/xstrings v1.5.0
 	github.com/jhillyerd/enmime/v2 v2.4.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.19.2
+	github.com/klauspost/compress v1.18.6
+	github.com/klauspost/cpuid/v2 v2.3.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
-	github.com/mattn/go-isatty v0.0.24
-	github.com/mattn/go-sqlite3 v1.14.50
+	github.com/mattn/go-isatty v0.0.22
+	github.com/mattn/go-sqlite3 v1.14.45
 	github.com/meilisearch/meilisearch-go v0.36.3
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.10.0
-	github.com/minio/minio-go/v7 v7.3.0
+	github.com/minio/minio-go/v7 v7.2.0
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pquerna/otp v1.5.0
-	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_golang v1.23.2
 	github.com/quasoft/websspi v1.1.2
-	github.com/redis/go-redis/v9 v9.22.0
-	github.com/rhysd/actionlint v1.7.12
+	github.com/redis/go-redis/v9 v9.20.0
 	github.com/robfig/cron/v3 v3.0.1
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/sassoftware/go-rpmutils v0.4.0
 	github.com/sergi/go-diff v1.4.0
-	github.com/stretchr/testify v1.12.1
+	github.com/stretchr/testify v1.11.1
 	github.com/syndtr/goleveldb v1.0.0
-	github.com/ulikunitz/xz v0.5.16
+	github.com/tstranex/u2f v1.0.0
+	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.11.0
-	github.com/wneessen/go-mail v0.8.1
+	github.com/urfave/cli/v3 v3.9.1
+	github.com/wneessen/go-mail v0.7.3
 	github.com/yohcop/openid-go v1.0.1
-	github.com/yuin/goldmark v1.8.6
+	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.61.0
+	gitlab.com/gitlab-org/api/client-go/v2 v2.38.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
-	golang.org/x/crypto v0.56.0
-	golang.org/x/image v0.45.0
-	golang.org/x/mod v0.40.0
-	golang.org/x/net v0.58.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/image v0.42.0
+	golang.org/x/net v0.56.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
-	golang.org/x/text v0.41.0
-	google.golang.org/grpc v1.83.2
-	google.golang.org/protobuf v1.36.12
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
+	golang.org/x/text v0.38.0
+	google.golang.org/grpc v1.81.1
+	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.3
-	modernc.org/sqlite v1.58.0
+	modernc.org/sqlite v1.52.0
 	mvdan.cc/xurls/v2 v2.6.0
+	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.4.1
+	xorm.io/xorm v1.3.11
 )

 require (
@@ -128,20 +131,21 @@ require (
 	github.com/STARRY-S/zip v0.2.3 // indirect
 	github.com/andybalholm/brotli v1.2.1 // indirect
 	github.com/andybalholm/cascadia v1.3.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.45.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 // indirect
-	github.com/aws/smithy-go v1.28.1 // indirect
+	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
+	github.com/aws/aws-sdk-go-v2 v1.42.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
+	github.com/aws/smithy-go v1.27.2 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.5 // indirect
-	github.com/blevesearch/bleve_index_api v1.4.1 // indirect
-	github.com/blevesearch/geo v0.2.6 // indirect
-	github.com/blevesearch/go-faiss v1.1.5 // indirect
+	github.com/blevesearch/bleve_index_api v1.3.12 // indirect
+	github.com/blevesearch/geo v0.2.5 // indirect
+	github.com/blevesearch/go-faiss v1.1.4 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
 	github.com/blevesearch/mmap-go v1.2.0 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.4.10 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.4.7 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
@@ -152,7 +156,7 @@ require (
 	github.com/blevesearch/zapx/v14 v14.4.3 // indirect
 	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
 	github.com/blevesearch/zapx/v16 v16.3.4 // indirect
-	github.com/blevesearch/zapx/v17 v17.2.3 // indirect
+	github.com/blevesearch/zapx/v17 v17.1.6 // indirect
 	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.4 // indirect
@@ -174,15 +178,15 @@ require (
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.3 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-openapi/jsonpointer v0.23.1 // indirect
 	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.3.0 // indirect
+	github.com/go-webauthn/x v0.2.6 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
@@ -191,18 +195,18 @@ require (
 	github.com/google/flatbuffers v25.12.19+incompatible // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/inbucket/html2text v1.0.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/libdns/libdns v1.1.1 // indirect
@@ -223,8 +227,8 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/nwaples/rardecode/v2 v2.2.3 // indirect
-	github.com/oasdiff/yaml v0.1.1 // indirect
-	github.com/oasdiff/yaml3 v0.0.14 // indirect
+	github.com/oasdiff/yaml v0.1.0 // indirect
+	github.com/oasdiff/yaml3 v0.0.13 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.3.0 // indirect
 	github.com/olekukonko/ll v0.1.8 // indirect
@@ -236,9 +240,10 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/common v0.68.1 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rhysd/actionlint v1.7.12 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
@@ -260,23 +265,22 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.28.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
+	golang.org/x/mod v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	modernc.org/libc v1.75.6 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/libc v1.73.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.12.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )

 ignore (
 	./.venv
 	./node_modules
-	./public
-	./vendor
-	./web_src
 )

 // When doing "go get -u ./...", Golang will try to update all dependencies
@@ -2,30 +2,34 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
 code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
+codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570 h1:TXbikPqa7YRtfU9vS6QJBg77pUvbEb6StRdZO8t1bEY=
+codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570/go.mod h1:IIAjsijsd8q1isWX8MACefDEgTQslQ4stk2AeeTt3kM=
 connectrpc.com/connect v1.20.0 h1:6TNDAB+WeNd2uolWNlYczB5E0KNNaVMNUEx8JEUsPmQ=
 connectrpc.com/connect v1.20.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-gitea.com/go-chi/binding v0.0.0-20260819122636-082915a69981 h1:LmdlwGbzgZFZA3bK3R1q8QrNabaSz3KpnOJBLmzhN6E=
-gitea.com/go-chi/binding v0.0.0-20260819122636-082915a69981/go.mod h1:q1SSPpkC9A0gfNnoqqZ3My6kEHIpKN6QsTI+Zx73B/o=
+gitea.com/gitea/runner v1.0.8 h1:zKfC4+zyyGIDagqhII3WVw52P+A9iAa63It0lniN4SI=
+gitea.com/gitea/runner v1.0.8/go.mod h1:AGLQXo8ELz9WPzNJ5W1SvnCik8ZX3jF0o6yCPCmwLtM=
+gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a h1:JHoBrfuTSF9Ke9aNfSYj1XRPBHjKPgCApVprnt2Am0M=
+gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a/go.mod h1:FOsLJIMdpiHzBp3Vby6Wfkdw2ppGscrjgU1IC7E4/zQ=
 gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
 gitea.com/go-chi/cache v0.2.1/go.mod h1:Qic0HZ8hOHW62ETGbonpwz8WYypj9NieU9659wFUJ8Q=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098 h1:p2ki+WK0cIeNQuqjR98IP2KZQKRzJJiV7aTeMAFwaWo=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098/go.mod h1:LjzIOHlRemuUyO7WR12fmm18VZIlCAaOt9L3yKw40pk=
-gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6 h1:YWzVGeC/8SZThrJS48ZmQYLkzssdeABxHPhbdnxPDIU=
-gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
+gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e h1:4bugwPyGMLvblEm3pZ8fZProSPVxE4l0UXF2Kv6IJoY=
+gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:VyMQP6ue6MKHM8UsOXfNfuMKD0oSAWZdXVcpHIN2yaY=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHqdhS7keYWioqfmxdnfblFDTGoOwcZ+o=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGqTOXqu2aRi/XEQxDCBwM8yJtE6s=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
-gitea.dev/actionslib v0.7.0 h1:JCV8eeIGwjlXcuSr7ojEdQC22VoE2466+K+D9vuQWKQ=
-gitea.dev/actionslib v0.7.0/go.mod h1:DI3Lqp+8TrycM7/semMdqsDQOHaBskjIAuMn+SXfZJ0=
-gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
-gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
+gitea.dev/actions-proto-go v0.6.0 h1:gjllYQ5vmwlkqOeofTQu5qKTZpmf7kWsafoHvoPCSzY=
+gitea.dev/actions-proto-go v0.6.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
+gitea.dev/sdk v1.1.0 h1:wLlz03WkLEiXa2bQpO1JQBTlYf7tQI2neYtZK1kU+TE=
+gitea.dev/sdk v1.1.0/go.mod h1:Zfl+EZXdsGGCLkryDfsmvYrQo6GKMl4U3BJA8Beu+cs=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -48,8 +52,10 @@ github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDP
 github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/DataDog/zstd v1.5.7 h1:ybO8RBeh29qrxIhCA9E8gKY6xfONU9T6G6aP9DTKfLE=
 github.com/DataDog/zstd v1.5.7/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
+github.com/Julusian/godocdown v0.0.0-20170816220326-6d19f8ff2df8/go.mod h1:INZr5t32rG59/5xeltqoCJoNY7e5x/3xoY9WSWVWg74=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
@@ -57,8 +63,10 @@ github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347 h1:3JhDl+JysaO8nh
 github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347/go.mod h1:2ErI0aycD43Ufr6CFK5lT/NrHGmoZuVbn1nlPThw69o=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
-github.com/PuerkitoBio/goquery v1.13.0 h1:mqHbjD7Jmnul4DTR24LKTjo1uUmHUh072kteGV+xpFM=
-github.com/PuerkitoBio/goquery v1.13.0/go.mod h1:Hip5mdBL8K2wEGKJdr27sRaNwIdDajmCwB/ExUPwW+g=
+github.com/PuerkitoBio/goquery v1.12.0 h1:pAcL4g3WRXekcB9AU/y1mbKez2dbY2AajVhtkO8RIBo=
+github.com/PuerkitoBio/goquery v1.12.0/go.mod h1:802ej+gV2y7bbIhOIoPY5sT183ZW0YFofScC4q/hIpQ=
+github.com/RoaringBitmap/roaring v0.4.23/go.mod h1:D0gp8kJQgE1A4LQ5wFLggQEyvDi06Mq5mKs52e1TwOo=
+github.com/RoaringBitmap/roaring v0.7.1/go.mod h1:jdT9ykXwHFNdJbEtxePexlFYH9LXucApeS0/+/g+p1I=
 github.com/RoaringBitmap/roaring/v2 v2.18.2 h1:oPq3Cgx//iDuJQVp6xSInAKW34J9CEwE5GmLI2z+Eic=
 github.com/RoaringBitmap/roaring/v2 v2.18.2/go.mod h1:eq4wdNXxtJIS/oikeCzdX1rBzek7ANzbth041hrU8Q4=
 github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
@@ -68,8 +76,8 @@ github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0/go.mod h1:I28hc9eaiqK
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
-github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/chroma/v2 v2.26.1 h1:2X21EdxGZNv5GF9mG5u+uzc02GCFyGxbcBm3Grd9A78=
+github.com/alecthomas/chroma/v2 v2.26.1/go.mod h1:lxhRRa9H4hPmRLOOdYga4zkQIQjq3dtrrdwQeCfu78Y=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
@@ -81,66 +89,82 @@ github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q3
 github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.45.1 h1:iIoG3NaLhV6UZpPXyPXlDj2I9oS8tV/nMcMnITCC6Ks=
-github.com/aws/aws-sdk-go-v2 v1.45.1/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
-github.com/aws/aws-sdk-go-v2/credentials v1.20.2 h1:VQjZODPNfdikCX2ZZrltw4zNLkcwjyUFDUl2vT9yTwg=
-github.com/aws/aws-sdk-go-v2/credentials v1.20.2/go.mod h1:OmeHCn28vZylsBvalLDf7t8fuJ2rHYQprJs+7WuxniI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 h1:pc138gM1CW+XPc60rEwUlwwuwWFQK16CI1T7v1F9Oec=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1/go.mod h1:1+koxpPIbfBdfzP6vojm5/zTpTQ/micYwlxIiNB3TxI=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 h1:K0JsbZQj+1h208Ro1zHeA4l7bMp0NvRffHQ91q8Ol1s=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1/go.mod h1:W3/vL6EtCIatICGy9ab29QhMuae+cOKPWcMxv02CO+Q=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.41.0 h1:SFxlwIhqw2GFVA+V/xOUfLTiDGvbrUDpaDHL5W7Buho=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.41.0/go.mod h1:YEgcX/qUvWg+Eczba8OpRk7WJx09nPaslkelDgpNymI=
-github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ=
-github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
+github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 h1:f3vKqSo13fhTYb+JEcXwXefZQE26I1FB5eTSniU67ko=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29/go.mod h1:MzoLFUArKGpGD+ukmPiTPG1X5x4o6M2kq4v2dr1FiEc=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJagbOyotl/cxoLY4xviKuE7p2GY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4 h1:Uu+wqrOXozYYvaxcNIqjFsMTjoIJIZDN3R0f70ZIjyQ=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
+github.com/aws/smithy-go v1.27.2 h1:y9NPmSE6am6LjEFPfqHqG/jJk7AauQvhCJONKh7kpzk=
+github.com/aws/smithy-go v1.27.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bits-and-blooms/bitset v1.1.10/go.mod h1:w0XsmFg8qg6cmpTtJ0z3pKgjTDBMMnI/+I2syrE6XBE=
+github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
 github.com/bits-and-blooms/bitset v1.24.5 h1:654xBVHc23gJMAgOTkPNoCVfiRxuIOAUnAZFtopqJ4w=
 github.com/bits-and-blooms/bitset v1.24.5/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
-github.com/blevesearch/bleve/v2 v2.6.1 h1:47vLskRTqxvQEtxVPYHjf5KpOgzD2msslXFjvUQCgWQ=
-github.com/blevesearch/bleve/v2 v2.6.1/go.mod h1:Dvvx6ZoEBTOj6RSzfk0lEz0wce/qhe2yOUubXeuzd2c=
-github.com/blevesearch/bleve_index_api v1.4.1 h1:CYIyecFlI+/RYjzUm+NmDjYbSvk870Bb7f+Vl4b12q8=
-github.com/blevesearch/bleve_index_api v1.4.1/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
-github.com/blevesearch/geo v0.2.6 h1:7K1oyQKYlauC+mJuo2AfNPyjN/4mihEoJMfyClVH1Mo=
-github.com/blevesearch/geo v0.2.6/go.mod h1:6qzVUiB4BK47QkSZcRqiXEP2W3EeXuzM5XFTF8AdZ8A=
-github.com/blevesearch/go-faiss v1.1.5 h1:/IU5lkOahH9Ghfk9n3F6N0XD7PYVXZJWmNDc9TtXuco=
-github.com/blevesearch/go-faiss v1.1.5/go.mod h1:w3W9AiWsFRGVaMG+/cmJi7iHEAuGyC6blsgO1EzCK/M=
+github.com/blevesearch/bleve/v2 v2.0.5/go.mod h1:ZjWibgnbRX33c+vBRgla9QhPb4QOjD6fdVJ+R1Bk8LM=
+github.com/blevesearch/bleve/v2 v2.6.0 h1:Cyd3dd4q5tCbOV8MnKUVRUDYMHOir9xn12NZzXVSEd4=
+github.com/blevesearch/bleve/v2 v2.6.0/go.mod h1:gLmI8lWgHgrIYf7UpUX7JISI1CaqC6VScu46mHThuAY=
+github.com/blevesearch/bleve_index_api v1.0.0/go.mod h1:fiwKS0xLEm+gBRgv5mumf0dhgFr2mDgZah1pqv1c1M4=
+github.com/blevesearch/bleve_index_api v1.3.12 h1:MirVNltwGq8z0PhOgiQp+bKL5qq8OvCxEwOOC7NnHNE=
+github.com/blevesearch/bleve_index_api v1.3.12/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
+github.com/blevesearch/geo v0.2.5 h1:yJg9FX1oRwLnjXSXF+ECHfXFTF4diF02Ca/qUGVjJhE=
+github.com/blevesearch/geo v0.2.5/go.mod h1:Jhq7WE2K6mJTx1xS44M2pUO6Io+wjCSHh1+co3YOgH4=
+github.com/blevesearch/go-faiss v1.1.4 h1:wGHK+yiOSIvBAQMr4LcTaHBFf9v1dBebs3WpFqT93Rg=
+github.com/blevesearch/go-faiss v1.1.4/go.mod h1:w3W9AiWsFRGVaMG+/cmJi7iHEAuGyC6blsgO1EzCK/M=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
 github.com/blevesearch/go-porterstemmer v1.0.3/go.mod h1:angGc5Ht+k2xhJdZi511LtmxuEf0OVpvUUNrwmM1P7M=
 github.com/blevesearch/gtreap v0.1.1 h1:2JWigFrzDMR+42WGIN/V2p0cUvn4UP3C4Q5nmaZGW8Y=
 github.com/blevesearch/gtreap v0.1.1/go.mod h1:QaQyDRAT51sotthUWAH4Sj08awFSSWzgYICSZ3w0tYk=
+github.com/blevesearch/mmap-go v1.0.2/go.mod h1:ol2qBqYaOUsGdm7aRMRrYGgPvnwLe6Y+7LMvAB5IbSA=
 github.com/blevesearch/mmap-go v1.2.0 h1:l33nNKPFcBjJUMwem6sAYJPUzhUCABoK9FxZDGiFNBI=
 github.com/blevesearch/mmap-go v1.2.0/go.mod h1:Vd6+20GBhEdwJnU1Xohgt88XCD/CTWcqbCNxkZpyBo0=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.10 h1:C3873+iWZ0YJM2ijaSHhJJzSvD4x1k+5UaQdGygZVhM=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.10/go.mod h1:WUUkAocbkDlNK/kgAE13NvS9oxe+u618mYZ8sOvcCc4=
+github.com/blevesearch/scorch_segment_api/v2 v2.0.1/go.mod h1:lq7yK2jQy1yQjtjTfU931aVqz7pYxEudHaDwOt1tXfU=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7 h1:GlMzW08hcsM3DnLUxhyF/1PcDal1qtvvIuytuph5djw=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7/go.mod h1://IJ7tG3QCf0cWW/aVSXqy77tc1AvLu3fcJLYEvOAFs=
+github.com/blevesearch/segment v0.9.0/go.mod h1:9PfHYUdQCgHktBgvtUOF4x+pc4/l8rdH0u5spnW85UQ=
 github.com/blevesearch/segment v0.9.1 h1:+dThDy+Lvgj5JMxhmOVlgFfkUtZV2kw49xax4+jTfSU=
 github.com/blevesearch/segment v0.9.1/go.mod h1:zN21iLm7+GnBHWTao9I+Au/7MBiL8pPFtJBJTsk6kQw=
 github.com/blevesearch/snowballstem v0.9.0 h1:lMQ189YspGP6sXvZQ4WZ+MLawfV8wOmPoD/iWeNXm8s=
 github.com/blevesearch/snowballstem v0.9.0/go.mod h1:PivSj3JMc8WuaFkTSRDW2SlrulNWPl4ABg1tC/hlgLs=
+github.com/blevesearch/upsidedown_store_api v1.0.1/go.mod h1:MQDVGpHZrpe3Uy26zJBf/a8h0FZY6xJbthIMm8myH2Q=
 github.com/blevesearch/upsidedown_store_api v1.0.2 h1:U53Q6YoWEARVLd1OYNc9kvhBMGZzVrdmaozG2MfoB+A=
 github.com/blevesearch/upsidedown_store_api v1.0.2/go.mod h1:M01mh3Gpfy56Ps/UXHjEO/knbqyQ1Oamg8If49gRwrQ=
+github.com/blevesearch/vellum v1.0.3/go.mod h1:2u5ax02KeDuNWu4/C+hVQMD6uLN4txH1JbtpaDNLJRo=
+github.com/blevesearch/vellum v1.0.4/go.mod h1:cMhywHI0de50f7Nj42YgvyD6bFJ2WkNRvNBlNMrEVgY=
 github.com/blevesearch/vellum v1.2.0 h1:xkDiOEsHc2t3Cp0NsNZZ36pvc130sCzcGKOPMzXe+e0=
 github.com/blevesearch/vellum v1.2.0/go.mod h1:uEcfBJz7mAOf0Kvq6qoEKQQkLODBF46SINYNkZNae4k=
+github.com/blevesearch/zapx/v11 v11.2.0/go.mod h1:gN/a0alGw1FZt/YGTo1G6Z6XpDkeOfujX5exY9sCQQM=
 github.com/blevesearch/zapx/v11 v11.4.3 h1:PTZOO5loKpHC/x/GzmPZNa9cw7GZIQxd5qRjwij9tHY=
 github.com/blevesearch/zapx/v11 v11.4.3/go.mod h1:4gdeyy9oGa/lLa6D34R9daXNUvfMPZqUYjPwiLmekwc=
+github.com/blevesearch/zapx/v12 v12.2.0/go.mod h1:fdjwvCwWWwJW/EYTYGtAp3gBA0geCYGLcVTtJEZnY6A=
 github.com/blevesearch/zapx/v12 v12.4.3 h1:eElXvAaAX4m04t//CGBQAtHNPA+Q6A1hHZVrN3LSFYo=
 github.com/blevesearch/zapx/v12 v12.4.3/go.mod h1:TdFmr7afSz1hFh/SIBCCZvcLfzYvievIH6aEISCte58=
+github.com/blevesearch/zapx/v13 v13.2.0/go.mod h1:o5rAy/lRS5JpAbITdrOHBS/TugWYbkcYZTz6VfEinAQ=
 github.com/blevesearch/zapx/v13 v13.4.3 h1:qsdhRhaSpVnqDFlRiH9vG5+KJ+dE7KAW9WyZz/KXAiE=
 github.com/blevesearch/zapx/v13 v13.4.3/go.mod h1:knK8z2NdQHlb5ot/uj8wuvOq5PhDGjNYQQy0QDnopZk=
+github.com/blevesearch/zapx/v14 v14.2.0/go.mod h1:GNgZusc1p4ot040cBQMRGEZobvwjCquiEKYh1xLFK9g=
 github.com/blevesearch/zapx/v14 v14.4.3 h1:GY4Hecx0C6UTmiNC2pKdeA2rOKiLR5/rwpU9WR51dgM=
 github.com/blevesearch/zapx/v14 v14.4.3/go.mod h1:rz0XNb/OZSMjNorufDGSpFpjoFKhXmppH9Hi7a877D8=
+github.com/blevesearch/zapx/v15 v15.2.0/go.mod h1:MmQceLpWfME4n1WrBFIwplhWmaQbQqLQARpaKUEOs/A=
 github.com/blevesearch/zapx/v15 v15.4.3 h1:iJiMJOHrz216jyO6lS0m9RTCEkprUnzvqAI2lc/0/CU=
 github.com/blevesearch/zapx/v15 v15.4.3/go.mod h1:1pssev/59FsuWcgSnTa0OeEpOzmhtmr/0/11H0Z8+Nw=
 github.com/blevesearch/zapx/v16 v16.3.4 h1:hDAqA8qusZTNbPEL7//w5P65UZ2de6yhSeUaTbp0Po0=
 github.com/blevesearch/zapx/v16 v16.3.4/go.mod h1:zqkPPqs9GS9FzVWzCO3Wf1X044yWAV17+4zb+FTiEHg=
-github.com/blevesearch/zapx/v17 v17.2.3 h1:UYYJPAt5b2tVxldx5h0jmv23RMsg8/UZKFVya7v92po=
-github.com/blevesearch/zapx/v17 v17.2.3/go.mod h1:r7mb4QWbDQSkbAnOjCb9iCfkcrzajB4yBdJpuBIo/fE=
+github.com/blevesearch/zapx/v17 v17.1.6 h1:rVGeyH0EPElBXM4PvjrCdt8LDdRLpa4GC1gMRQkCWUE=
+github.com/blevesearch/zapx/v17 v17.1.6/go.mod h1:c+mPvbZgZnDPOUS5Z9EXhntMcJnpIVjQTM9TF5yEGJM=
 github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
 github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D1fsDb3EJvhqgXRbFx7bs2wqZ10HQPeU8U/Q=
@@ -161,18 +185,18 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
-github.com/buildkite/terminal-to-html/v3 v3.17.1 h1:gs9WhKUwxK27YHf3hijj4tG4wuDLfCANYbRPd5ltMdI=
-github.com/buildkite/terminal-to-html/v3 v3.17.1/go.mod h1:0pv+Z75FC+NvIju2o+Cw+YHIDkueeudIoeyfVm8i8GQ=
-github.com/caddyserver/certmagic v0.25.4 h1:8eIXh0HC3MsGnNo8One+BCxMGTbe5zb/oz+2KsxBFQg=
-github.com/caddyserver/certmagic v0.25.4/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
+github.com/buildkite/terminal-to-html/v3 v3.16.8 h1:QN/daUob6cmK8GcdKnwn9+YTlPr1vNj+oeAIiJK6fPc=
+github.com/buildkite/terminal-to-html/v3 v3.16.8/go.mod h1:+k1KVKROZocrTLsEQ9PEf9A+8+X8uaVV5iO1ZIOwKYM=
+github.com/caddyserver/certmagic v0.25.3 h1:mGf5ba8F7xA4c5jfDZZbK2buY1VEkbnwpMDixaju94A=
+github.com/caddyserver/certmagic v0.25.3/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
 github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
 github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a/go.mod h1:2GxOXOlEPAMFPfp014mK1SWq8G8BN8o7/dfYqJrVGn8=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260812203852-971c0284dc33 h1:YG5mXlv9SxS4rdtSxK3RuH146x1HIQzsbVJqSp/Rvfc=
-github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260812203852-971c0284dc33/go.mod h1:R+SetERD4+IL7QH0WHp9MLifvITvh9gL3g8vX1j2Fcs=
+github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635 h1:RwCfD5XyO8jAermEy6pauh5Q5o6mCvbeNcCPOZlIA5o=
+github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635/go.mod h1:R+SetERD4+IL7QH0WHp9MLifvITvh9gL3g8vX1j2Fcs=
 github.com/chi-middleware/proxy v1.1.1 h1:4HaXUp8o2+bhHr1OhVy+VjN0+L7/07JDcn6v7YrTjrQ=
 github.com/chi-middleware/proxy v1.1.1/go.mod h1:jQwMEJct2tz9VmtCELxvnXoMfa+SOdikvbVJVHv/M+0=
 github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
@@ -187,8 +211,10 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
-github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
-github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
+github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
+github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/couchbase/ghistogram v0.1.0/go.mod h1:s1Jhy76zqfEecpNWJfWUiKZookAFaiGOEoyzgHt9i7k=
 github.com/couchbase/go-couchbase v0.1.1 h1:ClFXELcKj/ojyoTYbsY34QUrrYCBi/1G749sXSCkdhk=
 github.com/couchbase/go-couchbase v0.1.1/go.mod h1:+/bddYDxXsf9qt0xpDUtRR47A2GjaXmGGAqQ/k3GJ8A=
 github.com/couchbase/gomemcached v0.3.4 h1:VGdrZUJbt5lLyI/MXnyVCZKHKYXg/vaud08lJIAeZps=
@@ -196,6 +222,8 @@ github.com/couchbase/gomemcached v0.3.4/go.mod h1:pISAjweI42vljCumsJIo7CVhqIMIIP
 github.com/couchbase/goutils v0.1.2/go.mod h1:h89Ek/tiOxxqjz30nPPlwZdQbdB8BwgnuBxeoUe/ViE=
 github.com/couchbase/goutils v0.3.0 h1:rsv72B6BDjW9jmwlfiDUrdu3EpNvPuo5WLULHzQ0DLE=
 github.com/couchbase/goutils v0.3.0/go.mod h1:7Gm+D3vXfV4HS+hQWvKfy6e6ILCptGXNqBKvQXhplhk=
+github.com/couchbase/moss v0.1.0/go.mod h1:9MaHIaRuy9pvLPUJxB8sh8OrLfyDczECVL37grCIubs=
+github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
@@ -212,15 +240,17 @@ github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55k
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2/v2 v2.7.1 h1:yqDtwI1ptXXvEUNpYTk2lad4jLtAcKqkzepn4savSk4=
-github.com/dlclark/regexp2/v2 v2.7.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/dlclark/regexp2/v2 v2.2.1 h1:mf4KkFUj0gJuarK8P+LgiS+Lit7m9N1yAwEfPbee7R0=
+github.com/dlclark/regexp2/v2 v2.2.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dvyukov/go-fuzz v0.0.0-20210429054444-fca39067bc72/go.mod h1:11Gm+ccJnvAhCNLlf5+cS9KjtbaD5I5zaZpFMsTHWTw=
 github.com/editorconfig/editorconfig-core-go/v2 v2.6.4 h1:CHwUbBVVyKWRX9kt5A/OtwhYUJB32DrFp9xzmjR6cac=
 github.com/editorconfig/editorconfig-core-go/v2 v2.6.4/go.mod h1:JWRVKHdVW+dkv6F8p+xGCa6a+TyMrqsFbFkSs/aQkrQ=
+github.com/elazarl/go-bindata-assetfs v1.0.1/go.mod h1:v+YaWX3bdea5J/mo8dSETolEo7R71Vk1u8bnjau5yw4=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emersion/go-imap v1.2.1 h1:+s9ZjMEjOB8NzZMVTM3cCenz2JrQIGGo5j1df19WjTA=
@@ -232,6 +262,8 @@ github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTe
 github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/ethantkoenig/rupture v1.0.1 h1:6aAXghmvtnngMgQzy7SMGdicMvkV86V4n9fT0meE5E4=
+github.com/ethantkoenig/rupture v1.0.1/go.mod h1:Sjqo/nbffZp1pVVXNGhpugIjsWmuS9KiIB4GtpEBur4=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/fgprof v0.9.5 h1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=
@@ -240,39 +272,41 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
-github.com/fxamacker/cbor/v2 v2.9.3 h1:oQBnFATpNdY8gJHTndDDv5Xl4QqNaz51G5LLEPhng3Q=
-github.com/fxamacker/cbor/v2 v2.9.3/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA=
-github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/getkin/kin-openapi v0.140.0 h1:JFn675aXRFjyiZKa/BFWploGldQlI0gobp4J5k0EZ2g=
+github.com/getkin/kin-openapi v0.140.0/go.mod h1:lISrB64F0CPcuDJ3LdtPTMJBY8VENjR9wJBdrcT6J3g=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 h1:mtDjlmloH7ytdblogrMz1/8Hqua1y8B4ID+bh3rvod0=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1/go.mod h1:fenKRzpXDjNpsIBhuhUzvjCKlDjKam0boRAenTE0Q6A=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
-github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/glycerine/go-unsnap-stream v0.0.0-20181221182339-f9677308dec2/go.mod h1:/20jfyN9Y5QPEAprSgKAUr+glWDY39ZiUEAYOEv5dsE=
+github.com/glycerine/goconvey v0.0.0-20190410193231-58a59202ab31/go.mod h1:Ogl1Tioa0aV7gstGFO7KhffUsb9M4ydbEbbxpcEDc24=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-chi/chi/v5 v5.0.1/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY=
-github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
+github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
-github.com/go-co-op/gocron/v2 v2.22.0 h1:uEuH2F7k7VoESb1BYSaffuuV+T0kkpzsC0aXk7/z79I=
-github.com/go-co-op/gocron/v2 v2.22.0/go.mod h1:hiH/U9RMhTi1BBZJmef9s3KC9QwhpBF6PFrvUKaXY9M=
+github.com/go-co-op/gocron/v2 v2.21.2 h1:bD8/YwkojYHgXFr3iEulL148KBdTbKVxUZzFKpXcdbY=
+github.com/go-co-op/gocron/v2 v2.21.2/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
 github.com/go-enry/go-enry/v2 v2.9.6 h1:np63eOtMV56zfYDHnFVgpEVOk8fr2kmylcMnAZUDbSs=
 github.com/go-enry/go-enry/v2 v2.9.6/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
 github.com/go-enry/go-oniguruma v1.2.1/go.mod h1:bWDhYP+S6xZQgiRL7wlTScFYBe023B6ilRZbCAD5Hf4=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryLCdA=
-github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
-github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
-github.com/go-ldap/ldap/v3 v3.4.14/go.mod h1:S4eJUMUNjDkE0ZJtIZdybwyb03sGGLW6gxXT1Hs8VKA=
+github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
+github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
 github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
 github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
@@ -285,8 +319,8 @@ github.com/go-redis/redis/v7 v7.4.1 h1:PASvf36gyUpr2zdOUS/9Zqc80GbM+9BDyiJSJDDOr
 github.com/go-redis/redis/v7 v7.4.1/go.mod h1:JDNMw23GTyLNC4GZu9njt15ctBQVn7xjRfnwdHj/Dcg=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-redsync/redsync/v4 v4.17.0 h1:FFJ+uxZs44y4Sq10//IFKic9T94AYl+u3Sog98AHzBo=
-github.com/go-redsync/redsync/v4 v4.17.0/go.mod h1:CKVA6qwT07S/916i+Yd9h1/8YFQhCCpPYTQhvvYytJo=
+github.com/go-redsync/redsync/v4 v4.16.0 h1:bNcOzeHH9d3s6pghU9NJFMPrQa41f5Nx3L4YKr3BdEU=
+github.com/go-redsync/redsync/v4 v4.16.0/go.mod h1:V4gagqgyASWBZuwx4xGzu72aZNb/6Mo05byUa3mVmKQ=
 github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
 github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
@@ -294,10 +328,10 @@ github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.18.0 h1:PC8R3PNLEmjZf++WwcQlo1Z39S9rf8ma69rlwkypZhA=
-github.com/go-webauthn/webauthn v0.18.0/go.mod h1:ymzZQhx3D/PrDjznemBdQJ23gHTaSDxUchM7sH1lUCg=
-github.com/go-webauthn/x v0.3.0 h1:Q2X9vbrlP0Ed+QGEzixh1hthGZlDnzVT0XH/9IIQ0kE=
-github.com/go-webauthn/x v0.3.0/go.mod h1:5OkdSQdOy7taRXWqvNHggtaPffmW94ybu3rZEER4I+I=
+github.com/go-webauthn/webauthn v0.17.4 h1:KFTSz3R2RYDiUn/0cDi3XTJgFenSG74eKTTHlqWhlxk=
+github.com/go-webauthn/webauthn v0.17.4/go.mod h1:pZk63EE/BdztlmyS4Yc+9H5g4a8blNlbtGmdHQHbZX8=
+github.com/go-webauthn/x v0.2.6 h1:TEyDuQAIiEgYpx60nKiBJIX/5nSUC8LxNbH+uf5U9uk=
+github.com/go-webauthn/x v0.2.6/go.mod h1:45bA7YEqyQhRcQJ/TiBb46Ww8yqHBGvgEhQ3WWF0aDo=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
@@ -316,6 +350,7 @@ github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EO
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -341,8 +376,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
-github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
+github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
+github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -355,12 +390,13 @@ github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/licenseclassifier/v2 v2.0.0 h1:1Y57HHILNf4m0ABuMVb6xk4vAJYEUO0gDxNpog0pyeA=
 github.com/google/licenseclassifier/v2 v2.0.0/go.mod h1:cOjbdH0kyC9R22sdQbYsFkto4NGCAc+ZSwbeThazEtM=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/pprof v0.0.0-20260604005048-7023385849c0 h1:h1QTMDl6q9wDvDCJVpKQSjgleGFYnd2fOxmg2K+6BGE=
+github.com/google/pprof v0.0.0-20260604005048-7023385849c0/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v0.0.0-20190910122728-9d188e94fb99 h1:twflg0XRTjwKpxb/jFExr4HGq6on2dEOmnL6FV+fgPw=
+github.com/gopherjs/gopherjs v0.0.0-20190910122728-9d188e94fb99/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
@@ -377,10 +413,17 @@ github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pw
 github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
+github.com/graph-gophers/graphql-go v1.10.2 h1:HXu6Wu5klCH4ALn1fQHVI20cjEIa4wftavHIgbLA4Fo=
+github.com/graph-gophers/graphql-go v1.10.2/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
@@ -389,6 +432,7 @@ github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaX
 github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -397,6 +441,7 @@ github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq
 github.com/ianlancetaylor/demangle v0.0.0-20230524184225-eabc099b10ab/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
 github.com/inbucket/html2text v1.0.0 h1:N5kza++4uBBDJ2Z3KUnTRyPNoBcW+YfOgNiNmNB+sgs=
 github.com/inbucket/html2text v1.0.0/go.mod h1:5TrhXQKGU+LXurODaSm55Y9eXoPBRnYiOz4x2XfUoJU=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -426,16 +471,17 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
-github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
+github.com/kljensen/snowball v0.6.0/go.mod h1:27N7E8fVU5H68RlUmnWwZCfxgt4POBJfENGMvNRhldw=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -454,6 +500,7 @@ github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
 github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
 github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/markbates/going v1.0.3 h1:mY45T5TvW+Xz5A6jY7lf4+NLg9D8+iuStIHyR7M8qsE=
 github.com/markbates/going v1.0.3/go.mod h1:fQiT6v6yQar9UD6bd/D4Z5Afbk9J6BBVBtLiyY4gp2o=
@@ -461,14 +508,14 @@ github.com/markbates/goth v1.82.0 h1:8j/c34AjBSTNzO7zTsOyP5IYCQCMBTRBHAbBt/PI0bQ
 github.com/markbates/goth v1.82.0/go.mod h1:/DRlcq0pyqkKToyZjsL2KgiA1zbF1HIjE7u2uC79rUk=
 github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
 github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.13 h1:DC0OMEpGjm6LfNFU4ckYcvbQKyp2vE8atyFGXNtDcf4=
 github.com/mattn/go-shellwords v1.0.13/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.50 h1:dmdFvo1XG4MPzA4IkAmE9upVz/Nj31uRoM5+jC8hYbY=
-github.com/mattn/go-sqlite3 v1.14.50/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/mattn/go-sqlite3 v1.14.45 h1:6KA/spDguL3KV8rnybG7ezSaE4SeMR3KC9VbUoAQaIk=
+github.com/mattn/go-sqlite3 v1.14.45/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/meilisearch/meilisearch-go v0.36.3 h1:Yx1aTY5jDgtbStPVkhJTDoLnZTy5sejQSPyjfNMy6e4=
 github.com/meilisearch/meilisearch-go v0.36.3/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
 github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
@@ -487,10 +534,12 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.3.0 h1:HM4pFCSQq/TK+j0/zmorSh5ddh81iDgRgU0BG0Vz/YU=
-github.com/minio/minio-go/v7 v7.3.0/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk=
+github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
+github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/minio/minlz v1.1.1 h1:OGmft1V6AnI/Wme332U6bhG54nxEan+VFgkD7lat4KM=
 github.com/minio/minlz v1.1.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -498,6 +547,7 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 h1:j2kD3MT1z4PXCiUllUJF9mWUESr9TWKS7iEKsQ/IipM=
 github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450/go.mod h1:skjdDftzkFALcuGzYSklqYd8gvat6F1gZJ4YPVbkZpM=
+github.com/mschoch/smat v0.0.0-20160514031455-90eadee771ae/go.mod h1:qAyveg+e4CE+eKJXWVjKXM4ck2QobLqTDytGJbLLhJg=
 github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
 github.com/msteinert/pam/v2 v2.1.0 h1:er5F9TKV5nGFuTt12ubtqPHEUdeBwReP7vd3wovidGY=
@@ -513,10 +563,10 @@ github.com/nwaples/rardecode/v2 v2.2.3/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsR
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oasdiff/yaml v0.1.1 h1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=
-github.com/oasdiff/yaml v0.1.1/go.mod h1:EYJNoyktvWMJ0Hmhx+6qTaqMOsalUaRGT8Sj1hNcegU=
-github.com/oasdiff/yaml3 v0.0.14 h1:aLJee3hxBK2H5wdXd9iPcIXb93Nty1Ge0pT171eHtkw=
-github.com/oasdiff/yaml3 v0.0.14/go.mod h1:csto2xfDjYccdUn/yw/bPjj/cYTdp6HtFA0J4TWG+gg=
+github.com/oasdiff/yaml v0.1.0 h1:0bqZjfKc/8S9urj4JuwepX41WX9EoA6ifhU3SV06cXg=
+github.com/oasdiff/yaml v0.1.0/go.mod h1:kOlRmMdL2X3vucLCEQO5u61SU22RysnfXvcttrZA1O0=
+github.com/oasdiff/yaml3 v0.0.13 h1:06svmvOHOVBqF81+sY2EUScvUI/iS/vl2VIeUUxZQwg=
+github.com/oasdiff/yaml3 v0.0.13/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
 github.com/olekukonko/errors v1.3.0 h1:teJvgLGUEqMzBUms+Dj3/3szNqCG/Jdw9iDbum8fR6U=
@@ -540,6 +590,8 @@ github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3I
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
+github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/philhofer/fwd v1.0.0/go.mod h1:gk3iGcWd9+svBvR0sR+KPcfE+RNWozjowpeBVG3ZVNU=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=
@@ -555,36 +607,39 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
-github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/common v0.68.1 h1:omjRRl4QP4komogpXuhfeOiisQg7xdy8VM1UY+pStaY=
+github.com/prometheus/common v0.68.1/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/quasoft/websspi v1.1.2 h1:/mA4w0LxWlE3novvsoEL6BBA1WnjJATbjkh1kFrTidw=
 github.com/quasoft/websspi v1.1.2/go.mod h1:HmVdl939dQ0WIXZhyik+ARdI03M6bQzaSEKcgpFmewk=
-github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
-github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
-github.com/redis/rueidis v1.0.76 h1:RdDWuvlYBSp+bTrBvaXqJnNEL3VVzsnjo+0psPFgLc4=
-github.com/redis/rueidis v1.0.76/go.mod h1:UsfHPSbomB6QAVMk4iiFkzRy0nh9o7scDGa+SitvBY4=
-github.com/redis/rueidis/rueidiscompat v1.0.76 h1:7LikbiqCQqCsZXeZ+akgZMnjIV/J0VHih9PIX4gGZC4=
-github.com/redis/rueidis/rueidiscompat v1.0.76/go.mod h1:UatQQLVj4QMIsZtpvRWY28qm6r2d72idhcS+C/RM+Zg=
+github.com/rcrowley/go-metrics v0.0.0-20190826022208-cac0b30c2563/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/redis/go-redis/v9 v9.20.0 h1:WnQYxLkgO2xiXTCJY0ldIiI8dNqCDlQAG+AtaH7a2a0=
+github.com/redis/go-redis/v9 v9.20.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/redis/rueidis v1.0.71 h1:pODtnAR5GAB7j4ekhldZ29HKOxe4Hph0GTDGk1ayEQY=
+github.com/redis/rueidis v1.0.71/go.mod h1:lfdcZzJ1oKGKL37vh9fO3ymwt+0TdjkkUCJxbgpmcgQ=
+github.com/redis/rueidis/rueidiscompat v1.0.71 h1:wNZ//kEjMZgBM0KCk7ncOX8KmAgROU2kDdDNpwheG4w=
+github.com/redis/rueidis/rueidiscompat v1.0.71/go.mod h1:esmCLJvaRzZoKlgB82G1bY7Iky5TnO9Rz+NlhbEccFI=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rhysd/actionlint v1.7.12 h1:vQ4GeJN86C0QH+gTUQcs8McmK62OLT3kmakPMtEWYnY=
 github.com/rhysd/actionlint v1.7.12/go.mod h1:krOUhujIsJusovkaYzQ/VNH8PFexjNKqU0q5XI/4w+g=
+github.com/robertkrimen/godocdown v0.0.0-20130622164427-0bfa04905481/go.mod h1:C9WhFzY47SzYBIvzFqSvHIR6ROgDo4TtdTuRaOMjF/s=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sassoftware/go-rpmutils v0.4.0 h1:ojND82NYBxgwrV+mX1CWsd5QJvvEZTKddtCdFLPWhpg=
 github.com/sassoftware/go-rpmutils v0.4.0/go.mod h1:3goNWi7PGAT3/dlql2lv3+MSN5jNYPjT5mVcQcIsYzI=
 github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
@@ -605,12 +660,20 @@ github.com/smartystreets/goconvey v0.0.0-20190731233626-505e41936337 h1:WN9BUFbd
 github.com/smartystreets/goconvey v0.0.0-20190731233626-505e41936337/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/sorairolake/lzip-go v0.3.8 h1:j5Q2313INdTA80ureWYRhX+1K78mUXfMoPZCw/ivWik=
 github.com/sorairolake/lzip-go v0.3.8/go.mod h1:JcBqGMV0frlxwrsE9sMWXDjqn3EeVf0/54YPsw66qkU=
+github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
+github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf h1:pvbZ0lM0XWPBqUKqFU8cmavspvIl9nulOYwdy6IFRRo=
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf/go.mod h1:RJID2RhlZKId02nZ62WenDCkgHFerpIOmW0iT7GKmXM=
 github.com/stangelandcl/ppmd v0.1.1 h1:c25QazhlWUn5nmR1QOzafKhQxBicAr7GGCKER2aJ8H8=
 github.com/stangelandcl/ppmd v0.1.1/go.mod h1:Rrv7M+/2P5jYr/GMLhBl7Ug3uJ1bUiVzr5LbbaV6xgY=
+github.com/stephens2424/writerset v1.0.2/go.mod h1:aS2JhsMn6eA7e82oNmW4rfsgAOp9COBTTl8mzkwADnc=
+github.com/steveyen/gtreap v0.1.0/go.mod h1:kl/5J7XbrOmlIbYIXdRHDDE5QxHqpk0cmkT7Z4dM9/Y=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -627,32 +690,37 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
-github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203 h1:QVqDTf3h2WHt08YuiTGPZLls0Wq99X9bWd0Q5ZSBesM=
 github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203/go.mod h1:oqN97ltKNihBbwlX8dLpwxCl3+HnXKV/R0e+sRLd9C8=
 github.com/syndtr/goleveldb v1.0.0 h1:fBdIW9lB4Iz0n9khmH8w27SJ3QEJ7+IgjPEwGSZiFdE=
 github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ=
+github.com/tinylib/msgp v1.1.0/go.mod h1:+d+yLhGm8mzTaHzB+wgMYrodPfmZrzkirds8fDWklFE=
 github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
 github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
+github.com/tstranex/u2f v1.0.0 h1:HhJkSzDDlVSVIVt7pDJwCHQj67k7A5EeBgPmeD+pVsQ=
+github.com/tstranex/u2f v1.0.0/go.mod h1:eahSLaqAS0zsIEv80+vXT7WanXs7MQQDg3j3wGBSayo=
+github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
-github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
+github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
+github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.11.0 h1:P/euJp99kb9p0tlVY+iYTLYYTAQlfl0hR2gUO1Img1Q=
-github.com/urfave/cli/v3 v3.11.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
-github.com/wneessen/go-mail v0.8.1 h1:tVcncj02/QySVFw3zr/kXOzZcuFQqBNT6K+Rbgm/pcM=
-github.com/wneessen/go-mail v0.8.1/go.mod h1:dWZ61zadzCIyvB4y1/YzC5O7MrbbzBfPkARmbosdf8w=
+github.com/urfave/cli/v3 v3.9.1 h1:OLU13atWZ0M+a4xmyBuBNOLZsSRYXyPeMeNjOvgYP54=
+github.com/urfave/cli/v3 v3.9.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
+github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
+github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yohcop/openid-go v1.0.1 h1:DPRd3iPO5F6O5zX2e62XpVAbPT6wV51cuucH0z9g3js=
@@ -660,8 +728,8 @@ github.com/yohcop/openid-go v1.0.1/go.mod h1:b/AvD03P0KHj4yuihb+VtLD6bYYgsy0zqBz
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.8.6 h1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=
-github.com/yuin/goldmark v1.8.6/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
+github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
@@ -672,8 +740,9 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.61.0 h1:QTsQS/SQMliXel6VjXr53AKBkn2TiIAP62WxTfhuzaQ=
-gitlab.com/gitlab-org/api/client-go/v2 v2.61.0/go.mod h1:8MV7TChxjlqD7Yp/XUMCF6Pjwz1JVKfQf6uYG2EW/cQ=
+gitlab.com/gitlab-org/api/client-go/v2 v2.38.0 h1:gZSMTTnLcUeY5mH4z3G6GEzbaBTOCUfBCAJXMRyuzEM=
+gitlab.com/gitlab-org/api/client-go/v2 v2.38.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
+go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
@@ -690,12 +759,13 @@ go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
 go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 go4.org v0.0.0-20260112195520-a5071408f32f h1:ziUVAjmTPwQMBmYR1tbdRFJPtTcQUI12fH9QQjfb0Sw=
 go4.org v0.0.0-20260112195520-a5071408f32f/go.mod h1:ZRJnO5ZI4zAwMFp+dS1+V6J6MSyAowhRqAE+DPa1Xp0=
+golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -706,24 +776,27 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
-golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
-golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
+golang.org/x/image v0.42.0 h1:1gSs6ehNWXLbkHBIPcWztk3D/6aIA/8hauiAYtlodVY=
+golang.org/x/image v0.42.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
-golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -734,12 +807,13 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -748,16 +822,20 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181221143128-b4a75ba826a6/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -776,8 +854,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -787,8 +865,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -799,35 +877,37 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200928182047-19e03678916f/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
-google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
-google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -848,30 +928,30 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
-modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
-modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
+modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c=
+modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws=
+modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
-modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
+modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.75.6 h1:yKk8qo+Di4gkmvRboK8ocCqH22FiUCR6jRy2OwtCRus=
-modernc.org/libc v1.75.6/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
+modernc.org/libc v1.73.0 h1:Y/KmTxbIN5T3x+NFjYOzV/+Ha7wKClfIecmTCTuYlqQ=
+modernc.org/libc v1.73.0/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
-modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.58.0 h1:38u40/bwkfM7f0Myhosl+SEMltSDxnGdQf8o6Kjmys0=
-modernc.org/sqlite v1.58.0/go.mod h1:rsD2CckafgObKC4DhBlGBf+RiHxkc3hINGt1Xw32tVY=
+modernc.org/sqlite v1.52.0 h1:p4dhYh2tXZCiyaqHwRVJDjIGKWyXayiQpThxgDzJaxo=
+modernc.org/sqlite v1.52.0/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -880,7 +960,9 @@ mvdan.cc/xurls/v2 v2.6.0 h1:3NTZpeTxYVWNSokW3MKeyVkz/j7uYXYiMtXRUfmjbgI=
 mvdan.cc/xurls/v2 v2.6.0/go.mod h1:bCvEZ1XvdA6wDnxY7jPPjEmigDtvtvPXAD/Exa9IMSk=
 pgregory.net/rapid v0.4.2 h1:lsi9jhvZTYvzVpeG93WWgimPRmiJQfGFRNTEZh1dtY0=
 pgregory.net/rapid v0.4.2/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
+strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab h1:3IZDVyI8uBmZko6pwm39f7mE0aTY7LViNdQHMeH7U60=
+strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
-xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.3.11 h1:i4tlVUASogb0ZZFJHA7dZqoRU2pUpUsutnNdaOlFyMI=
+xorm.io/xorm v1.3.11/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
@@ -17,7 +17,6 @@ import (
 	// register supported doc types
 	_ "gitea.dev/modules/markup/console"
 	_ "gitea.dev/modules/markup/csv"
-	_ "gitea.dev/modules/markup/jupyter"
 	_ "gitea.dev/modules/markup/markdown"
 	_ "gitea.dev/modules/markup/orgmode"

@@ -1,25 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package base
-
-import (
-	"gitea.dev/models/db" //nolint:depguard // allow to access db in migration
-	"gitea.dev/modules/git/gitrepo"
-)
-
-// HINT: MIGRATION-STRUCT-FROZEN: the structs used in migrations should not be affected by the changes happen in the future,
-// because the details can be different in different releases.
-// e.g. if one migration uses "User" model, it works in the early releases,
-// then one day, when the User model changes, the existing migration will break because it will use the new (incorrect) User model,
-// it should only use the old User model.
-//
-// Related: "models", "modules/structs", git repo directory layout on the disk, etc.
-//
-// If changes happen, the old migrations need to use a snapshot struct/function (copy the code and freeze)
-
-type ResourceIndex = db.ResourceIndex
-
-func LocalCodeGitRepo(ownerName, repoName string) gitrepo.RepositoryFacade {
-	return gitrepo.CodeRepoByName(ownerName, repoName)
-}
@@ -1,14 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_14
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-)
-
-func RecreateUserTableToFixDefaultValues(_ context.Context, _ base.EngineMigration) error {
-	return nil
-}
@@ -1,15 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_16
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-)
-
-func UseBase32HexForCredIDInWebAuthnCredential(_ context.Context, x base.EngineMigration) error {
-	// noop
-	return nil
-}
@@ -1,24 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_17
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-	"gitea.dev/modules/timeutil"
-)
-
-func AddReviewViewedFiles(_ context.Context, x base.EngineMigration) error {
-	type ReviewState struct {
-		ID           int64              `xorm:"pk autoincr"`
-		UserID       int64              `xorm:"NOT NULL UNIQUE(pull_commit_user)"`
-		PullID       int64              `xorm:"NOT NULL INDEX UNIQUE(pull_commit_user) DEFAULT 0"`
-		CommitSHA    string             `xorm:"NOT NULL VARCHAR(40) UNIQUE(pull_commit_user)"`
-		UpdatedFiles map[string]uint8   `xorm:"NOT NULL LONGTEXT JSON"`
-		UpdatedUnix  timeutil.TimeStamp `xorm:"updated"`
-	}
-
-	return x.Sync(new(ReviewState))
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
wxiaoguang	0c8be7bee0	FIXME	2026-06-15 14:22:38 +08:00
Nicolas	f25811942c	fix: re-check branch write permission for every ref in a push The pre-receive hook cached the result of CanWriteCode() after the first ref in a batch push, but CanMaintainerWriteToBranch depends on the current branch name. A user holding a per-branch maintainer-edit grant (an open PR with "allow edits from maintainers") could batch that branch with protected branches or tags and have the cached approval reused, escalating to full repository write. Evaluate the permission fresh for every ref; the pusher and base permission remain cached via loadPusherAndPermission. Assisted-by: Claude:claude-opus-4-8	2026-06-13 18:38:06 +02:00
Nicolas	c0c11c551c	fix: enforce single-use TOTP passcodes across all 2FA surfaces The web 2FA login and password-reset paths validated the passcode and then wrote LastUsedPasscode in a non-atomic read-check-write sequence, so two parallel submissions of the same code could each authenticate (TOCTOU). The Basic-Auth X-Gitea-OTP path never recorded the used passcode at all, letting a captured code be replayed for its whole validity window. Add TwoFactor.ValidateAndConsumeTOTP, which validates and atomically marks the passcode used via a conditional UPDATE (rejecting replays and racing duplicates), and route the web login, password-reset, and Basic-Auth paths through it. Assisted-by: Claude:claude-opus-4-8	2026-06-13 18:38:06 +02:00
Nicolas	e99e24cb04	fix: stop trusting all proxies by default in docker app.ini templates The Docker app.ini templates hard-coded REVERSE_PROXY_TRUSTED_PROXIES = *, so with ENABLE_REVERSE_PROXY_AUTHENTICATION enabled any source IP reaching the container could impersonate any user via the X-WEBAUTH-USER header. Align the templates with the documented loopback-only default (127.0.0.0/8,::1/128), matching app.example.ini and the in-code default. Assisted-by: Claude:claude-opus-4-8	2026-06-13 18:38:06 +02:00
Nicolas	c20df84548	fix: block fork sync when base repo is no longer readable POST /api/v1/repos/{owner}/{repo}/merge-upstream kept importing commits from the parent repository even after the parent was switched from public to private, leaking commits a fork owner could no longer access directly. Require the doer to still have read access to the base repo's code before syncing, and map the permission error to 403 (API) / not-found (web). Assisted-by: Claude:claude-opus-4-8	2026-06-13 17:36:35 +02:00
Nicolas	24ce5ae082	fix: enforce org visibility on organization label read endpoints The GET /api/v1/orgs/{org}/labels and GET /api/v1/orgs/{org}/labels/{id} endpoints did not check whether the caller could see the organization, so labels of a private org were disclosed to non-members (and anonymously for the list route). Add a reqOrgVisible() middleware mirroring the visibility check used by org.Get and apply it to the labels group.	2026-06-13 17:30:10 +02:00