Merge branch 'main' into renovate/major-go-dependencies

Otherwise, the user just isn't able to use "auto merge" form

.github/actions/docker-dryrun/action.yml

@@ -9,10 +9,10 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+    - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
     - name: Build regular image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
       with:
         context: .
         platforms: ${{ inputs.platform }}
@@ -20,7 +20,7 @@ runs:
         file: Dockerfile
         cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
     - name: Build rootless image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
       with:
         context: .
         platforms: ${{ inputs.platform }}

.github/actions/go-cache/action.yml

@@ -16,34 +16,34 @@ runs:
   using: composite
   steps:
     - if: ${{ github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/go/pkg/mod
         key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
     - if: ${{ github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/go/pkg/mod
         key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
         restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
     - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/go-build
         key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
     - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/go-build
         key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
         restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
     - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/golangci-lint
         key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
     - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/golangci-lint
         key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}

.github/actions/node-setup/action.yml

@@ -13,10 +13,10 @@ runs:
     - if: ${{ inputs.cache == 'true' }}
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: 24
+        node-version: 26
         cache: pnpm
         cache-dependency-path: pnpm-lock.yaml
     - if: ${{ inputs.cache != 'true' }}
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: 24
+        node-version: 26

.github/workflows/cron-renovate.yml

@@ -21,12 +21,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
+      - uses: renovatebot/github-action@b50d2ba2bd928235abdcc14d06dfafc217f1c565 # v46.1.18
         with:
           renovate-version: ${{ env.RENOVATE_VERSION }}
           configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:
           RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg|generate-codemirror-languages)$"]'
           RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'

.github/workflows/files-changed.yml

@@ -50,7 +50,7 @@ jobs:
       shell: ${{ steps.changes.outputs.shell }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         with:
           filters: |

.github/workflows/pull-compliance.yml

@@ -42,7 +42,7 @@ jobs:
       - run: make lint-spell
 
       - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           python-version: 3.14
       - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'

.github/workflows/pull-db-tests.yml

@@ -131,7 +131,7 @@ jobs:
         ports:
           - "7700:7700"
       redis:
-        image: redis:latest@sha256:c904002d182255b6db3cbe3a1e8ce6c187d15390c39500b59fc07181aabff7bf
+        image: redis:latest@sha256:5d2c689b4b55fc3fab4b0cc8aaa950f85b508c76c1e0f35a90d8f411d55a8b2b
         options: >- # wait until redis has started
           --health-cmd "redis-cli ping"
           --health-interval 5s

.github/workflows/pull-labeler.yml

@@ -17,7 +17,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         with:
           sync-labels: true
 
@@ -35,7 +35,7 @@ jobs:
           ref: ${{ github.event.pull_request.base.sha }}
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 24
+          node-version: 26
       # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
       - run: node ./tools/ci-tools.ts lint-pr-title
         env:

.github/workflows/release-nightly-snapcraft.yml

@@ -6,40 +6,30 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   build-and-publish:
-    runs-on: ubuntu-latest
-
-    env:
-      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Install snapcraft
-        run: sudo snap install snapcraft --classic
-
-      - name: Authenticate snapcraft
-        shell: bash
-        run: snapcraft login --with <(printf '%s' "$SNAPCRAFT_STORE_CREDENTIALS")
-
-      - name: Remote build
-        run: |
-          snapcraft remote-build \
-            --launchpad-accept-public-upload \
-            --build-for=amd64,arm64,armhf
-
-      - name: List built snaps
-        run: find . -maxdepth 1 -type f -name '*.snap' -print
-
-      - name: Upload and release snapcraft nightly build
-        run: |
-          set -euo pipefail
-
-          for snap in ./*.snap; do
-            echo "Uploading $snap to edge"
-            snapcraft upload --release="latest/edge" "$snap"
-          done
+        with:
+          fetch-depth: 0
+      - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
+        id: build
+      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        with:
+          snap: ${{ steps.build.outputs.snap }}
+          release: latest/edge

.github/workflows/release-nightly.yml

@@ -23,12 +23,7 @@ jobs:
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
       - run: make deps-frontend deps-backend
       # xgo build
       - run: make release
@@ -61,7 +56,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -83,8 +78,8 @@ jobs:
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Get cleaned branch name
         id: clean_name
         env:
@@ -92,7 +87,7 @@ jobs:
         run: |
           REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:
           images: |-
@@ -102,7 +97,7 @@ jobs:
             type=raw,value=${{ steps.clean_name.outputs.branch }}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta_rootless
         with:
           images: |-
@@ -116,18 +111,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -137,7 +132,7 @@ jobs:
           cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
           cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
       - name: build rootless docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64

.github/workflows/release-tag-rc.yml

@@ -24,12 +24,7 @@ jobs:
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
       - run: make deps-frontend deps-backend
       # xgo build
       - run: make release
@@ -62,7 +57,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -94,9 +89,9 @@ jobs:
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:
           images: |-
@@ -109,7 +104,7 @@ jobs:
             type=semver,pattern={{version}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta_rootless
         with:
           images: |-
@@ -125,18 +120,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -144,7 +139,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64

.github/workflows/release-tag-version.yml

@@ -27,12 +27,7 @@ jobs:
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
       - run: make deps-frontend deps-backend
       # xgo build
       - run: make release
@@ -65,7 +60,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -97,9 +92,9 @@ jobs:
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:
           images: |-
@@ -116,7 +111,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta_rootless
         with:
           images: |-
@@ -137,18 +132,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -156,7 +151,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64

MAINTAINERS

@@ -41,7 +41,6 @@ Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
-Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)

Makefile

@@ -12,13 +12,13 @@ COMMA := ,
 XGO_VERSION := go-1.26.x
 
 AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.8.0 # renovate: datasource=go
 GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.1 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.35.0 # renovate: datasource=go
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.4.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.5.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
 SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker
 
@@ -231,7 +231,9 @@ endif
 generate-swagger: $(SWAGGER_SPEC) $(OPENAPI3_SPEC) ## generate the swagger spec from code comments
 
 $(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
-	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'
+	@output="$$($(GO) run $(SWAGGER_PACKAGE) generate spec --enable-allof-compounding --skip-enum-desc --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)' 2>&1)" || { printf '%s\n' "$$output" >&2; exit 1; }; \
+	warnings="$$(printf '%s\n' "$$output" | grep -v '^go: ')"; \
+	if [ -n "$$warnings" ]; then printf '%s\n' "$$warnings" >&2; exit 1; fi
 
 .PHONY: swagger-check
 swagger-check: generate-swagger
@@ -246,9 +248,11 @@ swagger-check: generate-swagger
 swagger-validate: ## check if the swagger spec is valid
 	@# swagger "validate" requires that the "basePath" must start with a slash, but we are using Golang template "{{...}}"
 	@$(SED_INPLACE) -E -e 's|"basePath":( *)"(.*)"|"basePath":\1"/\2"|g' './$(SWAGGER_SPEC)' # add a prefix slash to basePath
-	@# FIXME: there are some warnings
-	$(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)'
-	@$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)' # remove the prefix slash from basePath
+	@output="$$($(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)' 2>&1)"; status=$$?; \
+	$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)'; \
+	printf '%s\n' "$$output" | grep -v '^go: '; \
+	[ $$status -eq 0 ] || exit $$status; \
+	case "$$output" in *WARNING:*) exit 1;; esac
 
 .PHONY: generate-openapi3
 generate-openapi3: $(OPENAPI3_SPEC) ## generate the OpenAPI 3.0 spec from the Swagger 2.0 spec

assets/codemirror-languages.json

@@ -436,6 +436,7 @@
       "jsonl",
       "mcmeta",
       "sarif",
+      "slnlaunch",
       "tact",
       "tfstate",
       "topojson",
@@ -691,10 +692,17 @@
     "extensions": [
       "ini",
       "cnf",
+      "container",
       "dof",
       "lektorproject",
+      "mount",
+      "network",
       "prefs",
       "properties",
+      "service",
+      "socket",
+      "target",
+      "timer",
       "url",
       "conf"
     ],

cmd/admin_user.go

@@ -18,6 +18,7 @@ func newUserCommand() *cli.Command {
 			microcmdUserDelete(),
 			newUserGenerateAccessTokenCommand(),
 			microcmdUserMustChangePassword(),
+			microcmdUserDisableTwoFactor(),
 		},
 	}
 }

cmd/admin_user_disable_2fa.go

@@ -0,0 +1,72 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+
+	"github.com/urfave/cli/v3"
+)
+
+func microcmdUserDisableTwoFactor() *cli.Command {
+	return &cli.Command{
+		Name:  "disable-2fa",
+		Usage: "Disable two-factor authentication for a user",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "username",
+				Aliases: []string{"u"},
+				Usage:   "Username of the user to disable 2FA for",
+			},
+			&cli.Int64Flag{
+				Name:  "id",
+				Usage: "ID of the user to disable 2FA for",
+			},
+		},
+		Action: runDisableTwoFactor,
+	}
+}
+
+func runDisableTwoFactor(ctx context.Context, c *cli.Command) error {
+	if !c.IsSet("id") && !c.IsSet("username") {
+		return errors.New("either --id or --username must be provided")
+	}
+
+	if !setting.IsInTesting {
+		if err := initDB(ctx); err != nil {
+			return err
+		}
+	}
+
+	var user *user_model.User
+	var err error
+	if c.IsSet("id") {
+		user, err = user_model.GetUserByID(ctx, c.Int64("id"))
+	} else {
+		user, err = user_model.GetUserByName(ctx, c.String("username"))
+	}
+	if err != nil {
+		return err
+	}
+
+	// When both selectors are given, make sure they refer to the same user.
+	if c.IsSet("id") && c.IsSet("username") && user.LowerName != strings.ToLower(strings.TrimSpace(c.String("username"))) {
+		return fmt.Errorf("the user with id %d is %q, which does not match the provided username %q", user.ID, user.Name, c.String("username"))
+	}
+
+	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, user.ID)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Disabled 2FA for user %q (removed %d TOTP and %d WebAuthn credential(s))\n", user.Name, totp, webAuthn)
+	return nil
+}

cmd/admin_user_disable_2fa_test.go

@@ -0,0 +1,119 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"io"
+	"strconv"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	"github.com/go-webauthn/webauthn/webauthn"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDisableTwoFactorCommand(t *testing.T) {
+	ctx := t.Context()
+
+	defer func() {
+		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}, &auth_model.TwoFactor{}, &auth_model.WebAuthnCredential{}))
+	}()
+
+	t.Run("disable TOTP and WebAuthn", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "tfuser", "--email", "tfuser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "tfuser"})
+
+		// Enroll TOTP.
+		tf := &auth_model.TwoFactor{UID: user.ID}
+		require.NoError(t, tf.SetSecret("test-secret"))
+		_, err := tf.GenerateScratchToken()
+		require.NoError(t, err)
+		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
+
+		// Register a WebAuthn credential.
+		_, err = auth_model.CreateCredential(ctx, user.ID, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
+		require.NoError(t, err)
+
+		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		require.True(t, has)
+
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "tfuser"}))
+
+		// Both factors must be gone afterwards.
+		has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		assert.False(t, has)
+	})
+
+	t.Run("disable by id", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "iduser", "--email", "iduser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "iduser"})
+
+		tf := &auth_model.TwoFactor{UID: user.ID}
+		require.NoError(t, tf.SetSecret("test-secret"))
+		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
+
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", strconv.FormatInt(user.ID, 10)}))
+
+		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		assert.False(t, has)
+	})
+
+	t.Run("no enrollment is a no-op", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "plainuser", "--email", "plainuser@gitea.local", "--random-password"}))
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "plainuser"}))
+	})
+
+	t.Run("id and username must match when both given", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "matchuser", "--email", "matchuser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "matchuser"})
+		id := strconv.FormatInt(user.ID, 10)
+
+		// Matching id + username is accepted.
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", id, "--username", "matchuser"}))
+
+		// Mismatched id + username is rejected.
+		cmd := microcmdUserDisableTwoFactor()
+		cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
+		err := cmd.Run(ctx, []string{"disable-2fa", "--id", id, "--username", "someotheruser"})
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "does not match the provided username")
+	})
+
+	t.Run("failure cases", func(t *testing.T) {
+		testCases := []struct {
+			name        string
+			args        []string
+			expectedErr string
+		}{
+			{
+				name:        "user does not exist",
+				args:        []string{"disable-2fa", "--username", "nonexistentuser"},
+				expectedErr: "user does not exist",
+			},
+			{
+				name:        "neither id nor username",
+				args:        []string{"disable-2fa"},
+				expectedErr: "either --id or --username must be provided",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				cmd := microcmdUserDisableTwoFactor()
+				cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
+				err := cmd.Run(ctx, tc.args)
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.expectedErr)
+			})
+		}
+	})
+}

custom/conf/app.example.ini

@@ -536,6 +536,13 @@ INTERNAL_TOKEN =
 ;; Leave it empty to apply the default policy, or set it to "unset" to disable Content-Security-Policy.
 ;CONTENT_SECURITY_POLICY_GENERAL =
 
+;; Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
+;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
+;; CIDR list: 1.2.3.0/8, 2001:db8::/32
+;; Wildcard hosts: *.mydomain.com, 192.168.100.*
+;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
+;ALLOWED_HOST_LIST = external
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [camo]
@@ -1191,6 +1198,7 @@ LEVEL = Info
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
+;; "branch-name" always uses the PR's branch name.
 ;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
@@ -1754,13 +1762,6 @@ LEVEL = Info
 ;; Deliver timeout in seconds
 ;DELIVER_TIMEOUT = 5
 ;;
-;; Webhook can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
-;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
-;; CIDR list: 1.2.3.0/8, 2001:db8::/32
-;; Wildcard hosts: *.mydomain.com, 192.168.100.*
-;; Since 1.15.7. Default to * for 1.15.x, external for 1.16 and later
-;ALLOWED_HOST_LIST = external
-;;
 ;; Allow insecure certification
 ;SKIP_TLS_VERIFY = false
 ;;
@@ -3008,6 +3009,10 @@ LEVEL = Info
 ;SCOPED_WORKFLOW_DIRS = .gitea/scoped_workflows
 ;; Maximum number of attempts a single workflow run can have. Default value is 50.
 ;MAX_RERUN_ATTEMPTS = 50
+;; Maximum number of runners that may run the task-assignment query concurrently, per Gitea instance.
+;; Caps this instance's DB load when many runners poll at once; excess runners retry on their next poll.
+;; In a multi-instance deployment the cluster-wide limit is this value times the number of instances. Default value is 16.
+;MAX_CONCURRENT_TASK_PICKS = 16
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

docs/community-governance.md

@@ -95,8 +95,15 @@ However, if there are no objections from maintainers, the PR can be merged with
 ### Commit messages
 
 Mergers are required to rewrite the PR title and the first comment (the summary) when necessary so the squash commit message is clear.
+Usually the Pull Request description and commit message body should not be empty, unless the title is already clear enough or the description would be a copy of the comments in code.
 
-The final commit message should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
+The final commit message:
+
+- should match the code changes.
+- should only keep true co-authors, false-positive co-authors should be removed.
+- should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
+- should not contain hidden information like `<!-- -->` or extra information after the description's divider `----`.
+- should not contain unrelated contents (e.g.: Release Notes, Configuration, etc.) from a Renovate update PR.
 
 #### PR Co-authors
 
@@ -158,9 +165,16 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:
 
 - Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
-- Rewriting the PR title and summary so the squash [commit message](#commit-messages) is clear, removing false-positive co-authors while keeping every true co-author.
+- Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
+  In particular, mergers should edit the PR description.\
+  Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.
 - Assigning the correct labels (including `type/…`) needed for changelog and backport decisions.
 - Agreeing, together with the owners, on when a release is ready (see [release management](release-management.md)).
+- Merging a PR also means the PR looks good to the merger and is approved by the merger.
+
+If a merger violates these merge guides more than 3 times in the past 365 days
+(e.g.: merge with unresolved reviews without TOC decision to ignore the review, merge with garbage commit messages),
+they may lose their merging privileges for at least three months.
 
 #### Becoming a merger
 
@@ -200,20 +214,20 @@ random.seed("Gitea TOC <YEAR> Election")
 random.choice([<CANDIDATE_1>, <CANDIDATE_2>, ...])
 ```
 
-The result of this script needs then to be published in the TOC election issue to ensure transparency of the process. 
+The result of this script needs then to be published in the TOC election issue to ensure transparency of the process.
 
 ### Current TOC members
 
 - 2026-06-14 ~ 2026-12-31
   - Company
-    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
+    - [Yu Tian](https://gitea.com/Zettat123) <zettat123@gmail.com>
     - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
     - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
   - Community
     - [bircni](https://gitea.com/bircni) <bircni@icloud.com>
     - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
     - [TheFox0x7](https://gitea.com/TheFox0x7) <thefox0x7@gmail.com>
-    
+
 
 ### Previous TOC/owners members
 
@@ -227,7 +241,7 @@ Here's the history of the owners and the time they served:
 - [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
 - [6543](https://gitea.com/6543) - 2023, 2025
 - [John Olheiser](https://gitea.com/jolheiser) - 2023, 2024
-- [Jason Song](https://gitea.com/wolfogre) - 2023
+- [Jason Song](https://gitea.com/wolfogre) - 2023, 2025
 
 ## Governance Compensation
 

eslint.config.ts

@@ -1,6 +1,4 @@
-import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
-import deMorgan from 'eslint-plugin-de-morgan';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
 import playwright from 'eslint-plugin-playwright';
@@ -15,7 +13,6 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
-import type {ESLint} from 'eslint';
 
 import unescapedHtmlLiteral from './tools/eslint-rules/unescaped-html-literal.ts';
 
@@ -64,10 +61,8 @@ export default defineConfig([
       '@eslint-community/eslint-comments': comments,
       '@stylistic': stylistic,
       '@typescript-eslint': typescriptPlugin.plugin,
-      'array-func': arrayFunc,
-      'de-morgan': deMorgan,
       'gitea': {rules: {'unescaped-html-literal': unescapedHtmlLiteral}},
-      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
+      'import-x': importPlugin,
       regexp,
       sonarjs,
       unicorn,
@@ -278,12 +273,6 @@ export default defineConfig([
       '@typescript-eslint/unified-signatures': [2],
       'accessor-pairs': [2],
       'array-callback-return': [2, {checkForEach: true}],
-      'array-func/avoid-reverse': [2],
-      'array-func/from-map': [2],
-      'array-func/no-unnecessary-this-arg': [2],
-      'array-func/prefer-array-from': [2],
-      'array-func/prefer-flat-map': [0], // handled by unicorn/prefer-array-flat-map
-      'array-func/prefer-flat': [0], // handled by unicorn/prefer-array-flat
       'arrow-body-style': [0],
       'block-scoped-var': [2],
       'camelcase': [0],
@@ -294,8 +283,6 @@ export default defineConfig([
       'consistent-this': [0],
       'constructor-super': [2],
       'curly': [0],
-      'de-morgan/no-negated-conjunction': [2],
-      'de-morgan/no-negated-disjunction': [2],
       'default-case-last': [2],
       'default-case': [0],
       'default-param-last': [0],
@@ -745,6 +732,7 @@ export default defineConfig([
       'unicorn/consistent-json-file-read': [2],
       'unicorn/consistent-optional-chaining': [2],
       'unicorn/consistent-template-literal-escape': [2],
+      'unicorn/consistent-tuple-labels': [2],
       'unicorn/custom-error-definition': [0],
       'unicorn/default-export-style': [2],
       'unicorn/dom-node-dataset': [2, {preferAttributes: true}],
@@ -778,6 +766,7 @@ export default defineConfig([
       'unicorn/no-array-sort-for-min-max': [2],
       'unicorn/no-array-splice': [0],
       'unicorn/no-asterisk-prefix-in-documentation-comments': [0],
+      'unicorn/no-async-promise-finally': [2],
       'unicorn/no-await-expression-member': [0],
       'unicorn/no-await-in-promise-methods': [2],
       'unicorn/no-blob-to-file': [2],
@@ -814,8 +803,10 @@ export default defineConfig([
       'unicorn/no-invalid-fetch-options': [2],
       'unicorn/no-invalid-file-input-accept': [2],
       'unicorn/no-invalid-remove-event-listener': [2],
+      'unicorn/no-invalid-well-known-symbol-methods': [2],
       'unicorn/no-keyword-prefix': [0],
       'unicorn/no-late-current-target-access': [2],
+      'unicorn/no-late-event-control': [2],
       'unicorn/no-lonely-if': [2],
       'unicorn/no-loop-iterable-mutation': [2],
       'unicorn/no-magic-array-flat-depth': [0],
@@ -852,9 +843,11 @@ export default defineConfig([
       'unicorn/no-uncalled-method': [2],
       'unicorn/no-undeclared-class-members': [2],
       'unicorn/no-unnecessary-array-flat-depth': [2],
+      'unicorn/no-unnecessary-array-flat-map': [2],
       'unicorn/no-unnecessary-array-splice-count': [2],
       'unicorn/no-unnecessary-await': [2],
       'unicorn/no-unnecessary-boolean-comparison': [2],
+      'unicorn/no-unnecessary-fetch-options': [0],
       'unicorn/no-unnecessary-global-this': [0],
       'unicorn/no-unnecessary-nested-ternary': [2],
       'unicorn/no-unnecessary-polyfills': [2],
@@ -867,6 +860,7 @@ export default defineConfig([
       'unicorn/no-unreadable-object-destructuring': [0],
       'unicorn/no-unsafe-buffer-conversion': [2],
       'unicorn/no-unsafe-dom-html': [0],
+      'unicorn/no-unsafe-promise-all-settled-values': [2],
       'unicorn/no-unsafe-property-key': [0],
       'unicorn/no-unsafe-string-replacement': [0],
       'unicorn/no-unused-array-method-return': [2],
@@ -896,13 +890,17 @@ export default defineConfig([
       'unicorn/number-literal-case': [0],
       'unicorn/numeric-separators-style': [0],
       'unicorn/operator-assignment': [2],
+      'unicorn/prefer-abort-signal-any': [2],
+      'unicorn/prefer-abort-signal-timeout': [2],
       'unicorn/prefer-add-event-listener': [2],
       'unicorn/prefer-add-event-listener-options': [2],
+      'unicorn/prefer-aggregate-error': [2],
       'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
       'unicorn/prefer-array-flat': [2],
       'unicorn/prefer-array-flat-map': [2],
       'unicorn/prefer-array-from-async': [2],
       'unicorn/prefer-array-from-map': [2],
+      'unicorn/prefer-array-from-range': [2],
       'unicorn/prefer-array-index-of': [2],
       'unicorn/prefer-array-iterable-methods': [2],
       'unicorn/prefer-array-last-methods': [2],
@@ -912,6 +910,7 @@ export default defineConfig([
       'unicorn/prefer-await': [2],
       'unicorn/prefer-bigint-literals': [2],
       'unicorn/prefer-blob-reading-methods': [2],
+      'unicorn/prefer-block-statement-over-iife': [2],
       'unicorn/prefer-boolean-return': [2],
       'unicorn/prefer-class-fields': [2],
       'unicorn/prefer-classlist-toggle': [2],
@@ -924,15 +923,18 @@ export default defineConfig([
       'unicorn/prefer-dom-node-append': [2],
       'unicorn/prefer-dom-node-html-methods': [0],
       'unicorn/prefer-dom-node-remove': [2],
+      'unicorn/prefer-dom-node-replace-children': [2],
       'unicorn/prefer-dom-node-text-content': [2],
       'unicorn/prefer-early-return': [0],
       'unicorn/prefer-else-if': [2],
+      'unicorn/prefer-error-is-error': [0],
       'unicorn/prefer-event-target': [2],
       'unicorn/prefer-export-from': [0],
       'unicorn/prefer-flat-math-min-max': [2],
       'unicorn/prefer-get-or-insert-computed': [2],
       'unicorn/prefer-global-number-constants': [2],
       'unicorn/prefer-global-this': [0],
+      'unicorn/prefer-group-by': [2],
       'unicorn/prefer-has-check': [2],
       'unicorn/prefer-hoisting-branch-code': [2],
       'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
@@ -942,6 +944,7 @@ export default defineConfig([
       'unicorn/prefer-includes-over-repeated-comparisons': [0], // too opinionated
       'unicorn/prefer-iterable-in-constructor': [2],
       'unicorn/prefer-iterator-concat': [0], // too opinionated
+      'unicorn/prefer-iterator-helpers': [2],
       'unicorn/prefer-iterator-to-array': [2],
       'unicorn/prefer-iterator-to-array-at-end': [2],
       'unicorn/prefer-keyboard-event-key': [2],
@@ -966,9 +969,11 @@ export default defineConfig([
       'unicorn/prefer-object-destructuring-defaults': [2],
       'unicorn/prefer-object-from-entries': [2],
       'unicorn/prefer-object-iterable-methods': [2],
+      'unicorn/prefer-observer-apis': [2],
       'unicorn/prefer-optional-catch-binding': [2],
       'unicorn/prefer-path2d': [2],
       'unicorn/prefer-private-class-fields': [0],
+      'unicorn/prefer-promise-try': [2],
       'unicorn/prefer-promise-with-resolvers': [2],
       'unicorn/prefer-prototype-methods': [0],
       'unicorn/prefer-query-selector': [2],
@@ -979,10 +984,12 @@ export default defineConfig([
       'unicorn/prefer-response-static-json': [2],
       'unicorn/prefer-scoped-selector': [0],
       'unicorn/prefer-set-has': [0],
+      'unicorn/prefer-set-methods': [0],
       'unicorn/prefer-set-size': [2],
       'unicorn/prefer-short-arrow-method': [2],
       'unicorn/prefer-simple-condition-first': [0],
       'unicorn/prefer-simple-sort-comparator': [2],
+      'unicorn/prefer-simplified-conditions': [2],
       'unicorn/prefer-single-array-predicate': [2],
       'unicorn/prefer-single-call': [2],
       'unicorn/prefer-single-object-destructuring': [2],
@@ -1002,6 +1009,7 @@ export default defineConfig([
       'unicorn/prefer-switch': [0],
       'unicorn/prefer-temporal': [0],
       'unicorn/prefer-ternary': [0],
+      'unicorn/prefer-toggle-attribute': [2],
       'unicorn/prefer-top-level-await': [0],
       'unicorn/prefer-type-error': [0],
       'unicorn/prefer-type-literal-last': [0],
@@ -1010,6 +1018,7 @@ export default defineConfig([
       'unicorn/prefer-unicode-code-point-escapes': [0],
       'unicorn/prefer-url-can-parse': [2],
       'unicorn/prefer-url-href': [2],
+      'unicorn/prefer-url-search-parameters': [2],
       'unicorn/prefer-while-loop-condition': [2],
       'unicorn/prevent-abbreviations': [0],
       'unicorn/relative-url-style': [2],

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776877367,
-        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
+        "lastModified": 1782723713,
+        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
+        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
         "type": "github"
       },
       "original": {

flake.nix

@@ -34,7 +34,7 @@
 
               # only bump toolchain versions here
               go = pkgs.go_1_26;
-              nodejs = pkgs.nodejs_24;
+              nodejs = pkgs.nodejs_26;
               python3 = pkgs.python314;
               pnpm = pkgs.pnpm_10;
 

go.mod

@@ -13,7 +13,7 @@ require (
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
 	gitea.dev/actions-proto-go v0.6.0
-	gitea.dev/sdk v1.1.0
+	gitea.dev/sdk v1.2.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
@@ -24,8 +24,8 @@ require (
 	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
 	github.com/alecthomas/chroma/v2 v2.27.0
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.25
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
@@ -57,7 +57,7 @@ require (
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v88 v88.0.0
+	github.com/google/go-github/v89 v89.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
 	github.com/google/pprof v0.0.0-20260604005048-7023385849c0
 	github.com/google/uuid v1.6.0
@@ -68,8 +68,8 @@ require (
 	github.com/huandu/xstrings v1.5.0
 	github.com/jhillyerd/enmime/v2 v2.4.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.18.6
-	github.com/klauspost/cpuid/v2 v2.3.0
+	github.com/klauspost/compress v1.19.0
+	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.22
@@ -78,7 +78,7 @@ require (
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.10.0
-	github.com/minio/minio-go/v7 v7.2.0
+	github.com/minio/minio-go/v7 v7.2.1
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/opencontainers/go-digest v1.0.0
@@ -96,12 +96,12 @@ require (
 	github.com/tstranex/u2f v1.0.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.10.0
+	github.com/urfave/cli/v3 v3.10.1
 	github.com/wneessen/go-mail v0.7.3
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.42.0
+	gitlab.com/gitlab-org/api/client-go/v2 v2.44.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
 	golang.org/x/crypto v0.53.0
 	golang.org/x/image v0.43.0
@@ -111,14 +111,14 @@ require (
 	golang.org/x/sync v0.21.0
 	golang.org/x/sys v0.46.0
 	golang.org/x/text v0.38.0
-	google.golang.org/grpc v1.81.1
+	google.golang.org/grpc v1.82.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.3
 	modernc.org/sqlite v1.53.0
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.3.11
+	xorm.io/xorm v1.4.1
 )
 
 require (

go.sum

@@ -28,8 +28,8 @@ gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGq
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
 gitea.dev/actions-proto-go v0.6.0 h1:gjllYQ5vmwlkqOeofTQu5qKTZpmf7kWsafoHvoPCSzY=
 gitea.dev/actions-proto-go v0.6.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
-gitea.dev/sdk v1.1.0 h1:wLlz03WkLEiXa2bQpO1JQBTlYf7tQI2neYtZK1kU+TE=
-gitea.dev/sdk v1.1.0/go.mod h1:Zfl+EZXdsGGCLkryDfsmvYrQo6GKMl4U3BJA8Beu+cs=
+gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
+gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -94,14 +94,14 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
 github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.25 h1:TzPVjfUZ1hsKafvYE+DIzKXIik2KufQxsPHanlkttbo=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.25/go.mod h1:K4hw0buguVvtC74HnVfTRr0LzQQHAWPqJbBU9QGk2Pg=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 h1:f3vKqSo13fhTYb+JEcXwXefZQE26I1FB5eTSniU67ko=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29/go.mod h1:MzoLFUArKGpGD+ukmPiTPG1X5x4o6M2kq4v2dr1FiEc=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJagbOyotl/cxoLY4xviKuE7p2GY=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4 h1:Uu+wqrOXozYYvaxcNIqjFsMTjoIJIZDN3R0f70ZIjyQ=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5 h1:mY0qCJuWfbRxok5sRkGxehMGshSYAVIskDvPE4zIZwM=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
 github.com/aws/smithy-go v1.27.2 h1:y9NPmSE6am6LjEFPfqHqG/jJk7AauQvhCJONKh7kpzk=
 github.com/aws/smithy-go v1.27.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
@@ -376,8 +376,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
-github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -413,8 +413,6 @@ github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pw
 github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
-github.com/graph-gophers/graphql-go v1.10.2 h1:HXu6Wu5klCH4ALn1fQHVI20cjEIa4wftavHIgbLA4Fo=
-github.com/graph-gophers/graphql-go v1.10.2/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -471,12 +469,12 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
+github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -534,8 +532,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
-github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
+github.com/minio/minio-go/v7 v7.2.1 h1:PfBfwvKB/MmqyN8Vb1G9voWisaM9OrLv+WwOvMwS9Dw=
+github.com/minio/minio-go/v7 v7.2.1/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/minio/minlz v1.1.1 h1:OGmft1V6AnI/Wme332U6bhG54nxEan+VFgkD7lat4KM=
 github.com/minio/minlz v1.1.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -709,8 +707,8 @@ github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.10.0 h1:0aU8yOObVDMkM13Cj4G+zb4P0PdeJMec65f81Ak1ioM=
-github.com/urfave/cli/v3 v3.10.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.10.1 h1:7Kx9H50hrHbRbyxgO1KP6/BcbiGRz0uYh5YyQ30JEEY=
+github.com/urfave/cli/v3 v3.10.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
 github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
@@ -740,8 +738,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0 h1:Bq5YIYgUJVbt4Hbh7ibBwNR4SNEafsyDVhIXl7dXDdg=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
+gitlab.com/gitlab-org/api/client-go/v2 v2.44.0 h1:Vtv2WKC8p9BAygu5VCZlZUwDhTQ7UMlS3PErXyjUmeY=
+gitlab.com/gitlab-org/api/client-go/v2 v2.44.0/go.mod h1:pTbeBowtVA+0/ZExWEZYUGOrpu5qlRN5ZyOUf27BnVY=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -898,8 +896,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -964,5 +962,5 @@ strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab h1:3IZDVyI
 strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.3.11 h1:i4tlVUASogb0ZZFJHA7dZqoRU2pUpUsutnNdaOlFyMI=
-xorm.io/xorm v1.3.11/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
+xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=

models/actions/run.go

@@ -121,7 +121,7 @@ func (run *ActionRun) PrettyRef() string {
 	return refName.ShortName()
 }
 
-// RefTooltip return a tooltop of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
+// RefTooltip return a tooltip of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
 func (run *ActionRun) RefTooltip() string {
 	payload, err := run.GetPullRequestEventPayload()
 	if err == nil && payload != nil && payload.PullRequest != nil {
@@ -277,6 +277,12 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }
 
+func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
+	var runs []*ActionRun
+	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
+	return runs, err
+}
+
 func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
 	run, has, err := db.Get[ActionRun](ctx, builder.Eq{"repo_id": repoID, "`index`": runIndex})
 	if err != nil {

models/actions/run_job_list.go

@@ -99,6 +99,10 @@ type FindRunJobOptions struct {
 	UpdatedBefore    timeutil.TimeStamp
 	ConcurrencyGroup string
 	OrderBy          db.SearchOrderBy
+	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
+	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
+	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
+	AccessibleRepoIDsSubQuery *builder.Builder
 }
 
 var JobOrderByMap = map[string]map[string]db.SearchOrderBy{
@@ -132,6 +136,9 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 		}
 		cond = cond.And(builder.Eq{"`action_run_job`.concurrency_group": opts.ConcurrencyGroup})
 	}
+	if opts.AccessibleRepoIDsSubQuery != nil {
+		cond = cond.And(builder.In("`action_run_job`.repo_id", opts.AccessibleRepoIDsSubQuery))
+	}
 	return cond
 }
 

models/actions/run_list.go

@@ -70,6 +70,10 @@ type FindRunOptions struct {
 	Status           []Status
 	ConcurrencyGroup string
 	CommitSHA        string
+	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
+	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
+	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
+	AccessibleRepoIDsSubQuery *builder.Builder
 }
 
 func (opts FindRunOptions) ToConds() builder.Cond {
@@ -101,6 +105,9 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.CommitSHA != "" {
 		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
 	}
+	if opts.AccessibleRepoIDsSubQuery != nil {
+		cond = cond.And(builder.In("`action_run`.repo_id", opts.AccessibleRepoIDsSubQuery))
+	}
 	return cond
 }
 
@@ -135,8 +142,8 @@ type StatusInfo struct {
 
 // GetStatusInfoList returns a slice of StatusInfo
 func GetStatusInfoList(ctx context.Context, lang translation.Locale) []StatusInfo {
-	// same as those in aggregateJobStatus
-	allStatus := []Status{StatusSuccess, StatusFailure, StatusWaiting, StatusRunning, StatusCancelling}
+	// same as those in aggregateJobStatus (StatusUnknown excluded; it's the "shouldn't happen" fallback)
+	allStatus := []Status{StatusSuccess, StatusFailure, StatusCancelled, StatusSkipped, StatusWaiting, StatusRunning, StatusBlocked, StatusCancelling}
 	statusInfoList := make([]StatusInfo, 0, len(allStatus))
 	for _, s := range allStatus {
 		statusInfoList = append(statusInfoList, StatusInfo{

models/actions/run_list_test.go

@@ -73,8 +73,11 @@ func TestGetStatusInfoList(t *testing.T) {
 	assert.Equal(t, []StatusInfo{
 		{Status: int(StatusSuccess), StatusName: StatusSuccess.String(), DisplayedStatus: "actions.status.success"},
 		{Status: int(StatusFailure), StatusName: StatusFailure.String(), DisplayedStatus: "actions.status.failure"},
+		{Status: int(StatusCancelled), StatusName: StatusCancelled.String(), DisplayedStatus: "actions.status.cancelled"},
+		{Status: int(StatusSkipped), StatusName: StatusSkipped.String(), DisplayedStatus: "actions.status.skipped"},
 		{Status: int(StatusWaiting), StatusName: StatusWaiting.String(), DisplayedStatus: "actions.status.waiting"},
 		{Status: int(StatusRunning), StatusName: StatusRunning.String(), DisplayedStatus: "actions.status.running"},
+		{Status: int(StatusBlocked), StatusName: StatusBlocked.String(), DisplayedStatus: "actions.status.blocked"},
 		{Status: int(StatusCancelling), StatusName: StatusCancelling.String(), DisplayedStatus: "actions.status.cancelling"},
 	}, statusInfoList)
 }

models/actions/runner.go

@@ -75,8 +75,28 @@ type ActionRunner struct {
 const (
 	RunnerOfflineTime = time.Minute
 	RunnerIdleTime    = 10 * time.Second
+	// RunnerHeartbeatInterval is how often last_online is persisted on poll.
+	// Must stay well below RunnerOfflineTime so runners don't flap to offline.
+	RunnerHeartbeatInterval = 30 * time.Second
+	// RunnerActiveInterval is how often last_active is persisted while a runner
+	// streams task updates and logs. Must stay well below RunnerIdleTime so a
+	// busy runner keeps showing ACTIVE without a DB write on every RPC.
+	RunnerActiveInterval = 5 * time.Second
 )
 
+// ShouldPersistLastOnline reports whether last_online is stale enough to be
+// worth writing back. Avoids a DB write on every runner poll.
+func ShouldPersistLastOnline(last timeutil.TimeStamp, now time.Time) bool {
+	return now.Sub(last.AsTime()) >= RunnerHeartbeatInterval
+}
+
+// ShouldPersistLastActive reports whether last_active is stale enough to be
+// worth writing back. Avoids a DB write on every UpdateTask/UpdateLog RPC while
+// a runner is actively streaming logs.
+func ShouldPersistLastActive(last timeutil.TimeStamp, now time.Time) bool {
+	return now.Sub(last.AsTime()) >= RunnerActiveInterval
+}
+
 // BelongsToOwnerName before calling, should guarantee that all attributes are loaded
 func (r *ActionRunner) BelongsToOwnerName() string {
 	if r.RepoID != 0 {
@@ -251,21 +271,24 @@ func (opts FindRunnerOptions) ToConds() builder.Cond {
 }
 
 func (opts FindRunnerOptions) ToOrders() string {
+	// A unique tiebreaker (id) is appended so that runners sharing the same
+	// last_online or name keep a deterministic order across paginated queries,
+	// otherwise the same runner may appear on more than one page.
 	switch opts.Sort {
 	case "online":
-		return "last_online DESC"
+		return "last_online DESC, id ASC"
 	case "offline":
-		return "last_online ASC"
+		return "last_online ASC, id ASC"
 	case "alphabetically":
-		return "name ASC"
+		return "name ASC, id ASC"
 	case "reversealphabetically":
-		return "name DESC"
+		return "name DESC, id ASC"
 	case "newest":
 		return "id DESC"
 	case "oldest":
 		return "id ASC"
 	}
-	return "last_online DESC"
+	return "last_online DESC, id ASC"
 }
 
 // GetRunnerByUUID returns a runner via uuid

models/actions/runner_test.go

@@ -0,0 +1,149 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestShouldPersistLastOnline(t *testing.T) {
+	now := time.Now()
+	tests := []struct {
+		name string
+		last timeutil.TimeStamp
+		want bool
+	}{
+		{
+			name: "fresh, skip write",
+			last: timeutil.TimeStamp(now.Add(-5 * time.Second).Unix()),
+			want: false,
+		},
+		{
+			name: "exactly at interval, write",
+			last: timeutil.TimeStamp(now.Add(-RunnerHeartbeatInterval).Unix()),
+			want: true,
+		},
+		{
+			name: "stale, write",
+			last: timeutil.TimeStamp(now.Add(-2 * RunnerHeartbeatInterval).Unix()),
+			want: true,
+		},
+		{
+			name: "zero (never seen), write",
+			last: 0,
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, ShouldPersistLastOnline(tt.last, now))
+		})
+	}
+}
+
+func TestShouldPersistLastActive(t *testing.T) {
+	now := time.Now()
+	tests := []struct {
+		name string
+		last timeutil.TimeStamp
+		want bool
+	}{
+		{
+			name: "fresh, skip write",
+			last: timeutil.TimeStamp(now.Add(-1 * time.Second).Unix()),
+			want: false,
+		},
+		{
+			name: "exactly at interval, write",
+			last: timeutil.TimeStamp(now.Add(-RunnerActiveInterval).Unix()),
+			want: true,
+		},
+		{
+			name: "stale, write",
+			last: timeutil.TimeStamp(now.Add(-2 * RunnerActiveInterval).Unix()),
+			want: true,
+		},
+		{
+			name: "zero (never seen), write",
+			last: 0,
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, ShouldPersistLastActive(tt.last, now))
+		})
+	}
+}
+
+func TestFindRunnerOptions_ToOrders_StableTiebreaker(t *testing.T) {
+	// Sorts on a non-unique column must end with the unique id tiebreaker so
+	// pagination is deterministic; without it, runners sharing the same
+	// last_online or name can appear on more than one page. Sorts already on
+	// the unique id need no tiebreaker.
+	expected := map[string]string{
+		"":                      "last_online DESC, id ASC",
+		"online":                "last_online DESC, id ASC",
+		"offline":               "last_online ASC, id ASC",
+		"alphabetically":        "name ASC, id ASC",
+		"reversealphabetically": "name DESC, id ASC",
+		"newest":                "id DESC",
+		"oldest":                "id ASC",
+	}
+	for sort, want := range expected {
+		assert.Equal(t, want, FindRunnerOptions{Sort: sort}.ToOrders(), "sort %q", sort)
+	}
+}
+
+func TestFindRunners_PaginationNoDuplicates(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	// Create several runners that all share the same last_online value so the
+	// primary sort key (last_online) is tied for all of them.
+	const ownerID = 1000
+	const count = 6
+	for i := range count {
+		runner := &ActionRunner{
+			Name:       "paginated-runner",
+			UUID:       fmt.Sprintf("PAGINATE-TEST-0000-0000-00000000000%d", i),
+			TokenHash:  fmt.Sprintf("paginate-test-token-hash-%d", i),
+			OwnerID:    ownerID,
+			RepoID:     0,
+			LastOnline: 42,
+		}
+		require.NoError(t, db.Insert(ctx, runner))
+	}
+
+	// Page through the runners and ensure every id is returned exactly once.
+	seen := make(map[int64]int)
+	const pageSize = 2
+	for page := 1; ; page++ {
+		runners, err := db.Find[ActionRunner](ctx, FindRunnerOptions{
+			ListOptions: db.ListOptions{Page: page, PageSize: pageSize},
+			OwnerID:     ownerID,
+		})
+		require.NoError(t, err)
+		if len(runners) == 0 {
+			break
+		}
+		for _, r := range runners {
+			seen[r.ID]++
+		}
+	}
+
+	assert.Len(t, seen, count, "each runner should be returned exactly once across all pages")
+	for id, n := range seen {
+		assert.Equal(t, 1, n, "runner %d appeared on %d pages", id, n)
+	}
+}

models/actions/task.go

@@ -16,6 +16,7 @@ import (
 	"gitea.dev/models/db"
 	"gitea.dev/models/unit"
 	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/timeutil"
@@ -231,6 +232,11 @@ func makeTaskStepDisplayName(step *jobparser.Step, limit int) (name string) {
 // another runner won the optimistic-lock race; it is never returned to callers.
 var errJobAlreadyClaimed = errors.New("job already claimed by another runner")
 
+// pickTaskBatchSize bounds how many waiting jobs each CreateTaskForRunner query loads,
+// so a large backlog is not fetched into memory on every runner poll.
+// It is a var only so tests can shrink it to exercise pagination cheaply.
+var pickTaskBatchSize = 100
+
 // CreateTaskForRunner finds a waiting job that matches the runner's labels and
 // atomically claims it. It iterates through all matching jobs so that a
 // concurrent claim by another runner (which would lose the optimistic lock on
@@ -249,31 +255,51 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 			Join("INNER", "repo_unit", "`repository`.id = `repo_unit`.repo_id").
 			Where(builder.Eq{"`repository`.owner_id": runner.OwnerID, "`repo_unit`.type": unit.TypeActions}))
 	}
-	if jobCond.IsValid() {
-		jobCond = builder.In("run_id", builder.Select("id").From("action_run").Where(jobCond))
-	}
-
-	var jobs []*ActionRunJob
-	if err := e.Where("task_id=? AND status=? AND is_reusable_caller=?", 0, StatusWaiting, false).And(jobCond).Asc("updated", "id").Find(&jobs); err != nil {
-		return nil, false, err
-	}
+	baseCond := builder.Eq{"task_id": 0, "status": StatusWaiting, "is_reusable_caller": false}.And(jobCond)
 
 	// TODO: a more efficient way to filter labels
 	log.Trace("runner labels: %v", runner.AgentLabels)
-	for _, v := range jobs {
-		if !runner.CanMatchLabels(v.RunsOn) {
-			continue
+
+	// Page through the waiting jobs oldest-first instead of loading the whole backlog into memory on every poll.
+	// Keyset pagination on (updated, id) is safe under concurrent claims:
+	// updated only moves forward, so the advancing cursor never skips a still-waiting job even as claimed jobs drop out.
+	var cursorUpdated timeutil.TimeStamp
+	var cursorID int64
+	for {
+		cond := baseCond
+		if cursorID > 0 {
+			cond = cond.And(builder.Or(
+				builder.Gt{"updated": cursorUpdated},
+				builder.And(builder.Eq{"updated": cursorUpdated}, builder.Gt{"id": cursorID}),
+			))
 		}
-		task, ok, err := claimJobForRunner(ctx, runner, v)
-		if err != nil {
+
+		var jobs []*ActionRunJob
+		if err := e.Where(cond).Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
 			return nil, false, err
 		}
-		if ok {
-			return task, true, nil
+
+		for _, v := range jobs {
+			if !runner.CanMatchLabels(v.RunsOn) {
+				continue
+			}
+			task, ok, err := claimJobForRunner(ctx, runner, v)
+			if err != nil {
+				return nil, false, err
+			}
+			if ok {
+				return task, true, nil
+			}
+			// Another runner claimed this job concurrently; try the next one.
 		}
-		// Another runner claimed this job concurrently; try the next one.
+
+		// A short page means no waiting jobs remain beyond it.
+		if len(jobs) < pickTaskBatchSize {
+			return nil, false, nil
+		}
+		last := jobs[len(jobs)-1]
+		cursorUpdated, cursorID = last.Updated, last.ID
 	}
-	return nil, false, nil
 }
 
 // claimJobForRunner attempts to atomically claim job for runner inside its own
@@ -413,6 +439,18 @@ func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
 	return err
 }
 
+func getRunIDByTaskID(ctx context.Context, taskID int64) (runID int64, _ error) {
+	if has, err := db.GetEngine(ctx).Cols("action_run_job.run_id").
+		Table("action_task").
+		Join("INNER", "action_run_job", "action_run_job.id = action_task.job_id").
+		Where(builder.Eq{"action_task.id": taskID}).Get(&runID); err != nil {
+		return runID, err
+	} else if !has {
+		return runID, util.ErrNotExist
+	}
+	return runID, nil
+}
+
 // UpdateTaskByState updates the task by the state.
 // It will always update the task if the state is not final, even there is no change.
 // So it will update ActionTask.Updated to avoid the task being judged as a zombie task.
@@ -422,21 +460,26 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 		stepStates[v.Id] = v
 	}
 
-	return db.WithTx2(ctx, func(ctx context.Context) (*ActionTask, error) {
-		e := db.GetEngine(ctx)
-
-		task := &ActionTask{}
-		if has, err := e.ID(state.Id).Get(task); err != nil {
-			return nil, err
+	// Only one request can update the task because the final state needs to be calculated with all job states.
+	// Otherwise, concurrent requests with transaction will make the SQL read stale job state and result in wrong final state.
+	taskID := state.Id
+	runID, err := getRunIDByTaskID(ctx, taskID)
+	if err != nil {
+		return nil, err
+	}
+	task := &ActionTask{}
+	err = globallock.LockAndDo(ctx, fmt.Sprintf("UpdateTaskByState-run-%d", runID), func(ctx context.Context) error {
+		if has, err := db.GetEngine(ctx).ID(taskID).Get(task); err != nil {
+			return err
 		} else if !has {
-			return nil, util.ErrNotExist
+			return util.ErrNotExist
 		} else if runnerID != task.RunnerID {
-			return nil, errors.New("invalid runner for task")
+			return errors.New("invalid runner for task")
 		}
 
 		if task.Status.IsDone() {
 			// the state is final, do nothing
-			return task, nil
+			return nil
 		}
 
 		// state.Result is not unspecified means the task is finished
@@ -449,7 +492,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			}
 			task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
 			if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
-				return nil, err
+				return err
 			}
 			if _, err := UpdateRunJob(ctx, &ActionRunJob{
 				ID:      task.JobID,
@@ -457,18 +500,18 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 				Status:  task.Status,
 				Stopped: task.Stopped,
 			}, nil, "status", "stopped"); err != nil {
-				return nil, err
+				return err
 			}
 		} else {
 			// Force update ActionTask.Updated to avoid the task being judged as a zombie task
 			task.Updated = timeutil.TimeStampNow()
 			if err := UpdateTask(ctx, task, "updated"); err != nil {
-				return nil, err
+				return err
 			}
 		}
 
 		if err := task.LoadAttributes(ctx); err != nil {
-			return nil, err
+			return err
 		}
 
 		for _, step := range task.Steps {
@@ -485,13 +528,13 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			} else if step.Started != 0 {
 				step.Status = StatusRunning
 			}
-			if _, err := e.ID(step.ID).Update(step); err != nil {
-				return nil, err
+			if _, err := db.GetEngine(ctx).ID(step.ID).Update(step); err != nil {
+				return err
 			}
 		}
-
-		return task, nil
+		return nil
 	})
+	return task, err
 }
 
 func StopTask(ctx context.Context, taskID int64, status Status) error {

models/actions/task_test.go

@@ -371,3 +371,74 @@ func TestReleaseTaskForRunner(t *testing.T) {
 	unittest.AssertNotExistsBean(t, &ActionTask{ID: task.ID})
 	unittest.AssertNotExistsBean(t, &ActionTaskStep{TaskID: task.ID})
 }
+
+// TestCreateTaskForRunnerPagination verifies that a job sitting beyond the first page is still claimed
+func TestCreateTaskForRunnerPagination(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	defer func(orig int) { pickTaskBatchSize = orig }(pickTaskBatchSize)
+	pickTaskBatchSize = 2
+
+	run := &ActionRun{
+		Title:         "pagination-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         9903,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/main",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusWaiting,
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	// Five waiting jobs the runner cannot run, then one it can.
+	// With a page size of 2 the matching job only appears on the third page.
+	for i := range 5 {
+		mismatch := &ActionRunJob{
+			RunID:     run.ID,
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+			Name:      "mismatch-" + string(rune('a'+i)),
+			Attempt:   1,
+			JobID:     "mismatch-" + string(rune('a'+i)),
+			Status:    StatusWaiting,
+			RunsOn:    []string{"windows-latest"},
+		}
+		require.NoError(t, db.Insert(t.Context(), mismatch))
+	}
+
+	target := &ActionRunJob{
+		RunID:           run.ID,
+		RepoID:          run.RepoID,
+		OwnerID:         run.OwnerID,
+		CommitSHA:       run.CommitSHA,
+		Name:            "target-job",
+		Attempt:         1,
+		JobID:           "target-job",
+		Status:          StatusWaiting,
+		RunsOn:          []string{"ubuntu-latest"},
+		WorkflowPayload: []byte("on: push\njobs:\n  target-job:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hi\n"),
+	}
+	require.NoError(t, db.Insert(t.Context(), target))
+
+	runner := &ActionRunner{
+		UUID:        "pagination-runner-uuid",
+		Name:        "pagination-runner",
+		AgentLabels: []string{"ubuntu-latest"},
+	}
+	runner.GenerateAndFillToken()
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task, ok, err := CreateTaskForRunner(t.Context(), runner)
+	require.NoError(t, err)
+	require.True(t, ok)
+	require.NotNil(t, task)
+
+	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: target.ID})
+	assert.Equal(t, StatusRunning, claimed.Status)
+	assert.Equal(t, task.ID, claimed.TaskID)
+}

models/asymkey/ssh_key_parse.go

@@ -36,7 +36,18 @@ import (
 
 const ssh2keyStart = "---- BEGIN SSH2 PUBLIC KEY ----"
 
+const (
+	// the longest RSA key ssh-keygen allows to generate is 16384 bits (2048 bytes), we still relax the limit a little here
+	maxKeyBinaryBytes        = 4096
+	maxKeyContentBase64Bytes = maxKeyBinaryBytes * 4 / 3
+	maxKeyContentExtraBytes  = 4 * 1024 // header, footer, comment
+	maxKeyContentBytes       = maxKeyContentBase64Bytes + maxKeyContentExtraBytes
+)
+
 func extractTypeFromBase64Key(key string) (string, error) {
+	if len(key) > maxKeyContentBase64Bytes {
+		return "", util.NewInvalidArgumentErrorf("SSH public key base64 is too long")
+	}
 	b, err := base64.StdEncoding.DecodeString(key)
 	if err != nil || len(b) < 4 {
 		return "", fmt.Errorf("invalid key format: %w", err)
@@ -52,6 +63,10 @@ func extractTypeFromBase64Key(key string) (string, error) {
 
 // parseKeyString parses any key string in OpenSSH or SSH2 format to clean OpenSSH string (RFC4253).
 func parseKeyString(content string) (string, error) {
+	if len(content) > maxKeyContentBytes {
+		return "", util.NewInvalidArgumentErrorf("SSH public key content is too long")
+	}
+
 	// remove whitespace at start and end
 	content = strings.TrimSpace(content)
 
@@ -63,6 +78,8 @@ func parseKeyString(content string) (string, error) {
 		// Transform all legal line endings to a single "\n".
 		content = strings.NewReplacer("\r\n", "\n", "\r", "\n").Replace(content)
 
+		var b strings.Builder
+		b.Grow(len(content))
 		lines := strings.Split(content, "\n")
 		continuationLine := false
 
@@ -74,9 +91,10 @@ func parseKeyString(content string) (string, error) {
 			if continuationLine || strings.ContainsAny(line, ":-") {
 				continuationLine = strings.HasSuffix(line, "\\")
 			} else {
-				keyContent += line
+				b.WriteString(line)
 			}
 		}
+		keyContent = b.String()
 
 		t, err := extractTypeFromBase64Key(keyContent)
 		if err != nil {

models/asymkey/ssh_key_test.go

@@ -473,10 +473,20 @@ func runErr(t *testing.T, stdin []byte, args ...string) {
 	}
 }
 
-func Test_PublicKeysAreExternallyManaged(t *testing.T) {
+func TestPublicKeysAreExternallyManaged(t *testing.T) {
 	key1 := unittest.AssertExistsAndLoadBean(t, &PublicKey{ID: 1})
 	externals, err := PublicKeysAreExternallyManaged(t.Context(), []*PublicKey{key1})
 	assert.NoError(t, err)
 	assert.Len(t, externals, 1)
 	assert.False(t, externals[0])
 }
+
+// TestCheckPublicKeyStringOversized tests if oversized SSH2 public key strings are rejected before triggering costly operations.
+func TestCheckPublicKeyStringOversized(t *testing.T) {
+	_, err := parseKeyString(strings.Repeat("a", maxKeyContentBytes+1))
+	assert.ErrorContains(t, err, "SSH public key content is too long")
+
+	content := "---- BEGIN SSH2 PUBLIC KEY ----\n" + strings.Repeat("a", maxKeyContentBase64Bytes+1) + "\n--- END SSH2 PUBLIC KEY ----"
+	_, err = parseKeyString(content)
+	assert.ErrorContains(t, err, "SSH public key base64 is too long")
+}

models/auth/access_token_scope.go

@@ -304,6 +304,36 @@ func (s AccessTokenScope) PublicOnly() (bool, error) {
 	return bitmap.hasScope(AccessTokenScopePublicOnly)
 }
 
+// CanCreateChildScope reports whether a request authenticated by this (parent) scope may mint a token
+// carrying the child scope. It rejects any grantable scope the parent does not hold, closing the
+// scope-escalation path. public-only is a restriction rather than a grantable permission, so it is
+// ignored here (a child may always be public-only); EnforcePublicOnlyFrom handles carrying it down.
+func (s AccessTokenScope) CanCreateChildScope(child AccessTokenScope) (bool, error) {
+	requested := child.StringSlice()
+	scopes := make([]AccessTokenScope, 0, len(requested))
+	for _, sc := range requested {
+		childScope := AccessTokenScope(sc)
+		if childScope == AccessTokenScopePublicOnly {
+			continue
+		}
+		scopes = append(scopes, childScope)
+	}
+	return s.HasScope(scopes...)
+}
+
+// EnforcePublicOnlyFrom adds the public-only restriction to s when the authorizing parent scope is
+// public-only, so a public-only token cannot mint a child token that drops the restriction.
+func (s AccessTokenScope) EnforcePublicOnlyFrom(parent AccessTokenScope) (AccessTokenScope, error) {
+	publicOnly, err := parent.PublicOnly()
+	if err != nil {
+		return "", err
+	}
+	if !publicOnly {
+		return s, nil
+	}
+	return AccessTokenScope(string(s) + "," + string(AccessTokenScopePublicOnly)).Normalize()
+}
+
 // HasScope returns true if the string has the given scope
 func (s AccessTokenScope) HasScope(scopes ...AccessTokenScope) (bool, error) {
 	bitmap, err := s.parse()

models/auth/access_token_scope_test.go

@@ -89,3 +89,26 @@ func TestAccessTokenScope_HasScope(t *testing.T) {
 		})
 	}
 }
+
+func TestAccessTokenScope_EnforcePublicOnlyFrom(t *testing.T) {
+	tests := []struct {
+		in     AccessTokenScope
+		parent AccessTokenScope
+		out    AccessTokenScope
+	}{
+		// public-only parent forces the restriction onto the minted scope
+		{"write:user", "write:user,public-only", "public-only,write:user"},
+		// already public-only stays public-only
+		{"public-only,read:user", "public-only", "public-only,read:user"},
+		// non-public-only parent leaves the scope untouched
+		{"write:user", "write:user", "write:user"},
+		{"all", "all", "all"},
+	}
+	for _, test := range tests {
+		t.Run(string(test.parent)+"->"+string(test.in), func(t *testing.T) {
+			got, err := test.in.EnforcePublicOnlyFrom(test.parent)
+			assert.NoError(t, err)
+			assert.Equal(t, test.out, got)
+		})
+	}
+}

models/auth/twofactor.go

@@ -195,3 +195,18 @@ func HasTwoFactorOrWebAuthn(ctx context.Context, id int64) (bool, error) {
 	}
 	return HasWebAuthnRegistrationsByUID(ctx, id)
 }
+
+// DisableTwoFactor removes every two-factor method of the given user atomically,
+// returning the number of TOTP records and WebAuthn credentials removed.
+// It is a no-op for a user that has no 2FA enrolled.
+func DisableTwoFactor(ctx context.Context, uid int64) (totp, webAuthn int64, err error) {
+	err = db.WithTx(ctx, func(ctx context.Context) error {
+		var e error
+		if totp, e = db.GetEngine(ctx).Where("uid = ?", uid).Delete(&TwoFactor{}); e != nil {
+			return e
+		}
+		webAuthn, e = db.GetEngine(ctx).Where("user_id = ?", uid).Delete(&WebAuthnCredential{})
+		return e
+	})
+	return totp, webAuthn, err
+}

models/auth/twofactor_test.go

@@ -10,6 +10,7 @@ import (
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/unittest"
 
+	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pquerna/otp/totp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -45,3 +46,37 @@ func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
 	require.NoError(t, err)
 	assert.False(t, ok)
 }
+
+func TestDisableTwoFactor(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	const uid = 1000 // a uid with no user/2FA fixtures
+
+	// Enroll TOTP and register a WebAuthn credential.
+	tfa := &auth_model.TwoFactor{UID: uid}
+	require.NoError(t, tfa.SetSecret("test-secret"))
+	require.NoError(t, auth_model.NewTwoFactor(ctx, tfa))
+	_, err := auth_model.CreateCredential(ctx, uid, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
+	require.NoError(t, err)
+
+	has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
+	require.NoError(t, err)
+	require.True(t, has)
+
+	// Both records are removed and counted separately.
+	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, uid)
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, totp)
+	assert.EqualValues(t, 1, webAuthn)
+
+	has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
+	require.NoError(t, err)
+	assert.False(t, has)
+
+	// A second call on a user without 2FA is a no-op.
+	totp, webAuthn, err = auth_model.DisableTwoFactor(ctx, uid)
+	require.NoError(t, err)
+	assert.EqualValues(t, 0, totp)
+	assert.EqualValues(t, 0, webAuthn)
+}

models/issues/comment.go

@@ -27,6 +27,7 @@ import (
 	"gitea.dev/modules/markup"
 	"gitea.dev/modules/optional"
 	"gitea.dev/modules/references"
+	"gitea.dev/modules/setting"
 	"gitea.dev/modules/structs"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/translation"
@@ -626,11 +627,18 @@ func UpdateCommentAttachments(ctx context.Context, c *Comment, uuids []string) e
 		return nil
 	}
 	return db.WithTx(ctx, func(ctx context.Context) error {
+		issue, err := GetIssueByID(ctx, c.IssueID)
+		if err != nil {
+			return err
+		}
 		attachments, err := repo_model.GetAttachmentsByUUIDs(ctx, uuids)
 		if err != nil {
 			return fmt.Errorf("getAttachmentsByUUIDs [uuids: %v]: %w", uuids, err)
 		}
 		for i := range attachments {
+			if err := validateAttachmentForIssue(ctx, issue, attachments[i]); err != nil {
+				return err
+			}
 			attachments[i].IssueID = c.IssueID
 			attachments[i].CommentID = c.ID
 			if err := repo_model.UpdateAttachment(ctx, attachments[i]); err != nil {
@@ -643,36 +651,18 @@ func UpdateCommentAttachments(ctx context.Context, c *Comment, uuids []string) e
 }
 
 // LoadAssigneeUserAndTeam if comment.Type is CommentTypeAssignees, then load assignees
-func (c *Comment) LoadAssigneeUserAndTeam(ctx context.Context) error {
-	var err error
-
+func (c *Comment) LoadAssigneeUserAndTeam(ctx context.Context) (err error) {
 	if c.AssigneeID > 0 && c.Assignee == nil {
-		c.Assignee, err = user_model.GetUserByID(ctx, c.AssigneeID)
+		_, c.Assignee, err = user_model.GetPossibleUserByID(ctx, c.AssigneeID)
 		if err != nil {
-			if !user_model.IsErrUserNotExist(err) {
-				return err
-			}
-			c.Assignee = user_model.NewGhostUser()
-		}
-	} else if c.AssigneeTeamID > 0 && c.AssigneeTeam == nil {
-		if err = c.LoadIssue(ctx); err != nil {
 			return err
 		}
-
-		if err = c.Issue.LoadRepo(ctx); err != nil {
+	}
+	if c.AssigneeTeamID > 0 && c.AssigneeTeam == nil {
+		_, c.AssigneeTeam, err = organization.GetPossibleTeamByID(ctx, c.AssigneeTeamID)
+		if err != nil {
 			return err
 		}
-
-		if err = c.Issue.Repo.LoadOwner(ctx); err != nil {
-			return err
-		}
-
-		if c.Issue.Repo.Owner.IsOrganization() {
-			c.AssigneeTeam, err = organization.GetTeamByID(ctx, c.AssigneeTeamID)
-			if err != nil && !organization.IsErrTeamNotExist(err) {
-				return err
-			}
-		}
 	}
 	return nil
 }
@@ -795,8 +785,7 @@ func (c *Comment) MetaSpecialDoerTr(locale translation.Locale) template.HTML {
 }
 
 func (c *Comment) TimelineRequestedReviewTr(locale translation.Locale, createdStr template.HTML) template.HTML {
-	if c.AssigneeID > 0 {
-		// it guarantees LoadAssigneeUserAndTeam has been called, and c.Assignee is Ghost user but not nil if the user doesn't exist
+	if c.Assignee != nil {
 		if c.RemovedAssignee {
 			if c.PosterID == c.AssigneeID {
 				return locale.Tr("repo.issues.review.remove_review_request_self", createdStr)
@@ -805,14 +794,20 @@ func (c *Comment) TimelineRequestedReviewTr(locale translation.Locale, createdSt
 		}
 		return locale.Tr("repo.issues.review.add_review_request", c.Assignee.GetDisplayName(), createdStr)
 	}
-	teamName := "Ghost Team"
 	if c.AssigneeTeam != nil {
-		teamName = c.AssigneeTeam.Name
+		if c.RemovedAssignee {
+			return locale.Tr("repo.issues.review.remove_review_request", c.AssigneeTeam.Name, createdStr)
+		}
+		return locale.Tr("repo.issues.review.add_review_request", c.AssigneeTeam.Name, createdStr)
 	}
+
+	// impossible fallback
+	assigneePrompt := fmt.Sprintf("(AssigneeID=%d, AssigneeTeamID=%d)", c.AssigneeID, c.AssigneeTeam.ID)
+	setting.PanicInDevOrTesting("unknown timeline pull request review event comment: id=%d, %s", c.ID, assigneePrompt)
 	if c.RemovedAssignee {
-		return locale.Tr("repo.issues.review.remove_review_request", teamName, createdStr)
+		return locale.Tr("repo.issues.review.remove_review_request", assigneePrompt, createdStr)
 	}
-	return locale.Tr("repo.issues.review.add_review_request", teamName, createdStr)
+	return locale.Tr("repo.issues.review.add_review_request", assigneePrompt, createdStr)
 }
 
 // CreateComment creates comment with context

models/issues/comment_test.go

@@ -45,12 +45,27 @@ func TestCreateComment(t *testing.T) {
 	unittest.AssertInt64InRange(t, now, then, int64(updatedIssue.UpdatedUnix))
 }
 
+func TestLoadAssigneeUserAndTeam_DeletedTeamBecomesGhostTeam(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 15})
+	comment := &issues_model.Comment{
+		Type:           issues_model.CommentTypeAssignees,
+		IssueID:        issue.ID,
+		AssigneeTeamID: 999999, // non-existing team ID
+	}
+	assert.NoError(t, comment.LoadAssigneeUserAndTeam(t.Context()))
+	assert.NotNil(t, comment.AssigneeTeam)
+	assert.EqualValues(t, -1, comment.AssigneeTeam.ID)
+}
+
 func Test_UpdateCommentAttachment(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 
 	comment := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: 1})
+	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: comment.IssueID})
 	attachment := repo_model.Attachment{
-		Name: "test.txt",
+		RepoID: issue.RepoID, // must match the comment's repo, else the cross-repo guard rejects it
+		Name:   "test.txt",
 	}
 	assert.NoError(t, db.Insert(t.Context(), &attachment))
 

models/issues/issue_update.go

@@ -263,14 +263,46 @@ func AddDeletePRBranchComment(ctx context.Context, doer *user_model.User, repo *
 	return err
 }
 
+// validateAttachmentForIssue rejects a foreign or already-linked attachment before it is linked to
+// issue: a known UUID could otherwise re-link (and expose) another repo's private attachment. A
+// legacy attachment predating repo_id-on-upload is adopted into the issue's repo.
+func validateAttachmentForIssue(ctx context.Context, issue *Issue, attachment *repo_model.Attachment) error {
+	if attachment.RepoID == 0 && attachment.CreatedUnix < repo_model.LegacyAttachmentMissingRepoIDCutoff {
+		attachment.RepoID = issue.RepoID
+		if err := repo_model.UpdateAttachmentByUUID(ctx, attachment, "repo_id"); err != nil {
+			return fmt.Errorf("update attachment repo_id [id: %d]: %w", attachment.ID, err)
+		}
+	}
+	if attachment.RepoID != issue.RepoID {
+		return util.NewPermissionDeniedErrorf("attachment belongs to a different repository")
+	}
+	if attachment.IssueID != 0 && attachment.IssueID != issue.ID {
+		return util.NewPermissionDeniedErrorf("attachment is already linked to another issue")
+	}
+	if attachment.ReleaseID != 0 {
+		return util.NewPermissionDeniedErrorf("attachment is already linked to a release")
+	}
+	return nil
+}
+
 // UpdateIssueAttachments update attachments by UUIDs for the issue
 func UpdateIssueAttachments(ctx context.Context, issueID int64, uuids []string) (err error) {
+	if len(uuids) == 0 {
+		return nil
+	}
 	return db.WithTx(ctx, func(ctx context.Context) error {
+		issue, err := GetIssueByID(ctx, issueID)
+		if err != nil {
+			return err
+		}
 		attachments, err := repo_model.GetAttachmentsByUUIDs(ctx, uuids)
 		if err != nil {
 			return fmt.Errorf("getAttachmentsByUUIDs [uuids: %v]: %w", uuids, err)
 		}
 		for i := range attachments {
+			if err := validateAttachmentForIssue(ctx, issue, attachments[i]); err != nil {
+				return err
+			}
 			attachments[i].IssueID = issueID
 			if err := repo_model.UpdateAttachment(ctx, attachments[i]); err != nil {
 				return fmt.Errorf("update attachment [id: %d]: %w", attachments[i].ID, err)

models/issues/issue_update_test.go

@@ -0,0 +1,33 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package issues_test
+
+import (
+	"testing"
+
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/util"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateIssueAttachmentsCrossRepo(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	// attachment id 2 belongs to repo 2 / issue 4; issue 1 lives in repo 1
+	issue1 := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1})
+	foreign := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 2})
+	require.NotEqual(t, issue1.RepoID, foreign.RepoID)
+
+	// re-linking a foreign repo's attachment by UUID must be rejected
+	err := issues_model.UpdateIssueAttachments(t.Context(), issue1.ID, []string{foreign.UUID})
+	assert.ErrorIs(t, err, util.ErrPermissionDenied)
+
+	// the foreign attachment must be left untouched
+	reloaded := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 2})
+	assert.Equal(t, foreign.IssueID, reloaded.IssueID)
+}

models/issues/label.go

@@ -6,6 +6,7 @@ package issues
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"slices"
 	"strconv"
@@ -27,12 +28,6 @@ type ErrRepoLabelNotExist struct {
 	RepoID  int64
 }
 
-// IsErrRepoLabelNotExist checks if an error is a RepoErrLabelNotExist.
-func IsErrRepoLabelNotExist(err error) bool {
-	_, ok := err.(ErrRepoLabelNotExist)
-	return ok
-}
-
 func (err ErrRepoLabelNotExist) Error() string {
 	return fmt.Sprintf("label does not exist [label_id: %d, repo_id: %d]", err.LabelID, err.RepoID)
 }
@@ -312,6 +307,18 @@ func GetLabelInRepoByName(ctx context.Context, repoID int64, labelName string) (
 	return l, nil
 }
 
+// GetLabelInRepoOrOrgByID returns the label with labelID scoped to the repo, falling back to the
+// repo's owning organization when ownerIsOrg is set. It returns ErrRepoLabelNotExist /
+// ErrOrgLabelNotExist when the label is in neither scope, so a foreign-but-existing label ID is
+// indistinguishable from a nonexistent one (no cross-repo enumeration oracle).
+func GetLabelInRepoOrOrgByID(ctx context.Context, repoID, ownerID int64, ownerIsOrg bool, labelID int64) (*Label, error) {
+	label, err := GetLabelInRepoByID(ctx, repoID, labelID)
+	if err != nil && errors.Is(err, util.ErrNotExist) && ownerIsOrg {
+		return GetLabelInOrgByID(ctx, ownerID, labelID)
+	}
+	return label, err
+}
+
 // GetLabelInRepoByID returns a label by ID in given repository.
 func GetLabelInRepoByID(ctx context.Context, repoID, labelID int64) (*Label, error) {
 	if labelID <= 0 || repoID <= 0 {

models/issues/label_test.go

@@ -12,6 +12,7 @@ import (
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -94,10 +95,10 @@ func TestGetLabelInRepoByName(t *testing.T) {
 	assert.Equal(t, "label1", label.Name)
 
 	_, err = issues_model.GetLabelInRepoByName(t.Context(), 1, "")
-	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
+	assert.ErrorIs(t, err, util.ErrNotExist)
 
 	_, err = issues_model.GetLabelInRepoByName(t.Context(), unittest.NonexistentID, "nonexistent")
-	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
+	assert.ErrorIs(t, err, util.ErrNotExist)
 }
 
 func TestGetLabelInRepoByNames(t *testing.T) {
@@ -131,10 +132,10 @@ func TestGetLabelInRepoByID(t *testing.T) {
 	assert.EqualValues(t, 1, label.ID)
 
 	_, err = issues_model.GetLabelInRepoByID(t.Context(), 1, -1)
-	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
+	assert.ErrorIs(t, err, util.ErrNotExist)
 
 	_, err = issues_model.GetLabelInRepoByID(t.Context(), unittest.NonexistentID, unittest.NonexistentID)
-	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
+	assert.ErrorIs(t, err, util.ErrNotExist)
 }
 
 func TestGetLabelsInRepoByIDs(t *testing.T) {

models/issues/review.go

@@ -324,6 +324,59 @@ func IsOfficialReviewerTeam(ctx context.Context, issue *Issue, team *organizatio
 	return slices.Contains(pb.ApprovalsWhitelistTeamIDs, team.ID), nil
 }
 
+// RecalculateReviewsOfficial re-evaluates the "official" flag of the latest approve
+// and reject reviews of an issue against its pull request's current base branch.
+// It must be called whenever the target branch changes, otherwise an approval that
+// was official on the previous (possibly unprotected) branch would keep satisfying
+// the new branch's protection rules.
+func RecalculateReviewsOfficial(ctx context.Context, issue *Issue) error {
+	if err := issue.LoadPullRequest(ctx); err != nil {
+		return err
+	}
+
+	// Clearing and restoring the official flags must happen atomically, otherwise a
+	// failure in between would leave the reviews without any official flag set.
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		// Only the latest approve/reject review of each reviewer counts as official, so
+		// clear the flag on all of them first and restore it only where it still applies.
+		if _, err := db.GetEngine(ctx).
+			Where("issue_id = ?", issue.ID).
+			In("type", ReviewTypeApprove, ReviewTypeReject).
+			Cols("official").
+			Update(&Review{Official: false}); err != nil {
+			return err
+		}
+
+		reviews, err := FindLatestReviews(ctx, FindReviewOptions{
+			Types:   []ReviewType{ReviewTypeApprove, ReviewTypeReject},
+			IssueID: issue.ID,
+		})
+		if err != nil {
+			return err
+		}
+
+		for _, review := range reviews {
+			if err := review.LoadReviewer(ctx); err != nil {
+				return err
+			}
+			if review.Reviewer == nil {
+				continue
+			}
+			official, err := IsOfficialReviewer(ctx, issue, review.Reviewer)
+			if err != nil {
+				return err
+			}
+			if official {
+				if _, err := db.GetEngine(ctx).ID(review.ID).Cols("official").Update(&Review{Official: true}); err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
 // CreateReview creates a new review based on opts
 func CreateReview(ctx context.Context, opts CreateReviewOptions) (*Review, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Review, error) {

models/issues/review_test.go

@@ -6,6 +6,8 @@ package issues_test
 import (
 	"testing"
 
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
 	issues_model "gitea.dev/models/issues"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
@@ -386,3 +388,45 @@ func TestAddReviewRequest(t *testing.T) {
 	assert.NotNil(t, comment.CommentMetaData)
 	assert.Equal(t, issues_model.SpecialDoerNameCodeOwners, comment.CommentMetaData.SpecialDoerName)
 }
+
+func TestRecalculateReviewsOfficial(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	// PR #2 targets repo1's "master" branch. Simulate an approval that became
+	// official while the PR targeted an unprotected branch.
+	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 3})
+	reviewer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+	review, err := issues_model.CreateReview(t.Context(), issues_model.CreateReviewOptions{
+		Type:     issues_model.ReviewTypeApprove,
+		Issue:    issue,
+		Reviewer: reviewer,
+		Official: true,
+	})
+	assert.NoError(t, err)
+
+	// Protect the (now current) target branch with an approvals whitelist that
+	// does not include the reviewer, mirroring a retarget onto a protected branch.
+	rule := &git_model.ProtectedBranch{
+		RepoID:                    issue.RepoID,
+		RuleName:                  "master",
+		EnableApprovalsWhitelist:  true,
+		ApprovalsWhitelistUserIDs: []int64{2},
+		RequiredApprovals:         1,
+	}
+	assert.NoError(t, db.Insert(t.Context(), rule))
+
+	// Re-evaluating must strip the stale official flag, otherwise the approval
+	// would still satisfy the protected branch's required approvals.
+	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
+	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
+	assert.False(t, review.Official)
+
+	// Once the reviewer is whitelisted, re-evaluating restores the official flag.
+	rule.ApprovalsWhitelistUserIDs = []int64{2, reviewer.ID}
+	_, err = db.GetEngine(t.Context()).ID(rule.ID).Cols("approvals_whitelist_user_i_ds").Update(rule)
+	assert.NoError(t, err)
+
+	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
+	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
+	assert.True(t, review.Official)
+}

models/organization/team.go

@@ -6,6 +6,7 @@ package organization
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -92,6 +93,15 @@ func (t *Team) IsPublic() bool  { return t.Visibility.IsPublic() }
 func (t *Team) IsLimited() bool { return t.Visibility.IsLimited() }
 func (t *Team) IsPrivate() bool { return t.Visibility.IsPrivate() }
 
+const (
+	ghostTeamID   = -1
+	ghostTeamName = "(deleted team)"
+)
+
+func newGhostTeam() *Team {
+	return &Team{ID: ghostTeamID, Name: ghostTeamName, LowerName: ghostTeamName}
+}
+
 // CanNonMemberReadMeta reports whether a non-member, non-owner doer may read
 // the team's metadata, based on the team's visibility tier and the parent org's
 // visibility. Privileged callers (site admins, org owners, team members) are
@@ -270,6 +280,17 @@ func GetTeamByID(ctx context.Context, teamID int64) (*Team, error) {
 	return t, nil
 }
 
+func GetPossibleTeamByID(ctx context.Context, teamID int64) (int64, *Team, error) {
+	t, err := GetTeamByID(ctx, teamID)
+	if errors.Is(err, util.ErrNotExist) {
+		t = newGhostTeam()
+		return t.ID, t, nil
+	} else if err != nil {
+		return 0, nil, err
+	}
+	return t.ID, t, nil
+}
+
 // IncrTeamRepoNum increases the number of repos for the given team by 1
 func IncrTeamRepoNum(ctx context.Context, teamID int64) error {
 	_, err := db.GetEngine(ctx).Incr("num_repos").ID(teamID).Update(new(Team))

models/repo/org_repo.go

@@ -31,18 +31,28 @@ func GetOrgRepositoryIDs(ctx context.Context, orgID int64) (repoIDs []int64, _ e
 type SearchTeamRepoOptions struct {
 	db.ListOptions
 	TeamID int64
+	// PublicOnly restricts the result (and count) to non-private repositories.
+	PublicOnly bool
+}
+
+func (opts *SearchTeamRepoOptions) toCond() builder.Cond {
+	cond := builder.NewCond()
+	if opts.TeamID > 0 {
+		cond = cond.And(builder.In("id",
+			builder.Select("repo_id").
+				From("team_repo").
+				Where(builder.Eq{"team_id": opts.TeamID}),
+		))
+	}
+	if opts.PublicOnly {
+		cond = cond.And(builder.Eq{"is_private": false})
+	}
+	return cond
 }
 
 // GetTeamRepositories returns paginated repositories in team of organization.
 func GetTeamRepositories(ctx context.Context, opts *SearchTeamRepoOptions) (RepositoryList, error) {
-	sess := db.GetEngine(ctx)
-	if opts.TeamID > 0 {
-		sess = sess.In("id",
-			builder.Select("repo_id").
-				From("team_repo").
-				Where(builder.Eq{"team_id": opts.TeamID}),
-		)
-	}
+	sess := db.GetEngine(ctx).Where(opts.toCond())
 	if opts.PageSize > 0 {
 		sess.Limit(opts.PageSize, (opts.Page-1)*opts.PageSize)
 	}
@@ -51,6 +61,11 @@ func GetTeamRepositories(ctx context.Context, opts *SearchTeamRepoOptions) (Repo
 		Find(&repos)
 }
 
+// CountTeamRepositories returns the number of repositories in team of organization matching opts.
+func CountTeamRepositories(ctx context.Context, opts *SearchTeamRepoOptions) (int64, error) {
+	return db.GetEngine(ctx).Where(opts.toCond()).Count(new(Repository))
+}
+
 // AccessibleReposEnvironment operations involving the repositories that are
 // accessible to a particular user
 type AccessibleReposEnvironment interface {

models/repo/repo_list.go

@@ -310,11 +310,17 @@ func userOrgTeamRepoBuilder(userID int64) *builder.Builder {
 }
 
 // userOrgTeamUnitRepoBuilder returns repo ids where user's teams can access the special unit.
+// A team grants the unit either through an explicit team_unit row (access_mode > none) or by being an
+// admin/owner team (team.authorize >= admin), which grants every unit regardless of team_unit rows —
+// mirroring the HasAdminAccess() short-circuit in access.GetIndividualUserRepoPermission.
 func userOrgTeamUnitRepoBuilder(userID int64, unitType unit.Type) *builder.Builder {
 	return userOrgTeamRepoBuilder(userID).
-		Join("INNER", "team_unit", "`team_unit`.team_id = `team_repo`.team_id").
-		Where(builder.Eq{"`team_unit`.`type`": unitType}).
-		And(builder.Gt{"`team_unit`.`access_mode`": int(perm.AccessModeNone)})
+		Join("INNER", "team", "`team`.id = `team_repo`.team_id").
+		Join("LEFT", "team_unit", builder.Expr("`team_unit`.team_id = `team_repo`.team_id AND `team_unit`.`type` = ?", unitType)).
+		Where(builder.Or(
+			builder.Gte{"`team`.authorize": int(perm.AccessModeAdmin)},
+			builder.Gt{"`team_unit`.`access_mode`": int(perm.AccessModeNone)},
+		))
 }
 
 // userOrgTeamUnitRepoCond returns a condition to select repo ids where user's teams can access the special unit.
@@ -326,7 +332,7 @@ func userOrgTeamUnitRepoCond(idStr string, userID int64, unitType unit.Type) bui
 func UserOrgUnitRepoCond(idStr string, userID, orgID int64, unitType unit.Type) builder.Cond {
 	return builder.In(idStr,
 		userOrgTeamUnitRepoBuilder(userID, unitType).
-			And(builder.Eq{"`team_unit`.org_id": orgID}),
+			And(builder.Eq{"`team`.org_id": orgID}),
 	)
 }
 
@@ -755,6 +761,40 @@ func FindUserCodeAccessibleOwnerRepoIDs(ctx context.Context, ownerID int64, user
 	))
 }
 
+// PublicRepoUnderPublicOwnerCond restricts to public repos whose owner is publicly visible: the
+// "genuinely public" set a public-only token or an anonymous caller may see (a public repo under a
+// limited/private owner is not publicly reachable and must be excluded).
+func PublicRepoUnderPublicOwnerCond() builder.Cond {
+	return builder.And(
+		builder.Eq{"`repository`.is_private": false},
+		builder.In("`repository`.owner_id", builder.Select("id").From("`user`").Where(builder.Eq{"visibility": structs.VisibleTypePublic})),
+	)
+}
+
+// UserActionsAccessibleOwnerRepoCond selects the repos owned by ownerID whose Actions `user` may read.
+// It is used to list an org/user's Actions runs and jobs (see the callers in routers/api/v1/shared).
+//   - owner_id = ownerID: only that owner's repos.
+//   - AccessibleRepositoryCondition(user, TypeActions): only repos whose Actions the user can read
+//     (admin/owner teams are handled inside it; a site admin is not, callers must skip the filter for one).
+//   - publicOnly (a public-only token): additionally limit to public repos under a public owner.
+func UserActionsAccessibleOwnerRepoCond(ownerID int64, user *user_model.User, publicOnly bool) builder.Cond {
+	cond := builder.NewCond().And(
+		builder.Eq{"`repository`.owner_id": ownerID},
+		AccessibleRepositoryCondition(user, unit.TypeActions),
+	)
+	if publicOnly {
+		cond = cond.And(PublicRepoUnderPublicOwnerCond())
+	}
+	return cond
+}
+
+// FindUserActionsAccessibleOwnerRepoIDsSubQuery returns a subquery selecting the repository IDs the user
+// can see for the given owner. Callers embed it in an `IN (...)` condition so that a large owner does not
+// materialize every repo ID into the SQL statement, which could exceed database parameter limits.
+func FindUserActionsAccessibleOwnerRepoIDsSubQuery(ownerID int64, user *user_model.User, publicOnly bool) *builder.Builder {
+	return builder.Select("id").From("repository").Where(UserActionsAccessibleOwnerRepoCond(ownerID, user, publicOnly))
+}
+
 // GetUserRepositories returns a list of repositories of given user.
 func GetUserRepositories(ctx context.Context, opts SearchRepoOptions) (RepositoryList, int64, error) {
 	if len(opts.OrderBy) == 0 {

models/repo/repo_list_test.go

@@ -9,6 +9,7 @@ import (
 
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/optional"
@@ -466,3 +467,50 @@ func TestSearchRepositoryByTopicName(t *testing.T) {
 		})
 	}
 }
+
+func TestFindUserActionsAccessibleOwnerRepoIDs(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	// user2 is on org3's owner team, so it can access org3's private repo3 (which has the actions unit)
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+
+	// org3 is a public org owning repo3 (private) and repo32 (public), both with the actions unit
+	const orgID = 3
+
+	all, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, user, false))
+	require.NoError(t, err)
+	assert.Contains(t, all, int64(3), "without public-only the private repo's actions are listed")
+
+	publicOnly, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, user, true))
+	require.NoError(t, err)
+	assert.NotContains(t, publicOnly, int64(3), "a public-only token must not list a private repo's actions")
+	assert.Contains(t, publicOnly, int64(32), "a public repo under a public owner stays listed")
+}
+
+// TestUserOrgUnitRepoCondTeamAuthorize pins the team.authorize behavior of userOrgTeamUnitRepoBuilder
+// (exercised through UserOrgUnitRepoCond): an admin/owner team grants every unit even without an explicit
+// team_unit row, while a non-admin team only grants a unit it has an explicit row for. This guards both
+// directions — hiding repos from admin-team members, and over-broadening a plain team's access.
+func TestUserOrgUnitRepoCondTeamAuthorize(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	accessibleRepoIDs := func(userID, orgID int64, unitType unit.Type) []int64 {
+		ids, err := repo_model.SearchRepositoryIDsByCondition(t.Context(),
+			repo_model.UserOrgUnitRepoCond("`repository`.id", userID, orgID, unitType))
+		require.NoError(t, err)
+		return ids
+	}
+
+	// Case A: user18 is only on org17's owner team (team5, authorize=owner), linked to the private repo24
+	// but with no Actions team_unit row. The owner authorize must still grant it, mirroring the runtime
+	// HasAdminAccess() short-circuit in access.GetIndividualUserRepoPermission.
+	assert.Contains(t, accessibleRepoIDs(18, 17, unit.TypeActions), int64(24),
+		"an owner team grants a unit it has no explicit team_unit row for")
+
+	// Cases B and C share one subject so the team_unit row is the only difference: user4 is only on org3's
+	// write team (team2, authorize=write, non-admin), linked to the private repo3. team2 has an explicit
+	// Projects row but none for Actions.
+	assert.Contains(t, accessibleRepoIDs(4, 3, unit.TypeProjects), int64(3),
+		"a non-admin team grants a unit it has an explicit team_unit row for")
+	assert.NotContains(t, accessibleRepoIDs(4, 3, unit.TypeActions), int64(3),
+		"a non-admin team must NOT grant a unit it has no team_unit row for")
+}

models/repo/user_repo.go

@@ -22,6 +22,9 @@ type StarredReposOptions struct {
 	StarrerID      int64
 	RepoOwnerID    int64
 	IncludePrivate bool
+	// Actor is the user the private repositories are gated on: a private repo is only
+	// returned when Actor still has access to it, even if it was starred while access was granted.
+	Actor *user_model.User
 }
 
 func (opts *StarredReposOptions) ApplyPublicOnly(publicOnly bool) {
@@ -39,10 +42,12 @@ func (opts *StarredReposOptions) ToConds() builder.Cond {
 			"repository.owner_id": opts.RepoOwnerID,
 		})
 	}
-	if !opts.IncludePrivate {
-		cond = cond.And(builder.Eq{
-			"repository.is_private": false,
-		})
+	if opts.IncludePrivate {
+		// only include private repos the actor can still access, so metadata does not leak after access revocation
+		cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
+	} else {
+		// a public repo under a limited/private owner is not publicly reachable, so exclude it too
+		cond = cond.And(PublicRepoUnderPublicOwnerCond())
 	}
 	return cond
 }
@@ -66,6 +71,9 @@ type WatchedReposOptions struct {
 	WatcherID      int64
 	RepoOwnerID    int64
 	IncludePrivate bool
+	// Actor is the user the private repositories are gated on: a private repo is only
+	// returned when Actor still has access to it, even if it was watched while access was granted.
+	Actor *user_model.User
 }
 
 func (opts *WatchedReposOptions) ApplyPublicOnly(publicOnly bool) {
@@ -83,10 +91,12 @@ func (opts *WatchedReposOptions) ToConds() builder.Cond {
 			"repository.owner_id": opts.RepoOwnerID,
 		})
 	}
-	if !opts.IncludePrivate {
-		cond = cond.And(builder.Eq{
-			"repository.is_private": false,
-		})
+	if opts.IncludePrivate {
+		// only include private repos the actor can still access, so metadata does not leak after access revocation
+		cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
+	} else {
+		// a public repo under a limited/private owner is not publicly reachable, so exclude it too
+		cond = cond.And(PublicRepoUnderPublicOwnerCond())
 	}
 	return cond.And(builder.Neq{
 		"watch.mode": WatchModeDont,

models/repo/user_repo_test.go

@@ -84,3 +84,40 @@ func testUserRepoGetIssuePostersWithSearch(t *testing.T) {
 	require.Len(t, users, 1)
 	assert.Equal(t, "user2", users[0].Name)
 }
+
+func TestStarredWatchedReposExcludeNonPublicOwners(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	const viewerID = 2
+	// repo1: public repo under a public owner; repo38: public repo under a limited org (not publicly reachable)
+	const publicOwnerRepo, limitedOwnerRepo = 1, 38
+
+	require.NoError(t, db.Insert(t.Context(), &repo_model.Star{UID: viewerID, RepoID: publicOwnerRepo}))
+	require.NoError(t, db.Insert(t.Context(), &repo_model.Star{UID: viewerID, RepoID: limitedOwnerRepo}))
+	require.NoError(t, db.Insert(t.Context(), &repo_model.Watch{UserID: viewerID, RepoID: publicOwnerRepo, Mode: repo_model.WatchModeNormal}))
+	require.NoError(t, db.Insert(t.Context(), &repo_model.Watch{UserID: viewerID, RepoID: limitedOwnerRepo, Mode: repo_model.WatchModeNormal}))
+
+	listOpts := db.ListOptions{Page: 1, PageSize: 50}
+
+	starred, err := repo_model.GetStarredRepos(t.Context(), &repo_model.StarredReposOptions{
+		ListOptions: listOpts, StarrerID: viewerID, IncludePrivate: false,
+	})
+	require.NoError(t, err)
+	assert.NotContains(t, repoIDs(starred), int64(limitedOwnerRepo), "a public repo under a limited owner must be hidden from a public star listing")
+	assert.Contains(t, repoIDs(starred), int64(publicOwnerRepo), "a public repo under a public owner stays visible")
+
+	watched, _, err := repo_model.GetWatchedRepos(t.Context(), &repo_model.WatchedReposOptions{
+		ListOptions: listOpts, WatcherID: viewerID, IncludePrivate: false,
+	})
+	require.NoError(t, err)
+	assert.NotContains(t, repoIDs(watched), int64(limitedOwnerRepo), "a public repo under a limited owner must be hidden from a public watch listing")
+	assert.Contains(t, repoIDs(watched), int64(publicOwnerRepo), "a public repo under a public owner stays visible")
+}
+
+func repoIDs(repos []*repo_model.Repository) []int64 {
+	ids := make([]int64, len(repos))
+	for i, r := range repos {
+		ids[i] = r.ID
+	}
+	return ids
+}

modules/actions/scoped_workflows.go

@@ -55,29 +55,34 @@ func ParseScopedWorkflows(sourceCommit *git.Commit) ([]*ParsedScopedWorkflow, er
 	return parsed, nil
 }
 
-// MatchScopedWorkflows evaluates already-parsed scoped workflows against one consuming event, returning those whose `on:` matches.
+// MatchScopedWorkflows evaluates already-parsed scoped workflows against one consuming event.
+// It returns the workflows whose `on:` matches, and those that matched the event but were excluded by a branch/paths filter (filtered).
 func MatchScopedWorkflows(
 	parsed []*ParsedScopedWorkflow,
 	consumerGitRepo *git.Repository,
 	consumerCommit *git.Commit,
 	triggedEvent webhook_module.HookEventType,
 	payload api.Payloader,
-) []*DetectedWorkflow {
-	workflows := make([]*DetectedWorkflow, 0, len(parsed))
+) (matched, filtered []*DetectedWorkflow) {
 	for _, p := range parsed {
 		for _, evt := range p.Events {
 			if evt.IsSchedule() {
 				// schedule is a non-target for scoped workflows
 				continue
 			}
-			if detectMatched(consumerGitRepo, consumerCommit, triggedEvent, payload, evt) {
-				workflows = append(workflows, &DetectedWorkflow{
-					EntryName:    p.EntryName,
-					TriggerEvent: evt,
-					Content:      p.Content,
-				})
+			dwf := &DetectedWorkflow{
+				EntryName:    p.EntryName,
+				TriggerEvent: evt,
+				Content:      p.Content,
+			}
+			switch detectWorkflowMatch(consumerGitRepo, consumerCommit, triggedEvent, payload, evt) {
+			case detectMatched:
+				matched = append(matched, dwf)
+			case detectFilteredOut:
+				filtered = append(filtered, dwf)
+			case detectNotApplicable:
 			}
 		}
 	}
-	return workflows
+	return matched, filtered
 }

modules/actions/workflows.go

@@ -30,6 +30,14 @@ type DetectedWorkflow struct {
 	Content      []byte
 }
 
+type detectResult int
+
+const (
+	detectMatched       detectResult = iota // event matched; run normally
+	detectNotApplicable                     // event/type doesn't apply; create nothing
+	detectFilteredOut                       // matched but excluded by a branch/paths filter; posts a skipped commit status when the context is a required check
+)
+
 func init() {
 	model.OnDecodeNodeError = func(node yaml.Node, out any, err error) {
 		// Log the error instead of panic or fatal.
@@ -172,18 +180,16 @@ func DetectWorkflows(
 	triggedEvent webhook_module.HookEventType,
 	payload api.Payloader,
 	detectSchedule bool,
-) ([]*DetectedWorkflow, []*DetectedWorkflow, error) {
+) (workflows, schedules, filtered []*DetectedWorkflow, err error) {
 	_, entries, err := ListWorkflows(commit)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
-	workflows := make([]*DetectedWorkflow, 0, len(entries))
-	schedules := make([]*DetectedWorkflow, 0, len(entries))
 	for _, entry := range entries {
 		content, err := GetContentFromEntry(entry)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 
 		// one workflow may have multiple events
@@ -203,18 +209,24 @@ func DetectWorkflows(
 					}
 					schedules = append(schedules, dwf)
 				}
-			} else if detectMatched(gitRepo, commit, triggedEvent, payload, evt) {
+			} else {
 				dwf := &DetectedWorkflow{
 					EntryName:    entry.Name(),
 					TriggerEvent: evt,
 					Content:      content,
 				}
-				workflows = append(workflows, dwf)
+				switch detectWorkflowMatch(gitRepo, commit, triggedEvent, payload, evt) {
+				case detectMatched:
+					workflows = append(workflows, dwf)
+				case detectFilteredOut:
+					filtered = append(filtered, dwf)
+				case detectNotApplicable:
+				}
 			}
 		}
 	}
 
-	return workflows, schedules, nil
+	return workflows, schedules, filtered, nil
 }
 
 func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*DetectedWorkflow, error) {
@@ -252,9 +264,9 @@ func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*D
 	return wfs, nil
 }
 
-func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent webhook_module.HookEventType, payload api.Payloader, evt *jobparser.Event) bool {
+func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEvent webhook_module.HookEventType, payload api.Payloader, evt *jobparser.Event) detectResult {
 	if !canGithubEventMatch(evt.Name, triggedEvent) {
-		return false
+		return detectNotApplicable
 	}
 
 	switch triggedEvent {
@@ -268,7 +280,7 @@ func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent web
 			log.Warn("Ignore unsupported %s event arguments %v", triggedEvent, evt.Acts())
 		}
 		// no special filter parameters for these events, just return true if name matched
-		return true
+		return detectMatched
 
 	case // push
 		webhook_module.HookEventPush:
@@ -279,14 +291,20 @@ func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent web
 		webhook_module.HookEventIssueAssign,
 		webhook_module.HookEventIssueLabel,
 		webhook_module.HookEventIssueMilestone:
-		return matchIssuesEvent(payload.(*api.IssuePayload), evt)
+		if matchIssuesEvent(payload.(*api.IssuePayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // issue_comment
 		webhook_module.HookEventIssueComment,
 		// `pull_request_comment` is same as `issue_comment`
 		// See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_comment-use-issue_comment
 		webhook_module.HookEventPullRequestComment:
-		return matchIssueCommentEvent(payload.(*api.IssueCommentPayload), evt)
+		if matchIssueCommentEvent(payload.(*api.IssueCommentPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // pull_request
 		webhook_module.HookEventPullRequest,
@@ -300,34 +318,49 @@ func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent web
 	case // pull_request_review
 		webhook_module.HookEventPullRequestReviewApproved,
 		webhook_module.HookEventPullRequestReviewRejected:
-		return matchPullRequestReviewEvent(payload.(*api.PullRequestPayload), evt)
+		if matchPullRequestReviewEvent(payload.(*api.PullRequestPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // pull_request_review_comment
 		webhook_module.HookEventPullRequestReviewComment:
-		return matchPullRequestReviewCommentEvent(payload.(*api.PullRequestPayload), evt)
+		if matchPullRequestReviewCommentEvent(payload.(*api.PullRequestPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // release
 		webhook_module.HookEventRelease:
-		return matchReleaseEvent(payload.(*api.ReleasePayload), evt)
+		if matchReleaseEvent(payload.(*api.ReleasePayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // registry_package
 		webhook_module.HookEventPackage:
-		return matchPackageEvent(payload.(*api.PackagePayload), evt)
+		if matchPackageEvent(payload.(*api.PackagePayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // workflow_run
 		webhook_module.HookEventWorkflowRun:
-		return matchWorkflowRunEvent(payload.(*api.WorkflowRunPayload), evt)
+		if matchWorkflowRunEvent(payload.(*api.WorkflowRunPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	default:
 		log.Warn("unsupported event %q", triggedEvent)
-		return false
+		return detectNotApplicable
 	}
 }
 
-func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) bool {
+func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) detectResult {
 	// with no special filter parameters
 	if len(evt.Acts()) == 0 {
-		return true
+		return detectMatched
 	}
 
 	matchTimes := 0
@@ -393,14 +426,14 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Skip(patterns, filesChanged) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Skip(patterns, filesChanged) {
+				matchTimes++
 			}
 		case "paths-ignore":
 			if refName.IsTag() {
@@ -410,14 +443,14 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Filter(patterns, filesChanged) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Filter(patterns, filesChanged) {
+				matchTimes++
 			}
 		default:
 			log.Warn("push event unsupported condition %q", cond)
@@ -427,7 +460,10 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 	if hasBranchFilter && hasTagFilter {
 		matchTimes++
 	}
-	return matchTimes == len(evt.Acts())
+	if matchTimes == len(evt.Acts()) {
+		return detectMatched
+	}
+	return detectFilteredOut
 }
 
 func matchIssuesEvent(issuePayload *api.IssuePayload, evt *jobparser.Event) bool {
@@ -478,7 +514,7 @@ func matchIssuesEvent(issuePayload *api.IssuePayload, evt *jobparser.Event) bool
 	return matchTimes == len(evt.Acts())
 }
 
-func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayload *api.PullRequestPayload, evt *jobparser.Event) bool {
+func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayload *api.PullRequestPayload, evt *jobparser.Event) detectResult {
 	acts := evt.Acts()
 	activityTypeMatched := false
 	matchTimes := 0
@@ -525,7 +561,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 		headCommit, err = gitRepo.GetCommit(prPayload.PullRequest.Head.Sha)
 		if err != nil {
 			log.Error("GetCommit [ref: %s]: %v", prPayload.PullRequest.Head.Sha, err)
-			return false
+			return detectNotApplicable
 		}
 	}
 
@@ -557,33 +593,39 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Skip(patterns, filesChanged) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Skip(patterns, filesChanged) {
+				matchTimes++
 			}
 		case "paths-ignore":
 			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Filter(patterns, filesChanged) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Filter(patterns, filesChanged) {
+				matchTimes++
 			}
 		default:
 			log.Warn("pull request event unsupported condition %q", cond)
 		}
 	}
-	return activityTypeMatched && matchTimes == len(evt.Acts())
+	if !activityTypeMatched {
+		return detectNotApplicable
+	}
+	if matchTimes != len(evt.Acts()) {
+		return detectFilteredOut
+	}
+	return detectMatched
 }
 
 func matchIssueCommentEvent(issueCommentPayload *api.IssueCommentPayload, evt *jobparser.Event) bool {

modules/actions/workflows_test.go

@@ -101,49 +101,49 @@ func TestDetectMatched(t *testing.T) {
 		triggedEvent webhook_module.HookEventType
 		payload      api.Payloader
 		yamlOn       string
-		expected     bool
+		expected     detectResult
 	}{
 		{
 			desc:         "HookEventCreate(create) matches GithubEventCreate(create)",
 			triggedEvent: webhook_module.HookEventCreate,
 			payload:      nil,
 			yamlOn:       "on: create",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventIssues(issues) `opened` action matches GithubEventIssues(issues)",
 			triggedEvent: webhook_module.HookEventIssues,
 			payload:      &api.IssuePayload{Action: api.HookIssueOpened},
 			yamlOn:       "on: issues",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventIssues(issues) `milestoned` action matches GithubEventIssues(issues)",
 			triggedEvent: webhook_module.HookEventIssues,
 			payload:      &api.IssuePayload{Action: api.HookIssueMilestoned},
 			yamlOn:       "on: issues",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequestSync(pull_request_sync) matches GithubEventPullRequest(pull_request)",
 			triggedEvent: webhook_module.HookEventPullRequestSync,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueSynchronized},
 			yamlOn:       "on: pull_request",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `label_updated` action doesn't match GithubEventPullRequest(pull_request) with no activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueLabelUpdated},
 			yamlOn:       "on: pull_request",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `closed` action doesn't match GithubEventPullRequest(pull_request) with no activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueClosed},
 			yamlOn:       "on: pull_request",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `closed` action doesn't match GithubEventPullRequest(pull_request) with branches",
@@ -155,56 +155,56 @@ func TestDetectMatched(t *testing.T) {
 				},
 			},
 			yamlOn:   "on:\n  pull_request:\n    branches: [main]",
-			expected: false,
+			expected: detectNotApplicable,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `label_updated` action matches GithubEventPullRequest(pull_request) with `label` activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueLabelUpdated},
 			yamlOn:       "on:\n  pull_request:\n    types: [labeled]",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequestReviewComment(pull_request_review_comment) matches GithubEventPullRequestReviewComment(pull_request_review_comment)",
 			triggedEvent: webhook_module.HookEventPullRequestReviewComment,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueReviewed},
 			yamlOn:       "on:\n  pull_request_review_comment:\n    types: [created]",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequestReviewRejected(pull_request_review_rejected) doesn't match GithubEventPullRequestReview(pull_request_review) with `dismissed` activity type (we don't support `dismissed` at present)",
 			triggedEvent: webhook_module.HookEventPullRequestReviewRejected,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueReviewed},
 			yamlOn:       "on:\n  pull_request_review:\n    types: [dismissed]",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventRelease(release) `published` action matches GithubEventRelease(release) with `published` activity type",
 			triggedEvent: webhook_module.HookEventRelease,
 			payload:      &api.ReleasePayload{Action: api.HookReleasePublished},
 			yamlOn:       "on:\n  release:\n    types: [published]",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPackage(package) `created` action doesn't match GithubEventRegistryPackage(registry_package) with `updated` activity type",
 			triggedEvent: webhook_module.HookEventPackage,
 			payload:      &api.PackagePayload{Action: api.HookPackageCreated},
 			yamlOn:       "on:\n  registry_package:\n    types: [updated]",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventWiki(wiki) matches GithubEventGollum(gollum)",
 			triggedEvent: webhook_module.HookEventWiki,
 			payload:      nil,
 			yamlOn:       "on: gollum",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventSchedule(schedule) matches GithubEventSchedule(schedule)",
 			triggedEvent: webhook_module.HookEventSchedule,
 			payload:      nil,
 			yamlOn:       "on: schedule",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "push to tag matches workflow with paths condition (should skip paths check)",
@@ -222,7 +222,19 @@ func TestDetectMatched(t *testing.T) {
 			},
 			commit:   nil,
 			yamlOn:   "on:\n  push:\n    paths:\n      - src/**",
-			expected: true,
+			expected: detectMatched,
+		},
+		{
+			desc:         "push branch filter excludes -> filtered out",
+			triggedEvent: webhook_module.HookEventPush,
+			payload: &api.PushPayload{
+				Ref:     "refs/heads/feature/x",
+				Before:  "0000000",
+				Commits: []*api.PayloadCommit{{ID: "abc", Added: []string{"a.go"}, Message: "x"}},
+			},
+			commit:   nil,
+			yamlOn:   "on:\n  push:\n    branches: [main]",
+			expected: detectFilteredOut,
 		},
 	}
 
@@ -231,7 +243,7 @@ func TestDetectMatched(t *testing.T) {
 			evts, err := GetEventsFromContent(fullWorkflowContent(tc.yamlOn))
 			assert.NoError(t, err)
 			assert.Len(t, evts, 1)
-			assert.Equal(t, tc.expected, detectMatched(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
+			assert.Equal(t, tc.expected, detectWorkflowMatch(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
 		})
 	}
 }

modules/auth/openid/openid.go

@@ -4,8 +4,14 @@
 package openid
 
 import (
+	"net/http"
+	"sync"
 	"time"
 
+	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/setting"
+
 	"github.com/yohcop/openid-go"
 )
 
@@ -19,11 +25,23 @@ import (
 var (
 	nonceStore     = openid.NewSimpleNonceStore()
 	discoveryCache = newTimedDiscoveryCache(24 * time.Hour)
+
+	// openIDInstance does discovery/verification via an SSRF-protected client, so a user-supplied
+	// OpenID identifier can't reach internal/loopback/reserved addresses. It honors the operator's
+	// [security] ALLOWED_HOST_LIST (empty defaults to "external"), matching the avatar/webhook/migration
+	// clients, and validates the proxy path too. Lazy: reads proxy/settings once.
+	openIDInstance = sync.OnceValue(func() *openid.OpenID {
+		allowList := hostmatcher.ParseHostMatchList("security.ALLOWED_HOST_LIST", setting.Security.AllowedHostList)
+		return openid.NewOpenID(&http.Client{
+			Timeout:   30 * time.Second,
+			Transport: hostmatcher.NewHTTPTransport("openid", allowList, nil, proxy.Proxy(), setting.Proxy.ProxyURLFixed, nil),
+		})
+	})
 )
 
 // Verify handles response from OpenID provider
 func Verify(fullURL string) (id string, err error) {
-	return openid.Verify(fullURL, discoveryCache, nonceStore)
+	return openIDInstance().Verify(fullURL, discoveryCache, nonceStore)
 }
 
 // Normalize normalizes an OpenID URI
@@ -33,5 +51,5 @@ func Normalize(url string) (id string, err error) {
 
 // RedirectURL redirects browser
 func RedirectURL(id, callbackURL, realm string) (string, error) {
-	return openid.RedirectURL(id, callbackURL, realm)
+	return openIDInstance().RedirectURL(id, callbackURL, realm)
 }

modules/auth/openid/openid_test.go

@@ -0,0 +1,29 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package openid
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOpenIDDiscoveryBlocksInternalHost(t *testing.T) {
+	var reached atomic.Bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached.Store(true)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	// RedirectURL performs server-side discovery of the identifier URL; a loopback URL
+	// must be refused at dial time instead of reaching the internal server
+	_, err := RedirectURL(srv.URL, "http://example.com/callback", "http://example.com/")
+	require.Error(t, err)
+	assert.False(t, reached.Load(), "OpenID discovery must not reach an internal/loopback host")
+}

modules/git/commit_message.go

@@ -10,16 +10,22 @@ import (
 	"sync"
 
 	"gitea.dev/modules/charset"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/util"
 )
 
 // CoAuthoredByTrailer is the canonical token for the `Co-authored-by:` git trailer.
 const CoAuthoredByTrailer = "Co-authored-by"
 
+const (
+	commitIdentityRoleAuthor    = 1
+	commitIdentityRoleCommitter = 2
+	commitIdentityRoleCoAuthor  = 3
+)
+
 type CommitIdentity struct {
 	Name  string
 	Email string
+	role  int
 }
 
 // CommitMessageTrailerValues keys are all in lower-case
@@ -33,7 +39,9 @@ type CommitMessage struct {
 
 	trailerValues CommitMessageTrailerValues
 
-	allParticipants []*CommitIdentity
+	allParticipants      []*CommitIdentity
+	committerCoAuthorIdx int
+	committerCoAuthor    *CommitIdentity
 }
 
 func (c *CommitMessage) MessageUTF8() string {
@@ -105,29 +113,57 @@ func (c *Commit) AllParticipantIdentities() []*CommitIdentity {
 		return c.allParticipants
 	}
 
-	exclude := container.Set[string]{}
-	c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: c.Author.Name, Email: c.Author.Email})
-	exclude.Add(strings.ToLower(c.Author.Email))
-
-	addParticipant := func(name, email string) {
+	exclude := map[string]int{}
+	addParticipant := func(name, email string, role int) (existingRole int) {
 		if name == "" && email == "" {
-			return
+			return 0
 		}
 		emailLower := strings.ToLower(email)
-		if emailLower != "" && exclude.Contains(emailLower) {
-			return
+		if existingRole = exclude[emailLower]; emailLower != "" && existingRole != 0 {
+			return existingRole
 		}
-		c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: name, Email: email})
-		exclude.Add(emailLower)
+		c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: name, Email: email, role: role})
+		exclude[emailLower] = role
+		return 0
 	}
-	addParticipant(c.Committer.Name, c.Committer.Email)
+
+	c.committerCoAuthorIdx = -1
+	addParticipant(c.Author.Name, c.Author.Email, commitIdentityRoleAuthor)
+	addParticipant(c.Committer.Name, c.Committer.Email, commitIdentityRoleCommitter)
 	for _, coAuthorValue := range c.MessageTrailer()["co-authored-by"] {
 		addr, err := mail.ParseAddress(coAuthorValue)
+		coAuthorName, coAuthorEmail := coAuthorValue, ""
 		if err == nil {
-			addParticipant(addr.Name, addr.Address)
-		} else {
-			addParticipant(coAuthorValue, "")
+			coAuthorName, coAuthorEmail = addr.Name, addr.Address
+		}
+		existingRole := addParticipant(coAuthorName, coAuthorEmail, commitIdentityRoleCoAuthor)
+		if existingRole == commitIdentityRoleCommitter && c.committerCoAuthorIdx == -1 {
+			c.committerCoAuthorIdx = len(c.allParticipants)
+			c.committerCoAuthor = &CommitIdentity{coAuthorName, coAuthorEmail, commitIdentityRoleCoAuthor}
 		}
 	}
 	return c.allParticipants
 }
+
+// CoAuthorIdentities returns co-author identities defined by "Co-authored-by:" in the git message trailer
+// Only the commit's author is excluded. If committer is declared as co-author, it will be included in the result.
+// * Author & Co-author: they changed the code (attribution)
+// * Committer: they submitted the commit but didn't change the code (e.g.: maintainer signed a commit)
+// So, a committer can also be a co-author if they changed the code.
+func (c *Commit) CoAuthorIdentities() (coAuthors []*CommitIdentity) {
+	all := c.AllParticipantIdentities()
+	if len(all) <= 1 {
+		return nil // no co-author list
+	}
+	if all[1].role != commitIdentityRoleCommitter {
+		return all[1:] // no committer, so all after author are co-authors
+	}
+	if c.committerCoAuthorIdx == -1 {
+		return all[2:] // the committer is not in the co-author list, so just return the co-author list
+	}
+	// the committer is in the co-author list but de-duplicated, so include them as co-author again
+	coAuthors = append(coAuthors, all[2:c.committerCoAuthorIdx]...)
+	coAuthors = append(coAuthors, c.committerCoAuthor)
+	coAuthors = append(coAuthors, all[c.committerCoAuthorIdx:]...)
+	return coAuthors
+}

modules/git/commit_message_test.go

@@ -47,36 +47,83 @@ func TestCommitMessageTrailer(t *testing.T) {
 	}
 }
 
-func TestCommitMessageAllParticipantIdentities(t *testing.T) {
+func TestCommitMessageParticipants(t *testing.T) {
 	sig := func(n, e string) *Signature { return &Signature{Name: n, Email: e} }
-	idt := func(n, e string) *CommitIdentity { return &CommitIdentity{Name: n, Email: e} }
-	cases := []struct {
-		commit      *Commit
-		participant []*CommitIdentity
-	}{
-		{
-			&Commit{
-				Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-				CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: x@m.com"},
-			},
-			[]*CommitIdentity{idt("a", "a@m.com"), idt("c", "c@m.com"), idt("", "x@m.com")},
-		},
-		{
-			&Commit{
-				Author: sig("a", "a@m.com"), Committer: sig("a", "A@M.com"),
-				CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: a@m.com"},
-			},
-			[]*CommitIdentity{idt("a", "a@m.com")},
-		},
-		{
-			&Commit{
-				Author: sig("a", "a@m.com"), Committer: sig("", ""),
-				CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: Full Name <X@M.com>"},
-			},
-			[]*CommitIdentity{idt("a", "a@m.com"), idt("Full Name", "X@M.com")},
-		},
-	}
-	for _, c := range cases {
-		assert.Equal(t, c.participant, c.commit.AllParticipantIdentities())
+	idt := func(n, e string, r int) *CommitIdentity { return &CommitIdentity{n, e, r} }
+	roleAuthor, roleCommitter, roleCoAuthor := commitIdentityRoleAuthor, commitIdentityRoleCommitter, commitIdentityRoleCoAuthor
+	type testCase struct {
+		name       string
+		commit     *Commit
+		identities []*CommitIdentity
 	}
+	t.Run("AllParticipants", func(t *testing.T) {
+		cases := []testCase{
+			{
+				"DifferentUsers",
+				&Commit{
+					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
+					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: x@m.com"},
+				},
+				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor), idt("c", "c@m.com", roleCommitter), idt("", "x@m.com", roleCoAuthor)},
+			},
+			{
+				"SameUser",
+				&Commit{
+					Author: sig("a", "a@m.com"), Committer: sig("a", "A@M.com"),
+					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: a@m.com"},
+				},
+				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor)},
+			},
+			{
+				"NoCommitter",
+				&Commit{
+					Author: sig("a", "a@m.com"), Committer: sig("", ""),
+					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: Full Name <X@M.com>"},
+				},
+				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor), idt("Full Name", "X@M.com", roleCoAuthor)},
+			},
+		}
+		for _, c := range cases {
+			assert.Equal(t, c.identities, c.commit.AllParticipantIdentities(), "case: %s", c.name)
+		}
+	})
+	t.Run("CoAuthors", func(t *testing.T) {
+		cases := []testCase{
+			{
+				"GenuineCoAuthor",
+				&Commit{
+					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
+					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: x <x@m.com>"},
+				},
+				[]*CommitIdentity{idt("x", "x@m.com", roleCoAuthor)},
+			},
+			{
+				"CoAuthorIsCommitter",
+				&Commit{
+					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
+					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: c <c@m.com>"},
+				},
+				[]*CommitIdentity{idt("c", "c@m.com", roleCoAuthor)},
+			},
+			{
+				"CoAuthorIsAuthor",
+				&Commit{
+					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
+					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: a <a@m.com>"},
+				},
+				[]*CommitIdentity{},
+			},
+			{
+				"CoAuthorCommitterNameWithIndex", // restore the committer co-author to the co-author list by the index with correct name
+				&Commit{
+					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
+					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: x <x@m.com>\nCo-authored-by: c-other <c@m.com>\nCo-authored-by: y <y@m.com>"},
+				},
+				[]*CommitIdentity{idt("x", "x@m.com", roleCoAuthor), idt("c-other", "c@m.com", roleCoAuthor), idt("y", "y@m.com", roleCoAuthor)},
+			},
+		}
+		for _, c := range cases {
+			assert.Equal(t, c.identities, c.commit.CoAuthorIdentities(), "case: %s", c.name)
+		}
+	})
 }

modules/git/object_format.go

@@ -10,10 +10,10 @@ import (
 	"strconv"
 )
 
-// sha1Pattern can be used to determine if a string is an valid sha
+// sha1Pattern can be used to determine if a string is a valid sha
 var sha1Pattern = regexp.MustCompile(`^[0-9a-f]{4,40}$`)
 
-// sha256Pattern can be used to determine if a string is an valid sha
+// sha256Pattern can be used to determine if a string is a valid sha
 var sha256Pattern = regexp.MustCompile(`^[0-9a-f]{4,64}$`)
 
 type ObjectFormat interface {

modules/gitrepo/commit_test.go

@@ -21,19 +21,6 @@ func TestCommitsCount(t *testing.T) {
 	assert.Equal(t, int64(3), commitsCount)
 }
 
-func TestCommitsCountWithoutBase(t *testing.T) {
-	bareRepo1 := &mockRepository{path: "repo1_bare"}
-
-	commitsCount, err := CommitsCount(t.Context(), bareRepo1,
-		CommitsCountOptions{
-			Not:      "master",
-			Revision: []string{"branch1"},
-		})
-
-	assert.NoError(t, err)
-	assert.Equal(t, int64(2), commitsCount)
-}
-
 func TestCommitsCountWithSinceUntil(t *testing.T) {
 	bareRepo1 := &mockRepository{path: "repo1_bare"}
 	revision := []string{"8006ff9adbf0cb94da7dad9e537e53817f9fa5c0"}
@@ -65,6 +52,19 @@ func TestCommitsCountWithSinceUntil(t *testing.T) {
 	}
 }
 
+func TestCommitsCountWithoutBase(t *testing.T) {
+	bareRepo1 := &mockRepository{path: "repo1_bare"}
+
+	commitsCount, err := CommitsCount(t.Context(), bareRepo1,
+		CommitsCountOptions{
+			Not:      "master",
+			Revision: []string{"branch1"},
+		})
+
+	assert.NoError(t, err)
+	assert.Equal(t, int64(2), commitsCount)
+}
+
 func TestGetLatestCommitTime(t *testing.T) {
 	bareRepo1 := &mockRepository{path: "repo1_bare"}
 	lct, err := GetLatestCommitTime(t.Context(), bareRepo1)

modules/hostmatcher/http.go

@@ -5,8 +5,10 @@ package hostmatcher
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
+	"net/http"
 	"net/url"
 	"syscall"
 	"time"
@@ -63,3 +65,17 @@ func NewDialContext(usage string, allowList, blockList *HostMatchList, proxy *ur
 		return dialer.DialContext(ctx, network, addrOrHost)
 	}
 }
+
+// NewHTTPTransport builds an http.Transport that validates the request target against the allow/block
+// lists on the direct-dial path (DialContext). When an HTTP proxy is configured the proxy resolves and
+// dials the target itself, so restricting the proxied target is the proxy server's responsibility, not
+// Gitea's. proxyFunc selects the proxy URL per request (the http.Transport.Proxy selector, e.g.
+// proxy.Proxy()); proxyURLFixed is the fixed proxy address the dialer must always permit; tlsConfig may
+// be nil. blockList may be nil for callers that only maintain an allow-list.
+func NewHTTPTransport(usage string, allowList, blockList *HostMatchList, proxyFunc func(*http.Request) (*url.URL, error), proxyURLFixed *url.URL, tlsConfig *tls.Config) *http.Transport {
+	return &http.Transport{
+		TLSClientConfig: tlsConfig,
+		Proxy:           proxyFunc,
+		DialContext:     NewDialContext(usage, allowList, blockList, proxyURLFixed),
+	}
+}

modules/issue/template/template.go

@@ -167,7 +167,7 @@ func validateOptions(field *api.IssueFormField, idx int) error {
 
 	options, ok := field.Attributes["options"].([]any)
 	if !ok || len(options) == 0 {
-		return position.Errorf("'options' is required and should be a array")
+		return position.Errorf("'options' is required and should be an array")
 	}
 
 	for optIdx, option := range options {
@@ -270,7 +270,7 @@ func validateDropdownDefault(position errorPosition, attributes map[string]any)
 	options, ok := attributes["options"].([]any)
 	if !ok {
 		// should not happen
-		return position.Errorf("'options' is required and should be a array")
+		return position.Errorf("'options' is required and should be an array")
 	}
 	if defaultValue < 0 || defaultValue >= len(options) {
 		return position.Errorf("the value of 'default' is out of range")

modules/issue/template/template_test.go

@@ -268,7 +268,7 @@ body:
     attributes:
       label: "a"
 `,
-			wantErr: "body[0](dropdown): 'options' is required and should be a array",
+			wantErr: "body[0](dropdown): 'options' is required and should be an array",
 		},
 		{
 			name: "dropdown invalid options",

modules/markup/html.go

@@ -51,7 +51,7 @@ var globalVars = sync.OnceValue(func() *globalVarsType {
 	v := &globalVarsType{}
 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and lead to false positives.
+	// While fast, this is also incorrect and leads to false positives.
 	// TODO: fix invalid linking issue (update: stale TODO, what issues? maybe no TODO anymore)
 
 	// valid chars in encoded path and parameter: [-+~_%.a-zA-Z0-9/]

modules/markup/sanitizer_default.go

@@ -54,7 +54,7 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 	// Allow 'color' and 'background-color' properties for the style attribute on text elements.
 	policy.AllowStyles("color", "background-color").OnElements("div", "span", "p", "tr", "th", "td")
 
-	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")
+	policy.AllowAttrs("src", "autoplay", "controls", "muted", "loop", "playsinline").OnElements("video")
 
 	// Native support of "<picture><source media=... srcset=...><img src=...></picture>"
 	// ATTENTION: it only works with "auto" theme, because "media" query doesn't work with the theme chosen by end user manually.

modules/packages/arch/metadata.go

@@ -13,6 +13,7 @@ import (
 	"strconv"
 	"strings"
 
+	"gitea.dev/modules/packages"
 	"gitea.dev/modules/util"
 	"gitea.dev/modules/validation"
 
@@ -46,6 +47,11 @@ var (
 	namePattern = regexp.MustCompile(`\A[a-zA-Z0-9@._+-]+\z`)
 	// (epoch:pkgver-pkgrel)
 	versionPattern = regexp.MustCompile(`\A(?:\d:)?[\w.+~]+(?:-[-\w.+~]+)?\z`)
+
+	// caps on the accumulated package file list (vars so tests can lower them); far above
+	// any legitimate package, but low enough to stop metadata amplification
+	maxFileEntries   = 100000
+	maxFileNameBytes = 16 * 1024 * 1024
 )
 
 type Package struct {
@@ -124,7 +130,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 	}
 
 	var p *Package
-	files := make([]string, 0, 10)
+	files := packages.NewBoundedFileList(maxFileEntries, maxFileNameBytes)
 
 	tr := tar.NewReader(inner)
 	for {
@@ -147,7 +153,9 @@ func ParsePackage(r io.Reader) (*Package, error) {
 				return nil, err
 			}
 		} else if !strings.HasPrefix(filename, ".") {
-			files = append(files, hd.Name)
+			if err := files.Add(hd.Name); err != nil {
+				return nil, err
+			}
 		}
 	}
 
@@ -155,7 +163,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 		return nil, ErrMissingPKGINFOFile
 	}
 
-	p.FileMetadata.Files = files
+	p.FileMetadata.Files = files.Files()
 	p.FileCompressionExtension = compressionType
 
 	return p, nil

modules/packages/arch/metadata_test.go

@@ -10,6 +10,9 @@ import (
 	"io"
 	"testing"
 
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+
 	"github.com/klauspost/compress/zstd"
 	"github.com/stretchr/testify/assert"
 	"github.com/ulikunitz/xz"
@@ -167,3 +170,25 @@ func TestParsePackageInfo(t *testing.T) {
 		assert.ElementsMatch(t, []string{"usr/bin/paket1"}, p.FileMetadata.Backup)
 	})
 }
+
+// TestParsePackageTooManyFiles ensures the accumulated file list is bounded to prevent
+// metadata amplification from a package with a huge number of (tiny) file entries.
+func TestParsePackageTooManyFiles(t *testing.T) {
+	defer test.MockVariableValue(&maxFileEntries, 3)()
+	buf := test.WriteTarCompression(func(w io.Writer) io.WriteCloser { return gzip.NewWriter(w) }, map[string]string{
+		"file1":    "content1",
+		".PKGINFO": string(createPKGINFOContent(packageName, packageVersion)),
+	})
+	_, err := ParsePackage(buf)
+	assert.NoError(t, err)
+
+	buf = test.WriteTarCompression(func(w io.Writer) io.WriteCloser { return gzip.NewWriter(w) }, map[string]string{
+		"file1":    "content1",
+		"file2":    "content2",
+		"file3":    "content3",
+		"file4":    "content4",
+		".PKGINFO": string(createPKGINFOContent(packageName, packageVersion)),
+	})
+	_, err = ParsePackage(buf)
+	assert.ErrorIs(t, err, util.ErrInvalidArgument)
+}

modules/packages/debian/metadata.go

@@ -135,7 +135,10 @@ func ParsePackage(r io.Reader) (*Package, error) {
 				return nil, GlobalVars().ErrUnsupportedCompression
 			}
 
-			tr := tar.NewReader(inner)
+			// bound the decompressed control archive: it holds only the small control file
+			// and maintainer scripts, so a much larger stream is a decompression bomb
+			const maxControlTarSize = 32 * 1024 * 1024
+			tr := tar.NewReader(io.LimitReader(inner, maxControlTarSize))
 			for {
 				hd, err := tr.Next()
 				if err == io.EOF {
@@ -168,6 +171,7 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 	key := ""
 	var depends strings.Builder
 	var control strings.Builder
+	var description strings.Builder
 
 	// https://www.debian.org/doc/debian-policy/ch-controlfields.html#syntax-of-control-files
 	s := bufio.NewScanner(r)
@@ -189,10 +193,13 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 		control.WriteString(line)
 		control.WriteByte('\n')
 
+		// a leading space or tab marks a folded continuation line that belongs to the previous field
+		// (identified by key), not a new "Key: value" pair; only the multi-line fields append here.
+		// Continuation lines may themselves contain a colon, so they must not be re-split on ":".
 		if line[0] == ' ' || line[0] == '\t' {
 			switch key {
 			case "Description":
-				p.Metadata.Description += line
+				description.WriteString(line)
 			case "Depends":
 				depends.WriteString(trimmed)
 			}
@@ -219,7 +226,8 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 					p.Metadata.Maintainer = a.Name
 				}
 			case "Description":
-				p.Metadata.Description = value
+				description.Reset()
+				description.WriteString(value)
 			case "Depends":
 				depends.WriteString(value)
 			case "Homepage":
@@ -243,6 +251,8 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 		return nil, GlobalVars().ErrInvalidArchitecture
 	}
 
+	p.Metadata.Description = description.String()
+
 	dependencies := strings.Split(depends.String(), ",")
 	for i := range dependencies {
 		dependencies[i] = strings.TrimSpace(dependencies[i])

modules/packages/debian/metadata_test.go

@@ -232,3 +232,15 @@ func TestValidateDistributionOrComponent(t *testing.T) {
 		assert.True(t, IsValidDistributionOrComponent(name), "good=%q", name)
 	}
 }
+
+// TestParseControlFileMultilineDescription verifies a multi-line Description is assembled in order
+// (the parser accumulates it in a strings.Builder); it guards the assembled value, not its timing.
+func TestParseControlFileMultilineDescription(t *testing.T) {
+	var buf bytes.Buffer
+	buf.WriteString("Package: testpkg\nVersion: 1.0\nArchitecture: amd64\nDescription: short summary\n more details\n even more\n")
+
+	p, err := ParseControlFile(&buf)
+	assert.NoError(t, err)
+	assert.NotNil(t, p)
+	assert.Equal(t, "short summary more details even more", p.Metadata.Description)
+}

modules/packages/filelist.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package packages
+
+import "gitea.dev/modules/util"
+
+// BoundedFileList accumulates file names from a package archive while enforcing caps on the number of
+// entries and their total name length, returning an error once either cap would be exceeded.
+type BoundedFileList struct {
+	files     []string
+	nameBytes int
+	maxFiles  int
+	maxBytes  int
+}
+
+// NewBoundedFileList creates a BoundedFileList with the given caps; a non-positive cap falls back to the
+// corresponding default.
+func NewBoundedFileList(maxFiles, maxNameBytes int) *BoundedFileList {
+	return &BoundedFileList{maxFiles: maxFiles, maxBytes: maxNameBytes}
+}
+
+// Add appends name, returning util.ErrInvalidArgument once the entry count or accumulated byte length
+// would exceed the configured cap.
+func (b *BoundedFileList) Add(name string) error {
+	if len(b.files) >= b.maxFiles || b.nameBytes+len(name) > b.maxBytes {
+		return util.NewInvalidArgumentErrorf("package contains too many file entries")
+	}
+	b.nameBytes += len(name)
+	b.files = append(b.files, name)
+	return nil
+}
+
+// Files returns the accumulated file names.
+func (b *BoundedFileList) Files() []string {
+	return b.files
+}

modules/private/internal.go

@@ -8,6 +8,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"strings"
 	"sync"
@@ -53,12 +54,37 @@ func dialContextInternalAPI(ctx context.Context, network, address string) (conn
 	return conn, nil
 }
 
+// internalAPIConnectionIsLocal reports whether the internal API transport connects to a local target,
+// where the self-signed local certificate cannot be verified so skipping verification is safe. It mirrors
+// what dialContextInternalAPI actually dials: a unix socket whenever Protocol is HTTPUnix (always local,
+// whatever LOCAL_ROOT_URL says), otherwise the LOCAL_ROOT_URL host directly. A non-loopback LOCAL_ROOT_URL
+// is a real network hop, so its certificate must be verified, else the internal token can be MITM'd. An
+// unparseable LOCAL_ROOT_URL is a hard misconfiguration and fails closed (verify).
+func internalAPIConnectionIsLocal(protocol setting.Scheme, localURL string) bool {
+	if protocol == setting.HTTPUnix {
+		return true
+	}
+	u, err := url.Parse(localURL)
+	if err != nil {
+		return false
+	}
+	host := u.Hostname()
+	if host == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}
+
 var internalAPITransport = sync.OnceValue(func() http.RoundTripper {
 	return &http.Transport{
 		DialContext: dialContextInternalAPI,
 		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: true,
-			ServerName:         setting.Domain,
+			// Skip verification only for a local target (unix socket, or a loopback LOCAL_ROOT_URL), where the
+			// self-signed local cert can't be verified anyway; a non-loopback LOCAL_ROOT_URL is a real network
+			// hop and must be verified so the internal token can't be MITM'd. When verifying, Go's default
+			// ServerName (the dialed LOCAL_ROOT_URL host) is already correct, so it is not overridden.
+			InsecureSkipVerify: internalAPIConnectionIsLocal(setting.Protocol, setting.LocalURL),
 		},
 	}
 })

modules/private/internal_test.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package private
+
+import (
+	"testing"
+
+	"gitea.dev/modules/setting"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestInternalAPIConnectionIsLocal(t *testing.T) {
+	cases := []struct {
+		name     string
+		protocol setting.Scheme
+		localURL string
+		want     bool
+	}{
+		// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
+		{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
+		{"localhost", setting.HTTP, "http://localhost:3000/", true},
+		{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
+		{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
+		// a non-loopback LOCAL_ROOT_URL is a real network hop and must be verified
+		{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
+		{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
+		// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
+		{"invalid url", setting.HTTPS, "://bad", false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, internalAPIConnectionIsLocal(c.protocol, c.localURL))
+		})
+	}
+}

modules/references/references.go

@@ -24,7 +24,7 @@ var (
 
 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and lead to false positives.
+	// While fast, this is also incorrect and leads to false positives.
 	// TODO: fix invalid linking issue
 
 	// mentionPattern matches all mentions in the form of "@user" or "@org/team"

modules/setting/actions.go

@@ -14,6 +14,8 @@ import (
 
 const defaultMaxRerunAttempts = 50
 
+const defaultMaxConcurrentTaskPicks = 16
+
 // Actions settings
 var (
 	Actions = struct {
@@ -31,13 +33,18 @@ var (
 		WorkflowDirs          []string          `ini:"WORKFLOW_DIRS"`
 		ScopedWorkflowDirs    []string          `ini:"SCOPED_WORKFLOW_DIRS"`
 		MaxRerunAttempts      int64             `ini:"MAX_RERUN_ATTEMPTS"`
+		// MaxConcurrentTaskPicks bounds how many runners may run the task-assignment
+		// transaction at once per Gitea instance, to avoid a thundering herd when many
+		// runners poll together. It is a per-process limit, not a cluster-wide one.
+		MaxConcurrentTaskPicks int `ini:"MAX_CONCURRENT_TASK_PICKS"`
 	}{
-		Enabled:             true,
-		DefaultActionsURL:   defaultActionsURLGitHub,
-		SkipWorkflowStrings: []string{"[skip ci]", "[ci skip]", "[no ci]", "[skip actions]", "[actions skip]"},
-		WorkflowDirs:        []string{".gitea/workflows", ".github/workflows"},
-		ScopedWorkflowDirs:  []string{".gitea/scoped_workflows"},
-		MaxRerunAttempts:    defaultMaxRerunAttempts,
+		Enabled:                true,
+		DefaultActionsURL:      defaultActionsURLGitHub,
+		SkipWorkflowStrings:    []string{"[skip ci]", "[ci skip]", "[no ci]", "[skip actions]", "[actions skip]"},
+		WorkflowDirs:           []string{".gitea/workflows", ".github/workflows"},
+		ScopedWorkflowDirs:     []string{".gitea/scoped_workflows"},
+		MaxRerunAttempts:       defaultMaxRerunAttempts,
+		MaxConcurrentTaskPicks: defaultMaxConcurrentTaskPicks,
 	}
 )
 
@@ -128,6 +135,10 @@ func loadActionsFrom(rootCfg ConfigProvider) error {
 		Actions.MaxRerunAttempts = defaultMaxRerunAttempts
 	}
 
+	if Actions.MaxConcurrentTaskPicks <= 0 {
+		Actions.MaxConcurrentTaskPicks = defaultMaxConcurrentTaskPicks
+	}
+
 	if !Actions.LogCompression.IsValid() {
 		return fmt.Errorf("invalid [actions] LOG_COMPRESSION: %q", Actions.LogCompression)
 	}

modules/setting/repository.go

@@ -22,6 +22,7 @@ const (
 const (
 	RepoPRTitleSourceFirstCommit = "first-commit"
 	RepoPRTitleSourceAuto        = "auto"
+	RepoPRTitleSourceBranchName  = "branch-name"
 )
 
 // ItemsPerPage maximum items per page in forks, watchers and stars of a repo

modules/setting/security.go

@@ -20,9 +20,11 @@ var Security = struct {
 	XContentTypeOptions string
 
 	ContentSecurityPolicyGeneral string // it only supports empty (default policy) or "unset", maybe it can support more in the future
+	AllowedHostList              string
 }{
 	XFrameOptions:       "SAMEORIGIN",
 	XContentTypeOptions: "nosniff",
+	AllowedHostList:     "external",
 }
 
 var (

modules/setting/security_test.go

@@ -10,13 +10,20 @@ import (
 )
 
 func TestLoadSecurityFrom(t *testing.T) {
+	assert.Equal(t, "SAMEORIGIN", Security.XFrameOptions)
+	assert.Equal(t, "nosniff", Security.XContentTypeOptions)
+	assert.Equal(t, "external", Security.AllowedHostList)
+
 	cfg, err := NewConfigProviderFromData(`[security]
 X_FRAME_OPTIONS = DENY
 X_CONTENT_TYPE_OPTIONS = unset
-CONTENT_SECURITY_POLICY_GENERAL = "script-src *; foo"`)
+ALLOWED_HOST_LIST = foo
+CONTENT_SECURITY_POLICY_GENERAL = "script-src *; foo"
+`)
 	assert.NoError(t, err)
 	loadSecurityFrom(cfg)
 	assert.Equal(t, "DENY", Security.XFrameOptions)
 	assert.Equal(t, "unset", Security.XContentTypeOptions)
+	assert.Equal(t, "foo", Security.AllowedHostList)
 	assert.Equal(t, `"script-src *`, Security.ContentSecurityPolicyGeneral) // holy shit ini package bug
 }

modules/setting/webhook.go

@@ -34,7 +34,10 @@ func loadWebhookFrom(rootCfg ConfigProvider) {
 	Webhook.QueueLength = sec.Key("QUEUE_LENGTH").MustInt(1000)
 	Webhook.DeliverTimeout = sec.Key("DELIVER_TIMEOUT").MustInt(5)
 	Webhook.SkipTLSVerify = sec.Key("SKIP_TLS_VERIFY").MustBool()
-	Webhook.AllowedHostList = sec.Key("ALLOWED_HOST_LIST").MustString("")
+
+	deprecatedSetting(rootCfg, "webhook", "ALLOWED_HOST_LIST", "security", "ALLOWED_HOST_LIST", "v28.0.0")
+	Webhook.AllowedHostList = sec.Key("ALLOWED_HOST_LIST").MustString(Security.AllowedHostList)
+
 	Webhook.Types = []string{"gitea", "gogs", "slack", "discord", "dingtalk", "telegram", "msteams", "feishu", "matrix", "wechatwork", "packagist"}
 	Webhook.PagingNum = sec.Key("PAGING_NUM").MustInt(10)
 	Webhook.ProxyURL = sec.Key("PROXY_URL").MustString("")

modules/ssh/ssh_test.go

@@ -73,17 +73,18 @@ func TestInitKeys(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, keyFiles, len(keyTypes))
 
-	metadata := map[string]os.FileInfo{}
+	// Record file contents so regeneration can be detected
+	content := map[string][]byte{}
 	for _, keyType := range keyTypes {
 		privKeyPath := filepath.Join(tempDir, "gitea."+keyType)
 		pubKeyPath := filepath.Join(tempDir, "gitea."+keyType+".pub")
-		info, err := os.Stat(privKeyPath)
+		data, err := os.ReadFile(privKeyPath)
 		require.NoError(t, err)
-		metadata[privKeyPath] = info
+		content[privKeyPath] = data
 
-		info, err = os.Stat(pubKeyPath)
+		data, err = os.ReadFile(pubKeyPath)
 		require.NoError(t, err)
-		metadata[pubKeyPath] = info
+		content[pubKeyPath] = data
 	}
 
 	// Test recreation on missing private key and noop for missing pub key
@@ -98,26 +99,26 @@ func TestInitKeys(t *testing.T) {
 		privKeyPath := filepath.Join(tempDir, "gitea."+keyType)
 		pubKeyPath := filepath.Join(tempDir, "gitea."+keyType+".pub")
 
-		infoPriv, err := os.Stat(privKeyPath)
+		dataPriv, err := os.ReadFile(privKeyPath)
 		require.NoError(t, err)
 
 		switch keyType {
 		case "rsa":
 			// No modification to RSA key
-			infoPub, err := os.Stat(pubKeyPath)
+			dataPub, err := os.ReadFile(pubKeyPath)
 			require.NoError(t, err)
-			assert.Equal(t, metadata[privKeyPath], infoPriv)
-			assert.Equal(t, metadata[pubKeyPath], infoPub)
+			assert.Equal(t, content[privKeyPath], dataPriv)
+			assert.Equal(t, content[pubKeyPath], dataPub)
 		case "ecdsa":
 			// ECDSA public key should be missing, private unchanged
-			assert.Equal(t, metadata[privKeyPath], infoPriv)
+			assert.Equal(t, content[privKeyPath], dataPriv)
 			assert.NoFileExists(t, pubKeyPath)
 		case "ed25519":
 			// ed25519 private key was removed, so both keys regenerated
-			infoPub, err := os.Stat(pubKeyPath)
+			dataPub, err := os.ReadFile(pubKeyPath)
 			require.NoError(t, err)
-			assert.NotEqual(t, metadata[privKeyPath], infoPriv)
-			assert.NotEqual(t, metadata[pubKeyPath], infoPub)
+			assert.NotEqual(t, content[privKeyPath], dataPriv)
+			assert.NotEqual(t, content[pubKeyPath], dataPub)
 		}
 	}
 }

modules/storage/minio.go

@@ -6,6 +6,7 @@ package storage
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -47,40 +48,42 @@ type MinioStorage struct {
 	basePath string
 }
 
-func convertMinioErr(err error) error {
+func convertMinioErr(err error, optMsg ...string) error {
 	if err == nil {
 		return nil
 	}
-	errResp, ok := err.(minio.ErrorResponse)
+
+	wrapErr := func(err error) error {
+		if len(optMsg) == 0 {
+			return err
+		}
+		return fmt.Errorf("%s: %w", optMsg[0], err)
+	}
+
+	errResp, ok := errors.AsType[minio.ErrorResponse](err)
 	if !ok {
-		return err
+		return wrapErr(err)
 	}
 
 	// Convert two responses to standard analogues
 	switch errResp.Code {
 	case "NoSuchKey":
-		return os.ErrNotExist
+		return wrapErr(os.ErrNotExist)
 	case "AccessDenied":
-		return os.ErrPermission
+		return wrapErr(os.ErrPermission)
 	}
 
-	return err
-}
-
-var getBucketVersioning = func(ctx context.Context, minioClient *minio.Client, bucket string) error {
-	_, err := minioClient.GetBucketVersioning(ctx, bucket)
-	return err
+	return wrapErr(err)
 }
 
 // NewMinioStorage returns a minio storage
 func NewMinioStorage(ctx context.Context, cfg *setting.Storage) (ObjectStorage, error) {
 	config := cfg.MinioConfig
+	log.Info("Creating minio storage at %s:%s with base path %s", config.Endpoint, config.Bucket, config.BasePath)
 	if config.ChecksumAlgorithm != "" && config.ChecksumAlgorithm != "default" && config.ChecksumAlgorithm != "md5" {
 		return nil, fmt.Errorf("invalid minio checksum algorithm: %s", config.ChecksumAlgorithm)
 	}
 
-	log.Info("Creating Minio storage at %s:%s with base path %s", config.Endpoint, config.Bucket, config.BasePath)
-
 	var lookup minio.BucketLookupType
 	switch config.BucketLookUpType {
 	case "auto", "":
@@ -93,6 +96,13 @@ func NewMinioStorage(ctx context.Context, cfg *setting.Storage) (ObjectStorage,
 		return nil, fmt.Errorf("invalid minio bucket lookup type: %s", config.BucketLookUpType)
 	}
 
+	// The request error message is something like:
+	// * "The request signature we calculated does not match the signature you provided. Check your key and signing method."
+	// It doesn't contain useful information to site admin, so here we wrap the error with our error message
+	// to tell the site admin what is the problem.
+	makeErrMsg := func(hint string) string {
+		return fmt.Sprintf("ObjectStorage.%s: endpoint=%s, location=%s, bucket=%s", hint, config.Endpoint, config.Location, config.Bucket)
+	}
 	minioClient, err := minio.New(config.Endpoint, &minio.Options{
 		Creds:        buildMinioCredentials(config),
 		Secure:       config.UseSSL,
@@ -101,37 +111,21 @@ func NewMinioStorage(ctx context.Context, cfg *setting.Storage) (ObjectStorage,
 		BucketLookup: lookup,
 	})
 	if err != nil {
-		return nil, convertMinioErr(err)
-	}
-
-	// The GetBucketVersioning is only used for checking whether the Object Storage parameters are generally good. It doesn't need to succeed.
-	// The assumption is that if the API returns the HTTP code 400, then the parameters could be incorrect.
-	// Otherwise even if the request itself fails (403, 404, etc), the code should still continue because the parameters seem "good" enough.
-	// Keep in mind that GetBucketVersioning requires "owner" to really succeed, so it can't be used to check the existence.
-	// Not using "BucketExists (HeadBucket)" because it doesn't include detailed failure reasons.
-	err = getBucketVersioning(ctx, minioClient, config.Bucket)
-	if err != nil {
-		errResp, ok := err.(minio.ErrorResponse)
-		if !ok {
-			return nil, err
-		}
-		if errResp.StatusCode == http.StatusBadRequest {
-			log.Error("S3 storage connection failure at %s:%s with base path %s and region: %s", config.Endpoint, config.Bucket, config.Location, errResp.Message)
-			return nil, err
-		}
+		return nil, convertMinioErr(err, makeErrMsg("NewClient"))
 	}
 
 	// Check to see if we already own this bucket
 	exists, err := minioClient.BucketExists(ctx, config.Bucket)
 	if err != nil {
-		return nil, convertMinioErr(err)
+		return nil, convertMinioErr(err, makeErrMsg("BucketExists"))
 	}
 
+	// If the bucket doesn't exist, try to create one
 	if !exists {
 		if err := minioClient.MakeBucket(ctx, config.Bucket, minio.MakeBucketOptions{
 			Region: config.Location,
 		}); err != nil {
-			return nil, convertMinioErr(err)
+			return nil, convertMinioErr(err, makeErrMsg("MakeBucket"))
 		}
 	}
 

modules/storage/minio_test.go

@@ -4,16 +4,13 @@
 package storage
 
 import (
-	"context"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"testing"
 
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 
-	"github.com/minio/minio-go/v7"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -84,31 +81,18 @@ func TestMinioStoragePath(t *testing.T) {
 }
 
 func TestS3StorageBadRequest(t *testing.T) {
-	if os.Getenv("CI") == "" {
-		t.Skip("S3Storage not present outside of CI")
-		return
-	}
+	endpoint := test.ExternalServiceHTTP(t, "TEST_MINIO_ENDPOINT", "minio:9000")
 	cfg := &setting.Storage{
 		MinioConfig: setting.MinioStorageConfig{
-			Endpoint:        "minio:9000",
+			Endpoint:        endpoint,
 			AccessKeyID:     "123456",
-			SecretAccessKey: "12345678",
+			SecretAccessKey: "invalid-secret",
 			Bucket:          "bucket",
 			Location:        "us-east-1",
 		},
 	}
-	message := "ERROR"
-	old := getBucketVersioning
-	defer func() { getBucketVersioning = old }()
-	getBucketVersioning = func(ctx context.Context, minioClient *minio.Client, bucket string) error {
-		return minio.ErrorResponse{
-			StatusCode: http.StatusBadRequest,
-			Code:       "FixtureError",
-			Message:    message,
-		}
-	}
 	_, err := NewStorage(setting.MinioStorageType, cfg)
-	assert.ErrorContains(t, err, message)
+	assert.ErrorContains(t, err, "ObjectStorage.BucketExists: endpoint="+endpoint)
 }
 
 func TestMinioCredentials(t *testing.T) {

modules/structs/admin_user.go

@@ -19,7 +19,6 @@ type CreateUserOption struct {
 	// The full display name of the user
 	FullName string `json:"full_name" binding:"MaxSize(100)"`
 	// required: true
-	// swagger:strfmt email
 	Email string `json:"email" binding:"Required;Email;MaxSize(254)"`
 	// The plain text password for the user
 	Password string `json:"password" binding:"MaxSize(255)"`

modules/structs/issue.go

@@ -133,7 +133,6 @@ type IssueAssigneesOption struct {
 // EditDeadlineOption options for creating a deadline
 type EditDeadlineOption struct {
 	// required:true
-	// swagger:strfmt date-time
 	Deadline *time.Time `json:"due_date"`
 }
 

modules/structs/notifications.go

@@ -68,7 +68,7 @@ const (
 type NotifySubjectType string
 
 const (
-	// NotifySubjectIssue a issue is subject of an notification
+	// NotifySubjectIssue an issue is subject of a notification
 	NotifySubjectIssue NotifySubjectType = "Issue"
 	// NotifySubjectPull a pull is subject of an notification
 	NotifySubjectPull NotifySubjectType = "Pull"

modules/structs/org_team.go

@@ -54,10 +54,10 @@ type CreateTeamOption struct {
 	// Whether the team has access to all repositories in the organization
 	IncludesAllRepositories bool                `json:"includes_all_repositories"`
 	Permission              RepoWritePermission `json:"permission"`
-	// example: ["repo.actions","repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.ext_wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"]
+	// example: ["repo.actions","repo.packages","repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"]
 	// Deprecated: This variable should be replaced by UnitsMap and will be dropped in later versions.
 	Units []string `json:"units"`
-	// example: {"repo.actions","repo.packages","repo.code":"read","repo.issues":"write","repo.ext_issues":"none","repo.wiki":"admin","repo.pulls":"owner","repo.releases":"none","repo.projects":"none","repo.ext_wiki":"none"}
+	// example: {"repo.actions":"read","repo.packages":"read","repo.code":"read","repo.issues":"write","repo.ext_issues":"none","repo.wiki":"admin","repo.pulls":"owner","repo.releases":"none","repo.projects":"none","repo.ext_wiki":"none"}
 	UnitsMap map[string]string `json:"units_map"`
 	// Whether the team can create repositories in the organization
 	CanCreateOrgRepo bool `json:"can_create_org_repo"`

modules/templates/helper_test.go

@@ -92,9 +92,12 @@ func TestTemplateEscape(t *testing.T) {
 	}
 
 	t.Run("Golang URL Escape", func(t *testing.T) {
-		// Golang template considers "href", "*src*", "*uri*", "*url*" (and more) ... attributes as contentTypeURL and does auto-escaping
+		// HINT: GOLANG-HTML-TEMPLATE-URL-ESCAPING: demo cases (html/template/attr.go):
+		// Golang template considers "href", "data-href", "*src*", "*uri*", "*url*" (and more) ... attributes as contentTypeURL and does auto-escaping
 		actual := execTmpl(`<a href="?a={{"%"}}"></a>`)
 		assert.Equal(t, `<a href="?a=%25"></a>`, actual)
+		actual = execTmpl(`<a data-href="?a={{"%"}}"></a>`)
+		assert.Equal(t, `<a data-href="?a=%25"></a>`, actual)
 		actual = execTmpl(`<a data-xxx-url="?a={{"%"}}"></a>`)
 		assert.Equal(t, `<a data-xxx-url="?a=%25"></a>`, actual)
 	})
@@ -102,6 +105,10 @@ func TestTemplateEscape(t *testing.T) {
 		// non-URL content isn't auto-escaped
 		actual := execTmpl(`<a data-link="?a={{"%"}}"></a>`)
 		assert.Equal(t, `<a data-link="?a=%"></a>`, actual)
+		// the attr names like "data-href" and "data-action" are treated as URL (as the "data-" prefix is stripped)
+		// but "data-xxx-href" and "data-xxx-action" are not, so no escaping.
+		actual = execTmpl(`<a data-xxx-href="?a={{"%"}}"></a>`)
+		assert.Equal(t, `<a data-xxx-href="?a=%"></a>`, actual)
 	})
 	t.Run("QueryBuild", func(t *testing.T) {
 		actual := execTmpl(`<a href="{{QueryBuild "?" "a" "%"}}"></a>`)

modules/turnstile/turnstile.go

@@ -12,9 +12,20 @@ import (
 	"strings"
 
 	"gitea.dev/modules/json"
+	"gitea.dev/modules/proxy"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
+// httpClient returns an HTTP client that honors Gitea's proxy configuration.
+var httpClient = util.OnceValue[*http.Client]{
+	Func: func() *http.Client {
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.Proxy = proxy.Proxy()
+		return &http.Client{Transport: transport}
+	},
+}
+
 // Response is the structure of JSON returned from API
 type Response struct {
 	Success     bool        `json:"success"`
@@ -40,7 +51,7 @@ func Verify(ctx context.Context, response string) (bool, error) {
 	}
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := httpClient.Value().Do(req)
 	if err != nil {
 		return false, fmt.Errorf("Failed to send CAPTCHA response: %w", err)
 	}

modules/turnstile/turnstile_test.go

@@ -0,0 +1,38 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package turnstile
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTPClientHonorsProxy(t *testing.T) {
+	proxyURL, err := url.Parse("http://proxy.example.com:3128")
+	require.NoError(t, err)
+
+	defer test.MockVariableValue(&setting.Proxy.Enabled, true)()
+	defer test.MockVariableValue(&setting.Proxy.ProxyURL, proxyURL.String())()
+	defer test.MockVariableValue(&setting.Proxy.ProxyURLFixed, proxyURL)()
+	defer test.MockVariableValue(&setting.Proxy.ProxyHosts, []string{"**"})()
+	httpClient.Reset()
+	transport, ok := httpClient.Value().Transport.(*http.Transport)
+	require.True(t, ok)
+	require.NotNil(t, transport.Proxy)
+
+	// The Turnstile verification request must be routed through the configured proxy.
+	req := httptest.NewRequest(http.MethodPost, "https://any.example.com", nil)
+	got, err := transport.Proxy(req)
+	require.NoError(t, err)
+	require.NotNil(t, got)
+	assert.Equal(t, proxyURL.String(), got.String())
+}

modules/uri/uri.go

@@ -23,13 +23,21 @@ func (e ErrURISchemeNotSupported) Error() string {
 
 // Open open a local file or a remote file
 func Open(uriStr string) (io.ReadCloser, error) {
+	return OpenWithClient(uriStr, http.DefaultClient)
+}
+
+// OpenWithClient opens a local file or a remote file, using the given (non-nil) HTTP client
+// for http/https URLs. Callers that must confine remote access (e.g. to defeat SSRF via
+// redirects) should pass a client whose transport validates the peer at dial time; Open
+// passes http.DefaultClient.
+func OpenWithClient(uriStr string, client *http.Client) (io.ReadCloser, error) {
 	u, err := url.Parse(uriStr)
 	if err != nil {
 		return nil, err
 	}
 	switch strings.ToLower(u.Scheme) {
 	case "http", "https":
-		f, err := http.Get(uriStr)
+		f, err := client.Get(uriStr)
 		if err != nil {
 			return nil, err
 		}

modules/uri/uri_test.go

@@ -4,10 +4,18 @@
 package uri
 
 import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
+	"strings"
+	"sync/atomic"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestReadURI(t *testing.T) {
@@ -17,3 +25,45 @@ func TestReadURI(t *testing.T) {
 	assert.NoError(t, err)
 	defer f.Close()
 }
+
+// TestOpenWithClientValidatesRedirectTarget verifies OpenWithClient routes the
+// whole request chain (including redirects) through the provided client, so a
+// client whose transport refuses to dial an internal target blocks a redirect to
+// it — whereas the default client (old Open behavior) follows it.
+func TestOpenWithClientValidatesRedirectTarget(t *testing.T) {
+	var internalHit atomic.Bool
+	internal := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		internalHit.Store(true)
+		_, _ = w.Write([]byte("secret"))
+	}))
+	defer internal.Close()
+
+	front := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, internal.URL, http.StatusFound)
+	}))
+	defer front.Close()
+
+	internalAddr := strings.TrimPrefix(internal.URL, "http://")
+
+	// a client that refuses to dial the internal target, mimicking the migration
+	// hostmatcher dialer that re-validates every hop
+	blockingClient := &http.Client{Transport: &http.Transport{
+		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			if addr == internalAddr {
+				return nil, errors.New("blocked internal address")
+			}
+			return (&net.Dialer{}).DialContext(ctx, network, addr)
+		},
+	}}
+
+	_, err := OpenWithClient(front.URL, blockingClient)
+	require.Error(t, err)
+	assert.False(t, internalHit.Load(), "the redirect target must not be reached through the validating client")
+
+	// the default client (the previous behavior) follows the redirect to the internal target
+	internalHit.Store(false)
+	rc, err := Open(front.URL)
+	require.NoError(t, err)
+	_ = rc.Close()
+	assert.True(t, internalHit.Load(), "sanity check: the default client follows the redirect")
+}

modules/util/sync.go

@@ -0,0 +1,51 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package util
+
+import (
+	"sync"
+	"sync/atomic"
+)
+
+type onceValueResult[T any] struct {
+	value T
+	panic any
+}
+
+// OnceValue is similar to Golang's "sync.OnceValue", but can be reset.
+type OnceValue[T any] struct {
+	Func func() T
+	mu   sync.Mutex
+	res  atomic.Pointer[onceValueResult[T]]
+}
+
+func (o *OnceValue[T]) Value() T {
+	res := o.res.Load()
+	if res == nil {
+		o.mu.Lock()
+		defer o.mu.Unlock()
+		res = o.res.Load()
+		if res == nil {
+			res = &onceValueResult[T]{}
+			defer func() {
+				res.panic = recover()
+				o.res.Store(res)
+				if res.panic != nil {
+					panic(res.panic)
+				}
+			}()
+			res.value = o.Func()
+		}
+	}
+	if res.panic != nil {
+		panic(res.panic)
+	}
+	return res.value
+}
+
+func (o *OnceValue[T]) Reset() {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	o.res.Store(nil)
+}

modules/util/sync_test.go

@@ -0,0 +1,49 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package util
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestOnceValue(t *testing.T) {
+	t.Run("RepeatCall", func(t *testing.T) {
+		callCount := 0
+		o := OnceValue[int]{Func: func() int {
+			callCount++
+			return 42
+		}}
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 1, callCount)
+		o.Reset()
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+	})
+
+	t.Run("Panic", func(t *testing.T) {
+		callCount := 0
+		doPanic := true
+		o := OnceValue[int]{Func: func() int {
+			callCount++
+			if doPanic {
+				panic("some error")
+			}
+			return 42
+		}}
+		assert.PanicsWithValue(t, "some error", func() { o.Value() })
+		assert.PanicsWithValue(t, "some error", func() { o.Value() })
+		assert.Equal(t, 1, callCount)
+		doPanic = false
+		o.Reset()
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+	})
+}

modules/util/time_str.go

@@ -40,6 +40,7 @@ var timeStrGlobalVars = sync.OnceValue(func() *timeStrGlobalVarsType {
 })
 
 func TimeEstimateParse(timeStr string) (int64, error) {
+	timeStr = strings.TrimSpace(timeStr)
 	if timeStr == "" {
 		return 0, nil
 	}
@@ -51,7 +52,13 @@ func TimeEstimateParse(timeStr string) (int64, error) {
 	if matches[0][0] != 0 || matches[len(matches)-1][1] != len(timeStr) {
 		return 0, fmt.Errorf("invalid time string: %s", timeStr)
 	}
+	prevEnd := 0
 	for _, match := range matches {
+		// only whitespace may separate two units, otherwise the string contains invalid content like "1h x 2m"
+		if strings.TrimSpace(timeStr[prevEnd:match[0]]) != "" {
+			return 0, fmt.Errorf("invalid time string: %s", timeStr)
+		}
+		prevEnd = match[1]
 		amount, err := strconv.ParseInt(timeStr[match[2]:match[3]], 10, 64)
 		if err != nil {
 			return 0, fmt.Errorf("invalid time string: %v", err)

modules/util/time_str_test.go

@@ -22,6 +22,9 @@ func TestTimeStr(t *testing.T) {
 			{"1s", 1, false},
 			{"1h 1m 1s", 3600 + 60 + 1, false},
 			{"1d1x", 0, true},
+			{"1h 2x 3m", 0, true},
+			{"1h_2m", 0, true},
+			{"1h,1m", 0, true},
 		}
 		for _, test := range tests {
 			t.Run(test.input, func(t *testing.T) {

modules/web/middleware/locale.go

@@ -12,6 +12,24 @@ import (
 	"golang.org/x/text/language"
 )
 
+// maxAcceptLanguageLen bounds the Accept-Language header before it reaches
+// language.ParseAcceptLanguage. That parser has quadratic-time behavior on long
+// malformed inputs, and its built-in guard only counts "-" separators while the
+// scanner treats "_" as an alias for "-", so a "_"-heavy header slips past the
+// guard and burns CPU. Only the leading (highest-priority) languages are used, so
+// truncating a longer header is safe.
+const maxAcceptLanguageLen = 200
+
+// parseAcceptLanguage parses the Accept-Language header after bounding its length
+// to avoid a quadratic-time DoS on attacker-controlled input.
+func parseAcceptLanguage(header string) []language.Tag {
+	if len(header) > maxAcceptLanguageLen {
+		header = header[:maxAcceptLanguageLen]
+	}
+	tags, _, _ := language.ParseAcceptLanguage(header)
+	return tags
+}
+
 // Locale handle locale
 func Locale(resp http.ResponseWriter, req *http.Request) translation.Locale {
 	// 1. Check URL arguments.
@@ -35,7 +53,7 @@ func Locale(resp http.ResponseWriter, req *http.Request) translation.Locale {
 	// 3. Get language information from 'Accept-Language'.
 	// The first element in the list is chosen to be the default language automatically.
 	if len(lang) == 0 {
-		tags, _, _ := language.ParseAcceptLanguage(req.Header.Get("Accept-Language"))
+		tags := parseAcceptLanguage(req.Header.Get("Accept-Language"))
 		tag := translation.Match(tags...)
 		lang = tag.String()
 	}

modules/web/middleware/locale_test.go

@@ -0,0 +1,27 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package middleware
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseAcceptLanguage(t *testing.T) {
+	// a normal header is parsed and its leading language preserved
+	tags := parseAcceptLanguage("de-DE,de;q=0.9,en;q=0.8")
+	assert.NotEmpty(t, tags)
+	assert.Equal(t, "de-DE", tags[0].String())
+
+	// an oversized "_"-separated header would drive ParseAcceptLanguage into its
+	// quadratic-time path (the built-in guard only counts "-"); the length bound
+	// keeps the input passed to the parser small so it cannot be used for a DoS.
+	malicious := strings.Repeat("_aaaaaaaaa", 1<<16) // ~640 KiB, zero "-" characters
+	assert.Greater(t, len(malicious), maxAcceptLanguageLen)
+	tags = parseAcceptLanguage(malicious)
+	// no panic / hang, and nothing meaningful is parsed out of the garbage
+	assert.Empty(t, tags)
+}

options/locale/locale_de-DE.json

@@ -74,7 +74,7 @@
   "forks": "Forks",
   "activities": "Aktivitäten",
   "pull_requests": "Pull-Requests",
-  "issues": "Probleme",
+  "issues": "Issues",
   "milestones": "Meilensteine",
   "ok": "OK",
   "cancel": "Abbrechen",
@@ -1101,7 +1101,7 @@
   "repo.migrate_items_wiki": "Wiki",
   "repo.migrate_items_milestones": "Meilensteine",
   "repo.migrate_items_labels": "Labels",
-  "repo.migrate_items_issues": "Probleme",
+  "repo.migrate_items_issues": "Issues",
   "repo.migrate_items_pullrequests": "Pull-Requests",
   "repo.migrate_items_merge_requests": "Merge-Requests",
   "repo.migrate_items_releases": "Veröffentlichungen",
@@ -1178,7 +1178,7 @@
   "repo.find_tag": "Tag finden",
   "repo.branches": "Branches",
   "repo.tags": "Tags",
-  "repo.issues": "Probleme",
+  "repo.issues": "Issues",
   "repo.pulls": "Pull-Requests",
   "repo.projects": "Projekte",
   "repo.packages": "Pakete",
@@ -2300,7 +2300,7 @@
   "repo.settings.event_repository": "Repository",
   "repo.settings.event_repository_desc": "Repository erstellt oder gelöscht.",
   "repo.settings.event_header_issue": "Issue Ereignisse",
-  "repo.settings.event_issues": "Probleme",
+  "repo.settings.event_issues": "Issues",
   "repo.settings.event_issues_desc": "Issue geöffnet, geschlossen, wieder geöffnet, bearbeitet oder gelöscht.",
   "repo.settings.event_issue_assign": "Issue zugewiesen",
   "repo.settings.event_issue_assign_desc": "Issue zugewiesen oder Zuweisung entfernt.",
@@ -3104,7 +3104,7 @@
   "admin.repos.owner": "Besitzer",
   "admin.repos.name": "Name",
   "admin.repos.private": "Privat",
-  "admin.repos.issues": "Probleme",
+  "admin.repos.issues": "Issues",
   "admin.repos.size": "Größe",
   "admin.repos.lfs_size": "LFS-Größe",
   "admin.packages.package_manage_panel": "Paketverwaltung",
@@ -3779,6 +3779,7 @@
   "actions.runs.commit": "Commit",
   "actions.runs.run_details": "Run Details",
   "actions.runs.workflow_file": "Workflow-Datei",
+  "actions.runs.workflow_file_no_permission": "Keine Berechtigung zum Anzeigen der Workflow-Datei",
   "actions.runs.scheduled": "Geplant",
   "actions.runs.pushed_by": "gepusht von",
   "actions.runs.invalid_workflow_helper": "Die Workflow-Konfigurationsdatei ist ungültig. Bitte überprüfe Deine Konfigurationsdatei: %s",
@@ -3835,7 +3836,33 @@
   "actions.workflow.scope_owner": "Besitzer",
   "actions.workflow.scope_global": "Global",
   "actions.workflow.required": "Erforderlich",
+  "actions.workflow.scoped_required_cannot_disable": "Dieser Scoped Workflow ist erforderlich und kann nicht deaktiviert werden.",
+  "actions.scoped_workflows": "Scoped Workflows",
+  "actions.scoped_workflows.desc_org": "Repositories als Scoped Workflow Quellen registrieren. Workflow-Dateien unter den Workflow-Verzeichnissen eines Quell-Repositorys laufen in jedem Projektarchiv dieser Organisation, im eigenen Kontext des Projektarchivs.",
+  "actions.scoped_workflows.desc_user": "Repositories als Scoped Workflow Quellen registrieren. Workflow-Dateien unter den Workflow-Verzeichnissen eines Quell-Repositorys laufen in jedem Projektarchiv dieser Organisation, im eigenen Kontext des Projektarchivs.",
+  "actions.scoped_workflows.desc_global": "Repositories als Scoped Workflow-Quellen registrieren. Workflow-Dateien unter den Workflow-Verzeichnissen eines Quellcode-Repositorys laufen auf jedem Projektarchiv in dieser Instanz im eigenen Kontext des Projektarchivs. Da Quellen auf Instanzenebene auf den Ereignissen jedes Projektarchivs ausgewertet werden, kann die Registrierung bei großen Instanzen Overhead hinzufügen.",
+  "actions.scoped_workflows.add_help": "Um Scoped Workflows aus einem Repository zu erstellen, übertrage die Workflow-Dateien unter <code>%s</code> in seinem Standard Branch, dann registrieren Sie das Projektarchiv als Quelle unten.",
+  "actions.scoped_workflows.security_note": "Der Workflow-Inhalt eines Quell-Repositorys wird in jedem Repository ausgeführt, für das er gilt. Die Skripte der einzelnen Schritte sowie deren Ausgabe werden in den Actions-Logs des jeweiligen Repositorys gespeichert und sind für alle sichtbar, die die Actions des konsumierenden Repositorys einsehen können. Das Registrieren eines privaten Repositorys als Quelle legt daher dessen Workflow-Logik über diese Logs offen. Registriere nur Repositorys, deren Workflow-Inhalte mit allen konsumierenden Repositorys geteilt werden dürfen. Wenn ein scoped Workflow einen wiederverwendbaren Workflow aus einem privaten Repository referenziert, stelle sicher, dass jedes konsumierende Repository darauf Lesezugriff hat – andernfalls schlägt der Workflow dort fehl.",
+  "actions.scoped_workflows.source.add": "Quell-Repository hinzufügen",
+  "actions.scoped_workflows.source.add_success": "Quell-Repository hinzugefügt.",
+  "actions.scoped_workflows.source.remove_success": "Quell-Repository entfernt.",
+  "actions.scoped_workflows.source.not_found": "Repository nicht gefunden.",
+  "actions.scoped_workflows.required.update_success": "Erforderliche Workflows aktualisiert.",
+  "actions.scoped_workflows.required.label": "Workflows als erforderlich markieren (ein erforderlicher Workflow kann nicht durch Repositories deaktiviert werden):",
+  "actions.scoped_workflows.required.patterns": "Erforderliche Statusüberprüfungsmuster",
+  "actions.scoped_workflows.required.patterns_aria": "Erforderliche Statusüberprüfungsmuster für %s",
+  "actions.scoped_workflows.required.patterns_note": "nur erzwungen während der Workflow benötigt wird",
+  "actions.scoped_workflows.required.patterns_hint": "Markieren Sie den Workflow als erforderlich, um seine Statusüberprüfungsmuster zu konfigurieren.",
+  "actions.scoped_workflows.required.patterns_help": "Ein Statusüberprüfungsmuster (glob) pro Zeile. Ein Pull-Request kann erst zusammengeführt werden, wenn ein Status mit jedem Muster übereinstimmt. Dies wird für jeden Zielzweig erzwungen, der eine Schutzregel hat, auch für einen mit einer eigenen Statusüberprüfung; ein Zielzweig ohne Schutzregel ist nicht ausgeschaltet.",
+  "actions.scoped_workflows.required.patterns_empty": "Jeder benötigte Workflow benötigt mindestens ein Statusüberprüfungsmuster.",
+  "actions.scoped_workflows.required.missing_file": "nicht mehr im Quelltext",
+  "actions.scoped_workflows.required.expected_contexts": "Erwartete Statusüberprüfung (eine Prüfung, die zu einem Muster passt)",
+  "actions.scoped_workflows.required.no_status_contexts": "Dieser Workflow postet keine Status Checks, ihn als Anforderung zu markieren würde jede Pull Request blockieren. Deaktiviere die Anforderung.",
+  "actions.scoped_workflows.no_files": "Im Standard-Branch wurden keine Scoped Workflow-Dateien gefunden.",
   "actions.workflow.run": "Workflow ausführen",
+  "actions.workflow.create_status_badge": "Status Badge erstellen",
+  "actions.workflow.status_badge": "Status Badge",
+  "actions.workflow.status_badge_url": "Badge-URL",
   "actions.workflow.not_found": "Workflow '%s' wurde nicht gefunden.",
   "actions.workflow.run_success": "Workflow '%s' erfolgreich ausgeführt.",
   "actions.workflow.from_ref": "Nutze Workflow von",