chore(deps): update gitea/gitea docker tag to v1.26.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
gitea/gitea	minor	1.21.11 → 1.26.1

---

Release Notes

go-gitea/gitea (gitea/gitea)

v1.26.1

Compare Source

• BUGFIXES
  • Add event.schedule context for schedule actions task (#​37320) (#​37348)
  • Fix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#​37324) (#​37344)
  • Use modern "git update-index --cacheinfo" syntax to support more file names (#​37338) (#​37343)
  • Fix URL related escaping for oauth2 (#​37334) (#​37340)
  • When the requested arch rpm is missing fall back to noarch (#​37236) (#​37339)
  • Fix actions concurrency groups cross-branch leak (#​37311) (#​37331)
  • Fix bug when accessing user badges (#​37321) (#​37329)
  • Fix AppFullLink (#​37325) (#​37328)
  • Fix container auth for public instance (#​37290) (#​37294)
  • Enhance GetActionWorkflow to support fallback references (#​37189) (#​37283)
  • Fix vite manifest update masking build errors (#​37279) (#​37310)
  • Fix Mermaid diagrams failing when node labels contain line breaks (#​37296) (#​37299)
  • Use TriggerEvent instead of Event in workflow runs API response for scheduled runs (#​37288) #​37360
  • Add URL to Learn more about blocking a user. (#​37355) #​37367
  • Fix button layout shift when collapsing file tree in editor (#​37363) #​37375
  • Fix org team assignee/reviewer lookups for team member permissions (#​37365) #​37391
  • Fix repo init README EOL (#​37388) #​37399
  • Fix: dump with default zip type produces uncompressed zip (#​37401)#​37402

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.26.0

Compare Source

• BREAKING
  • Correct swagger annotations for enums, status codes, and notification state (#​37030)
  • Remove GET API registration-token (#​36801)
  • Support Actions concurrency syntax (#​32751)
  • Make PUBLIC_URL_DETECTION default to "auto" (#​36955)
• SECURITY
  • Bound PageSize in ListUnadoptedRepositories (#​36884)
• FEATURES
  • Support Actions concurrency syntax (#​32751)
  • Add terraform state registry (#​36710)
  • Instance-wide (global) info banner and maintenance mode (#​36571)
  • Support rendering OpenAPI spec (#​36449)
  • Add keyboard shortcuts for repository file and code search (#​36416)
  • Add support for archive-upload rpc (#​36391)
  • Add ability to download subpath archive (#​36371)
  • Add workflow dependencies visualization (#​26062) (#​36248) & Restyle Workflow Graph (#​36912)
  • Automatic generation of release notes (#​35977)
  • Add "Go to file", "Delete Directory" to repo file list page (#​35911)
  • Introduce "config edit-ini" sub command to help maintaining INI config file (#​35735)
  • Add button to re-run failed jobs in Actions (#​36924)
  • Support actions and reusable workflows from private repos (#​32562)
  • Add summary to action runs view (#​36883)
  • Add user badges (#​36752)
  • Add configurable permissions for Actions automatic tokens (#​36173)
  • Add per-runner "Disable/Pause" (#​36776)
  • Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#​36786)
• PERFORMANCE
  • WorkflowDispatch API optionally return runid (#​36706)
  • Add render cache for SVG icons (#​36863)
  • Load mentionValues asynchronously (#​36739)
  • Lazy-load some Vue components, fix heatmap chunk loading on every page (#​36719)
  • Load heatmap data asynchronously (#​36622)
  • Use prev/next pagination for user profile activities page to speed up (#​36642)
  • Refactor cat-file batch operations and support --batch-command approach (#​35775)
  • Use merge tree to detect conflicts when possible (#​36400)
• ENHANCEMENTS
  • Implement logout redirection for reverse proxy auth setups (#​36085) (#​37171)
  • Adds option to force update new branch in contents routes (#​35592)
  • Add viewer controller for mermaid (zoom, drag) (#​36557)
  • Add code editor setting dropdowns (#​36534)
  • Add elk layout support to mermaid (#​36486)
  • Add resolve/unresolve review comment API endpoints (#​36441)
  • Allow configuring default PR base branch (fixes #​36412) (#​36425)
  • Add support for RPM Errata (updateinfo.xml) (#​37125)
  • Require additional user confirmation for making repo private (#​36959)
  • Add actions.WORKFLOW_DIRS setting (#​36619)
  • Avoid opening new tab when downloading actions logs (#​36740)
  • Implements OIDC RP-Initiated Logout (#​36724)
  • Show workflow link (#​37070)
  • Desaturate dark theme background colors (#​37056)
  • Refactor "org teams" page and help new users to "add member" to an org (#​37051)
  • Add webhook name field to improve webhook identification (#​37025) (#​37040)
  • Make task list checkboxes clickable in the preview tab (#​37010)
  • Improve severity labels in Actions logs and tweak colors (#​36993)
  • Linkify URLs in Actions workflow logs (#​36986)
  • Allow text selection on checkbox labels (#​36970)
  • Support dark/light theme images in markdown (#​36922)
  • Enable native dark mode for swagger-ui (#​36899)
  • Rework checkbox styling, remove input border hover effect (#​36870)
  • Refactor storage content-type handling of ServeDirectURL (#​36804)
  • Use "Enable Gravatar" but not "Disable" (#​36771)
  • Use case-insensitive matching for Git error "Not a valid object name" (#​36728)
  • Add "Copy Source" to markup comment menu (#​36726)
  • Change image transparency grid to CSS (#​36711)
  • Add "Run" prefix for unnamed action steps (#​36624)
  • Persist actions log time display settings in localStorage (#​36623)
  • Use first commit title for multi-commit PRs and fix auto-focus title field (#​36606)
  • Improve BuildCaseInsensitiveLike with lowercase (#​36598)
  • Improve diff highlighting (#​36583)
  • Exclude cancelled runs from failure-only email notifications (#​36569)
  • Use full-file highlighting for diff sections (#​36561)
  • Color command/error logs in Actions log (#​36538)
  • Add paging headers (#​36521)
  • Improve timeline entries for WIP prefix changes in pull requests (#​36518)
  • Add FOLDER_ICON_THEME configuration option (#​36496)
  • Normalize guessed languages for code highlighting (#​36450)
  • Add chunked transfer encoding support for LFS uploads (#​36380)
  • Indicate when only optional checks failed (#​36367)
  • Add 'allow_maintainer_edit' API option for creating a pull request (#​36283)
  • Support closing keywords with URL references (#​36221)
  • Improve diff file headers (#​36215)
  • Fix and enhance comment editor monospace toggle (#​36181)
  • Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#​36164)
  • Add matching pair insertion to markdown textarea (#​36121)
  • Add sorting/filtering to admin user search API endpoint (#​36112)
  • Allow action user have read permission in public repo like other user (#​36095)
  • Disable matchBrackets in monaco (#​36089)
  • Use GitHub-style commit message for squash merge (#​35987)
  • Make composer registry support tar.gz and tar.bz2 and fix bugs (#​35958)
  • Add GITEA_PR_INDEX env variable to githooks (#​35938)
  • Add proper error message if session provider can not be created (#​35520)
  • Add button to copy file name in PR files (#​35509)
  • Move X_FRAME_OPTIONS setting from cors to security section (#​30256)
  • Add placeholder content for empty content page (#​37114)
  • Add DEFAULT_DELETE_BRANCH_AFTER_MERGE setting (#​36917)
  • Redirect to the only OAuth2 provider when no other login methods and fix various problems (#​36901)
  • Add admin badge to navbar avatar (#​36790)
  • Add never option to PUBLIC_URL_DETECTION configuration (#​36785)
  • Add background and run count to actions list page (#​36707)
  • Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#​36654)
  • Add support for in_progress event in workflow_run webhook (#​36979)
  • Report commit status for pull_request_review events (#​36589)
  • Render merged pull request title as such in dashboard feed (#​36479)
  • Feature to be able to filter project boards by milestones (#​36321)
  • Use user id in noreply emails (#​36550)
  • Enable pagination on GiteaDownloader.getIssueReactions() (#​36549)
  • Remove striped tables in UI (#​36509)
  • Improve control char rendering and escape button styling (#​37094)
  • Support legacy run/job index-based URLs and refactor migration 326 (#​37008)
  • Add date to "No Contributions" tooltip (#​36190)
  • Show edit page confirmation dialog on tree view file change (#​36130)
  • Mention proc-receive in text for dashboard.resync_all_hooks func (#​35991)
  • Reuse selectable style for wiki (#​35990)
  • Support blue yellow colorblind theme (#​35910)
  • Support selecting theme on the footer (#​35741)
  • Improve online runner check (#​35722)
  • Add quick approve button on PR page (#​35678)
  • Enable commenting on expanded lines in PR diffs (#​35662)
  • Print PR-Title into tooltip for actions (#​35579)
  • Use explicit, stronger defaults for newly generated repo signing keys for Debian (#​36236)
  • Improve the compare page (#​36261)
  • Unify repo names in system notices (#​36491)
  • Move package settings to package instead of being tied to version (#​37026)
  • Add Actions API rerun endpoints for runs and jobs (#​36768)
  • Add branch_count to repository API (#​35351) (#​36743)
  • Add created_by filter to SearchIssues (#​36670)
  • Allow admins to rename non-local users (#​35970)
  • Support updating branch via API (#​35951)
  • Add an option to automatically verify SSH keys from LDAP (#​35927)
  • Make "update file" API can create a new file when SHA is not set (#​35738)
  • Update issue.go with labels documentation (labels content, not ids) (#​35522)
  • Expose content_version for optimistic locking on issue and PR edits (#​37035)
  • Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#​36982)
• BUGFIXES
  • Frontend iframe renderer framework: 3D models, OpenAPI (#​37233) (#​37273)
  • Fix CODEOWNERS absolute path matching. (#​37244) (#​37264)
  • Swift registry metadata: preserve more JSON fields and accept empty metadata (#​37254) (#​37261)
  • Fix user ssh key exporting and tests (#​37256) (#​37258)
  • Fix team member avatar size and add tooltip (#​37253)
  • Fix commit title rendering in action run and blame (#​37243) (#​37251)
  • Fix corrupted JSON caused by goccy library (#​37214) (#​37220)
  • Add test for "fetch redirect", add CSS value validation for external render (#​37207) (#​37216)
  • Fix incorrect concurrency check (#​37205) (#​37215)
  • Fix handle missing base branch in PR commits API (#​37193) (#​37203)
  • Fix encoding for Matrix Webhooks (#​37190) (#​37201)
  • Fix handle fork-only commits in compare API (#​37185) (#​37199)
  • Indicate form field readonly via background, fix RunUser config (#​37175, #​37180) (#​37178)
  • Report structurally invalid workflows to users (#​37116) (#​37164)
  • Fix API not persisting pull request unit config when has_pull_requests is not set (#​36718)
  • Rename CSS variables and improve colorblind themes (#​36353)
  • Hide add-matcher and remove-matcher from actions job logs (#​36520)
  • Prevent navigation keys from triggering actions during IME composition (#​36540)
  • Fix vertical alignment of .commit-sign-badge children (#​36570)
  • Fix duplicate startup warnings in admin panel (#​36641)
  • Fix CODEOWNERS review request attribution using comment metadata (#​36348)
  • Fix HTML tags appearing in wiki table of contents (#​36284)
  • Fix various bugs (#​37096)
  • Fix various legacy problems (#​37092)
  • Fix RPM Registry 404 when package name contains 'package' (#​37087)
  • Merge some standalone Vite entries into index.js (#​37085)
  • Fix various problems (#​37077)
  • Fix issue label deletion with Actions tokens (#​37013)
  • Hide delete branch or tag buttons in mirror or archived repositories. (#​37006)
  • Fix org contact email not clearable once set (#​36975)
  • Fix a bug when forking a repository in an organization (#​36950)
  • Preserve sort order of exclusive labels from template repo (#​36931)
  • Make container registry support Apple Container (basic auth) (#​36920)
  • Fix the wrong push commits in the pull request when force push (#​36914)
  • Add class "list-header-filters" to the div for projects (#​36889)
  • Fix dbfs error handling (#​36844)
  • Fix incorrect viewed files counter if reverted change was viewed (#​36819)
  • Refactor avatar package, support default avatar fallback (#​36788)
  • Fix README symlink resolution in subdirectories like .github (#​36775)
  • Fix CSS stacking context issue in actions log (#​36749)
  • Add gpg signing for merge rebase and update by rebase (#​36701)
  • Delete non-exist branch should return 404 (#​36694)
  • Fix TestActionsCollaborativeOwner (#​36657)
  • Fix multi-arch Docker build SIGILL by splitting frontend stage (#​36646)
  • Fix linguist-detectable attribute being ignored for configuration files (#​36640)
  • Fix state desync in ComboMarkdownEditor (#​36625)
  • Unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#​36597)
  • Pull Request Pusher should be the author of the merge (#​36581)
  • Fix various version parsing problems (#​36553)
  • Fix highlight diff result (#​36539)
  • Fix mirror sync parser and fix mirror messages (#​36504)
  • Fix bug when list pull request commits (#​36485)
  • Fix various bugs (#​36446)
  • Fix issue filter menu layout (#​36426)
  • Restrict branch naming when new change matches with protection rules (#​36405)
  • Fix link/origin referrer and login redirect (#​36279)
  • Generate IDs for HTML headings without id attribute (#​36233)
  • Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#​36160)
  • Fix issue close timeline icon (#​36138)
  • Fix diff blob excerpt expansion (#​35922)
  • Fix external render (#​35727)
  • Fix review request webhook bug (#​35339) (#​35723)
  • Fix shutdown waitgroup panic (#​35676)
  • Cleanup ActionRun creation (#​35624)
  • Fix possible bug when migrating issues/pull requests (#​33487)
  • Various fixes (#​36697)
  • Apply notify/register mail flags during install load (#​37120)
  • Repair duration display for bad stopped timestamps (#​37121)
  • Fix(upgrade.sh): use HTTPS for GPG key import and restore SELinux context after upgrade (#​36930)
  • Fix various trivial problems (#​36921)
  • Fix various trivial problems (#​36953)
  • Fix NuGet package upload error handling (#​37074)
  • Fix CodeQL code scanning alerts (#​36858)
  • Refactor issue sidebar and fix various problems (#​37045)
  • Fix various problems (#​37029)
  • Fix relative-time RangeError (#​37021)
  • Fix chroma lexer mapping (#​36629)
  • Fix typos and grammar in English locale (#​36751)
  • Fix milestone/project text overflow in issue sidebar (#​36741)
  • Fix no-content message not rendering after comment edit (#​36733)
  • Fix theme loading in development (#​36605)
  • Fix workflow run jobs API returning null steps (#​36603)
  • Fix timeline event layout overflow with long content (#​36595)
  • Fix minor UI issues in runner edit page (#​36590)
  • Fix incorrect vendored detections (#​36508)
  • Fix editorconfig not respected in PR Conversation view (#​36492)
  • Don't create self-references in merged PRs (#​36490)
  • Fix potential incorrect runID in run status update (#​36437)
  • Fix file-tree ui error when adding files to repo without commits (#​36312)
  • Improve image captcha contrast for dark mode (#​36265)
  • Fix panic in blame view when a file has only a single commit (#​36230)
  • Fix spelling error in migrate-storage cmd utility (#​36226)
  • Fix code highlighting on blame page (#​36157)
  • Fix nilnil in onedev downloader (#​36154)
  • Fix actions lint (#​36029)
  • Fix oauth2 session gob register (#​36017)
  • Fix Arch repo pacman.conf snippet (#​35825)
  • Fix a number of strictNullChecks-related issues (#​35795)
  • Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (#​36861)
  • Hide delete directory button for mirror or archive repository and disable the menu item if user have no permission (#​36384)
  • Update message severity colors, fix navbar double border (#​37019)
  • Inline and lazy-load EasyMDE CSS, fix border colors (#​36714)
  • Closed milestones with no issues now show as 100% completed (#​36220)
  • Add test for ExtendCommentTreePathLength migration and fix bugs (#​35791)
  • Only turn links to current instance into hash links (#​36237)
  • Fix typos in code comments: doesnt, dont, wont (#​36890)
• REFACTOR
  • Clean up and improve non-gitea js error filter (#​37148) (#​37155)
  • Always show owner/repo name in compare page dropdowns (#​37172) (#​37200)
  • Remove dead CSS rules (#​37173) (#​37177)
  • Replace Monaco with CodeMirror (#​36764)
  • Replace CSRF cookie with CrossOriginProtection (#​36183)
  • Replace index with id in actions routes (#​36842)
  • Remove unnecessary function parameter (#​35765)
  • Move jobparser from act repository to Gitea (#​36699)
  • Refactor compare router param parse (#​36105)
  • Optimize 'refreshAccesses' to perform update without removing then adding (#​35702)
  • Clean up checkbox cursor styles (#​37016)
  • Remove undocumented support of signing key in the repository git configuration file (#​36143)
  • Switch cmd/ to use constructor functions. (#​36962)
  • Use relative-time to render absolute dates (#​36238)
  • Some refactors about GetMergeBase (#​36186)
  • Some small refactors (#​36163)
  • Use gitRepo as parameter instead of repopath when invoking sign functions (#​36162)
  • Move blame to gitrepo (#​36161)
  • Move some functions to gitrepo package to reduce RepoPath reference directly (#​36126)
  • Use gitrepo's clone and push when possible (#​36093)
  • Remove mermaid margin workaround (#​35732)
  • Move some functions to gitrepo package (#​35543)
  • Move GetDiverging functions to gitrepo (#​35524)
  • Use global lock instead of status pool for cron lock (#​35507)
  • Use explicit mux instead of DefaultServeMux (#​36276)
  • Use gitrepo's push function (#​36245)
  • Pass request context to generateAdditionalHeadersForIssue (#​36274)
  • Move assign project when creating pull request to the same database transaction (#​36244)
  • Move catfile batch to a sub package of git module (#​36232)
  • Use gitrepo.Repository instead of wikipath (#​35398)
  • Use experimental go json v2 library (#​35392)
  • Refactor template render (#​36438)
  • Refactor GetRepoRawDiffForFile to avoid unnecessary pipe or goroutine (#​36434)
  • Refactor text utility classes to Tailwind CSS (#​36703)
  • Refactor git command stdio pipe (#​36422)
  • Refactor git command context & pipeline (#​36406)
  • Refactor git command stdio pipe (#​36393)
  • Remove unused functions (#​36672)
  • Refactor Actions Token Access (#​35688)
  • Move commit related functions to gitrepo package (#​35600)
  • Move archive function to repo_model and gitrepo (#​35514)
  • Move some functions to gitrepo package (#​35503)
  • Use git model to detect whether branch exist instead of gitrepo method (#​35459)
  • Some refactor for repo path (#​36251)
  • Extract helper functions from SearchIssues (#​36158)
  • Refactor merge conan and container auth preserve actions taskID (#​36560)
  • Refactor Nuget Auth to reuse Basic Auth Token Validation (#​36558)
  • Refactor ActionsTaskID (#​36503)
  • Refactor auth middleware (#​36848)
  • Refactor code render and render control chars (#​37078)
  • Clean up AppURL, remove legacy origin-url webcomponent (#​37090)
  • Remove util.URLJoin and replace all callers with direct path concatenation (#​36867)
  • Replace legacy tw-flex utility classes with flex-text-block/inline (#​36778)
  • Mark unused&immature activitypub as "not implemented" (#​36789)
• TESTING
  • Add e2e tests for server push events (#​36879)
  • Rework e2e tests (#​36634)
  • Add e2e reaction test, improve accessibility, enable parallel testing (#​37081)
  • Increase e2e test timeouts on CI to fix flaky tests (#​37053)
• BUILD
  • Upgrade go-git to v5.18.0 (#​37269)
  • Replace rollup-plugin-license with rolldown-license-plugin (#​37130) (#​37158)
  • Bump min go version to 1.26.2 (#​37139) (#​37143)
  • Convert locale files from ini to json format (#​35489)
  • Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#​36180)
  • Port away from flake-utils (#​35675)
  • Remove nolint (#​36252)
  • Update the Unlicense copy to latest version (#​36636)
  • Update to go 1.26.0 and golangci-lint 2.9.0 (#​36588)
  • Replace google/go-licenses with custom generation (#​36575)
  • Update go dependencies (#​36548)
  • Bump appleboy/git-push-action from 1.0.0 to 1.2.0 (#​36306)
  • Remove fomantic form module (#​36222)
  • Bump setup-node to v6, re-enable cache (#​36207)
  • Bump crowdin/github-action from 1 to 2 (#​36204)
  • Revert "Bump alpine to 3.23 (#​36185)" (#​36202)
  • Update chroma to v2.21.1 (#​36201)
  • Bump astral-sh/setup-uv from 6 to 7 (#​36198)
  • Bump docker/build-push-action from 5 to 6 (#​36197)
  • Bump aws-actions/configure-aws-credentials from 4 to 5 (#​36196)
  • Bump dev-hanz-ops/install-gh-cli-action from 0.1.0 to 0.2.1 (#​36195)
  • Add JSON linting (#​36192)
  • Enable dependabot for actions (#​36191)
  • Bump alpine to 3.23 (#​36185)
  • Update chroma to v2.21.0 (#​36171)
  • Update JS deps and eslint enhancements (#​36147)
  • Update JS deps (#​36091)
  • update golangci-lint to v2.7.0 (#​36079)
  • Update JS deps, fix deprecations (#​36040)
  • Update JS deps (#​35978)
  • Add toolchain directive to go.mod (#​35901)
  • Move gitea-vet to use go tool (#​35878)
  • Update to go 1.25.4 (#​35877)
  • Enable TypeScript strictNullChecks (#​35843)
  • Enable vue/require-typed-ref eslint rule (#​35764)
  • Update JS dependencies (#​35759)
  • Move codeformat folder to tools (#​35758)
  • Update dependencies (#​35733)
  • Bump happy-dom from 20.0.0 to 20.0.2 (#​35677)
  • Bump setup-go to v6 (#​35660)
  • Update JS deps, misc tweaks (#​35643)
  • Bump happy-dom from 19.0.2 to 20.0.0 (#​35625)
  • Use bundled version of spectral (#​35573)
  • Update JS and PY deps (#​35565)
  • Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#​35557)
  • Migrate from webpack to vite (#​37002)
  • Update JS dependencies and misc tweaks (#​37064)
  • Update to eslint 10 (#​36925)
  • Optimize Docker build with dependency layer caching (#​36864)
  • Update JS deps (#​36850)
  • Update tool dependencies and fix new lint issues (#​36702)
  • Remove redundant linter rules (#​36658)
  • Move Fomantic dropdown CSS to custom module (#​36530)
  • Remove and forbid @ts-expect-error (#​36513)
  • Refactor git command stderr handling (#​36402)
  • Enable gocheckcompilerdirectives linter (#​36156)
  • Replace lint-go-gopls with additional govet linters (#​36028)
  • Update golangci-lint to v2.6.0 (#​35801)
  • Misc tool tweaks (#​35734)
  • Add cache to container build (#​35697)
  • Upgrade vite (#​37126)
  • Update setup-uv to v8.0.0 (#​37101)
  • Upgrade go-git to v5.17.2 and related dependencies (#​37060)
  • Raise minimum Node.js version to 22.18.0 (#​37058)
  • Upgrade golang.org/x/image to v0.38.0 (#​37054)
  • Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#​36876)
  • Enable eslint concurrency (#​36878)
  • Vendor relative-time-element as local web component (#​36853)
  • Update material-icon-theme v5.32.0 (#​36832)
  • Update Go dependencies (#​36781)
  • Upgrade minimatch (#​36760)
  • Remove i18n backport tool at the moment because of translation format changed (#​36643)
  • Update emoji data for Unicode 16 (#​36596)
  • Update JS dependencies, adjust webpack config, misc fixes (#​36431)
  • Update material-icon-theme to v5.31.0 (#​36427)
  • Update JS and PY deps (#​36383)
  • Bump alpine to 3.23, add platforms to docker-dryrun (#​36379)
  • Update JS deps (#​36354)
  • Update goldmark to v1.7.16 (#​36343)
  • Update chroma to v2.22.0 (#​36342)
• DOCS
  • Update AI Contribution Policy (#​37022)
  • Update AGENTS.md with additional guidelines (#​37018)
  • Add missing cron tasks to example ini (#​37012)
  • Add AI Contribution Policy to CONTRIBUTING.md (#​36651)
  • Minor punctuation improvement in CONTRIBUTING.md (#​36291)
  • Add documentation for markdown anchor post-processing (#​36443)
• MISC
  • Correct spelling (#​36783)
  • Update Nix flake (#​37110)
  • Update Nix flake (#​37024)
  • Add valid github scopes (#​36977)
  • Update Nix flake (#​36943)
  • Update Nix flake (#​36902)
  • Update Nix flake (#​36857)
  • Update Nix flake (#​36787)

v1.25.5

Compare Source

• SECURITY
  • Toolchain Update to Go 1.25.6 (#​36480) (#​36487)
  • Adjust the toolchain version (#​36537) (#​36542)
  • Update toolchain to 1.25.8 for v1.25 (#​36888)
  • Prevent redirect bypasses via backslash-encoded paths (#​36660) (#​36716)
  • Fix get release draft permission check (#​36659) (#​36715)
  • Fix a bug user could change another user's primary email (#​36586) (#​36607)
  • Fix OAuth2 authorization code expiry and reuse handling (#​36797) (#​36851)
  • Add validation constraints for repository creation fields (#​36671) (#​36757)
  • Fix bug to check whether user can update pull request branch or rebase branch (#​36465) (#​36838)
  • Add migration http transport for push/sync mirror lfs (#​36665) (#​36691)
  • Fix track time list permission check (#​36662) (#​36744)
  • Fix track time issue id (#​36664) (#​36689)
  • Fix path resolving (#​36734) (#​36746)
  • Fix dump release

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.