Gitea

Recent Commits

• fwag (18 Jun 26)

  fix: Fix issue target branch selection for non-collaborators (#36916) This PR fixes a bug in the UI that prevented non-collaborator users (the issue poster or creator) from setting the target branch (ref) of an issue. The backend API already supports this, but the UI was rigidly disabling the dropdown based only on collaborator status. Changes: - Enable the branch selector for the issue poster and during new issue creation. - Fix a typo (.IsIssueWriter -> .IsIssuePoster) that was preventing the reference update URL from being correctly set for posters.

• silverwind (18 Jun 26)

  refactor: replace legacy `delete-button` with `link-action` (#38143) Removes the legacy `delete-button` handler (`initGlobalDeleteButton`) and migrates all remaining usages to `link-action` and `show-modal` / `form-fetch-action`. Two handlers are adjusted for the new request shape: webauthn key delete reads `id` from the query, and account deletion returns `JSONError` on validation failure. A E2E test ist added to cover one of the use cases. Suggested in https://github.com/go-gitea/gitea/pull/38046#discussion_r3414936737. --------- Co-authored-by: wxiaoguang <[email protected]> Co-authored-by: bircni <[email protected]>

• Lunny Xiao (18 Jun 26)

  fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) Fix #38016

• bircni (17 Jun 26)

  perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076) Adds `created_unix` as the third column of the `c_u` composite index on the `action` table, changing it from `(user_id, is_deleted)` to `(user_id, is_deleted, created_unix)`. Migration 337 drops and recreates the index. No data is touched. ## Root causes #32333 introduced the `c_u` index to speed up dashboard queries, but defined it as `(user_id, is_deleted)` — without `created_unix`. #3368 The simple query is now efficient enough for the database to actually use `c_u`, but because `created_unix` is absent from the index, the database must load and sort **every** matching row before returning the first page of 20. The existing `c_u_d` index `(created_unix, user_id, is_deleted)` does not help because its leading column is `created_unix`, which can't be used for an equality seek on `user_id`. Those two caused this issue: https://github.com/go-gitea/gitea/issues/38075 With the fix, the database seeks directly to `(user_id=X, is_deleted=false)` and walks `created_unix` in descending order, stopping after 20 rows. Fixes https://github.com/go-gitea/gitea/issues/38075

• bircni (17 Jun 26)

  fix: Various security fixes (#38103) - Enforce org visibility on organization label read endpoints (private org labels no longer leak to non-members). - Block fork sync (`merge-upstream`) when the base repo is no longer readable (stops pulling commits after a parent goes private). - Remove `REVERSE_PROXY_LIMIT` / `REVERSE_PROXY_TRUSTED_PROXIES` from the Docker `app.ini` templates (the `= *` default allowed `X-WEBAUTH-USER` impersonation; reverse-proxy auth is now opt-in and admin-configured). - Enforce single-use TOTP passcodes across web login, password-reset, and Basic-Auth `X-Gitea-OTP` (fixes a TOCTOU race and a stateless replay). - Re-check branch write permission for every ref in a push (the pre-receive hook cached the first ref's result, letting a per-branch maintainer-edit grant escalate to full repo write). --------- Co-authored-by: wxiaoguang <[email protected]>

• bircni (17 Jun 26)

  docs: add development setup guide (#37960) Moves the "Hacking on Gitea" page out of the documentation website and into the repository as `docs/development.md`, so contributors find build and test instructions next to the code. The content has been cleaned up and corrected for in-repo use. --------- Signed-off-by: bircni <[email protected]> Co-authored-by: wxiaoguang <[email protected]> Co-authored-by: Lunny Xiao <[email protected]>

• bircni (17 Jun 26)

  fix: Various sec fixes 2 (#38108) - Enforce repository token scope on RSS/Atom feed endpoints so a PAT without repo scope can no longer read private repo commit data. - Block HTTP redirects during repository migration clones to prevent SSRF reaching internal addresses via an attacker-controlled redirect. - Redact the notification subject after repo access is revoked so private issue/PR metadata is no longer leaked through the notification API. --------- Co-authored-by: Lunny Xiao <[email protected]>

• GiteaBot (17 Jun 26)

  [skip ci] Updated translations via Crowdin

• Lunny Xiao (16 Jun 26)

  fix(mssql): expand legacy issue and comment long-text columns (#38120) ## Summary This fixes pull request creation failures on upgraded MSSQL instances where legacy `issue` and `comment` long-text columns are still limited to `nvarchar(4000)`. When a PR is created, Gitea stores a pull request push timeline comment containing JSON with `commit_ids`. For PRs with many commits, that payload can exceed 4000 characters and MSSQL rejects the insert with: > String or binary data would be truncated in table 'comment', column 'content' This change adds a migration that expands the affected legacy MSSQL columns to `NVARCHAR(MAX)`. The previous migration in models/migrations/v1_16/v191.go only applies to MySQL, not MSSQL. migration now skips columns already using NVARCHAR(MAX) / VARCHAR(MAX) Closes #37893 ## Changes - add migration `338` for MSSQL-only long-text expansion - expand: - `issue.content` - `comment.content` - `comment.patch` - add an MSSQL regression test that starts from a legacy `VARCHAR(4000)` schema and verifies inserts larger than 4000 characters succeed after migration ## Why this approach The current model already declares these fields as `LONGTEXT`, so the bug is caused by stale upgraded MSSQL schemas rather than by PR creation logic itself. Fixing the schema is the smallest and safest change, and also prevents similar truncation issues for other long issue/comment content.

• Giteabot (16 Jun 26)

  fix(deps): update npm dependencies (#38137) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`25.9.2` → `25.9.3`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.2/25.9.3) |  |  | | [vue](https://vuejs.org/) ([source](https://redirect.github.com/vuejs/core)) | [`3.5.35` → `3.5.37`](https://renovatebot.com/diffs/npm/vue/3.5.35/3.5.37) |  |  | --- ### Release Notes <details> <summary>vuejs/core (vue)</summary> ### [`v3.5.37`](https://redirect.github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3537-2026-06-11) [Compare Source](https://redirect.github.com/vuejs/core/compare/v3.5.36...v3.5.37) ### [`v3.5.36`](https://redirect.github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3536-2026-06-11) [Compare Source](https://redirect.github.com/vuejs/core/compare/v3.5.35...v3.5.36) ##### Bug Fixes - **compiler-core:** avoid crash on CDATA at the document root ([#&#8203;14916](https://redirect.github.com/vuejs/core/issues/14916)) ([0ea17e2](https://redirect.github.com/vuejs/core/commit/0ea17e232f9a8f4a9acf57c6addc78cf4f279c13)) - **compiler-core:** prefix dynamic keys on v-memo elements ([#&#8203;14922](https://redirect.github.com/vuejs/core/issues/14922)) ([68e978e](https://redirect.github.com/vuejs/core/commit/68e978e3e71a8ae40701808e78966f2168c5907c)), closes [#&#8203;14920](https://redirect.github.com/vuejs/core/issues/14920) - **compiler-sfc:** handle vue-ignore on leading intersection/union type ([#&#8203;14950](https://redirect.github.com/vuejs/core/issues/14950)) ([0dcd225](https://redirect.github.com/vuejs/core/commit/0dcd225c01f211ebb8ce4dda8c8eac10539abf1a)), closes [#&#8203;12254](https://redirect.github.com/vuejs/core/issues/12254) - **compiler-sfc:** respect var hoisting in props destructure ([48ad452](https://redirect.github.com/vuejs/core/commit/48ad452dd61926a59e358da3c74c5ef750ae21c4)) - **reactivity:** preserve watch callback return value when wrapped for `once: true` ([#&#8203;14902](https://redirect.github.com/vuejs/core/issues/14902)) ([450a8a8](https://redirect.github.com/vuejs/core/commit/450a8a8e45520f30fe8343c5016a777d888e53fc)) - **runtime-core:** add dev warning for silent catch in compat mode and fix test description typo ([#&#8203;14891](https://redirect.github.com/vuejs/core/issues/14891)) ([db3e117](https://redirect.github.com/vuejs/core/commit/db3e117025a7193291ed6676180a5a44bbe0ae76)) - **runtime-core:** force model update when reverted before sync ([#&#8203;14897](https://redirect.github.com/vuejs/core/issues/14897)) ([7f76378](https://redirect.github.com/vuejs/core/commit/7f76378b0d178a29113ee07d67faa48b637944e8)), closes [#&#8203;13524](https://redirect.github.com/vuejs/core/issues/13524) - **runtime-core:** skip async component callbacks after unmount ([#&#8203;14911](https://redirect.github.com/vuejs/core/issues/14911)) ([5300ead](https://redirect.github.com/vuejs/core/commit/5300ead57b3c14942d4c155ef5e485d5409e7f02)) - **transition:** avoid move transition for hidden v-show group children ([#&#8203;14895](https://redirect.github.com/vuejs/core/issues/14895)) ([c11f6ee](https://redirect.github.com/vuejs/core/commit/c11f6ee644412edf3eef6736991e895e4a3e1dde)), closes [#&#8203;14894](https://redirect.github.com/vuejs/core/issues/14894) - **watch:** trigger immediate callback for empty sources ([#&#8203;14914](https://redirect.github.com/vuejs/core/issues/14914)) ([1f2ca7e](https://redirect.github.com/vuejs/core/commit/1f2ca7e4837b1b0de0b91048fffdb03710c0b03e)), closes [#&#8203;14898](https://redirect.github.com/vuejs/core/issues/14898) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

• Lunny Xiao (16 Jun 26)

  ci: trigger giteabot maintenance on main pushes (#38135)

• GiteaBot (16 Jun 26)

  [skip ci] Updated translations via Crowdin

• Giteabot (15 Jun 26)

  chore(deps): update module github.com/go-swagger/go-swagger to v0.34.1 (#38122) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-swagger/go-swagger](https://redirect.github.com/go-swagger/go-swagger) | `v0.34.0` → `v0.34.1` |  |  | --- ### Release Notes <details> <summary>go-swagger/go-swagger (github.com/go-swagger/go-swagger)</summary> ### [`v0.34.1`](https://redirect.github.com/go-swagger/go-swagger/releases/tag/v0.34.1) [Compare Source](https://redirect.github.com/go-swagger/go-swagger/compare/v0.34.0...v0.34.1) go-swagger release 0.34.1 *** Released on 2026 Jun 05 ##### [0.34.1](https://redirect.github.com/go-swagger/go-swagger/tree/v0.34.1) - 2026-06-05 Fixed regression on initialisms (codegen) **Full Changelog**: <https://github.com/go-swagger/go-swagger/compare/v0.34.0...v0.34.1> 7 commits in this release. *** ##### <!-- 01 -->Fixed bugs - fix(codegen): fixed regression from v0.34.0 : initialisms skipped by [@&#8203;fredbi](https://redirect.github.com/fredbi) in [#&#8203;3360](https://redirect.github.com/go-swagger/go-swagger/pull/3360) [...](https://redirect.github.com/go-swagger/go-swagger/commit/e5c5fec88a5ad02a2ded264bbecd276b83340d12) ##### <!-- 07 -->Miscellaneous tasks - fix(ci): fixed release announcement to discord by [@&#8203;fredbi](https://redirect.github.com/fredbi) in [#&#8203;3354](https://redirect.github.com/go-swagger/go-swagger/pull/3354) [...](https://redirect.github.com/go-swagger/go-swagger/commit/d9244f53d41c79c3788867a4a031bea920cd418b) - ci: fixed event by [@&#8203;fredbi](https://redirect.github.com/fredbi) [...](https://redirect.github.com/go-swagger/go-swagger/commit/ba881e358085d4c4c004c5f61697d74f65390fa1) - ci: repair release by [@&#8203;fredbi](https://redirect.github.com/fredbi) in [#&#8203;3353](https://redirect.github.com/go-swagger/go-swagger/pull/3353) [...](https://redirect.github.com/go-swagger/go-swagger/commit/70b7c214ce3d9174956293f45f54d06ee3c4112f) ##### <!-- 0A -->Updates - chore(deps): bump the development-dependencies group with 3 updates by [@&#8203;dependabot\[bot\]](https://redirect.github.com/dependabot\[bot]) in [#&#8203;3359](https://redirect.github.com/go-swagger/go-swagger/pull/3359) [...](https://redirect.github.com/go-swagger/go-swagger/commit/65d6af084bb829d38bf53fc4d6cdc4a0cacec3ba) - chore(deps): bump golang from `91eda97` to `f23e8b2` in the development-dependencies group across 1 directory by [@&#8203;dependabot\[bot\]](https://redirect.github.com/dependabot\[bot]) in [#&#8203;3356](https://redirect.github.com/go-swagger/go-swagger/pull/3356) [...](https://redirect.github.com/go-swagger/go-swagger/commit/b1dfdf0c14f4de2d90b6de3b64619effcc82d67c) - chore(deps): bump the development-dependencies group with 2 updates by [@&#8203;dependabot\[bot\]](https://redirect.github.com/dependabot\[bot]) in [#&#8203;3355](https://redirect.github.com/go-swagger/go-swagger/pull/3355) [...](https://redirect.github.com/go-swagger/go-swagger/commit/340826c27f8ecd6d597d708505db83bf16033dcd) *** ##### People who contributed to this release - [@&#8203;fredbi](https://redirect.github.com/fredbi) *** **[go-swagger](https://redirect.github.com/go-swagger/go-swagger) license terms** [![License][license-badge]][license-url] [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg [license-url]: https://redirect.github.com/go-swagger/go-swagger/?tab=Apache-2.0-1-ov-file#readme *** Released by [GoReleaser](https://redirect.github.com/goreleaser/goreleaser). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: bircni <[email protected]>

• bircni (15 Jun 26)

  fix(pull): preserve squash message trailers and additional commit messages (#37954) * Closes #37950 * Closes #37946 * Fixes https://github.com/go-gitea/gitea/issues/37529 --------- Co-authored-by: wxiaoguang <[email protected]>

• metsw24-max (15 Jun 26)

  fix(packages): validate module version in goproxy ParsePackage (#38104) **Unvalidated version in goproxy ParsePackage** The module version is read straight from the zip directory path and never checked, so a crafted upload can leave a newline in it; `EnumeratePackageVersions` then writes each stored version on its own line for the `@v/list` endpoint, letting a module advertise fabricated versions to `go` clients. Validated the parsed version with `semver.IsValid` inside the parser, matching the version checks the other package parsers already do. Co-authored-by: Lunny Xiao <[email protected]>

• Rafail Giavrimis (15 Jun 26)

  feat: add raw diff/patch endpoint for repository comparisons (#37632) ## Summary Adds `GET /repos/{owner}/{repo}/compare/{basehead}.{diffType:diff|patch}`, mirroring the existing `/git/commits/{sha}.{diffType}` endpoint but for comparisons between two arbitrary refs. The new endpoint streams a raw unified diff or `git format-patch` output between any two refs: GET /repos/{owner}/{repo}/compare/main...feature.diff GET /repos/{owner}/{repo}/compare/v1.0..v1.1.patch GET /repos/{owner}/{repo}/compare/abc1234...def5678.diff Resolves #5561, #13416 and #17165. AI was used while creating this PR. Automated tests were added as per the contribution policy. --------- Co-authored-by: bircni <[email protected]> Co-authored-by: Claude Opus 4.8 <[email protected]>

• Giteabot (15 Jun 26)

  chore(deps): update pnpm to v11.5.3 (#38133) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`11.5.2` → `11.5.3`](https://renovatebot.com/diffs/npm/pnpm/11.5.2/11.5.3) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.5.3`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1153) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.2...v11.5.3) ##### Patch Changes - Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from `.npmrc`, and in workspace registry URLs from `pnpm-workspace.yaml`. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config. - Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution. - Avoid writing `packageManagerDependencies` to `pnpm-lock.yaml` when package manager policy is set to `onFail: ignore` or `pmOnFail: ignore` [#&#8203;12228](https://redirect.github.com/pnpm/pnpm/issues/12228). - Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest. - Using the `$` version reference syntax in `overrides` (e.g. `"react": "$react"`) now prints a deprecation warning. The syntax still works, but [catalogs](https://pnpm.io/catalogs) are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with the `catalog:` protocol instead. - Fixed `pnpm config get globalconfig` to return the global `config.yaml` path again [pnpm/pnpm#11962](https://redirect.github.com/pnpm/pnpm/issues/11962). - Fixed bare `--color` so it does not consume the following CLI flag, allowing command shorthands like `--parallel` to expand correctly and forms like `pnpm --color with current <command>` to dispatch the inner command instead of failing with `MISSING_WITH_CURRENT_CMD`. - Fix `pnpm install` ignoring `enableGlobalVirtualStore` toggle by including it in the workspace state settings check [#&#8203;12142](https://redirect.github.com/pnpm/pnpm/issues/12142). - Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary. This covers two paths that select an executable from repository-controlled input: - **pacquet install engine** — declaring `pacquet` (or `@pnpm/pacquet`) in `configDependencies` opts in to pnpm's Rust install engine. pnpm now verifies that the installed `pacquet` shim and the host's `@pacquet/<platform>-<arch>` binary carry a valid npm registry signature for their exact `name@version`, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform. - **automatic version switch / `self-update`** — the `packageManager` / `devEngines.packageManager` field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of `pnpm`, `@pnpm/exe`, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command. In both cases the signature is verified over the *installed* integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint. - Made peer-dependent deduplication deterministic. When a peer-suffixed package variant was a subset of two or more mutually incompatible larger variants, the variant it collapsed into depended on the order importers were resolved in, which varies between machines. This could resolve the same workspace to different lockfiles on different platforms and make `pnpm dedupe --check` alternate between passing and failing. - Reject invalid package names and versions from staged tarball manifests before deriving filenames for `pnpm stage download`. - Clarified in CLI help that the pnpm store is trusted shared state and store integrity checks are corruption detection, not a tamper boundary for untrusted store writers. - Reject reserved manifest `bin` names (`""`, `"."`, `".."`, and scoped forms such as `@scope/..`) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted. - Require trusted package identity before package-name `allowBuilds` entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the `allowBuilds` key. Lockfile verification now rejects lockfiles where a registry-style dependency path (`name@semver`) is backed by a git, directory, or git-hosted tarball resolution (`ERR_PNPM_RESOLUTION_SHAPE_MISMATCH`), so the dependency path is a reliable artifact identity by the time scripts can run. - Security: pnpm now verifies the OpenPGP signature of a downloaded Node.js runtime's `SHASUMS256.txt` before trusting its integrity hashes. When a repository requests a Node.js runtime (e.g. via `devEngines.runtime` / `useNodeVersion`), the download mirror is repository-configurable through `node-mirror:<channel>`. The integrity of the downloaded binary was only checked against `SHASUMS256.txt` fetched from that same mirror — a circular check that a malicious mirror could satisfy by serving a tampered binary together with a matching `SHASUMS256.txt`. pnpm then executes the binary (for example to run lifecycle scripts). pnpm now fetches `SHASUMS256.txt.sig` and verifies the detached OpenPGP signature against the Node.js release team's public keys, which ship embedded in the pnpm CLI. A mirror that serves a tampered binary cannot also produce a valid signature, so the download fails to verify. The embedded keys are kept current by a release-time check against the canonical `nodejs/release-keys` list. The musl variants from the hardcoded `unofficial-builds.nodejs.org` mirror are not repository-configurable and are signed by a different key, so they continue to be trusted over TLS. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: bircni <[email protected]>

• Giteabot (15 Jun 26)

  chore(deps): update action dependencies (#38121) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | redis | service | digest | `e74c9b9` → `a505f8b` | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | action | patch | `v46.1.14` → `v46.1.15` | --- ### Release Notes <details> <summary>renovatebot/github-action (renovatebot/github-action)</summary> ### [`v46.1.15`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.1.15) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.1.14...v46.1.15) ##### Documentation - update references to actions/checkout to v6.0.3 ([#&#8203;1033](https://redirect.github.com/renovatebot/github-action/issues/1033)) ([fb473e1](https://redirect.github.com/renovatebot/github-action/commit/fb473e186b4d3622f844c27052e93a8c5fda1717)) - update references to renovatebot/github-action to v46.1.14 ([34e09dd](https://redirect.github.com/renovatebot/github-action/commit/34e09dd76c34de1c47342613280a76eed7409e63)) ##### Miscellaneous Chores - **deps:** update linters to v8.60.0 ([1abcc51](https://redirect.github.com/renovatebot/github-action/commit/1abcc518dc56e8b8dc3679e53a454e8a06f06047)) - **deps:** update node.js to v24.16.0 ([7bbd8b1](https://redirect.github.com/renovatebot/github-action/commit/7bbd8b12ba39417da412895715d31c2304897b1c)) - **deps:** update pnpm to v10.34.1 ([fc48fa8](https://redirect.github.com/renovatebot/github-action/commit/fc48fa8e31dd5915d2cc35558846455f271630fe)) - **deps:** update semantic-release monorepo to v12.0.8 ([7ae9fb9](https://redirect.github.com/renovatebot/github-action/commit/7ae9fb9e94d999c8ba8b1371ffff0e5521f18f42)) ##### Build System - **deps:** lock file maintenance ([3e7e656](https://redirect.github.com/renovatebot/github-action/commit/3e7e6563b31485ac0fac48701c13e12737fec9ea)) ##### Continuous Integration - **deps:** update actions/checkout action to v6.0.3 ([bb87b51](https://redirect.github.com/renovatebot/github-action/commit/bb87b5131ab4a1fd5fad5b0b1a27995a99a89c61)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.171.3 ([f4736a8](https://redirect.github.com/renovatebot/github-action/commit/f4736a876f6e93d22501a6dbeebc3c79f15d954e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.173.0 ([4374486](https://redirect.github.com/renovatebot/github-action/commit/4374486206593aaf0106b4be898e4fa7dfffd670)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.214.5 ([3fbdafe](https://redirect.github.com/renovatebot/github-action/commit/3fbdafedb1c77e92a6c3a8560ab0c53aff06fad3)) - **deps:** update ghcr.io/zizmorcore/zizmor docker tag to v1.25.2 ([#&#8203;1034](https://redirect.github.com/renovatebot/github-action/issues/1034)) ([58252bc](https://redirect.github.com/renovatebot/github-action/commit/58252bce69198e9a1bdc863c40f3139fb1e6cb74)) - **deps:** update zizmorcore/zizmor-action action to v0.5.6 ([b8cc935](https://redirect.github.com/renovatebot/github-action/commit/b8cc935bc11c1ba8e6510fa2b9782919e6bb79f5)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: bircni <[email protected]>

• 6543 (15 Jun 26)

  docs: update missed gov docs update (#38131)

• Giteabot (15 Jun 26)

  fix(deps): update npm dependencies (#38123) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | @&#8203;codemirror/lint | [`6.9.6` → `6.9.7`](https://renovatebot.com/diffs/npm/@codemirror%2flint/6.9.6/6.9.7) |  |  | | @&#8203;codemirror/view | [`6.43.0` → `6.43.1`](https://renovatebot.com/diffs/npm/@codemirror%2fview/6.43.0/6.43.1) |  |  | | [@primer/octicons](https://primer.style/octicons) ([source](https://redirect.github.com/primer/octicons)) | [`19.28.0` → `19.28.1`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.28.0/19.28.1) |  |  | | [@types/jquery](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/jquery) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jquery)) | [`4.0.0` → `4.0.1`](https://renovatebot.com/diffs/npm/@types%2fjquery/4.0.0/4.0.1) |  |  | | [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`25.9.1` → `25.9.2`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.1/25.9.2) |  |  | | [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) | [`8.60.1` → `8.61.0`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.60.1/8.61.0) |  |  | | [@vitest/eslint-plugin](https://redirect.github.com/vitest-dev/eslint-plugin-vitest) | [`1.6.19` → `1.6.20`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.19/1.6.20) |  |  | | [happy-dom](https://redirect.github.com/capricorn86/happy-dom) | [`20.10.1` → `20.10.2`](https://renovatebot.com/diffs/npm/happy-dom/20.10.1/20.10.2) |  |  | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`11.5.1` → `11.5.2`](https://renovatebot.com/diffs/npm/pnpm/11.5.1/11.5.2) |  |  | | [stylelint](https://stylelint.io) ([source](https://redirect.github.com/stylelint/stylelint)) | [`17.12.0` → `17.13.0`](https://renovatebot.com/diffs/npm/stylelint/17.12.0/17.13.0) |  |  | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.60.1` → `8.61.0`](https://renovatebot.com/diffs/npm/typescript-eslint/8.60.1/8.61.0) |  |  | | [updates](https://redirect.github.com/silverwind/updates) | [`17.17.3` → `17.18.0`](https://renovatebot.com/diffs/npm/updates/17.17.3/17.18.0) |  |  | | [vue-tsc](https://redirect.github.com/vuejs/language-tools) ([source](https://redirect.github.com/vuejs/language-tools/tree/HEAD/packages/tsc)) | [`3.3.3` → `3.3.4`](https://renovatebot.com/diffs/npm/vue-tsc/3.3.3/3.3.4) |  |  | --- ### Release Notes <details> <summary>primer/octicons (@&#8203;primer/octicons)</summary> ### [`v19.28.1`](https://redirect.github.com/primer/octicons/blob/HEAD/CHANGELOG.md#19281) [Compare Source](https://redirect.github.com/primer/octicons/compare/v19.28.0...v19.28.1) ##### Patch Changes - [#&#8203;1215](https://redirect.github.com/primer/octicons/pull/1215) [`378d7af0`](https://redirect.github.com/primer/octicons/commit/378d7af0e343d23fb7df31202d21032bfca0d2c7) Thanks [@&#8203;ktravers](https://redirect.github.com/ktravers)! - Remove fill from StackRemove and StackCheck icons * [#&#8203;1221](https://redirect.github.com/primer/octicons/pull/1221) [`9d7b366a`](https://redirect.github.com/primer/octicons/commit/9d7b366a6ecfbbf8d632053a639b5400a3aecbb9) Thanks [@&#8203;CameronFoxly](https://redirect.github.com/CameronFoxly)! - Add stack-add-16.svg </details> <details> <summary>typescript-eslint/typescript-eslint (@&#8203;typescript-eslint/parser)</summary> ### [`v8.61.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8610-2026-06-08) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.60.1...v8.61.0) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>vitest-dev/eslint-plugin-vitest (@&#8203;vitest/eslint-plugin)</summary> ### [`v1.6.20`](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/releases/tag/v1.6.20) [Compare Source](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.19...v1.6.20) #####    🐞 Bug Fixes - **hoisted-apis-on-top**: Detect vitest.mock and aliased vi/vitest mock calls  -  by [@&#8203;spokodev](https://redirect.github.com/spokodev) in [#&#8203;909](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/issues/909) [<samp>(8fff9)</samp>](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/commit/8fff969) - **require-test-timeout**: Treat imported bindings as explicit timeouts  -  by [@&#8203;spokodev](https://redirect.github.com/spokodev) in [#&#8203;906](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/issues/906) [<samp>(bd82c)</samp>](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/commit/bd82c7d) - **valid-expect**: Treat .finally() as part of async assertion promise chains  -  by [@&#8203;spokodev](https://redirect.github.com/spokodev) in [#&#8203;908](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/issues/908) [<samp>(7c697)</samp>](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/commit/7c697f8) #####     [View changes on GitHub](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.19...v1.6.20) </details> <details> <summary>capricorn86/happy-dom (happy-dom)</summary> ### [`v20.10.2`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v20.10.2) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.10.1...v20.10.2) ##### :construction\_worker\_man: Patch fixes - Updates external dependencies - By **[@&#8203;capricorn86](https://redirect.github.com/capricorn86)** in task [#&#8203;2163](https://redirect.github.com/capricorn86/happy-dom/issues/2163) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.5.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1152) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.1...v11.5.2) ##### Patch Changes - Peer dependency resolution now reuses the peer contexts already recorded in the lockfile when those providers are still present in the dependency graph and still satisfy the peer ranges. This avoids unnecessary peer-context rewrites during lockfile regeneration. Current manifest choices remain authoritative: a newly added, explicitly updated, or aliased direct provider, a changed nested provider, or a locked version that no longer satisfies the range still takes precedence. - The lockfile verifier now checks that a registry entry pinning an explicit `tarball` URL points at the artifact the registry's own metadata lists for that `name@version`. Previously a tampered lockfile could pair a trusted `name@version` with an attacker-chosen tarball URL (and a matching integrity for those bytes), so the install fetched the attacker's bytes. A mismatch — or any entry that can't be confirmed against the registry — is rejected with `ERR_PNPM_TARBALL_URL_MISMATCH`. Non-registry resolutions (`file:`, git-hosted, etc.) and registry entries without an explicit tarball URL (the URL is reconstructed from name+version+registry, so it is inherently bound) are unaffected; non-standard registry tarball URLs (npm Enterprise, GitHub Packages) still pass because they match the metadata. - Fix `pnpm update --recursive --lockfile-only <pkg>@&#8203;<version>` crashing with `Invalid Version` when the catalog entry for `<pkg>` is a version range (e.g. `^21.2.10`) and `catalogMode` is `strict` or `prefer`. The catalog–version comparison now skips the equality check when either side is a range rather than passing a range to `semver.eq()`, so range specifiers fall through to the existing mismatch handling instead of throwing [#&#8203;11570](https://redirect.github.com/pnpm/pnpm/issues/11570). - Avoided a Node.js crash when pnpm exits after network requests on Windows. - Fixed packages being materialized into the virtual store without their root-level files (`package.json`, `LICENSE`, README, root entrypoints) when multiple `pnpm install` processes ran against the same store/workspace concurrently. The fast import path used to destructively empty the shared target directory, so a concurrent importer could wipe files another importer had already written; if the surviving files included the `package.json` completion marker, every later install treated the broken directory as complete and never repaired it. The fast path now imports directly only when it can create the target directory exclusively, and otherwise builds the package in a private temp directory and atomically renames it into place [#&#8203;12197](https://redirect.github.com/pnpm/pnpm/issues/12197). - Fix dependency build scripts not running under the global virtual store (`enableGlobalVirtualStore`). In a workspace install, dependency build scripts are deferred to a single `rebuild` pass (`buildProjects`). That pass resolved each package's location from the classic `node_modules/.pnpm/<depPathToFilename>` layout, which does not exist under the global virtual store — so native dependencies (e.g. packages using `node-gyp` / `prebuild-install`) were never built and failed to load at runtime (`Cannot find module .../build/Release/*.node`). `buildProjects` now resolves the global-virtual-store projection directory (`<storeDir>/links/<hash>`, computed with the same graph hash the installer uses) when `enableGlobalVirtualStore` is set, and serializes concurrent builds of the same shared projection so parallel workspace projects don't race on the same directory. - Don't promote a `runtime:` dependency (such as the Node.js version from `devEngines.runtime` or `pnpm runtime set`) into a catalog when `catalogMode` is `strict` or `prefer`. A `runtime:` dependency round-trips to `devEngines.runtime`, which only recognizes the `runtime:` protocol; cataloging it rewrote the manifest entry to `catalog:`, which broke that round-trip, stranded it in `devDependencies`, and left `devEngines.runtime` untouched. - Skip lockfile `minimumReleaseAge`/`trustPolicy` verification for non-registry tarball protocols (for example `file:`), so local tarball dependencies are not incorrectly checked against npm registry metadata. </details> <details> <summary>stylelint/stylelint (stylelint)</summary> ### [`v17.13.0`](https://redirect.github.com/stylelint/stylelint/blob/HEAD/CHANGELOG.md#17130---2026-06-06) [Compare Source](https://redirect.github.com/stylelint/stylelint/compare/17.12.0...17.13.0) It fixes 3 bugs, including a false negative one. - Fixed: `declaration-block-no-duplicate-properties` false negatives for interleaved non-consecutive duplicates with `ignore: ["consecutive-duplicates(-*)"]` ([#&#8203;9324](https://redirect.github.com/stylelint/stylelint/pull/9324)) ([@&#8203;sarathfrancis90](https://redirect.github.com/sarathfrancis90)). - Fixed: `selector-max-type` false positives for nested selectors ([#&#8203;9319](https://redirect.github.com/stylelint/stylelint/pull/9319)) ([@&#8203;romainmenke](https://redirect.github.com/romainmenke)). - Fixed: `selector-type-no-unknown` false positives for `install` ([#&#8203;9308](https://redirect.github.com/stylelint/stylelint/pull/9308)) ([@&#8203;Mouvedia](https://redirect.github.com/Mouvedia)). </details> <details> <summary>typescript-eslint/typescript-eslint (typescript-eslint)</summary> ### [`v8.61.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8610-2026-06-08) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.60.1...v8.61.0) This was a version bump only for typescript-eslint to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>silverwind/updates (updates)</summary> ### [`v17.18.0`](https://redirect.github.com/silverwind/updates/releases/tag/17.18.0) [Compare Source](https://redirect.github.com/silverwind/updates/compare/17.17.3...17.18.0) - Remove debug logging from test default route (silverwind) - update deps (silverwind) - fix a batch of correctness bugs across modes, parsing and CLI (silverwind) - Document make mode in modes list and package metadata (silverwind) - Support docker images in make mode (silverwind) - Add make mode for go tool versions in Makefiles (silverwind) - simplify control flow and drop redundant guards (silverwind) - fix a batch of correctness bugs in version resolution and parsing (silverwind) - skip redundant version filtering and replace-free go.mod scans (silverwind) - fix -t comma split, multiline toml strings, and prerelease ordering (silverwind) - make: collapse patch/minor/major into one rule (silverwind) - simplify matchesAny contract, toml parser, misc cleanups (silverwind) </details> <details> <summary>vuejs/language-tools (vue-tsc)</summary> ### [`v3.3.4`](https://redirect.github.com/vuejs/language-tools/blob/HEAD/CHANGELOG.md#334-2026-06-08) [Compare Source](https://redirect.github.com/vuejs/language-tools/compare/v3.3.3...v3.3.4) ##### language-core - **fix:** only exclude already-set props from inherited attrs when `checkRequiredFallthroughAttributes` is enabled ([#&#8203;6088](https://redirect.github.com/vuejs/language-tools/issues/6088)) - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)! - **fix:** camelize slot props regardless of `htmlAttributes` option ([#&#8203;6089](https://redirect.github.com/vuejs/language-tools/issues/6089)) - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)! - **fix:** detect duplicate event listeners across name formats ([#&#8203;6094](https://redirect.github.com/vuejs/language-tools/issues/6094)) - Thanks to [@&#8203;whysopaul](https://redirect.github.com/whysopaul)! ##### language-service - **fix:** respect var hoisting for destructured props hints ([#&#8203;6092](https://redirect.github.com/vuejs/language-tools/issues/6092)) - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)! ##### typescript-plugin - **fix:** do not treat `class` and `style` as a boolean property ([#&#8203;6081](https://redirect.github.com/vuejs/language-tools/issues/6081)) - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: bircni <[email protected]>

• Giteabot (15 Jun 26)

  chore(deps): update dependency djlint to v1.39.0 (#38124) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [djlint](https://redirect.github.com/djlint/djLint) | `==1.36.4` → `==1.39.0` |  |  | --- ### Release Notes <details> <summary>djlint/djLint (djlint)</summary> ### [`v1.39.0`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1390---2026-06-05) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.38.2...v1.39.0) ##### Feature - Add `preserve_class_newlines` / `--preserve-class-newlines` to keep authored line breaks inside multiline `class` attributes. ##### Fix - Fix Django 6.0 `{% partialdef %}` block indentation so `{% endpartialdef %}` aligns with its opener. - Preserve multiline Django/Jinja control-flow blocks instead of condensing short bodies onto one line. - Preserve single-line inline HTML and template tag bodies during expansion, even when they exceed `max_line_length`. ### [`v1.38.2`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1382---2026-06-05) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.38.1...v1.38.2) ##### Fix - Fix `python -m djlint` not working due to mypyc compilation. ### [`v1.38.1`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1381---2026-06-04) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.38.0...v1.38.1) ##### Fix - Match exclude paths on path boundaries. ### [`v1.38.0`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1380---2026-06-04) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.37.0...v1.38.0) ##### Feature - Add support for `.djlint.toml` project and global config files. ##### Fix - Preserve single-line inline HTML tag bodies when they fit within `max_line_length`. - Avoid evaluating template expressions while formatting tag contents. ##### Packaging - Fix npm publish workflow. ### [`v1.37.0`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1370---2026-06-04) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.36.4...v1.37.0) ##### Feature - Add `--format-attribute-js-json` for formatting JavaScript and JSON inside HTML attributes. It also supports `format_attribute_js_json_pattern` and `format_attribute_js_json_min_props` for tuning which attributes are formatted. Thanks, [@&#8203;oliverhaas](https://redirect.github.com/oliverhaas). - Add `--github-output` for GitHub Actions annotations. Thanks, [@&#8203;iloveitaly](https://redirect.github.com/iloveitaly). ##### Fix - Fix `ignore_blocks` matching when ignored blocks are indented. Thanks, [@&#8203;tdryer](https://redirect.github.com/tdryer). - Use relative paths for `--exclude` and `--use-gitignore` matching so path filters work consistently from nested directories. Thanks, [@&#8203;satya-waylit](https://redirect.github.com/satya-waylit). - Stop D018/J018 from flagging root links such as `href="/"`. Thanks, [@&#8203;SAY-5](https://redirect.github.com/SAY-5). - Do not treat soft hyphen entities as text for H023. Thanks, [@&#8203;kotutuloro](https://redirect.github.com/kotutuloro). - Fix Handlebars `{{#unless}}` indentation. Thanks, [@&#8203;S1mplePixels](https://redirect.github.com/S1mplePixels). - Fix formatting when `/>` appears inside an HTML attribute value. Thanks, [@&#8203;novucs](https://redirect.github.com/novucs). - Improve CPU count handling for worker setup. ##### Performance - Improve formatter caching and reduce cache memory usage. Formatting is about 19% faster. ##### Documentation - Add Chinese translation. Thanks, [@&#8203;Twisuki](https://redirect.github.com/Twisuki). - Add Homebrew installation instructions. Thanks, [@&#8203;alfawal](https://redirect.github.com/alfawal). - Add EFM Neovim integration documentation. Thanks, [@&#8203;danielebra](https://redirect.github.com/danielebra). - Add copy-pastable pre-commit YAML to the README. Thanks, [@&#8203;Pierre-Sassoulas](https://redirect.github.com/Pierre-Sassoulas). - Polish linter and CLI documentation. Thanks, [@&#8203;jasonaowen](https://redirect.github.com/jasonaowen) and [@&#8203;dotWee](https://redirect.github.com/dotWee). ##### Packaging - Drop Python 3.9 support. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: bircni <[email protected]>

• bircni (15 Jun 26)

  feat(actions): show run status on browser tab favicon (#38071)

• Karthik Bhandary (15 Jun 26)

  chore: center info message for unsupported jupyter notebook versions (#38114) Co-authored-by: wxiaoguang <[email protected]>

• Lunny Xiao (14 Jun 26)

  chore(actions): Add icon for status filter (#38082) <img width="352" height="391" alt="image" src="https://github.com/user-attachments/assets/261dd567-49c2-4fc6-a646-5f8641e08192" /> --------- Co-authored-by: bircni <[email protected]>

• bircni (14 Jun 26)

  feat(org): add team visibility so org members can discover teams (#37680) Closes #37670. Today, org members in Gitea only see teams they're a member of. In larger orgs that hurts onboarding and discoverability — there's no way to look up which team owns what without asking around. GitHub solves this with a per-team visibility setting; this PR brings the same model to Gitea. ## What changes - Every team gets a `visibility` setting: - `private` *(default)* — only team members and org owners can see the team. Same as today's behavior. - `limited` — listable by any member of the organization. Members and the repos the team has access to are visible too. Non-org-members still see nothing. - `public` — listable by any signed-in user. - The Owners team visibility is fixed and cannot be changed via settings. - Existing teams default to `private`, so this is a no-op for anyone who doesn't change anything. ## API - `Team`, `CreateTeamOption`, `EditTeamOption` all gain a `visibility` field (string enum: `private` | `limited` | `public`). - `GET /orgs/{org}/teams` and `/orgs/{org}/teams/search` now apply the same visibility rules as the web UI: - site admins and org owners still see every team - other org members see their own teams plus any `limited` or `public` team - `private` teams are no longer leaked through these endpoints - Swagger/OpenAPI specs regenerated. ## UI View from admin2 (not an owner): <img width="1669" height="726" src="https://github.com/user-attachments/assets/daf4bccb-644b-4426-b178-71963aeaf73b" /> View from admin (owner): <img width="2559" height="863" src="https://github.com/user-attachments/assets/4f22cebc-e9df-4fd2-8ed4-724d31fadb7a" /> --------- Signed-off-by: bircni <[email protected]> Co-authored-by: TheFox0x7 <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

• techknowlogick (14 Jun 26)

  chore(deps): bump dockerfile to use Alpine 3.24 (#38077)

• wxiaoguang (14 Jun 26)

  chore: fix form string abuse (#38106)

• delvh (14 Jun 26)

  docs: Clarify criteria for becoming a merger (#38113)

• TheFox0x7 (14 Jun 26)

  feat(api): add token introspection and self-deletion endpoint (#37995) Adds a /api/v1/token endpoint that allows tokens to introspect and delete themselves. partially fixes: https://github.com/go-gitea/gitea/issues/33583 Assisted-by: Mistral Vibe:mistral-medium-3.5 --------- Signed-off-by: wxiaoguang <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

• bircni (14 Jun 26)

  docs: Publish TOC Election Result 2026 (#38111) - Adjusted the wording for what happens on a draw (somehow we managed to get a draw) The new members are: - @delvh - @bircni - @TheFox0x7 Closes #37551