Gitea

Recent Commits

• TowyTowy (12 Jul 26)

  fix(util): reject invalid characters between time-estimate units (#38416) ### What / why `TimeEstimateParse` (used by the issue time-estimate form) only checked that the first token starts at the beginning of the string and the last token ends at its end, but never checked the gaps between consecutive tokens. Non-whitespace garbage embedded between two valid units was silently dropped and the string accepted with a wrong value instead of being reported as invalid. Examples that were wrongly accepted before this change: - `1h 2x 3m` → 3780s (parsed as 1h3m) - `1h_2m` → 3720s - `1h,1m` → 3660s All three now return an "invalid time string" error, while valid inputs such as `1h 1m 1s` and `1h1m1s` keep working. ### How Reject any non-whitespace content between two matched units. --------- Signed-off-by: TowyTowy <[email protected]> Signed-off-by: wxiaoguang <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

• Shudhanshu Singh (12 Jul 26)

  feat(actions): implement adaptive auto-refresh for workflow runs list (#38329) ### Description This PR implements an optimized, adaptive client-side auto-refresh mechanism for the Gitea Actions workflow runs list page. It allows users to see workflow progress updates dynamically without having to reload the page. Fixes https://github.com/go-gitea/gitea/issues/37457 --------- Signed-off-by: wxiaoguang <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

• Lovepreet Singh (12 Jul 26)

  fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) Fixes #38217 ## Problem Turnstile CAPTCHA verification uses `http.DefaultClient`, so the request to `challenges.cloudflare.com` bypasses Gitea's configured HTTP proxy — unlike other outbound HTTP clients such as the update checker (`modules/updatechecker/update_checker.go`) and migrations. In deployments where egress is only permitted through the configured proxy, verification fails. ## Fix Build the client with `proxy.Proxy()` as the transport proxy, mirroring the update checker: ```go func httpClient() *http.Client { return &http.Client{ Transport: &http.Transport{ Proxy: proxy.Proxy(), }, } } ``` The client is built per call (rather than a package-level var) because `proxy.Proxy()` reads `setting.Proxy` when invoked; building it at request time ensures it reflects the loaded settings. When no proxy is configured, behavior is unchanged (`proxy.Proxy()` returns a no-op / `http.ProxyFromEnvironment`). --------- Co-authored-by: wxiaoguang <[email protected]>

• Harsh Satyajit Thakur (12 Jul 26)

  fix: represent a deleted assignee team as a Ghost team (#38413) Fixes #35472. `Comment.LoadAssigneeUserAndTeam` already has a Ghost user fallback for a deleted assignee user, but the parallel branch for a deleted assignee team just swallowed the not-found error and left `AssigneeTeam` as `nil`. This is inconsistent (the reporter's example shows `assignee` becoming a Ghost user while `assignee_team` becomes `null`), and it's also a latent nil pointer bug: other code that assumes `AssigneeTeam` is set once this function returns without error will panic. Added `organization.NewGhostTeam()` / `Team.IsGhost()`, mirroring the existing `user_model.NewGhostUser()` / `User.IsGhost()` pattern, and used it in the same fallback branch. Co-authored-by: wxiaoguang <[email protected]>

• GiteaBot (12 Jul 26)

  [skip ci] Updated translations via Crowdin

• wxiaoguang (11 Jul 26)

  fix: refresh pull request merge box when the commit status is pending (#38410)

• Yarden Shoham (11 Jul 26)

  chore: remove Yarden Shoham from maintainers (#38407)

• wxiaoguang (11 Jul 26)

  fix: actions task state concurrent update (#38405) fix #38333

• bircni (10 Jul 26)

  fix(actions): keep workflow run trailing on one row with long branch names (#38382) The flex-list refactor (#37505) raised the shared `.item-trailing` selector's specificity, so its `flex-wrap: wrap` started overriding the run list's intended `flex-wrap: nowrap` — a long branch name pushed the trailing content past its fixed 280px width and wrapped the kebab menu onto its own line. --------- Co-authored-by: wxiaoguang <[email protected]>

• bircni (10 Jul 26)

  fix(pull): re-evaluate review official flag on target branch change (#38319) The `official` flag of a pull request review is computed against the target branch's protection rules at submit time and stored on the review record. `ChangeTargetBranch` updated the base branch but never re-evaluated it, so an `official` approval obtained against an unprotected branch could be retargeted onto a protected branch and satisfy its required approvals, bypassing the branch protection. This re-evaluates the `official` flag of the latest approve/reject reviews against the new base branch whenever the target branch changes.

• Shudhanshu Singh (10 Jul 26)

  fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) The contribution calendar manually constructed localized date strings instead of using the browser's locale-aware date formatting. Replace this with `toLocaleDateString()` to correctly format dates for all locales and calendar systems, including non-Gregorian calendars. Fixes https://github.com/go-gitea/gitea/issues/38375

• bircni (10 Jul 26)

  fix(security): harden access checks and migration validation (#38324) Harden access checks for issue dependencies, team repository membership, notifications, stars, tracked times and repository migrations.

• bircni (10 Jul 26)

  fix: enforce public-only token scope and harden push options / locale parsing (#38323) - **Locale DoS:** the `Locale` middleware passed the raw `Accept-Language` header to `ParseAcceptLanguage`, whose guard only counts `-` while the scanner aliases `_` to `-` — a large `_`-separated header on an unauthenticated request burned CPU. The header is now length-bounded before parsing. - **Public-only token scope:** `GET /teams/{id}/repos`, `.../repos/{org}/{repo}`, `/teams/{id}/activities/feeds`, and `/users/{username}/orgs/{org}/permissions` still returned private repo/activity/permission data to a public-only token. They now filter via `TokenCanAccessRepo` / `ApplyPublicOnly` and reject non-public org permissions. - **Push-option visibility:** `repo.private` / `repo.template` push options were applied to any existing repo, letting an owner/admin silently flip visibility bypassing audit, webhooks, and notifications. They are now honored only on push-to-create.

• wxiaoguang (10 Jul 26)

  fix: co-author detection (#38392) Committer can also be co-author, it should only not be included in the co-author list if it is not in the "Co-author-by" list. * Author & Co-author: they changed the code (attribution) * Committer: they submitted the commit but didn't change the code (e.g.: maintainer signed a commit) Fix #38384

• bircni (09 Jul 26)

  fix(api): stop leaking private repo metadata after access revocation (#38321) The `/user/starred` and `/user/subscriptions` endpoints returned private repositories a user had starred/watched even after their access to those repositories was revoked, still exposing the repository name, description and visibility (including later metadata changes). Private repositories in the starred/watched queries are now gated on the actor's current access via `AccessibleRepositoryCondition`, so users who no longer have access no longer receive the metadata. Public repositories and public-only tokens are unaffected.

• bircni (09 Jul 26)

  fix(lfs): require proof of possession for cross-repo objects (#38322) The LFS batch and upload handlers linked an object that already existed in the content store but was not linked to the current repo whenever the token's user could access it in another repo. Deploy-key tokens carry the repo owner's identity, so a single-repo write deploy key could link and then download objects from any repo the owner can see. This drops the cross-repo access check: the batch handler now makes the client upload (hash-verified) any object not yet linked to the repo, and the upload handler skips proof of possession only when the object is already linked to the current repo.

• bircni (09 Jul 26)

  fix: incorrect co-author detection on commit page (#38386) The commit page built its "co-authored by" list from `AllParticipantIdentities()[1:]`, which only drops the author and leaves the committer in the list even though the committer is already shown separately as "committed by". This caused the committer to be wrongly rendered as a co-author (issue #38384): a commit authored by `silverwind`, committed by `bircni`, with a `Co-authored-by: silverwind` trailer displayed "co-authored by bircni" instead of the actual trailer identity. This adds a `Commit.CoAuthorIdentities()` method that excludes both the author and the committer, uses it on the commit page, and covers the fix with a regression test. Closes #38384

• Zettat123 (09 Jul 26)

  enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) Follow #38237 #38237 posts "skipped" commit statuses for every workflow that is not triggered due to a filter (e.g. `paths` or `branches`) mismatch. However, for non-required workflows, creating "skipped" commit statuses for them would generate a lot of noise. To address this issue, this PR adds a check before creating commit status: - For the context that matches any required status check patterns, a "skipped" commit status will be created. The `Required` label can inform users that this status check is required, but has been skipped because of a filter mismatch. - For a non-required context, nothing will be created. NOTE: Reducing noise is a best-effort approach and isn't entirely accurate. When creating commit statuses, it is impossible to predict which branch protection rule will take effect. Therefore, we have to compare the commit status context against the required patterns from all rules. If any rule matches, the context is considered "required".

• silverwind (09 Jul 26)

  fix(ui): restore commits table column widths (#38379) https://github.com/go-gitea/gitea/pull/37594 widened the author column from `three wide` to `four wide`, leaving a large empty gap around the SHA column in the common single-author case. The old author cell was capped at 180px, so the wider column only adds whitespace: avatar-stack names ellipsize at 240px each, and wider multi-author rows still expand naturally in the auto-layout table. Restore the pre-existing `three`/`eight` widths. Co-authored-by: bircni <[email protected]>

• silverwind (09 Jul 26)

  test(e2e): fix race in pdf file render test (#38380) `data-render-name` is set before the plugin's async render runs, so measuring the container height right after the attribute appears can observe the pre-render 48px height when the `pdfobject` chunk loads slowly (flaked in CI). Poll for the height instead, like the asciicast test in the same file does.

• wxiaoguang (09 Jul 26)

  refactor: introduce ActivePageTimer to help to do partial page refresh (#38372) Before, the logic is already there for "pull merge box". After, the logic is extracted into a general class ActivePageTimer and will help more pages (including #38329)

• GiteaBot (09 Jul 26)

  [skip ci] Updated translations via Crowdin

• Milwad Khosravi (08 Jul 26)

  chore(typo): fix grammar in comments, API docs and error messages (#38370)

• wxiaoguang (08 Jul 26)

  fix: golang html template url escaping (#38363) fix #38362

• bircni (07 Jul 26)

  perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) 3 reductions in the DB load generated by many runners polling `FetchTask`: **1. Debounce runner heartbeat writes** Every poll wrote `last_online`, and every `UpdateTask`/`UpdateLog` wrote `last_active` — while a runner streams logs that is many writes per second per runner. These are now persisted only when stale enough to actually affect the active/offline status (`ShouldPersistLastOnline` / `ShouldPersistLastActive`), using the existing columns. **2. Throttle concurrent task picks** A new in-process semaphore (`MAX_CONCURRENT_TASK_PICKS`) bounds how many runners run the task-assignment transaction at once, so a fleet polling together cannot stampede the query. Throttled polls retry on their next poll without advancing the runner's tasks version. **3. Paginate the task-pick query** `CreateTaskForRunner` previously loaded every waiting job in the runner's scope into memory on each poll (no `LIMIT`). Now it pages through the waiting backlog oldest-first with `LIMIT`, claiming the first label-matching job. --------- Co-authored-by: Zettat123 <[email protected]>

• bircni (07 Jul 26)

  fix(mirror): disable HTTP redirects on pull mirror sync (#38320) Pull mirror sync ran `git fetch` / `remote update` / `remote prune` without disabling HTTP redirects. A mirror remote that later starts redirecting to an otherwise-blocked or internal address could be used as an SSRF/exfiltration vector on scheduled syncs, bypassing the allow/block validation applied at migration time. This sets `http.followRedirects=false` on all three remote-contacting commands in the pull mirror path, matching the existing guard already present on the clone path.

• Giteabot (07 Jul 26)

  chore(deps): update dependency djlint to v1.40.1 (#38354)

• Giteabot (07 Jul 26)

  fix(deps): update npm dependencies (#38352)

• Giteabot (07 Jul 26)

  chore(deps): update action dependencies (#38353)

• Giteabot (07 Jul 26)

  fix(deps): update go dependencies (#38346)