2
0
Commit Graph

447 Commits

Author SHA1 Message Date
Sebastian Ertz
14df4dc9c2 Update chroma to v2.21.1 (#36201)
https://github.com/alecthomas/chroma/releases/tag/v2.21.1
2025-12-18 23:26:18 +00:00
Sebastian Ertz
09287d10ab Update chroma to v2.21.0 (#36171)
https://github.com/alecthomas/chroma/releases/tag/v2.21.0
2025-12-17 01:07:44 +00:00
silverwind
01ea2b0d95 Update go toolchain to 1.25.5 (#36074)
Fixes: https://pkg.go.dev/vuln/GO-2025-4155
2025-12-03 00:26:07 +01:00
wxiaoguang
73976c8bf3 Fix oauth2 session gob register (#36017)
`gob.Register` must be called before Sessioner

Fix #36016
2025-11-26 23:25:34 +08:00
dependabot[bot]
9597e19ce9 Bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#35985)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from
0.43.0 to 0.45.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e0068c009"><code>4e0068c</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="e79546e28b"><code>e79546e</code></a>
ssh: curb GSSAPI DoS risk by limiting number of specified OIDs</li>
<li><a
href="f91f7a7c31"><code>f91f7a7</code></a>
ssh/agent: prevent panic on malformed constraint</li>
<li><a
href="2df4153a03"><code>2df4153</code></a>
acme/autocert: let automatic renewal work with short lifetime certs</li>
<li><a
href="bcf6a849ef"><code>bcf6a84</code></a>
acme: pass context to request</li>
<li><a
href="b4f2b62076"><code>b4f2b62</code></a>
ssh: fix error message on unsupported cipher</li>
<li><a
href="79ec3a51fc"><code>79ec3a5</code></a>
ssh: allow to bind to a hostname in remote forwarding</li>
<li><a
href="122a78f140"><code>122a78f</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="c0531f9c34"><code>c0531f9</code></a>
all: eliminate vet diagnostics</li>
<li><a
href="0997000b45"><code>0997000</code></a>
all: fix some comments</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.43.0...v0.45.0">compare
view</a></li>
</ul>
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-19 20:10:35 -08:00
Lunny Xiao
9421a5da0c Upgrade deps golang.org/x/crypto (#35952) 2025-11-14 03:19:51 +00:00
silverwind
1b48a904be Add toolchain directive to go.mod (#35901)
From [docs](https://go.dev/doc/toolchain#config):

> The go line declares the minimum required Go version for using the
module or workspace. For compatibility reasons, if the go line is
omitted from a go.mod file, the module is considered to have an implicit
go 1.16 line, and if the go line is omitted from a go.work file, the
workspace is considered to have an implicit go 1.18 line.

> The toolchain line declares a suggested toolchain to use with the
module or workspace. As described in “[Go toolchain
selection](https://go.dev/doc/toolchain#select)” below, the go command
may run this specific toolchain when operating in that module or
workspace if the default toolchain’s version is less than the suggested
toolchain’s version. If the toolchain line is omitted, the module or
workspace is considered to have an implicit toolchain goV line, where V
is the Go version from the go line.

This is better than setting `go` to the latest version which may break
builds when that go version is unavailable, for example with
`GOTOOLCHAIN=local` in the official go docker images.
2025-11-08 19:48:16 +00:00
silverwind
4fbb5bb6e0 Move gitea-vet to use go tool (#35878)
Add it as a [tool
dependency](https://go.dev/doc/modules/managing-dependencies#tools),
eliminating the need for `build.go`.
2025-11-06 21:09:31 +01:00
silverwind
faf5f62a0b Update to go 1.25.4 (#35877)
https://tip.golang.org/doc/devel/release#go1.25.4
2025-11-06 07:04:38 +01:00
Lunny Xiao
634486e76c upgrade go mail to 0.7.2 and fix the bug (#35833)
patch from
https://github.com/wneessen/go-mail/issues/504#issuecomment-3477890515.
Thanks to @wneessen
2025-11-03 11:32:45 -08:00
Lunny Xiao
bca490d888 Revert gomail to v0.7.0 to fix sending mail failed (#35816)
Revert gomail to the last work version to fix #35794

There is a problem between go mail v0.7.1 to prevent sending email work.
https://github.com/wneessen/go-mail/compare/v0.7.0...v0.7.1
2025-11-02 09:07:32 +00:00
Lunny Xiao
37af9c4b96 Upgrade go mail to 0.7.2 (#35748) 2025-10-26 09:52:01 -04:00
wxiaoguang
9b350f66dc Fix missing Close when error occurs and abused connection pool (#35658)
Fix #35649

* Use upstream `git-lfs-transfer`
* The Close should be called when error occurs (bug fix)
* The connection pool should be shared (bug fix)
* Add more tests to cover "LFS over SSH download"
2025-10-15 09:47:12 +00:00
Lunny Xiao
4a017be23f Upgrade to go 1.25.3 (#35656) 2025-10-15 10:09:32 +02:00
techknowlogick
4ad7c6ca59 bump archives&rar dep (#35637) 2025-10-12 05:48:19 +02:00
Zettat123
7baf4df302 Use inputs context when parsing workflows (#35590)
Depends on [gitea/act#143](https://gitea.com/gitea/act/pulls/143)

The [`inputs`
context](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#inputs-context)
is used when parsing workflows so that `run-name` like `run-name: Deploy
to ${{ inputs.deploy_target }}` can be parsed correctly.
2025-10-06 06:09:27 +02:00
dependabot[bot]
47c97ed8d9 Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#35557) 2025-10-01 00:14:53 +00:00
wxiaoguang
125c3dc8a7 Drop json-iterator dependency (#35544) 2025-09-28 22:30:28 +08:00
6543
2ab56829f5 Add proper error message if session provider can not be created (#35520)
the middleware that creates the session provider just panics if on
creation the config is wrong.
this is not catched and so you just get an cryptic stacktrace with no
point where to look at (as user).

## Before

```
2025/09/16 03:56:37 ...xer/stats/indexer.go:87:populateRepoIndexer() [I] Done (re)populating the repo stats indexer with existing repositories
2025/09/16 03:56:37 modules/ssh/ssh.go:387:Listen() [I] Adding SSH host key: /var/lib/gitea/data/ssh/gitea.rsa
2025/09/16 03:56:37 modules/ssh/init.go:26:Init() [I] SSH server started on :1234. Cipher list ([chacha20-poly1305@openssh.com aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com]), key exchange algorithms ([curve25519-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group14-sha256 diffie-hellman-group14-sha1]), MACs ([hmac-sha2-256-etm@openssh.com hmac-sha2-256 hmac-sha1])
2025/09/16 03:56:37 ...s/graceful/server.go:50:NewServer() [I] Starting new SSH server: tcp::1234 on PID: 83337
2025/09/16 03:56:38 cmd/web.go:231:func1() [F] PANIC: dial tcp 127.0.0.1:6379: connect: connection refused
gitea.com/go-chi/session@v0.0.0-20240316035857-16768d98ec96/session.go:239 (0x1cdb908)
code.gitea.io/gitea/routers/common/middleware.go:108 (0x2547f5a)
code.gitea.io/gitea/routers/web/web.go:270 (0x278b8e9)
code.gitea.io/gitea/routers/init.go:185 (0x2850d89)
code.gitea.io/gitea/cmd/web.go:211 (0x295c5ad)
code.gitea.io/gitea/cmd/web.go:262 (0x295cacb)
code.gitea.io/gitea/cmd/main.go:111 (0x2953422)
github.com/urfave/cli/v2@v2.27.2/command.go:276 (0x1cc3dfd)
github.com/urfave/cli/v2@v2.27.2/command.go:269 (0x1cc4084)
github.com/urfave/cli/v2@v2.27.2/app.go:333 (0x1cc086a)
github.com/urfave/cli/v2@v2.27.2/app.go:307 (0x2953f18)
code.gitea.io/gitea/cmd/main.go:172 (0x2953efc)
code.gitea.io/gitea/main.go:46 (0x2998498)
runtime/proc.go:283 (0x4471ca)
runtime/asm_amd64.s:1700 (0x484a20)
```

## After

```
2025/09/22 22:52:35 .../templates/htmlrenderer.go:118:initHTMLRenderer() [D] Creating static HTML Renderer
2025/09/22 22:52:35 routers/web/web.go:273:Routes() [F] common.Sessioner failed: failed to create session middleware: dial tcp 127.0.0.1:6379: connect: connection refused
```

---------

Signed-off-by: 6543 <6543@obermui.de>
2025-09-28 12:24:19 +00:00
junoberryferry
4c7da7312f use experimental go json v2 library (#35392)
details: https://pkg.go.dev/encoding/json/v2

---------

Co-authored-by: techknowlogick <matti@mdranta.net>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-09-28 08:03:36 +00:00
wxiaoguang
792804b180 Replace gobwas/glob package (#35478)
https://github.com/gobwas/glob is unmaintained and has bugs.
2025-09-13 18:01:00 +00:00
silverwind
a688d2e0d5 Update gofumpt, add go.mod ignore directive (#35434)
gofumpt now
[supports](https://github.com/mvdan/gofumpt/releases/tag/v0.9.0) the
[ignore](https://tip.golang.org/ref/mod#go-mod-file-ignore) directive
added in go 1.25, make use of it which speeds up `make fmt` by around
30%. Likely this also has similar speed gains in other go-related
commands which use the `./...` pattern.

The change in `build/code-batch-process.go` was introduced by `gofumpt`
because of this change:

> A new rule is introduced to "clothe" naked returns for the sake of
clarity. While there is nothing wrong with naming results in function
signatures, using lone return statements can be confusing to the reader.
2025-09-08 13:40:08 +02:00
Lunny Xiao
de0d896744 Upgrade golang to 1.25.1 and add descriptions for the swagger structs' fields (#35418) 2025-09-06 16:52:41 +00:00
Lunny Xiao
3270e42892 Upgrade dependencies (#35384)
- ~Upgrade golang to 1.25~ blocked by the issue
https://github.com/go-swagger/go-swagger/issues/3220
- Upgrade minor versions of most dependencies
- Upgrade github.com/google/go-github version to v74
- Fix meilisearch because of sdk interface change
- Use github.com/Necoro/html2text which is a fork instead of html2text
because of https://github.com/jaytaylor/html2text/issues/67 which
resulted in complie failure.
- Fix some deprecated methods of gitlab go client.
2025-09-02 23:13:38 -04:00
junoberryferry
e238261ab5 Use github.com/mholt/archives replace github.com/mholt/archiver (#35390)
Fix #32620

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: junoberryferry <user@example.tld>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-09-01 19:40:12 +00:00
Lunny Xiao
086ad96a3a Upgrade xz to v0.5.15 (#35377) 2025-08-29 17:44:33 +00:00
Sebastian Ertz
d9024c32a6 Update chroma to v2.20.0 (#35220)
https://github.com/alecthomas/chroma/releases/tag/v2.20.0

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-08-11 13:00:20 +02:00
NorthRealm
9575c9911d Upgrade go to 1.24.6 (#35235) 2025-08-08 13:03:30 +00:00
Lunny Xiao
f0d64d4c14 Change some columns from text to longtext and fix column wrong type caused by xorm (#35141)
This PR upgrade xorm to v1.3.10 which fixed a bug when both `longtext
json` tags in the struct field. The `longtext` will be ignored and
`json` will be considered as `text`.

A migration has been introduced to modify the column directly to
longtext. And another two columns should also be migrated from text to
longtext.

All these changes only affect mysql database because for other databases
Gitea supported, text is the same as longtext.

Fix #27244 
Fix #34764 
Fix #35042
2025-07-23 22:24:44 -07:00
silverwind
c4222c51c8 Update to go 1.24.5 (#35031)
https://go.dev/doc/devel/release#go1.24.5
2025-07-10 11:48:36 -04:00
Lunny Xiao
7ebee51a77 Upgrade chi to v5.2.2 (#34798) 2025-06-20 18:23:46 +00:00
Lunny Xiao
fc3073cb79 upgrade orgmode to v1.8.0 (#34721) 2025-06-17 19:30:43 +00:00
wxiaoguang
cc48d3657a Refactor embedded assets and drop unnecessary dependencies (#34692)
Benefits:

1. smaller binary size (reduces more than 1MB)
2. better control of the assets details
3. fewer unmaintained dependencies
4. faster startup if the assets are not needed
5. won't hang up editors when open "bindata.go" by accident
2025-06-12 03:59:33 +00:00
silverwind
92b509904b Bump minimum go version to 1.24.4 (#34699)
Fixes 3 open govulncheck issues.
2025-06-12 03:33:36 +00:00
TheFox0x7
e751a0490d Migrate to urfave v3 (#34510)
migrate cli to urfave v3

add more cli tests

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-06-10 12:35:12 +00:00
wxiaoguang
74c21b8934 Update x/crypto package and make builtin SSH use default parameters (#34667) 2025-06-09 19:51:02 +00:00
badhezi
faef118f8b Use run-name and evaluate workflow variables (#34301)
This addresses https://github.com/go-gitea/gitea/issues/34247
depends on https://gitea.com/gitea/act/pulls/137

I couldn't find any previous implementation for `run-name` support on
workflows so I created one.

Key points:
All dispatched workflows, scheduled workflows and detected workflows
(from different hooks) will use and evaluate `run-name` if exists, with
the corresponding gitea context and variables. This will be used as the
Action run title and replace the default commit message being used
today.

Had to change act package jobparser (see link above)
and create two helpers
3a1320c70d/models/actions/utils.go (L86)
and
3a1320c70d/services/actions/context.go (L169)
to pass the correct types to
[GenerateGiteaContext](https://github.com/go-gitea/gitea/pull/34301/files#diff-9c9c27cb61a33e55ad33dc2c2e6a3521957a3e5cc50ddf652fdcd1def87b044dR86)
and
[WithGitContext](65c232c4a5/pkg/jobparser/jobparser.go (L84))
respectively.

<img width="1336" alt="Screenshot 2025-04-28 at 17 13 01"
src="https://github.com/user-attachments/assets/73cb03d0-23a0-4858-a466-bbf0748cea98"
/>
2025-05-20 02:24:10 +00:00
Lunny Xiao
3a2c5fa7b8 Upgrade go-github v61 -> v71 (#34385)
There will be a possible bug when migrating from Github
https://github.com/google/go-github/issues/3229
This PR upgrades go-github from v61 to v71 to resolve that problem.
2025-05-06 20:10:14 -07:00
Mingzhu Yan
c6f620e220 fix go version (#34299)
go cmd will download and cache a copy of the Go toolchain, go1.24 is not
a valid version since https://github.com/golang/go/issues/57631.
2025-04-29 12:24:53 +00:00
Lunny Xiao
56179c5c1e Fix the ci build (#34309)
Fix
https://github.com/go-gitea/gitea/actions/runs/14722306878/job/41318217870

A fork has been created under https://gitea.com/gitea/go-xsd-duration
2025-04-28 20:47:16 -07:00
wxiaoguang
328928e788 update go&js dependencies (#34262) 2025-04-23 21:22:40 +00:00
Lunny Xiao
508753b180 Update net package (#34228) 2025-04-17 06:06:58 -04:00
Rowan Bohde
3082395453 Add middleware for request prioritization (#33951)
This adds a middleware for overload protection that is intended to help protect against malicious scrapers.
It does this via [`codel`](https://github.com/bohde/codel), which will perform the following:

1. Limit the number of in-flight requests to some user-defined max
2. When in-flight requests have reached their begin queuing requests.
    Logged-in requests having priority above logged-out requests
3. Once a request has been queued for too long,
    it has a probabilistic chance to be rejected based on how overloaded the entire system is.

When a server experiences more traffic than it can handle,
this keeps latency low for logged-in users and rejects just
enough requests from logged-out users to not overload the service.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2025-04-14 16:25:48 +02:00
wxiaoguang
279c9e45e0 Update go mod dependencies (#33988)
blevesearch is skipped because it causes errors

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
2025-03-25 05:51:52 +00:00
TheFox0x7
95710eb82e update jwt and redis packages (#33984) 2025-03-23 10:13:16 -04:00
Lunny Xiao
4d0dfb495b Upgrade golang net from 0.35.0 -> 0.36.0 (#33795) 2025-03-04 23:25:09 +01:00
Lunny Xiao
a0d061e9a4 Upgrade act to 0.261.4 and actions-proto-go to v0.4.1 (#33760)
Include https://gitea.com/gitea/act/pulls/129 Fix #33657 
And https://gitea.com/gitea/actions-proto-def/pulls/14
2025-03-01 20:02:58 +00:00
Lunny Xiao
b09a6a0fb0 upgrade go-crypto from 1.1.5 to 1.1.6 (#33745)
Fix #33296

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-02-28 14:06:47 +00:00
techknowlogick
ce02d9f918 bump x/crypto & x/oauth2 (#33704) 2025-02-24 20:15:18 +00:00
wxiaoguang
2d282cf032 Update Go dependencies (skip blevesearch, meilisearch) (#33655) 2025-02-20 22:10:54 +08:00