* SECURITY

  * Toolchain Update to Go 1.25.6 (go-gitea#36480) (go-gitea#36487)
  * Adjust the toolchain version (go-gitea#36537) (go-gitea#36542)
  * Update toolchain to 1.25.8 for v1.25 (go-gitea#36888)
  * Prevent redirect bypasses via backslash-encoded paths (go-gitea#36660) (go-gitea#36716)
  * Fix get release draft permission check (go-gitea#36659) (go-gitea#36715)
  * Fix a bug user could change another user's primary email (go-gitea#36586) (go-gitea#36607)
  * Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797) (go-gitea#36851)
  * Add validation constraints for repository creation fields (go-gitea#36671) (go-gitea#36757)
  * Fix bug to check whether user can update pull request branch or rebase branch (go-gitea#36465) (go-gitea#36838)
  * Add migration http transport for push/sync mirror lfs (go-gitea#36665) (go-gitea#36691)
  * Fix track time list permission check (go-gitea#36662) (go-gitea#36744)
  * Fix track time issue id (go-gitea#36664) (go-gitea#36689)
  * Fix path resolving (go-gitea#36734) (go-gitea#36746)
  * Fix dump release asset bug (go-gitea#36799) (go-gitea#36839)
  * Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798) (go-gitea#36841)
  * Fix forwarded proto handling for public URL detection (go-gitea#36810) (go-gitea#36836)
  * Add a git grep search timeout (go-gitea#36809) (go-gitea#36835)
  * Fix oauth2 s256 (go-gitea#36462) (go-gitea#36477)
* ENHANCEMENTS
  * Make `security-check` informational only (go-gitea#36681) (go-gitea#36852)
  * Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36840)
  * Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (go-gitea#36688) (go-gitea#36692)
  * Upgrade gogit to 5.16.5 (go-gitea#36687)
  * Add wrap to runner label list (go-gitea#36565) (go-gitea#36574)
  * Add dnf5 command for Fedora in RPM package instructions (go-gitea#36527) (go-gitea#36572)
  * Allow scroll propagation outside code editor (go-gitea#36502) (go-gitea#36510)
* BUGFIXES
  * Fix non-admins unable to automerge PRs from forks (go-gitea#36833) (go-gitea#36843)
  * Fix bug when pushing mirror with wiki (go-gitea#36795) (go-gitea#36807)
  * Fix artifacts v4 backend upload problems (go-gitea#36805) (go-gitea#36834)
  * Fix CRAN package version validation to allow more than 4 version components (go-gitea#36813) (go-gitea#36821)
  * Fix force push time-line commit comments of pull request (go-gitea#36653) (go-gitea#36717)
  * Fix SVG height calculation in diff viewer (go-gitea#36748) (go-gitea#36750)
  * Fix push time bug (go-gitea#36693) (go-gitea#36713)
  * Fix bug the protected branch rule name is conflicted with renamed branch name (go-gitea#36650) (go-gitea#36661)
  * Fix bug when do LFS GC (go-gitea#36500) (go-gitea#36608)
  * Fix focus lost bugs in the Monaco editor (go-gitea#36609)
  * Reprocess htmx content after loading more files (go-gitea#36568) (go-gitea#36577)
  * Fix assignee sidebar links and empty placeholder (go-gitea#36559) (go-gitea#36563)
  * Fix issues filter dropdown showing empty label scope section (go-gitea#36535) (go-gitea#36544)
  * Fix various mermaid bugs (go-gitea#36547) (go-gitea#36552)
  * Fix data race when uploading container blobs concurrently (go-gitea#36524) (go-gitea#36526)
  * Correct spacing between username and bot label (go-gitea#36473) (go-gitea#36484)

* SECURITY

  * Release attachments must belong to the intended repo (go-gitea#36347) (go-gitea#36375)
  * Fix permission check on org project operations (go-gitea#36318) (go-gitea#36373)
  * Clean watches when make a repository private and check permission when send release emails (go-gitea#36319) (go-gitea#36370)
  * Add more check for stopwatch read or list (go-gitea#36340) (go-gitea#36368)
  * Fix openid setting check (go-gitea#36346) (go-gitea#36361)
  * Fix cancel auto merge bug (go-gitea#36341) (go-gitea#36356)
  * Fix delete attachment check (go-gitea#36320) (go-gitea#36355)
  * LFS locks must belong to the intended repo (go-gitea#36344) (go-gitea#36349)
  * Fix bug on notification read (go-gitea#36339) go-gitea#36387
* ENHANCEMENTS
  * Add more routes to the "expensive" list (go-gitea#36290)
  * Make "commit statuses" API accept slashes in "ref" (go-gitea#36264) (go-gitea#36275)
* BUGFIXES
  * Fix markdown newline handling during IME composition (go-gitea#36421) go-gitea#36424
  * Fix missing repository id when migrating release attachments (go-gitea#36389)
  * Fix bug when compare in the pull request (go-gitea#36363) (go-gitea#36372)
  * Fix incorrect text content detection (go-gitea#36364) (go-gitea#36369)
  * Fill missing `has_code` in repository api (go-gitea#36338) (go-gitea#36359)
  * Fix notifications pagination query parameters (go-gitea#36351) (go-gitea#36358)
  * Fix some trivial problems (go-gitea#36336) (go-gitea#36337)
  * Prevent panic when GitLab release has more links than sources (go-gitea#36295) (go-gitea#36305)
  * Fix stats bug when syncing release (go-gitea#36285) (go-gitea#36294)
  * Always honor user's choice for "delete branch after merge" (go-gitea#36281) (go-gitea#36286)
  * Use the requested host for LFS links (go-gitea#36242) (go-gitea#36258)
  * Fix panic when get editor config file (go-gitea#36241) (go-gitea#36247)
  * Fix regression in writing authorized principals (go-gitea#36213) (go-gitea#36218)
  * Fix WebAuthn error checking (go-gitea#36219) (go-gitea#36235)