* BUGFIXES

  * Add event.schedule context for schedule actions task (#37320) (#37348)
  * Fix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#37324) (#37344)
  * Use modern "git update-index --cacheinfo" syntax to support more file names (#37338) (#37343)
  * Fix URL related escaping for oauth2 (#37334) (#37340)
  * When the requested arch rpm is missing fall back to noarch (#37236) (#37339)
  * Fix actions concurrency groups cross-branch leak (#37311) (#37331)
  * Fix bug when accessing user badges (#37321) (#37329)
  * Fix AppFullLink (#37325) (#37328)
  * Fix container auth for public instance (#37290) (#37294)
  * Enhance GetActionWorkflow to support fallback references (#37189) (#37283)
  * Fix vite manifest update masking build errors (#37279) (#37310)
  * Fix Mermaid diagrams failing when node labels contain line breaks (#37296) (#37299)
  * Use TriggerEvent instead of Event in workflow runs API response for scheduled runs (#37288) #37360
  * Add URL to Learn more about blocking a user. (#37355) #37367
  * Fix button layout shift when collapsing file tree in editor (#37363) #37375
  * Fix org team assignee/reviewer lookups for team member permissions (#37365) #37391
  * Fix repo init README EOL (#37388) #37399
  * Fix: dump with default zip type produces uncompressed zip (#37401)#37402

* BREAKING

  * Correct swagger annotations for enums, status codes, and notification state (#37030)
  * Remove GET API registration-token (#36801)
  * Support Actions `concurrency` syntax (#32751)
  * Make PUBLIC_URL_DETECTION default to "auto" (#36955)
* SECURITY
  * Bound PageSize in `ListUnadoptedRepositories` (#36884)
* FEATURES
  * Support Actions `concurrency` syntax (#32751)
  * Add terraform state registry (#36710)
  * Instance-wide (global) info banner and maintenance mode (#36571)
  * Support rendering OpenAPI spec (#36449)
  * Add keyboard shortcuts for repository file and code search (#36416)
  * Add support for archive-upload rpc (#36391)
  * Add ability to download subpath archive (#36371)
  * Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
  * Automatic generation of release notes (#35977)
  * Add "Go to file", "Delete Directory" to repo file list page (#35911)
  * Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
  * Add button to re-run failed jobs in Actions (#36924)
  * Support actions and reusable workflows from private repos (#32562)
  * Add summary to action runs view (#36883)
  * Add user badges (#36752)
  * Add configurable permissions for Actions automatic tokens (#36173)
  * Add per-runner "Disable/Pause"  (#36776)
  * Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
* PERFORMANCE
  * WorkflowDispatch API optionally return runid (#36706)
  * Add render cache for SVG icons (#36863)
  * Load `mentionValues` asynchronously (#36739)
  * Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
  * Load heatmap data asynchronously (#36622)
  * Use prev/next pagination for user profile activities page to speed up (#36642)
  * Refactor cat-file batch operations and support `--batch-command` approach (#35775)
  * Use merge tree to detect conflicts when possible (#36400)
* ENHANCEMENTS
  * Implement logout redirection for reverse proxy auth setups (#36085) (#37171)
  * Adds option to force update new branch in contents routes (#35592)
  * Add viewer controller for mermaid (zoom, drag) (#36557)
  * Add code editor setting dropdowns (#36534)
  * Add `elk` layout support to mermaid (#36486)
  * Add resolve/unresolve review comment API endpoints (#36441)
  * Allow configuring default PR base branch (fixes #36412) (#36425)
  * Add support for RPM Errata (updateinfo.xml) (#37125)
  * Require additional user confirmation for making repo private (#36959)
  * Add `actions.WORKFLOW_DIRS` setting (#36619)
  * Avoid opening new tab when downloading actions logs (#36740)
  * Implements OIDC RP-Initiated Logout (#36724)
  * Show workflow link (#37070)
  * Desaturate dark theme background colors (#37056)
  * Refactor "org teams" page and help new users to "add member" to an org (#37051)
  * Add webhook name field to improve webhook identification (#37025) (#37040)
  * Make task list checkboxes clickable in the preview tab (#37010)
  * Improve severity labels in Actions logs and tweak colors (#36993)
  * Linkify URLs in Actions workflow logs (#36986)
  * Allow text selection on checkbox labels (#36970)
  * Support dark/light theme images in markdown (#36922)
  * Enable native dark mode for swagger-ui (#36899)
  * Rework checkbox styling, remove `input` border hover effect (#36870)
  * Refactor storage content-type handling of ServeDirectURL (#36804)
  * Use "Enable Gravatar" but not "Disable" (#36771)
  * Use case-insensitive matching for Git error "Not a valid object name" (#36728)
  * Add "Copy Source" to markup comment menu (#36726)
  * Change image transparency grid to CSS (#36711)
  * Add "Run" prefix for unnamed action steps (#36624)
  * Persist actions log time display settings in `localStorage` (#36623)
  * Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
  * Improve BuildCaseInsensitiveLike with lowercase (#36598)
  * Improve diff highlighting (#36583)
  * Exclude cancelled runs from failure-only email notifications (#36569)
  * Use full-file highlighting for diff sections (#36561)
  * Color command/error logs in Actions log (#36538)
  * Add paging headers (#36521)
  * Improve timeline entries for WIP prefix changes in pull requests (#36518)
  * Add FOLDER_ICON_THEME configuration option (#36496)
  * Normalize guessed languages for code highlighting (#36450)
  * Add chunked transfer encoding support for LFS uploads (#36380)
  * Indicate when only optional checks failed (#36367)
  * Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
  * Support closing keywords with URL references (#36221)
  * Improve diff file headers (#36215)
  * Fix and enhance comment editor monospace toggle (#36181)
  * Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#36164)
  * Add matching pair insertion to markdown textarea (#36121)
  * Add sorting/filtering to admin user search API endpoint (#36112)
  * Allow action user have read permission in public repo like other user (#36095)
  * Disable matchBrackets in monaco (#36089)
  * Use GitHub-style commit message for squash merge (#35987)
  * Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)
  * Add GITEA_PR_INDEX env variable to githooks (#35938)
  * Add proper error message if session provider can not be created (#35520)
  * Add button to copy file name in PR files (#35509)
  * Move `X_FRAME_OPTIONS` setting from `cors` to `security` section (#30256)
  * Add placeholder content for empty content page (#37114)
  * Add `DEFAULT_DELETE_BRANCH_AFTER_MERGE` setting (#36917)
  * Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901)
  * Add admin badge to navbar avatar (#36790)
  * Add `never` option to `PUBLIC_URL_DETECTION` configuration (#36785)
  * Add background and run count to actions list page (#36707)
  * Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#36654)
  * Add support for in_progress event in workflow_run webhook (#36979)
  * Report commit status for pull_request_review events (#36589)
  * Render merged pull request title as such in dashboard feed (#36479)
  * Feature to be able to filter project boards by milestones (#36321)
  * Use user id in noreply emails (#36550)
  * Enable pagination on GiteaDownloader.getIssueReactions() (#36549)
  * Remove striped tables in UI (#36509)
  * Improve control char rendering and escape button styling (#37094)
  * Support legacy run/job index-based URLs and refactor migration 326 (#37008)
  * Add date to "No Contributions" tooltip (#36190)
  * Show edit page confirmation dialog on tree view file change (#36130)
  * Mention proc-receive in text for dashboard.resync_all_hooks func (#35991)
  * Reuse selectable style for wiki (#35990)
  * Support blue yellow colorblind theme (#35910)
  * Support selecting theme on the footer (#35741)
  * Improve online runner check (#35722)
  * Add quick approve button on PR page (#35678)
  * Enable commenting on expanded lines in PR diffs (#35662)
  * Print PR-Title into tooltip for actions (#35579)
  * Use explicit, stronger defaults for newly generated repo signing keys for Debian (#36236)
  * Improve the compare page (#36261)
  * Unify repo names in system notices (#36491)
  * Move package settings to package instead of being tied to version (#37026)
  * Add Actions API rerun endpoints for runs and jobs (#36768)
  * Add branch_count to repository API (#35351) (#36743)
  * Add created_by filter to SearchIssues (#36670)
  * Allow admins to rename non-local users (#35970)
  * Support updating branch via API (#35951)
  * Add an option to automatically verify SSH keys from LDAP (#35927)
  * Make "update file" API can create a new file when SHA is not set (#35738)
  * Update issue.go with labels documentation (labels content, not ids) (#35522)
  * Expose content_version for optimistic locking on issue and PR edits (#37035)
  * Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
* BUGFIXES
  * Frontend iframe renderer framework: 3D models, OpenAPI (#37233) (#37273)
  * Fix CODEOWNERS absolute path matching. (#37244) (#37264)
  * Swift registry metadata: preserve more JSON fields and accept empty metadata (#37254) (#37261)
  * Fix user ssh key exporting and tests (#37256) (#37258)
  * Fix team member avatar size and add tooltip (#37253)
  * Fix commit title rendering in action run and blame (#37243) (#37251)
  * Fix corrupted JSON caused by goccy library (#37214) (#37220)
  * Add test for "fetch redirect", add CSS value validation for external render (#37207) (#37216)
  * Fix incorrect concurrency check (#37205) (#37215)
  * Fix handle missing base branch in PR commits API (#37193) (#37203)
  * Fix encoding for Matrix Webhooks (#37190) (#37201)
  * Fix handle fork-only commits in compare API (#37185) (#37199)
  * Indicate form field readonly via background, fix RunUser config (#37175, #37180) (#37178)
  * Report structurally invalid workflows to users (#37116) (#37164)
  * Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
  * Rename CSS variables and improve colorblind themes (#36353)
  * Hide `add-matcher` and `remove-matcher` from actions job logs (#36520)
  * Prevent navigation keys from triggering actions during IME composition (#36540)
  * Fix vertical alignment of `.commit-sign-badge` children (#36570)
  * Fix duplicate startup warnings in admin panel (#36641)
  * Fix CODEOWNERS review request attribution using comment metadata (#36348)
  * Fix HTML tags appearing in wiki table of contents (#36284)
  * Fix various bugs (#37096)
  * Fix various legacy problems (#37092)
  * Fix RPM Registry 404 when package name contains 'package' (#37087)
  * Merge some standalone Vite entries into index.js (#37085)
  * Fix various problems (#37077)
  * Fix issue label deletion with Actions tokens (#37013)
  * Hide delete branch or tag buttons in mirror or archived repositories. (#37006)
  * Fix org contact email not clearable once set (#36975)
  * Fix a bug when forking a repository in an organization (#36950)
  * Preserve sort order of exclusive labels from template repo (#36931)
  * Make container registry support Apple Container (basic auth) (#36920)
  * Fix the wrong push commits in the pull request when force push (#36914)
  * Add class "list-header-filters" to the div for projects (#36889)
  * Fix dbfs error handling (#36844)
  * Fix incorrect viewed files counter if reverted change was viewed (#36819)
  * Refactor avatar package, support default avatar fallback (#36788)
  * Fix README symlink resolution in subdirectories like .github (#36775)
  * Fix CSS stacking context issue in actions log (#36749)
  * Add gpg signing for merge rebase and update by rebase (#36701)
  * Delete non-exist branch should return 404 (#36694)
  * Fix `TestActionsCollaborativeOwner` (#36657)
  * Fix multi-arch Docker build SIGILL by splitting frontend stage (#36646)
  * Fix linguist-detectable attribute being ignored for configuration files (#36640)
  * Fix state desync in ComboMarkdownEditor (#36625)
  * Unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#36597)
  * Pull Request Pusher should be the author of the merge (#36581)
  * Fix various version parsing problems (#36553)
  * Fix highlight diff result (#36539)
  * Fix mirror sync parser and fix mirror messages (#36504)
  * Fix bug when list pull request commits (#36485)
  * Fix various bugs (#36446)
  * Fix issue filter menu layout (#36426)
  * Restrict branch naming when new change matches with protection rules (#36405)
  * Fix link/origin referrer and login redirect (#36279)
  * Generate IDs for HTML headings without id attribute (#36233)
  * Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
  * Fix issue close timeline icon (#36138)
  * Fix diff blob excerpt expansion (#35922)
  * Fix external render (#35727)
  * Fix review request webhook bug (#35339) (#35723)
  * Fix shutdown waitgroup panic (#35676)
  * Cleanup ActionRun creation (#35624)
  * Fix possible bug when migrating issues/pull requests (#33487)
  * Various fixes (#36697)
  * Apply notify/register mail flags during install load (#37120)
  * Repair duration display for bad stopped timestamps (#37121)
  * Fix(upgrade.sh): use HTTPS for GPG key import and restore SELinux context after upgrade (#36930)
  * Fix various trivial problems (#36921)
  * Fix various trivial problems (#36953)
  * Fix NuGet package upload error handling (#37074)
  * Fix CodeQL code scanning alerts (#36858)
  * Refactor issue sidebar and fix various problems (#37045)
  * Fix various problems (#37029)
  * Fix relative-time RangeError (#37021)
  * Fix chroma lexer mapping (#36629)
  * Fix typos and grammar in English locale (#36751)
  * Fix milestone/project text overflow in issue sidebar (#36741)
  * Fix `no-content` message not rendering after comment edit (#36733)
  * Fix theme loading in development (#36605)
  * Fix workflow run jobs API returning null steps (#36603)
  * Fix timeline event layout overflow with long content (#36595)
  * Fix minor UI issues in runner edit page (#36590)
  * Fix incorrect vendored detections (#36508)
  * Fix editorconfig not respected in PR Conversation view (#36492)
  * Don't create self-references in merged PRs (#36490)
  * Fix potential incorrect runID in run status update (#36437)
  * Fix file-tree ui error when adding files to repo without commits (#36312)
  * Improve image captcha contrast for dark mode (#36265)
  * Fix panic in blame view when a file has only a single commit (#36230)
  * Fix spelling error in migrate-storage cmd utility (#36226)
  * Fix code highlighting on blame page (#36157)
  * Fix nilnil in onedev downloader (#36154)
  * Fix actions lint (#36029)
  * Fix oauth2 session gob register (#36017)
  * Fix Arch repo pacman.conf snippet (#35825)
  * Fix a number of `strictNullChecks`-related issues (#35795)
  * Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (#36861)
  * Hide delete directory button for mirror or archive repository and disable the menu item if user have no permission (#36384)
  * Update message severity colors, fix navbar double border (#37019)
  * Inline and lazy-load EasyMDE CSS, fix border colors (#36714)
  * Closed milestones with no issues now show as 100% completed (#36220)
  * Add test for ExtendCommentTreePathLength migration and fix bugs (#35791)
  * Only turn links to current instance into hash links (#36237)
  * Fix typos in code comments: doesnt, dont, wont (#36890)
* REFACTOR
  * Clean up and improve non-gitea js error filter (#37148) (#37155)
  * Always show owner/repo name in compare page dropdowns (#37172) (#37200)
  * Remove dead CSS rules (#37173) (#37177)
  * Replace Monaco with CodeMirror (#36764)
  * Replace CSRF cookie with `CrossOriginProtection` (#36183)
  * Replace index with id in actions routes (#36842)
  * Remove unnecessary function parameter (#35765)
  * Move jobparser from act repository to Gitea (#36699)
  * Refactor compare router param parse (#36105)
  * Optimize 'refreshAccesses' to perform update without removing then adding (#35702)
  * Clean up checkbox cursor styles (#37016)
  * Remove undocumented support of signing key in the repository git configuration file (#36143)
  * Switch `cmd/` to use constructor functions. (#36962)
  * Use `relative-time` to render absolute dates (#36238)
  * Some refactors about GetMergeBase (#36186)
  * Some small refactors (#36163)
  * Use gitRepo as parameter instead of repopath when invoking sign functions (#36162)
  * Move blame to gitrepo (#36161)
  * Move some functions to gitrepo package to reduce RepoPath reference directly (#36126)
  * Use gitrepo's clone and push when possible (#36093)
  * Remove mermaid margin workaround (#35732)
  * Move some functions to gitrepo package (#35543)
  * Move GetDiverging functions to gitrepo (#35524)
  * Use global lock instead of status pool for cron lock (#35507)
  * Use explicit mux instead of DefaultServeMux (#36276)
  * Use gitrepo's push function (#36245)
  * Pass request context to generateAdditionalHeadersForIssue (#36274)
  * Move assign project when creating pull request to the same database transaction (#36244)
  * Move catfile batch to a sub package of git module (#36232)
  * Use gitrepo.Repository instead of wikipath (#35398)
  * Use experimental go json v2 library (#35392)
  * Refactor template render (#36438)
  * Refactor GetRepoRawDiffForFile to avoid unnecessary pipe or goroutine (#36434)
  * Refactor text utility classes to Tailwind CSS (#36703)
  * Refactor git command stdio pipe (#36422)
  * Refactor git command context & pipeline (#36406)
  * Refactor git command stdio pipe (#36393)
  * Remove unused functions (#36672)
  * Refactor Actions Token Access (#35688)
  * Move commit related functions to gitrepo package (#35600)
  * Move archive function to repo_model and gitrepo (#35514)
  * Move some functions to gitrepo package (#35503)
  * Use git model to detect whether branch exist instead of gitrepo method (#35459)
  * Some refactor for repo path (#36251)
  * Extract helper functions from SearchIssues (#36158)
  * Refactor merge conan and container auth preserve actions taskID (#36560)
  * Refactor Nuget Auth to reuse Basic Auth Token Validation (#36558)
  * Refactor ActionsTaskID (#36503)
  * Refactor auth middleware (#36848)
  * Refactor code render and render control chars (#37078)
  * Clean up AppURL, remove legacy origin-url webcomponent (#37090)
  * Remove `util.URLJoin` and replace all callers with direct path concatenation (#36867)
  * Replace legacy tw-flex utility classes with flex-text-block/inline (#36778)
  * Mark unused&immature activitypub as "not implemented" (#36789)
* TESTING
  * Add e2e tests for server push events (#36879)
  * Rework e2e tests (#36634)
  * Add e2e reaction test, improve accessibility, enable parallel testing (#37081)
  * Increase e2e test timeouts on CI to fix flaky tests (#37053)
* BUILD
  * Upgrade go-git to v5.18.0 (#37269)
  * Replace rollup-plugin-license with rolldown-license-plugin (#37130) (#37158)
  * Bump min go version to 1.26.2 (#37139) (#37143)
  * Convert locale files from ini to json format (#35489)
  * Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#36180)
  * Port away from `flake-utils` (#35675)
  * Remove nolint (#36252)
  * Update the Unlicense copy to latest version (#36636)
  * Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)
  * Replace `google/go-licenses` with custom generation (#36575)
  * Update go dependencies (#36548)
  * Bump appleboy/git-push-action from 1.0.0 to 1.2.0 (#36306)
  * Remove fomantic form module (#36222)
  * Bump setup-node to v6, re-enable cache (#36207)
  * Bump crowdin/github-action from 1 to 2 (#36204)
  * Revert "Bump alpine to 3.23 (#36185)" (#36202)
  * Update chroma to v2.21.1 (#36201)
  * Bump astral-sh/setup-uv from 6 to 7 (#36198)
  * Bump docker/build-push-action from 5 to 6 (#36197)
  * Bump aws-actions/configure-aws-credentials from 4 to 5 (#36196)
  * Bump dev-hanz-ops/install-gh-cli-action from 0.1.0 to 0.2.1 (#36195)
  * Add JSON linting (#36192)
  * Enable dependabot for actions (#36191)
  * Bump alpine to 3.23 (#36185)
  * Update chroma to v2.21.0 (#36171)
  * Update JS deps and eslint enhancements (#36147)
  * Update JS deps (#36091)
  * update golangci-lint to v2.7.0 (#36079)
  * Update JS deps, fix deprecations (#36040)
  * Update JS deps (#35978)
  * Add toolchain directive to go.mod (#35901)
  * Move `gitea-vet` to use `go tool` (#35878)
  * Update to go 1.25.4 (#35877)
  * Enable TypeScript `strictNullChecks` (#35843)
  * Enable `vue/require-typed-ref` eslint rule (#35764)
  * Update JS dependencies (#35759)
  * Move `codeformat` folder to tools (#35758)
  * Update dependencies (#35733)
  * Bump happy-dom from 20.0.0 to 20.0.2 (#35677)
  * Bump setup-go to v6 (#35660)
  * Update JS deps, misc tweaks (#35643)
  * Bump happy-dom from 19.0.2 to 20.0.0 (#35625)
  * Use bundled version of spectral (#35573)
  * Update JS and PY deps (#35565)
  * Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#35557)
  * Migrate from webpack to vite (#37002)
  * Update JS dependencies and misc tweaks (#37064)
  * Update to eslint 10 (#36925)
  * Optimize Docker build with dependency layer caching (#36864)
  * Update JS deps (#36850)
  * Update tool dependencies and fix new lint issues (#36702)
  * Remove redundant linter rules (#36658)
  * Move Fomantic dropdown CSS to custom module (#36530)
  * Remove and forbid `@ts-expect-error` (#36513)
  * Refactor git command stderr handling (#36402)
  * Enable gocheckcompilerdirectives linter (#36156)
  * Replace `lint-go-gopls` with additional `govet` linters (#36028)
  * Update golangci-lint to v2.6.0 (#35801)
  * Misc tool tweaks (#35734)
  * Add cache to container build (#35697)
  * Upgrade vite (#37126)
  * Update `setup-uv` to v8.0.0 (#37101)
  * Upgrade `go-git` to v5.17.2 and related dependencies (#37060)
  * Raise minimum Node.js version to 22.18.0 (#37058)
  * Upgrade `golang.org/x/image` to v0.38.0 (#37054)
  * Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#36876)
  * Enable eslint concurrency (#36878)
  * Vendor relative-time-element as local web component (#36853)
  * Update material-icon-theme v5.32.0 (#36832)
  * Update Go dependencies (#36781)
  * Upgrade minimatch (#36760)
  * Remove i18n backport tool at the moment because of translation format changed (#36643)
  * Update emoji data for Unicode 16 (#36596)
  * Update JS dependencies, adjust webpack config, misc fixes (#36431)
  * Update material-icon-theme to v5.31.0 (#36427)
  * Update JS and PY deps (#36383)
  * Bump alpine to 3.23, add platforms to `docker-dryrun` (#36379)
  * Update JS deps (#36354)
  * Update goldmark to v1.7.16 (#36343)
  * Update chroma to v2.22.0 (#36342)
* DOCS
  * Update AI Contribution Policy (#37022)
  * Update AGENTS.md with additional guidelines (#37018)
  * Add missing cron tasks to example ini (#37012)
  * Add AI Contribution Policy to CONTRIBUTING.md (#36651)
  * Minor punctuation improvement in CONTRIBUTING.md (#36291)
  * Add documentation for markdown anchor post-processing (#36443)
* MISC
  * Correct spelling (#36783)
  * Update Nix flake (#37110)
  * Update Nix flake (#37024)
  * Add valid github scopes (#36977)
  * Update Nix flake (#36943)
  * Update Nix flake (#36902)
  * Update Nix flake (#36857)
  * Update Nix flake (#36787)

* BREAKING

  * Correct swagger annotations for enums, status codes, and notification state (#37030)
  * Remove GET API registration-token (#36801)
  * Support Actions `concurrency` syntax (#32751)
  * Make PUBLIC_URL_DETECTION default to "auto" (#36955)
* SECURITY
  * Bound PageSize in `ListUnadoptedRepositories` (#36884)
* FEATURES
  * Support Actions `concurrency` syntax (#32751)
  * Add terraform state registry (#36710)
  * Instance-wide (global) info banner and maintenance mode (#36571)
  * Support rendering OpenAPI spec (#36449)
  * Add keyboard shortcuts for repository file and code search (#36416)
  * Add support for archive-upload rpc (#36391)
  * Add ability to download subpath archive (#36371)
  * Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
  * Automatic generation of release notes (#35977)
  * Add "Go to file", "Delete Directory" to repo file list page (#35911)
  * Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
  * Add button to re-run failed jobs in Actions (#36924)
  * Support actions and reusable workflows from private repos (#32562)
  * Add summary to action runs view (#36883)
  * Add user badges (#36752)
  * Add configurable permissions for Actions automatic tokens (#36173)
  * Add per-runner “Disable/Pause”  (#36776)
* PERFORMANCE
  * WorkflowDispatch API optionally return runid (#36706)
  * Add render cache for SVG icons (#36863)
  * Load `mentionValues` asynchronously (#36739)
  * Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
  * Load heatmap data asynchronously (#36622)
  * Use prev/next pagination for user profile activities page to speed up (#36642)
  * Refactor cat-file batch operations and support `--batch-command` approach (#35775)
  * Use merge tree to detect conflicts when possible (#36400)
* ENHANCEMENTS
  * Adds option to force update new branch in contents routes (#35592)
  * Add viewer controller for mermaid (zoom, drag) (#36557)
  * Add code editor setting dropdowns (#36534)
  * Add `elk` layout support to mermaid (#36486)
  * Add resolve/unresolve review comment API endpoints (#36441)
  * Allow configuring default PR base branch (fixes #36412) (#36425)
  * Add support for RPM Errata (updateinfo.xml) (#37125)
  * Require additional user confirmation for making repo private (#36959)
  * Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
  * Add `actions.WORKFLOW_DIRS` setting (#36619)
  * Avoid opening new tab when downloading actions logs (#36740)
  * Implements OIDC RP-Initiated Logout (#36724)
  * Show workflow link (#37070)
  * Desaturate dark theme background colors (#37056)
  * Refactor "org teams" page and help new users to "add member" to an org (#37051)
  * Add webhook name field to improve webhook identification (#37025) (#37040)
  * Make task list checkboxes clickable in the preview tab (#37010)
  * Improve severity labels in Actions logs and tweak colors (#36993)
  * Linkify URLs in Actions workflow logs (#36986)
  * Allow text selection on checkbox labels (#36970)
  * Support dark/light theme images in markdown (#36922)
  * Enable native dark mode for swagger-ui (#36899)
  * Rework checkbox styling, remove `input` border hover effect (#36870)
  * Refactor storage content-type handling of ServeDirectURL (#36804)
  * Use "Enable Gravatar" but not "Disable" (#36771)
  * Use case-insensitive matching for Git error "Not a valid object name" (#36728)
  * Add “Copy Source” to markup comment menu (#36726)
  * Change image transparency grid to CSS (#36711)
  * Add "Run" prefix for unnamed action steps (#36624)
  * Persist actions log time display settings in `localStorage` (#36623)
  * Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
  * Improve BuildCaseInsensitiveLike with lowercase (#36598)
  * Improve diff highlighting (#36583)
  * Exclude cancelled runs from failure-only email notifications (#36569)
  * Use full-file highlighting for diff sections (#36561)
  * Color command/error logs in Actions log (#36538)
  * Add paging headers (#36521)
  * Improve timeline entries for WIP prefix changes in pull requests (#36518)
  * Add FOLDER_ICON_THEME configuration option (#36496)
  * Normalize guessed languages for code highlighting (#36450)
  * Add chunked transfer encoding support for LFS uploads (#36380)
  * Indicate when only optional checks failed (#36367)
  * Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
  * Support closing keywords with URL references (#36221)
  * Improve diff file headers (#36215)
  * Fix and enhance comment editor monospace toggle (#36181)
  * Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#36164)
  * Add matching pair insertion to markdown textarea (#36121)
  * Add sorting/filtering to admin user search API endpoint (#36112)
  * Allow action user have read permission in public repo like other user (#36095)
  * Disable matchBrackets in monaco (#36089)
  * Use GitHub-style commit message for squash merge (#35987)
  * Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)
  * Add GITEA_PR_INDEX env variable to githooks (#35938)
  * Add proper error message if session provider can not be created (#35520)
  * Add button to copy file name in PR files (#35509)
  * Move `X_FRAME_OPTIONS` setting from `cors` to `security` section (#30256)
  * Add placeholder content for empty content page (#37114)
  * Add `DEFAULT_DELETE_BRANCH_AFTER_MERGE` setting (#36917)
  * Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901)
  * Add admin badge to navbar avatar (#36790)
  * Add `never` option to `PUBLIC_URL_DETECTION` configuration (#36785)
  * Add background and run count to actions list page (#36707)
  * Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#36654)
  * Add support for in_progress event in workflow_run webhook (#36979)
  * Report commit status for pull_request_review events (#36589)
  * Render merged pull request title as such in dashboard feed (#36479)
  * Feature to be able to filter project boards by milestones (#36321)
  * Use user id in noreply emails (#36550)
  * Enable pagination on GiteaDownloader.getIssueReactions() (#36549)
  * Remove striped tables in UI (#36509)
  * Improve control char rendering and escape button styling (#37094)
  * Support legacy run/job index-based URLs and refactor migration 326 (#37008)
  * Add date to "No Contributions" tooltip (#36190)
  * Show edit page confirmation dialog on tree view file change (#36130)
  * Mention proc-receive in text for dashboard.resync_all_hooks func (#35991)
  * Reuse selectable style for wiki (#35990)
  * Support blue yellow colorblind theme (#35910)
  * Support selecting theme on the footer (#35741)
  * Improve online runner check (#35722)
  * Add quick approve button on PR page (#35678)
  * Enable commenting on expanded lines in PR diffs (#35662)
  * Print PR-Title into tooltip for actions (#35579)
  * Use explicit, stronger defaults for newly generated repo signing keys for Debian (#36236)
  * Improve the compare page (#36261)
  * Unify repo names in system notices (#36491)
  * Move package settings to package instead of being tied to version (#37026)
  * Add Actions API rerun endpoints for runs and jobs (#36768)
  * Add branch_count to repository API (#35351) (#36743)
  * Add created_by filter to SearchIssues (#36670)
  * Allow admins to rename non-local users (#35970)
  * Support updating branch via API (#35951)
  * Add an option to automatically verify SSH keys from LDAP (#35927)
  * Make "update file" API can create a new file when SHA is not set (#35738)
  * Update issue.go with labels documentation (labels content, not ids) (#35522)
  * Expose content_version for optimistic locking on issue and PR edits (#37035)
  * Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
* BUGFIXES
  * Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
  * Rename CSS variables and improve colorblind themes (#36353)
  * Hide `add-matcher` and `remove-matcher` from actions job logs (#36520)
  * Prevent navigation keys from triggering actions during IME composition (#36540)
  * Fix vertical alignment of `.commit-sign-badge` children (#36570)
  * Fix duplicate startup warnings in admin panel (#36641)
  * Fix CODEOWNERS review request attribution using comment metadata (#36348)
  * Fix HTML tags appearing in wiki table of contents (#36284)
  * Fix various bugs (#37096)
  * Fix various legacy problems (#37092)
  * Fix RPM Registry 404 when package name contains 'package' (#37087)
  * Merge some standalone Vite entries into index.js (#37085)
  * Fix various problems (#37077)
  * Fix issue label deletion with Actions tokens (#37013)
  * Hide delete branch or tag buttons in mirror or archived repositories. (#37006)
  * Fix org contact email not clearable once set (#36975)
  * Fix a bug when forking a repository in an organization (#36950)
  * Preserve sort order of exclusive labels from template repo (#36931)
  * Make container registry support Apple Container (basic auth) (#36920)
  * Fix the wrong push commits in the pull request when force push (#36914)
  * Add class "list-header-filters" to the div for projects (#36889)
  * Fix dbfs error handling (#36844)
  * Fix incorrect viewed files counter if reverted change was viewed (#36819)
  * Refactor avatar package, support default avatar fallback (#36788)
  * Fix README symlink resolution in subdirectories like .github (#36775)
  * Fix CSS stacking context issue in actions log (#36749)
  * Add gpg signing for merge rebase and update by rebase (#36701)
  * Delete non-exist branch should return 404 (#36694)
  * Fix `TestActionsCollaborativeOwner` (#36657)
  * Fix multi-arch Docker build SIGILL by splitting frontend stage (#36646)
  * Fix linguist-detectable attribute being ignored for configuration files (#36640)
  * Fix state desync in ComboMarkdownEditor (#36625)
  * Unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#36597)
  * Pull Request Pusher should be the author of the merge (#36581)
  * Fix various version parsing problems (#36553)
  * Fix highlight diff result (#36539)
  * Fix mirror sync parser and fix mirror messages (#36504)
  * Fix bug when list pull request commits (#36485)
  * Fix various bugs (#36446)
  * Fix issue filter menu layout (#36426)
  * Restrict branch naming when new change matches with protection rules (#36405)
  * Fix link/origin referrer and login redirect (#36279)
  * Generate IDs for HTML headings without id attribute (#36233)
  * Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
  * Fix issue close timeline icon (#36138)
  * Fix diff blob excerpt expansion (#35922)
  * Fix external render (#35727)
  * Fix review request webhook bug (#35339) (#35723)
  * Fix shutdown waitgroup panic (#35676)
  * Cleanup ActionRun creation (#35624)
  * Fix possible bug when migrating issues/pull requests (#33487)
  * Various fixes (#36697)
  * Apply notify/register mail flags during install load (#37120)
  * Repair duration display for bad stopped timestamps (#37121)
  * Fix(upgrade.sh): use HTTPS for GPG key import and restore SELinux context after upgrade (#36930)
  * Fix various trivial problems (#36921)
  * Fix various trivial problems (#36953)
  * Fix NuGet package upload error handling (#37074)
  * Fix CodeQL code scanning alerts (#36858)
  * Refactor issue sidebar and fix various problems (#37045)
  * Fix various problems (#37029)
  * Fix relative-time RangeError (#37021)
  * Fix chroma lexer mapping (#36629)
  * Fix typos and grammar in English locale (#36751)
  * Fix milestone/project text overflow in issue sidebar (#36741)
  * Fix `no-content` message not rendering after comment edit (#36733)
  * Fix theme loading in development (#36605)
  * Fix workflow run jobs API returning null steps (#36603)
  * Fix timeline event layout overflow with long content (#36595)
  * Fix minor UI issues in runner edit page (#36590)
  * Fix incorrect vendored detections (#36508)
  * Fix editorconfig not respected in PR Conversation view (#36492)
  * Don't create self-references in merged PRs (#36490)
  * Fix potential incorrect runID in run status update (#36437)
  * Fix file-tree ui error when adding files to repo without commits (#36312)
  * Improve image captcha contrast for dark mode (#36265)
  * Fix panic in blame view when a file has only a single commit (#36230)
  * Fix spelling error in migrate-storage cmd utility (#36226)
  * Fix code highlighting on blame page (#36157)
  * Fix nilnil in onedev downloader (#36154)
  * Fix actions lint (#36029)
  * Fix oauth2 session gob register (#36017)
  * Fix Arch repo pacman.conf snippet (#35825)
  * Fix a number of `strictNullChecks`-related issues (#35795)
  * Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (#36861)
  * Hide delete directory button for mirror or archive repository and disable the menu item if user have no permission (#36384)
  * Update message severity colors, fix navbar double border (#37019)
  * Inline and lazy-load EasyMDE CSS, fix border colors (#36714)
  * Closed milestones with no issues now show as 100% completed (#36220)
  * Add test for ExtendCommentTreePathLength migration and fix bugs (#35791)
  * Only turn links to current instance into hash links (#36237)
  * Fix typos in code comments: doesnt, dont, wont (#36890)
* REFACTOR
  * Replace Monaco with CodeMirror (#36764)
  * Replace CSRF cookie with `CrossOriginProtection` (#36183)
  * Replace index with id in actions routes (#36842)
  * Remove unnecessary function parameter (#35765)
  * Move jobparser from act repository to Gitea (#36699)
  * Refactor compare router param parse (#36105)
  * Optimize 'refreshAccesses' to perform update without removing then adding (#35702)
  * Clean up checkbox cursor styles (#37016)
  * Remove undocumented support of signing key in the repository git configuration file (#36143)
  * Switch `cmd/` to use constructor functions. (#36962)
  * Use `relative-time` to render absolute dates (#36238)
  * Some refactors about GetMergeBase (#36186)
  * Some small refactors (#36163)
  * Use gitRepo as parameter instead of repopath when invoking sign functions (#36162)
  * Move blame to gitrepo (#36161)
  * Move some functions to gitrepo package to reduce RepoPath reference directly (#36126)
  * Use gitrepo's clone and push when possible (#36093)
  * Remove mermaid margin workaround (#35732)
  * Move some functions to gitrepo package (#35543)
  * Move GetDiverging functions to gitrepo (#35524)
  * Use global lock instead of status pool for cron lock (#35507)
  * Use explicit mux instead of DefaultServeMux (#36276)
  * Use gitrepo's push function (#36245)
  * Pass request context to generateAdditionalHeadersForIssue (#36274)
  * Move assign project when creating pull request to the same database transaction (#36244)
  * Move catfile batch to a sub package of git module (#36232)
  * Use gitrepo.Repository instead of wikipath (#35398)
  * Use experimental go json v2 library (#35392)
  * Refactor template render (#36438)
  * Refactor GetRepoRawDiffForFile to avoid unnecessary pipe or goroutine (#36434)
  * Refactor text utility classes to Tailwind CSS (#36703)
  * Refactor git command stdio pipe (#36422)
  * Refactor git command context & pipeline (#36406)
  * Refactor git command stdio pipe (#36393)
  * Remove unused functions (#36672)
  * Refactor Actions Token Access (#35688)
  * Move commit related functions to gitrepo package (#35600)
  * Move archive function to repo_model and gitrepo (#35514)
  * Move some functions to gitrepo package (#35503)
  * Use git model to detect whether branch exist instead of gitrepo method (#35459)
  * Some refactor for repo path (#36251)
  * Extract helper functions from SearchIssues (#36158)
  * Refactor merge conan and container auth preserve actions taskID (#36560)
  * Refactor Nuget Auth to reuse Basic Auth Token Validation (#36558)
  * Refactor ActionsTaskID (#36503)
  * Refactor auth middleware (#36848)
  * Refactor code render and render control chars (#37078)
  * Clean up AppURL, remove legacy origin-url webcomponent (#37090)
  * Remove `util.URLJoin` and replace all callers with direct path concatenation (#36867)
  * Replace legacy tw-flex utility classes with flex-text-block/inline (#36778)
  * Mark unused&immature activitypub as "not implemented" (#36789)
* TESTING
  * Add e2e tests for server push events (#36879)
  * Rework e2e tests (#36634)
  * Add e2e reaction test, improve accessibility, enable parallel testing (#37081)
  * Increase e2e test timeouts on CI to fix flaky tests (#37053)
* BUILD
  * Convert locale files from ini to json format (#35489)
  * Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#36180)
  * Port away from `flake-utils` (#35675)
  * Remove nolint (#36252)
  * Update the Unlicense copy to latest version (#36636)
  * Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)
  * Replace `google/go-licenses` with custom generation (#36575)
  * Update go dependencies (#36548)
  * Bump appleboy/git-push-action from 1.0.0 to 1.2.0 (#36306)
  * Remove fomantic form module (#36222)
  * Bump setup-node to v6, re-enable cache (#36207)
  * Bump crowdin/github-action from 1 to 2 (#36204)
  * Revert "Bump alpine to 3.23 (#36185)" (#36202)
  * Update chroma to v2.21.1 (#36201)
  * Bump astral-sh/setup-uv from 6 to 7 (#36198)
  * Bump docker/build-push-action from 5 to 6 (#36197)
  * Bump aws-actions/configure-aws-credentials from 4 to 5 (#36196)
  * Bump dev-hanz-ops/install-gh-cli-action from 0.1.0 to 0.2.1 (#36195)
  * Add JSON linting (#36192)
  * Enable dependabot for actions (#36191)
  * Bump alpine to 3.23 (#36185)
  * Update chroma to v2.21.0 (#36171)
  * Update JS deps and eslint enhancements (#36147)
  * Update JS deps (#36091)
  * update golangci-lint to v2.7.0 (#36079)
  * Update JS deps, fix deprecations (#36040)
  * Update JS deps (#35978)
  * Add toolchain directive to go.mod (#35901)
  * Move `gitea-vet` to use `go tool` (#35878)
  * Update to go 1.25.4 (#35877)
  * Enable TypeScript `strictNullChecks` (#35843)
  * Enable `vue/require-typed-ref` eslint rule (#35764)
  * Update JS dependencies (#35759)
  * Move `codeformat` folder to tools (#35758)
  * Update dependencies (#35733)
  * Bump happy-dom from 20.0.0 to 20.0.2 (#35677)
  * Bump setup-go to v6 (#35660)
  * Update JS deps, misc tweaks (#35643)
  * Bump happy-dom from 19.0.2 to 20.0.0 (#35625)
  * Use bundled version of spectral (#35573)
  * Update JS and PY deps (#35565)
  * Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#35557)
  * Migrate from webpack to vite (#37002)
  * Update JS dependencies and misc tweaks (#37064)
  * Update to eslint 10 (#36925)
  * Optimize Docker build with dependency layer caching (#36864)
  * Update JS deps (#36850)
  * Update tool dependencies and fix new lint issues (#36702)
  * Remove redundant linter rules (#36658)
  * Move Fomantic dropdown CSS to custom module (#36530)
  * Remove and forbid `@ts-expect-error` (#36513)
  * Refactor git command stderr handling (#36402)
  * Enable gocheckcompilerdirectives linter (#36156)
  * Replace `lint-go-gopls` with additional `govet` linters (#36028)
  * Update golangci-lint to v2.6.0 (#35801)
  * Misc tool tweaks (#35734)
  * Add cache to container build (#35697)
  * Upgrade vite (#37126)
  * Update `setup-uv` to v8.0.0 (#37101)
  * Upgrade `go-git` to v5.17.2 and related dependencies (#37060)
  * Raise minimum Node.js version to 22.18.0 (#37058)
  * Upgrade `golang.org/x/image` to v0.38.0 (#37054)
  * Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#36876)
  * Enable eslint concurrency (#36878)
  * Vendor relative-time-element as local web component (#36853)
  * Update material-icon-theme v5.32.0 (#36832)
  * Update Go dependencies (#36781)
  * Upgrade minimatch (#36760)
  * Remove i18n backport tool at the moment because of translation format changed (#36643)
  * Update emoji data for Unicode 16 (#36596)
  * Update JS dependencies, adjust webpack config, misc fixes (#36431)
  * Update material-icon-theme to v5.31.0 (#36427)
  * Update JS and PY deps (#36383)
  * Bump alpine to 3.23, add platforms to `docker-dryrun` (#36379)
  * Update JS deps (#36354)
  * Update goldmark to v1.7.16 (#36343)
  * Update chroma to v2.22.0 (#36342)
* DOCS
  * Update AI Contribution Policy (#37022)
  * Update AGENTS.md with additional guidelines (#37018)
  * Add missing cron tasks to example ini (#37012)
  * Add AI Contribution Policy to CONTRIBUTING.md (#36651)
  * Minor punctuation improvement in CONTRIBUTING.md (#36291)
  * Add documentation for markdown anchor post-processing (#36443)
* MISC
  * Correct spelling (#36783)
  * Update Nix flake (#37110)
  * Update Nix flake (#37024)
  * Add valid github scopes (#36977)
  * Update Nix flake (#36943)
  * Update Nix flake (#36902)
  * Update Nix flake (#36857)
  * Update Nix flake (#36787)

Fix various problems (#37129)

* Fix #37128
    * Manually tested with various cases (issue, pr) X (close, reopen)
* Fix #36792
    * Fix the comment
* Fix #36755
    * Add a "sleep 3"
* Follow up #36697
    * Clarify the "attachment uploading" problem and function call

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>

* SECURITY

  * Toolchain Update to Go 1.25.6 (#36480) (#36487)
  * Adjust the toolchain version (#36537) (#36542)
  * Update toolchain to 1.25.8 for v1.25 (#36888)
  * Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716)
  * Fix get release draft permission check (#36659) (#36715)
  * Fix a bug user could change another user's primary email (#36586) (#36607)
  * Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851)
  * Add validation constraints for repository creation fields (#36671) (#36757)
  * Fix bug to check whether user can update pull request branch or rebase branch (#36465) (#36838)
  * Add migration http transport for push/sync mirror lfs (#36665) (#36691)
  * Fix track time list permission check (#36662) (#36744)
  * Fix track time issue id (#36664) (#36689)
  * Fix path resolving (#36734) (#36746)
  * Fix dump release asset bug (#36799) (#36839)
  * Fix org permission API visibility checks for hidden members and private orgs (#36798) (#36841)
  * Fix forwarded proto handling for public URL detection (#36810) (#36836)
  * Add a git grep search timeout (#36809) (#36835)
  * Fix oauth2 s256 (#36462) (#36477)
* ENHANCEMENTS
  * Make `security-check` informational only (#36681) (#36852)
  * Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (#36840)
  * Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (#36688) (#36692)
  * Upgrade gogit to 5.16.5 (#36687)
  * Add wrap to runner label list (#36565) (#36574)
  * Add dnf5 command for Fedora in RPM package instructions (#36527) (#36572)
  * Allow scroll propagation outside code editor (#36502) (#36510)
* BUGFIXES
  * Fix non-admins unable to automerge PRs from forks (#36833) (#36843)
  * Fix bug when pushing mirror with wiki (#36795) (#36807)
  * Fix artifacts v4 backend upload problems (#36805) (#36834)
  * Fix CRAN package version validation to allow more than 4 version components (#36813) (#36821)
  * Fix force push time-line commit comments of pull request (#36653) (#36717)
  * Fix SVG height calculation in diff viewer (#36748) (#36750)
  * Fix push time bug (#36693) (#36713)
  * Fix bug the protected branch rule name is conflicted with renamed branch name (#36650) (#36661)
  * Fix bug when do LFS GC (#36500) (#36608)
  * Fix focus lost bugs in the Monaco editor (#36609)
  * Reprocess htmx content after loading more files (#36568) (#36577)
  * Fix assignee sidebar links and empty placeholder (#36559) (#36563)
  * Fix issues filter dropdown showing empty label scope section (#36535) (#36544)
  * Fix various mermaid bugs (#36547) (#36552)
  * Fix data race when uploading container blobs concurrently (#36524) (#36526)
  * Correct spacing between username and bot label (#36473) (#36484)

* SECURITY

  * Release attachments must belong to the intended repo (#36347) (#36375)
  * Fix permission check on org project operations (#36318) (#36373)
  * Clean watches when make a repository private and check permission when send release emails (#36319) (#36370)
  * Add more check for stopwatch read or list (#36340) (#36368)
  * Fix openid setting check (#36346) (#36361)
  * Fix cancel auto merge bug (#36341) (#36356)
  * Fix delete attachment check (#36320) (#36355)
  * LFS locks must belong to the intended repo (#36344) (#36349)
  * Fix bug on notification read (#36339) #36387
* ENHANCEMENTS
  * Add more routes to the "expensive" list (#36290)
  * Make "commit statuses" API accept slashes in "ref" (#36264) (#36275)
* BUGFIXES
  * Fix markdown newline handling during IME composition (#36421) #36424
  * Fix missing repository id when migrating release attachments (#36389)
  * Fix bug when compare in the pull request (#36363) (#36372)
  * Fix incorrect text content detection (#36364) (#36369)
  * Fill missing `has_code` in repository api (#36338) (#36359)
  * Fix notifications pagination query parameters (#36351) (#36358)
  * Fix some trivial problems (#36336) (#36337)
  * Prevent panic when GitLab release has more links than sources (#36295) (#36305)
  * Fix stats bug when syncing release (#36285) (#36294)
  * Always honor user's choice for "delete branch after merge" (#36281) (#36286)
  * Use the requested host for LFS links (#36242) (#36258)
  * Fix panic when get editor config file (#36241) (#36247)
  * Fix regression in writing authorized principals (#36213) (#36218)
  * Fix WebAuthn error checking (#36219) (#36235)

* SECURITY

  * Bump toolchain to go1.25.5, misc fixes (#36082)
* ENHANCEMENTS
  * Add strikethrough button to markdown editor (#36087) (#36104)
  * Add "site admin" back to profile menu (#36010) (#36013)
  * Improve math rendering (#36124) (#36125)
* BUGFIXES
  * Check user visibility when redirecting to a renamed user (#36148) (#36159)
  * Fix various bugs (#36139) (#36151)
  * Fix bug when viewing the commit diff page with non-ANSI files (#36149) (#36150)
  * Hide RSS icon when viewing a file not under a branch (#36135) (#36141)
  * Fix SVG size calulation, only use `style` attribute (#36133) (#36134)
  * Make Golang correctly delete temp files during uploading (#36128) (#36129)
  * Fix the bug when ssh clone with redirect user or repository (#36039) (#36090)
  * Use Golang net/smtp instead of gomail's smtp to send email (#36055) (#36083)
  * Fix edit user email bug in API (#36068) (#36081)
  * Fix bug when updating user email (#36058) (#36066)
  * Fix incorrect viewed files counter if file has changed (#36009) (#36047)
  * Fix container registry error handling (#36021) (#36037)
  * Fix webAuthn insecure error view (#36165) (#36179)
  * Fix some file icon ui (#36078) (#36088)
  * Fix Actions `pull_request.paths` being triggered incorrectly by rebase (#36045) (#36054)
  * Fix error handling in mailer and wiki services (#36041) (#36053)
  * Fix bugs when comparing and creating pull request (#36166) (#36144)

* SECURITY

  * Upgrade golang.org/x/crypto to 0.45.0 (#35985) (#35988)
  * Fix various permission & login related bugs (#36002) (#36004)
* ENHANCEMENTS
  * Display source code downloads last for release attachments (#35897) (#35903)
  * Change project default column icon to 'star' (#35967) (#35979)
* BUGFIXES
  * Allow empty commit when merging pull request with squash style (#35989) (#36003)
  * Fix container push tag overwriting (#35936) (#35954)
  * Fix corrupted external render content (#35946) and upgrade golang.org/x packages (#35950)
  * Limit reading bytes instead of ReadAll (#35928) (#35934)
  * Use correct form field for allowed force push users in branch protection API (#35894) (#35908)
  * Fix team member access check (#35899) (#35905)
  * Fix conda null depend issue (#35900) (#35902)
  * Set the dates to now when not specified by the caller (#35861) (#35874)
  * Fix gogit ListEntriesRecursiveWithSize (#35862)
  * Misc CSS fixes (#35888) (#35981)
  * Don't show unnecessary error message to end users for DeleteBranchAfterMerge (#35937) (#35941)
  * Load jQuery as early as possible to support custom scripts (#35926) (#35929)
  * Allow to display embed images/pdfs when SERVE_DIRECT was enabled on MinIO storage (#35882) (#35917)
  * Make OAuth2 issuer configurable (#35915) (#35916)
  * Fix #35763: Add proper page title for project pages (#35773) (#35909)
  * Fix avatar upload error handling (#35887) (#35890)
  * Contribution heatmap improvements (#35876) (#35880)
  * Remove padding override on `.ui .sha.label` (#35864) (#35873)
  * Fix pull description code label background (#35865) (#35870)

* BUGFIXES

  * Make ACME email optional (#35849) #35857
  * Add a doctor command to fix inconsistent run status (#35840) (#35845)
  * Remove wrong code (#35846)
  * Fix viewed files number is not right if not all files loaded (#35821) (#35844)
  * Fix incorrect pull request counter (#35819) (#35841)
  * Upgrade go mail to 0.7.2 and fix the bug (#35833) (#35837)
  * Revert gomail to v0.7.0 to fix sending mail failed (#35816) (#35824)
  * Fix clone mixed bug (#35810) (#35822)
  * Fix cli "Before" handling (#35797) (#35808)
  * Improve and fix markup code preview rendering (#35777) (#35787)
  * Fix actions rerun bug (#35783) (#35784)
  * Fix actions schedule update issue (#35767) (#35774)
  * Fix circular spin animation direction (#35785) (#35823)
  * Fix file extension on gogs.png (#35793) (#35799)
  * Add pnpm to Snapcraft (#35778)

* BREAKING

  * Return 201 Created for CreateVariable API responses (#34517)
  * Add label 'state' to metric 'gitea_users' (#34326)
* SECURITY
  * Upgrade security public key (#34956)
  * Also include all security fixes in 1.24.x after 1.25.0-rc0
* FEATURES
  * Stream repo zip/tar.gz/bundle achives by default (#35487)
  * Use configurable remote name for git commands (#35172)
  * Send email on Workflow Run Success/Failure (#34982)
  * Refactor OpenIDConnect to support SSH/FullName sync (#34978)
  * Refactor repo contents API and add "contents-ext" API (#34822)
  * Add support for 3D/CAD file formats preview (#34794)
  * Improve instance wide ssh commit signing (#34341)
  * Edit file workflow for creating a fork and proposing changes (#34240)
  * Follow file symlinks in the UI to their target (#28835)
  * Allow renaming/moving binary/LFS files in the UI (#34350)
* PERFORMANCE
  * Improve the performance when detecting the file editable (#34653)
* ENHANCEMENTS
  * Enable more markdown paste features in textarea editor (#35494)
  * Don't store repo archives on `gitea dump` (#35467)
  * Always return the relevant status information, even if no status exists. (#35335)
  * Add start time on perf trace because it seems some steps haven't been recorded. (#35282)
  * Remove deprecated auth sources (#35272)
  * When sorting issues by nearest due date, issues without due date should be sorted ascending (#35267)
  * Disable field count validation of CSV viewer (#35228)
  * Add `has_code` to repository REST API (#35214)
  * Display pull request in merged commit view (#35202)
  * Support Basic Authentication for archive downloads (#35087)
  * Add hover background to table rows in user and repo admin page (#35072)
  * Partially refresh notifications list (#35010)
  * Also display "recently pushed branch" alert on PR view (#35001)
  * Refactor time tracker UI (#34983)
  * Improve CLI commands (#34973)
  * Improve project & label color picker and image scroll (#34971)
  * Improve NuGet API Parity (#21291) (#34940)
  * Support getting last commit message using contents-ext API (#34904)
  * Adds title on branch commit counts (#34869)
  * Add "Cancel workflow run" button to Actions list page (#34817)
  * Improve img lazy loading (#34804)
  * Forks repository list page follow other repositories page (#34784)
  * Add ff_only parameter to POST /repos/{owner}/{repo}/merge-upstream (#34770)
  * Rework delete org and rename org UI (#34762)
  * Improve nuget/rubygems package registries (#34741)
  * Add repo file tree item link behavior (#34730)
  * Add issue delete notifier (#34592)
  * Improve Actions list (#34530)
  * Add a default tab on repo header when migrating (#34503)
  * Add post-installation redirect based on admin account status (#34493)
  * Trigger 'unlabeled' event when label is Deleted from PR (#34316)
  * Support annotated tags when using create release API (#31840)
  * Use lfs label for lfs file rather than a long description (#34363)
  * Add "View workflow file" to Actions list page (#34538)
  * Move organization's visibility change to danger zone. (#34814)
  * Don't block site admin's operation if SECRET_KEY is lost (#35721)
  * Make restricted users can access public repositories (#35693)
  * The status icon of the Action step is consistent with GitHub (#35618) #35621
* BUGFIXES
  * Update tab title when navigating file tree (#35757) #35772
  * Fix "ref-issue" handling in markup (#35739) #35771
  * Fix webhook to prevent tag events from bypassing branch filters targets (#35567) #35577
  * Fix markup init after issue comment editing (#35536) #35537
  * Fix creating pull request failure when the target branch name is the same as some tag (#35552) #35582
  * Fix auto-expand and auto-scroll for actions logs (#35570) (#35583) #35586
  * Use inputs context when parsing workflows (#35590) #35595
  * Fix diffpatch API endpoint (#35610) #35613
  * Creating push comments before invoke pull request checking (#35647) #35668
  * Fix missing Close when error occurs and abused connection pool (#35658) #35670
  * Fix build (#35674)
  * Use LFS object size instead of blob size when viewing a LFS file (#35679)
  * Fix workflow run event status while rerunning a failed job (#35689)
  * Avoid emoji mismatch and allow to only enable chosen emojis (#35692)
  * Refactor legacy code, fix LFS auth bypass, fix symlink bypass (#35708)
  * Fix various trivial problems (#35714)
  * Fix attachment file size limit in server backend (#35519)
  * Honor delete branch on merge repo setting when using merge API (#35488)
  * Fix external render, make iframe render work (#35727, #35730)
  * Upgrade go mail to 0.7.2 (#35748)
  * Revert #18491, fix oauth2 client link account (#35745)
  * Fix different behavior in status check pattern matching with double stars (#35474)
  * Fix overflow in notifications list (#35446)
  * Fix package link setting can only list limited repositories (#35394)
  * Extend comment treepath length (#35389)
  * Fix font-size in inline code comment preview (#35209)
  * Move git config/remote to gitrepo package and add global lock to resolve possible conflict when updating repository git config file (#35151)
  * Change some columns from text to longtext and fix column wrong type caused by xorm (#35141)
  * Redirect to a presigned URL of HEAD for HEAD requests (#35088)
  * Fix git commit committer parsing and add some tests (#35007)
  * Fix OCI manifest parser (#34797)
  * Refactor FindOrgOptions to use enum instead of bool, fix membership visibility (#34629)
  * Fix notification count positioning for variable-width elements (#34597)
  * Keeping consistent between UI and API about combined commit status state and fix some bugs (#34562)
  * Fix possible panic (#34508)
  * Fix autofocus behavior (#34397)
  * Fix Actions API (#35204)
  * Fix ListWorkflowRuns OpenAPI response model. (#35026)
  * Small fix in Pull Requests page (#34612)
  * Fix http auth header parsing (#34936)
  * Fix modal + form abuse (#34921)
  * Fix PR toggle WIP (#34920)
  * Fix log fmt (#34810)
  * Replace stopwatch toggle with explicit start/stop actions (#34818)
  * Fix some package registry problems (#34759)
  * Fix RPM package download routing & missing package version count (#34909)
  * Fix repo search input height (#34330)
  * Fix "The sidebar of the repository file list does not have a fixed height #34298" (#34321)
  * Fix minor typos in two files #HSFDPMUW (#34944)
  * Fix actions skipped commit status indicator (#34507)
  * Fix job status aggregation logic (#35000)
  * Fix broken OneDev migration caused by various REST API changes in OneDev 7.8.0 and later (#35216)
  * Fix typo in oauth2_full_name_claim_name string (#35199)
  * Fix typo in locale_en-US.ini (#35196)
* API
  * Exposing TimeEstimate field in the API (#35475)
  * UpdateBranch API supports renaming a branch (#35374)
  * Add `owner` and `parent` fields clarification to docs (#35023)
  * Improve OAuth2 provider (correct Issuer, respect ENABLED) (#34966)
  * Add a `login`/`login-name`/`username` disambiguation to affected endpoint parameters and response/request models (#34901)
  * Do not mutate incoming options to SearchRepositoryByName (#34553)
  * Do not mutate incoming options to RenderUserSearch and SearchUsers  (#34544)
  * Export repo's manual merge settings (#34502)
  * Add date range filtering to commit retrieval endpoints (#34497)
  * Add endpoint deleting workflow run (#34337)
  * Add workflow_run api + webhook (#33964)
* REFACTOR
  * Move updateref and removeref to gitrepo and remove unnecessary open repository (#35511)
  * Remove unused param `doer` (#34545)
  * Split GetLatestCommitStatus as two functions (#34535)
  * Use gitrepo.SetDefaultBranch when set default branch of wiki repository (#33911)
  * Refactor editor (#34780)
  * Refactor packages (#34777)
  * Refactor container package (#34877)
  * Refactor "change file" API (#34855)
  * Rename pull request GetGitRefName to GetGitHeadRefName to prepare introducing GetGitMergeRefName (#35093)
  * Move git command to git/gitcmd (#35483)
  * Use db.WithTx/WithTx2 instead of TxContext when possible (#35428)
  * Support Node.js 22.6 with type stripping (#35427)
  * Migrate tools and configs to typescript, require node.js >= 22.18.0 (#35421)
  * Check user and repo for redirects when using git via SSH transport (#35416)
  * Remove the duplicated function GetTags (#35375)
  * Refactor to use reflect.TypeFor (#35370)
  * Deleting branch could delete broken branch which has database record but git branch is missing (#35360)
  * Exit with success when already up to date (#35312)
  * Split admin config settings templates to make it maintain easier (#35294)
  * A small refactor to use context in the service layer (#35179)
  * Refactor and update mail templates (#35150)
  * Use db.WithTx/WithTx2 instead of TxContext when possible (#35130)
  * Align `issue-title-buttons` with `list-header` (#35018)
  * Add Notifications section in User Settings (#35008)
  * Tweak placement of diff file menu (#34999)
  * Refactor mail template and support preview (#34990)
  * Rerun job only when run is done (#34970)
  * Merge index.js (#34963)
  * Refactor "delete-button" to "link-action" (#34962)
  * Refactor webhook and fix feishu/lark secret (#34961)
  * Exclude devtest.ts from tailwindcss (#34935)
  * Refactor head navbar icons (#34922)
  * Improve html escape (#34911)
  * Improve tags list page (#34898)
  * Improve `labels-list` rendering (#34846)
  * Remove unused variable HUGO_VERSION (#34840)
  * Correct migration tab name (#34826)
  * Refactor template helper (#34819)
  * Use `shallowRef` instead of `ref` in `.vue` files where possible (#34813)
  * Use standalone function to update repository cols (#34811)
  * Refactor wiki (#34805)
  * Remove unnecessary duplicate code (#34733)
  * Refactor embedded assets and drop unnecessary dependencies (#34692)
  * Update x/crypto package and make builtin SSH use default parameters (#34667)
  * Add `--color-logo`, matching the logo's primary color (#34639)
  * Add openssh-keygen to rootless image (#34625)
  * Replace update repository function in some places (#34566)
  * Change "rejected" to "changes requested" in 3rd party PR review notification (#34481)
  * Remove legacy template helper functions (#34426)
  * Use run-name and evaluate workflow variables (#34301)
  * Move HasWiki to repository service package (#33912)
  * Move some functions from package git to gitrepo (#33910)
* TESTING
  * Add webhook test for push event (#34442)
  * Add a webhook push test for dev branch (#34421)
  * Add migrations tests (#34456) (#34498)
* STYLE
  * Enforce explanation for necessary nolints and fix bugs (#34883)
  * Fix remaining issues after `gopls modernize` formatting (#34771)
  * Update gofumpt, add go.mod ignore directive (#35434)
  * Enforce nolint scope (#34851)
  * Enable gocritic `equalFold` and fix issues (#34952)
  * Run `gopls modernize` on codebase (#34751)
  * Upgrade `gopls` to v0.19.0, add `make fix` (#34772)
* BUILD
  * bump archives&rar dep (#35637) #35638
  * Use github.com/mholt/archives replace github.com/mholt/archiver (#35390)
  * Update JS and PY dependencies (#35444)
  * Upgrade devcontainer go version to 1.24.6 (#35298)
  * Upgrade golang to 1.25.1 and add descriptions for the swagger structs' fields (#35418)
  * Update JS and PY deps (#35191)
  * Update JS and PY dependencies (#34391)
  * Update go tool dependencies (#34845)
  * Update `uint8-to-base64`, remove type stub (#34844)
  * Switch to `@resvg/resvg-wasm` for `generate-images` (#35415)
  * Switch to pnpm (#35274)
  * Update chroma to v2.20.0 (#35220)
  * Migrate to urfave v3 (#34510)
  * Update JS deps, regenerate SVGs (#34640)
  * Upgrade dependencies (#35384)
  * Bump `@github/relative-time-element` to v4.4.8 (#34413)
  * Update JS dependencies (#34951)
  * Upgrade orgmode to v1.8.0 (#34721)
  * Raise minimum Node.js version to 20, test on 24 (#34713)
  * Update JS deps (#34701)
  * Upgrade htmx to 2.0.6 (#34887)
  * Update eslint to v9 (#35485)
  * Update js dependencies (#35429)
  * Clean up npm dependencies (#35508)
  * Clean up npm dependencies (#35484)
  * Bump setup-node to v5 (#35448)
* MISC
  * Add gitignore rules to exclude LLM instruction files (#35076)
  * Gitignore: Visual Studio settings folder (#34375)
  * Improve language in en-US locale strings (#35124)
  * Fixed all grammatical errors in locale_en-US.ini (#35053)
  * Docs/fix typo and grammar in CONTRIBUTING.md (#35024)
  * Improve english grammar and readability in locale_en-US.ini (#35017)