CVS commit: pkgsrc/www/gitea

Module Name:	pkgsrc
Committed By:	khorben
Date:		Fri Aug 14 23:48:56 UTC 2026

Modified Files:
	pkgsrc/www/gitea: Makefile PLIST distinfo go-modules.mk

Log Message:
www/gitea: update to 1.27.2

Changes in 1.27.2:

* SECURITY
  - Fix: update collaborator access mode and httpsign
  - Refactor: external render
  - Fix(actions): resolve pull_request_target reusable workflows at the
    base commit
  - Refactor: markup render
  - Fix(deps): update dependency mermaid to v11.16.1
  - Fix(auth): set WebAuthn user verification per request
  - Fix: render highlight language
* ENHANCEMENTS
  - enhance: add missing npm package metadata properties
*  BUGFIXES
  - fix(actions): keep github.event.inputs as strings for
    workflow_dispatch
  - fix(actions): let a rerun of selected jobs read the previous
    attempt's artifacts
  - fix(lfs): accept successful transfer responses
  - fix(packages): ignore nested Package.swift
  - fix: drop newline-bearing member names in arch ParsePackage
  - fix(storage): fix Azure Blob dump failing with file does not exist
  - fix(migration): migration deletion returned json redirection
  - fix(ui): change underlines to default browser style
  - fix(actions): allow cancelling runs without running jobs
  - fix(actions): evaluate each ${{ }} part on its own
  - fix(actions): write an action task report in one transaction
  - fix: markup link
  - fix: set a minio part size when the content size is unknown
  - fix: bad path escape in subpath archive download
  - fix: remove the pull merge box from UI when the refreshed page
    doesn't contain it
  - fix(markdown): fix double strikethough on code
  - fix(lfs): failed upload deletes a concurrent upload's meta object
  - fix: correct full url when using sub-path
  - fix: avoid markup render panic
  - fix(ui): too many participants shown in commit avatar stacks
  - fix: support HEAD requests on Alpine registry APKINDEX.tar.gz
  - fix(migrations): use all configured GitHub tokens

Changes in 1.27.1:

* SECURITY
  - Fix: orgmode render include path
  - Fix: git patch apply
* API
  - fix(api): align Swagger schemas for UserSettings and
    TopicListResponse
* ENHANCEMENTS
  - enhance: improve diff contrast in light and dark themes
* BUGFIXES
  - fix: skip OIDC end-session after password login for OAuth2 users
  - fix: make Actions log parser support multiple line message encoding
  - fix(actions): use base branch ref for pull_request_target context
  - fix(actions): skip already-approved runs in ApproveRuns
  - fix: orgmode render include path
  - fix(actions): cancel tasks immediately when the runner stopped
    reporting
  - fix(issues): fix label bulk-load key and reduce log noise in
    LoadLabel
  - fix(actions): improve runner list status sorting, labels and task
    job links
  - fix(actions): correctness and hardening fixes
  - fix(repo): prevent double-write redirect collisions on dependency
    errors, fix ui
  - fix: delete repo-scoped rows of seven more tables when deleting a
    repository
  - fix(webhook): remove slack channel name check
  - fix: download dropdown menu clipped on the branches page
  - fix(project): prevent database mutations on invalid MoveIssues
    payload
  - fix(actions): make SingleWorkflow.Marshal round-trip multi-line run
    blocks (stop silent job stranding)
  - fix(file-tree): handle submodule links and missing view container
  - fix(actions): fail unexpandable reusable workflow callers and
    decouple the job emitter's cross-run processing
  - fix: keep serving valid ACME cert when renewal fails at startup
  - fix: branch protection user list
  - fix(pulls): respect diff.orderFile in diff file tree
  - fix(issue): make issue action (issue list batch operation) elements
    have correct attributes
  - fix(actions): support matrix when evaluating workflow if expression
  - fix(actions): align status icon span for Safari rendering
  - fix: revert git clone http redirection forbidden
  - fix: clean up orphaned user-keyed tables in deleteUser
  - fix(actions): coerce workflow_dispatch boolean inputs to native
    types
  - fix: make the merge box button red if some checks fail
  - fix(pull): sign the commit when updating a branch by merge
  - fix: make commit message merge correctly
  - fix(actions): explain why a blocked or waiting job has not started
  - fix(actions): make cancelled() work in job if evaluation
  - fix(actions): show retention info on hover for expired artifacts
  - fix(actions): group reusable-workflow matrix legs in the workflow
    graph
  - fix: full file highlighting for git diff with CR char
  - fix(packages): serve noarch Alpine index for any requested
    architecture
  - fix: 500 error when updating user visibility
  - fix(actions): make job list item fully clickable
  - fix: mail template for push event
  - fix: make "test push webhook" always work
  - fix(actions): prevent bulk actions from affecting all runners
  - fix(org): align follow button and wrap description
  - fix(actions): populate github.event for scheduled runs
* MISC
  - refactor: git patch apply

Changes in 1.27.0:

* BREAKING
  - Feat(actions)!: improve support for reusable workflows
  - Use Content-Security-Policy: script nonce
* SECURITY
  - Fix: various security fixes
  - Fix(security): harden access checks and migration validation
  - Fix: enforce public-only token scope and harden push options /
    locale parsing
  - Fix(pull): re-evaluate review official flag on target branch change
  - Fix(api): stop leaking private repo metadata after access revocation
  - Fix(lfs): require proof of possession for cross-repo objects
  - Fix(mirror): disable HTTP redirects on pull mirror sync
  - Fix: golang html template url escaping
  - Fix(release): validate web attachment renames against allowed types
  - Fix(release): gate draft release attachments on web download
    endpoints
  - Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1
    [security]
  - Fix(oauth): restrict introspection to the token's client
  - Fix(api): don't expose private org membership via public_members
  - Fix(actions): deny fork-PR cross-repo access via collaborative owner
  - Fix(migrations): prevent path traversal in repository restore
* FEATURES
  - Feat(actions): add workflow status badge modal
  - Feat(actions): support owner-level and global scoped workflows
  - Feat(api): support ref suffixes in compare
  - Feat(actions): implement jobs.<job_id>.continue-on-error
  - Feat(actions): show run status on browser tab favicon
  - Feat(api): add token introspection and self-deletion endpoint
  - Feat(api): add q parameter to list branches API for server-side
    filtering
  - Feat(repo): split repository creation limit into user and org scopes
  - Feat(actions): bulk delete, disable and enable runners in admin UI
  - Feat(actions): List workflows that were executed once but got
    removed from the default branch
  - Feat(org): add team visibility so org members can discover teams
  - Feat: add raw diff/patch endpoint for repository comparisons
  - Feat: Add avatar stacks
  - Feat(actions): add job summaries (GITHUB_STEP_SUMMARY)
  - Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support
  - Support for Custom URI Schemes in OAuth2 Redirect URIs
  - Feat(orgs): Add search bar for organization members tab page
  - Feat(api): Add assignees APIs
  - Feat(api): Add GET
    /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs
  - Serve OpenAPI 3.0 spec at /openapi.v1.json
  - Add project column picker to issue and pull request sidebar
  - Allow multiple projects per issue and pull requests
  - Feat(ui): add "follow rename" to file commit history list
  - Feat(ssh): auto generate additional ssh keys
* ENHANCEMENTS
  - Enhance(actions): only create filtered-out workflow commit status
    for required contexts
  - Enhance: allow builtin default git config options to be overridden
  - Enhance: allow MathML core elements
  - Enhance(markup): improve issue title rendering
  - Enhance(actions): set descriptive browser tab title on run view
  - Enhance: Migrate remaining gopkg.in/yaml.v3 usages to
    go.yaml.in/yaml/v4
  - Enhance(actions): show workflow name from YAML instead of filename
  - Feat(actions): add before/after to PR synchronize event payload
  - Enhance(actions): add branch filters to run list
  - Enhance(actions): Make Summary UI more beautiful with more infos
  - Feat: add copy button to action step header, improve other copy
    buttons
  - Fix(icon): use repo-forked icon to display forks count
  - Feat(api): add sort and order query parameters to job list endpoints
  - Feat(api): add last_sync to repository API
  - Enhance: Adjust Workflow Graph styling
  - Improve code editor text selection and clean up lint enablement
  - Add mirror auth updates to repo edit API and settings
  - Replace olivere/elastic with REST API client, add OpenSearch support
  - Feat: Add default PR branch update style setting
  - Fix inconsistent disabled styling on logged-out repo header buttons
  - Allow fast-forward-only merge when signed commits are required
  - Enhance styling in actions page
  - Fix: improve actions status icons and texts
  - Make Markdown fenced code block work with more syntaxes
  - Fix: Sort action run jobs by JobID and Name with matrix examples
  - Add API endpoint to reply to pull request review comments
* PERFORMANCE
  - Perf(actions): debounce runner heartbeat writes and throttle task
    picks
  - Perf(web): sort the action_run query by a repo-scoped index when
    possible
  - Perf: Various performance regression fixes
  - Perf: extend action c_u index to include created_unix for faster
    dashboard feeds
  - Batch-load related data in actions run, job, and task API endpoints
* BUGFIXES
  - Fix(util): reject invalid characters between time-estimate units
  - Fix: represent a deleted assignee team as a Ghost team
  - Fix(turnstile): route CAPTCHA verification through the configured
    proxy
  - Fix: refresh pull request merge box when the commit status is
    pending
  - Fix: actions task state concurrent update
  - Fix(actions): keep workflow run trailing on one row with long branch
    names
  - Fix(web): use locale-aware date formatting for contribution calendar
    tooltips
  - Fix: co-author detection
  - Fix: incorrect co-author detection on commit page
  - Fix(ui): restore commits table column widths
  - Fix: minio init check
  - Fix: org project view assignee list
  - Fix(actions): release claimed task if context is cancelled during
    FetchTask
  - Fix(actions): make runner list pagination order deterministic
  - Fix: Improve since/until when counting commits for X-Total-Count
  - Fix(actions): prevent chevron overlap with log text when timestamps
    are enabled
  - Fix(workflows): branch protection status checks fail when workflow
    uses on: paths filter
  - Fix(oauth2): persist linkAccountData during auto-link 2FA flow
  - Fix(actions): allow Actions bot to push to protected branches
  - Fix(actions): include all aggregable run statuses in status filter
  - Fix(archiver): use serializable repo-archive queue payload
  - Fix: update npm dependencies, fix misc issues
  - Fix(api): respect since/until when counting commits for
    X-Total-Count
  - Fix: codemirror regressions
  - Fix(api): support HEAD requests on all API GET endpoints
  - Fix(actions): Cleanup workflow status badge code
  - Fix(web): Correctly align the "disabled" label on larger workflow
    names
  - Fix(actions): don't swallow HTML entities into linkified URLs
  - Fix(packages): accept npm "repository" and "bin" in string form
  - Fix(actions): fix 500 error when canceling a canceling task
  - Fix(deps): update module golang.org/x/image to v0.43.0 [security]
  - Fix(mssql): convert legacy DATETIME columns to DATETIME2
  - Fix(api): deny private org member enumeration via /members
  - Fix(actions): ensure all waiting jobs get runners in large workflows
  - Fix(deps): update go dependencies
  - Fix(deps): update npm dependencies
  - Fix(cli): default must-change-password to false for bot users
  - Fix(actions): show run index in run view and fix summary graph
    height
  - Fix: csp
  - Fix(deps): update npm dependencies
  - Fix(mssql): expand legacy issue and comment long-text columns
  - Fix(packages): validate debian distribution and component names
  - Fix(packages): validate module version in goproxy ParsePackage
  - Fix(deps): update dependency esbuild to v0.28.1 [security]
  - Fix: git push hook post receive
  - Fix(ui): prevent commit status popup overflowing its row
  - Fix: validate gem name in rubygems parseMetadataFile
  - Fix: commit display name
  - Fix: csp regressions
  - Fix: api error message
  - Fix(deps): update npm dependencies
  - Fix: pgsql lint
  - Fix(indexer): fix assignee filters in issue search
  - Fix: various dropdown problems
  - Fix: refactor git error handling and make archive streaming handle
    non-existing commit id
  - Fix: raise git required version to 2.13
  - Fix: remove "no-transfrom" from the cache-control header
  - Fix(deps): update module github.com/google/go-github/v87 to v88
  - Fix: use committer time where ever possible as default
  - Fix(deps): update npm dependencies, remove nolyfill
  - Fix(deps): update go dependencies
  - Fix(pull): preserve squash message trailers and additional commit
    messages
  - Fix(deps): update module golang.org/x/image to v0.41.0 [security]
  - Fix: support ##[command] log prefix in action run UI
  - Fix(deps): update module github.com/google/go-github/v86 to v87
  - Fix(deps): update npm dependencies
  - Fix(deps): update go dependencies
  - Fix(frontend): resolve Vite assets by manifest source path
  - Fix(locales): Replace hardcoded strings
  - Fix(packages): render markdown links relative to linked repo
  - Fix: persist mirror repository metadata
  - Fix cmd tests by mocking builtin paths
  - Add form-fetch-action to some forms, fix "fetch action" resp bug
  - Feat: execute post run cleanup when workflow is cancelled
  - Fix relative-time error and improve global error handler
  - Refactor flash message and remove SanitizeHTML template func
* TESTING
  - Test(e2e): fix race in pdf file render test
  - Test: compare key file contents instead of FileInfo in TestInitKeys
  - Test: speed up two tests
  - Test: Fix random failure test
  - Test: fix flaky issue-comment close test
  - Test: enable WAL for sqlite integration tests
  - Test: fix flaky TestResourceIndex and reduce its runtime
  - Test: run TestAPIRepoMigrate offline via a local clone source
  - Ci: shard tests and reduce redundant work
  - Test(e2e): run playwright via container
  - Remove external service dependencies in migration tests
* BUILD
  - Fix(actions): authenticate snapcraft before nightly remote build
  - Ci: cap Elasticsearch heap in db-tests
  - Build(snap): publish nightly version to snapcraft via actions
  - Ci: split pgsql shards into plain jobs, dedupe setup actions
  - Ci: narrow files-changed frontend filter
  - Ci: add zizmor to lint-actions
  - Chore: clean up "contrib" dir
  - Fix: snap build (main branch)
  - Ci: Also lint json5 files
  - Feat(editor): broaden language detection in web code editor
  - Build: update pnpm to v11
  - Refactor(deps): migrate from nektos/act fork to gitea/runner
  - Refactor: lint bare fill/stroke colors, add vars for git graph color
    series
  - Update go js py dependencies
  - Ci: lint PR titles with commitlint
  - Chore: upgrade Go version in devcontainer image to 1.26
  - Update GitHub Actions to latest major versions
  - Update go js dependencies
  - Fail vite build on rolldown warnings via NODE_ENV=test
  - Remove htmx
  - Replace custom Go formatter with golangci-lint fmt
  - Refactor htmx and fetch-action related code
  - Integrate renovate bot for all dependency updates
  - Build(sign): move to sigstore
* DOCS
  - Docs: update changelog for 1.26.3 & 1.26.4
  - Docs: fix duplicated word in foreachref doc comment
  - Docs: Clarify criteria for becoming a merger
  - Docs: Publish TOC Election Result 2026
  - Docs: mark openapi3 as autogenerated in attributes
  - Docs: add development setup guide
* MISC
  - Revert(sign): restore gpg
  - Refactor: replace legacy delete-button with link-action
  - Refactor(actions): read runner capabilities from proto field
  - Refactor(api): clarify APIError message usage and fix legacy lint
    error
  - Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to
    avoid zero value fetching wrong database record
  - Fix(deps): update go dependencies
  - Ci: Fix sync PR labels from the conventional-commit title
  - Ci: tweak files-changed, add free-disk-space
  - Fix(deps): update module golang.org/x/crypto to v0.52.0 [security]
  - Test(e2e): add comment, release, star, PR and fork tests
  - Chore: simplify issue and pull request templates
  - Chore: Update giteabot to fix failure when backport
  - Fix(api): handle partial failures in push mirror synchronization
    gracefully
  - Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to
    v2.26.0
  - Ci: split giteabot workflow
  - Fix(deps): update npm dependencies
  - Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go
  - Fix(deps): update module google.golang.org/grpc to v1.81.1
  - Ci: fix cache-related issues
  - Chore: fix tests
  - Fix(deps): update module github.com/google/go-github/v85 to v86
  - Fix(deps): update npm dependencies
  - Fix(deps): update go dependencies
  - Chore(deps): update action dependencies
  - Fix(markup): wrap indented code blocks for the code-copy button
  - Chore(db): introduce db.Session and db.EngineMigration interfaces
  - Feat(web): also display PR counts in repo list
  - Refactor(glob): use strings.Builder for regexp compilation
  - Chore(doctor): remove four obsolete doctor check implementations
  - Refactor(org): simplify owner-team org repo creation logic
  - Refactor: move workflowpattern into modules/actions
  - Chore: clean up tests
  - Style: misc UI fixes
  - Ci: add shellcheck linter
  - Fix: catch and fix more lint problems
  - Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e
    test
  - Fix(deps): update npm dependencies
  - Ci(renovate): update Go import paths on major bumps
  - Fix(deps): update go dependencies (major)
  - Chore(deps): update action dependencies (major)
  - Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0
  - Fix(deps): update npm dependencies
  - Refactor(log): replace log.Critical with log.Error
  - Build(deps): bump fast-uri from 3.1.0 to 3.1.2
  - Feat(oauth): Support AWS Cognito OAuth2 provider
  - Chore(deps): update action dependencies
  - Ci: allow chore type in PR title lint
  - Refactor: only reset a database table when the table's data was
    changed
  - Ci: increase renovate frequency and fix
    RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS
  - Refactor: use modernc sqlite driver as default
  - Docs: fix 4 typos in CHANGELOG.md
  - Fix(deps): update go dependencies
  - Chore(deps): update action dependencies
  - Refactor pull request view (6)
  - Fix: redirect early CLI console logger to stderr
  - Refactor "flex-list" to "flex-divided-list"
  - Refactor compare diff/pull page (1)
  - Refactor pull request view (4)
  - Update 1.26.1 changelog in main
  - Refactor: use named Permission field in Repository struct instead of
    anonymous embedding
  - Refactor: serve site manifest via /assets/site-manifest.json
    endpoint
  - Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites
  - Update Block a user form
  - Move review request functions to a standalone file
  - Feat(security): set X-Content-Type-Options: nosniff by default
  - Enable strict TypeScript, add errorMessage helper
  - Refactor frontend tw-justify-between layouts to flex-left-right
  - Update Nix flake
  - Fix Repository transferring page
  - Remove SubmitEvent polyfill
  - Remove dead code identified by deadcode tool
  - Upgrade go-git to v5.18.0
  - Don't add useless labels which will bother changelog generation
  - Move heatmap to first-party code
  - Tests/integration: simplify code
  - Add pagination and search box to org teams list
  - Remove error returns from crypto random helpers and callers
  - Add ExternalIDClaim option for OAuth2 OIDC auth source
  - Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries
  - Refactor "htmx" to "fetch action"
  - Update go js py dependencies
  - Add comment for the design of "user activity time"
  - Remove outdated RunUser logic
  - Models/fixtures: add "DO NOT add more test data" comment to all yml
    fixture files
  - Update javascript dependencies
  - Update go dependencies
  - Frontport changelog of v1.26.0-rc0
  - Introduce ActionRunAttempt to represent each execution of a run
  - Workflow Artifact Info Hover
  - Extend issue context popup beyond markdown content
  - Add bulk repository deletion for organizations
  - Feat: Add bypass allowlist for branch protection


To generate a diff of this commit:
cvs rdiff -u -r1.139 -r1.140 pkgsrc/www/gitea/Makefile
cvs rdiff -u -r1.21 -r1.22 pkgsrc/www/gitea/PLIST
cvs rdiff -u -r1.44 -r1.45 pkgsrc/www/gitea/distinfo
cvs rdiff -u -r1.12 -r1.13 pkgsrc/www/gitea/go-modules.mk

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.