mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-07-24 18:38:42 +00:00
941 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Renovate Bot
|
5719f6ddf1 |
Update module code.forgejo.org/forgejo/runner/v12 to v12.13.1 (forgejo) (#13515)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.13.0` → `v12.13.1` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.13.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.13.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.13.0...v12.13.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/issues/1633): fix(jobparser): nil dereference when EvaluateIf is called w/ cancelled() expr <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI2MC4yIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13515 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
eb8d24640a |
Update module golang.org/x/net to v0.57.0 (forgejo) (#13508)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13508 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
4e1c50f1f7 |
Update module golang.org/x/image to v0.44.0 (forgejo) (#13506)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13506 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
7dd81bf953 |
Update module golang.org/x/crypto to v0.54.0 (forgejo) (#13472)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13472 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
d73f7fb2b7 |
Update module code.forgejo.org/forgejo/runner/v12 to v12.13.0 (forgejo) (#13453)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.12.0` → `v12.13.0` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.13.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.13.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.12.0...v12.13.0) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1590): <!--number 1590 --><!--line 0 --><!--description ZmVhdChpbnRlcnByZXRlcik6IEFkZCBzdXBwb3J0IGZvciBgY2FzZWAgc3RhdGVtZW50cw==-->feat(interpreter): Add support for `case` statements<!--description--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1583): <!--number 1583 --><!--line 0 --><!--description Zml4OiBzdGFuZGFyZGl6ZSBydW5uZXIub3MgYW5kIHJ1bm5lci5hcmNo-->fix: standardize runner.os and runner.arch<!--description--> - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1603): <!--number 1603 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgYnVpbGR4IHRvIHYwLjM1LjA=-->Update dependency buildx to v0.35.0<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1601): <!--number 1601 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8tYnVpbGQtcHVibGlzaCBhY3Rpb24gdG8gdjUuNy4z-->Update <https://data.forgejo.org/forgejo/forgejo-build-publish> action to v5.7.3<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1600): <!--number 1600 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjIuMw==-->Update <https://data.forgejo.org/actions/setup-forgejo> action to v3.2.3<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1599): <!--number 1599 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS43LjM=-->Update dependency forgejo/release-notes-assistant to v1.7.3<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1598): <!--number 1598 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTU=-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.15<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1597): <!--number 1597 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjUuMTI=-->Update go toolchain directive to v1.25.12<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1595): <!--number 1595 --><!--line 0 --><!--description VXBkYXRlIGZvcmdlam8tcnVubmVyIHRvIHYxMi4xMi4w-->Update forgejo-runner to v12.12.0<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1591): <!--number 1591 --><!--line 0 --><!--description dGVzdDogdXNlIGZsYWdzIGluc3RlYWQgb2YgZW52IHZhcmlhYmxlcyBmb3Igc2tpcHBpbmcgdGVzdHM=-->test: use flags instead of env variables for skipping tests<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1589): <!--number 1589 --><!--line 0 --><!--description ZG9jczogcmV2aXNlIHRlc3Rpbmcgc2VjdGlvbiBvZiBSRUFETUU=-->docs: revise testing section of README<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1585): <!--number 1585 --><!--line 0 --><!--description dGVzdDogdXNlIGVudmlyb25tZW50IHZhcmlhYmxlIGZvciBza2lwcGluZyBEb2NrZXIgdGVzdHM=-->test: use environment variable for skipping Docker tests<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI2MC4yIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13453 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
6edcbeb69f |
Update module github.com/klauspost/compress to v1.19.0 (forgejo) (#13456)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13456 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
3b5ff5e855 |
Update module github.com/buildkite/terminal-to-html/v3 to v3.17.1 (forgejo) (#13455)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13455 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
11676ee20f |
Update module code.forgejo.org/go-chi/captcha to v1.0.3 (forgejo) (#13448)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13448 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
f6383fc4ed |
Update module github.com/go-openapi/spec to v0.22.6 (forgejo) (#13096)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13096 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
7da78a1715 |
Update module github.com/yuin/goldmark to v1.8.4 (forgejo) (#13430)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13430 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
dc8d9948cf |
Update module github.com/mattn/go-sqlite3 to v1.14.48 (forgejo) (#13428)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13428 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
1ca432165f |
Update module github.com/go-chi/chi/v5 to v5.3.1 (forgejo) (#13427)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13427 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
9dbe0d1181 |
Update github.com/google/pprof digest to e2ebcbe (forgejo) (#13264)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13264 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
5da9f78f52 |
Update module github.com/redis/go-redis/v9 to v9.21.0 (forgejo) (#13255)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13255 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
327cbada8a |
Update module github.com/go-chi/chi/v5 to v5.3.0 (forgejo) (#12697)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12697 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
0d9527dd35 |
Update module github.com/caddyserver/certmagic to v0.25.4 (forgejo) (#13200)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13200 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
19a5039fe5 |
Update module github.com/mattn/go-sqlite3 to v1.14.47 (forgejo) (#13162)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13162 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
af0a1ab993 |
Update module code.forgejo.org/forgejo/runner/v12 to v12.12.0 (forgejo) (#13153)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.11.1` → `v12.12.0` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.12.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.12.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.11.1...v12.12.0) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1571): <!--number 1571 --><!--line 0 --><!--description ZmVhdDogcGVyLWxhYmVsIGNvbnRhaW5lciBwbGF0Zm9ybSBzcGVjaWZpY2F0aW9u-->feat: per-label container platform specification<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1575): <!--number 1575 --><!--line 0 --><!--description ZmVhdChqb2JwYXJzZXIpOiBhZGQgc3VwcG9ydCBmb3IgYHJ1bi1uYW1lYA==-->feat(jobparser): add support for `run-name`<!--description--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1577): <!--number 1577 --><!--line 0 --><!--description Zml4KGV4ZWMpOiBGaXggYGV2ZW50X25hbWVgL2BGT1JHRUpPX0VWRU5UX05BTUVgIG5vdCBiZWluZyBzZXQ=-->fix(exec): Fix `event_name`/`FORGEJO_EVENT_NAME` not being set<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1572): <!--number 1572 --><!--line 0 --><!--description Zml4OiBleHByZXNzaW9uIGV2YWx1YXRpb24gZml4ZXMgZGlzY292ZXJlZCB3aGlsZSByZWZhY3RvcmluZyAnaWYnIGRldGVjdGlvbg==-->fix: expression evaluation fixes discovered while refactoring 'if' detection<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIyMi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13153 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
2048d2347b |
Update x/tools to v0.46.0 (forgejo) (#13145)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/tools](https://pkg.go.dev/golang.org/x/tools) | [`v0.45.0` → `v0.46.0`](https://cs.opensource.google/go/x/tools/+/refs/tags/v0.45.0...refs/tags/v0.46.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled because a matching PR was automerged previously. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIyMi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13145 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
dde0125478 |
Update module golang.org/x/image to v0.43.0 (forgejo) (#13134)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) | [`v0.42.0` → `v0.43.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.42.0...refs/tags/v0.43.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIyMi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13134 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
0b1f20c27c |
Update module github.com/mattn/go-sqlite3 to v1.14.45 (forgejo) (#12969)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12969 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Mathieu Fenniak
|
bd4201ed25 |
chore: remove EXIF stripping capability due to usage of AGPL licensed exif-terminator library (#13105)
In #9638, repository and user avatars had an EXIF removal capability added to them. Unfortunately, this capability was added with an AGPL licensed library, exif-terminator, which is incompatible with Forgejo's license. This was not detected by license check automation at the time. This PR removes the capability in order to fix the license compatibility. The `forgejo doctor avatar-strip-exif` is retained with a warning output that it is not supported. Reopens: forgejo/forgejo#9608 ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13105 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> Reviewed-by: 0ko <0ko@noreply.codeberg.org> |
||
|
Renovate Bot
|
3be06159b4 |
Update module code.forgejo.org/forgejo/runner/v12 to v12.11.1 (forgejo) (#13074)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.11.0` → `v12.11.1` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.11.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.11.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.11.0...v12.11.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1570): <!--number 1570 --><!--line 0 --><!--description Zml4KGRvY2tlcik6IGhvbm91ciBET0NLRVJfVExTX1ZFUklGWSBhbmQgRE9DS0VSX0NFUlRfUEFUSCB3aGVuIERPQ0tFUl9IT1NUIGlzIHNldA==-->fix(docker): honour DOCKER\_TLS\_VERIFY and DOCKER\_CERT\_PATH when DOCKER\_HOST is set<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuNSIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC41IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13074 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
a893d5e339 |
Update module code.forgejo.org/forgejo/runner/v12 to v12.11.0 (forgejo) (#13062)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.10.2` → `v12.11.0` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.11.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.11.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.10.2...v12.11.0) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1563): <!--number 1563 --><!--line 0 --><!--description ZmVhdChqb2JwYXJzZXIpOiBpbXBsZW1lbnQgam9icGFyc2VyIGNhcGFiaWxpdHkgdG8gZXZhbHVhdGUgJ2lmJyBjbGF1c2Vz-->feat(jobparser): implement jobparser capability to evaluate 'if' clauses<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1541): <!--number 1541 --><!--line 0 --><!--description ZmVhdDogaWRlbnRpZnkgcnVubmVyIGJ5IGl0cyBVVUlEIGluIHdvcmtmbG93IGxvZ3M=-->feat: identify runner by its UUID in workflow logs<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1534): <!--number 1534 --><!--line 0 --><!--description ZmVhdChqb2JwYXJzZXIpOiBwcm92aWRlIGRldGVjdGlvbiBjYXBhYmlsaXR5IGZvciBgcGVybWlzc2lvbnNgIGJlaW5nIGRlZmluZWQ=-->feat(jobparser): provide detection capability for `permissions` being defined<!--description--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1559): <!--number 1559 --><!--line 0 --><!--description Zml4OiBldmFsdWF0ZSBpZiBjb25kaXRpb25zIG9mIGlubmVyIGpvYnMgYmVmb3JlIGNvbWJpbmluZyByZXN1bHRz-->fix: evaluate if conditions of inner jobs before combining results<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1553): <!--number 1553 --><!--line 0 --><!--description Zml4OiBtYWtlIGxvb2stdXAgb2YgbWF0cml4IHZhbHVlcyBjYXNlLWluc2Vuc2l0aXZlIHdoZW4gZXhwYW5kaW5nIHdvcmtmbG93cw==-->fix: make look-up of matrix values case-insensitive when expanding workflows<!--description--> - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1561): <!--number 1561 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1ydW5uZXItc2VydmljZS15cSB0byB2NC41My4z-->Update dependency forgejo-runner-service-yq to v4.53.3<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1558): <!--number 1558 --><!--line 0 --><!--description VXBkYXRlIGZvcmdlam8vZm9yZ2Vqby1idWlsZC1wdWJsaXNoIHRvIHY1LjcuMg==-->Update forgejo/forgejo-build-publish to v5.7.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1546): <!--number 1546 --><!--line 0 --><!--description Y2k6IGFkZCBjYXBhYmlsaXR5IHRvIHJ1biB0ZXN0aW5nIG9uIGFybTY0-->ci: add capability to run testing on arm64<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1557): <!--number 1557 --><!--line 0 --><!--description VXBkYXRlIGFjdGlvbnMvc2V0dXAtZm9yZ2VqbyB0byB2My4yLjE=-->Update actions/setup-forgejo to v3.2.1<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1556): <!--number 1556 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS43LjI=-->Update dependency forgejo/release-notes-assistant to v1.7.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1555): <!--number 1555 --><!--line 0 --><!--description UGluIGRlcGVuZGVuY2llcw==-->Pin dependencies<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1548): <!--number 1548 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjUuMTEgW1NFQ1VSSVRZXQ==-->Update go toolchain directive to v1.25.11 \[SECURITY]<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1551): <!--number 1551 --><!--line 0 --><!--description Y2hvcmU6IGNoYW5nZSBzeXN0ZW1kIGV4YW1wbGUgVGltZW91dFN0b3BTZWMgLT4gaW5maW5pdHk=-->chore: change systemd example TimeoutStopSec -> infinity<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1545): <!--number 1545 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvb2NpL2NpIERvY2tlciB0YWcgdG8gdjI=-->Update data.forgejo.org/oci/ci Docker tag to v2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1542): <!--number 1542 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb25uZWN0cnBjLmNvbS9jb25uZWN0IHRvIHYxLjIwLjA=-->Update module connectrpc.com/connect to v1.20.0<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1507): <!--number 1507 --><!--line 0 --><!--description cmVmYWN0b3I6IGV4dHJhY3QgZG9ja2VyIGJhY2stZW5kIGludG8gYWN0L2NvbnRhaW5lci9kb2NrZXIgcGFja2FnZQ==-->refactor: extract docker back-end into act/container/docker package<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1538): <!--number 1538 --><!--line 0 --><!--description VXBkYXRlIGZvcmdlam8tcnVubmVyIHRvIHYxMi4xMC4y-->Update forgejo-runner to v12.10.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1537): <!--number 1537 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS43LjE=-->Update dependency forgejo/release-notes-assistant to v1.7.1<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1536): <!--number 1536 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1ydW5uZXItc2VydmljZS15cSB0byB2NC41My4y-->Update dependency forgejo-runner-service-yq to v4.53.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1535): <!--number 1535 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTI=-->Update <https://data.forgejo.org/actions/setup-forgejo> action to v3.1.12<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1533): <!--number 1533 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgYnVpbGR4IHRvIHYwLjM0LjE=-->Update dependency buildx to v0.34.1<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuNSIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC41IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13062 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
48cdf76a39 |
Update module github.com/redis/go-redis/v9 to v9.20.1 (forgejo) (#13061)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `v9.20.0` → `v9.20.1` |  |  | --- ### Release Notes <details> <summary>redis/go-redis (github.com/redis/go-redis/v9)</summary> ### [`v9.20.1`](https://github.com/redis/go-redis/releases/tag/v9.20.1): 9.20.1 [Compare Source](https://github.com/redis/go-redis/compare/v9.20.0...v9.20.1) This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement. #### 🚀 Highlights ##### RESP3 pub/sub message loss fixed `PeekPushNotificationName` previously inspected only the bytes already buffered by `bufio`, so when a push frame header straddled a buffer fill boundary it could return a **truncated** notification name (e.g. `"messa"` instead of `"message"`). The push processor then mis-routed the frame and `ReadReply` silently dropped it, causing intermittent RESP3 pub/sub message loss. The peek now grows its window (36 bytes → up to 4 KiB) and reads more from the connection until the header is complete, cleanly separating incomplete prefixes from corrupt frames (including overflow-safe bulk-length handling). Fixes [#​3839](https://github.com/redis/go-redis/issues/3839). ([#​3842](https://github.com/redis/go-redis/pull/3842)) by [@​ndyakov](https://github.com/ndyakov) #### 🐛 Bug Fixes - **RESP3 push peeking**: `PeekPushNotificationName` no longer returns a truncated notification name when a push frame header spans a buffer boundary, preventing silent RESP3 pub/sub message loss (fixes [#​3839](https://github.com/redis/go-redis/issues/3839)) ([#​3842](https://github.com/redis/go-redis/pull/3842)) by [@​ndyakov](https://github.com/ndyakov) - **`FT.HYBRID` vector params**: Vector data is now always sent via `PARAMS` with auto-generated param names (`__vector_param_N`, with collision avoidance) when `VectorParamName` is omitted, since Redis no longer accepts inline vector blobs; the `FTHybridOptions.Params` map is no longer mutated, so the same options struct can be reused across calls ([#​3844](https://github.com/redis/go-redis/pull/3844)) by [@​ndyakov](https://github.com/ndyakov) - **`CLUSTER SHARDS` forward compatibility**: Unknown shard- and node-level attributes in the `CLUSTER SHARDS` reply are now skipped via `DiscardNext()` instead of erroring, so clients keep working when the server introduces new fields ([#​3843](https://github.com/redis/go-redis/pull/3843)) by [@​madolson](https://github.com/madolson) - **PubSub double reconnect**: `PubSub.releaseConn` no longer reconnects twice when a connection is both unusable (or pending handoff) and reports a bad-connection error, avoiding a wasted connection establish-then-close cycle ([#​3833](https://github.com/redis/go-redis/pull/3833)) by [@​cxljs](https://github.com/cxljs) #### 👥 Contributors We'd like to thank all the contributors who worked on this release! [@​cxljs](https://github.com/cxljs), [@​madolson](https://github.com/madolson), [@​ndyakov](https://github.com/ndyakov) *** **Full Changelog**: <https://github.com/redis/go-redis/compare/v9.20.0...v9.20.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuNSIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC41IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13061 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
2191c8459a | Update module github.com/urfave/cli/v3 to v3.9.1 (forgejo) (#13047) | ||
|
Renovate Bot
|
37db207344 |
Update module golang.org/x/net to v0.56.0 (forgejo) (#13048)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.55.0` → `v0.56.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.55.0...refs/tags/v0.56.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuNSIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC41IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13048 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
d9b0deddd8 |
Update module golang.org/x/crypto to v0.53.0 (forgejo) (#13010)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13010 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
a15302c609 |
Update module golang.org/x/image to v0.42.0 (forgejo) (#13011)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13011 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
c93e1330ac |
Update module gopkg.in/ini.v1 to v1.67.3 (forgejo) (#12999)
See https://codeberg.org/forgejo/forgejo/issues/11453 for context on performance Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12999 Reviewed-by: 0ko <0ko@noreply.codeberg.org> |
||
|
Renovate Bot
|
377c455062 |
Update module github.com/jackc/pgx/v5 to v5.10.0 (forgejo) (#12914)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12914 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
eda4c387b8 |
Update go-openapi packages to v0.22.5 (forgejo) (#12909)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12909 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
c4520693aa |
Update module github.com/SaveTheRbtz/zstd-seekable-format-go/pkg to v0.9.0 (forgejo) (#12884)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12884 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
57fde010dd |
Update module github.com/redis/go-redis/v9 to v9.20.0 (forgejo) (#12804)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `v9.19.0` → `v9.20.0` |  |  | --- ### Release Notes <details> <summary>redis/go-redis (github.com/redis/go-redis/v9)</summary> ### [`v9.20.0`](https://github.com/redis/go-redis/releases/tag/v9.20.0): 9.20.0 [Compare Source](https://github.com/redis/go-redis/compare/v9.19.0...v9.20.0) #### 🚀 Highlights ##### Redis 8.8 Support This release adds support for **Redis 8.8**. The README's supported-versions list now includes Redis 8.8 alongside 8.0/8.2/8.4, and CI exercises the `8.8` client-libs-test image across the full suite (Makefile, build workflow, doctests, run-tests action, and docker-compose). Coverage for the new commands that ship in the 8.x line, rounded out in this release: - **`AR*` array data type** ([#​3813](https://github.com/redis/go-redis/pull/3813)) — new array data structure, exposed via the `ArrayCmdable` interface (see the experimental-features highlight below). - **`INCREX`** ([#​3816](https://github.com/redis/go-redis/pull/3816)) — atomic increment with expiration in a single round-trip. - **`XNACK`** ([#​3790](https://github.com/redis/go-redis/pull/3790)) — explicit negative-acknowledge of pending stream entries. - **`XAUTOCLAIM` PEL deletes** ([#​3798](https://github.com/redis/go-redis/pull/3798)) — `XAUTOCLAIM`/`XAUTOCLAIMJUSTID` now return the list of deleted message IDs from the pending entries list. - **`TS.RANGE` multiple aggregators** ([#​3791](https://github.com/redis/go-redis/pull/3791)) — `TS.RANGE`/`TS.REVRANGE`/`TS.MRANGE`/`TS.MREVRANGE` accept multiple aggregators in a single call. - **`Z(UNION|INTER|DIFF)` `COUNT` aggregator** ([#​3802](https://github.com/redis/go-redis/pull/3802)) — `COUNT` reducer for sorted-set set operations. - **`JSON.SET FPHA`** ([#​3797](https://github.com/redis/go-redis/pull/3797)) — new `FPHA` argument that specifies the floating-point type for homogeneous FP arrays. CI image bump ([#​3814](https://github.com/redis/go-redis/pull/3814)) by [@​ofekshenawa](https://github.com/ofekshenawa). Command coverage contributions by [@​cxljs](https://github.com/cxljs), [@​elena-kolevska](https://github.com/elena-kolevska), [@​Khukharr](https://github.com/Khukharr), [@​ndyakov](https://github.com/ndyakov), and [@​ofekshenawa](https://github.com/ofekshenawa). ##### Stable RESP3 for RediSearch (`UnstableResp3` deprecated) `FT.SEARCH`, `FT.AGGREGATE`, `FT.INFO`, `FT.SPELLCHECK`, and `FT.SYNDUMP` now parse RESP3 (map) responses into the same typed result objects as RESP2 — `Val()` and `Result()` work uniformly on both protocols, no flag required. Previously, RESP3 search responses required `UnstableResp3: true` and were returned as opaque maps accessible only via `RawResult()` / `RawVal()`. As a result, the `UnstableResp3` option is now a **no-op** across every options struct (`Options`, `ClusterOptions`, `UniversalOptions`, `FailoverOptions`, `RingOptions`) and has been marked `// Deprecated:`. The field is retained for backwards compatibility — existing code that sets `UnstableResp3: true` will continue to compile and behave identically — but it will be removed in a future release and new code should not set it. `RawResult()` / `RawVal()` continue to work for callers that prefer the raw RESP payload. ([#​3741](https://github.com/redis/go-redis/pull/3741)) by [@​ndyakov](https://github.com/ndyakov) ##### Experimental Array Data Structure Commands Adds an experimental `ArrayCmdable` interface with the `AR*` command family (`ARSet`, `ARGet`, `ARGetRange`, `ARMSet`, `ARMGet`, `ARDel`, `ARDelRange`, `ARScan`, `ARSeek`, `ARNext`, `ARLastItems`, `ARGrep`, `ARGrepWithValues`, `ARInfo`/`ARInfoFull`, and typed reducers `AROpSum`/`AROpMin`/`AROpMax`/`AROpAnd`/`AROpOr`/`AROpXor`/`AROpMatch`/`AROpUsed`) for working with Redis 8.8's new array data type. **API is experimental and may change in a future release.** ([#​3813](https://github.com/redis/go-redis/pull/3813)) by [@​cxljs](https://github.com/cxljs) #### ✨ New Features - **RESP3 search parser**: First-class RESP3 parsing for `FT.SEARCH`/`FT.AGGREGATE`/`FT.INFO`/`FT.SPELLCHECK`/`FT.SYNDUMP` responses with backwards compatibility for RESP2 ([#​3741](https://github.com/redis/go-redis/pull/3741)) by [@​ndyakov](https://github.com/ndyakov) - **INCREX**: New `INCREX` command support — atomic increment with expiration ([#​3816](https://github.com/redis/go-redis/pull/3816)) by [@​ndyakov](https://github.com/ndyakov) - **XNACK**: Client support for the `XNACK` stream command for explicitly negative-acknowledging pending entries ([#​3790](https://github.com/redis/go-redis/pull/3790)) by [@​elena-kolevska](https://github.com/elena-kolevska) - **TS range multiple aggregators**: `TS.RANGE`/`TS.REVRANGE`/`TS.MRANGE`/`TS.MREVRANGE` now accept multiple aggregators in a single call ([#​3791](https://github.com/redis/go-redis/pull/3791)) by [@​elena-kolevska](https://github.com/elena-kolevska) - **`XAutoClaim` deleted IDs**: `XAUTOCLAIM`/`XAUTOCLAIMJUSTID` now return the list of deleted message IDs from the PEL ([#​3798](https://github.com/redis/go-redis/pull/3798)) by [@​Khukharr](https://github.com/Khukharr) - **`JSON.SET FPHA`**: `JSON.SET` accepts a new `FPHA` argument that specifies the floating-point type for homogeneous floating-point arrays ([#​3797](https://github.com/redis/go-redis/pull/3797)) by [@​ndyakov](https://github.com/ndyakov) - **Sorted-set union/intersection COUNT**: `ZUNION`/`ZINTER`/`ZDIFF` aggregator now supports `COUNT` ([#​3802](https://github.com/redis/go-redis/pull/3802)) by [@​ofekshenawa](https://github.com/ofekshenawa) - **`FT.HYBRID` vector validation**: Validates hybrid-search vector input types and adds proper typed vector parameters ([#​3756](https://github.com/redis/go-redis/pull/3756)) by [@​DengY11](https://github.com/DengY11) - **Cluster pool wait stats**: `ClusterClient.PoolStats()` now accumulates `WaitCount` and `WaitDurationNs` across all node pools (previously always zero) ([#​3809](https://github.com/redis/go-redis/pull/3809)) by [@​LINKIWI](https://github.com/LINKIWI) #### 🐛 Bug Fixes - **TLS-only Cluster PubSub**: `CLUSTER SLOTS` port-0 entries now fall back to the origin endpoint's port, fixing `dial tcp <ip>:0: connection refused` on TLS-only clusters started with `--port 0 --tls-port <port>` (fixes [#​3726](https://github.com/redis/go-redis/issues/3726)) ([#​3828](https://github.com/redis/go-redis/pull/3828)) by [@​ndyakov](https://github.com/ndyakov) - **Sharded PubSub reconnect routing**: `PubSub.conn()` now passes both regular (`c.channels`) and sharded (`c.schannels`) channels into the per-PubSub `newConn` closure. Previously, `ClusterClient.SSubscribe`-only PubSubs reconnected to a random node (because the routing closure saw an empty channel list), the `SSUBSCRIBE` was sent to the wrong shard, and the resulting `MOVED` reply was silently dropped ([#​3829](https://github.com/redis/go-redis/pull/3829)) by [@​ndyakov](https://github.com/ndyakov) - **ClusterClient `Watch` retry**: User errors returned from a `Watch` callback are no longer subjected to cluster-retry classification; transient cluster errors still retry, but a callback returning e.g. `net.ErrClosed` short-circuits immediately ([#​3821](https://github.com/redis/go-redis/pull/3821)) by [@​obiyang](https://github.com/obiyang) - **Sentinel concurrent-probe leak**: `MasterAddr`'s concurrent sentinel probe now closes the non-winning sentinel clients instead of leaking them ([#​3827](https://github.com/redis/go-redis/pull/3827)) by [@​cxljs](https://github.com/cxljs) - **Sentinel rediscovery loop on master-only setups**: `replicaAddrs` no longer tears down the cached sentinel client when the replica list is empty, eliminating a continuous rediscovery loop on master-only Sentinel deployments that flooded logs and added per-operation latency ([#​3795](https://github.com/redis/go-redis/pull/3795)) by [@​shahyash2609](https://github.com/shahyash2609) - **Pool `CloseConn` hooks**: `Pool.CloseConn` now triggers registered hooks, fixing a memory leak when connections are closed explicitly rather than via the normal removal path ([#​3818](https://github.com/redis/go-redis/pull/3818)) by [@​ndyakov](https://github.com/ndyakov) - **Dial TCP error redirection**: Wrapped `dial tcp` errors are now correctly classified as redirectable so cluster routing can recover from a single unreachable node ([#​3810](https://github.com/redis/go-redis/pull/3810)) by [@​vladisa88](https://github.com/vladisa88) - **Pool `Close` health checks**: `ConnPool.Close` now only runs health checks against idle connections, avoiding spurious activity on connections still in use ([#​3805](https://github.com/redis/go-redis/pull/3805)) by [@​ndyakov](https://github.com/ndyakov) - **VLinks return type**: Fixed the return type of `VLINKS`/`VLINKSWITHSCORES` vector-set replies ([#​3820](https://github.com/redis/go-redis/pull/3820)) by [@​romanpovol](https://github.com/romanpovol) #### 🧪 Testing & Infrastructure - **Flaky tests**: Stabilized several flaky tests in the sentinel and pool suites ([#​3815](https://github.com/redis/go-redis/pull/3815)) by [@​ndyakov](https://github.com/ndyakov) - **Sentinel failover metric race**: Fixed a data race in the sentinel failover metric test ([#​3824](https://github.com/redis/go-redis/pull/3824)) by [@​cxljs](https://github.com/cxljs) - **`waitForSentinelClusterStable` post-conditions**: The sentinel test harness now waits for replicas to be fully connected (not just present in the count) and is robust to randomized spec ordering after failover specs, eliminating an intermittent `Expected master to equal slave` flake ([#​3830](https://github.com/redis/go-redis/pull/3830)) by [@​ndyakov](https://github.com/ndyakov) - **`govulncheck` workflow**: New scheduled GitHub Actions workflow runs `govulncheck` on every push, PR, and weekly, surfacing newly disclosed Go vulnerabilities even when no code changes ([#​3779](https://github.com/redis/go-redis/pull/3779)) by [@​solardome](https://github.com/solardome) - **CI Redis 8.8-rc1**: CI now exercises the 8.8-rc1 Redis image ([#​3814](https://github.com/redis/go-redis/pull/3814)) by [@​ofekshenawa](https://github.com/ofekshenawa) #### 🧰 Maintenance - **`Cmd.Slot()` lookup refactor**: Caches the per-command `CommandInfo` and short-circuits keyless commands before the switch dispatch, removing redundant `Peek` calls ([#​3804](https://github.com/redis/go-redis/pull/3804)) by [@​retr0-kernel](https://github.com/retr0-kernel) - **stdlib `math/rand`**: Replaced `internal/rand` with `math/rand` from the standard library now that the minimum Go version is 1.24 ([#​3823](https://github.com/redis/go-redis/pull/3823)) by [@​cxljs](https://github.com/cxljs) - **ConnPool queue channel**: Removed the unused queue channel from `ConnPool`, trimming the pool's footprint ([#​3826](https://github.com/redis/go-redis/pull/3826)) by [@​cxljs](https://github.com/cxljs) - **Extra packages LICENSE**: Added a LICENSE file to each `extra/*` package ([#​3817](https://github.com/redis/go-redis/pull/3817)) by [@​ndyakov](https://github.com/ndyakov) - **README & CI image**: Documentation refresh and bumped the default CI image tag ([#​3822](https://github.com/redis/go-redis/pull/3822)) by [@​ndyakov](https://github.com/ndyakov) #### 👥 Contributors We'd like to thank all the contributors who worked on this release! [@​cxljs](https://github.com/cxljs), [@​DengY11](https://github.com/DengY11), [@​elena-kolevska](https://github.com/elena-kolevska), [@​Khukharr](https://github.com/Khukharr), [@​LINKIWI](https://github.com/LINKIWI), [@​ndyakov](https://github.com/ndyakov), [@​obiyang](https://github.com/obiyang), [@​ofekshenawa](https://github.com/ofekshenawa), [@​retr0-kernel](https://github.com/retr0-kernel), [@​romanpovol](https://github.com/romanpovol), [@​shahyash2609](https://github.com/shahyash2609), [@​solardome](https://github.com/solardome), [@​vladisa88](https://github.com/vladisa88) *** **Full Changelog**: <https://github.com/redis/go-redis/compare/v9.19.0...v9.20.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12804 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
c37f5a96a9 |
Update google.golang.org/grpc (indirect) to v1.79.3 [SECURITY] (forgejo) (#12794)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.75.0` → `v1.79.3` |  |  | --- ### gRPC-Go has an authorization bypass via missing leading slash in :path [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) / [GHSA-p77j-4mvh-x3m3](https://github.com/advisories/GHSA-p77j-4mvh-x3m3) / [GO-2026-4762](https://pkg.go.dev/vuln/GO-2026-4762) <details> <summary>More information</summary> #### Details ##### Impact _What kind of vulnerability is it? Who is impacted?_ It is an **Authorization Bypass** resulting from **Improper Input Validation** of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. **Who is impacted?** This affects gRPC-Go servers that meet both of the following criteria: 1. They use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`. 2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. ##### Patches _Has the problem been patched? What versions should users upgrade to?_ Yes, the issue has been patched. The fix ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. Users should upgrade to the following versions (or newer): * **v1.79.3** * The latest **master** branch. It is recommended that all users employing path-based authorization (especially `grpc/authz`) upgrade as soon as the patch is available in a tagged release. ##### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: ##### 1. Use a Validating Interceptor (Recommended Mitigation) Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs: ```go func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) { if info.FullMethod == "" || info.FullMethod[0] != '/' { return nil, status.Errorf(codes.Unimplemented, "malformed method name") } return handler(ctx, req) } // Ensure this is the FIRST interceptor in your chain s := grpc.NewServer( grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor), ) ``` ##### 2. Infrastructure-Level Normalization If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the `:path` header does not start with a leading slash. ##### 3. Policy Hardening Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs. #### Severity - CVSS Score: 9.1 / 10 (Critical) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` #### References - [https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3](https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3) - [https://nvd.nist.gov/vuln/detail/CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [https://github.com/grpc/grpc-go](https://github.com/grpc/grpc-go) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) / [GHSA-p77j-4mvh-x3m3](https://github.com/advisories/GHSA-p77j-4mvh-x3m3) / [GO-2026-4762](https://pkg.go.dev/vuln/GO-2026-4762) <details> <summary>More information</summary> #### Details Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc #### Severity Unknown #### References - [https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3](https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-4762) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.79.3`](https://github.com/grpc/grpc-go/releases/tag/v1.79.3): Release 1.79.3 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.79.2...v1.79.3) ### Security - server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like `grpc/authz`. Any request with a non-canonical path is now immediately rejected with an `Unimplemented` error. ([#​8981](https://github.com/grpc/grpc-go/issues/8981)) ### [`v1.79.2`](https://github.com/grpc/grpc-go/releases/tag/v1.79.2): Release 1.79.2 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.79.1...v1.79.2) ### Bug Fixes - stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. ([#​8874](https://github.com/grpc/grpc-go/pull/8874)) ### [`v1.79.1`](https://github.com/grpc/grpc-go/releases/tag/v1.79.1): Release 1.79.1 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.79.0...v1.79.1) ### Bug Fixes - grpc: Remove the `-dev` suffix from the User-Agent header. ([#​8902](https://github.com/grpc/grpc-go/pull/8902)) ### [`v1.79.0`](https://github.com/grpc/grpc-go/releases/tag/v1.79.0): Release 1.79.0 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.0) ### API Changes - mem: Add experimental API `SetDefaultBufferPool` to change the default buffer pool. ([#​8806](https://github.com/grpc/grpc-go/issues/8806)) - Special Thanks: [@​vanja-p](https://github.com/vanja-p) - experimental/stats: Update `MetricsRecorder` to require embedding the new `UnimplementedMetricsRecorder` (a no-op struct) in all implementations for forward compatibility. ([#​8780](https://github.com/grpc/grpc-go/issues/8780)) ### Behavior Changes - balancer/weightedtarget: Remove handling of `Addresses` and only handle `Endpoints` in resolver updates. ([#​8841](https://github.com/grpc/grpc-go/issues/8841)) ### New Features - experimental/stats: Add support for asynchronous gauge metrics through the new `AsyncMetricReporter` and `RegisterAsyncReporter` APIs. ([#​8780](https://github.com/grpc/grpc-go/issues/8780)) - pickfirst: Add support for weighted random shuffling of endpoints, as described in [gRFC A113](https://github.com/grpc/proposal/pull/535). - This is enabled by default, and can be turned off using the environment variable `GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING`. ([#​8864](https://github.com/grpc/grpc-go/issues/8864)) - xds: Implement `:authority` rewriting, as specified in [gRFC A81](https://github.com/grpc/proposal/blob/master/A81-xds-authority-rewriting.md). ([#​8779](https://github.com/grpc/grpc-go/issues/8779)) - balancer/randomsubsetting: Implement the `random_subsetting` LB policy, as specified in [gRFC A68](https://github.com/grpc/proposal/blob/master/A68-random-subsetting.md). ([#​8650](https://github.com/grpc/grpc-go/issues/8650)) - Special Thanks: [@​marek-szews](https://github.com/marek-szews) ### Bug Fixes - credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. ([#​8726](https://github.com/grpc/grpc-go/issues/8726)) - Special Thanks: [@​Atul1710](https://github.com/Atul1710) - xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in `CONNECTING` state. ([#​8813](https://github.com/grpc/grpc-go/issues/8813)) - health: Fix a bug where health checks failed for clients using legacy compression options (`WithDecompressor` or `RPCDecompressor`). ([#​8765](https://github.com/grpc/grpc-go/issues/8765)) - Special Thanks: [@​sanki92](https://github.com/sanki92) - transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. ([#​8769](https://github.com/grpc/grpc-go/issues/8769)) - Special Thanks: [@​joybestourous](https://github.com/joybestourous) - server: Propagate status detail headers, if available, when terminating a stream during request header processing. ([#​8754](https://github.com/grpc/grpc-go/issues/8754)) - Special Thanks: [@​joybestourous](https://github.com/joybestourous) ### Performance Improvements - credentials/alts: Optimize read buffer alignment to reduce copies. ([#​8791](https://github.com/grpc/grpc-go/issues/8791)) - mem: Optimize pooling and creation of `buffer` objects. ([#​8784](https://github.com/grpc/grpc-go/issues/8784)) - transport: Reduce slice re-allocations by reserving slice capacity. ([#​8797](https://github.com/grpc/grpc-go/issues/8797)) ### [`v1.78.0`](https://github.com/grpc/grpc-go/releases/tag/v1.78.0): Release 1.78.0 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.77.0...v1.78.0) ### Behavior Changes - client: Align URL validation with Go 1.26+ to now reject target URLs with unbracketed colons in the hostname. ([#​8716](https://github.com/grpc/grpc-go/issues/8716)) - Special Thanks: [@​neild](https://github.com/neild) - transport/client : Return status code `Unknown` on malformed grpc-status. ([#​8735](https://github.com/grpc/grpc-go/issues/8735)) - - xds/resolver: - Drop previous route resources and report an error when no matching virtual host is found. - Only log LDS/RDS configuration errors following a successful update and retain the last valid resource to prevent transient failures. ([#​8711](https://github.com/grpc/grpc-go/issues/8711)) ### New Features - stats/otel: Add backend service label to weighted round robin metrics as part of A89. ([#​8737](https://github.com/grpc/grpc-go/issues/8737)) - stats/otel: Add subchannel metrics (without the disconnection reason) to eventually replace the pickfirst metrics. ([#​8738](https://github.com/grpc/grpc-go/issues/8738)) - client: Wait for all pending goroutines to complete when closing a graceful switch balancer. ([#​8746](https://github.com/grpc/grpc-go/issues/8746)) - Special Thanks: [@​twz123](https://github.com/twz123) - client: Add `experimental.AcceptCompressors` so callers can restrict the `grpc-accept-encoding` header advertised for a call. ([#​8718](https://github.com/grpc/grpc-go/issues/8718)) - Special Thanks: [@​iblancasa](https://github.com/iblancasa) ### Bug Fixes - xds: Fix a bug in `StringMatcher` where regexes would match incorrectly when ignore\_case is set to true. ([#​8723](https://github.com/grpc/grpc-go/issues/8723)) - client: - Change connectivity state to CONNECTING when creating the name resolver (as part of exiting IDLE). - Change connectivity state to TRANSIENT\_FAILURE if name resolver creation fails (as part of exiting IDLE). - Change connectivity state to IDLE after idle timeout expires even when current state is TRANSIENT\_FAILURE. - Fix a bug that resulted in `OnFinish` call option not being invoked for RPCs where stream creation failed. ([#​8710](https://github.com/grpc/grpc-go/issues/8710)) - xdsclient: Fix a race in the xdsClient that could lead to resource-not-found errors. ([#​8627](https://github.com/grpc/grpc-go/issues/8627)) ### Performance Improvements - mem: Round up to nearest 4KiB for pool allocations larger than 1MiB. ([#​8705](https://github.com/grpc/grpc-go/issues/8705)) - Special Thanks: [@​cjc25](https://github.com/cjc25) ### [`v1.77.0`](https://github.com/grpc/grpc-go/releases/tag/v1.77.0): Release 1.77.0 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.76.0...v1.77.0) ### API Changes - mem: Replace the `Reader` interface with a struct for better performance and maintainability. ([#​8669](https://github.com/grpc/grpc-go/issues/8669)) ### Behavior Changes - balancer/pickfirst: Remove support for the old `pick_first` LB policy via the environment variable `GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false`. The new `pick_first` has been the default since `v1.71.0`. ([#​8672](https://github.com/grpc/grpc-go/issues/8672)) ### Bug Fixes - xdsclient: Fix a race condition in the ADS stream implementation that could result in `resource-not-found` errors, causing the gRPC client channel to move to `TransientFailure`. ([#​8605](https://github.com/grpc/grpc-go/issues/8605)) - client: Ignore HTTP status header for gRPC streams. ([#​8548](https://github.com/grpc/grpc-go/issues/8548)) - client: Set a read deadline when closing a transport to prevent it from blocking indefinitely on a broken connection. ([#​8534](https://github.com/grpc/grpc-go/issues/8534)) - Special Thanks: [@​jgold2-stripe](https://github.com/jgold2-stripe) - client: Fix a bug where default port 443 was not automatically added to addresses without a specified port when sent to a proxy. - Setting environment variable `GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET=false` disables this change; please file a bug if any problems are encountered as we will remove this option soon. ([#​8613](https://github.com/grpc/grpc-go/issues/8613)) - balancer/pickfirst: Fix a bug where duplicate addresses were not being ignored as intended. ([#​8611](https://github.com/grpc/grpc-go/issues/8611)) - server: Fix a bug that caused overcounting of channelz metrics for successful and failed streams. ([#​8573](https://github.com/grpc/grpc-go/issues/8573)) - Special Thanks: [@​hugehoo](https://github.com/hugehoo) - balancer/pickfirst: When configured, shuffle addresses in resolver updates that lack endpoints. Since gRPC automatically adds endpoints to resolver updates, this bug only affects custom LB policies that delegate to `pick_first` but don't set endpoints. ([#​8610](https://github.com/grpc/grpc-go/issues/8610)) - mem: Clear large buffers before re-using. ([#​8670](https://github.com/grpc/grpc-go/issues/8670)) ### Performance Improvements - transport: Reduce heap allocations to reduce time spent in garbage collection. ([#​8624](https://github.com/grpc/grpc-go/issues/8624), [#​8630](https://github.com/grpc/grpc-go/issues/8630), [#​8639](https://github.com/grpc/grpc-go/issues/8639), [#​8668](https://github.com/grpc/grpc-go/issues/8668)) - transport: Avoid copies when reading and writing Data frames. ([#​8657](https://github.com/grpc/grpc-go/issues/8657), [#​8667](https://github.com/grpc/grpc-go/issues/8667)) - mem: Avoid clearing newly allocated buffers. ([#​8670](https://github.com/grpc/grpc-go/issues/8670)) ### New Features - outlierdetection: Add metrics specified in [gRFC A91](https://github.com/grpc/proposal/blob/master/A91-outlier-detection-metrics.md). ([#​8644](https://github.com/grpc/grpc-go/issues/8644)) - Special Thanks: [@​davinci26](https://github.com/davinci26), [@​PardhuKonakanchi](https://github.com/PardhuKonakanchi) - stats/opentelemetry: Add support for optional label `grpc.lb.backend_service` in per-call metrics ([#​8637](https://github.com/grpc/grpc-go/issues/8637)) - xds: Add support for JWT Call Credentials as specified in [gRFC A97](https://github.com/grpc/proposal/blob/master/A97-xds-jwt-call-creds.md). Set environment variable `GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS=true` to enable this feature. ([#​8536](https://github.com/grpc/grpc-go/issues/8536)) - Special Thanks: [@​dimpavloff](https://github.com/dimpavloff) - experimental/stats: Add support for up/down counters. ([#​8581](https://github.com/grpc/grpc-go/issues/8581)) ### [`v1.76.0`](https://github.com/grpc/grpc-go/releases/tag/v1.76.0): Release 1.76.0 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.75.1...v1.76.0) ### Dependencies - Minimum supported Go version is now 1.24 ([#​8509](https://github.com/grpc/grpc-go/issues/8509)) - Special Thanks: [@​kevinGC](https://github.com/kevinGC) ### Bug Fixes - client: Return status `INTERNAL` when a server sends zero response messages for a unary or client-streaming RPC. ([#​8523](https://github.com/grpc/grpc-go/issues/8523)) - client: Fail RPCs with status `INTERNAL` instead of `UNKNOWN` upon receiving http headers with status 1xx and `END_STREAM` flag set. ([#​8518](https://github.com/grpc/grpc-go/issues/8518)) - Special Thanks: [@​vinothkumarr227](https://github.com/vinothkumarr227) - pick\_first: Fix race condition that could cause pick\_first to get stuck in `IDLE` state on backend address change. ([#​8615](https://github.com/grpc/grpc-go/issues/8615)) ### New Features - credentials: Add `credentials/jwt` package providing file-based JWT PerRPCCredentials (A97). ([#​8431](https://github.com/grpc/grpc-go/issues/8431)) - Special Thanks: [@​dimpavloff](https://github.com/dimpavloff) ### Performance Improvements - client: Improve HTTP/2 header size estimate to reduce re-allocations. ([#​8547](https://github.com/grpc/grpc-go/issues/8547)) - encoding/proto: Avoid redundant message size calculation when marshaling. ([#​8569](https://github.com/grpc/grpc-go/issues/8569)) - Special Thanks: [@​rs-unity](https://github.com/rs-unity) ### [`v1.75.1`](https://github.com/grpc/grpc-go/releases/tag/v1.75.1): Release 1.75.1 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.75.0...v1.75.1) ### Bug Fixes - transport: Fix a data race while copying headers for stats handlers in the std lib http2 server transport. ([#​8519](https://github.com/grpc/grpc-go/issues/8519)) - xdsclient: - Fix a data race caused while reporting load to LRS. ([#​8483](https://github.com/grpc/grpc-go/pull/8483)) - Fix regression preventing empty node IDs when creating an LRS client. ([#​8483](https://github.com/grpc/grpc-go/issues/8483)) - server: Fix a regression preventing streams from being cancelled or timed out when blocked on flow control. ([#​8528](https://github.com/grpc/grpc-go/issues/8528)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12794 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Alex619829
|
e35880e7ac |
Add code search with zoekt support (#8827)
This PR adds zoekt as a code search engine for forgejo. This Pull Request is a continuation of the discussion #8302. The meilisearch search engine was not suitable, as it is not designed for searching by code. The zoekt project was proposed instead. Zoekt copes well with code indexing, but its operating principle differs from such search engines as elasticsearch. While elasticsearch can return a result in a ready-made form (with pagination, ready-made snippets, etc.) and forgejo only needs to show this result in the interface with a little work with the data, zoekt works completely differently. Zoekt finds matches in the repository index and returns a response. The response contains a line with the search word, its number from the file, and also a context, if specified in the request. This response is not suitable for Forgejo, so you need to assemble it yourself. To assemble the response from Zoekt into a form acceptable for Forgejo, I had to write some code and create a new function `searchZoektResult`, since the existing `searchResult` function is completely unsuitable for this search engine. I also had to write logic for pagination, highlighting, and correct display of lines in found snippets with a match, but this is a feature of Zoekt. At the moment, Zoekt does not support deleting a repository index by repo_id, it only supports complete deletion of all repositories. But I still implemented the Delete function, which deletes a specific repository by its ID. Co-authored-by: Aleksandr Gamzin <gamzin@altlinux.org> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8827 Reviewed-by: Shiny Nematoda <snematoda@noreply.codeberg.org> Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
7dea39659d |
Update module code.forgejo.org/forgejo/runner/v12 to v12.10.2 (forgejo) (#12759)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.10.1` → `v12.10.2` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.10.2`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.10.2) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.10.1...v12.10.2) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1523): <!--number 1523 --><!--line 0 --><!--description Zml4OiByZW1vdmUgY29udGFpbmVycyBhZnRlciBmYWlsZWQgc3RhcnQtdXA=-->fix: remove containers after failed start-up<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1519): <!--number 1519 --><!--line 0 --><!--description Zml4OiByZWplY3QgaW52YWxpZCBjcm9uIHNjaGVkdWxlcyB3aGlsZSBwYXJzaW5nIHdvcmtmbG93cw==-->fix: reject invalid cron schedules while parsing workflows<!--description--> - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1532): <!--number 1532 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3JoeXNkL2FjdGlvbmxpbnQgdG8gdjEuNy4xMg==-->Update module github.com/rhysd/actionlint to v1.7.12<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1531): <!--number 1531 --><!--line 0 --><!--description UmVwbGFjZSBOb2RlLmpzIHdpdGggZGF0YS5mb3JnZWpvLm9yZy9vY2kvbm9kZSAyNC10cml4aWU=-->Replace Node.js with data.forgejo.org/oci/node 24-trixie<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1530): <!--number 1530 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Nhc2NhZGluZy1wciBhY3Rpb24gdG8gdjIuMy4y-->Update <https://data.forgejo.org/actions/cascading-pr> action to v2.3.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1522): <!--number 1522 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21vYnkvcGF0dGVybm1hdGNoZXIgdG8gdjAuNi4x-->Update module github.com/moby/patternmatcher to v0.6.1<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1529): <!--number 1529 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvc3lzIHRvIHYwLjQ0LjAgW1NFQ1VSSVRZXQ==-->Update module golang.org/x/sys to v0.44.0 \[SECURITY]<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1527): <!--number 1527 --><!--line 0 --><!--description dGVzdDogdXBkYXRlIGFwdCBjYWNoZSBiZWZvcmUgaW5zdGFsbGluZyBwYWNrYWdlcyBpbiBQb2RtYW4gam9i-->test: update apt cache before installing packages in Podman job<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1521): <!--number 1521 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21hdHRuL2dvLWlzYXR0eSB0byB2MC4wLjIy-->Update module github.com/mattn/go-isatty to v0.0.22<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1520): <!--number 1520 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTQ=-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.14<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1515): <!--number 1515 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb25uZWN0cnBjLmNvbS9jb25uZWN0IHRvIHYxLjE5LjI=-->Update module connectrpc.com/connect to v1.19.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1514): <!--number 1514 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://data.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1513): <!--number 1513 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTM=-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.13<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1512): <!--number 1512 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjUuMTA=-->Update go toolchain directive to v1.25.10<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1503): <!--number 1503 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlcGxhY2UgYmFja2VuZCBpZGVudGl0eSBjaGVja3Mgd2l0aCBjYXBhYmlsaXR5IHF1ZXJpZXM=-->refactor: replace backend identity checks with capability queries<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12759 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
1a108e8fbb |
Update module golang.org/x/net to v0.55.0 [SECURITY] (forgejo) (#12686)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.55.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.55.0) |  |  | --- ### Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html [CVE-2026-42506](https://nvd.nist.gov/vuln/detail/CVE-2026-42506) / [GO-2026-5025](https://pkg.go.dev/vuln/GO-2026-5025) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79571](https://go.dev/issue/79571) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781700](https://go.dev/cl/781700) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5025) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) / [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) <details> <summary>More information</summary> #### Details The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". #### Severity Unknown #### References - [https://go.dev/cl/767220](https://go.dev/cl/767220) - [https://go.dev/issue/78760](https://go.dev/issue/78760) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5026) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html [CVE-2026-42502](https://nvd.nist.gov/vuln/detail/CVE-2026-42502) / [GO-2026-5027](https://pkg.go.dev/vuln/GO-2026-5027) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79572](https://go.dev/issue/79572) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781701](https://go.dev/cl/781701) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5027) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. #### Severity Unknown #### References - [https://go.dev/cl/781702](https://go.dev/cl/781702) - [https://go.dev/issue/79573](https://go.dev/issue/79573) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5028) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html [CVE-2026-25681](https://nvd.nist.gov/vuln/detail/CVE-2026-25681) / [GO-2026-5029](https://pkg.go.dev/vuln/GO-2026-5029) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79574](https://go.dev/issue/79574) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781703](https://go.dev/cl/781703) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5029) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking duplicate attributes can cause XSS in golang.org/x/net/html [CVE-2026-27136](https://nvd.nist.gov/vuln/detail/CVE-2026-27136) / [GO-2026-5030](https://pkg.go.dev/vuln/GO-2026-5030) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79575](https://go.dev/issue/79575) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781685](https://go.dev/cl/781685) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5030) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12686 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
ede3bbe670 |
Update module golang.org/x/image to v0.41.0 (forgejo) (#12673)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12673 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
294952b774 |
Update module golang.org/x/crypto to v0.52.0 (forgejo) (#12676)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.51.0` → `v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12676 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
f4c319db0b |
Update module code.forgejo.org/forgejo/levelqueue to v1.1.0 (forgejo) (#12630)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12630 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
6fd667dcd8 |
Update module connectrpc.com/connect to v1.20.0 (forgejo) (#12654)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.19.2` → `v1.20.0` |  |  | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.20.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.20.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0) #### What's Changed ##### Other changes - Bump minimum supported Go version to 1.25 by [@​jonbodner-buf](https://github.com/jonbodner-buf) in [#​922](https://github.com/connectrpc/connect-go/issues/922) - Update Unary-Get query parameter order to match spec recommendation by [@​oliversun9](https://github.com/oliversun9) in [#​926](https://github.com/connectrpc/connect-go/issues/926) #### New Contributors - [@​jonbodner-buf](https://github.com/jonbodner-buf) made their first contribution in [#​922](https://github.com/connectrpc/connect-go/issues/922) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12654 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Mathieu Fenniak
|
29eddd311b |
chore: upgrade to https://code.forgejo.org/xorm/xorm v1.4.0 (#12639)
Upgrade Forgejo to our forked [xorm v1.4.0](https://code.forgejo.org/xorm/xorm/compare/v1.3.9-forgejo.12...v1.4.0), which is now named `code.forgejo.org/xorm/xorm` to reflect the current expectation that it is a permanent fork. A small number of API changes were made recently in https://code.forgejo.org/xorm/xorm/issues/120 which are accounted for in this PR, in addition to the module rename. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12639 Reviewed-by: Otto <otto@codeberg.org> |
||
|
Renovate Bot
|
05d784bb38 |
Update module github.com/urfave/cli/v3 to v3.9.0 (forgejo) (#12544)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12544 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
b21b173f6e |
Update module golang.org/x/net to v0.54.0 (forgejo) (#12485)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12485 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
3f0a8b4424 |
Update module golang.org/x/image to v0.40.0 (forgejo) (#12484)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12484 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
dcf1e7ce09 |
Update module github.com/fsnotify/fsnotify to v1.10.1 (forgejo) (#12416)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12416 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
0b3192b8af |
Update module golang.org/x/crypto to v0.51.0 (forgejo) (#12483)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.50.0` → `v0.51.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.50.0...refs/tags/v0.51.0) |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2779) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC42IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12483 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Mathieu Fenniak
|
1cdef7d39f |
chore: upgrade xorm to v1.3.9-forgejo.12 (#12430)
Upgrading to bring https://code.forgejo.org/xorm/xorm/pulls/106 into Forgejo. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12430 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate Bot
|
4cebc5d1d5 |
Update module code.forgejo.org/forgejo/runner/v12 to v12.10.1 (forgejo) (#12426)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.10.0` → `v12.10.1` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.10.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.10.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.10.0...v12.10.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1509): <!--number 1509 --><!--line 0 --><!--description ZmVhdDogbWVyZ2UgcmV1c2FibGUgZXhwYW5zaW9uIGNhbGxlcidzICdpZicgaW50byBleHBhbmRlZCBqb2Jz-->feat: merge reusable expansion caller's 'if' into expanded jobs<!--description--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1510): <!--number 1510 --><!--line 0 --><!--description Zml4OiB3b3JrZmxvdy1sZXZlbCAnZW52JyBpcyBsb3N0IGR1cmluZyBqb2IgcGFyc2luZw==-->fix: workflow-level 'env' is lost during job parsing<!--description--> - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1511): <!--number 1511 --><!--line 0 --><!--description Y2hvcmU6IHVzZSBzcGVjaWZpYyB2ZXJzaW9uIG9mIGdvZnVtcHQsIG5vdCBsYXRlc3Q=-->chore: use specific version of gofumpt, not latest<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1508): <!--number 1508 --><!--line 0 --><!--description Y2hvcmU6IGluY3JlYXNlIHRoZSBsZW5ndGggb2YgdGhlIGNhY2hlIHRva2VuIGtleQ==-->chore: increase the length of the cache token key<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1504): <!--number 1504 --><!--line 0 --><!--description Y2hvcmU6IHJlbW92ZSBnby1naXQ=-->chore: remove go-git<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1506): <!--number 1506 --><!--line 0 --><!--description cmVmYWN0b3I6IGRyb3AgdW51c2VkIENvbm5lY3RUb05ldHdvcmsgZnJvbSBDb250YWluZXIgaW50ZXJmYWNl-->refactor: drop unused ConnectToNetwork from Container interface<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC42IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12426 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |