

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13002): <!--number 13002 --><!--line 0 --><!--description LSBmaXg6IHByZXZlbnQgc3RvcmVkIFhTUyBpbiB1c2VyIGRpc3BsYXkgbmFtZSBvbiBBY3Rpb25zIHBhZ2U=-->- fix: prevent stored XSS in user display name on Actions page<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13002): <!--number 13002 --><!--line 1 --><!--description LSBmaXg6IExGUyBsb2NrcyBtdXN0IGJlbG9uZyB0byB0aGUgaW50ZW5kZWQgcmVwbywgcG9ydCBmcm9tIEdpdGVh-->- fix: LFS locks must belong to the intended repo, port from Gitea<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13002): <!--number 13002 --><!--line 2 --><!--description LSBmaXg6IHByZXZlbnQgdW5hdXRob3JpemVkIGFjY2VzcyB0byBkcmFmdCByZWxlYXNlcyB2aWEgQVBJ-->- fix: prevent unauthorized access to draft releases via API<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13002): <!--number 13002 --><!--line 3 --><!--description LSBmaXg6IHByZXZlbnQgd3JpdGVzIHRvIE9wZW5JRCB2aXNpYmlsaXR5IHdoaWNoIG1heSBhZmZlY3Qgb3RoZXIgdXNlcnM=-->- fix: prevent writes to OpenID visibility which may affect other users<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13002): <!--number 13002 --><!--line 4 --><!--description LSBmaXg6IHByZXZlbnQgdmlld2luZyBwcml2YXRlIFBScyB0aGF0IGFyZSBsaW5rZWQgdG8gcHVibGljIGlzc3VlcyBvbiBwdWJsaWMgcHJvamVjdHM=-->- fix: prevent viewing private PRs that are linked to public issues on public projects<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12735) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12792)): <!--number 12792 --><!--line 0 --><!--description Zml4OiBkbyBub3QgbWlncmF0ZSBjb25maWRlbnRpYWwgaXNzdWVzIGFuZCBpbnRlcm5hbCBub3RlcyBmcm9tIEdpdGxhYg==-->fix: do not migrate confidential issues and internal notes from Gitlab<!--description-->
- User Interface features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12627) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12652)): <!--number 12652 --><!--line 0 --><!--description Zml4OiBpbXByb3ZlIHZpc2liaWxpdHkgb2YgbWlzbWF0Y2hlZCByZXBvc2l0b3J5ICYgcGFja2FnZSB2aXNpYmlsaXR5-->fix: improve visibility of mismatched repository & package visibility<!--description-->
- User Interface bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12704) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12712)): <!--number 12712 --><!--line 0 --><!--description Zml4OiBkaXNwbGF5IHRoZSBhY3Rpb25zIHRydXN0IG1hbmFnZW1lbnQgcGFuZWwgb24gbWVyZ2VkIGFuZCBjbG9zZWQgcHVsbCByZXF1ZXN0cw==-->fix: display the actions trust management panel on merged and closed pull requests<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12928) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12949)): <!--number 12949 --><!--line 0 --><!--description Zml4KHVpKTogaW1wcm92ZSBjb250cmFzdCBvZiBjaGVja2JveGVzIGluIG1hcmt1cA==-->fix(ui): improve contrast of checkboxes in markup<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12773) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12835)): <!--number 12835 --><!--line 0 --><!--description Zml4KHVpKTogaGlkZSBzb21lIGRpc2FsbG93ZWQgYWN0aW9ucyB0aGF0IGxlYWQgdG8gNDA0IGVycm9ycyBpbiBhcmNoaXZlZCByZXBvcw==-->fix(ui): hide some disallowed actions that lead to 404 errors in archived repos<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12753) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12767)): <!--number 12767 --><!--line 0 --><!--description Zml4KHVpKTogZG8gbm90IGNsaXAgb3ZlcmZsb3cgaW4gd29ya2Zsb3cgZGlzcGF0Y2ggbWVudQ==-->fix(ui): do not clip overflow in workflow dispatch menu<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12812) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12831)): <!--number 12831 --><!--line 0 --><!--description Zml4OiBzaG93IHRoZSBhY3Rpb25zIHRydXN0IG1hbmFnZW1lbnQgcGFuZWwgd2hlbiBydW5zIGZyb20gdHJ1c3RlZCB1c2VycyBhcmUgcGVuZGluZyBhcHByb3ZhbA==-->fix: show the actions trust management panel when runs from trusted users are pending approval<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12785) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12832)): <!--number 12832 --><!--line 0 --><!--description Zml4OiBhbHdheXMgZGlzcGxheSB0aGUgcHVsbCByZXF1ZXN0IG1lcmdlIGJveCBpZiB0aGVyZSBhcmUgYWN0aW9ucyBwZW5kaW5nIGFwcHJvdmFs-->fix: always display the pull request merge box if there are actions pending approval<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12771) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12793)): <!--number 12793 --><!--line 0 --><!--description Zml4KHVpKTogZml4IHR5cG8gaW4gaXNzdWUgc29ydCBkcm9wZG93bjsgcmVsZXZhbmNlIHdhcyBtaXNuYW1lZCBhcyByZWxldmVuY3k=-->fix(ui): fix typo in issue sort dropdown; relevance was misnamed as relevency<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12779) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12787)): <!--number 12787 --><!--line 0 --><!--description Zml4OiBkbyBub3QgaGlkZSBwcmV2aW91cyBhdHRlbXB0cyB3aXRob3V0IHRhc2sgZm9yIGxhdGVzdCBhdHRlbXB0-->fix: do not hide previous attempts without task for latest attempt<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12581) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12594)): <!--number 12594 --><!--line 0 --><!--description Zml4KHVpKTogdXNlIFVSTCBxdWVyeSBlc2NhcGluZyBmb3IgU1NIIGtleSB2ZXJpZmljYXRpb24gcmVsb2FkIHRva2VuIGxpbms=-->fix(ui): use URL query escaping for SSH key verification reload token link<!--description-->
- Features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13000): <!--number 13000 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBpbmkgdG8gdjEuNjcuMyB0byBpbXByb3ZlIGNvbmZpZyBwYXJzZSBwZXJmb3JtYW5jZQ==-->Update module ini to v1.67.3 to improve config parse performance<!--description-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12901) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12974)): <!--number 12974 --><!--line 0 --><!--description Zml4KGRvY3Rvcik6IGVuc3VyZSB0aGUgZG9jdG9yIHJ1bnMgd2l0aCB0aGUgc2FtZSBzZXR0aW5ncy5BcHBQYXRoIGFzIEZvcmdlam8=-->fix(doctor): ensure the doctor runs with the same settings.AppPath as Forgejo<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12460) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12834)): <!--number 12834 --><!--line 0 --><!--description Zml4OiBtYWtlIGVtYWlsIHRva2VuIGV4dHJhY3Rpb24gY2FzZS1pbnNlbnNpdGl2ZSAoIzEyNDM2KQ==-->fix: make email token extraction case-insensitive (#12436)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12756) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12806)): <!--number 12806 --><!--line 0 --><!--description Zml4OiBjYW5jZWwgZGVwZW5kZW50IGpvYnMgd2hlbiByZXJ1bm5pbmcgam9icw==-->fix: cancel dependent jobs when rerunning jobs<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12755) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12790)): <!--number 12790 --><!--line 0 --><!--description Zml4OiBjaGVjayBxdW90YSBpbiBMRlMgdXBsb2FkcyBhZ2FpbnN0IHRoZSByZXBvc2l0b3J5IG93bmVyLCBub3Qgb3BlcmF0aW5nIHVzZXI=-->fix: check quota in LFS uploads against the repository owner, not operating user<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12737) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12789)): <!--number 12789 --><!--line 0 --><!--description Zml4OiBsb2FkIHJlcG8gbGFuZ3VhZ2UgZm9yIGNvbnZlcnRpbmcgdG8gYXBpIHN0cnVjdA==-->fix: load repo language for converting to api struct<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12764) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12774)): <!--number 12774 --><!--line 0 --><!--description Zml4OiBkZWJpYW4gcGFja2FnZSBjbGVhbnVwIGZhaWx1cmUgZHVlIHRvIHhvcm0gY29ubmVjdGlvbiBjb3JydXB0aW9u-->fix: debian package cleanup failure due to xorm connection corruption<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12739) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12744)): <!--number 12744 --><!--line 0 --><!--description Zml4OiB3b3JrZmxvdyB3aXRoIHB1bGxfcmVxdWVzdCB0cmlnZ2VyIGFuZCBwYXRoIGZpbHRlciBub3QgcnVuIHdoZW4gbWVyZ2luZw==-->fix: workflow with pull_request trigger and path filter not run when merging<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12685) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12730)): <!--number 12730 --><!--line 0 --><!--description Zml4OiB1cGRhdGUgc3RhdHVzZXMgaW4gcGhhc2VzIHRvIHByZXZlbnQgb3V0IG9mIG9yZGVyIHVwZGF0ZXMgZnJvbSBzdGFsbGluZyB3b3JrZmxvd3M=-->fix: update statuses in phases to prevent out of order updates from stalling workflows<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12476) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12671)): <!--number 12671 --><!--line 0 --><!--description Zml4OiByZXR1cm4gNDA0IGluc3RlYWQgb2YgNTAwIGZvciBub24tZXhpc3RpbmcgU0hBIGluIGNvbW1pdCBzdGF0dXMgZW5kcG9pbnQ=-->fix: return 404 instead of 500 for non-existing SHA in commit status endpoint<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12589) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12592)): <!--number 12592 --><!--line 0 --><!--description Zml4KGlzc3VlLXNlYXJjaCk6IHNpbmdsZSBleGNsdWRlIHF1ZXJ5IHdhcyBlcnJvbmVvc2x5IGNvbnNpZGVyZWQgYXMgbXVzdA==-->fix(issue-search): single exclude query was erroneosly considered as must<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12550) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12553)): <!--number 12553 --><!--line 0 --><!--description Zml4OiByZW1vdmUgbGluayB0byBhcnRlZmFjdHMgdGhhdCBoYXZlIGV4cGlyZWQ=-->fix: remove link to artefacts that have expired<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12523) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12542)): <!--number 12542 --><!--line 0 --><!--description Zml4OiB3aXBlIHJ1biBhcnRpZmFjdHMgYmVmb3JlIHJlcnVuICgjMTI1MjMp-->fix: wipe run artifacts before rerun (#12523)<!--description-->
- Included for completeness but not user-facing (chores, etc.)
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13021): <!--number 13021 --><!--line 0 --><!--description VXBkYXRlIHBsYXl3cmlnaHQgbW9ub3JlcG8gdG8gdjEuNjAuMCAodjE1LjAvZm9yZ2Vqbyk=-->Update playwright monorepo to v1.60.0 (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12916): <!--number 12916 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjYuNCBbU0VDVVJJVFldICh2MTUuMC9mb3JnZWpvKQ==-->Update go toolchain directive to v1.26.4 [SECURITY] (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12555) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12868)): <!--number 12868 --><!--line 0 --><!--description cmVmYWN0b3IodGVzdHMpOiB1c2UgZm9yZ2VyeS5DcmVhdGVSZXBvc2l0b3J5IGluIG1vcmUgcGxhY2Vz-->refactor(tests): use forgery.CreateRepository in more places<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12796) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12852)): <!--number 12852 --><!--line 0 --><!--description cmVmYWN0b3IoZm9yZ2VyeSk6IENyZWF0ZVByb2plY3QgaGVscGVyIHRvIHJlZHVjZSBkZXBlbmRlbmN5IG9uIGdsb2JhbCBmaXh0dXJlIHdoZW4gdGVzdGluZw==-->refactor(forgery): CreateProject helper to reduce dependency on global fixture when testing<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12818) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12826)): <!--number 12826 --><!--line 0 --><!--description Zml4OiBrZWVwIHJ1biBpbiBzeW5jIHdoZW4gcmVydW5uaW5nIGluZGl2aWR1YWwgam9icw==-->fix: keep run in sync when rerunning individual jobs<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12828): <!--number 12828 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuNDEuMCBbU0VDVVJJVFldICh2MTUuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.41.0 [SECURITY] (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12780): <!--number 12780 --><!--line 0 --><!--description Zml4OiBgbWFrZSB0aWR5LWNoZWNrYCBmYWlsdXJlIGFmdGVyIHJlY2VudCBtZXJnZXM=-->fix: `make tidy-check` failure after recent merges<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12775): <!--number 12775 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuMTAuMiAodjE1LjAvZm9yZ2Vqbyk=-->Update module code.forgejo.org/forgejo/runner/v12 to v12.10.2 (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12365) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12777)): <!--number 12777 --><!--line 0 --><!--description Y2hvcmU6IHJlcGxhY2UgYGdpdGh1Yi5jb20vcm9iZmlnL2Nyb24vdjNgICgjMTIzNjUp-->chore: replace `github.com/robfig/cron/v3` (#12365)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12702) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12710)): <!--number 12710 --><!--line 0 --><!--description Zml4OiBhZGRzIG1pc3NpbmcgQXBwU3ViVXJsIHRvIHRoZSB3ZWJtYW5pZmVzdCdzIGxvY2F0aW9u-->fix: adds missing AppSubUrl to the webmanifest's location<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12690): <!--number 12690 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjU1LjAgW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.55.0 [SECURITY] (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12679): <!--number 12679 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvY3J5cHRvIHRvIHYwLjUyLjAgW1NFQ1VSSVRZXSAodjE1LjAvZm9yZ2Vqbyk=-->Update module golang.org/x/crypto to v0.52.0 [SECURITY] (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12659): <!--number 12659 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vbGV2ZWxxdWV1ZSB0byB2MS4xLjAgKHYxNS4wL2Zvcmdlam8p-->Update module code.forgejo.org/forgejo/levelqueue to v1.1.0 (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12577) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12593)): <!--number 12593 --><!--line 0 --><!--description Y2hvcmU6IHRpZHkgdXAgdXBsb2FkaW5nIG1pZ3JhdGlvbiBjb2Rl-->chore: tidy up uploading migration code<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12588): <!--number 12588 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb2RlLmZvcmdlam8ub3JnL2Zvcmdlam8vcnVubmVyL3YxMiB0byB2MTIuMTAuMSAodjE1LjAvZm9yZ2Vqbyk=-->Update module code.forgejo.org/forgejo/runner/v12 to v12.10.1 (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12442) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12579)): <!--number 12579 --><!--line 0 --><!--description Zml4OiBtYWtlIHRoZSBmb3JrIEFQSSByZXNwZWN0IENhbkNyZWF0ZU9yZ1JlcG8gcG9saWN5-->fix: make the fork API respect CanCreateOrgRepo policy<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12554) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12574)): <!--number 12574 --><!--line 0 --><!--description Zml4KGUyZSk6IFJhY2UgY29uZGl0aW9uIGluIGRpYWxvZyBtb2RhbCB0ZXN0-->fix(e2e): Race condition in dialog modal test<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11356) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12540)): <!--number 12540 --><!--line 0 --><!--description dGVzdHM6IGJldHRlciBmYWN0b3J5IHdpdGggZm9yZ2VyeSBwYWNrYWdl-->tests: better factory with forgery package<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12142) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12538)): <!--number 12538 --><!--line 0 --><!--description cmVmYWN0b3I6IGRlbGVnYXRlIHRvIHNlcnZpY2UgZm9yIHJ1biBjYW5jZWxsYXRpb24gKCMxMjE0Mik=-->refactor: delegate to service for run cancellation (#12142)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12469) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12471)): <!--number 12471 --><!--line 0 --><!--description Zml4KGUyZSk6IERpYWxvZyBtb2RhbCBtYXgtd2lkdGggcmVuZGVyaW5nIGZhaWx1cmU=-->fix(e2e): Dialog modal max-width rendering failure<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12141) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12537)): <!--number 12537 --><!--line 0 --><!--description cmVmYWN0b3I6IG1vdmUgcmVydW4gbG9naWMgdG8gc2VydmljZXM=-->refactor: move rerun logic to services<!--description-->
<!--end release-notes-assistant-->