

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13372): <!--number 13372 --><!--line 0 --><!--description Zml4OiBkb24ndCBjYWNoZSB3cml0ZSBwZXJtaXNzaW9uIG9uIGZpcnN0IHB1c2hlZCBnaXQgcmVmZXJlbmNl-->fix: don't cache write permission on first pushed git reference<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13184) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13220)): <!--number 13220 --><!--line 0 --><!--description Zml4OiBlbnN1cmUgbWlncmF0aW9ucyBhbGxvdy9kZW55IGhvc3QgbGlzdHMgYXJlIGFwcGxpZWQgdG8gb25lZGV2LCBwYWd1cmUsIGFuZCBjb2RlYmFzZSBtaWdyYXRvcnM=-->fix: ensure migrations allow/deny host lists are applied to onedev, pagure, and codebase migrators<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13185): <!--number 13185 --><!--line 0 --><!--description SW1wcm92ZWQgY29tcGxpYW5jZSB3aXRoIHRoZSBjb25maWcgc2V0dGluZ3MgYFttaWdyYXRpb25zXS5BTExPV0VEX0RPTUFJTlNgLCBgW21pZ3JhdGlvbnNdLkJMT0NLRURfRE9NQUlOU2AsIGFuZCBgW21pZ3JhdGlvbnNdLkFMTE9XX0xPQ0FMTkVUV09SS1NgLCB3aGljaCBjb250cm9sIHRoZSByZW1vdGVzIHRoYXQgRm9yZ2VqbyBjYW4gYWNjZXNzIGZvciBnaXQgJiBMRlMgbWlncmF0aW9uIGFuZCBtaXJyb3Jpbmcgb3BlcmF0aW9ucywgZml4aW5nIHRpbWUtb2YtY2hlY2sgdnMuIHRpbWUtb2YtdXNlIGlzc3VlIGFuZCBtaXNzaW5nIGNoZWNrcyBpbiBMRlMu-->Improved compliance with the config settings `[migrations].ALLOWED_DOMAINS`, `[migrations].BLOCKED_DOMAINS`, and `[migrations].ALLOW_LOCALNETWORKS`, which control the remotes that Forgejo can access for git & LFS migration and mirroring operations, fixing time-of-check vs. time-of-use issue and missing checks in LFS.<!--description-->
- Localization
  - Backport of translations from Codeberg Translate: [#13354](https://codeberg.org/forgejo/forgejo/pulls/13354) (backport of [#12284](https://codeberg.org/forgejo/forgejo/pulls/12284), [#12728](https://codeberg.org/forgejo/forgejo/pulls/12728))
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12200) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13209)): <!--number 13209 --><!--line 0 --><!--description Zml4OiBVcGRhdGUgc3dpZnQgcGFja2FnZSByZWdpc3RyeSB0byB1c2UgdGhlIG1ldGFkYXRhIHNjaGVtYSBmcm9tIHRoZSBvZmZpY2lhbCBTd2lmdCBkb2NzICgjMTIyMDAp-->fix: Update swift package registry to use the metadata schema from the official Swift docs (#12200)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13140) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13182)): <!--number 13182 --><!--line 0 --><!--description Zml4OiBHRVQgL3JlcG9zL3tvd25lcn0ve3JlcG99L2lzc3Vlcy9jb21tZW50cy97aWR9IGRvZXMgbm90IGZhaWwgaWYgdGhlIHBvc3RlciBpcyBhIGRlbGV0ZWQgdXNlcg==-->fix: GET /repos/{owner}/{repo}/issues/comments/{id} does not fail if the poster is a deleted user<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13040) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13055)): <!--number 13055 --><!--line 0 --><!--description Zml4OiBkbyBub3QgdHJ5IHRvIHJlbW92ZSB0YXNrIGxvZ3MgdGhhdCBkb24ndCBleGlzdCAoIzEzMDQwKQ==-->fix: do not try to remove task logs that don't exist (#13040)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12865) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13132)): <!--number 13132 --><!--line 0 --><!--description Zml4OiBhZGQgc3VwcG9ydCB0aGUgaHR0cCBIRUFEIHJlcXVlc3QgbWV0aG9kIGZvciBnZW5lcmljIHBhY2thZ2Vz-->fix: add support the http HEAD request method for generic packages<!--description-->
- Other changes without a feature or bug label
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13105) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13115)): <!--number 13115 --><!--line 0 --><!--description Y2hvcmU6IHJlbW92ZSBFWElGIHN0cmlwcGluZyBjYXBhYmlsaXR5IGR1ZSB0byB1c2FnZSBvZiBBR1BMIGxpY2Vuc2VkIGV4aWYtdGVybWluYXRvciBsaWJyYXJ5-->chore: remove EXIF stripping capability due to usage of AGPL licensed exif-terminator library<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13036) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13042)): <!--number 13042 --><!--line 0 --><!--description Y29ycmVjdGluZyByZWZlcnJlciBwb2xpY3kgaW4gSFRNTCBgPG1ldGE+YCB0YWc=-->correcting referrer policy in HTML `<meta>` tag<!--description-->
- Included for completeness but not user-facing (chores, etc.)
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13348): <!--number 13348 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjYuNSAodjE1LjAvZm9yZ2Vqbyk=-->Update go toolchain directive to v1.26.5 (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13271) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13311)): <!--number 13311 --><!--line 0 --><!--description Y2hvcmUocmVmYWN0b3IpOiBjbGFyaWZ5IFJFU1QgQVBJIHBlcm1pc3Npb25zIHRlc3Rz-->chore(refactor): clarify REST API permissions tests<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13293) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13301)): <!--number 13301 --><!--line 0 --><!--description Zml4OiBpbnRlcm1pdHRlbnQgdGVzdCBmYWlsdXJlIGluIHByb2Nlc3MgY2FuY2VsbGF0aW9u-->fix: intermittent test failure in process cancellation<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13289) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13291)): <!--number 13291 --><!--line 0 --><!--description Zml4OiByZXN0b3JlIEZvcmdlam8ncyBjYXBhYmlsaXR5IHRvIGJ1aWxkIG9uIG5vbi1MaW51eCBVTklYIHBsYXRmb3Jtcw==-->fix: restore Forgejo's capability to build on non-Linux UNIX platforms<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13263) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13273)): <!--number 13273 --><!--line 0 --><!--description Zml4OiB0ZXJtaW5hdGUgZ2l0ICgmIG90aGVyKSBzdWJjb21tYW5kcyBncmFjZWZ1bGx5IG9uIGNvbnRleHQgdGltZW91dC9jYW5jZWxsYXRpb24=-->fix: terminate git (& other) subcommands gracefully on context timeout/cancellation<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13262) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13269)): <!--number 13269 --><!--line 0 --><!--description Zml4OiBlbnN1cmUgcnVubmVycyBlaXRoZXIgYmVsb25nIHRvIG93bmVyIG9yIHJlcG8gd2hlbiB1cGRhdGVkICgjMTMyNjIp-->fix: ensure runners either belong to owner or repo when updated (#13262)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13215) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13218)): <!--number 13218 --><!--line 0 --><!--description Y2hvcmUocmVmYWN0b3IpOiByZW1vdmUgR2V0WCByZWR1bmRhbnQgYWNjZXNzb3JzIGFuZCB1c2UgWCBpbiBzZXJ2aWNlcy9jb250ZXh0L2FwaS5nbw==-->chore(refactor): remove GetX redundant accessors and use X in services/context/api.go<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13143) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13214)): <!--number 13214 --><!--line 0 --><!--description Y2hvcmUocmVmYWN0b3IpOiBhZGQgZ2V0dGVyL3NldHRlciB0byBBUElDb250ZXh0IGRhdGEgbWVtYmVycw==-->chore(refactor): add getter/setter to APIContext data members<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13198): <!--number 13198 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuNDMuMCBbU0VDVVJJVFldICh2MTUuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.43.0 [SECURITY] (v15.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13138) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13181)): <!--number 13181 --><!--line 0 --><!--description Y2hvcmUocmVmYWN0b3IpOiBzL0Jhc2UuRGF0YVsicmVxdWlyZWRTY29wZUNhdGVnb3JpZXMiXS9BUElDb250ZXh0LlJlcXVpcmVkU2NvcGVDYXRlZ29yaWVzLw==-->chore(refactor): s/Base.Data["requiredScopeCategories"]/APIContext.RequiredScopeCategories/<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12512) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13156)): <!--number 13156 --><!--line 0 --><!--description ZmVhdDogaW1wcm92ZSBSRVNUIEFQSSBwZXJtaXNzaW9ucyBmdW5jdGlvbnMgdGVzdCBjb3ZlcmFnZQ==-->feat: improve REST API permissions functions test coverage<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13116) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13119)): <!--number 13119 --><!--line 0 --><!--description Y2k6IGRvbid0IHVzZSByZWRpY3QgZHVyaW5nIEZvcmdlam8gdGVzdGluZw==-->ci: don't use redict during Forgejo testing<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13087) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13092)): <!--number 13092 --><!--line 0 --><!--description Zml4OiBpbnRyb2R1Y2UgbGludC1zaW5nbGUtcmVzcG9uc2UgdG8gcHJldmVudCBjb250cm9sIGZsb3cgY29udGludWluZyBwYXN0IGEgYGN0eC5FcnJvciguLi4pYC1zdHlsZSBtZXRob2Q=-->fix: introduce lint-single-response to prevent control flow continuing past a `ctx.Error(...)`-style method<!--description-->
<!--end release-notes-assistant-->