User keypairs and HTTP signatures for ActivityPub federation using go-ap #19133

ghost · 2022-03-18T22:57:44Z

This implements a few components of the ActivityPub protocol using the go-ap library. This includes an /activitypub and /activitypub/user endpoint for the API, ActivityPub-specific information in the /.well-known/webfinger endpoint, and middleware for HTTP signatures. It does not do much but it is an essential building block for ActivityPub federation.

depend on Use Golang 1.18 for Gitea 1.17 release #19918

go get github.com/go-fed/activity/streams@master go get github.com/go-fed/activity/pub@master go get github.com/go-fed/httpsig@master

Return informations regarding a Person (as defined in ActivityStreams https://www.w3.org/TR/activitystreams-vocabulary/#dfn-person). Refs: #14186 Signed-off-by: Loïc Dachary <loic@dachary.org>

Refs: #14186 Signed-off-by: Loïc Dachary <loic@dachary.org>

Signed-off-by: Loïc Dachary <loic@dachary.org>

integrations/api_activitypub_person_test.go

Signed-off-by: Anthony Wang <ta180m@pm.me>

integrations/api_activitypub_person_test.go

Signed-off-by: Anthony Wang <ta180m@pm.me>

Gusted

Overall looking good. Code flow looks good to me, we might want to add some more comments here and there because I'm still scratching my head at some sections of the code, of what's actually doing.

routers/api/v1/api.go

routers/api/v1/activitypub/reqsignature.go

routers/api/v1/activitypub/person.go

modules/activitypub/hack_16834.go

Signed-off-by: Anthony Wang <ta180m@pm.me>

ghost · 2022-03-24T23:50:31Z

This PR adds the large go-fed library which increases the Gitea binary size from 80 MB to 103 MB. I originally created #19104 to discuss ways to deal with this addition, but we can also discuss it here.

Gusted · 2022-03-25T16:16:48Z

This PR adds the large go-fed library which increases the Gitea binary size from 80 MB to 103 MB. I originally created #19104 to discuss ways to deal with this addition, but we can also discuss it here.

That's measurably bigger. Of course it would be nice if go-fed was able to simplify code to reduce the binary size. Possible solution, given the nature of this is to introduce build tags within gitea, such that go-fed won't compile if one doesn't want to use federation.

Signed-off-by: Anthony Wang <ta180m@pm.me>

modules/activitypub/client.go

ghost · 2022-06-18T17:30:48Z

Sorry for the force-push: I think it's because https://github.com/Ta180m/gitea is a push mirror of https://gitea.com/Ta180m/gitea and a commit on the GitHub repo was overwritten when gitea.com synchronized the mirror.

6543 · 2022-06-18T18:28:46Z

to bad ... I was just going to merge this ...

ghost · 2022-06-18T19:22:18Z

Sorry for the force-push: I think it's because https://github.com/Ta180m/gitea is a push mirror of https://gitea.com/Ta180m/gitea and a commit on the GitHub repo was overwritten when gitea.com synchronized the mirror.

@6543 I don't think there was anything important overwritten so it should be OK to merge now.

delvh

I only skimmed through it because it seems to get merged soon, but I found a few things:

routers/api/v1/swagger/activitypub.go

routers/web/webfinger.go

delvh · 2022-06-18T21:04:14Z

modules/activitypub/client.go

+// NewClient function
+func NewClient(user *user_model.User, pubID string) (c *Client, err error) {
+	if err = containsRequiredHTTPHeaders(http.MethodGet, setting.Federation.GetHeaders); err != nil {
+		return


Given that there is currently a PR that attempts to get rid of naked returns, I think you should convert them.
Everywhere you added them.

routers/api/v1/activitypub/reqsignature.go

routers/api/v1/activitypub/person.go

…nger.go

6543 · 2022-06-19T05:22:49Z

🚀

* giteaofficial/main: [skip ci] Updated translations via Crowdin Catch the error before the response is processed by goth. (go-gitea#20000) Adjust transaction handling via db.Context (go-gitea#20031) Add more linters to improve code readability (go-gitea#19989) [skip ci] Updated translations via Crowdin Disable federation by default (go-gitea#20045) Respond with a 401 on git push when password isn't changed yet (go-gitea#20026) Alter hook_task TEXT fields to LONGTEXT (go-gitea#20038) Simplify and fix migration 216 (go-gitea#20035) use quoted regexp instead of git fixed-value (go-gitea#20029) fix delete pull head ref for DeleteIssue (go-gitea#20032) User keypairs and HTTP signatures for ActivityPub federation using go-ap (go-gitea#19133) Backtick table name in generic orphan check (go-gitea#20019) Update document to clarify that ALLOWED_DOMAINS/BLOCKED_DOMAINS support wildcard (go-gitea#20016) Return 404 when tag is broken (go-gitea#20017) Dump should only copy regular files and symlink regular files (go-gitea#20015)

@context

…-ap (go-gitea#19133) * go.mod: add go-fed/{httpsig,activity/pub,activity/streams} dependency go get github.com/go-fed/activity/streams@master go get github.com/go-fed/activity/pub@master go get github.com/go-fed/httpsig@master * activitypub: implement /api/v1/activitypub/user/{username} (go-gitea#14186) Return informations regarding a Person (as defined in ActivityStreams https://www.w3.org/TR/activitystreams-vocabulary/#dfn-person). Refs: go-gitea#14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: add the public key to Person (go-gitea#14186) Refs: go-gitea#14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: go-fed conformant Clock instance Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: signing http client Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: implement the ReqSignature middleware Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: hack_16834 Signed-off-by: Loïc Dachary <loic@dachary.org> * Fix CI checks-backend errors with go mod tidy Signed-off-by: Anthony Wang <ta180m@pm.me> * Change 2021 to 2022, properly format package imports Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt and make generate-swagger Signed-off-by: Anthony Wang <ta180m@pm.me> * Use Gitea JSON library, add assert for pkp Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt again, fix err var redeclaration Signed-off-by: Anthony Wang <ta180m@pm.me> * Remove LogSQL from ActivityPub person test Signed-off-by: Anthony Wang <ta180m@pm.me> * Assert if json.Unmarshal succeeds Signed-off-by: Anthony Wang <ta180m@pm.me> * Cleanup, handle invalid usernames for ActivityPub person GET request Signed-off-by: Anthony Wang <ta180m@pm.me> * Rename hack_16834 to user_settings Signed-off-by: Anthony Wang <ta180m@pm.me> * Use the httplib module instead of http for GET requests * Clean up whitespace with make fmt * Use time.RFC1123 and make the http.Client proxy-aware * Check if digest algo is supported in setting module * Clean up some variable declarations * Remove unneeded copy * Use system timezone instead of setting.DefaultUILocation * Use named constant for httpsigExpirationTime * Make pubKey IRI #main-key instead of /#main-key * Move /#main-key to #main-key in tests * Implemented Webfinger endpoint. * Add visible check. * Add user profile as alias. * Add actor IRI and remote interaction URL to WebFinger response * fmt * Fix lint errors * Use go-ap instead of go-fed * Run go mod tidy to fix missing modules in go.mod and go.sum * make fmt * Convert remaining code to go-ap * Clean up go.sum * Fix JSON unmarshall error * Fix CI errors by adding @context to Person() and making sure types match * Correctly decode JSON in api_activitypub_person_test.go * Force CI rerun * Fix TestActivityPubPersonInbox segfault * Fix lint error * Use @mariusor's suggestions for idiomatic go-ap usage * Correctly add inbox/outbox IRIs to person * Code cleanup * Remove another LogSQL from ActivityPub person test * Move httpsig algos slice to an init() function * Add actor IRI and remote interaction URL to WebFinger response * Update TestWebFinger to check for ActivityPub IRI in aliases * make fmt * Force CI rerun * WebFinger: Add CORS header and fix Href -> Template for remote interactions The CORS header is needed due to https://datatracker.ietf.org/doc/html/rfc7033#section-5 and fixes some Peertube <-> Gitea federation issues * make lint-backend * Make sure Person endpoint has Content-Type application/activity+json and includes PreferredUsername, URL, and Icon Setting the correct Content-Type is essential for federating with Mastodon * Use UTC instead of GMT * Rename pkey to pubKey * Make sure HTTP request Date in GMT * make fmt * dont drop err * Make sure API responses always refer to username in original case Copied from what I wrote on go-gitea#19133 discussion: Handling username case is a very tricky issue and I've already encountered a Mastodon <-> Gitea federation bug due to Gitea considering Ta180m and ta180m to be the same user while Mastodon thinks they are two different users. I think the best way forward is for Gitea to only use the original case version of the username for federation so other AP software don't get confused. * Move httpsig algs constant slice to modules/setting/federation.go * Add new federation settings to app.example.ini and config-cheat-sheet * Return if marshalling error * Make sure Person IRIs are generated correctly This commit ensures that if the setting.AppURL is something like "http://127.0.0.1:42567" (like in the integration tests), a trailing slash will be added after that URL. * If httpsig verification fails, fix Host header and try again This fixes a very rare bug when Gitea and another AP server (confirmed to happen with Mastodon) are running on the same machine, Gitea fails to verify incoming HTTP signatures. This is because the other AP server creates the sig with the public Gitea domain as the Host. However, when Gitea receives the request, the Host header is instead localhost, so the signature verification fails. Manually changing the host header to the correct value and trying the veification again fixes the bug. * Revert "If httpsig verification fails, fix Host header and try again" This reverts commit f53e46c. The bug was actually caused by nginx messing up the Host header when reverse-proxying since I didn't have the line `proxy_set_header Host $host;` in my nginx config for Gitea. * Go back to using ap.IRI to generate inbox and outbox IRIs * use const for key values * Update routers/web/webfinger.go * Use ctx.JSON in Person response to make code cleaner * Revert "Use ctx.JSON in Person response to make code cleaner" This doesn't work because the ctx.JSON() function already sends the response out and it's too late to edit the headers. This reverts commit 95aad98. * Use activitypub.ActivityStreamsContentType for Person response Content Type * Limit maximum ActivityPub request and response sizes to a configurable setting * Move setting key constants to models/user/setting_keys.go * Fix failing ActivityPubPerson integration test by checking the correct field for username * Add a warning about changing settings that can break federation * Add better comments * Don't multiply Federation.MaxSize by 1<<20 twice * Add more better comments * Fix failing ActivityPubMissingPerson test We now use ctx.ContextUser so the message printed out when a user does not exist is slightly different * make generate-swagger For some reason I didn't realize that /templates/swagger/v1_json.tmpl was machine-generated by make generate-swagger... I've been editing it by hand for three months! 🤦 * Move getting the RFC 2616 time to a separate function * More code cleanup * Update go-ap to fix empty liked collection and removed unneeded HTTP headers * go mod tidy * Add ed25519 to httpsig algorithms * Use go-ap/jsonld to add @context and marshal JSON * Change Gitea user agent from the default to Gitea/Version * Use ctx.ServerError and remove all remote interaction code from webfinger.go

@context

…-ap (go-gitea#19133) * go.mod: add go-fed/{httpsig,activity/pub,activity/streams} dependency go get github.com/go-fed/activity/streams@master go get github.com/go-fed/activity/pub@master go get github.com/go-fed/httpsig@master * activitypub: implement /api/v1/activitypub/user/{username} (go-gitea#14186) Return informations regarding a Person (as defined in ActivityStreams https://www.w3.org/TR/activitystreams-vocabulary/#dfn-person). Refs: go-gitea#14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: add the public key to Person (go-gitea#14186) Refs: go-gitea#14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: go-fed conformant Clock instance Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: signing http client Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: implement the ReqSignature middleware Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: hack_16834 Signed-off-by: Loïc Dachary <loic@dachary.org> * Fix CI checks-backend errors with go mod tidy Signed-off-by: Anthony Wang <ta180m@pm.me> * Change 2021 to 2022, properly format package imports Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt and make generate-swagger Signed-off-by: Anthony Wang <ta180m@pm.me> * Use Gitea JSON library, add assert for pkp Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt again, fix err var redeclaration Signed-off-by: Anthony Wang <ta180m@pm.me> * Remove LogSQL from ActivityPub person test Signed-off-by: Anthony Wang <ta180m@pm.me> * Assert if json.Unmarshal succeeds Signed-off-by: Anthony Wang <ta180m@pm.me> * Cleanup, handle invalid usernames for ActivityPub person GET request Signed-off-by: Anthony Wang <ta180m@pm.me> * Rename hack_16834 to user_settings Signed-off-by: Anthony Wang <ta180m@pm.me> * Use the httplib module instead of http for GET requests * Clean up whitespace with make fmt * Use time.RFC1123 and make the http.Client proxy-aware * Check if digest algo is supported in setting module * Clean up some variable declarations * Remove unneeded copy * Use system timezone instead of setting.DefaultUILocation * Use named constant for httpsigExpirationTime * Make pubKey IRI #main-key instead of /#main-key * Move /#main-key to #main-key in tests * Implemented Webfinger endpoint. * Add visible check. * Add user profile as alias. * Add actor IRI and remote interaction URL to WebFinger response * fmt * Fix lint errors * Use go-ap instead of go-fed * Run go mod tidy to fix missing modules in go.mod and go.sum * make fmt * Convert remaining code to go-ap * Clean up go.sum * Fix JSON unmarshall error * Fix CI errors by adding @context to Person() and making sure types match * Correctly decode JSON in api_activitypub_person_test.go * Force CI rerun * Fix TestActivityPubPersonInbox segfault * Fix lint error * Use @mariusor's suggestions for idiomatic go-ap usage * Correctly add inbox/outbox IRIs to person * Code cleanup * Remove another LogSQL from ActivityPub person test * Move httpsig algos slice to an init() function * Add actor IRI and remote interaction URL to WebFinger response * Update TestWebFinger to check for ActivityPub IRI in aliases * make fmt * Force CI rerun * WebFinger: Add CORS header and fix Href -> Template for remote interactions The CORS header is needed due to https://datatracker.ietf.org/doc/html/rfc7033#section-5 and fixes some Peertube <-> Gitea federation issues * make lint-backend * Make sure Person endpoint has Content-Type application/activity+json and includes PreferredUsername, URL, and Icon Setting the correct Content-Type is essential for federating with Mastodon * Use UTC instead of GMT * Rename pkey to pubKey * Make sure HTTP request Date in GMT * make fmt * dont drop err * Make sure API responses always refer to username in original case Copied from what I wrote on go-gitea#19133 discussion: Handling username case is a very tricky issue and I've already encountered a Mastodon <-> Gitea federation bug due to Gitea considering Ta180m and ta180m to be the same user while Mastodon thinks they are two different users. I think the best way forward is for Gitea to only use the original case version of the username for federation so other AP software don't get confused. * Move httpsig algs constant slice to modules/setting/federation.go * Add new federation settings to app.example.ini and config-cheat-sheet * Return if marshalling error * Make sure Person IRIs are generated correctly This commit ensures that if the setting.AppURL is something like "http://127.0.0.1:42567" (like in the integration tests), a trailing slash will be added after that URL. * If httpsig verification fails, fix Host header and try again This fixes a very rare bug when Gitea and another AP server (confirmed to happen with Mastodon) are running on the same machine, Gitea fails to verify incoming HTTP signatures. This is because the other AP server creates the sig with the public Gitea domain as the Host. However, when Gitea receives the request, the Host header is instead localhost, so the signature verification fails. Manually changing the host header to the correct value and trying the veification again fixes the bug. * Revert "If httpsig verification fails, fix Host header and try again" This reverts commit f53e46c. The bug was actually caused by nginx messing up the Host header when reverse-proxying since I didn't have the line `proxy_set_header Host $host;` in my nginx config for Gitea. * Go back to using ap.IRI to generate inbox and outbox IRIs * use const for key values * Update routers/web/webfinger.go * Use ctx.JSON in Person response to make code cleaner * Revert "Use ctx.JSON in Person response to make code cleaner" This doesn't work because the ctx.JSON() function already sends the response out and it's too late to edit the headers. This reverts commit 95aad98. * Use activitypub.ActivityStreamsContentType for Person response Content Type * Limit maximum ActivityPub request and response sizes to a configurable setting * Move setting key constants to models/user/setting_keys.go * Fix failing ActivityPubPerson integration test by checking the correct field for username * Add a warning about changing settings that can break federation * Add better comments * Don't multiply Federation.MaxSize by 1<<20 twice * Add more better comments * Fix failing ActivityPubMissingPerson test We now use ctx.ContextUser so the message printed out when a user does not exist is slightly different * make generate-swagger For some reason I didn't realize that /templates/swagger/v1_json.tmpl was machine-generated by make generate-swagger... I've been editing it by hand for three months! 🤦 * Move getting the RFC 2616 time to a separate function * More code cleanup * Update go-ap to fix empty liked collection and removed unneeded HTTP headers * go mod tidy * Add ed25519 to httpsig algorithms * Use go-ap/jsonld to add @context and marshal JSON * Change Gitea user agent from the default to Gitea/Version * Use ctx.ServerError and remove all remote interaction code from webfinger.go

routers/api/v1/activitypub/person.go

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gitea/gitea](https://github.com/go-gitea/gitea) | minor | `1.17.3-rootless` -> `1.18.5-rootless` | --- ### Release Notes <details> <summary>go-gitea/gitea</summary> ### [`v1.18.5`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1185-httpsgithubcomgo-giteagiteareleasestagv1185---2023-02-21) [Compare Source](go-gitea/gitea@v1.18.4...v1.18.5) - ENHANCEMENTS - Hide 2FA status from other members in organization members list ([#22999](go-gitea/gitea#22999)) ([#23023](go-gitea/gitea#23023)) - BUGFIXES - Add force_merge to merge request and fix checking mergable ([#23010](go-gitea/gitea#23010)) ([#23032](go-gitea/gitea#23032)) - Use `--message=%s` for git commit message ([#23028](go-gitea/gitea#23028)) ([#23029](go-gitea/gitea#23029)) - Render access log template as text instead of HTML ([#23013](go-gitea/gitea#23013)) ([#23025](go-gitea/gitea#23025)) - Fix the Manually Merged form ([#23015](go-gitea/gitea#23015)) ([#23017](go-gitea/gitea#23017)) - Use beforeCommit instead of baseCommit ([#22949](go-gitea/gitea#22949)) ([#22996](go-gitea/gitea#22996)) - Display attachments of review comment when comment content is blank ([#23035](go-gitea/gitea#23035)) ([#23046](go-gitea/gitea#23046)) - Return empty url for submodule tree entries ([#23043](go-gitea/gitea#23043)) ([#23048](go-gitea/gitea#23048)) ### [`v1.18.4`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1184-httpsgithubcomgo-giteagiteareleasestag1184---2023-02-20) [Compare Source](go-gitea/gitea@v1.18.3...v1.18.4) - SECURITY - Provide the ability to set password hash algorithm parameters ([#22942](go-gitea/gitea#22942)) ([#22943](go-gitea/gitea#22943)) - Add command to bulk set must-change-password ([#22823](go-gitea/gitea#22823)) ([#22928](go-gitea/gitea#22928)) - ENHANCEMENTS - Use import of OCI structs ([#22765](go-gitea/gitea#22765)) ([#22805](go-gitea/gitea#22805)) - Fix color of tertiary button on dark theme ([#22739](go-gitea/gitea#22739)) ([#22744](go-gitea/gitea#22744)) - Link issue and pull requests status change in UI notifications directly to their event in the timelined view. ([#22627](go-gitea/gitea#22627)) ([#22642](go-gitea/gitea#22642)) - BUGFIXES - Notify on container image create ([#22806](go-gitea/gitea#22806)) ([#22965](go-gitea/gitea#22965)) - Fix blame view missing lines ([#22826](go-gitea/gitea#22826)) ([#22929](go-gitea/gitea#22929)) - Fix incorrect role labels for migrated issues and comments ([#22914](go-gitea/gitea#22914)) ([#22923](go-gitea/gitea#22923)) - Fix PR file tree folders no longer collapsing ([#22864](go-gitea/gitea#22864)) ([#22872](go-gitea/gitea#22872)) - Escape filename when assemble URL ([#22850](go-gitea/gitea#22850)) ([#22871](go-gitea/gitea#22871)) - Fix isAllowed of escapeStreamer ([#22814](go-gitea/gitea#22814)) ([#22837](go-gitea/gitea#22837)) - Load issue before accessing index in merge message ([#22822](go-gitea/gitea#22822)) ([#22830](go-gitea/gitea#22830)) - Improve trace logging for pulls and processes ([#22633](go-gitea/gitea#22633)) ([#22812](go-gitea/gitea#22812)) - Fix restore repo bug, clarify the problem of ForeignIndex ([#22776](go-gitea/gitea#22776)) ([#22794](go-gitea/gitea#22794)) - Add default user visibility to cli command "admin user create" ([#22750](go-gitea/gitea#22750)) ([#22760](go-gitea/gitea#22760)) - Escape path for the file list ([#22741](go-gitea/gitea#22741)) ([#22757](go-gitea/gitea#22757)) - Fix bugs with WebAuthn preventing sign in and registration. ([#22651](go-gitea/gitea#22651)) ([#22721](go-gitea/gitea#22721)) - Add missing close bracket in imagediff ([#22710](go-gitea/gitea#22710)) ([#22712](go-gitea/gitea#22712)) - Move code comments to a standalone file and fix the bug when adding a reply to an outdated review appears to not post([#20821](go-gitea/gitea#20821)) ([#22707](go-gitea/gitea#22707)) - Fix line spacing for plaintext previews ([#22699](go-gitea/gitea#22699)) ([#22701](go-gitea/gitea#22701)) - Fix wrong hint when deleting a branch successfully from pull request UI ([#22673](go-gitea/gitea#22673)) ([#22698](go-gitea/gitea#22698)) - Fix README TOC links ([#22577](go-gitea/gitea#22577)) ([#22677](go-gitea/gitea#22677)) - Fix missing message in git hook when pull requests disabled on fork ([#22625](go-gitea/gitea#22625)) ([#22658](go-gitea/gitea#22658)) - Improve checkIfPRContentChanged ([#22611](go-gitea/gitea#22611)) ([#22644](go-gitea/gitea#22644)) - Prevent duplicate labels when importing more than 99 ([#22591](go-gitea/gitea#22591)) ([#22598](go-gitea/gitea#22598)) - Don't return duplicated users who can create org repo ([#22560](go-gitea/gitea#22560)) ([#22562](go-gitea/gitea#22562)) - BUILD - Upgrade golangcilint to v1.51.0 ([#22764](go-gitea/gitea#22764)) - MISC - Use proxy for pull mirror ([#22771](go-gitea/gitea#22771)) ([#22772](go-gitea/gitea#22772)) - Use `--index-url` in PyPi description ([#22620](go-gitea/gitea#22620)) ([#22636](go-gitea/gitea#22636)) ### [`v1.18.3`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1183-httpsgithubcomgo-giteagiteareleasestagv1183---2023-01-23) [Compare Source](go-gitea/gitea@v1.18.2...v1.18.3) - SECURITY - Prevent multiple `To` recipients ([#22566](go-gitea/gitea#22566)) ([#22569](go-gitea/gitea#22569)) - BUGFIXES - Truncate commit summary on repo files table. ([#22551](go-gitea/gitea#22551)) ([#22552](go-gitea/gitea#22552)) - Mute all links in issue timeline ([#22534](go-gitea/gitea#22534)) ### [`v1.18.2`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1182-httpsgithubcomgo-giteagiteareleasestagv1182---2023-01-19) [Compare Source](go-gitea/gitea@v1.18.1...v1.18.2) - BUGFIXES - Fix issue not auto-closing when it includes a reference to a branch ([#22514](go-gitea/gitea#22514)) ([#22521](go-gitea/gitea#22521)) - Fix invalid issue branch reference if not specified in template ([#22513](go-gitea/gitea#22513)) ([#22520](go-gitea/gitea#22520)) - Fix 500 error viewing pull request when fork has pull requests disabled ([#22512](go-gitea/gitea#22512)) ([#22515](go-gitea/gitea#22515)) - Reliable selection of admin user ([#22509](go-gitea/gitea#22509)) ([#22511](go-gitea/gitea#22511)) - Set disable_gravatar/enable_federated_avatar when offline mode is true ([#22479](go-gitea/gitea#22479)) ([#22496](go-gitea/gitea#22496)) - BUILD - cgo cross-compile for freebsd ([#22397](go-gitea/gitea#22397)) ([#22519](go-gitea/gitea#22519)) ### [`v1.18.1`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1181-httpsgithubcomgo-giteagiteareleasestagv1181---2023-01-17) [Compare Source](go-gitea/gitea@v1.18.0...v1.18.1) - API - Add `sync_on_commit` option for push mirrors api ([#22271](go-gitea/gitea#22271)) ([#22292](go-gitea/gitea#22292)) - BUGFIXES - Update `github.com/zeripath/zapx/v15` ([#22485](go-gitea/gitea#22485)) - Fix pull request API field `closed_at` always being `null` ([#22482](go-gitea/gitea#22482)) ([#22483](go-gitea/gitea#22483)) - Fix container blob mount ([#22226](go-gitea/gitea#22226)) ([#22476](go-gitea/gitea#22476)) - Fix error when calculating repository size ([#22392](go-gitea/gitea#22392)) ([#22474](go-gitea/gitea#22474)) - Fix Operator does not exist bug on explore page with ONLY_SHOW_RELEVANT_REPOS ([#22454](go-gitea/gitea#22454)) ([#22472](go-gitea/gitea#22472)) - Fix environments for KaTeX and error reporting ([#22453](go-gitea/gitea#22453)) ([#22473](go-gitea/gitea#22473)) - Remove the netgo tag for Windows build ([#22467](go-gitea/gitea#22467)) ([#22468](go-gitea/gitea#22468)) - Fix migration from GitBucket ([#22477](go-gitea/gitea#22477)) ([#22465](go-gitea/gitea#22465)) - Prevent panic on looking at api "git" endpoints for empty repos ([#22457](go-gitea/gitea#22457)) ([#22458](go-gitea/gitea#22458)) - Fix PR status layout on mobile ([#21547](go-gitea/gitea#21547)) ([#22441](go-gitea/gitea#22441)) - Fix wechatwork webhook sends empty content in PR review ([#21762](go-gitea/gitea#21762)) ([#22440](go-gitea/gitea#22440)) - Remove duplicate "Actions" label in mobile view ([#21974](go-gitea/gitea#21974)) ([#22439](go-gitea/gitea#22439)) - Fix leaving organization bug on user settings -> orgs ([#21983](go-gitea/gitea#21983)) ([#22438](go-gitea/gitea#22438)) - Fixed colour transparency regex matching in project board sorting ([#22092](go-gitea/gitea#22092)) ([#22437](go-gitea/gitea#22437)) - Correctly handle select on multiple channels in Queues ([#22146](go-gitea/gitea#22146)) ([#22428](go-gitea/gitea#22428)) - Prepend refs/heads/ to issue template refs ([#20461](go-gitea/gitea#20461)) ([#22427](go-gitea/gitea#22427)) - Restore function to "Show more" buttons ([#22399](go-gitea/gitea#22399)) ([#22426](go-gitea/gitea#22426)) - Continue GCing other repos on error in one repo ([#22422](go-gitea/gitea#22422)) ([#22425](go-gitea/gitea#22425)) - Allow HOST has no port ([#22280](go-gitea/gitea#22280)) ([#22409](go-gitea/gitea#22409)) - Fix omit avatar_url in discord payload when empty ([#22393](go-gitea/gitea#22393)) ([#22394](go-gitea/gitea#22394)) - Don't display stop watch top bar icon when disabled and hidden when click other place ([#22374](go-gitea/gitea#22374)) ([#22387](go-gitea/gitea#22387)) - Don't lookup mail server when using sendmail ([#22300](go-gitea/gitea#22300)) ([#22383](go-gitea/gitea#22383)) - Fix gravatar disable bug ([#22337](go-gitea/gitea#22337)) - Fix update settings table on install ([#22326](go-gitea/gitea#22326)) ([#22327](go-gitea/gitea#22327)) - Fix sitemap ([#22272](go-gitea/gitea#22272)) ([#22320](go-gitea/gitea#22320)) - Fix code search title translation ([#22285](go-gitea/gitea#22285)) ([#22316](go-gitea/gitea#22316)) - Fix due date rendering the wrong date in issue ([#22302](go-gitea/gitea#22302)) ([#22306](go-gitea/gitea#22306)) - Fix get system setting bug when enabled redis cache ([#22298](go-gitea/gitea#22298)) - Fix bug of DisableGravatar default value ([#22297](go-gitea/gitea#22297)) - Fix key signature error page ([#22229](go-gitea/gitea#22229)) ([#22230](go-gitea/gitea#22230)) - TESTING - Remove test session cache to reduce possible concurrent problem ([#22199](go-gitea/gitea#22199)) ([#22429](go-gitea/gitea#22429)) - MISC - Restore previous official review when an official review is deleted ([#22449](go-gitea/gitea#22449)) ([#22460](go-gitea/gitea#22460)) - Log STDERR of external renderer when it fails ([#22442](go-gitea/gitea#22442)) ([#22444](go-gitea/gitea#22444)) ### [`v1.18.0`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1180-httpsgithubcomgo-giteagiteareleasestagv1180---2022-12-29) [Compare Source](go-gitea/gitea@v1.17.4...v1.18.0) - SECURITY - Remove ReverseProxy authentication from the API ([#22219](go-gitea/gitea#22219)) ([#22251](go-gitea/gitea#22251)) - Support Go Vulnerability Management ([#21139](go-gitea/gitea#21139)) - Forbid HTML string tooltips ([#20935](go-gitea/gitea#20935)) - BREAKING - Rework mailer settings ([#18982](go-gitea/gitea#18982)) - Remove U2F support ([#20141](go-gitea/gitea#20141)) - Refactor `i18n` to `locale` ([#20153](go-gitea/gitea#20153)) - Enable contenthash in filename for dynamic assets ([#20813](go-gitea/gitea#20813)) - FEATURES - Add color previews in markdown ([#21474](go-gitea/gitea#21474)) - Allow package version sorting ([#21453](go-gitea/gitea#21453)) - Add support for Chocolatey/NuGet v2 API ([#21393](go-gitea/gitea#21393)) - Add API endpoint to get changed files of a PR ([#21177](go-gitea/gitea#21177)) - Add filetree on left of diff view ([#21012](go-gitea/gitea#21012)) - Support Issue forms and PR forms ([#20987](go-gitea/gitea#20987)) - Add support for Vagrant packages ([#20930](go-gitea/gitea#20930)) - Add support for `npm unpublish` ([#20688](go-gitea/gitea#20688)) - Add badge capabilities to users ([#20607](go-gitea/gitea#20607)) - Add issue filter for Author ([#20578](go-gitea/gitea#20578)) - Add KaTeX rendering to Markdown. ([#20571](go-gitea/gitea#20571)) - Add support for Pub packages ([#20560](go-gitea/gitea#20560)) - Support localized README ([#20508](go-gitea/gitea#20508)) - Add support mCaptcha as captcha provider ([#20458](go-gitea/gitea#20458)) - Add team member invite by email ([#20307](go-gitea/gitea#20307)) - Added email notification option to receive all own messages ([#20179](go-gitea/gitea#20179)) - Switch Unicode Escaping to a VSCode-like system ([#19990](go-gitea/gitea#19990)) - Add user/organization code search ([#19977](go-gitea/gitea#19977)) - Only show relevant repositories on explore page ([#19361](go-gitea/gitea#19361)) - User keypairs and HTTP signatures for ActivityPub federation using go-ap ([#19133](go-gitea/gitea#19133)) - Add sitemap support ([#18407](go-gitea/gitea#18407)) - Allow creation of OAuth2 applications for orgs ([#18084](go-gitea/gitea#18084)) - Add system setting table with cache and also add cache supports for user setting ([#18058](go-gitea/gitea#18058)) - Add pages to view watched repos and subscribed issues/PRs ([#17156](go-gitea/gitea#17156)) - Support Proxy protocol ([#12527](go-gitea/gitea#12527)) - Implement sync push mirror on commit ([#19411](go-gitea/gitea#19411)) - API - Allow empty assignees on pull request edit ([#22150](go-gitea/gitea#22150)) ([#22214](go-gitea/gitea#22214)) - Make external issue tracker regexp configurable via API ([#21338](go-gitea/gitea#21338)) - Add name field for org api ([#21270](go-gitea/gitea#21270)) - Show teams with no members if user is admin ([#21204](go-gitea/gitea#21204)) - Add latest commit's SHA to content response ([#20398](go-gitea/gitea#20398)) - Add allow_rebase_update, default_delete_branch_after_merge to repository api response ([#20079](go-gitea/gitea#20079)) - Add new endpoints for push mirrors management ([#19841](go-gitea/gitea#19841)) - ENHANCEMENTS - Add setting to disable the git apply step in test patch ([#22130](go-gitea/gitea#22130)) ([#22170](go-gitea/gitea#22170)) - Multiple improvements for comment edit diff ([#21990](go-gitea/gitea#21990)) ([#22007](go-gitea/gitea#22007)) - Fix button in branch list, avoid unexpected page jump before restore branch actually done ([#21562](go-gitea/gitea#21562)) ([#21928](go-gitea/gitea#21928)) - Fix flex layout for repo list icons ([#21896](go-gitea/gitea#21896)) ([#21920](go-gitea/gitea#21920)) - Fix vertical align of committer avatar rendered by email address ([#21884](go-gitea/gitea#21884)) ([#21918](go-gitea/gitea#21918)) - Fix setting HTTP headers after write ([#21833](go-gitea/gitea#21833)) ([#21877](go-gitea/gitea#21877)) - Color and Style enhancements ([#21784](go-gitea/gitea#21784), [#21799](go-gitea/gitea#21799)) ([#21868](go-gitea/gitea#21868)) - Ignore line anchor links with leading zeroes ([#21728](go-gitea/gitea#21728)) ([#21776](go-gitea/gitea#21776)) - Quick fixes monaco-editor error: "vs.editor.nullLanguage" ([#21734](go-gitea/gitea#21734)) ([#21738](go-gitea/gitea#21738)) - Use CSS color-scheme instead of invert ([#21616](go-gitea/gitea#21616)) ([#21623](go-gitea/gitea#21623)) - Respect user's locale when rendering the date range in the repo activity page ([#21410](go-gitea/gitea#21410)) - Change `commits-table` column width ([#21564](go-gitea/gitea#21564)) - Refactor git command arguments and make all arguments to be safe to be used ([#21535](go-gitea/gitea#21535)) - CSS color enhancements ([#21534](go-gitea/gitea#21534)) - Add link to user profile in markdown mention only if user exists ([#21533](go-gitea/gitea#21533), [#21554](go-gitea/gitea#21554)) - Add option to skip index dirs ([#21501](go-gitea/gitea#21501)) - Diff file tree tweaks ([#21446](go-gitea/gitea#21446)) - Localize all timestamps ([#21440](go-gitea/gitea#21440)) - Add `code` highlighting in issue titles ([#21432](go-gitea/gitea#21432)) - Use Name instead of DisplayName in LFS Lock ([#21415](go-gitea/gitea#21415)) - Consolidate more CSS colors into variables ([#21402](go-gitea/gitea#21402)) - Redirect to new repository owner ([#21398](go-gitea/gitea#21398)) - Use ISO date format instead of hard-coded English date format for date range in repo activity page ([#21396](go-gitea/gitea#21396)) - Use weighted algorithm for string matching when finding files in repo ([#21370](go-gitea/gitea#21370)) - Show private data in feeds ([#21369](go-gitea/gitea#21369)) - Refactor parseTreeEntries, speed up tree list ([#21368](go-gitea/gitea#21368)) - Add GET and DELETE endpoints for Docker blob uploads ([#21367](go-gitea/gitea#21367)) - Add nicer error handling on template compile errors ([#21350](go-gitea/gitea#21350)) - Add `stat` to `ToCommit` function for speed ([#21337](go-gitea/gitea#21337)) - Support instance-wide OAuth2 applications ([#21335](go-gitea/gitea#21335)) - Record OAuth client type at registration ([#21316](go-gitea/gitea#21316)) - Add new CSS variables --color-accent and --color-small-accent ([#21305](go-gitea/gitea#21305)) - Improve error descriptions for unauthorized_client ([#21292](go-gitea/gitea#21292)) - Case-insensitive "find files in repo" ([#21269](go-gitea/gitea#21269)) - Consolidate more CSS rules, fix inline code on arc-green ([#21260](go-gitea/gitea#21260)) - Log real ip of requests from ssh ([#21216](go-gitea/gitea#21216)) - Save files in local storage as group readable ([#21198](go-gitea/gitea#21198)) - Enable fluid page layout on medium size viewports ([#21178](go-gitea/gitea#21178)) - File header tweaks ([#21175](go-gitea/gitea#21175)) - Added missing headers on user packages page ([#21172](go-gitea/gitea#21172)) - Display image digest for container packages ([#21170](go-gitea/gitea#21170)) - Skip dirty check for team forms ([#21154](go-gitea/gitea#21154)) - Keep path when creating a new branch ([#21153](go-gitea/gitea#21153)) - Remove fomantic image module ([#21145](go-gitea/gitea#21145)) - Make labels clickable in the comments section. ([#21137](go-gitea/gitea#21137)) - Sort branches and tags by date descending ([#21136](go-gitea/gitea#21136)) - Better repo API unit checks ([#21130](go-gitea/gitea#21130)) - Improve commit status icons ([#21124](go-gitea/gitea#21124)) - Limit length of repo description and repo url input fields ([#21119](go-gitea/gitea#21119)) - Show .editorconfig errors in frontend ([#21088](go-gitea/gitea#21088)) - Allow poster to choose reviewers ([#21084](go-gitea/gitea#21084)) - Remove black labels and CSS cleanup ([#21003](go-gitea/gitea#21003)) - Make e-mail sanity check more precise ([#20991](go-gitea/gitea#20991)) - Use native inputs in whitespace dropdown ([#20980](go-gitea/gitea#20980)) - Enhance package date display ([#20928](go-gitea/gitea#20928)) - Display total blob size of a package version ([#20927](go-gitea/gitea#20927)) - Show language name on hover ([#20923](go-gitea/gitea#20923)) - Show instructions for all generic package files ([#20917](go-gitea/gitea#20917)) - Refactor AssertExistsAndLoadBean to use generics ([#20797](go-gitea/gitea#20797)) - Move the official website link at the footer of gitea ([#20777](go-gitea/gitea#20777)) - Add support for full name in reverse proxy auth ([#20776](go-gitea/gitea#20776)) - Remove useless JS operation for relative time tooltips ([#20756](go-gitea/gitea#20756)) - Replace some icons with SVG ([#20741](go-gitea/gitea#20741)) - Change commit status icons to SVG ([#20736](go-gitea/gitea#20736)) - Improve single repo action for issue and pull requests ([#20730](go-gitea/gitea#20730)) - Allow multiple files in generic packages ([#20661](go-gitea/gitea#20661)) - Add option to create new issue from /issues page ([#20650](go-gitea/gitea#20650)) - Background color of private list-items updated ([#20630](go-gitea/gitea#20630)) - Added search input field to issue filter ([#20623](go-gitea/gitea#20623)) - Increase default item listing size `ISSUE_PAGING_NUM` to 20 ([#20547](go-gitea/gitea#20547)) - Modify milestone search keywords to be case insensitive again ([#20513](go-gitea/gitea#20513)) - Show hint to link package to repo when viewing empty repo package list ([#20504](go-gitea/gitea#20504)) - Add Tar ZSTD support ([#20493](go-gitea/gitea#20493)) - Make code review checkboxes clickable ([#20481](go-gitea/gitea#20481)) - Add "X-Gitea-Object-Type" header for GET `/raw/` & `/media/` API ([#20438](go-gitea/gitea#20438)) - Display project in issue list ([#20434](go-gitea/gitea#20434)) - Prepend commit message to template content when opening a new PR ([#20429](go-gitea/gitea#20429)) - Replace fomantic popup module with tippy.js ([#20428](go-gitea/gitea#20428)) - Allow to specify colors for text in markup ([#20363](go-gitea/gitea#20363)) - Allow access to the Public Organization Member lists with minimal permissions ([#20330](go-gitea/gitea#20330)) - Use default values when provided values are empty ([#20318](go-gitea/gitea#20318)) - Vertical align navbar avatar at middle ([#20302](go-gitea/gitea#20302)) - Delete cancel button in repo creation page ([#21381](go-gitea/gitea#21381)) - Include login_name in adminCreateUser response ([#20283](go-gitea/gitea#20283)) - fix: icon margin in user/settings/repos ([#20281](go-gitea/gitea#20281)) - Remove blue text on migrate page ([#20273](go-gitea/gitea#20273)) - Modify milestone search keywords to be case insensitive ([#20266](go-gitea/gitea#20266)) - Move some files into models' sub packages ([#20262](go-gitea/gitea#20262)) - Add tooltip to repo icons in explore page ([#20241](go-gitea/gitea#20241)) - Remove deprecated licenses ([#20222](go-gitea/gitea#20222)) - Webhook for Wiki changes ([#20219](go-gitea/gitea#20219)) - Share HTML template renderers and create a watcher framework ([#20218](go-gitea/gitea#20218)) - Allow enable LDAP source and disable user sync via CLI ([#20206](go-gitea/gitea#20206)) - Adds a checkbox to select all issues/PRs ([#20177](go-gitea/gitea#20177)) - Refactor `i18n` to `locale` ([#20153](go-gitea/gitea#20153)) - Disable status checks in template if none found ([#20088](go-gitea/gitea#20088)) - Allow manager logging to set SQL ([#20064](go-gitea/gitea#20064)) - Add order by for assignee no sort issue ([#20053](go-gitea/gitea#20053)) - Take a stab at porting existing components to Vue3 ([#20044](go-gitea/gitea#20044)) - Add doctor command to write commit-graphs ([#20007](go-gitea/gitea#20007)) - Add support for authentication based on reverse proxy email ([#19949](go-gitea/gitea#19949)) - Enable spellcheck for EasyMDE, use contenteditable mode ([#19776](go-gitea/gitea#19776)) - Allow specifying SECRET_KEY_URI, similar to INTERNAL_TOKEN_URI ([#19663](go-gitea/gitea#19663)) - Rework mailer settings ([#18982](go-gitea/gitea#18982)) - Add option to purge users ([#18064](go-gitea/gitea#18064)) - Add author search input ([#21246](go-gitea/gitea#21246)) - Make rss/atom identifier globally unique ([#21550](go-gitea/gitea#21550)) - BUGFIXES - Auth interface return error when verify failure ([#22119](go-gitea/gitea#22119)) ([#22259](go-gitea/gitea#22259)) - Use complete SHA to create and query commit status ([#22244](go-gitea/gitea#22244)) ([#22257](go-gitea/gitea#22257)) - Update bleve and zapx to fix unaligned atomic ([#22031](go-gitea/gitea#22031)) ([#22218](go-gitea/gitea#22218)) - Prevent panic in doctor command when running default checks ([#21791](go-gitea/gitea#21791)) ([#21807](go-gitea/gitea#21807)) - Load GitRepo in API before deleting issue ([#21720](go-gitea/gitea#21720)) ([#21796](go-gitea/gitea#21796)) - Ignore line anchor links with leading zeroes ([#21728](go-gitea/gitea#21728)) ([#21776](go-gitea/gitea#21776)) - Set last login when activating account ([#21731](go-gitea/gitea#21731)) ([#21755](go-gitea/gitea#21755)) - Fix UI language switching bug ([#21597](go-gitea/gitea#21597)) ([#21749](go-gitea/gitea#21749)) - Quick fixes monaco-editor error: "vs.editor.nullLanguage" ([#21734](go-gitea/gitea#21734)) ([#21738](go-gitea/gitea#21738)) - Allow local package identifiers for PyPI packages ([#21690](go-gitea/gitea#21690)) ([#21727](go-gitea/gitea#21727)) - Deal with markdown template without metadata ([#21639](go-gitea/gitea#21639)) ([#21654](go-gitea/gitea#21654)) - Fix opaque background on mermaid diagrams ([#21642](go-gitea/gitea#21642)) ([#21652](go-gitea/gitea#21652)) - Fix repository adoption on Windows ([#21646](go-gitea/gitea#21646)) ([#21650](go-gitea/gitea#21650)) - Sync git hooks when config file path changed ([#21619](go-gitea/gitea#21619)) ([#21626](go-gitea/gitea#21626)) - Fix 500 on PR files API ([#21602](go-gitea/gitea#21602)) ([#21607](go-gitea/gitea#21607)) - Fix `Timestamp.IsZero` ([#21593](go-gitea/gitea#21593)) ([#21603](go-gitea/gitea#21603)) - Fix viewing user subscriptions ([#21482](go-gitea/gitea#21482)) - Fix mermaid-related bugs ([#21431](go-gitea/gitea#21431)) - Fix branch dropdown shifting on page load ([#21428](go-gitea/gitea#21428)) - Fix default theme-auto selector when nologin ([#21346](go-gitea/gitea#21346)) - Fix and improve incorrect error messages ([#21342](go-gitea/gitea#21342)) - Fix formatted link for PR review notifications to matrix ([#21319](go-gitea/gitea#21319)) - Center-aligning content of WebAuthN page ([#21127](go-gitea/gitea#21127)) - Remove follow from commits by file ([#20765](go-gitea/gitea#20765)) - Fix commit status popup ([#20737](go-gitea/gitea#20737)) - Fix init mail render logic ([#20704](go-gitea/gitea#20704)) - Use correct page size for link header pagination ([#20546](go-gitea/gitea#20546)) - Preserve unix socket file ([#20499](go-gitea/gitea#20499)) - Use tippy.js for context popup ([#20393](go-gitea/gitea#20393)) - Add missing parameter for error in log message ([#20144](go-gitea/gitea#20144)) - Do not allow organisation owners add themselves as collaborator ([#20043](go-gitea/gitea#20043)) - Rework file highlight rendering and fix yaml copy-paste ([#19967](go-gitea/gitea#19967)) - Improve code diff highlight, fix incorrect rendered diff result ([#19958](go-gitea/gitea#19958)) - TESTING - Improve OAuth integration tests ([#21390](go-gitea/gitea#21390)) - Add playwright tests ([#20123](go-gitea/gitea#20123)) - BUILD - Switch to building with go1.19 ([#20695](go-gitea/gitea#20695)) - Update JS dependencies, adjust eslint ([#20659](go-gitea/gitea#20659)) - Add more linters to improve code readability ([#19989](go-gitea/gitea#19989)) ### [`v1.17.4`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1174-httpsgithubcomgo-giteagiteareleasestagv1174---2022-12-21) [Compare Source](go-gitea/gitea@v1.17.3...v1.17.4) - SECURITY - Do not allow Ghost access to limited visible user/org ([#21849](go-gitea/gitea#21849)) ([#21875](go-gitea/gitea#21875)) - Fix package access for admins and inactive users ([#21580](go-gitea/gitea#21580)) ([#21592](go-gitea/gitea#21592)) - ENHANCEMENTS - Fix button in branch list, avoid unexpected page jump before restore branch actually done ([#21562](go-gitea/gitea#21562)) ([#21927](go-gitea/gitea#21927)) - Fix vertical align of committer avatar rendered by email address ([#21884](go-gitea/gitea#21884)) ([#21919](go-gitea/gitea#21919)) - Fix setting HTTP headers after write ([#21833](go-gitea/gitea#21833)) ([#21874](go-gitea/gitea#21874)) - Ignore line anchor links with leading zeroes ([#21728](go-gitea/gitea#21728)) ([#21777](go-gitea/gitea#21777)) - Enable Monaco automaticLayout ([#21516](go-gitea/gitea#21516)) - BUGFIXES - Do not list active repositories as unadopted ([#22034](go-gitea/gitea#22034)) ([#22167](go-gitea/gitea#22167)) - Correctly handle moved files in apply patch ([#22118](go-gitea/gitea#22118)) ([#22136](go-gitea/gitea#22136)) - Fix condition for is_internal ([#22095](go-gitea/gitea#22095)) ([#22131](go-gitea/gitea#22131)) - Fix permission check on issue/pull lock ([#22114](go-gitea/gitea#22114)) - Fix sorting admin user list by last login ([#22081](go-gitea/gitea#22081)) ([#22106](go-gitea/gitea#22106)) - Workaround for container registry push/pull errors ([#21862](go-gitea/gitea#21862)) ([#22069](go-gitea/gitea#22069)) - Fix issue/PR numbers ([#22037](go-gitea/gitea#22037)) ([#22045](go-gitea/gitea#22045)) - Handle empty author names ([#21902](go-gitea/gitea#21902)) ([#22028](go-gitea/gitea#22028)) - Fix ListBranches to handle empty case ([#21921](go-gitea/gitea#21921)) ([#22025](go-gitea/gitea#22025)) - Fix enabling partial clones on 1.17 ([#21809](go-gitea/gitea#21809)) - Prevent panic in doctor command when running default checks ([#21791](go-gitea/gitea#21791)) ([#21808](go-gitea/gitea#21808)) - Upgrade golang.org/x/crypto ([#21792](go-gitea/gitea#21792)) ([#21794](go-gitea/gitea#21794)) - Init git module before database migration ([#21764](go-gitea/gitea#21764)) ([#21766](go-gitea/gitea#21766)) - Set last login when activating account ([#21731](go-gitea/gitea#21731)) ([#21754](go-gitea/gitea#21754)) - Add HEAD fix to gitea doctor ([#21352](go-gitea/gitea#21352)) ([#21751](go-gitea/gitea#21751)) - Fix UI language switching bug ([#21597](go-gitea/gitea#21597)) ([#21748](go-gitea/gitea#21748)) - Remove semver compatible flag and change pypi to an array of test cases ([#21708](go-gitea/gitea#21708)) ([#21729](go-gitea/gitea#21729)) - Allow local package identifiers for PyPI packages ([#21690](go-gitea/gitea#21690)) ([#21726](go-gitea/gitea#21726)) - Fix repository adoption on Windows ([#21646](go-gitea/gitea#21646)) ([#21651](go-gitea/gitea#21651)) - Sync git hooks when config file path changed ([#21619](go-gitea/gitea#21619)) ([#21625](go-gitea/gitea#21625)) - Added check for disabled Packages ([#21540](go-gitea/gitea#21540)) ([#21614](go-gitea/gitea#21614)) - Fix `Timestamp.IsZero` ([#21593](go-gitea/gitea#21593)) ([#21604](go-gitea/gitea#21604)) - Fix issues count bug ([#21600](go-gitea/gitea#21600)) - Support binary deploy in npm packages ([#21589](go-gitea/gitea#21589)) - Update milestone counters when issue is deleted ([#21459](go-gitea/gitea#21459)) ([#21586](go-gitea/gitea#21586)) - SessionUser protection against nil pointer dereference ([#21581](go-gitea/gitea#21581)) - Case-insensitive NuGet symbol file GUID ([#21409](go-gitea/gitea#21409)) ([#21575](go-gitea/gitea#21575)) - Suppress `ExternalLoginUserNotExist` error ([#21504](go-gitea/gitea#21504)) ([#21572](go-gitea/gitea#21572)) - Prevent Authorization header for presigned LFS urls ([#21531](go-gitea/gitea#21531)) ([#21569](go-gitea/gitea#21569)) - Update binding to fix bugs ([#21560](go-gitea/gitea#21560)) - Fix generating compare link ([#21519](go-gitea/gitea#21519)) ([#21530](go-gitea/gitea#21530)) - Ignore error when retrieving changed PR review files ([#21487](go-gitea/gitea#21487)) ([#21524](go-gitea/gitea#21524)) - Fix incorrect notification commit url ([#21479](go-gitea/gitea#21479)) ([#21483](go-gitea/gitea#21483)) - Display total commit count in hook message ([#21400](go-gitea/gitea#21400)) ([#21481](go-gitea/gitea#21481)) - Enforce grouped NuGet search results ([#21442](go-gitea/gitea#21442)) ([#21480](go-gitea/gitea#21480)) - Return 404 when user is not found on avatar ([#21476](go-gitea/gitea#21476)) ([#21477](go-gitea/gitea#21477)) - Normalize NuGet package version on upload ([#22186](go-gitea/gitea#22186)) ([#22201](go-gitea/gitea#22201)) - MISC - Check for zero time instant in TimeStamp.IsZero() ([#22171](go-gitea/gitea#22171)) ([#22173](go-gitea/gitea#22173)) - Fix warn in database structs sync ([#22111](go-gitea/gitea#22111)) - Allow for resolution of NPM registry paths that match upstream ([#21568](go-gitea/gitea#21568)) ([#21723](go-gitea/gitea#21723)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: Michael Wittig <michael.wittig@posteo.de> Reviewed-on: https://gitea.sh4ke.rocks/sh4ke/k8s-projects/pulls/85

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gitea/gitea](https://github.com/go-gitea/gitea) | minor | `1.17.3-rootless` -> `1.18.5-rootless` | --- ### Release Notes <details> <summary>go-gitea/gitea</summary> ### [`v1.18.5`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1185-httpsgithubcomgo-giteagiteareleasestagv1185---2023-02-21) [Compare Source](go-gitea/gitea@v1.18.4...v1.18.5) - ENHANCEMENTS - Hide 2FA status from other members in organization members list ([#22999](go-gitea/gitea#22999)) ([#23023](go-gitea/gitea#23023)) - BUGFIXES - Add force_merge to merge request and fix checking mergable ([#23010](go-gitea/gitea#23010)) ([#23032](go-gitea/gitea#23032)) - Use `--message=%s` for git commit message ([#23028](go-gitea/gitea#23028)) ([#23029](go-gitea/gitea#23029)) - Render access log template as text instead of HTML ([#23013](go-gitea/gitea#23013)) ([#23025](go-gitea/gitea#23025)) - Fix the Manually Merged form ([#23015](go-gitea/gitea#23015)) ([#23017](go-gitea/gitea#23017)) - Use beforeCommit instead of baseCommit ([#22949](go-gitea/gitea#22949)) ([#22996](go-gitea/gitea#22996)) - Display attachments of review comment when comment content is blank ([#23035](go-gitea/gitea#23035)) ([#23046](go-gitea/gitea#23046)) - Return empty url for submodule tree entries ([#23043](go-gitea/gitea#23043)) ([#23048](go-gitea/gitea#23048)) ### [`v1.18.4`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1184-httpsgithubcomgo-giteagiteareleasestag1184---2023-02-20) [Compare Source](go-gitea/gitea@v1.18.3...v1.18.4) - SECURITY - Provide the ability to set password hash algorithm parameters ([#22942](go-gitea/gitea#22942)) ([#22943](go-gitea/gitea#22943)) - Add command to bulk set must-change-password ([#22823](go-gitea/gitea#22823)) ([#22928](go-gitea/gitea#22928)) - ENHANCEMENTS - Use import of OCI structs ([#22765](go-gitea/gitea#22765)) ([#22805](go-gitea/gitea#22805)) - Fix color of tertiary button on dark theme ([#22739](go-gitea/gitea#22739)) ([#22744](go-gitea/gitea#22744)) - Link issue and pull requests status change in UI notifications directly to their event in the timelined view. ([#22627](go-gitea/gitea#22627)) ([#22642](go-gitea/gitea#22642)) - BUGFIXES - Notify on container image create ([#22806](go-gitea/gitea#22806)) ([#22965](go-gitea/gitea#22965)) - Fix blame view missing lines ([#22826](go-gitea/gitea#22826)) ([#22929](go-gitea/gitea#22929)) - Fix incorrect role labels for migrated issues and comments ([#22914](go-gitea/gitea#22914)) ([#22923](go-gitea/gitea#22923)) - Fix PR file tree folders no longer collapsing ([#22864](go-gitea/gitea#22864)) ([#22872](go-gitea/gitea#22872)) - Escape filename when assemble URL ([#22850](go-gitea/gitea#22850)) ([#22871](go-gitea/gitea#22871)) - Fix isAllowed of escapeStreamer ([#22814](go-gitea/gitea#22814)) ([#22837](go-gitea/gitea#22837)) - Load issue before accessing index in merge message ([#22822](go-gitea/gitea#22822)) ([#22830](go-gitea/gitea#22830)) - Improve trace logging for pulls and processes ([#22633](go-gitea/gitea#22633)) ([#22812](go-gitea/gitea#22812)) - Fix restore repo bug, clarify the problem of ForeignIndex ([#22776](go-gitea/gitea#22776)) ([#22794](go-gitea/gitea#22794)) - Add default user visibility to cli command "admin user create" ([#22750](go-gitea/gitea#22750)) ([#22760](go-gitea/gitea#22760)) - Escape path for the file list ([#22741](go-gitea/gitea#22741)) ([#22757](go-gitea/gitea#22757)) - Fix bugs with WebAuthn preventing sign in and registration. ([#22651](go-gitea/gitea#22651)) ([#22721](go-gitea/gitea#22721)) - Add missing close bracket in imagediff ([#22710](go-gitea/gitea#22710)) ([#22712](go-gitea/gitea#22712)) - Move code comments to a standalone file and fix the bug when adding a reply to an outdated review appears to not post([#20821](go-gitea/gitea#20821)) ([#22707](go-gitea/gitea#22707)) - Fix line spacing for plaintext previews ([#22699](go-gitea/gitea#22699)) ([#22701](go-gitea/gitea#22701)) - Fix wrong hint when deleting a branch successfully from pull request UI ([#22673](go-gitea/gitea#22673)) ([#22698](go-gitea/gitea#22698)) - Fix README TOC links ([#22577](go-gitea/gitea#22577)) ([#22677](go-gitea/gitea#22677)) - Fix missing message in git hook when pull requests disabled on fork ([#22625](go-gitea/gitea#22625)) ([#22658](go-gitea/gitea#22658)) - Improve checkIfPRContentChanged ([#22611](go-gitea/gitea#22611)) ([#22644](go-gitea/gitea#22644)) - Prevent duplicate labels when importing more than 99 ([#22591](go-gitea/gitea#22591)) ([#22598](go-gitea/gitea#22598)) - Don't return duplicated users who can create org repo ([#22560](go-gitea/gitea#22560)) ([#22562](go-gitea/gitea#22562)) - BUILD - Upgrade golangcilint to v1.51.0 ([#22764](go-gitea/gitea#22764)) - MISC - Use proxy for pull mirror ([#22771](go-gitea/gitea#22771)) ([#22772](go-gitea/gitea#22772)) - Use `--index-url` in PyPi description ([#22620](go-gitea/gitea#22620)) ([#22636](go-gitea/gitea#22636)) ### [`v1.18.3`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1183-httpsgithubcomgo-giteagiteareleasestagv1183---2023-01-23) [Compare Source](go-gitea/gitea@v1.18.2...v1.18.3) - SECURITY - Prevent multiple `To` recipients ([#22566](go-gitea/gitea#22566)) ([#22569](go-gitea/gitea#22569)) - BUGFIXES - Truncate commit summary on repo files table. ([#22551](go-gitea/gitea#22551)) ([#22552](go-gitea/gitea#22552)) - Mute all links in issue timeline ([#22534](go-gitea/gitea#22534)) ### [`v1.18.2`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1182-httpsgithubcomgo-giteagiteareleasestagv1182---2023-01-19) [Compare Source](go-gitea/gitea@v1.18.1...v1.18.2) - BUGFIXES - Fix issue not auto-closing when it includes a reference to a branch ([#22514](go-gitea/gitea#22514)) ([#22521](go-gitea/gitea#22521)) - Fix invalid issue branch reference if not specified in template ([#22513](go-gitea/gitea#22513)) ([#22520](go-gitea/gitea#22520)) - Fix 500 error viewing pull request when fork has pull requests disabled ([#22512](go-gitea/gitea#22512)) ([#22515](go-gitea/gitea#22515)) - Reliable selection of admin user ([#22509](go-gitea/gitea#22509)) ([#22511](go-gitea/gitea#22511)) - Set disable_gravatar/enable_federated_avatar when offline mode is true ([#22479](go-gitea/gitea#22479)) ([#22496](go-gitea/gitea#22496)) - BUILD - cgo cross-compile for freebsd ([#22397](go-gitea/gitea#22397)) ([#22519](go-gitea/gitea#22519)) ### [`v1.18.1`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1181-httpsgithubcomgo-giteagiteareleasestagv1181---2023-01-17) [Compare Source](go-gitea/gitea@v1.18.0...v1.18.1) - API - Add `sync_on_commit` option for push mirrors api ([#22271](go-gitea/gitea#22271)) ([#22292](go-gitea/gitea#22292)) - BUGFIXES - Update `github.com/zeripath/zapx/v15` ([#22485](go-gitea/gitea#22485)) - Fix pull request API field `closed_at` always being `null` ([#22482](go-gitea/gitea#22482)) ([#22483](go-gitea/gitea#22483)) - Fix container blob mount ([#22226](go-gitea/gitea#22226)) ([#22476](go-gitea/gitea#22476)) - Fix error when calculating repository size ([#22392](go-gitea/gitea#22392)) ([#22474](go-gitea/gitea#22474)) - Fix Operator does not exist bug on explore page with ONLY_SHOW_RELEVANT_REPOS ([#22454](go-gitea/gitea#22454)) ([#22472](go-gitea/gitea#22472)) - Fix environments for KaTeX and error reporting ([#22453](go-gitea/gitea#22453)) ([#22473](go-gitea/gitea#22473)) - Remove the netgo tag for Windows build ([#22467](go-gitea/gitea#22467)) ([#22468](go-gitea/gitea#22468)) - Fix migration from GitBucket ([#22477](go-gitea/gitea#22477)) ([#22465](go-gitea/gitea#22465)) - Prevent panic on looking at api "git" endpoints for empty repos ([#22457](go-gitea/gitea#22457)) ([#22458](go-gitea/gitea#22458)) - Fix PR status layout on mobile ([#21547](go-gitea/gitea#21547)) ([#22441](go-gitea/gitea#22441)) - Fix wechatwork webhook sends empty content in PR review ([#21762](go-gitea/gitea#21762)) ([#22440](go-gitea/gitea#22440)) - Remove duplicate "Actions" label in mobile view ([#21974](go-gitea/gitea#21974)) ([#22439](go-gitea/gitea#22439)) - Fix leaving organization bug on user settings -> orgs ([#21983](go-gitea/gitea#21983)) ([#22438](go-gitea/gitea#22438)) - Fixed colour transparency regex matching in project board sorting ([#22092](go-gitea/gitea#22092)) ([#22437](go-gitea/gitea#22437)) - Correctly handle select on multiple channels in Queues ([#22146](go-gitea/gitea#22146)) ([#22428](go-gitea/gitea#22428)) - Prepend refs/heads/ to issue template refs ([#20461](go-gitea/gitea#20461)) ([#22427](go-gitea/gitea#22427)) - Restore function to "Show more" buttons ([#22399](go-gitea/gitea#22399)) ([#22426](go-gitea/gitea#22426)) - Continue GCing other repos on error in one repo ([#22422](go-gitea/gitea#22422)) ([#22425](go-gitea/gitea#22425)) - Allow HOST has no port ([#22280](go-gitea/gitea#22280)) ([#22409](go-gitea/gitea#22409)) - Fix omit avatar_url in discord payload when empty ([#22393](go-gitea/gitea#22393)) ([#22394](go-gitea/gitea#22394)) - Don't display stop watch top bar icon when disabled and hidden when click other place ([#22374](go-gitea/gitea#22374)) ([#22387](go-gitea/gitea#22387)) - Don't lookup mail server when using sendmail ([#22300](go-gitea/gitea#22300)) ([#22383](go-gitea/gitea#22383)) - Fix gravatar disable bug ([#22337](go-gitea/gitea#22337)) - Fix update settings table on install ([#22326](go-gitea/gitea#22326)) ([#22327](go-gitea/gitea#22327)) - Fix sitemap ([#22272](go-gitea/gitea#22272)) ([#22320](go-gitea/gitea#22320)) - Fix code search title translation ([#22285](go-gitea/gitea#22285)) ([#22316](go-gitea/gitea#22316)) - Fix due date rendering the wrong date in issue ([#22302](go-gitea/gitea#22302)) ([#22306](go-gitea/gitea#22306)) - Fix get system setting bug when enabled redis cache ([#22298](go-gitea/gitea#22298)) - Fix bug of DisableGravatar default value ([#22297](go-gitea/gitea#22297)) - Fix key signature error page ([#22229](go-gitea/gitea#22229)) ([#22230](go-gitea/gitea#22230)) - TESTING - Remove test session cache to reduce possible concurrent problem ([#22199](go-gitea/gitea#22199)) ([#22429](go-gitea/gitea#22429)) - MISC - Restore previous official review when an official review is deleted ([#22449](go-gitea/gitea#22449)) ([#22460](go-gitea/gitea#22460)) - Log STDERR of external renderer when it fails ([#22442](go-gitea/gitea#22442)) ([#22444](go-gitea/gitea#22444)) ### [`v1.18.0`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1180-httpsgithubcomgo-giteagiteareleasestagv1180---2022-12-29) [Compare Source](go-gitea/gitea@v1.17.4...v1.18.0) - SECURITY - Remove ReverseProxy authentication from the API ([#22219](go-gitea/gitea#22219)) ([#22251](go-gitea/gitea#22251)) - Support Go Vulnerability Management ([#21139](go-gitea/gitea#21139)) - Forbid HTML string tooltips ([#20935](go-gitea/gitea#20935)) - BREAKING - Rework mailer settings ([#18982](go-gitea/gitea#18982)) - Remove U2F support ([#20141](go-gitea/gitea#20141)) - Refactor `i18n` to `locale` ([#20153](go-gitea/gitea#20153)) - Enable contenthash in filename for dynamic assets ([#20813](go-gitea/gitea#20813)) - FEATURES - Add color previews in markdown ([#21474](go-gitea/gitea#21474)) - Allow package version sorting ([#21453](go-gitea/gitea#21453)) - Add support for Chocolatey/NuGet v2 API ([#21393](go-gitea/gitea#21393)) - Add API endpoint to get changed files of a PR ([#21177](go-gitea/gitea#21177)) - Add filetree on left of diff view ([#21012](go-gitea/gitea#21012)) - Support Issue forms and PR forms ([#20987](go-gitea/gitea#20987)) - Add support for Vagrant packages ([#20930](go-gitea/gitea#20930)) - Add support for `npm unpublish` ([#20688](go-gitea/gitea#20688)) - Add badge capabilities to users ([#20607](go-gitea/gitea#20607)) - Add issue filter for Author ([#20578](go-gitea/gitea#20578)) - Add KaTeX rendering to Markdown. ([#20571](go-gitea/gitea#20571)) - Add support for Pub packages ([#20560](go-gitea/gitea#20560)) - Support localized README ([#20508](go-gitea/gitea#20508)) - Add support mCaptcha as captcha provider ([#20458](go-gitea/gitea#20458)) - Add team member invite by email ([#20307](go-gitea/gitea#20307)) - Added email notification option to receive all own messages ([#20179](go-gitea/gitea#20179)) - Switch Unicode Escaping to a VSCode-like system ([#19990](go-gitea/gitea#19990)) - Add user/organization code search ([#19977](go-gitea/gitea#19977)) - Only show relevant repositories on explore page ([#19361](go-gitea/gitea#19361)) - User keypairs and HTTP signatures for ActivityPub federation using go-ap ([#19133](go-gitea/gitea#19133)) - Add sitemap support ([#18407](go-gitea/gitea#18407)) - Allow creation of OAuth2 applications for orgs ([#18084](go-gitea/gitea#18084)) - Add system setting table with cache and also add cache supports for user setting ([#18058](go-gitea/gitea#18058)) - Add pages to view watched repos and subscribed issues/PRs ([#17156](go-gitea/gitea#17156)) - Support Proxy protocol ([#12527](go-gitea/gitea#12527)) - Implement sync push mirror on commit ([#19411](go-gitea/gitea#19411)) - API - Allow empty assignees on pull request edit ([#22150](go-gitea/gitea#22150)) ([#22214](go-gitea/gitea#22214)) - Make external issue tracker regexp configurable via API ([#21338](go-gitea/gitea#21338)) - Add name field for org api ([#21270](go-gitea/gitea#21270)) - Show teams with no members if user is admin ([#21204](go-gitea/gitea#21204)) - Add latest commit's SHA to content response ([#20398](go-gitea/gitea#20398)) - Add allow_rebase_update, default_delete_branch_after_merge to repository api response ([#20079](go-gitea/gitea#20079)) - Add new endpoints for push mirrors management ([#19841](go-gitea/gitea#19841)) - ENHANCEMENTS - Add setting to disable the git apply step in test patch ([#22130](go-gitea/gitea#22130)) ([#22170](go-gitea/gitea#22170)) - Multiple improvements for comment edit diff ([#21990](go-gitea/gitea#21990)) ([#22007](go-gitea/gitea#22007)) - Fix button in branch list, avoid unexpected page jump before restore branch actually done ([#21562](go-gitea/gitea#21562)) ([#21928](go-gitea/gitea#21928)) - Fix flex layout for repo list icons ([#21896](go-gitea/gitea#21896)) ([#21920](go-gitea/gitea#21920)) - Fix vertical align of committer avatar rendered by email address ([#21884](go-gitea/gitea#21884)) ([#21918](go-gitea/gitea#21918)) - Fix setting HTTP headers after write ([#21833](go-gitea/gitea#21833)) ([#21877](go-gitea/gitea#21877)) - Color and Style enhancements ([#21784](go-gitea/gitea#21784), [#21799](go-gitea/gitea#21799)) ([#21868](go-gitea/gitea#21868)) - Ignore line anchor links with leading zeroes ([#21728](go-gitea/gitea#21728)) ([#21776](go-gitea/gitea#21776)) - Quick fixes monaco-editor error: "vs.editor.nullLanguage" ([#21734](go-gitea/gitea#21734)) ([#21738](go-gitea/gitea#21738)) - Use CSS color-scheme instead of invert ([#21616](go-gitea/gitea#21616)) ([#21623](go-gitea/gitea#21623)) - Respect user's locale when rendering the date range in the repo activity page ([#21410](go-gitea/gitea#21410)) - Change `commits-table` column width ([#21564](go-gitea/gitea#21564)) - Refactor git command arguments and make all arguments to be safe to be used ([#21535](go-gitea/gitea#21535)) - CSS color enhancements ([#21534](go-gitea/gitea#21534)) - Add link to user profile in markdown mention only if user exists ([#21533](go-gitea/gitea#21533), [#21554](go-gitea/gitea#21554)) - Add option to skip index dirs ([#21501](go-gitea/gitea#21501)) - Diff file tree tweaks ([#21446](go-gitea/gitea#21446)) - Localize all timestamps ([#21440](go-gitea/gitea#21440)) - Add `code` highlighting in issue titles ([#21432](go-gitea/gitea#21432)) - Use Name instead of DisplayName in LFS Lock ([#21415](go-gitea/gitea#21415)) - Consolidate more CSS colors into variables ([#21402](go-gitea/gitea#21402)) - Redirect to new repository owner ([#21398](go-gitea/gitea#21398)) - Use ISO date format instead of hard-coded English date format for date range in repo activity page ([#21396](go-gitea/gitea#21396)) - Use weighted algorithm for string matching when finding files in repo ([#21370](go-gitea/gitea#21370)) - Show private data in feeds ([#21369](go-gitea/gitea#21369)) - Refactor parseTreeEntries, speed up tree list ([#21368](go-gitea/gitea#21368)) - Add GET and DELETE endpoints for Docker blob uploads ([#21367](go-gitea/gitea#21367)) - Add nicer error handling on template compile errors ([#21350](go-gitea/gitea#21350)) - Add `stat` to `ToCommit` function for speed ([#21337](go-gitea/gitea#21337)) - Support instance-wide OAuth2 applications ([#21335](go-gitea/gitea#21335)) - Record OAuth client type at registration ([#21316](go-gitea/gitea#21316)) - Add new CSS variables --color-accent and --color-small-accent ([#21305](go-gitea/gitea#21305)) - Improve error descriptions for unauthorized_client ([#21292](go-gitea/gitea#21292)) - Case-insensitive "find files in repo" ([#21269](go-gitea/gitea#21269)) - Consolidate more CSS rules, fix inline code on arc-green ([#21260](go-gitea/gitea#21260)) - Log real ip of requests from ssh ([#21216](go-gitea/gitea#21216)) - Save files in local storage as group readable ([#21198](go-gitea/gitea#21198)) - Enable fluid page layout on medium size viewports ([#21178](go-gitea/gitea#21178)) - File header tweaks ([#21175](go-gitea/gitea#21175)) - Added missing headers on user packages page ([#21172](go-gitea/gitea#21172)) - Display image digest for container packages ([#21170](go-gitea/gitea#21170)) - Skip dirty check for team forms ([#21154](go-gitea/gitea#21154)) - Keep path when creating a new branch ([#21153](go-gitea/gitea#21153)) - Remove fomantic image module ([#21145](go-gitea/gitea#21145)) - Make labels clickable in the comments section. ([#21137](go-gitea/gitea#21137)) - Sort branches and tags by date descending ([#21136](go-gitea/gitea#21136)) - Better repo API unit checks ([#21130](go-gitea/gitea#21130)) - Improve commit status icons ([#21124](go-gitea/gitea#21124)) - Limit length of repo description and repo url input fields ([#21119](go-gitea/gitea#21119)) - Show .editorconfig errors in frontend ([#21088](go-gitea/gitea#21088)) - Allow poster to choose reviewers ([#21084](go-gitea/gitea#21084)) - Remove black labels and CSS cleanup ([#21003](go-gitea/gitea#21003)) - Make e-mail sanity check more precise ([#20991](go-gitea/gitea#20991)) - Use native inputs in whitespace dropdown ([#20980](go-gitea/gitea#20980)) - Enhance package date display ([#20928](go-gitea/gitea#20928)) - Display total blob size of a package version ([#20927](go-gitea/gitea#20927)) - Show language name on hover ([#20923](go-gitea/gitea#20923)) - Show instructions for all generic package files ([#20917](go-gitea/gitea#20917)) - Refactor AssertExistsAndLoadBean to use generics ([#20797](go-gitea/gitea#20797)) - Move the official website link at the footer of gitea ([#20777](go-gitea/gitea#20777)) - Add support for full name in reverse proxy auth ([#20776](go-gitea/gitea#20776)) - Remove useless JS operation for relative time tooltips ([#20756](go-gitea/gitea#20756)) - Replace some icons with SVG ([#20741](go-gitea/gitea#20741)) - Change commit status icons to SVG ([#20736](go-gitea/gitea#20736)) - Improve single repo action for issue and pull requests ([#20730](go-gitea/gitea#20730)) - Allow multiple files in generic packages ([#20661](go-gitea/gitea#20661)) - Add option to create new issue from /issues page ([#20650](go-gitea/gitea#20650)) - Background color of private list-items updated ([#20630](go-gitea/gitea#20630)) - Added search input field to issue filter ([#20623](go-gitea/gitea#20623)) - Increase default item listing size `ISSUE_PAGING_NUM` to 20 ([#20547](go-gitea/gitea#20547)) - Modify milestone search keywords to be case insensitive again ([#20513](go-gitea/gitea#20513)) - Show hint to link package to repo when viewing empty repo package list ([#20504](go-gitea/gitea#20504)) - Add Tar ZSTD support ([#20493](go-gitea/gitea#20493)) - Make code review checkboxes clickable ([#20481](go-gitea/gitea#20481)) - Add "X-Gitea-Object-Type" header for GET `/raw/` & `/media/` API ([#20438](go-gitea/gitea#20438)) - Display project in issue list ([#20434](go-gitea/gitea#20434)) - Prepend commit message to template content when opening a new PR ([#20429](go-gitea/gitea#20429)) - Replace fomantic popup module with tippy.js ([#20428](go-gitea/gitea#20428)) - Allow to specify colors for text in markup ([#20363](go-gitea/gitea#20363)) - Allow access to the Public Organization Member lists with minimal permissions ([#20330](go-gitea/gitea#20330)) - Use default values when provided values are empty ([#20318](go-gitea/gitea#20318)) - Vertical align navbar avatar at middle ([#20302](go-gitea/gitea#20302)) - Delete cancel button in repo creation page ([#21381](go-gitea/gitea#21381)) - Include login_name in adminCreateUser response ([#20283](go-gitea/gitea#20283)) - fix: icon margin in user/settings/repos ([#20281](go-gitea/gitea#20281)) - Remove blue text on migrate page ([#20273](go-gitea/gitea#20273)) - Modify milestone search keywords to be case insensitive ([#20266](go-gitea/gitea#20266)) - Move some files into models' sub packages ([#20262](go-gitea/gitea#20262)) - Add tooltip to repo icons in explore page ([#20241](go-gitea/gitea#20241)) - Remove deprecated licenses ([#20222](go-gitea/gitea#20222)) - Webhook for Wiki changes ([#20219](go-gitea/gitea#20219)) - Share HTML template renderers and create a watcher framework ([#20218](go-gitea/gitea#20218)) - Allow enable LDAP source and disable user sync via CLI ([#20206](go-gitea/gitea#20206)) - Adds a checkbox to select all issues/PRs ([#20177](go-gitea/gitea#20177)) - Refactor `i18n` to `locale` ([#20153](go-gitea/gitea#20153)) - Disable status checks in template if none found ([#20088](go-gitea/gitea#20088)) - Allow manager logging to set SQL ([#20064](go-gitea/gitea#20064)) - Add order by for assignee no sort issue ([#20053](go-gitea/gitea#20053)) - Take a stab at porting existing components to Vue3 ([#20044](go-gitea/gitea#20044)) - Add doctor command to write commit-graphs ([#20007](go-gitea/gitea#20007)) - Add support for authentication based on reverse proxy email ([#19949](go-gitea/gitea#19949)) - Enable spellcheck for EasyMDE, use contenteditable mode ([#19776](go-gitea/gitea#19776)) - Allow specifying SECRET_KEY_URI, similar to INTERNAL_TOKEN_URI ([#19663](go-gitea/gitea#19663)) - Rework mailer settings ([#18982](go-gitea/gitea#18982)) - Add option to purge users ([#18064](go-gitea/gitea#18064)) - Add author search input ([#21246](go-gitea/gitea#21246)) - Make rss/atom identifier globally unique ([#21550](go-gitea/gitea#21550)) - BUGFIXES - Auth interface return error when verify failure ([#22119](go-gitea/gitea#22119)) ([#22259](go-gitea/gitea#22259)) - Use complete SHA to create and query commit status ([#22244](go-gitea/gitea#22244)) ([#22257](go-gitea/gitea#22257)) - Update bleve and zapx to fix unaligned atomic ([#22031](go-gitea/gitea#22031)) ([#22218](go-gitea/gitea#22218)) - Prevent panic in doctor command when running default checks ([#21791](go-gitea/gitea#21791)) ([#21807](go-gitea/gitea#21807)) - Load GitRepo in API before deleting issue ([#21720](go-gitea/gitea#21720)) ([#21796](go-gitea/gitea#21796)) - Ignore line anchor links with leading zeroes ([#21728](go-gitea/gitea#21728)) ([#21776](go-gitea/gitea#21776)) - Set last login when activating account ([#21731](go-gitea/gitea#21731)) ([#21755](go-gitea/gitea#21755)) - Fix UI language switching bug ([#21597](go-gitea/gitea#21597)) ([#21749](go-gitea/gitea#21749)) - Quick fixes monaco-editor error: "vs.editor.nullLanguage" ([#21734](go-gitea/gitea#21734)) ([#21738](go-gitea/gitea#21738)) - Allow local package identifiers for PyPI packages ([#21690](go-gitea/gitea#21690)) ([#21727](go-gitea/gitea#21727)) - Deal with markdown template without metadata ([#21639](go-gitea/gitea#21639)) ([#21654](go-gitea/gitea#21654)) - Fix opaque background on mermaid diagrams ([#21642](go-gitea/gitea#21642)) ([#21652](go-gitea/gitea#21652)) - Fix repository adoption on Windows ([#21646](go-gitea/gitea#21646)) ([#21650](go-gitea/gitea#21650)) - Sync git hooks when config file path changed ([#21619](go-gitea/gitea#21619)) ([#21626](go-gitea/gitea#21626)) - Fix 500 on PR files API ([#21602](go-gitea/gitea#21602)) ([#21607](go-gitea/gitea#21607)) - Fix `Timestamp.IsZero` ([#21593](go-gitea/gitea#21593)) ([#21603](go-gitea/gitea#21603)) - Fix viewing user subscriptions ([#21482](go-gitea/gitea#21482)) - Fix mermaid-related bugs ([#21431](go-gitea/gitea#21431)) - Fix branch dropdown shifting on page load ([#21428](go-gitea/gitea#21428)) - Fix default theme-auto selector when nologin ([#21346](go-gitea/gitea#21346)) - Fix and improve incorrect error messages ([#21342](go-gitea/gitea#21342)) - Fix formatted link for PR review notifications to matrix ([#21319](go-gitea/gitea#21319)) - Center-aligning content of WebAuthN page ([#21127](go-gitea/gitea#21127)) - Remove follow from commits by file ([#20765](go-gitea/gitea#20765)) - Fix commit status popup ([#20737](go-gitea/gitea#20737)) - Fix init mail render logic ([#20704](go-gitea/gitea#20704)) - Use correct page size for link header pagination ([#20546](go-gitea/gitea#20546)) - Preserve unix socket file ([#20499](go-gitea/gitea#20499)) - Use tippy.js for context popup ([#20393](go-gitea/gitea#20393)) - Add missing parameter for error in log message ([#20144](go-gitea/gitea#20144)) - Do not allow organisation owners add themselves as collaborator ([#20043](go-gitea/gitea#20043)) - Rework file highlight rendering and fix yaml copy-paste ([#19967](go-gitea/gitea#19967)) - Improve code diff highlight, fix incorrect rendered diff result ([#19958](go-gitea/gitea#19958)) - TESTING - Improve OAuth integration tests ([#21390](go-gitea/gitea#21390)) - Add playwright tests ([#20123](go-gitea/gitea#20123)) - BUILD - Switch to building with go1.19 ([#20695](go-gitea/gitea#20695)) - Update JS dependencies, adjust eslint ([#20659](go-gitea/gitea#20659)) - Add more linters to improve code readability ([#19989](go-gitea/gitea#19989)) ### [`v1.17.4`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1174-httpsgithubcomgo-giteagiteareleasestagv1174---2022-12-21) [Compare Source](go-gitea/gitea@v1.17.3...v1.17.4) - SECURITY - Do not allow Ghost access to limited visible user/org ([#21849](go-gitea/gitea#21849)) ([#21875](go-gitea/gitea#21875)) - Fix package access for admins and inactive users ([#21580](go-gitea/gitea#21580)) ([#21592](go-gitea/gitea#21592)) - ENHANCEMENTS - Fix button in branch list, avoid unexpected page jump before restore branch actually done ([#21562](go-gitea/gitea#21562)) ([#21927](go-gitea/gitea#21927)) - Fix vertical align of committer avatar rendered by email address ([#21884](go-gitea/gitea#21884)) ([#21919](go-gitea/gitea#21919)) - Fix setting HTTP headers after write ([#21833](go-gitea/gitea#21833)) ([#21874](go-gitea/gitea#21874)) - Ignore line anchor links with leading zeroes ([#21728](go-gitea/gitea#21728)) ([#21777](go-gitea/gitea#21777)) - Enable Monaco automaticLayout ([#21516](go-gitea/gitea#21516)) - BUGFIXES - Do not list active repositories as unadopted ([#22034](go-gitea/gitea#22034)) ([#22167](go-gitea/gitea#22167)) - Correctly handle moved files in apply patch ([#22118](go-gitea/gitea#22118)) ([#22136](go-gitea/gitea#22136)) - Fix condition for is_internal ([#22095](go-gitea/gitea#22095)) ([#22131](go-gitea/gitea#22131)) - Fix permission check on issue/pull lock ([#22114](go-gitea/gitea#22114)) - Fix sorting admin user list by last login ([#22081](go-gitea/gitea#22081)) ([#22106](go-gitea/gitea#22106)) - Workaround for container registry push/pull errors ([#21862](go-gitea/gitea#21862)) ([#22069](go-gitea/gitea#22069)) - Fix issue/PR numbers ([#22037](go-gitea/gitea#22037)) ([#22045](go-gitea/gitea#22045)) - Handle empty author names ([#21902](go-gitea/gitea#21902)) ([#22028](go-gitea/gitea#22028)) - Fix ListBranches to handle empty case ([#21921](go-gitea/gitea#21921)) ([#22025](go-gitea/gitea#22025)) - Fix enabling partial clones on 1.17 ([#21809](go-gitea/gitea#21809)) - Prevent panic in doctor command when running default checks ([#21791](go-gitea/gitea#21791)) ([#21808](go-gitea/gitea#21808)) - Upgrade golang.org/x/crypto ([#21792](go-gitea/gitea#21792)) ([#21794](go-gitea/gitea#21794)) - Init git module before database migration ([#21764](go-gitea/gitea#21764)) ([#21766](go-gitea/gitea#21766)) - Set last login when activating account ([#21731](go-gitea/gitea#21731)) ([#21754](go-gitea/gitea#21754)) - Add HEAD fix to gitea doctor ([#21352](go-gitea/gitea#21352)) ([#21751](go-gitea/gitea#21751)) - Fix UI language switching bug ([#21597](go-gitea/gitea#21597)) ([#21748](go-gitea/gitea#21748)) - Remove semver compatible flag and change pypi to an array of test cases ([#21708](go-gitea/gitea#21708)) ([#21729](go-gitea/gitea#21729)) - Allow local package identifiers for PyPI packages ([#21690](go-gitea/gitea#21690)) ([#21726](go-gitea/gitea#21726)) - Fix repository adoption on Windows ([#21646](go-gitea/gitea#21646)) ([#21651](go-gitea/gitea#21651)) - Sync git hooks when config file path changed ([#21619](go-gitea/gitea#21619)) ([#21625](go-gitea/gitea#21625)) - Added check for disabled Packages ([#21540](go-gitea/gitea#21540)) ([#21614](go-gitea/gitea#21614)) - Fix `Timestamp.IsZero` ([#21593](go-gitea/gitea#21593)) ([#21604](go-gitea/gitea#21604)) - Fix issues count bug ([#21600](go-gitea/gitea#21600)) - Support binary deploy in npm packages ([#21589](go-gitea/gitea#21589)) - Update milestone counters when issue is deleted ([#21459](go-gitea/gitea#21459)) ([#21586](go-gitea/gitea#21586)) - SessionUser protection against nil pointer dereference ([#21581](go-gitea/gitea#21581)) - Case-insensitive NuGet symbol file GUID ([#21409](go-gitea/gitea#21409)) ([#21575](go-gitea/gitea#21575)) - Suppress `ExternalLoginUserNotExist` error ([#21504](go-gitea/gitea#21504)) ([#21572](go-gitea/gitea#21572)) - Prevent Authorization header for presigned LFS urls ([#21531](go-gitea/gitea#21531)) ([#21569](go-gitea/gitea#21569)) - Update binding to fix bugs ([#21560](go-gitea/gitea#21560)) - Fix generating compare link ([#21519](go-gitea/gitea#21519)) ([#21530](go-gitea/gitea#21530)) - Ignore error when retrieving changed PR review files ([#21487](go-gitea/gitea#21487)) ([#21524](go-gitea/gitea#21524)) - Fix incorrect notification commit url ([#21479](go-gitea/gitea#21479)) ([#21483](go-gitea/gitea#21483)) - Display total commit count in hook message ([#21400](go-gitea/gitea#21400)) ([#21481](go-gitea/gitea#21481)) - Enforce grouped NuGet search results ([#21442](go-gitea/gitea#21442)) ([#21480](go-gitea/gitea#21480)) - Return 404 when user is not found on avatar ([#21476](go-gitea/gitea#21476)) ([#21477](go-gitea/gitea#21477)) - Normalize NuGet package version on upload ([#22186](go-gitea/gitea#22186)) ([#22201](go-gitea/gitea#22201)) - MISC - Check for zero time instant in TimeStamp.IsZero() ([#22171](go-gitea/gitea#22171)) ([#22173](go-gitea/gitea#22173)) - Fix warn in database structs sync ([#22111](go-gitea/gitea#22111)) - Allow for resolution of NPM registry paths that match upstream ([#21568](go-gitea/gitea#21568)) ([#21723](go-gitea/gitea#21723)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: Michael Wittig <michael.wittig@posteo.de> Reviewed-on: https://gitea.sh4ke.rocks/sh4ke/k8s-projects/pulls/84

Loïc Dachary added 7 commits March 18, 2022 17:33

go.mod: add go-fed/{httpsig,activity/pub,activity/streams} dependency

f2db473

go get github.com/go-fed/activity/streams@master go get github.com/go-fed/activity/pub@master go get github.com/go-fed/httpsig@master

activitypub: implement /api/v1/activitypub/user/{username} (#14186)

4951af4

Return informations regarding a Person (as defined in ActivityStreams https://www.w3.org/TR/activitystreams-vocabulary/#dfn-person). Refs: #14186 Signed-off-by: Loïc Dachary <loic@dachary.org>

activitypub: add the public key to Person (#14186)

678a56f

Refs: #14186 Signed-off-by: Loïc Dachary <loic@dachary.org>

activitypub: go-fed conformant Clock instance

e8907c3

Signed-off-by: Loïc Dachary <loic@dachary.org>

activitypub: signing http client

15c1f62

Signed-off-by: Loïc Dachary <loic@dachary.org>

activitypub: implement the ReqSignature middleware

97fedf2

Signed-off-by: Loïc Dachary <loic@dachary.org>

activitypub: hack_16834

b342241

Signed-off-by: Loïc Dachary <loic@dachary.org>

lunny reviewed Mar 19, 2022

View reviewed changes

integrations/api_activitypub_person_test.go Outdated Show resolved Hide resolved

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Mar 19, 2022

lunny reviewed Mar 19, 2022

View reviewed changes

integrations/api_activitypub_person_test.go Outdated Show resolved Hide resolved

lunny reviewed Mar 19, 2022

View reviewed changes

integrations/api_activitypub_person_test.go Show resolved Hide resolved

lunny added type/feature Completely new functionality. Can only be merged if feature freeze is not active. topic/federation labels Mar 19, 2022

Gusted added this to the 1.17.0 milestone Mar 19, 2022

Anthony Wang added 2 commits March 19, 2022 08:54

Fix CI checks-backend errors with go mod tidy

2a8864f

Signed-off-by: Anthony Wang <ta180m@pm.me>

Change 2021 to 2022, properly format package imports

b480c52

Signed-off-by: Anthony Wang <ta180m@pm.me>

Gusted reviewed Mar 19, 2022

View reviewed changes

Anthony Wang added 5 commits March 19, 2022 09:14

Run make fmt and make generate-swagger

f9e33d9

Signed-off-by: Anthony Wang <ta180m@pm.me>

Use Gitea JSON library, add assert for pkp

ea4129e

Signed-off-by: Anthony Wang <ta180m@pm.me>

Run make fmt again, fix err var redeclaration

456ed42

Signed-off-by: Anthony Wang <ta180m@pm.me>

Remove LogSQL from ActivityPub person test

d75809a

Signed-off-by: Anthony Wang <ta180m@pm.me>

Assert if json.Unmarshal succeeds

ebef769

Signed-off-by: Anthony Wang <ta180m@pm.me>

ghost force-pushed the feature-activitypub branch from 2fddd7f to ebef769 Compare March 20, 2022 15:53

ghost requested a review from Gusted March 21, 2022 02:41

Gusted reviewed Mar 23, 2022

View reviewed changes

Cleanup, handle invalid usernames for ActivityPub person GET request

46973f9

Signed-off-by: Anthony Wang <ta180m@pm.me>

ghost mentioned this pull request Mar 25, 2022

Draft: Add the go-fed dependency needed for ActivityPub federation #19104

Closed

Rename hack_16834 to user_settings

3ed4a71

Signed-off-by: Anthony Wang <ta180m@pm.me>

Anthony Wang and others added 3 commits June 17, 2022 13:43

Add ed25519 to httpsig algorithms

47011db

Merge branch 'main' into feature-activitypub

7bfadb4

Merge branch 'main' into feature-activitypub

fe18cf7

Gusted reviewed Jun 18, 2022

View reviewed changes

modules/activitypub/client.go Show resolved Hide resolved

Use go-ap/jsonld to add @context and marshal JSON

37d2d01

ghost force-pushed the feature-activitypub branch from 66ef5ce to 37d2d01 Compare June 18, 2022 17:27

Anthony Wang and others added 3 commits June 18, 2022 13:08

Change Gitea user agent from the default to Gitea/Version

7c10ab9

go mod tidy

0231dad

Merge branch 'main' into feature-activitypub

adfb213

Merge branch 'main' into feature-activitypub

1bd8eb6

delvh reviewed Jun 18, 2022

View reviewed changes

Anthony Wang and others added 4 commits June 18, 2022 16:30

Use ctx.ServerError and remove all remote interaction code from webfi…

4ffb6b6

…nger.go

Remove accidently added files

28fd3e7

Use ctx.ServerError in reqsignature.go

f602958

Merge branch 'main' into feature-activitypub

a3ff170

6543 merged commit e86f18a into go-gitea:main Jun 19, 2022

trwnh reviewed Dec 16, 2022

View reviewed changes

routers/api/v1/activitypub/person.go Show resolved Hide resolved

GiteaBot added the lgtm/need 1 This PR needs approval from one additional maintainer to be merged. label Dec 16, 2022

trwnh mentioned this pull request Mar 29, 2023

Use ID instead of username in ActivityPub API #23802

Closed

go-gitea locked and limited conversation to collaborators May 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

User keypairs and HTTP signatures for ActivityPub federation using go-ap #19133

User keypairs and HTTP signatures for ActivityPub federation using go-ap #19133

ghost commented Mar 18, 2022 •

edited by 6543

Loading

Gusted left a comment

ghost commented Mar 24, 2022

Gusted commented Mar 25, 2022

ghost commented Jun 18, 2022 •

edited by ghost

Loading

6543 commented Jun 18, 2022

ghost commented Jun 18, 2022

delvh left a comment

delvh Jun 18, 2022

6543 commented Jun 19, 2022

User keypairs and HTTP signatures for ActivityPub federation using go-ap #19133

User keypairs and HTTP signatures for ActivityPub federation using go-ap #19133

Conversation

ghost commented Mar 18, 2022 • edited by 6543 Loading

Gusted left a comment

Choose a reason for hiding this comment

ghost commented Mar 24, 2022

Gusted commented Mar 25, 2022

ghost commented Jun 18, 2022 • edited by ghost Loading

6543 commented Jun 18, 2022

ghost commented Jun 18, 2022

delvh left a comment

Choose a reason for hiding this comment

delvh Jun 18, 2022

Choose a reason for hiding this comment

6543 commented Jun 19, 2022

ghost commented Mar 18, 2022 •

edited by 6543

Loading

ghost commented Jun 18, 2022 •

edited by ghost

Loading