v0.6.0

0.6.0 (2026-10-08)

Features

• admin: issue password reset links from the admin user page (#183) (704ec0f)
• admin: manage user accounts and suspend them everywhere (#176) (45c4372)
• api: rate-limit requests per user and per IP (#169) (b49b349)
• auth: password reset by email, with a CLI fallback (#175) (79bdcb9)
• cli: reset-2fa command for a locked-out operator (#182) (b6e9763)
• code: edit, rename and delete files from the browser (#173) (2c97715)
• fork: a create-a-fork page with owner, name and default-branch options (#149) (2bd21e2)
• issues: close issues from closing keywords (#174) (d493529)
• mirror: pull mirrors with scheduled sync, a read-only guard and sealed credentials (#181) (e7f9b86)
• ops: add /healthz and /readyz probes and a Docker HEALTHCHECK (#170) (dbb0518)
• ops: Prometheus metrics on a separate listener (#184) (b3385d5)
• storage: avatar uploads on local or S3-compatible storage (#179) (db352df)
• ui: keep the file tree on blob pages (#146) (c6f9749)
• ui: syntax highlighting with per-user code themes (#150) (7755d08)

Bug Fixes

• a11y: keep the file tree's aria-expanded in sync with each folder (#168) (4d1e48d)
• code: answer an unknown archive ref with 404 (#158) (ba0cbe1)
• code: build code-browser links from the full commit SHA (#152) (50845af)
• code: escape refs and paths in code-browser URLs (#167) (15dfcdb)
• code: file-tree filter shows nested matches (#161) (ecf3954)
• code: resolve annotated tags in the code browser (#153) (42fcbca)
• files: serve raw files so the blob page's Raw button works (#148) (bb49cbe)
• markdown: cap fence highlighting per request, not just per document (#162) (7cbeead)
• pulls: check required statuses against the head commit's SHA (#154) (261a833)
• pulls: merge the head commit that passed the required checks (#165) (ceeccc9)
• repo: point an empty repo's HEAD at its default branch (#160) (b575a7a)
• security: answer a private repo over git like a missing repo (#157) (315d8ea)
• security: answer a private repo's code search like a missing repo's (#155) (dd551ab)
• security: answer a private repo's pages like a missing repo's (#151) (8306f09)
• security: include readable private repos in code search (#164) (5c1f6a7)
• settings: keep the default branch an existing branch and move HEAD with it (#156) (6072351)
• settings: show account, org and SSO save errors instead of a stale success toast (#166) (ac1ac93)
• settings: show repo settings save errors instead of a stale success toast (#163) (92e8045)
• ssh: refuse a deploy key already registered on another repo (#178) (140e777)
• ssh: refuse a user SSH key already registered as a deploy key (#177) (298963b)
• ui: point footer and user-menu help links at the upstream docs (#143) (8b27356)
• ui: replace the Actions mockup with a Checks tab of commit statuses (#171) (1b1b3a7)
• ui: show the build version in the footer (#144) (daaaf0a)
• ui: switch branches from the code browser, including feature/x refs (#147) (affd92b)
• webhooks: refuse private addresses at dial time (#172) (678541e)

Tests

• db: fail when two migrations share a number (#180) (6420bc4)