2084 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Renovate Bot	70a3b7f602	chore(deps): update pnpm to v11.10.0 (#460) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.9.0` → `11.10.0`](https://renovatebot.com/diffs/npm/pnpm/11.9.0/11.10.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.10.0`](https://github.com/pnpm/pnpm/blob/HEAD/pnpm11/pnpm/CHANGELOG.md#11100) [Compare Source](https://github.com/pnpm/pnpm/compare/v11.9.0...v11.10.0) ##### Minor Changes - [`e2e3c81`](https://github.com/pnpm/pnpm/commit/e2e3c81): Added the `issues` command as an alias of `bugs`, so `pnpm issues` opens the package's bug tracker URL in the browser. - [`8491f8e`](https://github.com/pnpm/pnpm/commit/8491f8e): Added the `prefix` command which prints the current package prefix directory (or global prefix directory if `-g` / `--global` is used). - [`3425e80`](https://github.com/pnpm/pnpm/commit/3425e80): Added an `_auth` setting for configuring registry authentication as a single structured (URL-keyed) value. It can be set in the **global** pnpm config (`config.yaml`) or, for CI, via the `pnpm_config__auth` environment variable. The env form sidesteps the GitHub Actions / bash / zsh limitation that broke the existing `pnpm_config_//host/:_authToken=…` form (env var names containing `/`, `:`, or `.` are silently dropped). Closes [#&#8203;12314](https://github.com/pnpm/pnpm/issues/12314). The value is keyed by registry URL so each secret is explicitly bound to the host that may receive it. Registry URL keys must use `http` or `https` and must not include credentials, query strings, or fragments: ```sh export pnpm_config__auth='{"https://registry.npmjs.org":{"@&#8203;":{"authToken":"npm-token"},"@&#8203;org":{"authToken":"org-token"}}}' ``` The equivalent in the global `config.yaml`: ```yaml _auth: https://registry.npmjs.org: "@&#8203;": authToken: npm-token "@&#8203;org": authToken: org-token ``` Within each registry URL, `@` means registry-wide/default credentials and package scopes like `@org` bind credentials to that scope on the same host. The only supported credential field is `authToken` (maps to `_authToken` / bearer auth); the deprecated `basicAuth` / `username` + `password` forms are intentionally not accepted here. Each entry also infers a trusted registry route: `@` routes the default registry (and `pnpm add <pkg>` resolves there), and `@org` routes that scope. Because the credential and destination host arrive in one trusted value, repo-controlled `pnpm-workspace.yaml` or project `.npmrc` cannot redirect the token to a different host. `_auth` is honored **only** from the env var and the global config — it is ignored in a project `pnpm-workspace.yaml` / `.npmrc`, so repo-controlled config can never supply registry auth. Precedence: CLI flags (`--registry`, `--@&#8203;scope:registry`) > `pnpm_config__auth` > global `config.yaml` `_auth` > `pnpm-workspace.yaml`. Both `pnpm_config__auth` (lowercase, documented form) and `PNPM_CONFIG__AUTH` (all-caps, the shell convention some CI runners apply) are honored. If both are set, lowercase wins unless it is empty, in which case uppercase is used. The env var wins over the global `config.yaml` `_auth` on a conflicting key. `tokenHelper` is not supported in `_auth`. Parsing is strict: a malformed value (bad JSON, wrong shape, invalid registry URL or scope, an unsupported credential field) fails fast with an error rather than being silently dropped. **Pacquet parity note:** the pacquet (Rust) port supports the same single credential field as the TS CLI: `authToken`. - [`a33eeec`](https://github.com/pnpm/pnpm/commit/a33eeec): `pnpm self-update` and `packageManager` version-switching can now install and link pnpm v12 (the Rust port), published with equal content under both the `pnpm` and `@pnpm/exe` names on the `next-12` dist-tag. Its native binaries ship as `@pnpm/exe.<platform>-<arch>` packages, which pnpm's built-in installer links directly — no Node.js launcher, so the command pays no Node startup cost. v12 is initialized exactly like `@pnpm/exe`, including per-platform global-virtual-store hashing. From v12 onward the install converges on the unscoped `pnpm` package (the Rust exe) — even when updating from the SEA `@pnpm/exe` build. - [`1dd12bd`](https://github.com/pnpm/pnpm/commit/1dd12bd): When resolving through a pnpr install-accelerator server, pnpm no longer forwards its own upstream registry credentials in the resolve request. Only the `Authorization` header identifying the caller to pnpr is sent. The pnpr server now selects upstream credentials from its own route policy (operator-configured upstream credential aliases), so private dependencies resolve through a pnpr-managed alias the caller is authorized to use, rather than by sending the client's registry tokens to the server. - [`1e81761`](https://github.com/pnpm/pnpm/commit/1e81761): Expose web authentication `authUrl` and `doneUrl` in JSON error output when OTP is required in a non-interactive terminal [#&#8203;12724](https://github.com/pnpm/pnpm/issues/12724). ##### Patch Changes - [`2f389d6`](https://github.com/pnpm/pnpm/commit/2f389d6): Added the Node.js release team's new signing key (Stewart X Addison, `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`) to the embedded Node.js release keys, so runtimes whose `SHASUMS256.txt` is signed by the new releaser verify successfully. - [`acbdb94`](https://github.com/pnpm/pnpm/commit/acbdb94): Fixed shell tab completion not suggesting workspaces after the `-F` alias for `--filter` option. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): Fixed `pnpm up -r <pkg>` bumping unrelated packages that have open semver ranges. Previously, any update mutation nullified the lockfile-derived `preferredVersions` globally, so packages with `^x.y.z` ranges could re-resolve to newer compatible versions even though the user only asked to update a specific package. The install layer now always seeds `preferredVersions` from the lockfile, and caller-supplied preferred versions (such as the vulnerability penalties of `pnpm audit --fix`) layer on top of the seed instead of replacing it. The targeted package still bumps: the per-resolve `updateRequested` flag makes the resolver ignore the target's own lockfile pins. Closes [#&#8203;10662](https://github.com/pnpm/pnpm/issues/10662). - [`d539172`](https://github.com/pnpm/pnpm/commit/d539172): Fixed pnpm pack and pnpm publish failing when prepack generates files that are included in the package and postpack cleans them up. - [`be6505a`](https://github.com/pnpm/pnpm/commit/be6505a): Hardened global package management: - On Windows, removing or updating a global package now also cleans up the `node.exe` flavor of a bin, so a stale `node.exe` no longer survives on `PATH` after uninstall, and a new global install no longer silently overwrites an existing `node.exe`. - `pnpm add -g pnpm@<version>` (and `@pnpm/exe@<version>`) is now rejected like the bare `pnpm` form, pointing to `pnpm self-update`. - Dependency aliases read from a global package's manifest are validated before being joined onto `node_modules` paths, preventing a tampered manifest from escaping the install directory. - Each global install group is created in its own freshly-made directory (no longer reusing a colliding or pre-existing path). - Removing or updating a global package no longer unlinks a bin that belongs to a different globally installed package. - [`25c7388`](https://github.com/pnpm/pnpm/commit/25c7388): pnpm now rejects `jsr:` specifiers whose package name is not a valid npm package name — an empty scope or name (e.g. `jsr:@&#8203;scope/`), path separators inside the name, or any other shape `validate-npm-package-name` rejects — with `ERR_PNPM_INVALID_JSR_PACKAGE_NAME` instead of silently converting them into a malformed `@jsr/...` npm package name. - [`25c7388`](https://github.com/pnpm/pnpm/commit/25c7388): pnpm now rejects named-registry specifiers (e.g. `gh:`) whose package name is not a valid npm package name — an empty scope (e.g. `gh:@&#8203;/bar`), path separators inside the name (e.g. `gh:@&#8203;scope/../name`), or any other shape `validate-npm-package-name` rejects — with `ERR_PNPM_INVALID_NAMED_REGISTRY_PACKAGE_NAME` instead of passing the name through to registry URLs and metadata cache file paths. - [`96da7c5`](https://github.com/pnpm/pnpm/commit/96da7c5): node-gyp's `gyp_main.py` and `gyp` entrypoints are now packed with the executable bit in the `pnpm` and `@pnpm/exe` tarballs. Without it, building native addons from source could fail with a permission error. - [`99982b9`](https://github.com/pnpm/pnpm/commit/99982b9): Sped up resolution and reduced memory use against registries that ignore npm's abbreviated metadata format and always return the full package document (for example, Azure DevOps Artifacts). pnpm now strips such documents down to the abbreviated field set before caching them. Resolution output is unchanged, and registries that honor the abbreviated format (such as the npm registry) pay no extra cost. - [`11a7fdd`](https://github.com/pnpm/pnpm/commit/11a7fdd): Sped up offline and `--prefer-offline` resolution on large workspaces (e.g. `pnpm dedupe --offline`, `pnpm install --offline`). Package metadata loaded from the local cache is now kept in memory, so each package's metadata is parsed once per command instead of once per dependent that references it. - [`2c7369d`](https://github.com/pnpm/pnpm/commit/2c7369d): `pnpm pack-app` now rejects `--entry` / `pnpm.app.entry` and `--output-dir` / `pnpm.app.outputDir` values that are absolute paths or escape the project directory via `..` (or a symlink that resolves outside it), and refuses to write the produced executable when its target path already exists as a symlink (or other non-regular file). This prevents a repository-controlled `package.json` from embedding host files (such as an SSH key) into the produced executable, writing build artifacts outside the project, or overwriting an arbitrary file through a committed symlink. The new error codes are `ERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT`, `ERR_PNPM_PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT`, and `ERR_PNPM_PACK_APP_OUTPUT_FILE_NOT_REGULAR`. When ad-hoc signing macOS targets, `pnpm pack-app` now runs the system `codesign` by absolute path and resolves `ldid` to a location outside the project, so a repository-controlled `node_modules/.bin` on `PATH` cannot hijack the signer. - [`ce5d5a5`](https://github.com/pnpm/pnpm/commit/ce5d5a5): Relative paths in `patchedDependencies` are now resolved against the lockfile directory when computing patch file hashes, so running `pnpm install` from a subdirectory no longer fails with `ENOENT` looking for the patch file in the wrong location [#&#8203;12762](https://github.com/pnpm/pnpm/pull/12762). - [`ebb4096`](https://github.com/pnpm/pnpm/commit/ebb4096): `pnpm peers` no longer reports a conflict for a missing peer dependency that is ignored via `pnpm.peerDependencyRules.ignoreMissing`. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): Fixed a prototype-pollution hazard when seeding preferred versions: a dependency named `__proto__` in a manifest or in `pnpm-lock.yaml` could write through `Object.prototype` (or crash the install) while the preferred-versions map was being built. The maps are now null-prototype objects, so crafted package names land as plain keys. - [`f38e696`](https://github.com/pnpm/pnpm/commit/f38e696): Hardened `pnpm deploy --force` so it refuses unsafe deploy targets such as workspace roots, parent directories, out-of-workspace paths, and symlinked target parents. - [`806c3ec`](https://github.com/pnpm/pnpm/commit/806c3ec): pnpm no longer warns about ignored project-level auth settings when `PNPM_CONFIG_NPMRC_AUTH_FILE` points at the project `.npmrc` — setting it to that file is an explicit opt-in to trusting it, so auth env variables in it are expanded [pnpm/pnpm#12480](https://github.com/pnpm/pnpm/issues/12480). - [`991405e`](https://github.com/pnpm/pnpm/commit/991405e): Restore differential rendering (`ansi-diff`) to fix duplicated output lines introduced by [#&#8203;12351](https://github.com/pnpm/pnpm/issues/12351). - [`c121235`](https://github.com/pnpm/pnpm/commit/c121235): Fixed the topological order of `--filter`ed commands (`pnpm run`, `pnpm exec`, `pnpm publish`, `pnpm pack`, `pnpm rebuild`) when the selected projects depend on each other only transitively through projects that were not selected. Previously such selected projects could run concurrently or in the wrong order; now a project always runs after the selected projects it transitively depends on, while projects without a real dependency relationship still run concurrently. This now also holds for prod-only filters (`--filter-prod`), which resolve order through the production dependency graph so transitive production dependencies are respected without pulling back the dev dependencies the filter drops, and for selections that mix `--filter` with `--filter-prod` [#&#8203;8335](https://github.com/pnpm/pnpm/issues/8335). - [`d539172`](https://github.com/pnpm/pnpm/commit/d539172): `pnpm pack` and `pnpm publish` no longer follow a symlinked workspace `LICENSE` file when injecting it into a package that has no license of its own. Following the symlink could pack bytes from outside the workspace into the published tarball. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): Fixed `pnpm up <pkg>` producing a different result than a fresh install of the same manifests would. The resolver now distinguishes `updateRequested` (true only for packages that match the user's update target) from the broader `update` flag, and for the targeted package ignores only its own lockfile-derived preferred-version pins — so the target re-resolves exactly as if its lockfile entries were deleted and `pnpm install` ran. Preferred versions a fresh install applies (manifest pins, versions propagated down the dependency chain, and the vulnerability-avoidance penalties of `pnpm audit --fix`) stay in effect, so an update never installs duplicate versions that a reinstall from scratch would not reproduce. When a preferred version holds the update target below the newest version its range admits, pnpm now prints a warning explaining that reaching the newer version everywhere requires an override. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): `pnpm update <dep>@&#8203;<version>` now prints a warning when `<dep>` is only present as a transitive dependency: the requested version cannot be applied there (updates resolve the target the way a fresh install would), and the warning recommends adding the version to `pnpm.overrides` instead, which is the mechanism that does pin transitive dependencies. Closes [#&#8203;12744](https://github.com/pnpm/pnpm/issues/12744). - [`a6c4d5f`](https://github.com/pnpm/pnpm/commit/a6c4d5f): When a dependency cannot be found in the registry (404) or the registry has no matching version, and a workspace project with the same name exists only at non-matching versions, the error now reports the available workspace versions (`ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE`) instead of the raw registry failure [pnpm/pnpm#1379](https://github.com/pnpm/pnpm/issues/1379). Other registry failures (authorization, network, server errors) still propagate unchanged. The pacquet (Rust) resolver applies the same behavior. </details> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/460 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>	2026-07-11 17:03:42 +00:00
TheFox0x7	985e2239ef	update cheatsheet (#461) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/461 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>	2026-07-10 20:04:19 +00:00
Nicolas	e3317cd869	Move Hacking to Gitea main repo (#429) ... Related: https://github.com/go-gitea/gitea/pull/37960 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/429 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-07-09 23:55:17 +00:00
SiriosDev	20c924ddb6	docs: add note on environment variable formatting in case of special characters (#425) ... Added information to explain to the user what to do when sections contain special characters such as `.` and `-` --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: SiriosDev <26876994+SiriosDev@users.noreply.github.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/425 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: SiriosDev <203106+siriosdev@noreply.gitea.com>	2026-07-09 23:51:10 +00:00
bircni	938700805b	docs: clarify that [git.config] options override Gitea's built-in defaults (#444) ... User-provided git config options are now applied after Gitea's built-in defaults, so they take precedence. Update the config cheat sheet to reflect this new behavior and add a warning about potentially breaking git operations. refers to https://github.com/go-gitea/gitea/pull/38172 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/444 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: bircni <bircni@icloud.com>	2026-07-09 23:50:21 +00:00
Renovate Bot	690cf6b9a0	fix(deps): update dependency @mui/material to v9.2.0 (#459) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@mui/material](https://mui.com/material-ui/) ([source](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material)) | [`9.1.2` → `9.2.0`](https://renovatebot.com/diffs/npm/@mui%2fmaterial/9.1.2/9.2.0) |  |  | --- ### Release Notes <details> <summary>mui/material-ui (@&#8203;mui/material)</summary> ### [`v9.2.0`](https://github.com/mui/material-ui/blob/HEAD/CHANGELOG.md#920) [Compare Source](https://github.com/mui/material-ui/compare/v9.1.2...v9.2.0) <!-- generated comparing v9.1.2..master --> *Jul 3, 2026* A big thanks to the 9 contributors who made this release possible. - ⚙️ Add support for [`data-*` attributes on `slotProps`](https://mui.com/material-ui/guides/typescript/#allowing-data-attributes-on-slotprops). ##### `@mui/material@9.2.0` - \[l10n] Add missing MuiPagination localization to zh-CN locale ([#&#8203;48741](https://github.com/mui/material-ui/issues/48741)) [@&#8203;greymoth-jp](https://github.com/greymoth-jp) - \[select] Guard display ref during mouse down ([#&#8203;48744](https://github.com/mui/material-ui/issues/48744)) [@&#8203;michelengelen](https://github.com/michelengelen) ##### `@mui/utils@9.2.0` - \[utils] Add opt-in `DataAttributesOverrides` augmentation for slot props ([#&#8203;48554](https://github.com/mui/material-ui/issues/48554)) [@&#8203;LukasTy](https://github.com/LukasTy) ##### Docs - \[docs] Improve Icon Dialog responsiveness on small screens ([#&#8203;48639](https://github.com/mui/material-ui/issues/48639)) [@&#8203;Prakash1185](https://github.com/Prakash1185) - \[docs] Fix invalid UTF-8 in skill references ([#&#8203;48739](https://github.com/mui/material-ui/issues/48739)) [@&#8203;mturac](https://github.com/mturac) ##### Core - \[code-infra] Resolve Renovate dashboard warnings ([#&#8203;48700](https://github.com/mui/material-ui/issues/48700)) [@&#8203;Sushantplive](https://github.com/Sushantplive) - \[code-infra] Validate npm publishing through dry run ([#&#8203;48691](https://github.com/mui/material-ui/issues/48691)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[code-infra] Run prettier after renovate update ([#&#8203;48754](https://github.com/mui/material-ui/issues/48754)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Fix 'A11y results committed?' check on react-pinned nightly jobs ([#&#8203;48740](https://github.com/mui/material-ui/issues/48740)) [@&#8203;Janpot](https://github.com/Janpot) - \[core] Remove leftover Joy UI references ([#&#8203;48719](https://github.com/mui/material-ui/issues/48719)) [@&#8203;siriwatknp](https://github.com/siriwatknp) - \[code-infra] Bump react-router to 7.15.1 ([#&#8203;48725](https://github.com/mui/material-ui/issues/48725)) [@&#8203;Janpot](https://github.com/Janpot) - \[docs-infra] Drive docs analytics IDs via ANALYTICS\_ENV ([#&#8203;48694](https://github.com/mui/material-ui/issues/48694)) [@&#8203;Janpot](https://github.com/Janpot) - \[docs-infra] Pre-render API page descriptions ([#&#8203;48693](https://github.com/mui/material-ui/issues/48693)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[code-infra]\[icons-material] Build lib/package.json with code-infra --no-expand ([#&#8203;48689](https://github.com/mui/material-ui/issues/48689)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Fix react\@&#8203;18/next nightly workflow ([#&#8203;48635](https://github.com/mui/material-ui/issues/48635)) [@&#8203;Janpot](https://github.com/Janpot) All contributors of this release in alphabetical order: [@&#8203;brijeshb42](https://github.com/brijeshb42), [@&#8203;greymoth-jp](https://github.com/greymoth-jp), [@&#8203;Janpot](https://github.com/Janpot), [@&#8203;LukasTy](https://github.com/LukasTy), [@&#8203;michelengelen](https://github.com/michelengelen), [@&#8203;mturac](https://github.com/mturac), [@&#8203;Prakash1185](https://github.com/Prakash1185), [@&#8203;siriwatknp](https://github.com/siriwatknp), [@&#8203;Sushantplive](https://github.com/Sushantplive) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/459 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>	2026-07-09 23:48:06 +00:00
Lunny Xiao	965c269495	Update zh tw languages and fix some broken links (#455) ... --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/455 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>	2026-07-09 23:41:46 +00:00
Renovate Bot	c0f8a04185	fix(deps): update dependency redocusaurus to v2.5.2 (#456) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [redocusaurus](https://redocusaurus.vercel.app/) ([source](https://github.com/rohit-gohri/redocusaurus)) | [`2.5.0` → `2.5.2`](https://renovatebot.com/diffs/npm/redocusaurus/2.5.0/2.5.2) |  |  | --- ### Release Notes <details> <summary>rohit-gohri/redocusaurus (redocusaurus)</summary> ### [`v2.5.2`](https://github.com/rohit-gohri/redocusaurus/blob/HEAD/CHANGELOG.md#redocusaurus252) [Compare Source](https://github.com/rohit-gohri/redocusaurus/compare/v2.5.0...v2.5.2) ##### Patch Changes - [#&#8203;450](https://github.com/rohit-gohri/redocusaurus/pull/450) [`b84704a`](b84704ad24) Thanks [@&#8203;copilot-swe-agent](https://github.com/apps/copilot-swe-agent)! - chore: upgrade Yarn, Node.js, and GitHub Actions </details> --------- Reviewed-on: https://gitea.com/gitea/docs/pulls/456 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>	2026-07-08 05:03:07 +00:00
Lunny Xiao	6a3f75f060	sync customizing gitea (#458) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/458	2026-07-08 04:58:43 +00:00
wxiaoguang	7fa4bc6bd4	update config: DEFAULT_TITLE_SOURCE=branch-name (#457) ... https://github.com/go-gitea/gitea/pull/38356Reviewed-on: https://gitea.com/gitea/docs/pulls/457 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com>	2026-07-07 18:40:24 +00:00
TheFox0x7	9558006c39	update binary verification section (#449) ... --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/449 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>	2026-07-01 17:22:39 +00:00
Lunny Xiao	1033f033bc	Add 1.27 rc0 documentation (#453) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/453 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>	2026-07-01 17:14:52 +00:00
Renovate Bot	24fdff218d	fix(deps): update dependency @mui/material to v9.1.2 (#450) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@mui/material](https://mui.com/material-ui/) ([source](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material)) | [`9.1.1` → `9.1.2`](https://renovatebot.com/diffs/npm/@mui%2fmaterial/9.1.1/9.1.2) |  |  | --- ### Release Notes <details> <summary>mui/material-ui (@&#8203;mui/material)</summary> ### [`v9.1.2`](https://github.com/mui/material-ui/blob/HEAD/CHANGELOG.md#912) [Compare Source](https://github.com/mui/material-ui/compare/v9.1.1...v9.1.2) <!-- generated comparing v9.1.1..master --> *Jun 23, 2026* A big thanks to the 5 contributors who made this release possible. ##### `@mui/material@9.1.2` - \[autocomplete] Don't submit forms when committing `freeSolo` value with Enter key ([#&#8203;48679](https://github.com/mui/material-ui/issues/48679)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[transitions] Fix RTG import in ESM ([#&#8203;48645](https://github.com/mui/material-ui/issues/48645)) [@&#8203;mj12albert](https://github.com/mj12albert) ##### `@mui/system@9.1.2` - \[InitColorSchemeScript] Fix script tag warning in Next.js 16 dev mode ([#&#8203;48671](https://github.com/mui/material-ui/issues/48671)) [@&#8203;siriwatknp](https://github.com/siriwatknp) ##### Docs - Fix typos in release instructions ([#&#8203;48687](https://github.com/mui/material-ui/issues/48687)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - Update [@&#8203;mui/x-](https://github.com/mui/x-)\* packages to latest ([#&#8203;48661](https://github.com/mui/material-ui/issues/48661)) [@&#8203;Janpot](https://github.com/Janpot) ##### Core - \[code-infra] Convert leaf [@&#8203;mui/system](https://github.com/mui/system) .js+.d.ts pairs to TypeScript (part 1) ([#&#8203;48578](https://github.com/mui/material-ui/issues/48578)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Bump to latest code-infra packages ([#&#8203;48672](https://github.com/mui/material-ui/issues/48672)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[code-infra] Resolve remaining minimatch advisory ([#&#8203;48662](https://github.com/mui/material-ui/issues/48662)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Bump nx to resolve minimatch advisory ([#&#8203;48658](https://github.com/mui/material-ui/issues/48658)) [@&#8203;Janpot](https://github.com/Janpot) - \[core] Drop @&#8203;babel/\* pnpm overrides ([#&#8203;48710](https://github.com/mui/material-ui/issues/48710)) [@&#8203;Janpot](https://github.com/Janpot) - \[docs-infra] Revert "Pin StackBlitz demo vite to v7 and plugin-react to v5" ([#&#8203;48709](https://github.com/mui/material-ui/issues/48709)) [@&#8203;Janpot](https://github.com/Janpot) - \[docs-infra] Fix code-block copy button broken on direct page load ([#&#8203;48653](https://github.com/mui/material-ui/issues/48653)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[test] Stabilize Data Grid demo data in Argos screenshots ([#&#8203;48654](https://github.com/mui/material-ui/issues/48654)) [@&#8203;LukasTy](https://github.com/LukasTy) All contributors of this release in alphabetical order: [@&#8203;brijeshb42](https://github.com/brijeshb42), [@&#8203;Janpot](https://github.com/Janpot), [@&#8203;LukasTy](https://github.com/LukasTy), [@&#8203;mj12albert](https://github.com/mj12albert), [@&#8203;siriwatknp](https://github.com/siriwatknp) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/450 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>	2026-07-01 03:30:52 +00:00
Nicolas	7aae398e37	docs: Update as we now support continue-on-error in 1.27 (#452) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/452 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-07-01 03:20:59 +00:00
Renovate Bot	09bde5a387	chore(deps): update pnpm to v11.9.0 (#446) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`11.7.0` → `11.9.0`](https://renovatebot.com/diffs/npm/pnpm/11.7.0/11.9.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.9.0`](https://github.com/pnpm/pnpm/releases/tag/v11.9.0): pnpm 11.9 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.8.0...v11.9.0) #### Minor Changes - [`bae694f`](https://github.com/pnpm/pnpm/commit/bae694f): Some registries generate tarballs on-demand and cannot provide an integrity checksum in their package metadata. In that case pnpm now computes the integrity from the downloaded tarball and stores it in the lockfile, so the entry is verifiable on subsequent installs instead of being written without an integrity (which would fail the next install). This also applies to `--lockfile-only`: the tarball is downloaded so its integrity can be computed. A lockfile entry that is still missing its integrity is rejected as a `ERR_PNPM_MISSING_TARBALL_INTEGRITY` lockfile verification violation (the install fails closed) rather than being silently re-fetched. - [`6c35a43`](https://github.com/pnpm/pnpm/commit/6c35a43): Added `--exclude-peers` to `pnpm sbom`. With `auto-install-peers` (the default), peer dependencies resolve into the lockfile and are otherwise indistinguishable from the package's own dependencies. The flag drops peer dependencies (and any transitive subtree reachable only through them) from the SBOM. CycloneDX 1.7 has no scope or relationship that expresses "consumer-provided peer", so omission is the only spec-clean handling. The flag name matches `pnpm list --exclude-peers`; note the SBOM flag prunes a peer's exclusive subtree, which is stricter than `pnpm list` (which only hides leaf peers). #### Patch Changes - [`25a829e`](https://github.com/pnpm/pnpm/commit/25a829e): `pnpm audit --fix` now writes a single combined `minimumReleaseAgeExclude` entry per package (e.g. `axios@0.18.1 || 0.21.1`) instead of one entry per version, matching the format documented for the setting. Existing per-version entries in `pnpm-workspace.yaml` are merged into the combined form rather than left as duplicates. Installs that auto-collect immature versions into `minimumReleaseAgeExclude` now report the same combined entries, so the "Added N entries" message matches what is written to the manifest [#&#8203;12534](https://github.com/pnpm/pnpm/issues/12534). - [`1cbb5f2`](https://github.com/pnpm/pnpm/commit/1cbb5f2): Fixed non-deterministic peer resolution that could add or remove an optional transitive peer — for example `@babel/core`, reached through `styled-jsx` — from a package's peer-dependency suffix across otherwise identical installs, churning the lockfile and causing intermittent `pnpm dedupe --check` failures in CI. When a package's children are resolved by one occurrence (the "owner") and reused by a deeper consumer, whether that consumer inherited the owner's missing peers depended on whether the owner's resolution had finished yet — a race under concurrent resolution. The decision is now a function of the dependency graph's structure rather than resolution-completion order. - [`d577eea`](https://github.com/pnpm/pnpm/commit/d577eea): Fixed a Windows flakiness in `pnpm dlx` where a failed install could surface a spurious `EBUSY: resource busy or locked` error. The cleanup of a partially-populated dlx cache is now best-effort with retries and no longer masks the original error. - [`ec7cf70`](https://github.com/pnpm/pnpm/commit/ec7cf70): Shortened the `pnpm dlx` cache path so deep dependency trees no longer overflow Windows' `MAX_PATH`, which could make a dependency's lifecycle script fail with `spawn cmd.exe ENOENT`. - [`05b95ab`](https://github.com/pnpm/pnpm/commit/05b95ab): Fixed `pnpm` hanging (and crashing with an unhandled promise rejection) when a non-retryable network error such as `SELF_SIGNED_CERT_IN_CHAIN` occurs while fetching from a registry. The error is now rejected through the returned promise instead of being thrown inside the detached retry callback. - [`d3f68e2`](https://github.com/pnpm/pnpm/commit/d3f68e2): Fix a `pnpm audit` performance regression on lockfiles that contain dependency cycles. The reachable-vulnerability pruning added in pnpm 11.5.1 only memoized acyclic subtrees, so any node whose subtree touched a cycle — together with all of its ancestors — was recomputed on every query, making the path walk quadratic. Reachability is now computed once per node using Tarjan's strongly-connected-components algorithm, so cyclic graphs are handled in linear time [#&#8203;12212](https://github.com/pnpm/pnpm/issues/12212). The audit path walk also no longer recurses, so a deeply nested dependency graph can no longer overflow the call stack, and the install path to each finding is tracked without per-node copying, keeping memory linear in the graph depth. - [`322f88f`](https://github.com/pnpm/pnpm/commit/322f88f): Fix failed optional dependency updates so they don't rewrite unrelated dependency specs [#&#8203;11267](https://github.com/pnpm/pnpm/issues/11267). - [`1488db1`](https://github.com/pnpm/pnpm/commit/1488db1): When `enableGlobalVirtualStore` is toggled on for a project that was previously installed without it, stale hoisted symlinks under `node_modules/.pnpm/node_modules` are now replaced instead of being left pointing at the old per-project virtual store location [#&#8203;9739](https://github.com/pnpm/pnpm/issues/9739). - [`6545793`](https://github.com/pnpm/pnpm/commit/6545793): Fixed `pnpm install --ignore-workspace` overwriting the `allowBuilds` map in `pnpm-workspace.yaml`. The ignored builds of a package with a build script were auto-populated into `allowBuilds` even though `--ignore-workspace` was passed, clobbering committed `true`/`false` values with the `set this to true or false` placeholder [#&#8203;12469](https://github.com/pnpm/pnpm/issues/12469). - [`fbdc0eb`](https://github.com/pnpm/pnpm/commit/fbdc0eb): Fixed `minimumReleaseAgeExclude` and `trustPolicyExclude` so multiple exact-version entries for the same package behave the same as a single `||` disjunction entry. Previously only the first matching rule's versions were honored, so a config like `[form-data@4.0.6, form-data@2.5.6]` could still flag `form-data@2.5.6` as violating `minimumReleaseAge`, while `[form-data@4.0.6 || 2.5.6]` worked as expected [#&#8203;12463](https://github.com/pnpm/pnpm/issues/12463). - [`fa7004b`](https://github.com/pnpm/pnpm/commit/fa7004b): The in-memory package metadata cache is now populated on the exact-version disk fast path, so repeated resolutions of the same package within one install no longer re-read and re-parse the on-disk metadata. In large monorepos this brings the time for adding a new package down from minutes to seconds. The in-memory cache key now also includes the registry, so a package of the same name served by two different registries in a single install can no longer share a cache slot and resolve the wrong tarball. - [`0a154b1`](https://github.com/pnpm/pnpm/commit/0a154b1): Fixed `pnpm patch` dropping the package name (and leaking internal option fields) when the patched dependency resolves to a single git-hosted version. - [`4d3fe4b`](https://github.com/pnpm/pnpm/commit/4d3fe4b): The pnpr resolver endpoints moved under the reserved `/-/pnpr` namespace: `POST /v1/resolve` is now `POST /-/pnpr/v0/resolve` and `POST /v1/verify-lockfile` is now `POST /-/pnpr/v0/verify-lockfile`. The capability handshake at `GET /-/pnpr` advertises protocol version `0` to match. This keeps every pnpr-proprietary route in npm's reserved namespace, so it can never collide with a package path. - [`0ec878d`](https://github.com/pnpm/pnpm/commit/0ec878d): Removing a runtime dependency now removes the matching `devEngines.runtime` or `engines.runtime` entry that was materialized from it. Blank runtime selectors are normalized to `latest`. - [`17e7f2c`](https://github.com/pnpm/pnpm/commit/17e7f2c): `pnpm sbom` now emits a CycloneDX `issue-tracker` external reference for components (and the root) whose `package.json` declares a `bugs` URL. Email-only `bugs` entries are skipped, since the reference requires a URL. - [`a84d2a1`](https://github.com/pnpm/pnpm/commit/a84d2a1): Add `@pnpm/resolving.tarball-url`, which builds and recognizes the canonical npm tarball URL of a package. It vendors `getNpmTarballUrl` (previously the external `get-npm-tarball-url` package) and adds `isCanonicalRegistryTarballUrl`, the predicate the lockfile writer uses to decide whether a tarball URL is derivable from name+version+registry (and can therefore be omitted from `pnpm-lock.yaml`). Exposing `isCanonicalRegistryTarballUrl` lets a custom resolver (pnpmfile `resolvers`) fronting a proxy that serves tarballs on a non-canonical path (e.g. an ephemeral `localhost:<port>`) rewrite the resolved tarball to the canonical form, so nothing host-specific is persisted to the lockfile. Previously this logic was private to `@pnpm/lockfile.utils`. Two correctness fixes are included while consolidating the logic: the scoped-package unescape now handles uppercase `%2F` as well as `%2f` (percent-encoding is case-insensitive), and protocol-insensitive comparison strips only a leading `http(s)://` scheme instead of splitting on the first `://` (which could truncate URLs containing a later `://`). - [`852d537`](https://github.com/pnpm/pnpm/commit/852d537): Lockfile verification no longer reports a registry metadata fetch failure (for example a `403`/`401` on a private registry, or a network error) as `ERR_PNPM_TARBALL_URL_MISMATCH`. When the registry can't be reached to verify an entry, the install now aborts with the registry's own fetch error (such as `ERR_PNPM_FETCH_403`, which already explains the authentication situation) instead of mislabeling a transport failure as lockfile tampering. Registry fetch errors no longer leak basic-auth credentials embedded in the registry URL (`https://user:pass@host/`) into their message. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.8.0`](https://github.com/pnpm/pnpm/releases/tag/v11.8.0): pnpm 11.8 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.7.0...v11.8.0) #### Minor Changes - [`c112b61`](https://github.com/pnpm/pnpm/commit/c112b61): Added a `--dry-run` option to `pnpm install`. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, no `node_modules`) and always exits with code 0. This mirrors the preview semantics of `npm install --dry-run` [#&#8203;7340](https://github.com/pnpm/pnpm/issues/7340). - [`179ebc4`](https://github.com/pnpm/pnpm/commit/179ebc4): `pnpm run --no-bail` now exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of `--no-bail` consistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursive `pnpm run --no-bail` always exited with code 0, even when a script failed [#&#8203;8013](https://github.com/pnpm/pnpm/issues/8013). - [`0474a9c`](https://github.com/pnpm/pnpm/commit/0474a9c): Added support for generating Node.js package maps at `node_modules/.package-map.json` during isolated and hoisted installs. Added the `node-experimental-package-map` setting to inject the generated map into pnpm-managed Node.js script environments, and the `node-package-map-type` setting to choose between `standard` and `loose` package maps. - [`dcededc`](https://github.com/pnpm/pnpm/commit/dcededc): `pnpm sbom` now marks components reachable only through `devDependencies` with CycloneDX `scope: "excluded"` and the `cdx:npm:package:development` property. The `excluded` scope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by `@cyclonedx/cyclonedx-npm`, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installed `optionalDependencies`) omit `scope` and default to `required`. - [`1495cb0`](https://github.com/pnpm/pnpm/commit/1495cb0): Added per-package SBOM generation with `--out` and `--split` flags. Use `--out out/%s.cdx.json` to write one SBOM per workspace package to individual files, or `--split` for NDJSON output to stdout. When `--filter` selects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (`workspace:` protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them. - [`293921a`](https://github.com/pnpm/pnpm/commit/293921a): feat(view): support searching project manifest upward when package name is omitted When running `pnpm view` without a package name, the command now searches upward for the nearest project manifest (`package.json`, `package.yaml`, or `package.json5`) and uses its `name` field. If the manifest exists but lacks a `name` field, an error is thrown. This change also replaces the `find-up` dependency with `empathic` for improved performance and consistency across workspace tools. #### Patch Changes - [`29ab905`](https://github.com/pnpm/pnpm/commit/29ab905): Fixed `pnpm update` overriding the version range policy of a named catalog whose name parses as a version (e.g. `catalog:express4-21`). The `catalog:` reference carries no pinning of its own, so the prefix from the catalog entry (such as `~`) is now preserved instead of being widened to `^` [#&#8203;10321](https://github.com/pnpm/pnpm/issues/10321). - [`bee4bf4`](https://github.com/pnpm/pnpm/commit/bee4bf4): Security: validate config dependency names and versions from the env lockfile (`pnpm-lock.yaml`) before using them to build filesystem paths. A committed lockfile with a traversal-shaped `configDependencies` name (such as `../../PWNED`) or version (such as `../../../PWNED`) could previously cause `pnpm install` to create symlinks or write package files outside `node_modules/.pnpm-config` and the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See [GHSA-qrv3-253h-g69c](https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c). - [`96bdd57`](https://github.com/pnpm/pnpm/commit/96bdd57): Fix `link:` workspace protocol switching to `file:` after `pnpm rm` is run from inside a workspace package whose target workspace dependency has its own dependencies, when `injectWorkspacePackages: true` is set. Follow-up to [#&#8203;10575](https://github.com/pnpm/pnpm/pull/10575), which fixed the same symptom for workspace packages without dependencies. - [`302a2f7`](https://github.com/pnpm/pnpm/commit/302a2f7): No longer warn about using both `packageManager` and `devEngines.packageManager` when the two fields pin the same package manager at the same version with the same integrity hash (e.g. both `pnpm@11.5.1+sha512.…`). Previously the hash was stripped from the legacy `packageManager` field but not from `devEngines.packageManager`, so even identical specifications looked like a mismatch [#&#8203;12028](https://github.com/pnpm/pnpm/issues/12028). The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version. - [`3f0fb21`](https://github.com/pnpm/pnpm/commit/3f0fb21): Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment like `added 0sa':`). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared [#&#8203;12350](https://github.com/pnpm/pnpm/issues/12350). - [`564619f`](https://github.com/pnpm/pnpm/commit/564619f): Fixed `pnpm approve-builds` reporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. after `git stash` drops the `allowBuilds` from `pnpm-workspace.yaml`) is re-added. The revoked packages are now correctly recorded in `.modules.yaml` so `approve-builds` can find them. [#&#8203;12221](https://github.com/pnpm/pnpm/issues/12221) - [`3d1fd20`](https://github.com/pnpm/pnpm/commit/3d1fd20): Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existing `node.exe` already matches the target (same hard link or identical content) [pnpm/pnpm#12203](https://github.com/pnpm/pnpm/issues/12203). - [`1b02b47`](https://github.com/pnpm/pnpm/commit/1b02b47): Fix macOS Gatekeeper blocking native binaries (`.node`, `.dylib`, `.so`) by removing the `com.apple.quarantine` extended attribute after importing them from the store. When pnpm imports files from its content-addressable store into `node_modules`, macOS preserves extended attributes, including `com.apple.quarantine`. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates to `node_modules`, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile. After importing a package, pnpm now strips `com.apple.quarantine` from its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batched `xattr` call per package, is restricted to native binaries (other files are untouched), and is non-fatal (it logs a warning on unexpected errors). Fixes [#&#8203;11056](https://github.com/pnpm/pnpm/issues/11056) - [`61969fb`](https://github.com/pnpm/pnpm/commit/61969fb): Fix `pnpm install` with `optimisticRepeatInstall` incorrectly reporting `Already up to date` when `pnpm-lock.yaml` changed but project manifests did not. This affected workflows such as checking out or restoring only the lockfile [#&#8203;12100](https://github.com/pnpm/pnpm/issues/12100). Also fixes `checkDepsStatus` to use the correct lockfile path when `useGitBranchLockfile` is enabled, so the optimistic fast-path and lockfile modification detection work with `pnpm-lock.<branch>.yaml` files instead of always stat'ing `pnpm-lock.yaml`. Merge-conflict detection now reads the resolved lockfile name as well, and with `mergeGitBranchLockfiles` enabled every `pnpm-lock.*.yaml` is scanned for modifications and conflicts. The git branch is now resolved by reading `.git/HEAD` directly (no process spawn) and uses the workspace directory rather than `process.cwd()`. - [`5c12968`](https://github.com/pnpm/pnpm/commit/5c12968): Fix recursive updates of transitive dependencies when the update command mixes transitive dependency patterns with direct dependency selectors. For example, `pnpm up -r "@&#8203;babel/core" uuid` now updates matching transitive `@babel/core` dependencies even when `uuid` is a direct dependency selector [#&#8203;12103](https://github.com/pnpm/pnpm/issues/12103). - [`9d79ba1`](https://github.com/pnpm/pnpm/commit/9d79ba1): Register the `pnpm update --no-save` flag in the CLI help and option parser. - [`0474a9c`](https://github.com/pnpm/pnpm/commit/0474a9c): Fixed `pnpm import` for Yarn v2 lockfiles when `js-yaml` v4 is installed. - [`9e0c375`](https://github.com/pnpm/pnpm/commit/9e0c375): Fixed `pnpm install` repeatedly prompting to remove and reinstall `node_modules` in a workspace package when `enableGlobalVirtualStore` is enabled. The post-install build step recorded a per-project `node_modules/.pnpm` virtual store directory in `node_modules/.modules.yaml`, overwriting the global `<storeDir>/links` value the install step had written. The next install then detected a virtual-store mismatch (`ERR_PNPM_UNEXPECTED_VIRTUAL_STORE`). The build step now derives the same global virtual store directory as the install step [#&#8203;12307](https://github.com/pnpm/pnpm/issues/12307). - [`223d060`](https://github.com/pnpm/pnpm/commit/223d060): Document the `--cpu`, `--os` and `--libc` flags in the output of `pnpm install --help`. These flags were already supported but were only documented on the website [#&#8203;12359](https://github.com/pnpm/pnpm/issues/12359). - [`e85aea2`](https://github.com/pnpm/pnpm/commit/e85aea2): Avoid reading `README.md` from disk when publishing if the publish manifest already provides a `readme` field. The README is now only read lazily, inside `createExportableManifest`, when it is actually needed. - [`3188ae7`](https://github.com/pnpm/pnpm/commit/3188ae7): Fixed `pnpm peers check` to accept loose peer dependency ranges such as `>=3.16.0 || >=4.0.0-` when the installed peer version satisfies the range [#&#8203;12149](https://github.com/pnpm/pnpm/issues/12149). - [`531f2a3`](https://github.com/pnpm/pnpm/commit/531f2a3): Fixed `pnpm update` rewriting a `workspace:` dependency that points at a local path (e.g. `workspace:../packages/foo/dist`) into a normalized `link:` or version-range specifier. Such specifiers are now preserved verbatim when the workspace protocol is preserved [#&#8203;3902](https://github.com/pnpm/pnpm/issues/3902). - [`fe66535`](https://github.com/pnpm/pnpm/commit/fe66535): Fixed a lockfile non-convergence bug where an incremental install kept a duplicate transitive dependency that a fresh install would not produce. When a package is reused from the lockfile, its child edges are taken verbatim and bypass the preferred-versions walk, so a transitive dependency could stay pinned to an older version even after a direct dependency resolved to a higher version that satisfies the same range. The resolver now refreshes such a stale pin to the higher direct-dependency version during resolution — so the older version is never resolved or fetched, and the incremental result converges to the fresh one. - [`6d35338`](https://github.com/pnpm/pnpm/commit/6d35338): `pnpm install` detects changes inside local file dependencies again. The optimistic repeat-install fast path only tracks manifest and lockfile modification times, so edits inside a local dependency's directory (or a repacked local tarball) were reported as "Already up to date". Projects with local file dependencies (`file:` and bare local path or tarball specifiers, declared directly or through `pnpm.overrides`) now always run a full install, which refetches those dependencies, matching pnpm v10 behavior [#&#8203;11795](https://github.com/pnpm/pnpm/issues/11795). - [`4ca9247`](https://github.com/pnpm/pnpm/commit/4ca9247): Preserve the existing Node.js runtime version prefix when resolving `node@runtime:<range>` to a concrete version. - [`30c7590`](https://github.com/pnpm/pnpm/commit/30c7590): Create shorter CAFS temporary package directories to leave room for lifecycle scripts that create IPC socket paths under TMPDIR. - [`13815ad`](https://github.com/pnpm/pnpm/commit/13815ad): Reporter output (warnings, progress) for `pnpm store` and `pnpm config` subcommands now goes to stderr instead of stdout. This fixes scripts that capture their stdout (e.g. `PNPM_STORE=$(pnpm store path)`, `pnpm config list --json | jq`) from getting warnings mixed into the result. - [`1c05876`](https://github.com/pnpm/pnpm/commit/1c05876): Avoid relinking unchanged child dependencies and remove stale child links during warm installs. - [`817f99d`](https://github.com/pnpm/pnpm/commit/817f99d): Fixed lockfile churn where a package's `transitivePeerDependencies` could be dropped (and shift between packages) when the package participates in a dependency cycle. A cycle re-entry resolves against truncated children, so it must not be cached as "pure"; otherwise sibling occurrences of the same package short-circuit and lose transitive peers depending on traversal order [#&#8203;5108](https://github.com/pnpm/pnpm/issues/5108). - [`eba03e0`](https://github.com/pnpm/pnpm/commit/eba03e0): Fix `pnpm install` reporting "Already up to date" after a catalog entry in `pnpm-workspace.yaml` was reverted to a previous version. After an update modified a catalog, the workspace state cache stored the pre-update catalog versions, so reverting the entry back to its original version was not detected as an outdated state [#&#8203;12418](https://github.com/pnpm/pnpm/issues/12418). - [`3b54d79`](https://github.com/pnpm/pnpm/commit/3b54d79): `pnpm update` now keeps lockfile `overrides` that resolve through a catalog in sync with the catalog. Previously, when an override referenced a catalog (e.g. `overrides: { foo: 'catalog:' }`) and `pnpm update` bumped that catalog entry, the lockfile's `catalogs` advanced while the resolved `overrides` kept the old version. The resulting lockfile was internally inconsistent, so a later `pnpm install --frozen-lockfile` failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`. - [`9d0a300`](https://github.com/pnpm/pnpm/commit/9d0a300): Fixed `pnpm version --recursive` so it honors the workspace selection. In recursive mode the version bump now applies to the packages resolved from the workspace filter (`selectedProjectsGraph`), matching the behavior of `pnpm publish --recursive`, instead of always bumping every workspace package [#&#8203;11348](https://github.com/pnpm/pnpm/issues/11348). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/446 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-29 21:25:48 +00:00
Zettat123	1fb481c186	docs: add docs for scoped workflows (#447) ... Related: https://github.com/go-gitea/gitea/pull/38154 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/447 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-committed-by: Zettat123 <zettat123@gmail.com>	2026-06-28 09:32:51 +00:00
Lunny Xiao	7fe73e351f	release to cloudflare as well (#448) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/448	2026-06-28 03:29:01 +00:00
Renovate Bot	c9216685d5	chore(deps): update actions/checkout action to v7 (#445) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/445 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-23 00:05:55 +00:00
Nicolas	f455b38c06	update 1.26.4 (#443) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/443 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-committed-by: Nicolas <bircni@icloud.com>	2026-06-21 22:28:28 +00:00
Lunny Xiao	c677b5da29	update 1.26.3 (#442) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/442 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-committed-by: Lunny Xiao <xiaolunwen@gmail.com>	2026-06-21 07:50:31 +00:00
Renovate Bot	6d5451918d	fix(deps): update dependency @mui/material to v9.1.1 (#439) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/439 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-19 17:20:46 +00:00
silverwind	3842dd1f55	build: update pnpm to v11 and pin exact dependencies (#441) ... - bump `packageManager` to `pnpm@11.7.0`, move settings to `pnpm-workspace.yaml`, drop the npm-only `.npmrc` - pin all dependencies to exact versions Reviewed-on: https://gitea.com/gitea/docs/pulls/441 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-committed-by: silverwind <me@silverwind.io>	2026-06-18 09:14:55 +00:00
Renovate Bot	4b2bcc99a2	chore(deps): update pnpm to v10.34.3 (#440) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.34.2` → `10.34.3`](https://renovatebot.com/diffs/npm/pnpm/10.34.2/10.34.3) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v10.34.3`](https://github.com/pnpm/pnpm/releases/tag/v10.34.3): pnpm 10.34.3 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.34.2...v10.34.3) ##### ⚠️ Security fix — environment variables in a project `.npmrc` (action may be required) Following [GHSA-3qhv-2rgh-x77r](https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r), pnpm no longer expands `${ENV_VAR}` placeholders that come from a **repository-controlled** config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to: - the project/workspace `.npmrc` — `registry`, `@scope:registry`, proxy URLs, URL-scoped keys (`//host/…`), and credential values (`_authToken`, `_auth`, `_password`, `username`, `tokenHelper`, `cert`, `key`); - registry URLs in `pnpm-workspace.yaml`. This release also closes a bypass where a project `.npmrc` could set `userconfig`, `globalconfig`, or `prefix` to make pnpm load a repo-supplied file as *trusted* config (via `@pnpm/npm-conf@3.0.3`). Environment variables are **still** expanded in trusted config: your user-level `~/.npmrc`, the global config, CLI options, and environment config. **If your authentication broke after upgrading**, move the token out of the committed `.npmrc`: ```sh # Writes to your user/global config, not the repository: pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN" ``` Or keep the `${NPM_TOKEN}` line but put it in your user-level `~/.npmrc` instead of the repo. In **GitHub Actions**, `actions/setup-node` with `registry-url` already writes a user-level `.npmrc`, so `NODE_AUTH_TOKEN` keeps working. For other CI where editing each pipeline is hard, set `NPM_CONFIG_USERCONFIG=.npmrc` in the CI environment to declare the project `.npmrc` trusted. See <https://pnpm.io/npmrc> for full migration details. #### Patch Changes - Improved the warning printed when a project `.npmrc` uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running `pnpm config set "<key>" <value>` to store it in the global config, or by keeping the `${...}` line in the user-level `~/.npmrc` — with a link to <https://pnpm.io/npmrc>. - A repository-controlled project or workspace `.npmrc` can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set `userconfig`, `globalconfig`, or `prefix` to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set `tokenHelper`. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace `.npmrc` files are read. Fixed by upgrading `@pnpm/npm-conf` to `3.0.3`. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/440 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-17 07:05:14 +00:00
Renovate Bot	49dec05ddd	chore(deps): update pnpm to v10.34.2 (#438) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/438 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-16 16:51:52 +00:00
Nicolas	eb65e671a2	Runner docs v1.0.8 (#435) ... Adds a versioned docs snapshot for Gitea Runner v1.0.8 (latest stable), updates lastVersion and navbar to point to the new version while keeping 0.2.11 in the dropdown for historical reference. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/435 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-committed-by: Nicolas <bircni@icloud.com>	2026-06-14 00:30:30 +00:00
Renovate Bot	7737ef98a4	chore(deps): update dependency @mui/material to v9.1.0 (#437) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@mui/material](https://mui.com/material-ui/) ([source](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material)) | [`9.0.1` → `9.1.0`](https://renovatebot.com/diffs/npm/@mui%2fmaterial/9.0.1/9.1.0) |  |  | --- ### Release Notes <details> <summary>mui/material-ui (@&#8203;mui/material)</summary> ### [`v9.1.0`](https://github.com/mui/material-ui/blob/HEAD/CHANGELOG.md#910) [Compare Source](https://github.com/mui/material-ui/compare/v9.0.1...v9.1.0) <!-- generated comparing v9.0.1..master --> *Jun 8, 2026* A big thanks to the 15 contributors who made this release possible. Here are some highlights ✨: - ⚙️ Support for the [prefers-reduced-motion](https://mui.com/material-ui/transitions/#reduced-motion) setting. - ♿️ Improved support for Windows High Contrast mode with the [enhanceHighContrast](https://mui.com/material-ui/customization/palette/#windows-high-contrast-mode) theme wrapper. ##### `@mui/material@9.1.0` - \[autocomplete] Enable clearing highlight when mouse leaves popup ([#&#8203;48354](https://github.com/mui/material-ui/issues/48354)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[autocomplete] Fix `freeSolo` controlled values cleared by initial `null` ([#&#8203;48611](https://github.com/mui/material-ui/issues/48611)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[autocomplete] Fix item removal when it receives focus from VoiceOver before using Backspace ([#&#8203;48572](https://github.com/mui/material-ui/issues/48572)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[autocomplete] Fix `resetHighlightOnMouseLeave` JSdoc ([#&#8203;48536](https://github.com/mui/material-ui/issues/48536)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[autocomplete] Guard against null inputRef during unmount ([#&#8203;48617](https://github.com/mui/material-ui/issues/48617)) [@&#8203;noam3127](https://github.com/noam3127) - \[badge] Add `aria-hidden` to badge content and polish docs demos ([#&#8203;48471](https://github.com/mui/material-ui/issues/48471)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[badge] Use inline CSS variables for anchorOrigin/overlap positioning ([#&#8203;48549](https://github.com/mui/material-ui/issues/48549)) [@&#8203;siriwatknp](https://github.com/siriwatknp) - \[button] Fix customized flex gap styles ([#&#8203;48542](https://github.com/mui/material-ui/issues/48542)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[dialog] Fix unwanted `DialogPaper` focus ring ([#&#8203;48535](https://github.com/mui/material-ui/issues/48535)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[focus trap] Fix incorrect tab order when `tabIndex >= 1` ([#&#8203;48546](https://github.com/mui/material-ui/issues/48546)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[progress] Show runtime errors only once ([#&#8203;48591](https://github.com/mui/material-ui/issues/48591)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[select] Allow spacebar to select elements ([#&#8203;48615](https://github.com/mui/material-ui/issues/48615)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[select] Support typeahead when closed ([#&#8203;48563](https://github.com/mui/material-ui/issues/48563)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[step button] Choose higher contrast ripple color for dark mode focus ([#&#8203;48612](https://github.com/mui/material-ui/issues/48612)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[stepper] Include StepConnector inside Step element ([#&#8203;48492](https://github.com/mui/material-ui/issues/48492)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[stepper] Proper support for vertical alternativeLabel ([#&#8203;48485](https://github.com/mui/material-ui/issues/48485)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[tabs] Fix React 18 roving tabindex and dedupe invalid-value warning ([#&#8203;48605](https://github.com/mui/material-ui/issues/48605)) [@&#8203;Janpot](https://github.com/Janpot) - \[theme] Add HighContrast theme enhancer ([#&#8203;48319](https://github.com/mui/material-ui/issues/48319)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[timeline item] Fix extra ::before spacing when TimelineOppositeContent is present ([#&#8203;46663](https://github.com/mui/material-ui/issues/46663)) [@&#8203;tyalau](https://github.com/tyalau) - \[tooltip] Prevent stuck-open tooltip when child becomes disabled ([#&#8203;48606](https://github.com/mui/material-ui/issues/48606)) [@&#8203;Janpot](https://github.com/Janpot) - \[transitions] Custom `Transition` component ([#&#8203;48325](https://github.com/mui/material-ui/issues/48325)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[transitions] Support `prefers-reduced-motion` ([#&#8203;48357](https://github.com/mui/material-ui/issues/48357)) [@&#8203;mj12albert](https://github.com/mj12albert) ##### `@mui/utils@9.1.0` - \[utils] Prevent prototype pollution in fastDeepAssign ([#&#8203;48580](https://github.com/mui/material-ui/issues/48580)) [@&#8203;Janpot](https://github.com/Janpot) ##### Docs - \[docs] Add function `slotProps` documentation ([#&#8203;48574](https://github.com/mui/material-ui/issues/48574)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[docs] Clarify styled-components version compatibility ([#&#8203;48533](https://github.com/mui/material-ui/issues/48533)) [@&#8203;nightt5879](https://github.com/nightt5879) - \[docs] Fix broken URLs ([#&#8203;48520](https://github.com/mui/material-ui/issues/48520)) [@&#8203;oliviertassinari](https://github.com/oliviertassinari) - \[docs] Fix invalid JSON in Zed MCP setup example ([#&#8203;48490](https://github.com/mui/material-ui/issues/48490)) [@&#8203;pavan-sh](https://github.com/pavan-sh) - \[docs] Mention release version for enhanceHighContrast ([#&#8203;48609](https://github.com/mui/material-ui/issues/48609)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[docs] Remove outdated MUI X v8 notification ([#&#8203;48600](https://github.com/mui/material-ui/issues/48600)) [@&#8203;cherniavskii](https://github.com/cherniavskii) - \[docs] Remove redundant enhanceHighContrast information ([#&#8203;48632](https://github.com/mui/material-ui/issues/48632)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[docs-infra] Decrease loaded bundle size on docs ([#&#8203;48584](https://github.com/mui/material-ui/issues/48584)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[docs-infra] Drop multi-locale plumbing from API pages ([#&#8203;48370](https://github.com/mui/material-ui/issues/48370)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[docs-infra] Fix Cookie banner heading ([#&#8203;48529](https://github.com/mui/material-ui/issues/48529)) [@&#8203;oliviertassinari](https://github.com/oliviertassinari) - \[docs-infra] Infinitely cache all static assets ([#&#8203;48627](https://github.com/mui/material-ui/issues/48627)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[docs-infra] Remove outdated noSEOadvantage entries ([#&#8203;48527](https://github.com/mui/material-ui/issues/48527)) [@&#8203;oliviertassinari](https://github.com/oliviertassinari) - \[docs-infra] Restore build-only invariant throws via `NEXT_RUNTIME` guard ([#&#8203;48475](https://github.com/mui/material-ui/issues/48475)) [@&#8203;Janpot](https://github.com/Janpot) - \[docs-infra] Test HTML validation in broken links checker ([#&#8203;48088](https://github.com/mui/material-ui/issues/48088)) [@&#8203;Janpot](https://github.com/Janpot) - \[docs]\[icons] Fix Font Awesome Chip demo in dark mode ([#&#8203;48576](https://github.com/mui/material-ui/issues/48576)) [@&#8203;siriwatknp](https://github.com/siriwatknp) - \[docs]\[icons] Remove redundant font awesome demo ([#&#8203;48493](https://github.com/mui/material-ui/issues/48493)) [@&#8203;ZeeshanTamboli](https://github.com/ZeeshanTamboli) - \[docs]\[modal] Add nested modal guidance ([#&#8203;46507](https://github.com/mui/material-ui/issues/46507)) [@&#8203;JakeSaterlay](https://github.com/JakeSaterlay) - \[docs]\[stepper] Fix focus management in examples ([#&#8203;48494](https://github.com/mui/material-ui/issues/48494)) [@&#8203;silviuaavram](https://github.com/silviuaavram) ##### Core - Eslint markdown ([#&#8203;48371](https://github.com/mui/material-ui/issues/48371)) [@&#8203;Janpot](https://github.com/Janpot) - \[agents] Fix some docs links ([#&#8203;48561](https://github.com/mui/material-ui/issues/48561)) [@&#8203;silviuaavram](https://github.com/silviuaavram) - \[blog] Copy editing improvement on v9 announcement blog posts ([#&#8203;48543](https://github.com/mui/material-ui/issues/48543)) [@&#8203;joserodolfofreitas](https://github.com/joserodolfofreitas) - \[code-infra] Cleanup unused jss packages ([#&#8203;48590](https://github.com/mui/material-ui/issues/48590)) [@&#8203;brijeshb42](https://github.com/brijeshb42) - \[code-infra] Collapse canary workflows into nightly and nightly-cron ([#&#8203;48556](https://github.com/mui/material-ui/issues/48556)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Convert [@&#8203;mui/private-theming](https://github.com/mui/private-theming) to TypeScript ([#&#8203;48565](https://github.com/mui/material-ui/issues/48565)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Convert [@&#8203;mui/styled-engine](https://github.com/mui/styled-engine) to TypeScript ([#&#8203;48544](https://github.com/mui/material-ui/issues/48544)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Convert [@&#8203;mui/styled-engine-sc](https://github.com/mui/styled-engine-sc) to TypeScript ([#&#8203;48577](https://github.com/mui/material-ui/issues/48577)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Fix duplicate resource\_class in test\_regressions CI job ([#&#8203;48601](https://github.com/mui/material-ui/issues/48601)) [@&#8203;LukasTy](https://github.com/LukasTy) - \[code-infra] Make [@&#8203;mui/internal-docs-utils](https://github.com/mui/internal-docs-utils) compatible with TypeScript 6 ([#&#8203;48594](https://github.com/mui/material-ui/issues/48594)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Migrate CircleCI jobs to Gen2 resource classes ([#&#8203;48593](https://github.com/mui/material-ui/issues/48593)) [@&#8203;LukasTy](https://github.com/LukasTy) - \[code-infra] Parallelize visual regression screenshots ([#&#8203;48557](https://github.com/mui/material-ui/issues/48557)) [@&#8203;Janpot](https://github.com/Janpot) - \[code-infra] Run nightly-cron on v7.x ([#&#8203;48579](https://github.com/mui/material-ui/issues/48579)) [@&#8203;Janpot](https://github.com/Janpot) - \[core] Fix typescript\@&#8203;next typecheck ([#&#8203;48587](https://github.com/mui/material-ui/issues/48587)) [@&#8203;Janpot](https://github.com/Janpot) - \[pnpm] Add security settings to pnpm-workspace.yaml ([#&#8203;48582](https://github.com/mui/material-ui/issues/48582)) [@&#8203;Janpot](https://github.com/Janpot) - \[styled-engine-sc] Fix compatibility with Vite and Vitest ([#&#8203;48558](https://github.com/mui/material-ui/issues/48558)) [@&#8203;mj12albert](https://github.com/mj12albert) - \[test] Add axe-core tests for mui-material ([#&#8203;48341](https://github.com/mui/material-ui/issues/48341)) [@&#8203;siriwatknp](https://github.com/siriwatknp) - \[test] Configure Tailwind CSS in the visual-regression app ([#&#8203;48575](https://github.com/mui/material-ui/issues/48575)) [@&#8203;Janpot](https://github.com/Janpot) All contributors of this release in alphabetical order: [@&#8203;brijeshb42](https://github.com/brijeshb42), [@&#8203;cherniavskii](https://github.com/cherniavskii), [@&#8203;JakeSaterlay](https://github.com/JakeSaterlay), [@&#8203;Janpot](https://github.com/Janpot), [@&#8203;joserodolfofreitas](https://github.com/joserodolfofreitas), [@&#8203;LukasTy](https://github.com/LukasTy), [@&#8203;mj12albert](https://github.com/mj12albert), [@&#8203;nightt5879](https://github.com/nightt5879), [@&#8203;noam3127](https://github.com/noam3127), [@&#8203;oliviertassinari](https://github.com/oliviertassinari), [@&#8203;pavan-sh](https://github.com/pavan-sh), [@&#8203;silviuaavram](https://github.com/silviuaavram), [@&#8203;siriwatknp](https://github.com/siriwatknp), [@&#8203;tyalau](https://github.com/tyalau), [@&#8203;ZeeshanTamboli](https://github.com/ZeeshanTamboli) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/437 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-14 00:26:19 +00:00
Nicolas	98c4aa4bd0	fix: correct typo in FAQ regarding Configuration Summary (#436) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/436 Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-committed-by: Nicolas <bircni@icloud.com>	2026-06-13 17:07:13 +00:00
wxiaoguang	88f92b0698	Add CONTENT_SECURITY_POLICY_GENERAL (#434) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/434 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com> Co-committed-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com>	2026-06-12 01:27:20 +00:00
Renovate Bot	45165ceb22	chore(deps): update pnpm to v10.34.1 (#430) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/430 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-10 15:01:24 +00:00
Renovate Bot	fb856b8432	chore(deps): update dependency @easyops-cn/docusaurus-search-local to v0.55.2 (#431) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@easyops-cn/docusaurus-search-local](https://github.com/easyops-cn/docusaurus-search-local) ([source](https://github.com/easyops-cn/docusaurus-search-local/tree/HEAD/packages/docusaurus-search-local)) | [`0.55.1` → `0.55.2`](https://renovatebot.com/diffs/npm/@easyops-cn%2fdocusaurus-search-local/0.55.1/0.55.2) |  |  | --- ### Release Notes <details> <summary>easyops-cn/docusaurus-search-local (@&#8203;easyops-cn/docusaurus-search-local)</summary> ### [`v0.55.2`](https://github.com/easyops-cn/docusaurus-search-local/releases/tag/v0.55.2) [Compare Source](https://github.com/easyops-cn/docusaurus-search-local/compare/v0.55.1...v0.55.2) ##### Bug Fixes - some languages need lunr wordcut ([1e60641](1e60641f5d)) - some languages need lunr wordcut ([d871555](d87155582f)), closes [#&#8203;438](https://github.com/easyops-cn/docusaurus-search-local/issues/438) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/431 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-10 02:17:40 +00:00
Renovate Bot	8bb0e9f105	chore(deps): update react monorepo to v19.2.7 (#432) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/432 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-06-09 14:01:39 +00:00
nico-i	eb5204f658	Added project config to issue template example (#428) ... I have updated the docs since this feature is now supported. Reviewed-on: https://gitea.com/gitea/docs/pulls/428 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: nico-i <nico@ismaili.de> Co-committed-by: nico-i <nico@ismaili.de>	2026-05-29 16:52:56 +00:00
Zettat123	95106c08e9	docs: split MAX_CREATION_LIMIT into USER_MAX_CREATION_LIMIT and ORG_MAX_CREATION_LIMIT (#427) ... Related https://github.com/go-gitea/gitea/pull/37872 Reviewed-on: https://gitea.com/gitea/docs/pulls/427 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-committed-by: Zettat123 <39446+zettat123@noreply.gitea.com>	2026-05-28 17:29:35 +00:00
wxiaoguang	478059a7ed	Update SSH_PORT comment	2026-05-27 06:01:42 +00:00
harryzcy	69e92d33ec	docs: update conan login command for conan v2 (#426) ... Conan v1 reached end-of-life. https://blog.conan.io/2024/09/30/Conan-Center-will-stop-receiving-updates-for-Conan-1.html The command for conan v2 login has changed to `conan remote login`. https://docs.conan.io/2/reference/commands/remote.html#conan-remote-login I briefly looked at Gitea codebase. Gitea supports conan v2 cli (given functions like `DeleteRecipeV2` and `SearchPackagesV2`) --------- Co-authored-by: Chongyi Zheng <git@zcy.dev> Reviewed-on: https://gitea.com/gitea/docs/pulls/426 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: harryzcy <37645+harryzcy@noreply.gitea.com> Co-committed-by: harryzcy <37645+harryzcy@noreply.gitea.com>	2026-05-26 07:53:05 +00:00
Lunny Xiao	21aad7f5d1	update 1.26.2 (#424) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/424 Reviewed-by: Nicolas <bircni@icloud.com>	2026-05-20 21:59:25 +00:00
wxiaoguang	8b31adbc6f	fix: make DEFAULT_TITLE_SOURCE default to auto	2026-05-19 08:07:42 +00:00
Renovate Bot	eea1d90216	chore(deps): update react monorepo to v19.2.6 (#423) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/423 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-05-14 16:52:34 +00:00
Renovate Bot	19c2342e2f	chore(deps): update dependency @mui/material to v9.0.1 (#422) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/422 Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-05-14 16:36:03 +00:00
Renovate Bot	d9effabc6c	chore(deps): update pnpm to v10.33.4 (#418) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.33.2` → `10.33.4`](https://renovatebot.com/diffs/npm/pnpm/10.33.2/10.33.4) |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/114) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/418 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-05-07 17:23:56 +00:00
Lunny Xiao	54af905d63	rename act runner to runner (#390) ... Depends on gitea/runner#850 --------- Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/docs/pulls/390 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Reviewed-by: Nicolas <bircni@icloud.com>	2026-05-07 17:18:58 +00:00
wxiaoguang	b6b8dbcc64	Update SQLITE_TIMEOUT (#419) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/419 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com> Co-committed-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com>	2026-05-07 12:59:34 +00:00
silverwind	5bab08db10	Note OpenSearch compatibility for elasticsearch indexer (#417) ... https://github.com/go-gitea/gitea/pull/37411 --- This PR was written with the help of Claude Opus 4.7 Reviewed-on: https://gitea.com/gitea/docs/pulls/417 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-committed-by: silverwind <me@silverwind.io>	2026-05-04 11:38:21 +00:00
Renovate Bot	173bc20908	chore(deps): update docusaurus monorepo to v3.10.1 (#392) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@docusaurus/core](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fcore/3.10.0/3.10.1) |  |  | | [@docusaurus/faster](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-faster)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2ffaster/3.10.0/3.10.1) |  |  | | [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fmodule-type-aliases/3.10.0/3.10.1) |  |  | | [@docusaurus/plugin-content-docs](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fplugin-content-docs/3.10.0/3.10.1) |  |  | | [@docusaurus/preset-classic](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fpreset-classic/3.10.0/3.10.1) |  |  | --- ### Release Notes <details> <summary>facebook/docusaurus (@&#8203;docusaurus/core)</summary> ### [`v3.10.1`](https://github.com/facebook/docusaurus/blob/HEAD/CHANGELOG.md#3101-2026-04-30) [Compare Source](https://github.com/facebook/docusaurus/compare/v3.10.0...v3.10.1) ##### 🐛 Bug Fix - `docusaurus-bundler` - [#&#8203;11981](https://github.com/facebook/docusaurus/pull/11981) fix(bundler): fix v3 webpackbar bug due to webpack breaking change ([@&#8203;slorber](https://github.com/slorber)) ##### 🔧 Maintenance - `docusaurus` - [#&#8203;11982](https://github.com/facebook/docusaurus/pull/11982) chore: cherry-pick commits for v3.10.1 patch release ([@&#8203;slorber](https://github.com/slorber)) ##### Committers: 1 - Sébastien Lorber ([@&#8203;slorber](https://github.com/slorber)) </details> --- Reviewed-on: https://gitea.com/gitea/docs/pulls/392 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-05-02 02:05:18 +00:00
Lunny Xiao	14b76120b4	update webhook documentation (#393) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/393	2026-05-01 16:40:27 +00:00
wxiaoguang	f550d33ad7	Update SSH_ROOT_PATH / attachment comment (#373) ... Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/373 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com> Co-committed-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com>	2026-04-28 21:56:14 +00:00
0xGREG	e0fcc861f2	Document DEFAULT_TITLE_SOURCE pull request title setting (#391) ... Adds documentation for the `DEFAULT_TITLE_SOURCE` setting. - Added `DEFAULT_TITLE_SOURCE` to the config cheat sheet under `[repository.pull-request]` - Added a "Default pull request title" section to the pull request usage docs explaining both modes (`first-commit` and `auto`) --------- Co-authored-by: Nicolas <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/391 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: 0xGREG <gitea@freespeech.work> Co-committed-by: 0xGREG <gitea@freespeech.work>	2026-04-28 21:45:22 +00:00
Renovate Bot	a0802c6748	chore(deps): update pnpm to v10.33.2 (#388) ... Reviewed-on: https://gitea.com/gitea/docs/pulls/388 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>	2026-04-28 16:31:48 +00:00
Lunny Xiao	49a6f7649a	update 1.26.1	2026-04-25 11:28:59 -07:00
Zettat123	3ef08b184a	Add MAX_RERUN_ATTEMPTS to config cheat sheet (#383) ... Related https://github.com/go-gitea/gitea/pull/37119 Reviewed-on: https://gitea.com/gitea/docs/pulls/383 Reviewed-by: Nicolas <bircni@icloud.com> Co-authored-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-committed-by: Zettat123 <39446+zettat123@noreply.gitea.com>	2026-04-25 18:25:14 +00:00