Add changelog for 1.21.8 (#29735 )

Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: 6543 <6543@obermui.de>
Fix date rendering by adding <gitea-absolute-date> (#29725 ) (#29747 )
2025-08-14 06:20:32 +02:00 · 2024-03-13 03:10:02 +00:00 · 2024-03-13 01:04:58 +01:00 · 2024-03-12 21:45:45 +00:00 · 2024-03-12 17:31:45 +01:00 · 2024-03-11 10:10:07 +01:00
3639 changed files with 121910 additions and 146658 deletions
--- a/.air.toml
+++ b/.air.toml
@@ -2,25 +2,12 @@ root = "."
 tmp_dir = ".air"

 [build]
-pre_cmd = ["killall -9 gitea 2>/dev/null || true"] # kill off potential zombie processes from previous runs
 cmd = "make --no-print-directory backend"
 bin = "gitea"
-delay = 2000
+delay = 1000
 include_ext = ["go", "tmpl"]
 include_file = ["main.go"]
 include_dir = ["cmd", "models", "modules", "options", "routers", "services"]
-exclude_dir = [
-  "models/fixtures",
-  "models/migrations/fixtures",
-  "modules/avatar/identicon/testdata",
-  "modules/avatar/testdata",
-  "modules/git/tests",
-  "modules/migration/file_format_testdata",
-  "routers/private/tests",
-  "services/gitdiff/testdata",
-]
+exclude_dir = ["modules/git/tests", "services/gitdiff/testdata", "modules/avatar/testdata", "models/fixtures", "models/migrations/fixtures", "modules/migration/file_format_testdata", "modules/avatar/identicon/testdata"]
 exclude_regex = ["_test.go$", "_gen.go$"]
 stop_on_error = true
-
-[log]
-main_only = true
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,17 +1,14 @@
 {
  "name": "Gitea DevContainer",
-  "image": "mcr.microsoft.com/devcontainers/go:1.23-bookworm",
+  "image": "mcr.microsoft.com/devcontainers/go:1.21-bullseye",
  "features": {
    // installs nodejs into container
    "ghcr.io/devcontainers/features/node:1": {
-      "version": "20"
+      "version":"20"
    },
-    "ghcr.io/devcontainers/features/git-lfs:1.2.2": {},
+    "ghcr.io/devcontainers/features/git-lfs:1.1.0": {},
    "ghcr.io/devcontainers-contrib/features/poetry:2": {},
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.12"
-    },
-    "ghcr.io/warrenbuckley/codespace-features/sqlite:1": {}
+    "ghcr.io/devcontainers/features/python:1": {}
  },
  "customizations": {
    "vscode": {
@@ -25,10 +22,9 @@
        "DavidAnson.vscode-markdownlint",
        "Vue.volar",
        "ms-azuretools.vscode-docker",
-        "vitest.explorer",
-        "cweijan.vscode-database-client2",
-        "GitHub.vscode-pull-request-github",
-        "Azurite.azurite"
+        "zixuanchen.vitest-explorer",
+        "qwtel.sqlite-viewer",
+        "GitHub.vscode-pull-request-github"
      ]
    }
  },
--- a/.dockerignore
+++ b/.dockerignore
@@ -14,7 +14,7 @@ _test

 # MS VSCode
 .vscode
-__debug_bin*
+__debug_bin

 # Architecture specific extensions/prefixes
 *.[568vq]
@@ -62,6 +62,7 @@ cpu.out
 /data
 /indexers
 /log
+/public/img/avatar
 /tests/integration/gitea-integration-*
 /tests/integration/indexers-*
 /tests/e2e/gitea-e2e-*
@@ -77,7 +78,7 @@ cpu.out
 /public/assets/js
 /public/assets/css
 /public/assets/fonts
-/public/assets/img/avatar
+/public/assets/img/webpack
 /vendor
 /web_src/fomantic/node_modules
 /web_src/fomantic/build/*
@@ -95,9 +96,6 @@ cpu.out
 /.air
 /.go-licenses

-# Files and folders that were previously generated
-/public/assets/img/webpack
-
 # Snapcraft
 snap/.snapcraft/
 parts/
--- a/.envrc
+++ b/.envrc
@@ -1 +0,0 @@
-use flake
--- a/.eslintrc.yaml
+++ b/.eslintrc.yaml
@@ -3,38 +3,21 @@ reportUnusedDisableDirectives: true

 ignorePatterns:
  - /web_src/js/vendor
-  - /web_src/fomantic
-  - /public/assets/js
-
-parser: "@typescript-eslint/parser"

 parserOptions:
  sourceType: module
  ecmaVersion: latest
-  project: true
-  extraFileExtensions: [".vue"]
-  parser: "@typescript-eslint/parser" # for vue plugin - https://eslint.vuejs.org/user-guide/#how-to-use-a-custom-parser
-
-settings:
-  import-x/extensions: [".js", ".ts"]
-  import-x/parsers:
-    "@typescript-eslint/parser": [".js", ".ts"]
-  import-x/resolver:
-    typescript: true

 plugins:
  - "@eslint-community/eslint-plugin-eslint-comments"
-  - "@stylistic/eslint-plugin-js"
-  - "@typescript-eslint/eslint-plugin"
  - eslint-plugin-array-func
-  - eslint-plugin-github
-  - eslint-plugin-import-x
+  - eslint-plugin-import
+  - eslint-plugin-jquery
  - eslint-plugin-no-jquery
  - eslint-plugin-no-use-extend-native
  - eslint-plugin-regexp
  - eslint-plugin-sonarjs
  - eslint-plugin-unicorn
-  - eslint-plugin-vitest
  - eslint-plugin-vitest-globals
  - eslint-plugin-wc

@@ -56,89 +39,19 @@ overrides:
      worker: true
    rules:
      no-restricted-globals: [2, addEventListener, blur, close, closed, confirm, defaultStatus, defaultstatus, error, event, external, find, focus, frameElement, frames, history, innerHeight, innerWidth, isFinite, isNaN, length, locationbar, menubar, moveBy, moveTo, name, onblur, onerror, onfocus, onload, onresize, onunload, open, opener, opera, outerHeight, outerWidth, pageXOffset, pageYOffset, parent, print, removeEventListener, resizeBy, resizeTo, screen, screenLeft, screenTop, screenX, screenY, scroll, scrollbars, scrollBy, scrollTo, scrollX, scrollY, status, statusbar, stop, toolbar, top]
+  - files: ["build/generate-images.js"]
+    rules:
+      import/no-unresolved: [0]
+      import/no-extraneous-dependencies: [0]
  - files: ["*.config.*"]
    rules:
-      import-x/no-unused-modules: [0]
-  - files: ["**/*.d.ts"]
-    rules:
-      import-x/no-unused-modules: [0]
-      "@typescript-eslint/consistent-type-definitions": [0]
-      "@typescript-eslint/consistent-type-imports": [0]
-  - files: ["web_src/js/types.ts"]
-    rules:
-      import-x/no-unused-modules: [0]
-  - files: ["**/*.test.*", "web_src/js/test/setup.ts"]
+      import/no-unused-modules: [0]
+  - files: ["**/*.test.*", "web_src/js/test/setup.js"]
    env:
      vitest-globals/env: true
-    rules:
-      vitest/consistent-test-filename: [0]
-      vitest/consistent-test-it: [0]
-      vitest/expect-expect: [0]
-      vitest/max-expects: [0]
-      vitest/max-nested-describe: [0]
-      vitest/no-alias-methods: [0]
-      vitest/no-commented-out-tests: [0]
-      vitest/no-conditional-expect: [0]
-      vitest/no-conditional-in-test: [0]
-      vitest/no-conditional-tests: [0]
-      vitest/no-disabled-tests: [0]
-      vitest/no-done-callback: [0]
-      vitest/no-duplicate-hooks: [0]
-      vitest/no-focused-tests: [0]
-      vitest/no-hooks: [0]
-      vitest/no-identical-title: [2]
-      vitest/no-interpolation-in-snapshots: [0]
-      vitest/no-large-snapshots: [0]
-      vitest/no-mocks-import: [0]
-      vitest/no-restricted-matchers: [0]
-      vitest/no-restricted-vi-methods: [0]
-      vitest/no-standalone-expect: [0]
-      vitest/no-test-prefixes: [0]
-      vitest/no-test-return-statement: [0]
-      vitest/prefer-called-with: [0]
-      vitest/prefer-comparison-matcher: [0]
-      vitest/prefer-each: [0]
-      vitest/prefer-equality-matcher: [0]
-      vitest/prefer-expect-resolves: [0]
-      vitest/prefer-hooks-in-order: [0]
-      vitest/prefer-hooks-on-top: [2]
-      vitest/prefer-lowercase-title: [0]
-      vitest/prefer-mock-promise-shorthand: [0]
-      vitest/prefer-snapshot-hint: [0]
-      vitest/prefer-spy-on: [0]
-      vitest/prefer-strict-equal: [0]
-      vitest/prefer-to-be: [0]
-      vitest/prefer-to-be-falsy: [0]
-      vitest/prefer-to-be-object: [0]
-      vitest/prefer-to-be-truthy: [0]
-      vitest/prefer-to-contain: [0]
-      vitest/prefer-to-have-length: [0]
-      vitest/prefer-todo: [0]
-      vitest/require-hook: [0]
-      vitest/require-to-throw-message: [0]
-      vitest/require-top-level-describe: [0]
-      vitest/valid-describe-callback: [2]
-      vitest/valid-expect: [2]
-      vitest/valid-title: [2]
-  - files: ["web_src/js/modules/fetch.ts", "web_src/js/standalone/**/*"]
+  - files: ["web_src/js/modules/fetch.js", "web_src/js/standalone/**/*"]
    rules:
      no-restricted-syntax: [2, WithStatement, ForInStatement, LabeledStatement, SequenceExpression]
-  - files: ["**/*.vue"]
-    plugins:
-      - eslint-plugin-vue
-      - eslint-plugin-vue-scoped-css
-    extends:
-      - plugin:vue/vue3-recommended
-      - plugin:vue-scoped-css/vue3-recommended
-    rules:
-      vue/attributes-order: [0]
-      vue/html-closing-bracket-spacing: [2, {startTag: never, endTag: never, selfClosingTag: never}]
-      vue/max-attributes-per-line: [0]
-      vue/singleline-html-element-content-newline: [0]
-  - files: ["tests/e2e/**"]
-    plugins:
-      - eslint-plugin-playwright
-    extends: plugin:playwright/recommended

 rules:
  "@eslint-community/eslint-comments/disable-enable-pair": [2]
@@ -150,196 +63,11 @@ rules:
  "@eslint-community/eslint-comments/no-unused-enable": [2]
  "@eslint-community/eslint-comments/no-use": [0]
  "@eslint-community/eslint-comments/require-description": [0]
-  "@stylistic/js/array-bracket-newline": [0]
-  "@stylistic/js/array-bracket-spacing": [2, never]
-  "@stylistic/js/array-element-newline": [0]
-  "@stylistic/js/arrow-parens": [2, always]
-  "@stylistic/js/arrow-spacing": [2, {before: true, after: true}]
-  "@stylistic/js/block-spacing": [0]
-  "@stylistic/js/brace-style": [2, 1tbs, {allowSingleLine: true}]
-  "@stylistic/js/comma-dangle": [2, always-multiline]
-  "@stylistic/js/comma-spacing": [2, {before: false, after: true}]
-  "@stylistic/js/comma-style": [2, last]
-  "@stylistic/js/computed-property-spacing": [2, never]
-  "@stylistic/js/dot-location": [2, property]
-  "@stylistic/js/eol-last": [2]
-  "@stylistic/js/function-call-argument-newline": [0]
-  "@stylistic/js/function-call-spacing": [2, never]
-  "@stylistic/js/function-paren-newline": [0]
-  "@stylistic/js/generator-star-spacing": [0]
-  "@stylistic/js/implicit-arrow-linebreak": [0]
-  "@stylistic/js/indent": [2, 2, {ignoreComments: true, SwitchCase: 1}]
-  "@stylistic/js/key-spacing": [2]
-  "@stylistic/js/keyword-spacing": [2]
-  "@stylistic/js/line-comment-position": [0]
-  "@stylistic/js/linebreak-style": [2, unix]
-  "@stylistic/js/lines-around-comment": [0]
-  "@stylistic/js/lines-between-class-members": [0]
-  "@stylistic/js/max-len": [0]
-  "@stylistic/js/max-statements-per-line": [0]
-  "@stylistic/js/multiline-comment-style": [0]
-  "@stylistic/js/multiline-ternary": [0]
-  "@stylistic/js/new-parens": [2]
-  "@stylistic/js/newline-per-chained-call": [0]
-  "@stylistic/js/no-confusing-arrow": [0]
-  "@stylistic/js/no-extra-parens": [0]
-  "@stylistic/js/no-extra-semi": [2]
-  "@stylistic/js/no-floating-decimal": [0]
-  "@stylistic/js/no-mixed-operators": [0]
-  "@stylistic/js/no-mixed-spaces-and-tabs": [2]
-  "@stylistic/js/no-multi-spaces": [2, {ignoreEOLComments: true, exceptions: {Property: true}}]
-  "@stylistic/js/no-multiple-empty-lines": [2, {max: 1, maxEOF: 0, maxBOF: 0}]
-  "@stylistic/js/no-tabs": [2]
-  "@stylistic/js/no-trailing-spaces": [2]
-  "@stylistic/js/no-whitespace-before-property": [2]
-  "@stylistic/js/nonblock-statement-body-position": [2]
-  "@stylistic/js/object-curly-newline": [0]
-  "@stylistic/js/object-curly-spacing": [2, never]
-  "@stylistic/js/object-property-newline": [0]
-  "@stylistic/js/one-var-declaration-per-line": [0]
-  "@stylistic/js/operator-linebreak": [2, after]
-  "@stylistic/js/padded-blocks": [2, never]
-  "@stylistic/js/padding-line-between-statements": [0]
-  "@stylistic/js/quote-props": [0]
-  "@stylistic/js/quotes": [2, single, {avoidEscape: true, allowTemplateLiterals: true}]
-  "@stylistic/js/rest-spread-spacing": [2, never]
-  "@stylistic/js/semi": [2, always, {omitLastInOneLineBlock: true}]
-  "@stylistic/js/semi-spacing": [2, {before: false, after: true}]
-  "@stylistic/js/semi-style": [2, last]
-  "@stylistic/js/space-before-blocks": [2, always]
-  "@stylistic/js/space-before-function-paren": [2, {anonymous: ignore, named: never, asyncArrow: always}]
-  "@stylistic/js/space-in-parens": [2, never]
-  "@stylistic/js/space-infix-ops": [2]
-  "@stylistic/js/space-unary-ops": [2]
-  "@stylistic/js/spaced-comment": [2, always]
-  "@stylistic/js/switch-colon-spacing": [2]
-  "@stylistic/js/template-curly-spacing": [2, never]
-  "@stylistic/js/template-tag-spacing": [2, never]
-  "@stylistic/js/wrap-iife": [2, inside]
-  "@stylistic/js/wrap-regex": [0]
-  "@stylistic/js/yield-star-spacing": [2, after]
-  "@typescript-eslint/adjacent-overload-signatures": [0]
-  "@typescript-eslint/array-type": [0]
-  "@typescript-eslint/await-thenable": [2]
-  "@typescript-eslint/ban-ts-comment": [2, {'ts-expect-error': false, 'ts-ignore': true, 'ts-nocheck': false, 'ts-check': false}]
-  "@typescript-eslint/ban-tslint-comment": [0]
-  "@typescript-eslint/class-literal-property-style": [0]
-  "@typescript-eslint/class-methods-use-this": [0]
-  "@typescript-eslint/consistent-generic-constructors": [0]
-  "@typescript-eslint/consistent-indexed-object-style": [0]
-  "@typescript-eslint/consistent-return": [0]
-  "@typescript-eslint/consistent-type-assertions": [2, {assertionStyle: as, objectLiteralTypeAssertions: allow}]
-  "@typescript-eslint/consistent-type-definitions": [2, type]
-  "@typescript-eslint/consistent-type-exports": [2, {fixMixedExportsWithInlineTypeSpecifier: false}]
-  "@typescript-eslint/consistent-type-imports": [2, {prefer: type-imports, fixStyle: separate-type-imports, disallowTypeAnnotations: true}]
-  "@typescript-eslint/default-param-last": [0]
-  "@typescript-eslint/dot-notation": [0]
-  "@typescript-eslint/explicit-function-return-type": [0]
-  "@typescript-eslint/explicit-member-accessibility": [0]
-  "@typescript-eslint/explicit-module-boundary-types": [0]
-  "@typescript-eslint/init-declarations": [0]
-  "@typescript-eslint/max-params": [0]
-  "@typescript-eslint/member-ordering": [0]
-  "@typescript-eslint/method-signature-style": [0]
-  "@typescript-eslint/naming-convention": [0]
-  "@typescript-eslint/no-array-constructor": [2]
-  "@typescript-eslint/no-array-delete": [2]
-  "@typescript-eslint/no-base-to-string": [0]
-  "@typescript-eslint/no-confusing-non-null-assertion": [2]
-  "@typescript-eslint/no-confusing-void-expression": [0]
-  "@typescript-eslint/no-deprecated": [2]
-  "@typescript-eslint/no-dupe-class-members": [0]
-  "@typescript-eslint/no-duplicate-enum-values": [2]
-  "@typescript-eslint/no-duplicate-type-constituents": [2, {ignoreUnions: true}]
-  "@typescript-eslint/no-dynamic-delete": [0]
-  "@typescript-eslint/no-empty-function": [0]
-  "@typescript-eslint/no-empty-interface": [0]
-  "@typescript-eslint/no-empty-object-type": [2]
-  "@typescript-eslint/no-explicit-any": [0]
-  "@typescript-eslint/no-extra-non-null-assertion": [2]
-  "@typescript-eslint/no-extraneous-class": [0]
-  "@typescript-eslint/no-floating-promises": [0]
-  "@typescript-eslint/no-for-in-array": [2]
-  "@typescript-eslint/no-implied-eval": [2]
-  "@typescript-eslint/no-import-type-side-effects": [0] # dupe with consistent-type-imports
-  "@typescript-eslint/no-inferrable-types": [0]
-  "@typescript-eslint/no-invalid-this": [0]
-  "@typescript-eslint/no-invalid-void-type": [0]
-  "@typescript-eslint/no-loop-func": [0]
-  "@typescript-eslint/no-loss-of-precision": [0]
-  "@typescript-eslint/no-magic-numbers": [0]
-  "@typescript-eslint/no-meaningless-void-operator": [0]
-  "@typescript-eslint/no-misused-new": [2]
-  "@typescript-eslint/no-misused-promises": [2, {checksVoidReturn: {attributes: false, arguments: false}}]
-  "@typescript-eslint/no-mixed-enums": [0]
-  "@typescript-eslint/no-namespace": [2]
-  "@typescript-eslint/no-non-null-asserted-nullish-coalescing": [0]
-  "@typescript-eslint/no-non-null-asserted-optional-chain": [2]
-  "@typescript-eslint/no-non-null-assertion": [0]
-  "@typescript-eslint/no-redeclare": [0]
-  "@typescript-eslint/no-redundant-type-constituents": [2]
-  "@typescript-eslint/no-require-imports": [2]
-  "@typescript-eslint/no-restricted-imports": [0]
-  "@typescript-eslint/no-restricted-types": [0]
-  "@typescript-eslint/no-shadow": [0]
-  "@typescript-eslint/no-this-alias": [0] # handled by unicorn/no-this-assignment
-  "@typescript-eslint/no-unnecessary-boolean-literal-compare": [0]
-  "@typescript-eslint/no-unnecessary-condition": [0]
-  "@typescript-eslint/no-unnecessary-qualifier": [0]
-  "@typescript-eslint/no-unnecessary-template-expression": [0]
-  "@typescript-eslint/no-unnecessary-type-arguments": [0]
-  "@typescript-eslint/no-unnecessary-type-assertion": [2]
-  "@typescript-eslint/no-unnecessary-type-constraint": [2]
-  "@typescript-eslint/no-unsafe-argument": [0]
-  "@typescript-eslint/no-unsafe-assignment": [0]
-  "@typescript-eslint/no-unsafe-call": [0]
-  "@typescript-eslint/no-unsafe-declaration-merging": [2]
-  "@typescript-eslint/no-unsafe-enum-comparison": [2]
-  "@typescript-eslint/no-unsafe-function-type": [2]
-  "@typescript-eslint/no-unsafe-member-access": [0]
-  "@typescript-eslint/no-unsafe-return": [0]
-  "@typescript-eslint/no-unsafe-unary-minus": [2]
-  "@typescript-eslint/no-unused-expressions": [0]
-  "@typescript-eslint/no-unused-vars": [2, {vars: all, args: all, caughtErrors: all, ignoreRestSiblings: false, argsIgnorePattern: ^_, varsIgnorePattern: ^_, caughtErrorsIgnorePattern: ^_, destructuredArrayIgnorePattern: ^_}]
-  "@typescript-eslint/no-use-before-define": [0]
-  "@typescript-eslint/no-useless-constructor": [0]
-  "@typescript-eslint/no-useless-empty-export": [0]
-  "@typescript-eslint/no-wrapper-object-types": [2]
-  "@typescript-eslint/non-nullable-type-assertion-style": [0]
-  "@typescript-eslint/only-throw-error": [2]
-  "@typescript-eslint/parameter-properties": [0]
-  "@typescript-eslint/prefer-as-const": [2]
-  "@typescript-eslint/prefer-destructuring": [0]
-  "@typescript-eslint/prefer-enum-initializers": [0]
-  "@typescript-eslint/prefer-find": [2]
-  "@typescript-eslint/prefer-for-of": [2]
-  "@typescript-eslint/prefer-function-type": [2]
-  "@typescript-eslint/prefer-includes": [2]
-  "@typescript-eslint/prefer-literal-enum-member": [0]
-  "@typescript-eslint/prefer-namespace-keyword": [0]
-  "@typescript-eslint/prefer-nullish-coalescing": [0]
-  "@typescript-eslint/prefer-optional-chain": [2, {requireNullish: true}]
-  "@typescript-eslint/prefer-promise-reject-errors": [0]
-  "@typescript-eslint/prefer-readonly": [0]
-  "@typescript-eslint/prefer-readonly-parameter-types": [0]
-  "@typescript-eslint/prefer-reduce-type-parameter": [0]
-  "@typescript-eslint/prefer-regexp-exec": [0]
-  "@typescript-eslint/prefer-return-this-type": [0]
-  "@typescript-eslint/prefer-string-starts-ends-with": [2, {allowSingleElementEquality: always}]
-  "@typescript-eslint/promise-function-async": [0]
-  "@typescript-eslint/require-array-sort-compare": [0]
-  "@typescript-eslint/require-await": [0]
-  "@typescript-eslint/restrict-plus-operands": [2]
-  "@typescript-eslint/restrict-template-expressions": [0]
-  "@typescript-eslint/return-await": [0]
-  "@typescript-eslint/strict-boolean-expressions": [0]
-  "@typescript-eslint/switch-exhaustiveness-check": [0]
-  "@typescript-eslint/triple-slash-reference": [2]
-  "@typescript-eslint/typedef": [0]
-  "@typescript-eslint/unbound-method": [0] # too many false-positives
-  "@typescript-eslint/unified-signatures": [2]
  accessor-pairs: [2]
+  array-bracket-newline: [0]
+  array-bracket-spacing: [2, never]
  array-callback-return: [2, {checkForEach: true}]
+  array-element-newline: [0]
  array-func/avoid-reverse: [2]
  array-func/from-map: [2]
  array-func/no-unnecessary-this-arg: [2]
@@ -347,11 +75,18 @@ rules:
  array-func/prefer-flat-map: [0] # handled by unicorn/prefer-array-flat-map
  array-func/prefer-flat: [0] # handled by unicorn/prefer-array-flat
  arrow-body-style: [0]
+  arrow-parens: [2, always]
+  arrow-spacing: [2, {before: true, after: true}]
  block-scoped-var: [2]
+  brace-style: [2, 1tbs, {allowSingleLine: true}]
  camelcase: [0]
  capitalized-comments: [0]
  class-methods-use-this: [0]
+  comma-dangle: [2, only-multiline]
+  comma-spacing: [2, {before: false, after: true}]
+  comma-style: [2, last]
  complexity: [0]
+  computed-property-spacing: [2, never]
  consistent-return: [0]
  consistent-this: [0]
  constructor-super: [2]
@@ -359,98 +94,142 @@ rules:
  default-case-last: [2]
  default-case: [0]
  default-param-last: [0]
+  dot-location: [2, property]
  dot-notation: [0]
+  eol-last: [2]
  eqeqeq: [2]
  for-direction: [2]
+  func-call-spacing: [2, never]
  func-name-matching: [2]
  func-names: [0]
  func-style: [0]
+  function-call-argument-newline: [0]
+  function-paren-newline: [0]
+  generator-star-spacing: [0]
  getter-return: [2]
-  github/a11y-aria-label-is-well-formatted: [0]
-  github/a11y-no-title-attribute: [0]
-  github/a11y-no-visually-hidden-interactive-element: [0]
-  github/a11y-role-supports-aria-props: [0]
-  github/a11y-svg-has-accessible-name: [0]
-  github/array-foreach: [0]
-  github/async-currenttarget: [2]
-  github/async-preventdefault: [2]
-  github/authenticity-token: [0]
-  github/get-attribute: [0]
-  github/js-class-name: [0]
-  github/no-blur: [0]
-  github/no-d-none: [0]
-  github/no-dataset: [2]
-  github/no-dynamic-script-tag: [2]
-  github/no-implicit-buggy-globals: [2]
-  github/no-inner-html: [0]
-  github/no-innerText: [2]
-  github/no-then: [2]
-  github/no-useless-passive: [2]
-  github/prefer-observers: [2]
-  github/require-passive-events: [2]
-  github/unescaped-html-literal: [0]
  grouped-accessor-pairs: [2]
  guard-for-in: [0]
  id-blacklist: [0]
  id-length: [0]
  id-match: [0]
-  import-x/consistent-type-specifier-style: [0]
-  import-x/default: [0]
-  import-x/dynamic-import-chunkname: [0]
-  import-x/export: [2]
-  import-x/exports-last: [0]
-  import-x/extensions: [2, always, {ignorePackages: true}]
-  import-x/first: [2]
-  import-x/group-exports: [0]
-  import-x/max-dependencies: [0]
-  import-x/named: [2]
-  import-x/namespace: [0]
-  import-x/newline-after-import: [0]
-  import-x/no-absolute-path: [0]
-  import-x/no-amd: [2]
-  import-x/no-anonymous-default-export: [0]
-  import-x/no-commonjs: [2]
-  import-x/no-cycle: [2, {ignoreExternal: true, maxDepth: 1}]
-  import-x/no-default-export: [0]
-  import-x/no-deprecated: [0]
-  import-x/no-dynamic-require: [0]
-  import-x/no-empty-named-blocks: [2]
-  import-x/no-extraneous-dependencies: [2]
-  import-x/no-import-module-exports: [0]
-  import-x/no-internal-modules: [0]
-  import-x/no-mutable-exports: [0]
-  import-x/no-named-as-default-member: [0]
-  import-x/no-named-as-default: [0]
-  import-x/no-named-default: [0]
-  import-x/no-named-export: [0]
-  import-x/no-namespace: [0]
-  import-x/no-nodejs-modules: [0]
-  import-x/no-relative-packages: [0]
-  import-x/no-relative-parent-imports: [0]
-  import-x/no-restricted-paths: [0]
-  import-x/no-self-import: [2]
-  import-x/no-unassigned-import: [0]
-  import-x/no-unresolved: [2, {commonjs: true, ignore: ["\\?.+$"]}]
-  import-x/no-unused-modules: [2, {unusedExports: true}]
-  import-x/no-useless-path-segments: [2, {commonjs: true}]
-  import-x/no-webpack-loader-syntax: [2]
-  import-x/order: [0]
-  import-x/prefer-default-export: [0]
-  import-x/unambiguous: [0]
+  implicit-arrow-linebreak: [0]
+  import/consistent-type-specifier-style: [0]
+  import/default: [0]
+  import/dynamic-import-chunkname: [0]
+  import/export: [2]
+  import/exports-last: [0]
+  import/extensions: [2, always, {ignorePackages: true}]
+  import/first: [2]
+  import/group-exports: [0]
+  import/max-dependencies: [0]
+  import/named: [2]
+  import/namespace: [0]
+  import/newline-after-import: [0]
+  import/no-absolute-path: [0]
+  import/no-amd: [2]
+  import/no-anonymous-default-export: [0]
+  import/no-commonjs: [2]
+  import/no-cycle: [2, {ignoreExternal: true, maxDepth: 1}]
+  import/no-default-export: [0]
+  import/no-deprecated: [0]
+  import/no-dynamic-require: [0]
+  import/no-empty-named-blocks: [2]
+  import/no-extraneous-dependencies: [2]
+  import/no-import-module-exports: [0]
+  import/no-internal-modules: [0]
+  import/no-mutable-exports: [0]
+  import/no-named-as-default-member: [0]
+  import/no-named-as-default: [2]
+  import/no-named-default: [0]
+  import/no-named-export: [0]
+  import/no-namespace: [0]
+  import/no-nodejs-modules: [0]
+  import/no-relative-packages: [0]
+  import/no-relative-parent-imports: [0]
+  import/no-restricted-paths: [0]
+  import/no-self-import: [2]
+  import/no-unassigned-import: [0]
+  import/no-unresolved: [2, {commonjs: true, ignore: ["\\?.+$", ^vitest/]}]
+  import/no-unused-modules: [2, {unusedExports: true}]
+  import/no-useless-path-segments: [2, {commonjs: true}]
+  import/no-webpack-loader-syntax: [2]
+  import/order: [0]
+  import/prefer-default-export: [0]
+  import/unambiguous: [0]
+  indent: [2, 2, {SwitchCase: 1}]
  init-declarations: [0]
+  jquery/no-ajax-events: [2]
+  jquery/no-ajax: [0]
+  jquery/no-animate: [2]
+  jquery/no-attr: [0]
+  jquery/no-bind: [2]
+  jquery/no-class: [0]
+  jquery/no-clone: [2]
+  jquery/no-closest: [0]
+  jquery/no-css: [0]
+  jquery/no-data: [0]
+  jquery/no-deferred: [2]
+  jquery/no-delegate: [2]
+  jquery/no-each: [0]
+  jquery/no-extend: [2]
+  jquery/no-fade: [0]
+  jquery/no-filter: [0]
+  jquery/no-find: [0]
+  jquery/no-global-eval: [2]
+  jquery/no-grep: [2]
+  jquery/no-has: [2]
+  jquery/no-hide: [2]
+  jquery/no-html: [0]
+  jquery/no-in-array: [2]
+  jquery/no-is-array: [2]
+  jquery/no-is-function: [2]
+  jquery/no-is: [0]
+  jquery/no-load: [2]
+  jquery/no-map: [0]
+  jquery/no-merge: [2]
+  jquery/no-param: [2]
+  jquery/no-parent: [0]
+  jquery/no-parents: [0]
+  jquery/no-parse-html: [2]
+  jquery/no-prop: [0]
+  jquery/no-proxy: [2]
+  jquery/no-ready: [2]
+  jquery/no-serialize: [2]
+  jquery/no-show: [2]
+  jquery/no-size: [2]
+  jquery/no-sizzle: [0]
+  jquery/no-slide: [0]
+  jquery/no-submit: [0]
+  jquery/no-text: [0]
+  jquery/no-toggle: [2]
+  jquery/no-trigger: [0]
+  jquery/no-trim: [2]
+  jquery/no-val: [0]
+  jquery/no-when: [2]
+  jquery/no-wrap: [2]
+  key-spacing: [2]
+  keyword-spacing: [2]
  line-comment-position: [0]
+  linebreak-style: [2, unix]
+  lines-around-comment: [0]
+  lines-between-class-members: [0]
  logical-assignment-operators: [0]
  max-classes-per-file: [0]
  max-depth: [0]
+  max-len: [0]
  max-lines-per-function: [0]
  max-lines: [0]
  max-nested-callbacks: [0]
  max-params: [0]
+  max-statements-per-line: [0]
  max-statements: [0]
  multiline-comment-style: [2, separate-lines]
+  multiline-ternary: [0]
  new-cap: [0]
+  new-parens: [2]
+  newline-per-chained-call: [0]
  no-alert: [0]
-  no-array-constructor: [0] # handled by @typescript-eslint/no-array-constructor
+  no-array-constructor: [2]
  no-async-promise-executor: [0]
  no-await-in-loop: [0]
  no-bitwise: [0]
@@ -460,6 +239,7 @@ rules:
  no-class-assign: [2]
  no-compare-neg-zero: [2]
  no-cond-assign: [2, except-parens]
+  no-confusing-arrow: [0]
  no-console: [1, {allow: [debug, info, warn, error]}]
  no-const-assign: [2]
  no-constant-binary-expression: [2]
@@ -475,7 +255,7 @@ rules:
  no-dupe-else-if: [2]
  no-dupe-keys: [2]
  no-duplicate-case: [2]
-  no-duplicate-imports: [0]
+  no-duplicate-imports: [2]
  no-else-return: [2]
  no-empty-character-class: [2]
  no-empty-function: [0]
@@ -489,12 +269,15 @@ rules:
  no-extra-bind: [2]
  no-extra-boolean-cast: [2]
  no-extra-label: [0]
+  no-extra-parens: [0]
+  no-extra-semi: [2]
  no-fallthrough: [2]
+  no-floating-decimal: [0]
  no-func-assign: [2]
  no-global-assign: [2]
  no-implicit-coercion: [2]
  no-implicit-globals: [0]
-  no-implied-eval: [0] # handled by @typescript-eslint/no-implied-eval
+  no-implied-eval: [2]
  no-import-assign: [2]
  no-inline-comments: [0]
  no-inner-declarations: [2]
@@ -503,28 +286,27 @@ rules:
  no-irregular-whitespace: [2]
  no-iterator: [2]
  no-jquery/no-ajax-events: [2]
-  no-jquery/no-ajax: [2]
+  no-jquery/no-ajax: [0]
  no-jquery/no-and-self: [2]
  no-jquery/no-animate-toggle: [2]
  no-jquery/no-animate: [2]
-  no-jquery/no-append-html: [2]
-  no-jquery/no-attr: [2]
+  no-jquery/no-append-html: [0]
+  no-jquery/no-attr: [0]
  no-jquery/no-bind: [2]
  no-jquery/no-box-model: [2]
  no-jquery/no-browser: [2]
  no-jquery/no-camel-case: [2]
-  no-jquery/no-class-state: [2]
+  no-jquery/no-class-state: [0]
  no-jquery/no-class: [0]
  no-jquery/no-clone: [2]
  no-jquery/no-closest: [0]
  no-jquery/no-constructor-attributes: [2]
  no-jquery/no-contains: [2]
  no-jquery/no-context-prop: [2]
-  no-jquery/no-css: [2]
+  no-jquery/no-css: [0]
  no-jquery/no-data: [0]
  no-jquery/no-deferred: [2]
  no-jquery/no-delegate: [2]
-  no-jquery/no-done-fail: [2]
  no-jquery/no-each-collection: [0]
  no-jquery/no-each-util: [0]
  no-jquery/no-each: [0]
@@ -539,7 +321,6 @@ rules:
  no-jquery/no-find-util: [2]
  no-jquery/no-find: [0]
  no-jquery/no-fx-interval: [2]
-  no-jquery/no-fx: [2]
  no-jquery/no-global-eval: [2]
  no-jquery/no-global-selector: [0]
  no-jquery/no-grep: [2]
@@ -553,14 +334,14 @@ rules:
  no-jquery/no-is-numeric: [2]
  no-jquery/no-is-plain-object: [2]
  no-jquery/no-is-window: [2]
-  no-jquery/no-is: [2]
+  no-jquery/no-is: [0]
  no-jquery/no-jquery-constructor: [0]
  no-jquery/no-live: [2]
  no-jquery/no-load-shorthand: [2]
  no-jquery/no-load: [2]
  no-jquery/no-map-collection: [0]
  no-jquery/no-map-util: [2]
-  no-jquery/no-map: [2]
+  no-jquery/no-map: [0]
  no-jquery/no-merge: [2]
  no-jquery/no-node-name: [2]
  no-jquery/no-noop: [2]
@@ -570,23 +351,23 @@ rules:
  no-jquery/no-other-utils: [2]
  no-jquery/no-param: [2]
  no-jquery/no-parent: [0]
-  no-jquery/no-parents: [2]
-  no-jquery/no-parse-html-literal: [2]
+  no-jquery/no-parents: [0]
+  no-jquery/no-parse-html-literal: [0]
  no-jquery/no-parse-html: [2]
  no-jquery/no-parse-json: [2]
  no-jquery/no-parse-xml: [2]
-  no-jquery/no-prop: [2]
+  no-jquery/no-prop: [0]
  no-jquery/no-proxy: [2]
  no-jquery/no-ready-shorthand: [2]
  no-jquery/no-ready: [2]
  no-jquery/no-selector-prop: [2]
  no-jquery/no-serialize: [2]
  no-jquery/no-size: [2]
-  no-jquery/no-sizzle: [2]
+  no-jquery/no-sizzle: [0]
  no-jquery/no-slide: [2]
  no-jquery/no-sub: [2]
  no-jquery/no-support: [2]
-  no-jquery/no-text: [2]
+  no-jquery/no-text: [0]
  no-jquery/no-trigger: [0]
  no-jquery/no-trim: [2]
  no-jquery/no-type: [2]
@@ -596,7 +377,7 @@ rules:
  no-jquery/no-visibility: [2]
  no-jquery/no-when: [2]
  no-jquery/no-wrap: [2]
-  no-jquery/variable-pattern: [2]
+  no-jquery/variable-pattern: [0]
  no-label-var: [2]
  no-labels: [0] # handled by no-restricted-syntax
  no-lone-blocks: [2]
@@ -605,7 +386,10 @@ rules:
  no-loss-of-precision: [2]
  no-magic-numbers: [0]
  no-misleading-character-class: [2]
+  no-mixed-operators: [0]
+  no-mixed-spaces-and-tabs: [2]
  no-multi-assign: [0]
+  no-multi-spaces: [2, {ignoreEOLComments: true, exceptions: {Property: true}}]
  no-multi-str: [2]
  no-negated-condition: [0]
  no-nested-ternary: [0]
@@ -624,12 +408,12 @@ rules:
  no-promise-executor-return: [0]
  no-proto: [2]
  no-prototype-builtins: [2]
-  no-redeclare: [0] # must be disabled for typescript overloads
+  no-redeclare: [2]
  no-regex-spaces: [2]
  no-restricted-exports: [0]
  no-restricted-globals: [2, addEventListener, blur, close, closed, confirm, defaultStatus, defaultstatus, error, event, external, find, focus, frameElement, frames, history, innerHeight, innerWidth, isFinite, isNaN, length, location, locationbar, menubar, moveBy, moveTo, name, onblur, onerror, onfocus, onload, onresize, onunload, open, opener, opera, outerHeight, outerWidth, pageXOffset, pageYOffset, parent, print, removeEventListener, resizeBy, resizeTo, screen, screenLeft, screenTop, screenX, screenY, scroll, scrollbars, scrollBy, scrollTo, scrollX, scrollY, self, status, statusbar, stop, toolbar, top, __dirname, __filename]
  no-restricted-imports: [0]
-  no-restricted-syntax: [2, WithStatement, ForInStatement, LabeledStatement, SequenceExpression, {selector: "CallExpression[callee.name='fetch']", message: "use modules/fetch.ts instead"}]
+  no-restricted-syntax: [2, WithStatement, ForInStatement, LabeledStatement, SequenceExpression, {selector: "CallExpression[callee.name='fetch']", message: "use modules/fetch.js instead"}]
  no-return-assign: [0]
  no-script-url: [2]
  no-self-assign: [2, {props: true}]
@@ -639,17 +423,19 @@ rules:
  no-shadow-restricted-names: [2]
  no-shadow: [0]
  no-sparse-arrays: [2]
+  no-tabs: [2]
  no-template-curly-in-string: [2]
  no-ternary: [0]
  no-this-before-super: [2]
  no-throw-literal: [2]
+  no-trailing-spaces: [2]
  no-undef-init: [2]
-  no-undef: [2, {typeof: true}] # TODO: disable this rule after tsc passes
+  no-undef: [2, {typeof: true}]
  no-undefined: [0]
  no-underscore-dangle: [0]
  no-unexpected-multiline: [2]
  no-unmodified-loop-condition: [2]
-  no-unneeded-ternary: [2]
+  no-unneeded-ternary: [0]
  no-unreachable-loop: [2]
  no-unreachable: [2]
  no-unsafe-finally: [2]
@@ -657,7 +443,7 @@ rules:
  no-unused-expressions: [2]
  no-unused-labels: [2]
  no-unused-private-class-members: [2]
-  no-unused-vars: [0] # handled by @typescript-eslint/no-unused-vars
+  no-unused-vars: [2, {args: all, argsIgnorePattern: ^_, varsIgnorePattern: ^_, caughtErrorsIgnorePattern: ^_, destructuredArrayIgnorePattern: ^_, ignoreRestSiblings: false}]
  no-use-before-define: [2, {functions: false, classes: true, variables: true, allowNamedExports: true}]
  no-use-extend-native/no-use-extend-native: [2]
  no-useless-backreference: [2]
@@ -672,12 +458,18 @@ rules:
  no-var: [2]
  no-void: [2]
  no-warning-comments: [0]
+  no-whitespace-before-property: [2]
  no-with: [0] # handled by no-restricted-syntax
+  nonblock-statement-body-position: [2]
+  object-curly-newline: [0]
+  object-curly-spacing: [2, never]
  object-shorthand: [2, always]
  one-var-declaration-per-line: [0]
  one-var: [0]
  operator-assignment: [2, always]
  operator-linebreak: [2, after]
+  padded-blocks: [2, never]
+  padding-line-between-statements: [0]
  prefer-arrow-callback: [2, {allowNamedFunctions: true, allowUnboundThis: true}]
  prefer-const: [2, {destructuring: all, ignoreReadBeforeAssign: true}]
  prefer-destructuring: [0]
@@ -691,6 +483,8 @@ rules:
  prefer-rest-params: [2]
  prefer-spread: [2]
  prefer-template: [2]
+  quote-props: [0]
+  quotes: [2, single, {avoidEscape: true, allowTemplateLiterals: true}]
  radix: [2, as-needed]
  regexp/confusing-quantifier: [2]
  regexp/control-character-escape: [2]
@@ -707,7 +501,6 @@ rules:
  regexp/no-empty-character-class: [0]
  regexp/no-empty-group: [2]
  regexp/no-empty-lookarounds-assertion: [2]
-  regexp/no-empty-string-literal: [2]
  regexp/no-escape-backspace: [2]
  regexp/no-extra-lookaround-assertions: [0]
  regexp/no-invalid-regexp: [2]
@@ -738,8 +531,6 @@ rules:
  regexp/no-useless-non-capturing-group: [2]
  regexp/no-useless-quantifier: [2]
  regexp/no-useless-range: [2]
-  regexp/no-useless-set-operand: [2]
-  regexp/no-useless-string-literal: [2]
  regexp/no-useless-two-nums-quantifier: [2]
  regexp/no-zero-quantifier: [2]
  regexp/optimal-lookaround-quantifier: [2]
@@ -759,12 +550,10 @@ rules:
  regexp/prefer-regexp-exec: [2]
  regexp/prefer-regexp-test: [2]
  regexp/prefer-result-array-groups: [0]
-  regexp/prefer-set-operation: [2]
  regexp/prefer-star-quantifier: [2]
  regexp/prefer-unicode-codepoint-escapes: [2]
  regexp/prefer-w: [0]
  regexp/require-unicode-regexp: [0]
-  regexp/simplify-set-operations: [2]
  regexp/sort-alternatives: [0]
  regexp/sort-character-class-elements: [0]
  regexp/sort-flags: [0]
@@ -772,9 +561,13 @@ rules:
  regexp/unicode-escape: [0]
  regexp/use-ignore-case: [0]
  require-atomic-updates: [0]
-  require-await: [0] # handled by @typescript-eslint/require-await
+  require-await: [0]
  require-unicode-regexp: [0]
  require-yield: [2]
+  rest-spread-spacing: [2, never]
+  semi-spacing: [2, {before: false, after: true}]
+  semi-style: [2, last]
+  semi: [2, always, {omitLastInOneLineBlock: true}]
  sonarjs/cognitive-complexity: [0]
  sonarjs/elseif-without-else: [0]
  sonarjs/max-switch-cases: [0]
@@ -810,15 +603,21 @@ rules:
  sort-imports: [0]
  sort-keys: [0]
  sort-vars: [0]
+  space-before-blocks: [2, always]
+  space-in-parens: [2, never]
+  space-infix-ops: [2]
+  space-unary-ops: [2]
+  spaced-comment: [2, always]
  strict: [0]
+  switch-colon-spacing: [2]
  symbol-description: [2]
+  template-curly-spacing: [2, never]
+  template-tag-spacing: [2, never]
  unicode-bom: [2, never]
  unicorn/better-regex: [0]
  unicorn/catch-error-name: [0]
  unicorn/consistent-destructuring: [2]
-  unicorn/consistent-empty-array-spread: [2]
-  unicorn/consistent-existence-index-check: [0]
-  unicorn/consistent-function-scoping: [0]
+  unicorn/consistent-function-scoping: [2]
  unicorn/custom-error-definition: [0]
  unicorn/empty-brace-spaces: [2]
  unicorn/error-message: [0]
@@ -830,41 +629,33 @@ rules:
  unicorn/import-style: [0]
  unicorn/new-for-builtins: [2]
  unicorn/no-abusive-eslint-disable: [0]
-  unicorn/no-anonymous-default-export: [0]
  unicorn/no-array-callback-reference: [0]
  unicorn/no-array-for-each: [2]
  unicorn/no-array-method-this-argument: [2]
  unicorn/no-array-push-push: [2]
  unicorn/no-array-reduce: [2]
  unicorn/no-await-expression-member: [0]
-  unicorn/no-await-in-promise-methods: [2]
  unicorn/no-console-spaces: [0]
  unicorn/no-document-cookie: [2]
  unicorn/no-empty-file: [2]
  unicorn/no-for-loop: [0]
  unicorn/no-hex-escape: [0]
  unicorn/no-instanceof-array: [0]
-  unicorn/no-invalid-fetch-options: [2]
  unicorn/no-invalid-remove-event-listener: [2]
  unicorn/no-keyword-prefix: [0]
-  unicorn/no-length-as-slice-end: [2]
  unicorn/no-lonely-if: [2]
-  unicorn/no-magic-array-flat-depth: [0]
  unicorn/no-negated-condition: [0]
-  unicorn/no-negation-in-equality-check: [2]
  unicorn/no-nested-ternary: [0]
  unicorn/no-new-array: [0]
  unicorn/no-new-buffer: [0]
  unicorn/no-null: [0]
  unicorn/no-object-as-default-parameter: [0]
  unicorn/no-process-exit: [0]
-  unicorn/no-single-promise-in-promise-methods: [2]
  unicorn/no-static-only-class: [2]
  unicorn/no-thenable: [2]
  unicorn/no-this-assignment: [2]
  unicorn/no-typeof-undefined: [2]
  unicorn/no-unnecessary-await: [2]
-  unicorn/no-unnecessary-polyfills: [2]
  unicorn/no-unreadable-array-destructuring: [0]
  unicorn/no-unreadable-iife: [2]
  unicorn/no-unused-properties: [2]
@@ -894,12 +685,10 @@ rules:
  unicorn/prefer-dom-node-text-content: [2]
  unicorn/prefer-event-target: [2]
  unicorn/prefer-export-from: [0]
-  unicorn/prefer-global-this: [0]
  unicorn/prefer-includes: [2]
  unicorn/prefer-json-parse-buffer: [0]
  unicorn/prefer-keyboard-event-key: [2]
  unicorn/prefer-logical-operator-over-ternary: [2]
-  unicorn/prefer-math-min-max: [2]
  unicorn/prefer-math-trunc: [2]
  unicorn/prefer-modern-dom-apis: [0]
  unicorn/prefer-modern-math-apis: [2]
@@ -912,18 +701,16 @@ rules:
  unicorn/prefer-object-has-own: [0]
  unicorn/prefer-optional-catch-binding: [2]
  unicorn/prefer-prototype-methods: [0]
-  unicorn/prefer-query-selector: [2]
+  unicorn/prefer-query-selector: [0]
  unicorn/prefer-reflect-apply: [0]
  unicorn/prefer-regexp-test: [2]
  unicorn/prefer-set-has: [0]
  unicorn/prefer-set-size: [2]
  unicorn/prefer-spread: [0]
-  unicorn/prefer-string-raw: [0]
  unicorn/prefer-string-replace-all: [0]
  unicorn/prefer-string-slice: [0]
  unicorn/prefer-string-starts-ends-with: [2]
  unicorn/prefer-string-trim-start-end: [2]
-  unicorn/prefer-structured-clone: [2]
  unicorn/prefer-switch: [0]
  unicorn/prefer-ternary: [0]
  unicorn/prefer-text-content: [2]
@@ -964,4 +751,7 @@ rules:
  wc/no-typos: [2]
  wc/require-listener-teardown: [2]
  wc/tag-name-matches-class: [2]
+  wrap-iife: [2, inside]
+  wrap-regex: [0]
+  yield-star-spacing: [2, after]
  yoda: [2, never]
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,6 +1,5 @@
 * text=auto eol=lf
 *.tmpl linguist-language=Handlebars
-*.pb.go linguist-generated
 /assets/*.json linguist-generated
 /public/assets/img/svg/*.svg linguist-generated
 /templates/swagger/v1_json.tmpl linguist-generated
--- a/.gitea/issue_template.md
+++ b/.gitea/issue_template.md
@@ -3,7 +3,7 @@
 <!--
    1. Please speak English, this is the language all maintainers can speak and write.
    2. Please ask questions or configuration/deploy problems on our Discord
-       server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
+       server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
    3. Please take a moment to check that your issue doesn't already exist.
    4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
    5. Please give all relevant information below for bug reports, because
@@ -21,7 +21,7 @@
  - [ ] MySQL
  - [ ] MSSQL
  - [ ] SQLite
- Can you reproduce the bug at https://demo.gitea.com:
+- Can you reproduce the bug at https://try.gitea.io:
  - [ ] Yes (provide example URL)
  - [ ] No
 - Log gist:
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1 +1,2 @@
 open_collective: gitea
+custom: https://www.bountysource.com/teams/gitea
--- a/.github/ISSUE_TEMPLATE/bug-report.yaml
+++ b/.github/ISSUE_TEMPLATE/bug-report.yaml
@@ -1,6 +1,6 @@
 name: Bug Report
 description: Found something you weren't expecting? Report it here!
-labels: ["type/bug"]
+labels: ["kind/bug"]
 body:
  - type: markdown
    attributes:
@@ -11,7 +11,7 @@ body:
      value: |
        1. Please speak English, this is the language all maintainers can speak and write.
        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
+           server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
        3. Make sure you are using the latest release and
           take a moment to check that your issue hasn't been reported before.
        4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
@@ -37,7 +37,7 @@ body:
      label: Can you reproduce the bug on the Gitea demo site?
      description: |
        If so, please provide a URL in the Description field
-        URL of Gitea demo: https://demo.gitea.com
+        URL of Gitea demo: https://try.gitea.io
      options:
        - "Yes"
        - "No"
@@ -74,7 +74,7 @@ body:
    attributes:
      label: How are you running Gitea?
      description: |
-        Please include information on whether you built Gitea yourself, used one of our downloads, are using https://demo.gitea.com or are using some other package
+        Please include information on whether you built Gitea yourself, used one of our downloads, are using https://try.gitea.io or are using some other package
        Please also tell us how you are running Gitea, e.g. if it is being run from docker, a command-line, systemd etc.
        If you are using a package or systemd tell us what distribution you are using
    validations:
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -7,7 +7,7 @@ contact_links:
    url: https://discord.gg/Gitea
    about: Please ask questions and discuss configuration or deployment problems here.
  - name: Discourse Forum
-    url: https://forum.gitea.com
+    url: https://discourse.gitea.io
    about: Questions and configuration or deployment problems can also be discussed on our forum.
  - name: Frequently Asked Questions
    url: https://docs.gitea.com/help/faq
--- a/.github/ISSUE_TEMPLATE/feature-request.yaml
+++ b/.github/ISSUE_TEMPLATE/feature-request.yaml
@@ -1,13 +1,13 @@
 name: Feature Request
 description: Got an idea for a feature that Gitea doesn't have currently?  Submit your idea here!
-labels: ["type/proposal"]
+labels: ["kind/proposal"]
 body:
  - type: markdown
    attributes:
      value: |
        1. Please speak English, this is the language all maintainers can speak and write.
        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
+           server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
        3. Please take a moment to check that your feature hasn't already been suggested.
  - type: textarea
    id: description
--- a/.github/ISSUE_TEMPLATE/ui.bug-report.yaml
+++ b/.github/ISSUE_TEMPLATE/ui.bug-report.yaml
@@ -1,6 +1,6 @@
 name: Web Interface Bug Report
 description: Something doesn't look quite as it should?  Report it here!
-labels: ["type/bug", "topic/ui"]
+labels: ["kind/bug", "kind/ui"]
 body:
  - type: markdown
    attributes:
@@ -11,7 +11,7 @@ body:
      value: |
        1. Please speak English, this is the language all maintainers can speak and write.
        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
+           server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
        3. Please take a moment to check that your issue doesn't already exist.
        4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
        5. Please give all relevant information below for bug reports, because
@@ -46,7 +46,7 @@ body:
      label: Can you reproduce the bug on the Gitea demo site?
      description: |
        If so, please provide a URL in the Description field
-        URL of Gitea demo: https://demo.gitea.com
+        URL of Gitea demo: https://try.gitea.io
      options:
        - "Yes"
        - "No"
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -3,5 +3,3 @@ self-hosted-runner:
    - actuated-4cpu-8gb
    - actuated-4cpu-16gb
    - nscloud
-    - namespace-profile-gitea-release-docker
-    - namespace-profile-gitea-release-binary
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,83 +1,36 @@
 modifies/docs:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/*.md"
-          - "docs/**"
-
-modifies/templates:
-  - changed-files:
-      - all-globs-to-any-file:
-          - "templates/**"
-          - "!templates/swagger/v1_json.tmpl"
-
-modifies/api:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "routers/api/**"
-          - "templates/swagger/v1_json.tmpl"
-
-modifies/cli:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "cmd/**"
-
-modifies/translation:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "options/locale/*.ini"
-
-modifies/migrations:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "models/migrations/**"
-
-modifies/internal:
-  - changed-files:
-      - any-glob-to-any-file:
-          - ".air.toml"
-          - "Makefile"
-          - "Dockerfile"
-          - "Dockerfile.rootless"
-          - ".dockerignore"
-          - "docker/**"
-          - ".editorconfig"
-          - ".eslintrc.yaml"
-          - ".golangci.yml"
-          - ".gitpod.yml"
-          - ".markdownlint.yaml"
-          - ".spectral.yaml"
-          - "stylelint.config.js"
-          - ".yamllint.yaml"
-          - ".github/**"
-          - ".gitea/"
-          - ".devcontainer/**"
-          - "build.go"
-          - "build/**"
-          - "contrib/**"
-
-modifies/dependencies:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "package.json"
-          - "package-lock.json"
-          - "pyproject.toml"
-          - "poetry.lock"
-          - "go.mod"
-          - "go.sum"
-
-modifies/go:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/*.go"
+  - "**/*.md"
+  - "docs/**"

 modifies/frontend:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/*.js"
-          - "**/*.ts"
-          - "**/*.vue"
+  - "web_src/**/*"

-docs-update-needed:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "custom/conf/app.example.ini"
+modifies/templates:
+  - all: ["templates/**", "!templates/swagger/v1_json.tmpl"]
+
+modifies/api:
+  - "routers/api/**"
+  - "templates/swagger/v1_json.tmpl"
+
+modifies/cli:
+  - "cmd/**"
+
+modifies/translation:
+  - "options/locale/*.ini"
+
+modifies/migrations:
+  - "models/migrations/**/*"
+
+modifies/internal:
+  - "Makefile"
+  - "Dockerfile"
+  - "Dockerfile.rootless"
+  - "docker/**"
+  - "webpack.config.js"
+  - ".eslintrc.yaml"
+  - ".golangci.yml"
+  - ".markdownlint.yaml"
+  - ".spectral.yaml"
+  - ".stylelintrc.yaml"
+  - ".yamllint.yaml"
+  - ".github/**"
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,10 +1,9 @@
-<!-- start tips -->
+<!-- start tips --> 
 Please check the following:
 1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for backports.
 2. Make sure you have read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md .
-3. For documentations contribution, please go to https://gitea.com/gitea/docs
-4. Describe what your pull request does and which issue you're targeting (if any).
-5. It is recommended to enable "Allow edits by maintainers", so maintainers can help more easily.
-6. Your input here will be included in the commit message when this PR has been merged. If you don't want some content to be included, please separate them with a line like `---`.
-7. Delete all these tips before posting.
+3. Describe what your pull request does and which issue you're targeting (if any).
+4. It is recommended to enable "Allow edits by maintainers", so maintainers can help more easily.
+5. Your input here will be included in the commit message when this PR has been merged. If you don't want some content to be included, please separate them with a line like `---`.
+6. Delete all these tips before posting.
 <!-- end tips -->
--- a/.github/stale.yml
+++ b/.github/stale.yml
@@ -0,0 +1,54 @@
+# Configuration for probot-stale - https://github.com/probot/stale
+
+# Number of days of inactivity before an Issue or Pull Request becomes stale
+daysUntilStale: 60
+
+# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
+# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
+daysUntilClose: 14
+
+# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
+exemptLabels:
+  - status/blocked
+  - kind/security
+  - lgtm/done
+  - reviewed/confirmed
+  - priority/critical
+  - kind/proposal
+
+# Set to true to ignore issues in a project (defaults to false)
+exemptProjects: false
+
+# Set to true to ignore issues in a milestone (defaults to false)
+exemptMilestones: false
+
+# Label to use when marking as stale
+staleLabel: stale
+
+# Comment to post when marking as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had recent activity.
+  I am here to help clear issues left open even if solved or waiting for more insight.
+  This issue will be closed if no further activity occurs during the next 2 weeks.
+  If the issue is still valid just add a comment to keep it alive.
+  Thank you for your contributions.
+
+# Comment to post when closing a stale Issue or Pull Request.
+closeComment: >
+  This issue has been automatically closed because of inactivity.
+  You can re-open it if needed.
+
+# Limit the number of actions per hour, from 1-30. Default is 30
+limitPerRun: 1
+
+# Optionally, specify configuration settings that are specific to just 'issues' or 'pulls':
+pulls:
+  daysUntilStale: 60
+  daysUntilClose: 60
+  markComment: >
+    This pull request has been automatically marked as stale because it has not had
+    recent activity. It will be closed if no further activity occurs during the next 2 months. Thank you
+    for your contributions.
+  closeComment: >
+    This pull request has been automatically closed because of inactivity.
+    You can re-open it if needed.
--- a/.github/workflows/cron-licenses.yml
+++ b/.github/workflows/cron-licenses.yml
@@ -11,14 +11,14 @@ jobs:
    if: github.repository == 'go-gitea/gitea'
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - run: make generate-license generate-gitignore
        timeout-minutes: 40
      - name: push translations to repo
-        uses: appleboy/git-push-action@v0.0.3
+        uses: appleboy/git-push-action@v0.0.2
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
--- a/.github/workflows/cron-lock.yml
+++ b/.github/workflows/cron-lock.yml
@@ -0,0 +1,22 @@
+name: cron-lock
+
+on:
+  schedule:
+    - cron: "0 0 * * *" # every day at 00:00 UTC
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: lock
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    if: github.repository == 'go-gitea/gitea'
+    steps:
+      - uses: dessant/lock-threads@v4
+        with:
+          issue-inactive-days: 45
--- a/.github/workflows/cron-translations.yml
+++ b/.github/workflows/cron-translations.yml
@@ -11,23 +11,18 @@ jobs:
    if: github.repository == 'go-gitea/gitea'
    steps:
      - uses: actions/checkout@v4
-      - uses: crowdin/github-action@v1
-        with:
-          upload_sources: true
-          upload_translations: false
-          download_sources: false
-          download_translations: true
-          push_translations: false
-          push_sources: false
-          create_pull_request: false
-          config: crowdin.yml
+      - name: download from crowdin
+        uses: docker://jonasfranz/crowdin
        env:
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
          CROWDIN_KEY: ${{ secrets.CROWDIN_KEY }}
+          PLUGIN_DOWNLOAD: true
+          PLUGIN_EXPORT_DIR: options/locale/
+          PLUGIN_IGNORE_BRANCH: true
+          PLUGIN_PROJECT_IDENTIFIER: gitea
      - name: update locales
        run: ./build/update-locales.sh
      - name: push translations to repo
-        uses: appleboy/git-push-action@v0.0.3
+        uses: appleboy/git-push-action@v0.0.2
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
@@ -36,3 +31,19 @@ jobs:
          commit_message: "[skip ci] Updated translations via Crowdin"
          remote: "git@github.com:go-gitea/gitea.git"
          ssh_key: ${{ secrets.DEPLOY_KEY }}
+  crowdin-push:
+    runs-on: ubuntu-latest
+    if: github.repository == 'go-gitea/gitea'
+    steps:
+      - uses: actions/checkout@v4
+      - name: push translations to crowdin
+        uses: docker://jonasfranz/crowdin
+        env:
+          CROWDIN_KEY: ${{ secrets.CROWDIN_KEY }}
+          PLUGIN_UPLOAD: true
+          PLUGIN_EXPORT_DIR: options/locale/
+          PLUGIN_IGNORE_BRANCH: true
+          PLUGIN_PROJECT_IDENTIFIER: gitea
+          PLUGIN_FILES: |
+            locale_en-US.ini: options/locale/locale_en-US.ini
+          PLUGIN_BRANCH: main
--- a/.github/workflows/disk-clean.yml
+++ b/.github/workflows/disk-clean.yml
@@ -0,0 +1,36 @@
+name: disk-clean
+
+on:
+  workflow_call:
+
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      # FIXME: https://github.com/jlumbroso/free-disk-space/issues/17
+      - name: same as 'large-packages' but without 'google-cloud-sdk'
+        shell: bash
+        run: |
+          sudo apt-get remove -y '^dotnet-.*'
+          sudo apt-get remove -y '^llvm-.*'
+          sudo apt-get remove -y 'php.*'
+          sudo apt-get remove -y '^mongodb-.*'
+          sudo apt-get remove -y '^mysql-.*'
+          sudo apt-get remove -y azure-cli google-chrome-stable firefox powershell mono-devel libgl1-mesa-dri
+          sudo apt-get autoremove -y
+          sudo apt-get clean
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@main
+        with:
+          # this might remove tools that are actually needed,
+          # if set to "true" but frees about 6 GB
+          tool-cache: false
+
+          # all of these default to true, but feel free to set to
+          # "false" if necessary for your workflow
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: false
+          docker-images: false
+          swap-storage: true
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -35,7 +35,7 @@ jobs:
      yaml: ${{ steps.changes.outputs.yaml }}
    steps:
      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v2
        id: changes
        with:
          filters: |
@@ -48,7 +48,6 @@ jobs:
              - "Makefile"
              - ".golangci.yml"
              - ".editorconfig"
-              - "options/locale/locale_en-US.ini"

            frontend:
              - "**/*.js"
@@ -58,11 +57,12 @@ jobs:
              - "package-lock.json"
              - "Makefile"
              - ".eslintrc.yaml"
-              - "stylelint.config.js"
+              - ".stylelintrc.yaml"
              - ".npmrc"

            docs:
              - "**/*.md"
+              - "docs/**"
              - ".markdownlint.yaml"
              - "package.json"
              - "package-lock.json"
@@ -72,7 +72,6 @@ jobs:
              - "Makefile"

            templates:
-              - "tools/lint-templates-*.js"
              - "templates/**/*.tmpl"
              - "pyproject.toml"
              - "poetry.lock"
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -17,9 +17,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - run: make deps-backend deps-tools
      - run: make lint-backend
@@ -32,17 +32,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
        with:
-          python-version: "3.12"
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          python-version: "3.11"
      - run: pip install poetry
      - run: make deps-py
-      - run: make deps-frontend
      - run: make lint-templates

  lint-yaml:
@@ -51,9 +45,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
        with:
-          python-version: "3.12"
+          python-version: "3.11"
      - run: pip install poetry
      - run: make deps-py
      - run: make lint-yaml
@@ -64,11 +58,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          node-version: 20
      - run: make deps-frontend
      - run: make lint-swagger

@@ -90,9 +82,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - run: make deps-backend deps-tools
      - run: make lint-go-windows lint-go-vet
@@ -107,9 +99,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - run: make deps-backend deps-tools
      - run: make lint-go
@@ -122,9 +114,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - run: make deps-backend deps-tools
      - run: make --always-make checks-backend # ensure the "go-licenses" make target runs
@@ -135,11 +127,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          node-version: 20
      - run: make deps-frontend
      - run: make lint-frontend
      - run: make checks-frontend
@@ -152,9 +142,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      # no frontend build here as backend should be able to build
      # even without any frontend files
@@ -184,13 +174,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          node-version: 20
      - run: make deps-frontend
      - run: make lint-md
+      - run: make docs

  actions:
    if: needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.actions == 'true'
@@ -198,8 +187,5 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          check-latest: true
+      - uses: actions/setup-go@v4
      - run: make lint-actions
--- a/.github/workflows/pull-db-tests.yml
+++ b/.github/workflows/pull-db-tests.yml
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    services:
      pgsql:
-        image: postgres:12
+        image: postgres:15
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
@@ -31,17 +31,17 @@ jobs:
      minio:
        # as github actions doesn't support "entrypoint", we need to use a non-official image
        # that has a custom entrypoint set to "minio server /data"
-        image: bitnami/minio:2023.8.31
+        image: bitnami/minio:2021.3.17
        env:
-          MINIO_ROOT_USER: 123456
-          MINIO_ROOT_PASSWORD: 12345678
+          MINIO_ACCESS_KEY: 123456
+          MINIO_SECRET_KEY: 12345678
        ports:
          - "9000:9000"
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 pgsql ldap minio" | sudo tee -a /etc/hosts'
@@ -67,9 +67,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - run: make deps-backend
      - run: make backend
@@ -91,6 +91,13 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    services:
+      mysql:
+        image: mysql:5.7
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: test
+        ports:
+          - "3306:3306"
      elasticsearch:
        image: elasticsearch:7.5.0
        env:
@@ -103,6 +110,13 @@ jobs:
          MEILI_ENV: development # disable auth
        ports:
          - "7700:7700"
+      smtpimap:
+        image: tabascoterrier/docker-imap-devel:latest
+        ports:
+          - "25:25"
+          - "143:143"
+          - "587:587"
+          - "993:993"
      redis:
        image: redis
        options: >- # wait until redis has started
@@ -119,18 +133,14 @@ jobs:
          MINIO_SECRET_KEY: 12345678
        ports:
          - "9000:9000"
-      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest
-        ports:
-          - 10000:10000
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - name: Add hosts to /etc/hosts
-        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
+        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
      - run: make deps-backend
      - run: make backend
        env:
@@ -148,21 +158,18 @@ jobs:
          RACE_ENABLED: true
          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}

-  test-mysql:
+  test-mysql5:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    services:
      mysql:
-        # the bitnami mysql image has more options than the official one, it's easier to customize
-        image: bitnami/mysql:8.0
+        image: mysql:5.7
        env:
-          ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: testgitea
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: test
        ports:
          - "3306:3306"
-        options: >-
-          --mount type=tmpfs,destination=/bitnami/mysql/data
      elasticsearch:
        image: elasticsearch:7.5.0
        env:
@@ -178,9 +185,9 @@ jobs:
          - "993:993"
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
@@ -191,41 +198,64 @@ jobs:
      - name: run migration tests
        run: make test-mysql-migration
      - name: run tests
-        # run: make integration-test-coverage (at the moment, no coverage is really handled)
-        run: make test-mysql
+        run: make integration-test-coverage
        env:
          TAGS: bindata
          RACE_ENABLED: true
          USE_REPO_TEST_DIR: 1
          TEST_INDEXER_CODE_ES_URL: "http://elastic:changeme@elasticsearch:9200"

+  test-mysql8:
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    services:
+      mysql8:
+        image: mysql:8
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: testgitea
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v4
+        with:
+          go-version: "~1.21"
+          check-latest: true
+      - name: Add hosts to /etc/hosts
+        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql8" | sudo tee -a /etc/hosts'
+      - run: make deps-backend
+      - run: make backend
+        env:
+          TAGS: bindata
+      - run: make test-mysql8-migration test-mysql8
+        timeout-minutes: 50
+        env:
+          TAGS: bindata
+          USE_REPO_TEST_DIR: 1
+
  test-mssql:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
-    # specifying the version of ubuntu in use as mssql fails on newer kernels
-    # pending resolution from vendor
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    services:
      mssql:
-        image: mcr.microsoft.com/mssql/server:2017-latest
+        image: mcr.microsoft.com/mssql/server:latest
        env:
          ACCEPT_EULA: Y
          MSSQL_PID: Standard
          SA_PASSWORD: MwantsaSecurePassword1
        ports:
          - "1433:1433"
-      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest
-        ports:
-          - 10000:10000
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
      - name: Add hosts to /etc/hosts
-        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
+        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql" | sudo tee -a /etc/hosts'
      - run: make deps-backend
      - run: make backend
        env:
--- a/.github/workflows/pull-docker-dryrun.yml
+++ b/.github/workflows/pull-docker-dryrun.yml
@@ -16,8 +16,8 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v5
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/build-push-action@v4
        with:
          push: false
          tags: gitea/gitea:linux-amd64
@@ -27,8 +27,8 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v5
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/build-push-action@v4
        with:
          push: false
          file: Dockerfile.rootless
--- a/.github/workflows/pull-e2e-tests.yml
+++ b/.github/workflows/pull-e2e-tests.yml
@@ -17,15 +17,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          node-version: 20
      - run: make deps-frontend frontend deps-backend
      - run: npx playwright install --with-deps
      - run: make test-e2e-sqlite
--- a/.github/workflows/pull-labeler.yml
+++ b/.github/workflows/pull-labeler.yml
@@ -9,12 +9,13 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  labeler:
+  label:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v4
        with:
+          dot: true
          sync-labels: true
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -2,7 +2,7 @@ name: release-nightly

 on:
  push:
-    branches: [main, release/v*]
+    branches: [ main, release/v* ]

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -10,21 +10,19 @@ concurrency:

 jobs:
  nightly-binary:
-    runs-on: namespace-profile-gitea-release-binary
+    runs-on: nscloud
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          node-version: 20
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -32,7 +30,7 @@ jobs:
          TAGS: bindata sqlite sqlite_unlock_notify
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v6
+        uses: crazy-max/ghaction-import-gpg@v5
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -47,7 +45,7 @@ jobs:
        run: |
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
-          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
+          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
        uses: aws-actions/configure-aws-credentials@v4
        with:
@@ -58,18 +56,18 @@ jobs:
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
  nightly-docker-rootful:
-    runs-on: namespace-profile-gitea-release-docker
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
      - name: Get cleaned branch name
        id: clean_name
        run: |
@@ -81,32 +79,32 @@ jobs:
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: fetch go modules
        run: make vendor
      - name: build rootful docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: gitea/gitea:${{ steps.clean_name.outputs.branch }}
  nightly-docker-rootless:
-    runs-on: namespace-profile-gitea-release-docker
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
      - name: Get cleaned branch name
        id: clean_name
        run: |
@@ -118,14 +116,14 @@ jobs:
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: fetch go modules
        run: make vendor
      - name: build rootless docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -3,7 +3,7 @@ name: release-tag-rc
 on:
  push:
    tags:
-      - "v1*-rc*"
+      - 'v1*-rc*'

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -11,21 +11,19 @@ concurrency:

 jobs:
  binary:
-    runs-on: namespace-profile-gitea-release-binary
+    runs-on: nscloud
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          node-version: 20
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -33,7 +31,7 @@ jobs:
          TAGS: bindata sqlite sqlite_unlock_notify
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v6
+        uses: crazy-max/ghaction-import-gpg@v5
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -68,14 +66,14 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
  docker-rootful:
-    runs-on: namespace-profile-gitea-release-docker
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
      - uses: docker/metadata-action@v5
        id: meta
        with:
@@ -86,12 +84,12 @@ jobs:
          tags: |
            type=semver,pattern={{version}}
      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: build rootful docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -99,14 +97,14 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  docker-rootless:
-    runs-on: namespace-profile-gitea-release-docker
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
      - uses: docker/metadata-action@v5
        id: meta
        with:
@@ -119,12 +117,12 @@ jobs:
          tags: |
            type=semver,pattern={{version}}
      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: build rootless docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -3,9 +3,9 @@ name: release-tag-version
 on:
  push:
    tags:
-      - "v1.*"
-      - "!v1*-rc*"
-      - "!v1*-dev"
+      - 'v1.*'
+      - '!v1*-rc*'
+      - '!v1*-dev'

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -13,21 +13,19 @@ concurrency:

 jobs:
  binary:
-    runs-on: namespace-profile-gitea-release-binary
+    runs-on: nscloud
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: "~1.21"
          check-latest: true
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
+          node-version: 20
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -35,7 +33,7 @@ jobs:
          TAGS: bindata sqlite sqlite_unlock_notify
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v6
+        uses: crazy-max/ghaction-import-gpg@v5
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -70,14 +68,14 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
  docker-rootful:
-    runs-on: namespace-profile-gitea-release-docker
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
      - uses: docker/metadata-action@v5
        id: meta
        with:
@@ -92,12 +90,12 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{version}}
      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: build rootful docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -105,14 +103,14 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  docker-rootless:
-    runs-on: namespace-profile-gitea-release-docker
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
      - uses: docker/metadata-action@v5
        id: meta
        with:
@@ -130,12 +128,12 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{version}}
      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: build rootless docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
--- a/.gitignore
+++ b/.gitignore
@@ -11,11 +11,10 @@ _test
 .idea
 # Goland's output filename can not be set manually
 /go_build_*
-/gitea_*

 # MS VSCode
 .vscode
-__debug_bin*
+__debug_bin

 *.cgo1.go
 *.cgo2.c
@@ -28,7 +27,6 @@ _testmain.go
 *.exe
 *.test
 *.prof
-*.tsbuildinfo

 *coverage.out
 coverage.all
@@ -59,7 +57,7 @@ cpu.out
 /data
 /indexers
 /log
-/public/assets/img/avatar
+/public/img/avatar
 /tests/integration/gitea-integration-*
 /tests/integration/indexers-*
 /tests/e2e/gitea-e2e-*
@@ -78,6 +76,7 @@ cpu.out
 /public/assets/css
 /public/assets/fonts
 /public/assets/licenses.txt
+/public/assets/img/webpack
 /vendor
 /web_src/fomantic/node_modules
 /web_src/fomantic/build/*
@@ -95,9 +94,6 @@ cpu.out
 /.air
 /.go-licenses

-# Files and folders that were previously generated
-/public/assets/img/webpack
-
 # Snapcraft
 /gitea_a*.txt
 snap/.snapcraft/
@@ -109,9 +105,6 @@ prime/
 *_source.tar.bz2
 .DS_Store

-# nix-direnv generated files
-.direnv/
-
 # Make evidence files
 /.make_evidence

--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -10,19 +10,10 @@ tasks:
  - name: Run backend
    command: |
      gp sync-await setup
-
-      # Get the URL and extract the domain
-      url=$(gp url 3000)
-      domain=$(echo $url | awk -F[/:] '{print $4}')
-
-      if [ -f custom/conf/app.ini ]; then
-        sed -i "s|^ROOT_URL =.*|ROOT_URL = ${url}/|" custom/conf/app.ini
-        sed -i "s|^DOMAIN =.*|DOMAIN = ${domain}|" custom/conf/app.ini
-        sed -i "s|^SSH_DOMAIN =.*|SSH_DOMAIN = ${domain}|" custom/conf/app.ini
-        sed -i "s|^NO_REPLY_ADDRESS =.*|SSH_DOMAIN = noreply.${domain}|" custom/conf/app.ini
-      else
+      if [ ! -f custom/conf/app.ini ]
+      then
        mkdir -p custom/conf/
-        echo -e "[server]\nROOT_URL = ${url}/" > custom/conf/app.ini
+        echo -e "[server]\nROOT_URL=$(gp url 3000)/" > custom/conf/app.ini
        echo -e "\n[database]\nDB_TYPE = sqlite3\nPATH = $GITPOD_REPO_ROOT/data/gitea.db" >> custom/conf/app.ini
      fi
      export TAGS="sqlite sqlite_unlock_notify"
@@ -42,8 +33,8 @@ vscode:
    - DavidAnson.vscode-markdownlint
    - Vue.volar
    - ms-azuretools.vscode-docker
-    - vitest.explorer
-    - cweijan.vscode-database-client2
+    - zixuanchen.vitest-explorer
+    - qwtel.sqlite-viewer
    - GitHub.vscode-pull-request-github

 ports:
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,14 +1,13 @@
 linters:
-  enable-all: false
-  disable-all: true
-  fast: false
  enable:
    - bidichk
+    # - deadcode # deprecated - https://github.com/golangci/golangci-lint/issues/1841
    - depguard
    - dupl
    - errcheck
    - forbidigo
    - gocritic
+    # - gocyclo # The cyclomatic complexety of a lot of functions is too high, we should refactor those another time.
    - gofmt
    - gofumpt
    - gosimple
@@ -18,28 +17,26 @@ linters:
    - nolintlint
    - revive
    - staticcheck
+    # - structcheck # deprecated - https://github.com/golangci/golangci-lint/issues/1841
    - stylecheck
-    - tenv
-    - testifylint
    - typecheck
    - unconvert
    - unused
-    - unparam
+    # - varcheck # deprecated - https://github.com/golangci/golangci-lint/issues/1841
    - wastedassign
+  enable-all: false
+  disable-all: true
+  fast: false

 run:
+  go: "1.21"
  timeout: 10m
-
-output:
-  sort-results: true
-  sort-order: [file]
-  show-stats: true
+  skip-dirs:
+    - node_modules
+    - public
+    - web_src

 linters-settings:
-  testifylint:
-    disable:
-      - go-require
-      - require-error
  stylecheck:
    checks: ["all", "-ST1005", "-ST1003"]
  nakedret:
@@ -49,41 +46,36 @@ linters-settings:
      - ifElseChain
      - singleCaseSwitch # Every time this occurred in the code, there  was no other way.
  revive:
-    severity: error
+    ignore-generated-header: false
+    severity: warning
+    confidence: 0.8
+    errorCode: 1
+    warningCode: 1
    rules:
-      - name: atomic
-      - name: bare-return
      - name: blank-imports
-      - name: constant-logical-expr
      - name: context-as-argument
      - name: context-keys-type
      - name: dot-imports
-      - name: duplicated-imports
-      - name: empty-lines
-      - name: error-naming
      - name: error-return
      - name: error-strings
-      - name: errorf
+      - name: error-naming
      - name: exported
-      - name: identical-branches
      - name: if-return
      - name: increment-decrement
-      - name: indent-error-flow
-      - name: modifies-value-receiver
+      - name: var-naming
+      - name: var-declaration
      - name: package-comments
      - name: range
      - name: receiver-naming
-      - name: redefines-builtin-id
-      - name: string-of-int
-      - name: superfluous-else
      - name: time-naming
-      - name: unconditional-recursion
      - name: unexported-return
-      - name: unreachable-code
-      - name: var-declaration
-      - name: var-naming
+      - name: indent-error-flow
+      - name: errorf
+      - name: duplicated-imports
+      - name: modifies-value-receiver
  gofumpt:
    extra-rules: true
+    lang-version: "1.21"
  depguard:
    rules:
      main:
@@ -100,15 +92,12 @@ linters-settings:
            desc: do not use the internal package, use AddXxx function instead
          - pkg: gopkg.in/ini.v1
            desc: do not use the ini package, use gitea's config system instead
-          - pkg: gitea.com/go-chi/cache
-            desc: do not use the go-chi cache package, use gitea's cache system

 issues:
  max-issues-per-linter: 0
  max-same-issues: 0
-  exclude-dirs: [node_modules, public, web_src]
-  exclude-case-sensitive: true
  exclude-rules:
+    # Exclude some linters from running on tests files.
    - path: _test\.go
      linters:
        - gocyclo
@@ -126,19 +115,19 @@ issues:
    - path: cmd
      linters:
        - forbidigo
-    - text: "webhook"
-      linters:
+    - linters:
        - dupl
-    - text: "`ID' should not be capitalized"
-      linters:
+      text: "webhook"
+    - linters:
        - gocritic
-    - text: "swagger"
-      linters:
+      text: "`ID' should not be capitalized"
+    - linters:
        - unused
        - deadcode
-    - text: "argument x is overwritten before first use"
-      linters:
+      text: "swagger"
+    - linters:
        - staticcheck
+      text: "argument x is overwritten before first use"
    - text: "commentFormatting: put a space between `//` and comment text"
      linters:
        - gocritic
--- a/.ignore
+++ b/.ignore
@@ -4,8 +4,6 @@
 /modules/options/bindata.go
 /modules/public/bindata.go
 /modules/templates/bindata.go
-/options/gitignore
-/options/license
-/public/assets
 /vendor
+/public/assets
 node_modules
--- a/.markdownlint.yaml
+++ b/.markdownlint.yaml
@@ -1,15 +1,17 @@
 commands-show-output: false
 fenced-code-language: false
 first-line-h1: false
-heading-increment: false
+header-increment: false
 line-length: {code_blocks: false, tables: false, stern: true, line_length: -1}
 no-alt-text: false
 no-bare-urls: false
-no-emphasis-as-heading: false
+no-blanks-blockquote: false
+no-emphasis-as-header: false
 no-empty-links: false
 no-hard-tabs: {code_blocks: false}
 no-inline-html: false
 no-space-in-code: false
 no-space-in-emphasis: false
+no-trailing-punctuation: false
 no-trailing-spaces: {br_spaces: 0}
 single-h1: false
--- a/.stylelintrc.yaml
+++ b/.stylelintrc.yaml
@@ -0,0 +1,221 @@
+plugins:
+  - stylelint-declaration-strict-value
+  - stylelint-declaration-block-no-ignored-properties
+  - stylelint-stylistic
+
+ignoreFiles:
+  - "**/*.go"
+
+overrides:
+  - files: ["**/chroma/*", "**/codemirror/*", "**/standalone/*", "**/console.css", "font_i18n.css"]
+    rules:
+      scale-unlimited/declaration-strict-value: null
+  - files: ["**/chroma/*", "**/codemirror/*"]
+    rules:
+      block-no-empty: null
+  - files: ["**/*.vue"]
+    customSyntax: postcss-html
+
+rules:
+  alpha-value-notation: null
+  annotation-no-unknown: true
+  at-rule-allowed-list: null
+  at-rule-disallowed-list: null
+  at-rule-empty-line-before: null
+  at-rule-no-unknown: true
+  at-rule-no-vendor-prefix: true
+  at-rule-property-required-list: null
+  block-no-empty: true
+  color-function-notation: null
+  color-hex-alpha: null
+  color-hex-length: null
+  color-named: null
+  color-no-hex: null
+  color-no-invalid-hex: true
+  comment-empty-line-before: null
+  comment-no-empty: true
+  comment-pattern: null
+  comment-whitespace-inside: null
+  comment-word-disallowed-list: null
+  custom-media-pattern: null
+  custom-property-empty-line-before: null
+  custom-property-no-missing-var-function: true
+  custom-property-pattern: null
+  declaration-block-no-duplicate-custom-properties: true
+  declaration-block-no-duplicate-properties: [true, {ignore: [consecutive-duplicates-with-different-values]}]
+  declaration-block-no-redundant-longhand-properties: null
+  declaration-block-no-shorthand-property-overrides: null
+  declaration-block-single-line-max-declarations: null
+  declaration-empty-line-before: null
+  declaration-no-important: null
+  declaration-property-max-values: null
+  declaration-property-unit-allowed-list: null
+  declaration-property-unit-disallowed-list: {line-height: [em]}
+  declaration-property-value-allowed-list: null
+  declaration-property-value-disallowed-list: null
+  declaration-property-value-no-unknown: true
+  font-family-name-quotes: always-where-recommended
+  font-family-no-duplicate-names: true
+  font-family-no-missing-generic-family-keyword: true
+  font-weight-notation: null
+  function-allowed-list: null
+  function-calc-no-unspaced-operator: true
+  function-disallowed-list: null
+  function-linear-gradient-no-nonstandard-direction: true
+  function-name-case: lower
+  function-no-unknown: null
+  function-url-no-scheme-relative: null
+  function-url-quotes: always
+  function-url-scheme-allowed-list: null
+  function-url-scheme-disallowed-list: null
+  hue-degree-notation: null
+  import-notation: string
+  keyframe-block-no-duplicate-selectors: true
+  keyframe-declaration-no-important: true
+  keyframe-selector-notation: null
+  keyframes-name-pattern: null
+  length-zero-no-unit: true
+  max-nesting-depth: null
+  media-feature-name-allowed-list: null
+  media-feature-name-disallowed-list: null
+  media-feature-name-no-unknown: true
+  media-feature-name-no-vendor-prefix: true
+  media-feature-name-unit-allowed-list: null
+  media-feature-name-value-allowed-list: null
+  media-feature-name-value-no-unknown: true
+  media-feature-range-notation: null
+  media-query-no-invalid: true
+  named-grid-areas-no-invalid: true
+  no-descending-specificity: null
+  no-duplicate-at-import-rules: true
+  no-duplicate-selectors: true
+  no-empty-source: true
+  no-invalid-double-slash-comments: true
+  no-invalid-position-at-import-rule: null
+  no-irregular-whitespace: true
+  no-unknown-animations: null
+  no-unknown-custom-properties: null
+  number-max-precision: null
+  plugin/declaration-block-no-ignored-properties: true
+  property-allowed-list: null
+  property-disallowed-list: null
+  property-no-unknown: true
+  property-no-vendor-prefix: null
+  rule-empty-line-before: null
+  rule-selector-property-disallowed-list: null
+  scale-unlimited/declaration-strict-value: [[color, background-color, border-color, font-weight], {ignoreValues: /^(inherit|transparent|unset|initial|currentcolor|none)$/, ignoreFunctions: false, disableFix: true}]
+  selector-attribute-name-disallowed-list: null
+  selector-attribute-operator-allowed-list: null
+  selector-attribute-operator-disallowed-list: null
+  selector-attribute-quotes: always
+  selector-class-pattern: null
+  selector-combinator-allowed-list: null
+  selector-combinator-disallowed-list: null
+  selector-disallowed-list: null
+  selector-id-pattern: null
+  selector-max-attribute: null
+  selector-max-class: null
+  selector-max-combinators: null
+  selector-max-compound-selectors: null
+  selector-max-id: null
+  selector-max-pseudo-class: null
+  selector-max-specificity: null
+  selector-max-type: null
+  selector-max-universal: null
+  selector-nested-pattern: null
+  selector-no-qualifying-type: null
+  selector-no-vendor-prefix: true
+  selector-not-notation: null
+  selector-pseudo-class-allowed-list: null
+  selector-pseudo-class-disallowed-list: null
+  selector-pseudo-class-no-unknown: true
+  selector-pseudo-element-allowed-list: null
+  selector-pseudo-element-colon-notation: double
+  selector-pseudo-element-disallowed-list: null
+  selector-pseudo-element-no-unknown: true
+  selector-type-case: lower
+  selector-type-no-unknown: [true, {ignore: [custom-elements]}]
+  shorthand-property-no-redundant-values: true
+  string-no-newline: true
+  stylistic/at-rule-name-case: null
+  stylistic/at-rule-name-newline-after: null
+  stylistic/at-rule-name-space-after: null
+  stylistic/at-rule-semicolon-newline-after: null
+  stylistic/at-rule-semicolon-space-before: null
+  stylistic/block-closing-brace-empty-line-before: null
+  stylistic/block-closing-brace-newline-after: null
+  stylistic/block-closing-brace-newline-before: null
+  stylistic/block-closing-brace-space-after: null
+  stylistic/block-closing-brace-space-before: null
+  stylistic/block-opening-brace-newline-after: null
+  stylistic/block-opening-brace-newline-before: null
+  stylistic/block-opening-brace-space-after: null
+  stylistic/block-opening-brace-space-before: null
+  stylistic/color-hex-case: lower
+  stylistic/declaration-bang-space-after: never
+  stylistic/declaration-bang-space-before: null
+  stylistic/declaration-block-semicolon-newline-after: null
+  stylistic/declaration-block-semicolon-newline-before: null
+  stylistic/declaration-block-semicolon-space-after: null
+  stylistic/declaration-block-semicolon-space-before: never
+  stylistic/declaration-block-trailing-semicolon: null
+  stylistic/declaration-colon-newline-after: null
+  stylistic/declaration-colon-space-after: null
+  stylistic/declaration-colon-space-before: never
+  stylistic/function-comma-newline-after: null
+  stylistic/function-comma-newline-before: null
+  stylistic/function-comma-space-after: null
+  stylistic/function-comma-space-before: null
+  stylistic/function-max-empty-lines: 0
+  stylistic/function-parentheses-newline-inside: never-multi-line
+  stylistic/function-parentheses-space-inside: null
+  stylistic/function-whitespace-after: null
+  stylistic/indentation: 2
+  stylistic/linebreaks: null
+  stylistic/max-empty-lines: 1
+  stylistic/max-line-length: null
+  stylistic/media-feature-colon-space-after: null
+  stylistic/media-feature-colon-space-before: never
+  stylistic/media-feature-name-case: null
+  stylistic/media-feature-parentheses-space-inside: null
+  stylistic/media-feature-range-operator-space-after: always
+  stylistic/media-feature-range-operator-space-before: always
+  stylistic/media-query-list-comma-newline-after: null
+  stylistic/media-query-list-comma-newline-before: null
+  stylistic/media-query-list-comma-space-after: null
+  stylistic/media-query-list-comma-space-before: null
+  stylistic/no-empty-first-line: null
+  stylistic/no-eol-whitespace: true
+  stylistic/no-extra-semicolons: true
+  stylistic/no-missing-end-of-source-newline: null
+  stylistic/number-leading-zero: null
+  stylistic/number-no-trailing-zeros: null
+  stylistic/property-case: lower
+  stylistic/selector-attribute-brackets-space-inside: null
+  stylistic/selector-attribute-operator-space-after: null
+  stylistic/selector-attribute-operator-space-before: null
+  stylistic/selector-combinator-space-after: null
+  stylistic/selector-combinator-space-before: null
+  stylistic/selector-descendant-combinator-no-non-space: null
+  stylistic/selector-list-comma-newline-after: null
+  stylistic/selector-list-comma-newline-before: null
+  stylistic/selector-list-comma-space-after: always-single-line
+  stylistic/selector-list-comma-space-before: never-single-line
+  stylistic/selector-max-empty-lines: 0
+  stylistic/selector-pseudo-class-case: lower
+  stylistic/selector-pseudo-class-parentheses-space-inside: never
+  stylistic/selector-pseudo-element-case: lower
+  stylistic/string-quotes: double
+  stylistic/unicode-bom: null
+  stylistic/unit-case: lower
+  stylistic/value-list-comma-newline-after: null
+  stylistic/value-list-comma-newline-before: null
+  stylistic/value-list-comma-space-after: null
+  stylistic/value-list-comma-space-before: null
+  stylistic/value-list-max-empty-lines: 0
+  time-min-milliseconds: null
+  unit-allowed-list: null
+  unit-disallowed-list: null
+  unit-no-unknown: true
+  value-keyword-case: null
+  value-no-vendor-prefix: [true, {ignoreValues: [box, inline-box]}]
--- a/CHANGELOG-archived.md
+++ b/CHANGELOG-archived.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -8,7 +8,6 @@
    - [How to report issues](#how-to-report-issues)
    - [Types of issues](#types-of-issues)
    - [Discuss your design before the implementation](#discuss-your-design-before-the-implementation)
-    - [Issue locking](#issue-locking)
  - [Building Gitea](#building-gitea)
  - [Dependencies](#dependencies)
    - [Backend](#backend)
@@ -48,7 +47,6 @@
  - [Release Cycle](#release-cycle)
  - [Maintainers](#maintainers)
  - [Technical Oversight Committee (TOC)](#technical-oversight-committee-toc)
-    - [TOC election process](#toc-election-process)
    - [Current TOC members](#current-toc-members)
    - [Previous TOC/owners members](#previous-tocowners-members)
  - [Governance Compensation](#governance-compensation)
@@ -77,7 +75,7 @@ If your issue has not been reported yet, [open an issue](https://github.com/go-g
 and answer the questions so we can understand and reproduce the problematic behavior. \
 Please write clear and concise instructions so that we can reproduce the behavior — even if it seems obvious. \
 The more detailed and specific you are, the faster we can fix the issue. \
-It is really helpful if you can reproduce your problem on a site running on the latest commits, i.e. <https://demo.gitea.com>, as perhaps your problem has already been fixed on a current version. \
+It is really helpful if you can reproduce your problem on a site running on the latest commits, i.e. <https://try.gitea.io>, as perhaps your problem has already been fixed on a current version. \
 Please follow the guidelines described in [How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html) for your report.

 Please be kind, remember that Gitea comes at no cost to you, and you're getting free help.
@@ -104,13 +102,6 @@ the goals for the project and tools.

 Pull requests should not be the place for architecture discussions.

-### Issue locking
-
-Commenting on closed or merged issues/PRs is strongly discouraged.
-Such comments will likely be overlooked as some maintainers may not view notifications on closed issues, thinking that the item is resolved.
-As such, commenting on closed/merged issues/PRs may be disabled prior to the scheduled auto-locking if a discussion starts or if unrelated comments are posted.
-If further discussion is needed, we encourage you to open a new issue instead and we recommend linking to the issue/PR in question for context.
-
 ## Building Gitea

 See the [development setup instructions](https://docs.gitea.com/development/hacking-on-gitea).
@@ -119,7 +110,7 @@ See the [development setup instructions](https://docs.gitea.com/development/hack

 ### Backend

-Go dependencies are managed using [Go Modules](https://go.dev/cmd/go/#hdr-Module_maintenance). \
+Go dependencies are managed using [Go Modules](https://golang.org/cmd/go/#hdr-Module_maintenance). \
 You can find more details in the [go mod documentation](https://go.dev/ref/mod) and the [Go Modules Wiki](https://github.com/golang/go/wiki/Modules).

 Pull requests should only modify `go.mod` and `go.sum` where it is related to your change, be it a bugfix or a new feature. \
@@ -176,7 +167,7 @@ Here's how to run the test suite:

 |  Command                               | Action                                           |              |
 | :------------------------------------- | :----------------------------------------------- | ------------ |
-|``make test[\#SpecificTestName]``       |  run unit test(s)  | |
+|``make test[\#SpecificTestName]``       |  run unit test(s)  |
 |``make test-sqlite[\#SpecificTestName]``|  run [integration](tests/integration) test(s) for SQLite |[More details](tests/integration/README.md)  |
 |``make test-e2e-sqlite[\#SpecificTestName]``|  run [end-to-end](tests/e2e) test(s) for SQLite |[More details](tests/e2e/README.md)  |

@@ -212,20 +203,10 @@ Some of the key points:

 In the PR title, describe the problem you are fixing, not how you are fixing it. \
 Use the first comment as a summary of your PR. \
-In the PR summary, you can describe exactly how you are fixing this problem.
-
+In the PR summary, you can describe exactly how you are fixing this problem. \
 Keep this summary up-to-date as the PR evolves. \
 If your PR changes the UI, you must add **after** screenshots in the PR summary. \
-If you are not implementing a new feature, you should also post **before** screenshots for comparison.
-
-If you are implementing a new feature, your PR will only be merged if your screenshots are up to date.\
-Furthermore, feature PRs will only be merged if their summary contains a clear usage description (understandable for users) and testing description (understandable for reviewers).
-You should strive to combine both into a single description.
-
-Another requirement for merging PRs is that the PR is labeled correctly.\
-However, this is not your job as a contributor, but the job of the person merging your PR.\
-If you think that your PR was labeled incorrectly, or notice that it was merged without labels, please let us know.
-
+If you are not implementing a new feature, you should also post **before** screenshots for comparison. \
 If your PR closes some issues, you must note that in a way that both GitHub and Gitea understand, i.e. by appending a paragraph like

 ```text
@@ -244,20 +225,17 @@ PRs without a milestone may not be merged.

 ### Labels

-Almost all labels used inside Gitea can be classified as one of the following:
-
- `modifies/…`: Determines which parts of the codebase are affected. These labels will be set through the CI.
- `topic/…`:  Determines the conceptual component of Gitea that is affected, i.e. issues, projects, or authentication. At best, PRs should only target one component but there might be overlap. Must be set manually.
- `type/…`: Determines the type of an issue or PR (feature, refactoring, docs, bug, …). If GitHub supported scoped labels, these labels would be exclusive, so you should set **exactly** one, not more or less (every PR should fall into one of the provided categories, and only one).
- `issue/…` / `pr/…`: Labels that are specific to issues or PRs respectively and that are only necessary in a given context, i.e. `issue/not-a-bug` or `pr/need-2-approvals`
-
-Every PR should be labeled correctly with every label that applies.
-
-There are also some labels that will be managed automatically.\
-In particular, these are
+Every PR should be labeled correctly with every label that applies. \
+This includes especially the distinction between `bug` (fixing existing functionality), `feature` (new functionality), `enhancement` (upgrades for existing functionality), and `refactoring` (improving the internal code structure without changing the output (much)). \
+Furthermore,

 - the amount of pending required approvals
- has all `backport`s or needs a manual backport
+- whether this PR is `blocked`, a `backport` or `breaking`
+- if it targets the `ui` or `api`
+- if it increases the application `speed`
+- reduces `memory usage`
+
+are oftentimes notable labels.

 ### Breaking PRs

@@ -274,16 +252,13 @@ Changing the default value of a setting or replacing the setting with another on

 #### How to handle breaking PRs?

-If your PR has a breaking change, you must add two things to the summary of your PR:
+If your PR has a breaking change, you must add a `BREAKING` section to your PR summary, e.g.

-1. A reasoning why this breaking change is necessary
-2. A `BREAKING` section explaining in simple terms (understandable for a typical user) how this PR affects users and how to mitigate these changes. This section can look for example like
-
-```md
+```
 ## :warning: BREAKING :warning:
 ```

-Breaking PRs will not be merged as long as not both of these requirements are met.
+To explain how this will affect users and how to mitigate these changes.

 ### Maintaining open PRs

@@ -358,12 +333,11 @@ $REWRITTEN_PR_SUMMARY

 ## Documentation

-If you add a new feature or change an existing aspect of Gitea, the documentation for that feature must be created or updated in another PR at [https://gitea.com/gitea/docs](https://gitea.com/gitea/docs).
-**The docs directory on main repository will be removed at some time. We will have a yaml file to store configuration file's meta data. After that completed, configuration documentation should be in the main repository.**
+If you add a new feature or change an existing aspect of Gitea, the documentation for that feature must be created or updated in the same PR.

 ## API v1

-The API is documented by [swagger](https://gitea.com/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).
+The API is documented by [swagger](http://try.gitea.io/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).

 ### GitHub API compatibility

@@ -465,7 +439,7 @@ We assume in good faith that the information you provide is legally binding.
 We adopted a release schedule to streamline the process of working on, finishing, and issuing releases. \
 The overall goal is to make a major release every three or four months, which breaks down into two or three months of general development followed by one month of testing and polishing known as the release freeze. \
 All the feature pull requests should be
-merged before feature freeze. All feature pull requests haven't been merged before this feature freeze will be moved to next milestone, please notice our feature freeze announcement on discord. And, during the frozen period, a corresponding
+merged before feature freeze. And, during the frozen period, a corresponding
 release branch is open for fixes backported from main branch. Release candidates
 are made during this period for user testing to
 obtain a final version that is maintained in this branch.
@@ -496,53 +470,36 @@ if possible provide GPG signed commits.
 https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
 https://help.github.com/articles/signing-commits-with-gpg/

-Furthermore, any account with write access (like bots and TOC members) **must** use 2FA.
-https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
-
 ## Technical Oversight Committee (TOC)

-At the start of 2023, the `Owners` team was dissolved. Instead, the governance charter proposed a technical oversight committee (TOC) which expands the ownership team of the Gitea project from three elected positions to six positions. Three positions are elected as it has been over the past years, and the other three consist of appointed members from the Gitea company.
+At the start of 2023, the `Owners` team was dissolved. Instead, the governance charter proposed a technical oversight committee (TOC) which expands the ownership team of the Gitea project from three elected positions to six positions. Three positions would be elected as it has been over the past years, and the other three would consist of appointed members from the Gitea company.
 https://blog.gitea.com/quarterly-23q1/

-### TOC election process
-
-Any maintainer is eligible to be part of the community TOC if they are not associated with the Gitea company.
-A maintainer can either nominate themselves, or can be nominated by other maintainers to be a candidate for the TOC election.
-If you are nominated by someone else, you must first accept your nomination before the vote starts to be a candidate.
-
-The TOC is elected for one year, the TOC election happens yearly.
-After the announcement of the results of the TOC election, elected members have two weeks time to confirm or refuse the seat.
-If an elected member does not answer within this timeframe, they are automatically assumed to refuse the seat.
-Refusals result in the person with the next highest vote getting the same choice.
-As long as seats are empty in the TOC, members of the previous TOC can fill them until an elected member accepts the seat.
-
-If an elected member that accepts the seat does not have 2FA configured yet, they will be temporarily counted as `answer pending` until they manage to configure 2FA, thus leaving their seat empty for this duration.
+When the new community members have been elected, the old members will give up ownership to the newly elected members. For security reasons, TOC members or any account with write access (like a bot) must use 2FA.
+https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/

 ### Current TOC members

- 2024-01-01 ~ 2024-12-31
+- 2023-01-01 ~ 2023-12-31 - https://blog.gitea.com/quarterly-23q1/
  - Company
    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
-    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
+    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.io>
  - Community
    - [6543](https://gitea.com/6543) <6543@obermui.de>
-    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
+    - [Andrew Thornton](https://gitea.com/zeripath) <art27@cantab.net>
    - [John Olheiser](https://gitea.com/jolheiser) <john.olheiser@gmail.com>

 ### Previous TOC/owners members

 Here's the history of the owners and the time they served:

- [Lunny Xiao](https://gitea.com/lunny) - 2016, 2017, [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
+- [Lunny Xiao](https://gitea.com/lunny) - 2016, 2017, [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872)
 - [Kim Carlbäcker](https://github.com/bkcsoft) - 2016, 2017
 - [Thomas Boerger](https://gitea.com/tboerger) - 2016, 2017
 - [Lauris Bukšis-Haberkorns](https://gitea.com/lafriks) - [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801)
- [Matti Ranta](https://gitea.com/techknowlogick) - [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [6543](https://gitea.com/6543) - 2023
- [John Olheiser](https://gitea.com/jolheiser) - 2023
- [Jason Song](https://gitea.com/wolfogre) - 2023
+- [Matti Ranta](https://gitea.com/techknowlogick) - [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872)
+- [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872)

 ## Governance Compensation

--- a/12
+++ b/12
@@ -1,12 +1,12 @@
 # Build stage
-FROM docker.io/library/golang:1.23-alpine3.20 AS build-env
+FROM docker.io/library/golang:1.21-alpine3.18 AS build-env

 ARG GOPROXY
-ENV GOPROXY=${GOPROXY:-direct}
+ENV GOPROXY ${GOPROXY:-direct}

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
-ENV TAGS="bindata timetzdata $TAGS"
+ENV TAGS "bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

 # Build deps
@@ -41,7 +41,7 @@ RUN chmod 755 /tmp/local/usr/bin/entrypoint \
              /go/src/code.gitea.io/gitea/environment-to-ini
 RUN chmod 644 /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete

-FROM docker.io/library/alpine:3.20
+FROM docker.io/library/alpine:3.18
 LABEL maintainer="maintainers@gitea.io"

 EXPOSE 22 3000
@@ -72,8 +72,8 @@ RUN addgroup \
    git && \
  echo "git:*" | chpasswd -e

-ENV USER=git
-ENV GITEA_CUSTOM=/data/gitea
+ENV USER git
+ENV GITEA_CUSTOM /data/gitea

 VOLUME ["/data"]

--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -1,12 +1,12 @@
 # Build stage
-FROM docker.io/library/golang:1.23-alpine3.20 AS build-env
+FROM docker.io/library/golang:1.21-alpine3.18 AS build-env

 ARG GOPROXY
-ENV GOPROXY=${GOPROXY:-direct}
+ENV GOPROXY ${GOPROXY:-direct}

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
-ENV TAGS="bindata timetzdata $TAGS"
+ENV TAGS "bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

 #Build deps
@@ -39,7 +39,7 @@ RUN chmod 755 /tmp/local/usr/local/bin/docker-entrypoint.sh \
              /go/src/code.gitea.io/gitea/environment-to-ini
 RUN chmod 644 /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete

-FROM docker.io/library/alpine:3.20
+FROM docker.io/library/alpine:3.18
 LABEL maintainer="maintainers@gitea.io"

 EXPOSE 2222 3000
@@ -75,14 +75,14 @@ COPY --from=build-env /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_au

 # git:git
 USER 1000:1000
-ENV GITEA_WORK_DIR=/var/lib/gitea
-ENV GITEA_CUSTOM=/var/lib/gitea/custom
-ENV GITEA_TEMP=/tmp/gitea
-ENV TMPDIR=/tmp/gitea
+ENV GITEA_WORK_DIR /var/lib/gitea
+ENV GITEA_CUSTOM /var/lib/gitea/custom
+ENV GITEA_TEMP /tmp/gitea
+ENV TMPDIR /tmp/gitea

 # TODO add to docs the ability to define the ini to load (useful to test and revert a config)
-ENV GITEA_APP_INI=/etc/gitea/app.ini
-ENV HOME="/var/lib/gitea/git"
+ENV GITEA_APP_INI /etc/gitea/app.ini
+ENV HOME "/var/lib/gitea/git"
 VOLUME ["/var/lib/gitea", "/etc/gitea"]
 WORKDIR /var/lib/gitea

--- a/8
+++ b/8
@@ -46,6 +46,7 @@ Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
 Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
+Eddie Yang <576951401@qq.com> (@yp05327)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)
 wxiaoguang <wxiaoguang@gmail.com> (@wxiaoguang)
@@ -56,10 +57,3 @@ Punit Inani <punitinani1@gmail.com> (@puni9869)
 CaiCandong  <1290147055@qq.com> (@caicandong)
 Rui Chen  <rui@chenrui.dev> (@chenrui333)
 Nanguan Lin <nanguanlin6@gmail.com> (@lng2020)
-kerwin612 <kerwin612@qq.com> (@kerwin612)
-Gary Wang <git@blumia.net> (@BLumia)
-Tim-Niclas Oelschläger <zokki.softwareschmiede@gmail.com> (@zokkis)
-Yu Liu <1240335630@qq.com> (@HEREYUA)
-Kemal Zebari <kemalzebra@gmail.com> (@kemzeb)
-Rowan Bohde <rowan.bohde@gmail.com> (@bohde)
-hiifong <i@hiif.ong> (@hiifong)
--- a/214
+++ b/214
@@ -23,38 +23,36 @@ SHASUM ?= shasum -a 256
 HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
 COMMA := ,

-XGO_VERSION := go-1.23.x
+XGO_VERSION := go-1.21.x

-AIR_PACKAGE ?= github.com/air-verse/air@v1
+AIR_PACKAGE ?= github.com/cosmtrek/air@v1.44.0
 EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/cmd/editorconfig-checker@2.7.0
-GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.7.0
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.2
+GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.5.0
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.1
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.11
-MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.5.1
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.31.0
+MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.4.1
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.30.5
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
-GO_LICENSES_PACKAGE ?= github.com/google/go-licenses@v1
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
-ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1
-GOPLS_PACKAGE ?= golang.org/x/tools/gopls@v0.15.3
+GO_LICENSES_PACKAGE ?= github.com/google/go-licenses@v1.6.0
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.0.1
+ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.6.25

 DOCKER_IMAGE ?= gitea/gitea
 DOCKER_TAG ?= latest
 DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)

 ifeq ($(HAS_GO), yes)
+	GOPATH ?= $(shell $(GO) env GOPATH)
+	export PATH := $(GOPATH)/bin:$(PATH)
+
 	CGO_EXTRA_CFLAGS := -DSQLITE_MAX_VARIABLE_NUMBER=32766
 	CGO_CFLAGS ?= $(shell $(GO) env CGO_CFLAGS) $(CGO_EXTRA_CFLAGS)
 endif

-ifeq ($(GOOS),windows)
-	IS_WINDOWS := yes
-else ifeq ($(patsubst Windows%,Windows,$(OS)),Windows)
-	ifeq ($(GOOS),)
-		IS_WINDOWS := yes
-	endif
-endif
-ifeq ($(IS_WINDOWS),yes)
+ifeq ($(OS), Windows_NT)
+	GOFLAGS := -v -buildmode=exe
+	EXECUTABLE ?= gitea.exe
+else ifeq ($(OS), Windows)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= gitea.exe
 else
@@ -89,7 +87,7 @@ ifneq ($(GITHUB_REF_TYPE),branch)
 	GITEA_VERSION ?= $(VERSION)
 else
 	ifneq ($(GITHUB_REF_NAME),)
-		VERSION ?= $(subst release/v,,$(GITHUB_REF_NAME))-nightly
+		VERSION ?= $(subst release/v,,$(GITHUB_REF_NAME))
 	else
 		VERSION ?= main
 	endif
@@ -111,15 +109,16 @@ LDFLAGS := $(LDFLAGS) -X "main.MakeVersion=$(MAKE_VERSION)" -X "main.Version=$(G

 LINUX_ARCHS ?= linux/amd64,linux/386,linux/arm-5,linux/arm-6,linux/arm64

+GO_PACKAGES ?= $(filter-out code.gitea.io/gitea/tests/integration/migration-test code.gitea.io/gitea/tests code.gitea.io/gitea/tests/integration code.gitea.io/gitea/tests/e2e,$(shell $(GO) list ./... | grep -v /vendor/))
 GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list code.gitea.io/gitea/models/migrations/...) code.gitea.io/gitea/tests/integration/migration-test code.gitea.io/gitea/tests code.gitea.io/gitea/tests/integration code.gitea.io/gitea/tests/e2e,$(shell $(GO) list ./... | grep -v /vendor/))
 MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list code.gitea.io/gitea/models/migrations/...)

 FOMANTIC_WORK_DIR := web_src/fomantic

 WEBPACK_SOURCES := $(shell find web_src/js web_src/css -type f)
-WEBPACK_CONFIGS := webpack.config.js tailwind.config.js
+WEBPACK_CONFIGS := webpack.config.js
 WEBPACK_DEST := public/assets/js/index.js public/assets/css/index.css
-WEBPACK_DEST_ENTRIES := public/assets/js public/assets/css public/assets/fonts
+WEBPACK_DEST_ENTRIES := public/assets/js public/assets/css public/assets/fonts public/assets/img/webpack

 BINDATA_DEST := modules/public/bindata.go modules/options/bindata.go modules/templates/bindata.go
 BINDATA_HASH := $(addsuffix .hash,$(BINDATA_DEST))
@@ -137,17 +136,14 @@ TAGS ?=
 TAGS_SPLIT := $(subst $(COMMA), ,$(TAGS))
 TAGS_EVIDENCE := $(MAKE_EVIDENCE_DIR)/tags

-TEST_TAGS ?= $(TAGS_SPLIT) sqlite sqlite_unlock_notify
+TEST_TAGS ?= sqlite sqlite_unlock_notify

 TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(FOMANTIC_WORK_DIR)/node_modules $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR) $(GO_LICENSE_TMP_DIR)

 GO_DIRS := build cmd models modules routers services tests
 WEB_DIRS := web_src/js web_src/css

-ESLINT_FILES := web_src/js tools *.js *.ts tests/e2e
-STYLELINT_FILES := web_src/css web_src/js/components/*.vue
-SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.ini .github $(filter-out CHANGELOG.md, $(wildcard *.go *.js *.md *.yml *.yaml *.toml))
-EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.ini
+SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) docs/content templates options/locale/locale_en-US.ini .github

 GO_SOURCES := $(wildcard *.go)
 GO_SOURCES += $(shell find $(GO_DIRS) -type f -name "*.go" ! -path modules/options/bindata.go ! -path modules/public/bindata.go ! -path modules/templates/bindata.go)
@@ -165,8 +161,8 @@ ifdef DEPS_PLAYWRIGHT
 endif

 SWAGGER_SPEC := templates/swagger/v1_json.tmpl
-SWAGGER_SPEC_S_TMPL := s|"basePath": *"/api/v1"|"basePath": "{{AppSubUrl \| JSEscape}}/api/v1"|g
-SWAGGER_SPEC_S_JSON := s|"basePath": *"{{AppSubUrl \| JSEscape}}/api/v1"|"basePath": "/api/v1"|g
+SWAGGER_SPEC_S_TMPL := s|"basePath": *"/api/v1"|"basePath": "{{AppSubUrl \| JSEscape \| Safe}}/api/v1"|g
+SWAGGER_SPEC_S_JSON := s|"basePath": *"{{AppSubUrl \| JSEscape \| Safe}}/api/v1"|"basePath": "/api/v1"|g
 SWAGGER_EXCLUDE := code.gitea.io/sdk
 SWAGGER_NEWLINE_COMMAND := -e '$$a\'

@@ -174,12 +170,15 @@ TEST_MYSQL_HOST ?= mysql:3306
 TEST_MYSQL_DBNAME ?= testgitea
 TEST_MYSQL_USERNAME ?= root
 TEST_MYSQL_PASSWORD ?=
+TEST_MYSQL8_HOST ?= mysql8:3306
+TEST_MYSQL8_DBNAME ?= testgitea
+TEST_MYSQL8_USERNAME ?= root
+TEST_MYSQL8_PASSWORD ?=
 TEST_PGSQL_HOST ?= pgsql:5432
 TEST_PGSQL_DBNAME ?= testgitea
 TEST_PGSQL_USERNAME ?= postgres
 TEST_PGSQL_PASSWORD ?= postgres
 TEST_PGSQL_SCHEMA ?= gtestschema
-TEST_MINIO_ENDPOINT ?= minio:9000
 TEST_MSSQL_HOST ?= mssql:1433
 TEST_MSSQL_DBNAME ?= gitea
 TEST_MSSQL_USERNAME ?= sa
@@ -215,7 +214,6 @@ help:
 	@echo " - lint-go                          lint go files"
 	@echo " - lint-go-fix                      lint go files and fix issues"
 	@echo " - lint-go-vet                      lint go files with vet"
-	@echo " - lint-go-gopls                    lint go files with gopls"
 	@echo " - lint-js                          lint js files"
 	@echo " - lint-js-fix                      lint js files and fix issues"
 	@echo " - lint-css                         lint css files"
@@ -285,19 +283,20 @@ clean-all: clean

 .PHONY: clean
 clean:
+	$(GO) clean -i ./...
 	rm -rf $(EXECUTABLE) $(DIST) $(BINDATA_DEST) $(BINDATA_HASH) \
 		integrations*.test \
 		e2e*.test \
-		tests/integration/gitea-integration-* \
-		tests/integration/indexers-* \
-		tests/mysql.ini tests/pgsql.ini tests/mssql.ini man/ \
-		tests/e2e/gitea-e2e-*/ \
-		tests/e2e/indexers-*/ \
-		tests/e2e/reports/ tests/e2e/test-artifacts/ tests/e2e/test-snapshots/
+		tests/integration/gitea-integration-pgsql/ tests/integration/gitea-integration-mysql/ tests/integration/gitea-integration-mysql8/ tests/integration/gitea-integration-sqlite/ \
+		tests/integration/gitea-integration-mssql/ tests/integration/indexers-mysql/ tests/integration/indexers-mysql8/ tests/integration/indexers-pgsql tests/integration/indexers-sqlite \
+		tests/integration/indexers-mssql tests/mysql.ini tests/mysql8.ini tests/pgsql.ini tests/mssql.ini man/ \
+		tests/e2e/gitea-e2e-pgsql/ tests/e2e/gitea-e2e-mysql/ tests/e2e/gitea-e2e-mysql8/ tests/e2e/gitea-e2e-sqlite/ \
+		tests/e2e/gitea-e2e-mssql/ tests/e2e/indexers-mysql/ tests/e2e/indexers-mysql8/ tests/e2e/indexers-pgsql/ tests/e2e/indexers-sqlite/ \
+		tests/e2e/indexers-mssql/ tests/e2e/reports/ tests/e2e/test-artifacts/ tests/e2e/test-snapshots/

 .PHONY: fmt
 fmt:
-	@GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run build/code-batch-process.go gitea-fmt -w '{file-list}'
+	GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run build/code-batch-process.go gitea-fmt -w '{file-list}'
 	$(eval TEMPLATES := $(shell find templates -type f -name '*.tmpl'))
 	@# strip whitespace after '{{' or '(' and before '}}' or ')' unless there is only
 	@# whitespace before it
@@ -369,28 +368,26 @@ lint-frontend: lint-js lint-css
 lint-frontend-fix: lint-js-fix lint-css-fix

 .PHONY: lint-backend
-lint-backend: lint-go lint-go-vet lint-go-gopls lint-editorconfig
+lint-backend: lint-go lint-go-vet lint-editorconfig

 .PHONY: lint-backend-fix
 lint-backend-fix: lint-go-fix lint-go-vet lint-editorconfig

 .PHONY: lint-js
 lint-js: node_modules
-	npx eslint --color --max-warnings=0 --ext js,ts,vue $(ESLINT_FILES)
-	npx vue-tsc
+	npx eslint --color --max-warnings=0 --ext js,vue web_src/js build *.config.js tests/e2e

 .PHONY: lint-js-fix
 lint-js-fix: node_modules
-	npx eslint --color --max-warnings=0 --ext js,ts,vue $(ESLINT_FILES) --fix
-	npx vue-tsc
+	npx eslint --color --max-warnings=0 --ext js,vue web_src/js build *.config.js tests/e2e --fix

 .PHONY: lint-css
 lint-css: node_modules
-	npx stylelint --color --max-warnings=0 $(STYLELINT_FILES)
+	npx stylelint --color --max-warnings=0 web_src/css web_src/js/components/*.vue

 .PHONY: lint-css-fix
 lint-css-fix: node_modules
-	npx stylelint --color --max-warnings=0 $(STYLELINT_FILES) --fix
+	npx stylelint --color --max-warnings=0 web_src/css web_src/js/components/*.vue --fix

 .PHONY: lint-swagger
 lint-swagger: node_modules
@@ -398,15 +395,15 @@ lint-swagger: node_modules

 .PHONY: lint-md
 lint-md: node_modules
-	npx markdownlint *.md
+	npx markdownlint docs *.md

 .PHONY: lint-spell
 lint-spell:
-	@go run $(MISSPELL_PACKAGE) -dict tools/misspellings.csv -error $(SPELLCHECK_FILES)
+	@go run $(MISSPELL_PACKAGE) -error $(SPELLCHECK_FILES)

 .PHONY: lint-spell-fix
 lint-spell-fix:
-	@go run $(MISSPELL_PACKAGE) -dict tools/misspellings.csv -w $(SPELLCHECK_FILES)
+	@go run $(MISSPELL_PACKAGE) -w $(SPELLCHECK_FILES)

 .PHONY: lint-go
 lint-go:
@@ -427,24 +424,18 @@ lint-go-windows:
 lint-go-vet:
 	@echo "Running go vet..."
 	@GOOS= GOARCH= $(GO) build code.gitea.io/gitea-vet
-	@$(GO) vet -vettool=gitea-vet ./...
-
-.PHONY: lint-go-gopls
-lint-go-gopls:
-	@echo "Running gopls check..."
-	@GO=$(GO) GOPLS_PACKAGE=$(GOPLS_PACKAGE) tools/lint-go-gopls.sh $(GO_SOURCES_NO_BINDATA)
+	@$(GO) vet -vettool=gitea-vet $(GO_PACKAGES)

 .PHONY: lint-editorconfig
 lint-editorconfig:
-	@$(GO) run $(EDITORCONFIG_CHECKER_PACKAGE) $(EDITORCONFIG_FILES)
+	$(GO) run $(EDITORCONFIG_CHECKER_PACKAGE) templates .github/workflows

 .PHONY: lint-actions
 lint-actions:
 	$(GO) run $(ACTIONLINT_PACKAGE)

 .PHONY: lint-templates
-lint-templates: .venv node_modules
-	@node tools/lint-templates-svg.js
+lint-templates: .venv
 	@poetry run djlint $(shell find templates -type f -iname '*.tmpl')

 .PHONY: lint-yaml
@@ -453,7 +444,7 @@ lint-yaml: .venv

 .PHONY: watch
 watch:
-	@bash tools/watch.sh
+	@bash build/watch.sh

 .PHONY: watch-frontend
 watch-frontend: node-check node_modules
@@ -569,13 +560,33 @@ test-mysql\#%: integrations.mysql.test generate-ini-mysql
 .PHONY: test-mysql-migration
 test-mysql-migration: migrations.mysql.test migrations.individual.mysql.test

+generate-ini-mysql8:
+	sed -e 's|{{TEST_MYSQL8_HOST}}|${TEST_MYSQL8_HOST}|g' \
+		-e 's|{{TEST_MYSQL8_DBNAME}}|${TEST_MYSQL8_DBNAME}|g' \
+		-e 's|{{TEST_MYSQL8_USERNAME}}|${TEST_MYSQL8_USERNAME}|g' \
+		-e 's|{{TEST_MYSQL8_PASSWORD}}|${TEST_MYSQL8_PASSWORD}|g' \
+		-e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
+		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
+		-e 's|{{TEST_TYPE}}|$(or $(TEST_TYPE),integration)|g' \
+			tests/mysql8.ini.tmpl > tests/mysql8.ini
+
+.PHONY: test-mysql8
+test-mysql8: integrations.mysql8.test generate-ini-mysql8
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql8.ini ./integrations.mysql8.test
+
+.PHONY: test-mysql8\#%
+test-mysql8\#%: integrations.mysql8.test generate-ini-mysql8
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql8.ini ./integrations.mysql8.test -test.run $(subst .,/,$*)
+
+.PHONY: test-mysql8-migration
+test-mysql8-migration: migrations.mysql8.test migrations.individual.mysql8.test
+
 generate-ini-pgsql:
 	sed -e 's|{{TEST_PGSQL_HOST}}|${TEST_PGSQL_HOST}|g' \
 		-e 's|{{TEST_PGSQL_DBNAME}}|${TEST_PGSQL_DBNAME}|g' \
 		-e 's|{{TEST_PGSQL_USERNAME}}|${TEST_PGSQL_USERNAME}|g' \
 		-e 's|{{TEST_PGSQL_PASSWORD}}|${TEST_PGSQL_PASSWORD}|g' \
 		-e 's|{{TEST_PGSQL_SCHEMA}}|${TEST_PGSQL_SCHEMA}|g' \
-		-e 's|{{TEST_MINIO_ENDPOINT}}|${TEST_MINIO_ENDPOINT}|g' \
 		-e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
 		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
 		-e 's|{{TEST_TYPE}}|$(or $(TEST_TYPE),integration)|g' \
@@ -614,7 +625,8 @@ test-mssql\#%: integrations.mssql.test generate-ini-mssql
 test-mssql-migration: migrations.mssql.test migrations.individual.mssql.test

 .PHONY: playwright
-playwright: deps-frontend
+playwright: $(PLAYWRIGHT_DIR)
+	npm install --no-save @playwright/test
 	npx playwright install $(PLAYWRIGHT_FLAGS)

 .PHONY: test-e2e%
@@ -641,6 +653,14 @@ test-e2e-mysql: playwright e2e.mysql.test generate-ini-mysql
 test-e2e-mysql\#%: playwright e2e.mysql.test generate-ini-mysql
 	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./e2e.mysql.test -test.run TestE2e/$*

+.PHONY: test-e2e-mysql8
+test-e2e-mysql8: playwright e2e.mysql8.test generate-ini-mysql8
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql8.ini ./e2e.mysql8.test
+
+.PHONY: test-e2e-mysql8\#%
+test-e2e-mysql8\#%: playwright e2e.mysql8.test generate-ini-mysql8
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql8.ini ./e2e.mysql8.test -test.run TestE2e/$*
+
 .PHONY: test-e2e-pgsql
 test-e2e-pgsql: playwright e2e.pgsql.test generate-ini-pgsql
 	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./e2e.pgsql.test
@@ -684,6 +704,9 @@ integration-test-coverage-sqlite: integrations.cover.sqlite.test generate-ini-sq
 integrations.mysql.test: git-check $(GO_SOURCES)
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.mysql.test

+integrations.mysql8.test: git-check $(GO_SOURCES)
+	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.mysql8.test
+
 integrations.pgsql.test: git-check $(GO_SOURCES)
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.pgsql.test

@@ -704,6 +727,11 @@ migrations.mysql.test: $(GO_SOURCES) generate-ini-mysql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mysql.test
 	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./migrations.mysql.test

+.PHONY: migrations.mysql8.test
+migrations.mysql8.test: $(GO_SOURCES) generate-ini-mysql8
+	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mysql8.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql8.ini ./migrations.mysql8.test
+
 .PHONY: migrations.pgsql.test
 migrations.pgsql.test: $(GO_SOURCES) generate-ini-pgsql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.pgsql.test
@@ -723,7 +751,13 @@ migrations.sqlite.test: $(GO_SOURCES) generate-ini-sqlite
 migrations.individual.mysql.test: $(GO_SOURCES)
 	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

-.PHONY: migrations.individual.sqlite.test\#%
+.PHONY: migrations.individual.mysql8.test
+migrations.individual.mysql8.test: $(GO_SOURCES)
+	for pkg in $(shell $(GO) list code.gitea.io/gitea/models/migrations/...); do \
+		GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql8.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' $$pkg; \
+	done
+
+.PHONY: migrations.individual.mysql8.test\#%
 migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
 	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

@@ -754,6 +788,9 @@ migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
 e2e.mysql.test: $(GO_SOURCES)
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.mysql.test

+e2e.mysql8.test: $(GO_SOURCES)
+	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.mysql8.test
+
 e2e.pgsql.test: $(GO_SOURCES)
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.pgsql.test

@@ -789,7 +826,7 @@ generate-backend: $(TAGS_PREREQ) generate-go
 .PHONY: generate-go
 generate-go: $(TAGS_PREREQ)
 	@echo "Running go generate..."
-	@CC= GOOS= GOARCH= CGO_ENABLED=0 $(GO) generate -tags '$(TAGS)' ./...
+	@CC= GOOS= GOARCH= $(GO) generate -tags '$(TAGS)' $(GO_PACKAGES)

 .PHONY: security-check
 security-check:
@@ -799,7 +836,7 @@ $(EXECUTABLE): $(GO_SOURCES) $(TAGS_PREREQ)
 	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(LDFLAGS)' -o $@

 .PHONY: release
-release: frontend generate release-windows release-linux release-darwin release-freebsd release-copy release-compress vendor release-sources release-check
+release: frontend generate release-windows release-linux release-darwin release-freebsd release-copy release-compress vendor release-sources release-docs release-check

 $(DIST_DIRS):
 	mkdir -p $(DIST_DIRS)
@@ -845,6 +882,14 @@ release-sources: | $(DIST_DIRS)
 	tar $(addprefix $(EXCL),$(TAR_EXCLUDES)) $(TRANSFORM) -czf $(DIST)/release/gitea-src-$(VERSION).tar.gz .
 	rm -f $(STORED_VERSION_FILE)

+.PHONY: release-docs
+release-docs: | $(DIST_DIRS) docs
+	tar -czf $(DIST)/release/gitea-docs-$(VERSION).tar.gz -C ./docs .
+
+.PHONY: docs
+docs:
+	cd docs; bash scripts/trans-copy.sh;
+
 .PHONY: deps
 deps: deps-frontend deps-backend deps-tools deps-py

@@ -860,26 +905,24 @@ deps-backend:

 .PHONY: deps-tools
 deps-tools:
-	$(GO) install $(AIR_PACKAGE) & \
-	$(GO) install $(EDITORCONFIG_CHECKER_PACKAGE) & \
-	$(GO) install $(GOFUMPT_PACKAGE) & \
-	$(GO) install $(GOLANGCI_LINT_PACKAGE) & \
-	$(GO) install $(GXZ_PACKAGE) & \
-	$(GO) install $(MISSPELL_PACKAGE) & \
-	$(GO) install $(SWAGGER_PACKAGE) & \
-	$(GO) install $(XGO_PACKAGE) & \
-	$(GO) install $(GO_LICENSES_PACKAGE) & \
-	$(GO) install $(GOVULNCHECK_PACKAGE) & \
-	$(GO) install $(ACTIONLINT_PACKAGE) & \
-	$(GO) install $(GOPLS_PACKAGE) & \
-	wait
+	$(GO) install $(AIR_PACKAGE)
+	$(GO) install $(EDITORCONFIG_CHECKER_PACKAGE)
+	$(GO) install $(GOFUMPT_PACKAGE)
+	$(GO) install $(GOLANGCI_LINT_PACKAGE)
+	$(GO) install $(GXZ_PACKAGE)
+	$(GO) install $(MISSPELL_PACKAGE)
+	$(GO) install $(SWAGGER_PACKAGE)
+	$(GO) install $(XGO_PACKAGE)
+	$(GO) install $(GO_LICENSES_PACKAGE)
+	$(GO) install $(GOVULNCHECK_PACKAGE)
+	$(GO) install $(ACTIONLINT_PACKAGE)

 node_modules: package-lock.json
 	npm install --no-save
 	@touch node_modules

 .venv: poetry.lock
-	poetry install
+	poetry install --no-root
 	@touch .venv

 .PHONY: update
@@ -890,8 +933,6 @@ update-js: node-check | node_modules
 	npx updates -u -f package.json
 	rm -rf node_modules package-lock.json
 	npm install --package-lock
-	npx nolyfill install
-	npm install --package-lock
 	@touch node_modules

 .PHONY: update-py
@@ -907,7 +948,6 @@ fomantic:
 	cd $(FOMANTIC_WORK_DIR) && npm install --no-save
 	cp -f $(FOMANTIC_WORK_DIR)/theme.config.less $(FOMANTIC_WORK_DIR)/node_modules/fomantic-ui/src/theme.config
 	cp -rf $(FOMANTIC_WORK_DIR)/_site $(FOMANTIC_WORK_DIR)/node_modules/fomantic-ui/src/
-	$(SED_INPLACE) -e 's/  overrideBrowserslist\r/  overrideBrowserslist: ["defaults"]\r/g' $(FOMANTIC_WORK_DIR)/node_modules/fomantic-ui/tasks/config/tasks.js
 	cd $(FOMANTIC_WORK_DIR) && npx gulp -f node_modules/fomantic-ui/gulpfile.js build
 	# fomantic uses "touchstart" as click event for some browsers, it's not ideal, so we force fomantic to always use "click" as click event
 	$(SED_INPLACE) -e 's/clickEvent[ \t]*=/clickEvent = "click", unstableClickEvent =/g' $(FOMANTIC_WORK_DIR)/build/semantic.js
@@ -919,15 +959,14 @@ webpack: $(WEBPACK_DEST)

 $(WEBPACK_DEST): $(WEBPACK_SOURCES) $(WEBPACK_CONFIGS) package-lock.json
 	@$(MAKE) -s node-check node_modules
-	@rm -rf $(WEBPACK_DEST_ENTRIES)
-	@echo "Running webpack..."
-	@BROWSERSLIST_IGNORE_OLD_DATA=true npx webpack
+	rm -rf $(WEBPACK_DEST_ENTRIES)
+	npx webpack
 	@touch $(WEBPACK_DEST)

 .PHONY: svg
 svg: node-check | node_modules
 	rm -rf $(SVG_DEST_DIR)
-	node tools/generate-svg.js
+	node build/generate-svg.js

 .PHONY: svg-check
 svg-check: svg
@@ -970,8 +1009,8 @@ generate-gitignore:

 .PHONY: generate-images
 generate-images: | node_modules
-	npm install --no-save fabric@6 imagemin-zopfli@7
-	node tools/generate-images.js $(TAGS)
+	npm install --no-save --no-package-lock fabric@5 imagemin-zopfli@7
+	node build/generate-images.js $(TAGS)

 .PHONY: generate-manpage
 generate-manpage:
@@ -988,8 +1027,3 @@ docker:

 # This endif closes the if at the top of the file
 endif
-
-# Disable parallel execution because it would break some targets that don't
-# specify exact dependencies like 'backend' which does currently not depend
-# on 'frontend' to enable Node.js-less builds from source tarballs.
-.NOTPARALLEL:
--- a/README.md
+++ b/README.md
@@ -1,17 +1,58 @@
-# Gitea
+<p align="center">
+  <a href="https://gitea.io/">
+    <img alt="Gitea" src="https://raw.githubusercontent.com/go-gitea/gitea/main/public/assets/img/gitea.svg" width="220"/>
+  </a>
+</p>
+<h1 align="center">Gitea - Git with a cup of tea</h1>

-[![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
-[![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
-[![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
-[![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
-[![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
-[![Contribute with Gitpod](https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod&color=green)](https://gitpod.io/#https://github.com/go-gitea/gitea)
-[![](https://badges.crowdin.net/gitea/localized.svg)](https://crowdin.com/project/gitea "Crowdin")
+<p align="center">
+  <a href="https://drone.gitea.io/go-gitea/gitea" title="Build Status">
+    <img src="https://drone.gitea.io/api/badges/go-gitea/gitea/status.svg?ref=refs/heads/main">
+  </a>
+  <a href="https://discord.gg/Gitea" title="Join the Discord chat at https://discord.gg/Gitea">
+    <img src="https://img.shields.io/discord/322538954119184384.svg">
+  </a>
+  <a href="https://app.codecov.io/gh/go-gitea/gitea" title="Codecov">
+    <img src="https://codecov.io/gh/go-gitea/gitea/branch/main/graph/badge.svg">
+  </a>
+  <a href="https://goreportcard.com/report/code.gitea.io/gitea" title="Go Report Card">
+    <img src="https://goreportcard.com/badge/code.gitea.io/gitea">
+  </a>
+  <a href="https://pkg.go.dev/code.gitea.io/gitea" title="GoDoc">
+    <img src="https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg">
+  </a>
+  <a href="https://github.com/go-gitea/gitea/releases/latest" title="GitHub release">
+    <img src="https://img.shields.io/github/release/go-gitea/gitea.svg">
+  </a>
+  <a href="https://www.codetriage.com/go-gitea/gitea" title="Help Contribute to Open Source">
+    <img src="https://www.codetriage.com/go-gitea/gitea/badges/users.svg">
+  </a>
+  <a href="https://opencollective.com/gitea" title="Become a backer/sponsor of gitea">
+    <img src="https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen">
+  </a>
+  <a href="https://opensource.org/licenses/MIT" title="License: MIT">
+    <img src="https://img.shields.io/badge/License-MIT-blue.svg">
+  </a>
+  <a href="https://gitpod.io/#https://github.com/go-gitea/gitea">
+  <img
+    src="https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod"
+    alt="Contribute with Gitpod"
+  />
+  </a>
+  <a href="https://crowdin.com/project/gitea" title="Crowdin">
+    <img src="https://badges.crowdin.net/gitea/localized.svg">
+  </a>
+  <a href="https://www.tickgit.com/browse?repo=github.com/go-gitea/gitea&branch=main" title="TODOs">
+    <img src="https://badgen.net/https/api.tickgit.com/badgen/github.com/go-gitea/gitea/main">
+  </a>
+  <a href="https://app.bountysource.com/teams/gitea" title="Bountysource">
+    <img src="https://img.shields.io/bountysource/team/gitea/activity">
+  </a>
+</p>

-[View this document in Chinese](./README_ZH.md)
+<p align="center">
+  <a href="README_ZH.md">View this document in Chinese</a>
+</p>

 ## Purpose

@@ -21,16 +62,11 @@ painless way of setting up a self-hosted Git service.
 As Gitea is written in Go, it works across **all** the platforms and
 architectures that are supported by Go, including Linux, macOS, and
 Windows on x86, amd64, ARM and PowerPC architectures.
+You can try it out using [the online demo](https://try.gitea.io/).
 This project has been
 [forked](https://blog.gitea.com/welcome-to-gitea/) from
 [Gogs](https://gogs.io) since November of 2016, but a lot has changed.

-For online demonstrations, you can visit [demo.gitea.com](https://demo.gitea.com).
-
-For accessing free Gitea service (with a limited number of repositories), you can visit [gitea.com](https://gitea.com/user/login).
-
-To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at [cloud.gitea.com](https://cloud.gitea.com).
-
 ## Building

 From the root of the source tree, run:
@@ -48,23 +84,25 @@ The `build` target is split into two sub-targets:

 Internet connectivity is required to download the go and npm modules. When building from the official source tarballs which include pre-built frontend files, the `frontend` target will not be triggered, making it possible to build without Node.js.

+Parallelism (`make -j <num>`) is not supported.
+
 More info: https://docs.gitea.com/installation/install-from-source

 ## Using

    ./gitea web

-> [!NOTE]
-> If you're interested in using our APIs, we have experimental support with [documentation](https://docs.gitea.com/api).
+NOTE: If you're interested in using our APIs, we have experimental
+support with [documentation](https://try.gitea.io/api/swagger).

 ## Contributing

 Expected workflow is: Fork -> Patch -> Push -> Pull Request

-> [!NOTE]
->
-> 1. **YOU MUST READ THE [CONTRIBUTORS GUIDE](CONTRIBUTING.md) BEFORE STARTING TO WORK ON A PULL REQUEST.**
-> 2. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!
+NOTES:
+
+1. **YOU MUST READ THE [CONTRIBUTORS GUIDE](CONTRIBUTING.md) BEFORE STARTING TO WORK ON A PULL REQUEST.**
+2. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!

 ## Translating

@@ -79,7 +117,7 @@ https://docs.gitea.com/contributing/localization
 ## Further information

 For more information and instructions about how to install Gitea, please look at our [documentation](https://docs.gitea.com/).
-If you have questions that are not covered by the documentation, you can get in contact with us on our [Discord server](https://discord.gg/Gitea) or create  a post in the [discourse forum](https://forum.gitea.com/).
+If you have questions that are not covered by the documentation, you can get in contact with us on our [Discord server](https://discord.gg/Gitea) or create  a post in the [discourse forum](https://discourse.gitea.io/).

 We maintain a list of Gitea-related projects at [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea).

@@ -135,5 +173,5 @@ Looking for an overview of the interface? Check it out!
 |![Dashboard](https://dl.gitea.com/screenshots/home_timeline.png)|![User Profile](https://dl.gitea.com/screenshots/user_profile.png)|![Global Issues](https://dl.gitea.com/screenshots/global_issues.png)|
 |:---:|:---:|:---:|
 |![Branches](https://dl.gitea.com/screenshots/branches.png)|![Web Editor](https://dl.gitea.com/screenshots/web_editor.png)|![Activity](https://dl.gitea.com/screenshots/activity.png)|
-|![New Migration](https://dl.gitea.com/screenshots/migration.png)|![Migrating](https://dl.gitea.com/screenshots/migration.gif)|![Pull Request View](https://image.ibb.co/e02dSb/6.png)|
-|![Pull Request Dark](https://dl.gitea.com/screenshots/pull_requests_dark.png)|![Diff Review Dark](https://dl.gitea.com/screenshots/review_dark.png)|![Diff Dark](https://dl.gitea.com/screenshots/diff_dark.png)|
+|![New Migration](https://dl.gitea.com/screenshots/migration.png)|![Migrating](https://dl.gitea.com/screenshots/migration.gif)|![Pull Request View](https://image.ibb.co/e02dSb/6.png)
+![Pull Request Dark](https://dl.gitea.com/screenshots/pull_requests_dark.png)|![Diff Review Dark](https://dl.gitea.com/screenshots/review_dark.png)|![Diff Dark](https://dl.gitea.com/screenshots/diff_dark.png)|
--- a/README_ZH.md
+++ b/README_ZH.md
@@ -1,27 +1,64 @@
-# Gitea
+<p align="center">
+  <a href="https://gitea.io/">
+    <img alt="Gitea" src="https://raw.githubusercontent.com/go-gitea/gitea/main/public/assets/img/gitea.svg" width="220"/>
+  </a>
+</p>
+<h1 align="center">Gitea - Git with a cup of tea</h1>

-[![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
-[![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
-[![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
-[![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
-[![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
-[![Contribute with Gitpod](https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod&color=green)](https://gitpod.io/#https://github.com/go-gitea/gitea)
-[![](https://badges.crowdin.net/gitea/localized.svg)](https://crowdin.com/project/gitea "Crowdin")
+<p align="center">
+  <a href="https://drone.gitea.io/go-gitea/gitea" title="Build Status">
+    <img src="https://drone.gitea.io/api/badges/go-gitea/gitea/status.svg?ref=refs/heads/main">
+  </a>
+  <a href="https://discord.gg/Gitea" title="Join the Discord chat at https://discord.gg/Gitea">
+    <img src="https://img.shields.io/discord/322538954119184384.svg">
+  </a>
+  <a href="https://app.codecov.io/gh/go-gitea/gitea" title="Codecov">
+    <img src="https://codecov.io/gh/go-gitea/gitea/branch/main/graph/badge.svg">
+  </a>
+  <a href="https://goreportcard.com/report/code.gitea.io/gitea" title="Go Report Card">
+    <img src="https://goreportcard.com/badge/code.gitea.io/gitea">
+  </a>
+  <a href="https://pkg.go.dev/code.gitea.io/gitea" title="GoDoc">
+    <img src="https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg">
+  </a>
+  <a href="https://github.com/go-gitea/gitea/releases/latest" title="GitHub release">
+    <img src="https://img.shields.io/github/release/go-gitea/gitea.svg">
+  </a>
+  <a href="https://www.codetriage.com/go-gitea/gitea" title="Help Contribute to Open Source">
+    <img src="https://www.codetriage.com/go-gitea/gitea/badges/users.svg">
+  </a>
+  <a href="https://opencollective.com/gitea" title="Become a backer/sponsor of gitea">
+    <img src="https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen">
+  </a>
+  <a href="https://opensource.org/licenses/MIT" title="License: MIT">
+    <img src="https://img.shields.io/badge/License-MIT-blue.svg">
+  </a>
+  <a href="https://gitpod.io/#https://github.com/go-gitea/gitea">
+  <img
+    src="https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod"
+    alt="Contribute with Gitpod"
+  />
+  </a>
+  <a href="https://crowdin.com/project/gitea" title="Crowdin">
+    <img src="https://badges.crowdin.net/gitea/localized.svg">
+  </a>
+  <a href="https://www.tickgit.com/browse?repo=github.com/go-gitea/gitea&branch=main" title="TODOs">
+    <img src="https://badgen.net/https/api.tickgit.com/badgen/github.com/go-gitea/gitea/main">
+  </a>
+  <a href="https://app.bountysource.com/teams/gitea" title="Bountysource">
+    <img src="https://img.shields.io/bountysource/team/gitea/activity">
+  </a>
+</p>

-[View this document in English](./README.md)
+<p align="center">
+  <a href="README.md">View this document in English</a>
+</p>

 ## 目标

 Gitea 的首要目标是创建一个极易安装，运行非常快速，安装和使用体验良好的自建 Git 服务。我们采用 Go 作为后端语言，这使我们只要生成一个可执行程序即可。并且他还支持跨平台，支持 Linux, macOS 和 Windows 以及各种架构，除了 x86，amd64，还包括 ARM 和 PowerPC。

-如果你想试用在线演示和报告问题，请访问 [demo.gitea.com](https://demo.gitea.com/)。
-
-如果你想使用免费的 Gitea 服务（有仓库数量限制），请访问 [gitea.com](https://gitea.com/user/login)。
-
-如果你想在 Gitea Cloud 上快速部署你自己独享的 Gitea 实例，请访问 [cloud.gitea.com](https://cloud.gitea.com) 开始免费试用。
+如果您想试用一下，请访问 [在线Demo](https://try.gitea.io/)！

 ## 提示

@@ -57,5 +94,5 @@ Fork -> Patch -> Push -> Pull Request
 |![Dashboard](https://dl.gitea.com/screenshots/home_timeline.png)|![User Profile](https://dl.gitea.com/screenshots/user_profile.png)|![Global Issues](https://dl.gitea.com/screenshots/global_issues.png)|
 |:---:|:---:|:---:|
 |![Branches](https://dl.gitea.com/screenshots/branches.png)|![Web Editor](https://dl.gitea.com/screenshots/web_editor.png)|![Activity](https://dl.gitea.com/screenshots/activity.png)|
-|![New Migration](https://dl.gitea.com/screenshots/migration.png)|![Migrating](https://dl.gitea.com/screenshots/migration.gif)|![Pull Request View](https://image.ibb.co/e02dSb/6.png)|
-|![Pull Request Dark](https://dl.gitea.com/screenshots/pull_requests_dark.png)|![Diff Review Dark](https://dl.gitea.com/screenshots/review_dark.png)|![Diff Dark](https://dl.gitea.com/screenshots/diff_dark.png)|
+|![New Migration](https://dl.gitea.com/screenshots/migration.png)|![Migrating](https://dl.gitea.com/screenshots/migration.gif)|![Pull Request View](https://image.ibb.co/e02dSb/6.png)
+![Pull Request Dark](https://dl.gitea.com/screenshots/pull_requests_dark.png)|![Diff Review Dark](https://dl.gitea.com/screenshots/review_dark.png)|![Diff Dark](https://dl.gitea.com/screenshots/diff_dark.png)|
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -12,14 +12,14 @@ Please **DO NOT** file a public issue, instead send your report privately to `se

 ## Protecting Security Information

-Due to the sensitive nature of security information, you can use the below GPG public key to encrypt your mail body.
+Due to the sensitive nature of security information, you can use below GPG public key encrypt your mail body.

-The PGP key is valid until July 9, 2025.
+The PGP key is valid until June 24, 2024.

 ```
 Key ID: 6FCD2D5B
 Key Type: RSA
-Expires: 7/9/2025
+Expires: 6/24/2024
 Key Size: 4096/4096
 Fingerprint: 3DE0 3D1E 144A 7F06 9359 99DC AAFD 2381 6FCD 2D5B
 ```
@@ -40,20 +40,20 @@ q+pHZl24JYR0Kf3T/ZiOC0cGd2QJqpJtg5J6S/OqfX9NH6MsCczO8pUC1N/aHH2X
 CTme2nF56izORqDWKoiICteL3GpYsCV9nyCidcCmoQsS+DKvE86YhIhVIVWGRY2F
 lzpAjnN9/KLtQroutrm+Ft0mdjDiJUeFVl1cOHDhoyfCsQh62HumoyZoZvqzQd6e
 AbN11nq6aViMe2Q3je1AbiBnRnQSHxt1Tc8X4IshO3MQK1Sk7oPI6LA5oQARAQAB
-tCJHaXRlYSBTZWN1cml0eSA8c2VjdXJpdHlAZ2l0ZWEuaW8+iQJXBBMBCABBAhsD
-BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAFiEEPeA9HhRKfwaTWZncqv0jgW/N
-LVsFAmaMse0FCQW4fW8ACgkQqv0jgW/NLVtXLg/+PF4G9Jhlui15BTNlEBJAV2P/
-1QlAV2krk0fP7tykn0FR9RfGIfVV/kwC1f+ouosYPQDDevl9LWdUIM+g94DtNo2o
-7ACpcL3morvt5lVGpIZHL8TbX0qmFRXL/pB/cB+K6IwYvh2mrbp2zH+r4SCRyFYq
-BjgXYFTI1MylJ1ShAjU6Z+m3oJ+2xs5LzHS0X6zkTjzA2Zl4zQzciQ9T+wJcE7Zi
-HXdM1+YMF8KGNP8J9Rpug5oNDJ98lgZirRY7c3A/1xmYBiPnULwuuymdqEZO7l70
-SeAlE1RWYX8kbOBnBb/KY4XwE3Vic1oEzc9DiPWVH1ElX86WNNsFzuyULiwoBoWg
-pqZGhL9x1p5+46RGQSDczsHM7YGVtfYOiDo2PAVrmwsT0BnXnK8Oe3YIkvmUPEJu
-OkLt0Z6A5n8pz8zhQzuApwBsK4ncJ8zTCpvz/pfKKqZC/Vnoh3gKGhDGvOZ+b5IJ
-0kUTe2JsbnwFixDUMDtacQ1op8XOyLoLVmgqLn0+Pws4XPBlMof2bioFir3yHKnP
-gNchsF1agrlSIo5GA8u4ga+IlCSfvFIKrl7+cxacKcJYt/vbOU5KcvVJI5EtHKCG
-xfHjHY2ah1Qww7SxW6IXiRZZzPpsL2mBM2CD7N3qh9bV2s27wxYCdUodsIZbiyHe
-oWPzfBnkmiAN8KlZxHm5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
+tCJHaXRlYSBTZWN1cml0eSA8c2VjdXJpdHlAZ2l0ZWEuaW8+iQJXBBMBCABBFiEE
+PeA9HhRKfwaTWZncqv0jgW/NLVsFAmK1Z/4CGwMFCQPCZwAFCwkIBwICIgIGFQoJ
+CAsCBBYCAwECHgcCF4AACgkQqv0jgW/NLVvnyxAAhxyNnWzw/rQO2qhzqicmZM94
+njSbOg+U2qMBvCdaqCQQeC+uaMmMzkDPanUUmLcyCkWqfCjPNjeSXAkE9npepVJI
+4HtmgxZQ94OU/h3CLbft+9GVRzUkVI29TSYGdvNtV2/BkNGoFFnKWQr119um0o6A
+bgha2Uy5uY8o3ZIoiKkiHRaEoWIjjeBxJxYAojsZY4YElUmsQ3ik2joG6rhFesTa
+ofVt/bL8G2xzpOG26WGIxBbqf2qjV6OtZ0hu/vtTPHeIWMLq0Mz0V3PEDQWfkGPE
+i2RYxxYDs2xzJhSQWqTNVLSq0m5xTJnbHhQPfdCX4C2jvFKgLdfmytQq49S7jiJb
+Z03HVOZ/PsyBlQfH9xJi06R5yQCMEA8h8Z5r3/NXW09kQ6OFRe6xshoTcxZGRPTo
+srhwr3uPbmCRh+YEl7qBLU6+BC5k8IRTZXqhrj/aPJu3MxgbgwV8u3vLoFSXM2lb
+a61FgeCQ0O7lkgVswwF0RppCaH9Ul3ZDapet/vCRg4NVwm9zOI/8q/Vj0FKA1GDR
+JhRu8+Ce8zlFL65D34t+PprAzSeTlbv9um3x/ZIjCco7EEKSBylt+AZj/VyA6+e5
+kjOQwRRc6dFJWBcorsSI2dG+H+QMF7ZabzmeCcz1v9HjLOPzYHoZAHhCmSppWTvX
+AJy6+lhfW2OUTqQeYSi5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
 T+p07yCSSoSlmnJHCQmwh4vfg1blyz0zZ4vkIhtpHsEgc+ZAG+WQXSsJ2iRz+eSN
 GwoOQl4XC3n+QWkc1ws+btr48+6UqXIQU+F8TPQyx/PIgi2nZXJB7f5+mjCqsk46
 XvH4nTr4kJjuqMSR/++wvre2qNQRa/q/dTsK0OaN/mJsdX6Oi+aGNaQJUhIG7F+E
@@ -64,20 +64,20 @@ qoExANj5lUTZPe8M50lI182FrcjAN7dClO3QI6pg7wy0erMxfFly3j8UQ91ysS9T
 s+GsP9I3cmWWQcKYxWHtE8xTXnNCVPFZQj2nwhJzae8ypfOtulBRA3dUKWGKuDH/
 axFENhUsT397aOU3qkP/od4a64JyNIEo4CTTSPVeWd7njsGqli2U3A4xL2CcyYvt
 D/MWcMBGEoLSNTswwKdom4FaJpn5KThnK/T0bQcmJblJhoCtppXisbexZnCpuS0x
-Zdlm2T14KJ3LABEBAAGJAjwEGAEIACYCGwwWIQQ94D0eFEp/BpNZmdyq/SOBb80t
-WwUCZoyyjQUJBbh+DwAKCRCq/SOBb80tW18XD/9MXztmf01MT+1kZdBouZ/7Rp/7
-9kuqo//B1G+RXau4oFtPqb67kNe2WaIc3u5B73PUHsMf3i6z4ib2KbMhZZerLn0O
-dRglcuPeNWmsASY3dH/XVG0cT0zvvWegagd12TJEl3Vs+7XNrOw4cwDj9L1+GH9m
-kSt4uaANWn/6a3RvMRhiVEYuNwhAzcKaactPmYqrLJgoVLbRSDkgyHaMQ2jKgLxk
-ifS/fvluGV0ub2Po6DJiqfRpd1tDvPhe9y1+r1WFDZsOcvTcZUfSt/7dXMGfqGu0
-2daVFlfeSXSALrDE5uc0UxodHCpP3sqRYDZevGLBRaaTkIjYXG/+N898+7K5WJF4
-xXOLWxM2cwGkG7eC9pugcDnBp9XlF7O+GBiZ05JUe5flXDQFZ+h3exjopu6KHF1B
-RnzNy8LC0UKb+AuvRIOLV92a9Q9wGWU/jaVDu6nZ0umAeuSzxiHoDsonm0Fl9QAz
-2/xCokebuoeLrEK7R2af3X86mqq3sVO4ax+HPYChzOaVQBiHUW/TAldWcldYYphR
-/e2WsbmQfvCRtz/bZfo+aUVnrHNjzVMtF2SszdVmA/04Y8pS28MqtuRqhm5DPOOd
-g1YeUywK5jRZ1twyo1kzJEFPLaoeaXaycsR1PMVBW0Urik5mrR/pOWq7PPoZoKb2
-lXYLE8bwkuQTmsyL1g==
-=9i7d
+Zdlm2T14KJ3LABEBAAGJAjwEGAEIACYWIQQ94D0eFEp/BpNZmdyq/SOBb80tWwUC
+YrVn/gIbDAUJA8JnAAAKCRCq/SOBb80tWyTBD/9AGpW6QoDF7zYjHAozH9S5RGCA
+Y7E82dG/0xmFUwPprAG0BKmmgU6TiipyVGmKIXGYYYU92pMnbvXkYQMoa+WJNncN
+D3fY52UeXeffTf4cFpStlzi9xgYtOLhFamzYu/4xhkjOX+xhOSXscCiFRyT8cF3B
+O6c5BHU+Zj0/rGPgOyPUbx7l7B9MubB/41nNX35k08e+8T3wtWDb4XF+15HnRfva
+6fblO8wgU25Orv2Rm1jnKGa9DxJ8nE40IMrqDapENtDuL+zKJsvR0+ptWvEyL56U
+GtJJG5un6mXiLKuRQT0DEv4MdZRHDgDstDnqcbEiazVEbUuvhZZob6lRY2A19m1+
+7zfnDxkhqCA1RCnv4fdvcPdCMMFHwLpdhjgW0aI/uwgwrvsEz5+JRlnLvdQHlPAg
+q7l2fGcBSpz9U0ayyfRPjPntsNCtZl1UDxGLeciPkZhyG84zEWQbk/j52ZpRN+Ik
+ALpRLa8RBFmFSmXDUmwQrmm1EmARyQXwweKU31hf8ZGbCp2lPuRYm1LuGiirXSVP
+GysjRAJgW+VRpBKOzFQoUAUbReVWSaCwT8s17THzf71DdDb6CTj31jMLLYWwBpA/
+i73DgobDZMIGEZZC1EKqza8eh11xfyHFzGec03tbh+lIen+5IiRtWiEWkDS9ll0G
+zgS/ZdziCvdAutqnGA==
+=gZWO
 -----END PGP PUBLIC KEY BLOCK-----

 ```
--- a/assets/go-licenses.json
+++ b/assets/go-licenses.json
--- a/build/code-batch-process.go
+++ b/build/code-batch-process.go
@@ -69,7 +69,6 @@ func newFileCollector(fileFilter string, batchSize int) (*fileCollector, error)
 		co.includePatterns = append(co.includePatterns, regexp.MustCompile(`.*\.go$`))

 		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`.*\bbindata\.go$`))
-		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`\.pb\.go$`))
 		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`tests/gitea-repositories-meta`))
 		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`tests/integration/migration-test`))
 		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`modules/git/tests`))
@@ -204,6 +203,17 @@ Example:
 `, "file-batch-exec")
 }

+func getGoVersion() string {
+	goModFile, err := os.ReadFile("go.mod")
+	if err != nil {
+		log.Fatalf(`Faild to read "go.mod": %v`, err)
+		os.Exit(1)
+	}
+	goModVersionRegex := regexp.MustCompile(`go \d+\.\d+`)
+	goModVersionLine := goModVersionRegex.Find(goModFile)
+	return string(goModVersionLine[3:])
+}
+
 func newFileCollectorFromMainOptions(mainOptions map[string]string) (fc *fileCollector, err error) {
 	fileFilter := mainOptions["file-filter"]
 	if fileFilter == "" {
@@ -268,8 +278,7 @@ func main() {
 				log.Print("the -d option is not supported by gitea-fmt")
 			}
 			cmdErrors = append(cmdErrors, giteaFormatGoImports(files, containsString(subArgs, "-w")))
-			cmdErrors = append(cmdErrors, passThroughCmd("gofmt", append([]string{"-w", "-r", "interface{} -> any"}, substArgs...)))
-			cmdErrors = append(cmdErrors, passThroughCmd("go", append([]string{"run", os.Getenv("GOFUMPT_PACKAGE"), "-extra"}, substArgs...)))
+			cmdErrors = append(cmdErrors, passThroughCmd("go", append([]string{"run", os.Getenv("GOFUMPT_PACKAGE"), "-extra", "-lang", getGoVersion()}, substArgs...)))
 		default:
 			log.Fatalf("unknown cmd: %s %v", subCmd, subArgs)
 		}
--- a/build/generate-emoji.go
+++ b/build/generate-emoji.go
@@ -53,6 +53,8 @@ func (e Emoji) MarshalJSON() ([]byte, error) {
 }

 func main() {
+	var err error
+
 	flag.Parse()

 	// generate data
@@ -81,6 +83,8 @@ var replacer = strings.NewReplacer(
 var emojiRE = regexp.MustCompile(`\{Emoji:"([^"]*)"`)

 func generate() ([]byte, error) {
+	var err error
+
 	// load gemoji data
 	res, err := http.Get(gemojiURL)
 	if err != nil {
--- a/build/generate-images.js
+++ b/build/generate-images.js
@@ -1,13 +1,20 @@
 #!/usr/bin/env node
-import imageminZopfli from 'imagemin-zopfli'; // eslint-disable-line import-x/no-unresolved
-import {loadSVGFromString, Canvas, Rect, util} from 'fabric/node'; // eslint-disable-line import-x/no-unresolved
+import imageminZopfli from 'imagemin-zopfli';
 import {optimize} from 'svgo';
+import {fabric} from 'fabric';
 import {readFile, writeFile} from 'node:fs/promises';
-import {argv, exit} from 'node:process';

-function doExit(err) {
+function exit(err) {
  if (err) console.error(err);
-  exit(err ? 1 : 0);
+  process.exit(err ? 1 : 0);
+}
+
+function loadSvg(svg) {
+  return new Promise((resolve) => {
+    fabric.loadSVGFromString(svg, (objects, options) => {
+      resolve({objects, options});
+    });
+  });
 }

 async function generate(svg, path, {size, bg}) {
@@ -20,7 +27,7 @@ async function generate(svg, path, {size, bg}) {
        'removeDimensions',
        {
          name: 'addAttributesToSVGElement',
-          params: {attributes: [{width: size}, {height: size}]},
+          params: {attributes: [{width: size}, {height: size}]}
        },
      ],
    });
@@ -28,14 +35,14 @@ async function generate(svg, path, {size, bg}) {
    return;
  }

-  const {objects, options} = await loadSVGFromString(svg);
-  const canvas = new Canvas();
+  const {objects, options} = await loadSvg(svg);
+  const canvas = new fabric.Canvas();
  canvas.setDimensions({width: size, height: size});
  const ctx = canvas.getContext('2d');
  ctx.scale(options.width ? (size / options.width) : 1, options.height ? (size / options.height) : 1);

  if (bg) {
-    canvas.add(new Rect({
+    canvas.add(new fabric.Rect({
      left: 0,
      top: 0,
      height: size * (1 / (size / options.height)),
@@ -44,7 +51,7 @@ async function generate(svg, path, {size, bg}) {
    }));
  }

-  canvas.add(util.groupSVGElements(objects, options));
+  canvas.add(fabric.util.groupSVGElements(objects, options));
  canvas.renderAll();

  let png = Buffer.from([]);
@@ -57,7 +64,7 @@ async function generate(svg, path, {size, bg}) {
 }

 async function main() {
-  const gitea = argv.slice(2).includes('gitea');
+  const gitea = process.argv.slice(2).includes('gitea');
  const logoSvg = await readFile(new URL('../assets/logo.svg', import.meta.url), 'utf8');
  const faviconSvg = await readFile(new URL('../assets/favicon.svg', import.meta.url), 'utf8');

@@ -72,8 +79,4 @@ async function main() {
  ]);
 }

-try {
-  doExit(await main());
-} catch (err) {
-  doExit(err);
-}
+main().then(exit).catch(exit);
--- a/build/generate-licenses.go
+++ b/build/generate-licenses.go
@@ -1,6 +1,3 @@
-// Copyright 2017 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
 //go:build ignore

 package main
@@ -8,8 +5,6 @@ package main
 import (
 	"archive/tar"
 	"compress/gzip"
-	"crypto/md5"
-	"encoding/hex"
 	"flag"
 	"fmt"
 	"io"
@@ -20,8 +15,6 @@ import (
 	"path/filepath"
 	"strings"

-	"code.gitea.io/gitea/build/license"
-	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/util"
 )

@@ -84,7 +77,7 @@ func main() {
 	}

 	tr := tar.NewReader(gz)
-	aliasesFiles := make(map[string][]string)
+
 	for {
 		hdr, err := tr.Next()

@@ -104,73 +97,26 @@ func main() {
 			continue
 		}

-		fileBaseName := filepath.Base(hdr.Name)
-		licenseName := strings.TrimSuffix(fileBaseName, ".txt")
-
-		if strings.HasPrefix(fileBaseName, "README") {
+		if strings.HasPrefix(filepath.Base(hdr.Name), "README") {
 			continue
 		}

-		if strings.HasPrefix(fileBaseName, "deprecated_") {
+		if strings.HasPrefix(filepath.Base(hdr.Name), "deprecated_") {
 			continue
 		}
-		out, err := os.Create(path.Join(destination, licenseName))
+		out, err := os.Create(path.Join(destination, strings.TrimSuffix(filepath.Base(hdr.Name), ".txt")))
 		if err != nil {
 			log.Fatalf("Failed to create new file. %s", err)
 		}

 		defer out.Close()

-		// some license files have same content, so we need to detect these files and create a convert map into a json file
-		// Later we use this convert map to avoid adding same license content with different license name
-		h := md5.New()
-		// calculate md5 and write file in the same time
-		r := io.TeeReader(tr, h)
-		if _, err := io.Copy(out, r); err != nil {
+		if _, err := io.Copy(out, tr); err != nil {
 			log.Fatalf("Failed to write new file. %s", err)
 		} else {
 			fmt.Printf("Written %s\n", out.Name())
-
-			md5 := hex.EncodeToString(h.Sum(nil))
-			aliasesFiles[md5] = append(aliasesFiles[md5], licenseName)
 		}
 	}

-	// generate convert license name map
-	licenseAliases := make(map[string]string)
-	for _, fileNames := range aliasesFiles {
-		if len(fileNames) > 1 {
-			licenseName := license.GetLicenseNameFromAliases(fileNames)
-			if licenseName == "" {
-				// license name should not be empty as expected
-				// if it is empty, we need to rewrite the logic of GetLicenseNameFromAliases
-				log.Fatalf("GetLicenseNameFromAliases: license name is empty")
-			}
-			for _, fileName := range fileNames {
-				licenseAliases[fileName] = licenseName
-			}
-		}
-	}
-	// save convert license name map to file
-	b, err := json.Marshal(licenseAliases)
-	if err != nil {
-		log.Fatalf("Failed to create json bytes. %s", err)
-	}
-
-	licenseAliasesDestination := filepath.Join(destination, "etc", "license-aliases.json")
-	if err := os.MkdirAll(filepath.Dir(licenseAliasesDestination), 0o755); err != nil {
-		log.Fatalf("Failed to create directory for license aliases json file. %s", err)
-	}
-
-	f, err := os.Create(licenseAliasesDestination)
-	if err != nil {
-		log.Fatalf("Failed to create license aliases json file. %s", err)
-	}
-	defer f.Close()
-
-	if _, err = f.Write(b); err != nil {
-		log.Fatalf("Failed to write license aliases json file. %s", err)
-	}
-
 	fmt.Println("Done")
 }
--- a/build/generate-svg.js
+++ b/build/generate-svg.js
@@ -4,16 +4,15 @@ import {optimize} from 'svgo';
 import {parse} from 'node:path';
 import {readFile, writeFile, mkdir} from 'node:fs/promises';
 import {fileURLToPath} from 'node:url';
-import {exit} from 'node:process';

 const glob = (pattern) => fastGlob.sync(pattern, {
  cwd: fileURLToPath(new URL('..', import.meta.url)),
  absolute: true,
 });

-function doExit(err) {
+function exit(err) {
  if (err) console.error(err);
-  exit(err ? 1 : 0);
+  process.exit(err ? 1 : 0);
 }

 async function processFile(file, {prefix, fullName} = {}) {
@@ -39,8 +38,8 @@ async function processFile(file, {prefix, fullName} = {}) {
          attributes: [
            {'xmlns': 'http://www.w3.org/2000/svg'},
            {'width': '16'}, {'height': '16'}, {'aria-hidden': 'true'},
-          ],
-        },
+          ]
+        }
      },
    ],
  });
@@ -64,8 +63,4 @@ async function main() {
  ]);
 }

-try {
-  doExit(await main());
-} catch (err) {
-  doExit(err);
-}
+main().then(exit).catch(exit);
--- a/build/license/aliasgenerator.go
+++ b/build/license/aliasgenerator.go
@@ -1,41 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package license
-
-import "strings"
-
-func GetLicenseNameFromAliases(fnl []string) string {
-	if len(fnl) == 0 {
-		return ""
-	}
-
-	shortestItem := func(list []string) string {
-		s := list[0]
-		for _, l := range list[1:] {
-			if len(l) < len(s) {
-				s = l
-			}
-		}
-		return s
-	}
-	allHasPrefix := func(list []string, s string) bool {
-		for _, l := range list {
-			if !strings.HasPrefix(l, s) {
-				return false
-			}
-		}
-		return true
-	}
-
-	sl := shortestItem(fnl)
-	slv := strings.Split(sl, "-")
-	var result string
-	for i := len(slv); i >= 0; i-- {
-		result = strings.Join(slv[:i], "-")
-		if allHasPrefix(fnl, result) {
-			return result
-		}
-	}
-	return ""
-}
--- a/build/license/aliasgenerator_test.go
+++ b/build/license/aliasgenerator_test.go
@@ -1,39 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package license
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetLicenseNameFromAliases(t *testing.T) {
-	tests := []struct {
-		target string
-		inputs []string
-	}{
-		{
-			// real case which you can find in license-aliases.json
-			target: "AGPL-1.0",
-			inputs: []string{
-				"AGPL-1.0-only",
-				"AGPL-1.0-or-late",
-			},
-		},
-		{
-			target: "",
-			inputs: []string{
-				"APSL-1.0",
-				"AGPL-1.0-only",
-				"AGPL-1.0-or-late",
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		result := GetLicenseNameFromAliases(tt.inputs)
-		assert.Equal(t, result, tt.target)
-	}
-}
--- a/build/watch.sh
+++ b/build/watch.sh
--- a/cmd/actions.go
+++ b/cmd/actions.go
@@ -15,8 +15,9 @@ import (
 var (
 	// CmdActions represents the available actions sub-commands.
 	CmdActions = &cli.Command{
-		Name:  "actions",
-		Usage: "Manage Gitea Actions",
+		Name:        "actions",
+		Usage:       "",
+		Description: "Commands for managing Gitea Actions",
 		Subcommands: []*cli.Command{
 			subcmdActionsGenRunnerToken,
 		},
@@ -50,6 +51,6 @@ func runGenerateActionsRunnerToken(c *cli.Context) error {
 	if extra.HasError() {
 		return handleCliResponseExtra(extra)
 	}
-	_, _ = fmt.Printf("%s\n", respText.Text)
+	_, _ = fmt.Printf("%s\n", respText)
 	return nil
 }
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -6,14 +6,26 @@ package cmd

 import (
 	"context"
+	"errors"
 	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"text/tabwriter"

+	asymkey_model "code.gitea.io/gitea/models/asymkey"
+	auth_model "code.gitea.io/gitea/models/auth"
 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
+	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
+	"code.gitea.io/gitea/modules/util"
+	auth_service "code.gitea.io/gitea/services/auth"
+	"code.gitea.io/gitea/services/auth/source/oauth2"
+	"code.gitea.io/gitea/services/auth/source/smtp"
+	repo_service "code.gitea.io/gitea/services/repository"

 	"github.com/urfave/cli/v2"
 )
@@ -22,7 +34,7 @@ var (
 	// CmdAdmin represents the available admin sub-command.
 	CmdAdmin = &cli.Command{
 		Name:  "admin",
-		Usage: "Perform common administrative operations",
+		Usage: "Command line interface to perform common administrative operations",
 		Subcommands: []*cli.Command{
 			subcmdUser,
 			subcmdRepoSyncReleases,
@@ -47,16 +59,28 @@ var (
 		},
 	}

+	microcmdRegenHooks = &cli.Command{
+		Name:   "hooks",
+		Usage:  "Regenerate git-hooks",
+		Action: runRegenerateHooks,
+	}
+
+	microcmdRegenKeys = &cli.Command{
+		Name:   "keys",
+		Usage:  "Regenerate authorized_keys file",
+		Action: runRegenerateKeys,
+	}
+
 	subcmdAuth = &cli.Command{
 		Name:  "auth",
 		Usage: "Modify external auth providers",
 		Subcommands: []*cli.Command{
 			microcmdAuthAddOauth,
 			microcmdAuthUpdateOauth,
-			microcmdAuthAddLdapBindDn,
-			microcmdAuthUpdateLdapBindDn,
-			microcmdAuthAddLdapSimpleAuth,
-			microcmdAuthUpdateLdapSimpleAuth,
+			cmdAuthAddLdapBindDn,
+			cmdAuthUpdateLdapBindDn,
+			cmdAuthAddLdapSimpleAuth,
+			cmdAuthUpdateLdapSimpleAuth,
 			microcmdAuthAddSMTP,
 			microcmdAuthUpdateSMTP,
 			microcmdAuthList,
@@ -64,6 +88,170 @@ var (
 		},
 	}

+	microcmdAuthList = &cli.Command{
+		Name:   "list",
+		Usage:  "List auth sources",
+		Action: runListAuth,
+		Flags: []cli.Flag{
+			&cli.IntFlag{
+				Name:  "min-width",
+				Usage: "Minimal cell width including any padding for the formatted table",
+				Value: 0,
+			},
+			&cli.IntFlag{
+				Name:  "tab-width",
+				Usage: "width of tab characters in formatted table (equivalent number of spaces)",
+				Value: 8,
+			},
+			&cli.IntFlag{
+				Name:  "padding",
+				Usage: "padding added to a cell before computing its width",
+				Value: 1,
+			},
+			&cli.StringFlag{
+				Name:  "pad-char",
+				Usage: `ASCII char used for padding if padchar == '\\t', the Writer will assume that the width of a '\\t' in the formatted output is tabwidth, and cells are left-aligned independent of align_left (for correct-looking results, tabwidth must correspond to the tab width in the viewer displaying the result)`,
+				Value: "\t",
+			},
+			&cli.BoolFlag{
+				Name:  "vertical-bars",
+				Usage: "Set to true to print vertical bars between columns",
+			},
+		},
+	}
+
+	idFlag = &cli.Int64Flag{
+		Name:  "id",
+		Usage: "ID of authentication source",
+	}
+
+	microcmdAuthDelete = &cli.Command{
+		Name:   "delete",
+		Usage:  "Delete specific auth source",
+		Flags:  []cli.Flag{idFlag},
+		Action: runDeleteAuth,
+	}
+
+	oauthCLIFlags = []cli.Flag{
+		&cli.StringFlag{
+			Name:  "name",
+			Value: "",
+			Usage: "Application Name",
+		},
+		&cli.StringFlag{
+			Name:  "provider",
+			Value: "",
+			Usage: "OAuth2 Provider",
+		},
+		&cli.StringFlag{
+			Name:  "key",
+			Value: "",
+			Usage: "Client ID (Key)",
+		},
+		&cli.StringFlag{
+			Name:  "secret",
+			Value: "",
+			Usage: "Client Secret",
+		},
+		&cli.StringFlag{
+			Name:  "auto-discover-url",
+			Value: "",
+			Usage: "OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider)",
+		},
+		&cli.StringFlag{
+			Name:  "use-custom-urls",
+			Value: "false",
+			Usage: "Use custom URLs for GitLab/GitHub OAuth endpoints",
+		},
+		&cli.StringFlag{
+			Name:  "custom-tenant-id",
+			Value: "",
+			Usage: "Use custom Tenant ID for OAuth endpoints",
+		},
+		&cli.StringFlag{
+			Name:  "custom-auth-url",
+			Value: "",
+			Usage: "Use a custom Authorization URL (option for GitLab/GitHub)",
+		},
+		&cli.StringFlag{
+			Name:  "custom-token-url",
+			Value: "",
+			Usage: "Use a custom Token URL (option for GitLab/GitHub)",
+		},
+		&cli.StringFlag{
+			Name:  "custom-profile-url",
+			Value: "",
+			Usage: "Use a custom Profile URL (option for GitLab/GitHub)",
+		},
+		&cli.StringFlag{
+			Name:  "custom-email-url",
+			Value: "",
+			Usage: "Use a custom Email URL (option for GitHub)",
+		},
+		&cli.StringFlag{
+			Name:  "icon-url",
+			Value: "",
+			Usage: "Custom icon URL for OAuth2 login source",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-local-2fa",
+			Usage: "Set to true to skip local 2fa for users authenticated by this source",
+		},
+		&cli.StringSliceFlag{
+			Name:  "scopes",
+			Value: nil,
+			Usage: "Scopes to request when to authenticate against this OAuth2 source",
+		},
+		&cli.StringFlag{
+			Name:  "required-claim-name",
+			Value: "",
+			Usage: "Claim name that has to be set to allow users to login with this source",
+		},
+		&cli.StringFlag{
+			Name:  "required-claim-value",
+			Value: "",
+			Usage: "Claim value that has to be set to allow users to login with this source",
+		},
+		&cli.StringFlag{
+			Name:  "group-claim-name",
+			Value: "",
+			Usage: "Claim name providing group names for this source",
+		},
+		&cli.StringFlag{
+			Name:  "admin-group",
+			Value: "",
+			Usage: "Group Claim value for administrator users",
+		},
+		&cli.StringFlag{
+			Name:  "restricted-group",
+			Value: "",
+			Usage: "Group Claim value for restricted users",
+		},
+		&cli.StringFlag{
+			Name:  "group-team-map",
+			Value: "",
+			Usage: "JSON mapping between groups and org teams",
+		},
+		&cli.BoolFlag{
+			Name:  "group-team-map-removal",
+			Usage: "Activate automatic team membership removal depending on groups",
+		},
+	}
+
+	microcmdAuthUpdateOauth = &cli.Command{
+		Name:   "update-oauth",
+		Usage:  "Update existing Oauth authentication source",
+		Action: runUpdateOauth,
+		Flags:  append(oauthCLIFlags[:1], append([]cli.Flag{idFlag}, oauthCLIFlags[1:]...)...),
+	}
+
+	microcmdAuthAddOauth = &cli.Command{
+		Name:   "add-oauth",
+		Usage:  "Add new Oauth authentication source",
+		Action: runAddOauth,
+		Flags:  oauthCLIFlags,
+	}
+
 	subcmdSendMail = &cli.Command{
 		Name:   "sendmail",
 		Usage:  "Send a message to all users",
@@ -87,9 +275,75 @@ var (
 		},
 	}

-	idFlag = &cli.Int64Flag{
-		Name:  "id",
-		Usage: "ID of authentication source",
+	smtpCLIFlags = []cli.Flag{
+		&cli.StringFlag{
+			Name:  "name",
+			Value: "",
+			Usage: "Application Name",
+		},
+		&cli.StringFlag{
+			Name:  "auth-type",
+			Value: "PLAIN",
+			Usage: "SMTP Authentication Type (PLAIN/LOGIN/CRAM-MD5) default PLAIN",
+		},
+		&cli.StringFlag{
+			Name:  "host",
+			Value: "",
+			Usage: "SMTP Host",
+		},
+		&cli.IntFlag{
+			Name:  "port",
+			Usage: "SMTP Port",
+		},
+		&cli.BoolFlag{
+			Name:  "force-smtps",
+			Usage: "SMTPS is always used on port 465. Set this to force SMTPS on other ports.",
+			Value: true,
+		},
+		&cli.BoolFlag{
+			Name:  "skip-verify",
+			Usage: "Skip TLS verify.",
+			Value: true,
+		},
+		&cli.StringFlag{
+			Name:  "helo-hostname",
+			Value: "",
+			Usage: "Hostname sent with HELO. Leave blank to send current hostname",
+		},
+		&cli.BoolFlag{
+			Name:  "disable-helo",
+			Usage: "Disable SMTP helo.",
+			Value: true,
+		},
+		&cli.StringFlag{
+			Name:  "allowed-domains",
+			Value: "",
+			Usage: "Leave empty to allow all domains. Separate multiple domains with a comma (',')",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-local-2fa",
+			Usage: "Skip 2FA to log on.",
+			Value: true,
+		},
+		&cli.BoolFlag{
+			Name:  "active",
+			Usage: "This Authentication Source is Activated.",
+			Value: true,
+		},
+	}
+
+	microcmdAuthAddSMTP = &cli.Command{
+		Name:   "add-smtp",
+		Usage:  "Add new SMTP authentication source",
+		Action: runAddSMTP,
+		Flags:  smtpCLIFlags,
+	}
+
+	microcmdAuthUpdateSMTP = &cli.Command{
+		Name:   "update-smtp",
+		Usage:  "Update existing SMTP authentication source",
+		Action: runUpdateSMTP,
+		Flags:  append(smtpCLIFlags[:1], append([]cli.Flag{idFlag}, smtpCLIFlags[1:]...)...),
 	}
 )

@@ -123,7 +377,7 @@ func runRepoSyncReleases(_ *cli.Context) error {
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
 			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RepoPath())
-			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
+			gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
 				continue
@@ -158,11 +412,359 @@ func runRepoSyncReleases(_ *cli.Context) error {
 }

 func getReleaseCount(ctx context.Context, id int64) (int64, error) {
-	return db.Count[repo_model.Release](
+	return repo_model.GetReleaseCountByRepoID(
 		ctx,
+		id,
 		repo_model.FindReleasesOptions{
-			RepoID:      id,
 			IncludeTags: true,
 		},
 	)
 }
+
+func runRegenerateHooks(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+	return repo_service.SyncRepositoryHooks(graceful.GetManager().ShutdownContext())
+}
+
+func runRegenerateKeys(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+	return asymkey_model.RewriteAllPublicKeys(ctx)
+}
+
+func parseOAuth2Config(c *cli.Context) *oauth2.Source {
+	var customURLMapping *oauth2.CustomURLMapping
+	if c.IsSet("use-custom-urls") {
+		customURLMapping = &oauth2.CustomURLMapping{
+			TokenURL:   c.String("custom-token-url"),
+			AuthURL:    c.String("custom-auth-url"),
+			ProfileURL: c.String("custom-profile-url"),
+			EmailURL:   c.String("custom-email-url"),
+			Tenant:     c.String("custom-tenant-id"),
+		}
+	} else {
+		customURLMapping = nil
+	}
+	return &oauth2.Source{
+		Provider:                      c.String("provider"),
+		ClientID:                      c.String("key"),
+		ClientSecret:                  c.String("secret"),
+		OpenIDConnectAutoDiscoveryURL: c.String("auto-discover-url"),
+		CustomURLMapping:              customURLMapping,
+		IconURL:                       c.String("icon-url"),
+		SkipLocalTwoFA:                c.Bool("skip-local-2fa"),
+		Scopes:                        c.StringSlice("scopes"),
+		RequiredClaimName:             c.String("required-claim-name"),
+		RequiredClaimValue:            c.String("required-claim-value"),
+		GroupClaimName:                c.String("group-claim-name"),
+		AdminGroup:                    c.String("admin-group"),
+		RestrictedGroup:               c.String("restricted-group"),
+		GroupTeamMap:                  c.String("group-team-map"),
+		GroupTeamMapRemoval:           c.Bool("group-team-map-removal"),
+	}
+}
+
+func runAddOauth(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	config := parseOAuth2Config(c)
+	if config.Provider == "openidConnect" {
+		discoveryURL, err := url.Parse(config.OpenIDConnectAutoDiscoveryURL)
+		if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
+			return fmt.Errorf("invalid Auto Discovery URL: %s (this must be a valid URL starting with http:// or https://)", config.OpenIDConnectAutoDiscoveryURL)
+		}
+	}
+
+	return auth_model.CreateSource(&auth_model.Source{
+		Type:     auth_model.OAuth2,
+		Name:     c.String("name"),
+		IsActive: true,
+		Cfg:      config,
+	})
+}
+
+func runUpdateOauth(c *cli.Context) error {
+	if !c.IsSet("id") {
+		return fmt.Errorf("--id flag is missing")
+	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	source, err := auth_model.GetSourceByID(c.Int64("id"))
+	if err != nil {
+		return err
+	}
+
+	oAuth2Config := source.Cfg.(*oauth2.Source)
+
+	if c.IsSet("name") {
+		source.Name = c.String("name")
+	}
+
+	if c.IsSet("provider") {
+		oAuth2Config.Provider = c.String("provider")
+	}
+
+	if c.IsSet("key") {
+		oAuth2Config.ClientID = c.String("key")
+	}
+
+	if c.IsSet("secret") {
+		oAuth2Config.ClientSecret = c.String("secret")
+	}
+
+	if c.IsSet("auto-discover-url") {
+		oAuth2Config.OpenIDConnectAutoDiscoveryURL = c.String("auto-discover-url")
+	}
+
+	if c.IsSet("icon-url") {
+		oAuth2Config.IconURL = c.String("icon-url")
+	}
+
+	if c.IsSet("scopes") {
+		oAuth2Config.Scopes = c.StringSlice("scopes")
+	}
+
+	if c.IsSet("required-claim-name") {
+		oAuth2Config.RequiredClaimName = c.String("required-claim-name")
+	}
+	if c.IsSet("required-claim-value") {
+		oAuth2Config.RequiredClaimValue = c.String("required-claim-value")
+	}
+
+	if c.IsSet("group-claim-name") {
+		oAuth2Config.GroupClaimName = c.String("group-claim-name")
+	}
+	if c.IsSet("admin-group") {
+		oAuth2Config.AdminGroup = c.String("admin-group")
+	}
+	if c.IsSet("restricted-group") {
+		oAuth2Config.RestrictedGroup = c.String("restricted-group")
+	}
+	if c.IsSet("group-team-map") {
+		oAuth2Config.GroupTeamMap = c.String("group-team-map")
+	}
+	if c.IsSet("group-team-map-removal") {
+		oAuth2Config.GroupTeamMapRemoval = c.Bool("group-team-map-removal")
+	}
+
+	// update custom URL mapping
+	customURLMapping := &oauth2.CustomURLMapping{}
+
+	if oAuth2Config.CustomURLMapping != nil {
+		customURLMapping.TokenURL = oAuth2Config.CustomURLMapping.TokenURL
+		customURLMapping.AuthURL = oAuth2Config.CustomURLMapping.AuthURL
+		customURLMapping.ProfileURL = oAuth2Config.CustomURLMapping.ProfileURL
+		customURLMapping.EmailURL = oAuth2Config.CustomURLMapping.EmailURL
+		customURLMapping.Tenant = oAuth2Config.CustomURLMapping.Tenant
+	}
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-token-url") {
+		customURLMapping.TokenURL = c.String("custom-token-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-auth-url") {
+		customURLMapping.AuthURL = c.String("custom-auth-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-profile-url") {
+		customURLMapping.ProfileURL = c.String("custom-profile-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-email-url") {
+		customURLMapping.EmailURL = c.String("custom-email-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-tenant-id") {
+		customURLMapping.Tenant = c.String("custom-tenant-id")
+	}
+
+	oAuth2Config.CustomURLMapping = customURLMapping
+	source.Cfg = oAuth2Config
+
+	return auth_model.UpdateSource(source)
+}
+
+func parseSMTPConfig(c *cli.Context, conf *smtp.Source) error {
+	if c.IsSet("auth-type") {
+		conf.Auth = c.String("auth-type")
+		validAuthTypes := []string{"PLAIN", "LOGIN", "CRAM-MD5"}
+		if !util.SliceContainsString(validAuthTypes, strings.ToUpper(c.String("auth-type"))) {
+			return errors.New("Auth must be one of PLAIN/LOGIN/CRAM-MD5")
+		}
+		conf.Auth = c.String("auth-type")
+	}
+	if c.IsSet("host") {
+		conf.Host = c.String("host")
+	}
+	if c.IsSet("port") {
+		conf.Port = c.Int("port")
+	}
+	if c.IsSet("allowed-domains") {
+		conf.AllowedDomains = c.String("allowed-domains")
+	}
+	if c.IsSet("force-smtps") {
+		conf.ForceSMTPS = c.Bool("force-smtps")
+	}
+	if c.IsSet("skip-verify") {
+		conf.SkipVerify = c.Bool("skip-verify")
+	}
+	if c.IsSet("helo-hostname") {
+		conf.HeloHostname = c.String("helo-hostname")
+	}
+	if c.IsSet("disable-helo") {
+		conf.DisableHelo = c.Bool("disable-helo")
+	}
+	if c.IsSet("skip-local-2fa") {
+		conf.SkipLocalTwoFA = c.Bool("skip-local-2fa")
+	}
+	return nil
+}
+
+func runAddSMTP(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	if !c.IsSet("name") || len(c.String("name")) == 0 {
+		return errors.New("name must be set")
+	}
+	if !c.IsSet("host") || len(c.String("host")) == 0 {
+		return errors.New("host must be set")
+	}
+	if !c.IsSet("port") {
+		return errors.New("port must be set")
+	}
+	active := true
+	if c.IsSet("active") {
+		active = c.Bool("active")
+	}
+
+	var smtpConfig smtp.Source
+	if err := parseSMTPConfig(c, &smtpConfig); err != nil {
+		return err
+	}
+
+	// If not set default to PLAIN
+	if len(smtpConfig.Auth) == 0 {
+		smtpConfig.Auth = "PLAIN"
+	}
+
+	return auth_model.CreateSource(&auth_model.Source{
+		Type:     auth_model.SMTP,
+		Name:     c.String("name"),
+		IsActive: active,
+		Cfg:      &smtpConfig,
+	})
+}
+
+func runUpdateSMTP(c *cli.Context) error {
+	if !c.IsSet("id") {
+		return fmt.Errorf("--id flag is missing")
+	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	source, err := auth_model.GetSourceByID(c.Int64("id"))
+	if err != nil {
+		return err
+	}
+
+	smtpConfig := source.Cfg.(*smtp.Source)
+
+	if err := parseSMTPConfig(c, smtpConfig); err != nil {
+		return err
+	}
+
+	if c.IsSet("name") {
+		source.Name = c.String("name")
+	}
+
+	if c.IsSet("active") {
+		source.IsActive = c.Bool("active")
+	}
+
+	source.Cfg = smtpConfig
+
+	return auth_model.UpdateSource(source)
+}
+
+func runListAuth(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	authSources, err := auth_model.Sources()
+	if err != nil {
+		return err
+	}
+
+	flags := tabwriter.AlignRight
+	if c.Bool("vertical-bars") {
+		flags |= tabwriter.Debug
+	}
+
+	padChar := byte('\t')
+	if len(c.String("pad-char")) > 0 {
+		padChar = c.String("pad-char")[0]
+	}
+
+	// loop through each source and print
+	w := tabwriter.NewWriter(os.Stdout, c.Int("min-width"), c.Int("tab-width"), c.Int("padding"), padChar, flags)
+	fmt.Fprintf(w, "ID\tName\tType\tEnabled\n")
+	for _, source := range authSources {
+		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, source.Type.String(), source.IsActive)
+	}
+	w.Flush()
+
+	return nil
+}
+
+func runDeleteAuth(c *cli.Context) error {
+	if !c.IsSet("id") {
+		return fmt.Errorf("--id flag is missing")
+	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	source, err := auth_model.GetSourceByID(c.Int64("id"))
+	if err != nil {
+		return err
+	}
+
+	return auth_service.DeleteSource(source)
+}
--- a/cmd/admin_auth.go
+++ b/cmd/admin_auth.go
@@ -1,111 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"text/tabwriter"
-
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	auth_service "code.gitea.io/gitea/services/auth"
-
-	"github.com/urfave/cli/v2"
-)
-
-var (
-	microcmdAuthDelete = &cli.Command{
-		Name:   "delete",
-		Usage:  "Delete specific auth source",
-		Flags:  []cli.Flag{idFlag},
-		Action: runDeleteAuth,
-	}
-	microcmdAuthList = &cli.Command{
-		Name:   "list",
-		Usage:  "List auth sources",
-		Action: runListAuth,
-		Flags: []cli.Flag{
-			&cli.IntFlag{
-				Name:  "min-width",
-				Usage: "Minimal cell width including any padding for the formatted table",
-				Value: 0,
-			},
-			&cli.IntFlag{
-				Name:  "tab-width",
-				Usage: "width of tab characters in formatted table (equivalent number of spaces)",
-				Value: 8,
-			},
-			&cli.IntFlag{
-				Name:  "padding",
-				Usage: "padding added to a cell before computing its width",
-				Value: 1,
-			},
-			&cli.StringFlag{
-				Name:  "pad-char",
-				Usage: `ASCII char used for padding if padchar == '\\t', the Writer will assume that the width of a '\\t' in the formatted output is tabwidth, and cells are left-aligned independent of align_left (for correct-looking results, tabwidth must correspond to the tab width in the viewer displaying the result)`,
-				Value: "\t",
-			},
-			&cli.BoolFlag{
-				Name:  "vertical-bars",
-				Usage: "Set to true to print vertical bars between columns",
-			},
-		},
-	}
-)
-
-func runListAuth(c *cli.Context) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	authSources, err := db.Find[auth_model.Source](ctx, auth_model.FindSourcesOptions{})
-	if err != nil {
-		return err
-	}
-
-	flags := tabwriter.AlignRight
-	if c.Bool("vertical-bars") {
-		flags |= tabwriter.Debug
-	}
-
-	padChar := byte('\t')
-	if len(c.String("pad-char")) > 0 {
-		padChar = c.String("pad-char")[0]
-	}
-
-	// loop through each source and print
-	w := tabwriter.NewWriter(os.Stdout, c.Int("min-width"), c.Int("tab-width"), c.Int("padding"), padChar, flags)
-	fmt.Fprintf(w, "ID\tName\tType\tEnabled\n")
-	for _, source := range authSources {
-		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, source.Type.String(), source.IsActive)
-	}
-	w.Flush()
-
-	return nil
-}
-
-func runDeleteAuth(c *cli.Context) error {
-	if !c.IsSet("id") {
-		return errors.New("--id flag is missing")
-	}
-
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
-	if err != nil {
-		return err
-	}
-
-	return auth_service.DeleteSource(ctx, source)
-}
--- a/cmd/admin_auth_ldap.go
+++ b/cmd/admin_auth_ldap.go
@@ -17,9 +17,9 @@ import (
 type (
 	authService struct {
 		initDB            func(ctx context.Context) error
-		createAuthSource  func(context.Context, *auth.Source) error
-		updateAuthSource  func(context.Context, *auth.Source) error
-		getAuthSourceByID func(ctx context.Context, id int64) (*auth.Source, error)
+		createAuthSource  func(*auth.Source) error
+		updateAuthSource  func(*auth.Source) error
+		getAuthSourceByID func(id int64) (*auth.Source, error)
 	}
 )

@@ -132,10 +132,10 @@ var (
 	ldapSimpleAuthCLIFlags = append(commonLdapCLIFlags,
 		&cli.StringFlag{
 			Name:  "user-dn",
-			Usage: "The user's DN.",
+			Usage: "The user’s DN.",
 		})

-	microcmdAuthAddLdapBindDn = &cli.Command{
+	cmdAuthAddLdapBindDn = &cli.Command{
 		Name:  "add-ldap",
 		Usage: "Add new LDAP (via Bind DN) authentication source",
 		Action: func(c *cli.Context) error {
@@ -144,7 +144,7 @@ var (
 		Flags: ldapBindDnCLIFlags,
 	}

-	microcmdAuthUpdateLdapBindDn = &cli.Command{
+	cmdAuthUpdateLdapBindDn = &cli.Command{
 		Name:  "update-ldap",
 		Usage: "Update existing LDAP (via Bind DN) authentication source",
 		Action: func(c *cli.Context) error {
@@ -153,7 +153,7 @@ var (
 		Flags: append([]cli.Flag{idFlag}, ldapBindDnCLIFlags...),
 	}

-	microcmdAuthAddLdapSimpleAuth = &cli.Command{
+	cmdAuthAddLdapSimpleAuth = &cli.Command{
 		Name:  "add-ldap-simple",
 		Usage: "Add new LDAP (simple auth) authentication source",
 		Action: func(c *cli.Context) error {
@@ -162,7 +162,7 @@ var (
 		Flags: ldapSimpleAuthCLIFlags,
 	}

-	microcmdAuthUpdateLdapSimpleAuth = &cli.Command{
+	cmdAuthUpdateLdapSimpleAuth = &cli.Command{
 		Name:  "update-ldap-simple",
 		Usage: "Update existing LDAP (simple auth) authentication source",
 		Action: func(c *cli.Context) error {
@@ -289,12 +289,12 @@ func findLdapSecurityProtocolByName(name string) (ldap.SecurityProtocol, bool) {

 // getAuthSource gets the login source by its id defined in the command line flags.
 // It returns an error if the id is not set, does not match any source or if the source is not of expected type.
-func (a *authService) getAuthSource(ctx context.Context, c *cli.Context, authType auth.Type) (*auth.Source, error) {
+func (a *authService) getAuthSource(c *cli.Context, authType auth.Type) (*auth.Source, error) {
 	if err := argsSet(c, "id"); err != nil {
 		return nil, err
 	}

-	authSource, err := a.getAuthSourceByID(ctx, c.Int64("id"))
+	authSource, err := a.getAuthSourceByID(c.Int64("id"))
 	if err != nil {
 		return nil, err
 	}
@@ -332,7 +332,7 @@ func (a *authService) addLdapBindDn(c *cli.Context) error {
 		return err
 	}

-	return a.createAuthSource(ctx, authSource)
+	return a.createAuthSource(authSource)
 }

 // updateLdapBindDn updates a new LDAP via Bind DN authentication source.
@@ -344,7 +344,7 @@ func (a *authService) updateLdapBindDn(c *cli.Context) error {
 		return err
 	}

-	authSource, err := a.getAuthSource(ctx, c, auth.LDAP)
+	authSource, err := a.getAuthSource(c, auth.LDAP)
 	if err != nil {
 		return err
 	}
@@ -354,7 +354,7 @@ func (a *authService) updateLdapBindDn(c *cli.Context) error {
 		return err
 	}

-	return a.updateAuthSource(ctx, authSource)
+	return a.updateAuthSource(authSource)
 }

 // addLdapSimpleAuth adds a new LDAP (simple auth) authentication source.
@@ -383,10 +383,10 @@ func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}

-	return a.createAuthSource(ctx, authSource)
+	return a.createAuthSource(authSource)
 }

-// updateLdapSimpleAuth updates a new LDAP (simple auth) authentication source.
+// updateLdapBindDn updates a new LDAP (simple auth) authentication source.
 func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
 	ctx, cancel := installSignals()
 	defer cancel()
@@ -395,7 +395,7 @@ func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}

-	authSource, err := a.getAuthSource(ctx, c, auth.DLDAP)
+	authSource, err := a.getAuthSource(c, auth.DLDAP)
 	if err != nil {
 		return err
 	}
@@ -405,5 +405,5 @@ func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}

-	return a.updateAuthSource(ctx, authSource)
+	return a.updateAuthSource(authSource)
 }
--- a/cmd/admin_auth_ldap_test.go
+++ b/cmd/admin_auth_ldap_test.go
@@ -210,15 +210,15 @@ func TestAddLdapBindDn(t *testing.T) {
 			initDB: func(context.Context) error {
 				return nil
 			},
-			createAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			createAuthSource: func(authSource *auth.Source) error {
 				createdAuthSource = authSource
 				return nil
 			},
-			updateAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			updateAuthSource: func(authSource *auth.Source) error {
 				assert.FailNow(t, "case %d: should not call updateAuthSource", n)
 				return nil
 			},
-			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
+			getAuthSourceByID: func(id int64) (*auth.Source, error) {
 				assert.FailNow(t, "case %d: should not call getAuthSourceByID", n)
 				return nil, nil
 			},
@@ -226,7 +226,7 @@ func TestAddLdapBindDn(t *testing.T) {

 		// Create a copy of command to test
 		app := cli.NewApp()
-		app.Flags = microcmdAuthAddLdapBindDn.Flags
+		app.Flags = cmdAuthAddLdapBindDn.Flags
 		app.Action = service.addLdapBindDn

 		// Run it
@@ -441,15 +441,15 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 			initDB: func(context.Context) error {
 				return nil
 			},
-			createAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			createAuthSource: func(authSource *auth.Source) error {
 				createdAuthSource = authSource
 				return nil
 			},
-			updateAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			updateAuthSource: func(authSource *auth.Source) error {
 				assert.FailNow(t, "case %d: should not call updateAuthSource", n)
 				return nil
 			},
-			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
+			getAuthSourceByID: func(id int64) (*auth.Source, error) {
 				assert.FailNow(t, "case %d: should not call getAuthSourceByID", n)
 				return nil, nil
 			},
@@ -457,7 +457,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {

 		// Create a copy of command to test
 		app := cli.NewApp()
-		app.Flags = microcmdAuthAddLdapSimpleAuth.Flags
+		app.Flags = cmdAuthAddLdapSimpleAuth.Flags
 		app.Action = service.addLdapSimpleAuth

 		// Run it
@@ -896,15 +896,15 @@ func TestUpdateLdapBindDn(t *testing.T) {
 			initDB: func(context.Context) error {
 				return nil
 			},
-			createAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			createAuthSource: func(authSource *auth.Source) error {
 				assert.FailNow(t, "case %d: should not call createAuthSource", n)
 				return nil
 			},
-			updateAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			updateAuthSource: func(authSource *auth.Source) error {
 				updatedAuthSource = authSource
 				return nil
 			},
-			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
+			getAuthSourceByID: func(id int64) (*auth.Source, error) {
 				if c.id != 0 {
 					assert.Equal(t, c.id, id, "case %d: wrong id", n)
 				}
@@ -920,7 +920,7 @@ func TestUpdateLdapBindDn(t *testing.T) {

 		// Create a copy of command to test
 		app := cli.NewApp()
-		app.Flags = microcmdAuthUpdateLdapBindDn.Flags
+		app.Flags = cmdAuthUpdateLdapBindDn.Flags
 		app.Action = service.updateLdapBindDn

 		// Run it
@@ -1286,15 +1286,15 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 			initDB: func(context.Context) error {
 				return nil
 			},
-			createAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			createAuthSource: func(authSource *auth.Source) error {
 				assert.FailNow(t, "case %d: should not call createAuthSource", n)
 				return nil
 			},
-			updateAuthSource: func(ctx context.Context, authSource *auth.Source) error {
+			updateAuthSource: func(authSource *auth.Source) error {
 				updatedAuthSource = authSource
 				return nil
 			},
-			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
+			getAuthSourceByID: func(id int64) (*auth.Source, error) {
 				if c.id != 0 {
 					assert.Equal(t, c.id, id, "case %d: wrong id", n)
 				}
@@ -1310,7 +1310,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {

 		// Create a copy of command to test
 		app := cli.NewApp()
-		app.Flags = microcmdAuthUpdateLdapSimpleAuth.Flags
+		app.Flags = cmdAuthUpdateLdapSimpleAuth.Flags
 		app.Action = service.updateLdapSimpleAuth

 		// Run it
--- a/cmd/admin_auth_oauth.go
+++ b/cmd/admin_auth_oauth.go
@@ -1,299 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"errors"
-	"fmt"
-	"net/url"
-
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-
-	"github.com/urfave/cli/v2"
-)
-
-var (
-	oauthCLIFlags = []cli.Flag{
-		&cli.StringFlag{
-			Name:  "name",
-			Value: "",
-			Usage: "Application Name",
-		},
-		&cli.StringFlag{
-			Name:  "provider",
-			Value: "",
-			Usage: "OAuth2 Provider",
-		},
-		&cli.StringFlag{
-			Name:  "key",
-			Value: "",
-			Usage: "Client ID (Key)",
-		},
-		&cli.StringFlag{
-			Name:  "secret",
-			Value: "",
-			Usage: "Client Secret",
-		},
-		&cli.StringFlag{
-			Name:  "auto-discover-url",
-			Value: "",
-			Usage: "OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider)",
-		},
-		&cli.StringFlag{
-			Name:  "use-custom-urls",
-			Value: "false",
-			Usage: "Use custom URLs for GitLab/GitHub OAuth endpoints",
-		},
-		&cli.StringFlag{
-			Name:  "custom-tenant-id",
-			Value: "",
-			Usage: "Use custom Tenant ID for OAuth endpoints",
-		},
-		&cli.StringFlag{
-			Name:  "custom-auth-url",
-			Value: "",
-			Usage: "Use a custom Authorization URL (option for GitLab/GitHub)",
-		},
-		&cli.StringFlag{
-			Name:  "custom-token-url",
-			Value: "",
-			Usage: "Use a custom Token URL (option for GitLab/GitHub)",
-		},
-		&cli.StringFlag{
-			Name:  "custom-profile-url",
-			Value: "",
-			Usage: "Use a custom Profile URL (option for GitLab/GitHub)",
-		},
-		&cli.StringFlag{
-			Name:  "custom-email-url",
-			Value: "",
-			Usage: "Use a custom Email URL (option for GitHub)",
-		},
-		&cli.StringFlag{
-			Name:  "icon-url",
-			Value: "",
-			Usage: "Custom icon URL for OAuth2 login source",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-local-2fa",
-			Usage: "Set to true to skip local 2fa for users authenticated by this source",
-		},
-		&cli.StringSliceFlag{
-			Name:  "scopes",
-			Value: nil,
-			Usage: "Scopes to request when to authenticate against this OAuth2 source",
-		},
-		&cli.StringFlag{
-			Name:  "required-claim-name",
-			Value: "",
-			Usage: "Claim name that has to be set to allow users to login with this source",
-		},
-		&cli.StringFlag{
-			Name:  "required-claim-value",
-			Value: "",
-			Usage: "Claim value that has to be set to allow users to login with this source",
-		},
-		&cli.StringFlag{
-			Name:  "group-claim-name",
-			Value: "",
-			Usage: "Claim name providing group names for this source",
-		},
-		&cli.StringFlag{
-			Name:  "admin-group",
-			Value: "",
-			Usage: "Group Claim value for administrator users",
-		},
-		&cli.StringFlag{
-			Name:  "restricted-group",
-			Value: "",
-			Usage: "Group Claim value for restricted users",
-		},
-		&cli.StringFlag{
-			Name:  "group-team-map",
-			Value: "",
-			Usage: "JSON mapping between groups and org teams",
-		},
-		&cli.BoolFlag{
-			Name:  "group-team-map-removal",
-			Usage: "Activate automatic team membership removal depending on groups",
-		},
-	}
-
-	microcmdAuthAddOauth = &cli.Command{
-		Name:   "add-oauth",
-		Usage:  "Add new Oauth authentication source",
-		Action: runAddOauth,
-		Flags:  oauthCLIFlags,
-	}
-
-	microcmdAuthUpdateOauth = &cli.Command{
-		Name:   "update-oauth",
-		Usage:  "Update existing Oauth authentication source",
-		Action: runUpdateOauth,
-		Flags:  append(oauthCLIFlags[:1], append([]cli.Flag{idFlag}, oauthCLIFlags[1:]...)...),
-	}
-)
-
-func parseOAuth2Config(c *cli.Context) *oauth2.Source {
-	var customURLMapping *oauth2.CustomURLMapping
-	if c.IsSet("use-custom-urls") {
-		customURLMapping = &oauth2.CustomURLMapping{
-			TokenURL:   c.String("custom-token-url"),
-			AuthURL:    c.String("custom-auth-url"),
-			ProfileURL: c.String("custom-profile-url"),
-			EmailURL:   c.String("custom-email-url"),
-			Tenant:     c.String("custom-tenant-id"),
-		}
-	} else {
-		customURLMapping = nil
-	}
-	return &oauth2.Source{
-		Provider:                      c.String("provider"),
-		ClientID:                      c.String("key"),
-		ClientSecret:                  c.String("secret"),
-		OpenIDConnectAutoDiscoveryURL: c.String("auto-discover-url"),
-		CustomURLMapping:              customURLMapping,
-		IconURL:                       c.String("icon-url"),
-		SkipLocalTwoFA:                c.Bool("skip-local-2fa"),
-		Scopes:                        c.StringSlice("scopes"),
-		RequiredClaimName:             c.String("required-claim-name"),
-		RequiredClaimValue:            c.String("required-claim-value"),
-		GroupClaimName:                c.String("group-claim-name"),
-		AdminGroup:                    c.String("admin-group"),
-		RestrictedGroup:               c.String("restricted-group"),
-		GroupTeamMap:                  c.String("group-team-map"),
-		GroupTeamMapRemoval:           c.Bool("group-team-map-removal"),
-	}
-}
-
-func runAddOauth(c *cli.Context) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	config := parseOAuth2Config(c)
-	if config.Provider == "openidConnect" {
-		discoveryURL, err := url.Parse(config.OpenIDConnectAutoDiscoveryURL)
-		if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
-			return fmt.Errorf("invalid Auto Discovery URL: %s (this must be a valid URL starting with http:// or https://)", config.OpenIDConnectAutoDiscoveryURL)
-		}
-	}
-
-	return auth_model.CreateSource(ctx, &auth_model.Source{
-		Type:     auth_model.OAuth2,
-		Name:     c.String("name"),
-		IsActive: true,
-		Cfg:      config,
-	})
-}
-
-func runUpdateOauth(c *cli.Context) error {
-	if !c.IsSet("id") {
-		return errors.New("--id flag is missing")
-	}
-
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
-	if err != nil {
-		return err
-	}
-
-	oAuth2Config := source.Cfg.(*oauth2.Source)
-
-	if c.IsSet("name") {
-		source.Name = c.String("name")
-	}
-
-	if c.IsSet("provider") {
-		oAuth2Config.Provider = c.String("provider")
-	}
-
-	if c.IsSet("key") {
-		oAuth2Config.ClientID = c.String("key")
-	}
-
-	if c.IsSet("secret") {
-		oAuth2Config.ClientSecret = c.String("secret")
-	}
-
-	if c.IsSet("auto-discover-url") {
-		oAuth2Config.OpenIDConnectAutoDiscoveryURL = c.String("auto-discover-url")
-	}
-
-	if c.IsSet("icon-url") {
-		oAuth2Config.IconURL = c.String("icon-url")
-	}
-
-	if c.IsSet("scopes") {
-		oAuth2Config.Scopes = c.StringSlice("scopes")
-	}
-
-	if c.IsSet("required-claim-name") {
-		oAuth2Config.RequiredClaimName = c.String("required-claim-name")
-	}
-	if c.IsSet("required-claim-value") {
-		oAuth2Config.RequiredClaimValue = c.String("required-claim-value")
-	}
-
-	if c.IsSet("group-claim-name") {
-		oAuth2Config.GroupClaimName = c.String("group-claim-name")
-	}
-	if c.IsSet("admin-group") {
-		oAuth2Config.AdminGroup = c.String("admin-group")
-	}
-	if c.IsSet("restricted-group") {
-		oAuth2Config.RestrictedGroup = c.String("restricted-group")
-	}
-	if c.IsSet("group-team-map") {
-		oAuth2Config.GroupTeamMap = c.String("group-team-map")
-	}
-	if c.IsSet("group-team-map-removal") {
-		oAuth2Config.GroupTeamMapRemoval = c.Bool("group-team-map-removal")
-	}
-
-	// update custom URL mapping
-	customURLMapping := &oauth2.CustomURLMapping{}
-
-	if oAuth2Config.CustomURLMapping != nil {
-		customURLMapping.TokenURL = oAuth2Config.CustomURLMapping.TokenURL
-		customURLMapping.AuthURL = oAuth2Config.CustomURLMapping.AuthURL
-		customURLMapping.ProfileURL = oAuth2Config.CustomURLMapping.ProfileURL
-		customURLMapping.EmailURL = oAuth2Config.CustomURLMapping.EmailURL
-		customURLMapping.Tenant = oAuth2Config.CustomURLMapping.Tenant
-	}
-	if c.IsSet("use-custom-urls") && c.IsSet("custom-token-url") {
-		customURLMapping.TokenURL = c.String("custom-token-url")
-	}
-
-	if c.IsSet("use-custom-urls") && c.IsSet("custom-auth-url") {
-		customURLMapping.AuthURL = c.String("custom-auth-url")
-	}
-
-	if c.IsSet("use-custom-urls") && c.IsSet("custom-profile-url") {
-		customURLMapping.ProfileURL = c.String("custom-profile-url")
-	}
-
-	if c.IsSet("use-custom-urls") && c.IsSet("custom-email-url") {
-		customURLMapping.EmailURL = c.String("custom-email-url")
-	}
-
-	if c.IsSet("use-custom-urls") && c.IsSet("custom-tenant-id") {
-		customURLMapping.Tenant = c.String("custom-tenant-id")
-	}
-
-	oAuth2Config.CustomURLMapping = customURLMapping
-	source.Cfg = oAuth2Config
-
-	return auth_model.UpdateSource(ctx, source)
-}
--- a/cmd/admin_auth_stmp.go
+++ b/cmd/admin_auth_stmp.go
@@ -1,200 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"errors"
-	"strings"
-
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/smtp"
-
-	"github.com/urfave/cli/v2"
-)
-
-var (
-	smtpCLIFlags = []cli.Flag{
-		&cli.StringFlag{
-			Name:  "name",
-			Value: "",
-			Usage: "Application Name",
-		},
-		&cli.StringFlag{
-			Name:  "auth-type",
-			Value: "PLAIN",
-			Usage: "SMTP Authentication Type (PLAIN/LOGIN/CRAM-MD5) default PLAIN",
-		},
-		&cli.StringFlag{
-			Name:  "host",
-			Value: "",
-			Usage: "SMTP Host",
-		},
-		&cli.IntFlag{
-			Name:  "port",
-			Usage: "SMTP Port",
-		},
-		&cli.BoolFlag{
-			Name:  "force-smtps",
-			Usage: "SMTPS is always used on port 465. Set this to force SMTPS on other ports.",
-			Value: true,
-		},
-		&cli.BoolFlag{
-			Name:  "skip-verify",
-			Usage: "Skip TLS verify.",
-			Value: true,
-		},
-		&cli.StringFlag{
-			Name:  "helo-hostname",
-			Value: "",
-			Usage: "Hostname sent with HELO. Leave blank to send current hostname",
-		},
-		&cli.BoolFlag{
-			Name:  "disable-helo",
-			Usage: "Disable SMTP helo.",
-			Value: true,
-		},
-		&cli.StringFlag{
-			Name:  "allowed-domains",
-			Value: "",
-			Usage: "Leave empty to allow all domains. Separate multiple domains with a comma (',')",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-local-2fa",
-			Usage: "Skip 2FA to log on.",
-			Value: true,
-		},
-		&cli.BoolFlag{
-			Name:  "active",
-			Usage: "This Authentication Source is Activated.",
-			Value: true,
-		},
-	}
-
-	microcmdAuthAddSMTP = &cli.Command{
-		Name:   "add-smtp",
-		Usage:  "Add new SMTP authentication source",
-		Action: runAddSMTP,
-		Flags:  smtpCLIFlags,
-	}
-
-	microcmdAuthUpdateSMTP = &cli.Command{
-		Name:   "update-smtp",
-		Usage:  "Update existing SMTP authentication source",
-		Action: runUpdateSMTP,
-		Flags:  append(smtpCLIFlags[:1], append([]cli.Flag{idFlag}, smtpCLIFlags[1:]...)...),
-	}
-)
-
-func parseSMTPConfig(c *cli.Context, conf *smtp.Source) error {
-	if c.IsSet("auth-type") {
-		conf.Auth = c.String("auth-type")
-		validAuthTypes := []string{"PLAIN", "LOGIN", "CRAM-MD5"}
-		if !util.SliceContainsString(validAuthTypes, strings.ToUpper(c.String("auth-type"))) {
-			return errors.New("Auth must be one of PLAIN/LOGIN/CRAM-MD5")
-		}
-		conf.Auth = c.String("auth-type")
-	}
-	if c.IsSet("host") {
-		conf.Host = c.String("host")
-	}
-	if c.IsSet("port") {
-		conf.Port = c.Int("port")
-	}
-	if c.IsSet("allowed-domains") {
-		conf.AllowedDomains = c.String("allowed-domains")
-	}
-	if c.IsSet("force-smtps") {
-		conf.ForceSMTPS = c.Bool("force-smtps")
-	}
-	if c.IsSet("skip-verify") {
-		conf.SkipVerify = c.Bool("skip-verify")
-	}
-	if c.IsSet("helo-hostname") {
-		conf.HeloHostname = c.String("helo-hostname")
-	}
-	if c.IsSet("disable-helo") {
-		conf.DisableHelo = c.Bool("disable-helo")
-	}
-	if c.IsSet("skip-local-2fa") {
-		conf.SkipLocalTwoFA = c.Bool("skip-local-2fa")
-	}
-	return nil
-}
-
-func runAddSMTP(c *cli.Context) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	if !c.IsSet("name") || len(c.String("name")) == 0 {
-		return errors.New("name must be set")
-	}
-	if !c.IsSet("host") || len(c.String("host")) == 0 {
-		return errors.New("host must be set")
-	}
-	if !c.IsSet("port") {
-		return errors.New("port must be set")
-	}
-	active := true
-	if c.IsSet("active") {
-		active = c.Bool("active")
-	}
-
-	var smtpConfig smtp.Source
-	if err := parseSMTPConfig(c, &smtpConfig); err != nil {
-		return err
-	}
-
-	// If not set default to PLAIN
-	if len(smtpConfig.Auth) == 0 {
-		smtpConfig.Auth = "PLAIN"
-	}
-
-	return auth_model.CreateSource(ctx, &auth_model.Source{
-		Type:     auth_model.SMTP,
-		Name:     c.String("name"),
-		IsActive: active,
-		Cfg:      &smtpConfig,
-	})
-}
-
-func runUpdateSMTP(c *cli.Context) error {
-	if !c.IsSet("id") {
-		return errors.New("--id flag is missing")
-	}
-
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
-	if err != nil {
-		return err
-	}
-
-	smtpConfig := source.Cfg.(*smtp.Source)
-
-	if err := parseSMTPConfig(c, smtpConfig); err != nil {
-		return err
-	}
-
-	if c.IsSet("name") {
-		source.Name = c.String("name")
-	}
-
-	if c.IsSet("active") {
-		source.IsActive = c.Bool("active")
-	}
-
-	source.Cfg = smtpConfig
-
-	return auth_model.UpdateSource(ctx, source)
-}
--- a/cmd/admin_regenerate.go
+++ b/cmd/admin_regenerate.go
@@ -1,46 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"code.gitea.io/gitea/modules/graceful"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	repo_service "code.gitea.io/gitea/services/repository"
-
-	"github.com/urfave/cli/v2"
-)
-
-var (
-	microcmdRegenHooks = &cli.Command{
-		Name:   "hooks",
-		Usage:  "Regenerate git-hooks",
-		Action: runRegenerateHooks,
-	}
-
-	microcmdRegenKeys = &cli.Command{
-		Name:   "keys",
-		Usage:  "Regenerate authorized_keys file",
-		Action: runRegenerateKeys,
-	}
-)
-
-func runRegenerateHooks(_ *cli.Context) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-	return repo_service.SyncRepositoryHooks(graceful.GetManager().ShutdownContext())
-}
-
-func runRegenerateKeys(_ *cli.Context) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-	return asymkey_service.RewriteAllPublicKeys(ctx)
-}
--- a/cmd/admin_user_change_password.go
+++ b/cmd/admin_user_change_password.go
@@ -4,14 +4,13 @@
 package cmd

 import (
+	"context"
 	"errors"
 	"fmt"

 	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
+	pwd "code.gitea.io/gitea/modules/auth/password"
 	"code.gitea.io/gitea/modules/setting"
-	user_service "code.gitea.io/gitea/services/user"

 	"github.com/urfave/cli/v2"
 )
@@ -33,11 +32,6 @@ var microcmdUserChangePassword = &cli.Command{
 			Value:   "",
 			Usage:   "New password to set for user",
 		},
-		&cli.BoolFlag{
-			Name:  "must-change-password",
-			Usage: "User must change password (can be disabled by --must-change-password=false)",
-			Value: true,
-		},
 	},
 }

@@ -52,27 +46,31 @@ func runChangePassword(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	if len(c.String("password")) < setting.MinPasswordLength {
+		return fmt.Errorf("Password is not long enough. Needs to be at least %d", setting.MinPasswordLength)
+	}

-	user, err := user_model.GetUserByName(ctx, c.String("username"))
+	if !pwd.IsComplexEnough(c.String("password")) {
+		return errors.New("Password does not meet complexity requirements")
+	}
+	pwned, err := pwd.IsPwned(context.Background(), c.String("password"))
 	if err != nil {
 		return err
 	}
-
-	opts := &user_service.UpdateAuthOptions{
-		Password:           optional.Some(c.String("password")),
-		MustChangePassword: optional.Some(c.Bool("must-change-password")),
+	if pwned {
+		return errors.New("The password you chose is on a list of stolen passwords previously exposed in public data breaches. Please try again with a different password.\nFor more details, see https://haveibeenpwned.com/Passwords")
 	}
-	if err := user_service.UpdateAuth(ctx, user, opts); err != nil {
-		switch {
-		case errors.Is(err, password.ErrMinLength):
-			return fmt.Errorf("password is not long enough, needs to be at least %d characters", setting.MinPasswordLength)
-		case errors.Is(err, password.ErrComplexity):
-			return errors.New("password does not meet complexity requirements")
-		case errors.Is(err, password.ErrIsPwned):
-			return errors.New("the password is in a list of stolen passwords previously exposed in public data breaches, please try again with a different password, to see more details: https://haveibeenpwned.com/Passwords")
-		default:
-			return err
-		}
+	uname := c.String("username")
+	user, err := user_model.GetUserByName(ctx, uname)
+	if err != nil {
+		return err
+	}
+	if err = user.SetPassword(c.String("password")); err != nil {
+		return err
+	}
+
+	if err = user_model.UpdateUserCols(ctx, user, "passwd", "passwd_hash_algo", "salt"); err != nil {
+		return err
 	}

 	fmt.Printf("%s's password has been successfully updated!\n", user.Name)
--- a/cmd/admin_user_create.go
+++ b/cmd/admin_user_create.go
@@ -4,16 +4,14 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"

 	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
 	user_model "code.gitea.io/gitea/models/user"
 	pwd "code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"

 	"github.com/urfave/cli/v2"
 )
@@ -48,9 +46,8 @@ var microcmdUserCreate = &cli.Command{
 			Usage: "Generate a random password for the user",
 		},
 		&cli.BoolFlag{
-			Name:               "must-change-password",
-			Usage:              "User must change password after initial login, defaults to true for all users except the first one (can be disabled by --must-change-password=false)",
-			DisableDefaultText: true,
+			Name:  "must-change-password",
+			Usage: "Set this option to false to prevent forcing the user to change their password after initial login, (Default: true)",
 		},
 		&cli.IntFlag{
 			Name:  "random-password-length",
@@ -74,10 +71,10 @@ func runCreateUser(c *cli.Context) error {
 	}

 	if c.IsSet("name") && c.IsSet("username") {
-		return errors.New("cannot set both --name and --username flags")
+		return errors.New("Cannot set both --name and --username flags")
 	}
 	if !c.IsSet("name") && !c.IsSet("username") {
-		return errors.New("one of --name or --username flags must be set")
+		return errors.New("One of --name or --username flags must be set")
 	}

 	if c.IsSet("password") && c.IsSet("random-password") {
@@ -92,16 +89,11 @@ func runCreateUser(c *cli.Context) error {
 		_, _ = fmt.Fprintf(c.App.ErrWriter, "--name flag is deprecated. Use --username instead.\n")
 	}

-	ctx := c.Context
-	if !setting.IsInTesting {
-		// FIXME: need to refactor the "installSignals/initDB" related code later
-		// it doesn't make sense to call it in (almost) every command action function
-		var cancel context.CancelFunc
-		ctx, cancel = installSignals()
-		defer cancel()
-		if err := initDB(ctx); err != nil {
-			return err
-		}
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
 	}

 	var password string
@@ -118,27 +110,23 @@ func runCreateUser(c *cli.Context) error {
 		return errors.New("must set either password or random-password flag")
 	}

-	isAdmin := c.Bool("admin")
-	mustChangePassword := true // always default to true
-	if c.IsSet("must-change-password") {
-		// if the flag is set, use the value provided by the user
-		mustChangePassword = c.Bool("must-change-password")
-	} else {
-		// check whether there are users in the database
-		hasUserRecord, err := db.IsTableNotEmpty(&user_model.User{})
-		if err != nil {
-			return fmt.Errorf("IsTableNotEmpty: %w", err)
-		}
-		if !hasUserRecord {
-			// if this is the first one being created, don't force to change password (keep the old behavior)
-			mustChangePassword = false
-		}
+	// always default to true
+	changePassword := true
+
+	// If this is the first user being created.
+	// Take it as the admin and don't force a password update.
+	if n := user_model.CountUsers(ctx, nil); n == 0 {
+		changePassword = false
 	}

-	restricted := optional.None[bool]()
+	if c.IsSet("must-change-password") {
+		changePassword = c.Bool("must-change-password")
+	}
+
+	restricted := util.OptionalBoolNone

 	if c.IsSet("restricted") {
-		restricted = optional.Some(c.Bool("restricted"))
+		restricted = util.OptionalBoolOf(c.Bool("restricted"))
 	}

 	// default user visibility in app.ini
@@ -148,17 +136,17 @@ func runCreateUser(c *cli.Context) error {
 		Name:               username,
 		Email:              c.String("email"),
 		Passwd:             password,
-		IsAdmin:            isAdmin,
-		MustChangePassword: mustChangePassword,
+		IsAdmin:            c.Bool("admin"),
+		MustChangePassword: changePassword,
 		Visibility:         visibility,
 	}

 	overwriteDefault := &user_model.CreateUserOverwriteOptions{
-		IsActive:     optional.Some(true),
+		IsActive:     util.OptionalBoolTrue,
 		IsRestricted: restricted,
 	}

-	if err := user_model.CreateUser(ctx, u, &user_model.Meta{}, overwriteDefault); err != nil {
+	if err := user_model.CreateUser(ctx, u, overwriteDefault); err != nil {
 		return fmt.Errorf("CreateUser: %w", err)
 	}

--- a/cmd/admin_user_create_test.go
+++ b/cmd/admin_user_create_test.go
@@ -1,44 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestAdminUserCreate(t *testing.T) {
-	app := NewMainApp(AppVersion{})
-
-	reset := func() {
-		assert.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.User{}))
-		assert.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.EmailAddress{}))
-	}
-
-	type createCheck struct{ IsAdmin, MustChangePassword bool }
-	createUser := func(name, args string) createCheck {
-		assert.NoError(t, app.Run(strings.Fields(fmt.Sprintf("./gitea admin user create --username %s --email %s@gitea.local %s --password foobar", name, name, args))))
-		u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: name})
-		return createCheck{u.IsAdmin, u.MustChangePassword}
-	}
-	reset()
-	assert.Equal(t, createCheck{IsAdmin: false, MustChangePassword: false}, createUser("u", ""), "first non-admin user doesn't need to change password")
-
-	reset()
-	assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: false}, createUser("u", "--admin"), "first admin user doesn't need to change password")
-
-	reset()
-	assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: true}, createUser("u", "--admin --must-change-password"))
-	assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: true}, createUser("u2", "--admin"))
-	assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: false}, createUser("u3", "--admin --must-change-password=false"))
-	assert.Equal(t, createCheck{IsAdmin: false, MustChangePassword: true}, createUser("u4", ""))
-	assert.Equal(t, createCheck{IsAdmin: false, MustChangePassword: false}, createUser("u5", "--must-change-password=false"))
-}
--- a/cmd/admin_user_delete.go
+++ b/cmd/admin_user_delete.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"errors"
 	"fmt"
 	"strings"

@@ -43,7 +42,7 @@ var microcmdUserDelete = &cli.Command{

 func runDeleteUser(c *cli.Context) error {
 	if !c.IsSet("id") && !c.IsSet("username") && !c.IsSet("email") {
-		return errors.New("You must provide the id, username or email of a user to delete")
+		return fmt.Errorf("You must provide the id, username or email of a user to delete")
 	}

 	ctx, cancel := installSignals()
--- a/cmd/admin_user_generate_access_token.go
+++ b/cmd/admin_user_generate_access_token.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"errors"
 	"fmt"

 	auth_model "code.gitea.io/gitea/models/auth"
@@ -43,7 +42,7 @@ var microcmdUserGenerateAccessToken = &cli.Command{

 func runGenerateAccessToken(c *cli.Context) error {
 	if !c.IsSet("username") {
-		return errors.New("You must provide a username to generate a token for")
+		return fmt.Errorf("You must provide a username to generate a token for")
 	}

 	ctx, cancel := installSignals()
@@ -69,7 +68,7 @@ func runGenerateAccessToken(c *cli.Context) error {
 		return err
 	}
 	if exist {
-		return errors.New("access token name has been used already")
+		return fmt.Errorf("access token name has been used already")
 	}

 	// make sure the scopes are valid
--- a/cmd/doctor.go
+++ b/cmd/doctor.go
@@ -15,9 +15,9 @@ import (
 	"code.gitea.io/gitea/models/migrations"
 	migrate_base "code.gitea.io/gitea/models/migrations/base"
 	"code.gitea.io/gitea/modules/container"
+	"code.gitea.io/gitea/modules/doctor"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/doctor"

 	"github.com/urfave/cli/v2"
 	"xorm.io/xorm"
@@ -26,7 +26,7 @@ import (
 // CmdDoctor represents the available doctor sub-command.
 var CmdDoctor = &cli.Command{
 	Name:        "doctor",
-	Usage:       "Diagnose and optionally fix problems, convert or re-create database tables",
+	Usage:       "Diagnose and optionally fix problems",
 	Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",

 	Subcommands: []*cli.Command{
--- a/cmd/doctor_convert.go
+++ b/cmd/doctor_convert.go
@@ -37,8 +37,8 @@ func runDoctorConvert(ctx *cli.Context) error {

 	switch {
 	case setting.Database.Type.IsMySQL():
-		if err := db.ConvertDatabaseTable(); err != nil {
-			log.Fatal("Failed to convert database & table: %v", err)
+		if err := db.ConvertUtf8ToUtf8mb4(); err != nil {
+			log.Fatal("Failed to convert database from utf8 to utf8mb4: %v", err)
 			return err
 		}
 		fmt.Println("Converted successfully, please confirm your database's character set is now utf8mb4")
--- a/cmd/doctor_test.go
+++ b/cmd/doctor_test.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"

+	"code.gitea.io/gitea/modules/doctor"
 	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/doctor"

 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v2"
--- a/cmd/dump.go
+++ b/cmd/dump.go
@@ -6,13 +6,14 @@ package cmd

 import (
 	"fmt"
+	"io"
 	"os"
 	"path"
 	"path/filepath"
 	"strings"
+	"time"

 	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/dump"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -24,17 +25,89 @@ import (
 	"github.com/urfave/cli/v2"
 )

+func addReader(w archiver.Writer, r io.ReadCloser, info os.FileInfo, customName string, verbose bool) error {
+	if verbose {
+		log.Info("Adding file %s", customName)
+	}
+
+	return w.Write(archiver.File{
+		FileInfo: archiver.FileInfo{
+			FileInfo:   info,
+			CustomName: customName,
+		},
+		ReadCloser: r,
+	})
+}
+
+func addFile(w archiver.Writer, filePath, absPath string, verbose bool) error {
+	file, err := os.Open(absPath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	fileInfo, err := file.Stat()
+	if err != nil {
+		return err
+	}
+
+	return addReader(w, file, fileInfo, filePath, verbose)
+}
+
+func isSubdir(upper, lower string) (bool, error) {
+	if relPath, err := filepath.Rel(upper, lower); err != nil {
+		return false, err
+	} else if relPath == "." || !strings.HasPrefix(relPath, ".") {
+		return true, nil
+	}
+	return false, nil
+}
+
+type outputType struct {
+	Enum     []string
+	Default  string
+	selected string
+}
+
+func (o outputType) Join() string {
+	return strings.Join(o.Enum, ", ")
+}
+
+func (o *outputType) Set(value string) error {
+	for _, enum := range o.Enum {
+		if enum == value {
+			o.selected = value
+			return nil
+		}
+	}
+
+	return fmt.Errorf("allowed values are %s", o.Join())
+}
+
+func (o outputType) String() string {
+	if o.selected == "" {
+		return o.Default
+	}
+	return o.selected
+}
+
+var outputTypeEnum = &outputType{
+	Enum:    []string{"zip", "tar", "tar.sz", "tar.gz", "tar.xz", "tar.bz2", "tar.br", "tar.lz4", "tar.zst"},
+	Default: "zip",
+}
+
 // CmdDump represents the available dump sub-command.
 var CmdDump = &cli.Command{
-	Name:        "dump",
-	Usage:       "Dump Gitea files and database",
-	Description: `Dump compresses all related files and database into zip file. It can be used for backup and capture Gitea server image to send to maintainer`,
-	Action:      runDump,
+	Name:  "dump",
+	Usage: "Dump Gitea files and database",
+	Description: `Dump compresses all related files and database into zip file.
+It can be used for backup and capture Gitea server image to send to maintainer`,
+	Action: runDump,
 	Flags: []cli.Flag{
 		&cli.StringFlag{
 			Name:    "file",
 			Aliases: []string{"f"},
-			Usage:   `Name of the dump file which will be created, default to "gitea-dump-{time}.zip". Supply '-' for stdout. See type for available types.`,
+			Value:   fmt.Sprintf("gitea-dump-%d.zip", time.Now().Unix()),
+			Usage:   "Name of the dump file which will be created. Supply '-' for stdout. See type for available types.",
 		},
 		&cli.BoolFlag{
 			Name:    "verbose",
@@ -87,56 +160,64 @@ var CmdDump = &cli.Command{
 			Name:  "skip-index",
 			Usage: "Skip bleve index data",
 		},
-		&cli.BoolFlag{
-			Name:  "skip-db",
-			Usage: "Skip database",
-		},
-		&cli.StringFlag{
+		&cli.GenericFlag{
 			Name:  "type",
-			Usage: fmt.Sprintf(`Dump output format, default to "zip", supported types: %s`, strings.Join(dump.SupportedOutputTypes, ", ")),
+			Value: outputTypeEnum,
+			Usage: fmt.Sprintf("Dump output format: %s", outputTypeEnum.Join()),
 		},
 	},
 }

 func fatal(format string, args ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", args...)
 	log.Fatal(format, args...)
 }

 func runDump(ctx *cli.Context) error {
+	var file *os.File
+	fileName := ctx.String("file")
+	outType := ctx.String("type")
+	if fileName == "-" {
+		file = os.Stdout
+		setupConsoleLogger(log.FATAL, log.CanColorStderr, os.Stderr)
+	} else {
+		for _, suffix := range outputTypeEnum.Enum {
+			if strings.HasSuffix(fileName, "."+suffix) {
+				fileName = strings.TrimSuffix(fileName, "."+suffix)
+				break
+			}
+		}
+		fileName += "." + outType
+	}
 	setting.MustInstalled()

-	quite := ctx.Bool("quiet")
-	verbose := ctx.Bool("verbose")
-	if verbose && quite {
-		fatal("Option --quiet and --verbose cannot both be set")
+	// make sure we are logging to the console no matter what the configuration tells us do to
+	// FIXME: don't use CfgProvider directly
+	if _, err := setting.CfgProvider.Section("log").NewKey("MODE", "console"); err != nil {
+		fatal("Setting logging mode to console failed: %v", err)
+	}
+	if _, err := setting.CfgProvider.Section("log.console").NewKey("STDERR", "true"); err != nil {
+		fatal("Setting console logger to stderr failed: %v", err)
 	}

-	// outFileName is either "-" or a file name (will be made absolute)
-	outFileName, outType := dump.PrepareFileNameAndType(ctx.String("file"), ctx.String("type"))
-	if outType == "" {
-		fatal("Invalid output type")
+	// Set loglevel to Warn if quiet-mode is requested
+	if ctx.Bool("quiet") {
+		if _, err := setting.CfgProvider.Section("log.console").NewKey("LEVEL", "Warn"); err != nil {
+			fatal("Setting console log-level failed: %v", err)
+		}
 	}

-	outFile := os.Stdout
-	if outFileName != "-" {
-		var err error
-		if outFileName, err = filepath.Abs(outFileName); err != nil {
-			fatal("Unable to get absolute path of dump file: %v", err)
-		}
-		if exist, _ := util.IsExist(outFileName); exist {
-			fatal("Dump file %q exists", outFileName)
-		}
-		if outFile, err = os.Create(outFileName); err != nil {
-			fatal("Unable to create dump file %q: %v", outFileName, err)
-		}
-		defer outFile.Close()
+	if !setting.InstallLock {
+		log.Error("Is '%s' really the right config path?\n", setting.CustomConf)
+		return fmt.Errorf("gitea is not initialized")
 	}
-
-	setupConsoleLogger(util.Iif(quite, log.WARN, log.INFO), log.CanColorStderr, os.Stderr)
-
-	setting.DisableLoggerInit()
 	setting.LoadSettings() // cannot access session settings otherwise

+	verbose := ctx.Bool("verbose")
+	if verbose && ctx.Bool("quiet") {
+		return fmt.Errorf("--quiet and --verbose cannot both be set")
+	}
+
 	stdCtx, cancel := installSignals()
 	defer cancel()

@@ -145,32 +226,44 @@ func runDump(ctx *cli.Context) error {
 		return err
 	}

-	if err = storage.Init(); err != nil {
+	if err := storage.Init(); err != nil {
 		return err
 	}

-	archiverGeneric, err := archiver.ByExtension("." + outType)
+	if file == nil {
+		file, err = os.Create(fileName)
+		if err != nil {
+			fatal("Unable to open %s: %v", fileName, err)
+		}
+	}
+	defer file.Close()
+
+	absFileName, err := filepath.Abs(fileName)
+	if err != nil {
+		return err
+	}
+
+	var iface any
+	if fileName == "-" {
+		iface, err = archiver.ByExtension(fmt.Sprintf(".%s", outType))
+	} else {
+		iface, err = archiver.ByExtension(fileName)
+	}
 	if err != nil {
 		fatal("Unable to get archiver for extension: %v", err)
 	}

-	archiverWriter := archiverGeneric.(archiver.Writer)
-	if err := archiverWriter.Create(outFile); err != nil {
+	w, _ := iface.(archiver.Writer)
+	if err := w.Create(file); err != nil {
 		fatal("Creating archiver.Writer failed: %v", err)
 	}
-	defer archiverWriter.Close()
-
-	dumper := &dump.Dumper{
-		Writer:  archiverWriter,
-		Verbose: verbose,
-	}
-	dumper.GlobalExcludeAbsPath(outFileName)
+	defer w.Close()

 	if ctx.IsSet("skip-repository") && ctx.Bool("skip-repository") {
 		log.Info("Skip dumping local repositories")
 	} else {
 		log.Info("Dumping local repositories... %s", setting.RepoRootPath)
-		if err := dumper.AddRecursiveExclude("repos", setting.RepoRootPath, nil); err != nil {
+		if err := addRecursiveExclude(w, "repos", setting.RepoRootPath, []string{absFileName}, verbose); err != nil {
 			fatal("Failed to include repositories: %v", err)
 		}

@@ -183,52 +276,49 @@ func runDump(ctx *cli.Context) error {
 			if err != nil {
 				return err
 			}
-			return dumper.AddReader(object, info, path.Join("data", "lfs", objPath))
+
+			return addReader(w, object, info, path.Join("data", "lfs", objPath), verbose)
 		}); err != nil {
 			fatal("Failed to dump LFS objects: %v", err)
 		}
 	}

-	if ctx.Bool("skip-db") {
-		// Ensure that we don't dump the database file that may reside in setting.AppDataPath or elsewhere.
-		dumper.GlobalExcludeAbsPath(setting.Database.Path)
-		log.Info("Skipping database")
-	} else {
-		tmpDir := ctx.String("tempdir")
-		if _, err := os.Stat(tmpDir); os.IsNotExist(err) {
-			fatal("Path does not exist: %s", tmpDir)
-		}
-
-		dbDump, err := os.CreateTemp(tmpDir, "gitea-db.sql")
-		if err != nil {
-			fatal("Failed to create tmp file: %v", err)
-		}
-		defer func() {
-			_ = dbDump.Close()
-			if err := util.Remove(dbDump.Name()); err != nil {
-				log.Warn("Unable to remove temporary file: %s: Error: %v", dbDump.Name(), err)
-			}
-		}()
-
-		targetDBType := ctx.String("database")
-		if len(targetDBType) > 0 && targetDBType != setting.Database.Type.String() {
-			log.Info("Dumping database %s => %s...", setting.Database.Type, targetDBType)
-		} else {
-			log.Info("Dumping database...")
-		}
-
-		if err := db.DumpDatabase(dbDump.Name(), targetDBType); err != nil {
-			fatal("Failed to dump database: %v", err)
-		}
-
-		if err = dumper.AddFile("gitea-db.sql", dbDump.Name()); err != nil {
-			fatal("Failed to include gitea-db.sql: %v", err)
-		}
+	tmpDir := ctx.String("tempdir")
+	if _, err := os.Stat(tmpDir); os.IsNotExist(err) {
+		fatal("Path does not exist: %s", tmpDir)
 	}

-	log.Info("Adding custom configuration file from %s", setting.CustomConf)
-	if err = dumper.AddFile("app.ini", setting.CustomConf); err != nil {
-		fatal("Failed to include specified app.ini: %v", err)
+	dbDump, err := os.CreateTemp(tmpDir, "gitea-db.sql")
+	if err != nil {
+		fatal("Failed to create tmp file: %v", err)
+	}
+	defer func() {
+		_ = dbDump.Close()
+		if err := util.Remove(dbDump.Name()); err != nil {
+			log.Warn("Unable to remove temporary file: %s: Error: %v", dbDump.Name(), err)
+		}
+	}()
+
+	targetDBType := ctx.String("database")
+	if len(targetDBType) > 0 && targetDBType != setting.Database.Type.String() {
+		log.Info("Dumping database %s => %s...", setting.Database.Type, targetDBType)
+	} else {
+		log.Info("Dumping database...")
+	}
+
+	if err := db.DumpDatabase(dbDump.Name(), targetDBType); err != nil {
+		fatal("Failed to dump database: %v", err)
+	}
+
+	if err := addFile(w, "gitea-db.sql", dbDump.Name(), verbose); err != nil {
+		fatal("Failed to include gitea-db.sql: %v", err)
+	}
+
+	if len(setting.CustomConf) > 0 {
+		log.Info("Adding custom configuration file from %s", setting.CustomConf)
+		if err := addFile(w, "app.ini", setting.CustomConf, verbose); err != nil {
+			fatal("Failed to include specified app.ini: %v", err)
+		}
 	}

 	if ctx.IsSet("skip-custom-dir") && ctx.Bool("skip-custom-dir") {
@@ -236,8 +326,8 @@ func runDump(ctx *cli.Context) error {
 	} else {
 		customDir, err := os.Stat(setting.CustomPath)
 		if err == nil && customDir.IsDir() {
-			if is, _ := dump.IsSubdir(setting.AppDataPath, setting.CustomPath); !is {
-				if err := dumper.AddRecursiveExclude("custom", setting.CustomPath, nil); err != nil {
+			if is, _ := isSubdir(setting.AppDataPath, setting.CustomPath); !is {
+				if err := addRecursiveExclude(w, "custom", setting.CustomPath, []string{absFileName}, verbose); err != nil {
 					fatal("Failed to include custom: %v", err)
 				}
 			} else {
@@ -274,7 +364,8 @@ func runDump(ctx *cli.Context) error {
 		excludes = append(excludes, setting.Attachment.Storage.Path)
 		excludes = append(excludes, setting.Packages.Storage.Path)
 		excludes = append(excludes, setting.Log.RootPath)
-		if err := dumper.AddRecursiveExclude("data", setting.AppDataPath, excludes); err != nil {
+		excludes = append(excludes, absFileName)
+		if err := addRecursiveExclude(w, "data", setting.AppDataPath, excludes, verbose); err != nil {
 			fatal("Failed to include data directory: %v", err)
 		}
 	}
@@ -286,7 +377,8 @@ func runDump(ctx *cli.Context) error {
 		if err != nil {
 			return err
 		}
-		return dumper.AddReader(object, info, path.Join("data", "attachments", objPath))
+
+		return addReader(w, object, info, path.Join("data", "attachments", objPath), verbose)
 	}); err != nil {
 		fatal("Failed to dump attachments: %v", err)
 	}
@@ -300,7 +392,8 @@ func runDump(ctx *cli.Context) error {
 		if err != nil {
 			return err
 		}
-		return dumper.AddReader(object, info, path.Join("data", "packages", objPath))
+
+		return addReader(w, object, info, path.Join("data", "packages", objPath), verbose)
 	}); err != nil {
 		fatal("Failed to dump packages: %v", err)
 	}
@@ -316,23 +409,80 @@ func runDump(ctx *cli.Context) error {
 			log.Error("Unable to check if %s exists. Error: %v", setting.Log.RootPath, err)
 		}
 		if isExist {
-			if err := dumper.AddRecursiveExclude("log", setting.Log.RootPath, nil); err != nil {
+			if err := addRecursiveExclude(w, "log", setting.Log.RootPath, []string{absFileName}, verbose); err != nil {
 				fatal("Failed to include log: %v", err)
 			}
 		}
 	}

-	if outFileName == "-" {
-		log.Info("Finish dumping to stdout")
-	} else {
-		if err = archiverWriter.Close(); err != nil {
-			_ = os.Remove(outFileName)
-			fatal("Failed to save %q: %v", outFileName, err)
+	if fileName != "-" {
+		if err = w.Close(); err != nil {
+			_ = util.Remove(fileName)
+			fatal("Failed to save %s: %v", fileName, err)
 		}
-		if err = os.Chmod(outFileName, 0o600); err != nil {
+
+		if err := os.Chmod(fileName, 0o600); err != nil {
 			log.Info("Can't change file access permissions mask to 0600: %v", err)
 		}
-		log.Info("Finish dumping in file %s", outFileName)
+	}
+
+	if fileName != "-" {
+		log.Info("Finish dumping in file %s", fileName)
+	} else {
+		log.Info("Finish dumping to stdout")
+	}
+
+	return nil
+}
+
+// addRecursiveExclude zips absPath to specified insidePath inside writer excluding excludeAbsPath
+func addRecursiveExclude(w archiver.Writer, insidePath, absPath string, excludeAbsPath []string, verbose bool) error {
+	absPath, err := filepath.Abs(absPath)
+	if err != nil {
+		return err
+	}
+	dir, err := os.Open(absPath)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+
+	files, err := dir.Readdir(0)
+	if err != nil {
+		return err
+	}
+	for _, file := range files {
+		currentAbsPath := filepath.Join(absPath, file.Name())
+		currentInsidePath := path.Join(insidePath, file.Name())
+		if file.IsDir() {
+			if !util.SliceContainsString(excludeAbsPath, currentAbsPath) {
+				if err := addFile(w, currentInsidePath, currentAbsPath, false); err != nil {
+					return err
+				}
+				if err = addRecursiveExclude(w, currentInsidePath, currentAbsPath, excludeAbsPath, verbose); err != nil {
+					return err
+				}
+			}
+		} else {
+			// only copy regular files and symlink regular files, skip non-regular files like socket/pipe/...
+			shouldAdd := file.Mode().IsRegular()
+			if !shouldAdd && file.Mode()&os.ModeSymlink == os.ModeSymlink {
+				target, err := filepath.EvalSymlinks(currentAbsPath)
+				if err != nil {
+					return err
+				}
+				targetStat, err := os.Stat(target)
+				if err != nil {
+					return err
+				}
+				shouldAdd = targetStat.Mode().IsRegular()
+			}
+			if shouldAdd {
+				if err = addFile(w, currentInsidePath, currentAbsPath, verbose); err != nil {
+					return err
+				}
+			}
+		}
 	}
 	return nil
 }
--- a/cmd/embedded.go
+++ b/cmd/embedded.go
@@ -157,9 +157,9 @@ func runViewDo(c *cli.Context) error {
 	}

 	if len(matchedAssetFiles) == 0 {
-		return errors.New("no files matched the given pattern")
+		return fmt.Errorf("no files matched the given pattern")
 	} else if len(matchedAssetFiles) > 1 {
-		return errors.New("too many files matched the given pattern, try to be more specific")
+		return fmt.Errorf("too many files matched the given pattern, try to be more specific")
 	}

 	data, err := matchedAssetFiles[0].fs.ReadFile(matchedAssetFiles[0].name)
@@ -180,7 +180,7 @@ func runExtractDo(c *cli.Context) error {
 	}

 	if c.NArg() == 0 {
-		return errors.New("a list of pattern of files to extract is mandatory (e.g. '**' for all)")
+		return fmt.Errorf("a list of pattern of files to extract is mandatory (e.g. '**' for all)")
 	}

 	destdir := "."
--- a/cmd/generate.go
+++ b/cmd/generate.go
@@ -18,7 +18,7 @@ var (
 	// CmdGenerate represents the available generate sub-command.
 	CmdGenerate = &cli.Command{
 		Name:  "generate",
-		Usage: "Generate Gitea's secrets/keys/tokens",
+		Usage: "Command line interface for running generators",
 		Subcommands: []*cli.Command{
 			subcmdSecret,
 		},
--- a/cmd/hook.go
+++ b/cmd/hook.go
@@ -31,8 +31,8 @@ var (
 	// CmdHook represents the available hooks sub-command.
 	CmdHook = &cli.Command{
 		Name:        "hook",
-		Usage:       "(internal) Should only be called by Git",
-		Description: "Delegate commands to corresponding Git hooks",
+		Usage:       "Delegate commands to corresponding Git hooks",
+		Description: "This should only be called by Git",
 		Before:      PrepareConsoleLoggerLevel(log.FATAL),
 		Subcommands: []*cli.Command{
 			subcmdHookPreReceive,
@@ -220,7 +220,10 @@ Gitea or set your environment appropriately.`, "")
 		}
 	}

-	supportProcReceive := git.DefaultFeatures().SupportProcReceive
+	supportProcReceive := false
+	if git.CheckGitVersionAtLeast("2.29") == nil {
+		supportProcReceive = true
+	}

 	for scanner.Scan() {
 		// TODO: support news feeds for wiki
@@ -290,22 +293,8 @@ Gitea or set your environment appropriately.`, "")
 	return nil
 }

-// runHookUpdate avoid to do heavy operations on update hook because it will be
-// invoked for every ref update which does not like pre-receive and post-receive
 func runHookUpdate(c *cli.Context) error {
-	if isInternal, _ := strconv.ParseBool(os.Getenv(repo_module.EnvIsInternal)); isInternal {
-		return nil
-	}
-
 	// Update is empty and is kept only for backwards compatibility
-	if len(os.Args) < 3 {
-		return nil
-	}
-	refName := git.RefName(os.Args[len(os.Args)-3])
-	if refName.IsPull() {
-		// ignore update to refs/pull/xxx/head, so we don't need to output any information
-		os.Exit(1)
-	}
 	return nil
 }

@@ -352,7 +341,6 @@ Gitea or set your environment appropriately.`, "")
 	isWiki, _ := strconv.ParseBool(os.Getenv(repo_module.EnvRepoIsWiki))
 	repoName := os.Getenv(repo_module.EnvRepoName)
 	pusherID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
-	prID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPRID), 10, 64)
 	pusherName := os.Getenv(repo_module.EnvPusherName)

 	hookOptions := private.HookOptions{
@@ -362,8 +350,6 @@ Gitea or set your environment appropriately.`, "")
 		GitObjectDirectory:              os.Getenv(private.GitObjectDirectory),
 		GitQuarantinePath:               os.Getenv(private.GitQuarantinePath),
 		GitPushOptions:                  pushOptions(),
-		PullRequestID:                   prID,
-		PushTrigger:                     repo_module.PushTrigger(os.Getenv(repo_module.EnvPushTrigger)),
 	}
 	oldCommitIDs := make([]string, hookBatchSize)
 	newCommitIDs := make([]string, hookBatchSize)
@@ -390,9 +376,7 @@ Gitea or set your environment appropriately.`, "")
 		oldCommitIDs[count] = string(fields[0])
 		newCommitIDs[count] = string(fields[1])
 		refFullNames[count] = git.RefName(fields[2])
-
-		commitID, _ := git.NewIDFromString(newCommitIDs[count])
-		if refFullNames[count] == git.BranchPrefix+"master" && !commitID.IsZero() && count == total {
+		if refFullNames[count] == git.BranchPrefix+"master" && newCommitIDs[count] != git.EmptySHA && count == total {
 			masterPushed = true
 		}
 		count++
@@ -462,24 +446,21 @@ Gitea or set your environment appropriately.`, "")

 func hookPrintResults(results []private.HookPostReceiveBranchResult) {
 	for _, res := range results {
-		hookPrintResult(res.Message, res.Create, res.Branch, res.URL)
-	}
-}
+		if !res.Message {
+			continue
+		}

-func hookPrintResult(output, isCreate bool, branch, url string) {
-	if !output {
-		return
+		fmt.Fprintln(os.Stderr, "")
+		if res.Create {
+			fmt.Fprintf(os.Stderr, "Create a new pull request for '%s':\n", res.Branch)
+			fmt.Fprintf(os.Stderr, "  %s\n", res.URL)
+		} else {
+			fmt.Fprint(os.Stderr, "Visit the existing pull request:\n")
+			fmt.Fprintf(os.Stderr, "  %s\n", res.URL)
+		}
+		fmt.Fprintln(os.Stderr, "")
+		os.Stderr.Sync()
 	}
-	fmt.Fprintln(os.Stderr, "")
-	if isCreate {
-		fmt.Fprintf(os.Stderr, "Create a new pull request for '%s':\n", branch)
-		fmt.Fprintf(os.Stderr, "  %s\n", url)
-	} else {
-		fmt.Fprint(os.Stderr, "Visit the existing pull request:\n")
-		fmt.Fprintf(os.Stderr, "  %s\n", url)
-	}
-	fmt.Fprintln(os.Stderr, "")
-	_ = os.Stderr.Sync()
 }

 func pushOptions() map[string]string {
@@ -511,7 +492,7 @@ Gitea or set your environment appropriately.`, "")
 		return nil
 	}

-	if !git.DefaultFeatures().SupportProcReceive {
+	if git.CheckGitVersionAtLeast("2.29") != nil {
 		return fail(ctx, "No proc-receive support", "current git version doesn't support proc-receive.")
 	}

@@ -542,14 +523,14 @@ Gitea or set your environment appropriately.`, "")

 	index := bytes.IndexByte(rs.Data, byte(0))
 	if index >= len(rs.Data) {
-		return fail(ctx, "Protocol: format error", "pkt-line: format error %s", rs.Data)
+		return fail(ctx, "Protocol: format error", "pkt-line: format error "+fmt.Sprint(rs.Data))
 	}

 	if index < 0 {
 		if len(rs.Data) == 10 && rs.Data[9] == '\n' {
 			index = 9
 		} else {
-			return fail(ctx, "Protocol: format error", "pkt-line: format error %s", rs.Data)
+			return fail(ctx, "Protocol: format error", "pkt-line: format error "+fmt.Sprint(rs.Data))
 		}
 	}

@@ -591,9 +572,8 @@ Gitea or set your environment appropriately.`, "")
 	// S: ... ...
 	// S: flush-pkt
 	hookOptions := private.HookOptions{
-		UserName:       pusherName,
-		UserID:         pusherID,
-		GitPushOptions: make(map[string]string),
+		UserName: pusherName,
+		UserID:   pusherID,
 	}
 	hookOptions.OldCommitIDs = make([]string, 0, hookBatchSize)
 	hookOptions.NewCommitIDs = make([]string, 0, hookBatchSize)
@@ -618,6 +598,8 @@ Gitea or set your environment appropriately.`, "")
 		hookOptions.RefFullNames = append(hookOptions.RefFullNames, git.RefName(t[2]))
 	}

+	hookOptions.GitPushOptions = make(map[string]string)
+
 	if hasPushOptions {
 		for {
 			rs, err = readPktLine(ctx, reader, pktLineTypeUnknow)
@@ -628,7 +610,11 @@ Gitea or set your environment appropriately.`, "")
 			if rs.Type == pktLineTypeFlush {
 				break
 			}
-			hookOptions.GitPushOptions.AddFromKeyValue(string(rs.Data))
+
+			kv := strings.SplitN(string(rs.Data), "=", 2)
+			if len(kv) == 2 {
+				hookOptions.GitPushOptions[kv[0]] = kv[1]
+			}
 		}
 	}

@@ -683,8 +669,7 @@ Gitea or set your environment appropriately.`, "")
 		if err != nil {
 			return err
 		}
-		commitID, _ := git.NewIDFromString(rs.OldOID)
-		if !commitID.IsZero() {
+		if rs.OldOID != git.EmptySHA {
 			err = writeDataPktLine(ctx, os.Stdout, []byte("option old-oid "+rs.OldOID))
 			if err != nil {
 				return err
@@ -703,12 +688,6 @@ Gitea or set your environment appropriately.`, "")
 	}
 	err = writeFlushPktLine(ctx, os.Stdout)

-	if err == nil {
-		for _, res := range resp.Results {
-			hookPrintResult(res.ShouldShowMessage, res.IsCreatePR, res.HeadBranch, res.URL)
-		}
-	}
-
 	return err
 }

--- a/cmd/keys.go
+++ b/cmd/keys.go
@@ -16,11 +16,10 @@ import (

 // CmdKeys represents the available keys sub-command
 var CmdKeys = &cli.Command{
-	Name:        "keys",
-	Usage:       "(internal) Should only be called by SSH server",
-	Description: "Queries the Gitea database to get the authorized command for a given ssh key fingerprint",
-	Before:      PrepareConsoleLoggerLevel(log.FATAL),
-	Action:      runKeys,
+	Name:   "keys",
+	Usage:  "This command queries the Gitea database to get the authorized command for a given ssh key fingerprint",
+	Before: PrepareConsoleLoggerLevel(log.FATAL),
+	Action: runKeys,
 	Flags: []cli.Flag{
 		&cli.StringFlag{
 			Name:    "expected",
@@ -71,13 +70,13 @@ func runKeys(c *cli.Context) error {
 	ctx, cancel := installSignals()
 	defer cancel()

-	setup(ctx, c.Bool("debug"))
+	setup(ctx, false)

 	authorizedString, extra := private.AuthorizedPublicKeyByContent(ctx, content)
 	// do not use handleCliResponseExtra or cli.NewExitError, if it exists immediately, it breaks some tests like Test_CmdKeys
 	if extra.Error != nil {
 		return extra.Error
 	}
-	_, _ = fmt.Fprintln(c.App.Writer, strings.TrimSpace(authorizedString.Text))
+	_, _ = fmt.Fprintln(c.App.Writer, strings.TrimSpace(authorizedString))
 	return nil
 }
--- a/cmd/mailer.go
+++ b/cmd/mailer.go
@@ -45,6 +45,6 @@ func runSendMail(c *cli.Context) error {
 	if extra.HasError() {
 		return handleCliResponseExtra(extra)
 	}
-	_, _ = fmt.Printf("Sent %s email(s) to all users\n", respText.Text)
+	_, _ = fmt.Printf("Sent %s email(s) to all users\n", respText)
 	return nil
 }
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -10,12 +10,12 @@ import (

 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"

 	"github.com/urfave/cli/v2"
 )

 // cmdHelp is our own help subcommand with more information
-// Keep in mind that the "./gitea help"(subcommand) is different from "./gitea --help"(flag), the flag doesn't parse the config or output "DEFAULT CONFIGURATION:" information
 func cmdHelp() *cli.Command {
 	c := &cli.Command{
 		Name:      "help",
@@ -47,10 +47,16 @@ DEFAULT CONFIGURATION:
 	return c
 }

+var helpFlag = cli.HelpFlag
+
+func init() {
+	// cli.HelpFlag = nil TODO: after https://github.com/urfave/cli/issues/1794 we can use this
+}
+
 func appGlobalFlags() []cli.Flag {
 	return []cli.Flag{
 		// make the builtin flags at the top
-		cli.HelpFlag,
+		helpFlag,

 		// shared configuration flags, they are for global and for each sub-command at the same time
 		// eg: such command is valid: "./gitea --config /tmp/app.ini web --config /tmp/app.ini", while it's discouraged indeed
@@ -112,30 +118,23 @@ func prepareWorkPathAndCustomConf(action cli.ActionFunc) func(ctx *cli.Context)
 	}
 }

-type AppVersion struct {
-	Version string
-	Extra   string
-}
-
-func NewMainApp(appVer AppVersion) *cli.App {
+func NewMainApp(version, versionExtra string) *cli.App {
 	app := cli.NewApp()
 	app.Name = "Gitea"
-	app.HelpName = "gitea"
 	app.Usage = "A painless self-hosted Git service"
-	app.Description = `Gitea program contains "web" and other subcommands. If no subcommand is given, it starts the web server by default. Use "web" subcommand for more web server arguments, use other subcommands for other purposes.`
-	app.Version = appVer.Version + appVer.Extra
+	app.Description = `By default, Gitea will start serving using the web-server with no argument, which can alternatively be run by running the subcommand "web".`
+	app.Version = version + versionExtra
 	app.EnableBashCompletion = true

 	// these sub-commands need to use config file
 	subCmdWithConfig := []*cli.Command{
-		cmdHelp(), // the "help" sub-command was used to show the more information for "work path" and "custom config"
 		CmdWeb,
 		CmdServ,
 		CmdHook,
-		CmdKeys,
 		CmdDump,
 		CmdAdmin,
 		CmdMigrate,
+		CmdKeys,
 		CmdDoctor,
 		CmdManager,
 		CmdEmbedded,
@@ -143,8 +142,13 @@ func NewMainApp(appVer AppVersion) *cli.App {
 		CmdDumpRepository,
 		CmdRestoreRepository,
 		CmdActions,
+		cmdHelp(), // the "help" sub-command was used to show the more information for "work path" and "custom config"
 	}

+	cmdConvert := util.ToPointer(*cmdDoctorConvert)
+	cmdConvert.Hidden = true // still support the legacy "./gitea doctor" by the hidden sub-command, remove it in next release
+	subCmdWithConfig = append(subCmdWithConfig, cmdConvert)
+
 	// these sub-commands do not need the config file, and they do not depend on any path or environment variable.
 	subCmdStandalone := []*cli.Command{
 		CmdCert,
--- a/cmd/main_test.go
+++ b/cmd/main_test.go
@@ -20,7 +20,9 @@ import (
 )

 func TestMain(m *testing.M) {
-	unittest.MainTest(m)
+	unittest.MainTest(m, &unittest.TestOptions{
+		GiteaRootPath: "..",
+	})
 }

 func makePathOutput(workPath, customPath, customConf string) string {
@@ -28,7 +30,7 @@ func makePathOutput(workPath, customPath, customConf string) string {
 }

 func newTestApp(testCmdAction func(ctx *cli.Context) error) *cli.App {
-	app := NewMainApp(AppVersion{})
+	app := NewMainApp("version", "version-extra")
 	testCmd := &cli.Command{Name: "test-cmd", Action: testCmdAction}
 	prepareSubcommandWithConfig(testCmd, appGlobalFlags())
 	app.Commands = append(app.Commands, testCmd)
--- a/cmd/manager_logging.go
+++ b/cmd/manager_logging.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"errors"
 	"fmt"
 	"os"

@@ -250,7 +249,7 @@ func runAddFileLogger(c *cli.Context) error {
 	if c.IsSet("filename") {
 		vals["filename"] = c.String("filename")
 	} else {
-		return errors.New("filename must be set when creating a file logger")
+		return fmt.Errorf("filename must be set when creating a file logger")
 	}
 	if c.IsSet("rotate") {
 		vals["rotate"] = c.Bool("rotate")
--- a/cmd/migrate_storage.go
+++ b/cmd/migrate_storage.go
@@ -5,9 +5,7 @@ package cmd

 import (
 	"context"
-	"errors"
 	"fmt"
-	"io/fs"
 	"strings"

 	actions_model "code.gitea.io/gitea/models/actions"
@@ -36,13 +34,13 @@ var CmdMigrateStorage = &cli.Command{
 			Name:    "type",
 			Aliases: []string{"t"},
 			Value:   "",
-			Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log', 'actions-artifacts",
+			Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log'",
 		},
 		&cli.StringFlag{
 			Name:    "storage",
 			Aliases: []string{"s"},
 			Value:   "",
-			Usage:   "New storage type: local (default), minio or azureblob",
+			Usage:   "New storage type: local (default) or minio",
 		},
 		&cli.StringFlag{
 			Name:    "path",
@@ -50,7 +48,6 @@ var CmdMigrateStorage = &cli.Command{
 			Value:   "",
 			Usage:   "New storage placement if store is local (leave blank for default)",
 		},
-		// Minio Storage special configurations
 		&cli.StringFlag{
 			Name:  "minio-endpoint",
 			Value: "",
@@ -94,37 +91,6 @@ var CmdMigrateStorage = &cli.Command{
 			Value: "",
 			Usage: "Minio checksum algorithm (default/md5)",
 		},
-		&cli.StringFlag{
-			Name:  "minio-bucket-lookup-type",
-			Value: "",
-			Usage: "Minio bucket lookup type",
-		},
-		// Azure Blob Storage special configurations
-		&cli.StringFlag{
-			Name:  "azureblob-endpoint",
-			Value: "",
-			Usage: "Azure Blob storage endpoint",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-account-name",
-			Value: "",
-			Usage: "Azure Blob storage account name",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-account-key",
-			Value: "",
-			Usage: "Azure Blob storage account key",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-container",
-			Value: "",
-			Usage: "Azure Blob storage container",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-base-path",
-			Value: "",
-			Usage: "Azure Blob storage base path",
-		},
 	},
 }

@@ -194,25 +160,6 @@ func migrateActionsLog(ctx context.Context, dstStorage storage.ObjectStorage) er
 	})
 }

-func migrateActionsArtifacts(ctx context.Context, dstStorage storage.ObjectStorage) error {
-	return db.Iterate(ctx, nil, func(ctx context.Context, artifact *actions_model.ActionArtifact) error {
-		if artifact.Status == int64(actions_model.ArtifactStatusExpired) {
-			return nil
-		}
-
-		_, err := storage.Copy(dstStorage, artifact.StoragePath, storage.ActionsArtifacts, artifact.StoragePath)
-		if err != nil {
-			// ignore files that do not exist
-			if errors.Is(err, fs.ErrNotExist) {
-				return nil
-			}
-			return err
-		}
-
-		return nil
-	})
-}
-
 func runMigrateStorage(ctx *cli.Context) error {
 	stdCtx, cancel := installSignals()
 	defer cancel()
@@ -266,19 +213,6 @@ func runMigrateStorage(ctx *cli.Context) error {
 					UseSSL:             ctx.Bool("minio-use-ssl"),
 					InsecureSkipVerify: ctx.Bool("minio-insecure-skip-verify"),
 					ChecksumAlgorithm:  ctx.String("minio-checksum-algorithm"),
-					BucketLookUpType:   ctx.String("minio-bucket-lookup-type"),
-				},
-			})
-	case string(setting.AzureBlobStorageType):
-		dstStorage, err = storage.NewAzureBlobStorage(
-			stdCtx,
-			&setting.Storage{
-				AzureBlobConfig: setting.AzureBlobStorageConfig{
-					Endpoint:    ctx.String("azureblob-endpoint"),
-					AccountName: ctx.String("azureblob-account-name"),
-					AccountKey:  ctx.String("azureblob-account-key"),
-					Container:   ctx.String("azureblob-container"),
-					BasePath:    ctx.String("azureblob-base-path"),
 				},
 			})
 	default:
@@ -289,14 +223,13 @@ func runMigrateStorage(ctx *cli.Context) error {
 	}

 	migratedMethods := map[string]func(context.Context, storage.ObjectStorage) error{
-		"attachments":       migrateAttachments,
-		"lfs":               migrateLFS,
-		"avatars":           migrateAvatars,
-		"repo-avatars":      migrateRepoAvatars,
-		"repo-archivers":    migrateRepoArchivers,
-		"packages":          migratePackages,
-		"actions-log":       migrateActionsLog,
-		"actions-artifacts": migrateActionsArtifacts,
+		"attachments":    migrateAttachments,
+		"lfs":            migrateLFS,
+		"avatars":        migrateAvatars,
+		"repo-avatars":   migrateRepoAvatars,
+		"repo-archivers": migrateRepoArchivers,
+		"packages":       migratePackages,
+		"actions-log":    migrateActionsLog,
 	}

 	tp := strings.ToLower(ctx.String("type"))
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -20,10 +20,8 @@ import (
 	asymkey_model "code.gitea.io/gitea/models/asymkey"
 	git_model "code.gitea.io/gitea/models/git"
 	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/lfstransfer"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/pprof"
 	"code.gitea.io/gitea/modules/private"
@@ -38,17 +36,13 @@ import (
 )

 const (
-	verbUploadPack      = "git-upload-pack"
-	verbUploadArchive   = "git-upload-archive"
-	verbReceivePack     = "git-receive-pack"
-	verbLfsAuthenticate = "git-lfs-authenticate"
-	verbLfsTransfer     = "git-lfs-transfer"
+	lfsAuthenticateVerb = "git-lfs-authenticate"
 )

 // CmdServ represents the available serv sub-command.
 var CmdServ = &cli.Command{
 	Name:        "serv",
-	Usage:       "(internal) Should only be called by SSH shell",
+	Usage:       "This command should only be called by SSH shell",
 	Description: "Serv provides access auth for repositories",
 	Before:      PrepareConsoleLoggerLevel(log.FATAL),
 	Action:      runServ,
@@ -69,28 +63,33 @@ func setup(ctx context.Context, debug bool) {
 		setupConsoleLogger(log.FATAL, false, os.Stderr)
 	}
 	setting.MustInstalled()
+	if debug {
+		setting.RunMode = "dev"
+	}
+
+	// Check if setting.RepoRootPath exists. It could be the case that it doesn't exist, this can happen when
+	// `[repository]` `ROOT` is a relative path and $GITEA_WORK_DIR isn't passed to the SSH connection.
 	if _, err := os.Stat(setting.RepoRootPath); err != nil {
-		_ = fail(ctx, "Unable to access repository path", "Unable to access repository path %q, err: %v", setting.RepoRootPath, err)
+		if os.IsNotExist(err) {
+			_ = fail(ctx, "Incorrect configuration, no repository directory.", "Directory `[repository].ROOT` %q was not found, please check if $GITEA_WORK_DIR is passed to the SSH connection or make `[repository].ROOT` an absolute value.", setting.RepoRootPath)
+		} else {
+			_ = fail(ctx, "Incorrect configuration, repository directory is inaccessible", "Directory `[repository].ROOT` %q is inaccessible. err: %v", setting.RepoRootPath, err)
+		}
 		return
 	}
+
 	if err := git.InitSimple(context.Background()); err != nil {
 		_ = fail(ctx, "Failed to init git", "Failed to init git, err: %v", err)
 	}
 }

 var (
-	// keep getAccessMode() in sync
-	allowedCommands = container.SetOf(
-		verbUploadPack,
-		verbUploadArchive,
-		verbReceivePack,
-		verbLfsAuthenticate,
-		verbLfsTransfer,
-	)
-	allowedCommandsLfs = container.SetOf(
-		verbLfsAuthenticate,
-		verbLfsTransfer,
-	)
+	allowedCommands = map[string]perm.AccessMode{
+		"git-upload-pack":    perm.AccessModeRead,
+		"git-upload-archive": perm.AccessModeRead,
+		"git-receive-pack":   perm.AccessModeWrite,
+		lfsAuthenticateVerb:  perm.AccessModeNone,
+	}
 	alphaDashDotPattern = regexp.MustCompile(`[^\w-\.]`)
 )

@@ -111,10 +110,12 @@ func fail(ctx context.Context, userMessage, logMsgFmt string, args ...any) error
 		if !setting.IsProd {
 			_, _ = fmt.Fprintln(os.Stderr, "Gitea:", logMsg)
 		}
-		if unicode.IsPunct(rune(userMessage[len(userMessage)-1])) {
-			logMsg = userMessage + " " + logMsg
-		} else {
-			logMsg = userMessage + ". " + logMsg
+		if userMessage != "" {
+			if unicode.IsPunct(rune(userMessage[len(userMessage)-1])) {
+				logMsg = userMessage + " " + logMsg
+			} else {
+				logMsg = userMessage + ". " + logMsg
+			}
 		}
 		_ = private.SSHLog(ctx, true, logMsg)
 	}
@@ -134,45 +135,6 @@ func handleCliResponseExtra(extra private.ResponseExtra) error {
 	return nil
 }

-func getAccessMode(verb, lfsVerb string) perm.AccessMode {
-	switch verb {
-	case verbUploadPack, verbUploadArchive:
-		return perm.AccessModeRead
-	case verbReceivePack:
-		return perm.AccessModeWrite
-	case verbLfsAuthenticate, verbLfsTransfer:
-		switch lfsVerb {
-		case "upload":
-			return perm.AccessModeWrite
-		case "download":
-			return perm.AccessModeRead
-		}
-	}
-	// should be unreachable
-	return perm.AccessModeNone
-}
-
-func getLFSAuthToken(ctx context.Context, lfsVerb string, results *private.ServCommandResults) (string, error) {
-	now := time.Now()
-	claims := lfs.Claims{
-		RegisteredClaims: jwt.RegisteredClaims{
-			ExpiresAt: jwt.NewNumericDate(now.Add(setting.LFS.HTTPAuthExpiry)),
-			NotBefore: jwt.NewNumericDate(now),
-		},
-		RepoID: results.RepoID,
-		Op:     lfsVerb,
-		UserID: results.UserID,
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-
-	// Sign and get the complete encoded token as a string using the secret
-	tokenString, err := token.SignedString(setting.LFS.JWTSecretBytes)
-	if err != nil {
-		return "", fail(ctx, "Failed to sign JWT Token", "Failed to sign JWT token: %v", err)
-	}
-	return fmt.Sprintf("Bearer %s", tokenString), nil
-}
-
 func runServ(c *cli.Context) error {
 	ctx, cancel := installSignals()
 	defer cancel()
@@ -192,12 +154,6 @@ func runServ(c *cli.Context) error {
 		return nil
 	}

-	defer func() {
-		if err := recover(); err != nil {
-			_ = fail(ctx, "Internal Server Error", "Panic: %v\n%s", err, log.Stack(2))
-		}
-	}()
-
 	keys := strings.Split(c.Args().First(), "-")
 	if len(keys) != 2 || keys[0] != "key" {
 		return fail(ctx, "Key ID format error", "Invalid key argument: %s", c.Args().First())
@@ -233,7 +189,7 @@ func runServ(c *cli.Context) error {
 	}

 	if len(words) < 2 {
-		if git.DefaultFeatures().SupportProcReceive {
+		if git.CheckGitVersionAtLeast("2.29") == nil {
 			// for AGit Flow
 			if cmd == "ssh_info" {
 				fmt.Print(`{"type":"gitea","version":1}`)
@@ -244,9 +200,21 @@ func runServ(c *cli.Context) error {
 	}

 	verb := words[0]
-	repoPath := strings.TrimPrefix(words[1], "/")
+	repoPath := words[1]
+	if repoPath[0] == '/' {
+		repoPath = repoPath[1:]
+	}

 	var lfsVerb string
+	if verb == lfsAuthenticateVerb {
+		if !setting.LFS.StartServer {
+			return fail(ctx, "Unknown git command", "LFS authentication request over SSH denied, LFS support is disabled")
+		}
+
+		if len(words) > 2 {
+			lfsVerb = words[2]
+		}
+	}

 	rr := strings.SplitN(repoPath, "/", 2)
 	if len(rr) != 2 {
@@ -283,52 +251,53 @@ func runServ(c *cli.Context) error {
 		}()
 	}

-	if allowedCommands.Contains(verb) {
-		if allowedCommandsLfs.Contains(verb) {
-			if !setting.LFS.StartServer {
-				return fail(ctx, "LFS Server is not enabled", "")
-			}
-			if verb == verbLfsTransfer && !setting.LFS.AllowPureSSH {
-				return fail(ctx, "LFS SSH transfer is not enabled", "")
-			}
-			if len(words) > 2 {
-				lfsVerb = words[2]
-			}
-		}
-	} else {
+	requestedMode, has := allowedCommands[verb]
+	if !has {
 		return fail(ctx, "Unknown git command", "Unknown git command %s", verb)
 	}

-	requestedMode := getAccessMode(verb, lfsVerb)
+	if verb == lfsAuthenticateVerb {
+		if lfsVerb == "upload" {
+			requestedMode = perm.AccessModeWrite
+		} else if lfsVerb == "download" {
+			requestedMode = perm.AccessModeRead
+		} else {
+			return fail(ctx, "Unknown LFS verb", "Unknown lfs verb %s", lfsVerb)
+		}
+	}

 	results, extra := private.ServCommand(ctx, keyID, username, reponame, requestedMode, verb, lfsVerb)
 	if extra.HasError() {
 		return fail(ctx, extra.UserMsg, "ServCommand failed: %s", extra.Error)
 	}

-	// LFS SSH protocol
-	if verb == verbLfsTransfer {
-		token, err := getLFSAuthToken(ctx, lfsVerb, results)
-		if err != nil {
-			return err
-		}
-		return lfstransfer.Main(ctx, repoPath, lfsVerb, token)
-	}
-
 	// LFS token authentication
-	if verb == verbLfsAuthenticate {
+	if verb == lfsAuthenticateVerb {
 		url := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, url.PathEscape(results.OwnerName), url.PathEscape(results.RepoName))

-		token, err := getLFSAuthToken(ctx, lfsVerb, results)
+		now := time.Now()
+		claims := lfs.Claims{
+			RegisteredClaims: jwt.RegisteredClaims{
+				ExpiresAt: jwt.NewNumericDate(now.Add(setting.LFS.HTTPAuthExpiry)),
+				NotBefore: jwt.NewNumericDate(now),
+			},
+			RepoID: results.RepoID,
+			Op:     lfsVerb,
+			UserID: results.UserID,
+		}
+		token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+
+		// Sign and get the complete encoded token as a string using the secret
+		tokenString, err := token.SignedString(setting.LFS.JWTSecretBytes)
 		if err != nil {
-			return err
+			return fail(ctx, "Failed to sign JWT Token", "Failed to sign JWT token: %v", err)
 		}

 		tokenAuthentication := &git_model.LFSTokenResponse{
 			Header: make(map[string]string),
 			Href:   url,
 		}
-		tokenAuthentication.Header["Authorization"] = token
+		tokenAuthentication.Header["Authorization"] = fmt.Sprintf("Bearer %s", tokenString)

 		enc := json.NewEncoder(os.Stdout)
 		err = enc.Encode(tokenAuthentication)
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -114,7 +114,7 @@ func showWebStartupMessage(msg string) {
 	log.Info("* WorkPath: %s", setting.AppWorkPath)
 	log.Info("* CustomPath: %s", setting.CustomPath)
 	log.Info("* ConfigFile: %s", setting.CustomConf)
-	log.Info("%s", msg) // show startup message
+	log.Info("%s", msg)
 }

 func serveInstall(ctx *cli.Context) error {
--- a/contrib/backport/backport.go
+++ b/contrib/backport/backport.go
@@ -17,7 +17,7 @@ import (
 	"strings"
 	"syscall"

-	"github.com/google/go-github/v61/github"
+	"github.com/google/go-github/v53/github"
 	"github.com/urfave/cli/v2"
 	"gopkg.in/yaml.v3"
 )
@@ -64,11 +64,6 @@ func main() {
 			Value: "",
 			Usage: "Forked user name on Github",
 		},
-		&cli.StringFlag{
-			Name:  "gh-access-token",
-			Value: "",
-			Usage: "Access token for GitHub api request",
-		},
 		&cli.BoolFlag{
 			Name:  "no-fetch",
 			Usage: "Set this flag to prevent fetch of remote branches",
@@ -174,10 +169,9 @@ func runBackport(c *cli.Context) error {
 	fmt.Printf("* Backporting %s to %s as %s\n", pr, localReleaseBranch, backportBranch)

 	sha := c.String("cherry-pick")
-	accessToken := c.String("gh-access-token")
 	if sha == "" {
 		var err error
-		sha, err = determineSHAforPR(ctx, pr, accessToken)
+		sha, err = determineSHAforPR(ctx, pr)
 		if err != nil {
 			return err
 		}
@@ -433,16 +427,13 @@ func readVersion() string {
 	return strings.Join(split[:2], ".")
 }

-func determineSHAforPR(ctx context.Context, prStr, accessToken string) (string, error) {
+func determineSHAforPR(ctx context.Context, prStr string) (string, error) {
 	prNum, err := strconv.Atoi(prStr)
 	if err != nil {
 		return "", err
 	}

 	client := github.NewClient(http.DefaultClient)
-	if accessToken != "" {
-		client = client.WithAuthToken(accessToken)
-	}

 	pr, _, err := client.PullRequests.Get(ctx, "go-gitea", "gitea", prNum)
 	if err != nil {
--- a/contrib/fixtures/fixture_generation.go
+++ b/contrib/fixtures/fixture_generation.go
@@ -0,0 +1,78 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//nolint:forbidigo
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/unittest"
+)
+
+// To generate derivative fixtures, execute the following from Gitea's repository base dir:
+// go run -tags 'sqlite sqlite_unlock_notify' contrib/fixtures/fixture_generation.go [fixture...]
+
+var (
+	generators = []struct {
+		gen  func() (string, error)
+		name string
+	}{
+		{
+			models.GetYamlFixturesAccess, "access",
+		},
+	}
+	fixturesDir string
+)
+
+func main() {
+	pathToGiteaRoot := "."
+	fixturesDir = filepath.Join(pathToGiteaRoot, "models", "fixtures")
+	if err := unittest.CreateTestEngine(unittest.FixturesOptions{
+		Dir: fixturesDir,
+	}); err != nil {
+		fmt.Printf("CreateTestEngine: %+v", err)
+		os.Exit(1)
+	}
+	if err := unittest.PrepareTestDatabase(); err != nil {
+		fmt.Printf("PrepareTestDatabase: %+v\n", err)
+		os.Exit(1)
+	}
+	if len(os.Args) == 0 {
+		for _, r := range os.Args {
+			if err := generate(r); err != nil {
+				fmt.Printf("generate '%s': %+v\n", r, err)
+				os.Exit(1)
+			}
+		}
+	} else {
+		for _, g := range generators {
+			if err := generate(g.name); err != nil {
+				fmt.Printf("generate '%s': %+v\n", g.name, err)
+				os.Exit(1)
+			}
+		}
+	}
+}
+
+func generate(name string) error {
+	for _, g := range generators {
+		if g.name == name {
+			data, err := g.gen()
+			if err != nil {
+				return err
+			}
+			path := filepath.Join(fixturesDir, name+".yml")
+			if err := os.WriteFile(path, []byte(data), 0o644); err != nil {
+				return fmt.Errorf("%s: %+v", path, err)
+			}
+			fmt.Printf("%s created.\n", path)
+			return nil
+		}
+	}
+
+	return fmt.Errorf("generator not found")
+}
--- a/crowdin.yml
+++ b/crowdin.yml
@@ -1,12 +0,0 @@
-project_id_env: CROWDIN_PROJECT_ID
-api_token_env: CROWDIN_KEY
-base_path: "."
-base_url: "https://api.crowdin.com"
-preserve_hierarchy: true
-files:
-  - source: "/options/locale/locale_en-US.ini"
-    translation: "/options/locale/locale_%locale%.ini"
-    type: "ini"
-    skip_untranslated_strings: true
-    export_only_approved: true
-    update_option: "update_as_unapproved"
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -60,7 +60,6 @@ RUN_USER = ; git
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; The protocol the server listens on. One of 'http', 'https', 'http+unix', 'fcgi' or 'fcgi+unix'. Defaults to 'http'
-;; Note: Value must be lowercase.
 ;PROTOCOL = http
 ;;
 ;; Expect PROXY protocol headers on connections
@@ -81,10 +80,6 @@ RUN_USER = ; git
 ;; Overwrite the automatically generated public URL. Necessary for proxies and docker.
 ;ROOT_URL = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/
 ;;
-;; For development purpose only. It makes Gitea handle sub-path ("/sub-path/owner/repo/...") directly when debugging without a reverse proxy.
-;; DO NOT USE IT IN PRODUCTION!!!
-;USE_SUB_URL_PATH = false
-;;
 ;; when STATIC_URL_PREFIX is empty it will follow ROOT_URL
 ;STATIC_URL_PREFIX =
 ;;
@@ -238,7 +233,7 @@ RUN_USER = ; git
 ;MINIMUM_KEY_SIZE_CHECK = false
 ;;
 ;; Disable CDN even in "prod" mode
-;OFFLINE_MODE = true
+;OFFLINE_MODE = false
 ;;
 ;; TLS Settings: Either ACME or manual
 ;; (Other common TLS configuration are found before)
@@ -306,8 +301,6 @@ RUN_USER = ; git
 ;; Enables git-lfs support. true or false, default is false.
 ;LFS_START_SERVER = false
 ;;
-;; Enables git-lfs SSH protocol support. true or false, default is false.
-;LFS_ALLOW_PURE_SSH = false
 ;;
 ;; LFS authentication secret, change this yourself
 ;LFS_JWT_SECRET =
@@ -324,10 +317,6 @@ RUN_USER = ; git
 ;; Maximum number of locks returned per page
 ;LFS_LOCKS_PAGING_NUM = 50
 ;;
-;; When clients make lfs batch requests, reject them if there are more pointers than this number
-;; zero means 'unlimited'
-;LFS_MAX_BATCH_SIZE = 0
-;;
 ;; Allow graceful restarts using SIGHUP to fork
 ;ALLOW_GRACEFUL_RESTARTS = true
 ;;
@@ -361,7 +350,6 @@ NAME = gitea
 USER = root
 ;PASSWD = ;Use PASSWD = `your password` for quoting if you use special characters in the password.
 ;SSL_MODE = false ; either "false" (default), "true", or "skip-verify"
-;CHARSET_COLLATION = ; Empty as default, Gitea will try to find a case-sensitive collation. Don't change it unless you clearly know what you need.
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -393,7 +381,6 @@ USER = root
 ;NAME = gitea
 ;USER = SA
 ;PASSWD = MwantsaSecurePassword1
-;CHARSET_COLLATION = ; Empty as default, Gitea will try to find a case-sensitive collation. Don't change it unless you clearly know what you need.
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -422,10 +409,6 @@ USER = root
 ;;
 ;; Whether execute database models migrations automatically
 ;AUTO_MIGRATION = true
-;;
-;; Threshold value (in seconds) beyond which query execution time is logged as a warning in the xorm logger
-;;
-;SLOW_QUERY_THRESHOLD = 5s

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -445,13 +428,13 @@ SECRET_KEY =
 ;SECRET_KEY_URI = file:/etc/gitea/secret_key
 ;;
 ;; Secret used to validate communication within Gitea binary.
-INTERNAL_TOKEN =
+INTERNAL_TOKEN=
 ;;
 ;; Alternative location to specify internal token, instead of this file; you cannot specify both this and INTERNAL_TOKEN, and must pick one
 ;INTERNAL_TOKEN_URI = file:/etc/gitea/internal_token
 ;;
 ;; How long to remember that a user is logged in before requiring relogin (in days)
-;LOGIN_REMEMBER_DAYS = 31
+;LOGIN_REMEMBER_DAYS = 7
 ;;
 ;; Name of the cookie used to store the current username.
 ;COOKIE_USERNAME = gitea_awesome
@@ -513,9 +496,6 @@ INTERNAL_TOKEN =
 ;; stemming from cached/logged plain-text API tokens.
 ;; In future releases, this will become the default behavior
 ;DISABLE_QUERY_AUTH_TOKEN = false
-;;
-;; On user registration, record the IP address and user agent of the user to help identify potential abuse.
-;; RECORD_USER_SIGNUP_METADATA = false

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -532,8 +512,7 @@ INTERNAL_TOKEN =
 ;; HMAC to encode urls with, it **is required** if camo is enabled.
 ;HMAC_KEY =
 ;; Set to true to use camo for https too lese only non https urls are proxyed
-;; ALLWAYS is deprecated and will be removed in the future
-;ALWAYS = false
+;ALLWAYS = false

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -542,7 +521,7 @@ INTERNAL_TOKEN =
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Enables OAuth2 provider
-ENABLED = true
+ENABLE = true
 ;;
 ;; Algorithm used to sign OAuth2 tokens. Valid values: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, EdDSA
 ;JWT_SIGNING_ALGORITHM = RS256
@@ -574,8 +553,7 @@ ENABLED = true
 ;; Pre-register OAuth2 applications for some universally useful services
 ;; * https://github.com/hickford/git-credential-oauth
 ;; * https://github.com/git-ecosystem/git-credential-manager
-;; * https://gitea.com/gitea/tea
-;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea
+;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -784,10 +762,6 @@ LEVEL = Info
 ;; Please note that setting this to false will not disable OAuth Basic or Basic authentication using a token
 ;ENABLE_BASIC_AUTHENTICATION = true
 ;;
-;; Show the password sign-in form (for password-based login), otherwise, only show OAuth2 login methods.
-;; If you set it to false, maybe it also needs to set ENABLE_BASIC_AUTHENTICATION to false to completely disable password-based authentication.
-;ENABLE_PASSWORD_SIGNIN_FORM = true
-;;
 ;; More detail: https://github.com/gogits/gogs/issues/165
 ;ENABLE_REVERSE_PROXY_AUTHENTICATION = false
 ; Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.
@@ -915,24 +889,6 @@ LEVEL = Info
 ;; Valid site url schemes for user profiles
 ;VALID_SITE_URL_SCHEMES=http,https

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[service.explore]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;
-;; Only allow signed in users to view the explore pages.
-;REQUIRE_SIGNIN_VIEW = false
-;;
-;; Disable the users explore page.
-;DISABLE_USERS_PAGE = false
-;;
-;; Disable the organizations explore page.
-;DISABLE_ORGANIZATIONS_PAGE = false
-;;
-;; Disable the code explore page.
-;DISABLE_CODE_PAGE = false
-;;

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -992,12 +948,6 @@ LEVEL = Info
 ;GO_GET_CLONE_URL_PROTOCOL = https
 ;;
 ;; Close issues as long as a commit on any branch marks it as fixed
-;DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH = false
-;;
-;; Allow users to push local repositories to Gitea and have them automatically created for a user or an org
-;ENABLE_PUSH_CREATE_USER = false
-;ENABLE_PUSH_CREATE_ORG = false
-;;
 ;; Comma separated list of globally disabled repo units. Allowed values: repo.issues, repo.ext_issues, repo.pulls, repo.wiki, repo.ext_wiki, repo.projects, repo.packages, repo.actions.
 ;DISABLED_REPO_UNITS =
 ;;
@@ -1005,20 +955,12 @@ LEVEL = Info
 ;; Note: Code and Releases can currently not be deactivated. If you specify default repo units you should still list them for future compatibility.
 ;; External wiki and issue tracker can't be enabled by default as it requires additional settings.
 ;; Disabled repo units will not be added to new repositories regardless if it is in the default list.
-;DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions
+;DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages
 ;;
 ;; Comma separated list of default forked repo units.
 ;; The set of allowed values and rules are the same as DEFAULT_REPO_UNITS.
 ;DEFAULT_FORK_REPO_UNITS = repo.code,repo.pulls
 ;;
-;; Comma separated list of default mirror repo units.
-;; The set of allowed values and rules are the same as DEFAULT_REPO_UNITS.
-;DEFAULT_MIRROR_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.wiki,repo.projects,repo.packages
-;;
-;; Comma separated list of default template repo units.
-;; The set of allowed values and rules are the same as DEFAULT_REPO_UNITS.
-;DEFAULT_TEMPLATE_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages
-;;
 ;; Prefix archive files by placing them in a directory named after the repository
 ;PREFIX_ARCHIVE_FILES = true
 ;;
@@ -1040,13 +982,9 @@ LEVEL = Info
 ;; Don't allow download source archive files from UI
 ;DISABLE_DOWNLOAD_SOURCE_ARCHIVES = false

-;; Allow to fork repositories without maximum number limit
+;; Allow fork repositories without maximum number limit
 ;ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT = true

-;; Allow to fork repositories into the same owner (user or organization)
-;; This feature is experimental, not fully tested, and may be changed in the future
-;ALLOW_FORK_INTO_SAME_OWNER = false
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[repository.editor]
@@ -1082,7 +1020,7 @@ LEVEL = Info
 ;ALLOWED_TYPES =
 ;;
 ;; Max size of each file in megabytes. Defaults to 50MB
-;FILE_MAX_SIZE = 50
+;FILE_MAX_SIZE = 50 
 ;;
 ;; Max number of files per upload. Defaults to 5
 ;MAX_FILES = 5
@@ -1102,7 +1040,7 @@ LEVEL = Info
 ;; List of keywords used in Pull Request comments to automatically reopen a related issue
 ;REOPEN_KEYWORDS = reopen,reopens,reopened
 ;;
-;; Set default merge style for repository creating, valid options: merge, rebase, rebase-merge, squash, fast-forward-only
+;; Set default merge style for repository creating, valid options: merge, rebase, rebase-merge, squash
 ;DEFAULT_MERGE_STYLE = merge
 ;;
 ;; In the default merge message for squash commits include at most this many commits
@@ -1125,9 +1063,6 @@ LEVEL = Info
 ;;
 ;; In addition to testing patches using the three-way merge method, re-test conflicting patches with git apply
 ;TEST_CONFLICTING_PATCHES_WITH_GIT_APPLY = false
-;;
-;; Retarget child pull requests to the parent pull request branch target on merge of parent pull request. It only works on merged PRs where the head and base branch target the same repo.
-;RETARGET_CHILDREN_ON_MERGE = true

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1276,11 +1211,10 @@ LEVEL = Info
 ;SHOW_USER_EMAIL = true
 ;;
 ;; Set the default theme for the Gitea install
-;DEFAULT_THEME = gitea-auto
+;DEFAULT_THEME = auto
 ;;
 ;; All available themes. Allow users select personalized themes regardless of the value of `DEFAULT_THEME`.
-;; Leave it empty to allow users to select any theme from "{CustomPath}/public/assets/css/theme-*.css"
-;THEMES =
+;THEMES = auto,gitea,arc-green
 ;;
 ;; All available reactions users can choose on issues/prs and comments.
 ;; Values can be emoji alias (:smile:) or a unicode emoji.
@@ -1304,14 +1238,6 @@ LEVEL = Info
 ;; Whether to only show relevant repos on the explore page when no keyword is specified and default sorting is used.
 ;; A repo is considered irrelevant if it's a fork or if it has no metadata (no description, no icon, no topic).
 ;ONLY_SHOW_RELEVANT_REPOS = false
-;;
-;; Change the sort type of the explore pages.
-;; Default is "recentupdate", but you also have "alphabetically", "reverselastlogin", "newest", "oldest".
-;EXPLORE_PAGING_DEFAULT_SORT = recentupdate
-;;
-;; The tense all timestamps should be rendered in. Possible values are `absolute` time (i.e. 1970-01-01, 11:59) and `mixed`.
-;; `mixed` means most timestamps are rendered in relative time (i.e. 2 days ago).
-;PREFERRED_TIMESTAMP_TENSE = mixed

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1382,9 +1308,6 @@ LEVEL = Info
 ;;
 ;; Maximum allowed file size in bytes to render CSV files as table. (Set to 0 for no limit).
 ;MAX_FILE_SIZE = 524288
-;;
-;; Maximum allowed rows to render CSV files. (Set to 0 for no limit)
-;MAX_ROWS = 2500

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1507,7 +1430,7 @@ LEVEL = Info
 ;; Batch size to send for batched queues
 ;BATCH_LENGTH = 20
 ;;
-;; Connection string for redis queues this will store the redis (or Redis cluster) connection string.
+;; Connection string for redis queues this will store the redis or redis-cluster connection string.
 ;; When `TYPE` is `persistable-channel`, this provides a directory for the underlying leveldb
 ;; or additional options of the form `leveldb://path/to/db?option=value&....`, and will override `DATADIR`.
 ;CONN_STR = "redis://127.0.0.1:6379/0"
@@ -1532,22 +1455,6 @@ LEVEL = Info
 ;;
 ;; Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disabled
 ;DEFAULT_EMAIL_NOTIFICATIONS = enabled
-;; Disabled features for users could be "deletion", "manage_ssh_keys", "manage_gpg_keys", "manage_mfa", "manage_credentials" more features can be disabled in future
-;; - deletion: a user cannot delete their own account
-;; - manage_ssh_keys: a user cannot configure ssh keys
-;; - manage_gpg_keys: a user cannot configure gpg keys
-;; - manage_mfa: a user cannot configure mfa devices
-;; - manage_credentials: a user cannot configure emails, passwords, or openid
-;USER_DISABLED_FEATURES =
-;; Comma separated list of disabled features ONLY if the user has an external login type (eg. LDAP, Oauth, etc.), could be "deletion", "manage_ssh_keys", "manage_gpg_keys", "manage_mfa", "manage_credentials". This setting is independent from `USER_DISABLED_FEATURES` and supplements its behavior.
-;; - deletion: a user cannot delete their own account
-;; - manage_ssh_keys: a user cannot configure ssh keys
-;; - manage_gpg_keys: a user cannot configure gpg keys
-;; - manage_mfa: a user cannot configure mfa devices
-;; - manage_credentials: a user cannot configure emails, passwords, or openid
-;; - change_username: a user cannot change their username
-;; - change_full_name: a user cannot change their full name
-;;EXTERNAL_USER_DISABLE_FEATURES =

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1611,12 +1518,7 @@ LEVEL = Info
 ;; The source of the username for new oauth2 accounts:
 ;; userid = use the userid / sub attribute
 ;; nickname = use the nickname attribute
-;; preferred_username = use the preferred_username attribute
 ;; email = use the username part of the email attribute
-;; Note: `nickname`, `preferred_username` and `email` options will normalize input strings using the following criteria:
-;; - diacritics are removed
-;; - the characters in the set ['´`] are removed
-;; - the characters in the set [\s~+] are replaced with "-"
 ;USERNAME = nickname
 ;;
 ;; Update avatar if available from oauth2 provider.
@@ -1722,10 +1624,6 @@ LEVEL = Info
 ;; Sometimes it is helpful to use a different address on the envelope. Set this to use ENVELOPE_FROM as the from on the envelope. Set to `<>` to send an empty address.
 ;ENVELOPE_FROM =
 ;;
-;; If gitea sends mails on behave of users, it will just use the name also displayed in the WebUI. If you want e.g. `Mister X (by CodeIt) <gitea@codeit.net>`,
-;; set it to `{{ .DisplayName }} (by {{ .AppName }})`. Available Variables: `.DisplayName`, `.AppName` and `.Domain`.
-;FROM_DISPLAY_NAME_FORMAT = {{ .DisplayName }}
-;;
 ;; Mailer user name and password, if required by provider.
 ;USER =
 ;;
@@ -1748,16 +1646,6 @@ LEVEL = Info
 ;; convert \r\n to \n for Sendmail
 ;SENDMAIL_CONVERT_CRLF = true

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[mailer.override_header]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; This is empty by default, use it only if you know what you need it for.
-;Reply-To = test@example.com, test2@example.com
-;Content-Type = text/html; charset=utf-8
-;In-Reply-To =
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[email.incoming]
@@ -1805,14 +1693,18 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
+;; if the cache enabled
+;ENABLED = true
+;;
 ;; Either "memory", "redis", "memcache", or "twoqueue". default is "memory"
 ;ADAPTER = memory
 ;;
 ;; For "memory" only, GC interval in seconds, default is 60
 ;INTERVAL = 60
 ;;
-;; For "redis" and "memcache", connection host address
-;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
+;; For "redis", "redis-cluster" and "memcache", connection host address
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s`
+;; redis-cluster: `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s`
 ;; memcache: `127.0.0.1:11211`
 ;; twoqueue: `{"size":50000,"recent_ratio":0.25,"ghost_ratio":0.5}` or `50000`
 ;HOST =
@@ -1828,6 +1720,8 @@ LEVEL = Info
 ;[cache.last_commit]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; if the cache enabled
+;ENABLED = true
 ;;
 ;; Time to keep items in cache if not used, default is 8760 hours.
 ;; Setting it to -1 disables caching
@@ -1842,14 +1736,15 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;; Either "memory", "file", "redis", "db", "mysql", "couchbase", "memcache" or "postgres"
+;; Either "memory", "file", "redis", "redis-cluster", "db", "mysql", "couchbase", "memcache" or "postgres"
 ;; Default is "memory". "db" will reuse the configuration in [database]
 ;PROVIDER = memory
 ;;
 ;; Provider config options
 ;; memory: doesn't have any config yet
 ;; file: session file path, e.g. `data/sessions`
-;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s`
+;; redis-cluster: `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s`
 ;; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
 ;PROVIDER_CONFIG = data/sessions ; Relative paths will be made absolute against _`AppWorkPath`_.
 ;;
@@ -1920,7 +1815,7 @@ LEVEL = Info
 ;ENABLED = true
 ;;
 ;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
-;ALLOWED_TYPES = .avif,.cpuprofile,.csv,.dmp,.docx,.fodg,.fodp,.fods,.fodt,.gif,.gz,.jpeg,.jpg,.json,.jsonc,.log,.md,.mov,.mp4,.odf,.odg,.odp,.ods,.odt,.patch,.pdf,.png,.pptx,.svg,.tgz,.txt,.webm,.webp,.xls,.xlsx,.zip
+;ALLOWED_TYPES = .csv,.docx,.fodg,.fodp,.fods,.fodt,.gif,.gz,.jpeg,.jpg,.log,.md,.mov,.mp4,.odf,.odg,.odp,.ods,.odt,.patch,.pdf,.png,.pptx,.svg,.tgz,.txt,.webm,.xls,.xlsx,.zip
 ;;
 ;; Max size of each file. Defaults to 2048MB
 ;MAX_SIZE = 2048
@@ -1933,7 +1828,7 @@ LEVEL = Info
 ;STORAGE_TYPE = local
 ;;
 ;; Allows the storage driver to redirect to authenticated URLs to serve files directly
-;; Currently, only `minio` and `azureblob` is supported.
+;; Currently, only `minio` is supported.
 ;SERVE_DIRECT = false
 ;;
 ;; Path for attachments. Defaults to `attachments`. Only available when STORAGE_TYPE is `local`
@@ -1943,22 +1838,12 @@ LEVEL = Info
 ;; Minio endpoint to connect only available when STORAGE_TYPE is `minio`
 ;MINIO_ENDPOINT = localhost:9000
 ;;
-;; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`.
-;; If not provided and STORAGE_TYPE is `minio`, will search for credentials in known
-;; environment variables (MINIO_ACCESS_KEY_ID, AWS_ACCESS_KEY_ID), credentials files
-;; (~/.mc/config.json, ~/.aws/credentials), and EC2 instance metadata.
+;; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`
 ;MINIO_ACCESS_KEY_ID =
 ;;
 ;; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
 ;MINIO_SECRET_ACCESS_KEY =
 ;;
-;; Preferred IAM Endpoint to override Minio's default IAM Endpoint resolution only available when STORAGE_TYPE is `minio`.
-;; If not provided and STORAGE_TYPE is `minio`, will search for and derive endpoint from known environment variables
-;; (AWS_CONTAINER_AUTHORIZATION_TOKEN, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
-;; AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME, AWS_REGION),
-;; or the DefaultIAMRoleEndpoint if not provided otherwise.
-;MINIO_IAM_ENDPOINT =
-;;
 ;; Minio bucket to store the attachments only available when STORAGE_TYPE is `minio`
 ;MINIO_BUCKET = gitea
 ;;
@@ -1976,24 +1861,6 @@ LEVEL = Info
 ;;
 ;; Minio checksum algorithm: default (for MinIO or AWS S3) or md5 (for Cloudflare or Backblaze)
 ;MINIO_CHECKSUM_ALGORITHM = default
-;;
-;; Minio bucket lookup method defaults to auto mode; set it to `dns` for virtual host style or `path` for path style, only available when STORAGE_TYPE is `minio`
-;MINIO_BUCKET_LOOKUP_TYPE = auto
-;; Azure Blob endpoint to connect only available when STORAGE_TYPE is `azureblob`,
-;; e.g. https://accountname.blob.core.windows.net or http://127.0.0.1:10000/devstoreaccount1
-;AZURE_BLOB_ENDPOINT =
-;;
-;; Azure Blob account name to connect only available when STORAGE_TYPE is `azureblob`
-;AZURE_BLOB_ACCOUNT_NAME =
-;;
-;; Azure Blob account key to connect only available when STORAGE_TYPE is `azureblob`
-;AZURE_BLOB_ACCOUNT_KEY =
-;;
-;; Azure Blob container to store the attachments only available when STORAGE_TYPE is `azureblob`
-;AZURE_BLOB_CONTAINER = gitea
-;;
-;; override the azure blob base path if storage type is azureblob
-;AZURE_BLOB_BASE_PATH = attachments/

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2132,17 +1999,6 @@ LEVEL = Info
 ;;   or only create new users if UPDATE_EXISTING is set to false
 ;UPDATE_EXISTING = true

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Cleanup expired actions assets
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.cleanup_actions]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;ENABLED = true
-;RUN_AT_START = true
-;SCHEDULE = @midnight
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Clean-up deleted branches
@@ -2425,8 +2281,6 @@ LEVEL = Info
 ;SHOW_FOOTER_VERSION = true
 ;; Show template execution time in the footer
 ;SHOW_FOOTER_TEMPLATE_LOAD_TIME = true
-;; Show the "powered by" text in the footer
-;SHOW_FOOTER_POWERED_BY = true
 ;; Generate sitemap. Defaults to `true`.
 ;ENABLE_SITEMAP = true
 ;; Enable/Disable RSS/Atom feed
@@ -2486,6 +2340,22 @@ LEVEL = Info
 ;; Enable issue by repository metrics; default is false
 ;ENABLED_ISSUE_BY_REPOSITORY = false

+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[task]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Task queue type, could be `channel` or `redis`.
+;QUEUE_TYPE = channel
+;;
+;; Task queue length, available only when `QUEUE_TYPE` is `channel`.
+;QUEUE_LENGTH = 1000
+;;
+;; Task queue connection string, available only when `QUEUE_TYPE` is `redis`.
+;; If there is a password of redis, use `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for `redis-clsuter`.
+;QUEUE_CONN_STR = "redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s"
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[migrations]
@@ -2553,11 +2423,6 @@ LEVEL = Info
 ;STORAGE_TYPE = local
 ;; override the minio base path if storage type is minio
 ;MINIO_BASE_PATH = packages/
-;; override the azure blob base path if storage type is azureblob
-;AZURE_BLOB_BASE_PATH = packages/
-;; Allows the storage driver to redirect to authenticated URLs to serve files directly
-;; Currently, only `minio` and `azureblob` is supported.
-;SERVE_DIRECT = false
 ;;
 ;; Path for chunked uploads. Defaults to APP_DATA_PATH + `tmp/package-upload`
 ;CHUNKED_UPLOAD_PATH = tmp/package-upload
@@ -2608,8 +2473,7 @@ LEVEL = Info
 ;LIMIT_SIZE_SWIFT = -1
 ;; Maximum size of a Vagrant upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
 ;LIMIT_SIZE_VAGRANT = -1
-;; Enable RPM re-signing by default. (It will overwrite the old signature ,using v4 format, not compatible with CentOS 6 or older)
-;DEFAULT_RPM_SIGN_ENABLED  = false
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; default storage for attachments, lfs and avatars
@@ -2632,8 +2496,6 @@ LEVEL = Info
 ;;
 ;; override the minio base path if storage type is minio
 ;MINIO_BASE_PATH = repo-archive/
-;; override the azure blob base path if storage type is azureblob
-;AZURE_BLOB_BASE_PATH = repo-archive/

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2655,25 +2517,8 @@ LEVEL = Info
 ;; Where your lfs files reside, default is data/lfs.
 ;PATH = data/lfs
 ;;
-;; Allows the storage driver to redirect to authenticated URLs to serve files directly
-;; Currently, only `minio` and `azureblob` is supported.
-;SERVE_DIRECT = false
-;;
 ;; override the minio base path if storage type is minio
 ;MINIO_BASE_PATH = lfs/
-;;
-;; override the azure blob base path if storage type is azureblob
-;AZURE_BLOB_BASE_PATH = lfs/
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; settings for Gitea's LFS client (eg: mirroring an upstream lfs endpoint)
-;;
-;[lfs_client]
-;; Limit the number of pointers in each batch request to this number
-;BATCH_SIZE = 20
-;; Limit the number of concurrent upload/download operations within a batch
-;BATCH_OPERATION_CONCURRENCY = 8

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2688,28 +2533,18 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; customize storage
-;[storage.minio]
+;[storage.my_minio]
 ;STORAGE_TYPE = minio
 ;;
 ;; Minio endpoint to connect only available when STORAGE_TYPE is `minio`
 ;MINIO_ENDPOINT = localhost:9000
 ;;
-;; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`.
-;; If not provided and STORAGE_TYPE is `minio`, will search for credentials in known
-;; environment variables (MINIO_ACCESS_KEY_ID, AWS_ACCESS_KEY_ID), credentials files
-;; (~/.mc/config.json, ~/.aws/credentials), and EC2 instance metadata.
+;; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`
 ;MINIO_ACCESS_KEY_ID =
 ;;
 ;; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
 ;MINIO_SECRET_ACCESS_KEY =
 ;;
-;; Preferred IAM Endpoint to override Minio's default IAM Endpoint resolution only available when STORAGE_TYPE is `minio`.
-;; If not provided and STORAGE_TYPE is `minio`, will search for and derive endpoint from known environment variables
-;; (AWS_CONTAINER_AUTHORIZATION_TOKEN, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
-;; AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME, AWS_REGION),
-;; or the DefaultIAMRoleEndpoint if not provided otherwise.
-;MINIO_IAM_ENDPOINT =
-;;
 ;; Minio bucket to store the attachments only available when STORAGE_TYPE is `minio`
 ;MINIO_BUCKET = gitea
 ;;
@@ -2721,25 +2556,6 @@ LEVEL = Info
 ;;
 ;; Minio skip SSL verification available when STORAGE_TYPE is `minio`
 ;MINIO_INSECURE_SKIP_VERIFY = false
-;;
-;; Minio bucket lookup method defaults to auto mode; set it to `dns` for virtual host style or `path` for path style, only available when STORAGE_TYPE is `minio`
-;MINIO_BUCKET_LOOKUP_TYPE = auto
-
-;[storage.azureblob]
-;STORAGE_TYPE = azureblob
-;;
-;; Azure Blob endpoint to connect only available when STORAGE_TYPE is `azureblob`,
-;; e.g. https://accountname.blob.core.windows.net or http://127.0.0.1:10000/devstoreaccount1
-;AZURE_BLOB_ENDPOINT =
-;;
-;; Azure Blob account name to connect only available when STORAGE_TYPE is `azureblob`
-;AZURE_BLOB_ACCOUNT_NAME =
-;;
-;; Azure Blob account key to connect only available when STORAGE_TYPE is `azureblob`
-;AZURE_BLOB_ACCOUNT_KEY =
-;;
-;; Azure Blob container to store the attachments only available when STORAGE_TYPE is `azureblob`
-;AZURE_BLOB_CONTAINER = gitea

 ;[proxy]
 ;; Enable the proxy, all requests to external via HTTP will be affected
@@ -2755,14 +2571,6 @@ LEVEL = Info
 ;;
 ;; Default platform to get action plugins, `github` for `https://github.com`, `self` for the current Gitea instance.
 ;DEFAULT_ACTIONS_URL = github
-;; Logs retention time in days. Old logs will be deleted after this period.
-;LOG_RETENTION_DAYS = 365
-;; Log compression type, `none` for no compression, `zstd` for zstd compression.
-;; Other compression types like `gzip` are NOT supported, since seekable stream is required for log view.
-;; It's always recommended to use compression when using local disk as log storage if CPU or memory is not a bottleneck.
-;; And for object storage services like S3, which is billed for requests, it would cause extra 2 times of get requests for each log view.
-;; But it will save storage space and network bandwidth, so it's still recommended to use compression.
-;LOG_COMPRESSION = zstd
 ;; Default artifact retention time in days. Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
 ;ARTIFACT_RETENTION_DAYS = 90
 ;; Timeout to stop the task which have running status, but haven't been updated for a long time
@@ -2771,8 +2579,6 @@ LEVEL = Info
 ;ENDLESS_TASK_TIMEOUT = 3h
 ;; Timeout to cancel the jobs which have waiting status, but haven't been picked by a runner for a long time
 ;ABANDONED_JOB_TIMEOUT = 24h
-;; Strings committers can place inside a commit message or PR title to skip executing the corresponding actions workflow
-;SKIP_WORKFLOW_STRINGS = [skip ci],[ci skip],[no ci],[skip actions],[actions skip]

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2783,9 +2589,3 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; storage type
 ;STORAGE_TYPE = local
-
-;[global_lock]
-;; Lock service type, could be memory or redis
-;SERVICE_TYPE = memory
-;; Ignored for the "memory" type. For "redis" use something like `redis://127.0.0.1:6379/0`
-;SERVICE_CONN_STR =
--- a/docker/README.md
+++ b/docker/README.md
@@ -1,7 +1,7 @@
 # Gitea - Docker

-Dockerfile is found in the root of the repository.
+Dockerfile is found in root of repository.

-Docker image can be found on [docker hub](https://hub.docker.com/r/gitea/gitea).
+Docker image can be found on [docker hub](https://hub.docker.com/r/gitea/gitea)

-Documentation on using docker image can be found on [Gitea Docs site](https://docs.gitea.com/installation/install-with-docker-rootless).
+Documentation on using docker image can be found on [Gitea Docs site](https://docs.gitea.com/installation/install-with-docker-rootless)
--- a/docs/.gitignore
+++ b/docs/.gitignore
@@ -0,0 +1,7 @@
+public/
+templates/swagger/v1_json.tmpl
+themes/
+resources/
+
+# Temporary lock file while building
+/.hugo_build.lock
--- a/options/license/Pixar
+++ b/options/license/Pixar
@@ -1,6 +1,7 @@

-                               Modified Apache 2.0 License
-
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

@@ -136,9 +137,9 @@
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor
-      and its affiliates, except as required to comply with Section 4(c) of
-      the License and to reproduce the content of the NOTICE file.
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
@@ -172,3 +173,30 @@
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
--- a/docs/README.md
+++ b/docs/README.md
@@ -0,0 +1,22 @@
+# Gitea: Docs
+
+[![Join the chat at https://img.shields.io/discord/322538954119184384.svg](https://img.shields.io/discord/322538954119184384.svg)](https://discord.gg/Gitea)
+[![](https://images.microbadger.com/badges/image/gitea/docs.svg)](http://microbadger.com/images/gitea/docs "Get your own image badge on microbadger.com")
+
+These docs are ingested by our [docs repo](https://gitea.com/gitea/gitea-docusaurus).
+
+## Authors
+
+* [Maintainers](https://github.com/orgs/go-gitea/people)
+* [Contributors](https://github.com/go-gitea/docs/graphs/contributors)
+
+## License
+
+This project is under the Apache-2.0 License. See the [LICENSE](LICENSE) file
+for the full license text.
+
+## Copyright
+
+```
+Copyright (c) 2016 The Gitea Authors <https://gitea.io>
+```
--- a/docs/README_ZH.md
+++ b/docs/README_ZH.md
@@ -0,0 +1,22 @@
+# Gitea: 文档
+
+[![Build Status](http://drone.gitea.io/api/badges/go-gitea/docs/status.svg)](http://drone.gitea.io/go-gitea/docs)
+[![Join the chat at https://img.shields.io/discord/322538954119184384.svg](https://img.shields.io/discord/322538954119184384.svg)](https://discord.gg/Gitea)
+[![](https://images.microbadger.com/badges/image/gitea/docs.svg)](http://microbadger.com/images/gitea/docs "Get your own image badge on microbadger.com")
+
+https://gitea.com/gitea/gitea-docusaurus
+
+## 关于我们
+
+* [维护者信息](https://github.com/orgs/go-gitea/people)
+* [代码贡献者信息](https://github.com/go-gitea/docs/graphs/contributors)
+
+## 许可证
+
+此项目采用 Apache-2.0 许可协议，请参见 [协议文件](LICENSE) 获取更多信息。
+
+## 版权声明
+
+```
+Copyright (c) 2016 The Gitea Authors <https://gitea.io>
+```
--- a/docs/content/actions.en-us.md
+++ b/docs/content/actions.en-us.md
@@ -0,0 +1,13 @@
+---
+date: "2023-04-27T14:00:00+08:00"
+title: "Actions"
+slug: "actions"
+sidebar_position: 36
+toc: false
+draft: false
+menu:
+  sidebar:
+    name: "Usage - Actions"
+    sidebar_position: 31
+    identifier: "actions"
+---
--- a/docs/content/administration.en-us.md
+++ b/docs/content/administration.en-us.md
@@ -0,0 +1,14 @@
+---
+date: "2016-12-01T16:00:00+02:00"
+title: "Administration"
+slug: "administration"
+sidebar_position: 30
+toc: false
+draft: false
+menu:
+  sidebar:
+    name: "Administration"
+    sidebar_position: 20
+    collapse: true
+    identifier: "administration"
+---
--- a/docs/content/administration.zh-cn.md
+++ b/docs/content/administration.zh-cn.md
@@ -0,0 +1,13 @@
+---
+date: "2016-12-01T16:00:00+02:00"
+title: "运维"
+slug: "administration"
+sidebar_position: 30
+toc: false
+draft: false
+menu:
+  sidebar:
+    name: "运维"
+    sidebar_position: 20
+    identifier: "administration"
+---
--- a/tests/gitea-repositories-meta/org41/repo61.git/objects/.keep
+++ b/tests/gitea-repositories-meta/org41/repo61.git/objects/.keep
--- a/tests/gitea-repositories-meta/org41/repo61.git/refs/.keep
+++ b/tests/gitea-repositories-meta/org41/repo61.git/refs/.keep
--- a/docs/content/administration/adding-legal-pages.en-us.md
+++ b/docs/content/administration/adding-legal-pages.en-us.md
@@ -0,0 +1,40 @@
+---
+date: "2019-12-28"
+title: "Adding Legal Pages"
+slug: adding-legal-pages
+sidebar_position: 110
+toc: false
+draft: false
+aliases:
+  - /en-us/adding-legal-pages
+menu:
+  sidebar:
+    parent: "administration"
+    name: "Adding Legal Pages"
+    identifier: "adding-legal-pages"
+    sidebar_position: 110
+---
+
+Some jurisdictions (such as EU), requires certain legal pages (e.g. Privacy Policy) to be added to website. Follow these steps to add them to your Gitea instance.
+
+## Getting Pages
+
+Gitea source code ships with sample pages, available in `contrib/legal` directory. Copy them to `custom/public/assets/`. For example, to add Privacy Policy:
+
+```
+wget -O /path/to/custom/public/assets/privacy.html https://raw.githubusercontent.com/go-gitea/gitea/main/contrib/legal/privacy.html.sample
+```
+
+Now you need to edit the page to meet your requirements. In particular you must change the email addresses, web addresses and references to "Your Gitea Instance" to match your situation.
+
+You absolutely must not place a general ToS or privacy statement that implies that the Gitea project is responsible for your server.
+
+## Make it Visible
+
+Create or append to `/path/to/custom/templates/custom/extra_links_footer.tmpl`:
+
+```go
+<a class="item" href="{{AppSubUrl}}/assets/privacy.html">Privacy Policy</a>
+```
+
+Restart Gitea to see the changes.
--- a/docs/content/administration/adding-legal-pages.zh-cn.md
+++ b/docs/content/administration/adding-legal-pages.zh-cn.md
@@ -0,0 +1,40 @@
+---
+date: "2023-05-23T09:00:00+08:00"
+title: "添加法律页面"
+slug: adding-legal-pages
+sidebar_position: 110
+toc: false
+draft: false
+aliases:
+  - /zh-cn/adding-legal-pages
+menu:
+  sidebar:
+    parent: "administration"
+    name: "添加法律页面"
+    identifier: "adding-legal-pages"
+    sidebar_position: 110
+---
+
+一些法域（例如欧盟）要求在网站上添加特定的法律页面（例如隐私政策）。按照以下步骤将它们添加到你的 Gitea 实例中。
+
+## 获取页面
+
+Gitea 源代码附带了示例页面，位于 `contrib/legal` 目录中。将它们复制到 `custom/public/assets/` 目录下。例如，如果要添加隐私政策：
+
+```
+wget -O /path/to/custom/public/assets/privacy.html https://raw.githubusercontent.com/go-gitea/gitea/main/contrib/legal/privacy.html.sample
+```
+
+现在，你需要编辑该页面以满足你的需求。特别是，你必须更改电子邮件地址、网址以及与 "Your Gitea Instance" 相关的引用，以匹配你的情况。
+
+请务必不要放置会暗示 Gitea 项目对你的服务器负责的一般服务条款或隐私声明。
+
+## 使其可见
+
+创建或追加到 `/path/to/custom/templates/custom/extra_links_footer.tmpl` 文件中：
+
+```go
+<a class="item" href="{{AppSubUrl}}/assets/privacy.html">隐私政策</a>
+```
+
+重启 Gitea 以查看更改。
--- a/docs/content/administration/backup-and-restore.en-us.md
+++ b/docs/content/administration/backup-and-restore.en-us.md
@@ -0,0 +1,158 @@
+---
+date: "2017-01-01T16:00:00+02:00"
+title: "Backup and Restore"
+slug: "backup-and-restore"
+sidebar_position: 11
+toc: false
+draft: false
+aliases:
+  - /en-us/backup-and-restore
+menu:
+  sidebar:
+    parent: "administration"
+    name: "Backup and Restore"
+    sidebar_position: 11
+    identifier: "backup-and-restore"
+---
+
+# Backup and Restore
+
+Gitea currently has a `dump` command that will save the installation to a ZIP file. This
+file can be unpacked and used to restore an instance.
+
+## Backup Consistency
+
+To ensure the consistency of the Gitea instance, it must be shutdown during backup.
+
+Gitea consists of a database, files and git repositories, all of which change when it is used. For instance, when a migration is in progress, a transaction is created in the database while the git repository is being copied over. If the backup happens in the middle of the migration, the git repository may be incomplete although the database claims otherwise because it was dumped afterwards. The only way to avoid such race conditions is by stopping the Gitea instance during the backups.
+
+## Backup Command (`dump`)
+
+Switch to the user running Gitea: `su git`. Run `./gitea dump -c /path/to/app.ini` in the Gitea installation
+directory. There should be some output similar to the following:
+
+```none
+2016/12/27 22:32:09 Creating tmp work dir: /tmp/gitea-dump-417443001
+2016/12/27 22:32:09 Dumping local repositories.../home/git/gitea-repositories
+2016/12/27 22:32:22 Dumping database...
+2016/12/27 22:32:22 Packing dump files...
+2016/12/27 22:32:34 Removing tmp work dir: /tmp/gitea-dump-417443001
+2016/12/27 22:32:34 Finish dumping in file gitea-dump-1482906742.zip
+```
+
+Inside the `gitea-dump-1482906742.zip` file, will be the following:
+
+- `app.ini` - Optional copy of configuration file if originally stored outside the default `custom/` directory
+- `custom/` - All config or customization files in `custom/`.
+- `data/` - Data directory (APP_DATA_PATH), except sessions if you are using file session. This directory includes `attachments`, `avatars`, `lfs`, `indexers`, SQLite file if you are using SQLite.
+- `repos/` - Complete copy of the repository directory.
+- `gitea-db.sql` - SQL dump of database
+- `log/` - Various logs. They are not needed for a recovery or migration.
+
+Intermediate backup files are created in a temporary directory specified either with the
+`--tempdir` command-line parameter or the `TMPDIR` environment variable.
+
+## Backup the database
+
+The SQL dump created by `gitea dump` uses XORM and Gitea admins may prefer to use the native the MySQL and PostgreSQL dump tools instead. There are still open issues when using XORM for dumping the database that may cause problems when attempting to restore it.
+
+```sh
+# mysql
+mysqldump -u$USER -p$PASS --database $DATABASE > gitea-db.sql
+# postgres
+pg_dump -U $USER $DATABASE > gitea-db.sql
+```
+
+### Using Docker (`dump`)
+
+There are a few caveats for using the `dump` command with Docker.
+
+The command has to be executed with the `RUN_USER = <OS_USERNAME>` specified in `gitea/conf/app.ini`; and, for the zipping of the backup folder to occur without permission error the command `docker exec` must be executed inside of the `--tempdir`.
+
+Example:
+
+```none
+docker exec -u <OS_USERNAME> -it -w <--tempdir> $(docker ps -qf 'name=^<NAME_OF_DOCKER_CONTAINER>$') bash -c '/usr/local/bin/gitea dump -c </path/to/app.ini>'
+```
+
+\*Note: `--tempdir` refers to the temporary directory of the docker environment used by Gitea; if you have not specified a custom `--tempdir`, then Gitea uses `/tmp` or the `TMPDIR` environment variable of the docker container. For `--tempdir` adjust your `docker exec` command options accordingly.
+
+The result should be a file, stored in the `--tempdir` specified, along the lines of: `gitea-dump-1482906742.zip`
+
+## Restore Command (`restore`)
+
+There is currently no support for a recovery command. It is a manual process that mostly
+involves moving files to their correct locations and restoring a database dump.
+
+Example:
+
+```sh
+unzip gitea-dump-1610949662.zip
+cd gitea-dump-1610949662
+mv app.ini /etc/gitea/conf/app.ini
+mv data/* /var/lib/gitea/data/
+mv log/* /var/lib/gitea/log/
+mv repos/* /var/lib/gitea/gitea-repositories/
+chown -R gitea:gitea /etc/gitea/conf/app.ini /var/lib/gitea
+
+# mysql
+mysql --default-character-set=utf8mb4 -u$USER -p$PASS $DATABASE <gitea-db.sql
+# sqlite3
+sqlite3 $DATABASE_PATH <gitea-db.sql
+# postgres
+psql -U $USER -d $DATABASE < gitea-db.sql
+
+service gitea restart
+```
+
+Repository Git Hooks should be regenerated if installation method is changed (eg. binary -> Docker), or if Gitea is installed to a different directory than the previous installation.
+
+With Gitea running, and from the directory Gitea's binary is located, execute: `./gitea admin regenerate hooks`
+
+This ensures that application and configuration file paths in repository Git Hooks are consistent and applicable to the current installation. If these paths are not updated, repository `push` actions will fail.
+
+### Using Docker (`restore`)
+
+There is also no support for a recovery command in a Docker-based gitea instance. The restore process contains the same steps as described in the previous section but with different paths.
+
+Example:
+
+```sh
+# open bash session in container
+docker exec --user git -it 2a83b293548e bash
+# unzip your backup file within the container
+unzip gitea-dump-1610949662.zip
+cd gitea-dump-1610949662
+# restore the gitea data
+mv data/* /data/gitea
+# restore the repositories itself
+mv repos/* /data/git/gitea-repositories/
+# adjust file permissions
+chown -R git:git /data
+# Regenerate Git Hooks
+/usr/local/bin/gitea -c '/data/gitea/conf/app.ini' admin regenerate hooks
+```
+
+The default user in the gitea container is `git` (1000:1000). Please replace `2a83b293548e` with your gitea container id or name.
+
+### Using Docker-rootless (`restore`)
+
+The restore workflow in Docker-rootless containers differs only in the directories to be used:
+
+```sh
+# open bash session in container
+docker exec --user git -it 2a83b293548e bash
+# unzip your backup file within the container
+unzip gitea-dump-1610949662.zip
+cd gitea-dump-1610949662
+# restore the app.ini
+mv data/conf/app.ini /etc/gitea/app.ini
+# restore the gitea data
+mv data/* /var/lib/gitea
+# restore the repositories itself
+mv repos/* /var/lib/gitea/git/gitea-repositories
+# adjust file permissions
+chown -R git:git /etc/gitea/app.ini /var/lib/gitea
+# Regenerate Git Hooks
+/usr/local/bin/gitea -c '/etc/gitea/app.ini' admin regenerate hooks
+```
--- a/docs/content/administration/backup-and-restore.zh-cn.md
+++ b/docs/content/administration/backup-and-restore.zh-cn.md
@@ -0,0 +1,68 @@
+---
+date: "2018-06-06T09:33:00+08:00"
+title: "备份与恢复"
+slug: "backup-and-restore"
+sidebar_position: 11
+toc: false
+draft: false
+aliases:
+  - /zh-cn/backup-and-restore
+menu:
+  sidebar:
+    parent: "administration"
+    name: "备份与恢复"
+    sidebar_position: 11
+    identifier: "backup-and-restore"
+---
+
+# 备份与恢复
+
+Gitea 已经实现了 `dump` 命令可以用来备份所有需要的文件到一个zip压缩文件。该压缩文件可以被用来进行数据恢复。
+
+## 备份命令 (`dump`)
+
+先转到git用户的权限: `su git`. 再Gitea目录运行 `./gitea dump`。一般会显示类似如下的输出：
+
+```
+2016/12/27 22:32:09 Creating tmp work dir: /tmp/gitea-dump-417443001
+2016/12/27 22:32:09 Dumping local repositories.../home/git/gitea-repositories
+2016/12/27 22:32:22 Dumping database...
+2016/12/27 22:32:22 Packing dump files...
+2016/12/27 22:32:34 Removing tmp work dir: /tmp/gitea-dump-417443001
+2016/12/27 22:32:34 Finish dumping in file gitea-dump-1482906742.zip
+```
+
+最后生成的 `gitea-dump-1482906742.zip` 文件将会包含如下内容：
+
+* `custom` - 所有保存在 `custom/` 目录下的配置和自定义的文件。
+* `data` - 数据目录下的所有内容不包含使用文件session的文件。该目录包含 `attachments`, `avatars`, `lfs`, `indexers`, 如果使用sqlite 还会包含 sqlite 数据库文件。
+* `gitea-db.sql` - 数据库dump出来的 SQL。
+* `gitea-repo.zip` - Git仓库压缩文件。
+* `log/` - Logs文件，如果用作迁移不是必须的。
+
+中间备份文件将会在临时目录进行创建，如果您要重新指定临时目录，可以用 `--tempdir` 参数，或者用 `TMPDIR` 环境变量。
+
+## Restore Command (`restore`)
+
+当前还没有恢复命令，恢复需要人工进行。主要是把文件和数据库进行恢复。
+
+例如：
+
+```sh
+unzip gitea-dump-1610949662.zip
+cd gitea-dump-1610949662
+mv data/conf/app.ini /etc/gitea/conf/app.ini
+mv data/* /var/lib/gitea/data/
+mv log/* /var/lib/gitea/log/
+mv repos/* /var/lib/gitea/repositories/
+chown -R gitea:gitea /etc/gitea/conf/app.ini /var/lib/gitea
+
+# mysql
+mysql --default-character-set=utf8mb4 -u$USER -p$PASS $DATABASE <gitea-db.sql
+# sqlite3
+sqlite3 $DATABASE_PATH <gitea-db.sql
+# postgres
+psql -U $USER -d $DATABASE < gitea-db.sql
+
+service gitea restart
+```
--- a/Show More
+++ b/Show More