Drop `*http.Request` from handlers that only needed it for the request
context or `URL.Query()`, and replace `params := c.Params()` indexing
with `c.Param(...)` lookups. Every handler in webapi_repo.go now takes
just `(c flamego.Context, user *database.User)`.
Apply review feedback on PR #8295. Flatten `repoHeaderCounts` into
`repoHeader` and rename fields to be more descriptive on the JSON wire
(`isViewerAdmin`, `issuesEnabled`, `pullRequestsEnabled`, `wikiEnabled`,
`watches`, `openPullRequests`, `isViewerWatching`, `hasViewerStarred`).
Apply the same naming to `repoActionResponse`. Rename `getRepoRaw` ->
`getRepoRawFile` with `{file}` param. Update the TS types and consumers
in `RepoHeader.tsx` to match.
Merge the author and parent/commit/buttons rows into a single
wrap-friendly flex line on desktop. Drop the committer line, since
showing it twice (author + committer) is rarely useful for the
common case where they match. Render each parent SHA as its own
clickable chip so multi-parent merge commits link to every parent.
Align View patch and Browse files to the left on mobile.
The commit diff page only ships the patch hunks, so unmodified context
between hunks is invisible. Add a per-file "Expand all lines" toggle so
the reader can pull in the full file when the surrounding code matters.
Backend:
- Migrate `repo.SingleDownload` to a new Flamego `getRepoRaw` handler.
Same URL shape (`/{owner}/{name}/raw/{ref}/{path}`) so external
consumers (`curl`, scripts) keep working. Bridged from the Macaron
router via `flamegoBridger` so the legacy path doesn't double-route
through `RepoRef` middleware. The ref segment accepts a branch, tag,
or commit SHA; commit SHAs match first (the common case from the
React diff page).
- Delete `repo.SingleDownload` and the legacy `m.Get("/raw/*", ...)`
Macaron handler. `repo.ServeBlob` stays because `internal/route/api/v1`
still uses it for the public REST API.
Frontend:
- Add an `UnfoldVertical` icon button to each file header. Click fetches
the pre + post file contents in parallel via the legacy raw URL,
calls `parseDiffFromFile` to upgrade the `FileDiffMetadata` to
`isPartial: false`, and stores the result keyed by item id.
- The `items` useMemo swaps in the upgraded `fileDiff` when present and
bumps the item `version` so Pierre's `CodeView` re-renders that file.
Set `expandUnchanged: true` globally so non-partial files immediately
render all context lines.
- Show a spinner during fetch, hide the button once expansion succeeds.
Skip the button for added/deleted files (no opposite side to expand).
- Added/deleted files preserve the old behaviour (no expansion).
Migrate the React commit diff page off of mocked repo metadata and onto
live web API endpoints, and take over the legacy `/owner/repo/commit/{sha}`
URL so the React page is the canonical commit view.
Backend:
- Split `webapi.go` into `webapi.go` (shared infra), `webapi_user.go`
(user handlers), and `webapi_repo.go` (repo handlers).
- Add `GET /api/web/{owner}/{name}/info` returning repo header data
(avatar, visibility, counts, mirror, viewer state). Mirrors legacy
`RepoAssignment` access logic: admin shortcut + partial-public masking.
- Add `GET /api/web/{owner}/{name}/commit/{sha}` returning commit
metadata only. Patch text lives on the existing `.diff` URL so it
avoids JSON-string escaping and caches independently.
- Migrate `repo.RawDiff` to Flamego `getRepoCommitRawDiff`. Now supports
`?whitespace=` for the React diff toggle. Public URL unchanged.
- Add `POST/DELETE /api/web/{owner}/{name}/watch` and `.../star` returning
the new viewer state + count so the client can update without refetch.
- Delete legacy `repo.Diff` and `repo.DiffJSON`. Add a SPA pass-through
Macaron route at `/owner/repo/commit/{sha}` with the legacy
`[a-f0-9]{7,40}` SHA regex.
Frontend:
- Install `@tanstack/react-query` and wire `QueryClientProvider` in
`router.tsx`. Pass `queryClient` through router context so loaders can
prefetch via `ensureQueryData`.
- Add `lib/queries/repo.ts` with `repoInfoQuery` + watch/star mutations.
- Move `CommitDiff.tsx` → `pages/repo/Commit.tsx` and `CommitDiff.search.ts`
→ `pages/repo/Commit.search.ts`. Rename `CommitDiff` → `RepoCommit`,
`CommitDiffPage` → `RepoCommitPage`, etc.
- Change route from `/$owner/$repo/_diff/$sha` to
`/$owner/$repo/commit/$sha`. Enforce SHA regex via TanStack `params.parse`
and convert API 404s to router `notFound()` so they render the NotFound
page instead of ServerError.
- Loader fetches metadata + raw diff in parallel (plus repo info via
Query cache), assembles them into `RepoCommitPage`.
- Replace `RepoHeader`'s `RepoHeaderRepo` interface with the live
`RepoInfo` type. Watch/Star buttons fire `useMutation` with optimistic
cache updates via `setQueryData`. Anonymous users see sign-in links.
- Swap the "Public"/"Private" pill for a Globe/Lock icon with tooltip.
- Add a collapsible desktop file tree. The toolbar's "Showing N changed
files" row owns a single toggle icon that opens the Sheet on mobile
and toggles the persistent sidebar on desktop. State persists to
localStorage.
- Hide the always-on "Verified" badge until commit signature
verification lands.
- DiffSearch: walk hunks by addition/deletionCount so matches on context
lines and pure-deletion hunks are no longer dropped.
- DiffSearch: nudge popup up to top-1 so it sits closer to the toolbar.
- RepoHeader: add per-repo avatar slot (mocked to favicon for now),
fold mobile tabs past the third into a hamburger overflow, swap
Issues icon from Clock to CircleDot, nudge avatar down 2px to
optically center the off-center favicon glyph.
- CommitDiff: render the authored timestamp as a relative string with
RFC1123 tooltip (matches Gogs's TimeSince template helper); helper
lives in web/src/lib/relative-time.ts.
- CommitDiff: inject GitHub-style yellow into Pierre's selected-line
background overrides so search matches read clearly in both themes.
- AGENTS.md: note that chrome-devtools MCP should run headless.
Adds the full commit diff experience around the @pierre/diffs CodeView
and @pierre/trees FileTree spike from the prior commit:
- RepoHeader, DiffToolbar, FileHeaderMenu, ResizableSidebar components
for the page chrome and per-file actions
- Sheet and Tooltip shadcn primitives
- CommitDiff.search.ts encodes diff toggles in the URL via TanStack
Router validation so the view is shareable
- Sticky workspace lock that pins the toolbar plus tree plus diff to
the viewport once the user scrolls past the commit metadata
- Whitespace mode wired through to git via the diff API's new
whitespace query (ignore-all, ignore-change)
- Per-file collapse, status filter, unified/split toggle, wrap, expand
all and collapse all
- New --color-success, --color-diff-added, --color-diff-removed
tokens documented in DESIGN.md, replacing ad-hoc Tailwind palette
references
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>
## Describe the pull request
A simple fix in public/js/gogs.js making bug upload not result in a
timeout (added just one line)
Link to the issue: closes https://github.com/gogs/gogs/issues/6149
## Test plan
- Set the max_size of `attachment` to a high number
```toml
[release.attachment]
ENABLED = true
ALLOWED_TYPES = */*
MAX_SIZE = 512
MAX_FILES = 20
```
- Upload a file to releases
It doesn't randomly timeout!
Related to #7864
## Describe the pull request
Fix the path of the s6-svscan binary path in the Dockerfile. As
mentionned in the issue, it is probably to the alpine base image change
(from `3.17` to `3.21`).
Link to the issue:
https://github.com/gogs/gogs/issues/7864#issuecomment-2558323928
Credit to @cryptovaltt
## Test plan
Build the image and check if the application can be ran. E.g.:
```bash
docker build -t gogs:working-7864 -f Dockerfile .
docker run --name=gogs -p 10022:22 -p 10880:3000 -v gogs:working-7864 --rm
```
This pull request targets issue #6573.
It provides a new API endpoint: `/api/v1/repos/{org}/{repo}/commits?pageSize=<int>` with a default page size of 30 commits (the same as the UI).
This implementation currently only focuses on the main/master branch of the repository, and does not provide the ability to return commit history for other branches.
- Note: Since the logic for converting a git.Commit to api.Commit had to be used in `GetAllCommits` and `GetSingleCommit`, I decided to pull the code out into a helper function, ` gitCommitToAPICommit(commit, context)`.
innodb_file_format and innodb_large_prefix have been deprecated with MariaDB v10.2 and removed with v10.3.1. They have been reintroduced with v10.4.3 but remain deprecated and unused:
- https://mariadb.com/kb/en/innodb-system-variables/#innodb_file_format
- https://mariadb.com/kb/en/innodb-system-variables/#innodb_large_prefix
Setting those variables on MariaDB >=10.3.1 leads to the following error:
"ERROR 1238 (HY000) at line 7: Variable 'innodb_file_format' is a read only variable"
Since semantic versioning patch versions cannot be compared via numeric operators, only the major + minor versions are compared against 10.3. Since v10.2.2 the defaults match the desired values, so there is only the single patch version 10.3.0 where, when explicitly set differently via MariaDB configs, this commit could lead to an unwanted database format. In favour of a simple SQL change, this case is ignored.
This commit additionally removes trailing spaces and the doubled trailing empty line.
Signed-off-by: MichaIng <micha@dietpi.com>
As Golang supports getting usernames via the standard library, this function
is now used to get the username if the environment variables are empty.
Using the standard library as a fallback is intended to keep compability
to existing implementations that rely on the environment variables dictating
the current username.
* Add new methods
* Use Users.Create to replace previous hack
* Reduce side effect
* Do not clear tables when test failed
* test_users_Authenticate
* Rename constant
* test_users_Create
* test_users_GetByEmail
* test_users_GetByID
* test_users_GetByUsername
This means that when using the API to create a new team, the output
contains the existing team ID, not just the name.
While there may be the thought that this reveals sensitive
information, it is never the case that a user can create or update
a team without permission to view the teams in the first place.
* Add unit test for `authenticate` middleware
* Add more cases
* Add tests for verifyOID and internalServerError
* Add tests for verifyHeader
* Add tests for authroize
Not all routes need session, register session and CSRF middleware as global is a waste of resource, and creating a lot one-time off yet never used session records.
This PR groups the contents api endpoint with both `""` and `/*` as
valid URL patterns.
When `""` is the URL pattern, this means that no repo path has'nt been
provided, in which case the path would be the default repo path.
When `"/*"` is the URL pattern, then this would return the contents at
the specified path if it's valid.
Github API v3 is conformant to this behavior and have verified it
locally.
* conf: add tests for utils.go
* conf: add tests for static.go
* mock os/exec
* Run tests on Windows
* appveyor: fix gcc not found
* computed: add unit tests
* log: add unit tests
* log: fix tests on Windows
* conf: add some tests
* Finish adding tests
* Cover more cases
* Add tests for testutil
* Add more tests
* add basic git repository tree api (#5934)
This PR adds the tree api endpoint to gogs api:
`GET/repos/:owner/:repo/git/trees/:tree_sha`
This new api endpoint that is being added is in conformance to
the GitHub REST API v3 specification. Documentation can be found
here: developer.github.com/v3/git/trees/#get-a-tree
For a given user, repo and sha value, this api (currently) returns
a single tree using the SHA1 value for that tree.
- Recursive implementation is yet to be implemented.
- Creating a Tree using POST is yet to be implemented.
Example curl:
```
l curl -H "Authorization: token REDACTED" http://localhost:3000/api/v1/repos/root/testrepo/git/trees/c59441ded1549b149def0d4c54594d31a7f3718f -X GET | jq .
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 940 100 940 0 0 12034 0 --:--:-- --:--:-- --:--:-- 12051
[
{
"sha": "c59441ded1549b149def0d4c54594d31a7f3718f",
"tree": [
{
"mode": "120000",
"path": "/home/bharatnc/gogs-repositories/root/testrepo.git",
"sha": "472ac2361b65136b393d652de25341e2ea44f299",
"size": 1077,
"type": "blob",
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/472ac2361b65136b393d652de25341e2ea44f299"
},
{
"mode": "120000",
"path": "/home/bharatnc/gogs-repositories/root/testrepo.git",
"sha": "70fcb456d436f08462602f26df6fb7e167e7a916",
"size": 12,
"type": "blob",
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/70fcb456d436f08462602f26df6fb7e167e7a916"
},
{
"mode": "120000",
"path": "/home/bharatnc/gogs-repositories/root/testrepo.git",
"sha": "092c58d4b63df5779a4d020b1fdbb762421bbb4f",
"size": 380,
"type": "blob",
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/092c58d4b63df5779a4d020b1fdbb762421bbb4f"
}
],
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/c59441ded1549b149def0d4c54594d31a7f3718f"
}
]
```
* remove vertical space
* make go.mod to be same as in master
* rename structs to sound better
* simplify expressions and fix error msg
* Update tree.go
* Update tree.go
* display file name instead of repo path
* Update tree.go
Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>
* fixed private repositories are hidden in the organization's view
* use go-bindata integrate public and templates files to gogs binary
* optimize Dockerfile don't COPY public and templates files
* use kevinburke's go-bindata to generate assets code
* reset develepment as default run mode in configure file
* optimize generated assets code relayout and help function
* fixed code format
* Update conf/app.ini
* assets: add LICENSE headers
* Some housekeeping
* assets/public: simplify code logic
* assets/templates: simplify code logic
* cmd/web: more concise variable names
* Minor changes
* Add custom public and templates support back
Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>
* able fill pull request title by template from md file
* fix: unusedresult: result of fmt.Sprintf call not used (from govet)
* fix: remove import fmt -> not used
* after review / PullRequestTitleTemplateCandidates moved to after line 39
* Update pull.go
* Update pull.go
Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>
When running gogs after the first time, if the image has changed (update
rebuild), the /app/gogs directory will have changed owner back to
root:root, but /data will likely not be since the data directories are
likely to be persistent.
Checking /app/gogs separately fixes this.
* updated the highlight.js plugin
* added some explicit mappings for syntax highlighting
* public: makes CodeMirror mode by filename extension lookup case-insensitive
* Protect local repo copy deletion with repoWorkingPool, and delete the local
copy on owner name change.
* Update internal/db/user.go
Co-Authored-By: Unknwon <u@gogs.io>
* Error format on local repo and wiki deletion
* api/v1: don't allow multiple tokens with same name
Fail with 422 Unprocessable Entity if the token name
already exist
ref: https://github.com/gogs/gogs/issues/5587
* Move new token error type to models/errors/token
* Remove "useless" ListAccessTokensByName function
* Add an i18n entry for token_name_exists
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
Added wait for SQL as it may take more time to start up on a router: make sure you configure this before using.
Proper Start/Stop/Reset is now implemented.
* Add rsync to docker.
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* Add rsync to docker
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* Add rsync to docker
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* Add rsync to docker
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* pkg/context: Render live notice banner from file
- Contexter checks if there is a file called 'notice' under the
GOGS_CUSTOM directory and loads it.
- The first line is treated as a header/title and everything else as the
message body.
- Message body is rendered as HTML (tags allowed).
- File size is limited to 1024 bytes.
- File mime type must be text.
- Notice is rendered in head.tmpl for all pages.
* pkg/context: Rename maxlen to maxSize
Rename maxlen to maxSize for the maximum size (in bytes) of the notice
file to render.
Define the variable when needed to avoid instantiating it when the file
doesn't exist.
Co-Authored-By: ᴊ. ᴄʜᴇɴ <u@gogs.io>
* pkg/context: Package name after license header
Co-Authored-By: ᴊ. ᴄʜᴇɴ <u@gogs.io>
* pkg/context: Don't print 'Found notice file'
Becomes too verbose as it prints on every page load when the file
exists.
* pkg/context: Match project conventions
Import order and grouping
Variable names:
fileloc -> fpath
fp -> f
finfo -> fi
* pkg/context: Remove empty line
Co-Authored-By: ᴊ. ᴄʜᴇɴ <u@gogs.io>
* pkg/context: Render notice as markdown
Server notice file should be named 'notice.md'. The contents of the
file are treated as markdown and rendered as a warning message at the
top of every page.
* Update notice.go
Co-authored-by: ᴊ. ᴄʜᴇɴ <u@gogs.io>
The chown command in the setup file of Gogs is supposed to be executed just once. As soon as the app.ini file exists, this step should be skipped. However, the test was checking if a directory with the name app.ini exists instead of a file. Therefore, the chown command was executed on each boot.
* Added option to use plain text alt to HTML emails. Should make the messages friendlier for spam filters.
* Check that plaintext conversion worked before adding the HTML alt
* Add description of ADD_PLAIN_TEXT_ALT to app.ini
* Added comment clarifying html AddAlternative
At some point after #4970 was merged, isomorphic-git started sending a custom User-Agent in its HTTP requests to deal with some services (\*cough\* gists \*cough\*) which filtered git traffic by User-Agent. Sadly, this broke cloning from Gogs using isomorphic-git in the browser (https://github.com/isomorphic-git/isomorphic-git/issues/555). This PR fixes it by telling browsers it is OK for CORS requests to send a custom User-Agent header.
* Add default Authentication Switch.
* adjust the code accroding to reviews
* #1. Remove redudant logic.
#2, Fix a bug in "Edit" panel.
* Remove unused logic
* Fix local authentication files are not flushed.
* refactor according to review.
* add new Dockerfile.docker-ce for docker-ce(>=v17.06) to build docker image
* change default Dockerfile to support docker-ce(>=v17.06) multi-stage build
Spring cloud config server dependency spring cloud config monitor looks for X-Github-Event condition PropertyPathEndpoint.class -> GithubPropertyPathNotificationExtractor.class if ("push".equals(headers.getFirst("X-Github-Event"))) {...}
* pull request merges now allow for custom commit messages
* allow i18n on commit_message label
* place label above textarea for commit message
* rename commit message for pull requests into commit description and pass to git separately
* First code for repository avatars
* Last code for repository avatars
- add new option for repo avatars location on filesystem
- add route catch in web
- add new fields to repo model
- add migration
- update settings handlers
- update repo header template
* Update locale messages
* Add repo avatars to home page
* Add repo avatars to organization right panel
* Show repo avatars in repo list
* Remove AvatarEamil field, remove Gravatar support, use generic locale messages
* Fix migration
* Fix seed and not used tool
* Revert public css changes, add them to less files
* Latest lessc (2.6.0) don't put result into file but output to stdout
So redirect output to file
* Simplify things:
- migration don't needed, and table changes too
- just upload file to repo avatar storage
- or generate random image
* Fix repo image seed - name not unique
* Get rid of not needed model fields
* Class value is enough, remove height attribute
* Don't generate random avatar for repository
- use html and semantic ui icons if no avatar found
* Update styles and templates for repo
- use repo icon as default avatar
- use globe icon for public repos
- add micro style for repo avatars at dashboard
* Remvoe redundant empty line
* Fix nl2br filter - must return string
* Fix css style for micro-repo-avatar in dashboard list
* Remove `|len`, works fine w/o it.
* Update after review 2:
- use static route for repository avatar
- format images settings block in settings
* Update after review 2:
- no random avatar for repo
* Update after review 2:
- no random avatar for repo 2
- update imports
- update UploadAvatar* functions
* Update after review 2:
- update templates
* Fix trace call
* Remove unused immport since we use static route for repo avatars.
* Update repository description field to contain more than 256 symbols
- update repository model - description field now is `TEXT` and limited by 4000 symbols
- new migration
- add description to html forms - repo creation and repo settings
- add translation for description
* Update for description field, new features
- add autosize (height) for description textarea, new plugin
- set max description length to 512 symbols
- update locales
* Fix migration - typo in var
* Update repo description behaviour
- add textarea autosize for /repo/create
- add symbols counter under description testarea (create/edit)
* Fix function definition - it a var
* Revert ru-RU locale
* Update by review
- Use type `varchar(512)` in migration
- Remove unused files from autosize plugin
* Fix migration - new project paths
* Fixes after review 2
- copyright year
- format includes
- use switch instead of multi-if
* Remove unused `default:` option.
* Added deletion of an empty line at the end of file (#5261)
Signed-off-by: Alexey Terentyev <axifnx@gmail.com>
* Fix after feedback
Signed-off-by: Alexey Terentyev <axifnx@gmail.com>
* fixed make build failure when enviroment of GOPATH have Multiple items
gogs source in /other/path/to/go/src/github.com/gogs/gogs and then
>cd /other/path/go/go/src/github.com/gogs/gogs
>GOPATH=/path/to/go:/other/path/to/go make
will also build success in this fixed code
* in makefile rename gogits to gogs
* Add markdown renderer function to templates, use it for description in repo template
* Fix function call
* Define function Md2html in template namespace
* Change filter from Md2html to nl2br
* Change filter name to NewLine2br as suggested
* Update description output:
- just replace `\n` by `<br>`
- sanitize html after replace
If the user provides a string that does not contain "%s", fmt.Sprintf
silently appends "%!(EXTRA type=value)" instead of failing loudly.
This fixes#4375.
It's a fun feature but `ENABLE_FEDERATED_AVATAR` being true by default
leads to confusion and huge slowdowns (see #2838, #980, #914) --- it's
unexpected that Gogs requires DNS configured (?) for avatars.
Avatar lookup is a niche feature that I don't believe should be enabled
by default given how prone it is to causing problems.
Sets BaseRepo value for each resulting fork in GetForks().
Finds correct permissions for parent repository in APIFormat().
The output JSON is a little redundant, perhaps we should offer a
different view of the api.Repository without the Parent attribute?
Signed-off-by: Dennis Chen <barracks510@gmail.com>
* Enable Automated builds for aarch64
* Native aarch64 build
* Move to the new organization
* Try to build it with latest go binary
* Rebuild using Go 1.10
* Disallow web ui to delete protected branch
* Fix for branches not yet protected
Had to change how error was handled. If a branch had not yet been protected the error would be generated.
Reworked to start as false and then use the protected if it was found.
* add issue labels
* remove hyperlink from issue label
* wrap labels in right aligned span
* put issues with div
put the issue labels within a div so they don't interfere with the number of comments
- The `commits_table.tmpl` pagination uses a `$.FileName` variable in
order to generate the next/previous URLs, but it seems like that
variable was no longer being populated in `renderCommits`.
If a branch was deleted from server, sometimes it is not reflected
on local copy. Therefore, we need to remove the branch with same
name if it is out of sync and then checkout to correct version.
For DVCS, either merge or rebase works for getting new code in a pull
request in the main branch.
The rebase workflow produces a linear history which is cleaner, and
more bisect-able.
This commit adds a repo-level option to enable the rebase workflow. Once
enabled, "Merge Pull Request" will be replaced by
"Rebase and Merge Pull Request" which does exactly what the user wants.
It's unlikely a project wants a mixed-use of both rebase and merge
workflows, therefore the feature is not implemented as a drop-down
button like what GitHub does
(https://github.com/blog/2243-rebase-and-merge-pull-requests).
* Add API endpoint /api/v1/user/orgs
The difference between this endpoint and
/api/v1/admin/users/<username>/orgs,
is that here you're creating a repo with the `user`
that corresponds to the API token you're using.
* Extract duplicate API org creation
* Enable Automated builds for rpi
* Rename the file to fit only for Docker Hub
* Update the binary to v2.9.0+resin1
* Restore default status
* Commit as new file
In order to avoid breaking native builds
Ensure that the IN clause contains one value at least. The idea is avoid a
syntax error in the SQL sentence and rollbacks in the transactions.
For example:
ERROR: syntax error at or near ")"
LINE 1: ...RE ... and team.id IN ();
We will always add the -1 value in the IN list.
* don't load key when key size should not be checked
This makes it possible for users with incompatible ssh-keygen versions
to just disable the check completely without running into errors.
* add proper ed25519 constant
The x/crypto/ssh library has support for ed25519 now, so it is possible
to support it.
App would panic if user has validation error on installation and
the sanitizer is not yet built. Therefore we need a minimal valid
object for sanitizer at start.
Special characters such as '@', ';', '#' and ':' could occur in
password portion of credentials, which breaks the interpretation
and saves 'config' file in with extra characters that are not
recognized by Git (due to INI library).
When Git client has cached credentials for a site, missing response
header 'WWW-Authenticate: Basic realm="."' will result in Git client
does not prompt user to input credentials again but plain error
message and halts push/pull process.
Only expose public APIs for 'Sanitize' and 'SanitizeBytes' to
eliminate unintentional modifications to sanitizer policy. Also
use 'sync.Once' to make sure multiple calls of 'NewSanitizer' is
safe (although should never happen, but this is a better way).
To further support more markup languages (e.g. Org-mode, AsciiDoc,
reStructuredText), the name 'markdown' is inappropriate.
This is the first step towards more markup language support.
If user creates a protect branch for the first time (which has ID=0),
it generates invalid whitelist records with 'protect_branch_id=0'.
This prevents future updates of protect branch whitelist.
Migration: remove existing invalid protect branch whitelist records.
* models/repo.go SearchRepositoryByName()
Updated function to return public and private repositories that the logged in user has been given rights to view
issue #3088
* models/repo.go SearchRepositoryName
changed repository table alias to 'repo'
removed debug line
* models/repo.go SearchRepositoryByName
modified UserID search query to use the "access" table instead of team_repo, team_user etc
* models/repo.go SearchRepositoryByName
1) uppercased SQL keywords
2) removed alias for ACCESS table
Move 'Commits' and 'Releases' tabs down to body.
This patch also reduces page load time for pages that do not need
to use commits count anywhere. Get commits count can hurt
performance badly for huge repositories that has tens of thousands
commits like Linux Kernel.
Previously, we load all releases of a repository which could hurt
performance when the repository has a lot of releases.
Now we're able to only load releases in current page view we need
to show by matching with 'tag_name'.
Previously, if the user base directory somehow doesn't exist, the
application throws 500 for failure of rename.
Now it detects if the application should rename or just create a
new directory.
Sometimes user could simply request wrong URL, but if that wrong URL
has nothing related Git HTTP operations, HTTP Basic Authentication
should not prompted. Instead, clean 404 page should be presented.
The patch also supports Git HTTP operations without '.git' suffix
to the repository name, which addresses #4226 and #4189.
This also addresses #4231. It is now ignoring nonexistent
organizations returned from 'org_user' table.
This was a bug caused in older version that didn't cleanup
'org_user' table when delete an organization.
Was only possible to correctly redirect to pull request page within
same repository. And didn't take care of case when upstream has
disabled pull request.
Also add a new method 'PullRequestURL' to unify the code.
- Add Ukrainian translation into templates/home.tmpl
- Fix Ukrainian language name in conf/app.ini
because on Ukrainian 'language' is female.
- Add me as translator into conf/locale/TRANSLATORS
1. Fix sample content didn't show up when hook doesn't exist.
2. Fix CSS 'word-break' to use 'break-word' not 'break-all'.
3. Fix single quote in 'locale_en-US.ini' file.
Usage: <url>?page={page}&pageSize={pageSize}
Also avoid/removed getting total commits count for pagination,
users are only allowed navigation by 'newer' and 'older'.
We used to handle SSH and HTTP push separately which produces
duplicated code, but now with post-receive hook, the process
is unified to one single place and much cleaner.
Thus, UpdateTask struct is removed.
Narrow down the range of Git HTTP routes to reduce condufsing
HTTP Basic Authentication window popup on browser.
By detecting <old-commit, new-commit, ref-name> inside post-receive
hook, Git HTTP doesn't need to read the whole content body anymore,
which completely solve the RAM problem reported in #636.
Code only fetched issues corresponding to the pull requests, and left
out necessary base/head repository objects, which is required later
to generate API format.
Due to recent code refactor, ctx.PullRequest is not initialized for
route repo.CompareAndPullRequest, which leads the UI thinks the
compare is not happening inside the same repository.
The current fix is to allow compare URL to include redundant head
user name so everything works fine again, but code logic isn't
as clean as before.
Made comments about possible future fix.
* Check deploy keys when Gogs is run with require_sign_in_view
Check if the deploy key can access to a repository. A deploy key
doesn't represent an gogs user, so in a site with Service.RequireSignInView
activated we should give read access only in the repositories where
this deploy key is in use. In other case, a deploy service or system
using an active deploy key can get read access to all the repositories
in a Gogs service.
* Refactoring: Comments starts in a new line
* Minor change in a comment
* Code cleaning. Replace spaces with tabs
* Implement organizations listing in setting and allow user to create new organization.
* Implement organizations listing in setting and allow user to create new organization.
* Add space remove by mistake
* Remove unused part of the template
* Update display and behavior according to @Unknown remarks
Site admin now has to enable manually by config option
[repository] ENABLE_LOCAL_PATH_MIGRATION = true.
Site admin always grants this permission, but regulars users have
to be allowed by site admins in admin user panel.
* Fix assigned/created issues in dashboard.
* Use GetUserIssueStats for getting all Dashboard stats.
* Use gofmt to format the file properly.
* Replace &Issue{} with new(Issue).
* Check if user has access to given repository.
* Remove unnecessary filtering of issues.
* Return 404 error if invalid repository is given.
* Use correct number of issues in paginater.
* Use temporary file to avoid out-of-memory when receiving big chunk.
Not perfect but I think it's a reasonable solution.
For small request bodies, I suppose performance wouldn't be an issue.
For large ones, this seems to be a necessary evil.
* Must close the open file to avoid fd leaks
Closes#3696, #3611
Previously, ProdMode can only be true for web server,
which always prints dev mode log message to incoming SSH
connections and leaks unexpected information.
* #3480 Fix new ssh key adding issues
Added regular exp match (108) and remove training new line (111) that cause system to think its an ssh2 key.
* #3480 Fix new ssh key adding issues
-Sanitizate new lines (windows format) in posted key
-Edit sanitization implementation to use string replace for code readability and maintenability.
* UpdateIssueUsersByMentions was calling database write operations while
a transaction session was in progress. MailParticipants was failing
silently because of the SQLITE_LOCKED error. Make sure failures in
MailParticipants enter the log, and pass on the transaction context.
issue: let caller pass in database context, and use it
issue_comment: obtain database context to pass to UpdateIssueMentions
issue_comment: log any error from call to MailParticipants
issue_mail: pass on database context to UpdateIssueMentions
* issue: forgot debug statement
* Remove unused custom-alphabet feature of random string generator
* Fix modulo-biased random string generator
* Random string generator should return error if it fails to read random data via crypto/rand
* Can use a predefined set of labels
* Change UI
* Fix HTML file indentation
* Avoid reading file from other directory (security issue)
* Apply a better fix
* Remove not used variable
* Merge upstream/develop
* Do modifications
* Raname
* remove binding + rename variable
* Implement wiki mirroring, add Update mirrors operation to admin dashboard
* bindata.go update after merge
* Implement checking Git repo endpoint existence, support for BB included
* Remove admin dashboard operation
Fix bindata.go
* Apply gofmt to repo model file
* Try to remove bindata from PR
* Revert accepted wiki names change in favor of better system
* Remove unused imports
This is an attempt to fix#3089 following the strategy introduced
in d625e41c6c, although that strategy
by itself does not seem to be sufficient.
What needs be done is honouring the redirect_url query parameter
from the auth router.
* Do not show the "Sign up for free" button in issue tracker
The "Sign in to comment" link is good enough and will correctly
show or not show the "Sign Up" button link for those not having
an account already.
Fixes#3407 (link to nowhere when registration is disabled)
* Move html from translation to template
* Remove extra space in `{{ .SignInLink }}`.
* add git-daemon-export-ok "support"
* Slight fix to git-daemon-export-ok
* Add error-checking for git-demon-export-ok
* Remove old comments and fixed logging-issues
* Check if git-daemon-export-ok exists or not
* Add support for federated avatars
Fixes#3105
Removes avatar fetching duplication code
Adds an "Enable Federated Avatar" checkbox in user settings
(defaults to unchecked)
Moves avatar settings all in the same form, making
local and remote avatars mutually exclusive
Renames UploadAvatarForm to AvatarForm
as it's not anymore only for uploading
* Run gofmt on all modified files
* Move Avatar form in its own page
* Add go-libravatar dependency to vendor/ dir
Hopefully helps with accepting the contribution.
See also #3214
* Revert "Add go-libravatar dependency to vendor/ dir"
This reverts commit a8cb93ae640bbb90f7d25012fc257bda9fae9b82.
* Make federated avatar setting a global configuration
Removes the per-user setting
* Move avatar handling back to base tool, disable federated avatar in offline mode
* Format, handle error
* Properly set fallback host
* Use unsupported github.com mirror for importing go-libravatar
* Remove comment showing life exists outside of github.com
... pity, but contribution would not be accepted otherwise
* Use Combo for Get and Post methods over /avatar
* FEDERATED_AVATAR -> ENABLE_FEDERATED_AVATAR
* Fix persistance of federated avatar lookup checkbox at install time
* Federated Avatars -> Enable Federated Avatars
* Use len(string) == 0 instead of string == ""
* Move import line where it belong
See
https://github.com/Unknwon/go-code-convention/blob/master/en-US/import_packages.md
Pity the import url is still the unofficial one, but oh well...
* Save a line (and waste much more expensive time)
* Remove redundant parens
* Remove an empty line
* Remove empty lines
* Reorder lines to make diff smaller
* Remove another newline
Unknwon review got me start a fight against newlines
* Move DISABLE_GRAVATAR and ENABLE_FEDERATED_AVATAR after OFFLINE_MODE
On re-reading the diff I figured what Unknwon meant here:
https://github.com/gogits/gogs/pull/3320/files#r73741106
* Remove newlines that weren't there before my intervention
- Try to reduce memory allocations
- Add possibility to disable diff highlight (can improve performance for large diffs)
- Tweaking with cost for prettier (cleaner) diffs
- Do not calculate diff when the number of removed lines in a block is not equal to the number of added lines (this usually resulted in ugly diffs)
* Fix#3315: Release dont use tag creation date
* Simplify code and apply gofmt
* remove useless block (ctx.Repo.GitRepo.GetTag) on EditReleasePost
* apply gofmt on modified files
* Add API support for labels.
* Error handling for adding/replacing multiple issue labels
* Revisions to function names and error handling. Use issue.ClearLabels in replace/clear functions
* Additional code cleanup
* Add support for .diff and .patch
Add the ability to get text-diff and format-patch by adding .diff or
.patch in the end of a commit url. Issue #2641
* models: git_diff: various fixes
* Renames commitId to commitID.
* Writes stderr to a bytes.Buffer and displays proper error message on
command failure.
* Various style changes.
Signed-off-by: Dennis Chen <barracks510@gmail.com>
If anonymous (not signed in user) requests page
"/:owner/:repo/pulls" he gets an error:
template: repo/issue/list:11:105: executing "repo/issue/list" at <.PullRequestCtx.Base...>: nil pointer evaluating *models.Repository.Link
This commit fixes that.
Signed-off-by: Dmitry Yu Okunev <dyokunev@ut.mephi.ru>
Since the release struct is initialized with the current `HEAD` of the
current `release.Target` the commit id has to be updated if the tag
commit already exists. Otherwise the linked commit on the release page
will target the current `HEAD` at release time.
When calculating the current behind commit count the calculation should
use the current release target to get the total commit count. Should the
release target not exist anymore the calculation will return zero for
the newest release on that target. Older releases on that target will then
use that calculated commit count as reference.
The only use case that is now somehow invalid is when the release target
was merged / deleted after a tag on that release target:
master 1 - - - - - - - 6
\ /
branch 2 - 3 - 4 - 5
When `4` is the last tag on branch `branch` and the branch `branch` is not
yet deleted the calculated numbers would be:
1 commits to branch since this release
Now if the branch `branch` gets deleted the calculation function will not
find the branch and use the commit count of the newest release (`4`) as
reference resulting in:
0 commit to branch since this release
This fixes#3326
Analyze and help fix the GitHub Security Advisory (GHSA) at: $ARGUMENTS
Steps:
1. Fetch the GHSA page using `gh api repos/gogs/gogs/security-advisories` and understand the vulnerability details (description, severity, affected versions, CWE).
2. Verify the reported vulnerability actually exists, and why.
3. Identify the affected code in this repository.
4. Propose a fix with a clear explanation of the root cause and how the fix addresses it. Check for prior art in the codebase to stay consistent with existing patterns.
5. Implement the fix. Only add tests when there is something meaningful to test at our layer.
6. Run all the usual build and test commands.
7. If a changelog entry is warranted (user will specify), add it to CHANGELOG.md with a placeholder for the PR link.
8. Create a branch named after the GHSA ID, commit, and push.
9. Create a pull request with a proper title and description, do not reveal too much detail and link the GHSA.
10. If a changelog entry was added, update it with the PR link, then commit and push again.
> This guidelines sheet is forked from [CONTRIBUTING.md](https://github.com/drone/drone/blob/8d9c7cee56d6c2eac81dc156ce27be6716d97e68/CONTRIBUTING.md).
Thank you for investing your time in contributing to our projects!
Gogs is not perfect, and it has bugs or incomplete features in rare cases. You're welcome to tell us, or to contribute some code. This document describes details about how can you contribute to Gogs project.
Read our [Code of Conduct](https://go.dev/conduct) to keep our community approachable and respectable.
## Contribution guidelines
In this guide you will get an overview of the contribution workflow from opening an issue, creating a PR, reviewing, and merging the PR.
Depends on the situation, you will:
Use the table of contents icon <img src="https://github.com/github/docs/raw/50561895328b8f369694973252127b7d93899d83/assets/images/table-of-contents.png" width="25" height="25" /> on the top left corner of this document to get to a specific section of this guide quickly.
- Find a bug and create an issue
- Need more functionality and make a feature request
- Want to contribute code and open a pull request
- Run into issue and need help
## New contributor guide
### Bug Report
To get an overview of the project, read the [README](/README.md). Here are some resources to help you get started with open source contributions:
If you find something you consider a bug, please create a issue on [GitHub](https://github.com/gogits/gogs/issues). To avoid wasting time and reduce back-and-forth communication with team members, please include at least the following information in a form comfortable for you:
- [Finding ways to contribute to open source on GitHub](https://docs.github.com/en/get-started/exploring-projects-on-github/finding-ways-to-contribute-to-open-source-on-github)
- [Set up Git](https://docs.github.com/en/get-started/quickstart/set-up-git)
- [Collaborating with pull requests](https://docs.github.com/en/github/collaborating-with-pull-requests)
- [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
- [Talk, then code](https://www.craft.do/s/kyHVs6OoE4Dj5V)
- Bug Description
- Gogs Version
- Git Version
- System Type
- Error Log
- Other information
In addition to the general guides with open source contributions, you would also need to:
Please take a moment to check that an issue on [GitHub](https://github.com/gogits/gogs/issues) doesn't already exist documenting your bug report or improvement proposal. If it does, it never hurts to add a quick "+1" or "I have this problem too". This will help prioritize the most common problems and requests.
- Have basic knowledge about web applications development, database management systems and programming in [Go](https://go.dev/).
- Have a working local development setup with a reasonable good IDE or editor like [Visual Studio Code](https://code.visualstudio.com/docs/languages/go), [GoLand](https://www.jetbrains.com/go/) or [Vim](https://github.com/fatih/vim-go).
- [Set up your development environment](/docs/dev/local_development.md).
#### Bug Report Example
## Issues
Gogs crashed when creating a repository with a license, using v0.5.13.0207, SQLite3, Git 1.9.0, Ubuntu 12.04.
### Ask for help
Error log:
Before opening an issue, please make sure the problem you're encountering isn't already addressed on the [Troubleshooting](https://gogs.io/asking/troubleshooting) and [FAQs](https://gogs.io/asking/faq) pages.
```
2014/09/01 07:21:49 [E] nil pointer
```
### Create a new issue
### Feature Request
- For questions, ask in [Discussions](https://github.com/gogs/gogs/discussions).
- [Check to make sure](https://docs.github.com/en/github/searching-for-information-on-github/searching-on-github/searching-issues-and-pull-requests#search-by-the-title-body-or-comments) someone hasn't already opened a similar [issue](https://github.com/gogs/gogs/issues).
- If a similar issue doesn't exist, open a new issue using a relevant [issue form](https://github.com/gogs/gogs/issues/new/choose).
- Blank issues that are not coming from maintainers will be closed without a response.
There is no standard form of making a feature request. Just try to describe the feature as clearly as possible, because team members may not have experience with the functionality you're talking about.
### Pick up an issue to solve
### Pull Request
- Scan through our [existing issues](https://github.com/gogs/gogs/issues) to find one that interests you.
- The [👋 good first issue](https://github.com/gogs/gogs/issues?q=is%3Aissue+is%3Aopen+label%3A%22%F0%9F%91%8B+good+first+issue%22) is a good place to start exploring issues that are well-groomed for newcomers.
- Do not hesitate to ask for more details or clarifying questions on the issue!
- Communicate on the issue you are intended to pick up _before_ starting working on it.
- Every issue that gets picked up will have an expected timeline for the implementation, the issue may be reassigned after the expected timeline. Please be responsible and proactive on the communication 🙇♂️
Please read detailed information on [Wiki](https://github.com/gogits/gogs/wiki/Contributing-Code).
## Add new features or make big changes
### Ask For Help
New features or big changes require proposals before we may be able to accept any contribution. Proposals should be posted to the [Discussions - Proposal](https://github.com/gogs/gogs/discussions/categories/proposal) category for review and discussions. GitHub Discussions provides sub-threading which is much more suitable than GitHub Issues for discussions to happen. Please read [Write a proposal for open source contributions](https://unknwon.io/posts/220210-write-a-proposal-for-open-source-contributions/) to begin with.
Before opening an issue, please make sure your problem isn't already addressed on the [Troubleshooting](http://gogs.io/docs/intro/troubleshooting.html) and [FAQs](http://gogs.io/docs/intro/faqs.html) pages.
## Pull requests
## Code of conduct
When you're finished with the changes, create a pull request, or a series of pull requests if necessary.
As contributors and maintainers of this project, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities.
Contributing to another codebase is not as simple as code changes, it is also about contributing influence to the design. Therefore, we kindly ask you that:
We are committed to making participation in this project a harassment-free experience for everyone, regardless of level of experience, gender, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, age, or religion.
- Please acknowledge that no pull request is guaranteed to be merged.
- Please always do a self-review before requesting reviews from others.
- Please expect code review to be strict and may have multiple rounds.
- Please make self-contained incremental changes, pull requests with huge diff may be rejected for review.
- Please use English in code comments and docstring.
- Please do not force push unless absolutely necessary. Force pushes make review much harder in multiple rounds, and we use [Squash and merge](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/about-pull-request-merges#squash-and-merge-your-pull-request-commits) so you don't need to worry about messy commits and just focus on the changes.
Examples of unacceptable behavior by participants include the use of sexual language or imagery, derogatory comments or personal attacks, trolling, public or private harassment, insults, or other unprofessional conduct.
### Things we do not accept
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct. Project maintainers who do not follow the Code of Conduct may be removed from the project team.
1. Updates to locale files (`conf/locale_xx-XX.ini`) other than the `conf/locale_en-US.ini`. Please read the [guide for localizing Gogs](https://gogs.io/advancing/localization).
1. Docker compose files.
Instances of abusive, harassing, or otherwise unacceptable behavior can be reported by emailing u@gogs.io
### Coding guidelines
This Code of Conduct is adapted from the [Contributor Covenant](http:contributor-covenant.org), version 1.0.0, available at [http://contributor-covenant.org/version/1/0/0/](http://contributor-covenant.org/version/1/0/0/)
1. Please read the Sourcegraph's [Go style guide](https://github.com/sourcegraph/sourcegraph-public-snapshot/blob/main/doc/dev/background-information/languages/go.md).
## Your PR is merged!
Congratulations 🎉🎉 Thanks again for taking the effort to have this journey with us 🌟
_This is generated from the [minor release template](https://github.com/gogs/gogs/blob/main/.github/ISSUE_TEMPLATE/dev_release_minor_version.md)._
## Before release
On the `main` branch:
- [ ] Close stale issues with the label [status: needs feedback](https://github.com/gogs/gogs/issues?q=is%3Aissue+is%3Aopen+label%3A%22status%3A+needs+feedback%22).
- [ ] [Sync locales from Crowdin](https://github.com/gogs/gogs/blob/main/docs/dev/import_locale.md).
- [ ] [Update CHANGELOG](https://github.com/gogs/gogs/commit/f1102a7a7c545ec221d2906f02fa19170d96f96d) to include entries for the current minor release.
- Do not forget adding entries for GHSA patches.
- [ ] Cut a new release branch `release/<MAJOR>.<MINOR>`, e.g. `release/0.14`.
## During release
On the release branch:
- [ ] [Update the hard-coded version](https://github.com/gogs/gogs/commit/f0e3cd90f8d7695960eeef2e4e54b2e717302f6c) to the current release, e.g. `0.14.0+dev` -> `0.14.0`.
- [ ] Wait for GitHub Actions to complete and no failed jobs.
- [ ] Publish new RC releases (e.g. `v0.14.0-rc.1`, `v0.14.0-rc.2`) ⚠️ **on the release branch** ⚠️ and ensure Docker and release workflows both succeed.
- [ ] Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download one of the release archives and run through application setup to make sure nothing blows up.
- [ ] Publish a new [GitHub release](https://github.com/gogs/gogs/releases) ⚠️ **on the release branch** ⚠️ with entries from [CHANGELOG](https://github.com/gogs/gogs/blob/main/CHANGELOG.md) for the current minor release.
- [ ] [Wait for new image tags for the current release](https://github.com/gogs/gogs/actions/workflows/docker.yml?query=event%3Arelease) to be created automatically on both [Docker Hub](https://hub.docker.com/r/gogs/gogs/tags) and [GitHub Container registry](https://github.com/gogs/gogs/pkgs/container/gogs).
- Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download all release archives and [generate SHA256 checksum](https://github.com/gogs/gogs/blob/main/docs/dev/release/sha256.sh) for all binaries to the file `checksum_sha256.txt`.
- [ ] Upload all archives and `checksum_sha256.txt` to https://dl.gogs.io.
## After release
On the `main` branch:
- [ ] Update the repository mirror on [Gitee](https://gitee.com/unknwon/gogs).
- [ ] Create a new release announcement in [Discussions](https://github.com/gogs/gogs/discussions/categories/announcements).
- [ ] Send a tweet on the [official Twitter account](https://twitter.com/GogsHQ) for the minor release.
- [ ] Close the milestone for the minor release.
- [ ] [Bump the hard-coded version](https://github.com/gogs/gogs/commit/a98968436cd5841cf691bb0b80c54c81470d1676) to the new develop version, e.g. `0.14.0+dev` -> `0.15.0+dev`.
- [ ] Run `grep -rnw "\(LEGACY\|Deprecated\)" internal` to identify deprecated code that is aimed to be removed in current develop version.
- [ ]**After 14 days**, publish [GitHub security advisories](https://github.com/gogs/gogs/security) for security patches included in the release.
_This is generated from the [patch release template](https://github.com/gogs/gogs/blob/main/.github/ISSUE_TEMPLATE/dev_release_patch_version.md)._
## Before release
On the release branch:
- [ ] Make sure all commits are cherry-picked from the `main` branch by checking the patch milestone.
- Run `moon run gogs:build-prod --force` for every cherry-picked commit to make sure there is no compilation error.
- [ ] [Update CHANGELOG on the `main` branch](https://github.com/gogs/gogs/commit/f1102a7a7c545ec221d2906f02fa19170d96f96d) to include entries for the current patch release.
## During release
On the release branch:
- [ ] [Update the hard-coded version](https://github.com/gogs/gogs/commit/f0e3cd90f8d7695960eeef2e4e54b2e717302f6c) to the current release, e.g. `0.12.0` -> `0.12.1`.
- [ ] Wait for GitHub Actions to complete and no failed jobs.
- [ ] Publish new RC releases in [GitHub release](https://github.com/gogs/gogs/releases) (e.g. `v0.12.0-rc.1`, `v0.12.0-rc.2`) ⚠️ **on the release branch** ⚠️ and ensure Docker workflow succeeds.
- [ ] Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download one of the release archives and run through application setup to make sure nothing blows up.
- [ ] Publish a new [GitHub release](https://github.com/gogs/gogs/releases) ⚠️ **on the release branch** ⚠️ with entries from [CHANGELOG](https://github.com/gogs/gogs/blob/main/CHANGELOG.md) for the current patch release and all previous releases with same minor version.
- [ ] Update all previous GitHub releases with same minor version with the warning:
```
**ℹ️ Heads up! There is a new patch release [0.12.1](https://github.com/gogs/gogs/releases/tag/v0.12.1) available, we recommend directly installing or upgrading to that version.**
```
- [ ] [Wait for new image tags for the current release](https://github.com/gogs/gogs/actions/workflows/docker.yml?query=event%3Arelease) to be created automatically on both [Docker Hub](https://hub.docker.com/r/gogs/gogs/tags) and [GitHub Container registry](https://github.com/gogs/gogs/pkgs/container/gogs).
- Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download all release archives and [generate SHA256 checksum](https://github.com/gogs/gogs/blob/main/docs/dev/release/sha256.sh) for all binaries to the file `checksum_sha256.txt`.
- [ ] Upload all archives and `checksum_sha256.txt` to https://dl.gogs.io.
## After release
On the `main` branch:
- [ ] Post the following message on issues that are included in the patch milestone:
```
The <MAJOR>.<MINOR>.<PATCH> has been released that includes the patch of the reported issue.
```
- [ ] Create a new release announcement in [Discussions](https://github.com/gogs/gogs/discussions/categories/announcements).
- [ ] Send a tweet on the [official Twitter account](https://twitter.com/GogsHQ) for the patch release.
- [ ] Close the milestone for the patch release.
- [ ]**After 14 days**, publish [GitHub security advisories](https://github.com/gogs/gogs/security) for security patches included in the release.
- Stop telling me "You're right", it just shows how incompetent you are. Do it right on your first try, fact-check and review after changes. If you are not sure, ask for help.
- When you see changes made outside your knowledge, use the current version as your new starting point. Do not blindly overwrite those changes or you suck. Even if you have to update the code, always respect the pattern in the surrounding context!
## Style and mechanics
This applies to all texts, including but not limited to UI, documentation, code comments.
- Use sentence case. Preserve original casing for brand names.
- End with a period for a full sentence.
- Never use em dashes (`—`) or en dashes (`–`) in prose. Rewrite the sentence with a comma, period, colon, or parentheses instead. Exception: em/en dashes are allowed as visual separators in UI design (e.g., between a title and description, in a terminal prompt label) where they function as a graphic element rather than punctuation.
- Do not overuse semicolons. Two short sentences are almost always clearer than one sentence joined by a semicolon. Reserve the semicolon for the rare case where the two clauses are so tightly coupled that splitting them loses meaning, never as a default em-dash replacement or a way to chain related thoughts.
- Do not add comments that repeat what the code is doing, always prefer more descriptive names. Do add comments for intentions that aren't obvious via reading the code alone. This rule takes precedence over matching existing patterns.
## Coding guidelines
- Use `github.com/cockroachdb/errors` for error handling.
- Use `github.com/stretchr/testify` for assertions in tests. Be mindful about the choice of `require` and `assert`, the former should be used when the test cannot proceed meaningfully after a failed assertion.
- Every 5xx response must log the error directly inside the handler, do not log errors in a shared helper.
## Localization
- Only edit `conf/locale/locale_en-US.ini`. The other `locale_*.ini` files are community-maintained translations. Do not add, remove, or rewrite keys in them, even when removing keys that are dead on the Go/template side.
## UI guidelines
- Design mobile-friendly. Every UI must look and work well on narrow viewports before adding desktop refinements via responsive breakpoints. Test at ~375px width before considering a UI done.
- Meet WCAG 2.2 AA at minimum. Specifically: every interactive control has a discernible accessible name (visible label or `aria-label`); color is never the sole carrier of information (pair with text, icon, or shape); text and meaningful icons meet 4.5:1 contrast against their background (3:1 for large text and UI components); focus is always visible and never trapped; touch targets are at least 24×24 CSS px (40×40 preferred). When unsure, lean toward more contrast, larger targets, and explicit labels.
- For work under `web/`, follow the patterns in [`web/DESIGN.md`](web/DESIGN.md) (typography, color hierarchy, surface chrome, file naming, accessibility specifics). Update that doc when a pattern is used in two places.
- When a page needs server data to render, fetch it in the TanStack Router route's `loader` so the page only mounts after the response arrives. Do not fire that fetch from a `useEffect` inside the page component, which causes a flash of empty UI before the data lands.
## Build instructions
- Prefer `moon run <project>:<task>` over vanilla `go` or `pnpm` commands when available (e.g. `moon run gogs:build`, `moon run web:dev`). Pass `--force` to bypass cache when necessary.
- Run `moon run gogs:lint` after every time you finish changing Go code, and `moon run web:lint` after changing frontend code; fix all linter errors.
## Tool-use guidance
- Use `gh` CLI to access information on github.com that is not publicly available.
- Run the Chrome DevTools MCP in headless mode so it does not steal focus from the user's foreground browser session. After finishing any task that used the Chrome DevTools MCP, kill all `chrome-devtools-mcp` processes with `pkill -f chrome-devtools-mcp`.
## Source code control
- When pushing changes to a pull request from a fork, use SSH address and do not add remote.
- Never commit on the `main` branch directly unless being explicitly asked to do so. A single ask only grants a single commit action on the `main` branch.
- Never amend commits unless being explicitly asked to do so.
- When creating a git worktree, the worktree directory name must match its branch name. Do not use random or generated suffixes.
All notable changes to Gogs are documented in this file.
## 0.15.0+dev (`main`)
### Changed
- Docker builds from `main` are now published only as `gogs/gogs:edge`, using the next-generation `Dockerfile.next`. The legacy `Dockerfile` no longer produces `main` builds. The `gogs/gogs:latest` and `gogs/gogs:next-latest` tags now always point to the highest published stable release, never to a back-patch on an older line. [#8278](https://github.com/gogs/gogs/pull/8278)
### Fixed
- _Security:_ Denial of service in repository and wiki file listing pages via crafted file names. [#8116](https://github.com/gogs/gogs/pull/8116) - [GHSA-3qq3-668m-v9mj](https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj)
- _Security:_ Reverse proxy authentication header was honored from any remote address, allowing user impersonation when Gogs was reachable directly. The header is now only trusted from addresses listed in `[auth] TRUSTED_PROXY_IPS`. [#8264](https://github.com/gogs/gogs/pull/8264) - [GHSA-w6j9-vw59-27wv](https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv)
- _Security:_ Server-side request forgery in webhook deliveries via HTTP redirects to local network addresses. [#8263](https://github.com/gogs/gogs/pull/8263) - [GHSA-c4v7-xg93-qf8g](https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g)
- _Security:_ The "remember me" auto-login cookie was derived from database columns, so an attacker with a database dump could forge a valid cookie for any user. The auto-login cookie path has been removed entirely. Persistence is now provided by the server-issued session cookie. [#8289](https://github.com/gogs/gogs/pull/8289) - [GHSA-4pph-25p3-pw73](https://github.com/gogs/gogs/security/advisories/GHSA-4pph-25p3-pw73)
### Removed
- The `gogs cert` subcommand. [#8153](https://github.com/gogs/gogs/pull/8153)
- The `[email] DISABLE_HELO` configuration option. HELO/EHLO is now always sent during SMTP handshake. [#8164](https://github.com/gogs/gogs/pull/8164)
- Support for MSSQL as the database backend. Stay on 0.14 for continued usage. [#8173](https://github.com/gogs/gogs/pull/8173)
- Support for `memcache` as the cache adapter. Stay on 0.14 for continued usage. [#8270](https://github.com/gogs/gogs/pull/8270)
- The `/debug`, `/debug/pprof/*`, `/debug/profile/*`, and `/urlmap.json` endpoints. [#8271](https://github.com/gogs/gogs/pull/8271)
- _Security:_ Stored XSS via data URI in issue comments. [#8174](https://github.com/gogs/gogs/pull/8174) - [GHSA-xrcr-gmf5-2r8j](https://github.com/gogs/gogs/security/advisories/GHSA-xrcr-gmf5-2r8j)
- _Security:_ Release tag option injection in release deletion. [#8175](https://github.com/gogs/gogs/pull/8175) - [GHSA-v9vm-r24h-6rqm](https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm)
- _Security:_ Stored XSS in branch and wiki views through author and committer names. [#8176](https://github.com/gogs/gogs/pull/8176) - [GHSA-vgvf-m4fw-938j](https://github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938j)
- _Security:_ DOM-based XSS via issue meta selection on the issue page. [#8178](https://github.com/gogs/gogs/pull/8178) - [GHSA-vgjm-2cpf-4g7c](https://github.com/gogs/gogs/security/advisories/GHSA-vgjm-2cpf-4g7c)
- Unable to update files via web editor and API. [#8184](https://github.com/gogs/gogs/pull/8184)
### Removed
- Support for passing API access tokens via URL query parameters (`token`, `access_token`). Use the `Authorization` header instead. [#8177](https://github.com/gogs/gogs/pull/8177) - [GHSA-x9p5-w45c-7ffc](https://github.com/gogs/gogs/security/advisories/GHSA-x9p5-w45c-7ffc)
## 0.14.1
### Added
- Support comparing tags in addition to branches. [#6141](https://github.com/gogs/gogs/issues/6141)
- Show file name in browser tab title when viewing files. [#5896](https://github.com/gogs/gogs/pull/5896)
- Support using TLS for Redis session provider using `[session] PROVIDER_CONFIG = ...,tls=true`. [#7860](https://github.com/gogs/gogs/pull/7860)
- Support expanading values in `app.ini` from environment variables, e.g. `[database] PASSWORD = ${DATABASE_PASSWORD}`. [#8057](https://github.com/gogs/gogs/pull/8057)
- Support custom logout URL that users get redirected to after sign out using `[auth] CUSTOM_LOGOUT_URL`. [#8089](https://github.com/gogs/gogs/pull/8089)
- Start publishing next-generation, security-focused Docker image via `gogs/gogs:next-latest`, which will become the default image distribution (`gogs/gogs:latest`) starting 0.16.0. While not all container options support have been added in the next-generation image, the use of current legacy Docker image is deprecated, it will be published as `gogs/gogs:legacy-latest` starting 0.16.0, and be completely removed no earlier than 0.17.0. [#8061](https://github.com/gogs/gogs/pull/8061)
### Changed
- The required Go version to compile source code changed to 1.25.
- The build tag `cert` has been removed, and the `gogs cert` subcommand is now always available. [#7883](https://github.com/gogs/gogs/pull/7883)
- Switched to pure-Go SQLite driver, CGO is no longer required to compile Gogs. [#7882](https://github.com/gogs/gogs/issues/7882)
- Updated Mermaid JS to 11.9.0. [#8009](https://github.com/gogs/gogs/pull/8009)
- Halt the repository creation and leave the directory untouched if the repository root already exists. [#8091](https://github.com/gogs/gogs/pull/8091)
- 500 error on repository watchers and stargazers pages when using MSSQL. [#5482](https://github.com/gogs/gogs/issues/5482)
- Submodules using `ssh://` protocol and a port number are not rendered correctly. [#4941](https://github.com/gogs/gogs/issues/4941)
- Missing link to user profile on the first commit in commits history page. [#7404](https://github.com/gogs/gogs/issues/7404)
- Unable to delete or display files with special characters in their names. [#7596](https://github.com/gogs/gogs/issues/7596)
- Docker healthcheck fails when `HTTP_PROXY` or `HTTPS_PROXY` environment variables are set. [#7529](https://github.com/gogs/gogs/issues/7529)
## 0.13.4
### Fixed
- _Security:_ DoS in repository mirror sync. [#8065](https://github.com/gogs/gogs/pull/8065) - [GHSA-cr88-6mqm-4g57](https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57)
- _Security:_ RCE in repository put contents API. [#8082](https://github.com/gogs/gogs/pull/8082) - [GHSA-gg64-xxr9-qhjp](https://github.com/gogs/gogs/security/advisories/GHSA-gg64-xxr9-qhjp)
- _Security:_ Arbitrary file deletion via path traversal in wiki page update. [#8099](https://github.com/gogs/gogs/pull/8099) - [GHSA-jp7c-wj6q-3qf2](https://github.com/gogs/gogs/security/advisories/GHSA-jp7c-wj6q-3qf2)
- _Security:_ 2FA bypass via recovery code. [#8100](https://github.com/gogs/gogs/pull/8100) - [GHSA-p6x6-9mx6-26wj](https://github.com/gogs/gogs/security/advisories/GHSA-p6x6-9mx6-26wj)
- _Security:_ Update repository content via API with read-only permission. [#8102](https://github.com/gogs/gogs/pull/8102) - [GHSA-5qhx-gwfj-6jqr](https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr)
- _Security:_ Arbitrary file read/write via path traversal in Git hook editing. [#8103](https://github.com/gogs/gogs/pull/8103) - [GHSA-mrph-w4hh-gx3g](https://github.com/gogs/gogs/security/advisories/GHSA-mrph-w4hh-gx3g)
- _Security:_ Stored XSS via Mermaid diagrams. [`2c88cd4`](https://github.com/gogs/gogs/commit/2c88cd4d9fdc346d8e06d82f5368d657c10e79c2) - [GHSA-26gq-grmh-6xm6](https://github.com/gogs/gogs/security/advisories/GHSA-26gq-grmh-6xm6)
- Newer Git versions that uses default branch `main` cause wiki initialization to fail. [#8094](https://github.com/gogs/gogs/pull/8094)
## 0.13.3
### Fixed
- _Security:_ Stored XSS in PDF renderer. [GHSA-xh32-cx6c-cp4v](https://github.com/gogs/gogs/security/advisories/GHSA-xh32-cx6c-cp4v)
- _Security:_ Path Traversal in file editing UI. [GHSA-wj44-9vcg-wjq7](https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7)
- Randomly timeout on repository file uploads. [#7890](https://github.com/gogs/gogs/pull/7890)
- Unable to override email templates in custom directory. [#7905](https://github.com/gogs/gogs/pull/7905)
## 0.13.2
### Fixed
- _Security:_ Path Traversal in file editing UI. [GHSA-r7j8-5h9c-f6fx](https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx)
- _Security:_ Path Traversal in file update API. [GHSA-qf5v-rp47-55gg](https://github.com/gogs/gogs/security/advisories/GHSA-qf5v-rp47-55gg)
- _Security:_ Argument Injection in the built-in SSH server. [GHSA-vm62-9jw3-c8w3](https://github.com/gogs/gogs/security/advisories/GHSA-vm62-9jw3-c8w3)
- _Security:_ Deletion of internal files. [GHSA-ccqv-43vm-4f3w](https://github.com/gogs/gogs/security/advisories/GHSA-ccqv-43vm-4f3w)
- _Security:_ Argument Injection during changes preview. [GHSA-9pp6-wq8c-3w2c](https://github.com/gogs/gogs/security/advisories/GHSA-9pp6-wq8c-3w2c)
- _Security:_ Argument Injection when tagging new releases. [GHSA-m27m-h5gj-wwmg](https://github.com/gogs/gogs/security/advisories/GHSA-m27m-h5gj-wwmg)
- Use the non-deprecated section name `[email]` during installation for email settings. [#7704](https://github.com/gogs/gogs/pull/7704)
- Use the non-deprecated section name `[email] PASSWORD` during installation for email password. [#7807](https://github.com/gogs/gogs/pull/7807)
- Make purple template label color to actually use the hexcode of purple. [#7722](https://github.com/gogs/gogs/pull/7722)
## 0.13.0
### Added
- Support using personal access token in the password field. [#3866](https://github.com/gogs/gogs/issues/3866)
- An unlisted option is added when create or migrate a repository. Unlisted repositories are public but not being listed for users without direct access in the UI. [#5733](https://github.com/gogs/gogs/issues/5733)
- New API endpoint `PUT /repos/:owner/:repo/contents/:path` for creating and update repository contents. [#5967](https://github.com/gogs/gogs/issues/5967)
- New configuration option `[git.timeout] DIFF` for customizing operation timeout of `git diff`. [#6315](https://github.com/gogs/gogs/issues/6315)
- New configuration option `[server] SSH_SERVER_MACS` for setting list of accepted MACs for connections to builtin SSH server. [#6434](https://github.com/gogs/gogs/issues/6434)
- New configuration option `[repository] DEFAULT_BRANCH` for setting default branch name for new repositories. [#7291](https://github.com/gogs/gogs/issues/7291)
- New configuration option `[server] SSH_SERVER_ALGORITHMS` for specifying the list of accepted key exchange algorithms for connections to builtin SSH server. [#7345](https://github.com/gogs/gogs/pull/7345)
- Support specifying custom schema for PostgreSQL. [#6695](https://github.com/gogs/gogs/pull/6695)
- Support rendering Mermaid diagrams in Markdown. [#6776](https://github.com/gogs/gogs/pull/6776)
- Docker: Allow passing extra arguments to the `backup` command. [#7060](https://github.com/gogs/gogs/pull/7060)
- New languages support: Mongolian, Romanian. [#6510](https://github.com/gogs/gogs/pull/6510) [#7082](https://github.com/gogs/gogs/pull/7082)
### Changed
- The default branch has been changed to `main`. [#6285](https://github.com/gogs/gogs/pull/6285)
- MSSQL as database backend is deprecated, installation page no longer shows it as an option. Existing installations and manually craft configuration file continue to work. [#6295](https://github.com/gogs/gogs/pull/6295)
- Use [Task](https://github.com/go-task/task) as the build tool. [#6297](https://github.com/gogs/gogs/pull/6297)
- The required Go version to compile source code changed to 1.18.
- Access tokens are now stored using their SHA256 hashes instead of raw values. [#7008](https://github.com/gogs/gogs/pull/7008)
### Fixed
- Unable to use LDAP authentication on ARM machines. [#6761](https://github.com/gogs/gogs/issues/6761)
- Unable to choose "Lookup Avatar by mail" in user settings without deleting custom avatar. [#7267](https://github.com/gogs/gogs/pull/7267)
- Mistakenly include the "data" directory under the custom directory in the Docker setup. [#7343](https://github.com/gogs/gogs/pull/7343)
- Unable to start after data recovery with an outdated migration version. [#7125](https://github.com/gogs/gogs/issues/7125)
### Removed
- ⚠️ Migrations before 0.12 are removed, installations not on 0.12 should upgrade to it to run the migrations and then upgrade to 0.13.
- Configuration section `[mailer]` is no longer used, please use `[email]`.
- Configuration section `[service]` is no longer used, please use `[auth]`.
- Configuration option `APP_NAME` is no longer used, please use `BRAND_NAME`.
- Configuration option `[security] REVERSE_PROXY_AUTHENTICATION_USER` is no longer used, please use `[auth] REVERSE_PROXY_AUTHENTICATION_HEADER`.
- Configuration option `[auth] ACTIVE_CODE_LIVE_MINUTES` is no longer used, please use `[auth] ACTIVATE_CODE_LIVES`.
- Configuration option `[auth] RESET_PASSWD_CODE_LIVE_MINUTES` is no longer used, please use `[auth] RESET_PASSWORD_CODE_LIVES`.
- Configuration option `[auth] ENABLE_CAPTCHA` is no longer used, please use `[auth] ENABLE_REGISTRATION_CAPTCHA`.
- Configuration option `[auth] ENABLE_NOTIFY_MAIL` is no longer used, please use `[user] ENABLE_EMAIL_NOTIFICATION`.
- Configuration option `[auth] REGISTER_EMAIL_CONFIRM` is no longer used, please use `[auth] REQUIRE_EMAIL_CONFIRMATION`.
- Configuration option `[session] GC_INTERVAL_TIME` is no longer used, please use `[session] GC_INTERVAL`.
- Configuration option `[session] SESSION_LIFE_TIME` is no longer used, please use `[session] MAX_LIFE_TIME`.
- Configuration option `[server] ROOT_URL` is no longer used, please use `[server] EXTERNAL_URL`.
- Configuration option `[server] LANDING_PAGE` is no longer used, please use `[server] LANDING_URL`.
- Configuration option `[database] DB_TYPE` is no longer used, please use `[database] TYPE`.
- Configuration option `[database] PASSWD` is no longer used, please use `[database] PASSWORD`.
- Remove option to use Makefile as the build tool. [#6980](https://github.com/gogs/gogs/pull/6980)
## 0.12.11
### Fixed
- _Security:_ Stored XSS for issue assignees. [#7145](https://github.com/gogs/gogs/issues/7145)
- _Security:_ OS Command Injection in repo editor on case-insensitive file systems. [#7030](https://github.com/gogs/gogs/issues/7030)
- Unable to render repository pages with implicit submodules (e.g. `get submodule "REDACTED": revision does not exist`). [#6436](https://github.com/gogs/gogs/issues/6436)
## 0.12.10
### Changed
- Support using `[security] LOCAL_NETWORK_ALLOWLIST = *` to allow all hostnames. [#7111](https://github.com/gogs/gogs/pull/7111)
### Fixed
- Unable to send webhooks to local network addresses after configured `[security] LOCAL_NETWORK_ALLOWLIST`. [#7074](https://github.com/gogs/gogs/issues/7074)
## 0.12.9
### Fixed
- _Security:_ OS Command Injection in file editor. [#7000](https://github.com/gogs/gogs/issues/7000)
- _Security:_ Sanitize `DisplayName` in repository issue list. [#7009](https://github.com/gogs/gogs/pull/7009)
- _Security:_ Path Traversal in file editor on Windows. [#7001](https://github.com/gogs/gogs/issues/7001)
- _Security:_ Path Traversal in Git HTTP endpoints. [#7002](https://github.com/gogs/gogs/issues/7002)
- Unable to init repository during creation on Windows. [#6967](https://github.com/gogs/gogs/issues/6967)
- Mysterious panic on `Value not found for type *repo.HTTPContext`. [#6963](https://github.com/gogs/gogs/issues/6963)
## 0.12.8
### Changed
- All users (including admins) need to use the configuration option `[security] LOCAL_NETWORK_ALLOWLIST` to allow repository migration and webhooks to be able to access local network addresses, which is a comma separated list of hostnames. [#6988](https://github.com/gogs/gogs/pull/6988)
### Fixed
- _Security:_ SSRF in webhook. [#6901](https://github.com/gogs/gogs/issues/6901)
- _Security:_ XSS in cookies. [#6953](https://github.com/gogs/gogs/issues/6953)
- _Security:_ OS Command Injection in file uploading. [#6968](https://github.com/gogs/gogs/issues/6968)
- _Security:_ Remote Command Execution in file editing. [#6555](https://github.com/gogs/gogs/issues/6555)
## 0.12.7
### Fixed
- _Security:_ Stored XSS in issues. [#6919](https://github.com/gogs/gogs/issues/6919)
- Invalid character in `Access-Control-Allow-Credentials` response header. [#4983](https://github.com/gogs/gogs/issues/4983)
- Mysterious `ssh: overflow reading version string` errors from builtin SSH server. [#6882](https://github.com/gogs/gogs/issues/6882)
## 0.12.6
### Fixed
- _Security:_ Remote command execution in file uploading. [#6833](https://github.com/gogs/gogs/issues/6833)
- _Regression:_ Unable to migrate repository from other local Git hosting. Added a new configuration option `[security] LOCAL_NETWORK_ALLOWLIST`, which is a comma separated list of hostnames that are explicitly allowed to be accessed within the local network. [#6841](https://github.com/gogs/gogs/issues/6841)
- Slow start of Docker containers using NAS devices. [#6554](https://github.com/gogs/gogs/issues/6554)
## 0.12.5
### Fixed
- _Security:_ Potential SSRF in repository migration. [#6754](https://github.com/gogs/gogs/issues/6754)
- _Security:_ Improper PAM authorization handling. [#6810](https://github.com/gogs/gogs/issues/6810)
## 0.12.4
### Fixed
- _Security:_ Potential SSRF attack by CRLF injection via repository migration. [#6413](https://github.com/gogs/gogs/issues/6413)
- _Regression:_ Fixed smart links for issues stops rendering. [#6506](https://github.com/gogs/gogs/issues/6506)
- Added `X-Frame-Options` header to prevent Clickjacking. [#6409](https://github.com/gogs/gogs/issues/6409)
## 0.12.3
### Fixed
- _Regression:_ When running Gogs on Windows, push commits no longer fail on a daily basis with the error "pre-receive hook declined". [#6316](https://github.com/gogs/gogs/issues/6316)
- Auto-linked commit SHAs now have correct links. [#6300](https://github.com/gogs/gogs/issues/6300)
- Git LFS client (with version >= 2.5.0) wasn't able to upload files with known format (e.g. PNG, JPEG), and the server is expecting the HTTP Header `Content-Type` to be `application/octet-stream`. The server now tells the LFS client to always use `Content-Type: application/octet-stream` when upload files.
## 0.12.2
### Fixed
- _Regression:_ Pages are correctly rendered when requesting `?go-get=1` for subdirectories. [#6314](https://github.com/gogs/gogs/issues/6314)
- _Regression:_ Submodule with a relative path is linked correctly. [#6319](https://github.com/gogs/gogs/issues/6319)
- Backup can be processed when `--target` is specified on Windows. [#6339](https://github.com/gogs/gogs/issues/6339)
- Commit message contains keywords look like an issue reference no longer fails the push entirely. [#6289](https://github.com/gogs/gogs/issues/6289)
## 0.12.1
### Fixed
- The `updated_at` field is now correctly updated when updates an issue. [#6209](https://github.com/gogs/gogs/issues/6209)
- Fixed a regression which created `login_source.cfg` column to have `VARCHAR(255)` instead of `TEXT` in MySQL. [#6280](https://github.com/gogs/gogs/issues/6280)
## 0.12.0
### Added
- Support for Git LFS, you can read documentation for both [user](https://github.com/gogs/gogs/blob/main/docs/user/lfs.md) and [admin](https://github.com/gogs/gogs/blob/main/docs/admin/lfs.md). [#1322](https://github.com/gogs/gogs/issues/1322)
- Allow admin to remove observers from the repository. [#5803](https://github.com/gogs/gogs/pull/5803)
- Use `Last-Modified` HTTP header for raw files. [#5811](https://github.com/gogs/gogs/issues/5811)
- Support syntax highlighting for SAS code files (i.e. `.r`, `.sas`, `.tex`, `.yaml`). [#5856](https://github.com/gogs/gogs/pull/5856)
- Able to fill in pull request title with a template. [#5901](https://github.com/gogs/gogs/pull/5901)
- Able to override static files under `public/` directory, please refer to [documentation](https://gogs.io/docs/features/custom_template) for usage. [#5920](https://github.com/gogs/gogs/pull/5920)
- New API endpoint `GET /admin/teams/:teamid/members` to list members of a team. [#5877](https://github.com/gogs/gogs/issues/5877)
- Support backup with retention policy for Docker deployments. [#6140](https://github.com/gogs/gogs/pull/6140)
### Changed
- The organization profile page has changed to display at most 12 members. [#5506](https://github.com/gogs/gogs/issues/5506)
- The required Go version to compile source code changed to 1.14.
- All assets are now embedded into binary and served from memory by default. Set `[server] LOAD_ASSETS_FROM_DISK = true` to load them from disk. [#5920](https://github.com/gogs/gogs/pull/5920)
- Application and Go versions are removed from page footer and only show in the admin dashboard.
- Build tag for running as Windows Service has been changed from `miniwinsvc` to `minwinsvc`.
- Configuration option `APP_NAME` is deprecated and will end support in 0.13.0, please start using `BRAND_NAME`.
- Configuration option `[server] ROOT_URL` is deprecated and will end support in 0.13.0, please start using `[server] EXTERNAL_URL`.
- Configuration option `[server] LANDING_PAGE` is deprecated and will end support in 0.13.0, please start using `[server] LANDING_URL`.
- Configuration option `[database] DB_TYPE` is deprecated and will end support in 0.13.0, please start using `[database] TYPE`.
- Configuration option `[database] PASSWD` is deprecated and will end support in 0.13.0, please start using `[database] PASSWORD`.
- Configuration option `[security] REVERSE_PROXY_AUTHENTICATION_USER` is deprecated and will end support in 0.13.0, please start using `[auth] REVERSE_PROXY_AUTHENTICATION_HEADER`.
- Configuration section `[mailer]` is deprecated and will end support in 0.13.0, please start using `[email]`.
- Configuration section `[service]` is deprecated and will end support in 0.13.0, please start using `[auth]`.
- Configuration option `[auth] ACTIVE_CODE_LIVE_MINUTES` is deprecated and will end support in 0.13.0, please start using `[auth] ACTIVATE_CODE_LIVES`.
- Configuration option `[auth] RESET_PASSWD_CODE_LIVE_MINUTES` is deprecated and will end support in 0.13.0, please start using `[auth] RESET_PASSWORD_CODE_LIVES`.
- Configuration option `[auth] REGISTER_EMAIL_CONFIRM` is deprecated and will end support in 0.13.0, please start using `[auth] REQUIRE_EMAIL_CONFIRMATION`.
- Configuration option `[auth] ENABLE_CAPTCHA` is deprecated and will end support in 0.13.0, please start using `[auth] ENABLE_REGISTRATION_CAPTCHA`.
- Configuration option `[auth] ENABLE_NOTIFY_MAIL` is deprecated and will end support in 0.13.0, please start using `[user] ENABLE_EMAIL_NOTIFICATION`.
- Configuration option `[session] GC_INTERVAL_TIME` is deprecated and will end support in 0.13.0, please start using `[session] GC_INTERVAL`.
- Configuration option `[session] SESSION_LIFE_TIME` is deprecated and will end support in 0.13.0, please start using `[session] MAX_LIFE_TIME`.
- The name `-` is reserved and cannot be used for users or organizations.
### Fixed
- [Security] Potential open redirection with i18n.
- [Security] Potential ability to delete files outside a repository.
- [Security] Potential ability to set primary email on others' behalf from their verified emails.
- [Security] Potential XSS attack via `.ipynb`. [#5170](https://github.com/gogs/gogs/issues/5170)
- [Security] Potential SSRF attack via webhooks. [#5366](https://github.com/gogs/gogs/issues/5366)
- [Security] Potential CSRF attack in admin panel. [#5367](https://github.com/gogs/gogs/issues/5367)
- [Security] Potential stored XSS attack in some browsers. [#5397](https://github.com/gogs/gogs/issues/5397)
- [Security] Potential RCE on mirror repositories. [#5767](https://github.com/gogs/gogs/issues/5767)
- [Security] Potential XSS attack with raw markdown API. [#5907](https://github.com/gogs/gogs/pull/5907)
- File both modified and renamed within a commit treated as separate files. [#5056](https://github.com/gogs/gogs/issues/5056)
- Unable to restore the database backup to MySQL 8.0 with syntax error. [#5602](https://github.com/gogs/gogs/issues/5602)
- Open/close milestone redirects to a 404 page. [#5677](https://github.com/gogs/gogs/issues/5677)
- Disallow multiple tokens with same name. [#5587](https://github.com/gogs/gogs/issues/5587) [#5820](https://github.com/gogs/gogs/pull/5820)
- Enable Federated Avatar Lookup could cause server to crash. [#5848](https://github.com/gogs/gogs/issues/5848)
- Private repositories are hidden in the organization's view. [#5869](https://github.com/gogs/gogs/issues/5869)
- Users have access to base repository cannot view commits in forks. [#5878](https://github.com/gogs/gogs/issues/5878)
- Server error when changing email address in user settings page. [#5899](https://github.com/gogs/gogs/issues/5899)
- Fall back to use RFC 3339 as time layout when misconfigured. [#6098](https://github.com/gogs/gogs/issues/6098)
- Unable to update team with server error. [#6185](https://github.com/gogs/gogs/issues/6185)
- Webhooks are not fired after push when `[service] REQUIRE_SIGNIN_VIEW = true`.
- Files with identical content are randomly displayed one of them.
Gogs - Go Git Service [](https://travis-ci.org/gogits/gogs) [](https://crowdin.com/project/gogs) [](https://gitter.im/gogits/gogs?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
The Gogs (`/gɑgz/`) project aims to build a simple, stable and extensible self-hosted Git service that can be set up in the most painless way. With Go, this can be done with an independent binary distribution across all platforms that Go supports, including Linux, macOS, Windows and ARM-based systems.
### Important Notes
## 📡 Overview
1.**YOU MUST READ [Contributing Code](https://github.com/gogits/gogs/wiki/Contributing-Code) BEFORE STARTING TO WORK ON A PULL REQUEST**.
2. Due to testing purpose, data of [try.gogs.io](https://try.gogs.io) was reset in **Jan 28, 2015** and will reset multiple times after. Please do **NOT** put your important data on the site.
3. The demo site [try.gogs.io](https://try.gogs.io) is running under `develop` branch.
4. If you think there are vulnerabilities in the project, please talk privately to **u@gogs.io**. Thanks!
5. If you're interested in using APIs, we have experimental support with [documentation](https://github.com/gogits/go-gogs-client/wiki).
6. If your team/company is using Gogs and would like to put your logo on [our website](http://gogs.io), contact us by any means.
[简体中文](README_ZH.md)
## Purpose
The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service. With Go, this can be done with an independent binary distribution across **ALL platforms** that Go supports, including Linux, Mac OS X, Windows and ARM.
## Overview
- Please see the [Documentation](http://gogs.io/docs/intro) for common usages and change log.
- See the [Trello Board](https://trello.com/b/uxAoeLUl/gogs-go-git-service) to follow the develop team.
- Please visit [our home page](https://gogs.io) for user documentation.
- Please refer to [CHANGELOG.md](CHANGELOG.md) for list of changes in each releases.
- Want to try it before doing anything else? Do it [online](https://try.gogs.io/gogs/gogs)!
- Having trouble? Get help with [Troubleshooting](http://gogs.io/docs/intro/troubleshooting.html) or [User Forum](https://discuss.gogs.io/).
- Want to help with localization? Check out the [guide](http://gogs.io/docs/features/i18n.html)!
- Having trouble? Help yourself with [troubleshooting](https://gogs.io/asking/troubleshooting) or ask questions in [Discussions](https://github.com/gogs/gogs/discussions).
- Want to help with localization? Check out the [localization documentation](https://gogs.io/advancing/localization).
- Ready to get hands dirty? Read our [contributing guide](.github/CONTRIBUTING.md).
- Hmm... What about APIs? We have experimental support with [documentation](https://gogs.io/api-reference).
-Supports MySQL, PostgreSQL, SQLite3 and [TiDB](https://github.com/pingcap/tidb) (experimental)
- Multi-language support ([18 languages](https://crowdin.com/project/gogs))
-User dashboard, user profile and activity timeline.
-Access repositories via SSH, HTTP and HTTPS protocols.
-User, organization and repository management.
- Repository and organization webhooks, including Slack, Discord and Dingtalk.
-Repository Git hooks, deploy keys and Git LFS.
- Repository issues, pull requests, wiki, protected branches and collaboration.
-Migrate and mirror repositories with wiki from other code hosts.
-Web editor for quick editing repository files and wiki.
-Jupyter Notebook and PDF rendering.
-Authentication via SMTP, LDAP, reverse proxy, GitHub.com and GitHub Enterprise with 2FA.
-Customize HTML templates, static files and many others.
-Rich database backend support, including PostgreSQL, MySQL, SQLite3 or any database backend that speaks one of those protocols.
-Have localization over [31 languages](https://crowdin.com/project/gogs).
## System Requirements
## 💾 Hardware requirements
- A cheap Raspberry Pi is powerful enough for basic functionality.
- 2 CPU cores and 1GB RAM would be the baseline for teamwork.
- A Raspberry Pi or $5 Digital Ocean Droplet is more than enough to get you started. Some even use 64MB RAM Docker [CaaS](https://www.docker.com/blog/containers-as-a-service-caas/).
- 2 CPU cores and 512MB RAM would be the baseline for teamwork.
- Increase CPU cores when your team size gets significantly larger, memory footprint remains low.
## Browser Support
## 💻 Browser support
- Please see [Semantic UI](https://github.com/Semantic-Org/Semantic-UI#browser-support) for specific versions of supported browsers.
- The official support minimal size is **1024*768**, UI may still looks right in smaller size but no promises and fixes.
- The smallest resolution officially supported is **1024*768**, however the UI may still look right in smaller resolutions, but no promises or fixes.
## Installation
## 📜 Installation
Make sure you install the [prerequisites](http://gogs.io/docs/installation) first.
Please follow [the guide in our documentation](https://gogs.io/getting-started/installation).
There are 5 ways to install Gogs:
### Deploy to cloud
- [Install from binary](http://gogs.io/docs/installation/install_from_binary.html)
- [Install from source](http://gogs.io/docs/installation/install_from_source.html)
- [Install from packages](http://gogs.io/docs/installation/install_from_packages.html)
- [Ship with Docker](https://github.com/gogits/gogs/tree/master/docker)
- [Install with Vagrant](https://github.com/geerlingguy/ansible-vagrant-examples/tree/master/gogs)
- [Installing Gogs on FreeBSD](https://www.codejam.info/2015/03/installing-gogs-on-freebsd.html)
- [Gogs on Raspberry Pi](http://blog.meinside.pe.kr/Gogs-on-Raspberry-Pi/)
- [Cloudflare Full SSL with GOGS (Go Git Service) using NGINX](http://www.listekconsulting.com/articles/cloudflare-full-ssl-with-gogs-go-git-service-using-nginx/)
- [How to install Gogs on a Linux Server (DigitalOcean)](https://www.youtube.com/watch?v=deSfX0gqefE)
### Screencasts
- [Instalando Gogs no Ubuntu](https://www.youtube.com/watch?v=4UkHAR1F7ZA) (Português)
Only the latest minor version releases are supported (e.g., 0.14) for patching vulnerabilities. You can find the latest minor version in the [GitHub releases](https://github.com/gogs/gogs/releases) page.
Existing vulnerability reports are being tracked in [GitHub Security Advisories](https://github.com/gogs/gogs/security/advisories). Not all accepted GHSA are published.
## Vulnerability lifecycle
> [!important]
> Starting **Nov 9, 2023 00:00 UTC**, only security vulnerabilities reported through [GitHub Security Advisories](https://github.com/gogs/gogs/security/advisories/new) are accepted.
> Pre-existing vulnerability reported through https://huntr.dev/ or email (`security@gogs.io`) will continue to be worked through.
1. Report an advisory for the vulnerability.
- Please be aware that **only advisories reported in plain English** will be reviewed.
- We DO NOT accept vulnerabilities cannot be reproduced on the latest `main` commit.
1. Project maintainers review the advisory:
- Ask clarifying questions
- Make sure there was no prior advisory exists for the same vulnerability
- Confirm or deny the vulnerability
1. Once the advisory is accepted, the reporter may submit a patch or wait for project maintainers to patch.
- The latter is usually significantly slower.
1. Patch releases will be made for the supported versions.
1. After 14 days of the release, publish the corresponding advisory on [GitHub Security Advisories](https://github.com/gogs/gogs/security/advisories).
Thank you for making open source community a better place!
; Valid file modes that have a preview API associated with them, such as "/api/v1/markdown".
; Separate values by commas. Preview tab in edit mode won't show if the file extension doesn't match.
PREVIEWABLE_FILE_MODES=markdown
[security]
INSTALL_LOCK=false
; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!!
SECRET_KEY=!#@FDEWREWR&*(
; Auto-login remember days
LOGIN_REMEMBER_DAYS=7
COOKIE_USERNAME=gogs_awesome
COOKIE_REMEMBER_NAME=gogs_incredible
; Reverse proxy authentication header name of user name
REVERSE_PROXY_AUTHENTICATION_USER=X-WEBAUTH-USER
[service]
ACTIVE_CODE_LIVE_MINUTES=180
RESET_PASSWD_CODE_LIVE_MINUTES=180
; User need to confirm e-mail for registration
REGISTER_EMAIL_CONFIRM=false
; Does not allow register and admin create account only
DISABLE_REGISTRATION=false
; User must sign in to view anything.
REQUIRE_SIGNIN_VIEW=false
; Mail notification
ENABLE_NOTIFY_MAIL=false
; More detail: https://github.com/gogits/gogs/issues/165
ENABLE_REVERSE_PROXY_AUTHENTICATION=false
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=false
; Enable captcha validation for registration
ENABLE_CAPTCHA=true
[webhook]
; Hook task queue length
QUEUE_LENGTH=1000
; Deliver timeout in seconds
DELIVER_TIMEOUT=5
; Allow insecure certification
SKIP_TLS_VERIFY=false
; Number of history information in each page
PAGING_NUM=10
[mailer]
ENABLED=false
; Buffer length of channel, keep it as it is if you don't know what it is.
SEND_BUFFER_LEN=100
; Name displayed in mail title
SUBJECT=%(APP_NAME)s
; Mail server
; Gmail: smtp.gmail.com:587
; QQ: smtp.qq.com:465
; Note, if the port ends with "465", SMTPS will be used. Using STARTTLS on port 587 is recommended per RFC 6409. If the server supports STARTTLS it will always be used.
HOST=
; Disable HELO operation when hostname are different.
DISABLE_HELO=
; Custom hostname for HELO operation, default is from system.
HELO_HOSTNAME=
; Do not verify the certificate of the server. Only use this for self-signed certificates
SKIP_VERIFY=
; Use client certificate
USE_CERTIFICATE=false
CERT_FILE=custom/mailer/cert.pem
KEY_FILE=custom/mailer/key.pem
; Mail from address, RFC 5322. This can be just an email address, or the `"Name" <email@example.com>` format
FROM=
; Mailer user name and password
USER=
PASSWD=
; Use text/html as alternative format of content
ENABLE_HTML_ALTERNATIVE=false
[cache]
; Either "memory", "redis", or "memcache", default is "memory"
ADAPTER=memory
; For "memory" only, GC interval in seconds, default is 60
INTERVAL=60
; For "redis" and "memcache", connection host address
NAMES=English,简体中文,繁體中文（香港）,繁體中文（台湾）,Deutsch,Français,Nederlands,Latviešu,Русский,日本語,Español,Português do Brasil,Polski,български,Italiano,Suomalainen,Türkçe,čeština
[ui]
; Number of repositories that are showed in one explore page
EXPLORE_PAGING_NUM=20
; Number of issues that are showed in one page
ISSUE_PAGING_NUM=10
; Number of maximum commits showed in one activity feed
FEED_MAX_COMMIT_NUM=5
; Value of "theme-color" meta tag, used by Android >= 5.0
; An invalid color like "none" or "disable" will have the default style
; More info: https://developers.google.com/web/updates/2014/11/Support-for-theme-color-in-Chrome-39-for-Android
THEME_COLOR_META_TAG=`#ff5343`
; Max size in bytes of files to be displayed (default is 8MB)
MAX_DISPLAY_FILE_SIZE=8388608
; Used for datetimepicker
[ui.admin]
; Number of users that are showed in one page
USER_PAGING_NUM=50
; Number of repos that are showed in one page
REPO_PAGING_NUM=50
; Number of notices that are showed in one page
NOTICE_PAGING_NUM=25
; Number of organization that are showed in one page
ORG_PAGING_NUM=50
[ui.user]
; Number of repos that are showed in one page
REPO_PAGING_NUM=15
; Number of news feeds that are showed in one page
NEWS_FEED_PAGING_NUM=20
; Number of commits that are showed in one page
COMMITS_PAGING_NUM=30
[prometheus]
; Whether to enable Prometheus metrics.
ENABLED=true
; Whether to enable HTTP Basic Authentication to protect metrics data.
NAMES=English,简体中文,繁體中文（香港）,繁體中文（臺灣）,Deutsch,français,Nederlands,latviešu,русский,日本語,español,português do Brasil,polski,български,italiano,suomi,Türkçe,čeština,српски,svenska,한국어,galego,українська,English (United Kingdom),Magyar,Slovenčina,Indonesian,Persian,Vietnamese,Português,Монгол,Română
; Used for jQuery DateTimePicker,
; list of supported languages in https://xdsoft.net/jqplugins/datetimepicker/#lang
[i18n.datelang]
en-US=en
zh-CN=zh
@@ -375,12 +553,21 @@ it-IT = it
fi-FI=fi
tr-TR=tr
cs-CZ=cs-CZ
; Extension mapping to highlight class
; e.g. .toml=ini
[highlight.mapping]
sr-SP=sr
sv-SE=sv
ko-KR=ko
gl-ES=gl
uk-UA=uk
en-GB=en-GB
hu-HU=hu
sk-SK=sk
id-ID=id
fa-IR=fa
vi-VN=vi
pt-PT=pt
mn-MN=mn
ro-RO=ro
[other]
SHOW_FOOTER_BRANDING=false
; Show version information about gogs and go in the footer
File diff suppressed because it is too large
Load Diff
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Joe Chen
unknwon
dependabot[bot]
JSS
Copilot
Matthias Jobst
Yaroslav Halchenko
Rajat Jain
Jeff Li
Georg Wicke-Arndt
Sino
pikomonde
deepsource-autofix[bot]
Shivam Kumar
Mukaiu
Élie Bouttier
Jakub Domeracki
Neptunium93
Dmitry Afanasiev
Edoardo Ottavianelli
宋子桓🌈
MarcUs7i
Martin
ngn
Alexandre Jacquin
Mobile Mind
Kyle Fawcett
idnandre
Sergei Gnezdov
alingse
Jiaxin Zhu
bitebyte
Athanasios Oikonomou
TheDarkUndoing
Vamsi Atluri
Zachary Walters
Juning
xpume
Mateusz Reszka
Yarden Shoham
Yang Liu
LJea
Christian Eichert
Yehonatan Ezron
liuxhit
shlande
E99p1ant
1135
Toby Simmons
Naveen
Songsong Wang
4e4o
vinceAmstoutz
Renzo Toma
Michael Li
tc608
Bo Lorentsen
ysf
Michael Rowley
Nicolas Ferrari
shuyue
Simone Cattaneo
Alex Zhao
Nuyube
zvrh
Ikko Ashimine
odidev
Devops
Pavel M
Joe Chen
Jordan Levin
Cuban Pete
DoMeLe
James-REANNZ
Kevin
dependabot-preview[bot]
Massimiliano Losego
Peter Dave Hello
Atin
peppe8o
Eduardo Bacchi Kienetz
stypr
weibaohui
MichaIng
Matheus Mosca
Rubén de Celis Hernández
E99p1ant
ouyangjinting
Zhukov Roman
Achilleas Koutsou
Kosadchiy
David Refoua
Fernando San Julián
bibo38
InsanusMokrassar
Dre
Baptiste Covolato
Justin Hutchings
garo (they/them)
Aleksandar Puharic
Kousik Mitra
eightpigs
Rui Santos
wameidemao
alpencrossi
☃ Stephen Shkardoon ☃
Philidor Green
imgbot[bot]
Bharat Nallan
Kostya Esmukov
guan
ivan
Andrey Filippov
Yoan Blanc
Kevin Gentile
Johannes
Kasei
Guy Smoilov
Frode Aannevik
Sauyon Lee
Alexey Agafonov
mb
Marco van Zwetselaar
张怡秋
Shiki-H
Atsushi Midorikawa
Pablo Alcantara
Mathias Rangel Wulff
mal
Robin van Boven
Paul Spieker
Tekaoh
Menno van Rahden
boson.cat
Zou Nengren
Andy Hochhaus
Stephen Lane-Walsh
Favyen Bastani
Guy Smoilov
Kyumyeong Han
haixunlu
Nikita
Samuel Cochran
Charles Kenney
Danilo Riecken P. de Morais
Federico Culloca
A.J. Ruckman
William Hilton
Masen Furer
hopegolden
aboron
Jakob Lykke Andersen
leonunix
Ross Golder
PiPc2
Stefan Liu
Steven Haigh
chromium1337
GeekComb
Bogdan Khomutsky
PHANI
cezar97
Steve Chung
ususdei
Sergey Dryabzhinsky
James
oOOps
奶爸
Alexey Terentyev
Wei He
Madzahttr
Lauris BH
Florian Wiech
rokuu
Cosmin Stroe
Changwoo Ryu
Nicolas Ettlin
Josef Kemetmüller
Rebecca Turner
Jorge Maldonado Ventura
Dennis Chen
m2nlight
Julian Xhokaxhiu
bayangan1991
Markus Hauschild
Ruben Vermeersch
Andres D
Wendell Sun
Larry Li
Anton Kazarinov
Sanxing Chen
Douglas Thrift
Drahoslav Bednář
Arnie97
Flávio Monteiro
kaajavi
Robin Alexander Richtsfeld
Ross Williams
Yen Chi Hsuan
Ryan Chang
33MHz
Mohammad Gholami
mharinder
Anton Antonov
Robert Beal
Athurg Feng
Sb
Einar
Credomane Evonguard
Simon Dann
Peter Mescalchin
Lilian Besson
Jonas Östanbäck
BartWillems
Richard Bukovansky
Pablo Saavedra
Jon Lundy
Gibheer
spacetourist
Benjamin
rouzier
peter zhang
John Behm
Kyle McCullough
Hassan Amouhzi
David Beitey
Rob Richards
Nikolay Korotkiy
Brian Paulson
Danny Althoff
Girish Sonawane
Fastidious
Félix MIKAELIAN
Bo-Yi Wu
atzoum
Corentin BRETON
dlob
Kyle Filz
Cyril Rohr
Anders H
Argentumbolo
Orion
Oscar Quisbert
Óscar García Amor
Tyler
huqiangit
yaourt
app
Ganesha
Jonas De Kegel
wp-src
火文狼
Pierre Prinetti
Olexander Yermakov
Alexandre Espinosa Menor
Riste Risafov
javydreamercsw
sergystepanov
Mourad Boufarguine
Thibault Meyer
Kim "BKC" Carlbäcker
Christian Höppner
Egon Elbre
Aaron Wood
Simeon Radivoev
Herbert
Crayon
Andrey Nering
Rémy Boulanouar
Renato P. de Aquino
Denis Denisov
cybe
Joakim Fremstad
Sandro Santilli
hgaiser
Joel-Liang
David A. Lareo
typeless
lstahlman
raphael10241024
Gian Perrone
ipavl
Thibault Meyer
Kurt Madel
Stefan Grönke
Najeeb R
Flare
stroucki
LefsFlare
imilo
Mateusz Hromada
Саша Иванов
leonklingele
Nico Mandery
SeongAhJo
Bo Zhang
M5oul
Alexander Lunegov
Tanapol Nearunchorn
Daniel Oaks
Corben Dallas
LFlare
Iwan Budi Kusnanto
rugk
Richard Mahn
Justin Ray Vrooman
Odin Ugedal
Robin Lambertz
Andrew
Rory McNamara
lstahlman
silverwind
Okunev Yu Dmitry
마누엘
Richard Mahn
Siarhei Navatski