fix(actions): raise ZOMBIE_TASK_TIMEOUT default from 10min to 60min (GAP-5) - #3
Open
AlexMikhalev wants to merge 164 commits into
Open
AlexMikhalev wants to merge 164 commits into
AlexMikhalev wants to merge 164 commits into
Conversation
This commit adds the complete working robot API implementation: Features: - Robot API endpoints (/api/v1/robot/triage, /ready, /graph) - PageRank algorithm for issue prioritization - CLI tool (cmd/gitea-robot) for robot API access - Audit logging for all robot API access - Security tests and input validation Changes: - Updated robot routers with proper Gitea API compatibility - Complete graph_cache.go with CalculatePageRank and helpers - Fixed setting references and configuration - Removed broken/incompatible code - All tests passing (44 robot tests total) Co-authored-by: Alex Mikhalev <alex@alex-mikhalev.com>
- Document Robot API endpoints (triage, ready, graph) - Document CLI usage with examples - Document Docker images available on GHCR and Gitea Registry - Add publishing instructions for both registries - Include authentication steps for GHCR with write:packages scope
- Update Gitea image from 1.22.6 to 1.26.0 - Switch to ghcr.io/terraphim/gitea registry - Add Robot API configuration section - Enable PageRank algorithm with damping=0.85, iterations=100 - Enable audit logging for Robot API access Related to go-gitea#8
- Implement stdio-based MCP server with JSON-RPC 2.0 protocol - Add 4 MCP tools: triage, ready, graph, add_dep - Fix --help to work without GITEA_TOKEN environment variable - Add integration scripts for Claude Code, Opencode, and Codex CLI - Add 1Password secure token injection option to all scripts - Add comprehensive MCP server documentation - Include 50 unit tests for MCP functionality Refs kimiko-terraphim#2
- Echo back protocol version from initialize request - Change tools capability from map[string]bool to map[string]any - Add support for notifications/initialized method - Fix MCP spec compliance issues Refs kimiko-terraphim#2
The MCP tool handlers (triage, ready, graph, add_dep) were calling CLI command functions that invoke os.Exit() on errors. This caused the entire MCP server process to terminate when a tool encountered an error. Changed all tool handlers to: - Call API endpoints directly instead of CLI commands - Return proper MCP error responses instead of crashing - Added apiPostSafe() function that returns errors instead of exiting This fixes "Connection closed" errors when AI assistants call gitea-robot tools. Refs kimiko-terraphim#2
Add GetDependenciesByIssueID and GetBlockedByDependencies queries to the issues model. Implement all 6 API handlers (dependencies + blocks) in issue_dep.go with proper form binding via web.GetForm(ctx), cross-repo support, circular dependency detection, and permission checks. Co-Authored-By: Terraphim AI <noreply@anthropic.com>
…plicates The CalculatePageRank function returned uniform 0.15 scores for all issues due to three interrelated bugs: 1. DependencyWithRepo xorm struct tags used table-qualified names (e.g. "issue_dependency.issue_id") which xorm does not support in Find() result mapping. All fields silently remained at zero values, producing a degenerate single-node graph. Fixed by switching to raw SQL with explicit column selection. Refs go-gitea#6 2. Two overlapping queries (join on issue_id, join on dependency_id) produced duplicate edges for same-repo dependencies. Replaced with a single DISTINCT query that joins both sides. Refs go-gitea#8 3. Adjacency direction was inverted: rank flowed from blockers to blocked issues, making leaves rank highest. Reversed so blocked issues "vote for" their blockers, giving root/hub issues the highest PageRank. Also replaced O(issues*deps) inner loop with O(edges) distribution. Refs go-gitea#7 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Ready and Graph API handlers only read from the PageRank cache but never triggered computation. If Triage had not been called first (or if the cache was empty), these endpoints always returned baseline scores of 0.15. Add EnsureRepoPageRankComputed() calls in both getReadyIssues() and getDependencyGraph() before reading the cache. This lazily computes PageRank on first access and uses cached values thereafter. Refs go-gitea#9 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit addresses critical security vulnerabilities in the Robot API: Security Fixes: - Fix information disclosure by returning 404 for all errors (prevents repo enumeration) - Add PageRank caching to prevent CPU exhaustion from repeated calculations - Implement concurrent computation prevention (only one calc per repo at a time) New Files: - services/robot/cache.go: Thread-safe PageRank cache with TTL - services/robot/cache_test.go: Comprehensive cache tests - docs/ROBOT_SECURITY.md: Security documentation and best practices Modified Files: - routers/api/v1/robot/robot.go: Fix 400/500 error disclosure - routers/api/v1/robot/ready_graph.go: Fix 400 error disclosure - services/robot/robot.go: Integrate cache, reduce DB calls Security Requirements Met: ✓ SR-1: All endpoints verify repo issue read permission ✓ SR-2: No info disclosure via error messages (all return 404) ✓ SR-3: PageRank recalculation rate-limited via cache ✓ SR-4: All access audited (audit.go already present) ✓ SR-5: Input validated and sanitized Configuration: - PAGERANK_CACHE_TTL: 300s (5 minutes) default - AUDIT_LOG: true by default Closes security vulnerabilities: - Unauthorized repo access via error messages - CPU exhaustion via repeated PageRank calculation Refs: terraphim/gitea-robot-security-spec-1.0.0
Replace EnsureRepoPageRankComputed with CalculatePageRank to fix flat PageRank scores (all 0.15) in ready endpoint. The cache check in EnsureRepoPageRankComputed was broken: - hasPageRankCache only verified count > 0, not completeness - Stale/incomplete cache caused all issues to fallback to baseline 0.15 Now ready always recalculates from live dependency graph, matching triage behaviour exactly. Refs go-gitea#10
…eady endpoint' (go-gitea#11) from fix/10-pagerank-ready into main
Issues with highest PageRank now appear first in the ready endpoint, making it easier to identify high-impact work. Refs go-gitea#10
Add Sentrux structural quality check to CI uveline. Runs on PRs to main/develop, blocks merge if quality degrades. Refs go-gitea#1080
Adds verified research and design documents for the upstream security drift remediation effort. Empirically validates that 4 of 7 security commits cherry-pick cleanly and 3 have single-file mechanical conflicts caused by upstream evolution outside our Robot/PageRank code. Recommended strategy: selective cherry-pick (not full upstream merge) in severity-and-cleanliness order. Critical OAuth2 code-reuse fix (f3bdcc5) cherry-picks cleanly and lands first. Corrects original research claim of '0 commits ahead' -- verified count is 41 commits ahead of upstream/main (Robot/PageRank/MCP features and CI hardening). Refs terraphim/gitea#12 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…go-gitea#15 The acceptance criterion specified a bare go test command that fails without build tags and without the fixture database. Correct the command, add a note explaining the infrastructure requirement, and update the gate to use manual smoke + build-tag compilation check. Full integration test wiring is deferred to issue go-gitea#15. Refs go-gitea#12 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…o-gitea#12 Empirical dry-run shows design's predicted conflict scope was understated by ~7x: 21 files vs predicted 3, including auth-refactor structural conflicts. Documents four resolution options and recommends design revision (Option D) before resuming implementation. Refs terraphim/gitea#12
go-gitea#12 Echo (gitea-meta-coordinator) approved Option D after the empirical conflict survey contradicted v1 predictions (3 conflict files predicted vs 21 actual). This revision encodes the per-file resolution strategy in design before Phase 3 resumes. Empirical re-classification of all 21 conflict files via `git log upstream/main..main -- <file>` finds **20 upstream-only / 1 fork-touched**. Only `routers/api/v1/api.go` requires manual semantic merge to preserve the Robot route group; the remaining 20 are mechanical take-theirs. Sections updated: - Status -> Revised v2; Estimated Effort 4-6 h -> 8-12 h - Section 1: scope updated to 21 conflict files; new Avoid items (full upstream merge, picking prerequisite refactors) - Section 2: pick re-ordering (1, 4 first as green baseline, then conflict picks 2, 3, 5, 6, 7); new key decision rows for per-file rule and fork-touch detection; expanded Eliminated Options - Section 3: empirical 21-row conflict map with per-file fork-touched classification and resolution rule - Section 4: per-pick procedure rewritten with concrete take-theirs loops and the manual merge guard for api.go - Section 5: expanded from 3 to 5 conflict-pick subsections; rule stated up front; correction noted that auth.go is upstream-only (v1 blocker doc speculation that it was fork-touched was incorrect) - Section 6: integration test commands tagged with sqlite build tag; acceptance criteria add Robot route preservation checks - Section 7: re-estimated to 8 h - 11 h 30 m total with per-step breakdown reflecting take-theirs vs manual merge effort - Appendix: new commit reference card with empirical conflict counts Refs terraphim/gitea#12 Resolves blocker `.docs/blocker-12-conflict-survey.md`
- set OAuth2 authorization code `ValidUntil` on creation and add expiry checks during exchange - return a specific error when codes are invalidated twice to prevent concurrent reuse - add unit tests covering validity timestamps, expiration, and double invalidation --- Generate by a coding agent with Codex 5.2 --------- Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> (cherry picked from commit f3bdcc5)
The link to authentication sources is now escaped with the QueryEscape. This commit fixes that by unescaping the provider name in the URL. --------- Signed-off-by: prettysunflower <me@prettysunflower.moe> Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> (cherry picked from commit 63db597)
Pick 4 (63db597) introduced url.QueryUnescape() in SignInOAuth but 3-way merge silently dropped the net/url import because that import was added by an unrelated upstream commit between merge-base and the security commit (one of the 343 drift commits identified in .docs/blocker-12-conflict-survey.md). This is the same upstream-evolution-drift class of issue that the design's per-file rule resolves with take-theirs on conflict files; here git did not emit a conflict marker so the rule did not trigger. The fix is mechanical: add the missing import. Equivalent in spirit to take-theirs on the import block. Refs terraphim/gitea#12
…-gitea#12 Pick 2 (aee6628) take-theirs on routers/web/auth/auth.go cascades into transitive upstream symbols (RenderWithErrDeprecated, setting.Config().Instance, buildOIDCEndSessionURL, setting.ReverseProxyLogoutRedirect) absent from our fork. Per-file rule from design v2 is incomplete -- it does not cover transitive symbol dependencies or silent 3-way-merge drift. Picks 1, 4 + drift fix landed cleanly. Picks 2, 3, 5, 6, 7 paused pending design v3 or coordinator decision between options E1-E4. Refs terraphim/gitea#12
…tea#37354) Fixes go-gitea#37316. --------- Signed-off-by: SAY-5 <SAY-5@users.noreply.github.com> Co-authored-by: SAY-5 <SAY-5@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> (cherry picked from commit 6826321)
…Refs go-gitea#12 Consistent with pick 2's E1 resolution. All three picks are blocked by upstream symbol drift requiring prerequisite refactor picks, which violates design v2's explicit constraint. Nosniff (pick 3) confirmed landed. Deferred picks tracked for follow-up issue if surface confirmed in deployment. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three surgical fixes from gitea-reviewer's structural review of the security cherry-pick PR (go-gitea#16). Refs go-gitea#12. 1. routers/web/auth/oauth2_provider.go: log the DB error on the expired-code cleanup path. Previously `_ = authorizationCode.Invalidate(ctx)` silently swallowed every failure, hiding DB degradation. Errors other than the expected ErrOAuth2AuthorizationCodeInvalidated are now logged. 2. models/auth/oauth2.go + models/auth/oauth2_test.go: kill the sub-second timing race in TestOAuth2AuthorizationCodeValidity/GenerateSetsValidUntil. Production code switched from raw `time.Now().Add(...)` to `timeutil.TimeStampNow().AddDuration(...)` so the existing `timeutil.MockSet` test fixture takes effect (matching the pattern used by IsExpired and the Expired sub-test). Test now freezes the clock, eliminating CI flake risk on slow runners. 3. routers/web/auth/oauth.go: malformed percent-encoding in the OAuth provider path param now returns http 400, not http 500. The QueryUnescape error was previously discarded; it now short-circuits with httpError(StatusBadRequest). Verification: go build ./... and go vet pass; targeted tests (`go test -tags sqlite,sqlite_unlock_notify ./models/auth/... ./routers/web/auth/... ./services/oauth2_provider/...`) all green. Refs go-gitea#12
Triage was unconditionally dereferencing ctx.Doer in checkRepoPermissionForTriage and the audit-log calls, which crashed the api with a nil-pointer panic whenever an unauthenticated user hit /api/v1/robot/triage on a public repository. Mirror the pattern already used by Ready and Graph: short-circuit checkRepoPermissionForTriage for anonymous callers (allowed only on public repos) and resolve the audit-log identity to "anonymous(uid=0)" when ctx.Doer is nil. This is the minimum change required to make the integration tests for the robot api pass without crashing the api process. No external behaviour changes for authenticated callers. Refs terraphim/gitea#15
…n on write leg Refs go-gitea#57
…) from task/57-automations-daemon into main
…ction (go-gitea#37706) This PR tightens several OAuth validation paths related to PKCE handling, redirect URI normalization, and refresh-token replay safety. What it changes: - switch redirect URI comparison to ASCII-only normalization for exact-match checks, avoiding Unicode case-folding surprises - harden PKCE verification by: - allowing PKCE omission only when no challenge data was stored - rejecting exchanges with a missing verifier when PKCE was used - rejecting malformed challenge state where a challenge exists without a valid method - comparing derived challenges with constant-time string matching - make refresh-token invalidation counter updates conditional on the previously observed counter value, so stale refresh state cannot be accepted after the grant changes Why: These checks close gaps where: - redirect URI comparisons could rely on broader Unicode normalization than intended - malformed or incomplete PKCE state could be treated too permissively - concurrent or stale refresh-token use could advance the same grant more than once --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com> (cherry picked from commit ae69aec) Refs go-gitea#45
…itea#37704) (cherry picked from commit 7e54514) Refs go-gitea#46
…ount register (go-gitea#37564) (go-gitea#37588) ## Summary Fixes [go-gitea#37564](go-gitea#37564): when an OIDC provider returns a `picture` claim, Gitea is supposed to download that image as the user's avatar (if `[oauth2_client] UPDATE_AVATAR = true`). Two latent bugs prevented this from working consistently: 1. **Default Go User-Agent rejected by some image hosts.** `oauth2UpdateAvatarIfNeed` used `http.Get`, which sends `User-Agent: Go-http-client/1.1`. Hosts like `upload.wikimedia.org` reject that UA with `403`, and every error path silently returned, so the user was left with an identicon and **no log line** to diagnose the issue. 2. **Link-account *register* path skipped avatar sync.** First-time OIDC sign-ins where auto-registration is disabled (or required a username/password retype) go through `LinkAccountPostRegister`, which created the user but never called `oauth2SignInSync`. So the avatar / full name / SSH keys from the IdP were dropped on the floor for those users, even though the existing-account-link path (`oauth2LinkAccount`) and the auto-register path (`handleOAuth2SignIn`) both already did the sync. ## Changes - `routers/web/auth/oauth.go` — `oauth2UpdateAvatarIfNeed` now uses `http.NewRequest` + `http.DefaultClient.Do`, sets `User-Agent: Gitea <version>`, and logs every failure path at `Warn` (invalid URL, fetch error, non-200, body read error, oversize body, upload error). No silent failures. - `routers/web/auth/linkaccount.go` — `LinkAccountPostRegister` now calls `oauth2SignInSync` after a successful user creation, mirroring the auto-register and link-existing-account flows. - `tests/integration/oauth_avatar_test.go` — new `TestOAuth2AvatarFromPicture` integration test with five sub-cases: - `AutoRegister_FetchesAvatarFromPictureWithGiteaUA` — happy path, asserts `use_custom_avatar=true`, an avatar hash is set, exactly one HTTP request was made, and the request carried a `Gitea ` UA. The mock server enforces the UA prefix to mirror real-world hosts that reject Go's default UA. - `AutoRegister_NonOK_DoesNotUpdateAvatar` — server returns 403; user's avatar must remain unset. - `AutoRegister_EmptyPicture_NoFetch` — empty `picture` claim must not trigger any HTTP request. - `AutoRegister_UpdateAvatarFalse_NoFetch` — `UPDATE_AVATAR=false` must not trigger any HTTP request. - `LinkAccountRegister_FetchesAvatarFromPicture` — guards the `linkaccount.go` fix; without the new `oauth2SignInSync` call this assertion fails. ## Related - Upstream issue: go-gitea#37564 -------------------------------------------- AI Editor was used in this PR --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> (cherry picked from commit ef801bb) Refs go-gitea#47
The cherry-pick of ef801bb (go-gitea#37588) applied clean, but its new tests/integration/oauth_avatar_test.go calls createOAuth2MockProvider(), which upstream renamed in a commit this fork has not taken. This fork still has the same helper under its original name, createMockServer(), in tests/integration/oauth_test.go. Without this the integration package fails to build with "undefined: createOAuth2MockProvider". Kept as a separate commit so the cherry-pick itself stays an unmodified application of the upstream change-set. Refs go-gitea#47
…t time (go-gitea#37695) This PR fixes two permission-checking gaps in Git and LFS request handling. ## What it changes - keep wiki Git HTTP pushes on the normal write-permission path, even when proc-receive support is enabled - revalidate LFS bearer token requests against the current user state and current repository permissions before allowing access - add regression coverage for unauthorized wiki HTTP pushes - add LFS tests for blocked users, revoked repository access, read-only upload attempts, and valid write access ## Why - wiki repositories should not inherit the relaxed refs/for handling used for normal code repositories - LFS authorization tokens should not remain usable after a user is disabled or loses repository access Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> (cherry picked from commit f9b7b65) Refs go-gitea#48
The cherry-pick of f9b7b65 (go-gitea#37695) calls access_model.GetDoerRepoPermission when validating an LFS token, which does not exist in this fork. It is NOT a rename of this fork's GetUserRepoPermission. Upstream split the original function into a dispatcher plus GetIndividualUserRepoPermission. This fork's GetUserRepoPermission is byte-identical to upstream's GetIndividualUserRepoPermission and does not resolve Actions task users, so substituting it directly would have silently dropped task-scoped permission resolution on the LFS token path. This adds the dispatcher with upstream's exact logic, using this fork's name for the individual-permission call. It mirrors the inline pattern already used in services/lfs/server.go, routers/web/repo/githttp.go and routers/api/v1/api.go. Refs go-gitea#48
The rewritten tests/integration/wiki_test.go from f9b7b65 (go-gitea#37695) uses gitcmd.StderrContains, which upstream added in a separate commit this fork has not taken. Copied verbatim from upstream, alongside the existing StderrHasPrefix which it mirrors. Refs go-gitea#48
…test (go-gitea#37662) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [mermaid](https://redirect.github.com/mermaid-js/mermaid) | [`11.14.0` → `11.15.0`](https://renovatebot.com/diffs/npm/mermaid/11.14.0/11.15.0) |  |  | --- CSS injection [CVE-2026-41148](https://nvd.nist.gov/vuln/detail/CVE-2026-41148) / [GHSA-xcj9-5m2h-648r](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r) <details> <summary>More information</summary> The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures `classDef` values with an unrestricted regex: ```jison // packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83 <CLASSDEFID>[^\n]* { this.popState(); return 'CLASSDEF_STYLEOPTS' } ``` The value passes unsanitized through `addStyleClass()` -> `createCssStyles()` -> `style.innerHTML` (mermaidAPI.ts:418). A `}` in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page. ``` stateDiagram-v2 classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")} ``` Live demo: <https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU> This has been patched in: - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [e9b0f34d8d82a6260077764ee45e1d7d90957a0f](https://redirect.github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [8fead23c59166b7bab6a39eac81acebee2859102](https://redirect.github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102)) Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`. Enables page defacement, user tracking via `url()` callbacks, and DOM attribute exfiltration via CSS `:has()` selectors. - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r) - [https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102](https://redirect.github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102) - [https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f](https://redirect.github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) - [https://github.com/advisories/GHSA-xcj9-5m2h-648r](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- to HTML injection [CVE-2026-41149](https://nvd.nist.gov/vuln/detail/CVE-2026-41149) / [GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr) <details> <summary>More information</summary> Under the default configuration, Mermaid state diagram's `classDef` allow DOM injection that escapes the SVG, although `<script>` tags are removed, preventing XSS. ``` stateDiagram-v2 classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b [*] --> A:::xss ``` - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [37ff937f1da2e19f882fd1db01235db4d01f4056](https://redirect.github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](https://redirect.github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3)) If you can not update to a patched version, setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`. Thanks to @&go-gitea#8203;zsxsoft from @&go-gitea#8203;KeenSecurityLab for reporting this vulnerability. - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr) - [https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056](https://redirect.github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056) - [https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](https://redirect.github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) - [https://github.com/advisories/GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- injection [CVE-2026-41159](https://nvd.nist.gov/vuln/detail/CVE-2026-41159) / [GHSA-87f9-hvmw-gh4p](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p) <details> <summary>More information</summary> Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the `fontFamily`, `themeCSS`, and `altFontFamily` configuration options. Live demo: [mermaid.live](https://mermaid.live/edit#pako:eNpNjktLxDAUhf9KvFBR6JS-60QQfODKlUvJ5k6TtsEmKTHFGUP-u-mI6Nmdy3fOPR56wwVQSBIvtXSUeAaD0e4ZlZxPDChhcLxFfwiEauOuLq_9Afv30ZpVczpaITS5kGox1qF2gfSeBwYhJAnThAyz-ewntI68vG5-0z3Z7e7IA9OQwmglB-rsKlJQwircLPgNZeAmocTPAi4GXGfHgOkQYwvqN2PUbzJuGSegA84f0a0LRyeeJI4W_xChubCPcbQD2pwbgHo4Aq2aKmvbqq3zoiu7pizqFE6RybN9VFfFY1HWXRVS-Dr_zLObrt7_V_gGGXZlGg) Example code: ``` %%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%% flowchart LR A --> B ``` The injected CSS exploits stylis's `&` (scope reference) handling. `:not(&)` escapes the `#mermaid-xxx` automatic scoping, applying styles to all page elements. Global at-rules (`@font-face`, `@keyframes`, `@counter-style`) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS `:has()` selectors. - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [64769738d5b59211e1decb471ffbaca8afec51aa](https://redirect.github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a9d9f0d8eb790349121508688cd338253fd80d76](https://redirect.github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76)) If you can't upgrade mermaid, you can set the [`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure) config value in the mermaid config to avoid allowing diagrams to modify `fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`. Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will also prevent this. Reported by @&go-gitea#8203;zsxsoft on behalf of @&go-gitea#8203;KeenSecurityLab - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p) - [https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa](https://redirect.github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa) - [https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76](https://redirect.github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://github.com/advisories/GHSA-87f9-hvmw-gh4p](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- [CVE-2026-41150](https://nvd.nist.gov/vuln/detail/CVE-2026-41150) / [GHSA-6m6c-36f7-fhxh](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh) <details> <summary>More information</summary> Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the [`excludes` attribute](https://mermaid.js.org/syntax/gantt.html?#excludes) to exclude all dates. Example: ``` gantt excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday DoS :2025-01-01, 1d ``` `mermaid.parse` is unaffected, unless you then call the `ganttDb.getTasks()` (which is called when rendering a diagram). This has been patched in: - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [faafb5d49106dd32c367f3882505f2dd625aa30e](https://redirect.github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a59ea56174712ee5430dfd5bc877cb5151f501a6](https://redirect.github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6)) There are no workarounds available without updating to a newer version of mermaid. - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh) - [https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6](https://redirect.github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6) - [https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e](https://redirect.github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://github.com/advisories/GHSA-6m6c-36f7-fhxh](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- [CVE-2026-41150](https://nvd.nist.gov/vuln/detail/CVE-2026-41150) / [GHSA-6m6c-36f7-fhxh](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh) <details> <summary>More information</summary> Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the [`excludes` attribute](https://mermaid.js.org/syntax/gantt.html?#excludes) to exclude all dates. Example: ``` gantt excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday DoS :2025-01-01, 1d ``` `mermaid.parse` is unaffected, unless you then call the `ganttDb.getTasks()` (which is called when rendering a diagram). This has been patched in: - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [faafb5d49106dd32c367f3882505f2dd625aa30e](https://redirect.github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a59ea56174712ee5430dfd5bc877cb5151f501a6](https://redirect.github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6)) There are no workarounds available without updating to a newer version of mermaid. - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh) - [https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6](https://redirect.github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6) - [https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e](https://redirect.github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e) - [https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- injection [CVE-2026-41159](https://nvd.nist.gov/vuln/detail/CVE-2026-41159) / [GHSA-87f9-hvmw-gh4p](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p) <details> <summary>More information</summary> Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the `fontFamily`, `themeCSS`, and `altFontFamily` configuration options. Live demo: [mermaid.live](https://mermaid.live/edit#pako:eNpNjktLxDAUhf9KvFBR6JS-60QQfODKlUvJ5k6TtsEmKTHFGUP-u-mI6Nmdy3fOPR56wwVQSBIvtXSUeAaD0e4ZlZxPDChhcLxFfwiEauOuLq_9Afv30ZpVczpaITS5kGox1qF2gfSeBwYhJAnThAyz-ewntI68vG5-0z3Z7e7IA9OQwmglB-rsKlJQwircLPgNZeAmocTPAi4GXGfHgOkQYwvqN2PUbzJuGSegA84f0a0LRyeeJI4W_xChubCPcbQD2pwbgHo4Aq2aKmvbqq3zoiu7pizqFE6RybN9VFfFY1HWXRVS-Dr_zLObrt7_V_gGGXZlGg) Example code: ``` %%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%% flowchart LR A --> B ``` The injected CSS exploits stylis's `&` (scope reference) handling. `:not(&)` escapes the `#mermaid-xxx` automatic scoping, applying styles to all page elements. Global at-rules (`@font-face`, `@keyframes`, `@counter-style`) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS `:has()` selectors. - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [64769738d5b59211e1decb471ffbaca8afec51aa](https://redirect.github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a9d9f0d8eb790349121508688cd338253fd80d76](https://redirect.github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76)) If you can't upgrade mermaid, you can set the [`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure) config value in the mermaid config to avoid allowing diagrams to modify `fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`. Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will also prevent this. Reported by @&go-gitea#8203;zsxsoft on behalf of @&go-gitea#8203;KeenSecurityLab - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p) - [https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa](https://redirect.github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa) - [https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76](https://redirect.github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76) - [https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- to HTML injection [CVE-2026-41149](https://nvd.nist.gov/vuln/detail/CVE-2026-41149) / [GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr) <details> <summary>More information</summary> Under the default configuration, Mermaid state diagram's `classDef` allow DOM injection that escapes the SVG, although `<script>` tags are removed, preventing XSS. ``` stateDiagram-v2 classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b [*] --> A:::xss ``` - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [37ff937f1da2e19f882fd1db01235db4d01f4056](https://redirect.github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](https://redirect.github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3)) If you can not update to a patched version, setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`. Thanks to @&go-gitea#8203;zsxsoft from @&go-gitea#8203;KeenSecurityLab for reporting this vulnerability. - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr) - [https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056](https://redirect.github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056) - [https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](https://redirect.github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3) - [https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-ghcm-xqfw-q4vr) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- CSS injection [CVE-2026-41148](https://nvd.nist.gov/vuln/detail/CVE-2026-41148) / [GHSA-xcj9-5m2h-648r](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r) <details> <summary>More information</summary> The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures `classDef` values with an unrestricted regex: ```jison // packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83 <CLASSDEFID>[^\n]* { this.popState(); return 'CLASSDEF_STYLEOPTS' } ``` The value passes unsanitized through `addStyleClass()` -> `createCssStyles()` -> `style.innerHTML` (mermaidAPI.ts:418). A `}` in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page. ``` stateDiagram-v2 classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")} ``` Live demo: <https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU> This has been patched in: - [v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [e9b0f34d8d82a6260077764ee45e1d7d90957a0f](https://redirect.github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f)) - [v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [8fead23c59166b7bab6a39eac81acebee2859102](https://redirect.github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102)) Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`. Enables page defacement, user tracking via `url()` callbacks, and DOM attribute exfiltration via CSS `:has()` selectors. - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r) - [https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102](https://redirect.github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102) - [https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f](https://redirect.github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f) - [https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xcj9-5m2h-648r) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- <details> <summary>mermaid-js/mermaid (mermaid)</summary> [`v11.15.0`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0) - [#&go-gitea#8203;7174](https://redirect.github.com/mermaid-js/mermaid/pull/7174) [`0aca217`](https://redirect.github.com/mermaid-js/mermaid/commit/0aca21739c0d1fcaaa206e04a6cd574ebc415483) Thanks [@&go-gitea#8203;milesspencer35](https://redirect.github.com/milesspencer35)! - feat(sequence): Add support for decimal start and increment values in the `autonumber` directive - [#&go-gitea#8203;7512](https://redirect.github.com/mermaid-js/mermaid/pull/7512) [`8e17492`](https://redirect.github.com/mermaid-js/mermaid/commit/8e17492f7365ba50896382feb69a23efd9d8a22d) Thanks [@&go-gitea#8203;aruncveli](https://redirect.github.com/aruncveli)! - feat(flowchart): add datastore shape In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with `A@{ shape: datastore, label: "Datastore" }`. - [#&go-gitea#8203;6440](https://redirect.github.com/mermaid-js/mermaid/pull/6440) [`9ad8dde`](https://redirect.github.com/mermaid-js/mermaid/commit/9ad8dde6d049adde85d8ed2d476c09b5820f3f4b) Thanks [@&go-gitea#8203;yordis](https://redirect.github.com/yordis), [@&go-gitea#8203;lgazo](https://redirect.github.com/lgazo)! - feat: add Event Modeling diagram - [#&go-gitea#8203;7707](https://redirect.github.com/mermaid-js/mermaid/pull/7707) [`27db774`](https://redirect.github.com/mermaid-js/mermaid/commit/27db774627be1cee881961dfd0d2cb21cd01b79d) Thanks [@&go-gitea#8203;txmxthy](https://redirect.github.com/txmxthy)! - feat(architecture): expose four fcose layout knobs for `architecture-beta` diagrams (`nodeSeparation`, `idealEdgeLengthMultiplier`, `edgeElasticity`, `numIter`) so authors can tune layout density and spread overlapping siblings without changing diagram source - [#&go-gitea#8203;7604](https://redirect.github.com/mermaid-js/mermaid/pull/7604) [`bf9502f`](https://redirect.github.com/mermaid-js/mermaid/commit/bf9502fb6012a4b724679b401ac928f5ee55161c) Thanks [@&go-gitea#8203;M-a-c](https://redirect.github.com/M-a-c)! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting If you have namespaces in class diagrams that use `.`s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set `class.hierarchicalNamespaces=false` in your mermaid config: ```yaml config: class: hierarchicalNamespaces: false ``` - [#&go-gitea#8203;7272](https://redirect.github.com/mermaid-js/mermaid/pull/7272) [`88cdd3d`](https://redirect.github.com/mermaid-js/mermaid/commit/88cdd3dc0aab9577174561b04e14760c565a232b) Thanks [@&go-gitea#8203;xinbenlv](https://redirect.github.com/xinbenlv)! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors - [#&go-gitea#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737) [`e9b0f34`](https://redirect.github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f) Thanks [@&go-gitea#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix: prevent unbalanced CSS styles in classDefs - [#&go-gitea#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737) [`37ff937`](https://redirect.github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056) Thanks [@&go-gitea#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix: create CSS styles using the CSSOM This removes some invalid CSS and normalizes some CSS formatting. - [#&go-gitea#8203;7508](https://redirect.github.com/mermaid-js/mermaid/pull/7508) [`bfe60cc`](https://redirect.github.com/mermaid-js/mermaid/commit/bfe60cc67b9a6dec64f9161f58e4d24a06c42b65) Thanks [@&go-gitea#8203;biiab](https://redirect.github.com/biiab)! - fix(stateDiagram): `end note` now only closes a note when used on a new line - [#&go-gitea#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737) [`faafb5d`](https://redirect.github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e) Thanks [@&go-gitea#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix(gantt): add iteration limit for `excludes` field - [#&go-gitea#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737) [`65f8be2`](https://redirect.github.com/mermaid-js/mermaid/commit/65f8be2a42faf869b811469571983cba7eeeca99) Thanks [@&go-gitea#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix: disallow some CSS at-rules in custom CSS - [#&go-gitea#8203;7726](https://redirect.github.com/mermaid-js/mermaid/pull/7726) [`1502f32`](https://redirect.github.com/mermaid-js/mermaid/commit/1502f32f3c5fb944925b0c527fbbde3c4f041824) Thanks [@&go-gitea#8203;aloisklink](https://redirect.github.com/aloisklink)! - fix(wardley): fix unnecessary sanitization of text - [#&go-gitea#8203;7578](https://redirect.github.com/mermaid-js/mermaid/pull/7578) [`1f98db8`](https://redirect.github.com/mermaid-js/mermaid/commit/1f98db8e326299ac97a2fa60abfd509d8f5f16e2) Thanks [@&go-gitea#8203;Gaston202](https://redirect.github.com/Gaston202)! - fix(class): self-referential class multiplicity labels no longer rendered multiple times Fixes [#&go-gitea#8203;7560](https://redirect.github.com/mermaid-js/mermaid/issues/7560). Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions. - [#&go-gitea#8203;7592](https://redirect.github.com/mermaid-js/mermaid/pull/7592) [`2343e38`](https://redirect.github.com/mermaid-js/mermaid/commit/2343e38498a3b31f8ce5e79f1f009e0b56fbe086) Thanks [@&go-gitea#8203;knsv-bot](https://redirect.github.com/knsv-bot)! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams - [#&go-gitea#8203;7589](https://redirect.github.com/mermaid-js/mermaid/pull/7589) [`7fb9509`](https://redirect.github.com/mermaid-js/mermaid/commit/7fb9509b8b5cb1dc48519dc60cf6cdc6afba0462) Thanks [@&go-gitea#8203;NYCU-Chung](https://redirect.github.com/NYCU-Chung)! - fix(block): prevent column widths from shrinking when mixing different column spans - [#&go-gitea#8203;7632](https://redirect.github.com/mermaid-js/mermaid/pull/7632) [`3f9e0f1`](https://redirect.github.com/mermaid-js/mermaid/commit/3f9e0f15bedc1e2c71ddb6b34192d1a21124cfc2) Thanks [@&go-gitea#8203;ekiauhce](https://redirect.github.com/ekiauhce)! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams - [#&go-gitea#8203;7642](https://redirect.github.com/mermaid-js/mermaid/pull/7642) [`7a8fb85`](https://redirect.github.com/mermaid-js/mermaid/commit/7a8fb8532c57ecc55b3711454ab0e505a4291445) Thanks [@&go-gitea#8203;tractorjuice](https://redirect.github.com/tractorjuice)! - fix(wardley): allow hyphens in unquoted component names Multi-word names containing hyphens — e.g. `real-time processing`, `end-user`, `on-call engineer` — now parse without quoting, bringing the grammar in line with the OnlineWardleyMaps (OWM) convention. `A->B` (no-space arrow) still tokenises correctly. - [#&go-gitea#8203;7523](https://redirect.github.com/mermaid-js/mermaid/pull/7523) [`5144ed4`](https://redirect.github.com/mermaid-js/mermaid/commit/5144ed4b138ae0f4836bab4c163c575e0a767dd3) Thanks [@&go-gitea#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix(block): Arrow blocks in block-beta diagrams not spanning the specified number of columns when using `:n` syntax. - [#&go-gitea#8203;7262](https://redirect.github.com/mermaid-js/mermaid/pull/7262) [`13d9bfa`](https://redirect.github.com/mermaid-js/mermaid/commit/13d9bfa4748e845a9eec7d6265ba496d2278f26e) Thanks [@&go-gitea#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix(block): Ensure block diagram hexagon blocks respect column spanning syntax - [#&go-gitea#8203;7684](https://redirect.github.com/mermaid-js/mermaid/pull/7684) [`e14bb88`](https://redirect.github.com/mermaid-js/mermaid/commit/e14bb88bdb940124cdb0a107025653bf93745c99) Thanks [@&go-gitea#8203;aloisklink](https://redirect.github.com/aloisklink)! - fix: loosen `uuid` dependency range to allow v14 Mermaid does not use any of the vulnerable code in CVE-2026-41907, but this allows users to silence any `npm audit` alerts on it. - [#&go-gitea#8203;7633](https://redirect.github.com/mermaid-js/mermaid/pull/7633) [`9217c0d`](https://redirect.github.com/mermaid-js/mermaid/commit/9217c0d8b221b423af80e420b7adae901acf6c8c) Thanks [@&go-gitea#8203;Felix-Garci](https://redirect.github.com/Felix-Garci)! - fix(block): add support for all arrow types in block diagrams - [#&go-gitea#8203;7587](https://redirect.github.com/mermaid-js/mermaid/pull/7587) [`5e7eb62`](https://redirect.github.com/mermaid-js/mermaid/commit/5e7eb62e3aba6b5df559f5c839a868e5b7f40e72) Thanks [@&go-gitea#8203;MaddyGuthridge](https://redirect.github.com/MaddyGuthridge)! - chore: drop lodash-es in favour of es-toolkit - [#&go-gitea#8203;7693](https://redirect.github.com/mermaid-js/mermaid/pull/7693) [`afaf306`](https://redirect.github.com/mermaid-js/mermaid/commit/afaf3062381d115d66744413151b642f124dd9ba) Thanks [@&go-gitea#8203;dull-bird](https://redirect.github.com/dull-bird)! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Previously the lexer only matched ASCII `[A-Za-z]+` for text tokens, even though the grammar referenced `UNICODE_TEXT`. Bare Chinese, Japanese, Korean, emoji, and accented Latin characters in labels caused a parse error. Added a `[^\x00-\x7F]+` lexer rule to emit `UNICODE_TEXT` and included it in the `alphaNumToken` grammar rule. Fixes [#&go-gitea#8203;7120](https://redirect.github.com/mermaid-js/mermaid/issues/7120). - [#&go-gitea#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737) [`4755553`](https://redirect.github.com/mermaid-js/mermaid/commit/4755553d5fb6d1217809e43ffb8fc54d6a73e482) Thanks [@&go-gitea#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix: improve D3 types for mermaidAPI funcs - [#&go-gitea#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737) [`6476973`](https://redirect.github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa) Thanks [@&go-gitea#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix: handle `&` when namespacing CSS rules - [#&go-gitea#8203;7520](https://redirect.github.com/mermaid-js/mermaid/pull/7520) [`8c1a0c1`](https://redirect.github.com/mermaid-js/mermaid/commit/8c1a0c1fd19587c6772d6966fe9d217e5cd1356c) Thanks [@&go-gitea#8203;RodrigojndSantos](https://redirect.github.com/RodrigojndSantos)! - fix(stateDiagram): comments starting with one `%` are no longer treated as comments Switch to using two `%%` if you want to write a comment. - Updated dependencies \[[`7a8fb85`](https://redirect.github.com/mermaid-js/mermaid/commit/7a8fb8532c57ecc55b3711454ab0e505a4291445), [`675a64c`](https://redirect.github.com/mermaid-js/mermaid/commit/675a64ca0e3cde8728ca715991623c3fc055ce88)]: - [@&go-gitea#8203;mermaid-js/parser](https://redirect.github.com/mermaid-js/parser)@​1.1.1 </details> --- 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> (cherry picked from commit 6a27066) Refs go-gitea#49
The mermaid e2e test from 6a27066 (go-gitea#37662) imports randomString, apiCreateIssue and assertNoJsError from tests/e2e/utils.ts. This fork has none of them; they arrived upstream in commits not taken here. randomString and assertNoJsError are copied verbatim from upstream. apiCreateIssue is adapted rather than copied. Upstream's version calls baseUrl() and a single-argument apiRetry(); this fork has apiBaseUrl() and a two-argument apiRetry(fn, label) that returns void rather than the response. The adaptation captures the issue index through the closure and leaves apiRetry untouched, so its three existing call sites are unaffected. Placed in utils.ts rather than inline in the test because apiRetry is not exported. Refs go-gitea#49
The avatar warning paths redact avatarURL, because the logger applies protectSensitiveInfo to string arguments. The accompanying error value is not a string, so it is formatted verbatim, and url.Error embeds the whole request URL including any signed query parameters. The redaction the upstream pick added was therefore incomplete on exactly the paths it was added for. avatarErrForLog unwraps url.Error and logs the underlying cause, which still identifies the failure (dial error, timeout) without the URL. Applied to the request-construction, fetch and body-read paths; the upload path takes no URL. This is a deliberate fork-side hardening beyond upstream ef801bb (go-gitea#37588), raised as a P1 by the independent gpt-5.5 structural review on PR go-gitea#66. The test drives a real request against a closed port rather than a mock, and asserts the raw error does leak the secret before asserting the sanitised one does not, so it cannot pass vacuously. Refs go-gitea#47
…y] (go-gitea#37662)' (go-gitea#68) from task/49-mermaid-11-15-0 into main
…e token enforcement (go-gitea#37695)' (go-gitea#67) from task/48-wiki-lfs-token-enforcement into main
… replay (go-gitea#37706)' (go-gitea#64) from task/45-oauth-pkce-replay into main
… client bind (go-gitea#37704)' (go-gitea#65) from task/46-oauth-token-exchange-bind into main
…nk-account sync (go-gitea#37588)' (go-gitea#66) from task/47-avatar-ua-link-account into main
Pick/defer/reject decisions for the eight feature commits flagged in go-gitea#43, with conflict surface measured by in-memory three-way merge against current main, value assessed against this fork's Actions/ADF usage, and the robot-token audit issue go-gitea#50 requires for F4. Accepted F7, F5, F6 (Actions operational capability). Deferred F1, F8 and F4. Rejected F2, F3. Two findings outweigh the individual verdicts: F5 has a hard dependency on F7, so its measured conflicts are an artefact of picking order; and upstream migrations collide with this fork's own, since fork migrations 327 and 328 are occupied by ADF features while F6 wants 327 and F4 wants 328. The F4 audit is included even though F4 is not accepted, because the issue requires it as a deliverable in its own right. Refs go-gitea#50
This PR adds official REST API endpoints to rerun Gitea Actions workflow
runs and individual jobs:
* POST /api/v1/repos/{owner}/{repo}/actions/runs/{run}/rerun
* POST /api/v1/repos/{owner}/{repo}/actions/runs/{run}/jobs/{job_id}/rerun
It reuses the existing rerun behavior from the web UI and exposes it
through stable API routes.
---------
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
(cherry picked from commit 054eb6d)
Refs go-gitea#69
This PR adds per-runner disable/enable support for Gitea Actions so a registered runner can be paused from picking up new jobs without unregistering. Disabled runners stay registered and online but are excluded from new task assignment; running tasks are allowed to finish. Re-enabling restores pickup, and runner list/get responses now expose disabled state. Also added an endpoint for testing http://localhost:3000/devtest/runner-edit/enable <img width="1509" height="701" alt="Bildschirmfoto 2026-02-27 um 22 13 24" src="https://github.com/user-attachments/assets/5328eda9-e59c-46b6-b398-f436e50ee3da" /> Fixes: go-gitea#36767 (cherry picked from commit b3b2d11) Conflict resolution (4 files): - models/migrations/v1_26/v327.go and v327_test.go: add/add collision. This fork's 327 (AddAgentIdentity) is kept untouched -- it is applied in production. Upstream's migration content moves verbatim to v329.go and v329_test.go. - models/migrations/migrations.go: kept this fork's 326/327/328 entries and appended the incoming migration as 329. Upstream's side also carried a different migration 326 (FixCommitStatusTargetURLToUseRunAndJobID) that this commit does not add; that is pre-existing upstream context this fork has not taken, and was not pulled in. - routers/api/v1/api.go: kept this fork's runner group, which uses reqChecker rather than upstream's renamed reqOwnerCheck, retains the fork-only GET /registration-token, and keeps reqHumanAuth() on both registration-token routes. Added only the new PATCH route this commit introduces. It carries no reqHumanAuth(), consistent with upstream and with this fork's own DeleteRunner: reqHumanAuth guards credential minting here, not runner lifecycle. Refs go-gitea#71
…dpoints (go-gitea#36768)' (go-gitea#73) from task/69-actions-rerun-api into main
Fixes go-gitea#35997 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> (cherry picked from commit b22123e) Conflict resolution (2 conflicts; 6 before F7 landed): - routers/web/repo/actions/view.go: F5 factors the run-done and workflow-disabled guards into checkRunRerunAllowed, which merged cleanly, so the explicit workflow-disabled block in the conflicting hunk became a duplicate of a check already made two lines above and was dropped. Kept this fork's index-based addressing (getRunIndex, jobIndexHas, jobIndex plus its bounds check) rather than upstream's getRunID/getRunJobsAndCurrentJob, which do not exist here, and produced jobsToRerun for F5's new four-argument RerunWorkflowRunJobs. GetAllRerunJobs(jobs[jobIndex], jobs) is behaviour-preserving: F7's five-argument version already computed dependents with the same call. - web_src/js/components/RepoActionView.vue: took F5's split rerun button and dropped upstream's surrounding wrapper and workflow-graph toggle, which belong to F8 (go-gitea#36248, deferred in go-gitea#50). showWorkflowGraph and locale.workflowGraph have no support in this fork and would not render. Adapted beyond the conflicts: - RerunFailed arrived without conflict but called getRunID and getRunJobsAndCurrentJob, neither of which exists here, so the package did not build. Rewritten to mirror Rerun's existing shape. The route is registered under /runs/{run} alongside Rerun, so index addressing is correct for it. Refs go-gitea#70
The runner list template added by the cherry-pick renders disabled runners
with {{ctx.Locale.Tr "actions.runners.disabled"}}, but neither upstream
b3b2d11 nor upstream's tree at that commit defines that key. Gitea's
TrString falls back to html.EscapeString(trKey) when a key is absent, so
the list page showed the literal text "actions.runners.disabled" in place
of a label.
This is an upstream defect carried faithfully by the pick, not a conflict
resolution error: the template hunk here is byte-identical to upstream's,
and upstream's own runner_edit.tmpl renders the same state via the
top-level "disabled" key, which does exist.
The fix is fork-side and additive: add the runner-scoped key with the same
value as the existing top-level "disabled". The template is left untouched
so the pick keeps its byte-identity with upstream and converges with
whatever upstream does when it fixes this.
en-US only, matching the scope of upstream's own locale hunk.
Refs go-gitea#71
…ause (go-gitea#36776)' (go-gitea#74) from task/71-runner-disable-pause into main
Upstream b22123e returns nil from RerunWorkflowRunJobs as soon as the job set is empty, before any validation runs. GetFailedRerunJobs is legitimately empty whenever nothing has failed, so the rerun-failed-jobs endpoint answered 201 Created without checking run.Status.IsDone() or whether the workflow is disabled — reporting success for a rerun it never validated or performed. Validation is now separate from mutation: - validateRunRerun holds the two guards and touches nothing. prepareRunRerun calls it first, so behaviour for a non-empty job set is unchanged. - RerunWorkflowRunJobs validates before the empty check, then returns ErrNoJobsToRerun rather than nil. The guards deliberately are not enforced by calling prepareRunRerun earlier: that function resets the run to Waiting and fires a notification, so a run with nothing to rerun would be left waiting for work that never comes. ErrNoJobsToRerun wraps util.ErrInvalidArgument, so handleWorkflowRerunError maps it to 400 with no new plumbing. On the web side, handleRerunError keeps this out of ctx.ServerError: a run with nothing to rerun is a user-level condition, not a 500 on a button click. This diverges from upstream, which the API and service code otherwise match byte for byte. Raised by independent review of PR go-gitea#75. Tests, both with negative controls confirming they reproduce the defect when the upstream ordering is restored: - services/actions: still-running run and completed run, each with zero failed jobs, assert the error and that the run is not mutated. - tests/integration: TestAPIActionsRerunFailedWorkflowRun, the first coverage of this endpoint. Without the fix the two empty-set cases return 201 instead of 400. Refs go-gitea#70
…s button (go-gitea#36924)' (go-gitea#75) from task/70-rerun-failed-jobs-ui into main
… F1-F8' (go-gitea#72) from task/50-feature-triage into main
…63d15 from terraphim/gitea) CVE-2025-60005: action_task row exists but underlying dbfs/storage blob is gone, OpenLogs returns a wrapped os.ErrNotExist which surfaced as a 500 on the job logs endpoints. Translate it to util.NewNotExistErrorf shape so both API and web download handlers return 404. Upstream PR: go-gitea#38003 (authored by bircni, 2026-06-05) Fork commit: aa63d15 in https://git.terraphim.cloud/terraphim/gitea.git Applied to: gitea-src HEAD 58bd852 (buildable source for 1.26.3-dev-cve6000X images) Method: git apply --3way, single-file 5-line insertion in routers/common/actions.go Refs: terraphim/gitea#102, terraphim/gitea#103, terraphim/gitea#96
…GAP-5) The upstream default of 10 minutes for ZOMBIE_TASK_TIMEOUT is too aggressive for terraphim workflows. The terraphim/clients native-ci workflow takes 12-14 minutes, and the StopZombieTasks cron sweep (every 5 minutes) was prematurely marking these tasks as failed while the runner was still actively executing - causing every long workflow to report conclusion: failure even when the runner-side journal correctly reported success=true. This commit raises the fork default to 60 minutes (4-5x headroom over the longest observed workflow), preserves the zombie-safety-net (90min+ tasks still get marked failure), and adds regression tests covering both sides of the threshold. Files changed: - modules/setting/actions.go: change default to 60min with explanatory comment - custom/conf/app.example.ini: document the choice and reference the issue - modules/setting/actions_test.go: add default-value regression test - services/actions/clear_tasks_test.go: add threshold integration tests Closes GAP-5 in terraphim/gitea#116. Refs: terraphim/gitea#116 Refs: terraphim/terraphim-clients native-ci workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fork-local change in the terraphim/gitea fork.
The upstream default of 10 minutes for
ZOMBIE_TASK_TIMEOUTis too aggressive for terraphim workflows. The terraphim/clients native-ci workflow takes 12-14 minutes, and theStopZombieTaskscron sweep (every 5 minutes) was prematurely marking these tasks as failed while the runner was still actively executing — causing every long workflow to reportconclusion: failureeven when the runner-side journal correctly reportedsuccess=true.This commit raises the fork default to 60 minutes (4-5x headroom over the longest observed workflow), preserves the zombie-safety-net (90min+ tasks still get marked failure), and adds regression tests covering both sides of the threshold.
Files changed
modules/setting/actions.go— default to 60min with explanatory commentcustom/conf/app.example.ini— document the choice and reference the issuemodules/setting/actions_test.go— default-value regression testservices/actions/clear_tasks_test.go— threshold integration testsVerification
git.terraphim.cloud/terraphim/gitea:1.26.3-dev-cve60005-gap5-da7c77b37deployedTracking
Notes
state: nullbug) tracked separately.