feat: update gitea vendor

package/gitea/source/modules/private/actions.go

@@ -6,7 +6,7 @@ package private
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 type GenerateTokenRequest struct {

package/gitea/source/modules/private/hook.go

@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"net/url"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
 )
 
 // Git environment variables
@@ -48,9 +48,7 @@ type SSHLogOption struct {
 
 // HookPostReceiveResult represents an individual result from PostReceive
 type HookPostReceiveResult struct {
-	Results      []HookPostReceiveBranchResult
-	RepoWasEmpty bool
-	Err          string
+	Results []HookPostReceiveBranchResult
 }
 
 // HookPostReceiveBranchResult represents an individual branch result from PostReceive
@@ -111,18 +109,6 @@ func HookProcReceive(ctx context.Context, ownerName, repoName string, opts HookO
 	return requestJSONResp(req, &HookProcReceiveResult{})
 }
 
-// SetDefaultBranch will set the default branch to the provided branch for the provided repository
-func SetDefaultBranch(ctx context.Context, ownerName, repoName, branch string) ResponseExtra {
-	reqURL := setting.LocalURL + fmt.Sprintf("api/internal/hook/set-default-branch/%s/%s/%s",
-		url.PathEscape(ownerName),
-		url.PathEscape(repoName),
-		url.PathEscape(branch),
-	)
-	req := newInternalRequestAPI(ctx, reqURL, "POST")
-	_, extra := requestJSONResp(req, &ResponseText{})
-	return extra
-}
-
 // SSHLog sends ssh error log response
 func SSHLog(ctx context.Context, isErr bool, msg string) error {
 	reqURL := setting.LocalURL + "api/internal/ssh/log"

package/gitea/source/modules/private/internal.go

@@ -8,16 +8,17 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"strings"
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/proxyprotocol"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/proxyprotocol"
+	"gitea.dev/modules/setting"
 )
 
 // Response is used for internal request response (for user message and error message)
@@ -53,12 +54,37 @@ func dialContextInternalAPI(ctx context.Context, network, address string) (conn
 	return conn, nil
 }
 
+// internalAPIConnectionIsLocal reports whether the internal API transport connects to a local target,
+// where the self-signed local certificate cannot be verified so skipping verification is safe. It mirrors
+// what dialContextInternalAPI actually dials: a unix socket whenever Protocol is HTTPUnix (always local,
+// whatever LOCAL_ROOT_URL says), otherwise the LOCAL_ROOT_URL host directly. A non-loopback LOCAL_ROOT_URL
+// is a real network hop, so its certificate must be verified, else the internal token can be MITM'd. An
+// unparseable LOCAL_ROOT_URL is a hard misconfiguration and fails closed (verify).
+func internalAPIConnectionIsLocal(protocol setting.Scheme, localURL string) bool {
+	if protocol == setting.HTTPUnix {
+		return true
+	}
+	u, err := url.Parse(localURL)
+	if err != nil {
+		return false
+	}
+	host := u.Hostname()
+	if host == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}
+
 var internalAPITransport = sync.OnceValue(func() http.RoundTripper {
 	return &http.Transport{
 		DialContext: dialContextInternalAPI,
 		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: true,
-			ServerName:         setting.Domain,
+			// Skip verification only for a local target (unix socket, or a loopback LOCAL_ROOT_URL), where the
+			// self-signed local cert can't be verified anyway; a non-loopback LOCAL_ROOT_URL is a real network
+			// hop and must be verified so the internal token can't be MITM'd. When verifying, Go's default
+			// ServerName (the dialed LOCAL_ROOT_URL host) is already correct, so it is not overridden.
+			InsecureSkipVerify: internalAPIConnectionIsLocal(setting.Protocol, setting.LocalURL),
 		},
 	}
 })

package/gitea/source/modules/private/internal_test.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package private
+
+import (
+	"testing"
+
+	"gitea.dev/modules/setting"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestInternalAPIConnectionIsLocal(t *testing.T) {
+	cases := []struct {
+		name     string
+		protocol setting.Scheme
+		localURL string
+		want     bool
+	}{
+		// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
+		{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
+		{"localhost", setting.HTTP, "http://localhost:3000/", true},
+		{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
+		{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
+		// a non-loopback LOCAL_ROOT_URL is a real network hop and must be verified
+		{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
+		{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
+		// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
+		{"invalid url", setting.HTTPS, "://bad", false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, internalAPIConnectionIsLocal(c.protocol, c.localURL))
+		})
+	}
+}

package/gitea/source/modules/private/key.go

@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // UpdatePublicKeyInRepo update public key and if necessary deploy key updates

package/gitea/source/modules/private/mail.go

@@ -6,7 +6,7 @@ package private
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // Email structure holds a data for sending general emails

package/gitea/source/modules/private/manager.go

@@ -12,7 +12,7 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // Shutdown calls the internal shutdown function
@@ -88,25 +88,6 @@ type LoggerOptions struct {
 	Config map[string]any
 }
 
-// AddLogger adds a logger
-func AddLogger(ctx context.Context, logger, writer, mode string, config map[string]any) ResponseExtra {
-	reqURL := setting.LocalURL + "api/internal/manager/add-logger"
-	req := newInternalRequestAPI(ctx, reqURL, "POST", LoggerOptions{
-		Logger: logger,
-		Writer: writer,
-		Mode:   mode,
-		Config: config,
-	})
-	return requestJSONClientMsg(req, "Added")
-}
-
-// RemoveLogger removes a logger
-func RemoveLogger(ctx context.Context, logger, writer string) ResponseExtra {
-	reqURL := setting.LocalURL + fmt.Sprintf("api/internal/manager/remove-logger/%s/%s", url.PathEscape(logger), url.PathEscape(writer))
-	req := newInternalRequestAPI(ctx, reqURL, "POST")
-	return requestJSONClientMsg(req, "Removed")
-}
-
 // Processes return the current processes from this gitea instance
 func Processes(ctx context.Context, out io.Writer, flat, noSystem, stacktraces, json bool, cancel string) ResponseExtra {
 	reqURL := setting.LocalURL + fmt.Sprintf("api/internal/manager/processes?flat=%t&no-system=%t&stacktraces=%t&json=%t&cancel-pid=%s", flat, noSystem, stacktraces, json, url.QueryEscape(cancel))

package/gitea/source/modules/private/pushoptions.go

@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 )
 
 // GitPushOptions is a wrapper around a map[string]string

package/gitea/source/modules/private/request.go

@@ -8,8 +8,8 @@ import (
 	"io"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
 )
 
 // ResponseText is used to get the response as text, instead of parsing it as JSON.

package/gitea/source/modules/private/restore_repo.go

@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // RestoreParams structure holds a data for restore repository

package/gitea/source/modules/private/serv.go

@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"net/url"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/perm"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/perm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 )
 
 // KeyAndOwner is the response from ServNoCommand