feat: update gitea vendor

package/gitea/source/modules/turnstile/turnstile.go

@@ -11,10 +11,21 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
+// httpClient returns an HTTP client that honors Gitea's proxy configuration.
+var httpClient = util.OnceValue[*http.Client]{
+	Func: func() *http.Client {
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.Proxy = proxy.Proxy()
+		return &http.Client{Transport: transport}
+	},
+}
+
 // Response is the structure of JSON returned from API
 type Response struct {
 	Success     bool        `json:"success"`
@@ -40,7 +51,7 @@ func Verify(ctx context.Context, response string) (bool, error) {
 	}
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := httpClient.Value().Do(req)
 	if err != nil {
 		return false, fmt.Errorf("Failed to send CAPTCHA response: %w", err)
 	}

package/gitea/source/modules/turnstile/turnstile_test.go

@@ -0,0 +1,38 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package turnstile
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTPClientHonorsProxy(t *testing.T) {
+	proxyURL, err := url.Parse("http://proxy.example.com:3128")
+	require.NoError(t, err)
+
+	defer test.MockVariableValue(&setting.Proxy.Enabled, true)()
+	defer test.MockVariableValue(&setting.Proxy.ProxyURL, proxyURL.String())()
+	defer test.MockVariableValue(&setting.Proxy.ProxyURLFixed, proxyURL)()
+	defer test.MockVariableValue(&setting.Proxy.ProxyHosts, []string{"**"})()
+	httpClient.Reset()
+	transport, ok := httpClient.Value().Transport.(*http.Transport)
+	require.True(t, ok)
+	require.NotNil(t, transport.Proxy)
+
+	// The Turnstile verification request must be routed through the configured proxy.
+	req := httptest.NewRequest(http.MethodPost, "https://any.example.com", nil)
+	got, err := transport.Proxy(req)
+	require.NoError(t, err)
+	require.NotNil(t, got)
+	assert.Equal(t, proxyURL.String(), got.String())
+}