feat: update gitea vendor

package/gitea/source/services/packages/alpine/repository.go

@@ -20,15 +20,15 @@ import (
 	"io"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	alpine_model "code.gitea.io/gitea/models/packages/alpine"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	alpine_module "code.gitea.io/gitea/modules/packages/alpine"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	alpine_model "gitea.dev/models/packages/alpine"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	alpine_module "gitea.dev/modules/packages/alpine"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 )
 
 const (

package/gitea/source/services/packages/arch/repository.go

@@ -13,19 +13,20 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"slices"
 	"strconv"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	arch_model "code.gitea.io/gitea/models/packages/arch"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	arch_module "code.gitea.io/gitea/modules/packages/arch"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	arch_model "gitea.dev/models/packages/arch"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	arch_module "gitea.dev/modules/packages/arch"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
@@ -360,9 +361,16 @@ type keyValue struct {
 	Value string
 }
 
+// pacman parses the index line by line, so a value with a newline could forge extra fields
+func joinFields(values []string) string {
+	return strings.Join(slices.DeleteFunc(slices.Clone(values), func(value string) bool {
+		return strings.ContainsAny(value, "\n\r")
+	}), "\n")
+}
+
 func writeFiles(tw *tar.Writer, opts *entryOptions) error {
 	return writeFields(tw, fmt.Sprintf("%s-%s/files", opts.Package.Name, opts.Version.Version), []keyValue{
-		{"FILES", strings.Join(opts.FileMetadata.Files, "\n")},
+		{"FILES", joinFields(opts.FileMetadata.Files)},
 	})
 }
 
@@ -381,17 +389,17 @@ func writeDescription(tw *tar.Writer, opts *entryOptions) error {
 		{"VERSION", opts.Version.Version},
 		{"DESC", opts.VersionMetadata.Description},
 		{"URL", opts.VersionMetadata.ProjectURL},
-		{"LICENSE", strings.Join(opts.VersionMetadata.Licenses, "\n")},
-		{"GROUPS", strings.Join(opts.FileMetadata.Groups, "\n")},
+		{"LICENSE", joinFields(opts.VersionMetadata.Licenses)},
+		{"GROUPS", joinFields(opts.FileMetadata.Groups)},
 		{"BUILDDATE", strconv.FormatInt(opts.FileMetadata.BuildDate, 10)},
 		{"PACKAGER", opts.FileMetadata.Packager},
-		{"PROVIDES", strings.Join(opts.FileMetadata.Provides, "\n")},
-		{"REPLACES", strings.Join(opts.FileMetadata.Replaces, "\n")},
-		{"CONFLICTS", strings.Join(opts.FileMetadata.Conflicts, "\n")},
-		{"DEPENDS", strings.Join(opts.FileMetadata.Depends, "\n")},
-		{"OPTDEPENDS", strings.Join(opts.FileMetadata.OptDepends, "\n")},
-		{"MAKEDEPENDS", strings.Join(opts.FileMetadata.MakeDepends, "\n")},
-		{"CHECKDEPENDS", strings.Join(opts.FileMetadata.CheckDepends, "\n")},
+		{"PROVIDES", joinFields(opts.FileMetadata.Provides)},
+		{"REPLACES", joinFields(opts.FileMetadata.Replaces)},
+		{"CONFLICTS", joinFields(opts.FileMetadata.Conflicts)},
+		{"DEPENDS", joinFields(opts.FileMetadata.Depends)},
+		{"OPTDEPENDS", joinFields(opts.FileMetadata.OptDepends)},
+		{"MAKEDEPENDS", joinFields(opts.FileMetadata.MakeDepends)},
+		{"CHECKDEPENDS", joinFields(opts.FileMetadata.CheckDepends)},
 	})
 }
 

package/gitea/source/services/packages/arch/repository_test.go

@@ -0,0 +1,17 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package arch
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestJoinFields(t *testing.T) {
+	values := []string{"usr/bin/a", "usr/bin/b\n\n%FILES%\netc/cron.d/x", "usr/bin/c"}
+
+	assert.Equal(t, "usr/bin/a\nusr/bin/c", joinFields(values))
+	assert.Len(t, values, 3) // must not modify the caller's slice
+}

package/gitea/source/services/packages/auth.go

@@ -10,10 +10,10 @@ import (
 	"strings"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/golang-jwt/jwt/v5"
 )

package/gitea/source/services/packages/cargo/index.go

@@ -12,17 +12,17 @@ import (
 	"path"
 	"strconv"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	cargo_module "code.gitea.io/gitea/modules/packages/cargo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	repo_service "code.gitea.io/gitea/services/repository"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	cargo_module "gitea.dev/modules/packages/cargo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
+	files_service "gitea.dev/services/repository/files"
 )
 
 const (

package/gitea/source/services/packages/cleanup/cleanup.go

@@ -8,19 +8,19 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	packages_service "code.gitea.io/gitea/services/packages"
-	alpine_service "code.gitea.io/gitea/services/packages/alpine"
-	arch_service "code.gitea.io/gitea/services/packages/arch"
-	cargo_service "code.gitea.io/gitea/services/packages/cargo"
-	container_service "code.gitea.io/gitea/services/packages/container"
-	debian_service "code.gitea.io/gitea/services/packages/debian"
-	rpm_service "code.gitea.io/gitea/services/packages/rpm"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	packages_service "gitea.dev/services/packages"
+	alpine_service "gitea.dev/services/packages/alpine"
+	arch_service "gitea.dev/services/packages/arch"
+	cargo_service "gitea.dev/services/packages/cargo"
+	container_service "gitea.dev/services/packages/container"
+	debian_service "gitea.dev/services/packages/debian"
+	rpm_service "gitea.dev/services/packages/rpm"
 )
 
 // CleanupTask executes cleanup rules and cleanup expired package data

package/gitea/source/services/packages/container/blob_uploader.go

@@ -9,10 +9,10 @@ import (
 	"io"
 	"os"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/tempdir"
+	packages_model "gitea.dev/models/packages"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/tempdir"
 )
 
 var (

package/gitea/source/services/packages/container/cleanup.go

@@ -7,11 +7,11 @@ import (
 	"context"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_model "code.gitea.io/gitea/models/packages/container"
-	"code.gitea.io/gitea/modules/optional"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	container_model "gitea.dev/models/packages/container"
+	"gitea.dev/modules/optional"
+	container_module "gitea.dev/modules/packages/container"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/opencontainers/go-digest"
 )

package/gitea/source/services/packages/container/common.go

@@ -8,12 +8,12 @@ import (
 	"io"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_service "code.gitea.io/gitea/models/packages/container"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/packages"
-	container_module "code.gitea.io/gitea/modules/packages/container"
+	packages_model "gitea.dev/models/packages"
+	container_service "gitea.dev/models/packages/container"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/packages"
+	container_module "gitea.dev/modules/packages/container"
 
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 )

package/gitea/source/services/packages/debian/repository.go

@@ -15,14 +15,14 @@ import (
 	"strings"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	debian_model "code.gitea.io/gitea/models/packages/debian"
-	user_model "code.gitea.io/gitea/models/user"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	debian_module "code.gitea.io/gitea/modules/packages/debian"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	debian_model "gitea.dev/models/packages/debian"
+	user_model "gitea.dev/models/user"
+	packages_module "gitea.dev/modules/packages"
+	debian_module "gitea.dev/modules/packages/debian"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"

package/gitea/source/services/packages/package_update.go

@@ -7,13 +7,13 @@ import (
 	"context"
 	"fmt"
 
-	org_model "code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	org_model "gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 )
 
 func LinkToRepository(ctx context.Context, pkg *packages_model.Package, repo *repo_model.Repository, doer *user_model.User) error {

package/gitea/source/services/packages/packages.go

@@ -13,18 +13,18 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	notify_service "gitea.dev/services/notify"
 )
 
 var (

package/gitea/source/services/packages/pkgspec/manager.go

@@ -4,9 +4,9 @@
 package pkgspec
 
 import (
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_service "code.gitea.io/gitea/services/packages"
-	"code.gitea.io/gitea/services/packages/terraform"
+	packages_model "gitea.dev/models/packages"
+	packages_service "gitea.dev/services/packages"
+	"gitea.dev/services/packages/terraform"
 )
 
 func InitManager() error {

package/gitea/source/services/packages/rpm/repository.go

@@ -17,14 +17,14 @@ import (
 	"strings"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	rpm_model "code.gitea.io/gitea/models/packages/rpm"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	rpm_module "code.gitea.io/gitea/modules/packages/rpm"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	rpm_model "gitea.dev/models/packages/rpm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	rpm_module "gitea.dev/modules/packages/rpm"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"

package/gitea/source/services/packages/rpm/sign.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"strings"
 
-	packages_module "code.gitea.io/gitea/modules/packages"
+	packages_module "gitea.dev/modules/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/sassoftware/go-rpmutils"

package/gitea/source/services/packages/spec.go

@@ -7,8 +7,8 @@ import (
 	"context"
 	"sync"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
+	packages_model "gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
 )
 
 type nop struct{}

package/gitea/source/services/packages/terraform/spec.go

@@ -6,12 +6,12 @@ package terraform
 import (
 	"context"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	terraform_module "gitea.dev/modules/packages/terraform"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 )
 
 type Specialization struct{}

package/gitea/source/services/packages/terraform/state.go

@@ -6,9 +6,9 @@ package terraform
 import (
 	"context"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/optional"
-	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/optional"
+	terraform_module "gitea.dev/modules/packages/terraform"
 )
 
 // IsLocked is a helper function to check if the terraform state is locked