feat: update gitea vendor

package/gitea/source/services/packages/arch/repository.go

@@ -13,19 +13,20 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"slices"
 	"strconv"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	arch_model "code.gitea.io/gitea/models/packages/arch"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	arch_module "code.gitea.io/gitea/modules/packages/arch"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	arch_model "gitea.dev/models/packages/arch"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	arch_module "gitea.dev/modules/packages/arch"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
@@ -360,9 +361,16 @@ type keyValue struct {
 	Value string
 }
 
+// pacman parses the index line by line, so a value with a newline could forge extra fields
+func joinFields(values []string) string {
+	return strings.Join(slices.DeleteFunc(slices.Clone(values), func(value string) bool {
+		return strings.ContainsAny(value, "\n\r")
+	}), "\n")
+}
+
 func writeFiles(tw *tar.Writer, opts *entryOptions) error {
 	return writeFields(tw, fmt.Sprintf("%s-%s/files", opts.Package.Name, opts.Version.Version), []keyValue{
-		{"FILES", strings.Join(opts.FileMetadata.Files, "\n")},
+		{"FILES", joinFields(opts.FileMetadata.Files)},
 	})
 }
 
@@ -381,17 +389,17 @@ func writeDescription(tw *tar.Writer, opts *entryOptions) error {
 		{"VERSION", opts.Version.Version},
 		{"DESC", opts.VersionMetadata.Description},
 		{"URL", opts.VersionMetadata.ProjectURL},
-		{"LICENSE", strings.Join(opts.VersionMetadata.Licenses, "\n")},
-		{"GROUPS", strings.Join(opts.FileMetadata.Groups, "\n")},
+		{"LICENSE", joinFields(opts.VersionMetadata.Licenses)},
+		{"GROUPS", joinFields(opts.FileMetadata.Groups)},
 		{"BUILDDATE", strconv.FormatInt(opts.FileMetadata.BuildDate, 10)},
 		{"PACKAGER", opts.FileMetadata.Packager},
-		{"PROVIDES", strings.Join(opts.FileMetadata.Provides, "\n")},
-		{"REPLACES", strings.Join(opts.FileMetadata.Replaces, "\n")},
-		{"CONFLICTS", strings.Join(opts.FileMetadata.Conflicts, "\n")},
-		{"DEPENDS", strings.Join(opts.FileMetadata.Depends, "\n")},
-		{"OPTDEPENDS", strings.Join(opts.FileMetadata.OptDepends, "\n")},
-		{"MAKEDEPENDS", strings.Join(opts.FileMetadata.MakeDepends, "\n")},
-		{"CHECKDEPENDS", strings.Join(opts.FileMetadata.CheckDepends, "\n")},
+		{"PROVIDES", joinFields(opts.FileMetadata.Provides)},
+		{"REPLACES", joinFields(opts.FileMetadata.Replaces)},
+		{"CONFLICTS", joinFields(opts.FileMetadata.Conflicts)},
+		{"DEPENDS", joinFields(opts.FileMetadata.Depends)},
+		{"OPTDEPENDS", joinFields(opts.FileMetadata.OptDepends)},
+		{"MAKEDEPENDS", joinFields(opts.FileMetadata.MakeDepends)},
+		{"CHECKDEPENDS", joinFields(opts.FileMetadata.CheckDepends)},
 	})
 }
 

package/gitea/source/services/packages/arch/repository_test.go

@@ -0,0 +1,17 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package arch
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestJoinFields(t *testing.T) {
+	values := []string{"usr/bin/a", "usr/bin/b\n\n%FILES%\netc/cron.d/x", "usr/bin/c"}
+
+	assert.Equal(t, "usr/bin/a\nusr/bin/c", joinFields(values))
+	assert.Len(t, values, 3) // must not modify the caller's slice
+}