feat: vendor gitea 1.16.2

package/gitea/source/modules/actions/artifacts.go

@@ -4,45 +4,82 @@
 package actions
 
 import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"io"
 	"net/http"
+	"strings"
 
 	actions_model "code.gitea.io/gitea/models/actions"
+	"code.gitea.io/gitea/modules/httplib"
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/storage"
 	"code.gitea.io/gitea/services/context"
 )
 
-// Artifacts using the v4 backend are stored as a single combined zip file per artifact on the backend
-// The v4 backend ensures ContentEncoding is set to "application/zip", which is not the case for the old backend
-func IsArtifactV4(art *actions_model.ActionArtifact) bool {
-	return art.ArtifactName+".zip" == art.ArtifactPath && art.ContentEncoding == "application/zip"
-}
+type tagType string
 
-func DownloadArtifactV4ServeDirectOnly(ctx *context.Base, art *actions_model.ActionArtifact) (bool, error) {
-	if setting.Actions.ArtifactStorage.ServeDirect() {
-		u, err := storage.ActionsArtifacts.URL(art.StoragePath, art.ArtifactPath, ctx.Req.Method, nil)
-		if u != nil && err == nil {
-			ctx.Redirect(u.String(), http.StatusFound)
-			return true, nil
-		}
+// BuildSignature builds a hmac signature for the input values.
+// "tag" is an internal pre-defined static string to distinguish the signatures for different purpose.
+func BuildSignature(tag tagType, vals ...string) []byte {
+	m := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret())
+	_, _ = io.WriteString(m, string(tag))
+	var buf8 [8]byte
+	for _, v := range vals {
+		binary.LittleEndian.PutUint64(buf8[:], uint64(len(v)))
+		_, _ = m.Write(buf8[:])
+		_, _ = io.WriteString(m, v)
 	}
-	return false, nil
+	return m.Sum(nil)
 }
 
-func DownloadArtifactV4Fallback(ctx *context.Base, art *actions_model.ActionArtifact) error {
+// IsArtifactV4 detects whether the artifact is likely from v4.
+// V4 backend stores the files as a single combined zip file per artifact, and ensures ContentEncoding contains a slash
+// (otherwise this uses application/zip instead of the custom mime type), which is not the case for the old backend.
+func IsArtifactV4(art *actions_model.ActionArtifact) bool {
+	return strings.Contains(art.ContentEncodingOrType, "/")
+}
+
+func GetArtifactV4ServeDirectURL(art *actions_model.ActionArtifact, method string) (string, error) {
+	contentType := art.ContentEncodingOrType
+	u, err := storage.ActionsArtifacts.ServeDirectURL(art.StoragePath, art.ArtifactPath, method, &storage.ServeDirectOptions{ContentType: contentType})
+	if err != nil {
+		return "", err
+	}
+	return u.String(), nil
+}
+
+func DownloadArtifactV4ServeDirect(ctx *context.Base, art *actions_model.ActionArtifact) bool {
+	if !setting.Actions.ArtifactStorage.ServeDirect() {
+		return false
+	}
+	u, err := GetArtifactV4ServeDirectURL(art, ctx.Req.Method)
+	if err != nil {
+		log.Error("GetArtifactV4ServeDirectURL: %v", err)
+		return false
+	}
+	ctx.Redirect(u, http.StatusFound)
+	return true
+}
+
+func DownloadArtifactV4ReadStorage(ctx *context.Base, art *actions_model.ActionArtifact) error {
 	f, err := storage.ActionsArtifacts.Open(art.StoragePath)
 	if err != nil {
 		return err
 	}
 	defer f.Close()
-	http.ServeContent(ctx.Resp, ctx.Req, art.ArtifactName+".zip", art.CreatedUnix.AsLocalTime(), f)
+	httplib.ServeUserContentByFile(ctx.Req, ctx.Resp, f, httplib.ServeHeaderOptions{
+		Filename:    art.ArtifactPath,
+		ContentType: art.ContentEncodingOrType, // v4 guarantees that the field is Content-Type
+	})
 	return nil
 }
 
 func DownloadArtifactV4(ctx *context.Base, art *actions_model.ActionArtifact) error {
-	ok, err := DownloadArtifactV4ServeDirectOnly(ctx, art)
-	if ok || err != nil {
-		return err
+	if DownloadArtifactV4ServeDirect(ctx, art) {
+		return nil
 	}
-	return DownloadArtifactV4Fallback(ctx, art)
+	return DownloadArtifactV4ReadStorage(ctx, art)
 }

package/gitea/source/modules/actions/artifacts_test.go

@@ -0,0 +1,36 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildSignature(t *testing.T) {
+	a := BuildSignature("v0", "x")
+	b := BuildSignature("v0", "x")
+	assert.Equal(t, a, b)
+
+	a = BuildSignature("v0", "x", "yz")
+	b = BuildSignature("v0", "xy", "z")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v1", "x")
+	b = BuildSignature("v2", "x")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v0", "x")
+	b = BuildSignature("v0x")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v0", "", "x")
+	b = BuildSignature("v0", "x", "")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v0")
+	b = BuildSignature("v0")
+	assert.Equal(t, a, b)
+}

package/gitea/source/modules/actions/github.go

@@ -59,6 +59,10 @@ func IsDefaultBranchWorkflow(triggedEvent webhook_module.HookEventType) bool {
 		// Github "issues" event
 		// https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#issues
 		return true
+	case webhook_module.HookEventWorkflowRun:
+		// GitHub "workflow_run" event
+		// https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run
+		return true
 	}
 
 	return false

package/gitea/source/modules/actions/jobparser/evaluator.go

@@ -0,0 +1,189 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"github.com/nektos/act/pkg/exprparser"
+	"go.yaml.in/yaml/v4"
+)
+
+// ExpressionEvaluator is copied from runner.expressionEvaluator,
+// to avoid unnecessary dependencies
+type ExpressionEvaluator struct {
+	interpreter exprparser.Interpreter
+}
+
+func NewExpressionEvaluator(interpreter exprparser.Interpreter) *ExpressionEvaluator {
+	return &ExpressionEvaluator{interpreter: interpreter}
+}
+
+func (ee ExpressionEvaluator) evaluate(in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) {
+	evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck)
+
+	return evaluated, err
+}
+
+func (ee ExpressionEvaluator) evaluateScalarYamlNode(node *yaml.Node) error {
+	var in string
+	if err := node.Decode(&in); err != nil {
+		return err
+	}
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return nil
+	}
+	expr, _ := rewriteSubExpression(in, false)
+	res, err := ee.evaluate(expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		return err
+	}
+	return node.Encode(res)
+}
+
+func (ee ExpressionEvaluator) evaluateMappingYamlNode(node *yaml.Node) error {
+	// GitHub has this undocumented feature to merge maps, called insert directive
+	insertDirective := regexp.MustCompile(`\${{\s*insert\s*}}`)
+	for i := 0; i < len(node.Content)/2; {
+		k := node.Content[i*2]
+		v := node.Content[i*2+1]
+		if err := ee.EvaluateYamlNode(v); err != nil {
+			return err
+		}
+		var sk string
+		// Merge the nested map of the insert directive
+		if k.Decode(&sk) == nil && insertDirective.MatchString(sk) {
+			node.Content = append(append(node.Content[:i*2], v.Content...), node.Content[(i+1)*2:]...)
+			i += len(v.Content) / 2
+		} else {
+			if err := ee.EvaluateYamlNode(k); err != nil {
+				return err
+			}
+			i++
+		}
+	}
+	return nil
+}
+
+func (ee ExpressionEvaluator) evaluateSequenceYamlNode(node *yaml.Node) error {
+	for i := 0; i < len(node.Content); {
+		v := node.Content[i]
+		// Preserve nested sequences
+		wasseq := v.Kind == yaml.SequenceNode
+		if err := ee.EvaluateYamlNode(v); err != nil {
+			return err
+		}
+		// GitHub has this undocumented feature to merge sequences / arrays
+		// We have a nested sequence via evaluation, merge the arrays
+		if v.Kind == yaml.SequenceNode && !wasseq {
+			node.Content = append(append(node.Content[:i], v.Content...), node.Content[i+1:]...)
+			i += len(v.Content)
+		} else {
+			i++
+		}
+	}
+	return nil
+}
+
+func (ee ExpressionEvaluator) EvaluateYamlNode(node *yaml.Node) error {
+	switch node.Kind {
+	case yaml.ScalarNode:
+		return ee.evaluateScalarYamlNode(node)
+	case yaml.MappingNode:
+		return ee.evaluateMappingYamlNode(node)
+	case yaml.SequenceNode:
+		return ee.evaluateSequenceYamlNode(node)
+	default:
+		return nil
+	}
+}
+
+func (ee ExpressionEvaluator) Interpolate(in string) string {
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return in
+	}
+
+	expr, _ := rewriteSubExpression(in, true)
+	evaluated, err := ee.evaluate(expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		return ""
+	}
+
+	value, ok := evaluated.(string)
+	if !ok {
+		panic(fmt.Sprintf("Expression %s did not evaluate to a string", expr))
+	}
+
+	return value
+}
+
+func escapeFormatString(in string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(in, "{", "{{"), "}", "}}")
+}
+
+func rewriteSubExpression(in string, forceFormat bool) (string, error) {
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return in, nil
+	}
+
+	strPattern := regexp.MustCompile("(?:''|[^'])*'")
+	pos := 0
+	exprStart := -1
+	strStart := -1
+	var results []string
+	var formatOut strings.Builder
+	for pos < len(in) {
+		if strStart > -1 {
+			matches := strPattern.FindStringIndex(in[pos:])
+			if matches == nil {
+				return "", errors.New("unclosed string")
+			}
+
+			strStart = -1
+			pos += matches[1]
+		} else if exprStart > -1 {
+			exprEnd := strings.Index(in[pos:], "}}")
+			strStart = strings.Index(in[pos:], "'")
+
+			if exprEnd > -1 && strStart > -1 {
+				if exprEnd < strStart {
+					strStart = -1
+				} else {
+					exprEnd = -1
+				}
+			}
+
+			if exprEnd > -1 {
+				fmt.Fprintf(&formatOut, "{%d}", len(results))
+				results = append(results, strings.TrimSpace(in[exprStart:pos+exprEnd]))
+				pos += exprEnd + 2
+				exprStart = -1
+			} else if strStart > -1 {
+				pos += strStart + 1
+			} else {
+				panic("unclosed expression.")
+			}
+		} else {
+			exprStart = strings.Index(in[pos:], "${{")
+			if exprStart != -1 {
+				formatOut.WriteString(escapeFormatString(in[pos : pos+exprStart]))
+				exprStart = pos + exprStart + 3
+				pos = exprStart
+			} else {
+				formatOut.WriteString(escapeFormatString(in[pos:]))
+				pos = len(in)
+			}
+		}
+	}
+
+	if len(results) == 1 && formatOut.String() == "{0}" && !forceFormat {
+		return in, nil
+	}
+
+	out := fmt.Sprintf("format('%s', %s)", strings.ReplaceAll(formatOut.String(), "'", "''"), strings.Join(results, ", "))
+	return out, nil
+}

package/gitea/source/modules/actions/jobparser/interpeter.go

@@ -0,0 +1,87 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"github.com/nektos/act/pkg/exprparser"
+	"github.com/nektos/act/pkg/model"
+	"go.yaml.in/yaml/v4"
+)
+
+// NewInterpeter returns an interpeter used in the server,
+// need github, needs, strategy, matrix, inputs context only,
+// see https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability
+func NewInterpeter(
+	jobID string,
+	job *model.Job,
+	matrix map[string]any,
+	gitCtx *model.GithubContext,
+	results map[string]*JobResult,
+	vars map[string]string,
+	inputs map[string]any,
+) exprparser.Interpreter {
+	strategy := make(map[string]any)
+	if job.Strategy != nil {
+		strategy["fail-fast"] = job.Strategy.FailFast
+		strategy["max-parallel"] = job.Strategy.MaxParallel
+	}
+
+	run := &model.Run{
+		Workflow: &model.Workflow{
+			Jobs: map[string]*model.Job{},
+		},
+		JobID: jobID,
+	}
+	for id, result := range results {
+		need := yaml.Node{}
+		_ = need.Encode(result.Needs)
+		run.Workflow.Jobs[id] = &model.Job{
+			RawNeeds: need,
+			Result:   result.Result,
+			Outputs:  result.Outputs,
+		}
+	}
+
+	jobs := run.Workflow.Jobs
+	jobNeeds := run.Job().Needs()
+
+	using := map[string]exprparser.Needs{}
+	for _, need := range jobNeeds {
+		if v, ok := jobs[need]; ok {
+			using[need] = exprparser.Needs{
+				Outputs: v.Outputs,
+				Result:  v.Result,
+			}
+		}
+	}
+
+	ee := &exprparser.EvaluationEnvironment{
+		Github:   gitCtx,
+		Env:      nil, // no need
+		Job:      nil, // no need
+		Steps:    nil, // no need
+		Runner:   nil, // no need
+		Secrets:  nil, // no need
+		Strategy: strategy,
+		Matrix:   matrix,
+		Needs:    using,
+		Inputs:   inputs,
+		Vars:     vars,
+	}
+
+	config := exprparser.Config{
+		Run:        run,
+		WorkingDir: "", // WorkingDir is used for  the function hashFiles, but it's not needed in the server
+		Context:    "job",
+	}
+
+	return exprparser.NewInterpeter(ee, config)
+}
+
+// JobResult is the minimum requirement of job results for Interpeter
+type JobResult struct {
+	Needs   []string
+	Result  string
+	Outputs map[string]string
+}

package/gitea/source/modules/actions/jobparser/jobparser.go

@@ -0,0 +1,180 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/nektos/act/pkg/exprparser"
+	"github.com/nektos/act/pkg/model"
+	"go.yaml.in/yaml/v4"
+)
+
+func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
+	origin, err := model.ReadWorkflow(bytes.NewReader(content))
+	if err != nil {
+		return nil, fmt.Errorf("model.ReadWorkflow: %w", err)
+	}
+
+	workflow := &SingleWorkflow{}
+	if err := yaml.Unmarshal(content, workflow); err != nil {
+		return nil, fmt.Errorf("yaml.Unmarshal: %w", err)
+	}
+
+	pc := &parseContext{}
+	for _, o := range options {
+		o(pc)
+	}
+	results := map[string]*JobResult{}
+	for id, job := range origin.Jobs {
+		if job == nil {
+			return nil, fmt.Errorf("needed job not found: %q", id)
+		}
+		results[id] = &JobResult{
+			Needs:   job.Needs(),
+			Result:  pc.jobResults[id],
+			Outputs: nil, // not supported yet
+		}
+	}
+
+	var ret []*SingleWorkflow
+	ids, jobs, err := workflow.jobs()
+	if err != nil {
+		return nil, fmt.Errorf("invalid jobs: %w", err)
+	}
+
+	evaluator := NewExpressionEvaluator(exprparser.NewInterpeter(&exprparser.EvaluationEnvironment{Github: pc.gitContext, Vars: pc.vars, Inputs: pc.inputs}, exprparser.Config{}))
+	workflow.RunName = evaluator.Interpolate(workflow.RunName)
+
+	for i, id := range ids {
+		job := jobs[i]
+		matricxes, err := getMatrixes(origin.GetJob(id))
+		if err != nil {
+			return nil, fmt.Errorf("getMatrixes: %w", err)
+		}
+		for _, matrix := range matricxes {
+			job := job.Clone()
+			if job.Name == "" {
+				job.Name = id
+			}
+			job.Strategy.RawMatrix = encodeMatrix(matrix)
+			evaluator := NewExpressionEvaluator(NewInterpeter(id, origin.GetJob(id), matrix, pc.gitContext, results, pc.vars, pc.inputs))
+			job.Name = nameWithMatrix(job.Name, matrix, evaluator)
+			runsOn := origin.GetJob(id).RunsOn()
+			for i, v := range runsOn {
+				runsOn[i] = evaluator.Interpolate(v)
+			}
+			job.RawRunsOn = encodeRunsOn(runsOn)
+			swf := &SingleWorkflow{
+				Name:           workflow.Name,
+				RawOn:          workflow.RawOn,
+				Env:            workflow.Env,
+				Defaults:       workflow.Defaults,
+				RawPermissions: workflow.RawPermissions,
+				RunName:        workflow.RunName,
+			}
+			if err := swf.SetJob(id, job); err != nil {
+				return nil, fmt.Errorf("SetJob: %w", err)
+			}
+			ret = append(ret, swf)
+		}
+	}
+	return ret, nil
+}
+
+func WithJobResults(results map[string]string) ParseOption {
+	return func(c *parseContext) {
+		c.jobResults = results
+	}
+}
+
+func WithGitContext(context *model.GithubContext) ParseOption {
+	return func(c *parseContext) {
+		c.gitContext = context
+	}
+}
+
+func WithVars(vars map[string]string) ParseOption {
+	return func(c *parseContext) {
+		c.vars = vars
+	}
+}
+
+func WithInputs(inputs map[string]any) ParseOption {
+	return func(c *parseContext) {
+		c.inputs = inputs
+	}
+}
+
+type parseContext struct {
+	jobResults map[string]string
+	gitContext *model.GithubContext
+	vars       map[string]string
+	inputs     map[string]any
+}
+
+type ParseOption func(c *parseContext)
+
+func getMatrixes(job *model.Job) ([]map[string]any, error) {
+	ret, err := job.GetMatrixes()
+	if err != nil {
+		return nil, fmt.Errorf("GetMatrixes: %w", err)
+	}
+	sort.Slice(ret, func(i, j int) bool {
+		return matrixName(ret[i]) < matrixName(ret[j])
+	})
+	return ret, nil
+}
+
+func encodeMatrix(matrix map[string]any) yaml.Node {
+	if len(matrix) == 0 {
+		return yaml.Node{}
+	}
+	value := map[string][]any{}
+	for k, v := range matrix {
+		value[k] = []any{v}
+	}
+	node := yaml.Node{}
+	_ = node.Encode(value)
+	return node
+}
+
+func encodeRunsOn(runsOn []string) yaml.Node {
+	node := yaml.Node{}
+	if len(runsOn) == 1 {
+		_ = node.Encode(runsOn[0])
+	} else {
+		_ = node.Encode(runsOn)
+	}
+	return node
+}
+
+func nameWithMatrix(name string, m map[string]any, evaluator *ExpressionEvaluator) string {
+	if len(m) == 0 {
+		return name
+	}
+
+	if !strings.Contains(name, "${{") || !strings.Contains(name, "}}") {
+		return name + " " + matrixName(m)
+	}
+
+	return evaluator.Interpolate(name)
+}
+
+func matrixName(m map[string]any) string {
+	ks := make([]string, 0, len(m))
+	for k := range m {
+		ks = append(ks, k)
+	}
+	sort.Strings(ks)
+	vs := make([]string, 0, len(m))
+	for _, v := range ks {
+		vs = append(vs, fmt.Sprint(m[v]))
+	}
+
+	return fmt.Sprintf("(%s)", strings.Join(vs, ", "))
+}

package/gitea/source/modules/actions/jobparser/jobparser_test.go

@@ -0,0 +1,104 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v4"
+)
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		name    string
+		options []ParseOption
+		wantErr bool
+	}{
+		{
+			name:    "multiple_jobs",
+			options: nil,
+			wantErr: false,
+		},
+		{
+			name:    "multiple_matrix",
+			options: nil,
+			wantErr: false,
+		},
+		{
+			name:    "has_needs",
+			options: nil,
+			wantErr: false,
+		},
+		{
+			name:    "has_with",
+			options: nil,
+			wantErr: false,
+		},
+		{
+			name:    "has_secrets",
+			options: nil,
+			wantErr: false,
+		},
+		{
+			name:    "empty_step",
+			options: nil,
+			wantErr: false,
+		},
+		{
+			name:    "job_name_with_matrix",
+			options: nil,
+			wantErr: false,
+		},
+		{
+			name:    "prefixed_newline",
+			options: nil,
+			wantErr: false,
+		},
+	}
+	invalidFileTests := []struct {
+		name string
+	}{
+		{name: "null_job_implicit"},
+		{name: "null_job_explicit"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			content := ReadTestdata(t, tt.name+".in.yaml")
+			want := ReadTestdata(t, tt.name+".out.yaml")
+			got, err := Parse(content, tt.options...)
+			if tt.wantErr {
+				require.Error(t, err)
+			}
+			require.NoError(t, err)
+
+			builder := &strings.Builder{}
+			for _, v := range got {
+				if builder.Len() > 0 {
+					builder.WriteString("---\n")
+				}
+				encoder := yaml.NewEncoder(builder)
+				encoder.SetIndent(2)
+				require.NoError(t, encoder.Encode(v))
+				id, job := v.Job()
+				assert.NotEmpty(t, id)
+				assert.NotNil(t, job)
+			}
+			assert.Equal(t, string(want), builder.String())
+		})
+	}
+
+	for _, tt := range invalidFileTests {
+		t.Run(tt.name, func(t *testing.T) {
+			content := ReadTestdata(t, tt.name+".in.yaml")
+			require.NotPanics(t, func() {
+				_, err := Parse(content)
+				require.Error(t, err)
+			})
+		})
+	}
+}

package/gitea/source/modules/actions/jobparser/model.go

@@ -0,0 +1,497 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"github.com/nektos/act/pkg/model"
+	"go.yaml.in/yaml/v4"
+)
+
+// SingleWorkflow is a workflow with single job and single matrix
+type SingleWorkflow struct {
+	Name           string            `yaml:"name,omitempty"`
+	RawOn          yaml.Node         `yaml:"on,omitempty"`
+	Env            map[string]string `yaml:"env,omitempty"`
+	RawJobs        yaml.Node         `yaml:"jobs,omitempty"`
+	Defaults       Defaults          `yaml:"defaults,omitempty"`
+	RawPermissions yaml.Node         `yaml:"permissions,omitempty"`
+	RunName        string            `yaml:"run-name,omitempty"`
+}
+
+func (w *SingleWorkflow) Job() (string, *Job) {
+	ids, jobs, _ := w.jobs()
+	if len(ids) >= 1 {
+		return ids[0], jobs[0]
+	}
+	return "", nil
+}
+
+func (w *SingleWorkflow) jobs() ([]string, []*Job, error) {
+	ids, jobs, err := parseMappingNode[*Job](&w.RawJobs)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for _, job := range jobs {
+		steps := make([]*Step, 0, len(job.Steps))
+		for _, s := range job.Steps {
+			if s != nil {
+				steps = append(steps, s)
+			}
+		}
+		job.Steps = steps
+	}
+
+	return ids, jobs, nil
+}
+
+func (w *SingleWorkflow) SetJob(id string, job *Job) error {
+	m := map[string]*Job{
+		id: job,
+	}
+	var buf bytes.Buffer
+	encoder := yaml.NewEncoder(&buf)
+	encoder.SetIndent(2)
+	if err := encoder.Encode(m); err != nil {
+		return err
+	}
+	encoder.Close()
+
+	node := yaml.Node{}
+	if err := yaml.Unmarshal(buf.Bytes(), &node); err != nil {
+		return err
+	}
+	if len(node.Content) != 1 || node.Content[0].Kind != yaml.MappingNode {
+		return fmt.Errorf("can not set job: %s", buf.String())
+	}
+	w.RawJobs = *node.Content[0]
+	return nil
+}
+
+func (w *SingleWorkflow) Marshal() ([]byte, error) {
+	return yaml.Marshal(w)
+}
+
+type Job struct {
+	Name           string                    `yaml:"name,omitempty"`
+	RawNeeds       yaml.Node                 `yaml:"needs,omitempty"`
+	RawRunsOn      yaml.Node                 `yaml:"runs-on,omitempty"`
+	Env            yaml.Node                 `yaml:"env,omitempty"`
+	If             yaml.Node                 `yaml:"if,omitempty"`
+	Steps          []*Step                   `yaml:"steps,omitempty"`
+	TimeoutMinutes string                    `yaml:"timeout-minutes,omitempty"`
+	Services       map[string]*ContainerSpec `yaml:"services,omitempty"`
+	Strategy       Strategy                  `yaml:"strategy,omitempty"`
+	RawContainer   yaml.Node                 `yaml:"container,omitempty"`
+	Defaults       Defaults                  `yaml:"defaults,omitempty"`
+	Outputs        map[string]string         `yaml:"outputs,omitempty"`
+	Uses           string                    `yaml:"uses,omitempty"`
+	With           map[string]any            `yaml:"with,omitempty"`
+	RawSecrets     yaml.Node                 `yaml:"secrets,omitempty"`
+	RawConcurrency *model.RawConcurrency     `yaml:"concurrency,omitempty"`
+	RawPermissions yaml.Node                 `yaml:"permissions,omitempty"`
+}
+
+func (j *Job) Clone() *Job {
+	if j == nil {
+		return nil
+	}
+	return &Job{
+		Name:           j.Name,
+		RawNeeds:       j.RawNeeds,
+		RawRunsOn:      j.RawRunsOn,
+		Env:            j.Env,
+		If:             j.If,
+		Steps:          j.Steps,
+		TimeoutMinutes: j.TimeoutMinutes,
+		Services:       j.Services,
+		Strategy:       j.Strategy,
+		RawContainer:   j.RawContainer,
+		Defaults:       j.Defaults,
+		Outputs:        j.Outputs,
+		Uses:           j.Uses,
+		With:           j.With,
+		RawSecrets:     j.RawSecrets,
+		RawConcurrency: j.RawConcurrency,
+		RawPermissions: j.RawPermissions,
+	}
+}
+
+func (j *Job) Needs() []string {
+	return (&model.Job{RawNeeds: j.RawNeeds}).Needs()
+}
+
+func (j *Job) EraseNeeds() *Job {
+	j.RawNeeds = yaml.Node{}
+	return j
+}
+
+func (j *Job) RunsOn() []string {
+	return (&model.Job{RawRunsOn: j.RawRunsOn}).RunsOn()
+}
+
+type Step struct {
+	ID               string            `yaml:"id,omitempty"`
+	If               yaml.Node         `yaml:"if,omitempty"`
+	Name             string            `yaml:"name,omitempty"`
+	Uses             string            `yaml:"uses,omitempty"`
+	Run              string            `yaml:"run,omitempty"`
+	WorkingDirectory string            `yaml:"working-directory,omitempty"`
+	Shell            string            `yaml:"shell,omitempty"`
+	Env              yaml.Node         `yaml:"env,omitempty"`
+	With             map[string]string `yaml:"with,omitempty"`
+	ContinueOnError  bool              `yaml:"continue-on-error,omitempty"`
+	TimeoutMinutes   string            `yaml:"timeout-minutes,omitempty"`
+}
+
+// String gets the name of step
+func (s *Step) String() string {
+	if s == nil {
+		return ""
+	}
+	return (&model.Step{
+		ID:   s.ID,
+		Name: s.Name,
+		Uses: s.Uses,
+		Run:  s.Run,
+	}).String()
+}
+
+type ContainerSpec struct {
+	Image       string            `yaml:"image,omitempty"`
+	Env         map[string]string `yaml:"env,omitempty"`
+	Ports       []string          `yaml:"ports,omitempty"`
+	Volumes     []string          `yaml:"volumes,omitempty"`
+	Options     string            `yaml:"options,omitempty"`
+	Credentials map[string]string `yaml:"credentials,omitempty"`
+	Cmd         []string          `yaml:"cmd,omitempty"`
+}
+
+type Strategy struct {
+	FailFastString    string    `yaml:"fail-fast,omitempty"`
+	MaxParallelString string    `yaml:"max-parallel,omitempty"`
+	RawMatrix         yaml.Node `yaml:"matrix,omitempty"`
+}
+
+type Defaults struct {
+	Run RunDefaults `yaml:"run,omitempty"`
+}
+
+type RunDefaults struct {
+	Shell            string `yaml:"shell,omitempty"`
+	WorkingDirectory string `yaml:"working-directory,omitempty"`
+}
+
+type WorkflowDispatchInput struct {
+	Name        string   `yaml:"name"`
+	Description string   `yaml:"description"`
+	Required    bool     `yaml:"required"`
+	Default     string   `yaml:"default"`
+	Type        string   `yaml:"type"`
+	Options     []string `yaml:"options"`
+}
+
+type Event struct {
+	Name      string
+	acts      map[string][]string
+	schedules []map[string]string
+	inputs    []WorkflowDispatchInput
+}
+
+func (evt *Event) IsSchedule() bool {
+	return evt.schedules != nil
+}
+
+func (evt *Event) Acts() map[string][]string {
+	return evt.acts
+}
+
+func (evt *Event) Schedules() []map[string]string {
+	return evt.schedules
+}
+
+func (evt *Event) Inputs() []WorkflowDispatchInput {
+	return evt.inputs
+}
+
+func ReadWorkflowRawConcurrency(content []byte) (*model.RawConcurrency, error) {
+	w := new(model.Workflow)
+	err := yaml.NewDecoder(bytes.NewReader(content)).Decode(w)
+	return w.RawConcurrency, err
+}
+
+func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (string, bool, error) {
+	actJob := &model.Job{}
+	if job != nil {
+		actJob.Strategy = &model.Strategy{
+			FailFastString:    job.Strategy.FailFastString,
+			MaxParallelString: job.Strategy.MaxParallelString,
+			RawMatrix:         job.Strategy.RawMatrix,
+		}
+		actJob.Strategy.FailFast = actJob.Strategy.GetFailFast()
+		actJob.Strategy.MaxParallel = actJob.Strategy.GetMaxParallel()
+	}
+
+	matrix := make(map[string]any)
+	matrixes, err := actJob.GetMatrixes()
+	if err != nil {
+		return "", false, err
+	}
+	if len(matrixes) > 0 {
+		matrix = matrixes[0]
+	}
+
+	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs))
+	var node yaml.Node
+	if err := node.Encode(rc); err != nil {
+		return "", false, fmt.Errorf("failed to encode concurrency: %w", err)
+	}
+	if err := evaluator.EvaluateYamlNode(&node); err != nil {
+		return "", false, fmt.Errorf("failed to evaluate concurrency: %w", err)
+	}
+	var evaluated model.RawConcurrency
+	if err := node.Decode(&evaluated); err != nil {
+		return "", false, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err)
+	}
+	if evaluated.RawExpression != "" {
+		return evaluated.RawExpression, false, nil
+	}
+	return evaluated.Group, evaluated.CancelInProgress == "true", nil
+}
+
+func toGitContext(input map[string]any) *model.GithubContext {
+	gitContext := &model.GithubContext{
+		EventPath:        asString(input["event_path"]),
+		Workflow:         asString(input["workflow"]),
+		RunID:            asString(input["run_id"]),
+		RunNumber:        asString(input["run_number"]),
+		Actor:            asString(input["actor"]),
+		Repository:       asString(input["repository"]),
+		EventName:        asString(input["event_name"]),
+		Sha:              asString(input["sha"]),
+		Ref:              asString(input["ref"]),
+		RefName:          asString(input["ref_name"]),
+		RefType:          asString(input["ref_type"]),
+		HeadRef:          asString(input["head_ref"]),
+		BaseRef:          asString(input["base_ref"]),
+		Token:            asString(input["token"]),
+		Workspace:        asString(input["workspace"]),
+		Action:           asString(input["action"]),
+		ActionPath:       asString(input["action_path"]),
+		ActionRef:        asString(input["action_ref"]),
+		ActionRepository: asString(input["action_repository"]),
+		Job:              asString(input["job"]),
+		RepositoryOwner:  asString(input["repository_owner"]),
+		RetentionDays:    asString(input["retention_days"]),
+	}
+
+	event, ok := input["event"].(map[string]any)
+	if ok {
+		gitContext.Event = event
+	}
+
+	return gitContext
+}
+
+func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
+	switch rawOn.Kind {
+	case yaml.ScalarNode:
+		var val string
+		err := rawOn.Decode(&val)
+		if err != nil {
+			return nil, err
+		}
+		return []*Event{
+			{Name: val},
+		}, nil
+	case yaml.SequenceNode:
+		var val []any
+		err := rawOn.Decode(&val)
+		if err != nil {
+			return nil, err
+		}
+		res := make([]*Event, 0, len(val))
+		for _, v := range val {
+			switch t := v.(type) {
+			case string:
+				res = append(res, &Event{Name: t})
+			default:
+				return nil, fmt.Errorf("invalid type %T", t)
+			}
+		}
+		return res, nil
+	case yaml.MappingNode:
+		events, triggers, err := parseMappingNode[yaml.Node](rawOn)
+		if err != nil {
+			return nil, err
+		}
+		res := make([]*Event, 0, len(events))
+		for i, k := range events {
+			v := triggers[i]
+			switch v.Kind {
+			case yaml.ScalarNode:
+				res = append(res, &Event{
+					Name: k,
+				})
+			case yaml.SequenceNode:
+				var t []any
+				err := v.Decode(&t)
+				if err != nil {
+					return nil, err
+				}
+				schedules := make([]map[string]string, len(t))
+				if k == "schedule" {
+					for i, tt := range t {
+						vv, ok := tt.(map[string]any)
+						if !ok {
+							return nil, fmt.Errorf("unknown on type(schedule): %#v", v)
+						}
+						schedules[i] = make(map[string]string, len(vv))
+						for k, vvv := range vv {
+							var ok bool
+							if schedules[i][k], ok = vvv.(string); !ok {
+								return nil, fmt.Errorf("unknown on type(schedule): %#v", v)
+							}
+						}
+					}
+				}
+
+				if len(schedules) == 0 {
+					schedules = nil
+				}
+				res = append(res, &Event{
+					Name:      k,
+					schedules: schedules,
+				})
+			case yaml.MappingNode:
+				acts := make(map[string][]string, len(v.Content)/2)
+				var inputs []WorkflowDispatchInput
+				expectedKey := true
+				var act string
+				for _, content := range v.Content {
+					if expectedKey {
+						if content.Kind != yaml.ScalarNode {
+							return nil, fmt.Errorf("key type not string: %#v", content)
+						}
+						act = ""
+						err := content.Decode(&act)
+						if err != nil {
+							return nil, err
+						}
+					} else {
+						switch content.Kind {
+						case yaml.SequenceNode:
+							var t []string
+							err := content.Decode(&t)
+							if err != nil {
+								return nil, err
+							}
+							acts[act] = t
+						case yaml.ScalarNode:
+							var t string
+							err := content.Decode(&t)
+							if err != nil {
+								return nil, err
+							}
+							acts[act] = []string{t}
+						case yaml.MappingNode:
+							if k != "workflow_dispatch" || act != "inputs" {
+								return nil, fmt.Errorf("map should only for workflow_dispatch but %s: %#v", act, content)
+							}
+
+							var key string
+							for i, vv := range content.Content {
+								if i%2 == 0 {
+									if vv.Kind != yaml.ScalarNode {
+										return nil, fmt.Errorf("key type not string: %#v", vv)
+									}
+									key = ""
+									if err := vv.Decode(&key); err != nil {
+										return nil, err
+									}
+								} else {
+									if vv.Kind != yaml.MappingNode {
+										return nil, fmt.Errorf("key type not map(%s): %#v", key, vv)
+									}
+
+									input := WorkflowDispatchInput{}
+									if err := vv.Decode(&input); err != nil {
+										return nil, err
+									}
+									input.Name = key
+									inputs = append(inputs, input)
+								}
+							}
+						default:
+							return nil, fmt.Errorf("unknown on type: %#v", content)
+						}
+					}
+					expectedKey = !expectedKey
+				}
+				if len(inputs) == 0 {
+					inputs = nil
+				}
+				if len(acts) == 0 {
+					acts = nil
+				}
+				res = append(res, &Event{
+					Name:   k,
+					acts:   acts,
+					inputs: inputs,
+				})
+			default:
+				return nil, fmt.Errorf("unknown on type: %v", v.Kind)
+			}
+		}
+		return res, nil
+	default:
+		return nil, fmt.Errorf("unknown on type: %v", rawOn.Kind)
+	}
+}
+
+// parseMappingNode parse a mapping node and preserve order.
+func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) {
+	if node.Kind != yaml.MappingNode {
+		return nil, nil, errors.New("input node is not a mapping node")
+	}
+
+	var scalars []string
+	var datas []T
+	expectKey := true
+	for _, item := range node.Content {
+		if expectKey {
+			if item.Kind != yaml.ScalarNode {
+				return nil, nil, fmt.Errorf("not a valid scalar node: %v", item.Value)
+			}
+			scalars = append(scalars, item.Value)
+			expectKey = false
+		} else {
+			var val T
+			if err := item.Decode(&val); err != nil {
+				return nil, nil, err
+			}
+			datas = append(datas, val)
+			expectKey = true
+		}
+	}
+
+	if len(scalars) != len(datas) {
+		return nil, nil, fmt.Errorf("invalid definition of on: %v", node.Value)
+	}
+
+	return scalars, datas, nil
+}
+
+func asString(v any) string {
+	if v == nil {
+		return ""
+	} else if s, ok := v.(string); ok {
+		return s
+	}
+	return ""
+}

package/gitea/source/modules/actions/jobparser/model_test.go

@@ -0,0 +1,373 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/nektos/act/pkg/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v4"
+)
+
+func TestParseRawOn(t *testing.T) {
+	kases := []struct {
+		input  string
+		result []*Event
+	}{
+		{
+			input: "on: issue_comment",
+			result: []*Event{
+				{
+					Name: "issue_comment",
+				},
+			},
+		},
+		{
+			input: "on:\n  push",
+			result: []*Event{
+				{
+					Name: "push",
+				},
+			},
+		},
+
+		{
+			input: "on:\n  - push\n  - pull_request",
+			result: []*Event{
+				{
+					Name: "push",
+				},
+				{
+					Name: "pull_request",
+				},
+			},
+		},
+		{
+			input: "on:\n  push:\n    branches:\n      - master",
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{
+						"branches": {
+							"master",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on:\n  push:\n    branches: main",
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{
+						"branches": {
+							"main",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on:\n  branch_protection_rule:\n    types: [created, deleted]",
+			result: []*Event{
+				{
+					Name: "branch_protection_rule",
+					acts: map[string][]string{
+						"types": {
+							"created",
+							"deleted",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on:\n  project:\n    types: [created, deleted]\n  milestone:\n    types: [opened, deleted]",
+			result: []*Event{
+				{
+					Name: "project",
+					acts: map[string][]string{
+						"types": {
+							"created",
+							"deleted",
+						},
+					},
+				},
+				{
+					Name: "milestone",
+					acts: map[string][]string{
+						"types": {
+							"opened",
+							"deleted",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on:\n  pull_request:\n    types:\n      - opened\n    branches:\n      - 'releases/**'",
+			result: []*Event{
+				{
+					Name: "pull_request",
+					acts: map[string][]string{
+						"types": {
+							"opened",
+						},
+						"branches": {
+							"releases/**",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on:\n  push:\n    branches:\n      - main\n  pull_request:\n    types:\n      - opened\n    branches:\n      - '**'",
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{
+						"branches": {
+							"main",
+						},
+					},
+				},
+				{
+					Name: "pull_request",
+					acts: map[string][]string{
+						"types": {
+							"opened",
+						},
+						"branches": {
+							"**",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on:\n  push:\n    branches:\n      - 'main'\n      - 'releases/**'",
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{
+						"branches": {
+							"main",
+							"releases/**",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on:\n  push:\n    tags:\n      - v1.**",
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{
+						"tags": {
+							"v1.**",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: "on: [pull_request, workflow_dispatch]",
+			result: []*Event{
+				{
+					Name: "pull_request",
+				},
+				{
+					Name: "workflow_dispatch",
+				},
+			},
+		},
+		{
+			input: "on:\n  schedule:\n    - cron: '20 6 * * *'",
+			result: []*Event{
+				{
+					Name: "schedule",
+					schedules: []map[string]string{
+						{
+							"cron": "20 6 * * *",
+						},
+					},
+				},
+			},
+		},
+		{
+			input: `on:
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: 'Log level'
+        required: true
+        default: 'warning'
+        type: choice
+        options:
+        - info
+        - warning
+        - debug
+      tags:
+        description: 'Test scenario tags'
+        required: false
+        type: boolean
+      environment:
+        description: 'Environment to run tests against'
+        type: environment
+        required: true
+  push:
+`,
+			result: []*Event{
+				{
+					Name: "workflow_dispatch",
+					inputs: []WorkflowDispatchInput{
+						{
+							Name:        "logLevel",
+							Description: "Log level",
+							Required:    true,
+							Default:     "warning",
+							Type:        "choice",
+							Options:     []string{"info", "warning", "debug"},
+						},
+						{
+							Name:        "tags",
+							Description: "Test scenario tags",
+							Required:    false,
+							Type:        "boolean",
+						},
+						{
+							Name:        "environment",
+							Description: "Environment to run tests against",
+							Type:        "environment",
+							Required:    true,
+						},
+					},
+				},
+				{
+					Name: "push",
+				},
+			},
+		},
+	}
+	for _, kase := range kases {
+		t.Run(kase.input, func(t *testing.T) {
+			origin, err := model.ReadWorkflow(strings.NewReader(kase.input))
+			assert.NoError(t, err)
+
+			events, err := ParseRawOn(&origin.RawOn)
+			assert.NoError(t, err)
+			assert.Equal(t, kase.result, events, events)
+		})
+	}
+}
+
+func TestSingleWorkflow_SetJob(t *testing.T) {
+	t.Run("erase needs", func(t *testing.T) {
+		content := ReadTestdata(t, "erase_needs.in.yaml")
+		want := ReadTestdata(t, "erase_needs.out.yaml")
+		swf, err := Parse(content)
+		require.NoError(t, err)
+		builder := &strings.Builder{}
+		for _, v := range swf {
+			id, job := v.Job()
+			require.NoError(t, v.SetJob(id, job.EraseNeeds()))
+
+			if builder.Len() > 0 {
+				builder.WriteString("---\n")
+			}
+			encoder := yaml.NewEncoder(builder)
+			encoder.SetIndent(2)
+			require.NoError(t, encoder.Encode(v))
+		}
+		assert.Equal(t, string(want), builder.String())
+	})
+}
+
+func TestParseMappingNode(t *testing.T) {
+	tests := []struct {
+		input   string
+		scalars []string
+		datas   []any
+	}{
+		{
+			input:   "on:\n  push:\n    branches:\n      - master",
+			scalars: []string{"push"},
+			datas: []any{
+				map[string]any{
+					"branches": []any{"master"},
+				},
+			},
+		},
+		{
+			input:   "on:\n  branch_protection_rule:\n    types: [created, deleted]",
+			scalars: []string{"branch_protection_rule"},
+			datas: []any{
+				map[string]any{
+					"types": []any{"created", "deleted"},
+				},
+			},
+		},
+		{
+			input:   "on:\n  project:\n    types: [created, deleted]\n  milestone:\n    types: [opened, deleted]",
+			scalars: []string{"project", "milestone"},
+			datas: []any{
+				map[string]any{
+					"types": []any{"created", "deleted"},
+				},
+				map[string]any{
+					"types": []any{"opened", "deleted"},
+				},
+			},
+		},
+		{
+			input:   "on:\n  pull_request:\n    types:\n      - opened\n    branches:\n      - 'releases/**'",
+			scalars: []string{"pull_request"},
+			datas: []any{
+				map[string]any{
+					"types":    []any{"opened"},
+					"branches": []any{"releases/**"},
+				},
+			},
+		},
+		{
+			input:   "on:\n  push:\n    branches:\n      - main\n  pull_request:\n    types:\n      - opened\n    branches:\n      - '**'",
+			scalars: []string{"push", "pull_request"},
+			datas: []any{
+				map[string]any{
+					"branches": []any{"main"},
+				},
+				map[string]any{
+					"types":    []any{"opened"},
+					"branches": []any{"**"},
+				},
+			},
+		},
+		{
+			input:   "on:\n  schedule:\n    - cron: '20 6 * * *'",
+			scalars: []string{"schedule"},
+			datas: []any{
+				[]any{map[string]any{
+					"cron": "20 6 * * *",
+				}},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			workflow, err := model.ReadWorkflow(strings.NewReader(test.input))
+			assert.NoError(t, err)
+
+			scalars, datas, err := parseMappingNode[any](&workflow.RawOn)
+			assert.NoError(t, err)
+			assert.Equal(t, test.scalars, scalars, scalars)
+			assert.Equal(t, test.datas, datas, datas)
+		})
+	}
+}

package/gitea/source/modules/actions/jobparser/testdata/empty_step.in.yaml

@@ -0,0 +1,8 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    steps:
+      - run: echo job-1
+      -

package/gitea/source/modules/actions/jobparser/testdata/empty_step.out.yaml

@@ -0,0 +1,7 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    steps:
+      - run: echo job-1

package/gitea/source/modules/actions/jobparser/testdata/erase_needs.in.yaml

@@ -0,0 +1,16 @@
+name: test
+jobs:
+  job1:
+    runs-on: linux
+    steps:
+      - run: uname -a
+  job2:
+    runs-on: linux
+    steps:
+      - run: uname -a
+    needs: job1
+  job3:
+    runs-on: linux
+    steps:
+      - run: uname -a
+    needs: [job1, job2]

package/gitea/source/modules/actions/jobparser/testdata/erase_needs.out.yaml

@@ -0,0 +1,23 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    steps:
+      - run: uname -a
+---
+name: test
+jobs:
+  job2:
+    name: job2
+    runs-on: linux
+    steps:
+      - run: uname -a
+---
+name: test
+jobs:
+  job3:
+    name: job3
+    runs-on: linux
+    steps:
+      - run: uname -a

package/gitea/source/modules/actions/jobparser/testdata/has_needs.in.yaml

@@ -0,0 +1,16 @@
+name: test
+jobs:
+  job1:
+    runs-on: linux
+    steps:
+      - run: uname -a
+  job2:
+    runs-on: linux
+    steps:
+      - run: uname -a
+    needs: job1
+  job3:
+    runs-on: linux
+    steps:
+      - run: uname -a
+    needs: [job1, job2]

package/gitea/source/modules/actions/jobparser/testdata/has_needs.out.yaml

@@ -0,0 +1,25 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    steps:
+      - run: uname -a
+---
+name: test
+jobs:
+  job2:
+    name: job2
+    needs: job1
+    runs-on: linux
+    steps:
+      - run: uname -a
+---
+name: test
+jobs:
+  job3:
+    name: job3
+    needs: [job1, job2]
+    runs-on: linux
+    steps:
+      - run: uname -a

package/gitea/source/modules/actions/jobparser/testdata/has_secrets.in.yaml

@@ -0,0 +1,14 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    secrets:
+      secret: hideme
+
+  job2:
+    name: job2
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    secrets: inherit

package/gitea/source/modules/actions/jobparser/testdata/has_secrets.out.yaml

@@ -0,0 +1,16 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    secrets:
+      secret: hideme
+---
+name: test
+jobs:
+  job2:
+    name: job2
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    secrets: inherit

package/gitea/source/modules/actions/jobparser/testdata/has_with.in.yaml

@@ -0,0 +1,15 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    with:
+      package: service
+
+  job2:
+    name: job2
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    with:
+      package: module

package/gitea/source/modules/actions/jobparser/testdata/has_with.out.yaml

@@ -0,0 +1,17 @@
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    with:
+      package: service
+---
+name: test
+jobs:
+  job2:
+    name: job2
+    runs-on: linux
+    uses: .gitea/workflows/build.yml
+    with:
+      package: module

package/gitea/source/modules/actions/jobparser/testdata/job_name_with_matrix.in.yaml

@@ -0,0 +1,14 @@
+name: test
+jobs:
+  job1:
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-20.04]
+        version: [1.17, 1.18, 1.19]
+    runs-on: ${{ matrix.os }}
+    name: test_version_${{ matrix.version }}_on_${{ matrix.os }}
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version

package/gitea/source/modules/actions/jobparser/testdata/job_name_with_matrix.out.yaml

@@ -0,0 +1,101 @@
+name: test
+jobs:
+  job1:
+    name: test_version_1.17_on_ubuntu-20.04
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-20.04
+        version:
+          - 1.17
+---
+name: test
+jobs:
+  job1:
+    name: test_version_1.18_on_ubuntu-20.04
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-20.04
+        version:
+          - 1.18
+---
+name: test
+jobs:
+  job1:
+    name: test_version_1.19_on_ubuntu-20.04
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-20.04
+        version:
+          - 1.19
+---
+name: test
+jobs:
+  job1:
+    name: test_version_1.17_on_ubuntu-22.04
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+        version:
+          - 1.17
+---
+name: test
+jobs:
+  job1:
+    name: test_version_1.18_on_ubuntu-22.04
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+        version:
+          - 1.18
+---
+name: test
+jobs:
+  job1:
+    name: test_version_1.19_on_ubuntu-22.04
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+        version:
+          - 1.19

package/gitea/source/modules/actions/jobparser/testdata/multiple_jobs.in.yaml

@@ -0,0 +1,22 @@
+name: test
+jobs:
+  zzz:
+    runs-on: linux
+    steps:
+      - run: echo zzz
+  job1:
+    runs-on: linux
+    steps:
+      - run: uname -a && go version
+  job2:
+    runs-on: linux
+    steps:
+      - run: uname -a && go version
+  job3:
+    runs-on: linux
+    steps:
+      - run: uname -a && go version
+  aaa:
+    runs-on: linux
+    steps:
+      - run: uname -a && go version

package/gitea/source/modules/actions/jobparser/testdata/multiple_jobs.out.yaml

@@ -0,0 +1,39 @@
+name: test
+jobs:
+  zzz:
+    name: zzz
+    runs-on: linux
+    steps:
+      - run: echo zzz
+---
+name: test
+jobs:
+  job1:
+    name: job1
+    runs-on: linux
+    steps:
+      - run: uname -a && go version
+---
+name: test
+jobs:
+  job2:
+    name: job2
+    runs-on: linux
+    steps:
+      - run: uname -a && go version
+---
+name: test
+jobs:
+  job3:
+    name: job3
+    runs-on: linux
+    steps:
+      - run: uname -a && go version
+---
+name: test
+jobs:
+  aaa:
+    name: aaa
+    runs-on: linux
+    steps:
+      - run: uname -a && go version

package/gitea/source/modules/actions/jobparser/testdata/multiple_matrix.in.yaml

@@ -0,0 +1,13 @@
+name: test
+jobs:
+  job1:
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-20.04]
+        version: [1.17, 1.18, 1.19]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version

package/gitea/source/modules/actions/jobparser/testdata/multiple_matrix.out.yaml

@@ -0,0 +1,101 @@
+name: test
+jobs:
+  job1:
+    name: job1 (ubuntu-20.04, 1.17)
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-20.04
+        version:
+          - 1.17
+---
+name: test
+jobs:
+  job1:
+    name: job1 (ubuntu-20.04, 1.18)
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-20.04
+        version:
+          - 1.18
+---
+name: test
+jobs:
+  job1:
+    name: job1 (ubuntu-20.04, 1.19)
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-20.04
+        version:
+          - 1.19
+---
+name: test
+jobs:
+  job1:
+    name: job1 (ubuntu-22.04, 1.17)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+        version:
+          - 1.17
+---
+name: test
+jobs:
+  job1:
+    name: job1 (ubuntu-22.04, 1.18)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+        version:
+          - 1.18
+---
+name: test
+jobs:
+  job1:
+    name: job1 (ubuntu-22.04, 1.19)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.version }}
+      - run: uname -a && go version
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+        version:
+          - 1.19

package/gitea/source/modules/actions/jobparser/testdata/null_job_explicit.in.yaml

@@ -0,0 +1,9 @@
+# null_job_explicit.in.yaml
+on: push
+jobs:
+  empty: null
+  notempty:
+    needs: empty
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo ok

package/gitea/source/modules/actions/jobparser/testdata/null_job_implicit.in.yaml

@@ -0,0 +1,9 @@
+# null_job_implicit.in.yaml
+on: push
+jobs:
+  empty:
+  notempty:
+    needs: empty
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo ok

package/gitea/source/modules/actions/jobparser/testdata/prefixed_newline.in.yaml

@@ -0,0 +1,14 @@
+name: Step with leading new line
+
+on:
+  push:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "\nExtract tag for variant"
+        id: extract_tag
+        run: |
+
+          echo Test

package/gitea/source/modules/actions/jobparser/testdata/prefixed_newline.out.yaml

@@ -0,0 +1,15 @@
+name: Step with leading new line
+"on":
+  push:
+jobs:
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    steps:
+      - id: extract_tag
+        name: |2-
+
+          Extract tag for variant
+        run: |2
+
+          echo Test

package/gitea/source/modules/actions/jobparser/testdata_test.go

@@ -0,0 +1,21 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"embed"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+//go:embed testdata
+var testdata embed.FS
+
+func ReadTestdata(t *testing.T, name string) []byte {
+	content, err := testdata.ReadFile(filepath.Join("testdata", name))
+	require.NoError(t, err)
+	return content
+}

package/gitea/source/modules/actions/log.go

@@ -33,21 +33,22 @@ const (
 // It doesn't respect the file format in the filename like ".zst", since it's difficult to reopen a closed compressed file and append new content.
 // Why doesn't it store logs in object storage directly? Because it's not efficient to append content to object storage.
 func WriteLogs(ctx context.Context, filename string, offset int64, rows []*runnerv1.LogRow) ([]int, error) {
-	flag := os.O_WRONLY
+	flag, openFileFor := os.O_WRONLY, "write-only"
 	if offset == 0 {
-		// Create file only if offset is 0, or it could result in content holes if the file doesn't exist.
-		flag |= os.O_CREATE
+		// Only allow to create file if offset is 0 (the first write), see #25560.
+		// Otherwise, it might result in content holes if the file has been deleted after transferred (actions.TransferLogs).
+		flag, openFileFor = os.O_WRONLY|os.O_CREATE, "write-create"
 	}
 	name := DBFSPrefix + filename
 	f, err := dbfs.OpenFile(ctx, name, flag)
 	if err != nil {
-		return nil, fmt.Errorf("dbfs OpenFile %q: %w", name, err)
+		return nil, fmt.Errorf("dbfs.OpenFile %q for %s: %w", name, openFileFor, err)
 	}
 	defer f.Close()
 
 	stat, err := f.Stat()
 	if err != nil {
-		return nil, fmt.Errorf("dbfs Stat %q: %w", name, err)
+		return nil, fmt.Errorf("dbfs.Stat %q: %w", name, err)
 	}
 	if stat.Size() < offset {
 		// If the size is less than offset, refuse to write, or it could result in content holes.
@@ -56,7 +57,7 @@ func WriteLogs(ctx context.Context, filename string, offset int64, rows []*runne
 	}
 
 	if _, err := f.Seek(offset, io.SeekStart); err != nil {
-		return nil, fmt.Errorf("dbfs Seek %q: %w", name, err)
+		return nil, fmt.Errorf("dbfs.Seek %q: %w", name, err)
 	}
 
 	writer := bufio.NewWriterSize(f, defaultBufSize)
@@ -121,16 +122,17 @@ const (
 // TransferLogs transfers logs from DBFS to object storage.
 // It happens when the file is complete and no more logs will be appended.
 // It respects the file format in the filename like ".zst", and compresses the content if needed.
+// The task log file must be marked as "log_in_storage=true" after the transfer.
 func TransferLogs(ctx context.Context, filename string) (func(), error) {
 	name := DBFSPrefix + filename
 	remove := func() {
 		if err := dbfs.Remove(ctx, name); err != nil {
-			log.Warn("dbfs remove %q: %v", name, err)
+			log.Warn("dbfs.Remove %q: %v", name, err)
 		}
 	}
 	f, err := dbfs.Open(ctx, name)
 	if err != nil {
-		return nil, fmt.Errorf("dbfs open %q: %w", name, err)
+		return nil, fmt.Errorf("dbfs.Open %q: %w", name, err)
 	}
 	defer f.Close()
 
@@ -164,7 +166,7 @@ func RemoveLogs(ctx context.Context, inStorage bool, filename string) error {
 		name := DBFSPrefix + filename
 		err := dbfs.Remove(ctx, name)
 		if err != nil {
-			return fmt.Errorf("dbfs remove %q: %w", name, err)
+			return fmt.Errorf("dbfs.Remove %q: %w", name, err)
 		}
 		return nil
 	}
@@ -180,7 +182,7 @@ func OpenLogs(ctx context.Context, inStorage bool, filename string) (io.ReadSeek
 		name := DBFSPrefix + filename
 		f, err := dbfs.Open(ctx, name)
 		if err != nil {
-			return nil, fmt.Errorf("dbfs open %q: %w", name, err)
+			return nil, fmt.Errorf("dbfs.Open %q: %w", name, err)
 		}
 		return f, nil
 	}

package/gitea/source/modules/actions/workflows.go

@@ -8,17 +8,18 @@ import (
 	"slices"
 	"strings"
 
+	"code.gitea.io/gitea/modules/actions/jobparser"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/glob"
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
 	webhook_module "code.gitea.io/gitea/modules/webhook"
 
-	"github.com/nektos/act/pkg/jobparser"
 	"github.com/nektos/act/pkg/model"
 	"github.com/nektos/act/pkg/workflowpattern"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type DetectedWorkflow struct {
@@ -41,22 +42,30 @@ func IsWorkflow(path string) bool {
 		return false
 	}
 
-	return strings.HasPrefix(path, ".gitea/workflows") || strings.HasPrefix(path, ".github/workflows")
+	for _, workflowDir := range setting.Actions.WorkflowDirs {
+		if strings.HasPrefix(path, workflowDir+"/") {
+			return true
+		}
+	}
+	return false
 }
 
 func ListWorkflows(commit *git.Commit) (string, git.Entries, error) {
-	rpath := ".gitea/workflows"
-	tree, err := commit.SubTree(rpath)
-	if _, ok := err.(git.ErrNotExist); ok {
-		rpath = ".github/workflows"
-		tree, err = commit.SubTree(rpath)
+	var tree *git.Tree
+	var err error
+	var workflowDir string
+	for _, workflowDir = range setting.Actions.WorkflowDirs {
+		tree, err = commit.SubTree(workflowDir)
+		if err == nil {
+			break
+		}
+		if !git.IsErrNotExist(err) {
+			return "", nil, err
+		}
 	}
-	if _, ok := err.(git.ErrNotExist); ok {
+	if tree == nil {
 		return "", nil, nil
 	}
-	if err != nil {
-		return "", nil, err
-	}
 
 	entries, err := tree.ListEntriesRecursiveFast()
 	if err != nil {
@@ -69,7 +78,7 @@ func ListWorkflows(commit *git.Commit) (string, git.Entries, error) {
 			ret = append(ret, entry)
 		}
 	}
-	return rpath, ret, nil
+	return workflowDir, ret, nil
 }
 
 func GetContentFromEntry(entry *git.TreeEntry) ([]byte, error) {
@@ -94,10 +103,20 @@ func GetEventsFromContent(content []byte) ([]*jobparser.Event, error) {
 	if err != nil {
 		return nil, err
 	}
+	if err := ValidateWorkflowContent(content); err != nil {
+		return nil, err
+	}
 
 	return events, nil
 }
 
+// ValidateWorkflowContent catches structural errors (e.g. blank lines in run: | blocks)
+// that model.ReadWorkflow alone does not detect.
+func ValidateWorkflowContent(content []byte) error {
+	_, err := jobparser.Parse(content)
+	return err
+}
+
 func DetectWorkflows(
 	gitRepo *git.Repository,
 	commit *git.Commit,

package/gitea/source/modules/actions/workflows_test.go

@@ -7,12 +7,93 @@ import (
 	"testing"
 
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
+	"code.gitea.io/gitea/modules/test"
 	webhook_module "code.gitea.io/gitea/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 )
 
+func fullWorkflowContent(part string) []byte {
+	return []byte(`
+name: test
+` + part + `
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo hello
+`)
+}
+
+func TestIsWorkflow(t *testing.T) {
+	defer test.MockVariableValue(&setting.Actions.WorkflowDirs)()
+
+	tests := []struct {
+		name     string
+		dirs     []string
+		path     string
+		expected bool
+	}{
+		{
+			name:     "default with yml extension",
+			dirs:     []string{".gitea/workflows", ".github/workflows"},
+			path:     ".gitea/workflows/test.yml",
+			expected: true,
+		},
+		{
+			name:     "default with yaml extension",
+			dirs:     []string{".gitea/workflows", ".github/workflows"},
+			path:     ".github/workflows/test.yaml",
+			expected: true,
+		},
+		{
+			name:     "only gitea configured, github path rejected",
+			dirs:     []string{".gitea/workflows"},
+			path:     ".github/workflows/test.yml",
+			expected: false,
+		},
+		{
+			name:     "only github configured, gitea path rejected",
+			dirs:     []string{".github/workflows"},
+			path:     ".gitea/workflows/test.yml",
+			expected: false,
+		},
+		{
+			name:     "custom workflow dir",
+			dirs:     []string{".custom/workflows"},
+			path:     ".custom/workflows/deploy.yml",
+			expected: true,
+		},
+		{
+			name:     "non-workflow file",
+			dirs:     []string{".gitea/workflows", ".github/workflows"},
+			path:     ".gitea/workflows/readme.md",
+			expected: false,
+		},
+		{
+			name:     "directory boundary",
+			dirs:     []string{".gitea/workflows"},
+			path:     ".gitea/workflows2/test.yml",
+			expected: false,
+		},
+		{
+			name:     "unrelated path",
+			dirs:     []string{".gitea/workflows", ".github/workflows"},
+			path:     "src/main.go",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setting.Actions.WorkflowDirs = tt.dirs
+			assert.Equal(t, tt.expected, IsWorkflow(tt.path))
+		})
+	}
+}
+
 func TestDetectMatched(t *testing.T) {
 	testCases := []struct {
 		desc         string
@@ -119,7 +200,7 @@ func TestDetectMatched(t *testing.T) {
 			expected:     true,
 		},
 		{
-			desc:         "HookEventSchedue(schedule) matches GithubEventSchedule(schedule)",
+			desc:         "HookEventSchedule(schedule) matches GithubEventSchedule(schedule)",
 			triggedEvent: webhook_module.HookEventSchedule,
 			payload:      nil,
 			yamlOn:       "on: schedule",
@@ -147,7 +228,7 @@ func TestDetectMatched(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
-			evts, err := GetEventsFromContent([]byte(tc.yamlOn))
+			evts, err := GetEventsFromContent(fullWorkflowContent(tc.yamlOn))
 			assert.NoError(t, err)
 			assert.Len(t, evts, 1)
 			assert.Equal(t, tc.expected, detectMatched(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
@@ -302,7 +383,7 @@ func TestMatchIssuesEvent(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
-			evts, err := GetEventsFromContent([]byte(tc.yamlOn))
+			evts, err := GetEventsFromContent(fullWorkflowContent(tc.yamlOn))
 			assert.NoError(t, err)
 			assert.Len(t, evts, 1)
 

package/gitea/source/modules/activitypub/client.go

@@ -1,124 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package activitypub
-
-import (
-	"bytes"
-	"context"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/pem"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/setting"
-
-	"github.com/42wim/httpsig"
-)
-
-const (
-	// ActivityStreamsContentType const
-	ActivityStreamsContentType = `application/ld+json; profile="https://www.w3.org/ns/activitystreams"`
-	httpsigExpirationTime      = 60
-)
-
-// Gets the current time as an RFC 2616 formatted string
-// RFC 2616 requires RFC 1123 dates but with GMT instead of UTC
-func CurrentTime() string {
-	return strings.ReplaceAll(time.Now().UTC().Format(time.RFC1123), "UTC", "GMT")
-}
-
-func containsRequiredHTTPHeaders(method string, headers []string) error {
-	var hasRequestTarget, hasDate, hasDigest bool
-	for _, header := range headers {
-		hasRequestTarget = hasRequestTarget || header == httpsig.RequestTarget
-		hasDate = hasDate || header == "Date"
-		hasDigest = hasDigest || header == "Digest"
-	}
-	if !hasRequestTarget {
-		return fmt.Errorf("missing http header for %s: %s", method, httpsig.RequestTarget)
-	} else if !hasDate {
-		return fmt.Errorf("missing http header for %s: Date", method)
-	} else if !hasDigest && method != http.MethodGet {
-		return fmt.Errorf("missing http header for %s: Digest", method)
-	}
-	return nil
-}
-
-// Client struct
-type Client struct {
-	client      *http.Client
-	algs        []httpsig.Algorithm
-	digestAlg   httpsig.DigestAlgorithm
-	getHeaders  []string
-	postHeaders []string
-	priv        *rsa.PrivateKey
-	pubID       string
-}
-
-// NewClient function
-func NewClient(ctx context.Context, user *user_model.User, pubID string) (c *Client, err error) {
-	if err = containsRequiredHTTPHeaders(http.MethodGet, setting.Federation.GetHeaders); err != nil {
-		return nil, err
-	} else if err = containsRequiredHTTPHeaders(http.MethodPost, setting.Federation.PostHeaders); err != nil {
-		return nil, err
-	}
-
-	priv, err := GetPrivateKey(ctx, user)
-	if err != nil {
-		return nil, err
-	}
-	privPem, _ := pem.Decode([]byte(priv))
-	privParsed, err := x509.ParsePKCS1PrivateKey(privPem.Bytes)
-	if err != nil {
-		return nil, err
-	}
-
-	c = &Client{
-		client: &http.Client{
-			Transport: &http.Transport{
-				Proxy: proxy.Proxy(),
-			},
-		},
-		algs:        setting.HttpsigAlgs,
-		digestAlg:   httpsig.DigestAlgorithm(setting.Federation.DigestAlgorithm),
-		getHeaders:  setting.Federation.GetHeaders,
-		postHeaders: setting.Federation.PostHeaders,
-		priv:        privParsed,
-		pubID:       pubID,
-	}
-	return c, err
-}
-
-// NewRequest function
-func (c *Client) NewRequest(b []byte, to string) (req *http.Request, err error) {
-	buf := bytes.NewBuffer(b)
-	req, err = http.NewRequest(http.MethodPost, to, buf)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Add("Content-Type", ActivityStreamsContentType)
-	req.Header.Add("Date", CurrentTime())
-	req.Header.Add("User-Agent", "Gitea/"+setting.AppVer)
-	signer, _, err := httpsig.NewSigner(c.algs, c.digestAlg, c.postHeaders, httpsig.Signature, httpsigExpirationTime)
-	if err != nil {
-		return nil, err
-	}
-	err = signer.SignRequest(c.priv, c.pubID, req, b)
-	return req, err
-}
-
-// Post function
-func (c *Client) Post(b []byte, to string) (resp *http.Response, err error) {
-	var req *http.Request
-	if req, err = c.NewRequest(b, to); err != nil {
-		return nil, err
-	}
-	resp, err = c.client.Do(req)
-	return resp, err
-}

package/gitea/source/modules/activitypub/client_test.go

@@ -1,45 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package activitypub
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestActivityPubSignedPost(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	pubID := "https://example.com/pubID"
-	c, err := NewClient(t.Context(), user, pubID)
-	assert.NoError(t, err)
-
-	expected := "BODY"
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Regexp(t, "^"+setting.Federation.DigestAlgorithm, r.Header.Get("Digest"))
-		assert.Contains(t, r.Header.Get("Signature"), pubID)
-		assert.Equal(t, ActivityStreamsContentType, r.Header.Get("Content-Type"))
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		assert.Equal(t, expected, string(body))
-		fmt.Fprint(w, expected)
-	}))
-	defer srv.Close()
-
-	r, err := c.Post([]byte(expected), srv.URL)
-	assert.NoError(t, err)
-	defer r.Body.Close()
-	body, err := io.ReadAll(r.Body)
-	assert.NoError(t, err)
-	assert.Equal(t, expected, string(body))
-}

package/gitea/source/modules/activitypub/main_test.go

@@ -1,18 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package activitypub
-
-import (
-	"testing"
-
-	"code.gitea.io/gitea/models/unittest"
-
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-)
-
-func TestMain(m *testing.M) {
-	unittest.MainTest(m)
-}

package/gitea/source/modules/activitypub/user_settings.go

@@ -1,48 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package activitypub
-
-import (
-	"context"
-
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
-)
-
-const rsaBits = 3072
-
-// GetKeyPair function returns a user's private and public keys
-func GetKeyPair(ctx context.Context, user *user_model.User) (pub, priv string, err error) {
-	var settings map[string]*user_model.Setting
-	settings, err = user_model.GetSettings(ctx, user.ID, []string{user_model.UserActivityPubPrivPem, user_model.UserActivityPubPubPem})
-	if err != nil {
-		return pub, priv, err
-	} else if len(settings) == 0 {
-		if priv, pub, err = util.GenerateKeyPair(rsaBits); err != nil {
-			return pub, priv, err
-		}
-		if err = user_model.SetUserSetting(ctx, user.ID, user_model.UserActivityPubPrivPem, priv); err != nil {
-			return pub, priv, err
-		}
-		if err = user_model.SetUserSetting(ctx, user.ID, user_model.UserActivityPubPubPem, pub); err != nil {
-			return pub, priv, err
-		}
-		return pub, priv, err
-	}
-	priv = settings[user_model.UserActivityPubPrivPem].SettingValue
-	pub = settings[user_model.UserActivityPubPubPem].SettingValue
-	return pub, priv, err
-}
-
-// GetPublicKey function returns a user's public key
-func GetPublicKey(ctx context.Context, user *user_model.User) (pub string, err error) {
-	pub, _, err = GetKeyPair(ctx, user)
-	return pub, err
-}
-
-// GetPrivateKey function returns a user's private key
-func GetPrivateKey(ctx context.Context, user *user_model.User) (priv string, err error) {
-	_, priv, err = GetKeyPair(ctx, user)
-	return priv, err
-}

package/gitea/source/modules/activitypub/user_settings_test.go

@@ -1,28 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package activitypub
-
-import (
-	"testing"
-
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-
-	_ "code.gitea.io/gitea/models" // https://forum.gitea.com/t/testfixtures-could-not-clean-table-access-no-such-table-access/4137/4
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUserSettings(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-	user1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	pub, priv, err := GetKeyPair(t.Context(), user1)
-	assert.NoError(t, err)
-	pub1, err := GetPublicKey(t.Context(), user1)
-	assert.NoError(t, err)
-	assert.Equal(t, pub, pub1)
-	priv1, err := GetPrivateKey(t.Context(), user1)
-	assert.NoError(t, err)
-	assert.Equal(t, priv, priv1)
-}

package/gitea/source/modules/analyze/code_language.go

@@ -4,12 +4,13 @@
 package analyze
 
 import (
-	"path/filepath"
+	"path"
 
 	"github.com/go-enry/go-enry/v2"
 )
 
 // GetCodeLanguage detects code language based on file name and content
+// It can be slow when the content is used for detection
 func GetCodeLanguage(filename string, content []byte) string {
 	if language, ok := enry.GetLanguageByExtension(filename); ok {
 		return language
@@ -23,5 +24,5 @@ func GetCodeLanguage(filename string, content []byte) string {
 		return enry.OtherLanguage
 	}
 
-	return enry.GetLanguage(filepath.Base(filename), content)
+	return enry.GetLanguage(path.Base(filename), content)
 }

package/gitea/source/modules/analyze/vendor.go

@@ -4,10 +4,28 @@
 package analyze
 
 import (
+	"path"
+	"strings"
+
 	"github.com/go-enry/go-enry/v2"
 )
 
-// IsVendor returns whether or not path is a vendor path.
-func IsVendor(path string) bool {
-	return enry.IsVendor(path)
+// IsVendor returns whether the path is a vendor path.
+// It uses go-enry's IsVendor function but overrides its detection for certain
+// special cases that shouldn't be marked as vendored in the diff view.
+func IsVendor(treePath string) bool {
+	if !enry.IsVendor(treePath) {
+		return false
+	}
+
+	// Override detection for single files
+	basename := path.Base(treePath)
+	switch basename {
+	case ".gitignore", ".gitattributes", ".gitmodules":
+		return false
+	}
+	if strings.HasPrefix(treePath, ".github/") || strings.HasPrefix(treePath, ".gitea/") {
+		return false
+	}
+	return true
 }

package/gitea/source/modules/analyze/vendor_test.go

@@ -14,6 +14,7 @@ func TestIsVendor(t *testing.T) {
 		path string
 		want bool
 	}{
+		// Original go-enry test cases
 		{"cache/", true},
 		{"random/cache/", true},
 		{"cache", false},
@@ -34,6 +35,14 @@ func TestIsVendor(t *testing.T) {
 		{"a/docs/_build/", true},
 		{"a/dasdocs/_build-vsdoc.js", true},
 		{"a/dasdocs/_build-vsdoc.j", false},
+
+		// Override: Git/GitHub/Gitea-related paths should NOT be detected as vendored
+		{".gitignore", false},
+		{".gitattributes", false},
+		{".gitmodules", false},
+		{"src/.gitignore", false},
+		{".github/workflows/ci.yml", false},
+		{".gitea/workflows/ci.yml", false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.path, func(t *testing.T) {

package/gitea/source/modules/assetfs/embed.go

@@ -260,7 +260,7 @@ func (fi *embeddedFileInfo) Mode() fs.FileMode {
 }
 
 func (fi *embeddedFileInfo) ModTime() time.Time {
-	return getExecutableModTime()
+	return GetExecutableModTime()
 }
 
 func (fi *embeddedFileInfo) IsDir() bool {
@@ -279,9 +279,9 @@ func (fi *embeddedFileInfo) Info() (fs.FileInfo, error) {
 	return fi, nil
 }
 
-// getExecutableModTime returns the modification time of the executable file.
+// GetExecutableModTime returns the modification time of the executable file.
 // In bindata, we can't use the ModTime of the files because we need to make the build reproducible
-var getExecutableModTime = sync.OnceValue(func() (modTime time.Time) {
+var GetExecutableModTime = sync.OnceValue(func() (modTime time.Time) {
 	exePath, err := os.Executable()
 	if err != nil {
 		return modTime
@@ -365,11 +365,11 @@ func GenerateEmbedBindata(fsRootPath, outputFile string) error {
 	if err = embedFiles(meta.Root, fsRootPath, ""); err != nil {
 		return err
 	}
-	jsonBuf, err := json.Marshal(meta) // can't use json.NewEncoder here because it writes extra EOL
+	jsonBuf, err := json.Marshal(meta)
 	if err != nil {
 		return err
 	}
 	_, _ = output.Write([]byte{'\n'})
-	_, err = output.Write(jsonBuf)
+	_, err = output.Write(bytes.TrimSpace(jsonBuf))
 	return err
 }

package/gitea/source/modules/assetfs/layered.go

@@ -6,12 +6,12 @@ package assetfs
 import (
 	"context"
 	"fmt"
-	"io"
 	"io/fs"
-	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"sort"
+	"strings"
 	"time"
 
 	"code.gitea.io/gitea/modules/container"
@@ -25,7 +25,7 @@ import (
 // Layer represents a layer in a layered asset file-system. It has a name and works like http.FileSystem
 type Layer struct {
 	name      string
-	fs        http.FileSystem
+	fs        fs.FS
 	localPath string
 }
 
@@ -34,7 +34,7 @@ func (l *Layer) Name() string {
 }
 
 // Open opens the named file. The caller is responsible for closing the file.
-func (l *Layer) Open(name string) (http.File, error) {
+func (l *Layer) Open(name string) (fs.File, error) {
 	return l.fs.Open(name)
 }
 
@@ -48,12 +48,12 @@ func Local(name, base string, sub ...string) *Layer {
 		panic(fmt.Sprintf("Unable to get absolute path for %q: %v", base, err))
 	}
 	root := util.FilePathJoinAbs(base, sub...)
-	return &Layer{name: name, fs: http.Dir(root), localPath: root}
+	return &Layer{name: name, fs: os.DirFS(root), localPath: root}
 }
 
 // Bindata returns a new Layer with the given name, it serves files from the given bindata asset.
 func Bindata(name string, fs fs.FS) *Layer {
-	return &Layer{name: name, fs: http.FS(fs)}
+	return &Layer{name: name, fs: fs}
 }
 
 // LayeredFS is a layered asset file-system. It works like http.FileSystem, but it can have multiple layers.
@@ -63,13 +63,15 @@ type LayeredFS struct {
 	layers []*Layer
 }
 
+var _ fs.ReadDirFS = (*LayeredFS)(nil)
+
 // Layered returns a new LayeredFS with the given layers. The first layer is the top layer.
 func Layered(layers ...*Layer) *LayeredFS {
 	return &LayeredFS{layers: layers}
 }
 
 // Open opens the named file. The caller is responsible for closing the file.
-func (l *LayeredFS) Open(name string) (http.File, error) {
+func (l *LayeredFS) Open(name string) (fs.File, error) {
 	for _, layer := range l.layers {
 		f, err := layer.Open(name)
 		if err == nil || !os.IsNotExist(err) {
@@ -85,44 +87,59 @@ func (l *LayeredFS) ReadFile(elems ...string) ([]byte, error) {
 	return bs, err
 }
 
+func (l *LayeredFS) ReadDir(name string) (files []fs.DirEntry, _ error) {
+	filesMap := map[string]fs.DirEntry{}
+	for _, layer := range l.layers {
+		entries, err := readDirOptional(layer, name)
+		if err != nil {
+			return nil, err
+		}
+		for _, entry := range entries {
+			entryName := entry.Name()
+			if _, exist := filesMap[entryName]; !exist && shouldInclude(entry) {
+				filesMap[entryName] = entry
+			}
+		}
+	}
+	for _, file := range filesMap {
+		files = append(files, file)
+	}
+	slices.SortFunc(files, func(a, b fs.DirEntry) int { return strings.Compare(a.Name(), b.Name()) })
+	return files, nil
+}
+
 // ReadLayeredFile reads the named file, and returns the layer name.
 func (l *LayeredFS) ReadLayeredFile(elems ...string) ([]byte, string, error) {
 	name := util.PathJoinRel(elems...)
 	for _, layer := range l.layers {
-		f, err := layer.Open(name)
+		bs, err := fs.ReadFile(layer, name)
 		if os.IsNotExist(err) {
 			continue
 		} else if err != nil {
 			return nil, layer.name, err
 		}
-		bs, err := io.ReadAll(f)
-		_ = f.Close()
 		return bs, layer.name, err
 	}
 	return nil, "", fs.ErrNotExist
 }
 
-func shouldInclude(info fs.FileInfo, fileMode ...bool) bool {
-	if util.IsCommonHiddenFileName(info.Name()) {
+func shouldInclude(dirEntry fs.DirEntry, fileMode ...bool) bool {
+	if util.IsCommonHiddenFileName(dirEntry.Name()) {
 		return false
 	}
 	if len(fileMode) == 0 {
 		return true
 	} else if len(fileMode) == 1 {
-		return fileMode[0] == !info.Mode().IsDir()
+		return fileMode[0] == !dirEntry.IsDir()
 	}
 	panic("too many arguments for fileMode in shouldInclude")
 }
 
-func readDir(layer *Layer, name string) ([]fs.FileInfo, error) {
-	f, err := layer.Open(name)
-	if os.IsNotExist(err) {
+func readDirOptional(layer *Layer, name string) (entries []fs.DirEntry, err error) {
+	if entries, err = fs.ReadDir(layer, name); os.IsNotExist(err) {
 		return nil, nil
-	} else if err != nil {
-		return nil, err
 	}
-	defer f.Close()
-	return f.Readdir(-1)
+	return entries, err
 }
 
 // ListFiles lists files/directories in the given directory. The fileMode controls the returned files.
@@ -133,13 +150,13 @@ func readDir(layer *Layer, name string) ([]fs.FileInfo, error) {
 func (l *LayeredFS) ListFiles(name string, fileMode ...bool) ([]string, error) {
 	fileSet := make(container.Set[string])
 	for _, layer := range l.layers {
-		infos, err := readDir(layer, name)
+		entries, err := readDirOptional(layer, name)
 		if err != nil {
 			return nil, err
 		}
-		for _, info := range infos {
-			if shouldInclude(info, fileMode...) {
-				fileSet.Add(info.Name())
+		for _, entry := range entries {
+			if shouldInclude(entry, fileMode...) {
+				fileSet.Add(entry.Name())
 			}
 		}
 	}
@@ -163,16 +180,16 @@ func listAllFiles(layers []*Layer, name string, fileMode ...bool) ([]string, err
 	var list func(dir string) error
 	list = func(dir string) error {
 		for _, layer := range layers {
-			infos, err := readDir(layer, dir)
+			entries, err := readDirOptional(layer, dir)
 			if err != nil {
 				return err
 			}
-			for _, info := range infos {
-				path := util.PathJoinRelX(dir, info.Name())
-				if shouldInclude(info, fileMode...) {
+			for _, entry := range entries {
+				path := util.PathJoinRelX(dir, entry.Name())
+				if shouldInclude(entry, fileMode...) {
 					fileSet.Add(path)
 				}
-				if info.IsDir() {
+				if entry.IsDir() {
 					if err = list(path); err != nil {
 						return err
 					}

package/gitea/source/modules/auth/pam/pam.go

@@ -8,7 +8,7 @@ package pam
 import (
 	"errors"
 
-	"github.com/msteinert/pam"
+	"github.com/msteinert/pam/v2"
 )
 
 // Supported is true when built with PAM
@@ -28,6 +28,7 @@ func Auth(serviceName, userName, passwd string) (string, error) {
 	if err != nil {
 		return "", err
 	}
+	defer t.End()
 
 	if err = t.Authenticate(0); err != nil {
 		return "", err

package/gitea/source/modules/auth/password/hash/argon2.go

@@ -61,17 +61,11 @@ func NewArgon2Hasher(config string) *Argon2Hasher {
 		return nil
 	}
 
-	parsed, err := parseUIntParam(vals[0], "time", "argon2", config, nil)
-	hasher.time = uint32(parsed)
-
-	parsed, err = parseUIntParam(vals[1], "memory", "argon2", config, err)
-	hasher.memory = uint32(parsed)
-
-	parsed, err = parseUIntParam(vals[2], "threads", "argon2", config, err)
-	hasher.threads = uint8(parsed)
-
-	parsed, err = parseUIntParam(vals[3], "keyLen", "argon2", config, err)
-	hasher.keyLen = uint32(parsed)
+	var err error
+	hasher.time, err = parseUintParam[uint32](vals[0], "time", "argon2", config, nil)
+	hasher.memory, err = parseUintParam[uint32](vals[1], "memory", "argon2", config, err)
+	hasher.threads, err = parseUintParam[uint8](vals[2], "threads", "argon2", config, err)
+	hasher.keyLen, err = parseUintParam[uint32](vals[3], "keyLen", "argon2", config, err)
 	if err != nil {
 		return nil
 	}

package/gitea/source/modules/auth/password/hash/common.go

@@ -7,6 +7,7 @@ import (
 	"strconv"
 
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/util"
 )
 
 func parseIntParam(value, param, algorithmName, config string, previousErr error) (int, error) {
@@ -18,11 +19,12 @@ func parseIntParam(value, param, algorithmName, config string, previousErr error
 	return parsed, previousErr // <- Keep the previous error as this function should still return an error once everything has been checked if any call failed
 }
 
-func parseUIntParam(value, param, algorithmName, config string, previousErr error) (uint64, error) { //nolint:unparam // algorithmName is always argon2
-	parsed, err := strconv.ParseUint(value, 10, 64)
+func parseUintParam[T uint32 | uint8](value, param, algorithmName, config string, previousErr error) (ret T, _ error) {
+	_, isUint32 := any(ret).(uint32)
+	parsed, err := strconv.ParseUint(value, 10, util.Iif(isUint32, 32, 8))
 	if err != nil {
 		log.Error("invalid integer for %s representation in %s hash spec %s", param, algorithmName, config)
 		return 0, err
 	}
-	return parsed, previousErr // <- Keep the previous error as this function should still return an error once everything has been checked if any call failed
+	return T(parsed), previousErr // <- Keep the previous error as this function should still return an error once everything has been checked if any call failed
 }

package/gitea/source/modules/auth/password/hash/setting.go

@@ -14,7 +14,7 @@ const DefaultHashAlgorithmName = "pbkdf2"
 
 var DefaultHashAlgorithm *PasswordHashAlgorithm
 
-// aliasAlgorithNames provides a mapping between the value of PASSWORD_HASH_ALGO
+// aliasAlgorithmNames provides a mapping between the value of PASSWORD_HASH_ALGO
 // configured in the app.ini and the parameters used within the hashers internally.
 //
 // If it is necessary to change the default parameters for any hasher in future you

package/gitea/source/modules/auth/password/pwn/pwn.go

@@ -72,7 +72,7 @@ func newRequest(ctx context.Context, method, url string, body io.ReadCloser) (*h
 // Adding padding will make requests more secure, however is also slower
 // because artificial responses will be added to the response
 // For more information, see https://www.troyhunt.com/enhancing-pwned-passwords-privacy-with-padding/
-func (c *Client) CheckPassword(pw string, padding bool) (int, error) {
+func (c *Client) CheckPassword(pw string, padding bool) (int64, error) {
 	if pw == "" {
 		return -1, ErrEmptyPassword
 	}
@@ -111,7 +111,7 @@ func (c *Client) CheckPassword(pw string, padding bool) (int, error) {
 			if err != nil {
 				return -1, err
 			}
-			return int(count), nil
+			return count, nil
 		}
 	}
 	return 0, nil

package/gitea/source/modules/auth/password/pwn/pwn_test.go

@@ -37,25 +37,25 @@ func TestPassword(t *testing.T) {
 
 	count, err := client.CheckPassword("", false)
 	assert.ErrorIs(t, err, ErrEmptyPassword, "blank input should return ErrEmptyPassword")
-	assert.Equal(t, -1, count)
+	assert.EqualValues(t, -1, count)
 
 	count, err = client.CheckPassword("pwned", false)
 	assert.NoError(t, err)
-	assert.Equal(t, 1, count)
+	assert.EqualValues(t, 1, count)
 
 	count, err = client.CheckPassword("notpwned", false)
 	assert.NoError(t, err)
-	assert.Equal(t, 0, count)
+	assert.EqualValues(t, 0, count)
 
 	count, err = client.CheckPassword("paddedpwned", true)
 	assert.NoError(t, err)
-	assert.Equal(t, 1, count)
+	assert.EqualValues(t, 1, count)
 
 	count, err = client.CheckPassword("paddednotpwned", true)
 	assert.NoError(t, err)
-	assert.Equal(t, 0, count)
+	assert.EqualValues(t, 0, count)
 
 	count, err = client.CheckPassword("paddednotpwnedzero", true)
 	assert.NoError(t, err)
-	assert.Equal(t, 0, count)
+	assert.EqualValues(t, 0, count)
 }

package/gitea/source/modules/auth/webauthn/webauthn.go

@@ -22,7 +22,7 @@ var WebAuthn *webauthn.WebAuthn
 
 // Init initializes the WebAuthn instance from the config.
 func Init() {
-	gob.Register(&webauthn.SessionData{})
+	gob.Register(&webauthn.SessionData{}) // TODO: CHI-SESSION-GOB-REGISTER.
 
 	appURL, _ := protocol.FullyQualifiedOrigin(setting.AppURL)
 

package/gitea/source/modules/avatar/avatar.go

@@ -28,21 +28,18 @@ import (
 // than the size after resizing.
 const DefaultAvatarSize = 256
 
-// RandomImageSize generates and returns a random avatar image unique to input data
+// RandomImageWithSize generates and returns a random avatar image unique to input data
 // in custom size (height and width).
-func RandomImageSize(size int, data []byte) (image.Image, error) {
+func RandomImageWithSize(size int, data []byte) image.Image {
 	// we use white as background, and use dark colors to draw blocks
-	imgMaker, err := identicon.New(size, color.White, identicon.DarkColors...)
-	if err != nil {
-		return nil, fmt.Errorf("identicon.New: %w", err)
-	}
-	return imgMaker.Make(data), nil
+	imgMaker := identicon.New(size, color.White, identicon.DarkColors)
+	return imgMaker.Make(data)
 }
 
-// RandomImage generates and returns a random avatar image unique to input data
+// RandomImageDefaultSize generates and returns a random avatar image unique to input data
 // in default size (height and width).
-func RandomImage(data []byte) (image.Image, error) {
-	return RandomImageSize(DefaultAvatarSize*setting.Avatar.RenderedSizeFactor, data)
+func RandomImageDefaultSize(data []byte) image.Image {
+	return RandomImageWithSize(DefaultAvatarSize*setting.Avatar.RenderedSizeFactor, data)
 }
 
 // processAvatarImage process the avatar image data, crop and resize it if necessary.

package/gitea/source/modules/avatar/avatar_test.go

@@ -15,19 +15,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_RandomImageSize(t *testing.T) {
-	_, err := RandomImageSize(0, []byte("gitea@local"))
-	assert.Error(t, err)
-
-	_, err = RandomImageSize(64, []byte("gitea@local"))
-	assert.NoError(t, err)
-}
-
-func Test_RandomImage(t *testing.T) {
-	_, err := RandomImage([]byte("gitea@local"))
-	assert.NoError(t, err)
-}
-
 func Test_ProcessAvatarPNG(t *testing.T) {
 	setting.Avatar.MaxWidth = 4096
 	setting.Avatar.MaxHeight = 4096
@@ -134,3 +121,18 @@ func Test_ProcessAvatarImage(t *testing.T) {
 	_, err = processAvatarImage(origin, 262144)
 	assert.ErrorContains(t, err, "image width is too large: 10 > 5")
 }
+
+func BenchmarkRandomImage(b *testing.B) {
+	b.Run("size-48", func(b *testing.B) {
+		for b.Loop() {
+			// BenchmarkRandomImage/size-48-12         	   49549	     22899 ns/op
+			RandomImageWithSize(48, []byte("test-content"))
+		}
+	})
+	b.Run("size-96", func(b *testing.B) {
+		for b.Loop() {
+			// BenchmarkRandomImage/size-96-12         	   13816	     88187 ns/op
+			RandomImageWithSize(96, []byte("test-content"))
+		}
+	})
+}

package/gitea/source/modules/avatar/identicon/identicon.go

@@ -8,13 +8,14 @@ package identicon
 
 import (
 	"crypto/sha256"
-	"errors"
-	"fmt"
 	"image"
 	"image/color"
 )
 
-const minImageSize = 16
+const (
+	minImageSize = 16
+	maxImageSize = 2048
+)
 
 // Identicon is used to generate pseudo-random avatars
 type Identicon struct {
@@ -24,25 +25,17 @@ type Identicon struct {
 	rect       image.Rectangle
 }
 
-// New returns an Identicon struct with the correct settings
-// size image size
-// back background color
-// fore all possible foreground colors. only one foreground color will be picked randomly for one image
-func New(size int, back color.Color, fore ...color.Color) (*Identicon, error) {
-	if len(fore) == 0 {
-		return nil, errors.New("foreground is not set")
-	}
-
-	if size < minImageSize {
-		return nil, fmt.Errorf("size %d is smaller than min size %d", size, minImageSize)
-	}
-
+// New returns an Identicon struct.
+// Only one foreground color will be picked randomly for one image.
+func New(size int, backColor color.Color, foreColors []color.Color) *Identicon {
+	size = max(size, minImageSize)
+	size = min(size, maxImageSize)
 	return &Identicon{
-		foreColors: fore,
-		backColor:  back,
+		foreColors: foreColors,
+		backColor:  backColor,
 		size:       size,
 		rect:       image.Rect(0, 0, size, size),
-	}, nil
+	}
 }
 
 // Make generates an avatar by data

package/gitea/source/modules/avatar/identicon/identicon_test.go

@@ -23,7 +23,7 @@ func TestGenerate(t *testing.T) {
 	}
 
 	backColor := color.White
-	imgMaker, err := New(64, backColor, DarkColors...)
+	imgMaker, err := New(64, backColor, DarkColors)
 	assert.NoError(t, err)
 	for i := 0; i < 100; i++ {
 		s := strconv.Itoa(i)

package/gitea/source/modules/base/natural_sort.go

@@ -41,8 +41,8 @@ func naturalSortAdvance(str string, pos int) (end int, isNumber bool) {
 	return end, isNumber
 }
 
-// NaturalSortLess compares two strings so that they could be sorted in natural order
-func NaturalSortLess(s1, s2 string) bool {
+// NaturalSortCompare compares two strings so that they could be sorted in natural order
+func NaturalSortCompare(s1, s2 string) int {
 	// There is a bug in Golang's collate package: https://github.com/golang/go/issues/67997
 	// text/collate: CompareString(collate.Numeric) returns wrong result for "0.0" vs "1.0" #67997
 	// So we need to handle the number parts by ourselves
@@ -55,16 +55,16 @@ func NaturalSortLess(s1, s2 string) bool {
 		if isNum1 && isNum2 {
 			if part1 != part2 {
 				if len(part1) != len(part2) {
-					return len(part1) < len(part2)
+					return len(part1) - len(part2)
 				}
-				return part1 < part2
+				return c.CompareString(part1, part2)
 			}
 		} else {
 			if cmp := c.CompareString(part1, part2); cmp != 0 {
-				return cmp < 0
+				return cmp
 			}
 		}
 		pos1, pos2 = end1, end2
 	}
-	return len(s1) < len(s2)
+	return len(s1) - len(s2)
 }

package/gitea/source/modules/base/natural_sort_test.go

@@ -11,12 +11,10 @@ import (
 
 func TestNaturalSortLess(t *testing.T) {
 	testLess := func(s1, s2 string) {
-		assert.True(t, NaturalSortLess(s1, s2), "s1<s2 should be true: s1=%q, s2=%q", s1, s2)
-		assert.False(t, NaturalSortLess(s2, s1), "s2<s1 should be false: s1=%q, s2=%q", s1, s2)
+		assert.Negative(t, NaturalSortCompare(s1, s2), "s1<s2 should be true: s1=%q, s2=%q", s1, s2)
 	}
 	testEqual := func(s1, s2 string) {
-		assert.False(t, NaturalSortLess(s1, s2), "s1<s2 should be false: s1=%q, s2=%q", s1, s2)
-		assert.False(t, NaturalSortLess(s2, s1), "s2<s1 should be false: s1=%q, s2=%q", s1, s2)
+		assert.Zero(t, NaturalSortCompare(s1, s2), "s1<s2 should be false: s1=%q, s2=%q", s1, s2)
 	}
 
 	testEqual("", "")

package/gitea/source/modules/base/tool_test.go

@@ -29,8 +29,10 @@ func TestShortSha(t *testing.T) {
 func TestVerifyTimeLimitCode(t *testing.T) {
 	defer test.MockVariableValue(&setting.InstallLock, true)()
 	initGeneralSecret := func(secret string) {
-		setting.InstallLock = true
 		setting.CfgProvider, _ = setting.NewConfigProviderFromData(fmt.Sprintf(`
+[security]
+INTERNAL_TOKEN = dummy
+INSTALL_LOCK = true
 [oauth2]
 JWT_SECRET = %s
 `, secret))

package/gitea/source/modules/charset/ambiguous.go

@@ -1,4 +1,3 @@
-// This file is generated by modules/charset/ambiguous/generate.go DO NOT EDIT
 // Copyright 2022 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
@@ -14,11 +13,12 @@ import (
 
 // AmbiguousTablesForLocale provides the table of ambiguous characters for this locale.
 func AmbiguousTablesForLocale(locale translation.Locale) []*AmbiguousTable {
+	ambiguousTableMap := globalVars().ambiguousTableMap
 	key := locale.Language()
 	var table *AmbiguousTable
 	var ok bool
 	for len(key) > 0 {
-		if table, ok = AmbiguousCharacters[key]; ok {
+		if table, ok = ambiguousTableMap[key]; ok {
 			break
 		}
 		idx := strings.LastIndexAny(key, "-_")
@@ -29,18 +29,18 @@ func AmbiguousTablesForLocale(locale translation.Locale) []*AmbiguousTable {
 		}
 	}
 	if table == nil && (locale.Language() == "zh-CN" || locale.Language() == "zh_CN") {
-		table = AmbiguousCharacters["zh-hans"]
+		table = ambiguousTableMap["zh-hans"]
 	}
 	if table == nil && strings.HasPrefix(locale.Language(), "zh") {
-		table = AmbiguousCharacters["zh-hant"]
+		table = ambiguousTableMap["zh-hant"]
 	}
 	if table == nil {
-		table = AmbiguousCharacters["_default"]
+		table = ambiguousTableMap["_default"]
 	}
 
 	return []*AmbiguousTable{
 		table,
-		AmbiguousCharacters["_common"],
+		ambiguousTableMap["_common"],
 	}
 }
 
@@ -52,7 +52,7 @@ func isAmbiguous(r rune, confusableTo *rune, tables ...*AmbiguousTable) bool {
 		i := sort.Search(len(table.Confusable), func(i int) bool {
 			return table.Confusable[i] >= r
 		})
-		(*confusableTo) = table.With[i]
+		*confusableTo = table.With[i]
 		return true
 	}
 	return false

package/gitea/source/modules/charset/ambiguous/generate.go

@@ -1,188 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package main
-
-import (
-	"bytes"
-	"flag"
-	"fmt"
-	"go/format"
-	"os"
-	"sort"
-	"text/template"
-	"unicode"
-
-	"code.gitea.io/gitea/modules/json"
-
-	"golang.org/x/text/unicode/rangetable"
-)
-
-// ambiguous.json provides a one to one mapping of ambiguous characters to other characters
-// See https://github.com/hediet/vscode-unicode-data/blob/main/out/ambiguous.json
-
-type AmbiguousTable struct {
-	Confusable []rune
-	With       []rune
-	Locale     string
-	RangeTable *unicode.RangeTable
-}
-
-type RunePair struct {
-	Confusable rune
-	With       rune
-}
-
-var verbose bool
-
-func main() {
-	flag.Usage = func() {
-		fmt.Fprintf(os.Stderr, `%s: Generate AmbiguousCharacter
-
-Usage: %[1]s [-v] [-o output.go] ambiguous.json
-`, os.Args[0])
-		flag.PrintDefaults()
-	}
-
-	output := ""
-	flag.BoolVar(&verbose, "v", false, "verbose output")
-	flag.StringVar(&output, "o", "ambiguous_gen.go", "file to output to")
-	flag.Parse()
-	input := flag.Arg(0)
-	if input == "" {
-		input = "ambiguous.json"
-	}
-
-	bs, err := os.ReadFile(input)
-	if err != nil {
-		fatalf("Unable to read: %s Err: %v", input, err)
-	}
-
-	var unwrapped string
-	if err := json.Unmarshal(bs, &unwrapped); err != nil {
-		fatalf("Unable to unwrap content in: %s Err: %v", input, err)
-	}
-
-	fromJSON := map[string][]uint32{}
-	if err := json.Unmarshal([]byte(unwrapped), &fromJSON); err != nil {
-		fatalf("Unable to unmarshal content in: %s Err: %v", input, err)
-	}
-
-	tables := make([]*AmbiguousTable, 0, len(fromJSON))
-	for locale, chars := range fromJSON {
-		table := &AmbiguousTable{Locale: locale}
-		table.Confusable = make([]rune, 0, len(chars)/2)
-		table.With = make([]rune, 0, len(chars)/2)
-		pairs := make([]RunePair, len(chars)/2)
-		for i := 0; i < len(chars); i += 2 {
-			pairs[i/2].Confusable, pairs[i/2].With = rune(chars[i]), rune(chars[i+1])
-		}
-		sort.Slice(pairs, func(i, j int) bool {
-			return pairs[i].Confusable < pairs[j].Confusable
-		})
-		for _, pair := range pairs {
-			table.Confusable = append(table.Confusable, pair.Confusable)
-			table.With = append(table.With, pair.With)
-		}
-		table.RangeTable = rangetable.New(table.Confusable...)
-		tables = append(tables, table)
-	}
-	sort.Slice(tables, func(i, j int) bool {
-		return tables[i].Locale < tables[j].Locale
-	})
-	data := map[string]any{
-		"Tables": tables,
-	}
-
-	if err := runTemplate(generatorTemplate, output, &data); err != nil {
-		fatalf("Unable to run template: %v", err)
-	}
-}
-
-func runTemplate(t *template.Template, filename string, data any) error {
-	buf := bytes.NewBuffer(nil)
-	if err := t.Execute(buf, data); err != nil {
-		return fmt.Errorf("unable to execute template: %w", err)
-	}
-	bs, err := format.Source(buf.Bytes())
-	if err != nil {
-		verbosef("Bad source:\n%s", buf.String())
-		return fmt.Errorf("unable to format source: %w", err)
-	}
-
-	old, err := os.ReadFile(filename)
-	if err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to read old file %s because %w", filename, err)
-	} else if err == nil {
-		if bytes.Equal(bs, old) {
-			// files are the same don't rewrite it.
-			return nil
-		}
-	}
-
-	file, err := os.Create(filename)
-	if err != nil {
-		return fmt.Errorf("failed to create file %s because %w", filename, err)
-	}
-	defer file.Close()
-	_, err = file.Write(bs)
-	if err != nil {
-		return fmt.Errorf("unable to write generated source: %w", err)
-	}
-	return nil
-}
-
-var generatorTemplate = template.Must(template.New("ambiguousTemplate").Parse(`// This file is generated by modules/charset/ambiguous/generate.go DO NOT EDIT
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-
-package charset
-
-import "unicode"
-
-// This file is generated from https://github.com/hediet/vscode-unicode-data/blob/main/out/ambiguous.json
-
-// AmbiguousTable matches a confusable rune with its partner for the Locale
-type AmbiguousTable struct {
-	Confusable []rune
-	With       []rune
-	Locale     string
-	RangeTable *unicode.RangeTable
-}
-
-// AmbiguousCharacters provides a map by locale name to the confusable characters in that locale
-var AmbiguousCharacters = map[string]*AmbiguousTable{
-	{{range .Tables}}{{printf "%q:" .Locale}} {
-			Confusable: []rune{ {{range .Confusable}}{{.}},{{end}} },
-			With: []rune{ {{range .With}}{{.}},{{end}} },
-			Locale: {{printf "%q" .Locale}},
-			RangeTable: &unicode.RangeTable{
-				R16: []unicode.Range16{
-			{{range .RangeTable.R16 }}		{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
-			{{end}}	},
-				R32: []unicode.Range32{
-			{{range .RangeTable.R32}}		{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
-			{{end}}	},
-				LatinOffset: {{.RangeTable.LatinOffset}},
-			},
-		},
-	{{end}}
-}
-
-`))
-
-func logf(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, format+"\n", args...)
-}
-
-func verbosef(format string, args ...any) {
-	if verbose {
-		logf(format, args...)
-	}
-}
-
-func fatalf(format string, args ...any) {
-	logf("fatal: "+format+"\n", args...)
-	os.Exit(1)
-}

package/gitea/source/modules/charset/ambiguous_gen_test.go

@@ -8,11 +8,13 @@ import (
 	"testing"
 	"unicode"
 
+	"code.gitea.io/gitea/modules/translation"
+
 	"github.com/stretchr/testify/assert"
 )
 
 func TestAmbiguousCharacters(t *testing.T) {
-	for locale, ambiguous := range AmbiguousCharacters {
+	for locale, ambiguous := range globalVars().ambiguousTableMap {
 		assert.Equal(t, locale, ambiguous.Locale)
 		assert.Len(t, ambiguous.With, len(ambiguous.Confusable))
 		assert.True(t, sort.SliceIsSorted(ambiguous.Confusable, func(i, j int) bool {
@@ -28,4 +30,8 @@ func TestAmbiguousCharacters(t *testing.T) {
 			assert.True(t, found, "%c is not in %d", confusable, i)
 		}
 	}
+
+	var confusableTo rune
+	ret := isAmbiguous('𝐾', &confusableTo, AmbiguousTablesForLocale(&translation.MockLocale{})...)
+	assert.True(t, ret)
 }

package/gitea/source/modules/charset/breakwriter.go

@@ -1,43 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package charset
-
-import (
-	"bytes"
-	"io"
-)
-
-// BreakWriter wraps an io.Writer to always write '\n' as '<br>'
-type BreakWriter struct {
-	io.Writer
-}
-
-// Write writes the provided byte slice transparently replacing '\n' with '<br>'
-func (b *BreakWriter) Write(bs []byte) (n int, err error) {
-	pos := 0
-	for pos < len(bs) {
-		idx := bytes.IndexByte(bs[pos:], '\n')
-		if idx < 0 {
-			wn, err := b.Writer.Write(bs[pos:])
-			return n + wn, err
-		}
-
-		if idx > 0 {
-			wn, err := b.Writer.Write(bs[pos : pos+idx])
-			n += wn
-			if err != nil {
-				return n, err
-			}
-		}
-
-		if _, err = b.Writer.Write([]byte("<br>")); err != nil {
-			return n, err
-		}
-		pos += idx + 1
-
-		n++
-	}
-
-	return n, err
-}

package/gitea/source/modules/charset/breakwriter_test.go

@@ -1,68 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package charset
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestBreakWriter_Write(t *testing.T) {
-	tests := []struct {
-		name    string
-		kase    string
-		expect  string
-		wantErr bool
-	}{
-		{
-			name:   "noline",
-			kase:   "abcdefghijklmnopqrstuvwxyz",
-			expect: "abcdefghijklmnopqrstuvwxyz",
-		},
-		{
-			name:   "endline",
-			kase:   "abcdefghijklmnopqrstuvwxyz\n",
-			expect: "abcdefghijklmnopqrstuvwxyz<br>",
-		},
-		{
-			name:   "startline",
-			kase:   "\nabcdefghijklmnopqrstuvwxyz",
-			expect: "<br>abcdefghijklmnopqrstuvwxyz",
-		},
-		{
-			name:   "onlyline",
-			kase:   "\n\n\n",
-			expect: "<br><br><br>",
-		},
-		{
-			name:   "empty",
-			kase:   "",
-			expect: "",
-		},
-		{
-			name:   "midline",
-			kase:   "\nabc\ndefghijkl\nmnopqrstuvwxy\nz",
-			expect: "<br>abc<br>defghijkl<br>mnopqrstuvwxy<br>z",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			buf := &strings.Builder{}
-			b := &BreakWriter{
-				Writer: buf,
-			}
-			n, err := b.Write([]byte(tt.kase))
-			if (err != nil) != tt.wantErr {
-				t.Errorf("BreakWriter.Write() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if n != len(tt.kase) {
-				t.Errorf("BreakWriter.Write() = %v, want %v", n, len(tt.kase))
-			}
-			if buf.String() != tt.expect {
-				t.Errorf("BreakWriter.Write() wrote %q, want %v", buf.String(), tt.expect)
-			}
-		})
-	}
-}

package/gitea/source/modules/charset/charset.go

@@ -5,12 +5,13 @@ package charset
 
 import (
 	"bytes"
-	"fmt"
 	"io"
+	"regexp"
 	"strings"
+	"sync"
+	"unicode"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 
@@ -19,11 +20,24 @@ import (
 	"golang.org/x/text/transform"
 )
 
-// UTF8BOM is the utf-8 byte-order marker
-var UTF8BOM = []byte{'\xef', '\xbb', '\xbf'}
+var globalVars = sync.OnceValue(func() (ret struct {
+	utf8Bom []byte
+
+	defaultWordRegexp   *regexp.Regexp
+	ambiguousTableMap   map[string]*AmbiguousTable
+	invisibleRangeTable *unicode.RangeTable
+},
+) {
+	ret.utf8Bom = []byte{'\xef', '\xbb', '\xbf'}
+	ret.ambiguousTableMap = newAmbiguousTableMap()
+	ret.invisibleRangeTable = newInvisibleRangeTable()
+	return ret
+})
 
 type ConvertOpts struct {
-	KeepBOM bool
+	KeepBOM           bool
+	ErrorReplacement  []byte
+	ErrorReturnOrigin bool
 }
 
 var ToUTF8WithFallbackReaderPrefetchSize = 16 * 1024
@@ -33,54 +47,27 @@ func ToUTF8WithFallbackReader(rd io.Reader, opts ConvertOpts) io.Reader {
 	buf := make([]byte, ToUTF8WithFallbackReaderPrefetchSize)
 	n, err := util.ReadAtMost(rd, buf)
 	if err != nil {
-		return io.MultiReader(bytes.NewReader(MaybeRemoveBOM(buf[:n], opts)), rd)
-	}
-
-	charsetLabel, err := DetectEncoding(buf[:n])
-	if err != nil || charsetLabel == "UTF-8" {
-		return io.MultiReader(bytes.NewReader(MaybeRemoveBOM(buf[:n], opts)), rd)
-	}
-
-	encoding, _ := charset.Lookup(charsetLabel)
-	if encoding == nil {
-		log.Error("Unknown encoding: %s", charsetLabel)
+		// read error occurs, don't do any processing
 		return io.MultiReader(bytes.NewReader(buf[:n]), rd)
 	}
 
-	return transform.NewReader(
-		io.MultiReader(
-			bytes.NewReader(MaybeRemoveBOM(buf[:n], opts)),
-			rd,
-		),
-		encoding.NewDecoder(),
-	)
-}
-
-// ToUTF8 converts content to UTF8 encoding
-func ToUTF8(content []byte, opts ConvertOpts) ([]byte, error) {
-	charsetLabel, err := DetectEncoding(content)
-	if err != nil {
-		return content, err
-	} else if charsetLabel == "UTF-8" {
-		return MaybeRemoveBOM(content, opts), nil
+	charsetLabel, _ := DetectEncoding(buf[:n])
+	if charsetLabel == "UTF-8" {
+		// is utf-8, try to remove BOM and read it as-is
+		return io.MultiReader(bytes.NewReader(maybeRemoveBOM(buf[:n], opts)), rd)
 	}
 
 	encoding, _ := charset.Lookup(charsetLabel)
 	if encoding == nil {
-		log.Error("Unknown encoding: %s", charsetLabel)
-		return content, fmt.Errorf("unknown encoding: %s", charsetLabel)
+		// unknown charset, don't do any processing
+		return io.MultiReader(bytes.NewReader(buf[:n]), rd)
 	}
 
-	// If there is an error, we concatenate the nicely decoded part and the
-	// original left over. This way we won't lose much data.
-	result, n, err := transform.Bytes(encoding.NewDecoder(), content)
-	if err != nil {
-		result = append(result, content[n:]...)
-	}
-
-	result = MaybeRemoveBOM(result, opts)
-
-	return result, err
+	// convert from charset to utf-8
+	return transform.NewReader(
+		io.MultiReader(bytes.NewReader(buf[:n]), rd),
+		encoding.NewDecoder(),
+	)
 }
 
 // ToUTF8WithFallback detects the encoding of content and converts to UTF-8 if possible
@@ -89,49 +76,50 @@ func ToUTF8WithFallback(content []byte, opts ConvertOpts) []byte {
 	return bs
 }
 
-// ToUTF8DropErrors makes sure the return string is valid utf-8; attempts conversion if possible
-func ToUTF8DropErrors(content []byte, opts ConvertOpts) []byte {
-	charsetLabel, err := DetectEncoding(content)
-	if err != nil || charsetLabel == "UTF-8" {
-		return MaybeRemoveBOM(content, opts)
+func ToUTF8DropErrors(content []byte) []byte {
+	return ToUTF8(content, ConvertOpts{ErrorReplacement: []byte{' '}})
+}
+
+func ToUTF8(content []byte, opts ConvertOpts) []byte {
+	charsetLabel, _ := DetectEncoding(content)
+	if charsetLabel == "UTF-8" {
+		return maybeRemoveBOM(content, opts)
 	}
 
 	encoding, _ := charset.Lookup(charsetLabel)
 	if encoding == nil {
-		log.Error("Unknown encoding: %s", charsetLabel)
+		setting.PanicInDevOrTesting("unsupported detected charset %q, it shouldn't happen", charsetLabel)
 		return content
 	}
 
-	// We ignore any non-decodable parts from the file.
-	// Some parts might be lost
 	var decoded []byte
 	decoder := encoding.NewDecoder()
 	idx := 0
-	for {
+	for idx < len(content) {
 		result, n, err := transform.Bytes(decoder, content[idx:])
 		decoded = append(decoded, result...)
 		if err == nil {
 			break
 		}
-		decoded = append(decoded, ' ')
-		idx = idx + n + 1
-		if idx >= len(content) {
-			break
+		if opts.ErrorReturnOrigin {
+			return content
 		}
+		if opts.ErrorReplacement == nil {
+			decoded = append(decoded, content[idx+n])
+		} else {
+			decoded = append(decoded, opts.ErrorReplacement...)
+		}
+		idx += n + 1
 	}
-
-	return MaybeRemoveBOM(decoded, opts)
+	return maybeRemoveBOM(decoded, opts)
 }
 
-// MaybeRemoveBOM removes a UTF-8 BOM from a []byte when opts.KeepBOM is false
-func MaybeRemoveBOM(content []byte, opts ConvertOpts) []byte {
+// maybeRemoveBOM removes a UTF-8 BOM from a []byte when opts.KeepBOM is false
+func maybeRemoveBOM(content []byte, opts ConvertOpts) []byte {
 	if opts.KeepBOM {
 		return content
 	}
-	if len(content) > 2 && bytes.Equal(content[0:3], UTF8BOM) {
-		return content[3:]
-	}
-	return content
+	return bytes.TrimPrefix(content, globalVars().utf8Bom)
 }
 
 // DetectEncoding detect the encoding of content

package/gitea/source/modules/charset/charset_test.go

@@ -5,6 +5,7 @@ package charset
 
 import (
 	"io"
+	"os"
 	"strings"
 	"testing"
 
@@ -14,97 +15,78 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func resetDefaultCharsetsOrder() {
-	defaultDetectedCharsetsOrder := make([]string, 0, len(setting.Repository.DetectedCharsetsOrder))
-	for _, charset := range setting.Repository.DetectedCharsetsOrder {
-		defaultDetectedCharsetsOrder = append(defaultDetectedCharsetsOrder, strings.ToLower(strings.TrimSpace(charset)))
-	}
+func TestMain(m *testing.M) {
 	setting.Repository.DetectedCharsetScore = map[string]int{}
-	i := 0
-	for _, charset := range defaultDetectedCharsetsOrder {
-		canonicalCharset := strings.ToLower(strings.TrimSpace(charset))
-		if _, has := setting.Repository.DetectedCharsetScore[canonicalCharset]; !has {
-			setting.Repository.DetectedCharsetScore[canonicalCharset] = i
-			i++
-		}
+	for i, charset := range setting.Repository.DetectedCharsetsOrder {
+		setting.Repository.DetectedCharsetScore[strings.ToLower(charset)] = i
 	}
+	os.Exit(m.Run())
 }
 
 func TestMaybeRemoveBOM(t *testing.T) {
-	res := MaybeRemoveBOM([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
+	res := maybeRemoveBOM([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
-	res = MaybeRemoveBOM([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
+	res = maybeRemoveBOM([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 }
 
 func TestToUTF8(t *testing.T) {
-	resetDefaultCharsetsOrder()
-
 	// Note: golang compiler seems so behave differently depending on the current
 	// locale, so some conversions might behave differently. For that reason, we don't
 	// depend on particular conversions but in expected behaviors.
 
-	res, err := ToUTF8([]byte{0x41, 0x42, 0x43}, ConvertOpts{})
-	assert.NoError(t, err)
+	res := ToUTF8([]byte{0x41, 0x42, 0x43}, ConvertOpts{})
 	assert.Equal(t, "ABC", string(res))
 
 	// "áéíóú"
-	res, err = ToUTF8([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
-	assert.NoError(t, err)
+	res = ToUTF8([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
 	// "áéíóú"
-	res, err = ToUTF8([]byte{
+	res = ToUTF8([]byte{
 		0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3,
 		0xc3, 0xba,
 	}, ConvertOpts{})
-	assert.NoError(t, err)
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
-	res, err = ToUTF8([]byte{
+	res = ToUTF8([]byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
 		0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73, 0x41, 0x41, 0x41, 0x2e,
 	}, ConvertOpts{})
-	assert.NoError(t, err)
 	stringMustStartWith(t, "Hola,", res)
 	stringMustEndWith(t, "AAA.", res)
 
-	res, err = ToUTF8([]byte{
+	res = ToUTF8([]byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
 		0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73, 0x41, 0x41, 0x41, 0x2e,
 	}, ConvertOpts{})
-	assert.NoError(t, err)
 	stringMustStartWith(t, "Hola,", res)
 	stringMustEndWith(t, "AAA.", res)
 
-	res, err = ToUTF8([]byte{
+	res = ToUTF8([]byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
 		0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73, 0x41, 0x41, 0x41, 0x2e,
 	}, ConvertOpts{})
-	assert.NoError(t, err)
 	stringMustStartWith(t, "Hola,", res)
 	stringMustEndWith(t, "AAA.", res)
 
 	// Japanese (Shift-JIS)
 	// 日属秘ぞしちゅ。
-	res, err = ToUTF8([]byte{
+	res = ToUTF8([]byte{
 		0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82,
 		0xBF, 0x82, 0xE3, 0x81, 0x42,
 	}, ConvertOpts{})
-	assert.NoError(t, err)
 	assert.Equal(t, []byte{
 		0xE6, 0x97, 0xA5, 0xE5, 0xB1, 0x9E, 0xE7, 0xA7, 0x98, 0xE3,
 		0x81, 0x9E, 0xE3, 0x81, 0x97, 0xE3, 0x81, 0xA1, 0xE3, 0x82, 0x85, 0xE3, 0x80, 0x82,
 	}, res)
 
-	res, err = ToUTF8([]byte{0x00, 0x00, 0x00, 0x00}, ConvertOpts{})
-	assert.NoError(t, err)
+	res = ToUTF8([]byte{0x00, 0x00, 0x00, 0x00}, ConvertOpts{})
 	assert.Equal(t, []byte{0x00, 0x00, 0x00, 0x00}, res)
 }
 
 func TestToUTF8WithFallback(t *testing.T) {
-	resetDefaultCharsetsOrder()
 	// "ABC"
 	res := ToUTF8WithFallback([]byte{0x41, 0x42, 0x43}, ConvertOpts{})
 	assert.Equal(t, []byte{0x41, 0x42, 0x43}, res)
@@ -151,54 +133,58 @@ func TestToUTF8WithFallback(t *testing.T) {
 }
 
 func TestToUTF8DropErrors(t *testing.T) {
-	resetDefaultCharsetsOrder()
 	// "ABC"
-	res := ToUTF8DropErrors([]byte{0x41, 0x42, 0x43}, ConvertOpts{})
+	res := ToUTF8DropErrors([]byte{0x41, 0x42, 0x43})
 	assert.Equal(t, []byte{0x41, 0x42, 0x43}, res)
 
 	// "áéíóú"
-	res = ToUTF8DropErrors([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
+	res = ToUTF8DropErrors([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
 	// UTF8 BOM + "áéíóú"
-	res = ToUTF8DropErrors([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
+	res = ToUTF8DropErrors([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
 	// "Hola, así cómo ños"
-	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73}, ConvertOpts{})
+	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73})
 	assert.Equal(t, []byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73}, res[:8])
 	assert.Equal(t, []byte{0x73}, res[len(res)-1:])
 
 	// "Hola, así cómo "
 	minmatch := []byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xC3, 0xAD, 0x20, 0x63, 0xC3, 0xB3, 0x6D, 0x6F, 0x20}
 
-	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73}, ConvertOpts{})
+	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73})
 	// Do not fail for differences in invalid cases, as the library might change the conversion criteria for those
 	assert.Equal(t, minmatch, res[0:len(minmatch)])
 
-	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73}, ConvertOpts{})
+	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73})
 	// Do not fail for differences in invalid cases, as the library might change the conversion criteria for those
 	assert.Equal(t, minmatch, res[0:len(minmatch)])
 
 	// Japanese (Shift-JIS)
 	// "日属秘ぞしちゅ。"
-	res = ToUTF8DropErrors([]byte{0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82, 0xBF, 0x82, 0xE3, 0x81, 0x42}, ConvertOpts{})
+	res = ToUTF8DropErrors([]byte{0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82, 0xBF, 0x82, 0xE3, 0x81, 0x42})
 	assert.Equal(t, []byte{
 		0xE6, 0x97, 0xA5, 0xE5, 0xB1, 0x9E, 0xE7, 0xA7, 0x98, 0xE3,
 		0x81, 0x9E, 0xE3, 0x81, 0x97, 0xE3, 0x81, 0xA1, 0xE3, 0x82, 0x85, 0xE3, 0x80, 0x82,
 	}, res)
 
-	res = ToUTF8DropErrors([]byte{0x00, 0x00, 0x00, 0x00}, ConvertOpts{})
+	res = ToUTF8DropErrors([]byte{0x00, 0x00, 0x00, 0x00})
 	assert.Equal(t, []byte{0x00, 0x00, 0x00, 0x00}, res)
 }
 
 func TestDetectEncoding(t *testing.T) {
-	resetDefaultCharsetsOrder()
 	testSuccess := func(b []byte, expected string) {
 		encoding, err := DetectEncoding(b)
 		assert.NoError(t, err)
 		assert.Equal(t, expected, encoding)
 	}
+
+	// invalid bytes
+	encoding, err := DetectEncoding([]byte{0xfa})
+	assert.Error(t, err)
+	assert.Equal(t, "UTF-8", encoding)
+
 	// utf-8
 	b := []byte("just some ascii")
 	testSuccess(b, "UTF-8")
@@ -213,21 +199,12 @@ func TestDetectEncoding(t *testing.T) {
 
 	// iso-8859-1: d<accented e>cor<newline>
 	b = []byte{0x44, 0xe9, 0x63, 0x6f, 0x72, 0x0a}
-	encoding, err := DetectEncoding(b)
+	encoding, err = DetectEncoding(b)
 	assert.NoError(t, err)
 	assert.Contains(t, encoding, "ISO-8859-1")
 
-	old := setting.Repository.AnsiCharset
-	setting.Repository.AnsiCharset = "placeholder"
-	defer func() {
-		setting.Repository.AnsiCharset = old
-	}()
-	testSuccess(b, "placeholder")
-
-	// invalid bytes
-	b = []byte{0xfa}
-	_, err = DetectEncoding(b)
-	assert.Error(t, err)
+	defer test.MockVariableValue(&setting.Repository.AnsiCharset, "MyEncoding")()
+	testSuccess(b, "MyEncoding")
 }
 
 func stringMustStartWith(t *testing.T, expected string, value []byte) {
@@ -239,7 +216,6 @@ func stringMustEndWith(t *testing.T, expected string, value []byte) {
 }
 
 func TestToUTF8WithFallbackReader(t *testing.T) {
-	resetDefaultCharsetsOrder()
 	test.MockVariableValue(&ToUTF8WithFallbackReaderPrefetchSize)
 
 	block := "aá啊🤔"

package/gitea/source/modules/charset/escape.go

@@ -1,10 +1,6 @@
 // Copyright 2022 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-//go:generate go run invisible/generate.go -v -o ./invisible_gen.go
-
-//go:generate go run ambiguous/generate.go -v -o ./ambiguous_gen.go ambiguous/ambiguous.json
-
 package charset
 
 import (
@@ -12,33 +8,36 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/translation"
 )
 
-// RuneNBSP is the codepoint for NBSP
-const RuneNBSP = 0xa0
+type EscapeOptions struct {
+	Allowed map[rune]bool
+}
 
-// EscapeControlHTML escapes the unicode control sequences in a provided html document
-func EscapeControlHTML(html template.HTML, locale translation.Locale, allowed ...rune) (escaped *EscapeStatus, output template.HTML) {
+func AllowRuneNBSP() map[rune]bool {
+	return map[rune]bool{0xa0: true}
+}
+
+func EscapeOptionsForView() EscapeOptions {
+	return EscapeOptions{
+		// it's safe to see NBSP in the view, but maybe not in the diff
+		Allowed: AllowRuneNBSP(),
+	}
+}
+
+// EscapeControlHTML escapes the Unicode control sequences in a provided html document
+func EscapeControlHTML(html template.HTML, locale translation.Locale, opts ...EscapeOptions) (escaped *EscapeStatus, output template.HTML) {
+	if !setting.UI.AmbiguousUnicodeDetection {
+		return &EscapeStatus{}, html
+	}
 	sb := &strings.Builder{}
-	escaped, _ = EscapeControlReader(strings.NewReader(string(html)), sb, locale, allowed...) // err has been handled in EscapeControlReader
+	escaped, _ = EscapeControlReader(strings.NewReader(string(html)), sb, locale, opts...) // err has been handled in EscapeControlReader
 	return escaped, template.HTML(sb.String())
 }
 
-// EscapeControlReader escapes the unicode control sequences in a provided reader of HTML content and writer in a locale and returns the findings as an EscapeStatus
-func EscapeControlReader(reader io.Reader, writer io.Writer, locale translation.Locale, allowed ...rune) (escaped *EscapeStatus, err error) {
-	if !setting.UI.AmbiguousUnicodeDetection {
-		_, err = io.Copy(writer, reader)
-		return &EscapeStatus{}, err
-	}
-	outputStream := &HTMLStreamerWriter{Writer: writer}
-	streamer := NewEscapeStreamer(locale, outputStream, allowed...).(*escapeStreamer)
-
-	if err = StreamHTML(reader, streamer); err != nil {
-		streamer.escaped.HasError = true
-		log.Error("Error whilst escaping: %v", err)
-	}
-	return streamer.escaped, err
+// EscapeControlReader escapes the Unicode control sequences in a provided reader of HTML content and writer in a locale and returns the findings as an EscapeStatus
+func EscapeControlReader(reader io.Reader, writer io.Writer, locale translation.Locale, opts ...EscapeOptions) (*EscapeStatus, error) {
+	return escapeStream(locale, reader, writer, opts...)
 }

package/gitea/source/modules/charset/escape_status.go

@@ -3,11 +3,9 @@
 
 package charset
 
-// EscapeStatus represents the findings of the unicode escaper
+// EscapeStatus represents the findings of the Unicode escaper
 type EscapeStatus struct {
-	Escaped      bool
-	HasError     bool
-	HasBadRunes  bool
+	Escaped      bool // it means that some characters were escaped, and they can also be unescaped back
 	HasInvisible bool
 	HasAmbiguous bool
 }
@@ -19,8 +17,6 @@ func (status *EscapeStatus) Or(other *EscapeStatus) *EscapeStatus {
 		st = &EscapeStatus{}
 	}
 	st.Escaped = st.Escaped || other.Escaped
-	st.HasError = st.HasError || other.HasError
-	st.HasBadRunes = st.HasBadRunes || other.HasBadRunes
 	st.HasAmbiguous = st.HasAmbiguous || other.HasAmbiguous
 	st.HasInvisible = st.HasInvisible || other.HasInvisible
 	return st

package/gitea/source/modules/charset/escape_stream.go

@@ -4,286 +4,415 @@
 package charset
 
 import (
+	"bytes"
 	"fmt"
-	"regexp"
-	"strings"
+	"html"
+	"io"
 	"unicode"
 	"unicode/utf8"
 
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/translation"
-
-	"golang.org/x/net/html"
 )
 
-// VScode defaultWordRegexp
-var defaultWordRegexp = regexp.MustCompile(`(-?\d*\.\d\w*)|([^\` + "`" + `\~\!\@\#\$\%\^\&\*\(\)\-\=\+\[\{\]\}\\\|\;\:\'\"\,\.\<\>\/\?\s\x00-\x1f]+)`)
-
-func NewEscapeStreamer(locale translation.Locale, next HTMLStreamer, allowed ...rune) HTMLStreamer {
-	allowedM := make(map[rune]bool, len(allowed))
-	for _, v := range allowed {
-		allowedM[v] = true
-	}
-	return &escapeStreamer{
-		escaped:                 &EscapeStatus{},
-		PassthroughHTMLStreamer: *NewPassthroughStreamer(next),
-		locale:                  locale,
-		ambiguousTables:         AmbiguousTablesForLocale(locale),
-		allowed:                 allowedM,
-	}
+type htmlChunkReader struct {
+	in       io.Reader
+	readErr  error
+	readBuf  []byte
+	curInTag bool
 }
 
 type escapeStreamer struct {
-	PassthroughHTMLStreamer
+	htmlChunkReader
+
 	escaped         *EscapeStatus
 	locale          translation.Locale
 	ambiguousTables []*AmbiguousTable
 	allowed         map[rune]bool
+
+	out io.Writer
 }
 
-func (e *escapeStreamer) EscapeStatus() *EscapeStatus {
-	return e.escaped
+func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts ...EscapeOptions) (*EscapeStatus, error) {
+	es := &escapeStreamer{
+		escaped:         &EscapeStatus{},
+		locale:          locale,
+		ambiguousTables: AmbiguousTablesForLocale(locale),
+		htmlChunkReader: htmlChunkReader{
+			in:      in,
+			readBuf: make([]byte, 0, 32*1024),
+		},
+		out: out,
+	}
+
+	if len(opts) > 0 {
+		es.allowed = opts[0].Allowed
+	}
+
+	readCount := 0
+	lastIsTag := false
+	for {
+		parts, partInTag, err := es.readRunes()
+		readCount++
+		if err == io.EOF {
+			return es.escaped, nil
+		} else if err != nil {
+			return nil, err
+		}
+		for i, part := range parts {
+			if partInTag[i] {
+				lastIsTag = true
+				if _, err := out.Write(part); err != nil {
+					return nil, err
+				}
+			} else {
+				// if last part is tag, then this part is content begin
+				// if the content is the first part of the first read, then it's also content begin
+				isContentBegin := lastIsTag || (readCount == 1 && i == 0)
+				lastIsTag = false
+				if isContentBegin {
+					if part, err = es.trimAndWriteBom(part); err != nil {
+						return nil, err
+					}
+				}
+				if err = es.detectAndWriteRunes(part); err != nil {
+					return nil, err
+				}
+			}
+		}
+	}
 }
 
-// Text tells the next streamer there is a text
-func (e *escapeStreamer) Text(data string) error {
-	sb := &strings.Builder{}
-	var until int
-	var next int
+func (e *escapeStreamer) trimAndWriteBom(part []byte) ([]byte, error) {
+	remaining, ok := bytes.CutPrefix(part, globalVars().utf8Bom)
+	if ok {
+		part = remaining
+		if _, err := e.out.Write(globalVars().utf8Bom); err != nil {
+			return part, err
+		}
+	}
+	return part, nil
+}
+
+const longSentenceDetectionLimit = 20
+
+func (e *escapeStreamer) possibleLongSentence(results []detectResult, pos int) bool {
+	countBasic := 0
+	countNonASCII := 0
+	for i := max(pos-longSentenceDetectionLimit, 0); i < min(pos+longSentenceDetectionLimit, len(results)); i++ {
+		if results[i].runeType == runeTypeBasic && results[i].runeChar != ' ' {
+			countBasic++
+		}
+		if results[i].runeType == runeTypeNonASCII || results[i].runeType == runeTypeAmbiguous {
+			countNonASCII++
+		}
+	}
+	countChar := countBasic + countNonASCII
+	// many non-ASCII runes around, it seems to be a sentence,
+	// don't handle the invisible/ambiguous chars in it, otherwise it will be too noisy
+	return countChar != 0 && countNonASCII*100/countChar >= 50
+}
+
+func (e *escapeStreamer) analyzeDetectResults(results []detectResult) {
+	for i := range results {
+		res := &results[i]
+		if res.runeType == runeTypeInvisible || res.runeType == runeTypeAmbiguous {
+			leftIsNonASCII := i > 0 && (results[i-1].runeType == runeTypeNonASCII || results[i-1].runeType == runeTypeAmbiguous)
+			rightIsNonASCII := i < len(results)-1 && (results[i+1].runeType == runeTypeNonASCII || results[i+1].runeType == runeTypeAmbiguous)
+			surroundingNonASCII := leftIsNonASCII || rightIsNonASCII
+			if !surroundingNonASCII {
+				if len(results) < longSentenceDetectionLimit {
+					res.needEscape = setting.UI.AmbiguousUnicodeDetection
+				} else if !e.possibleLongSentence(results, i) {
+					res.needEscape = setting.UI.AmbiguousUnicodeDetection
+				}
+			}
+		}
+	}
+}
+
+func (e *escapeStreamer) detectAndWriteRunes(part []byte) error {
+	results := e.detectRunes(part)
+	e.analyzeDetectResults(results)
+	return e.writeDetectResults(part, results)
+}
+
+func (e *htmlChunkReader) readRunes() (parts [][]byte, partInTag []bool, _ error) {
+	// we have read everything, eof
+	if e.readErr != nil && len(e.readBuf) == 0 {
+		return nil, nil, e.readErr
+	}
+
+	// not eof, and the there is space in the buffer, try to read more data
+	if e.readErr == nil && len(e.readBuf) <= cap(e.readBuf)*3/4 {
+		n, err := e.in.Read(e.readBuf[len(e.readBuf):cap(e.readBuf)])
+		e.readErr = err
+		e.readBuf = e.readBuf[:len(e.readBuf)+n]
+	}
+	if len(e.readBuf) == 0 {
+		return nil, nil, e.readErr
+	}
+
+	// try to exact tag parts and content parts
 	pos := 0
-	if len(data) > len(UTF8BOM) && data[:len(UTF8BOM)] == string(UTF8BOM) {
-		_, _ = sb.WriteString(data[:len(UTF8BOM)])
-		pos = len(UTF8BOM)
-	}
-	dataBytes := []byte(data)
-	for pos < len(data) {
-		nextIdxs := defaultWordRegexp.FindStringIndex(data[pos:])
-		if nextIdxs == nil {
-			until = len(data)
-			next = until
-		} else {
-			until, next = nextIdxs[0]+pos, nextIdxs[1]+pos
-		}
-
-		// from pos until we know that the runes are not \r\t\n or even ' '
-		runes := make([]rune, 0, next-until)
-		positions := make([]int, 0, next-until+1)
-
-		for pos < until {
-			r, sz := utf8.DecodeRune(dataBytes[pos:])
-			positions = positions[:0]
-			positions = append(positions, pos, pos+sz)
-			types, confusables, _ := e.runeTypes(r)
-			if err := e.handleRunes(dataBytes, []rune{r}, positions, types, confusables, sb); err != nil {
-				return err
-			}
-			pos += sz
-		}
-
-		for i := pos; i < next; {
-			r, sz := utf8.DecodeRune(dataBytes[i:])
-			runes = append(runes, r)
-			positions = append(positions, i)
-			i += sz
-		}
-		positions = append(positions, next)
-		types, confusables, runeCounts := e.runeTypes(runes...)
-		if runeCounts.needsEscape() {
-			if err := e.handleRunes(dataBytes, runes, positions, types, confusables, sb); err != nil {
-				return err
+	for pos < len(e.readBuf) {
+		var curPartEnd int
+		nextInTag := e.curInTag
+		if e.curInTag {
+			// if cur part is in tag, try to find the tag close char '>'
+			idx := bytes.IndexByte(e.readBuf[pos:], '>')
+			if idx == -1 {
+				// if no tag close char, then the whole buffer is in tag
+				curPartEnd = len(e.readBuf)
+			} else {
+				// tag part ends, switch to content part
+				curPartEnd = pos + idx + 1
+				nextInTag = !nextInTag
 			}
 		} else {
-			_, _ = sb.Write(dataBytes[pos:next])
+			// if cur part is in content, try to find the tag open char '<'
+			idx := bytes.IndexByte(e.readBuf[pos:], '<')
+			if idx == -1 {
+				// if no tag open char, then the whole buffer is in content
+				curPartEnd = len(e.readBuf)
+			} else {
+				// content part ends, switch to tag part
+				curPartEnd = pos + idx
+				nextInTag = !nextInTag
+			}
+		}
+
+		curPartLen := curPartEnd - pos
+		if curPartLen == 0 {
+			// if cur part is empty, only need to switch the part type
+			if e.curInTag == nextInTag {
+				panic("impossible, curPartLen is 0 but the part in tag status is not switched")
+			}
+			e.curInTag = nextInTag
+			continue
+		}
+
+		// now, curPartLen can't be 0
+		curPart := make([]byte, curPartLen)
+		copy(curPart, e.readBuf[pos:curPartEnd])
+		// now we get the curPart bytes, but we can't directly use it, the last rune in it might have been cut
+		// try to decode the last rune, if it's invalid, then we cut the last byte and try again until we get a valid rune or no byte left
+		for i := curPartLen - 1; i >= 0; i-- {
+			last, lastSize := utf8.DecodeRune(curPart[i:])
+			if last == utf8.RuneError && lastSize == 1 {
+				curPartLen--
+			} else {
+				curPartLen += lastSize - 1
+				break
+			}
+		}
+		if curPartLen == 0 {
+			// actually it's impossible that the part doesn't contain any valid rune,
+			// the only case is that the cap(readBuf) is too small, or the origin contain indeed doesn't contain any valid rune
+			// * try to leave the last 4 bytes (possible longest utf-8 encoding) to next round
+			// * at least consume 1 byte to avoid infinite loop
+			curPartLen = max(len(curPart)-utf8.UTFMax, 1)
+		}
+
+		// if curPartLen is not the same as curPart, it means we have cut some bytes,
+		// need to wait for more data if not eof
+		trailingCorrupted := curPartLen != len(curPart)
+
+		// finally, we get the real part we need
+		curPart = curPart[:curPartLen]
+		parts = append(parts, curPart)
+		partInTag = append(partInTag, e.curInTag)
+
+		pos += curPartLen
+		e.curInTag = nextInTag
+
+		if trailingCorrupted && e.readErr == nil {
+			// if the last part is corrupted, and we haven't reach eof, then we need to wait for more data to get the complete part
+			break
 		}
-		pos = next
 	}
-	if sb.Len() > 0 {
-		if err := e.PassthroughHTMLStreamer.Text(sb.String()); err != nil {
+
+	copy(e.readBuf, e.readBuf[pos:])
+	e.readBuf = e.readBuf[:len(e.readBuf)-pos]
+	return parts, partInTag, nil
+}
+
+func (e *escapeStreamer) writeDetectResults(data []byte, results []detectResult) error {
+	lastWriteRawIdx := -1
+	for idx := range results {
+		res := &results[idx]
+		if !res.needEscape {
+			if lastWriteRawIdx == -1 {
+				lastWriteRawIdx = idx
+			}
+			continue
+		}
+
+		if lastWriteRawIdx != -1 {
+			if _, err := e.out.Write(data[results[lastWriteRawIdx].position:res.position]); err != nil {
+				return err
+			}
+			lastWriteRawIdx = -1
+		}
+		switch res.runeType {
+		case runeTypeBroken:
+			if err := e.writeBrokenRune(data[res.position : res.position+res.runeSize]); err != nil {
+				return err
+			}
+		case runeTypeAmbiguous:
+			if err := e.writeAmbiguousRune(res.runeChar, res.confusable); err != nil {
+				return err
+			}
+		case runeTypeInvisible:
+			if err := e.writeInvisibleRune(res.runeChar); err != nil {
+				return err
+			}
+		case runeTypeControlChar:
+			if err := e.writeControlRune(res.runeChar); err != nil {
+				return err
+			}
+		default:
+			panic("unreachable")
+		}
+	}
+	if lastWriteRawIdx != -1 {
+		lastResult := results[len(results)-1]
+		if _, err := e.out.Write(data[results[lastWriteRawIdx].position : lastResult.position+lastResult.runeSize]); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func (e *escapeStreamer) handleRunes(data []byte, runes []rune, positions []int, types []runeType, confusables []rune, sb *strings.Builder) error {
-	for i, r := range runes {
-		switch types[i] {
-		case brokenRuneType:
-			if sb.Len() > 0 {
-				if err := e.PassthroughHTMLStreamer.Text(sb.String()); err != nil {
-					return err
-				}
-				sb.Reset()
-			}
-			end := positions[i+1]
-			start := positions[i]
-			if err := e.brokenRune(data[start:end]); err != nil {
-				return err
-			}
-		case ambiguousRuneType:
-			if sb.Len() > 0 {
-				if err := e.PassthroughHTMLStreamer.Text(sb.String()); err != nil {
-					return err
-				}
-				sb.Reset()
-			}
-			if err := e.ambiguousRune(r, confusables[0]); err != nil {
-				return err
-			}
-			confusables = confusables[1:]
-		case invisibleRuneType:
-			if sb.Len() > 0 {
-				if err := e.PassthroughHTMLStreamer.Text(sb.String()); err != nil {
-					return err
-				}
-				sb.Reset()
-			}
-			if err := e.invisibleRune(r); err != nil {
-				return err
-			}
-		default:
-			_, _ = sb.WriteRune(r)
-		}
-	}
-	return nil
+func (e *escapeStreamer) writeBrokenRune(_ []byte) (err error) {
+	// Although we'd like to use the original bytes to display (show the real broken content to users),
+	// however, when this "escape stream" module is applied to the content, the content has already been processed by other modules.
+	// So the invalid bytes just can't be kept till this step, in most (all) cases, the only thing we see here is utf8.RuneError
+	_, err = io.WriteString(e.out, `<span class="broken-code-point">�</span>`)
+	return err
 }
 
-func (e *escapeStreamer) brokenRune(bs []byte) error {
-	e.escaped.Escaped = true
-	e.escaped.HasBadRunes = true
-
-	if err := e.PassthroughHTMLStreamer.StartTag("span", html.Attribute{
-		Key: "class",
-		Val: "broken-code-point",
-	}); err != nil {
+func (e *escapeStreamer) writeEscapedCharHTML(tag1, attr, tag2, content, tag3 string) (err error) {
+	_, err = io.WriteString(e.out, tag1)
+	if err != nil {
 		return err
 	}
-	if err := e.PassthroughHTMLStreamer.Text(fmt.Sprintf("<%X>", bs)); err != nil {
+	_, err = io.WriteString(e.out, html.EscapeString(attr))
+	if err != nil {
 		return err
 	}
-
-	return e.PassthroughHTMLStreamer.EndTag("span")
+	_, err = io.WriteString(e.out, tag2)
+	if err != nil {
+		return err
+	}
+	_, err = io.WriteString(e.out, html.EscapeString(content))
+	if err != nil {
+		return err
+	}
+	_, err = io.WriteString(e.out, tag3)
+	return err
 }
 
-func (e *escapeStreamer) ambiguousRune(r, c rune) error {
+func runeToHex(r rune) string {
+	return fmt.Sprintf("[U+%04X]", r)
+}
+
+func (e *escapeStreamer) writeAmbiguousRune(r, c rune) (err error) {
 	e.escaped.Escaped = true
 	e.escaped.HasAmbiguous = true
-
-	if err := e.PassthroughHTMLStreamer.StartTag("span", html.Attribute{
-		Key: "class",
-		Val: "ambiguous-code-point",
-	}, html.Attribute{
-		Key: "data-tooltip-content",
-		Val: e.locale.TrString("repo.ambiguous_character", r, c),
-	}); err != nil {
-		return err
-	}
-	if err := e.PassthroughHTMLStreamer.StartTag("span", html.Attribute{
-		Key: "class",
-		Val: "char",
-	}); err != nil {
-		return err
-	}
-	if err := e.PassthroughHTMLStreamer.Text(string(r)); err != nil {
-		return err
-	}
-	if err := e.PassthroughHTMLStreamer.EndTag("span"); err != nil {
-		return err
-	}
-
-	return e.PassthroughHTMLStreamer.EndTag("span")
+	return e.writeEscapedCharHTML(
+		`<span class="ambiguous-code-point" data-tooltip-content="`,
+		e.locale.TrString("repo.ambiguous_character", string(r)+" "+runeToHex(r), string(c)+" "+runeToHex(c)),
+		`"><span class="char">`,
+		string(r),
+		`</span></span>`,
+	)
 }
 
-func (e *escapeStreamer) invisibleRune(r rune) error {
+func (e *escapeStreamer) writeInvisibleRune(r rune) error {
 	e.escaped.Escaped = true
 	e.escaped.HasInvisible = true
-
-	if err := e.PassthroughHTMLStreamer.StartTag("span", html.Attribute{
-		Key: "class",
-		Val: "escaped-code-point",
-	}, html.Attribute{
-		Key: "data-escaped",
-		Val: fmt.Sprintf("[U+%04X]", r),
-	}); err != nil {
-		return err
-	}
-	if err := e.PassthroughHTMLStreamer.StartTag("span", html.Attribute{
-		Key: "class",
-		Val: "char",
-	}); err != nil {
-		return err
-	}
-	if err := e.PassthroughHTMLStreamer.Text(string(r)); err != nil {
-		return err
-	}
-	if err := e.PassthroughHTMLStreamer.EndTag("span"); err != nil {
-		return err
-	}
-
-	return e.PassthroughHTMLStreamer.EndTag("span")
+	return e.writeEscapedCharHTML(
+		`<span class="escaped-code-point" data-escaped="`,
+		runeToHex(r),
+		`"><span class="char">`,
+		string(r),
+		`</span></span>`,
+	)
 }
 
-type runeCountType struct {
-	numBasicRunes                int
-	numNonConfusingNonBasicRunes int
-	numAmbiguousRunes            int
-	numInvisibleRunes            int
-	numBrokenRunes               int
+func (e *escapeStreamer) writeControlRune(r rune) error {
+	var display string
+	if r >= 0 && r <= 0x1f {
+		display = string(0x2400 + r)
+	} else if r == 0x7f {
+		display = string(rune(0x2421))
+	} else {
+		display = runeToHex(r)
+	}
+	return e.writeEscapedCharHTML(
+		`<span class="broken-code-point" data-escaped="`,
+		display,
+		`"><span class="char">`,
+		string(r),
+		`</span></span>`,
+	)
 }
 
-func (counts runeCountType) needsEscape() bool {
-	if counts.numBrokenRunes > 0 {
-		return true
-	}
-	if counts.numBasicRunes == 0 &&
-		counts.numNonConfusingNonBasicRunes > 0 {
-		return false
-	}
-	return counts.numAmbiguousRunes > 0 || counts.numInvisibleRunes > 0
+type detectResult struct {
+	runeChar   rune
+	runeType   int
+	runeSize   int
+	position   int
+	confusable rune
+	needEscape bool
 }
 
-type runeType int
-
 const (
-	basicASCIIRuneType runeType = iota // <- This is technically deadcode but its self-documenting so it should stay
-	brokenRuneType
-	nonBasicASCIIRuneType
-	ambiguousRuneType
-	invisibleRuneType
+	runeTypeBasic int = iota
+	runeTypeBroken
+	runeTypeNonASCII
+	runeTypeAmbiguous
+	runeTypeInvisible
+	runeTypeControlChar
 )
 
-func (e *escapeStreamer) runeTypes(runes ...rune) (types []runeType, confusables []rune, runeCounts runeCountType) {
-	types = make([]runeType, len(runes))
-	for i, r := range runes {
-		var confusable rune
+func (e *escapeStreamer) detectRunes(data []byte) []detectResult {
+	runeCount := utf8.RuneCount(data)
+	results := make([]detectResult, runeCount)
+	invisibleRangeTable := globalVars().invisibleRangeTable
+	var i int
+	var confusable rune
+	for pos := 0; pos < len(data); i++ {
+		r, runeSize := utf8.DecodeRune(data[pos:])
+		results[i].runeChar = r
+		results[i].runeSize = runeSize
+		results[i].position = pos
+		pos += runeSize
+
 		switch {
 		case r == utf8.RuneError:
-			types[i] = brokenRuneType
-			runeCounts.numBrokenRunes++
-		case r == ' ' || r == '\t' || r == '\n':
-			runeCounts.numBasicRunes++
-		case e.allowed[r]:
-			if r > 0x7e || r < 0x20 {
-				types[i] = nonBasicASCIIRuneType
-				runeCounts.numNonConfusingNonBasicRunes++
-			} else {
-				runeCounts.numBasicRunes++
+			results[i].runeType = runeTypeBroken
+			results[i].needEscape = true
+		case r == ' ' || r == '\t' || r == '\n' || e.allowed[r]:
+			results[i].runeType = runeTypeBasic
+			if r >= 0x80 {
+				results[i].runeType = runeTypeNonASCII
 			}
-		case unicode.Is(InvisibleRanges, r):
-			types[i] = invisibleRuneType
-			runeCounts.numInvisibleRunes++
-		case unicode.IsControl(r):
-			types[i] = invisibleRuneType
-			runeCounts.numInvisibleRunes++
+		case r < 0x20 || r == 0x7f:
+			results[i].runeType = runeTypeControlChar
+			results[i].needEscape = true
+		case unicode.Is(invisibleRangeTable, r):
+			results[i].runeType = runeTypeInvisible
+			// not sure about results[i].needEscape, will be detected separately
 		case isAmbiguous(r, &confusable, e.ambiguousTables...):
-			confusables = append(confusables, confusable)
-			types[i] = ambiguousRuneType
-			runeCounts.numAmbiguousRunes++
-		case r > 0x7e || r < 0x20:
-			types[i] = nonBasicASCIIRuneType
-			runeCounts.numNonConfusingNonBasicRunes++
-		default:
-			runeCounts.numBasicRunes++
+			results[i].runeType = runeTypeAmbiguous
+			results[i].confusable = confusable
+			// not sure about results[i].needEscape, will be detected separately
+		case r >= 0x80:
+			results[i].runeType = runeTypeNonASCII
+		default: // details to basic runes
 		}
 	}
-	return types, confusables, runeCounts
+	return results
 }

package/gitea/source/modules/charset/escape_test.go

@@ -4,7 +4,6 @@
 package charset
 
 import (
-	"regexp"
 	"strings"
 	"testing"
 
@@ -13,6 +12,7 @@ import (
 	"code.gitea.io/gitea/modules/translation"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type escapeControlTest struct {
@@ -57,24 +57,24 @@ var escapeControlTests = []escapeControlTest{
 		status: EscapeStatus{},
 	},
 	{
-		name:   "hebrew",
+		name:   "hebrew", // old test was wrong, such text shouldn't be escaped
 		text:   "עד תקופת יוון העתיקה היה העיסוק במתמטיקה תכליתי בלבד: היא שימשה כאוסף של נוסחאות לחישוב קרקע, אוכלוסין וכו'. פריצת הדרך של היוונים, פרט לתרומותיהם הגדולות לידע המתמטי, הייתה בלימוד המתמטיקה כשלעצמה, מתוקף ערכה הרוחני. יחסם של חלק מהיוונים הקדמונים למתמטיקה היה דתי - למשל, הכת שאסף סביבו פיתגורס האמינה כי המתמטיקה היא הבסיס לכל הדברים. היוונים נחשבים ליוצרי מושג ההוכחה המתמטית, וכן לראשונים שעסקו במתמטיקה לשם עצמה, כלומר כתחום מחקרי עיוני ומופשט ולא רק כעזר שימושי. עם זאת, לצדה",
-		result: `עד תקופת <span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">י</span></span><span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ו</span></span><span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ו</span></span><span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ן</span></span> העתיקה היה העיסוק במתמטיקה תכליתי בלבד: היא שימשה כאוסף של נוסחאות לחישוב קרקע, אוכלוסין וכו&#39;. פריצת הדרך של היוונים, פרט לתרומותיהם הגדולות לידע המתמטי, הייתה בלימוד המתמטיקה כשלעצמה, מתוקף ערכה הרוחני. יחסם של חלק מהיוונים הקדמונים למתמטיקה היה דתי - למשל, הכת שאסף סביבו פיתגורס האמינה כי המתמטיקה היא הבסיס לכל הדברים. היוונים נחשבים ליוצרי מושג ההוכחה המתמטית, וכן לראשונים שעסקו במתמטיקה לשם עצמה, כלומר כתחום מחקרי עיוני ומופשט ולא רק כעזר שימושי. עם זאת, לצדה`,
-		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
+		result: "עד תקופת יוון העתיקה היה העיסוק במתמטיקה תכליתי בלבד: היא שימשה כאוסף של נוסחאות לחישוב קרקע, אוכלוסין וכו'. פריצת הדרך של היוונים, פרט לתרומותיהם הגדולות לידע המתמטי, הייתה בלימוד המתמטיקה כשלעצמה, מתוקף ערכה הרוחני. יחסם של חלק מהיוונים הקדמונים למתמטיקה היה דתי - למשל, הכת שאסף סביבו פיתגורס האמינה כי המתמטיקה היא הבסיס לכל הדברים. היוונים נחשבים ליוצרי מושג ההוכחה המתמטית, וכן לראשונים שעסקו במתמטיקה לשם עצמה, כלומר כתחום מחקרי עיוני ומופשט ולא רק כעזר שימושי. עם זאת, לצדה",
+		status: EscapeStatus{},
 	},
 	{
-		name: "more hebrew",
+		name: "more hebrew", // old test was wrong, such text shouldn't be escaped
 		text: `בתקופה מאוחרת יותר, השתמשו היוונים בשיטת סימון מתקדמת יותר, שבה הוצגו המספרים לפי 22 אותיות האלפבית היווני. לסימון המספרים בין 1 ל-9 נקבעו תשע האותיות הראשונות, בתוספת גרש ( ' ) בצד ימין של האות, למעלה; תשע האותיות הבאות ייצגו את העשרות מ-10 עד 90, והבאות את המאות. לסימון הספרות בין 1000 ל-900,000, השתמשו היוונים באותן אותיות, אך הוסיפו לאותיות את הגרש דווקא מצד שמאל של האותיות, למטה. ממיליון ומעלה, כנראה השתמשו היוונים בשני תגים במקום אחד.
 
 			המתמטיקאי הבולט הראשון ביוון העתיקה, ויש האומרים בתולדות האנושות, הוא תאלס (624 לפנה"ס - 546 לפנה"ס בקירוב).[1] לא יהיה זה משולל יסוד להניח שהוא האדם הראשון שהוכיח משפט מתמטי, ולא רק גילה אותו. תאלס הוכיח שישרים מקבילים חותכים מצד אחד של שוקי זווית קטעים בעלי יחסים שווים (משפט תאלס הראשון), שהזווית המונחת על קוטר במעגל היא זווית ישרה (משפט תאלס השני), שהקוטר מחלק את המעגל לשני חלקים שווים, ושזוויות הבסיס במשולש שווה-שוקיים שוות זו לזו. מיוחסות לו גם שיטות למדידת גובהן של הפירמידות בעזרת מדידת צילן ולקביעת מיקומה של ספינה הנראית מן החוף.
 
 			בשנים 582 לפנה"ס עד 496 לפנה"ס, בקירוב, חי מתמטיקאי חשוב במיוחד - פיתגורס. המקורות הראשוניים עליו מועטים, וההיסטוריונים מתקשים להפריד את העובדות משכבת המסתורין והאגדות שנקשרו בו. ידוע שסביבו התקבצה האסכולה הפיתגוראית מעין כת פסבדו-מתמטית שהאמינה ש"הכל מספר", או ליתר דיוק הכל ניתן לכימות, וייחסה למספרים משמעויות מיסטיות. ככל הנראה הפיתגוראים ידעו לבנות את הגופים האפלטוניים, הכירו את הממוצע האריתמטי, הממוצע הגאומטרי והממוצע ההרמוני והגיעו להישגים חשובים נוספים. ניתן לומר שהפיתגוראים גילו את היותו של השורש הריבועי של 2, שהוא גם האלכסון בריבוע שאורך צלעותיו 1, אי רציונלי, אך תגליתם הייתה למעשה רק שהקטעים "חסרי מידה משותפת", ומושג המספר האי רציונלי מאוחר יותר.[2] אזכור ראשון לקיומם של קטעים חסרי מידה משותפת מופיע בדיאלוג "תאיטיטוס" של אפלטון, אך רעיון זה היה מוכר עוד קודם לכן, במאה החמישית לפנה"ס להיפאסוס, בן האסכולה הפיתגוראית, ואולי לפיתגורס עצמו.[3]`,
-		result: `בתקופה מאוחרת יותר, השתמשו היוונים בשיטת סימון מתקדמת יותר, שבה הוצגו המספרים לפי 22 אותיות האלפבית היווני. לסימון המספרים בין 1 ל-9 נקבעו תשע האותיות הראשונות, בתוספת גרש ( &#39; ) בצד ימין של האות, למעלה; תשע האותיות הבאות ייצגו את העשרות מ-10 עד 90, והבאות את המאות. לסימון הספרות בין 1000 ל-900,000, השתמשו היוונים באותן אותיות, אך הוסיפו לאותיות את הגרש דווקא מצד שמאל של האותיות, למטה. ממיליון ומעלה, כנראה השתמשו היוונים בשני תגים במקום אחד.
+		result: `בתקופה מאוחרת יותר, השתמשו היוונים בשיטת סימון מתקדמת יותר, שבה הוצגו המספרים לפי 22 אותיות האלפבית היווני. לסימון המספרים בין 1 ל-9 נקבעו תשע האותיות הראשונות, בתוספת גרש ( ' ) בצד ימין של האות, למעלה; תשע האותיות הבאות ייצגו את העשרות מ-10 עד 90, והבאות את המאות. לסימון הספרות בין 1000 ל-900,000, השתמשו היוונים באותן אותיות, אך הוסיפו לאותיות את הגרש דווקא מצד שמאל של האותיות, למטה. ממיליון ומעלה, כנראה השתמשו היוונים בשני תגים במקום אחד.
 
-			המתמטיקאי הבולט הראשון ביוון העתיקה, ויש האומרים בתולדות האנושות, הוא תאלס (624 לפנה&#34;<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ס</span></span> - 546 לפנה&#34;<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ס</span></span> בקירוב).[1] לא יהיה זה משולל יסוד להניח שהוא האדם הראשון שהוכיח משפט מתמטי, ולא רק גילה אותו. תאלס הוכיח שישרים מקבילים חותכים מצד אחד של שוקי זווית קטעים בעלי יחסים שווים (משפט תאלס הראשון), שהזווית המונחת על קוטר במעגל היא זווית ישרה (משפט תאלס השני), שהקוטר מחלק את המעגל לשני חלקים שווים, ושזוויות הבסיס במשולש שווה-שוקיים שוות זו לזו. מיוחסות לו גם שיטות למדידת גובהן של הפירמידות בעזרת מדידת צילן ולקביעת מיקומה של ספינה הנראית מן החוף.
+			המתמטיקאי הבולט הראשון ביוון העתיקה, ויש האומרים בתולדות האנושות, הוא תאלס (624 לפנה"ס - 546 לפנה"ס בקירוב).[1] לא יהיה זה משולל יסוד להניח שהוא האדם הראשון שהוכיח משפט מתמטי, ולא רק גילה אותו. תאלס הוכיח שישרים מקבילים חותכים מצד אחד של שוקי זווית קטעים בעלי יחסים שווים (משפט תאלס הראשון), שהזווית המונחת על קוטר במעגל היא זווית ישרה (משפט תאלס השני), שהקוטר מחלק את המעגל לשני חלקים שווים, ושזוויות הבסיס במשולש שווה-שוקיים שוות זו לזו. מיוחסות לו גם שיטות למדידת גובהן של הפירמידות בעזרת מדידת צילן ולקביעת מיקומה של ספינה הנראית מן החוף.
 
-			בשנים 582 לפנה&#34;<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ס</span></span> עד 496 לפנה&#34;<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ס</span></span>, בקירוב, חי מתמטיקאי חשוב במיוחד - פיתגורס. המקורות הראשוניים עליו מועטים, וההיסטוריונים מתקשים להפריד את העובדות משכבת המסתורין והאגדות שנקשרו בו. ידוע שסביבו התקבצה האסכולה הפיתגוראית מעין כת פסבדו-מתמטית שהאמינה ש&#34;הכל מספר&#34;, או ליתר דיוק הכל ניתן לכימות, וייחסה למספרים משמעויות מיסטיות. ככל הנראה הפיתגוראים ידעו לבנות את הגופים האפלטוניים, הכירו את הממוצע האריתמטי, הממוצע הגאומטרי והממוצע ההרמוני והגיעו להישגים חשובים נוספים. ניתן לומר שהפיתגוראים גילו את היותו של השורש הריבועי של 2, שהוא גם האלכסון בריבוע שאורך צלעותיו 1, אי רציונלי, אך תגליתם הייתה למעשה רק שהקטעים &#34;חסרי מידה משותפת&#34;, ומושג המספר האי רציונלי מאוחר יותר.[2] אזכור ראשון לקיומם של קטעים חסרי מידה משותפת מופיע בדיאלוג &#34;תאיטיטוס&#34; של אפלטון, אך רעיון זה היה מוכר עוד קודם לכן, במאה החמישית לפנה&#34;<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character"><span class="char">ס</span></span> להיפאסוס, בן האסכולה הפיתגוראית, ואולי לפיתגורס עצמו.[3]`,
-		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
+			בשנים 582 לפנה"ס עד 496 לפנה"ס, בקירוב, חי מתמטיקאי חשוב במיוחד - פיתגורס. המקורות הראשוניים עליו מועטים, וההיסטוריונים מתקשים להפריד את העובדות משכבת המסתורין והאגדות שנקשרו בו. ידוע שסביבו התקבצה האסכולה הפיתגוראית מעין כת פסבדו-מתמטית שהאמינה ש"הכל מספר", או ליתר דיוק הכל ניתן לכימות, וייחסה למספרים משמעויות מיסטיות. ככל הנראה הפיתגוראים ידעו לבנות את הגופים האפלטוניים, הכירו את הממוצע האריתמטי, הממוצע הגאומטרי והממוצע ההרמוני והגיעו להישגים חשובים נוספים. ניתן לומר שהפיתגוראים גילו את היותו של השורש הריבועי של 2, שהוא גם האלכסון בריבוע שאורך צלעותיו 1, אי רציונלי, אך תגליתם הייתה למעשה רק שהקטעים "חסרי מידה משותפת", ומושג המספר האי רציונלי מאוחר יותר.[2] אזכור ראשון לקיומם של קטעים חסרי מידה משותפת מופיע בדיאלוג "תאיטיטוס" של אפלטון, אך רעיון זה היה מוכר עוד קודם לכן, במאה החמישית לפנה"ס להיפאסוס, בן האסכולה הפיתגוראית, ואולי לפיתגורס עצמו.[3]`,
+		status: EscapeStatus{},
 	},
 	{
 		name: "Mixed RTL+LTR",
@@ -111,7 +111,7 @@ then resh (ר), and finally heh (ה) (which should appear leftmost).`,
 	{
 		name:   "CVE testcase",
 		text:   "if access_level != \"user\u202E \u2066// Check if admin\u2069 \u2066\" {",
-		result: `if access_level != &#34;user<span class="escaped-code-point" data-escaped="[U+202E]"><span class="char">` + "\u202e" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>// Check if admin<span class="escaped-code-point" data-escaped="[U+2069]"><span class="char">` + "\u2069" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>&#34; {`,
+		result: `if access_level != "user<span class="escaped-code-point" data-escaped="[U+202E]"><span class="char">` + "\u202e" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>// Check if admin<span class="escaped-code-point" data-escaped="[U+2069]"><span class="char">` + "\u2069" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>" {`,
 		status: EscapeStatus{Escaped: true, HasInvisible: true},
 	},
 	{
@@ -123,7 +123,7 @@ then resh (ר), and finally heh (ה) (which should appear leftmost).`,
 		result: `Many computer programs fail to display bidirectional text correctly.
 			For example, the Hebrew name Sarah ` + "\u2067" + `שרה` + "\u2066\n" +
 			`sin (ש) (which appears rightmost), then resh (ר), and finally heh (ה) (which should appear leftmost).` +
-			"\n" + `if access_level != &#34;user<span class="escaped-code-point" data-escaped="[U+202E]"><span class="char">` + "\u202e" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>// Check if admin<span class="escaped-code-point" data-escaped="[U+2069]"><span class="char">` + "\u2069" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>&#34; {` + "\n",
+			"\n" + `if access_level != "user<span class="escaped-code-point" data-escaped="[U+202E]"><span class="char">` + "\u202e" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>// Check if admin<span class="escaped-code-point" data-escaped="[U+2069]"><span class="char">` + "\u2069" + `</span></span> <span class="escaped-code-point" data-escaped="[U+2066]"><span class="char">` + "\u2066" + `</span></span>" {` + "\n",
 		status: EscapeStatus{Escaped: true, HasInvisible: true},
 	},
 	{
@@ -134,38 +134,22 @@ then resh (ר), and finally heh (ה) (which should appear leftmost).`,
 		result: "\xef\xbb\xbftest",
 		status: EscapeStatus{},
 	},
+	{
+		name:   "ambiguous",
+		text:   "O𝐾",
+		result: `O<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character:𝐾 [U+1D43E],K [U+004B]"><span class="char">𝐾</span></span>`,
+		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
+	},
 }
 
 func TestEscapeControlReader(t *testing.T) {
-	// add some control characters to the tests
-	tests := make([]escapeControlTest, 0, len(escapeControlTests)*3)
-	copy(tests, escapeControlTests)
-
-	// if there is a BOM, we should keep the BOM
-	addPrefix := func(prefix, s string) string {
-		if strings.HasPrefix(s, "\xef\xbb\xbf") {
-			return s[:3] + prefix + s[3:]
-		}
-		return prefix + s
-	}
-	for _, test := range escapeControlTests {
-		test.name += " (+Control)"
-		test.text = addPrefix("\u001E", test.text)
-		test.result = addPrefix(`<span class="escaped-code-point" data-escaped="[U+001E]"><span class="char">`+"\u001e"+`</span></span>`, test.result)
-		test.status.Escaped = true
-		test.status.HasInvisible = true
-		tests = append(tests, test)
-	}
-
-	re := regexp.MustCompile(`repo.ambiguous_character:\d+,\d+`) // simplify the output for the tests, remove the translation variants
-	for _, tt := range tests {
+	for _, tt := range escapeControlTests {
 		t.Run(tt.name, func(t *testing.T) {
 			output := &strings.Builder{}
 			status, err := EscapeControlReader(strings.NewReader(tt.text), output, &translation.MockLocale{})
 			assert.NoError(t, err)
 			assert.Equal(t, tt.status, *status)
 			outStr := output.String()
-			outStr = re.ReplaceAllString(outStr, "repo.ambiguous_character")
 			assert.Equal(t, tt.result, outStr)
 		})
 	}
@@ -179,3 +163,50 @@ func TestSettingAmbiguousUnicodeDetection(t *testing.T) {
 	_, out = EscapeControlHTML("a test", &translation.MockLocale{})
 	assert.EqualValues(t, `a test`, out)
 }
+
+func TestHTMLChunkReader(t *testing.T) {
+	type textPart struct {
+		text  string
+		isTag bool
+	}
+	testReadChunks := func(t *testing.T, chunkSize int, input string, expected []textPart) {
+		r := &htmlChunkReader{in: strings.NewReader(input), readBuf: make([]byte, 0, chunkSize)}
+		var results []textPart
+		for {
+			parts, partIsTag, err := r.readRunes()
+			if err != nil {
+				break
+			}
+			for i, part := range parts {
+				results = append(results, textPart{string(part), partIsTag[i]})
+			}
+		}
+		assert.Equal(t, expected, results, "chunk size: %d, input: %s", chunkSize, input)
+	}
+
+	testReadChunks(t, 10, "abc<def>ghi", []textPart{
+		{text: "abc", isTag: false},
+		{text: "<def>", isTag: true},
+		{text: "gh", isTag: false},
+		// -- chunk
+		{text: "i", isTag: false},
+	})
+
+	testReadChunks(t, 10, "<abc><def>ghi", []textPart{
+		{text: "<abc>", isTag: true},
+		{text: "<def>", isTag: true},
+		// -- chunk
+		{text: "ghi", isTag: false},
+	})
+
+	rune1, rune2, rune3, rune4 := "A", "é", "啊", "🌞"
+	require.Len(t, rune1, 1)
+	require.Len(t, rune2, 2)
+	require.Len(t, rune3, 3)
+	require.Len(t, rune4, 4)
+	input := "<" + rune1 + rune2 + rune3 + rune4 + ">" + rune1 + rune2 + rune3 + rune4
+	testReadChunks(t, 4, input, []textPart{{"<Aé", true}, {"啊", true}, {"🌞", true}, {">", true}, {"Aé", false}, {"啊", false}, {"🌞", false}})
+	testReadChunks(t, 5, input, []textPart{{"<Aé", true}, {"啊", true}, {"🌞>", true}, {"Aé", false}, {"啊", false}, {"🌞", false}})
+	testReadChunks(t, 6, input, []textPart{{"<Aé", true}, {"啊", true}, {"🌞>", true}, {"A", false}, {"é啊", false}, {"🌞", false}})
+	testReadChunks(t, 7, input, []textPart{{"<Aé啊", true}, {"🌞>", true}, {"A", false}, {"é啊", false}, {"🌞", false}})
+}

package/gitea/source/modules/charset/generate/generate.go

@@ -5,37 +5,86 @@ package main
 
 import (
 	"bytes"
-	"flag"
 	"fmt"
 	"go/format"
+	"log"
 	"os"
+	"sort"
 	"text/template"
+	"unicode"
+
+	"code.gitea.io/gitea/modules/json"
 
 	"golang.org/x/text/unicode/rangetable"
 )
 
+// ambiguous.json provides a one to one mapping of ambiguous characters to other characters
+// See https://github.com/hediet/vscode-unicode-data/blob/main/out/ambiguous.json
+
+type AmbiguousTable struct {
+	Confusable []rune
+	With       []rune
+	Locale     string
+	RangeTable *unicode.RangeTable
+}
+
+type RunePair struct {
+	Confusable rune
+	With       rune
+}
+
 // InvisibleRunes these are runes that vscode has assigned to be invisible
 // See https://github.com/hediet/vscode-unicode-data
 var InvisibleRunes = []rune{
 	9, 10, 11, 12, 13, 32, 127, 160, 173, 847, 1564, 4447, 4448, 6068, 6069, 6155, 6156, 6157, 6158, 7355, 7356, 8192, 8193, 8194, 8195, 8196, 8197, 8198, 8199, 8200, 8201, 8202, 8203, 8204, 8205, 8206, 8207, 8234, 8235, 8236, 8237, 8238, 8239, 8287, 8288, 8289, 8290, 8291, 8292, 8293, 8294, 8295, 8296, 8297, 8298, 8299, 8300, 8301, 8302, 8303, 10240, 12288, 12644, 65024, 65025, 65026, 65027, 65028, 65029, 65030, 65031, 65032, 65033, 65034, 65035, 65036, 65037, 65038, 65039, 65279, 65440, 65520, 65521, 65522, 65523, 65524, 65525, 65526, 65527, 65528, 65532, 78844, 119155, 119156, 119157, 119158, 119159, 119160, 119161, 119162, 917504, 917505, 917506, 917507, 917508, 917509, 917510, 917511, 917512, 917513, 917514, 917515, 917516, 917517, 917518, 917519, 917520, 917521, 917522, 917523, 917524, 917525, 917526, 917527, 917528, 917529, 917530, 917531, 917532, 917533, 917534, 917535, 917536, 917537, 917538, 917539, 917540, 917541, 917542, 917543, 917544, 917545, 917546, 917547, 917548, 917549, 917550, 917551, 917552, 917553, 917554, 917555, 917556, 917557, 917558, 917559, 917560, 917561, 917562, 917563, 917564, 917565, 917566, 917567, 917568, 917569, 917570, 917571, 917572, 917573, 917574, 917575, 917576, 917577, 917578, 917579, 917580, 917581, 917582, 917583, 917584, 917585, 917586, 917587, 917588, 917589, 917590, 917591, 917592, 917593, 917594, 917595, 917596, 917597, 917598, 917599, 917600, 917601, 917602, 917603, 917604, 917605, 917606, 917607, 917608, 917609, 917610, 917611, 917612, 917613, 917614, 917615, 917616, 917617, 917618, 917619, 917620, 917621, 917622, 917623, 917624, 917625, 917626, 917627, 917628, 917629, 917630, 917631, 917760, 917761, 917762, 917763, 917764, 917765, 917766, 917767, 917768, 917769, 917770, 917771, 917772, 917773, 917774, 917775, 917776, 917777, 917778, 917779, 917780, 917781, 917782, 917783, 917784, 917785, 917786, 917787, 917788, 917789, 917790, 917791, 917792, 917793, 917794, 917795, 917796, 917797, 917798, 917799, 917800, 917801, 917802, 917803, 917804, 917805, 917806, 917807, 917808, 917809, 917810, 917811, 917812, 917813, 917814, 917815, 917816, 917817, 917818, 917819, 917820, 917821, 917822, 917823, 917824, 917825, 917826, 917827, 917828, 917829, 917830, 917831, 917832, 917833, 917834, 917835, 917836, 917837, 917838, 917839, 917840, 917841, 917842, 917843, 917844, 917845, 917846, 917847, 917848, 917849, 917850, 917851, 917852, 917853, 917854, 917855, 917856, 917857, 917858, 917859, 917860, 917861, 917862, 917863, 917864, 917865, 917866, 917867, 917868, 917869, 917870, 917871, 917872, 917873, 917874, 917875, 917876, 917877, 917878, 917879, 917880, 917881, 917882, 917883, 917884, 917885, 917886, 917887, 917888, 917889, 917890, 917891, 917892, 917893, 917894, 917895, 917896, 917897, 917898, 917899, 917900, 917901, 917902, 917903, 917904, 917905, 917906, 917907, 917908, 917909, 917910, 917911, 917912, 917913, 917914, 917915, 917916, 917917, 917918, 917919, 917920, 917921, 917922, 917923, 917924, 917925, 917926, 917927, 917928, 917929, 917930, 917931, 917932, 917933, 917934, 917935, 917936, 917937, 917938, 917939, 917940, 917941, 917942, 917943, 917944, 917945, 917946, 917947, 917948, 917949, 917950, 917951, 917952, 917953, 917954, 917955, 917956, 917957, 917958, 917959, 917960, 917961, 917962, 917963, 917964, 917965, 917966, 917967, 917968, 917969, 917970, 917971, 917972, 917973, 917974, 917975, 917976, 917977, 917978, 917979, 917980, 917981, 917982, 917983, 917984, 917985, 917986, 917987, 917988, 917989, 917990, 917991, 917992, 917993, 917994, 917995, 917996, 917997, 917998, 917999,
 }
 
-var verbose bool
-
-func main() {
-	flag.Usage = func() {
-		fmt.Fprintf(os.Stderr, `%s: Generate InvisibleRunesRange
-
-Usage: %[1]s [-v] [-o output.go]
-`, os.Args[0])
-		flag.PrintDefaults()
+func generateAmbiguous() {
+	bs, err := os.ReadFile("ambiguous.json")
+	if err != nil {
+		log.Fatalf("Unable to read, err: %v", err)
 	}
 
-	output := ""
-	flag.BoolVar(&verbose, "v", false, "verbose output")
-	flag.StringVar(&output, "o", "invisible_gen.go", "file to output to")
-	flag.Parse()
+	var unwrapped string
+	if err := json.Unmarshal(bs, &unwrapped); err != nil {
+		log.Fatalf("Unable to unwrap content in, err: %v", err)
+	}
 
+	fromJSON := map[string][]uint32{}
+	if err := json.Unmarshal([]byte(unwrapped), &fromJSON); err != nil {
+		log.Fatalf("Unable to unmarshal content in, err: %v", err)
+	}
+
+	tables := make([]*AmbiguousTable, 0, len(fromJSON))
+	for locale, chars := range fromJSON {
+		table := &AmbiguousTable{Locale: locale}
+		table.Confusable = make([]rune, 0, len(chars)/2)
+		table.With = make([]rune, 0, len(chars)/2)
+		pairs := make([]RunePair, len(chars)/2)
+		for i := 0; i < len(chars); i += 2 {
+			pairs[i/2].Confusable, pairs[i/2].With = rune(chars[i]), rune(chars[i+1])
+		}
+		sort.Slice(pairs, func(i, j int) bool {
+			return pairs[i].Confusable < pairs[j].Confusable
+		})
+		for _, pair := range pairs {
+			table.Confusable = append(table.Confusable, pair.Confusable)
+			table.With = append(table.With, pair.With)
+		}
+		table.RangeTable = rangetable.New(table.Confusable...)
+		tables = append(tables, table)
+	}
+	sort.Slice(tables, func(i, j int) bool {
+		return tables[i].Locale < tables[j].Locale
+	})
+	data := map[string]any{"Tables": tables}
+
+	if err := runTemplate(templateAmbiguous, "../ambiguous_gen.go", &data); err != nil {
+		log.Fatalf("Unable to run template: %v", err)
+	}
+}
+
+func generateInvisible() {
 	// First we filter the runes to remove
 	// <space><tab><newline>
 	filtered := make([]rune, 0, len(InvisibleRunes))
@@ -47,8 +96,8 @@ Usage: %[1]s [-v] [-o output.go]
 	}
 
 	table := rangetable.New(filtered...)
-	if err := runTemplate(generatorTemplate, output, table); err != nil {
-		fatalf("Unable to run template: %v", err)
+	if err := runTemplate(generatorInvisible, "../invisible_gen.go", table); err != nil {
+		log.Fatalf("Unable to run template: %v", err)
 	}
 }
 
@@ -59,7 +108,7 @@ func runTemplate(t *template.Template, filename string, data any) error {
 	}
 	bs, err := format.Source(buf.Bytes())
 	if err != nil {
-		verbosef("Bad source:\n%s", buf.String())
+		log.Printf("Bad source:\n%s", buf.String())
 		return fmt.Errorf("unable to format source: %w", err)
 	}
 
@@ -85,37 +134,68 @@ func runTemplate(t *template.Template, filename string, data any) error {
 	return nil
 }
 
-var generatorTemplate = template.Must(template.New("invisibleTemplate").Parse(`// This file is generated by modules/charset/invisible/generate.go DO NOT EDIT
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
+func main() {
+	generateAmbiguous()
+	generateInvisible()
+}
 
+var templateAmbiguous = template.Must(template.New("ambiguousTemplate").Parse(`// This file is generated by modules/charset/generate/generate.go DO NOT EDIT
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
 
 package charset
 
 import "unicode"
 
-var InvisibleRanges = &unicode.RangeTable{
-	R16: []unicode.Range16{
-{{range .R16 }}		{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
-{{end}}	},
-	R32: []unicode.Range32{
-{{range .R32}}		{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
-{{end}}	},
-	LatinOffset: {{.LatinOffset}},
+// This file is generated from https://github.com/hediet/vscode-unicode-data/blob/main/out/ambiguous.json
+
+// AmbiguousTable matches a confusable rune with its partner for the Locale
+type AmbiguousTable struct {
+	Confusable []rune
+	With       []rune
+	Locale     string
+	RangeTable *unicode.RangeTable
+}
+
+func newAmbiguousTableMap() map[string]*AmbiguousTable {
+	return map[string]*AmbiguousTable {
+	{{- range .Tables}}
+	{{printf "%q" .Locale}}: {
+			Confusable: []rune{ {{range .Confusable}}{{.}},{{end}} },
+			With: []rune{ {{range .With}}{{.}},{{end}} },
+			Locale: {{printf "%q" .Locale}},
+			RangeTable: &unicode.RangeTable{
+				R16: []unicode.Range16{
+			{{range .RangeTable.R16 }}		{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
+			{{end}}	},
+				R32: []unicode.Range32{
+			{{range .RangeTable.R32}}		{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
+			{{end}}	},
+				LatinOffset: {{.RangeTable.LatinOffset}},
+			},
+		},
+	{{end}}
+	}
 }
 `))
 
-func logf(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, format+"\n", args...)
-}
+var generatorInvisible = template.Must(template.New("invisibleTemplate").Parse(`// This file is generated by modules/charset/generate/generate.go DO NOT EDIT
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
 
-func verbosef(format string, args ...any) {
-	if verbose {
-		logf(format, args...)
+package charset
+
+import "unicode"
+
+func newInvisibleRangeTable() *unicode.RangeTable {
+	return &unicode.RangeTable{
+		R16: []unicode.Range16{
+{{range .R16 }}			{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
+		{{end}}},
+		R32: []unicode.Range32{
+{{range .R32}}			{Lo:{{.Lo}}, Hi:{{.Hi}}, Stride: {{.Stride}}},
+		{{end}}},
+		LatinOffset: {{.LatinOffset}},
 	}
 }
-
-func fatalf(format string, args ...any) {
-	logf("fatal: "+format+"\n", args...)
-	os.Exit(1)
-}
+`))

package/gitea/source/modules/charset/htmlstream.go

@@ -1,200 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package charset
-
-import (
-	"fmt"
-	"io"
-
-	"golang.org/x/net/html"
-)
-
-// HTMLStreamer represents a SAX-like interface for HTML
-type HTMLStreamer interface {
-	Error(err error) error
-	Doctype(data string) error
-	Comment(data string) error
-	StartTag(data string, attrs ...html.Attribute) error
-	SelfClosingTag(data string, attrs ...html.Attribute) error
-	EndTag(data string) error
-	Text(data string) error
-}
-
-// PassthroughHTMLStreamer is a passthrough streamer
-type PassthroughHTMLStreamer struct {
-	next HTMLStreamer
-}
-
-func NewPassthroughStreamer(next HTMLStreamer) *PassthroughHTMLStreamer {
-	return &PassthroughHTMLStreamer{next: next}
-}
-
-var _ (HTMLStreamer) = &PassthroughHTMLStreamer{}
-
-// Error tells the next streamer in line that there is an error
-func (p *PassthroughHTMLStreamer) Error(err error) error {
-	return p.next.Error(err)
-}
-
-// Doctype tells the next streamer what the doctype is
-func (p *PassthroughHTMLStreamer) Doctype(data string) error {
-	return p.next.Doctype(data)
-}
-
-// Comment tells the next streamer there is a comment
-func (p *PassthroughHTMLStreamer) Comment(data string) error {
-	return p.next.Comment(data)
-}
-
-// StartTag tells the next streamer there is a starting tag
-func (p *PassthroughHTMLStreamer) StartTag(data string, attrs ...html.Attribute) error {
-	return p.next.StartTag(data, attrs...)
-}
-
-// SelfClosingTag tells the next streamer there is a self-closing tag
-func (p *PassthroughHTMLStreamer) SelfClosingTag(data string, attrs ...html.Attribute) error {
-	return p.next.SelfClosingTag(data, attrs...)
-}
-
-// EndTag tells the next streamer there is a end tag
-func (p *PassthroughHTMLStreamer) EndTag(data string) error {
-	return p.next.EndTag(data)
-}
-
-// Text tells the next streamer there is a text
-func (p *PassthroughHTMLStreamer) Text(data string) error {
-	return p.next.Text(data)
-}
-
-// HTMLStreamWriter acts as a writing sink
-type HTMLStreamerWriter struct {
-	io.Writer
-	err error
-}
-
-// Write implements io.Writer
-func (h *HTMLStreamerWriter) Write(data []byte) (int, error) {
-	if h.err != nil {
-		return 0, h.err
-	}
-	return h.Writer.Write(data)
-}
-
-// Write implements io.StringWriter
-func (h *HTMLStreamerWriter) WriteString(data string) (int, error) {
-	if h.err != nil {
-		return 0, h.err
-	}
-	return h.Writer.Write([]byte(data))
-}
-
-// Error tells the next streamer in line that there is an error
-func (h *HTMLStreamerWriter) Error(err error) error {
-	if h.err == nil {
-		h.err = err
-	}
-	return h.err
-}
-
-// Doctype tells the next streamer what the doctype is
-func (h *HTMLStreamerWriter) Doctype(data string) error {
-	_, h.err = h.WriteString("<!DOCTYPE " + data + ">")
-	return h.err
-}
-
-// Comment tells the next streamer there is a comment
-func (h *HTMLStreamerWriter) Comment(data string) error {
-	_, h.err = h.WriteString("<!--" + data + "-->")
-	return h.err
-}
-
-// StartTag tells the next streamer there is a starting tag
-func (h *HTMLStreamerWriter) StartTag(data string, attrs ...html.Attribute) error {
-	return h.startTag(data, attrs, false)
-}
-
-// SelfClosingTag tells the next streamer there is a self-closing tag
-func (h *HTMLStreamerWriter) SelfClosingTag(data string, attrs ...html.Attribute) error {
-	return h.startTag(data, attrs, true)
-}
-
-func (h *HTMLStreamerWriter) startTag(data string, attrs []html.Attribute, selfclosing bool) error {
-	if _, h.err = h.WriteString("<" + data); h.err != nil {
-		return h.err
-	}
-	for _, attr := range attrs {
-		if _, h.err = h.WriteString(" " + attr.Key + "=\"" + html.EscapeString(attr.Val) + "\""); h.err != nil {
-			return h.err
-		}
-	}
-	if selfclosing {
-		if _, h.err = h.WriteString("/>"); h.err != nil {
-			return h.err
-		}
-	} else {
-		if _, h.err = h.WriteString(">"); h.err != nil {
-			return h.err
-		}
-	}
-	return h.err
-}
-
-// EndTag tells the next streamer there is a end tag
-func (h *HTMLStreamerWriter) EndTag(data string) error {
-	_, h.err = h.WriteString("</" + data + ">")
-	return h.err
-}
-
-// Text tells the next streamer there is a text
-func (h *HTMLStreamerWriter) Text(data string) error {
-	_, h.err = h.WriteString(html.EscapeString(data))
-	return h.err
-}
-
-// StreamHTML streams an html to a provided streamer
-func StreamHTML(source io.Reader, streamer HTMLStreamer) error {
-	tokenizer := html.NewTokenizer(source)
-	for {
-		tt := tokenizer.Next()
-		switch tt {
-		case html.ErrorToken:
-			if tokenizer.Err() != io.EOF {
-				return tokenizer.Err()
-			}
-			return nil
-		case html.DoctypeToken:
-			token := tokenizer.Token()
-			if err := streamer.Doctype(token.Data); err != nil {
-				return err
-			}
-		case html.CommentToken:
-			token := tokenizer.Token()
-			if err := streamer.Comment(token.Data); err != nil {
-				return err
-			}
-		case html.StartTagToken:
-			token := tokenizer.Token()
-			if err := streamer.StartTag(token.Data, token.Attr...); err != nil {
-				return err
-			}
-		case html.SelfClosingTagToken:
-			token := tokenizer.Token()
-			if err := streamer.StartTag(token.Data, token.Attr...); err != nil {
-				return err
-			}
-		case html.EndTagToken:
-			token := tokenizer.Token()
-			if err := streamer.EndTag(token.Data); err != nil {
-				return err
-			}
-		case html.TextToken:
-			token := tokenizer.Token()
-			if err := streamer.Text(token.Data); err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("unknown type of token: %d", tt)
-		}
-	}
-}

package/gitea/source/modules/charset/invisible_gen.go

@@ -1,36 +1,38 @@
-// This file is generated by modules/charset/invisible/generate.go DO NOT EDIT
-// Copyright 2022 The Gitea Authors. All rights reserved.
+// This file is generated by modules/charset/generate/generate.go DO NOT EDIT
+// Copyright 2026 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
 package charset
 
 import "unicode"
 
-var InvisibleRanges = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		{Lo: 11, Hi: 13, Stride: 1},
-		{Lo: 127, Hi: 160, Stride: 33},
-		{Lo: 173, Hi: 847, Stride: 674},
-		{Lo: 1564, Hi: 4447, Stride: 2883},
-		{Lo: 4448, Hi: 6068, Stride: 1620},
-		{Lo: 6069, Hi: 6155, Stride: 86},
-		{Lo: 6156, Hi: 6158, Stride: 1},
-		{Lo: 7355, Hi: 7356, Stride: 1},
-		{Lo: 8192, Hi: 8207, Stride: 1},
-		{Lo: 8234, Hi: 8239, Stride: 1},
-		{Lo: 8287, Hi: 8303, Stride: 1},
-		{Lo: 10240, Hi: 12288, Stride: 2048},
-		{Lo: 12644, Hi: 65024, Stride: 52380},
-		{Lo: 65025, Hi: 65039, Stride: 1},
-		{Lo: 65279, Hi: 65440, Stride: 161},
-		{Lo: 65520, Hi: 65528, Stride: 1},
-		{Lo: 65532, Hi: 65532, Stride: 1},
-	},
-	R32: []unicode.Range32{
-		{Lo: 78844, Hi: 119155, Stride: 40311},
-		{Lo: 119156, Hi: 119162, Stride: 1},
-		{Lo: 917504, Hi: 917631, Stride: 1},
-		{Lo: 917760, Hi: 917999, Stride: 1},
-	},
-	LatinOffset: 2,
+func newInvisibleRangeTable() *unicode.RangeTable {
+	return &unicode.RangeTable{
+		R16: []unicode.Range16{
+			{Lo: 11, Hi: 13, Stride: 1},
+			{Lo: 127, Hi: 160, Stride: 33},
+			{Lo: 173, Hi: 847, Stride: 674},
+			{Lo: 1564, Hi: 4447, Stride: 2883},
+			{Lo: 4448, Hi: 6068, Stride: 1620},
+			{Lo: 6069, Hi: 6155, Stride: 86},
+			{Lo: 6156, Hi: 6158, Stride: 1},
+			{Lo: 7355, Hi: 7356, Stride: 1},
+			{Lo: 8192, Hi: 8207, Stride: 1},
+			{Lo: 8234, Hi: 8239, Stride: 1},
+			{Lo: 8287, Hi: 8303, Stride: 1},
+			{Lo: 10240, Hi: 12288, Stride: 2048},
+			{Lo: 12644, Hi: 65024, Stride: 52380},
+			{Lo: 65025, Hi: 65039, Stride: 1},
+			{Lo: 65279, Hi: 65440, Stride: 161},
+			{Lo: 65520, Hi: 65528, Stride: 1},
+			{Lo: 65532, Hi: 65532, Stride: 1},
+		},
+		R32: []unicode.Range32{
+			{Lo: 78844, Hi: 119155, Stride: 40311},
+			{Lo: 119156, Hi: 119162, Stride: 1},
+			{Lo: 917504, Hi: 917631, Stride: 1},
+			{Lo: 917760, Hi: 917999, Stride: 1},
+		},
+		LatinOffset: 2,
+	}
 }

package/gitea/source/modules/commitstatus/commit_status.go

@@ -61,16 +61,17 @@ type CommitStatusStates []CommitStatusState //nolint:revive // export stutter
 // According to https://docs.github.com/en/rest/commits/statuses?apiVersion=2022-11-28#get-the-combined-status-for-a-specific-reference
 // > Additionally, a combined state is returned. The state is one of:
 // > failure if any of the contexts report as error or failure
+// > failure if any of the contexts report as warning (Gitea specific behavior)
 // > pending if there are no statuses or a context is pending
 // > success if the latest status for all contexts is success
 func (css CommitStatusStates) Combine() CommitStatusState {
 	successCnt := 0
 	for _, state := range css {
 		switch {
-		case state.IsError() || state.IsFailure():
+		case state.IsError() || state.IsFailure() || state.IsWarning():
 			return CommitStatusFailure
 		case state.IsPending():
-		case state.IsSuccess() || state.IsWarning() || state.IsSkipped():
+		case state.IsSuccess() || state.IsSkipped():
 			successCnt++
 		}
 	}

package/gitea/source/modules/commitstatus/commit_status_test.go

@@ -41,7 +41,7 @@ func TestCombine(t *testing.T) {
 		{
 			name:     "warning",
 			states:   CommitStatusStates{CommitStatusWarning},
-			expected: CommitStatusSuccess,
+			expected: CommitStatusFailure,
 		},
 		// 2 states
 		{
@@ -62,7 +62,7 @@ func TestCombine(t *testing.T) {
 		{
 			name:     "pending and warning",
 			states:   CommitStatusStates{CommitStatusPending, CommitStatusWarning},
-			expected: CommitStatusPending,
+			expected: CommitStatusFailure,
 		},
 		{
 			name:     "success and error",
@@ -77,7 +77,7 @@ func TestCombine(t *testing.T) {
 		{
 			name:     "success and warning",
 			states:   CommitStatusStates{CommitStatusSuccess, CommitStatusWarning},
-			expected: CommitStatusSuccess,
+			expected: CommitStatusFailure,
 		},
 		{
 			name:     "error and failure",
@@ -98,7 +98,7 @@ func TestCombine(t *testing.T) {
 		{
 			name:     "pending, success and warning",
 			states:   CommitStatusStates{CommitStatusPending, CommitStatusSuccess, CommitStatusWarning},
-			expected: CommitStatusPending,
+			expected: CommitStatusFailure,
 		},
 		{
 			name:     "pending, success and error",
@@ -133,7 +133,7 @@ func TestCombine(t *testing.T) {
 		{
 			name:     "success, warning and skipped",
 			states:   CommitStatusStates{CommitStatusSuccess, CommitStatusWarning, CommitStatusSkipped},
-			expected: CommitStatusSuccess,
+			expected: CommitStatusFailure,
 		},
 		// All success
 		{
@@ -181,12 +181,12 @@ func TestCombine(t *testing.T) {
 		{
 			name:     "mixed states with all success",
 			states:   CommitStatusStates{CommitStatusSuccess, CommitStatusSuccess, CommitStatusPending, CommitStatusWarning},
-			expected: CommitStatusPending,
+			expected: CommitStatusFailure,
 		},
 		{
 			name:     "all success with warning",
 			states:   CommitStatusStates{CommitStatusSuccess, CommitStatusSuccess, CommitStatusSuccess, CommitStatusWarning},
-			expected: CommitStatusSuccess,
+			expected: CommitStatusFailure,
 		},
 	}
 

package/gitea/source/modules/dump/dumper.go

@@ -4,6 +4,7 @@
 package dump
 
 import (
+	"archive/zip"
 	"context"
 	"errors"
 	"fmt"
@@ -85,7 +86,7 @@ func NewDumper(ctx context.Context, format string, output io.Writer) (*Dumper, e
 	var comp archives.ArchiverAsync
 	switch format {
 	case "zip":
-		comp = archives.Zip{}
+		comp = archives.Zip{Compression: zip.Deflate}
 	case "tar":
 		comp = archives.Tar{}
 	case "tar.sz":

package/gitea/source/modules/emoji/emoji_data.go

@@ -4,7 +4,7 @@
 package emoji
 
 // Code generated by build/generate-emoji.go. DO NOT EDIT.
-// Sourced from https://raw.githubusercontent.com/github/gemoji/master/db/emoji.json
+// Sourced from https://raw.githubusercontent.com/rhysd/gemoji/537ff2d7e0496e9964824f7f73ec7ece88c9765a/db/emoji.json
 var GemojiData = Gemoji{
 	{"\U0001f44d", "thumbs up", []string{"+1", "thumbsup"}, "6.0", true},
 	{"\U0001f44d\U0001f3ff", "thumbs up: Dark Skin Tone", []string{"+1_Dark_Skin_Tone"}, "12.0", false},
@@ -345,10 +345,12 @@ var GemojiData = Gemoji{
 	{"\U0001f1ee\U0001f1f4", "flag: British Indian Ocean Territory", []string{"british_indian_ocean_territory"}, "6.0", false},
 	{"\U0001f1fb\U0001f1ec", "flag: British Virgin Islands", []string{"british_virgin_islands"}, "6.0", false},
 	{"\U0001f966", "broccoli", []string{"broccoli"}, "11.0", false},
+	{"\u26d3\ufe0f\u200d\U0001f4a5", "broken chain", []string{"broken_chain"}, "15.1", false},
 	{"\U0001f494", "broken heart", []string{"broken_heart"}, "6.0", false},
 	{"\U0001f9f9", "broom", []string{"broom"}, "11.0", false},
 	{"\U0001f7e4", "brown circle", []string{"brown_circle"}, "12.0", false},
 	{"\U0001f90e", "brown heart", []string{"brown_heart"}, "12.0", false},
+	{"\U0001f344\u200d\U0001f7eb", "brown mushroom", []string{"brown_mushroom"}, "15.1", false},
 	{"\U0001f7eb", "brown square", []string{"brown_square"}, "12.0", false},
 	{"\U0001f1e7\U0001f1f3", "flag: Brunei", []string{"brunei"}, "6.0", false},
 	{"\U0001f9cb", "bubble tea", []string{"bubble_tea"}, "13.0", false},
@@ -838,6 +840,7 @@ var GemojiData = Gemoji{
 	{"\U0001f62e\u200d\U0001f4a8", "face exhaling", []string{"face_exhaling"}, "13.1", false},
 	{"\U0001f979", "face holding back tears", []string{"face_holding_back_tears"}, "14.0", false},
 	{"\U0001f636\u200d\U0001f32b\ufe0f", "face in clouds", []string{"face_in_clouds"}, "13.1", false},
+	{"\U0001fae9", "face with bags under eyes", []string{"face_with_bags_under_eyes"}, "16.0", false},
 	{"\U0001fae4", "face with diagonal mouth", []string{"face_with_diagonal_mouth"}, "14.0", false},
 	{"\U0001f915", "face with head-bandage", []string{"face_with_head_bandage"}, "8.0", false},
 	{"\U0001fae2", "face with open eyes and hand over mouth", []string{"face_with_open_eyes_and_hand_over_mouth"}, "14.0", false},
@@ -879,6 +882,10 @@ var GemojiData = Gemoji{
 	{"\U0001f1eb\U0001f1f0", "flag: Falkland Islands", []string{"falkland_islands"}, "6.0", false},
 	{"\U0001f342", "fallen leaf", []string{"fallen_leaf"}, "6.0", false},
 	{"\U0001f46a", "family", []string{"family"}, "6.0", false},
+	{"\U0001f9d1\u200d\U0001f9d1\u200d\U0001f9d2", "family: adult, adult, child", []string{"family_adult_adult_child"}, "15.1", false},
+	{"\U0001f9d1\u200d\U0001f9d1\u200d\U0001f9d2\u200d\U0001f9d2", "family: adult, adult, child, child", []string{"family_adult_adult_child_child"}, "15.1", false},
+	{"\U0001f9d1\u200d\U0001f9d2", "family: adult, child", []string{"family_adult_child"}, "15.1", false},
+	{"\U0001f9d1\u200d\U0001f9d2\u200d\U0001f9d2", "family: adult, child, child", []string{"family_adult_child_child"}, "15.1", false},
 	{"\U0001f468\u200d\U0001f466", "family: man, boy", []string{"family_man_boy"}, "6.0", false},
 	{"\U0001f468\u200d\U0001f466\u200d\U0001f466", "family: man, boy, boy", []string{"family_man_boy_boy"}, "6.0", false},
 	{"\U0001f468\u200d\U0001f467", "family: man, girl", []string{"family_man_girl"}, "6.0", false},
@@ -931,6 +938,7 @@ var GemojiData = Gemoji{
 	{"\U0001f4c1", "file folder", []string{"file_folder"}, "6.0", false},
 	{"\U0001f4fd\ufe0f", "film projector", []string{"film_projector"}, "7.0", false},
 	{"\U0001f39e\ufe0f", "film frames", []string{"film_strip"}, "7.0", false},
+	{"\U0001fac6", "fingerprint", []string{"fingerprint"}, "16.0", false},
 	{"\U0001f1eb\U0001f1ee", "flag: Finland", []string{"finland"}, "6.0", false},
 	{"\U0001f525", "fire", []string{"fire"}, "6.0", false},
 	{"\U0001f692", "fire engine", []string{"fire_engine"}, "6.0", false},
@@ -973,6 +981,7 @@ var GemojiData = Gemoji{
 	{"\U0001f91c\U0001f3fc", "right-facing fist: Medium-Light Skin Tone", []string{"fist_right_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f91c\U0001f3fd", "right-facing fist: Medium Skin Tone", []string{"fist_right_Medium_Skin_Tone"}, "12.0", false},
 	{"5\ufe0f\u20e3", "keycap: 5", []string{"five"}, "", false},
+	{"\U0001f1e8\U0001f1f6", "flag: Sark", []string{"flag_sark"}, "16.0", false},
 	{"\U0001f38f", "carp streamer", []string{"flags"}, "6.0", false},
 	{"\U0001f9a9", "flamingo", []string{"flamingo"}, "12.0", false},
 	{"\U0001f526", "flashlight", []string{"flashlight"}, "6.0", false},
@@ -1189,9 +1198,12 @@ var GemojiData = Gemoji{
 	{"\U0001f91d\U0001f3fc", "handshake: Medium-Light Skin Tone", []string{"handshake_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f91d\U0001f3fd", "handshake: Medium Skin Tone", []string{"handshake_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f4a9", "pile of poo", []string{"hankey", "poop", "shit"}, "6.0", false},
+	{"\U0001fa89", "harp", []string{"harp"}, "16.0", false},
 	{"#\ufe0f\u20e3", "keycap: #", []string{"hash"}, "", false},
 	{"\U0001f425", "front-facing baby chick", []string{"hatched_chick"}, "6.0", false},
 	{"\U0001f423", "hatching chick", []string{"hatching_chick"}, "6.0", false},
+	{"\U0001f642\u200d\u2194\ufe0f", "head shaking horizontally", []string{"head_shaking_horizontally"}, "15.1", false},
+	{"\U0001f642\u200d\u2195\ufe0f", "head shaking vertically", []string{"head_shaking_vertically"}, "15.1", false},
 	{"\U0001f3a7", "headphone", []string{"headphones"}, "6.0", false},
 	{"\U0001faa6", "headstone", []string{"headstone"}, "13.0", false},
 	{"\U0001f9d1\u200d\u2695\ufe0f", "health worker", []string{"health_worker"}, "12.1", true},
@@ -1380,6 +1392,7 @@ var GemojiData = Gemoji{
 	{"\u271d\ufe0f", "latin cross", []string{"latin_cross"}, "", false},
 	{"\U0001f1f1\U0001f1fb", "flag: Latvia", []string{"latvia"}, "6.0", false},
 	{"\U0001f606", "grinning squinting face", []string{"laughing", "satisfied", "laugh"}, "6.0", false},
+	{"\U0001fabe", "leafless tree", []string{"leafless_tree"}, "16.0", false},
 	{"\U0001f96c", "leafy green", []string{"leafy_green"}, "11.0", false},
 	{"\U0001f343", "leaf fluttering in wind", []string{"leaves"}, "6.0", false},
 	{"\U0001f1f1\U0001f1e7", "flag: Lebanon", []string{"lebanon"}, "6.0", false},
@@ -1417,6 +1430,7 @@ var GemojiData = Gemoji{
 	{"\U0001f1f1\U0001f1ee", "flag: Liechtenstein", []string{"liechtenstein"}, "6.0", false},
 	{"\U0001fa75", "light blue heart", []string{"light_blue_heart"}, "15.0", false},
 	{"\U0001f688", "light rail", []string{"light_rail"}, "6.0", false},
+	{"\U0001f34b\u200d\U0001f7e9", "lime", []string{"lime"}, "15.1", false},
 	{"\U0001f517", "link", []string{"link"}, "6.0", false},
 	{"\U0001f981", "lion", []string{"lion"}, "8.0", false},
 	{"\U0001f444", "mouth", []string{"lips"}, "6.0", false},
@@ -1594,12 +1608,24 @@ var GemojiData = Gemoji{
 	{"\U0001f468\U0001f3fe\u200d\U0001f9bd", "man in manual wheelchair: Medium-Dark Skin Tone", []string{"man_in_manual_wheelchair_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fc\u200d\U0001f9bd", "man in manual wheelchair: Medium-Light Skin Tone", []string{"man_in_manual_wheelchair_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fd\u200d\U0001f9bd", "man in manual wheelchair: Medium Skin Tone", []string{"man_in_manual_wheelchair_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\u200d\U0001f9bd\u200d\u27a1\ufe0f", "man in manual wheelchair facing right", []string{"man_in_manual_wheelchair_facing_right"}, "15.1", true},
+	{"\U0001f468\U0001f3ff\u200d\U0001f9bd\u200d\u27a1\ufe0f", "man in manual wheelchair facing right: Dark Skin Tone", []string{"man_in_manual_wheelchair_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fb\u200d\U0001f9bd\u200d\u27a1\ufe0f", "man in manual wheelchair facing right: Light Skin Tone", []string{"man_in_manual_wheelchair_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fe\u200d\U0001f9bd\u200d\u27a1\ufe0f", "man in manual wheelchair facing right: Medium-Dark Skin Tone", []string{"man_in_manual_wheelchair_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fc\u200d\U0001f9bd\u200d\u27a1\ufe0f", "man in manual wheelchair facing right: Medium-Light Skin Tone", []string{"man_in_manual_wheelchair_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fd\u200d\U0001f9bd\u200d\u27a1\ufe0f", "man in manual wheelchair facing right: Medium Skin Tone", []string{"man_in_manual_wheelchair_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\u200d\U0001f9bc", "man in motorized wheelchair", []string{"man_in_motorized_wheelchair"}, "12.0", true},
 	{"\U0001f468\U0001f3ff\u200d\U0001f9bc", "man in motorized wheelchair: Dark Skin Tone", []string{"man_in_motorized_wheelchair_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fb\u200d\U0001f9bc", "man in motorized wheelchair: Light Skin Tone", []string{"man_in_motorized_wheelchair_Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fe\u200d\U0001f9bc", "man in motorized wheelchair: Medium-Dark Skin Tone", []string{"man_in_motorized_wheelchair_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fc\u200d\U0001f9bc", "man in motorized wheelchair: Medium-Light Skin Tone", []string{"man_in_motorized_wheelchair_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fd\u200d\U0001f9bc", "man in motorized wheelchair: Medium Skin Tone", []string{"man_in_motorized_wheelchair_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\u200d\U0001f9bc\u200d\u27a1\ufe0f", "man in motorized wheelchair facing right", []string{"man_in_motorized_wheelchair_facing_right"}, "15.1", true},
+	{"\U0001f468\U0001f3ff\u200d\U0001f9bc\u200d\u27a1\ufe0f", "man in motorized wheelchair facing right: Dark Skin Tone", []string{"man_in_motorized_wheelchair_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fb\u200d\U0001f9bc\u200d\u27a1\ufe0f", "man in motorized wheelchair facing right: Light Skin Tone", []string{"man_in_motorized_wheelchair_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fe\u200d\U0001f9bc\u200d\u27a1\ufe0f", "man in motorized wheelchair facing right: Medium-Dark Skin Tone", []string{"man_in_motorized_wheelchair_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fc\u200d\U0001f9bc\u200d\u27a1\ufe0f", "man in motorized wheelchair facing right: Medium-Light Skin Tone", []string{"man_in_motorized_wheelchair_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fd\u200d\U0001f9bc\u200d\u27a1\ufe0f", "man in motorized wheelchair facing right: Medium Skin Tone", []string{"man_in_motorized_wheelchair_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\u200d\u2642\ufe0f", "man in tuxedo", []string{"man_in_tuxedo"}, "13.0", true},
 	{"\U0001f935\U0001f3ff\u200d\u2642\ufe0f", "man in tuxedo: Dark Skin Tone", []string{"man_in_tuxedo_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\U0001f3fb\u200d\u2642\ufe0f", "man in tuxedo: Light Skin Tone", []string{"man_in_tuxedo_Light_Skin_Tone"}, "12.0", false},
@@ -1618,6 +1644,12 @@ var GemojiData = Gemoji{
 	{"\U0001f939\U0001f3fe\u200d\u2642\ufe0f", "man juggling: Medium-Dark Skin Tone", []string{"man_juggling_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f939\U0001f3fc\u200d\u2642\ufe0f", "man juggling: Medium-Light Skin Tone", []string{"man_juggling_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f939\U0001f3fd\u200d\u2642\ufe0f", "man juggling: Medium Skin Tone", []string{"man_juggling_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man kneeling facing right", []string{"man_kneeling_facing_right"}, "15.1", true},
+	{"\U0001f9ce\U0001f3ff\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man kneeling facing right: Dark Skin Tone", []string{"man_kneeling_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fb\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man kneeling facing right: Light Skin Tone", []string{"man_kneeling_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fe\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man kneeling facing right: Medium-Dark Skin Tone", []string{"man_kneeling_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fc\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man kneeling facing right: Medium-Light Skin Tone", []string{"man_kneeling_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fd\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man kneeling facing right: Medium Skin Tone", []string{"man_kneeling_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\u200d\U0001f527", "man mechanic", []string{"man_mechanic"}, "", true},
 	{"\U0001f468\U0001f3ff\u200d\U0001f527", "man mechanic: Dark Skin Tone", []string{"man_mechanic_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fb\u200d\U0001f527", "man mechanic: Light Skin Tone", []string{"man_mechanic_Light_Skin_Tone"}, "12.0", false},
@@ -1648,6 +1680,12 @@ var GemojiData = Gemoji{
 	{"\U0001f93d\U0001f3fe\u200d\u2642\ufe0f", "man playing water polo: Medium-Dark Skin Tone", []string{"man_playing_water_polo_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f93d\U0001f3fc\u200d\u2642\ufe0f", "man playing water polo: Medium-Light Skin Tone", []string{"man_playing_water_polo_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f93d\U0001f3fd\u200d\u2642\ufe0f", "man playing water polo: Medium Skin Tone", []string{"man_playing_water_polo_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man running facing right", []string{"man_running_facing_right"}, "15.1", true},
+	{"\U0001f3c3\U0001f3ff\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man running facing right: Dark Skin Tone", []string{"man_running_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fb\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man running facing right: Light Skin Tone", []string{"man_running_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fe\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man running facing right: Medium-Dark Skin Tone", []string{"man_running_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fc\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man running facing right: Medium-Light Skin Tone", []string{"man_running_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fd\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man running facing right: Medium Skin Tone", []string{"man_running_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\u200d\U0001f52c", "man scientist", []string{"man_scientist"}, "", true},
 	{"\U0001f468\U0001f3ff\u200d\U0001f52c", "man scientist: Dark Skin Tone", []string{"man_scientist_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fb\u200d\U0001f52c", "man scientist: Light Skin Tone", []string{"man_scientist_Light_Skin_Tone"}, "12.0", false},
@@ -1684,6 +1722,12 @@ var GemojiData = Gemoji{
 	{"\U0001f468\U0001f3fe\u200d\U0001f4bb", "man technologist: Medium-Dark Skin Tone", []string{"man_technologist_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fc\u200d\U0001f4bb", "man technologist: Medium-Light Skin Tone", []string{"man_technologist_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f468\U0001f3fd\u200d\U0001f4bb", "man technologist: Medium Skin Tone", []string{"man_technologist_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man walking facing right", []string{"man_walking_facing_right"}, "15.1", true},
+	{"\U0001f6b6\U0001f3ff\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man walking facing right: Dark Skin Tone", []string{"man_walking_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fb\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man walking facing right: Light Skin Tone", []string{"man_walking_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fe\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man walking facing right: Medium-Dark Skin Tone", []string{"man_walking_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fc\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man walking facing right: Medium-Light Skin Tone", []string{"man_walking_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fd\u200d\u2642\ufe0f\u200d\u27a1\ufe0f", "man walking facing right: Medium Skin Tone", []string{"man_walking_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f472", "person with skullcap", []string{"man_with_gua_pi_mao"}, "6.0", true},
 	{"\U0001f472\U0001f3ff", "person with skullcap: Dark Skin Tone", []string{"man_with_gua_pi_mao_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f472\U0001f3fb", "person with skullcap: Light Skin Tone", []string{"man_with_gua_pi_mao_Light_Skin_Tone"}, "12.0", false},
@@ -1708,6 +1752,12 @@ var GemojiData = Gemoji{
 	{"\U0001f470\U0001f3fe\u200d\u2642\ufe0f", "man with veil: Medium-Dark Skin Tone", []string{"man_with_veil_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f470\U0001f3fc\u200d\u2642\ufe0f", "man with veil: Medium-Light Skin Tone", []string{"man_with_veil_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f470\U0001f3fd\u200d\u2642\ufe0f", "man with veil: Medium Skin Tone", []string{"man_with_veil_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\u200d\U0001f9af\u200d\u27a1\ufe0f", "man with white cane facing right", []string{"man_with_white_cane_facing_right"}, "15.1", true},
+	{"\U0001f468\U0001f3ff\u200d\U0001f9af\u200d\u27a1\ufe0f", "man with white cane facing right: Dark Skin Tone", []string{"man_with_white_cane_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fb\u200d\U0001f9af\u200d\u27a1\ufe0f", "man with white cane facing right: Light Skin Tone", []string{"man_with_white_cane_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fe\u200d\U0001f9af\u200d\u27a1\ufe0f", "man with white cane facing right: Medium-Dark Skin Tone", []string{"man_with_white_cane_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fc\u200d\U0001f9af\u200d\u27a1\ufe0f", "man with white cane facing right: Medium-Light Skin Tone", []string{"man_with_white_cane_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f468\U0001f3fd\u200d\U0001f9af\u200d\u27a1\ufe0f", "man with white cane facing right: Medium Skin Tone", []string{"man_with_white_cane_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f96d", "mango", []string{"mango"}, "11.0", false},
 	{"\U0001f45e", "man’s shoe", []string{"mans_shoe", "shoe"}, "6.0", false},
 	{"\U0001f570\ufe0f", "mantelpiece clock", []string{"mantelpiece_clock"}, "7.0", false},
@@ -1874,12 +1924,12 @@ var GemojiData = Gemoji{
 	{"\U0001f3b5", "musical note", []string{"musical_note"}, "6.0", false},
 	{"\U0001f3bc", "musical score", []string{"musical_score"}, "6.0", false},
 	{"\U0001f507", "muted speaker", []string{"mute"}, "6.0", false},
-	{"\U0001f9d1\u200d\U0001f384", "mx claus", []string{"mx_claus"}, "13.0", true},
-	{"\U0001f9d1\U0001f3ff\u200d\U0001f384", "mx claus: Dark Skin Tone", []string{"mx_claus_Dark_Skin_Tone"}, "12.0", false},
-	{"\U0001f9d1\U0001f3fb\u200d\U0001f384", "mx claus: Light Skin Tone", []string{"mx_claus_Light_Skin_Tone"}, "12.0", false},
-	{"\U0001f9d1\U0001f3fe\u200d\U0001f384", "mx claus: Medium-Dark Skin Tone", []string{"mx_claus_Medium-Dark_Skin_Tone"}, "12.0", false},
-	{"\U0001f9d1\U0001f3fc\u200d\U0001f384", "mx claus: Medium-Light Skin Tone", []string{"mx_claus_Medium-Light_Skin_Tone"}, "12.0", false},
-	{"\U0001f9d1\U0001f3fd\u200d\U0001f384", "mx claus: Medium Skin Tone", []string{"mx_claus_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\u200d\U0001f384", "Mx Claus", []string{"mx_claus"}, "13.0", true},
+	{"\U0001f9d1\U0001f3ff\u200d\U0001f384", "Mx Claus: Dark Skin Tone", []string{"mx_claus_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fb\u200d\U0001f384", "Mx Claus: Light Skin Tone", []string{"mx_claus_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fe\u200d\U0001f384", "Mx Claus: Medium-Dark Skin Tone", []string{"mx_claus_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fc\u200d\U0001f384", "Mx Claus: Medium-Light Skin Tone", []string{"mx_claus_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fd\u200d\U0001f384", "Mx Claus: Medium Skin Tone", []string{"mx_claus_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f1f2\U0001f1f2", "flag: Myanmar (Burma)", []string{"myanmar"}, "6.0", false},
 	{"\U0001f485", "nail polish", []string{"nail_care"}, "6.0", true},
 	{"\U0001f485\U0001f3ff", "nail polish: Dark Skin Tone", []string{"nail_care_Dark_Skin_Tone"}, "12.0", false},
@@ -2140,24 +2190,54 @@ var GemojiData = Gemoji{
 	{"\U0001f9d1\U0001f3fe\u200d\U0001f9bd", "person in manual wheelchair: Medium-Dark Skin Tone", []string{"person_in_manual_wheelchair_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fc\u200d\U0001f9bd", "person in manual wheelchair: Medium-Light Skin Tone", []string{"person_in_manual_wheelchair_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fd\u200d\U0001f9bd", "person in manual wheelchair: Medium Skin Tone", []string{"person_in_manual_wheelchair_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\u200d\U0001f9bd\u200d\u27a1\ufe0f", "person in manual wheelchair facing right", []string{"person_in_manual_wheelchair_facing_right"}, "15.1", true},
+	{"\U0001f9d1\U0001f3ff\u200d\U0001f9bd\u200d\u27a1\ufe0f", "person in manual wheelchair facing right: Dark Skin Tone", []string{"person_in_manual_wheelchair_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fb\u200d\U0001f9bd\u200d\u27a1\ufe0f", "person in manual wheelchair facing right: Light Skin Tone", []string{"person_in_manual_wheelchair_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fe\u200d\U0001f9bd\u200d\u27a1\ufe0f", "person in manual wheelchair facing right: Medium-Dark Skin Tone", []string{"person_in_manual_wheelchair_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fc\u200d\U0001f9bd\u200d\u27a1\ufe0f", "person in manual wheelchair facing right: Medium-Light Skin Tone", []string{"person_in_manual_wheelchair_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fd\u200d\U0001f9bd\u200d\u27a1\ufe0f", "person in manual wheelchair facing right: Medium Skin Tone", []string{"person_in_manual_wheelchair_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\u200d\U0001f9bc", "person in motorized wheelchair", []string{"person_in_motorized_wheelchair"}, "12.1", true},
 	{"\U0001f9d1\U0001f3ff\u200d\U0001f9bc", "person in motorized wheelchair: Dark Skin Tone", []string{"person_in_motorized_wheelchair_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fb\u200d\U0001f9bc", "person in motorized wheelchair: Light Skin Tone", []string{"person_in_motorized_wheelchair_Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fe\u200d\U0001f9bc", "person in motorized wheelchair: Medium-Dark Skin Tone", []string{"person_in_motorized_wheelchair_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fc\u200d\U0001f9bc", "person in motorized wheelchair: Medium-Light Skin Tone", []string{"person_in_motorized_wheelchair_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fd\u200d\U0001f9bc", "person in motorized wheelchair: Medium Skin Tone", []string{"person_in_motorized_wheelchair_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\u200d\U0001f9bc\u200d\u27a1\ufe0f", "person in motorized wheelchair facing right", []string{"person_in_motorized_wheelchair_facing_right"}, "15.1", true},
+	{"\U0001f9d1\U0001f3ff\u200d\U0001f9bc\u200d\u27a1\ufe0f", "person in motorized wheelchair facing right: Dark Skin Tone", []string{"person_in_motorized_wheelchair_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fb\u200d\U0001f9bc\u200d\u27a1\ufe0f", "person in motorized wheelchair facing right: Light Skin Tone", []string{"person_in_motorized_wheelchair_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fe\u200d\U0001f9bc\u200d\u27a1\ufe0f", "person in motorized wheelchair facing right: Medium-Dark Skin Tone", []string{"person_in_motorized_wheelchair_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fc\u200d\U0001f9bc\u200d\u27a1\ufe0f", "person in motorized wheelchair facing right: Medium-Light Skin Tone", []string{"person_in_motorized_wheelchair_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fd\u200d\U0001f9bc\u200d\u27a1\ufe0f", "person in motorized wheelchair facing right: Medium Skin Tone", []string{"person_in_motorized_wheelchair_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f935", "person in tuxedo", []string{"person_in_tuxedo"}, "9.0", true},
 	{"\U0001f935\U0001f3ff", "person in tuxedo: Dark Skin Tone", []string{"person_in_tuxedo_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\U0001f3fb", "person in tuxedo: Light Skin Tone", []string{"person_in_tuxedo_Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\U0001f3fe", "person in tuxedo: Medium-Dark Skin Tone", []string{"person_in_tuxedo_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\U0001f3fc", "person in tuxedo: Medium-Light Skin Tone", []string{"person_in_tuxedo_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\U0001f3fd", "person in tuxedo: Medium Skin Tone", []string{"person_in_tuxedo_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\u200d\u27a1\ufe0f", "person kneeling facing right", []string{"person_kneeling_facing_right"}, "15.1", true},
+	{"\U0001f9ce\U0001f3ff\u200d\u27a1\ufe0f", "person kneeling facing right: Dark Skin Tone", []string{"person_kneeling_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fb\u200d\u27a1\ufe0f", "person kneeling facing right: Light Skin Tone", []string{"person_kneeling_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fe\u200d\u27a1\ufe0f", "person kneeling facing right: Medium-Dark Skin Tone", []string{"person_kneeling_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fc\u200d\u27a1\ufe0f", "person kneeling facing right: Medium-Light Skin Tone", []string{"person_kneeling_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fd\u200d\u27a1\ufe0f", "person kneeling facing right: Medium Skin Tone", []string{"person_kneeling_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\u200d\U0001f9b0", "person: red hair", []string{"person_red_hair"}, "12.1", true},
 	{"\U0001f9d1\U0001f3ff\u200d\U0001f9b0", "person: red hair: Dark Skin Tone", []string{"person_red_hair_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fb\u200d\U0001f9b0", "person: red hair: Light Skin Tone", []string{"person_red_hair_Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fe\u200d\U0001f9b0", "person: red hair: Medium-Dark Skin Tone", []string{"person_red_hair_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fc\u200d\U0001f9b0", "person: red hair: Medium-Light Skin Tone", []string{"person_red_hair_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fd\u200d\U0001f9b0", "person: red hair: Medium Skin Tone", []string{"person_red_hair_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\u200d\u27a1\ufe0f", "person running facing right", []string{"person_running_facing_right"}, "15.1", true},
+	{"\U0001f3c3\U0001f3ff\u200d\u27a1\ufe0f", "person running facing right: Dark Skin Tone", []string{"person_running_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fb\u200d\u27a1\ufe0f", "person running facing right: Light Skin Tone", []string{"person_running_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fe\u200d\u27a1\ufe0f", "person running facing right: Medium-Dark Skin Tone", []string{"person_running_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fc\u200d\u27a1\ufe0f", "person running facing right: Medium-Light Skin Tone", []string{"person_running_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fd\u200d\u27a1\ufe0f", "person running facing right: Medium Skin Tone", []string{"person_running_facing_right_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\u200d\u27a1\ufe0f", "person walking facing right", []string{"person_walking_facing_right"}, "15.1", true},
+	{"\U0001f6b6\U0001f3ff\u200d\u27a1\ufe0f", "person walking facing right: Dark Skin Tone", []string{"person_walking_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fb\u200d\u27a1\ufe0f", "person walking facing right: Light Skin Tone", []string{"person_walking_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fe\u200d\u27a1\ufe0f", "person walking facing right: Medium-Dark Skin Tone", []string{"person_walking_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fc\u200d\u27a1\ufe0f", "person walking facing right: Medium-Light Skin Tone", []string{"person_walking_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fd\u200d\u27a1\ufe0f", "person walking facing right: Medium Skin Tone", []string{"person_walking_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\u200d\U0001f9b3", "person: white hair", []string{"person_white_hair"}, "12.1", true},
 	{"\U0001f9d1\U0001f3ff\u200d\U0001f9b3", "person: white hair: Dark Skin Tone", []string{"person_white_hair_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d1\U0001f3fb\u200d\U0001f9b3", "person: white hair: Light Skin Tone", []string{"person_white_hair_Light_Skin_Tone"}, "12.0", false},
@@ -2188,9 +2268,16 @@ var GemojiData = Gemoji{
 	{"\U0001f470\U0001f3fe", "person with veil: Medium-Dark Skin Tone", []string{"person_with_veil_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f470\U0001f3fc", "person with veil: Medium-Light Skin Tone", []string{"person_with_veil_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f470\U0001f3fd", "person with veil: Medium Skin Tone", []string{"person_with_veil_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\u200d\U0001f9af\u200d\u27a1\ufe0f", "person with white cane facing right", []string{"person_with_white_cane_facing_right"}, "15.1", true},
+	{"\U0001f9d1\U0001f3ff\u200d\U0001f9af\u200d\u27a1\ufe0f", "person with white cane facing right: Dark Skin Tone", []string{"person_with_white_cane_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fb\u200d\U0001f9af\u200d\u27a1\ufe0f", "person with white cane facing right: Light Skin Tone", []string{"person_with_white_cane_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fe\u200d\U0001f9af\u200d\u27a1\ufe0f", "person with white cane facing right: Medium-Dark Skin Tone", []string{"person_with_white_cane_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fc\u200d\U0001f9af\u200d\u27a1\ufe0f", "person with white cane facing right: Medium-Light Skin Tone", []string{"person_with_white_cane_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9d1\U0001f3fd\u200d\U0001f9af\u200d\u27a1\ufe0f", "person with white cane facing right: Medium Skin Tone", []string{"person_with_white_cane_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f1f5\U0001f1ea", "flag: Peru", []string{"peru"}, "6.0", false},
 	{"\U0001f9eb", "petri dish", []string{"petri_dish"}, "11.0", false},
 	{"\U0001f1f5\U0001f1ed", "flag: Philippines", []string{"philippines"}, "6.0", false},
+	{"\U0001f426\u200d\U0001f525", "phoenix", []string{"phoenix"}, "15.1", false},
 	{"\u260e\ufe0f", "telephone", []string{"phone", "telephone"}, "", false},
 	{"\u26cf\ufe0f", "pick", []string{"pick"}, "5.2", false},
 	{"\U0001f6fb", "pickup truck", []string{"pickup_truck"}, "13.0", false},
@@ -2480,6 +2567,7 @@ var GemojiData = Gemoji{
 	{"\U0001f6fc", "roller skate", []string{"roller_skate"}, "13.0", false},
 	{"\U0001f1f7\U0001f1f4", "flag: Romania", []string{"romania"}, "6.0", false},
 	{"\U0001f413", "rooster", []string{"rooster"}, "6.0", false},
+	{"\U0001fadc", "root vegetable", []string{"root_vegetable"}, "16.0", false},
 	{"\U0001f339", "rose", []string{"rose"}, "6.0", false},
 	{"\U0001f3f5\ufe0f", "rosette", []string{"rosette"}, "7.0", false},
 	{"\U0001f6a8", "police car light", []string{"rotating_light"}, "6.0", false},
@@ -2613,6 +2701,7 @@ var GemojiData = Gemoji{
 	{"\U0001f6cd\ufe0f", "shopping bags", []string{"shopping"}, "7.0", false},
 	{"\U0001f6d2", "shopping cart", []string{"shopping_cart"}, "9.0", false},
 	{"\U0001fa73", "shorts", []string{"shorts"}, "12.0", false},
+	{"\U0001fa8f", "shovel", []string{"shovel"}, "16.0", false},
 	{"\U0001f6bf", "shower", []string{"shower"}, "6.0", false},
 	{"\U0001f990", "shrimp", []string{"shrimp"}, "9.0", false},
 	{"\U0001f937", "person shrugging", []string{"shrug"}, "11.0", true},
@@ -2711,6 +2800,7 @@ var GemojiData = Gemoji{
 	{"\U0001f578\ufe0f", "spider web", []string{"spider_web"}, "7.0", false},
 	{"\U0001f5d3\ufe0f", "spiral calendar", []string{"spiral_calendar"}, "7.0", false},
 	{"\U0001f5d2\ufe0f", "spiral notepad", []string{"spiral_notepad"}, "7.0", false},
+	{"\U0001fadf", "splatter", []string{"splatter"}, "16.0", false},
 	{"\U0001f9fd", "sponge", []string{"sponge"}, "11.0", false},
 	{"\U0001f944", "spoon", []string{"spoon"}, "9.0", false},
 	{"\U0001f991", "squid", []string{"squid"}, "9.0", false},
@@ -2945,7 +3035,7 @@ var GemojiData = Gemoji{
 	{"\U0001f51d", "TOP arrow", []string{"top"}, "6.0", false},
 	{"\U0001f3a9", "top hat", []string{"tophat"}, "6.0", false},
 	{"\U0001f32a\ufe0f", "tornado", []string{"tornado"}, "7.0", false},
-	{"\U0001f1f9\U0001f1f7", "flag: Turkey", []string{"tr"}, "8.0", false},
+	{"\U0001f1f9\U0001f1f7", "flag: Türkiye", []string{"tr"}, "8.0", false},
 	{"\U0001f5b2\ufe0f", "trackball", []string{"trackball"}, "7.0", false},
 	{"\U0001f69c", "tractor", []string{"tractor"}, "6.0", false},
 	{"\U0001f6a5", "horizontal traffic light", []string{"traffic_light"}, "6.0", false},
@@ -3247,12 +3337,24 @@ var GemojiData = Gemoji{
 	{"\U0001f469\U0001f3fe\u200d\U0001f9bd", "woman in manual wheelchair: Medium-Dark Skin Tone", []string{"woman_in_manual_wheelchair_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fc\u200d\U0001f9bd", "woman in manual wheelchair: Medium-Light Skin Tone", []string{"woman_in_manual_wheelchair_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fd\u200d\U0001f9bd", "woman in manual wheelchair: Medium Skin Tone", []string{"woman_in_manual_wheelchair_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\u200d\U0001f9bd\u200d\u27a1\ufe0f", "woman in manual wheelchair facing right", []string{"woman_in_manual_wheelchair_facing_right"}, "15.1", true},
+	{"\U0001f469\U0001f3ff\u200d\U0001f9bd\u200d\u27a1\ufe0f", "woman in manual wheelchair facing right: Dark Skin Tone", []string{"woman_in_manual_wheelchair_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fb\u200d\U0001f9bd\u200d\u27a1\ufe0f", "woman in manual wheelchair facing right: Light Skin Tone", []string{"woman_in_manual_wheelchair_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fe\u200d\U0001f9bd\u200d\u27a1\ufe0f", "woman in manual wheelchair facing right: Medium-Dark Skin Tone", []string{"woman_in_manual_wheelchair_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fc\u200d\U0001f9bd\u200d\u27a1\ufe0f", "woman in manual wheelchair facing right: Medium-Light Skin Tone", []string{"woman_in_manual_wheelchair_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fd\u200d\U0001f9bd\u200d\u27a1\ufe0f", "woman in manual wheelchair facing right: Medium Skin Tone", []string{"woman_in_manual_wheelchair_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\u200d\U0001f9bc", "woman in motorized wheelchair", []string{"woman_in_motorized_wheelchair"}, "12.0", true},
 	{"\U0001f469\U0001f3ff\u200d\U0001f9bc", "woman in motorized wheelchair: Dark Skin Tone", []string{"woman_in_motorized_wheelchair_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fb\u200d\U0001f9bc", "woman in motorized wheelchair: Light Skin Tone", []string{"woman_in_motorized_wheelchair_Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fe\u200d\U0001f9bc", "woman in motorized wheelchair: Medium-Dark Skin Tone", []string{"woman_in_motorized_wheelchair_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fc\u200d\U0001f9bc", "woman in motorized wheelchair: Medium-Light Skin Tone", []string{"woman_in_motorized_wheelchair_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fd\u200d\U0001f9bc", "woman in motorized wheelchair: Medium Skin Tone", []string{"woman_in_motorized_wheelchair_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\u200d\U0001f9bc\u200d\u27a1\ufe0f", "woman in motorized wheelchair facing right", []string{"woman_in_motorized_wheelchair_facing_right"}, "15.1", true},
+	{"\U0001f469\U0001f3ff\u200d\U0001f9bc\u200d\u27a1\ufe0f", "woman in motorized wheelchair facing right: Dark Skin Tone", []string{"woman_in_motorized_wheelchair_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fb\u200d\U0001f9bc\u200d\u27a1\ufe0f", "woman in motorized wheelchair facing right: Light Skin Tone", []string{"woman_in_motorized_wheelchair_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fe\u200d\U0001f9bc\u200d\u27a1\ufe0f", "woman in motorized wheelchair facing right: Medium-Dark Skin Tone", []string{"woman_in_motorized_wheelchair_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fc\u200d\U0001f9bc\u200d\u27a1\ufe0f", "woman in motorized wheelchair facing right: Medium-Light Skin Tone", []string{"woman_in_motorized_wheelchair_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fd\u200d\U0001f9bc\u200d\u27a1\ufe0f", "woman in motorized wheelchair facing right: Medium Skin Tone", []string{"woman_in_motorized_wheelchair_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\u200d\u2640\ufe0f", "woman in tuxedo", []string{"woman_in_tuxedo"}, "13.0", true},
 	{"\U0001f935\U0001f3ff\u200d\u2640\ufe0f", "woman in tuxedo: Dark Skin Tone", []string{"woman_in_tuxedo_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f935\U0001f3fb\u200d\u2640\ufe0f", "woman in tuxedo: Light Skin Tone", []string{"woman_in_tuxedo_Light_Skin_Tone"}, "12.0", false},
@@ -3271,6 +3373,12 @@ var GemojiData = Gemoji{
 	{"\U0001f939\U0001f3fe\u200d\u2640\ufe0f", "woman juggling: Medium-Dark Skin Tone", []string{"woman_juggling_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f939\U0001f3fc\u200d\u2640\ufe0f", "woman juggling: Medium-Light Skin Tone", []string{"woman_juggling_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f939\U0001f3fd\u200d\u2640\ufe0f", "woman juggling: Medium Skin Tone", []string{"woman_juggling_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman kneeling facing right", []string{"woman_kneeling_facing_right"}, "15.1", true},
+	{"\U0001f9ce\U0001f3ff\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman kneeling facing right: Dark Skin Tone", []string{"woman_kneeling_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fb\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman kneeling facing right: Light Skin Tone", []string{"woman_kneeling_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fe\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman kneeling facing right: Medium-Dark Skin Tone", []string{"woman_kneeling_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fc\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman kneeling facing right: Medium-Light Skin Tone", []string{"woman_kneeling_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f9ce\U0001f3fd\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman kneeling facing right: Medium Skin Tone", []string{"woman_kneeling_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\u200d\U0001f527", "woman mechanic", []string{"woman_mechanic"}, "", true},
 	{"\U0001f469\U0001f3ff\u200d\U0001f527", "woman mechanic: Dark Skin Tone", []string{"woman_mechanic_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fb\u200d\U0001f527", "woman mechanic: Light Skin Tone", []string{"woman_mechanic_Light_Skin_Tone"}, "12.0", false},
@@ -3301,6 +3409,12 @@ var GemojiData = Gemoji{
 	{"\U0001f93d\U0001f3fe\u200d\u2640\ufe0f", "woman playing water polo: Medium-Dark Skin Tone", []string{"woman_playing_water_polo_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f93d\U0001f3fc\u200d\u2640\ufe0f", "woman playing water polo: Medium-Light Skin Tone", []string{"woman_playing_water_polo_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f93d\U0001f3fd\u200d\u2640\ufe0f", "woman playing water polo: Medium Skin Tone", []string{"woman_playing_water_polo_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman running facing right", []string{"woman_running_facing_right"}, "15.1", true},
+	{"\U0001f3c3\U0001f3ff\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman running facing right: Dark Skin Tone", []string{"woman_running_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fb\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman running facing right: Light Skin Tone", []string{"woman_running_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fe\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman running facing right: Medium-Dark Skin Tone", []string{"woman_running_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fc\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman running facing right: Medium-Light Skin Tone", []string{"woman_running_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f3c3\U0001f3fd\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman running facing right: Medium Skin Tone", []string{"woman_running_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\u200d\U0001f52c", "woman scientist", []string{"woman_scientist"}, "", true},
 	{"\U0001f469\U0001f3ff\u200d\U0001f52c", "woman scientist: Dark Skin Tone", []string{"woman_scientist_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fb\u200d\U0001f52c", "woman scientist: Light Skin Tone", []string{"woman_scientist_Light_Skin_Tone"}, "12.0", false},
@@ -3337,6 +3451,12 @@ var GemojiData = Gemoji{
 	{"\U0001f469\U0001f3fe\u200d\U0001f4bb", "woman technologist: Medium-Dark Skin Tone", []string{"woman_technologist_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fc\u200d\U0001f4bb", "woman technologist: Medium-Light Skin Tone", []string{"woman_technologist_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f469\U0001f3fd\u200d\U0001f4bb", "woman technologist: Medium Skin Tone", []string{"woman_technologist_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman walking facing right", []string{"woman_walking_facing_right"}, "15.1", true},
+	{"\U0001f6b6\U0001f3ff\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman walking facing right: Dark Skin Tone", []string{"woman_walking_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fb\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman walking facing right: Light Skin Tone", []string{"woman_walking_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fe\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman walking facing right: Medium-Dark Skin Tone", []string{"woman_walking_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fc\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman walking facing right: Medium-Light Skin Tone", []string{"woman_walking_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f6b6\U0001f3fd\u200d\u2640\ufe0f\u200d\u27a1\ufe0f", "woman walking facing right: Medium Skin Tone", []string{"woman_walking_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d5", "woman with headscarf", []string{"woman_with_headscarf"}, "11.0", true},
 	{"\U0001f9d5\U0001f3ff", "woman with headscarf: Dark Skin Tone", []string{"woman_with_headscarf_Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f9d5\U0001f3fb", "woman with headscarf: Light Skin Tone", []string{"woman_with_headscarf_Light_Skin_Tone"}, "12.0", false},
@@ -3361,6 +3481,12 @@ var GemojiData = Gemoji{
 	{"\U0001f470\U0001f3fe\u200d\u2640\ufe0f", "woman with veil: Medium-Dark Skin Tone", []string{"woman_with_veil_Medium-Dark_Skin_Tone"}, "12.0", false},
 	{"\U0001f470\U0001f3fc\u200d\u2640\ufe0f", "woman with veil: Medium-Light Skin Tone", []string{"woman_with_veil_Medium-Light_Skin_Tone"}, "12.0", false},
 	{"\U0001f470\U0001f3fd\u200d\u2640\ufe0f", "woman with veil: Medium Skin Tone", []string{"woman_with_veil_Medium_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\u200d\U0001f9af\u200d\u27a1\ufe0f", "woman with white cane facing right", []string{"woman_with_white_cane_facing_right"}, "15.1", true},
+	{"\U0001f469\U0001f3ff\u200d\U0001f9af\u200d\u27a1\ufe0f", "woman with white cane facing right: Dark Skin Tone", []string{"woman_with_white_cane_facing_right_Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fb\u200d\U0001f9af\u200d\u27a1\ufe0f", "woman with white cane facing right: Light Skin Tone", []string{"woman_with_white_cane_facing_right_Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fe\u200d\U0001f9af\u200d\u27a1\ufe0f", "woman with white cane facing right: Medium-Dark Skin Tone", []string{"woman_with_white_cane_facing_right_Medium-Dark_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fc\u200d\U0001f9af\u200d\u27a1\ufe0f", "woman with white cane facing right: Medium-Light Skin Tone", []string{"woman_with_white_cane_facing_right_Medium-Light_Skin_Tone"}, "12.0", false},
+	{"\U0001f469\U0001f3fd\u200d\U0001f9af\u200d\u27a1\ufe0f", "woman with white cane facing right: Medium Skin Tone", []string{"woman_with_white_cane_facing_right_Medium_Skin_Tone"}, "12.0", false},
 	{"\U0001f45a", "woman’s clothes", []string{"womans_clothes"}, "6.0", false},
 	{"\U0001f452", "woman’s hat", []string{"womans_hat"}, "6.0", false},
 	{"\U0001f93c\u200d\u2640\ufe0f", "women wrestling", []string{"women_wrestling"}, "9.0", false},

package/gitea/source/modules/fileicon/render.go

@@ -34,7 +34,13 @@ func (p *RenderedIconPool) RenderToHTML() template.HTML {
 }
 
 func RenderEntryIconHTML(renderedIconPool *RenderedIconPool, entry *EntryInfo) template.HTML {
-	if setting.UI.FileIconTheme == "material" {
+	// Use folder theme for directories and symlinks to directories
+	theme := setting.UI.FileIconTheme
+	if entry.EntryMode.IsDir() || (entry.EntryMode.IsLink() && entry.SymlinkToMode.IsDir()) {
+		theme = setting.UI.FolderIconTheme
+	}
+
+	if theme == "material" {
 		return DefaultMaterialIconProvider().EntryIconHTML(renderedIconPool, entry)
 	}
 	return BasicEntryIconHTML(entry)

package/gitea/source/modules/fileicon/render_test.go

@@ -0,0 +1,75 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package fileicon_test
+
+import (
+	"testing"
+
+	"code.gitea.io/gitea/modules/fileicon"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/test"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRenderEntryIconHTML_WithDifferentThemes(t *testing.T) {
+	// Test that folder icons use the folder theme
+	t.Run("FolderUsesBasicTheme", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.UI.FileIconTheme, "material")()
+		defer test.MockVariableValue(&setting.UI.FolderIconTheme, "basic")()
+
+		folderEntry := &fileicon.EntryInfo{
+			BaseName:  "testfolder",
+			EntryMode: git.EntryModeTree,
+		}
+
+		html := fileicon.RenderEntryIconHTML(nil, folderEntry)
+		// Basic theme renders octicon classes
+		assert.Contains(t, string(html), "octicon-file-directory-fill")
+	})
+
+	t.Run("FileUsesMaterialTheme", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.UI.FileIconTheme, "material")()
+		defer test.MockVariableValue(&setting.UI.FolderIconTheme, "basic")()
+
+		fileEntry := &fileicon.EntryInfo{
+			BaseName:  "test.js",
+			EntryMode: git.EntryModeBlob,
+		}
+
+		html := fileicon.RenderEntryIconHTML(nil, fileEntry)
+		// Material theme for files renders material icons
+		assert.Contains(t, string(html), "svg-mfi-")
+	})
+
+	t.Run("SymlinkToFolderUsesBasicTheme", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.UI.FileIconTheme, "material")()
+		defer test.MockVariableValue(&setting.UI.FolderIconTheme, "basic")()
+
+		symlinkEntry := &fileicon.EntryInfo{
+			BaseName:      "link",
+			EntryMode:     git.EntryModeSymlink,
+			SymlinkToMode: git.EntryModeTree,
+		}
+
+		html := fileicon.RenderEntryIconHTML(nil, symlinkEntry)
+		// Symlinks to folders should use folder theme
+		assert.Contains(t, string(html), "octicon-file-directory-symlink")
+	})
+
+	t.Run("BothMaterialTheme", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.UI.FileIconTheme, "material")()
+		defer test.MockVariableValue(&setting.UI.FolderIconTheme, "material")()
+
+		folderEntry := &fileicon.EntryInfo{
+			BaseName:  "testfolder",
+			EntryMode: git.EntryModeTree,
+		}
+
+		html := fileicon.RenderEntryIconHTML(nil, folderEntry)
+		// Material theme for folders renders material folder icons
+		assert.Contains(t, string(html), "svg-mfi-")
+	})
+}

package/gitea/source/modules/generate/generate.go

@@ -54,13 +54,13 @@ func DecodeJwtSecretBase64(src string) ([]byte, error) {
 }
 
 // NewJwtSecretWithBase64 generates a jwt secret with its base64 encoded value intended to be used for saving into config file
-func NewJwtSecretWithBase64() ([]byte, string, error) {
+func NewJwtSecretWithBase64() ([]byte, string) {
 	bytes := make([]byte, defaultJwtSecretLen)
-	_, err := io.ReadFull(rand.Reader, bytes)
+	_, err := rand.Read(bytes)
 	if err != nil {
-		return nil, "", err
+		panic(err) // rand.Read never fails
 	}
-	return bytes, base64.RawURLEncoding.EncodeToString(bytes), nil
+	return bytes, base64.RawURLEncoding.EncodeToString(bytes)
 }
 
 // NewSecretKey generate a new value intended to be used by SECRET_KEY.

package/gitea/source/modules/generate/generate_test.go

@@ -25,10 +25,12 @@ func TestDecodeJwtSecretBase64(t *testing.T) {
 }
 
 func TestNewJwtSecretWithBase64(t *testing.T) {
-	secret, encoded, err := NewJwtSecretWithBase64()
-	assert.NoError(t, err)
+	secret, encoded := NewJwtSecretWithBase64()
 	assert.Len(t, secret, 32)
 	decoded, err := DecodeJwtSecretBase64(encoded)
 	assert.NoError(t, err)
 	assert.Equal(t, secret, decoded)
+
+	secret2, _ := NewJwtSecretWithBase64()
+	assert.NotEqual(t, secret, secret2)
 }

package/gitea/source/modules/git/attribute/attribute.go

@@ -96,8 +96,8 @@ func (attrs *Attributes) GetGitlabLanguage() optional.Option[string] {
 		// gitlab-language may have additional parameters after the language
 		// ignore them and just use the main language
 		// https://docs.gitlab.com/ee/user/project/highlighting.html#override-syntax-highlighting-for-a-file-type
-		if idx := strings.IndexByte(raw, '?'); idx >= 0 {
-			return optional.Some(raw[:idx])
+		if before, _, ok := strings.Cut(raw, "?"); ok {
+			return optional.Some(before)
 		}
 	}
 	return attrStr

package/gitea/source/modules/git/attribute/batch.go

@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"os"
+	"io"
 	"path/filepath"
 	"time"
 
@@ -20,7 +20,7 @@ import (
 type BatchChecker struct {
 	attributesNum int
 	repo          *git.Repository
-	stdinWriter   *os.File
+	stdinWriter   io.WriteCloser
 	stdOut        *nulSeparatedAttributeWriter
 	ctx           context.Context
 	cancel        context.CancelFunc
@@ -60,10 +60,7 @@ func NewBatchChecker(repo *git.Repository, treeish string, attributes []string)
 		},
 	}
 
-	stdinReader, stdinWriter, err := os.Pipe()
-	if err != nil {
-		return nil, err
-	}
+	stdinWriter, stdinWriterClose := cmd.MakeStdinPipe()
 	checker.stdinWriter = stdinWriter
 
 	lw := new(nulSeparatedAttributeWriter)
@@ -71,24 +68,19 @@ func NewBatchChecker(repo *git.Repository, treeish string, attributes []string)
 	lw.closed = make(chan struct{})
 	checker.stdOut = lw
 
-	go func() {
-		defer func() {
-			_ = stdinReader.Close()
-			_ = lw.Close()
-		}()
-		stdErr := new(bytes.Buffer)
-		err := cmd.Run(ctx, &gitcmd.RunOpts{
-			Env:    envs,
-			Dir:    repo.Path,
-			Stdin:  stdinReader,
-			Stdout: lw,
-			Stderr: stdErr,
-		})
+	cmd.WithEnv(envs).
+		WithDir(repo.Path).
+		WithStdoutCopy(lw)
 
-		if err != nil && !git.IsErrCanceledOrKilled(err) {
+	go func() {
+		defer stdinWriterClose()
+		defer checker.cancel()
+		defer lw.Close()
+
+		err := cmd.RunWithStderr(ctx)
+		if err != nil && !gitcmd.IsErrorCanceledOrKilled(err) {
 			log.Error("Attribute checker for commit %s exits with error: %v", treeish, err)
 		}
-		checker.cancel()
 	}()
 
 	return checker, nil

package/gitea/source/modules/git/attribute/checker.go

@@ -68,19 +68,14 @@ func CheckAttributes(ctx context.Context, gitRepo *git.Repository, treeish strin
 	}
 	defer cancel()
 
-	stdOut := new(bytes.Buffer)
-	stdErr := new(bytes.Buffer)
-
-	if err := cmd.Run(ctx, &gitcmd.RunOpts{
-		Env:    append(os.Environ(), envs...),
-		Dir:    gitRepo.Path,
-		Stdout: stdOut,
-		Stderr: stdErr,
-	}); err != nil {
-		return nil, fmt.Errorf("failed to run check-attr: %w\n%s\n%s", err, stdOut.String(), stdErr.String())
+	stdout, _, err := cmd.WithEnv(append(os.Environ(), envs...)).
+		WithDir(gitRepo.Path).
+		RunStdBytes(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to run check-attr: %w", err)
 	}
 
-	fields := bytes.Split(stdOut.Bytes(), []byte{'\000'})
+	fields := bytes.Split(stdout, []byte{'\000'})
 	if len(fields)%3 != 1 {
 		return nil, errors.New("wrong number of fields in return from check-attr")
 	}

package/gitea/source/modules/git/batch.go

@@ -1,47 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package git
-
-import (
-	"bufio"
-	"context"
-)
-
-type Batch struct {
-	cancel context.CancelFunc
-	Reader *bufio.Reader
-	Writer WriteCloserError
-}
-
-// NewBatch creates a new batch for the given repository, the Close must be invoked before release the batch
-func NewBatch(ctx context.Context, repoPath string) (*Batch, error) {
-	// Now because of some insanity with git cat-file not immediately failing if not run in a valid git directory we need to run git rev-parse first!
-	if err := ensureValidGitRepository(ctx, repoPath); err != nil {
-		return nil, err
-	}
-
-	var batch Batch
-	batch.Writer, batch.Reader, batch.cancel = catFileBatch(ctx, repoPath)
-	return &batch, nil
-}
-
-func NewBatchCheck(ctx context.Context, repoPath string) (*Batch, error) {
-	// Now because of some insanity with git cat-file not immediately failing if not run in a valid git directory we need to run git rev-parse first!
-	if err := ensureValidGitRepository(ctx, repoPath); err != nil {
-		return nil, err
-	}
-
-	var check Batch
-	check.Writer, check.Reader, check.cancel = catFileBatchCheck(ctx, repoPath)
-	return &check, nil
-}
-
-func (b *Batch) Close() {
-	if b.cancel != nil {
-		b.cancel()
-		b.Reader = nil
-		b.Writer = nil
-		b.cancel = nil
-	}
-}

package/gitea/source/modules/git/batch_reader.go

@@ -1,329 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package git
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"io"
-	"math"
-	"strconv"
-	"strings"
-
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-
-	"github.com/djherbis/buffer"
-	"github.com/djherbis/nio/v3"
-)
-
-// WriteCloserError wraps an io.WriteCloser with an additional CloseWithError function
-type WriteCloserError interface {
-	io.WriteCloser
-	CloseWithError(err error) error
-}
-
-// ensureValidGitRepository runs git rev-parse in the repository path - thus ensuring that the repository is a valid repository.
-// Run before opening git cat-file.
-// This is needed otherwise the git cat-file will hang for invalid repositories.
-func ensureValidGitRepository(ctx context.Context, repoPath string) error {
-	stderr := strings.Builder{}
-	err := gitcmd.NewCommand("rev-parse").
-		Run(ctx, &gitcmd.RunOpts{
-			Dir:    repoPath,
-			Stderr: &stderr,
-		})
-	if err != nil {
-		return gitcmd.ConcatenateError(err, (&stderr).String())
-	}
-	return nil
-}
-
-// catFileBatchCheck opens git cat-file --batch-check in the provided repo and returns a stdin pipe, a stdout reader and cancel function
-func catFileBatchCheck(ctx context.Context, repoPath string) (WriteCloserError, *bufio.Reader, func()) {
-	batchStdinReader, batchStdinWriter := io.Pipe()
-	batchStdoutReader, batchStdoutWriter := io.Pipe()
-	ctx, ctxCancel := context.WithCancel(ctx)
-	closed := make(chan struct{})
-	cancel := func() {
-		ctxCancel()
-		_ = batchStdoutReader.Close()
-		_ = batchStdinWriter.Close()
-		<-closed
-	}
-
-	// Ensure cancel is called as soon as the provided context is cancelled
-	go func() {
-		<-ctx.Done()
-		cancel()
-	}()
-
-	go func() {
-		stderr := strings.Builder{}
-		err := gitcmd.NewCommand("cat-file", "--batch-check").
-			Run(ctx, &gitcmd.RunOpts{
-				Dir:    repoPath,
-				Stdin:  batchStdinReader,
-				Stdout: batchStdoutWriter,
-				Stderr: &stderr,
-
-				UseContextTimeout: true,
-			})
-		if err != nil {
-			_ = batchStdoutWriter.CloseWithError(gitcmd.ConcatenateError(err, (&stderr).String()))
-			_ = batchStdinReader.CloseWithError(gitcmd.ConcatenateError(err, (&stderr).String()))
-		} else {
-			_ = batchStdoutWriter.Close()
-			_ = batchStdinReader.Close()
-		}
-		close(closed)
-	}()
-
-	// For simplicities sake we'll use a buffered reader to read from the cat-file --batch-check
-	batchReader := bufio.NewReader(batchStdoutReader)
-
-	return batchStdinWriter, batchReader, cancel
-}
-
-// catFileBatch opens git cat-file --batch in the provided repo and returns a stdin pipe, a stdout reader and cancel function
-func catFileBatch(ctx context.Context, repoPath string) (WriteCloserError, *bufio.Reader, func()) {
-	// We often want to feed the commits in order into cat-file --batch, followed by their trees and sub trees as necessary.
-	// so let's create a batch stdin and stdout
-	batchStdinReader, batchStdinWriter := io.Pipe()
-	batchStdoutReader, batchStdoutWriter := nio.Pipe(buffer.New(32 * 1024))
-	ctx, ctxCancel := context.WithCancel(ctx)
-	closed := make(chan struct{})
-	cancel := func() {
-		ctxCancel()
-		_ = batchStdinWriter.Close()
-		_ = batchStdoutReader.Close()
-		<-closed
-	}
-
-	// Ensure cancel is called as soon as the provided context is cancelled
-	go func() {
-		<-ctx.Done()
-		cancel()
-	}()
-
-	go func() {
-		stderr := strings.Builder{}
-		err := gitcmd.NewCommand("cat-file", "--batch").
-			Run(ctx, &gitcmd.RunOpts{
-				Dir:    repoPath,
-				Stdin:  batchStdinReader,
-				Stdout: batchStdoutWriter,
-				Stderr: &stderr,
-
-				UseContextTimeout: true,
-			})
-		if err != nil {
-			_ = batchStdoutWriter.CloseWithError(gitcmd.ConcatenateError(err, (&stderr).String()))
-			_ = batchStdinReader.CloseWithError(gitcmd.ConcatenateError(err, (&stderr).String()))
-		} else {
-			_ = batchStdoutWriter.Close()
-			_ = batchStdinReader.Close()
-		}
-		close(closed)
-	}()
-
-	// For simplicities sake we'll us a buffered reader to read from the cat-file --batch
-	batchReader := bufio.NewReaderSize(batchStdoutReader, 32*1024)
-
-	return batchStdinWriter, batchReader, cancel
-}
-
-// ReadBatchLine reads the header line from cat-file --batch
-// We expect: <oid> SP <type> SP <size> LF
-// then leaving the rest of the stream "<contents> LF" to be read
-func ReadBatchLine(rd *bufio.Reader) (sha []byte, typ string, size int64, err error) {
-	typ, err = rd.ReadString('\n')
-	if err != nil {
-		return sha, typ, size, err
-	}
-	if len(typ) == 1 {
-		typ, err = rd.ReadString('\n')
-		if err != nil {
-			return sha, typ, size, err
-		}
-	}
-	idx := strings.IndexByte(typ, ' ')
-	if idx < 0 {
-		log.Debug("missing space typ: %s", typ)
-		return sha, typ, size, ErrNotExist{ID: string(sha)}
-	}
-	sha = []byte(typ[:idx])
-	typ = typ[idx+1:]
-
-	idx = strings.IndexByte(typ, ' ')
-	if idx < 0 {
-		return sha, typ, size, ErrNotExist{ID: string(sha)}
-	}
-
-	sizeStr := typ[idx+1 : len(typ)-1]
-	typ = typ[:idx]
-
-	size, err = strconv.ParseInt(sizeStr, 10, 64)
-	return sha, typ, size, err
-}
-
-// ReadTagObjectID reads a tag object ID hash from a cat-file --batch stream, throwing away the rest of the stream.
-func ReadTagObjectID(rd *bufio.Reader, size int64) (string, error) {
-	var id string
-	var n int64
-headerLoop:
-	for {
-		line, err := rd.ReadBytes('\n')
-		if err != nil {
-			return "", err
-		}
-		n += int64(len(line))
-		idx := bytes.Index(line, []byte{' '})
-		if idx < 0 {
-			continue
-		}
-
-		if string(line[:idx]) == "object" {
-			id = string(line[idx+1 : len(line)-1])
-			break headerLoop
-		}
-	}
-
-	// Discard the rest of the tag
-	return id, DiscardFull(rd, size-n+1)
-}
-
-// ReadTreeID reads a tree ID from a cat-file --batch stream, throwing away the rest of the stream.
-func ReadTreeID(rd *bufio.Reader, size int64) (string, error) {
-	var id string
-	var n int64
-headerLoop:
-	for {
-		line, err := rd.ReadBytes('\n')
-		if err != nil {
-			return "", err
-		}
-		n += int64(len(line))
-		idx := bytes.Index(line, []byte{' '})
-		if idx < 0 {
-			continue
-		}
-
-		if string(line[:idx]) == "tree" {
-			id = string(line[idx+1 : len(line)-1])
-			break headerLoop
-		}
-	}
-
-	// Discard the rest of the commit
-	return id, DiscardFull(rd, size-n+1)
-}
-
-// git tree files are a list:
-// <mode-in-ascii> SP <fname> NUL <binary Hash>
-//
-// Unfortunately this 20-byte notation is somewhat in conflict to all other git tools
-// Therefore we need some method to convert these binary hashes to hex hashes
-
-// constant hextable to help quickly convert between binary and hex representation
-const hextable = "0123456789abcdef"
-
-// BinToHexHeash converts a binary Hash into a hex encoded one. Input and output can be the
-// same byte slice to support in place conversion without allocations.
-// This is at least 100x quicker that hex.EncodeToString
-func BinToHex(objectFormat ObjectFormat, sha, out []byte) []byte {
-	for i := objectFormat.FullLength()/2 - 1; i >= 0; i-- {
-		v := sha[i]
-		vhi, vlo := v>>4, v&0x0f
-		shi, slo := hextable[vhi], hextable[vlo]
-		out[i*2], out[i*2+1] = shi, slo
-	}
-	return out
-}
-
-// ParseCatFileTreeLine reads an entry from a tree in a cat-file --batch stream
-// This carefully avoids allocations - except where fnameBuf is too small.
-// It is recommended therefore to pass in an fnameBuf large enough to avoid almost all allocations
-//
-// Each line is composed of:
-// <mode-in-ascii-dropping-initial-zeros> SP <fname> NUL <binary HASH>
-//
-// We don't attempt to convert the raw HASH to save a lot of time
-func ParseCatFileTreeLine(objectFormat ObjectFormat, rd *bufio.Reader, modeBuf, fnameBuf, shaBuf []byte) (mode, fname, sha []byte, n int, err error) {
-	var readBytes []byte
-
-	// Read the Mode & fname
-	readBytes, err = rd.ReadSlice('\x00')
-	if err != nil {
-		return mode, fname, sha, n, err
-	}
-	idx := bytes.IndexByte(readBytes, ' ')
-	if idx < 0 {
-		log.Debug("missing space in readBytes ParseCatFileTreeLine: %s", readBytes)
-		return mode, fname, sha, n, &ErrNotExist{}
-	}
-
-	n += idx + 1
-	copy(modeBuf, readBytes[:idx])
-	if len(modeBuf) >= idx {
-		modeBuf = modeBuf[:idx]
-	} else {
-		modeBuf = append(modeBuf, readBytes[len(modeBuf):idx]...)
-	}
-	mode = modeBuf
-
-	readBytes = readBytes[idx+1:]
-
-	// Deal with the fname
-	copy(fnameBuf, readBytes)
-	if len(fnameBuf) > len(readBytes) {
-		fnameBuf = fnameBuf[:len(readBytes)]
-	} else {
-		fnameBuf = append(fnameBuf, readBytes[len(fnameBuf):]...)
-	}
-	for err == bufio.ErrBufferFull {
-		readBytes, err = rd.ReadSlice('\x00')
-		fnameBuf = append(fnameBuf, readBytes...)
-	}
-	n += len(fnameBuf)
-	if err != nil {
-		return mode, fname, sha, n, err
-	}
-	fnameBuf = fnameBuf[:len(fnameBuf)-1]
-	fname = fnameBuf
-
-	// Deal with the binary hash
-	idx = 0
-	length := objectFormat.FullLength() / 2
-	for idx < length {
-		var read int
-		read, err = rd.Read(shaBuf[idx:length])
-		n += read
-		if err != nil {
-			return mode, fname, sha, n, err
-		}
-		idx += read
-	}
-	sha = shaBuf
-	return mode, fname, sha, n, err
-}
-
-func DiscardFull(rd *bufio.Reader, discard int64) error {
-	if discard > math.MaxInt32 {
-		n, err := rd.Discard(math.MaxInt32)
-		discard -= int64(n)
-		if err != nil {
-			return err
-		}
-	}
-	for discard > 0 {
-		n, err := rd.Discard(int(discard))
-		discard -= int64(n)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}

package/gitea/source/modules/git/blob_nogogit.go

@@ -6,8 +6,6 @@
 package git
 
 import (
-	"bufio"
-	"bytes"
 	"io"
 
 	"code.gitea.io/gitea/modules/log"
@@ -25,38 +23,28 @@ type Blob struct {
 
 // DataAsync gets a ReadCloser for the contents of a blob without reading it all.
 // Calling the Close function on the result will discard all unread output.
-func (b *Blob) DataAsync() (io.ReadCloser, error) {
-	wr, rd, cancel, err := b.repo.CatFileBatch(b.repo.Ctx)
+func (b *Blob) DataAsync() (_ io.ReadCloser, retErr error) {
+	batch, cancel, err := b.repo.CatFileBatch(b.repo.Ctx)
 	if err != nil {
 		return nil, err
 	}
+	defer func() {
+		// if there was an error, cancel the batch right away,
+		// otherwise let the caller close it
+		if retErr != nil {
+			cancel()
+		}
+	}()
 
-	_, err = wr.Write([]byte(b.ID.String() + "\n"))
+	info, contentReader, err := batch.QueryContent(b.ID.String())
 	if err != nil {
-		cancel()
-		return nil, err
-	}
-	_, _, size, err := ReadBatchLine(rd)
-	if err != nil {
-		cancel()
 		return nil, err
 	}
 	b.gotSize = true
-	b.size = size
-
-	if size < 4096 {
-		bs, err := io.ReadAll(io.LimitReader(rd, size))
-		defer cancel()
-		if err != nil {
-			return nil, err
-		}
-		_, err = rd.Discard(1)
-		return io.NopCloser(bytes.NewReader(bs)), err
-	}
-
+	b.size = info.Size
 	return &blobReader{
-		rd:     rd,
-		n:      size,
+		rd:     contentReader,
+		n:      info.Size,
 		cancel: cancel,
 	}, nil
 }
@@ -67,30 +55,24 @@ func (b *Blob) Size() int64 {
 		return b.size
 	}
 
-	wr, rd, cancel, err := b.repo.CatFileBatchCheck(b.repo.Ctx)
+	batch, cancel, err := b.repo.CatFileBatch(b.repo.Ctx)
 	if err != nil {
 		log.Debug("error whilst reading size for %s in %s. Error: %v", b.ID.String(), b.repo.Path, err)
 		return 0
 	}
 	defer cancel()
-	_, err = wr.Write([]byte(b.ID.String() + "\n"))
+	info, err := batch.QueryInfo(b.ID.String())
 	if err != nil {
 		log.Debug("error whilst reading size for %s in %s. Error: %v", b.ID.String(), b.repo.Path, err)
 		return 0
 	}
-	_, _, b.size, err = ReadBatchLine(rd)
-	if err != nil {
-		log.Debug("error whilst reading size for %s in %s. Error: %v", b.ID.String(), b.repo.Path, err)
-		return 0
-	}
-
 	b.gotSize = true
-
+	b.size = info.Size
 	return b.size
 }
 
 type blobReader struct {
-	rd     *bufio.Reader
+	rd     BufferedReader
 	n      int64
 	cancel func()
 }

package/gitea/source/modules/git/catfile_batch.go

@@ -0,0 +1,52 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"context"
+	"io"
+)
+
+type BufferedReader interface {
+	io.Reader
+	Buffered() int
+	Peek(n int) ([]byte, error)
+	Discard(n int) (int, error)
+	ReadString(sep byte) (string, error)
+	ReadSlice(sep byte) ([]byte, error)
+	ReadBytes(sep byte) ([]byte, error)
+}
+
+type CatFileObject struct {
+	ID   string
+	Type string
+	Size int64
+}
+
+type CatFileBatch interface {
+	// QueryInfo queries the object info from the git repository by its object name using "git cat-file --batch" family commands.
+	// "git cat-file" accepts "<rev>" for the object name, it can be a ref name, object id, etc. https://git-scm.com/docs/gitrevisions
+	// In Gitea, we only use the simple ref name or object id, no other complex rev syntax like "suffix" or "git describe" although they are supported by git.
+	QueryInfo(obj string) (*CatFileObject, error)
+
+	// QueryContent is similar to QueryInfo, it queries the object info and additionally returns a reader for its content.
+	// FIXME: this design still follows the old pattern: the returned BufferedReader is very fragile,
+	// callers should carefully maintain its lifecycle and discard all unread data.
+	// TODO: It needs to be refactored to a fully managed Reader stream in the future, don't let callers manually Close or Discard
+	QueryContent(obj string) (*CatFileObject, BufferedReader, error)
+}
+
+type CatFileBatchCloser interface {
+	CatFileBatch
+	Close()
+}
+
+// NewBatch creates a "batch object provider (CatFileBatch)" for the given repository path to retrieve object info and content efficiently.
+// The CatFileBatch and the readers create by it should only be used in the same goroutine.
+func NewBatch(ctx context.Context, repoPath string) (CatFileBatchCloser, error) {
+	if DefaultFeatures().SupportCatFileBatchCommand {
+		return newCatFileBatchCommand(ctx, repoPath)
+	}
+	return newCatFileBatchLegacy(ctx, repoPath)
+}

package/gitea/source/modules/git/catfile_batch_command.go

@@ -0,0 +1,74 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"code.gitea.io/gitea/modules/git/gitcmd"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+)
+
+// catFileBatchCommand implements the CatFileBatch interface using the "cat-file --batch-command" command
+// for git version >= 2.36
+// ref: https://git-scm.com/docs/git-cat-file#Documentation/git-cat-file.txt---batch-command
+type catFileBatchCommand struct {
+	ctx      context.Context
+	repoPath string
+	batch    *catFileBatchCommunicator
+}
+
+var _ CatFileBatch = (*catFileBatchCommand)(nil)
+
+func newCatFileBatchCommand(ctx context.Context, repoPath string) (*catFileBatchCommand, error) {
+	if _, err := os.Stat(repoPath); err != nil {
+		return nil, util.NewNotExistErrorf("repo %q doesn't exist", filepath.Base(repoPath))
+	}
+	return &catFileBatchCommand{ctx: ctx, repoPath: repoPath}, nil
+}
+
+func (b *catFileBatchCommand) getBatch() *catFileBatchCommunicator {
+	if b.batch != nil {
+		return b.batch
+	}
+	b.batch = newCatFileBatch(b.ctx, b.repoPath, gitcmd.NewCommand("cat-file", "--batch-command"))
+	return b.batch
+}
+
+func (b *catFileBatchCommand) QueryContent(obj string) (*CatFileObject, BufferedReader, error) {
+	if strings.Contains(obj, "\n") {
+		setting.PanicInDevOrTesting("invalid object name with newline: %q", obj)
+	}
+	_, err := b.getBatch().reqWriter.Write([]byte("contents " + obj + "\n"))
+	if err != nil {
+		return nil, nil, err
+	}
+	info, err := catFileBatchParseInfoLine(b.getBatch().respReader)
+	if err != nil {
+		return nil, nil, err
+	}
+	return info, b.getBatch().respReader, nil
+}
+
+func (b *catFileBatchCommand) QueryInfo(obj string) (*CatFileObject, error) {
+	if strings.Contains(obj, "\n") {
+		setting.PanicInDevOrTesting("invalid object name with newline: %q", obj)
+	}
+	_, err := b.getBatch().reqWriter.Write([]byte("info " + obj + "\n"))
+	if err != nil {
+		return nil, err
+	}
+	return catFileBatchParseInfoLine(b.getBatch().respReader)
+}
+
+func (b *catFileBatchCommand) Close() {
+	if b.batch != nil {
+		b.batch.Close()
+		b.batch = nil
+	}
+}

package/gitea/source/modules/git/catfile_batch_legacy.go

@@ -0,0 +1,89 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"code.gitea.io/gitea/modules/git/gitcmd"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+)
+
+// catFileBatchLegacy implements the CatFileBatch interface using the "cat-file --batch" command and "cat-file --batch-check" command
+// for git version < 2.36
+// to align with "--batch-command", it creates the two commands for querying object contents and object info separately
+// ref: https://git-scm.com/docs/git-cat-file#Documentation/git-cat-file.txt---batch
+type catFileBatchLegacy struct {
+	ctx          context.Context
+	repoPath     string
+	batchContent *catFileBatchCommunicator
+	batchCheck   *catFileBatchCommunicator
+}
+
+var _ CatFileBatchCloser = (*catFileBatchLegacy)(nil)
+
+func newCatFileBatchLegacy(ctx context.Context, repoPath string) (*catFileBatchLegacy, error) {
+	if _, err := os.Stat(repoPath); err != nil {
+		return nil, util.NewNotExistErrorf("repo %q doesn't exist", filepath.Base(repoPath))
+	}
+	return &catFileBatchLegacy{ctx: ctx, repoPath: repoPath}, nil
+}
+
+func (b *catFileBatchLegacy) getBatchContent() *catFileBatchCommunicator {
+	if b.batchContent != nil {
+		return b.batchContent
+	}
+	b.batchContent = newCatFileBatch(b.ctx, b.repoPath, gitcmd.NewCommand("cat-file", "--batch"))
+	return b.batchContent
+}
+
+func (b *catFileBatchLegacy) getBatchCheck() *catFileBatchCommunicator {
+	if b.batchCheck != nil {
+		return b.batchCheck
+	}
+	b.batchCheck = newCatFileBatch(b.ctx, b.repoPath, gitcmd.NewCommand("cat-file", "--batch-check"))
+	return b.batchCheck
+}
+
+func (b *catFileBatchLegacy) QueryContent(obj string) (*CatFileObject, BufferedReader, error) {
+	if strings.Contains(obj, "\n") {
+		setting.PanicInDevOrTesting("invalid object name with newline: %q", obj)
+	}
+	_, err := io.WriteString(b.getBatchContent().reqWriter, obj+"\n")
+	if err != nil {
+		return nil, nil, err
+	}
+	info, err := catFileBatchParseInfoLine(b.getBatchContent().respReader)
+	if err != nil {
+		return nil, nil, err
+	}
+	return info, b.getBatchContent().respReader, nil
+}
+
+func (b *catFileBatchLegacy) QueryInfo(obj string) (*CatFileObject, error) {
+	if strings.Contains(obj, "\n") {
+		setting.PanicInDevOrTesting("invalid object name with newline: %q", obj)
+	}
+	_, err := io.WriteString(b.getBatchCheck().reqWriter, obj+"\n")
+	if err != nil {
+		return nil, err
+	}
+	return catFileBatchParseInfoLine(b.getBatchCheck().respReader)
+}
+
+func (b *catFileBatchLegacy) Close() {
+	if b.batchContent != nil {
+		b.batchContent.Close()
+		b.batchContent = nil
+	}
+	if b.batchCheck != nil {
+		b.batchCheck.Close()
+		b.batchCheck = nil
+	}
+}

package/gitea/source/modules/git/catfile_batch_reader.go

@@ -0,0 +1,264 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"math"
+	"strconv"
+	"strings"
+	"sync/atomic"
+
+	"code.gitea.io/gitea/modules/git/gitcmd"
+	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/util"
+)
+
+type catFileBatchCommunicator struct {
+	closeFunc   atomic.Pointer[func(err error)]
+	reqWriter   io.Writer
+	respReader  *bufio.Reader
+	debugGitCmd *gitcmd.Command
+}
+
+func (b *catFileBatchCommunicator) Close(err ...error) {
+	if fn := b.closeFunc.Swap(nil); fn != nil {
+		(*fn)(util.OptionalArg(err))
+	}
+}
+
+// newCatFileBatch opens git cat-file --batch/--batch-check/--batch-command command and prepares the stdin/stdout pipes for communication.
+func newCatFileBatch(ctx context.Context, repoPath string, cmdCatFile *gitcmd.Command) *catFileBatchCommunicator {
+	ctx, ctxCancel := context.WithCancelCause(ctx)
+	stdinWriter, stdoutReader, stdPipeClose := cmdCatFile.MakeStdinStdoutPipe()
+	ret := &catFileBatchCommunicator{
+		debugGitCmd: cmdCatFile,
+		reqWriter:   stdinWriter,
+		respReader:  bufio.NewReaderSize(stdoutReader, 32*1024), // use a buffered reader for rich operations
+	}
+	ret.closeFunc.Store(new(func(err error) {
+		ctxCancel(err)
+		stdPipeClose()
+	}))
+
+	err := cmdCatFile.WithDir(repoPath).StartWithStderr(ctx)
+	if err != nil {
+		log.Error("Unable to start git command %v: %v", cmdCatFile.LogString(), err)
+		// ideally here it should return the error, but it would require refactoring all callers
+		// so just return a dummy communicator that does nothing, almost the same behavior as before, not bad
+		ret.Close(err)
+		return ret
+	}
+
+	go func() {
+		err := cmdCatFile.WaitWithStderr()
+		if err != nil && !errors.Is(err, context.Canceled) {
+			log.Error("cat-file --batch command failed in repo %s, error: %v", repoPath, err)
+		}
+		ret.Close(err)
+	}()
+
+	return ret
+}
+
+func (b *catFileBatchCommunicator) debugKill() (ret struct {
+	beforeClose chan struct{}
+	blockClose  chan struct{}
+	afterClose  chan struct{}
+},
+) {
+	ret.beforeClose = make(chan struct{})
+	ret.blockClose = make(chan struct{})
+	ret.afterClose = make(chan struct{})
+	oldCloseFunc := b.closeFunc.Load()
+	b.closeFunc.Store(new(func(err error) {
+		b.closeFunc.Store(nil)
+		close(ret.beforeClose)
+		<-ret.blockClose
+		(*oldCloseFunc)(err)
+		close(ret.afterClose)
+	}))
+	b.debugGitCmd.DebugKill()
+	return ret
+}
+
+// catFileBatchParseInfoLine reads the header line from cat-file --batch
+// We expect: <oid> SP <type> SP <size> LF
+// then leaving the rest of the stream "<contents> LF" to be read
+func catFileBatchParseInfoLine(rd BufferedReader) (*CatFileObject, error) {
+	typ, err := rd.ReadString('\n')
+	if err != nil {
+		return nil, err
+	}
+	if len(typ) == 1 {
+		typ, err = rd.ReadString('\n')
+		if err != nil {
+			return nil, err
+		}
+	}
+	idx := strings.IndexByte(typ, ' ')
+	if idx < 0 {
+		return nil, ErrNotExist{}
+	}
+	sha := typ[:idx]
+	typ = typ[idx+1:]
+
+	idx = strings.IndexByte(typ, ' ')
+	if idx < 0 {
+		return nil, ErrNotExist{ID: sha}
+	}
+
+	sizeStr := typ[idx+1 : len(typ)-1]
+	typ = typ[:idx]
+
+	size, err := strconv.ParseInt(sizeStr, 10, 64)
+	return &CatFileObject{ID: sha, Type: typ, Size: size}, err
+}
+
+// ReadTagObjectID reads a tag object ID hash from a cat-file --batch stream, throwing away the rest of the stream.
+func ReadTagObjectID(rd BufferedReader, size int64) (string, error) {
+	var id string
+	var n int64
+headerLoop:
+	for {
+		line, err := rd.ReadBytes('\n')
+		if err != nil {
+			return "", err
+		}
+		n += int64(len(line))
+		idx := bytes.Index(line, []byte{' '})
+		if idx < 0 {
+			continue
+		}
+
+		if string(line[:idx]) == "object" {
+			id = string(line[idx+1 : len(line)-1])
+			break headerLoop
+		}
+	}
+
+	// Discard the rest of the tag
+	return id, DiscardFull(rd, size-n+1)
+}
+
+// ReadTreeID reads a tree ID from a cat-file --batch stream, throwing away the rest of the stream.
+func ReadTreeID(rd BufferedReader, size int64) (string, error) {
+	var id string
+	var n int64
+headerLoop:
+	for {
+		line, err := rd.ReadBytes('\n')
+		if err != nil {
+			return "", err
+		}
+		n += int64(len(line))
+		idx := bytes.Index(line, []byte{' '})
+		if idx < 0 {
+			continue
+		}
+
+		if string(line[:idx]) == "tree" {
+			id = string(line[idx+1 : len(line)-1])
+			break headerLoop
+		}
+	}
+
+	// Discard the rest of the commit
+	return id, DiscardFull(rd, size-n+1)
+}
+
+// git tree files are a list:
+// <mode-in-ascii> SP <fname> NUL <binary Hash>
+//
+// Unfortunately this 20-byte notation is somewhat in conflict to all other git tools
+// Therefore we need some method to convert these binary hashes to hex hashes
+
+// ParseCatFileTreeLine reads an entry from a tree in a cat-file --batch stream
+// This carefully avoids allocations - except where fnameBuf is too small.
+// It is recommended therefore to pass in an fnameBuf large enough to avoid almost all allocations
+//
+// Each line is composed of:
+// <mode-in-ascii-dropping-initial-zeros> SP <fname> NUL <binary HASH>
+//
+// We don't attempt to convert the raw HASH to save a lot of time
+func ParseCatFileTreeLine(objectFormat ObjectFormat, rd BufferedReader, modeBuf, fnameBuf, shaBuf []byte) (mode, fname, sha []byte, n int, err error) {
+	var readBytes []byte
+
+	// Read the Mode & fname
+	readBytes, err = rd.ReadSlice('\x00')
+	if err != nil {
+		return mode, fname, sha, n, err
+	}
+	idx := bytes.IndexByte(readBytes, ' ')
+	if idx < 0 {
+		log.Debug("missing space in readBytes ParseCatFileTreeLine: %s", readBytes)
+		return mode, fname, sha, n, &ErrNotExist{}
+	}
+
+	n += idx + 1
+	copy(modeBuf, readBytes[:idx])
+	if len(modeBuf) >= idx {
+		modeBuf = modeBuf[:idx]
+	} else {
+		modeBuf = append(modeBuf, readBytes[len(modeBuf):idx]...)
+	}
+	mode = modeBuf
+
+	readBytes = readBytes[idx+1:]
+
+	// Deal with the fname
+	copy(fnameBuf, readBytes)
+	if len(fnameBuf) > len(readBytes) {
+		fnameBuf = fnameBuf[:len(readBytes)]
+	} else {
+		fnameBuf = append(fnameBuf, readBytes[len(fnameBuf):]...)
+	}
+	for err == bufio.ErrBufferFull {
+		readBytes, err = rd.ReadSlice('\x00')
+		fnameBuf = append(fnameBuf, readBytes...)
+	}
+	n += len(fnameBuf)
+	if err != nil {
+		return mode, fname, sha, n, err
+	}
+	fnameBuf = fnameBuf[:len(fnameBuf)-1]
+	fname = fnameBuf
+
+	// Deal with the binary hash
+	idx = 0
+	length := objectFormat.FullLength() / 2
+	for idx < length {
+		var read int
+		read, err = rd.Read(shaBuf[idx:length])
+		n += read
+		if err != nil {
+			return mode, fname, sha, n, err
+		}
+		idx += read
+	}
+	sha = shaBuf
+	return mode, fname, sha, n, err
+}
+
+func DiscardFull(rd BufferedReader, discard int64) error {
+	if discard > math.MaxInt32 {
+		n, err := rd.Discard(math.MaxInt32)
+		discard -= int64(n)
+		if err != nil {
+			return err
+		}
+	}
+	for discard > 0 {
+		n, err := rd.Discard(int(discard))
+		discard -= int64(n)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}

package/gitea/source/modules/git/catfile_batch_test.go

@@ -0,0 +1,105 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"code.gitea.io/gitea/modules/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCatFileBatch(t *testing.T) {
+	defer test.MockVariableValue(&DefaultFeatures().SupportCatFileBatchCommand)()
+	DefaultFeatures().SupportCatFileBatchCommand = false
+	t.Run("LegacyCheck", testCatFileBatch)
+	DefaultFeatures().SupportCatFileBatchCommand = true
+	t.Run("BatchCommand", testCatFileBatch)
+}
+
+func testCatFileBatch(t *testing.T) {
+	t.Run("CorruptedGitRepo", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		batch, err := NewBatch(t.Context(), tmpDir)
+		// as long as the directory exists, no error, because we can't really know whether the git repo is valid until we run commands
+		require.NoError(t, err)
+		defer batch.Close()
+
+		_, err = batch.QueryInfo("e2129701f1a4d54dc44f03c93bca0a2aec7c5449")
+		require.Error(t, err)
+		_, err = batch.QueryInfo("e2129701f1a4d54dc44f03c93bca0a2aec7c5449")
+		require.Error(t, err)
+	})
+
+	simulateQueryTerminated := func(t *testing.T, errBeforePipeClose, errAfterPipeClose error) {
+		readError := func(t *testing.T, r io.Reader, expectedErr error) {
+			if expectedErr == nil {
+				return // expectedErr == nil means this read should be skipped
+			}
+			n, err := r.Read(make([]byte, 100))
+			assert.Zero(t, n)
+			assert.ErrorIs(t, err, expectedErr)
+		}
+
+		batch, err := NewBatch(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
+		require.NoError(t, err)
+		defer batch.Close()
+		_, err = batch.QueryInfo("e2129701f1a4d54dc44f03c93bca0a2aec7c5449")
+		require.NoError(t, err)
+
+		var c *catFileBatchCommunicator
+		switch b := batch.(type) {
+		case *catFileBatchLegacy:
+			c = b.batchCheck
+			_, _ = c.reqWriter.Write([]byte("in-complete-line-"))
+		case *catFileBatchCommand:
+			c = b.batch
+			_, _ = c.reqWriter.Write([]byte("info"))
+		default:
+			t.FailNow()
+		}
+
+		require.NotEqual(t, errBeforePipeClose == nil, errAfterPipeClose == nil, "must set exactly one of the expected errors")
+
+		inceptor := c.debugKill()
+		<-inceptor.beforeClose                         // wait for the command's Close to be called, the pipe is not closed yet
+		readError(t, c.respReader, errBeforePipeClose) // then caller will read on an open pipe which will be closed soon
+		close(inceptor.blockClose)                     // continue to close the pipe
+		<-inceptor.afterClose                          // wait for the pipe to be closed
+		readError(t, c.respReader, errAfterPipeClose)  // then caller will read on a closed pipe
+	}
+	t.Run("QueryTerminated", func(t *testing.T) {
+		simulateQueryTerminated(t, io.EOF, nil)       // reader is faster
+		simulateQueryTerminated(t, nil, os.ErrClosed) // pipes are closed faster
+	})
+
+	batch, err := NewBatch(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
+	require.NoError(t, err)
+	defer batch.Close()
+
+	t.Run("QueryInfo", func(t *testing.T) {
+		info, err := batch.QueryInfo("e2129701f1a4d54dc44f03c93bca0a2aec7c5449")
+		require.NoError(t, err)
+		assert.Equal(t, "e2129701f1a4d54dc44f03c93bca0a2aec7c5449", info.ID)
+		assert.Equal(t, "blob", info.Type)
+		assert.EqualValues(t, 6, info.Size)
+	})
+
+	t.Run("QueryContent", func(t *testing.T) {
+		info, rd, err := batch.QueryContent("e2129701f1a4d54dc44f03c93bca0a2aec7c5449")
+		require.NoError(t, err)
+		assert.Equal(t, "e2129701f1a4d54dc44f03c93bca0a2aec7c5449", info.ID)
+		assert.Equal(t, "blob", info.Type)
+		assert.EqualValues(t, 6, info.Size)
+
+		content, err := io.ReadAll(io.LimitReader(rd, info.Size))
+		require.NoError(t, err)
+		require.Equal(t, "file1\n", string(content))
+	})
+}

package/gitea/source/modules/git/commit.go

@@ -5,17 +5,13 @@
 package git
 
 import (
-	"bufio"
-	"bytes"
 	"context"
 	"errors"
 	"io"
 	"os/exec"
-	"strconv"
 	"strings"
 
 	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/util"
 )
 
@@ -41,7 +37,7 @@ type CommitSignature struct {
 
 // Message returns the commit message. Same as retrieving CommitMessage directly.
 func (c *Commit) Message() string {
-	return c.CommitMessage
+	return strings.ToValidUTF8(c.CommitMessage, "?")
 }
 
 // Summary returns first line of commit message.
@@ -86,109 +82,6 @@ func (c *Commit) GetCommitByPath(relpath string) (*Commit, error) {
 	return c.repo.getCommitByPathWithID(c.ID, relpath)
 }
 
-// AddChanges marks local changes to be ready for commit.
-func AddChanges(ctx context.Context, repoPath string, all bool, files ...string) error {
-	cmd := gitcmd.NewCommand().AddArguments("add")
-	if all {
-		cmd.AddArguments("--all")
-	}
-	cmd.AddDashesAndList(files...)
-	_, _, err := cmd.RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
-	return err
-}
-
-// CommitChangesOptions the options when a commit created
-type CommitChangesOptions struct {
-	Committer *Signature
-	Author    *Signature
-	Message   string
-}
-
-// CommitChanges commits local changes with given committer, author and message.
-// If author is nil, it will be the same as committer.
-func CommitChanges(ctx context.Context, repoPath string, opts CommitChangesOptions) error {
-	cmd := gitcmd.NewCommand()
-	if opts.Committer != nil {
-		cmd.AddOptionValues("-c", "user.name="+opts.Committer.Name)
-		cmd.AddOptionValues("-c", "user.email="+opts.Committer.Email)
-	}
-	cmd.AddArguments("commit")
-
-	if opts.Author == nil {
-		opts.Author = opts.Committer
-	}
-	if opts.Author != nil {
-		cmd.AddOptionFormat("--author='%s <%s>'", opts.Author.Name, opts.Author.Email)
-	}
-	cmd.AddOptionFormat("--message=%s", opts.Message)
-
-	_, _, err := cmd.RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
-	// No stderr but exit status 1 means nothing to commit.
-	if err != nil && err.Error() == "exit status 1" {
-		return nil
-	}
-	return err
-}
-
-// AllCommitsCount returns count of all commits in repository
-func AllCommitsCount(ctx context.Context, repoPath string, hidePRRefs bool, files ...string) (int64, error) {
-	cmd := gitcmd.NewCommand("rev-list")
-	if hidePRRefs {
-		cmd.AddArguments("--exclude=" + PullPrefix + "*")
-	}
-	cmd.AddArguments("--all", "--count")
-	if len(files) > 0 {
-		cmd.AddDashesAndList(files...)
-	}
-
-	stdout, _, err := cmd.RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
-	if err != nil {
-		return 0, err
-	}
-
-	return strconv.ParseInt(strings.TrimSpace(stdout), 10, 64)
-}
-
-// CommitsCountOptions the options when counting commits
-type CommitsCountOptions struct {
-	RepoPath string
-	Not      string
-	Revision []string
-	RelPath  []string
-	Since    string
-	Until    string
-}
-
-// CommitsCount returns number of total commits of until given revision.
-func CommitsCount(ctx context.Context, opts CommitsCountOptions) (int64, error) {
-	cmd := gitcmd.NewCommand("rev-list", "--count")
-
-	cmd.AddDynamicArguments(opts.Revision...)
-
-	if opts.Not != "" {
-		cmd.AddOptionValues("--not", opts.Not)
-	}
-
-	if len(opts.RelPath) > 0 {
-		cmd.AddDashesAndList(opts.RelPath...)
-	}
-
-	stdout, _, err := cmd.RunStdString(ctx, &gitcmd.RunOpts{Dir: opts.RepoPath})
-	if err != nil {
-		return 0, err
-	}
-
-	return strconv.ParseInt(strings.TrimSpace(stdout), 10, 64)
-}
-
-// CommitsCount returns number of total commits of until current revision.
-func (c *Commit) CommitsCount() (int64, error) {
-	return CommitsCount(c.repo.Ctx, CommitsCountOptions{
-		RepoPath: c.repo.Path,
-		Revision: []string{c.ID.String()},
-	})
-}
-
 // CommitsByRange returns the specific page commits before current revision, every page's number default by CommitsRangeSize
 func (c *Commit) CommitsByRange(page, pageSize int, not, since, until string) ([]*Commit, error) {
 	return c.repo.commitsByRangeWithTime(c.ID, page, pageSize, not, since, until)
@@ -208,7 +101,10 @@ func (c *Commit) HasPreviousCommit(objectID ObjectID) (bool, error) {
 		return false, nil
 	}
 
-	_, _, err := gitcmd.NewCommand("merge-base", "--is-ancestor").AddDynamicArguments(that, this).RunStdString(c.repo.Ctx, &gitcmd.RunOpts{Dir: c.repo.Path})
+	_, _, err := gitcmd.NewCommand("merge-base", "--is-ancestor").
+		AddDynamicArguments(that, this).
+		WithDir(c.repo.Path).
+		RunStdString(c.repo.Ctx)
 	if err == nil {
 		return true, nil
 	}
@@ -347,110 +243,14 @@ func (c *Commit) GetFileContent(filename string, limit int) (string, error) {
 	return string(bytes), nil
 }
 
-// GetBranchName gets the closest branch name (as returned by 'git name-rev --name-only')
-func (c *Commit) GetBranchName() (string, error) {
-	cmd := gitcmd.NewCommand("name-rev")
-	if DefaultFeatures().CheckVersionAtLeast("2.13.0") {
-		cmd.AddArguments("--exclude", "refs/tags/*")
-	}
-	cmd.AddArguments("--name-only", "--no-undefined").AddDynamicArguments(c.ID.String())
-	data, _, err := cmd.RunStdString(c.repo.Ctx, &gitcmd.RunOpts{Dir: c.repo.Path})
-	if err != nil {
-		// handle special case where git can not describe commit
-		if strings.Contains(err.Error(), "cannot describe") {
-			return "", nil
-		}
-
-		return "", err
-	}
-
-	// name-rev commitID output will be "master" or "master~12"
-	return strings.SplitN(strings.TrimSpace(data), "~", 2)[0], nil
-}
-
-// CommitFileStatus represents status of files in a commit.
-type CommitFileStatus struct {
-	Added    []string
-	Removed  []string
-	Modified []string
-}
-
-// NewCommitFileStatus creates a CommitFileStatus
-func NewCommitFileStatus() *CommitFileStatus {
-	return &CommitFileStatus{
-		[]string{}, []string{}, []string{},
-	}
-}
-
-func parseCommitFileStatus(fileStatus *CommitFileStatus, stdout io.Reader) {
-	rd := bufio.NewReader(stdout)
-	peek, err := rd.Peek(1)
-	if err != nil {
-		if err != io.EOF {
-			log.Error("Unexpected error whilst reading from git log --name-status. Error: %v", err)
-		}
-		return
-	}
-	if peek[0] == '\n' || peek[0] == '\x00' {
-		_, _ = rd.Discard(1)
-	}
-	for {
-		modifier, err := rd.ReadString('\x00')
-		if err != nil {
-			if err != io.EOF {
-				log.Error("Unexpected error whilst reading from git log --name-status. Error: %v", err)
-			}
-			return
-		}
-		file, err := rd.ReadString('\x00')
-		if err != nil {
-			if err != io.EOF {
-				log.Error("Unexpected error whilst reading from git log --name-status. Error: %v", err)
-			}
-			return
-		}
-		file = file[:len(file)-1]
-		switch modifier[0] {
-		case 'A':
-			fileStatus.Added = append(fileStatus.Added, file)
-		case 'D':
-			fileStatus.Removed = append(fileStatus.Removed, file)
-		case 'M':
-			fileStatus.Modified = append(fileStatus.Modified, file)
-		}
-	}
-}
-
-// GetCommitFileStatus returns file status of commit in given repository.
-func GetCommitFileStatus(ctx context.Context, repoPath, commitID string) (*CommitFileStatus, error) {
-	stdout, w := io.Pipe()
-	done := make(chan struct{})
-	fileStatus := NewCommitFileStatus()
-	go func() {
-		parseCommitFileStatus(fileStatus, stdout)
-		close(done)
-	}()
-
-	stderr := new(bytes.Buffer)
-	err := gitcmd.NewCommand("log", "--name-status", "-m", "--pretty=format:", "--first-parent", "--no-renames", "-z", "-1").AddDynamicArguments(commitID).Run(ctx, &gitcmd.RunOpts{
-		Dir:    repoPath,
-		Stdout: w,
-		Stderr: stderr,
-	})
-	w.Close() // Close writer to exit parsing goroutine
-	if err != nil {
-		return nil, gitcmd.ConcatenateError(err, stderr.String())
-	}
-
-	<-done
-	return fileStatus, nil
-}
-
 // GetFullCommitID returns full length (40) of commit ID by given short SHA in a repository.
 func GetFullCommitID(ctx context.Context, repoPath, shortID string) (string, error) {
-	commitID, _, err := gitcmd.NewCommand("rev-parse").AddDynamicArguments(shortID).RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
+	commitID, _, err := gitcmd.NewCommand("rev-parse").
+		AddDynamicArguments(shortID).
+		WithDir(repoPath).
+		RunStdString(ctx)
 	if err != nil {
-		if strings.Contains(err.Error(), "exit status 128") {
+		if gitcmd.IsErrorExitCode(err, 128) {
 			return "", ErrNotExist{shortID, ""}
 		}
 		return "", err
@@ -458,14 +258,6 @@ func GetFullCommitID(ctx context.Context, repoPath, shortID string) (string, err
 	return strings.TrimSpace(commitID), nil
 }
 
-// GetRepositoryDefaultPublicGPGKey returns the default public key for this commit
-func (c *Commit) GetRepositoryDefaultPublicGPGKey(forceUpdate bool) (*GPGSettings, error) {
-	if c.repo == nil {
-		return nil, nil
-	}
-	return c.repo.GetDefaultPublicGPGKey(forceUpdate)
-}
-
 func IsStringLikelyCommitID(objFmt ObjectFormat, s string, minLength ...int) bool {
 	maxLen := 64 // sha256
 	if objFmt != nil {

package/gitea/source/modules/git/commit_info_test.go

@@ -30,28 +30,57 @@ func cloneRepo(tb testing.TB, url string) (string, error) {
 }
 
 func testGetCommitsInfo(t *testing.T, repo1 *Repository) {
+	type expectedEntryInfo struct {
+		CommitID string
+		Size     int64
+	}
+
 	// these test case are specific to the repo1 test repo
 	testCases := []struct {
 		CommitID           string
 		Path               string
-		ExpectedIDs        map[string]string
+		ExpectedIDs        map[string]expectedEntryInfo
 		ExpectedTreeCommit string
 	}{
-		{"8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2", "", map[string]string{
-			"file1.txt": "95bb4d39648ee7e325106df01a621c530863a653",
-			"file2.txt": "8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2",
+		{"8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2", "", map[string]expectedEntryInfo{
+			"file1.txt": {
+				CommitID: "95bb4d39648ee7e325106df01a621c530863a653",
+				Size:     6,
+			},
+			"file2.txt": {
+				CommitID: "8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2",
+				Size:     6,
+			},
 		}, "8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2"},
-		{"2839944139e0de9737a044f78b0e4b40d989a9e3", "", map[string]string{
-			"file1.txt":   "2839944139e0de9737a044f78b0e4b40d989a9e3",
-			"branch1.txt": "9c9aef8dd84e02bc7ec12641deb4c930a7c30185",
+		{"2839944139e0de9737a044f78b0e4b40d989a9e3", "", map[string]expectedEntryInfo{
+			"file1.txt": {
+				CommitID: "2839944139e0de9737a044f78b0e4b40d989a9e3",
+				Size:     15,
+			},
+			"branch1.txt": {
+				CommitID: "9c9aef8dd84e02bc7ec12641deb4c930a7c30185",
+				Size:     8,
+			},
 		}, "2839944139e0de9737a044f78b0e4b40d989a9e3"},
-		{"5c80b0245c1c6f8343fa418ec374b13b5d4ee658", "branch2", map[string]string{
-			"branch2.txt": "5c80b0245c1c6f8343fa418ec374b13b5d4ee658",
+		{"5c80b0245c1c6f8343fa418ec374b13b5d4ee658", "branch2", map[string]expectedEntryInfo{
+			"branch2.txt": {
+				CommitID: "5c80b0245c1c6f8343fa418ec374b13b5d4ee658",
+				Size:     8,
+			},
 		}, "5c80b0245c1c6f8343fa418ec374b13b5d4ee658"},
-		{"feaf4ba6bc635fec442f46ddd4512416ec43c2c2", "", map[string]string{
-			"file1.txt": "95bb4d39648ee7e325106df01a621c530863a653",
-			"file2.txt": "8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2",
-			"foo":       "37991dec2c8e592043f47155ce4808d4580f9123",
+		{"feaf4ba6bc635fec442f46ddd4512416ec43c2c2", "", map[string]expectedEntryInfo{
+			"file1.txt": {
+				CommitID: "95bb4d39648ee7e325106df01a621c530863a653",
+				Size:     6,
+			},
+			"file2.txt": {
+				CommitID: "8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2",
+				Size:     6,
+			},
+			"foo": {
+				CommitID: "37991dec2c8e592043f47155ce4808d4580f9123",
+				Size:     0,
+			},
 		}, "feaf4ba6bc635fec442f46ddd4512416ec43c2c2"},
 	}
 	for _, testCase := range testCases {
@@ -93,11 +122,12 @@ func testGetCommitsInfo(t *testing.T, repo1 *Repository) {
 		for _, commitInfo := range commitsInfo {
 			entry := commitInfo.Entry
 			commit := commitInfo.Commit
-			expectedID, ok := testCase.ExpectedIDs[entry.Name()]
+			expectedInfo, ok := testCase.ExpectedIDs[entry.Name()]
 			if !assert.True(t, ok) {
 				continue
 			}
-			assert.Equal(t, expectedID, commit.ID.String())
+			assert.Equal(t, expectedInfo.CommitID, commit.ID.String())
+			assert.Equal(t, expectedInfo.Size, entry.Size(), entry.Name())
 		}
 	}
 }
@@ -173,7 +203,6 @@ func BenchmarkEntries_GetCommitsInfo(b *testing.B) {
 		} else if entries, err = commit.Tree.ListEntries(); err != nil {
 			b.Fatal(err)
 		}
-		entries.Sort()
 		b.ResetTimer()
 		b.Run(benchmark.name, func(b *testing.B) {
 			for b.Loop() {

package/gitea/source/modules/git/commit_sha256_test.go

@@ -14,33 +14,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestCommitsCountSha256(t *testing.T) {
-	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare_sha256")
-
-	commitsCount, err := CommitsCount(t.Context(),
-		CommitsCountOptions{
-			RepoPath: bareRepo1Path,
-			Revision: []string{"f004f41359117d319dedd0eaab8c5259ee2263da839dcba33637997458627fdc"},
-		})
-
-	assert.NoError(t, err)
-	assert.Equal(t, int64(3), commitsCount)
-}
-
-func TestCommitsCountWithoutBaseSha256(t *testing.T) {
-	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare_sha256")
-
-	commitsCount, err := CommitsCount(t.Context(),
-		CommitsCountOptions{
-			RepoPath: bareRepo1Path,
-			Not:      "main",
-			Revision: []string{"branch1"},
-		})
-
-	assert.NoError(t, err)
-	assert.Equal(t, int64(2), commitsCount)
-}
-
 func TestGetFullCommitIDSha256(t *testing.T) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare_sha256")
 
@@ -157,39 +130,3 @@ func TestHasPreviousCommitSha256(t *testing.T) {
 	assert.NoError(t, err)
 	assert.False(t, selfNot)
 }
-
-func TestGetCommitFileStatusMergesSha256(t *testing.T) {
-	bareRepo1Path := filepath.Join(testReposDir, "repo6_merge_sha256")
-
-	commitFileStatus, err := GetCommitFileStatus(t.Context(), bareRepo1Path, "d2e5609f630dd8db500f5298d05d16def282412e3e66ed68cc7d0833b29129a1")
-	assert.NoError(t, err)
-
-	expected := CommitFileStatus{
-		[]string{
-			"add_file.txt",
-		},
-		[]string{},
-		[]string{
-			"to_modify.txt",
-		},
-	}
-
-	assert.Equal(t, expected.Added, commitFileStatus.Added)
-	assert.Equal(t, expected.Removed, commitFileStatus.Removed)
-	assert.Equal(t, expected.Modified, commitFileStatus.Modified)
-
-	expected = CommitFileStatus{
-		[]string{},
-		[]string{
-			"to_remove.txt",
-		},
-		[]string{},
-	}
-
-	commitFileStatus, err = GetCommitFileStatus(t.Context(), bareRepo1Path, "da1ded40dc8e5b7c564171f4bf2fc8370487decfb1cb6a99ef28f3ed73d09172")
-	assert.NoError(t, err)
-
-	assert.Equal(t, expected.Added, commitFileStatus.Added)
-	assert.Equal(t, expected.Removed, commitFileStatus.Removed)
-	assert.Equal(t, expected.Modified, commitFileStatus.Modified)
-}

package/gitea/source/modules/git/commit_submodule.go

@@ -16,7 +16,7 @@ func (c *Commit) GetSubModules() (*ObjectCache[*SubModule], error) {
 	entry, err := c.GetTreeEntryByPath(".gitmodules")
 	if err != nil {
 		if _, ok := err.(ErrNotExist); ok {
-			return nil, nil
+			return nil, nil //nolint:nilnil // return nil to indicate that the submodule does not exist
 		}
 		return nil, err
 	}
@@ -48,5 +48,5 @@ func (c *Commit) GetSubModule(entryName string) (*SubModule, error) {
 			return module, nil
 		}
 	}
-	return nil, nil
+	return nil, nil //nolint:nilnil // return nil to indicate that the submodule does not exist
 }

package/gitea/source/modules/git/commit_test.go

@@ -13,33 +13,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestCommitsCount(t *testing.T) {
-	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
-
-	commitsCount, err := CommitsCount(t.Context(),
-		CommitsCountOptions{
-			RepoPath: bareRepo1Path,
-			Revision: []string{"8006ff9adbf0cb94da7dad9e537e53817f9fa5c0"},
-		})
-
-	assert.NoError(t, err)
-	assert.Equal(t, int64(3), commitsCount)
-}
-
-func TestCommitsCountWithoutBase(t *testing.T) {
-	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
-
-	commitsCount, err := CommitsCount(t.Context(),
-		CommitsCountOptions{
-			RepoPath: bareRepo1Path,
-			Not:      "master",
-			Revision: []string{"branch1"},
-		})
-
-	assert.NoError(t, err)
-	assert.Equal(t, int64(2), commitsCount)
-}
-
 func TestGetFullCommitID(t *testing.T) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
 
@@ -186,6 +159,14 @@ ISO-8859-1`, commitFromReader.Signature.Payload)
 	assert.Equal(t, commitFromReader, commitFromReader2)
 }
 
+func TestCommitMessageSanitizesInvalidUTF8(t *testing.T) {
+	commit := &Commit{
+		CommitMessage: "title \xff\n\n\nbody \xff\n\n\n",
+	}
+	assert.Equal(t, "title ?\n\n\nbody ?\n\n\n", commit.Message())
+	assert.Equal(t, "title ?", commit.Summary())
+}
+
 func TestHasPreviousCommit(t *testing.T) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
 
@@ -212,134 +193,6 @@ func TestHasPreviousCommit(t *testing.T) {
 	assert.False(t, selfNot)
 }
 
-func TestParseCommitFileStatus(t *testing.T) {
-	type testcase struct {
-		output   string
-		added    []string
-		removed  []string
-		modified []string
-	}
-
-	kases := []testcase{
-		{
-			// Merge commit
-			output: "MM\x00options/locale/locale_en-US.ini\x00",
-			modified: []string{
-				"options/locale/locale_en-US.ini",
-			},
-			added:   []string{},
-			removed: []string{},
-		},
-		{
-			// Spaces commit
-			output: "D\x00b\x00D\x00b b/b\x00A\x00b b/b b/b b/b\x00A\x00b b/b b/b b/b b/b\x00",
-			removed: []string{
-				"b",
-				"b b/b",
-			},
-			modified: []string{},
-			added: []string{
-				"b b/b b/b b/b",
-				"b b/b b/b b/b b/b",
-			},
-		},
-		{
-			// larger commit
-			output: "M\x00go.mod\x00M\x00go.sum\x00M\x00modules/ssh/ssh.go\x00M\x00vendor/github.com/gliderlabs/ssh/circle.yml\x00M\x00vendor/github.com/gliderlabs/ssh/context.go\x00A\x00vendor/github.com/gliderlabs/ssh/go.mod\x00A\x00vendor/github.com/gliderlabs/ssh/go.sum\x00M\x00vendor/github.com/gliderlabs/ssh/server.go\x00M\x00vendor/github.com/gliderlabs/ssh/session.go\x00M\x00vendor/github.com/gliderlabs/ssh/ssh.go\x00M\x00vendor/golang.org/x/sys/unix/mkerrors.sh\x00M\x00vendor/golang.org/x/sys/unix/syscall_darwin.go\x00M\x00vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go\x00M\x00vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go\x00M\x00vendor/golang.org/x/sys/unix/zerrors_freebsd_386.go\x00M\x00vendor/golang.org/x/sys/unix/zerrors_freebsd_amd64.go\x00M\x00vendor/golang.org/x/sys/unix/zerrors_freebsd_arm.go\x00M\x00vendor/golang.org/x/sys/unix/zerrors_freebsd_arm64.go\x00M\x00vendor/golang.org/x/sys/unix/zerrors_linux.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_darwin_amd64.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_darwin_arm64.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_dragonfly_amd64.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_freebsd_386.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_freebsd_amd64.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_freebsd_arm.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_freebsd_arm64.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go\x00M\x00vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go\x00M\x00vendor/modules.txt\x00",
-			modified: []string{
-				"go.mod",
-				"go.sum",
-				"modules/ssh/ssh.go",
-				"vendor/github.com/gliderlabs/ssh/circle.yml",
-				"vendor/github.com/gliderlabs/ssh/context.go",
-				"vendor/github.com/gliderlabs/ssh/server.go",
-				"vendor/github.com/gliderlabs/ssh/session.go",
-				"vendor/github.com/gliderlabs/ssh/ssh.go",
-				"vendor/golang.org/x/sys/unix/mkerrors.sh",
-				"vendor/golang.org/x/sys/unix/syscall_darwin.go",
-				"vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go",
-				"vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go",
-				"vendor/golang.org/x/sys/unix/zerrors_freebsd_386.go",
-				"vendor/golang.org/x/sys/unix/zerrors_freebsd_amd64.go",
-				"vendor/golang.org/x/sys/unix/zerrors_freebsd_arm.go",
-				"vendor/golang.org/x/sys/unix/zerrors_freebsd_arm64.go",
-				"vendor/golang.org/x/sys/unix/zerrors_linux.go",
-				"vendor/golang.org/x/sys/unix/ztypes_darwin_amd64.go",
-				"vendor/golang.org/x/sys/unix/ztypes_darwin_arm64.go",
-				"vendor/golang.org/x/sys/unix/ztypes_dragonfly_amd64.go",
-				"vendor/golang.org/x/sys/unix/ztypes_freebsd_386.go",
-				"vendor/golang.org/x/sys/unix/ztypes_freebsd_amd64.go",
-				"vendor/golang.org/x/sys/unix/ztypes_freebsd_arm.go",
-				"vendor/golang.org/x/sys/unix/ztypes_freebsd_arm64.go",
-				"vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go",
-				"vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go",
-				"vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go",
-				"vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go",
-				"vendor/modules.txt",
-			},
-			added: []string{
-				"vendor/github.com/gliderlabs/ssh/go.mod",
-				"vendor/github.com/gliderlabs/ssh/go.sum",
-			},
-			removed: []string{},
-		},
-		{
-			// git 1.7.2 adds an unnecessary \x00 on merge commit
-			output: "\x00MM\x00options/locale/locale_en-US.ini\x00",
-			modified: []string{
-				"options/locale/locale_en-US.ini",
-			},
-			added:   []string{},
-			removed: []string{},
-		},
-		{
-			// git 1.7.2 adds an unnecessary \n on normal commit
-			output: "\nD\x00b\x00D\x00b b/b\x00A\x00b b/b b/b b/b\x00A\x00b b/b b/b b/b b/b\x00",
-			removed: []string{
-				"b",
-				"b b/b",
-			},
-			modified: []string{},
-			added: []string{
-				"b b/b b/b b/b",
-				"b b/b b/b b/b b/b",
-			},
-		},
-	}
-
-	for _, kase := range kases {
-		fileStatus := NewCommitFileStatus()
-		parseCommitFileStatus(fileStatus, strings.NewReader(kase.output))
-
-		assert.Equal(t, kase.added, fileStatus.Added)
-		assert.Equal(t, kase.removed, fileStatus.Removed)
-		assert.Equal(t, kase.modified, fileStatus.Modified)
-	}
-}
-
-func TestGetCommitFileStatusMerges(t *testing.T) {
-	bareRepo1Path := filepath.Join(testReposDir, "repo6_merge")
-
-	commitFileStatus, err := GetCommitFileStatus(t.Context(), bareRepo1Path, "022f4ce6214973e018f02bf363bf8a2e3691f699")
-	assert.NoError(t, err)
-
-	expected := CommitFileStatus{
-		[]string{
-			"add_file.txt",
-		},
-		[]string{
-			"to_remove.txt",
-		},
-		[]string{
-			"to_modify.txt",
-		},
-	}
-
-	assert.Equal(t, expected.Added, commitFileStatus.Added)
-	assert.Equal(t, expected.Removed, commitFileStatus.Removed)
-	assert.Equal(t, expected.Modified, commitFileStatus.Modified)
-}
-
 func Test_GetCommitBranchStart(t *testing.T) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
 	repo, err := OpenRepository(t.Context(), bareRepo1Path)

package/gitea/source/modules/git/config.go

@@ -118,7 +118,9 @@ func syncGitConfig(ctx context.Context) (err error) {
 }
 
 func configSet(ctx context.Context, key, value string) error {
-	stdout, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key).RunStdString(ctx, nil)
+	stdout, _, err := gitcmd.NewCommand("config", "--global", "--get").
+		AddDynamicArguments(key).
+		RunStdString(ctx)
 	if err != nil && !gitcmd.IsErrorExitCode(err, 1) {
 		return fmt.Errorf("failed to get git config %s, err: %w", key, err)
 	}
@@ -128,8 +130,9 @@ func configSet(ctx context.Context, key, value string) error {
 		return nil
 	}
 
-	_, _, err = gitcmd.NewCommand("config", "--global").AddDynamicArguments(key, value).RunStdString(ctx, nil)
-	if err != nil {
+	if _, _, err = gitcmd.NewCommand("config", "--global").
+		AddDynamicArguments(key, value).
+		RunStdString(ctx); err != nil {
 		return fmt.Errorf("failed to set git global config %s, err: %w", key, err)
 	}
 
@@ -137,14 +140,14 @@ func configSet(ctx context.Context, key, value string) error {
 }
 
 func configSetNonExist(ctx context.Context, key, value string) error {
-	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key).RunStdString(ctx, nil)
+	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key).RunStdString(ctx)
 	if err == nil {
 		// already exist
 		return nil
 	}
 	if gitcmd.IsErrorExitCode(err, 1) {
 		// not exist, set new config
-		_, _, err = gitcmd.NewCommand("config", "--global").AddDynamicArguments(key, value).RunStdString(ctx, nil)
+		_, _, err = gitcmd.NewCommand("config", "--global").AddDynamicArguments(key, value).RunStdString(ctx)
 		if err != nil {
 			return fmt.Errorf("failed to set git global config %s, err: %w", key, err)
 		}
@@ -155,14 +158,14 @@ func configSetNonExist(ctx context.Context, key, value string) error {
 }
 
 func configAddNonExist(ctx context.Context, key, value string) error {
-	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key, regexp.QuoteMeta(value)).RunStdString(ctx, nil)
+	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key, regexp.QuoteMeta(value)).RunStdString(ctx)
 	if err == nil {
 		// already exist
 		return nil
 	}
 	if gitcmd.IsErrorExitCode(err, 1) {
 		// not exist, add new config
-		_, _, err = gitcmd.NewCommand("config", "--global", "--add").AddDynamicArguments(key, value).RunStdString(ctx, nil)
+		_, _, err = gitcmd.NewCommand("config", "--global", "--add").AddDynamicArguments(key, value).RunStdString(ctx)
 		if err != nil {
 			return fmt.Errorf("failed to add git global config %s, err: %w", key, err)
 		}
@@ -172,10 +175,10 @@ func configAddNonExist(ctx context.Context, key, value string) error {
 }
 
 func configUnsetAll(ctx context.Context, key, value string) error {
-	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key).RunStdString(ctx, nil)
+	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key).RunStdString(ctx)
 	if err == nil {
 		// exist, need to remove
-		_, _, err = gitcmd.NewCommand("config", "--global", "--unset-all").AddDynamicArguments(key, regexp.QuoteMeta(value)).RunStdString(ctx, nil)
+		_, _, err = gitcmd.NewCommand("config", "--global", "--unset-all").AddDynamicArguments(key, regexp.QuoteMeta(value)).RunStdString(ctx)
 		if err != nil {
 			return fmt.Errorf("failed to unset git global config %s, err: %w", key, err)
 		}

package/gitea/source/modules/git/diff.go

@@ -5,71 +5,83 @@ package git
 
 import (
 	"bufio"
-	"bytes"
 	"context"
 	"fmt"
 	"io"
-	"os"
 	"regexp"
 	"strconv"
 	"strings"
 
 	"code.gitea.io/gitea/modules/git/gitcmd"
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
 )
 
-// RawDiffType type of a raw diff.
+// RawDiffType output format: diff or patch
 type RawDiffType string
 
-// RawDiffType possible values.
 const (
 	RawDiffNormal RawDiffType = "diff"
 	RawDiffPatch  RawDiffType = "patch"
 )
 
 // GetRawDiff dumps diff results of repository in given commit ID to io.Writer.
-func GetRawDiff(repo *Repository, commitID string, diffType RawDiffType, writer io.Writer) error {
-	return GetRepoRawDiffForFile(repo, "", commitID, diffType, "", writer)
-}
-
-// GetReverseRawDiff dumps the reverse diff results of repository in given commit ID to io.Writer.
-func GetReverseRawDiff(ctx context.Context, repoPath, commitID string, writer io.Writer) error {
-	stderr := new(bytes.Buffer)
-	cmd := gitcmd.NewCommand("show", "--pretty=format:revert %H%n", "-R").AddDynamicArguments(commitID)
-	if err := cmd.Run(ctx, &gitcmd.RunOpts{
-		Dir:    repoPath,
-		Stdout: writer,
-		Stderr: stderr,
-	}); err != nil {
-		return fmt.Errorf("Run: %w - %s", err, stderr)
+func GetRawDiff(repo *Repository, commitID string, diffType RawDiffType, writer io.Writer) (retErr error) {
+	cmd, err := getRepoRawDiffForFileCmd(repo.Ctx, repo, "", commitID, diffType, "")
+	if err != nil {
+		return fmt.Errorf("getRepoRawDiffForFileCmd: %w", err)
 	}
-	return nil
+	return cmd.WithStdoutCopy(writer).RunWithStderr(repo.Ctx)
 }
 
-// GetRepoRawDiffForFile dumps diff results of file in given commit ID to io.Writer according given repository
-func GetRepoRawDiffForFile(repo *Repository, startCommit, endCommit string, diffType RawDiffType, file string, writer io.Writer) error {
+// GetFileDiffCutAroundLine cuts the old or new part of the diff of a file around a specific line number
+func GetFileDiffCutAroundLine(
+	repo *Repository, startCommit, endCommit, treePath string,
+	line int64, old bool, numbersOfLine int,
+) (ret string, retErr error) {
+	cmd, err := getRepoRawDiffForFileCmd(repo.Ctx, repo, startCommit, endCommit, RawDiffNormal, treePath)
+	if err != nil {
+		return "", fmt.Errorf("getRepoRawDiffForFileCmd: %w", err)
+	}
+	stdoutReader, stdoutClose := cmd.MakeStdoutPipe()
+	defer stdoutClose()
+	cmd.WithPipelineFunc(func(ctx gitcmd.Context) error {
+		ret, err = CutDiffAroundLine(stdoutReader, line, old, numbersOfLine)
+		return err
+	})
+	return ret, cmd.RunWithStderr(repo.Ctx)
+}
+
+// getRepoRawDiffForFile returns an io.Reader for the diff results of file in given commit ID
+// and a "finish" function to wait for the git command and clean up resources after reading is done.
+func getRepoRawDiffForFileCmd(_ context.Context, repo *Repository, startCommit, endCommit string, diffType RawDiffType, file string) (*gitcmd.Command, error) {
 	commit, err := repo.GetCommit(endCommit)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	var files []string
 	if len(file) > 0 {
 		files = append(files, file)
 	}
 
-	cmd := gitcmd.NewCommand()
+	cmd := gitcmd.NewCommand().WithDir(repo.Path)
 	switch diffType {
 	case RawDiffNormal:
 		if len(startCommit) != 0 {
-			cmd.AddArguments("diff", "-M").AddDynamicArguments(startCommit, endCommit).AddDashesAndList(files...)
+			cmd.AddArguments("diff").
+				AddOptionFormat("--find-renames=%s", setting.Git.DiffRenameSimilarityThreshold).
+				AddDynamicArguments(startCommit, endCommit).AddDashesAndList(files...)
 		} else if commit.ParentCount() == 0 {
 			cmd.AddArguments("show").AddDynamicArguments(endCommit).AddDashesAndList(files...)
 		} else {
 			c, err := commit.Parent(0)
 			if err != nil {
-				return err
+				return nil, err
 			}
-			cmd.AddArguments("diff", "-M").AddDynamicArguments(c.ID.String(), endCommit).AddDashesAndList(files...)
+			cmd.AddArguments("diff").
+				AddOptionFormat("--find-renames=%s", setting.Git.DiffRenameSimilarityThreshold).
+				AddDynamicArguments(c.ID.String(), endCommit).AddDashesAndList(files...)
 		}
 	case RawDiffPatch:
 		if len(startCommit) != 0 {
@@ -80,24 +92,15 @@ func GetRepoRawDiffForFile(repo *Repository, startCommit, endCommit string, diff
 		} else {
 			c, err := commit.Parent(0)
 			if err != nil {
-				return err
+				return nil, err
 			}
 			query := fmt.Sprintf("%s...%s", endCommit, c.ID.String())
 			cmd.AddArguments("format-patch", "--no-signature", "--stdout").AddDynamicArguments(query).AddDashesAndList(files...)
 		}
 	default:
-		return fmt.Errorf("invalid diffType: %s", diffType)
+		return nil, util.NewInvalidArgumentErrorf("invalid diff type: %s", diffType)
 	}
-
-	stderr := new(bytes.Buffer)
-	if err = cmd.Run(repo.Ctx, &gitcmd.RunOpts{
-		Dir:    repo.Path,
-		Stdout: writer,
-		Stderr: stderr,
-	}); err != nil {
-		return fmt.Errorf("Run: %w - %s", err, stderr)
-	}
-	return nil
+	return cmd, nil
 }
 
 // ParseDiffHunkString parse the diff hunk content and return
@@ -234,7 +237,7 @@ func CutDiffAroundLine(originalDiff io.Reader, line int64, old bool, numbersOfLi
 		}
 	}
 	if err := scanner.Err(); err != nil {
-		return "", err
+		return "", fmt.Errorf("CutDiffAroundLine: scan: %w", err)
 	}
 
 	// No hunk found
@@ -300,43 +303,27 @@ func GetAffectedFiles(repo *Repository, branchName, oldCommitID, newCommitID str
 		}
 		oldCommitID = startCommitID
 	}
-	stdoutReader, stdoutWriter, err := os.Pipe()
-	if err != nil {
-		log.Error("Unable to create os.Pipe for %s", repo.Path)
-		return nil, err
-	}
-	defer func() {
-		_ = stdoutReader.Close()
-		_ = stdoutWriter.Close()
-	}()
 
 	affectedFiles := make([]string, 0, 32)
 
 	// Run `git diff --name-only` to get the names of the changed files
-	err = gitcmd.NewCommand("diff", "--name-only").AddDynamicArguments(oldCommitID, newCommitID).
-		Run(repo.Ctx, &gitcmd.RunOpts{
-			Env:    env,
-			Dir:    repo.Path,
-			Stdout: stdoutWriter,
-			PipelineFunc: func(ctx context.Context, cancel context.CancelFunc) error {
-				// Close the writer end of the pipe to begin processing
-				_ = stdoutWriter.Close()
-				defer func() {
-					// Close the reader on return to terminate the git command if necessary
-					_ = stdoutReader.Close()
-				}()
-				// Now scan the output from the command
-				scanner := bufio.NewScanner(stdoutReader)
-				for scanner.Scan() {
-					path := strings.TrimSpace(scanner.Text())
-					if len(path) == 0 {
-						continue
-					}
-					affectedFiles = append(affectedFiles, path)
+	cmd := gitcmd.NewCommand("diff", "--name-only").AddDynamicArguments(oldCommitID, newCommitID)
+	stdoutReader, stdoutReaderClose := cmd.MakeStdoutPipe()
+	defer stdoutReaderClose()
+	err := cmd.WithEnv(env).WithDir(repo.Path).
+		WithPipelineFunc(func(ctx gitcmd.Context) error {
+			// Now scan the output from the command
+			scanner := bufio.NewScanner(stdoutReader)
+			for scanner.Scan() {
+				path := strings.TrimSpace(scanner.Text())
+				if len(path) == 0 {
+					continue
 				}
-				return scanner.Err()
-			},
-		})
+				affectedFiles = append(affectedFiles, path)
+			}
+			return scanner.Err()
+		}).
+		Run(repo.Ctx)
 	if err != nil {
 		log.Error("Unable to get affected files for commits from %s to %s in %s: %v", oldCommitID, newCommitID, repo.Path, err)
 	}

package/gitea/source/modules/git/error.go

@@ -4,8 +4,6 @@
 package git
 
 import (
-	"context"
-	"errors"
 	"fmt"
 	"strings"
 
@@ -98,28 +96,31 @@ func (err *ErrPushRejected) Unwrap() error {
 
 // GenerateMessage generates the remote message from the stderr
 func (err *ErrPushRejected) GenerateMessage() {
-	messageBuilder := &strings.Builder{}
-	i := strings.Index(err.StdErr, "remote: ")
-	if i < 0 {
-		err.Message = ""
+	// The stderr is like this:
+	//
+	// > remote: error: push is rejected .....
+	// > To /work/gitea/tests/integration/gitea-integration-sqlite/gitea-repositories/user2/repo1.git
+	// >  ! [remote rejected] 44e67c77559211d21b630b902cdcc6ab9d4a4f51 -> develop (pre-receive hook declined)
+	// > error: failed to push some refs to '/work/gitea/tests/integration/gitea-integration-sqlite/gitea-repositories/user2/repo1.git'
+	//
+	// The local message contains sensitive information, so we only need the remote message
+	const prefixRemote = "remote: "
+	const prefixError = "error: "
+	pos := strings.Index(err.StdErr, prefixRemote)
+	if pos < 0 {
+		err.Message = "push is rejected"
 		return
 	}
-	for {
-		if len(err.StdErr) <= i+8 {
-			break
-		}
-		if err.StdErr[i:i+8] != "remote: " {
-			break
-		}
-		i += 8
-		nl := strings.IndexByte(err.StdErr[i:], '\n')
-		if nl >= 0 {
-			messageBuilder.WriteString(err.StdErr[i : i+nl+1])
-			i = i + nl + 1
-		} else {
-			messageBuilder.WriteString(err.StdErr[i:])
-			i = len(err.StdErr)
+
+	messageBuilder := &strings.Builder{}
+	lines := strings.SplitSeq(err.StdErr, "\n")
+	for line := range lines {
+		line, ok := strings.CutPrefix(line, prefixRemote)
+		if !ok {
+			continue
 		}
+		line = strings.TrimPrefix(line, prefixError)
+		messageBuilder.WriteString(strings.TrimSpace(line) + "\n")
 	}
 	err.Message = strings.TrimSpace(messageBuilder.String())
 }
@@ -140,10 +141,3 @@ func IsErrMoreThanOne(err error) bool {
 func (err *ErrMoreThanOne) Error() string {
 	return fmt.Sprintf("ErrMoreThanOne Error: %v: %s\n%s", err.Err, err.StdErr, err.StdOut)
 }
-
-func IsErrCanceledOrKilled(err error) bool {
-	// When "cancel()" a git command's context, the returned error of "Run()" could be one of them:
-	// - context.Canceled
-	// - *exec.ExitError: "signal: killed"
-	return err != nil && (errors.Is(err, context.Canceled) || err.Error() == "signal: killed")
-}