This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [gitea/gitea](https://github.com/go-gitea/gitea) | patch | `1.25.4` → `1.25.5` |
---
### Release Notes
<details>
<summary>go-gitea/gitea (gitea/gitea)</summary>
### [`v1.25.5`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1255---2026-03-10)
[Compare Source](https://github.com/go-gitea/gitea/compare/v1.25.4...v1.25.5)
- SECURITY
- Toolchain Update to Go 1.25.6 ([#​36480](https://github.com/go-gitea/gitea/issues/36480)) ([#​36487](https://github.com/go-gitea/gitea/issues/36487))
- Adjust the toolchain version ([#​36537](https://github.com/go-gitea/gitea/issues/36537)) ([#​36542](https://github.com/go-gitea/gitea/issues/36542))
- Update toolchain to 1.25.8 for v1.25 ([#​36888](https://github.com/go-gitea/gitea/issues/36888))
- Prevent redirect bypasses via backslash-encoded paths ([#​36660](https://github.com/go-gitea/gitea/issues/36660)) ([#​36716](https://github.com/go-gitea/gitea/issues/36716))
- Fix get release draft permission check ([#​36659](https://github.com/go-gitea/gitea/issues/36659)) ([#​36715](https://github.com/go-gitea/gitea/issues/36715))
- Fix a bug user could change another user's primary email ([#​36586](https://github.com/go-gitea/gitea/issues/36586)) ([#​36607](https://github.com/go-gitea/gitea/issues/36607))
- Fix OAuth2 authorization code expiry and reuse handling ([#​36797](https://github.com/go-gitea/gitea/issues/36797)) ([#​36851](https://github.com/go-gitea/gitea/issues/36851))
- Add validation constraints for repository creation fields ([#​36671](https://github.com/go-gitea/gitea/issues/36671)) ([#​36757](https://github.com/go-gitea/gitea/issues/36757))
- Fix bug to check whether user can update pull request branch or rebase branch ([#​36465](https://github.com/go-gitea/gitea/issues/36465)) ([#​36838](https://github.com/go-gitea/gitea/issues/36838))
- Add migration http transport for push/sync mirror lfs ([#​36665](https://github.com/go-gitea/gitea/issues/36665)) ([#​36691](https://github.com/go-gitea/gitea/issues/36691))
- Fix track time list permission check ([#​36662](https://github.com/go-gitea/gitea/issues/36662)) ([#​36744](https://github.com/go-gitea/gitea/issues/36744))
- Fix track time issue id ([#​36664](https://github.com/go-gitea/gitea/issues/36664)) ([#​36689](https://github.com/go-gitea/gitea/issues/36689))
- Fix path resolving ([#​36734](https://github.com/go-gitea/gitea/issues/36734)) ([#​36746](https://github.com/go-gitea/gitea/issues/36746))
- Fix dump release asset bug ([#​36799](https://github.com/go-gitea/gitea/issues/36799)) ([#​36839](https://github.com/go-gitea/gitea/issues/36839))
- Fix org permission API visibility checks for hidden members and private orgs ([#​36798](https://github.com/go-gitea/gitea/issues/36798)) ([#​36841](https://github.com/go-gitea/gitea/issues/36841))
- Fix forwarded proto handling for public URL detection ([#​36810](https://github.com/go-gitea/gitea/issues/36810)) ([#​36836](https://github.com/go-gitea/gitea/issues/36836))
- Add a git grep search timeout ([#​36809](https://github.com/go-gitea/gitea/issues/36809)) ([#​36835](https://github.com/go-gitea/gitea/issues/36835))
- Fix oauth2 s256 ([#​36462](https://github.com/go-gitea/gitea/issues/36462)) ([#​36477](https://github.com/go-gitea/gitea/issues/36477))
- ENHANCEMENTS
- Make `security-check` informational only ([#​36681](https://github.com/go-gitea/gitea/issues/36681)) ([#​36852](https://github.com/go-gitea/gitea/issues/36852))
- Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 ([#​36840](https://github.com/go-gitea/gitea/issues/36840))
- Add some validation on values provided to USER\_DISABLED\_FEATURES and EXTERNAL\_USER\_DISABLED\_FEATURES ([#​36688](https://github.com/go-gitea/gitea/issues/36688)) ([#​36692](https://github.com/go-gitea/gitea/issues/36692))
- Upgrade gogit to 5.16.5 ([#​36687](https://github.com/go-gitea/gitea/issues/36687))
- Add wrap to runner label list ([#​36565](https://github.com/go-gitea/gitea/issues/36565)) ([#​36574](https://github.com/go-gitea/gitea/issues/36574))
- Add dnf5 command for Fedora in RPM package instructions ([#​36527](https://github.com/go-gitea/gitea/issues/36527)) ([#​36572](https://github.com/go-gitea/gitea/issues/36572))
- Allow scroll propagation outside code editor ([#​36502](https://github.com/go-gitea/gitea/issues/36502)) ([#​36510](https://github.com/go-gitea/gitea/issues/36510))
- BUGFIXES
- Fix non-admins unable to automerge PRs from forks ([#​36833](https://github.com/go-gitea/gitea/issues/36833)) ([#​36843](https://github.com/go-gitea/gitea/issues/36843))
- Fix bug when pushing mirror with wiki ([#​36795](https://github.com/go-gitea/gitea/issues/36795)) ([#​36807](https://github.com/go-gitea/gitea/issues/36807))
- Fix artifacts v4 backend upload problems ([#​36805](https://github.com/go-gitea/gitea/issues/36805)) ([#​36834](https://github.com/go-gitea/gitea/issues/36834))
- Fix CRAN package version validation to allow more than 4 version components ([#​36813](https://github.com/go-gitea/gitea/issues/36813)) ([#​36821](https://github.com/go-gitea/gitea/issues/36821))
- Fix force push time-line commit comments of pull request ([#​36653](https://github.com/go-gitea/gitea/issues/36653)) ([#​36717](https://github.com/go-gitea/gitea/issues/36717))
- Fix SVG height calculation in diff viewer ([#​36748](https://github.com/go-gitea/gitea/issues/36748)) ([#​36750](https://github.com/go-gitea/gitea/issues/36750))
- Fix push time bug ([#​36693](https://github.com/go-gitea/gitea/issues/36693)) ([#​36713](https://github.com/go-gitea/gitea/issues/36713))
- Fix bug the protected branch rule name is conflicted with renamed branch name ([#​36650](https://github.com/go-gitea/gitea/issues/36650)) ([#​36661](https://github.com/go-gitea/gitea/issues/36661))
- Fix bug when do LFS GC ([#​36500](https://github.com/go-gitea/gitea/issues/36500)) ([#​36608](https://github.com/go-gitea/gitea/issues/36608))
- Fix focus lost bugs in the Monaco editor ([#​36609](https://github.com/go-gitea/gitea/issues/36609))
- Reprocess htmx content after loading more files ([#​36568](https://github.com/go-gitea/gitea/issues/36568)) ([#​36577](https://github.com/go-gitea/gitea/issues/36577))
- Fix assignee sidebar links and empty placeholder ([#​36559](https://github.com/go-gitea/gitea/issues/36559)) ([#​36563](https://github.com/go-gitea/gitea/issues/36563))
- Fix issues filter dropdown showing empty label scope section ([#​36535](https://github.com/go-gitea/gitea/issues/36535)) ([#​36544](https://github.com/go-gitea/gitea/issues/36544))
- Fix various mermaid bugs ([#​36547](https://github.com/go-gitea/gitea/issues/36547)) ([#​36552](https://github.com/go-gitea/gitea/issues/36552))
- Fix data race when uploading container blobs concurrently ([#​36524](https://github.com/go-gitea/gitea/issues/36524)) ([#​36526](https://github.com/go-gitea/gitea/issues/36526))
- Correct spacing between username and bot label ([#​36473](https://github.com/go-gitea/gitea/issues/36473)) ([#​36484](https://github.com/go-gitea/gitea/issues/36484))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My43My4xIiwidXBkYXRlZEluVmVyIjoiNDMuNzMuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
1.25.4→1.25.5Release Notes
go-gitea/gitea (gitea/gitea)
v1.25.5Compare Source
security-checkinformational only (#36681) (#36852)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.