* SECURITY * Double check CloneURL is acceptable (#20869) (#20892) * Add more checks in migration code (#21011) (#21050) * ENHANCEMENTS * Fix hard-coded timeout and error panic in API archive download endpoint (#20925) (#21051) * Improve arc-green code theme (#21039) (#21042) * Enable contenthash in filename for dynamic assets (#20813) (#20932) * Don't open new page for ext wiki on same repository (#20725) (#20910) * Disable doctor logging on panic (#20847) (#20898) * Remove calls to load Mirrors in user.Dashboard (#20855) (#20897) * Update codemirror to 5.65.8 (#20875) * Rework repo buttons (#20602, #20718) (#20719) * BUGFIXES * Ensure delete user deletes all comments (#21067) (#21068) * Delete unreferenced packages when deleting a package version (#20977) (#21060) * Redirect if user does not exist on admin pages (#20981) (#21059) * Set uploadpack.allowFilter etc on gitea serv to enable partial clones with ssh (#20902) (#21058) * Fix 500 on time in timeline API (#21052) (#21057) * Fill the specified ref in webhook test payload (#20961) (#21055) * Add another index for Action table on postgres (#21033) (#21054) * Fix broken insecureskipverify handling in redis connection uris (#20967) (#21053) * Add Dev, Peer and Optional dependencies to npm PackageMetadataVersion (#21017) (#21044) * Do not add links to Posters or Assignees with ID < 0 (#20577) (#21037) * Fix modified due date message (#20388) (#21032) * Fix missed sort bug (#21006) * Fix input.value attr for RequiredClaimName/Value (#20946) (#21001) * Change review buttons to icons to make space for text (#20934) (#20978) * Fix download archiver of a commit (#20962) (#20971) * Return 404 NotFound if requested attachment does not exist (#20886) (#20941) * Set no-tags in git fetch on compare (#20893) (#20936) * Allow multiple metadata files for Maven packages (#20674) (#20916) * Increase Content field size of gpg_key and public_key to MEDIUMTEXT (#20896) (#20911) * Fix mirror address setting not working (#20850) (#20904) * Fix push mirror address backend get error Address cause setting page display error (#20593) (#20901) * Fix panic when an invalid oauth2 name is passed (#20820) (#20900) * In PushMirrorsIterate and MirrorsIterate if limit is negative do not set it (#20837) (#20899) * Ensure that graceful start-up is informed of unused SSH listener (#20877) (#20888) * Pad GPG Key ID with preceding zeroes (#20878) (#20885) * Fix SQL Query for `SearchTeam` (#20844) (#20872) * Fix the mode of custom dir to 0700 in docker-rootless (#20861) (#20867) * Fix UI mis-align for PR commit history (#20845) (#20859)