* SECURITY

  * Double check CloneURL is acceptable (#20869) (#20892)
  * Add more checks in migration code (#21011) (#21050)
* ENHANCEMENTS
  * Fix hard-coded timeout and error panic in API archive download endpoint (#20925) (#21051)
  * Improve arc-green code theme (#21039) (#21042)
  * Enable contenthash in filename for dynamic assets (#20813) (#20932)
  * Don't open new page for ext wiki on same repository (#20725) (#20910)
  * Disable doctor logging on panic (#20847) (#20898)
  * Remove calls to load Mirrors in user.Dashboard (#20855) (#20897)
  * Update codemirror to 5.65.8 (#20875)
  * Rework repo buttons (#20602, #20718) (#20719)
* BUGFIXES
  * Ensure delete user deletes all comments (#21067) (#21068)
  * Delete unreferenced packages when deleting a package version (#20977) (#21060)
  * Redirect if user does not exist on admin pages (#20981) (#21059)
  * Set uploadpack.allowFilter etc on gitea serv to enable partial clones with ssh (#20902) (#21058)
  * Fix 500 on time in timeline API (#21052) (#21057)
  * Fill the specified ref in webhook test payload (#20961) (#21055)
  * Add another index for Action table on postgres (#21033) (#21054)
  * Fix broken insecureskipverify handling in redis connection uris (#20967) (#21053)
  * Add Dev, Peer and Optional dependencies to npm PackageMetadataVersion (#21017) (#21044)
  * Do not add links to Posters or Assignees with ID < 0 (#20577) (#21037)
  * Fix modified due date message (#20388) (#21032)
  * Fix missed sort bug (#21006)
  * Fix input.value attr for RequiredClaimName/Value (#20946) (#21001)
  * Change review buttons to icons to make space for text (#20934) (#20978)
  * Fix download archiver of a commit (#20962) (#20971)
  * Return 404 NotFound if requested attachment does not exist (#20886) (#20941)
  * Set no-tags in git fetch on compare (#20893) (#20936)
  * Allow multiple metadata files for Maven packages (#20674) (#20916)
  * Increase Content field size of gpg_key and public_key to MEDIUMTEXT (#20896) (#20911)
  * Fix mirror address setting not working (#20850) (#20904)
  * Fix push mirror address backend get error Address cause setting page display error (#20593) (#20901)
  * Fix panic when an invalid oauth2 name is passed (#20820) (#20900)
  * In PushMirrorsIterate and MirrorsIterate if limit is negative do not set it (#20837) (#20899)
  * Ensure that graceful start-up is informed of unused SSH listener (#20877) (#20888)
  * Pad GPG Key ID with preceding zeroes (#20878) (#20885)
  * Fix SQL Query for `SearchTeam` (#20844) (#20872)
  * Fix the mode of custom dir to 0700 in docker-rootless (#20861) (#20867)
  * Fix UI mis-align for PR commit history (#20845) (#20859)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEtW48dDeknhNoYvXenYpXraojLpUFAmMXvO4ACgkQnYpXraoj
LpWyPxAAnUIMO3gYkgL1pV3mAioHvWmbSe4EZZ5R8LQ3qwNaTWzYH9398SNx4p9b
JyLmjLOeOxp8ZYxb200DaRGRimppQQzbavD1lXyz0MhDB76KUkvJxTXGlv3QreAf
WUE9n8ZEvJvuc/NOM2gBuR6dqwUbQJMydHu+KlVjQ5rd5OfYwLY8nxCOQczDtv++
7FW0qziVe9b3y4HqgzikYelmiX9BInGEyEmSNWmPLGTq2MYChjfhA+uVJuS5AzmM
A3JhMWlgGX9bLh53bqEks320cQrnbXB+TpbnpqtVcfhLWuwmvPnWiwOTjaG/o5A7
dUyG1ccsCwlqRQHRGyd7b6v8mFRTdfqC14NcX+wlh5rddhTn8nk8be8W/Qz24lhd
AhYSQBQBIX5wb+rewxSVlVnKxJXcQEqz8RMizvzAfQPuOP3lgiaVpMjiK7J/0kYE
XN0d1dFLnaNAPErxe7Ef+6wciFWzJDib0RDDfFazyQ3CJ+uVjM+pYIuCz0v9lV26
dUGJ+lJfrFc2C/gv5Z+YBzr7MEaXrvRzAYXo9tHRbEd+NZOID4UDW0mISt8EC9ZA
CXTQdxarssC+I9Vw1h/8wTt6QVwCyxwdawhjGZCs1a7I9Y9N3KtbzCYQpCIuZi3V
PbAO/jex7l2z5OzKUABL5IGu/9RY4ibKk7q5bQYZNPVzg8xwPJY=
=WWMb
-----END PGP SIGNATURE-----