chore(deps): update container image vikunja/vikunja to v2.5.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
vikunja/vikunja	major	0.24.6 → 2.5.0

---

Release Notes

go-vikunja/vikunja (vikunja/vikunja)

v2.5.0

Compare Source

Bug Fixes

• (api tokens) Guard GetTokenFromTokenString against short token strings
• (api/v2) Strip internal error detail in NewError, not NewErrorWithContext
• (api/v2) Stop leaking the healthcheck cause to unauthenticated callers
• (api/v2) Validate slice-of-struct body fields at the boundary
• (auth) Use configured bcrypt rounds everywhere
• (auth) Gate the v2 login route on local or ldap auth being enabled
• (avatar) Bounds-check size before narrowing int64 to int
• (caldav) Close username enumeration oracle in basic auth (#​3349)
• (caldav) Answer PROPPATCH with 207/403 instead of a blanket 501 (#​3364)
• (caldav) Return 404 for principal sub-paths and foreign usernames (#​3371)
• (caldav) Remove double trailing slash from current-user-principal href
• (caldav) Don't wipe fields the parser doesn't understand on update
• (caldav) Anchor RELATED=END alarm triggers on due date when the task has one
• (caldav) Report completion status from Done instead of done_at
• (caldav) Stop corrupting percent signs in REPORT responses
• (ci) Tag preview images with the PR head sha
• (ci) Describe PR head instead of base branch for preview version
• (ci) Replace retired GitHub Models inference in auto-label workflow (#​3415)
• (ci) Pin LLM-action to fork with reasoning model support
• (config) Apply deprecated service.jwtsecret to service.secret
• (db) Ping the database on connect so failures report the real error
• (desktop) Coordinate token refresh across renderer windows
• (desktop) Create quick-entry window lazily
• (dump) Parse dumped time strings so restore works on MySQL and MariaDB
• (dump) Skip directory entries in dump zip when restoring
• (dump) Reuse single stdin reader for all restore prompts
• (filter) Don't rewrite in/not in/like inside quoted values
• (filters) Skip saved filters owned by disabled users
• (filters) Don't let one filter fail the whole filter view maintenance
• (frontend) Route to not-found on forbidden task instead of blank shell
• (frontend) Don't reload page on first service worker install
• (frontend) Force rel=noopener on links in project descriptions
• (gravatar) Route avatar requests through the SSRF-safe http client
• (labels) Allow attaching labels via inherited child-project access (#​3374)
• (license) Refuse redirects and use the SSRF-safe http client for checks
• (mage) Scaffold new migrations with partialSync
• (migration) Seed task positions for exports without order information
• (migration) Stop existing-table struct syncs from dropping indexes
• (migration) Recreate indexes dropped by partial-struct sync migrations
• (migration) Detect sqlite indexes created with lowercase SQL (#​3354)
• (migration) Prevent stack overflow on ticktick parentId cycles
• (migration) Abort import on unexpected task creation error
• (migration) Repair kanban views without a bucket configuration mode
• (migration/csv) Cap CSV import buffer to the configured upload limit
• (models) Use ILIKE for the team search count query
• (models) Write back dates rescheduled by repeat logic under restricted column updates
• (notifications) Deliver task deleted notifications again
• (notifications) Don't notify subscribers who lost access to the entity
• (notifications) Check project access when reading notifications
• (notifications) Require a persisted notification to declare its project
• (notifications) Delete stored notifications of unknown types
• (oauth2) Burn authorization code even when validation fails (#​3350)
• (openid) Stop logging raw token-endpoint response bodies
• (packaging) Return ENOSYS instead of SIGSYS for filtered syscalls
• (packaging) Stop masking filesystem paths in the systemd unit (#​3306)
• (plugins) Regenerate stale yaegi symbol tables
• (projects) Don't report database errors as a missing project
• (ratelimit) Don't panic on unauthenticated requests
• (ratelimit) Key by ip when the configured kind is unknown
• (security) Rate limit the websocket upgrade endpoint (#​3348)
• (security) Return the negated user id from LinkSharing.GetID
• (security) Reject link shares at team, bot and webhook permission checks
• (security) Reject link shares in Webhook.ReadAll
• (security) Reject non-user tokens in GetUserFromClaims
• (subscriptions) Declare subscription entity as string enum in v2 OpenAPI schema
• (subscriptions) Marshal unknown subscription entity type as null
• (unsplash) Route api requests through the SSRF-safe http client
• (views) Seed and maintain kanban buckets when a view's kind changes
• (views) Preselect manual bucket mode in the view edit form
• (views) Drop deleted bucket from view state after deleting it
• (web) Stop logging the full auth object on permission denials
• (webhooks) Bound the error response body read
• Shadow embedded CRUDable Update method on LinkSharing (c580d51)
• Shadow embedded CRUDable ReadAll method on SavedFilter (6f65621)
• Embed user.User by value in AdminUser (4cc647b)
• Embed LinkSharing by value in LinkShareToken (b8492a0)
• Always serialize parent_project_id for pseudo-projects (2e0cd81)
• Avoid panic on null jwt claim values (ccba2e4)
• Report the real link share id in saved filter errors (ed8dc89)

Dependencies

• (deps) Update postgres:18 docker digest to 3a82e1f
• (deps) Update dev-dependencies
• (deps) Update actions/checkout action to v7.0.1
• (deps) Update danielroe/provenance-action digest to 8ecbdd2
• (deps) Update pnpm to v11.14.0
• (deps) Update module github.com/prometheus/client_golang to v1.24.0
• (deps) Update module github.com/labstack/echo/v5 to v5.3.1
• (deps) Update danielroe/provenance-action digest to fcc45fd
• (deps) Update pnpm to v11.15.0
• (deps) Update aws-sdk-go-v2 monorepo
• (deps) Update dependency happy-dom to v20.11.0
• (deps) Update dependency postcss to v8.5.20
• (deps) Update pnpm to v11.15.1
• (deps) Update dependency vue-i18n to v11.4.7
• (deps) Update dependency undici@​7 to v8.8.0
• (deps) Update docker/login-action action to v4.5.0
• (deps) Update module github.com/ganigeorgiev/fexpr to v0.6.0
• (deps) Update dependency marked to v18.0.7
• (deps) Update dependency undici@​6 to v8.8.0
• (deps) Update crowdin/github-action action to v2.17.0
• (deps) Update module github.com/gabriel-vasile/mimetype to v1.4.15
• (deps) Update docker/login-action action to v4.5.1
• (deps) Update dependency js-yaml to v5.2.2 [security]
• (deps) Update dependency js-yaml@​4 to v5.2.2 [security]
• (deps) Update dependency @​sentry/vue to v10.67.0
• (deps) Update module github.com/prometheus/client_golang to v1.24.1
• (deps) Update dependency tar to v7.5.21
• (deps) Update dependency @​fortawesome/vue-fontawesome to v3.3.3
• (deps) Update dependency flatted to v3.4.3
• (deps) Update dependency postcss to v8.5.22
• (deps) Update pnpm to v11.16.0
• (deps) Update pnpm to v11.17.0
• (deps) Lock file maintenance
• (deps) Update danielroe/provenance-action digest to b793421
• (deps) Update dependency @​sentry/vue to v10.68.0
• (deps) Update dependency undici@​7 to v8.9.0
• (deps) Update dependency postcss to v8.5.23
• (deps) Update tiptap to v3.29.0
• (deps) Update module github.com/aws/smithy-go to v1.27.5
• (deps) Update dependency tar to v7.5.22
• (deps) Update module github.com/yuin/goldmark to v1.8.5
• (deps) Update playwright to v1.62.0
• (deps) Update dependency undici@​6 to v8.9.0
• (deps) Update dependency ip-address to v10.2.2
• (deps) Update danielroe/provenance-action digest to ec1767b
• (deps) Update actions/stale action to v11
• (deps) Update dependency basic-ftp to v6.0.2
• (deps) Update dependency ip-address to v10.3.1
• (deps) Update dependency vite-plugin-vue-devtools to v8.2.1
• (deps) Update docker/login-action action to v4.5.2
• (deps) Update docker/login-action action to v4.6.0
• (deps) Update dependency vue-i18n to v11.4.8
• (deps) Update module github.com/mattn/go-sqlite3 to v1.14.49
• (deps) Update module github.com/aws/smithy-go to v1.27.6
• (deps) Update dependency postcss to v8.5.25
• (deps) Update node.js to v24.18.1
• (deps) Update dependency minimatch to v10.2.6
• (deps) Update tiptap to v3.29.2
• (deps) Update dependency rollup to v4.62.3
• (deps) Update pnpm to v11.18.0
• (deps) Update dependency @​sentry/vue to v10.69.0
• (deps) Update dependency axios to v1.19.0
• (deps) Update vueuse to v14.4.0
• (deps) Update dependency flatted to v3.4.4
• (deps) Update dependency markdown-it to v15
• (deps) Update pnpm/action-setup action to v6.0.10
• (deps) Update pnpm to v11.19.0
• (deps) Update danielroe/provenance-action digest to 193227b
• (deps) Update dependency ip-address to v10.4.0
• (deps) Update playwright to v1.62.1
• (deps) Update module github.com/danielgtaylor/huma/v2 to v2.39.1
• (deps) Update node.js to v24.19.0
• (deps) Update dependency js-yaml@​4 to v5.2.3
• (deps) Update dependency js-yaml to v5.2.3
• (deps) Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.106.4
• (deps) Update module github.com/redis/go-redis/v9 to v9.22.0
• (deps) Update dependency rollup to v4.62.4

Documentation

• (agents) Explicit mention of no raw sql [skip ci]
• (skill) Ban plain tx.Sync on existing tables in the migration skill
• Update readme with LLM disclosure, update sponsors [skip ci] (7f7d61f)

Features

• (api/v2) Add bulk task creation endpoint
• (audit) Audit full personal data export requests
• (desktop) Add a Content Security Policy to the app window (#​3351)
• (dev) Add paseo config
• (mage) Add generate:yaegi-symbols and check:yaegi-symbols targets
• (tasks) Calculate top-of-view positions per batch
• (tasks) Generalize task creation to batches
• (tasks) Add BulkTaskCreation model
• (tasks) Update saved-filter views once per creation batch
• (tasks) Add bulk creation to the task service
• (tasks) Add bulk quick-add creation to the task store
• (tasks) Create quick-add tasks through the bulk endpoint

Miscellaneous Tasks

• (i18n) Update translations via Crowdin
• Cleanup dead code (1e081d3)

Other

• (lint) Forbid plain Sync in migrations via forbidigo
• (other) Drop unused contents: write from generate-swagger-docs
• (other) [skip ci] Updated swagger docs
• (other) Auto-regenerate yaegi symbols alongside swagger docs
• (other) [skip ci] Updated yaegi symbols

Performance

• (tasks) Index task_positions on (project_view_id, position)

Refactor

• (projects) Resolve read permissions for many projects at once
• Drop redundant link share branch in comment permissions (d545e3b)

Testing

• (api-tokens) Match permission checkbox name exactly
• (e2e) Cover multiline creation order and subtasks
• (models) Restore notification faking after user delete tests
• (ratelimit) Assert exact statuses instead of absence of 500
• Guard schema-link creation for all v2 response types (f02df25)
• Guard parent_project_id in project responses (aa62c00)
• Cover link share principal confusion at the HTTP layer (2b1558e)
• Assert link share attachments are not attributed to a colliding user (4b35f5d)

v2.4.0

Compare Source

Bug Fixes

• (a11y) Make list view task links keyboard focusable and openable with Enter
• (a11y) Show a visible focus ring on checkboxes and other focusable controls
• (a11y) Make task title keyboard editable
• (a11y) Pick label text color by actual WCAG contrast ratio
• (a11y) Fix light theme contrast of success and danger text
• (a11y) Make kanban cards reachable and openable by keyboard
• (a11y) Show a keyboard-only focus ring on text inputs and editable titles
• (a11y) Move focus to main content when the skip link is activated
• (a11y) Add accessible names to all icon-only buttons
• (a11y) Login tab order, announced errors, combobox pattern, named dialogs and selects (#​3228)
• (a11y) Expose expanded, sort, result-count and toggle states to assistive technology
• (a11y) Contrast tokens, empty-title feedback, structure and landmarks (#​3234)
• (a11y) Render the kanban bucket footer as a list item
• (a11y) Un-nest the attachment rows
• (a11y) Keep the auth hero heading readable with a gradient scrim
• (a11y) Label the bucket selector with its purpose and current bucket
• (a11y) Announce comment and attachment counts on task cards and rows
• (a11y) Make the editor toolbar a single tab stop with roving focus
• (admin) Reload created user before returning in admin create handler
• (ai) Correct snake_case in json instructions
• (api) Uppercase project identifier before by-index lookup
• (api) Close the user data export reader after download
• (api) Export api-token permission groups in snake_case
• (api) Return 200 instead of 500 when listing attachments on a task with none
• (api) Derive API-token ownership from a verified user principal (GHSA-vvcv-vpph-h844)
• (api) Reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)
• (api/docs) Make redoc load docs.json from public URL
• (api/docs) Use Base in redoc template
• (api/v2) Publish OpenAPI Servers and make schemas publicly fetchable
• (api/v2) Return generic 401 instead of leaking internal auth error
• (api/v2) Don't leak internal error detail in 5xx responses
• (api/v2) Dedupe BucketConfigurationMode enum tag
• (api/v2) Guard against nil bucket configuration elements
• (api/v2) Scope project view delete to its parent project
• (api/v2) Apply rate limit before the admin gate
• (api/v2) Accept real image content-types on avatar upload
• (api/v2) Align avatar upload body limit with global overhead
• (api/v2) Reject non-decodable images (e.g. SVG) on avatar upload with 400
• (api/v2) Keep include_public out of the team body schema
• (api/v2) Omit project max_permission (null) when not expanded
• (api/v2) Drop ETag/conditional read on project get
• (api/v2) Map ValidationHTTPError to its HTTP status
• (api/v2) Return 200 from notifications mark-all (creates nothing)
• (api/v2) Group time-entries token routes under their own scope
• (api/v2) Expose v2-only token route groups via the routes endpoint
• (api/v2) Return ErrProjectDoesNotExist for unknown project identifiers
• (api/v2) Gate /register at registration time, not per request
• (api/v2) Close export reader when commit fails before streaming
• (assignees) Resolve 500 error when reading task assignees
• (assignees) Use db.ILIKE helper for assignee search count query
• (attachments) Keep blob mime type so pdf previews open inline (#​3157)
• (audit) Handle reopen failure after a failed rotation
• (audit) Only attribute the logout event to user tokens
• (auth) Tolerate string booleans in oidc provider config (#​2599)
• (auth) Make refresh token path respect to public URL
• (auth) Cleanup getRefreshTokenCookiePath implementation
• (auth) Don't panic on /token/test with API token
• (auth) Remove stale OIDC callback lock
• (auth) Roll back on commit failure in DeleteSession
• (auth) Return ErrAccountLocked for locked accounts on login
• (auth) Build OIDC end-session URL with RP-Initiated Logout params (#​2943)
• (auth) Preserve desktop authorize URL when not signed in (#​2944)
• (auth) Link OIDC username fallback on preferred_username, not just sub (#​2945)
• (auth) Dedupe and retry token refresh to prevent spurious logouts (#​2948)
• (auth) Allow api tokens to access global v2 task list endpoint
• (auth) Use binddn as group sync dn instead of userbind
• (auth) Require verified email before OIDC email-fallback account linking (GHSA-xv7q-fvmc-jx96)
• (auth) Reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)
• (caldav) Return 404 when trying to access a project that cannot exist with CalDAV (#​2796)
• (caldav) Store markdown descriptions as HTML, skip spurious updates
• (caldav) Compute VTODO DURATION components correctly (#​3155)
• (caldav) Parse ISO 8601 week durations in reminder triggers (#​3183)
• (ci) Skip interactive prompt in nixpkgs update workflow
• (ci) Use working model
• (ci) Don’t close issue directly
• (ci) Add mage aliases for pacakge releases
• (ci) Configure gpg loopback pinentry for reprepro signing
• (ci) Sign APT Release files manually instead of via reprepro gpgme
• (ci) Install makepkg for repo-add utility scripts
• (ci) Rename .archlinux files to .pkg.tar.zst for repo-add
• (ci) Add debug step to list incoming package files
• (ci) Add deeper debug for archlinux/pacman package contents
• (ci) Install libarchive-tools for repo-add bsdtar dependency
• (ci) Set RELEASE_VERSION to avoid git dependency in containers
• (ci) Add libc6-compat for Alpine, fix S3 upload glob, add debug
• (ci) Inline APK repo generation to avoid glibc binary on Alpine
• (ci) Skip desktop .apk in APK repo, not a valid Alpine package
• (ci) Revert S3 glob to */ and clean up directories before upload
• (ci) Update s3-action to skip directories during upload
• (ci) Pin s3-action to main branch
• (ci) Exclude package files from repo metadata upload
• (ci) Write GPG key directly to file instead of importing and exporting
• (ci) Resolve symlinks before upload instead of deleting them
• (ci) Commit newly added Crowdin translation files
• (ci) Escape ${{ secrets.* }} mention in release-binaries description
• (ci) Switch release composite actions to unstable on non-tag builds
• (ci) Drop "./" from PACKAGE_OUTPUT_DIR so strip-path-prefix matches
• (ci) Generate config.yml.sample in release-os-package for vikunja
• (ci) Copy pnpm-workspace.yaml into Docker frontend build
• (cli) Guard last admin on scheduled CLI deletion path
• (cli) Drain the mail queue before user commands exit
• (comments) Even padding around comment message
• (db) Interpolate table identifiers in truncate instead of binding them
• (desktop) Rebuild tray menu in place instead of recreating the Tray
• (desktop) Support Ctrl and mouse-wheel zoom shortcuts
• (desktop) Drop redundant zoom clamp
• (desktop) Show tray icon in packaged builds
• (desktop) Quit on SIGTERM and SIGINT
• (desktop) Show hidden window when relaunched from tray
• (desktop) Set the main window icon on Linux
• (desktop) Register vikunja-desktop:// scheme handler for AppImage (#​3203)
• (docker) Make /tmp world-writable so exports work under any UID
• (editor) Render floating popups inside the task dialog (Kanban popup)
• (editor) Render link prompt inside the task dialog so it works in the Kanban popup (#​2940)
• (editor) Make link prompt a sub-modal — Escape cancels it without closing the task dialog
• (events) Build event doers without re-fetching the user
• (events) Handle nil auth when building event doers
• (export) Treat a missing export meta row as no export in the status
• (files) Never cache file downloads in v1 or v2
• (filter) Accept non-zero-padded dates in task filters
• (filters) Resolve relative and absolute date filters in UTC (#​3181) 🤖🤖🤖 (#​3229)
• (frontend) Render editor popups inside modal dialog top-layer
• (frontend) Guard caldav and totp settings routes when disabled
• (frontend) Guard Object.keys against null in refactored helpers
• (frontend) Restore tablet pagination layout (space-between + flex order)
• (frontend) Make sw.ts respect to frontend base URL
• (frontend) Fix hard-coded API base in checkAndSetApiUrl.ts
• (frontend) Use import.meta.env.MODE instead of DEV for testid directive
• (frontend) Respect week_start setting when language is not explicitly set
• (frontend) Add postcss-html as explicit devDependency
• (frontend) Focus quick actions input after modal opens
• (frontend) Respect user's 12h/24h time format in date pickers
• (frontend) Extend checkbox hit target to 44x44
• (frontend) Skip task detail on label and checkbox clicks
• (frontend) Scope checkbox hit-area pseudo to the task row
• (frontend) Ensure text color inherits in filter autocomplete component
• (frontend) Prevent avatar layout shift while loading
• (frontend) Wrap notifications in Teleport to appear above modals for #​2744
• (frontend) Fix buttons alignments in rtl direction
• (frontend) Restore quick actions menu styling and height limit
• (frontend) Auto-refresh relative dates as time passes
• (frontend) Scroll tall default modals instead of clipping their top
• (frontend) Zero seconds on api token custom expiry date
• (frontend/kanban) Honor server bucket redirect on drag (#​2618)
• (frontend/oidc) Prefix frontend base to redirect URL
• (frontend/vite) Configure vite dev proxy to handle frontend path
• (gantt) Preserve horizontal scroll when focusing a task bar
• (kanban) Prevent task taps from leaking through the sticky add-task footer on touch devices
• (kanban) Count tasks in bucket, not filter total, for saved-filter bucket limits
• (kanban) Upsert race condition in kanban task bucket sync (#​2938)
• (kanban) Authorize body task_id when moving a task into a bucket (GHSA-5pg6-m483-7vrg)
• (kanban) Prevent cross-tenant bucket relocation via project_view_id mass-assignment (GHSA-569v-q83c-3j3g)
• (kanban) Pin link-share task collection view to the share's project (GHSA-rj9j-8772-4h6c)
• (keyvalue) Treat undecodable cached values as a cache miss
• (labels) Report owner-level max_permission
• (labels) Explain why link-share users can't create labels (#​3233)
• (license) Degrade to free when servers unreachable or key rejected
• (link-sharing) Resolve share read permission via project id so by-id reads work
• (migration) Reuse existing labels on re-import
• (migration) Tolerate non-numeric values in TickTick CSV exports
• (migration) Don't drop TickTick tasks sharing a malformed id
• (migration) Fail loudly if a deduplicated position pair has no row
• (modal) Open dialog reliably in electron desktop
• (modal) Clear stale data-closing flag when re-opened mid-close
• (modal) Skip showModal if enabled flipped false before mount
• (modal) Print full content of modal dialogs
• (models) Allow user-delete cascade to complete for disabled creators
• (models) Make API tokens work on /api/v2 routes
• (models) Validate API token permissions against v1+v2 route union
• (notifications) Pass lang to overdue reminder translation
• (notifications) Skip logo attachment for conversational mails
• (notifications) Strip remote images from notification emails
• (notifications) Refresh embedded users when reading notifications
• (notifications) Log unexpected user refresh failures
• (notifications) Use full user so notifications show display name
• (notifications) Queue mails only after the notification row is committed (#​3150)
• (notifications) Render Markdown in plain-text emails (#​3219)
• (oauth2server) Accept all loopback redirect forms
• (postgres) Resolve all statements against the configured schema (#​3156)
• (print) Hide bucket select icon
• (print) Hide description editor when no description is present
• (print) Hide reaction create button
• (project) Replace CAST(... AS int) with CASE WHEN for MySQL 8 compat
• (projects) Enforce write permission on target parent when duplicating a project (GHSA-f27p-pw2p-9pr4)
• (quick-add) Don't abort task creation when a label can't be created (#​3232)
• (relations) Correctly position quick add magic hint (#​2766)
• (routes) Set Cache-Control: no-store on /api/v2 too
• (routes) Apply rate-limit and metrics middleware to /api/v2
• (routes) Generate request IDs at the start of the middleware chain
• (search) Mirror ParadeDB BM25 matching into the subtask parent search condition
• (security) Clear plaintext user tokens for reset/confirm/deletion (GHSA-r6w9-259g-gwrv)
• (security) Hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)
• (security) Require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)
• (security) Reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)
• (static) Correct the API_URL value to replace in index.html
• (task) Print styles
• (task) Don't drop the list-view done save during the check animation
• (task) Recurring tasks return to original bucket when no default is set (#​2806)
• (task-comments) Derive update event doer from authenticated user
• (tasks) Let getCommentUrl handle frontendUrl including sub-path
• (tasks) Disable task glance tooltip on touch devices
• (tasks) Prevent duplicate task_positions rows and stale identifiers
• (tasks) Add labels sequentially when the backend db serializes writes
• (tasks) Reset description checklist when a recurring task recurs (#​2941)
• (tasks) Show filter-matched subtasks whose parent is filtered out (#​2952)
• (tasks) Prevent position race conditions with atomic upserts and locking (#​3098)
• (tasks) Bump project and task updated times when task sub-entities change
• (tasks) Make subtask root condition NULL-safe and search-aware (#​3197)
• (time-tracking) Reject inverted time-entry intervals
• (time-tracking) Cap smart-fill start at now so the range is never inverted
• (tooltip) Show tooltips in top layer when inside modal dialog
• (ui) Make code element background dark-mode aware and harden config store
• (user) Skip last-admin guard when target is already unreachable
• (user) Correct week_start validation range
• (user) Stop double-encoding FrontendSettings on UpdateUser (#​2793)
• (veans) Preserve unsent task fields on update via PATCH (#​2962)
• (views) Persist list/table sort across sidebar navigation (#​2778)
• (webhook) Use same casing for basic auth fields (#​2688)
• Fatal with clear message when keyvalue type is redis but redis is not enabled (85cfadc)
• Prevent package postinstall hang when generating jwt secret (9456223)
• Respect allow_icon_changes config on web and desktop (fb6f16a)
• Dispatch pending events after user creation commits (b867109)
• Blur quick add input on escape (5edc7b5)
• Don't re-login after logout when OIDC auto-redirect is enabled (e25ca7a)
• Use correct type for permission error (e1afa03)
• Adapt to sentry-go v0.47 API changes (c7413a1)
• Resolve golangci-lint v2.12 findings (93f8808)
• GCS signing issue (#​2920) (7ae80c0)
• Create saved filter positions before the fetch query (#​3084) (f11c90c)
• Assign bot-created projects to the bot's owner (61d74ee)
• Embed frontend assets with names starting with _ or . (568b367)
• Dispatch pending events in admin handlers (39bbf8d)
• Only audit denied admin access for confirmed non-admins (7217604)
• Use correct label for imported tasks 'project' (d8b4b49)
• Hide license-gated routes from api token scope list (#​3216) (e2c09d5)
• Interpolate dynamic values into translated error toasts (f388015)
• Disable echo group 404 auto-registration to keep pre-5.3.0 routing behavior (f76e405)

Dependencies

• (deps) Bump axios from 1.13.5 to 1.15.0 in /frontend
• (deps) Update dependency wait-on to v9.0.5
• (deps) Update dependency stylelint to v17.7.0
• (deps) Update dev-dependencies
• (deps) Patch follow-redirects and basic-ftp security vulnerabilities
• (deps) Update dependency stylelint to v17.8.0
• (deps) Update dependency postcss to v8.5.10
• (deps) Update dependency electron to v40.9.1
• (deps) Bump dompurify from 3.3.2 to 3.4.0 in /frontend
• (deps) Update dev-dependencies to v8.59.0
• (deps) Update dev-dependencies to v4.2.3
• (deps) Pin dependency otplib to 12.0.1
• (deps) Update dependency caniuse-lite to v1.0.30001790
• (deps) Bump github.com/Azure/go-ntlmssp
• (deps) Bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0
• (deps) Bump workbox-precaching to 7.4.1 to match workbox-cli
• (deps) Bump axios from 1.15.0 to 1.15.2 in /frontend
• (deps) Update dependency vite to v7.3.3
• (deps) Update dev-dependencies to v4.3.0
• (deps) Group node and pnpm updates across mise and version files
• (deps) Update dependency caniuse-lite to v1.0.30001793
• (deps) Bump brace-expansion from 5.0.5 to 5.0.6 in /frontend
• (deps) Update dependency vue-tsc to v3.3.0
• (deps) Update dev-dependencies to v8.59.4
• (deps) Bump @​babel/plugin-transform-modules-systemjs to 7.29.4
• (deps) Bump fast-uri to 3.1.2
• (deps) Bump ip-address to 10.2.0
• (deps) Bump postcss to >=8.5.10 to fix XSS via unescaped </style>
• (deps) Bump @​xmldom/xmldom to 0.8.13
• (deps) Bump js-cookie from 3.0.5 to 3.0.7 in /frontend
• (deps) Bump tmp to >=0.2.6 to fix path traversal vulnerability
• (deps) Bump qs to 6.15.2 in desktop
• (deps) Bump ip-address to >=10.1.1 in desktop workspace
• (deps) Bump axios from 1.15.2 to 1.16.0 in /frontend
• (deps) Update dependency vue-tsc to v3.3.3
• (deps) Add huma/v2 and align transitive deps
• (deps) Update dev-dependencies to v8.60.1
• (deps) Update dev-dependencies to v10.9.2
• (deps) Update dev-dependencies to v26.14.0
• (deps) Update devenv
• (deps) Update dev-dependencies to v8.61.0
• (deps) Update dev-dependencies to v40.10.3
• (deps) Update shell-quote to 1.8.4
• (deps) Bump tmp to >=0.2.7 to fix path traversal advisory
• (deps) Force esbuild >=0.28.1 to fix transitive advisories
• (deps) Bump dompurify to 3.4.9 to fix XSS advisories
• (deps) Force form-data >=4.0.6 to fix unsafe boundary advisory
• (deps) Tighten tar override to >=7.5.16
• (deps) Force markdown-it >=14.2.0 to fix ReDoS advisory
• (deps) Force launch-editor >=2.14.1
• (deps) Force @​babel/core >=7.29.6
• (deps) Bump js-yaml to >=4.2.0 where possible
• (deps) Update dev-dependencies to v10.5.0
• (deps) Update dev-dependencies to v20.10.6
• (deps) Bump dompurify from 3.4.9 to 3.4.11 in /frontend
• (deps) Update dev-dependencies to v4.62.1
• (deps) Update dev-dependencies to v4.62.2
• (deps) Bump desktop undici to patched versions
• (deps) Pin dependencies
• (deps) Update docker/dockerfile:1 docker digest to 87999aa
• (deps) Update tiptap to v3.27.1
• (deps) Update actions/cache action to v6
• (deps) Update ghcr.io/techknowlogick/xgo:go-1.25.x docker digest to 57c6285
• (deps) Update postgres:18 docker digest to 4aabea7
• (deps) Update node.js to cd6fb7e
• (deps) Update actions/checkout action to v7
• (deps) Update dependency @​floating-ui/dom to v1.7.6
• (deps) Update dependency dayjs to v1.11.21
• (deps) Update dependency marked to v17.0.6
• (deps) Update dependency sortablejs to v1.15.7
• (deps) Update dependency nanoid to v5.1.16
• (deps) Update dependency ufo to v1.6.4
• (deps) Update module github.com/arran4/golang-ical to v0.3.5
• (deps) Update module github.com/coder/websocket to v1.8.15
• (deps) Update module github.com/go-ldap/ldap/v3 to v3.4.13
• (deps) Update actions/ai-inference action to v2.1.1
• (deps) Update module github.com/golang-jwt/jwt/v5 to v5.3.1
• (deps) Update module github.com/labstack/echo-jwt/v5 to v5.0.1
• (deps) Update module github.com/olekukonko/tablewriter to v1.1.4
• (deps) Update module github.com/sahilm/fuzzy to v0.1.3
• (deps) Update node.js to v24.18.0
• (deps) Update playwright to v1.61.1
• (deps) Update dependency @​intlify/unplugin-vue-i18n to v11.2.4
• (deps) Update go to 1.26.4 in all places
• (deps) Update dependency vue to v3.5.39
• (deps) Update module github.com/threedotslabs/watermill to v1.5.2
• (deps) Update module github.com/wneessen/go-mail to v0.7.3
• (deps) Update aws-sdk-go-v2 monorepo
• (deps) Update dependency axios to v1.18.1
• (deps) Update pnpm to v10.34.4
• (deps) Update module github.com/mattn/go-sqlite3 to v1.14.47
• (deps) Update module github.com/aws/smithy-go to v1.27.3
• (deps) Update dependency @​sentry/vue to v10.62.0
• (deps) Update dependency vue-i18n to v11.4.6
• (deps) Update golangci/golangci-lint-action action to v9.3.0
• (deps) Update font awesome
• (deps) Update module github.com/bbrks/go-blurhash to v1.2.0
• (deps) Update module github.com/coreos/go-oidc/v3 to v3.19.0
• (deps) Update module github.com/fatih/color to v1.19.0
• (deps) Update module github.com/redis/go-redis/v9 to v9.21.0
• (deps) Update module github.com/labstack/echo/v5 to v5.2.1
• (deps) Update module golang.org/x/crypto to v0.53.0
• (deps) Update module github.com/magefile/mage to v1.17.2
• (deps) Update vueuse to v14.3.0
• (deps) Update module xorm.io/xorm to v1.4.1
• (deps) Update module github.com/danielgtaylor/huma/v2 to v2.38.0
• (deps) Update module github.com/go-sql-driver/mysql to v1.10.0
• (deps) Update module github.com/hashicorp/go-version to v1.9.0
• (deps) Update module golang.org/x/term to v0.44.0
• (deps) Update module github.com/lib/pq to v1.12.3
• (deps) Update module golang.org/x/image to v0.43.0
• (deps) Update ghcr.io/techknowlogick/xgo:go-1.26.x docker digest to 9887b39
• (deps) Update dependency undici@​6 to v8
• (deps) Update actions/create-github-app-token action to v3
• (deps) Update dependency stylelint to v17.14.0
• (deps) Update module github.com/getsentry/sentry-go to v0.47.0
• (deps) Update module golang.org/x/net to v0.56.0
• (deps) Update dependency golangci/golangci-lint to v2.12.2
• (deps) Update module github.com/schollz/progressbar/v3 to v3.19.1
• (deps) Update dependency tar to v7.5.19
• (deps) Update eslint to v10
• (deps) Update github artifact actions
• (deps) Update docker/setup-buildx-action action to v4
• (deps) Update magefile/mage-action action to v4
• (deps) Update docker/metadata-action action to v6
• (deps) Update docker/login-action action to v4
• (deps) Update docker/build-push-action action to v7
• (deps) Update low-risk dev-dependency majors
• (deps) Update cachix/install-nix-action action to v31
• (deps) Update actions/stale action to v10
• (deps) Update dependency undici@​7 to v8
• (deps) Update actions/github-script action to v9
• (deps) Update dependency postcss to v8.5.16
• (deps) Update dependency marked to v18
• (deps) Pin cachix/install-nix-action action to v31.10.6
• (deps) Update docker/login-action action to v4.3.0
• (deps) Update charmbracelet bubbletea and lipgloss to v2
• (deps) Update docker/metadata-action action to v6.2.0
• (deps) Update docker/setup-buildx-action action to v4.2.0
• (deps) Update softprops/action-gh-release action to v3
• (deps) Update pnpm/action-setup action to v6
• (deps) Update typescript to v6
• (deps) Update danielroe/provenance-action digest to 83ae780
• (deps) Update vite to v8
• (deps) Update module charm.land/bubbletea/v2 to v2.0.8
• (deps) Update module charm.land/lipgloss/v2 to v2.0.5
• (deps) Update dependency vue-router to v5
• (deps) Update dependency electron to v42
• (deps) Upgrade to pnpm 11 and migrate config to pnpm-workspace.yaml
• (deps) Update pnpm to 11 in devenv
• (deps) Lock file maintenance
• (deps) Update dependency js-yaml to v5.2.1
• (deps) Update dependency picomatch to v4.0.5
• (deps) Update dependency js-yaml@​4 to v5.2.1
• (deps) Update dependency markdown-it to v14.3.0
• (deps) Update dependency serialize-javascript to v7.0.7
• (deps) Update docker/login-action action to v4.4.0
• (deps) Migrate rollup override to pnpm catalog
• (deps) Update dependency @​sentry/vue to v10.63.0
• (deps) Update module github.com/wneessen/go-mail to v0.8.0
• (deps) Update dependency undici@​6 to v8.6.0
• (deps) Update dependency undici@​7 to v8.6.0
• (deps) Update dependency electron to v43
• (deps) Update module golang.org/x/text to v0.39.0
• (deps) Update module code.dny.dev/ssrf to v0.3.0
• (deps) Update pnpm to v11.10.0
• (deps) Update ghcr.io/techknowlogick/xgo:go-1.26.x docker digest to b00957d
• (deps) Update danielroe/provenance-action digest to da28a90
• (deps) Update dependency go to v1.26.5
• (deps) Update postgres:18 docker digest to 3111367
• (deps) Update dependency undici@​7 to v8.7.0
• (deps) Update module golang.org/x/sys to v0.47.0
• (deps) Update module golang.org/x/sync to v0.22.0
• (deps) Update postgres:18 docker digest to 22c89fe
• (deps) Update module golang.org/x/image to v0.44.0
• (deps) Update dependency undici@​6 to v8.7.0
• (deps) Update module golang.org/x/term to v0.45.0
• (deps) Update tiptap to v3.27.2
• (deps) Update module golang.org/x/net to v0.57.0
• (deps) Update module github.com/wneessen/go-mail to v0.8.1
• (deps) Update module github.com/coreos/go-oidc/v3 to v3.20.0
• (deps) Update cachix/install-nix-action action to v31.10.7
• (deps) Update actions/stale action to v10.4.0
• (deps) Update tiptap to v3.27.3
• (deps) Update dependency @​sentry/vue to v10.64.0
• (deps) Update module github.com/yuin/goldmark to v1.8.4
• (deps) Update dependency @​fortawesome/vue-fontawesome to v3.3.1
• (deps) Update dependency vite to v8.1.4
• (deps) Update danielroe/provenance-action digest to 97ee003
• (deps) Update softprops/action-gh-release action to v3.0.2
• (deps) Update module github.com/mattn/go-sqlite3 to v1.14.48
• (deps) Update postgres:18 docker digest to b913fd5
• (deps) Update dependency postcss to v8.5.17
• (deps) Update dependency dompurify to v3.4.12
• (deps) Update cachix/install-nix-action action to v31.11.0
• (deps) Update dependency @​sentry/vue to v10.65.0
• (deps) Update dependency @​floating-ui/dom to v1.8.0
• (deps) Update module github.com/getsentry/sentry-go to v0.48.0
• (deps) Update dependency tar to v7.5.20
• (deps) Update postgres:18 docker digest to 32ca0af
• (deps) Update dependency postcss to v8.5.19
• (deps) Update pnpm to v11.11.0
• (deps) Update actions/setup-node action to v6.5.0
• (deps) Replace vendored humaecho5 with upstream humaecho adapter (#​3205)
• (deps) Update dependency @​sentry/vue to v10.66.0
• (deps) Update actions/setup-go action to v7
• (deps) Update actions/setup-node action to v7
• (deps) Update dependency vue-router to v5.2.0
• (deps) Update pnpm to v11.13.1
• (deps) Update tiptap to v3.27.4
• (deps) Update module github.com/go-ldap/ldap/v3 to v3.4.14
• (deps) Update module github.com/aws/smithy-go to v1.27.4
• (deps) Update dependency @​fortawesome/vue-fontawesome to v3.3.2
• (deps) Update module github.com/labstack/echo-jwt/v5 to v5.0.2
• (deps) Update dependency marked to v18.0.6
• (deps) Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.105.2
• (deps) Update dependency nanoid to v6
• (deps) Update dependency vue to v3.5.40
• (deps) Update crowdin/github-action action to v2.16.4
• (deps) Update dependency pinia to v4
• (deps) Update module github.com/labstack/echo/v5 to v5.3.0
• (deps) Update font awesome to v7.3.1
• (deps) Update tiptap to v3.28.0
• (deps-dev) Bump esbuild from 0.28.0 to 0.28.1 in /frontend

Documentation

• (agents) Reference crudable and migration skills in AGENTS.md
• (agents) Add something about duplication [skip ci]
• (agents) Comments should document the why, not the what
• (api/v2) Add field and operation descriptions for labels
• (api/v2) Mark server-controlled label and user fields read-only
• (api/v2) Mark error code field read-only
• (api/v2) Keep registrar godoc attached; clarify registry concurrency + ordering
• (api/v2) Mark team external_id read-only
• (api/v2) Tag LinkSharing fields for the v2 schema
• (api/v2) Tag Webhook fields for the v2 schema
• (api/v2) Add doc/readOnly tags to notification model fields
• (api/v2) Tag project user share fields for the v2 schema
• (api/v2) Tag SavedFilter fields for the v2 schema
• (api/v2) Annotate TeamMember fields for the v2 schema
• (api/v2) Tag project team share fields for the v2 schema
• (api/v2) Tag bulk assignee fields for the v2 schema
• (api/v2) Tag task bucket fields for the v2 schema
• (api/v2) Tag project duplication fields for the v2 schema
• (api/v2) Tag bulk task fields for the v2 schema
• (api/v2) Tag task relation fields for the v2 schema
• (api/v2) Tag reaction fields for the v2 schema
• (api/v2) Tag task position fields for the v2 schema
• (api/v2) Tag bulk label fields for the v2 schema
• (api/v2) Tag task fields for the v2 schema
• (api/v2) Tag task attachment fields for the v2 schema
• (api/v2) Tag CalDAV token fields for the v2 schema
• (api/v2) Tag TOTP fields for the v2 schema
• (audit) Add package documentation
• (frontend) Document styles architecture and token system
• (models) Add doc and readOnly tags to Session fields for v2
• (models) Tag APIToken fields for v2 OpenAPI reflection
• (models) Tag TaskAssignee fields for the v2 schema
• (search) Describe the actual constant-score relevance semantics
• (skills) Hint at readOnly tags for server-controlled v2 fields
• (skills) Document v2 self-registration pattern
• (skills) Note v2 query params must be direct fields on the handler input
• (task-comments) Trim comments to the non-obvious why
• (veans) Add README with quick-start guide
• (veans) AGENTS.md cheat sheet for coding agents
• (webhooks) Version-qualify the events endpoint link in the events field doc
• Add api-v2-routes skill and freeze /api/v1 (d2a3186)
• Redirect translation requests to translation guide (a35518a)
• Trim wordy comments to load-bearing whys (fb4bca3)
• Trim wordy comments in v2 notifications (604e585)
• Update contribution guidelines about AI generated code (afbfda5)
• Fix typo in autotls.enabled description (123e480)
• Fix @​Success 200 -> 201 on 5 PUT/Create endpoints (44ed50d)

Features

• (a11y) Add i18n keys for accessibility labels
• (a11y) Add skip navigation link and main landmark on auth pages
• (a11y) Add accessible names to icon-only buttons
• (a11y) Add aria-live region to toast notifications
• (a11y) Add accessible names to modal dialogs
• (a11y) Use autocomplete='new-password' on register form
• (a11y) Fix logo link accessible name to include 'Vikunja'
• (a11y) Associate form errors with input fields
• (a11y) Add labels to color picker and sort select
• (a11y) Fix heading hierarchy across pages
• (a11y) Add descriptive labels to task checkboxes
• (a11y) Associate errors with inputs in FormInput and FormSelect
• (admin) Add /admin route group and overview endpoint
• (admin) Add users/projects list endpoints and is_admin patch
• (admin) Add user status and delete endpoints with reassign owner
• (admin) Add create-user endpoint
• (admin) Add typed models for admin users and overview
• (admin) Add frontend admin shell, views, services, and routes
• (admin) Wire up /admin route group with all endpoints
• (agents) Add crudable skill for CRUDable + permissions guidance
• (agents) Add migration skill for DB migration safety
• (api) Add GET /projects/:project/tasks/by-index/:index endpoint
• (api) Bot token support via /tokens CRUD and bot_users_enabled flag
• (api) Accept project identifier in by-index task route
• (api) Lowercase project identifier before by-index lookup
• (api) Add v2 markdown conversion helpers
• (api) Exchange rich-text fields as markdown on v2
• (api-v2) Vendor scalar api docs bundle
• (api/v2) Declare JWTKeyAuth security scheme
• (api/v2) Enable AutoPatch for automatic JSON Merge Patch
• (api/v2) Port Label to per-operation Huma handlers
• (api/v2) Serve Scalar docs UI at /api/v2/docs
• (api/v2) Preserve Vikunja numeric error code in problem+json
• (api/v2) Add task duplicate action (#​2815)
• (api/v2) Add project view routes
• (api/v2) Gate admin routes by feature + instance admin
• (api/v2) Serve user avatars
• (api/v2) Upload user avatar via multipart
• (api/v2) Add team CRUD endpoints
• (api/v2) Add nested task comment CRUD
• (api/v2) Add shared conditional read helper and document list params
• (api/v2) Report max_permission on label and project-view reads
• (api/v2) Add Project CRUD on /api/v2
• (api/v2) Report max_permission on task comment reads
• (api/v2) Report max_permission on team reads
• (api/v2) Add session list/delete on /api/v2
• (api/v2) Add task labels (create/list/delete) on /api/v2
• (api/v2) Add API token list/create/delete on /api/v2
• (api/v2) Add bot user CRUD on /api/v2
• (api/v2) Add link sharing (create/read/list/delete)
• (api/v2) Add task assignees (create/list/delete) on /api/v2
• (api/v2) Add project webhooks CRUD on /api/v2
• (api/v2) Enforce validation centrally in the Register wrapper
• (api/v2) Return 422 with invalid_fields for validation errors
• (api/v2) Add subscribe/unsubscribe on /api/v2
• (api/v2) Add notifications list/mark-read + mark-all on /api/v2
• (api/v2) Add project user shares CRUD on /api/v2
• (api/v2) Add saved filter CRUD on /api/v2
• (api/v2) Add team members (add/remove/admin-toggle) on /api/v2
• (api/v2) Add project team shares CRUD on /api/v2
• (api/v2) Add bulk assignee replacement on /api/v2
• (api/v2) Add task read-status marking on /api/v2
• (api/v2) Add kanban task-bucket moves on /api/v2
• (api/v2) Add project duplication on /api/v2
• (api/v2) Add bulk task updates on /api/v2
• (api/v2) Add task relations on /api/v2
• (api/v2) Add reactions on /api/v2
• (api/v2) Add task position updates on /api/v2
• (api/v2) Add bulk label replacement on /api/v2
• (api/v2) Add task CRUD on /api/v2
• (api/v2) Add task attachments on /api/v2
• (api/v2) Add CalDAV tokens on /api/v2
• (api/v2) Add TOTP 2FA on /api/v2
• (api/v2) Add user webhooks on /api/v2
• (api/v2) Add user account-deletion flow on /api/v2
• (api/v2) Add user account/settings on /api/v2
• (api/v2) Add task collection (task lists) on /api/v2
• (api/v2) Port OAuth migrators (Todoist, Trello, Microsoft To-Do)
• (api/v2) Add admin actions on /api/v2
• (api/v2) Add project background endpoints
• (api/v2) Add public instance info endpoint
• (api/v2) Add available webhook events endpoint
• (api/v2) Add user search endpoints
• (api/v2) Add public auth routes (register, password, confirm, link-share)
• (api/v2) Add OAuth 2.0 token and authorize endpoints
• (api/v2) Add token-check, token-routes and link-share renew endpoints
• (api/v2) Add project background upload on /api/v2
• (api/v2) Add file migrators (vikunja-file, ticktick, wekan) on /api/v2
• (api/v2) Add the generic CSV importer on /api/v2
• (api/v2) Add project background download and unsplash proxies
• (api/v2) Add e2e testing-support endpoints on /api/v2
• (api/v2) Add totp qr code endpoint
• (api/v2) Add user data export endpoints
• (api/v2) Add login and logout on /api/v2
• (api/v2) Add OpenID Connect callback on /api/v2
• (api/v2) Port refresh-token endpoint to /api/v2
• (api/v2) Expose healthcheck as a documented endpoint
• (api/v2) Expose notifications atom feed in the OpenAPI spec
• (api/v2) Expose websocket endpoint under /api/v2
• (api/v2) Add kanban bucket CRUD endpoints
• (audit) Add audit logging package
• (audit) Wire request-meta middleware and writer initialization
• (audit) Register the audited event surface
• (audit) Attribute failed logins to the originating request
• (audit) Emit the login event for the OAuth code exchange
• (auth) Include is_admin in JWT claims
• (auth) Reject password login for bot users
• (auth) Add GetAuthFromContext for Huma handlers
• (auth) Add OpenID provider availability monitoring and retry logic (#​3145)
• (avatar) Use distinct marble palette for bot users
• (build) Add centralized release magefile module
• (caldav) Reject basic auth for bot users
• (caldav) Serialize task descriptions as markdown
• (caldav) Emit STATUS:NEEDS-ACTION for incomplete todos
• (caldav) Implement RFC 6578 sync-collection REPORT to sync task deletions
• (ci) Add multi-architecture support for OS package builds (#​2610)
• (ci) Add publish-repos job for OS package repository metadata
• (ci) Sign RPM packages with GPG via nfpm
• (ci) Sign archlinux packages with GPG for pacman verification
• (ci) Add release-binaries and release-os-package composite actions
• (cli) Add user set-admin command (license-gated)
• (client) Add parent_project_id and position to Project wire type
• (comments) Treat quoted comment authors as implicit mentions
• (comments) Reply action with prefilled quote and jump-to-original chevron
• (config) Add license.key configuration option
• (config) Add service.enablebotusers flag
• (config) Add audit logging config keys
• (date) Show the matching preset name on the date-range button
• (date) Acce

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.