Commit log

000ab51 Merge commit from fork

Click to expand commit body 
* fix: require admin privileges for force delete of LFS locks

Move user context retrieval before the force flag check to ensure
proper authorization. Force deletions now require admin privileges,
preventing non-admin users from deleting locks owned by others.

Fixes GHSA-6jm8-x3g6-r33j (CVE-2026-22253)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: improve comment clarity for force delete path

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Tomer Fichman and Claude Opus 4.5 created

62e2d5c fix(ssh): ui: respect anon-access setting for the ui

Click to expand commit body 
Fixes: https://github.com/charmbracelet/soft-serve/issues/759

Ayman Bagabas created

ba7d415 ci: sync golangci-lint config (#767)

Click to expand commit body 
Co-authored-by: aymanbagabas <3187948+aymanbagabas@users.noreply.github.com>

github-actions[bot] and aymanbagabas created

c8779b1 chore(deps): bump the all group across 1 directory with 9 updates (#772)

Click to expand commit body 
Bumps the all group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) | `2.20.0` | `2.21.1` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.2` | `5.16.4` |
| [github.com/google/go-querystring](https://github.com/google/go-querystring) | `1.1.0` | `1.2.0` |
| [github.com/muesli/mango-cobra](https://github.com/muesli/mango-cobra) | `1.2.0` | `1.3.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.0` | `1.23.2` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.45.0` | `0.46.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.38.2` | `1.42.2` |



Updates `github.com/alecthomas/chroma/v2` from 2.20.0 to 2.21.1
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.20.0...v2.21.1)

Updates `github.com/go-git/go-git/v5` from 5.16.2 to 5.16.4
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.16.2...v5.16.4)

Updates `github.com/google/go-querystring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/google/go-querystring/releases)
- [Commits](https://github.com/google/go-querystring/compare/v1.1.0...v1.2.0)

Updates `github.com/muesli/mango-cobra` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/muesli/mango-cobra/releases)
- [Commits](https://github.com/muesli/mango-cobra/compare/v1.2.0...v1.3.0)

Updates `github.com/prometheus/client_golang` from 1.23.0 to 1.23.2
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2)

Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.1
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.1)

Updates `golang.org/x/crypto` from 0.45.0 to 0.46.0
- [Commits](https://github.com/golang/crypto/compare/v0.45.0...v0.46.0)

Updates `golang.org/x/sync` from 0.18.0 to 0.19.0
- [Commits](https://github.com/golang/sync/compare/v0.18.0...v0.19.0)

Updates `modernc.org/sqlite` from 1.38.2 to 1.42.2
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.38.2...v1.42.2)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/google/go-querystring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/muesli/mango-cobra
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/crypto
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/sync
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.42.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

2447a96 fix(tests): ignore stderr output in SSRF webhook test

Ayman Bagabas created

9e67180 chore(deps): bump actions/checkout from 5 to 6 in the all group (#765)

Click to expand commit body 
Bumps the all group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 5 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

8262d91 chore: go mod tidy

Ayman Bagabas created

a7f2fbe chore: bump dependencies and use charm.land modules

Ayman Bagabas created

f946151 chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#764)

Click to expand commit body 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.41.0 to 0.45.0.
- [Commits](https://github.com/golang/crypto/compare/v0.41.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

8a99b84 test: fix

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

bb73b9a Merge commit from fork

Click to expand commit body 
closes GHSA-vwq2-jx9q-9h9f

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

56e9784 docs: Add `IdentitiesOnly` option to ssh command examples (#628)

Rob Berwick created

d963932 Merge commit from fork

Click to expand commit body 
* sec: escape ansi sequences on user input

fixes HSA-fv2r-r8mp-pg48

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

* Apply suggestion from @Tomer-PL

Co-authored-by: Tomer Fichman <tomer@irregular.com>

* chore: fmt

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

---------

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Co-authored-by: Tomer Fichman <tomer@irregular.com>

Carlos Alexandro Becker and Tomer Fichman created

ea8799b feat: add CORS headers (#654)

fetsorn created

15e9e25 chore(deps): bump actions/setup-go from 5 to 6 in the all group (#748)

Click to expand commit body 
Bumps the all group with 1 update: [actions/setup-go](https://github.com/actions/setup-go).


Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

6856877 feat: add readiness and liveness probes for self healing (#734)

Click to expand commit body 
* feat: add k8s readiness and liveness probes

* fix: switch to single err var and add logging

* chore: remove fmt import

Jay Madden created

5c8639b chore(deps): update all deps (#746)

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

8e52267 chore(deps): bump github.com/sergi/go-diff (#729)

Click to expand commit body 
Bumps [github.com/sergi/go-diff](https://github.com/sergi/go-diff) from 1.3.2-0.20230802210424-5b0b94c5c0d3 to 1.4.0.
- [Commits](https://github.com/sergi/go-diff/commits/v1.4.0)

---
updated-dependencies:
- dependency-name: github.com/sergi/go-diff
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

bec9fb3 chore(deps): bump github.com/prometheus/client_golang (#739)

Click to expand commit body 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.22.0 to 1.23.0.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.22.0...v1.23.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

e5edfd5 sec: update git-module (#742)

Click to expand commit body 
The regex solution proposed in #737 is not sufficient.
I've added `--end-of-options` to the relevant commands in https://github.com/aymanbagabas/git-module/pull/1
so this reverts changes made in #737 and update git-module to include that fix.

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

a73db1a test: use a repo that doesn't change as much (#743)

Click to expand commit body 
wizard tutorial last commit was 2y ago

catwalk get commits almost daily

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

5d9034c ci: sync dependabot config (#741)

Charm created

76a71ef chore(deps): bump actions/checkout from 4 to 5 (#735)

Click to expand commit body 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

5a2bde5 fix: check that commit is a SHA1 (#737)

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

68e6304 chore(deps): bump github.com/alecthomas/chroma/v2 from 2.19.0 to 2.20.0 (#730)

Click to expand commit body 
Bumps [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) from 2.19.0 to 2.20.0.
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Changelog](https://github.com/alecthomas/chroma/blob/master/.goreleaser.yml)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.19.0...v2.20.0)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

efa8c06 chore(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.2 to 5.3.0 (#731)

Click to expand commit body 
Bumps [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) from 5.2.2 to 5.3.0.
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](https://github.com/golang-jwt/jwt/compare/v5.2.2...v5.3.0)

---
updated-dependencies:
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

fa175c7 fix: repo commit help (#736)

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

de888b9 test: fix golden files

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

844f175 ci: sync golangci-lint config (#732)

Click to expand commit body 
Co-authored-by: aymanbagabas <3187948+aymanbagabas@users.noreply.github.com>

github-actions[bot] and aymanbagabas created

dbcded6 chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 (#727)

Click to expand commit body 
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

9b64ebd chore(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 (#726)

Click to expand commit body 
---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

397288d fix(ui): help menu on file list view (#719)

Click to expand commit body 
* fix(ui): Add additional key function indicators

Add the h and l indications in the help message when
those keys select items from lists.

* fix(ui); Fix action long help on file views

Prior to this commit, the copy command help was not overwritten as
intended, and blame and toggle line number options were shown in help on
the file list view page, but only functioned on the file content view
page.

Eldon created

52f7a9e feat(tui): yank the patch/diff to clipboard (#725)

Benjamin Chausse created

331bf84 chore(deps): bump github.com/alecthomas/chroma/v2 from 2.18.0 to 2.19.0 (#723)

Click to expand commit body 
Bumps [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) from 2.18.0 to 2.19.0.
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Changelog](https://github.com/alecthomas/chroma/blob/master/.goreleaser.yml)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.18.0...v2.19.0)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

c177e0c chore(deps): bump github.com/caarlos0/env/v11 from 11.2.2 to 11.3.1 (#722)

Click to expand commit body 
Bumps [github.com/caarlos0/env/v11](https://github.com/caarlos0/env) from 11.2.2 to 11.3.1.
- [Release notes](https://github.com/caarlos0/env/releases)
- [Changelog](https://github.com/caarlos0/env/blob/main/.goreleaser.yml)
- [Commits](https://github.com/caarlos0/env/compare/v11.2.2...v11.3.1)

---
updated-dependencies:
- dependency-name: github.com/caarlos0/env/v11
  dependency-version: 11.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

8e6fd53 fix(ui): use more accurate scroll percent symbol and improve status bar

Click to expand commit body 
rendering

Ayman Bagabas created

28de5aa Merge pull request #678 from charmbracelet/v2-exp

Click to expand commit body 
Use the new v2 stack

Ayman Bagabas created

a9140d3 chore(ui): common: remove unused style config

Ayman Bagabas created

5356717 docs(common): update style comment

Ayman Bagabas created

a1f2860 Merge branch 'main' into v2-exp

Ayman Bagabas created

8ff1c70 chore: update .goreleaser.yml to version 2

Ayman Bagabas created

7c3fa24 fix(ui): viewport: rename HalfViewDown/Up to HalfPageDown/Up

Ayman Bagabas created

cae98f8 chore: update dependencies

Ayman Bagabas created

a2c6ec1 Merge branch 'main' into v2-exp

Ayman Bagabas created

e93eeff fix(daemon): ensure daemon starts correctly in tests and ignore errors

Ayman Bagabas created

14a804a fix(ssh): honor SOFT_SERVE_NO_COLOR env var in blob command

Ayman Bagabas created

7e944a2 fix(ui): remove red background for empty spaces in code blocks

Ayman Bagabas created

02eaf7f Merge branch 'main' into v2-exp

Ayman Bagabas created

3f646c6 fix(daemon): mutex for listeners

Ayman Bagabas created

cae622b ci: sync golangci-lint config (#708)

Click to expand commit body 
Co-authored-by: aymanbagabas <3187948+aymanbagabas@users.noreply.github.com>

github-actions[bot] and aymanbagabas created