# Changelog

All notable changes to MokoGitea are documented here. Versions follow the format
`v{upstream}-moko.{major}.{minor}` (e.g. `v1.26.1-moko.06.03`).

## [Unreleased]

* FEATURES
  * feat(api): issue status/priority/type exposed in REST API - GET/PATCH on issues now includes status_id, priority_id, type_id with resolved names
  * feat(api): org-level issue metadata endpoints - GET /orgs/{org}/issue-statuses, /issue-priorities, /issue-types
  * feat(wiki): org wiki tab - inline wiki rendering from convention repos (wiki / wiki-private)
  * feat(wiki): public/private wiki toggle dropdown (same UX as org profile README selector)
  * feat(wiki): external wiki support - link to an outside URL from the org wiki tab
  * feat(settings): wiki mode setting in org settings (internal repos vs external URL)
  * feat(mcp): 5 new MCP tools - gitea_org_issue_statuses_list, gitea_org_issue_priorities_list, gitea_org_issue_types_list, gitea_issue_set_status, gitea_issue_set_priority
  * feat(mcp): gitea_issue_create and gitea_issue_update now accept status_id, priority_id, type_id

* MIGRATIONS
  * migration 354: add wiki_mode and wiki_url columns to user table for org wiki settings

## [v1.26.1-moko.06.12] - 2026-06-07

* FEATURES
  * feat(security): dependency vulnerability scanner - parses go.mod, package.json, composer.json, requirements.txt and checks against OSV.dev API (#551)
  * feat(cdn): built-in CDN for release asset delivery via cdn.mokoconsulting.tech with per-asset public/private toggles (#561)
  * feat(cdn): IP/CIDR and referrer domain allowlists for CDN abuse prevention
  * feat(cdn): releases in update streams excluded from CDN (update server takes precedence)

* FIXES
  * fix(licensing): hide "Require license key" option for Joomla update servers (Joomla limitation)
  * fix(settings): remove duplicate description from manifest page (#559)

* INFRASTRUCTURE
  * chore: rename moko-platform to MokoPlatform across codebase (#548)
  * CDN CNAME: cdn.mokoconsulting.tech with auto-TLS via Let's Encrypt
  * Nginx reverse proxy for CDN hostname on production server
  * DreamHost MCP server path and API key configured

## [v1.26.1-moko.06.10] - 2026-06-06

* FEATURES
  * feat(issues): first-class Type field with 12 auto-seeded defaults (Bug, Feature, Enhancement, Task, Documentation, Security, Roadmap, Client, Dolibarr, Infrastructure, Joomla, WaaS)
  * feat(issues): first-class Status field with 13 auto-seeded defaults including 7 Pending states
  * feat(issues): first-class Priority field with 4 auto-seeded defaults (Critical, High, Medium, Low)
  * feat(issues): Type/Status/Priority colored badges in issue list view
  * feat(issues): status dropdown replaces close/reopen button in comment form
  * feat(security): built-in security scanning platform with secret scanner (15 patterns)
  * feat(security): Security tab in repo navigation with alerts, scan controls
  * feat(wiki): hierarchical folder navigation with sidebar tree and breadcrumbs
  * feat(ui): well-known file tabs (README/LICENSE/CONTRIBUTING/SECURITY/CHANGELOG)
  * feat(settings): repo manifest settings with REST API and auto-sync on push
  * feat(mcp): public MCP server published to npm (@mokoconsulting/mokogitea-mcp)
  * feat(mcp): SSE transport, env var config, Docker support, 120+ tools
  * feat(mcp): issue dedup on create, type_id/status_id/priority_id params

* MIGRATIONS
  * All org labels migrated to first-class Type/Status/Priority fields and deleted
  * Type custom field (id=9) migrated to type_id and deleted
  * Status custom field (id=1) deleted (replaced by first-class field)
  * Priority labels migrated to priority_id
  * Pending labels migrated to status definitions
  * Scope labels migrated to type definitions
  * Manifests populated for all 61 repos via API

* FIXES
  * fix(ui): dashboard issue count badges use label spans instead of strong tags
  * fix(wiki): directory check before raw redirect for folder navigation
  * fix(wiki): proper display names in sidebar tree (strip dash markers)
  * fix: replace non-ASCII em dashes with hyphens for hook compatibility
  * fix: hookify __init__.py for stop hook JSON validation

* INFRASTRUCTURE
  * npm: @mokoconsulting/mokogitea-mcp@1.1.0 and @mokoconsulting/mokowaas-mcp@1.0.0
  * MCP servers consolidated under mokoplatform/mcp/servers/
  * Remote MCP repos renamed to hyphens
  * Wiki restructured into features/, api/, operations/ folders
  * Swagger API docs enabled at /api/swagger

## [v1.26.1-moko.06.04] - 2026-06-06

* FEATURES
  * feat(licenses): full commercial license management system
    * Package archiving with soft-delete and collapsible archived section
    * Search keys by customer, domain, key number, email, or payment ref
    * Download gating (none/prerelease/all modes)
    * Domain lock grace period (DomainLockHours)
    * Domain restriction on packages and keys (comma-separated allowed domains)
    * RepoScope enforcement — packages scoped to specific repos
    * Configurable license key prefix per organization
    * Master key auto-generates, sorts first in key list
    * License package creation at repo level via modal
    * Key generation modal with licensee name, email, and domain fields
    * Manual release-to-stream mapping with UI selector
    * Double confirmation modals for permanent deletion
    * Combolist channel picker (replaces checkboxes)
    * Extension metadata in repo settings (per-repo override)
    * API: package CRUD, key revoke, key renew, settings GET/PUT
    * API: purchase webhook with PaymentRef idempotency
    * API: public validation endpoint (no auth)
    * Migration v340-v344: all new columns synced
  * feat(updates): Update Server system (renamed from "Licensing")
    * Joomla XML with SHA256, changelog URL, version from asset filename
    * Dolibarr JSON with channel filtering
    * WordPress PUC-compatible JSON (plugin-update-checker)
    * Composer packages.json
    * PrestaShop module update XML
    * Drupal update status XML
    * WHMCS module update JSON
    * Feed always public — downloads gated separately
    * Stream-name tags supported alongside version tags
    * Omit `<client>` for package extension types
    * `<downloadkey>` only when download_gating is prerelease or all
    * Version extracted from asset filename (matches actual download)
    * Joomla tag values verified: dev, alpha, beta, rc, stable
  * feat(orgs): enterprise sub-org hierarchy with parent-child relationships
  * feat(repos): three-level visibility — Public (200), Private (403), Hidden (404)
  * feat(settings): Update Server settings page with enable toggle in Advanced Settings
  * feat(settings): advanced settings on dedicated page with dividing headers
  * feat(settings): icons on all settings navbars (repo, org, user, admin)
  * feat(ui): styled 403 Access Denied page with inline login form
  * feat(issues): custom fields with inline editing in issue sidebar
  * feat(issues): pre-fill custom fields from issue template YAML frontmatter (#493)
    * Templates specify `custom_fields:` map (field name → default value)
    * New issue sidebar shows org-level fields with template defaults pre-selected
    * API create issue accepts `custom_fields` map by name
  * feat(updateserver): resolve extension metadata from org-level custom fields (#492)
    * Cascading fallback: custom fields → config table → repo-derived defaults
    * All six generators updated (Joomla, WordPress, Composer, Drupal, PrestaShop, WHMCS)
    * Repos can be migrated to custom fields gradually
  * feat(ui): two-in-one Update Server / Licenses tab
    * No gating: shows "Update Server" tab with feed URLs only
    * Gated: shows "Licenses" tab with full key management
    * `<downloadkey>` only appears when downloads are gated
* SECURITY
  * fix(security): ownership guards on all API handlers (cross-org prevention)
  * fix(security): RepoScope JSON parsing (substring matching bug)
  * fix(security): CSRF tokens in delete confirmation modals
  * fix(security): XSS escaping in WordPress changelog HTML
  * fix(security): require login for licenses and actions pages
  * fix(security): 403 for all users on private repos (not 404)
  * fix(security): licensed private repos allow release viewing for signed-in users
  * fix(security): anonymous download access respects download_gating setting
* FIXES
  * fix(licenses): explicit xorm column names for UpdateStreamConfig fields
  * fix(licenses): feed always public when licensing enabled
  * fix(settings): prevent double-highlight on Advanced Settings nav item
  * fix(settings): redirect back to /settings/advanced after save
  * fix(build): remove stale custom field API routes and dead code
  * fix(build): replace invalid UTF-8 character in API comment
  * fix(build): permanent fixes for AI migration, feed/file.go, unused imports
  * fix(updateserver): version extracted from asset filename (not release title)
  * fix(updateserver): omit `<client>` for package types per Joomla spec
  * fix(updateserver): `<downloadkey>` only shown when downloads are gated
  * fix(updateserver): prevent stream name tag from overriding asset-derived version
  * fix(build): restore build/ directory after accidental deletion
  * fix(licenses): master key banner removed, master keys sort first in table
  * fix(issues): issue sidebar loads org-level fields instead of legacy repo-level fields

## [v1.26.1-moko.05] - 2026-05-31

* BREAKING CHANGES
  * Deprecated Issue.Ref branch selector UI (#307)
    * Removed branch/tag selector from issue sidebar and new issue form
    * DB column and commit-close logic preserved for backward compatibility
* FEATURES
  * feat(ui): generic combo-multiselect component (#361)
    * Reusable dropdown with search, checkable items, and selected-items display
    * Template: `shared/combolist.tmpl`
  * feat(updates): extension metadata settings for update feed generation
  * feat(licenses): platform enforcement, key deletion, expired key cleanup
  * feat(actions): rebrand actions bot user to mokogitea-actions (#233, #234)
    * Backward-compatible: recognizes github-actions[bot], gitea-actions[bot]
  * feat(actions): actions bot user in branch protection whitelist (#233, #234)
    * WhitelistActionsUser, MergeWhitelistActionsUser, ForcePushAllowlistActionsUser
* TECH DEBT
  * chore: full namespace migration to code.mokoconsulting.tech (#336, #337, #344)
  * fix(blame): set HasSourceRenderedToggle for renderable files (#344)
  * fix(settings): translate team permission strings via data-locale (#344)
  * fix(dropzone): use relative path for non-image attachment markdown links (#344)
  * fix(templates): add required validation to issue dropdown fields (#350)
  * refactor(go): replace ValuesRepository with maps.Values (Go 1.21+) (#357)
  * refactor(go): remove CanEnableEditor wrapper (#357)
  * fix(ts): parseIssueHref uses URL pathname and trims appSubUrl (#360)
  * fix(actions): enforce MaxJobNumPerRun (256) limit (#360)
  * fix(css): use calc(infinity * 1px) for --border-radius-full (#361)
  * fix(css): remove legacy .center class, replace with tw-text-center (#361)
  * fix(routes): remove dead legacy /cherry-pick/{sha} route
  * fix(feed): use full ref name instead of ShortName for file feed revision
* BUGFIXES
  * fix(build): use slices.Collect for maps.Values (Go 1.23+ compat)
  * fix(licenses): remove duplicate DeleteLicenseKey declaration
  * fix(licenses): only show licenses tab when licensing is enabled
  * fix(licenses): show feed URLs based on repo update platform setting
  * fix(updates): correct dlid prefix and align XML with Joomla standard
* INFRASTRUCTURE
  * fix(ci): auto-deploy to production on merge to main (#235)

## [v1.26.1-moko.04] - 2026-05-24

* SECURITY
  * Backport 12 upstream v1.26.2 security fixes:
    * golang.org/x/net v0.55.0 security update (#140)
    * Token scope enforcement on raw/media/attachment downloads (#141)
    * OAuth PKCE hardening and refresh token replay protection (#142)
    * Wiki git write and LFS token access enforcement (#143)
    * Public-only token filtering in API queries (#144)
    * Artifact signature payload hardening (#146)
    * AWS credentials encryption (#161)
    * Mermaid v11.15.0 security update (#162)
    * Composer package permission check (#164)
* BUGFIXES
  * fix(actions): nil pointer dereference in concurrency during PR creation (#136)
  * fix(ui): actions runs list broken row layout (#138)
  * fix: scheduled action panic with null event payload
  * fix: treat email addresses case-insensitively
  * fix: .mod lexer panic — removed invalid AMPL mapping
* FEATURES
  * Joomla-style updates.xml with channel selection
  * Update checker with configurable CHANNEL setting
  * Admin dashboard update banner with docker pull command
  * Upstream bug sync workflow — daily automated issue creation
  * PR RC release workflow — auto-build RC on PR to main
* INFRASTRUCTURE
  * New 3-part versioning: v{upstream}-moko.{major}.{minor}.{patch}
  * Branding updates: error pages, home page, settings link
  * Deploy workflow updated for new version format
* PROCESS
  * Created `type: bug` and `upstream` labels for automated issue tracking
  * Closed 24 upstream bug/security issues after backporting
