diff --git a/BLENDER_README.md b/BLENDER_README.md
new file mode 100644
index 0000000000000..f5bd495d5e96d
--- /dev/null
+++ b/BLENDER_README.md
@@ -0,0 +1,12 @@
+# Blender Merges
+
+Currently the process for merging upstream changes is to rebase, and keep
+Blender modifications on top. This keeps a clear overview of the modifications
+that were made.
+
+When merging a major new release, cherry-pick all the Blender commits on
+top of it. A simple `git rebase` will not work because the release and main
+branches diverge.
+
+First do changes in `blender-merged-develop`, and deploy on uatest. Then apply
+the changes in `blender-merged` and deploy in production.
diff --git a/Dockerfile.rootless b/Dockerfile.rootless
index c87a965608023..32a3ff259ac26 100644
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -54,6 +54,11 @@ RUN apk --no-cache add \
     gnupg \
     && rm -rf /var/cache/apk/*
 
+# External renderers
+RUN apk --no-cache add \
+    python3-dev \
+    && rm -rf /var/cache/apk/*
+
 RUN addgroup \
     -S -g 1000 \
     git && \
diff --git a/go.mod b/go.mod
index 9b0421e1b65ac..c9957ecb8176d 100644
--- a/go.mod
+++ b/go.mod
@@ -257,6 +257,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mozillazg/go-unidecode v0.2.0 // indirect
 	github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
diff --git a/go.sum b/go.sum
index 3b7364af8d4aa..0880bd56391e0 100644
--- a/go.sum
+++ b/go.sum
@@ -590,6 +590,9 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/mozillazg/go-unidecode v0.2.0 h1:vFGEzAH9KSwyWmXCOblazEWDh7fOkpmy/Z4ArmamSUc=
+github.com/mozillazg/go-unidecode v0.2.0/go.mod h1:zB48+/Z5toiRolOZy9ksLryJ976VIwmDmpQ2quyt1aA=
 github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 h1:j2kD3MT1z4PXCiUllUJF9mWUESr9TWKS7iEKsQ/IipM=
 github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450/go.mod h1:skjdDftzkFALcuGzYSklqYd8gvat6F1gZJ4YPVbkZpM=
 github.com/mschoch/smat v0.0.0-20160514031455-90eadee771ae/go.mod h1:qAyveg+e4CE+eKJXWVjKXM4ck2QobLqTDytGJbLLhJg=
diff --git a/models/git/lfs.go b/models/git/lfs.go
index bb6361050aaef..83a2e7883d1cf 100644
--- a/models/git/lfs.go
+++ b/models/git/lfs.go
@@ -236,7 +236,7 @@ func CountLFSMetaObjects(ctx context.Context, repoID int64) (int64, error) {
 
 // LFSObjectAccessible checks if a provided Oid is accessible to the user
 func LFSObjectAccessible(ctx context.Context, user *user_model.User, oid string) (bool, error) {
-	if user.IsAdmin {
+	if user != nil && user.IsAdmin {
 		count, err := db.GetEngine(ctx).Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
 		return count > 0, err
 	}
diff --git a/models/issues/label.go b/models/issues/label.go
index cfbe100926990..cb7726aa717d2 100644
--- a/models/issues/label.go
+++ b/models/issues/label.go
@@ -184,11 +184,8 @@ func (l *Label) BelongsToRepo() bool {
 	return l.RepoID > 0
 }
 
-// ExclusiveScope returns scope substring of label name, or empty string if none exists
-func (l *Label) ExclusiveScope() string {
-	if !l.Exclusive {
-		return ""
-	}
+// Return scope substring of label name, or empty string if none exists
+func (l *Label) Scope() string {
 	lastIndex := strings.LastIndex(l.Name, "/")
 	if lastIndex == -1 || lastIndex == 0 || lastIndex == len(l.Name)-1 {
 		return ""
@@ -196,6 +193,14 @@ func (l *Label) ExclusiveScope() string {
 	return l.Name[:lastIndex]
 }
 
+// ExclusiveScope returns scope substring of label name, or empty string if none exists
+func (l *Label) ExclusiveScope() string {
+	if !l.Exclusive {
+		return ""
+	}
+	return l.Scope()
+}
+
 // NewLabel creates a new label
 func NewLabel(ctx context.Context, l *Label) error {
 	color, err := label.NormalizeColor(l.Color)
diff --git a/models/organization/team.go b/models/organization/team.go
index 7f3a9b3829592..f0717faf2eb36 100644
--- a/models/organization/team.go
+++ b/models/organization/team.go
@@ -247,3 +247,19 @@ func IncrTeamRepoNum(ctx context.Context, teamID int64) error {
 	_, err := db.GetEngine(ctx).Incr("num_repos").ID(teamID).Update(new(Team))
 	return err
 }
+
+// Avoid notifying large teams accidentally
+func FilterLargeTeams(teams []*Team, err error) ([]*Team, error) {
+	if err != nil {
+		return nil, err
+	}
+
+	var smallTeams []*Team
+	for _, team := range teams {
+		if team.NumMembers <= 10 {
+			smallTeams = append(smallTeams, team)
+		}
+	}
+
+	return smallTeams, nil
+}
diff --git a/models/repo/repo.go b/models/repo/repo.go
index 5aae02c6d8059..34d1bf55f65c7 100644
--- a/models/repo/repo.go
+++ b/models/repo/repo.go
@@ -653,7 +653,7 @@ func (repo *Repository) AllowsPulls(ctx context.Context) bool {
 
 // CanEnableEditor returns true if repository meets the requirements of web editor.
 func (repo *Repository) CanEnableEditor() bool {
-	return !repo.IsMirror
+	return !repo.IsMirror && !repo.IsArchived
 }
 
 // DescriptionHTML does special handles to description and return HTML string.
diff --git a/models/user/badge.go b/models/user/badge.go
index 3ff3530a369a5..9f030c7019103 100644
--- a/models/user/badge.go
+++ b/models/user/badge.go
@@ -105,13 +105,23 @@ func RemoveUserBadge(ctx context.Context, u *User, badge *Badge) error {
 // RemoveUserBadges removes badges from a user.
 func RemoveUserBadges(ctx context.Context, u *User, badges []*Badge) error {
 	return db.WithTx(ctx, func(ctx context.Context) error {
+		badgeSlugs := make([]string, 0, len(badges))
 		for _, badge := range badges {
-			if _, err := db.GetEngine(ctx).
-				Join("INNER", "badge", "badge.id = `user_badge`.badge_id").
-				Where("`user_badge`.user_id=? AND `badge`.slug=?", u.ID, badge.Slug).
-				Delete(&UserBadge{}); err != nil {
-				return err
-			}
+			badgeSlugs = append(badgeSlugs, badge.Slug)
+		}
+		var userBadges []UserBadge
+		if err := db.GetEngine(ctx).Table("user_badge").
+			Join("INNER", "badge", "badge.id = `user_badge`.badge_id").
+			Where("`user_badge`.user_id = ?", u.ID).In("`badge`.slug", badgeSlugs).
+			Find(&userBadges); err != nil {
+			return err
+		}
+		userBadgeIDs := make([]int64, 0, len(userBadges))
+		for _, ub := range userBadges {
+			userBadgeIDs = append(userBadgeIDs, ub.ID)
+		}
+		if _, err := db.GetEngine(ctx).Table("user_badge").In("id", userBadgeIDs).Delete(); err != nil {
+			return err
 		}
 		return nil
 	})
diff --git a/models/user/contributor_agreement.go b/models/user/contributor_agreement.go
new file mode 100644
index 0000000000000..186ac1a622453
--- /dev/null
+++ b/models/user/contributor_agreement.go
@@ -0,0 +1,50 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: contributor agreement
+
+package user
+
+import (
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+type ContributorAgreement struct {
+	ID          int64              `xorm:"pk autoincr"`
+	Slug        string             `xorm:"UNIQUE"`
+	CreatedUnix timeutil.TimeStamp `xorm:"created"`
+	Content     string             `xorm:"TEXT NOT NULL"`
+}
+
+type SignedContributorAgreement struct {
+	ID                     int64              `xorm:"pk autoincr"`
+	UserID                 int64              `xorm:"UNIQUE(s)"`
+	ContributorAgreementID int64              `xorm:"UNIQUE(s)"`
+	CreatedUnix            timeutil.TimeStamp `xorm:"created"`
+	Comment                string             `xorm:"TEXT DEFAULT NULL"`
+}
+
+type FindSignedContributorAgreementsOptions struct {
+	db.ListOptions
+	UserID int64
+}
+
+func (opts *FindSignedContributorAgreementsOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+	if opts.UserID != 0 {
+		cond = cond.And(builder.Eq{"user_id": opts.UserID})
+	}
+	return cond
+}
+
+func init() {
+	// These tables don't exist in the upstream code.
+	// We don't introduce migrations for it to avoid migration id clashes.
+	// Gitea will create the tables in the database during startup,
+	// so no manual action is required until we start modifying the tables.
+	db.RegisterModel(new(ContributorAgreement))
+	db.RegisterModel(new(SignedContributorAgreement))
+}
diff --git a/models/user/spamreport.go b/models/user/spamreport.go
new file mode 100644
index 0000000000000..a4390c9d4a054
--- /dev/null
+++ b/models/user/spamreport.go
@@ -0,0 +1,136 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: spam reporting
+
+package user
+
+import (
+	"context"
+	"fmt"
+
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/modules/timeutil"
+)
+
+// SpamReportStatusType is used to support a spam report lifecycle:
+//
+// pending -> locked
+// locked -> processed | dismissed
+//
+// "locked" status works as a lock for a record that is being processed.
+type SpamReportStatusType int
+
+const (
+	SpamReportStatusTypePending   = iota // 0
+	SpamReportStatusTypeLocked           // 1
+	SpamReportStatusTypeProcessed        // 2
+	SpamReportStatusTypeDismissed        // 3
+)
+
+func (t SpamReportStatusType) String() string {
+	switch t {
+	case SpamReportStatusTypePending:
+		return "pending"
+	case SpamReportStatusTypeLocked:
+		return "locked"
+	case SpamReportStatusTypeProcessed:
+		return "processed"
+	case SpamReportStatusTypeDismissed:
+		return "dismissed"
+	}
+	return "unknown"
+}
+
+type SpamReport struct {
+	ID          int64                `xorm:"pk autoincr"`
+	UserID      int64                `xorm:"UNIQUE"`
+	ReporterID  int64                `xorm:"NOT NULL"`
+	Status      SpamReportStatusType `xorm:"INDEX NOT NULL DEFAULT 0"`
+	CreatedUnix timeutil.TimeStamp   `xorm:"created"`
+	UpdatedUnix timeutil.TimeStamp   `xorm:"updated"`
+}
+
+func (*SpamReport) TableName() string {
+	return "user_spamreport"
+}
+
+func init() {
+	// This table doesn't exist in the upstream code.
+	// We don't introduce migrations for it to avoid migration id clashes.
+	// Gitea will create the table in the database during startup,
+	// so no manual action is required until we start modifying the table.
+	db.RegisterModel(new(SpamReport))
+}
+
+type ListSpamReportsOptions struct {
+	db.ListOptions
+	Status SpamReportStatusType
+}
+
+type ListSpamReportsResults struct {
+	ID              int64
+	CreatedUnix     timeutil.TimeStamp
+	UpdatedUnix     timeutil.TimeStamp
+	Status          SpamReportStatusType
+	UserName        string
+	UserCreatedUnix timeutil.TimeStamp
+	ReporterName    string
+}
+
+func ListSpamReports(ctx context.Context, opts *ListSpamReportsOptions) ([]*ListSpamReportsResults, int64, error) {
+	opts.SetDefaultValues()
+	count, err := db.GetEngine(ctx).Count(new(SpamReport))
+	if err != nil {
+		return nil, 0, fmt.Errorf("Count: %w", err)
+	}
+	spamReports := make([]*ListSpamReportsResults, 0, opts.PageSize)
+	err = db.GetEngine(ctx).Table("user_spamreport").Select(
+		"user_spamreport.id, "+
+			"user_spamreport.created_unix, "+
+			"user_spamreport.updated_unix, "+
+			"user_spamreport.status, "+
+			"`user`.name as user_name, "+
+			"`user`.created_unix as user_created_unix, "+
+			"reporter.name as reporter_name",
+	).
+		Join("LEFT", "`user`", "`user`.id = user_spamreport.user_id").
+		Join("LEFT", "`user` as reporter", "`reporter`.id = user_spamreport.reporter_id").
+		Where("status = ?", opts.Status).
+		OrderBy("user_spamreport.id").
+		Limit(opts.PageSize, (opts.Page-1)*opts.PageSize).
+		Find(&spamReports)
+
+	return spamReports, count, err
+}
+
+func GetPendingSpamReportIDs(ctx context.Context) ([]int64, error) {
+	var ids []int64
+	err := db.GetEngine(ctx).Table("user_spamreport").
+		Select("id").Where("status = ?", SpamReportStatusTypePending).Find(&ids)
+	return ids, err
+}
+
+type SpamReportStatusCounts struct {
+	Count  int64
+	Status SpamReportStatusType
+}
+
+func GetSpamReportStatusCounts(ctx context.Context) ([]*SpamReportStatusCounts, error) {
+	statusCounts := make([]*SpamReportStatusCounts, 0, 4) // 4 status types
+	err := db.GetEngine(ctx).Table("user_spamreport").
+		Select("count(*) as count, status").
+		GroupBy("status").
+		Find(&statusCounts)
+
+	return statusCounts, err
+}
+
+func GetSpamReportForUser(ctx context.Context, user *User) (*SpamReport, error) {
+	spamReport := &SpamReport{}
+	has, err := db.GetEngine(ctx).Where("user_id = ?", user.ID).Get(spamReport)
+	if has {
+		return spamReport, err
+	}
+	return nil, err
+}
diff --git a/modules/git/repo_compare.go b/modules/git/repo_compare.go
index ff44506e13c2d..b718ba65991fb 100644
--- a/modules/git/repo_compare.go
+++ b/modules/git/repo_compare.go
@@ -39,9 +39,12 @@ func (repo *Repository) GetMergeBase(tmpRemote, base, head string) (string, stri
 	if tmpRemote != "origin" {
 		tmpBaseName := RemotePrefix + tmpRemote + "/tmp_" + base
 		// Fetch commit into a temporary branch in order to be able to handle commits and tags
-		_, _, err := NewCommand("fetch", "--no-tags").AddDynamicArguments(tmpRemote).AddDashesAndList(base+":"+tmpBaseName).RunStdString(repo.Ctx, &RunOpts{Dir: repo.Path})
+		// --no-write-commit-graph works around issue with commit-graph-chain.lock files that should not be there.
+		_, _, err := NewCommand("fetch", "--no-write-commit-graph", "--no-tags").AddDynamicArguments(tmpRemote).AddDashesAndList(base+":"+tmpBaseName).RunStdString(repo.Ctx, &RunOpts{Dir: repo.Path})
 		if err == nil {
 			base = tmpBaseName
+		} else {
+			logger.Trace("GetMergeBase failed to git fetch. Error: %v", err)
 		}
 	}
 
diff --git a/modules/templates/util_render.go b/modules/templates/util_render.go
index 14655a53c3c5c..97bbd7958cf77 100644
--- a/modules/templates/util_render.go
+++ b/modules/templates/util_render.go
@@ -127,7 +127,7 @@ func (ut *RenderUtils) RenderLabel(label *issues_model.Label) template.HTML {
 	locale := ut.ctx.Value(translation.ContextKey).(translation.Locale)
 	var extraCSSClasses string
 	textColor := util.ContrastColor(label.Color)
-	labelScope := label.ExclusiveScope()
+	labelScope := label.Scope()
 	descriptionText := emoji.ReplaceAliases(label.Description)
 
 	if label.IsArchived() {
diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 0dc7b6e26add6..1f033a2c1744a 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -431,7 +431,7 @@ invalid_password=Vaše heslo se neshoduje s heslem, které bylo použito k vytvo
 reset_password_helper=Obnovit účet
 reset_password_wrong_user=Jste přihlášen/a jako %s, ale odkaz pro obnovení účtu je pro %s
 password_too_short=Délka hesla musí být minimálně %d znaků.
-non_local_account=Externě ověřovaní uživatelé nemohou aktualizovat své heslo prostřednictvím webového rozhraní Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Ověřit
 scratch_code=Pomocný kód
 use_scratch_code=Použijte pomocný kód
@@ -775,7 +775,7 @@ new_password=Nové heslo
 retype_new_password=Potvrdit nové heslo
 password_incorrect=Zadané heslo není správné.
 change_password_success=Vaše heslo bylo aktualizováno. Od teď se přihlašujte novým heslem.
-password_change_disabled=Externě ověřovaní uživatelé nemohou aktualizovat své heslo prostřednictvím webového rozhraní Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-mailová adresa
 manage_emails=Správa e-mailových adres
diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 9a5ae9418a7f0..15b28ae133804 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -437,7 +437,7 @@ invalid_password=Ihr Passwort stimmt nicht mit dem Passwort überein, das zur Er
 reset_password_helper=Konto wiederherstellen
 reset_password_wrong_user=Du bist angemeldet als %s, aber der Link zur Kontowiederherstellung ist für %s
 password_too_short=Das Passwort muss mindestens %d Zeichen lang sein.
-non_local_account=Benutzer, die nicht von Gitea verwaltet werden können ihre Passwörter nicht über das Web Interface ändern.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Verifizieren
 scratch_code=Einmalpasswort
 use_scratch_code=Einmalpasswort verwenden
@@ -781,7 +781,7 @@ new_password=Neues Passwort
 retype_new_password=Neues Passwort bestätigen
 password_incorrect=Das aktuelle Passwort ist falsch.
 change_password_success=Dein Passwort wurde aktualisiert. Bitte verwende dieses beim nächsten Einloggen.
-password_change_disabled=Benutzer, die nicht von Gitea verwaltet werden, können ihr Passwort im Web-Interface nicht ändern.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-Mail-Adressen
 manage_emails=E-Mail-Adressen verwalten
diff --git a/options/locale/locale_el-GR.ini b/options/locale/locale_el-GR.ini
index a70137f8ac7e8..e9700344c5361 100644
--- a/options/locale/locale_el-GR.ini
+++ b/options/locale/locale_el-GR.ini
@@ -375,7 +375,7 @@ invalid_password=Ο κωδικός πρόσβασης σας δεν ταιριά
 reset_password_helper=Ανάκτηση Λογαριασμού
 reset_password_wrong_user=Έχετε συνδεθεί ως %s, αλλά ο σύνδεσμος ανάκτησης λογαριασμού προορίζεται για το %s
 password_too_short=Το μήκος του κωδικού πρόσβασης δεν μπορεί να είναι μικρότερο από %d χαρακτήρες.
-non_local_account=Οι μη τοπικοί χρήστες δεν μπορούν να ενημερώσουν τον κωδικό πρόσβασής τους μέσω του διεπαφής web του Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Επαλήθευση
 scratch_code=Κωδικός μιας χρήσης
 use_scratch_code=Χρήση κωδικού μιας χρήσης
@@ -678,7 +678,7 @@ new_password=Νέος Κωδικός Πρόσβασης
 retype_new_password=Επιβεβαίωση Νέου Κωδικού Πρόσβασης
 password_incorrect=Ο τρέχων κωδικός πρόσβασης είναι λάθος.
 change_password_success=Ο κωδικός πρόσβασής σας έχει ενημερωθεί. Από εδώ και τώρα συνδέεστε χρησιμοποιώντας τον νέο κωδικό πρόσβασής σας.
-password_change_disabled=Οι μη τοπικοί χρήστες δεν μπορούν να ενημερώσουν τον κωδικό πρόσβασής τους μέσω του διεπαφής web του Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Διευθύνσεις Email
 manage_emails=Διαχείριση Διευθύνσεων Email
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index c026c818c5fd9..efdb27e269731 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -444,7 +444,7 @@ invalid_password = Your password does not match the password that was used to cr
 reset_password_helper = Recover Account
 reset_password_wrong_user = You are signed in as %s, but the account recovery link is meant for %s
 password_too_short = Password length cannot be less than %d characters.
-non_local_account = Non-local users cannot update their password through the Gitea web interface.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify = Verify
 scratch_code = Scratch code
 use_scratch_code = Use a scratch code
@@ -710,6 +710,18 @@ block.note.edit = Edit note
 block.list = Blocked users
 block.list.none = You have not blocked any users.
 
+purgespammer.modal_title = Purge spam account
+purgespammer.modal_info = All content created by the user will be deleted! This cannot be undone.
+purgespammer.modal_action = Purge spam account
+purgespammer.profile_button = Purge spam account
+
+spamreport.existing_status = The user has already been reported as a spammer, the report is %s.
+
+spamreport.modal_title = Report spam
+spamreport.modal_info = Report a user as a spammer to site admins.
+spamreport.modal_action = Report spam
+spamreport.profile_button = Report spam
+
 [settings]
 profile = Profile
 account = Account
@@ -728,12 +740,14 @@ account_link = Linked Accounts
 organization = Organizations
 uid = UID
 webauthn = Two-Factor Authentication (Security Keys)
+contributor_agreements = Contributor Agreements
 
 public_profile = Public Profile
 biography_placeholder = Tell us a little bit about yourself! (You can use Markdown)
 location_placeholder = Share your approximate location with others
 profile_desc = Control how your profile is show to other users. Your primary email address will be used for notifications, password recovery and web-based Git operations.
-password_username_disabled = You are not allowed to change your username. Please contact your site administrator for more details.
+password_username_disabled = You can change your username by changing your Blender ID nickname <a href="https://id.blender.org/settings/profile">here</a>.
+
 password_full_name_disabled = You are not allowed to change your full name. Please contact your site administrator for more details.
 full_name = Full Name
 website = Website
@@ -792,8 +806,7 @@ new_password = New Password
 retype_new_password = Confirm New Password
 password_incorrect = The current password is incorrect.
 change_password_success = Your password has been updated. Sign in using your new password from now on.
-password_change_disabled = Non-local users cannot update their password through the Gitea web interface.
-
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 emails = Email Addresses
 manage_emails = Manage Email Addresses
 manage_themes = Select default theme
@@ -1336,9 +1349,9 @@ editor.cannot_edit_non_text_files = Binary files cannot be edited in the web int
 editor.edit_this_file = Edit File
 editor.this_file_locked = File is locked
 editor.must_be_on_a_branch = You must be on a branch to make or propose changes to this file.
-editor.fork_before_edit = You must fork this repository to make or propose changes to this file.
 editor.delete_this_file = Delete File
 editor.must_have_write_access = You must have write access to make or propose changes to this file.
+editor.must_be_signed_in = You must be signed in to make or propose changes.
 editor.file_delete_success = File "%s" has been deleted.
 editor.name_your_file = Name your file…
 editor.filename_help = Add a directory by typing its name followed by a slash ('/'). Remove a directory by typing backspace at the beginning of the input field.
@@ -1396,6 +1409,15 @@ editor.user_no_push_to_branch = User cannot push to branch
 editor.require_signed_commit = Branch requires a signed commit
 editor.cherry_pick = Cherry-pick %s onto:
 editor.revert = Revert %s onto:
+editor.fork_create = Fork Repository to Propose Changes
+editor.fork_create_description = You can not edit this repository directly. Instead you can create a fork, make edits and create a pull request.
+editor.fork_edit_description = You can not edit this repository directly. The changes will be written to your fork <b>%s</b>, so you can create a pull request.
+editor.fork_failed_to_push_branch = Failed to push branch %s to your repoitory.
+editor.cannot_find_editable_repo = Can not find repository to apply the edit to. Was it deleted while editing?
+editor.fork_not_editable = Fork Repository Not Editable
+editor.fork_is_archived = Your repository <b>%s</b> is archived. Unarchive it in repository settings to make changes.
+editor.fork_code_disabled = Code is disabled in your repository <b>%s</b>. Enable code in repository settings to make changes.
+editor.fork_no_permission = You do not have permission to write to repository <b>%s</b>.
 
 commits.desc = Browse source code change history.
 commits.commits = Commits
@@ -2944,6 +2966,7 @@ first_page = First
 last_page = Last
 total = Total: %d
 settings = Admin Settings
+spamreports = Spam Reports
 
 dashboard.new_version_hint = Gitea %s is now available, you are running %s. Check <a target="_blank" rel="noreferrer" href="%s">the blog</a> for more details.
 dashboard.statistic = Summary
@@ -3031,6 +3054,7 @@ dashboard.sync_branch.started = Branches Sync started
 dashboard.sync_tag.started = Tags Sync started
 dashboard.rebuild_issue_indexer = Rebuild issue indexer
 dashboard.sync_repo_licenses = Sync repo licenses
+dashboard.process_spam_reports = Process spam reports
 
 users.user_manage_panel = User Account Management
 users.new_account = Create User Account
@@ -3107,6 +3131,14 @@ emails.delete_desc = Are you sure you want to delete this email address?
 emails.deletion_success = The email address has been deleted.
 emails.delete_primary_email_error = You can not delete the primary email.
 
+spamreports.spamreport_manage_panel = Spam Report Management
+spamreports.user = Reported for spam
+spamreports.user_created = User created
+spamreports.reporter = Reporter
+spamreports.created = Report Created
+spamreports.updated = Report Updated
+spamreports.status = Report Status
+
 orgs.org_manage_panel = Organization Management
 orgs.name = Name
 orgs.teams = Teams
@@ -3863,3 +3895,10 @@ normal_file = Normal file
 executable_file = Executable file
 symbolic_link = Symbolic link
 submodule = Submodule
+
+[contributor_agreements]
+signed_at = Signed by you at %s
+confirm = I agree to the terms of the contributor agreement.
+sign = Sign
+view_and_sign = View text and sign
+view = View text
diff --git a/options/locale/locale_es-ES.ini b/options/locale/locale_es-ES.ini
index 17c3e8e4a3a1c..14004be623fec 100644
--- a/options/locale/locale_es-ES.ini
+++ b/options/locale/locale_es-ES.ini
@@ -372,7 +372,7 @@ invalid_password=Su contraseña no coincide con la contraseña utilizada para cr
 reset_password_helper=Recuperar cuenta
 reset_password_wrong_user=Has iniciado sesión como %s, pero el enlace de recuperación de la cuenta está destinado a %s
 password_too_short=La longitud de la contraseña no puede ser menor a %d caracteres.
-non_local_account=Los usuarios no locales no pueden actualizar su contraseña a través de la interfaz web de Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Verificar
 scratch_code=Código de respaldo
 use_scratch_code=Usar un código de respaldo
@@ -675,7 +675,7 @@ new_password=Nueva contraseña
 retype_new_password=Confirme la nueva contraseña
 password_incorrect=Contraseña actual incorrecta.
 change_password_success=Su contraseña ha sido modificada. Utilice su nueva contraseña la próxima vez que acceda a la cuenta.
-password_change_disabled=Los usuarios no locales no pueden actualizar su contraseña a través de la interfaz web de Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Direcciones de correo electrónico
 manage_emails=Administrar direcciones de correo electrónico
diff --git a/options/locale/locale_fa-IR.ini b/options/locale/locale_fa-IR.ini
index a7a0e33570b16..d3f96addb6bdf 100644
--- a/options/locale/locale_fa-IR.ini
+++ b/options/locale/locale_fa-IR.ini
@@ -286,7 +286,7 @@ reset_password=بازیابی حساب
 invalid_code=کد تایید غیرمعتبر بوده و یا منقضی شده است.
 reset_password_helper=بازیابی حساب
 password_too_short=طول گذرواژه نمی تواند کمتر از %d کاراکتر باشد.
-non_local_account=کاربران غیر محلی نمیتوانند گذرواژه خود را از طریق واسط وب گیتی به روز کنند.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=تایید‌کنید
 scratch_code=کد پایه
 use_scratch_code=استفاده از کدپایه
@@ -526,7 +526,7 @@ old_password=گذارواژه فعلی
 new_password=گذرواژه جدید
 password_incorrect=گذرواژه فعلی شما اشتباه است.
 change_password_success=گذرواژه شما تغییر کرد. از این پس با گذرواژه جدید خود وارد شوید.
-password_change_disabled=کاربران غیر محلی نمیتوانند گذرواژه خود را از طریق واسط وب گیتی به روز کنند.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=نشانی‌های ایمیل
 manage_emails=مدیریت نشانی‌های ایمیل
diff --git a/options/locale/locale_fi-FI.ini b/options/locale/locale_fi-FI.ini
index 69cee090fe769..14923a32791cd 100644
--- a/options/locale/locale_fi-FI.ini
+++ b/options/locale/locale_fi-FI.ini
@@ -296,7 +296,7 @@ reset_password=Tilin palautus
 invalid_code=Vahvistusavain on virheellinen tai vanhentunut.
 reset_password_helper=Palauta käyttäjätili
 password_too_short=Salasanan pituus ei voi olla vähemmän kuin %d merkkiä.
-non_local_account=Ei-lokaalit käyttäjät eivät voi päivittää salasanojaan Gitean web-käyttöliittymän kautta.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Vahvista
 scratch_code=Kertakäyttökoodi
 use_scratch_code=Käytä kertakäyttökoodia
@@ -498,7 +498,7 @@ change_password=Päivitä salasana
 old_password=Nykyinen salasana
 new_password=Uusi salasana
 password_incorrect=Nykyinen salasanasi on virheellinen.
-password_change_disabled=Ei-lokaalit käyttäjät eivät voi päivittää salasanojaan Gitean web-käyttöliittymän kautta.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Sähköposti osoitteet
 manage_emails=Hallitse sähköpostiosoitteita
diff --git a/options/locale/locale_fr-FR.ini b/options/locale/locale_fr-FR.ini
index ec63f34515065..651da485579d5 100644
--- a/options/locale/locale_fr-FR.ini
+++ b/options/locale/locale_fr-FR.ini
@@ -443,7 +443,7 @@ invalid_password=Votre mot de passe ne correspond pas à celui utilisé pour cr
 reset_password_helper=Récupérer un compte
 reset_password_wrong_user=Vous êtes connecté en tant que %s, mais le lien de récupération est pour %s
 password_too_short=Le mot de passe doit contenir %d caractères minimum.
-non_local_account=Les mots de passes des comptes utilisateurs externes ne peuvent pas être modifiées depuis l'interface web Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Vérifier
 scratch_code=Code de secours
 use_scratch_code=Utiliser un code de secours
@@ -790,7 +790,7 @@ new_password=Nouveau mot de passe
 retype_new_password=Confirmer le nouveau mot de passe
 password_incorrect=Le mot de passe actuel est incorrect.
 change_password_success=Votre mot de passe a été mis à jour. Désormais, connectez-vous avec votre nouveau mot de passe.
-password_change_disabled=Les mots de passes des comptes utilisateurs externes ne peuvent pas être modifiées depuis l'interface web Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Adresses courriels
 manage_emails=Gérer les adresses courriels
diff --git a/options/locale/locale_ga-IE.ini b/options/locale/locale_ga-IE.ini
index 094f23886910c..e2a0a5dc8cda8 100644
--- a/options/locale/locale_ga-IE.ini
+++ b/options/locale/locale_ga-IE.ini
@@ -443,7 +443,7 @@ invalid_password=Ní mheaitseálann do phasfhocal leis an bhfocal faire a úsái
 reset_password_helper=Gnóthaigh Cuntas
 reset_password_wrong_user=Tá tú sínithe isteach mar %s, ach tá an nasc aisghabhála cuntas i gceist le haghaidh %s
 password_too_short=Ní féidir fad pasfhocal a bheith níos lú ná %d carachtair.
-non_local_account=Ní féidir le húsáideoirí neamháitiúla a bhfocal faire a nuashonrú trí chomhéadan gréasáin Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Fíoraigh
 scratch_code=Cód Scratch
 use_scratch_code=Úsáid cód scratch
@@ -790,7 +790,7 @@ new_password=Pasfhocal Nua
 retype_new_password=Deimhnigh Pasfhocal Nua
 password_incorrect=Tá an pasfhocal reatha mícheart.
 change_password_success=Tá do phasfhocal nuashonraithe. Sínigh isteach ag baint úsáide as do phasfhocal nua as seo amach.
-password_change_disabled=Ní féidir le húsáideoirí neamháitiúla a bhfocal faire a nuashonrú trí chomhéadan gréasáin Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Seoltaí ríomhphoist
 manage_emails=Bainistigh Seoltaí Ríomhphoist
diff --git a/options/locale/locale_hu-HU.ini b/options/locale/locale_hu-HU.ini
index 9df43afbfa17f..362aaf8e950ee 100644
--- a/options/locale/locale_hu-HU.ini
+++ b/options/locale/locale_hu-HU.ini
@@ -255,7 +255,7 @@ reset_password=Fiók Visszaállítás
 invalid_code=Az ellenőrző kód érvénytelen vagy lejárt.
 reset_password_helper=Fiók visszaállítása
 password_too_short=A jelszó nem lehet rövidebb, mint %d karakter.
-non_local_account=A nem helyi felhasználók nem frissíthetik jelszavukat a webes felületen keresztül.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Ellenőrzés
 scratch_code=Kaparós kód
 use_scratch_code=Kaparós kód használata
@@ -427,7 +427,7 @@ old_password=Jelenlegi jelszó
 new_password=Új jelszó
 password_incorrect=A megadott jelenlegi jelszó helytelen.
 change_password_success=A jelszava frissítve lett. Mostantól ezzel jelentkezhet be.
-password_change_disabled=A nem helyi felhasználók nem frissíthetik jelszavukat a webes felületen keresztül.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-mail címek
 manage_emails=E-mail címek kezelése
diff --git a/options/locale/locale_id-ID.ini b/options/locale/locale_id-ID.ini
index 9e2244c1ab1a5..5b48b247dd374 100644
--- a/options/locale/locale_id-ID.ini
+++ b/options/locale/locale_id-ID.ini
@@ -271,7 +271,7 @@ reset_password=Pemulihan Akun
 invalid_code=Kode konfirmasi Anda tidak valid atau sudah kadaluarsa.
 reset_password_helper=Pulihkan Akun
 password_too_short=Panjang kata sandi tidak boleh kurang dari %d karakter.
-non_local_account=Akun non-lokal tidak dapat mengubah kata sandi melalui antarmuka web Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Verifikasi
 scratch_code=Kode coretan
 use_scratch_code=Gunakan kode coretan
@@ -444,7 +444,7 @@ old_password=Kata Sandi Saat Ini
 new_password=Kata Sandi Baru
 password_incorrect=Kata sandi saat ini salah.
 change_password_success=Sandi Anda telah diperbarui. Mulai dari sekarang gunakan kata sandi yang baru.
-password_change_disabled=Pengguna non-lokal tidak dapat mengganti kata sandi mereka melalui antarmuka web Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Alamat Surel
 manage_emails=Kelola Alamat Surel
diff --git a/options/locale/locale_it-IT.ini b/options/locale/locale_it-IT.ini
index b89b75b2bceb0..d7be01dde81de 100644
--- a/options/locale/locale_it-IT.ini
+++ b/options/locale/locale_it-IT.ini
@@ -308,7 +308,7 @@ reset_password=Recupero account
 invalid_code=Il tuo codice di conferma è invalido oppure è scaduto.
 reset_password_helper=Recuperare account
 password_too_short=La lunghezza della password non può essere minore di %d caratteri.
-non_local_account=Gli utenti non locali non possono cambiare la loro password attraverso l'interfaccia web.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Verifica
 scratch_code=Codice Gratta e Vinci
 use_scratch_code=Utilizza un codice di zero
@@ -566,7 +566,7 @@ old_password=Password attuale
 new_password=Nuova Password
 password_incorrect=La password attuale non è corretta.
 change_password_success=La password è stata aggiornata. Utilizza la nuova password la prossima volta che effettui il login.
-password_change_disabled=Gli utenti non locali non possono cambiare la loro password attraverso l'interfaccia web.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Indirizzi e-mail
 manage_emails=Gestisci indirizzi email
diff --git a/options/locale/locale_ja-JP.ini b/options/locale/locale_ja-JP.ini
index 9121d8c11a00d..4e29e49fe35f3 100644
--- a/options/locale/locale_ja-JP.ini
+++ b/options/locale/locale_ja-JP.ini
@@ -443,7 +443,7 @@ invalid_password=アカウントの作成に使用されたパスワードと一
 reset_password_helper=アカウント回復
 reset_password_wrong_user=あなたは %s でサインイン中ですが、アカウント回復のリンクは %s のものです。
 password_too_short=%d文字未満のパスワードは設定できません。
-non_local_account=ローカルユーザーでない場合はGiteaのWebインターフェースからパスワードを変更することはできません。
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=確認
 scratch_code=スクラッチコード
 use_scratch_code=スクラッチコードを使う
@@ -790,7 +790,7 @@ new_password=新しいパスワード
 retype_new_password=新しいパスワードの確認
 password_incorrect=現在のパスワードが正しくありません。
 change_password_success=パスワードを更新しました。 今後は新しいパスワードを使ってサインインしてください。
-password_change_disabled=ローカルユーザーでない場合は、GiteaのWebインターフェースからパスワードを変更することはできません。
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=メールアドレス
 manage_emails=メールアドレスの管理
diff --git a/options/locale/locale_ko-KR.ini b/options/locale/locale_ko-KR.ini
index b6b9cf373eedf..5fa89d75dc253 100644
--- a/options/locale/locale_ko-KR.ini
+++ b/options/locale/locale_ko-KR.ini
@@ -240,7 +240,7 @@ reset_password=비밀번호 재설정
 invalid_code=검증 코드가 유효하지 않거나 만료되었습니다.
 reset_password_helper=계정 복구
 password_too_short=비밀번호의 길이는 최소 %d 자가 되어야 합니다.
-non_local_account=로컬 유저가 아닌 경우 Gitea 웹 인터페이스를 통해 비밀번호를 변경할 수 없습니다.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=확인
 scratch_code=스크래치 코드
 use_scratch_code=스크래치 코드 사용
@@ -404,7 +404,7 @@ old_password=현재 비밀번호
 new_password=새 비밀번호
 password_incorrect=현재 비밀번호가 올바르지 않습니다.
 change_password_success=비밀번호가 업데이트되었습니다. 다음 번 로그인하실 때는 새 비밀번호를 사용해 주십시오.
-password_change_disabled=로컬 유저가 아닌 경우 Gitea 웹 인터페이스를 통해 비밀번호를 변경할 수 없습니다.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=이메일 주소
 manage_emails=이메일 주소 관리
diff --git a/options/locale/locale_lv-LV.ini b/options/locale/locale_lv-LV.ini
index a55a0574c7d27..f94bb85f0ab41 100644
--- a/options/locale/locale_lv-LV.ini
+++ b/options/locale/locale_lv-LV.ini
@@ -378,7 +378,7 @@ invalid_password=Jūsu parole neatbilst parolei, kas tika ievadīta veidojot so
 reset_password_helper=Atjaunot paroli
 reset_password_wrong_user=Jūs esat pieteicies kā %s, bet konta atkopšanas saite ir paredzēta lietotājam %s
 password_too_short=Paroles garums nedrīkst būt mazāks par %d simboliem.
-non_local_account=Ārējie konti nevar mainīt paroli, izmantojot, Gitea saskarni.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Pārbaudīt
 scratch_code=Vienreizējais kods
 use_scratch_code=Izmantot vienreizējo kodu
@@ -682,7 +682,7 @@ new_password=Jauna parole
 retype_new_password=Apstiprināt jauno paroli
 password_incorrect=Ievadīta nepareiza pašreizējā parole.
 change_password_success=Parole tika veiksmīgi nomainīta. Tagad varat pieteikties ar jauno paroli.
-password_change_disabled=Ārējie konti nevar mainīt paroli, izmantojot, Gitea saskarni.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-pasta adreses
 manage_emails=Pārvaldīt e-pasta adreses
diff --git a/options/locale/locale_nl-NL.ini b/options/locale/locale_nl-NL.ini
index 4a7c05238dbb5..e532f3772a705 100644
--- a/options/locale/locale_nl-NL.ini
+++ b/options/locale/locale_nl-NL.ini
@@ -307,7 +307,7 @@ reset_password=Account herstel
 invalid_code=Uw bevestigingscode is ongeldig of is verlopen.
 reset_password_helper=Account herstellen
 password_too_short=De lengte van uw wachtwoord moet tenminste %d karakters zijn.
-non_local_account=Non-lokale gebruikers mogen hun wachtwoord niet wijzigen via de webinterface.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Verifiëren
 scratch_code=Eenmalige code
 use_scratch_code=Gebruik een eenmalige code
@@ -565,7 +565,7 @@ old_password=Huidige wachtwoord
 new_password=Nieuw wachtwoord
 password_incorrect=Het wachtwoord is niet correct.
 change_password_success=Je wachtwoord is bijgewerkt. Log vanaf nu in met je nieuwe wachtwoord.
-password_change_disabled=Niet-lokale gebruikers kunnen hun wachtwoord niet in de webinterface van Gitea wijzigen.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-mailadressen
 manage_emails=E-mailadressen beheren
diff --git a/options/locale/locale_pl-PL.ini b/options/locale/locale_pl-PL.ini
index ff4a8d7b81352..d983ee648b9c2 100644
--- a/options/locale/locale_pl-PL.ini
+++ b/options/locale/locale_pl-PL.ini
@@ -302,7 +302,7 @@ reset_password=Odzyskiwanie konta
 invalid_code=Twój kod potwierdzający jest nieprawidłowy lub wygasł.
 reset_password_helper=Odzyskaj konto
 password_too_short=Długość hasła nie może być mniejsza niż %d znaków.
-non_local_account=Konta niebędące lokalnymi nie mogą zmienić swojego hasła poprzez interfejs przeglądarkowy Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Potwierdź
 scratch_code=Kod jednorazowy
 use_scratch_code=Użyj kodu jednorazowego
@@ -532,7 +532,7 @@ old_password=Aktualne hasło
 new_password=Nowe hasło
 password_incorrect=Bieżące hasło nie jest prawidłowe.
 change_password_success=Twoje hasło zostało zaktualizowane. Od teraz możesz logować się za pomocą nowego hasła.
-password_change_disabled=Konta niebędące lokalnymi nie mogą zmienić swojego hasła poprzez interfejs przeglądarkowy Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Adresy e-mail
 manage_emails=Zarządzaj adresami e-mail
diff --git a/options/locale/locale_pt-BR.ini b/options/locale/locale_pt-BR.ini
index 407043ac2cecd..33db03387280c 100644
--- a/options/locale/locale_pt-BR.ini
+++ b/options/locale/locale_pt-BR.ini
@@ -375,7 +375,7 @@ invalid_password=Sua senha não coincide com a senha que foi usada para criar a
 reset_password_helper=Recuperar conta
 reset_password_wrong_user=Você está conectado como %s, mas o link de recuperação de conta é destinado a %s
 password_too_short=A senha deve ter %d ou mais caracteres.
-non_local_account=Usuários não-locais não podem atualizar sua senha através da interface web do Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Verificar
 scratch_code=Código de backup
 use_scratch_code=Use um código de backup
@@ -680,7 +680,7 @@ new_password=Nova senha
 retype_new_password=Confirmar nova senha
 password_incorrect=A senha atual está incorreta.
 change_password_success=Sua senha foi atualizada. Acesse usando sua nova senha de agora em diante.
-password_change_disabled=Contas não-locais não podem alterar sua senha através da interface web do Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Endereços de e-mail
 manage_emails=Gerenciar endereços de e-mail
diff --git a/options/locale/locale_pt-PT.ini b/options/locale/locale_pt-PT.ini
index 98498b252b6b9..ee14a42e523a1 100644
--- a/options/locale/locale_pt-PT.ini
+++ b/options/locale/locale_pt-PT.ini
@@ -443,7 +443,7 @@ invalid_password=A sua senha não corresponde à senha que foi usada para criar
 reset_password_helper=Recuperar conta
 reset_password_wrong_user=Tem conta iniciada como %s, mas a ligação de recuperação de conta é para %s
 password_too_short=O tamanho da senha não pode ser inferior a %d caracteres.
-non_local_account=Os utilizadores não-locais não podem alterar a sua senha através da interface web do Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Validar
 scratch_code=Código de recuperação
 use_scratch_code=Usar um código de recuperação
@@ -790,7 +790,7 @@ new_password=Nova senha
 retype_new_password=Confirme a nova senha
 password_incorrect=A senha corrente está errada.
 change_password_success=A sua senha foi substituída. Inicie a sessão com a nova senha a partir de agora.
-password_change_disabled=Os utilizadores não-locais não podem alterar a sua senha através da interface web do Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Endereços de email
 manage_emails=Gerir endereços de email
diff --git a/options/locale/locale_ru-RU.ini b/options/locale/locale_ru-RU.ini
index 970a46ee65dc5..44c0ace0b2214 100644
--- a/options/locale/locale_ru-RU.ini
+++ b/options/locale/locale_ru-RU.ini
@@ -373,7 +373,7 @@ invalid_password=Ваш пароль не совпадает с паролем,
 reset_password_helper=Восстановить аккаунт
 reset_password_wrong_user=Вы вошли как %s, но ссылка для восстановления учётной записи предназначена для %s
 password_too_short=Пароль не может быть короче %d символов.
-non_local_account=Нелокальные аккаунты не могут изменить пароль через Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Проверить
 scratch_code=Одноразовый пароль
 use_scratch_code=Использовать scratch-код
@@ -676,7 +676,7 @@ new_password=Новый пароль
 retype_new_password=Подтвердите новый пароль
 password_incorrect=Текущий пароль неправильный.
 change_password_success=Ваш пароль был изменён. С этого момента необходимо использовать новый пароль для входа.
-password_change_disabled=Нелокальные аккаунты не могут изменить пароль через Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Email адреса
 manage_emails=Управление адресами электронной почты
diff --git a/options/locale/locale_si-LK.ini b/options/locale/locale_si-LK.ini
index f9acaff64f6db..c23af03ca0e8a 100644
--- a/options/locale/locale_si-LK.ini
+++ b/options/locale/locale_si-LK.ini
@@ -276,7 +276,7 @@ reset_password=ගිණුම ප්‍රතිසාධනය
 invalid_code=ඔබගේ තහවුරු කිරීමේ කේතය අවලංගු හෝ කල් ඉකුත් වී ඇත.
 reset_password_helper=ගිණුම ප්‍රතිසාධනය
 password_too_short=මුරපදයේ දිග %d අක්ෂර වලට වඩා අඩු විය නොහැක.
-non_local_account=දේශීය නොවන පරිශීලකයින්ට Gitea වෙබ් අතුරුමුහුණත හරහා ඔවුන්ගේ මුරපදය යාවත්කාලීන කළ නොහැක.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=සත්යාපනය කරන්න
 scratch_code=සීරීම් කේතය
 use_scratch_code=සීරීම් කේතයක් භාවිතා කරන්න
@@ -515,7 +515,7 @@ old_password=වත්මන් මුරපදය
 new_password=නව මුරපදය
 password_incorrect=වත්මන් මුරපදය වැරදිය.
 change_password_success=ඔබගේ මුරපදය යාවත්කාලීන කර ඇත. මෙතැන් සිට ඔබගේ නව මුරපදය භාවිතා කරමින් පුරනය වන්න.
-password_change_disabled=දේශීය නොවන පරිශීලකයින්ට Gitea වෙබ් අතුරුමුහුණත හරහා ඔවුන්ගේ මුරපදය යාවත්කාලීන කළ නොහැක.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=වි-තැපැල් ලිපින
 manage_emails=වි-තැපැල් ලිපින කළමනාකරණය
@@ -1243,7 +1243,7 @@ pulls.cant_reopen_deleted_branch=ශාඛාව මකා දැමූ නි
 pulls.merged=සංයුක්ත කෙරිණි
 pulls.manually_merged=අතින් සංයුක්ත කර ඇත
 pulls.is_closed=අදින්න ඉල්ලීම වසා දමා ඇත.
-pulls.title_wip_desc=<a href="#">අහම්බෙන් ඒකාබද්ධ කිරීමෙන් අදින්න ඉල්ලීම වැළැක්වීම සඳහා <strong>%s</strong></a> සමඟ මාතෘකාව ආරම්භ කරන්න. 
+pulls.title_wip_desc=<a href="#">අහම්බෙන් ඒකාබද්ධ කිරීමෙන් අදින්න ඉල්ලීම වැළැක්වීම සඳහා <strong>%s</strong></a> සමඟ මාතෘකාව ආරම්භ කරන්න.
 pulls.cannot_merge_work_in_progress=මෙම අදින්න ඉල්ලීම ක්රියාත්මක වන කාර්යයක් ලෙස සලකුණු කර ඇත.
 pulls.still_in_progress=තවමත් ක්රියාත්මක වෙමින් තිබේද?
 pulls.add_prefix=<strong>%s</strong> උපසර්ගය එකතු කරන්න
@@ -1287,7 +1287,7 @@ pulls.rebase_conflict_summary=දෝෂ පණිවිඩය
 pulls.unrelated_histories=ඒකාබද්ධ කිරීම අසමත් විය: ඒකාබද්ධ හිස සහ පාදය පොදු ඉතිහාසයක් බෙදා නොගනී. ඉඟිය: වෙනත් උපාය මාර්ගයක් උත්සාහ කරන්න
 pulls.merge_out_of_date=ඒකාබද්ධ කිරීම අසමත් විය: ඒකාබද්ධ කිරීම ජනනය කරන අතර, පදනම යාවත්කාලීන කරන ලදී. ඉඟිය: නැවත උත්සාහ කරන්න.
 pulls.push_rejected_summary=පූර්ණ ප්රතික්ෂේප පණිවිඩය
-pulls.open_unmerged_pull_exists=සමාන ගුණාංග සහිත අදින්න ඉල්ලීමක් (#%d) ඇති බැවින් ඔබට නැවත විවෘත කිරීමේ මෙහෙයුමක් කළ නොහැක. 
+pulls.open_unmerged_pull_exists=සමාන ගුණාංග සහිත අදින්න ඉල්ලීමක් (#%d) ඇති බැවින් ඔබට නැවත විවෘත කිරීමේ මෙහෙයුමක් කළ නොහැක.
 pulls.status_checking=සමහර චෙක්පත් බලා ඇත
 pulls.status_checks_success=සියලුම චෙක්පත් සාර්ථක විය
 pulls.status_checks_warning=සමහර චෙක්පත් අනතුරු ඇඟවීම් වාර්තා කරයි
diff --git a/options/locale/locale_sk-SK.ini b/options/locale/locale_sk-SK.ini
index 20f26db801306..00d00f125bf62 100644
--- a/options/locale/locale_sk-SK.ini
+++ b/options/locale/locale_sk-SK.ini
@@ -362,7 +362,7 @@ invalid_code=Váš potvrdzovací kód je chybný alebo vypršala jeho platnosť.
 invalid_password=Vaše heslo sa nezhoduje s heslom, ktoré bolo použité na vytvorenie účtu.
 reset_password_helper=Obnoviť účet
 password_too_short=Heslo nemôže obsahovať menej ako %d znakov.
-non_local_account=Externe overovaní používatelia nemôžu aktualizovať svoje heslo prostredníctvom webového rozhrania Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Overiť
 scratch_code=Pomocný kód
 use_scratch_code=Použiť pomocný kód
@@ -630,7 +630,7 @@ old_password=Aktuálne heslo
 new_password=Nové heslo
 password_incorrect=Aktuálne heslo nie je správne.
 change_password_success=Vaše heslo bolo aktualizované. Od teraz sa prihlasujte novým heslom.
-password_change_disabled=Externe overovaní používatelia nemôžu aktualizovať svoje heslo prostredníctvom webového rozhrania Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-mailové adresy
 manage_emails=Správa e-mailových adries
diff --git a/options/locale/locale_sv-SE.ini b/options/locale/locale_sv-SE.ini
index 3ed904aca243f..099aa331d588e 100644
--- a/options/locale/locale_sv-SE.ini
+++ b/options/locale/locale_sv-SE.ini
@@ -263,7 +263,7 @@ reset_password=Kontoåterställning
 invalid_code=Din bekräftelsekod är ogiltig eller har löpt ut.
 reset_password_helper=Återställ konto
 password_too_short=Lösenordet får ej vara kortare än %d tecken.
-non_local_account=Externa användare kan inte ändra sitt lösenord genom Giteas webbgränssnitt.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Verifiera
 scratch_code=Skrapkod
 use_scratch_code=Använd en skrapkod
@@ -449,7 +449,7 @@ old_password=Nuvarande lösenord
 new_password=Nytt lösenord
 password_incorrect=Det nuvarande lösenordet är felaktigt.
 change_password_success=Ditt lösenord har uppdaterats. Logga in med ditt nya lösenord fortsättningsvis.
-password_change_disabled=Externa användare kan inte ändra sitt lösenord genom Giteas webbgränssnitt.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-postadresser
 manage_emails=Hantera mejladresser
diff --git a/options/locale/locale_tr-TR.ini b/options/locale/locale_tr-TR.ini
index 4e389217e976d..c100a1f92d185 100644
--- a/options/locale/locale_tr-TR.ini
+++ b/options/locale/locale_tr-TR.ini
@@ -426,7 +426,7 @@ invalid_password=Parolanız hesap oluşturulurken kullanılan parolayla eşleşm
 reset_password_helper=Hesabı Kurtar
 reset_password_wrong_user=%s olarak oturum açmışsınız, ancak hesap kurtarma bağlantısı %s için
 password_too_short=Parolanız en az %d karakter uzunluğunda olmalıdır.
-non_local_account=Yerel olmayan kullanıcılar parolalarını Gitea web arayüzünden güncelleyemezler.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Doğrula
 scratch_code=Çizgi kodu
 use_scratch_code=Bir çizgi kodu kullanınız
@@ -762,7 +762,7 @@ new_password=Yeni Parola
 retype_new_password=Yeni Parolayı Onayla
 password_incorrect=Mevcut parola hatalı.
 change_password_success=Parolanız güncelleştirildi. Şu andan itibaren yeni parolanızı kullanarak oturum açın.
-password_change_disabled=Yerel olmayan kullanıcılar parolalarını Gitea web arayüzünden güncelleyemezler.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=E-Posta Adresleri
 manage_emails=E-posta Adreslerini Yönet
diff --git a/options/locale/locale_uk-UA.ini b/options/locale/locale_uk-UA.ini
index cc9d668bfb56d..96c45afe81f4c 100644
--- a/options/locale/locale_uk-UA.ini
+++ b/options/locale/locale_uk-UA.ini
@@ -290,7 +290,7 @@ reset_password=Відновлення облікового запису
 invalid_code=Цей код підтвердження недійсний або закінчився.
 reset_password_helper=Відновити обліковий запис
 password_too_short=Довжина пароля не може бути меншою за %d символів.
-non_local_account=Нелокальні акаунти не можуть змінити пароль через Gitea.
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=Підтвердити
 scratch_code=Одноразовий пароль
 use_scratch_code=Використовувати одноразовий пароль
@@ -535,7 +535,7 @@ old_password=Поточний пароль
 new_password=Новий пароль
 password_incorrect=Поточний пароль неправильний.
 change_password_success=Ваш пароль був оновлений. Тепер увійдіть в систему, використовуючи новий пароль.
-password_change_disabled=Нелокальні акаунти не можуть змінити пароль через Gitea.
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=Адреса електронної пошти
 manage_emails=Керування адресами ел. пошти
diff --git a/options/locale/locale_zh-CN.ini b/options/locale/locale_zh-CN.ini
index b15d2c80a183e..c23d8b4d00691 100644
--- a/options/locale/locale_zh-CN.ini
+++ b/options/locale/locale_zh-CN.ini
@@ -442,7 +442,7 @@ invalid_password=您的密码与用于创建账户的密码不匹配。
 reset_password_helper=恢复账户
 reset_password_wrong_user=您以 %s 登录，但恢复账号链接是用于 %s。
 password_too_short=密码长度不能少于 %d 位。
-non_local_account=非本地帐户不能通过 Gitea 的 web 界面更改密码。
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=验证
 scratch_code=验证口令
 use_scratch_code=使用验证口令
@@ -789,7 +789,7 @@ new_password=新的密码
 retype_new_password=确认新密码
 password_incorrect=当前密码不正确！
 change_password_success=您的密码已更新。从现在开始使用您的新密码登录。
-password_change_disabled=非本地帐户不能通过 Gitea 的 web 界面更改密码。
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=邮箱地址
 manage_emails=管理邮箱地址
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index 7538cbaf2d3c4..551ef7f23ea2a 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -429,7 +429,7 @@ invalid_password=您的密碼和用來建立帳戶的不符。
 reset_password_helper=帳戶救援
 reset_password_wrong_user=您已經使用 %s 的帳戶登入，但帳戶救援連結是給 %s 的
 password_too_short=密碼長度不能少於 %d 個字！
-non_local_account=非本地帳戶無法透過 Gitea 的網頁介面更改密碼。
+non_local_account = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 verify=驗證
 scratch_code=備用驗證碼
 use_scratch_code=使用備用驗證碼
@@ -771,7 +771,7 @@ new_password=新的密碼
 retype_new_password=確認新密碼
 password_incorrect=輸入的密碼不正確！
 change_password_success=您的密碼已更新。 從現在起使用您的新密碼登入。
-password_change_disabled=非本地帳戶無法透過 Gitea 的網頁介面更改密碼。
+password_change_disabled = You can manage your Blender ID password <a href="https://id.blender.org/settings/profile">here</a>.
 
 emails=電子信箱
 manage_emails=管理電子信箱
diff --git a/public/assets/img/blenderid.png b/public/assets/img/blenderid.png
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 23e51161b8c69..fcb5d93233a76 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -458,7 +458,7 @@ func reqRepoWriter(unitTypes ...unit.Type) func(ctx *context.APIContext) {
 // reqRepoBranchWriter user should have a permission to write to a branch, or be a site admin
 func reqRepoBranchWriter(ctx *context.APIContext) {
 	options, ok := web.GetForm(ctx).(api.FileOptionInterface)
-	if !ok || (!ctx.Repo.CanWriteToBranch(ctx, ctx.Doer, options.Branch()) && !ctx.IsUserSiteAdmin()) {
+	if !ok || (!context.CanWriteToBranch(ctx, ctx.Doer, ctx.Repo.Repository, options.Branch()) && !ctx.IsUserSiteAdmin()) {
 		ctx.APIError(http.StatusForbidden, "user should have a permission to write to this branch")
 		return
 	}
@@ -1020,6 +1020,8 @@ func Routes() *web.Router {
 				}, reqSelfOrAdmin(), reqBasicOrRevProxyAuth())
 
 				m.Get("/activities/feeds", user.ListUserActivityFeeds)
+				// BLENDER: contributor agreement
+				m.Get("/contributor-agreements/{slug}", user.CheckContributorAgreement)
 			}, context.UserAssignmentAPI(), checkTokenPublicOnly(), individualPermsChecker)
 		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser))
 
diff --git a/routers/api/v1/repo/file.go b/routers/api/v1/repo/file.go
index f40d39a2517f6..9431e8f36f978 100644
--- a/routers/api/v1/repo/file.go
+++ b/routers/api/v1/repo/file.go
@@ -407,7 +407,7 @@ func GetEditorconfig(ctx *context.APIContext) {
 
 // canWriteFiles returns true if repository is editable and user has proper access level.
 func canWriteFiles(ctx *context.APIContext, branch string) bool {
-	return ctx.Repo.CanWriteToBranch(ctx, ctx.Doer, branch) &&
+	return context.CanWriteToBranch(ctx, ctx.Doer, ctx.Repo.Repository, branch) &&
 		!ctx.Repo.Repository.IsMirror &&
 		!ctx.Repo.Repository.IsArchived
 }
diff --git a/routers/api/v1/user/contributor_agreement.go b/routers/api/v1/user/contributor_agreement.go
new file mode 100644
index 0000000000000..c9ff5ddccf5ad
--- /dev/null
+++ b/routers/api/v1/user/contributor_agreement.go
@@ -0,0 +1,65 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: contributor agreement
+
+package user
+
+import (
+	"fmt"
+	"net/http"
+
+	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/services/context"
+
+	"xorm.io/builder"
+)
+
+func CheckContributorAgreement(ctx *context.APIContext) {
+	// swagger:operation GET /users/{username}/contributor-agreements/{slug} user userCheckContributorAgreement
+	// ---
+	// summary: Check if contributor agreement is signed by the user
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: username
+	//   in: path
+	//   description: username of user
+	//   type: string
+	//   required: true
+	// - name: slug
+	//   in: path
+	//   description: slug of a contributor agreement to check
+	//   type: string
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/string"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
+	slug := ctx.PathParam("slug")
+	ca, exist, err := db.Get[user_model.ContributorAgreement](ctx, builder.Eq{"slug": slug})
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if !exist {
+		ctx.APIError(http.StatusNotFound, fmt.Sprintf("Contributor agreement <%s> is not found.", slug))
+		return
+	}
+	_, exist, err = db.Get[user_model.SignedContributorAgreement](ctx, builder.Eq{
+		"contributor_agreement_id": ca.ID,
+		"user_id":                  ctx.ContextUser.ID,
+	})
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if !exist {
+		ctx.PlainText(http.StatusNotFound, fmt.Sprintf("Contributor agreement <%s> is not signed. Sign at Settings > Contributor Agreements.", slug))
+		return
+	}
+	ctx.PlainText(http.StatusOK, "OK")
+}
diff --git a/routers/common/blockexpensive.go b/routers/common/blockexpensive.go
index f52aa2b709286..b0c3aee079641 100644
--- a/routers/common/blockexpensive.go
+++ b/routers/common/blockexpensive.go
@@ -39,28 +39,28 @@ func isRoutePathExpensive(routePattern string) bool {
 	}
 
 	expensivePaths := []string{
-		// code related
+		// code related, very expensive pages
 		"/{username}/{reponame}/archive/",
 		"/{username}/{reponame}/blame/",
-		"/{username}/{reponame}/commit/",
-		"/{username}/{reponame}/commits/",
 		"/{username}/{reponame}/graph",
-		"/{username}/{reponame}/media/",
-		"/{username}/{reponame}/raw/",
-		"/{username}/{reponame}/src/",
 
-		// issue & PR related (no trailing slash)
-		"/{username}/{reponame}/issues",
-		"/{username}/{reponame}/{type:issues}",
-		"/{username}/{reponame}/pulls",
-		"/{username}/{reponame}/{type:pulls}",
-
-		// wiki
-		"/{username}/{reponame}/wiki/",
+		// activity, trailing slash removed
+		"/{username}/{reponame}/activity",
+	}
 
-		// activity
-		"/{username}/{reponame}/activity/",
+	if !(strings.HasPrefix(routePattern, "/blender/") ||
+		strings.HasPrefix(routePattern, "/studio/") ||
+		strings.HasPrefix(routePattern, "/extensions/") ||
+		strings.HasPrefix(routePattern, "/infrastructure/")) {
+		// code related, less expensive not allowed in forks
+		expensivePaths = append(expensivePaths,
+			"/{username}/{reponame}/media/",
+			"/{username}/{reponame}/commit/",
+			"/{username}/{reponame}/commits/",
+			"/{username}/{reponame}/src/",
+			"/{username}/{reponame}/raw/")
 	}
+
 	for _, path := range expensivePaths {
 		if strings.HasPrefix(routePattern, path) {
 			return true
diff --git a/routers/web/admin/spamreports.go b/routers/web/admin/spamreports.go
new file mode 100644
index 0000000000000..8b893a0c0f67d
--- /dev/null
+++ b/routers/web/admin/spamreports.go
@@ -0,0 +1,150 @@
+// Copyright 2025 The Gitea Authors.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: spam reporting
+
+package admin
+
+import (
+	"net/http"
+	"strconv"
+
+	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/templates"
+	"code.gitea.io/gitea/services/context"
+	user_service "code.gitea.io/gitea/services/user"
+)
+
+const (
+	tplSpamReports templates.TplName = "admin/spamreports/list"
+)
+
+// GetPendingSpamReports populates the counter for the header section displayed to site admins.
+func GetPendingSpamReports(ctx *context.Context) {
+	if ctx.Doer == nil || !ctx.Doer.IsAdmin {
+		return
+	}
+	ids, err := user_model.GetPendingSpamReportIDs(ctx)
+	if err != nil {
+		log.Error("Failed to GetPendingSpamReportIDs while rendering header: %v", err)
+		ctx.Data["PendingSpamReports"] = -1
+		return
+	}
+	ctx.Data["PendingSpamReports"] = len(ids)
+}
+
+// SpamReports shows spam reports
+func SpamReports(ctx *context.Context) {
+	ctx.Data["Title"] = ctx.Tr("admin.spamreports")
+	ctx.Data["PageIsSpamReports"] = true
+
+	var (
+		count        int64
+		err          error
+		filterStatus user_model.SpamReportStatusType
+	)
+
+	// When no value is specified reports are filtered by status=pending (=0),
+	// which luckily makes sense as a default view.
+	filterStatus = user_model.SpamReportStatusType(ctx.FormInt("status"))
+	ctx.Data["FilterStatus"] = filterStatus
+	opts := &user_model.ListSpamReportsOptions{
+		ListOptions: db.ListOptions{
+			PageSize: setting.UI.Admin.UserPagingNum,
+			Page:     ctx.FormInt("page"),
+		},
+		Status: filterStatus,
+	}
+
+	if opts.Page <= 1 {
+		opts.Page = 1
+	}
+
+	spamReports, count, err := user_model.ListSpamReports(ctx, opts)
+	if err != nil {
+		ctx.ServerError("SpamReports", err)
+		return
+	}
+
+	ctx.Data["Total"] = count
+	ctx.Data["SpamReports"] = spamReports
+
+	statusCounts, err := user_model.GetSpamReportStatusCounts(ctx)
+	if err != nil {
+		ctx.ServerError("GetSpamReportStatusCounts", err)
+		return
+	}
+	ctx.Data["StatusCounts"] = statusCounts
+
+       var pagerCount int
+       for _, sc := range statusCounts {
+		if sc.Status == filterStatus {
+			pagerCount = int(sc.Count)
+			break
+		}
+	}
+
+	pager := context.NewPagination(pagerCount, opts.PageSize, opts.Page, 5)
+	pager.AddParamFromRequest(ctx.Req)
+	ctx.Data["Page"] = pager
+
+	ctx.HTML(http.StatusOK, tplSpamReports)
+}
+
+// SpamReportsPost handles "process" and "dismiss" actions for pending reports.
+// The processing is done synchronously.
+func SpamReportsPost(ctx *context.Context) {
+	action := ctx.FormString("action")
+	// ctx.Req.PostForm is now parsed due to the call to FormString above
+	spamReportIDs := make([]int64, 0, len(ctx.Req.PostForm["spamreport_id"]))
+	for _, idStr := range ctx.Req.PostForm["spamreport_id"] {
+		id, err := strconv.ParseInt(idStr, 10, 64)
+		if err != nil {
+			ctx.ServerError("ParseSpamReportID", err)
+			return
+		}
+		spamReportIDs = append(spamReportIDs, id)
+	}
+
+	if action == "process" {
+		if err := user_service.ProcessSpamReports(ctx, ctx.Doer, spamReportIDs); err != nil {
+			ctx.ServerError("ProcessSpamReports", err)
+			return
+		}
+	}
+	if action == "dismiss" {
+		if err := user_service.DismissSpamReports(ctx, spamReportIDs); err != nil {
+			ctx.ServerError("DismissSpamReports", err)
+			return
+		}
+	}
+	ctx.Redirect(setting.AppSubURL + "/-/admin/spamreports")
+}
+
+// PurgeSpammerPost is a shortcut for admins to report and process at the same time.
+func PurgeSpammerPost(ctx *context.Context) {
+	username := ctx.FormString("username")
+
+	user, err := user_model.GetUserByName(ctx, username)
+	if err != nil {
+		ctx.NotFoundOrServerError("GetUserByName", user_model.IsErrUserNotExist, nil)
+		return
+	}
+	spamReport, err := user_service.CreateSpamReport(ctx, ctx.Doer, user)
+	if err != nil {
+		ctx.ServerError("CreateSpamReport", err)
+		return
+	}
+	if err := user_service.ProcessSpamReports(ctx, ctx.Doer, []int64{spamReport.ID}); err != nil {
+		ctx.ServerError("ProcessSpamReports", err)
+		return
+	}
+
+	if ctx.Written() {
+		return
+	}
+	ctx.Redirect(setting.AppSubURL + "/" + username)
+}
diff --git a/routers/web/auth/auth.go b/routers/web/auth/auth.go
index 87edbc357bcfd..b98fad647aad1 100644
--- a/routers/web/auth/auth.go
+++ b/routers/web/auth/auth.go
@@ -164,6 +164,26 @@ func CheckAutoLogin(ctx *context.Context) bool {
 	return false
 }
 
+// BLENDER: always use OAuth unless ?noredirect=true is set
+func checkForceOAuth(ctx *context.Context) bool {
+	// Check if authentication is forced to OAuth
+	if ctx.FormBool("noredirect") {
+		return false
+	}
+
+	oauth2Providers, err := oauth2.GetOAuth2Providers(ctx, optional.Some(true))
+	if err != nil {
+		return false
+	}
+
+	for _, provider := range oauth2Providers {
+		ctx.Redirect(setting.AppSubURL + "/user/oauth2/" + provider.Name())
+		return true
+	}
+
+	return false
+}
+
 func prepareSignInPageData(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("sign_in")
 	ctx.Data["OAuth2Providers"], _ = oauth2.GetOAuth2Providers(ctx, optional.Some(true))
@@ -185,6 +205,10 @@ func SignIn(ctx *context.Context) {
 	if CheckAutoLogin(ctx) {
 		return
 	}
+	// BLENDER: Check if authentication is forced to OAuth
+	if checkForceOAuth(ctx) {
+		return
+	}
 	if ctx.IsSigned {
 		RedirectAfterLogin(ctx)
 		return
diff --git a/routers/web/auth/oauth.go b/routers/web/auth/oauth.go
index a13b987aabeda..8c831e5e66c04 100644
--- a/routers/web/auth/oauth.go
+++ b/routers/web/auth/oauth.go
@@ -21,7 +21,9 @@ import (
 	"code.gitea.io/gitea/modules/session"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/templates"
+	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/web/middleware"
+	auth_service "code.gitea.io/gitea/services/auth"
 	source_service "code.gitea.io/gitea/services/auth/source"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 	"code.gitea.io/gitea/services/context"
@@ -299,8 +301,32 @@ func updateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {
 	}
 }
 
+// BLENDER: sync user badges
+func updateBadgesIfNeed(ctx *context.Context, rawData map[string]any, u *user_model.User) error {
+	blenderIDBadges, has := rawData["badges"]
+	if !has {
+		return nil
+	}
+	remoteBadgesMap, ok := blenderIDBadges.(map[string]any)
+	if !ok {
+		return fmt.Errorf("unexpected format of remote badges payload: %+v", blenderIDBadges)
+	}
+
+	remoteBadges := make([]*user_model.Badge, 0, len(remoteBadgesMap))
+	for slug := range remoteBadgesMap {
+		remoteBadges = append(remoteBadges, &user_model.Badge{Slug: slug})
+	}
+	return user_service.UpdateBadgesBestEffort(ctx, u, remoteBadges)
+}
+
 func handleOAuth2SignIn(ctx *context.Context, source *auth.Source, u *user_model.User, gothUser goth.User) {
 	updateAvatarIfNeed(ctx, gothUser.AvatarURL, u)
+	// BLENDER: sync user badges
+	// Don't escalate any errors, only log them:
+	// we don't want to break login process due to errors in badges sync
+	if err := updateBadgesIfNeed(ctx, gothUser.RawData, u); err != nil {
+		log.Error("Failed to update user badges for %s: %w", u.LoginName, err)
+	}
 
 	needs2FA := false
 	if !source.TwoFactorShouldSkip() {
@@ -368,6 +394,17 @@ func handleOAuth2SignIn(ctx *context.Context, source *auth.Source, u *user_model
 			return
 		}
 
+		// BLENDER: remember login for Blender ID.
+		// A proper OAuth implementation would check how long the access token is
+		// valid depending on the provider, but since this is only for Blender ID
+		// we can just set days in the Gitea config.
+		nt, token, err := auth_service.CreateAuthTokenForUserID(ctx, u.ID)
+		if err != nil {
+			ctx.ServerError("CreateAuthTokenForUserID", err)
+			return
+		}
+		ctx.SetSiteCookie(setting.CookieRememberName, nt.ID+":"+token, setting.LogInRememberDays*timeutil.Day)
+
 		// force to generate a new CSRF token
 		ctx.Csrf.PrepareForSessionUser(ctx)
 
diff --git a/routers/web/repo/cherry_pick.go b/routers/web/repo/cherry_pick.go
index 690b830bc2f2a..bc1fd1c14e69f 100644
--- a/routers/web/repo/cherry_pick.go
+++ b/routers/web/repo/cherry_pick.go
@@ -47,7 +47,7 @@ func CherryPick(ctx *context.Context) {
 		ctx.Data["commit_message"] = splits[1]
 	}
 
-	canCommit := renderCommitRights(ctx)
+	canCommit := renderCommitRights(ctx, ctx.Repo.Repository)
 	ctx.Data["TreePath"] = ""
 
 	if canCommit {
@@ -55,7 +55,7 @@ func CherryPick(ctx *context.Context) {
 	} else {
 		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
 	}
-	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx)
+	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx, ctx.Repo.Repository)
 	ctx.Data["last_commit"] = ctx.Repo.CommitID
 	ctx.Data["LineWrapExtensions"] = strings.Join(setting.Repository.Editor.LineWrapExtensions, ",")
 	ctx.Data["BranchLink"] = ctx.Repo.RepoLink + "/src/" + ctx.Repo.RefTypeNameSubURL()
@@ -75,7 +75,7 @@ func CherryPickPost(ctx *context.Context) {
 		ctx.Data["CherryPickType"] = "cherry-pick"
 	}
 
-	canCommit := renderCommitRights(ctx)
+	canCommit := renderCommitRights(ctx, ctx.Repo.Repository)
 	branchName := ctx.Repo.BranchName
 	if form.CommitChoice == frmCommitChoiceNewBranch {
 		branchName = form.NewBranchName
diff --git a/routers/web/repo/editor.go b/routers/web/repo/editor.go
index cbcb3a3b21d87..1ed49793d23fb 100644
--- a/routers/web/repo/editor.go
+++ b/routers/web/repo/editor.go
@@ -1,4 +1,5 @@
 // Copyright 2016 The Gogs Authors. All rights reserved.
+// Copyright 2025 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
 package repo
@@ -39,37 +40,47 @@ const (
 	frmCommitChoiceNewBranch string = "commit-to-new-branch"
 )
 
-func canCreateBasePullRequest(ctx *context.Context) bool {
-	baseRepo := ctx.Repo.Repository.BaseRepo
+func canCreateBasePullRequest(ctx *context.Context, editRepo *repo_model.Repository) bool {
+	baseRepo := editRepo.BaseRepo
 	return baseRepo != nil && baseRepo.UnitEnabled(ctx, unit.TypePullRequests)
 }
 
-func renderCommitRights(ctx *context.Context) bool {
-	canCommitToBranch, err := ctx.Repo.CanCommitToBranch(ctx, ctx.Doer)
+func renderCommitRights(ctx *context.Context, editRepo *repo_model.Repository) bool {
+	canCommitToBranch, err := context.CanCommitToBranch(ctx, ctx.Doer, editRepo, ctx.Repo.BranchName)
 	if err != nil {
 		log.Error("CanCommitToBranch: %v", err)
 	}
+
+	if editRepo.ID == ctx.Repo.Repository.ID {
+		// Editing the same repository that we are viewing
+		ctx.Data["CanCreatePullRequest"] = ctx.Repo.Repository.UnitEnabled(ctx, unit.TypePullRequests) || canCreateBasePullRequest(ctx, editRepo)
+	} else {
+		// Editing a user fork of the repository we are viewing, always choose a new branch
+		canCommitToBranch.CanCommitToBranch = false
+		canCommitToBranch.UserCanPush = false
+		ctx.Data["CanCreatePullRequest"] = canCreateBasePullRequest(ctx, editRepo)
+	}
+
 	ctx.Data["CanCommitToBranch"] = canCommitToBranch
-	ctx.Data["CanCreatePullRequest"] = ctx.Repo.Repository.UnitEnabled(ctx, unit.TypePullRequests) || canCreateBasePullRequest(ctx)
 
 	return canCommitToBranch.CanCommitToBranch
 }
 
 // redirectForCommitChoice redirects after committing the edit to a branch
-func redirectForCommitChoice(ctx *context.Context, commitChoice, newBranchName, treePath string) {
+func redirectForCommitChoice(ctx *context.Context, editRepo *repo_model.Repository, commitChoice, newBranchName, treePath string) {
 	if commitChoice == frmCommitChoiceNewBranch {
 		// Redirect to a pull request when possible
 		redirectToPullRequest := false
-		repo := ctx.Repo.Repository
+		repo := editRepo
 		baseBranch := ctx.Repo.BranchName
 		headBranch := newBranchName
-		if repo.UnitEnabled(ctx, unit.TypePullRequests) {
-			redirectToPullRequest = true
-		} else if canCreateBasePullRequest(ctx) {
+		if canCreateBasePullRequest(ctx, repo) {
 			redirectToPullRequest = true
 			baseBranch = repo.BaseRepo.DefaultBranch
 			headBranch = repo.Owner.Name + "/" + repo.Name + ":" + headBranch
 			repo = repo.BaseRepo
+		} else if repo.UnitEnabled(ctx, unit.TypePullRequests) {
+			redirectToPullRequest = true
 		}
 
 		if redirectToPullRequest {
@@ -82,7 +93,7 @@ func redirectForCommitChoice(ctx *context.Context, commitChoice, newBranchName,
 
 	ctx.RedirectToCurrentSite(
 		returnURI,
-		ctx.Repo.RepoLink+"/src/branch/"+util.PathEscapeSegments(newBranchName)+"/"+util.PathEscapeSegments(treePath),
+		editRepo.Link()+"/src/branch/"+util.PathEscapeSegments(newBranchName)+"/"+util.PathEscapeSegments(treePath),
 	)
 }
 
@@ -112,8 +123,14 @@ func editFileCommon(ctx *context.Context, isNewFile bool) {
 }
 
 func editFile(ctx *context.Context, isNewFile bool) {
+	editRepo := getEditRepositoryOrFork(ctx, util.Iif(isNewFile, "_new", "_edit"))
+	if editRepo == nil {
+		return
+	}
+
 	editFileCommon(ctx, isNewFile)
-	canCommit := renderCommitRights(ctx)
+
+	canCommit := renderCommitRights(ctx, editRepo)
 
 	treePath := cleanUploadFileName(ctx.Repo.TreePath)
 	if treePath != ctx.Repo.TreePath {
@@ -189,7 +206,7 @@ func editFile(ctx *context.Context, isNewFile bool) {
 	ctx.Data["commit_summary"] = ""
 	ctx.Data["commit_message"] = ""
 	ctx.Data["commit_choice"] = util.Iif(canCommit, frmCommitChoiceDirect, frmCommitChoiceNewBranch)
-	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx)
+	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx, editRepo)
 	ctx.Data["last_commit"] = ctx.Repo.CommitID
 
 	ctx.Data["EditorconfigJson"] = GetEditorConfig(ctx, treePath)
@@ -222,9 +239,9 @@ func NewFile(ctx *context.Context) {
 
 func editFilePost(ctx *context.Context, form forms.EditRepoFileForm, isNewFile bool) {
 	editFileCommon(ctx, isNewFile)
+
 	ctx.Data["PageHasPosted"] = true
 
-	canCommit := renderCommitRights(ctx)
 	treeNames, treePaths := getParentTreeFields(form.TreePath)
 	branchName := ctx.Repo.BranchName
 	if form.CommitChoice == frmCommitChoiceNewBranch {
@@ -247,11 +264,15 @@ func editFilePost(ctx *context.Context, form forms.EditRepoFileForm, isNewFile b
 		return
 	}
 
+	editRepo := getEditRepositoryOrError(ctx, tplEditFile, &form)
+	if editRepo == nil {
+		return
+	}
+
+	renderCommitRights(ctx, editRepo)
+
 	// Cannot commit to an existing branch if user doesn't have rights
-	if branchName == ctx.Repo.BranchName && !canCommit {
-		ctx.Data["Err_NewBranchName"] = true
-		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
-		ctx.RenderWithErr(ctx.Tr("repo.editor.cannot_commit_to_protected_branch", branchName), tplEditFile, &form)
+	if !canPushToEditRepository(ctx, editRepo, branchName, form.CommitChoice, tplEditFile, &form) {
 		return
 	}
 
@@ -282,9 +303,14 @@ func editFilePost(ctx *context.Context, form forms.EditRepoFileForm, isNewFile b
 		operation = "create"
 	}
 
-	if _, err := files_service.ChangeRepoFiles(ctx, ctx.Repo.Repository, ctx.Doer, &files_service.ChangeRepoFilesOptions{
+	editBranchName, err := pushToEditRepositoryOrError(ctx, editRepo, branchName, tplEditFile, &form)
+	if err != nil {
+		return
+	}
+
+	if _, err := files_service.ChangeRepoFiles(ctx, editRepo, ctx.Doer, &files_service.ChangeRepoFilesOptions{
 		LastCommitID: form.LastCommit,
-		OldBranch:    ctx.Repo.BranchName,
+		OldBranch:    editBranchName,
 		NewBranch:    branchName,
 		Message:      message,
 		Files: []*files_service.ChangeRepoFile{
@@ -376,7 +402,7 @@ func editFilePost(ctx *context.Context, form forms.EditRepoFileForm, isNewFile b
 		}
 	}
 
-	redirectForCommitChoice(ctx, form.CommitChoice, branchName, form.TreePath)
+	redirectForCommitChoice(ctx, editRepo, form.CommitChoice, branchName, form.TreePath)
 }
 
 // EditFilePost response for editing file
@@ -424,6 +450,11 @@ func DiffPreviewPost(ctx *context.Context) {
 
 // DeleteFile render delete file page
 func DeleteFile(ctx *context.Context) {
+	editRepo := getEditRepositoryOrFork(ctx, "_delete")
+	if editRepo == nil {
+		return
+	}
+
 	ctx.Data["PageIsDelete"] = true
 	ctx.Data["BranchLink"] = ctx.Repo.RepoLink + "/src/" + ctx.Repo.RefTypeNameSubURL()
 	treePath := cleanUploadFileName(ctx.Repo.TreePath)
@@ -434,7 +465,7 @@ func DeleteFile(ctx *context.Context) {
 	}
 
 	ctx.Data["TreePath"] = treePath
-	canCommit := renderCommitRights(ctx)
+	canCommit := renderCommitRights(ctx, editRepo)
 
 	ctx.Data["commit_summary"] = ""
 	ctx.Data["commit_message"] = ""
@@ -444,7 +475,7 @@ func DeleteFile(ctx *context.Context) {
 	} else {
 		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
 	}
-	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx)
+	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx, editRepo)
 
 	ctx.HTML(http.StatusOK, tplDeleteFile)
 }
@@ -452,7 +483,6 @@ func DeleteFile(ctx *context.Context) {
 // DeleteFilePost response for deleting file
 func DeleteFilePost(ctx *context.Context) {
 	form := web.GetForm(ctx).(*forms.DeleteRepoFileForm)
-	canCommit := renderCommitRights(ctx)
 	branchName := ctx.Repo.BranchName
 	if form.CommitChoice == frmCommitChoiceNewBranch {
 		branchName = form.NewBranchName
@@ -472,10 +502,15 @@ func DeleteFilePost(ctx *context.Context) {
 		return
 	}
 
-	if branchName == ctx.Repo.BranchName && !canCommit {
-		ctx.Data["Err_NewBranchName"] = true
-		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
-		ctx.RenderWithErr(ctx.Tr("repo.editor.cannot_commit_to_protected_branch", branchName), tplDeleteFile, &form)
+	editRepo := getEditRepositoryOrError(ctx, tplDeleteFile, &form)
+	if editRepo == nil {
+		return
+	}
+
+	renderCommitRights(ctx, editRepo)
+
+	// Cannot commit to an existing branch if user doesn't have rights
+	if !canPushToEditRepository(ctx, editRepo, branchName, form.CommitChoice, tplDeleteFile, &form) {
 		return
 	}
 
@@ -495,9 +530,14 @@ func DeleteFilePost(ctx *context.Context) {
 		return
 	}
 
-	if _, err := files_service.ChangeRepoFiles(ctx, ctx.Repo.Repository, ctx.Doer, &files_service.ChangeRepoFilesOptions{
+	editBranchName, err := pushToEditRepositoryOrError(ctx, editRepo, branchName, tplDeleteFile, &form)
+	if err != nil {
+		return
+	}
+
+	if _, err := files_service.ChangeRepoFiles(ctx, editRepo, ctx.Doer, &files_service.ChangeRepoFilesOptions{
 		LastCommitID: form.LastCommit,
-		OldBranch:    ctx.Repo.BranchName,
+		OldBranch:    editBranchName,
 		NewBranch:    branchName,
 		Files: []*files_service.ChangeRepoFile{
 			{
@@ -587,14 +627,19 @@ func DeleteFilePost(ctx *context.Context) {
 		}
 	}
 
-	redirectForCommitChoice(ctx, form.CommitChoice, branchName, treePath)
+	redirectForCommitChoice(ctx, editRepo, form.CommitChoice, branchName, treePath)
 }
 
 // UploadFile render upload file page
 func UploadFile(ctx *context.Context) {
+	editRepo := getEditRepositoryOrFork(ctx, "_upload")
+	if editRepo == nil {
+		return
+	}
+
 	ctx.Data["PageIsUpload"] = true
 	upload.AddUploadContext(ctx, "repo")
-	canCommit := renderCommitRights(ctx)
+	canCommit := renderCommitRights(ctx, editRepo)
 	treePath := cleanUploadFileName(ctx.Repo.TreePath)
 	if treePath != ctx.Repo.TreePath {
 		ctx.Redirect(path.Join(ctx.Repo.RepoLink, "_upload", util.PathEscapeSegments(ctx.Repo.BranchName), util.PathEscapeSegments(treePath)))
@@ -618,7 +663,7 @@ func UploadFile(ctx *context.Context) {
 	} else {
 		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
 	}
-	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx)
+	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx, editRepo)
 
 	ctx.HTML(http.StatusOK, tplUploadFile)
 }
@@ -628,11 +673,8 @@ func UploadFilePost(ctx *context.Context) {
 	form := web.GetForm(ctx).(*forms.UploadRepoFileForm)
 	ctx.Data["PageIsUpload"] = true
 	upload.AddUploadContext(ctx, "repo")
-	canCommit := renderCommitRights(ctx)
-
-	oldBranchName := ctx.Repo.BranchName
-	branchName := oldBranchName
 
+	branchName := ctx.Repo.BranchName
 	if form.CommitChoice == frmCommitChoiceNewBranch {
 		branchName = form.NewBranchName
 	}
@@ -659,16 +701,14 @@ func UploadFilePost(ctx *context.Context) {
 		return
 	}
 
-	if oldBranchName != branchName {
-		if exist, err := git_model.IsBranchExist(ctx, ctx.Repo.Repository.ID, branchName); err == nil && exist {
-			ctx.Data["Err_NewBranchName"] = true
-			ctx.RenderWithErr(ctx.Tr("repo.editor.branch_already_exists", branchName), tplUploadFile, &form)
-			return
-		}
-	} else if !canCommit {
-		ctx.Data["Err_NewBranchName"] = true
-		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
-		ctx.RenderWithErr(ctx.Tr("repo.editor.cannot_commit_to_protected_branch", branchName), tplUploadFile, &form)
+	editRepo := getEditRepositoryOrError(ctx, tplUploadFile, &form)
+	if editRepo == nil {
+		return
+	}
+
+	renderCommitRights(ctx, editRepo)
+
+	if !canPushToEditRepository(ctx, editRepo, branchName, form.CommitChoice, tplUploadFile, &form) {
 		return
 	}
 
@@ -715,9 +755,14 @@ func UploadFilePost(ctx *context.Context) {
 		return
 	}
 
-	if err := files_service.UploadRepoFiles(ctx, ctx.Repo.Repository, ctx.Doer, &files_service.UploadRepoFileOptions{
+	editBranchName, err := pushToEditRepositoryOrError(ctx, editRepo, branchName, tplUploadFile, &form)
+	if err != nil {
+		return
+	}
+
+	if err := files_service.UploadRepoFiles(ctx, editRepo, ctx.Doer, &files_service.UploadRepoFileOptions{
 		LastCommitID: ctx.Repo.CommitID,
-		OldBranch:    oldBranchName,
+		OldBranch:    editBranchName,
 		NewBranch:    branchName,
 		TreePath:     form.TreePath,
 		Message:      message,
@@ -776,19 +821,15 @@ func UploadFilePost(ctx *context.Context) {
 			}
 		} else {
 			// os.ErrNotExist - upload file missing in the intervening time?!
-			log.Error("Error during upload to repo: %-v to filepath: %s on %s from %s: %v", ctx.Repo.Repository, form.TreePath, oldBranchName, form.NewBranchName, err)
+			log.Error("Error during upload to repo: %-v to filepath: %s on %s from %s: %v", editRepo, form.TreePath, editBranchName, form.NewBranchName, err)
 			ctx.RenderWithErr(ctx.Tr("repo.editor.unable_to_upload_files", form.TreePath, err), tplUploadFile, &form)
 		}
 		return
 	}
 
-	if ctx.Repo.Repository.IsEmpty {
-		if isEmpty, err := ctx.Repo.GitRepo.IsEmpty(); err == nil && !isEmpty {
-			_ = repo_model.UpdateRepositoryColsWithAutoTime(ctx, &repo_model.Repository{ID: ctx.Repo.Repository.ID, IsEmpty: false}, "is_empty")
-		}
-	}
+	markRepositoryAsNonEmpty(ctx, editRepo) // a file has been uploaded, so the repository is no longer empty
 
-	redirectForCommitChoice(ctx, form.CommitChoice, branchName, form.TreePath)
+	redirectForCommitChoice(ctx, editRepo, form.CommitChoice, branchName, form.TreePath)
 }
 
 func cleanUploadFileName(name string) string {
@@ -863,11 +904,11 @@ func RemoveUploadFileFromServer(ctx *context.Context) {
 // It will be in the form of <username>-patch-<num> where <num> is the first branch of this format
 // that doesn't already exist. If we exceed 1000 tries or an error is thrown, we just return "" so the user has to
 // type in the branch name themselves (will be an empty field)
-func GetUniquePatchBranchName(ctx *context.Context) string {
+func GetUniquePatchBranchName(ctx *context.Context, editRepo *repo_model.Repository) string {
 	prefix := ctx.Doer.LowerName + "-patch-"
 	for i := 1; i <= 1000; i++ {
 		branchName := fmt.Sprintf("%s%d", prefix, i)
-		if exist, err := git_model.IsBranchExist(ctx, ctx.Repo.Repository.ID, branchName); err != nil {
+		if exist, err := git_model.IsBranchExist(ctx, editRepo.ID, branchName); err != nil {
 			log.Error("GetUniquePatchBranchName: %v", err)
 			return ""
 		} else if !exist {
diff --git a/routers/web/repo/editor_test.go b/routers/web/repo/editor_test.go
index 89bf8f309cd5e..c54648c51ed3a 100644
--- a/routers/web/repo/editor_test.go
+++ b/routers/web/repo/editor_test.go
@@ -51,7 +51,7 @@ func TestGetUniquePatchBranchName(t *testing.T) {
 	defer ctx.Repo.GitRepo.Close()
 
 	expectedBranchName := "user2-patch-1"
-	branchName := GetUniquePatchBranchName(ctx)
+	branchName := GetUniquePatchBranchName(ctx, ctx.Repo.Repository)
 	assert.Equal(t, expectedBranchName, branchName)
 }
 
diff --git a/routers/web/repo/fork.go b/routers/web/repo/fork.go
index 9f5cda10c28c3..3488d83e3e39b 100644
--- a/routers/web/repo/fork.go
+++ b/routers/web/repo/fork.go
@@ -151,21 +151,34 @@ func ForkPost(ctx *context.Context) {
 	ctx.Data["ContextUser"] = ctxUser
 
 	if ctx.HasError() {
-		ctx.JSONError(ctx.GetErrMsg())
+		ctx.HTML(http.StatusOK, tplFork)
 		return
 	}
 
+	repo := forkRepositoryOrError(ctx, ctxUser, repo_service.ForkRepoOptions{
+		BaseRepo:     forkRepo,
+		Name:         form.RepoName,
+		Description:  form.Description,
+		SingleBranch: form.ForkSingleBranch,
+	}, tplFork, form)
+	if repo == nil {
+		return
+	}
+
+	ctx.Redirect(ctxUser.HomeLink() + "/" + url.PathEscape(repo.Name))
+}
+
+func forkRepositoryOrError(ctx *context.Context, user *user_model.User, opts repo_service.ForkRepoOptions, tpl templates.TplName, form any) *repo_model.Repository {
 	var err error
-	traverseParentRepo := forkRepo
+	traverseParentRepo := opts.BaseRepo
 	for {
-		if !repository.CanUserForkBetweenOwners(ctxUser.ID, traverseParentRepo.OwnerID) {
-			ctx.JSONError(ctx.Tr("repo.settings.new_owner_has_same_repo"))
-			return
+		if !repository.CanUserForkBetweenOwners(user.ID, traverseParentRepo.OwnerID) {
+			ctx.RenderWithErr(ctx.Tr("repo.settings.new_owner_has_same_repo"), tpl, form)
+			return nil
 		}
-		repo := repo_model.GetForkedRepo(ctx, ctxUser.ID, traverseParentRepo.ID)
+		repo := repo_model.GetForkedRepo(ctx, user.ID, traverseParentRepo.ID)
 		if repo != nil {
-			ctx.JSONRedirect(ctxUser.HomeLink() + "/" + url.PathEscape(repo.Name))
-			return
+			return repo
 		}
 		if !traverseParentRepo.IsFork {
 			break
@@ -173,60 +186,54 @@ func ForkPost(ctx *context.Context) {
 		traverseParentRepo, err = repo_model.GetRepositoryByID(ctx, traverseParentRepo.ForkID)
 		if err != nil {
 			ctx.ServerError("GetRepositoryByID", err)
-			return
+			return nil
 		}
 	}
 
-	// Check if user is allowed to create repo's on the organization.
-	if ctxUser.IsOrganization() {
-		isAllowedToFork, err := organization.OrgFromUser(ctxUser).CanCreateOrgRepo(ctx, ctx.Doer.ID)
+	if user.IsOrganization() {
+		isAllowedToFork, err := organization.OrgFromUser(user).CanCreateOrgRepo(ctx, ctx.Doer.ID)
 		if err != nil {
 			ctx.ServerError("CanCreateOrgRepo", err)
-			return
+			return nil
 		} else if !isAllowedToFork {
 			ctx.HTTPError(http.StatusForbidden)
-			return
+			return nil
 		}
 	}
 
-	repo, err := repo_service.ForkRepository(ctx, ctx.Doer, ctxUser, repo_service.ForkRepoOptions{
-		BaseRepo:     forkRepo,
-		Name:         form.RepoName,
-		Description:  form.Description,
-		SingleBranch: form.ForkSingleBranch,
-	})
+	repo, err := repo_service.ForkRepository(ctx, ctx.Doer, user, opts)
 	if err != nil {
 		ctx.Data["Err_RepoName"] = true
 		switch {
 		case repo_model.IsErrReachLimitOfRepo(err):
-			maxCreationLimit := ctxUser.MaxCreationLimit()
+			maxCreationLimit := user.MaxCreationLimit()
 			msg := ctx.TrN(maxCreationLimit, "repo.form.reach_limit_of_creation_1", "repo.form.reach_limit_of_creation_n", maxCreationLimit)
-			ctx.JSONError(msg)
+			ctx.RenderWithErr(msg, tpl, form)
 		case repo_model.IsErrRepoAlreadyExist(err):
-			ctx.JSONError(ctx.Tr("repo.settings.new_owner_has_same_repo"))
+			ctx.RenderWithErr(ctx.Tr("repo.settings.new_owner_has_same_repo"), tpl, form)
 		case repo_model.IsErrRepoFilesAlreadyExist(err):
 			switch {
 			case ctx.IsUserSiteAdmin() || (setting.Repository.AllowAdoptionOfUnadoptedRepositories && setting.Repository.AllowDeleteOfUnadoptedRepositories):
-				ctx.JSONError(ctx.Tr("form.repository_files_already_exist.adopt_or_delete"))
+				ctx.RenderWithErr(ctx.Tr("form.repository_files_already_exist.adopt_or_delete"), tpl, form)
 			case setting.Repository.AllowAdoptionOfUnadoptedRepositories:
-				ctx.JSONError(ctx.Tr("form.repository_files_already_exist.adopt"))
+				ctx.RenderWithErr(ctx.Tr("form.repository_files_already_exist.adopt"), tpl, form)
 			case setting.Repository.AllowDeleteOfUnadoptedRepositories:
-				ctx.JSONError(ctx.Tr("form.repository_files_already_exist.delete"))
+				ctx.RenderWithErr(ctx.Tr("form.repository_files_already_exist.delete"), tpl, form)
 			default:
-				ctx.JSONError(ctx.Tr("form.repository_files_already_exist"))
+				ctx.RenderWithErr(ctx.Tr("form.repository_files_already_exist"), tpl, form)
 			}
 		case db.IsErrNameReserved(err):
-			ctx.JSONError(ctx.Tr("repo.form.name_reserved", err.(db.ErrNameReserved).Name))
+			ctx.RenderWithErr(ctx.Tr("repo.form.name_reserved", err.(db.ErrNameReserved).Name), tpl, form)
 		case db.IsErrNamePatternNotAllowed(err):
-			ctx.JSONError(ctx.Tr("repo.form.name_pattern_not_allowed", err.(db.ErrNamePatternNotAllowed).Pattern))
+			ctx.RenderWithErr(ctx.Tr("repo.form.name_pattern_not_allowed", err.(db.ErrNamePatternNotAllowed).Pattern), tpl, form)
 		case errors.Is(err, user_model.ErrBlockedUser):
-			ctx.JSONError(ctx.Tr("repo.fork.blocked_user"))
+			ctx.RenderWithErr(ctx.Tr("repo.fork.blocked_user"), tpl, form)
 		default:
 			ctx.ServerError("ForkPost", err)
 		}
-		return
+		return repo
 	}
 
-	log.Trace("Repository forked[%d]: %s/%s", forkRepo.ID, ctxUser.Name, repo.Name)
-	ctx.JSONRedirect(ctxUser.HomeLink() + "/" + url.PathEscape(repo.Name))
+	log.Trace("Repository forked[%d]: %s/%s", opts.BaseRepo.ID, user.Name, repo.Name)
+	return repo
 }
diff --git a/routers/web/repo/fork_to_edit.go b/routers/web/repo/fork_to_edit.go
new file mode 100644
index 0000000000000..9e8fd146e779f
--- /dev/null
+++ b/routers/web/repo/fork_to_edit.go
@@ -0,0 +1,188 @@
+// Copyright 2016 The Gogs Authors. All rights reserved.
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package repo
+
+import (
+	"fmt"
+	"net/http"
+	"path"
+
+	git_model "code.gitea.io/gitea/models/git"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
+	repo_module "code.gitea.io/gitea/modules/repository"
+	"code.gitea.io/gitea/modules/templates"
+	"code.gitea.io/gitea/modules/util"
+	"code.gitea.io/gitea/modules/web"
+	"code.gitea.io/gitea/services/context"
+	"code.gitea.io/gitea/services/forms"
+	repo_service "code.gitea.io/gitea/services/repository"
+)
+
+const (
+	tplForkFile templates.TplName = "repo/editor/fork"
+)
+
+// getEditRepositoryOrFork returns the repository where the edits will be written to.
+// If no repository is editable, redirects to a page to create a fork.
+func getEditRepositoryOrFork(ctx *context.Context, editOperation string) *repo_model.Repository {
+	editRepo, msg, err := context.GetEditableRepository(ctx, ctx.Doer, ctx.Repo.Repository, ctx.Repo.BranchName)
+	if err != nil {
+		ctx.ServerError("getEditRepository", err)
+		return nil
+	}
+	if editRepo == nil {
+		// No editable repository, suggest to create a fork
+		forkToEditFileCommon(ctx, editOperation, ctx.Repo.TreePath, msg)
+		ctx.HTML(http.StatusOK, tplForkFile)
+		return nil
+	}
+	if editRepo.ID != ctx.Repo.Repository.ID {
+		ctx.Data["ForkRepo"] = editRepo
+	}
+	return editRepo
+}
+
+// getEditRepositoryOrError returns the repository where the edits will be written to.
+// If no repository is editable, display an error.
+func getEditRepositoryOrError(ctx *context.Context, tpl templates.TplName, form any) *repo_model.Repository {
+	editRepo, _, err := context.GetEditableRepository(ctx, ctx.Doer, ctx.Repo.Repository, ctx.Repo.BranchName)
+	if err != nil {
+		ctx.ServerError("getEditRepository", err)
+		return nil
+	}
+	if editRepo == nil {
+		// No editable repo, maybe the fork was deleted in the meantime
+		ctx.RenderWithErr(ctx.Tr("repo.editor.cannot_find_editable_repo"), tpl, form)
+		return nil
+	}
+	if editRepo.ID != ctx.Repo.Repository.ID {
+		ctx.Data["ForkRepo"] = editRepo
+	}
+	return editRepo
+}
+
+// CheckPushEditBranch chesk if pushing to the branch in the edit repository is possible,
+// and if not renders an error and returns false.
+func canPushToEditRepository(ctx *context.Context, editRepo *repo_model.Repository, branchName, commitChoice string, tpl templates.TplName, form any) bool {
+	// When pushing to a fork or chosing to commit to a new branch, it should not exist yet
+	if editRepo.ID != ctx.Repo.Repository.ID || commitChoice == frmCommitChoiceNewBranch {
+		if exist, err := git_model.IsBranchExist(ctx, editRepo.ID, branchName); err == nil && exist {
+			ctx.Data["Err_NewBranchName"] = true
+			ctx.RenderWithErr(ctx.Tr("repo.editor.branch_already_exists", branchName), tpl, form)
+			return false
+		}
+	}
+
+	// Check for protected branch
+	canCommitToBranch, err := context.CanCommitToBranch(ctx, ctx.Doer, editRepo, branchName)
+	if err != nil {
+		log.Error("CanCommitToBranch: %v", err)
+	}
+	if !canCommitToBranch.CanCommitToBranch {
+		ctx.Data["Err_NewBranchName"] = true
+		ctx.RenderWithErr(ctx.Tr("repo.editor.cannot_commit_to_protected_branch", branchName), tpl, form)
+		return false
+	}
+
+	return true
+}
+
+// pushToEditRepositoryOrError pushes the branch that editing will be applied on top of
+// to the user fork, if needed. On failure, it displays and returns an error. The
+// branch name to be used for editing is returned.
+func pushToEditRepositoryOrError(ctx *context.Context, editRepo *repo_model.Repository, branchName string, tpl templates.TplName, form any) (string, error) {
+	// If editing the same repository, no need to push anything
+	if editRepo.ID == ctx.Repo.Repository.ID {
+		return ctx.Repo.BranchName, nil
+	}
+
+	// If editing a user fork, first push the branch to that repository
+	baseRepo := ctx.Repo.Repository
+	baseBranchName := ctx.Repo.BranchName
+
+	log.Trace("pushBranchToUserRepo: pushing branch to user repo for editing: %s:%s %s:%s", baseRepo.FullName(), baseBranchName, editRepo.FullName(), branchName)
+
+	if err := git.Push(ctx, baseRepo.RepoPath(), git.PushOptions{
+		Remote: editRepo.RepoPath(),
+		Branch: baseBranchName + ":" + branchName,
+		Env:    repo_module.PushingEnvironment(ctx.Doer, editRepo),
+	}); err != nil {
+		ctx.RenderWithErr(ctx.Tr("repo.editor.fork_failed_to_push_branch", branchName), tpl, form)
+		return "", err
+	}
+
+	return branchName, nil
+}
+
+// markRepositoryAsNonEmpty marks the repository as no longer empty
+func markRepositoryAsNonEmpty(ctx *context.Context, editRepo *repo_model.Repository) {
+	if !editRepo.IsEmpty {
+		return
+	}
+
+	_ = repo_model.UpdateRepositoryColsWithAutoTime(ctx, &repo_model.Repository{ID: editRepo.ID, IsEmpty: false}, "is_empty")
+}
+
+func forkToEditFileCommon(ctx *context.Context, editOperation, treePath string, msg context.RepositoryNotEditableMessage) {
+	treeNames, treePaths := getParentTreeFields(treePath)
+
+	ctx.Data["EditOperation"] = editOperation
+	ctx.Data["TreePath"] = treePath
+	ctx.Data["TreeNames"] = treeNames
+	ctx.Data["TreePaths"] = treePaths
+
+	canForkRepo := msg.Reason == ""
+	ctx.Data["CanForkRepo"] = canForkRepo
+	if !canForkRepo {
+		ctx.Data["NotEditableMessage"] = ctx.Tr(msg.Reason, msg.Repository)
+	}
+}
+
+func ForkToEditFilePost(ctx *context.Context) {
+	form := web.GetForm(ctx).(*forms.ForkToEditRepoFileForm)
+
+	editRepo, msg, err := context.GetEditableRepository(ctx, ctx.Doer, ctx.Repo.Repository, ctx.Repo.BranchName)
+	if err != nil {
+		ctx.ServerError("getEditRepository", err)
+		return
+	}
+
+	// Fork repository, if it doesn't already exist
+	if editRepo == nil && msg.Reason == "" {
+		forkRepo := forkRepositoryOrError(ctx, ctx.Doer, repo_service.ForkRepoOptions{
+			BaseRepo:     ctx.Repo.Repository,
+			Name:         getUniqueRepositoryName(ctx, ctx.Repo.Repository.Name),
+			Description:  ctx.Repo.Repository.Description,
+			SingleBranch: ctx.Repo.BranchName,
+		}, tplForkFile, form)
+		if forkRepo == nil {
+			forkToEditFileCommon(ctx, form.EditOperation, form.TreePath, msg)
+			ctx.HTML(http.StatusOK, tplForkFile)
+			return
+		}
+	}
+
+	// Redirect back to editing page
+	ctx.Redirect(path.Join(ctx.Repo.RepoLink, form.EditOperation, util.PathEscapeSegments(ctx.Repo.BranchName), util.PathEscapeSegments(form.TreePath)))
+}
+
+// getUniqueRepositoryName Gets a unique repository name for a user
+// It will append a -<num> postfix if the name is already taken
+func getUniqueRepositoryName(ctx *context.Context, name string) string {
+	uniqueName := name
+	i := 1
+
+	for {
+		_, err := repo_model.GetRepositoryByName(ctx, ctx.Doer.ID, uniqueName)
+		if err != nil || repo_model.IsErrRepoNotExist(err) {
+			return uniqueName
+		}
+
+		uniqueName = fmt.Sprintf("%s-%d", name, i)
+		i++
+	}
+}
diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go
index a4747964c6f02..97086a363b120 100644
--- a/routers/web/repo/issue.go
+++ b/routers/web/repo/issue.go
@@ -673,13 +673,13 @@ func handleMentionableAssigneesAndTeams(ctx *context.Context, assignees []*user_
 	}
 
 	if isAdmin {
-		teams, err = org.LoadTeams(ctx)
+		teams, err = organization.FilterLargeTeams(org.LoadTeams(ctx))
 		if err != nil {
 			ctx.ServerError("LoadTeams", err)
 			return
 		}
 	} else {
-		teams, err = org.GetUserTeams(ctx, ctx.Doer.ID)
+		teams, err = organization.FilterLargeTeams(org.GetUserTeams(ctx, ctx.Doer.ID))
 		if err != nil {
 			ctx.ServerError("GetUserTeams", err)
 			return
diff --git a/routers/web/repo/patch.go b/routers/web/repo/patch.go
index ca346b7e6c313..f673f0469af8d 100644
--- a/routers/web/repo/patch.go
+++ b/routers/web/repo/patch.go
@@ -24,7 +24,12 @@ const (
 
 // NewDiffPatch render create patch page
 func NewDiffPatch(ctx *context.Context) {
-	canCommit := renderCommitRights(ctx)
+	editRepo := getEditRepositoryOrFork(ctx, "_diffpatch")
+	if editRepo == nil {
+		return
+	}
+
+	canCommit := renderCommitRights(ctx, editRepo)
 
 	ctx.Data["PageIsPatch"] = true
 
@@ -35,7 +40,7 @@ func NewDiffPatch(ctx *context.Context) {
 	} else {
 		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
 	}
-	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx)
+	ctx.Data["new_branch_name"] = GetUniquePatchBranchName(ctx, editRepo)
 	ctx.Data["last_commit"] = ctx.Repo.CommitID
 	ctx.Data["LineWrapExtensions"] = strings.Join(setting.Repository.Editor.LineWrapExtensions, ",")
 	ctx.Data["BranchLink"] = ctx.Repo.RepoLink + "/src/" + ctx.Repo.RefTypeNameSubURL()
@@ -47,7 +52,6 @@ func NewDiffPatch(ctx *context.Context) {
 func NewDiffPatchPost(ctx *context.Context) {
 	form := web.GetForm(ctx).(*forms.EditRepoFileForm)
 
-	canCommit := renderCommitRights(ctx)
 	branchName := ctx.Repo.BranchName
 	if form.CommitChoice == frmCommitChoiceNewBranch {
 		branchName = form.NewBranchName
@@ -67,11 +71,15 @@ func NewDiffPatchPost(ctx *context.Context) {
 		return
 	}
 
+	editRepo := getEditRepositoryOrError(ctx, tplPatchFile, &form)
+	if editRepo == nil {
+		return
+	}
+
+	renderCommitRights(ctx, editRepo)
+
 	// Cannot commit to an existing branch if user doesn't have rights
-	if branchName == ctx.Repo.BranchName && !canCommit {
-		ctx.Data["Err_NewBranchName"] = true
-		ctx.Data["commit_choice"] = frmCommitChoiceNewBranch
-		ctx.RenderWithErr(ctx.Tr("repo.editor.cannot_commit_to_protected_branch", branchName), tplEditFile, &form)
+	if !canPushToEditRepository(ctx, editRepo, branchName, form.CommitChoice, tplPatchFile, &form) {
 		return
 	}
 
@@ -94,9 +102,14 @@ func NewDiffPatchPost(ctx *context.Context) {
 		return
 	}
 
-	fileResponse, err := files.ApplyDiffPatch(ctx, ctx.Repo.Repository, ctx.Doer, &files.ApplyDiffPatchOptions{
+	editBranchName, err := pushToEditRepositoryOrError(ctx, editRepo, branchName, tplPatchFile, &form)
+	if err != nil {
+		return
+	}
+
+	fileResponse, err := files.ApplyDiffPatch(ctx, editRepo, ctx.Doer, &files.ApplyDiffPatchOptions{
 		LastCommitID: form.LastCommit,
-		OldBranch:    ctx.Repo.BranchName,
+		OldBranch:    editBranchName,
 		NewBranch:    branchName,
 		Message:      message,
 		Content:      strings.ReplaceAll(form.Content, "\r", ""),
@@ -119,7 +132,8 @@ func NewDiffPatchPost(ctx *context.Context) {
 	}
 
 	if form.CommitChoice == frmCommitChoiceNewBranch && ctx.Repo.Repository.UnitEnabled(ctx, unit.TypePullRequests) {
-		ctx.Redirect(ctx.Repo.RepoLink + "/compare/" + util.PathEscapeSegments(ctx.Repo.BranchName) + "..." + util.PathEscapeSegments(form.NewBranchName))
+		editBranch := editRepo.Owner.Name + "/" + editRepo.Name + ":" + branchName
+		ctx.Redirect(ctx.Repo.RepoLink + "/compare/" + util.PathEscapeSegments(ctx.Repo.BranchName) + "..." + util.PathEscapeSegments(editBranch))
 	} else {
 		ctx.Redirect(ctx.Repo.RepoLink + "/commit/" + fileResponse.Commit.SHA)
 	}
diff --git a/routers/web/repo/pull.go b/routers/web/repo/pull.go
index 093f1ecaf81a6..246a13b505981 100644
--- a/routers/web/repo/pull.go
+++ b/routers/web/repo/pull.go
@@ -916,6 +916,7 @@ func viewPullFiles(ctx *context.Context, specifiedStartCommit, specifiedEndCommi
 				}
 
 				if perm.CanWrite(unit.TypeCode) || issues_model.CanMaintainerWriteToBranch(ctx, perm, pull.HeadBranch, ctx.Doer) {
+					ctx.Data["CanEnableEditor"] = ctx.Repo.Repository.CanEnableEditor()
 					ctx.Data["CanEditFile"] = true
 					ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.edit_this_file")
 					ctx.Data["HeadRepoLink"] = pull.HeadRepo.Link()
diff --git a/routers/web/repo/repo.go b/routers/web/repo/repo.go
index ee112b83f261b..5ec475b8fec96 100644
--- a/routers/web/repo/repo.go
+++ b/routers/web/repo/repo.go
@@ -49,21 +49,6 @@ func MustBeNotEmpty(ctx *context.Context) {
 	}
 }
 
-// MustBeEditable check that repo can be edited
-func MustBeEditable(ctx *context.Context) {
-	if !ctx.Repo.Repository.CanEnableEditor() {
-		ctx.NotFound(nil)
-		return
-	}
-}
-
-// MustBeAbleToUpload check that repo can be uploaded to
-func MustBeAbleToUpload(ctx *context.Context) {
-	if !setting.Repository.Upload.Enabled {
-		ctx.NotFound(nil)
-	}
-}
-
 func CommitInfoCache(ctx *context.Context) {
 	var err error
 	ctx.Repo.Commit, err = ctx.Repo.GitRepo.GetBranchCommit(ctx.Repo.Repository.DefaultBranch)
diff --git a/routers/web/repo/view_file.go b/routers/web/repo/view_file.go
index 3df6051975bc4..2dbf81e9b652b 100644
--- a/routers/web/repo/view_file.go
+++ b/routers/web/repo/view_file.go
@@ -147,6 +147,9 @@ func prepareToRenderFile(ctx *context.Context, entry *git.TreeEntry) {
 		ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.cannot_edit_non_text_files")
 	}
 
+	canEnableEditor := ctx.Repo.CanEnableEditor(ctx, ctx.Doer)
+	ctx.Data["CanEnableEditor"] = canEnableEditor
+
 	// read all needed attributes which will be used later
 	// there should be no performance different between reading 2 or 4 here
 	attrsMap, err := attribute.CheckAttributes(ctx, ctx.Repo.GitRepo, ctx.Repo.CommitID, attribute.CheckAttributeOpts{
@@ -244,8 +247,11 @@ func prepareToRenderFile(ctx *context.Context, entry *git.TreeEntry) {
 			ctx.Data["LineEscapeStatus"] = statuses
 		}
 		if !fInfo.isLFSFile {
-			if ctx.Repo.CanEnableEditor(ctx, ctx.Doer) {
-				if lfsLock != nil && lfsLock.OwnerID != ctx.Doer.ID {
+			if canEnableEditor {
+				if !ctx.IsSigned {
+					ctx.Data["CanEditFile"] = false
+					ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.must_be_signed_in")
+				} else if lfsLock != nil && lfsLock.OwnerID != ctx.Doer.ID {
 					ctx.Data["CanEditFile"] = false
 					ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.this_file_locked")
 				} else {
@@ -254,8 +260,6 @@ func prepareToRenderFile(ctx *context.Context, entry *git.TreeEntry) {
 				}
 			} else if !ctx.Repo.RefFullName.IsBranch() {
 				ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.must_be_on_a_branch")
-			} else if !ctx.Repo.CanWriteToBranch(ctx, ctx.Doer, ctx.Repo.BranchName) {
-				ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.fork_before_edit")
 			}
 		}
 
@@ -307,8 +311,11 @@ func prepareToRenderFile(ctx *context.Context, entry *git.TreeEntry) {
 		}
 	}
 
-	if ctx.Repo.CanEnableEditor(ctx, ctx.Doer) {
-		if lfsLock != nil && lfsLock.OwnerID != ctx.Doer.ID {
+	if canEnableEditor {
+		if !ctx.IsSigned {
+			ctx.Data["CanDeleteFile"] = false
+			ctx.Data["DeleteFileTooltip"] = ctx.Tr("repo.editor.must_be_signed_in")
+		} else if lfsLock != nil && lfsLock.OwnerID != ctx.Doer.ID {
 			ctx.Data["CanDeleteFile"] = false
 			ctx.Data["DeleteFileTooltip"] = ctx.Tr("repo.editor.this_file_locked")
 		} else {
@@ -317,7 +324,5 @@ func prepareToRenderFile(ctx *context.Context, entry *git.TreeEntry) {
 		}
 	} else if !ctx.Repo.RefFullName.IsBranch() {
 		ctx.Data["DeleteFileTooltip"] = ctx.Tr("repo.editor.must_be_on_a_branch")
-	} else if !ctx.Repo.CanWriteToBranch(ctx, ctx.Doer, ctx.Repo.BranchName) {
-		ctx.Data["DeleteFileTooltip"] = ctx.Tr("repo.editor.must_have_write_access")
 	}
 }
diff --git a/routers/web/repo/view_home.go b/routers/web/repo/view_home.go
index 48fa47d738426..4d6557f652832 100644
--- a/routers/web/repo/view_home.go
+++ b/routers/web/repo/view_home.go
@@ -408,6 +408,7 @@ func Home(ctx *context.Context) {
 	ctx.Data["Title"] = title
 	ctx.Data["PageIsViewCode"] = true
 	ctx.Data["RepositoryUploadEnabled"] = setting.Repository.Upload.Enabled // show New File / Upload File buttons
+	ctx.Data["CanEnableEditor"] = ctx.Repo.CanEnableEditor(ctx, ctx.Doer)
 
 	if ctx.Repo.Commit == nil || ctx.Repo.Repository.IsEmpty || ctx.Repo.Repository.IsBroken() {
 		// empty or broken repositories need to be handled differently
diff --git a/routers/web/repo/view_readme.go b/routers/web/repo/view_readme.go
index 7af6ad450e402..06bd574efc842 100644
--- a/routers/web/repo/view_readme.go
+++ b/routers/web/repo/view_readme.go
@@ -212,7 +212,18 @@ func prepareToRenderReadmeFile(ctx *context.Context, subfolder string, readmeFil
 		ctx.Data["EscapeStatus"], ctx.Data["FileContent"] = charset.EscapeControlHTML(template.HTML(contentEscaped), ctx.Locale)
 	}
 
-	if !fInfo.isLFSFile && ctx.Repo.CanEnableEditor(ctx, ctx.Doer) {
-		ctx.Data["CanEditReadmeFile"] = true
+	canEnableEditor := ctx.Repo.CanEnableEditor(ctx, ctx.Doer)
+	ctx.Data["CanEnableEditor"] = canEnableEditor
+
+	if !fInfo.isLFSFile {
+		if canEnableEditor {
+			if !ctx.IsSigned {
+				ctx.Data["CanEditReadmeFile"] = false
+				ctx.Data["EditReadmeFileTooltip"] = ctx.Tr("repo.editor.must_be_signed_in")
+			} else {
+				ctx.Data["CanEditReadmeFile"] = true
+				ctx.Data["EditReadmeFileTooltip"] = ctx.Tr("repo.editor.edit_this_file")
+			}
+		}
 	}
 }
diff --git a/routers/web/shared/user/header.go b/routers/web/shared/user/header.go
index 48a5d58ea427b..6379549bef9ef 100644
--- a/routers/web/shared/user/header.go
+++ b/routers/web/shared/user/header.go
@@ -22,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/context"
+	user_service "code.gitea.io/gitea/services/user"
 )
 
 // prepareContextForProfileBigAvatar set the context for big avatar view on the profile page
@@ -89,6 +90,25 @@ func prepareContextForProfileBigAvatar(ctx *context.Context) {
 		} else {
 			ctx.Data["UserBlocking"] = block
 		}
+
+		// BLENDER: spam reporting
+		doerIsTrusted, err := user_service.IsTrustedUser(ctx, ctx.Doer)
+		if err != nil {
+			ctx.ServerError("IsTrustedUser", err)
+			return
+		}
+		userIsTrusted, err := user_service.IsTrustedUser(ctx, ctx.ContextUser)
+		if err != nil {
+			ctx.ServerError("IsTrustedUser", err)
+			return
+		}
+		ctx.Data["CanReportSpam"] = doerIsTrusted && !userIsTrusted
+		existingSpamReport, err := user_model.GetSpamReportForUser(ctx, ctx.ContextUser)
+		if err != nil {
+			ctx.ServerError("GetSpamReportForUser", err)
+			return
+		}
+		ctx.Data["ExistingSpamReport"] = existingSpamReport
 	}
 }
 
diff --git a/routers/web/user/setting/contributor_agreements.go b/routers/web/user/setting/contributor_agreements.go
new file mode 100644
index 0000000000000..622a6e023a375
--- /dev/null
+++ b/routers/web/user/setting/contributor_agreements.go
@@ -0,0 +1,76 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: contributor agreement
+
+package setting
+
+import (
+	"net/http"
+
+	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/templates"
+	"code.gitea.io/gitea/modules/timeutil"
+	"code.gitea.io/gitea/services/context"
+
+	"xorm.io/builder"
+)
+
+const (
+	tplSettingsContributorAgreements templates.TplName = "user/settings/contributor_agreements"
+)
+
+// ContributorAgreements lists all agreements and shows which ones were signed.
+func ContributorAgreements(ctx *context.Context) {
+	contributorAgreements, err := db.Find[user_model.ContributorAgreement](ctx, &db.ListOptions{})
+	if err != nil {
+		ctx.ServerError("FindContributorAgreements", err)
+		return
+	}
+	signedContributorAgreements, err := db.Find[user_model.SignedContributorAgreement](ctx, &user_model.FindSignedContributorAgreementsOptions{UserID: ctx.Doer.ID})
+	if err != nil {
+		ctx.ServerError("FindSignedContributorAgreements", err)
+		return
+	}
+	signedID2Timestamp := make(map[int64]timeutil.TimeStamp)
+	for _, sca := range signedContributorAgreements {
+		signedID2Timestamp[sca.ContributorAgreementID] = sca.CreatedUnix
+	}
+	type UserContributorAgreement struct {
+		user_model.ContributorAgreement
+		SignedAt timeutil.TimeStamp
+	}
+	userContributorAgreements := make([]*UserContributorAgreement, len(contributorAgreements))
+	for i, ca := range contributorAgreements {
+		var uca UserContributorAgreement
+		uca.ContributorAgreement = *ca
+		uca.SignedAt = signedID2Timestamp[ca.ID]
+		userContributorAgreements[i] = &uca
+	}
+
+	ctx.Data["ContributorAgreements"] = userContributorAgreements
+	ctx.Data["PageIsSettingsContributorAgreements"] = true
+	ctx.Data["Title"] = ctx.Tr("settings.contributor_agreements")
+	ctx.HTML(http.StatusOK, tplSettingsContributorAgreements)
+}
+
+// SignContributorAgreement signs a contributor agreement.
+func SignContributorAgreement(ctx *context.Context) {
+	slug := ctx.PathParam("slug")
+	ca, exist, err := db.Get[user_model.ContributorAgreement](ctx, builder.Eq{"slug": slug})
+	if err != nil {
+		ctx.ServerError("GetContributorAgreement", err)
+		return
+	}
+	if !exist {
+		ctx.PlainText(http.StatusNotFound, "unknown contributor agreement")
+		return
+	}
+	if err := db.Insert(ctx, &user_model.SignedContributorAgreement{UserID: ctx.Doer.ID, ContributorAgreementID: ca.ID}); err != nil {
+		ctx.ServerError("SignContributorAgreement", err)
+		return
+	}
+	ctx.Redirect(setting.AppSubURL + "/user/settings/contributor_agreements")
+}
diff --git a/routers/web/user/setting/spamreport.go b/routers/web/user/setting/spamreport.go
new file mode 100644
index 0000000000000..254b54c56f1f5
--- /dev/null
+++ b/routers/web/user/setting/spamreport.go
@@ -0,0 +1,43 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: spam reporting
+
+package setting
+
+import (
+	"net/http"
+
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/services/context"
+	user_service "code.gitea.io/gitea/services/user"
+)
+
+// SpamReportUserPost creates a spam report for a given user.
+func SpamReportUserPost(ctx *context.Context) {
+	canReportSpam, err := user_service.IsTrustedUser(ctx, ctx.Doer)
+	if err != nil {
+		ctx.ServerError("IsTrustedUser", err)
+		return
+	}
+	if !canReportSpam {
+		ctx.PlainText(http.StatusForbidden, "you are not allowed to report spam")
+	}
+	username := ctx.FormString("username")
+
+	user, err := user_model.GetUserByName(ctx, username)
+	if err != nil {
+		ctx.NotFoundOrServerError("GetUserByName", user_model.IsErrUserNotExist, nil)
+		return
+	}
+	if _, err := user_service.CreateSpamReport(ctx, ctx.Doer, user); err != nil {
+		ctx.ServerError("CreateSpamReport", err)
+		return
+	}
+
+	if ctx.Written() {
+		return
+	}
+	ctx.Redirect(setting.AppSubURL + "/" + username)
+}
diff --git a/routers/web/web.go b/routers/web/web.go
index bd850baec0f46..d35b49f85b072 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -282,6 +282,8 @@ func Routes() *web.Router {
 
 	mid = append(mid, goGet)
 	mid = append(mid, common.PageTmplFunctions)
+	// BLENDER: spam reporting
+	mid = append(mid, admin.GetPendingSpamReports)
 
 	webRoutes := web.NewRouter()
 	webRoutes.Use(mid...)
@@ -682,6 +684,12 @@ func registerWebRoutes(m *web.Router) {
 			m.Get("", user_setting.BlockedUsers)
 			m.Post("", web.Bind(forms.BlockUserForm{}), user_setting.BlockedUsersPost)
 		})
+
+		// BLENDER: spam reporting
+		m.Post("/spamreport", user_setting.SpamReportUserPost)
+		// BLENDER: contributor agreement
+		m.Get("/contributor_agreements", user_setting.ContributorAgreements)
+		m.Post("/contributor_agreements/{slug}/sign", user_setting.SignContributorAgreement)
 	}, reqSignIn, ctxDataSet("PageIsUserSettings", true, "EnablePackages", setting.Packages.Enabled))
 
 	m.Group("/user", func() {
@@ -755,6 +763,13 @@ func registerWebRoutes(m *web.Router) {
 			m.Post("/delete", admin.DeleteEmail)
 		})
 
+		// BLENDER: spam reporting
+		m.Group("/spamreports", func() {
+			m.Get("", admin.SpamReports)
+			m.Post("", admin.SpamReportsPost)
+		})
+		m.Post("/purge_spammer", admin.PurgeSpammerPost)
+
 		m.Group("/orgs", func() {
 			m.Get("", admin.Organizations)
 		})
@@ -1321,18 +1336,22 @@ func registerWebRoutes(m *web.Router) {
 					Post(web.Bind(forms.EditRepoFileForm{}), repo.NewFilePost)
 				m.Combo("/_delete/*").Get(repo.DeleteFile).
 					Post(web.Bind(forms.DeleteRepoFileForm{}), repo.DeleteFilePost)
-				m.Combo("/_upload/*", repo.MustBeAbleToUpload).Get(repo.UploadFile).
+				m.Combo("/_upload/*", context.MustBeAbleToUpload()).Get(repo.UploadFile).
 					Post(web.Bind(forms.UploadRepoFileForm{}), repo.UploadFilePost)
 				m.Combo("/_diffpatch/*").Get(repo.NewDiffPatch).
 					Post(web.Bind(forms.EditRepoFileForm{}), repo.NewDiffPatchPost)
+				m.Combo("/_fork_to_edit/*").
+					Post(web.Bind(forms.ForkToEditRepoFileForm{}), repo.ForkToEditFilePost)
+			}, context.MustEnableEditor())
+			m.Group("", func() {
 				m.Combo("/_cherrypick/{sha:([a-f0-9]{7,64})}/*").Get(repo.CherryPick).
 					Post(web.Bind(forms.CherryPickForm{}), repo.CherryPickPost)
-			}, context.RepoRefByType(git.RefTypeBranch), context.CanWriteToBranch(), repo.WebGitOperationCommonData)
-			m.Group("", func() {
-				m.Post("/upload-file", repo.UploadFileToServer)
-				m.Post("/upload-remove", web.Bind(forms.RemoveUploadFileForm{}), repo.RemoveUploadFileFromServer)
-			}, repo.MustBeAbleToUpload, reqRepoCodeWriter)
-		}, repo.MustBeEditable, context.RepoMustNotBeArchived())
+			}, context.MustBeAbleToCherryPick())
+		}, context.RepoRefByType(git.RefTypeBranch), repo.WebGitOperationCommonData)
+		m.Group("", func() {
+			m.Post("/upload-file", repo.UploadFileToServer)
+			m.Post("/upload-remove", web.Bind(forms.RemoveUploadFileForm{}), repo.RemoveUploadFileFromServer)
+		}, context.MustBeAbleToUpload())
 
 		m.Group("/branches", func() {
 			m.Group("/_new", func() {
diff --git a/services/auth/source/oauth2/blenderid/blenderid.go b/services/auth/source/oauth2/blenderid/blenderid.go
new file mode 100644
index 0000000000000..671e5e4f541a5
--- /dev/null
+++ b/services/auth/source/oauth2/blenderid/blenderid.go
@@ -0,0 +1,181 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+// Package blenderid implements the OAuth2 protocol for authenticating users through Blender ID
+// This package can be used as a reference implementation of an OAuth2 provider for Goth.
+package blenderid
+
+// Allow "encoding/json" import.
+import (
+	"bytes"
+	"encoding/json" //nolint:depguard
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+
+	"github.com/markbates/goth"
+	"golang.org/x/oauth2"
+)
+
+// These vars define the default Authentication, Token, and Profile URLS for Blender ID
+//
+// Examples:
+//
+//	blenderid.AuthURL = "https://id.blender.org/oauth/authorize
+//	blenderid.TokenURL = "https://id.blender.org/oauth/token
+//	blenderid.ProfileURL = "https://id.blender.org/api/me
+var (
+	AuthURL    = "https://id.blender.org/oauth/authorize"
+	TokenURL   = "https://id.blender.org/oauth/token"
+	ProfileURL = "https://id.blender.org/api/me"
+)
+
+// Provider is the implementation of `goth.Provider` for accessing Blender ID
+type Provider struct {
+	ClientKey    string
+	Secret       string
+	CallbackURL  string
+	HTTPClient   *http.Client
+	config       *oauth2.Config
+	providerName string
+	profileURL   string
+}
+
+// New creates a new Blender ID provider and sets up important connection details.
+// You should always call `blenderid.New` to get a new provider.  Never try to
+// create one manually.
+func New(clientKey, secret, callbackURL string, scopes ...string) *Provider {
+	return NewCustomisedURL(clientKey, secret, callbackURL, AuthURL, TokenURL, ProfileURL, scopes...)
+}
+
+// NewCustomisedURL is similar to New(...) but can be used to set custom URLs to connect to
+func NewCustomisedURL(clientKey, secret, callbackURL, authURL, tokenURL, profileURL string, scopes ...string) *Provider {
+	p := &Provider{
+		ClientKey:    clientKey,
+		Secret:       secret,
+		CallbackURL:  callbackURL,
+		providerName: "blenderid",
+		profileURL:   profileURL,
+	}
+	p.config = newConfig(p, authURL, tokenURL, scopes)
+	return p
+}
+
+// Name is the name used to retrieve this provider later.
+func (p *Provider) Name() string {
+	return p.providerName
+}
+
+// SetName is to update the name of the provider (needed in case of multiple providers of 1 type)
+func (p *Provider) SetName(name string) {
+	p.providerName = name
+}
+
+func (p *Provider) Client() *http.Client {
+	return goth.HTTPClientWithFallBack(p.HTTPClient)
+}
+
+// Debug is a no-op for the blenderid package.
+func (p *Provider) Debug(debug bool) {}
+
+// BeginAuth asks Blender ID for an authentication end-point.
+func (p *Provider) BeginAuth(state string) (goth.Session, error) {
+	return &Session{
+		AuthURL: p.config.AuthCodeURL(state),
+	}, nil
+}
+
+// FetchUser will go to Blender ID and access basic information about the user.
+func (p *Provider) FetchUser(session goth.Session) (goth.User, error) {
+	sess := session.(*Session)
+	user := goth.User{
+		AccessToken:  sess.AccessToken,
+		Provider:     p.Name(),
+		RefreshToken: sess.RefreshToken,
+		ExpiresAt:    sess.ExpiresAt,
+	}
+
+	if user.AccessToken == "" {
+		// data is not yet retrieved since accessToken is still empty
+		return user, fmt.Errorf("%s cannot get user information without accessToken", p.providerName)
+	}
+
+	req, err := http.NewRequest("GET", p.profileURL, nil)
+	if err != nil {
+		return user, err
+	}
+
+	req.Header.Add("Authorization", "Bearer "+sess.AccessToken)
+	response, err := p.Client().Do(req)
+	if err != nil {
+		return user, err
+	}
+	if response.StatusCode != http.StatusOK {
+		return user, fmt.Errorf("Blender ID responded with a %d trying to fetch user information", response.StatusCode)
+	}
+
+	bits, err := io.ReadAll(response.Body)
+	if err != nil {
+		return user, err
+	}
+
+	err = json.NewDecoder(bytes.NewReader(bits)).Decode(&user.RawData)
+	if err != nil {
+		return user, err
+	}
+
+	err = userFromReader(bytes.NewReader(bits), &user)
+	if err != nil {
+		return user, err
+	}
+
+	return user, err
+}
+
+func newConfig(provider *Provider, authURL, tokenURL string, scopes []string) *oauth2.Config {
+	c := &oauth2.Config{
+		ClientID:     provider.ClientKey,
+		ClientSecret: provider.Secret,
+		RedirectURL:  provider.CallbackURL,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  authURL,
+			TokenURL: tokenURL,
+		},
+		Scopes: []string{},
+	}
+
+	if len(scopes) > 0 {
+		c.Scopes = append(c.Scopes, scopes...)
+	}
+	return c
+}
+
+func userFromReader(r io.Reader, user *goth.User) error {
+	u := struct {
+		Name     string `json:"full_name"`
+		Email    string `json:"email"`
+		NickName string `json:"nickname"`
+		ID       int    `json:"id"`
+	}{}
+	err := json.NewDecoder(r).Decode(&u)
+	if err != nil {
+		return err
+	}
+	user.Email = u.Email
+	user.Name = u.Name
+	user.NickName = gitealizeUsername(u.NickName)
+	user.UserID = strconv.Itoa(u.ID)
+	user.AvatarURL = fmt.Sprintf("https://id.blender.org/api/user/%s/avatar", user.UserID)
+	return nil
+}
+
+// RefreshTokenAvailable refresh token is not provided by Blender ID
+func (p *Provider) RefreshTokenAvailable() bool {
+	return true
+}
+
+// RefreshToken refresh token is not provided by Blender ID
+func (p *Provider) RefreshToken(refreshToken string) (*oauth2.Token, error) {
+	return nil, errors.New("Refresh token is not provided by Blender ID")
+}
diff --git a/services/auth/source/oauth2/blenderid/blenderid_test.go b/services/auth/source/oauth2/blenderid/blenderid_test.go
new file mode 100644
index 0000000000000..283ba0898a83f
--- /dev/null
+++ b/services/auth/source/oauth2/blenderid/blenderid_test.go
@@ -0,0 +1,70 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package blenderid_test
+
+import (
+	"os"
+	"testing"
+
+	"code.gitea.io/gitea/services/auth/source/oauth2/blenderid"
+
+	"github.com/markbates/goth"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_New(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	p := provider()
+
+	a.Equal(p.ClientKey, os.Getenv("BLENDERID_KEY"))
+	a.Equal(p.Secret, os.Getenv("BLENDERID_SECRET"))
+	a.Equal("/foo", p.CallbackURL)
+}
+
+func Test_NewCustomisedURL(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	p := urlCustomisedURLProvider()
+	session, err := p.BeginAuth("test_state")
+	s := session.(*blenderid.Session)
+	a.NoError(err)
+	a.Contains(s.AuthURL, "http://authURL")
+}
+
+func Test_Implements_Provider(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	a.Implements((*goth.Provider)(nil), provider())
+}
+
+func Test_BeginAuth(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	p := provider()
+	session, err := p.BeginAuth("test_state")
+	s := session.(*blenderid.Session)
+	a.NoError(err)
+	a.Contains(s.AuthURL, "id.blender.org/oauth/authorize")
+}
+
+func Test_SessionFromJSON(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+
+	p := provider()
+	session, err := p.UnmarshalSession(`{"AuthURL":"https://id.blender.org/oauth/authorize","AccessToken":"1234567890"}`)
+	a.NoError(err)
+
+	s := session.(*blenderid.Session)
+	a.Equal("https://id.blender.org/oauth/authorize", s.AuthURL)
+	a.Equal("1234567890", s.AccessToken)
+}
+
+func provider() *blenderid.Provider {
+	return blenderid.New(os.Getenv("BLENDERID_KEY"), os.Getenv("BLENDERID_SECRET"), "/foo")
+}
+
+func urlCustomisedURLProvider() *blenderid.Provider {
+	return blenderid.NewCustomisedURL(os.Getenv("BLENDERID_KEY"), os.Getenv("BLENDERID_SECRET"), "/foo", "http://authURL", "http://tokenURL", "http://profileURL")
+}
diff --git a/services/auth/source/oauth2/blenderid/gitealize_usernames.go b/services/auth/source/oauth2/blenderid/gitealize_usernames.go
new file mode 100644
index 0000000000000..880516c8e28f1
--- /dev/null
+++ b/services/auth/source/oauth2/blenderid/gitealize_usernames.go
@@ -0,0 +1,65 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package blenderid
+
+import (
+	"regexp"
+	"strings"
+
+	"code.gitea.io/gitea/models/user"
+
+	"github.com/mozillazg/go-unidecode"
+)
+
+var (
+	reInvalidCharsPattern = regexp.MustCompile(`[^\da-zA-Z.\w-]+`)
+
+	// Consecutive non-alphanumeric at start:
+	reConsPrefix = regexp.MustCompile(`^[._-]+`)
+	reConsSuffix = regexp.MustCompile(`[._-]+$`)
+	reConsInfix  = regexp.MustCompile(`[._-]{2,}`)
+)
+
+// gitealizeUsername turns a valid Blender ID nickname into a valid Gitea username.
+func gitealizeUsername(bidNickname string) string {
+	// Remove accents and other non-ASCIIness.
+	asciiUsername := unidecode.Unidecode(bidNickname)
+	asciiUsername = strings.TrimSpace(asciiUsername)
+	asciiUsername = strings.ReplaceAll(asciiUsername, " ", "_")
+
+	err := user.IsUsableUsername(asciiUsername)
+	if err == nil && len(asciiUsername) <= 40 {
+		return asciiUsername
+	}
+
+	newUsername := asciiUsername
+	newUsername = reInvalidCharsPattern.ReplaceAllString(newUsername, "_")
+	newUsername = reConsPrefix.ReplaceAllString(newUsername, "")
+	newUsername = reConsSuffix.ReplaceAllString(newUsername, "")
+	newUsername = reConsInfix.ReplaceAllStringFunc(
+		newUsername,
+		func(match string) string {
+			firstRune := []rune(match)[0]
+			return string(firstRune)
+		})
+
+	if newUsername == "" {
+		// Everything was stripped and nothing was left. Better to keep as-is and
+		// just let Gitea bork on it.
+		return asciiUsername
+	}
+
+	// This includes a test for reserved names, which are easily circumvented by
+	// appending another character.
+	if user.IsUsableUsername(newUsername) != nil {
+		if len(newUsername) > 39 {
+			return newUsername[:39] + "2"
+		}
+		return newUsername + "2"
+	}
+
+	if len(newUsername) > 40 {
+		return newUsername[:40]
+	}
+	return newUsername
+}
diff --git a/services/auth/source/oauth2/blenderid/gitealize_usernames_test.go b/services/auth/source/oauth2/blenderid/gitealize_usernames_test.go
new file mode 100644
index 0000000000000..7d633198e8886
--- /dev/null
+++ b/services/auth/source/oauth2/blenderid/gitealize_usernames_test.go
@@ -0,0 +1,43 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package blenderid
+
+import "testing"
+
+func Test_gitealizeUsername(t *testing.T) {
+	tests := []struct {
+		name        string
+		bidNickname string
+		want        string
+	}{
+		{"empty", "", ""},
+		{"underscore", "_", "_"},
+		{"reserved-name", "ghost", "ghost2"}, // Reserved name in Gitea.
+		{"short", "x", "x"},
+		{"simple", "simple", "simple"},
+		{"start-bad", "____startbad", "startbad"},
+		{"end-bad", "endbad___", "endbad"},
+		{"mid-bad-1", "mid__bad", "mid_bad"},
+		{"mid-bad-2", "user_.-name", "user_name"},
+		{"plus-mid-single", "RT2+356", "RT2_356"},
+		{"plus-mid-many", "RT2+++356", "RT2_356"},
+		{"plus-end", "RT2356+", "RT2356"},
+		{
+			"too-long", // # Max username length is 40:
+			"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		},
+		{"accented-latin", "Ümlaut-Đenja", "Umlaut-Denja"},
+		{"thai", "แบบไทย", "aebbaithy"},
+		{"mandarin", "普通话", "Pu_Tong_Hua"},
+		{"cyrillic", "ћирилица", "tshirilitsa"},
+		{"all-bad", "------", "------"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := gitealizeUsername(tt.bidNickname); got != tt.want {
+				t.Errorf("gitealizeUsername() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/services/auth/source/oauth2/blenderid/session.go b/services/auth/source/oauth2/blenderid/session.go
new file mode 100644
index 0000000000000..52a2d2174584c
--- /dev/null
+++ b/services/auth/source/oauth2/blenderid/session.go
@@ -0,0 +1,66 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package blenderid
+
+// Allow "encoding/json" import.
+import (
+	"encoding/json" //nolint:depguard
+	"errors"
+	"strings"
+	"time"
+
+	"github.com/markbates/goth"
+)
+
+// Session stores data during the auth process with Blender ID
+type Session struct {
+	AuthURL      string
+	AccessToken  string
+	RefreshToken string
+	ExpiresAt    time.Time
+}
+
+var _ goth.Session = &Session{}
+
+// GetAuthURL will return the URL set by calling the `BeginAuth` function on the Blender ID provider.
+func (s Session) GetAuthURL() (string, error) {
+	if s.AuthURL == "" {
+		return "", errors.New(goth.NoAuthUrlErrorMessage)
+	}
+	return s.AuthURL, nil
+}
+
+// Authorize the session with Blender ID and return the access token to be stored for future use.
+func (s *Session) Authorize(provider goth.Provider, params goth.Params) (string, error) {
+	p := provider.(*Provider)
+	token, err := p.config.Exchange(goth.ContextForClient(p.Client()), params.Get("code"))
+	if err != nil {
+		return "", err
+	}
+
+	if !token.Valid() {
+		return "", errors.New("Invalid token received from provider")
+	}
+
+	s.AccessToken = token.AccessToken
+	s.RefreshToken = token.RefreshToken
+	s.ExpiresAt = token.Expiry
+	return token.AccessToken, err
+}
+
+// Marshal the session into a string
+func (s Session) Marshal() string {
+	b, _ := json.Marshal(s)
+	return string(b)
+}
+
+func (s Session) String() string {
+	return s.Marshal()
+}
+
+// UnmarshalSession wil unmarshal a JSON string into a session.
+func (p *Provider) UnmarshalSession(data string) (goth.Session, error) {
+	s := &Session{}
+	err := json.NewDecoder(strings.NewReader(data)).Decode(s)
+	return s, err
+}
diff --git a/services/auth/source/oauth2/blenderid/session_test.go b/services/auth/source/oauth2/blenderid/session_test.go
new file mode 100644
index 0000000000000..7f5b6198739fd
--- /dev/null
+++ b/services/auth/source/oauth2/blenderid/session_test.go
@@ -0,0 +1,51 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package blenderid_test
+
+import (
+	"testing"
+
+	"code.gitea.io/gitea/services/auth/source/oauth2/blenderid"
+
+	"github.com/markbates/goth"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Implements_Session(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	s := &blenderid.Session{}
+
+	a.Implements((*goth.Session)(nil), s)
+}
+
+func Test_GetAuthURL(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	s := &blenderid.Session{}
+
+	_, err := s.GetAuthURL()
+	a.Error(err)
+
+	s.AuthURL = "/foo"
+
+	url, _ := s.GetAuthURL()
+	a.Equal("/foo", url)
+}
+
+func Test_ToJSON(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	s := &blenderid.Session{}
+
+	data := s.Marshal()
+	a.JSONEq(`{"AuthURL":"","AccessToken":"","RefreshToken":"","ExpiresAt":"0001-01-01T00:00:00Z"}`, data)
+}
+
+func Test_String(t *testing.T) {
+	t.Parallel()
+	a := assert.New(t)
+	s := &blenderid.Session{}
+
+	a.Equal(s.String(), s.Marshal())
+}
diff --git a/services/auth/source/oauth2/providers_custom.go b/services/auth/source/oauth2/providers_custom.go
index 65cf538ad7386..f6f49ada048aa 100644
--- a/services/auth/source/oauth2/providers_custom.go
+++ b/services/auth/source/oauth2/providers_custom.go
@@ -5,6 +5,7 @@ package oauth2
 
 import (
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/services/auth/source/oauth2/blenderid"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/providers/azureadv2"
@@ -120,4 +121,14 @@ func init() {
 			}), nil
 		},
 	))
+
+	RegisterGothProvider(NewCustomProvider(
+		"blenderid", "Blender ID", &CustomURLSettings{
+			TokenURL:   requiredAttribute(blenderid.TokenURL),
+			AuthURL:    requiredAttribute(blenderid.AuthURL),
+			ProfileURL: requiredAttribute(blenderid.ProfileURL),
+		},
+		func(clientID, secret, callbackURL string, custom *CustomURLMapping, scopes []string) (goth.Provider, error) {
+			return blenderid.NewCustomisedURL(clientID, secret, callbackURL, custom.AuthURL, custom.TokenURL, custom.ProfileURL, scopes...), nil
+		}))
 }
diff --git a/services/context/permission.go b/services/context/permission.go
index 7055f798da3f0..bf6e498741799 100644
--- a/services/context/permission.go
+++ b/services/context/permission.go
@@ -21,10 +21,10 @@ func RequireRepoAdmin() func(ctx *Context) {
 	}
 }
 
-// CanWriteToBranch checks if the user is allowed to write to the branch of the repo
-func CanWriteToBranch() func(ctx *Context) {
+// MustBeAbleToCherryPick checks if the user is allowed to cherry-pick to a branch of the repo
+func MustBeAbleToCherryPick() func(ctx *Context) {
 	return func(ctx *Context) {
-		if !ctx.Repo.CanWriteToBranch(ctx, ctx.Doer, ctx.Repo.BranchName) {
+		if !CanWriteToBranch(ctx, ctx.Doer, ctx.Repo.Repository, ctx.Repo.BranchName) || !ctx.Repo.CanEnableEditor(ctx, ctx.Doer) {
 			ctx.NotFound(nil)
 			return
 		}
diff --git a/services/context/repo.go b/services/context/repo.go
index 61841aa90b2a2..10c802c8d77bc 100644
--- a/services/context/repo.go
+++ b/services/context/repo.go
@@ -67,13 +67,72 @@ type Repository struct {
 }
 
 // CanWriteToBranch checks if the branch is writable by the user
-func (r *Repository) CanWriteToBranch(ctx context.Context, user *user_model.User, branch string) bool {
-	return issues_model.CanMaintainerWriteToBranch(ctx, r.Permission, branch, user)
+func CanWriteToBranch(ctx context.Context, user *user_model.User, repo *repo_model.Repository, branch string) bool {
+	permission, err := access_model.GetUserRepoPermission(ctx, repo, user)
+	if err != nil {
+		return false
+	}
+
+	return issues_model.CanMaintainerWriteToBranch(ctx, permission, branch, user)
+}
+
+// RepositoryNotEditableMessage explains why a repository can not be edited by the user
+type RepositoryNotEditableMessage struct {
+	Reason     string
+	Repository string
+}
+
+// GetEditRepository returns the repository where the editor will actually write the
+// the edits to. This may be a fork of the repository owned by the user. If no repository
+// can be found for editing, either a reason or error is returned.
+func GetEditableRepository(ctx context.Context, user *user_model.User, repo *repo_model.Repository, branch string) (*repo_model.Repository, RepositoryNotEditableMessage, error) {
+	if CanWriteToBranch(ctx, user, repo, branch) {
+		return repo, RepositoryNotEditableMessage{}, nil
+	}
+
+	// If we can't write to the branch, try find a user fork to create a branch in instead
+	userRepo, err := repo_model.GetUserFork(ctx, repo.ID, user.ID)
+	if err != nil {
+		return nil, RepositoryNotEditableMessage{}, fmt.Errorf("GetUserFork: %v", err)
+	}
+	if userRepo == nil {
+		return nil, RepositoryNotEditableMessage{}, nil
+	}
+
+	// Load repository information
+	if err := userRepo.LoadOwner(ctx); err != nil {
+		return nil, RepositoryNotEditableMessage{}, fmt.Errorf("LoadOwner: %v", err)
+	}
+	if err := userRepo.GetBaseRepo(ctx); err != nil || userRepo.BaseRepo == nil {
+		if err != nil {
+			return nil, RepositoryNotEditableMessage{}, fmt.Errorf("GetBaseRepo: %v", err)
+		}
+		return nil, RepositoryNotEditableMessage{}, errors.New("GetBaseRepo: Expected a base repo for user fork")
+	}
+
+	// Check code unit, archiving and permissions.
+	if !userRepo.UnitEnabled(ctx, unit_model.TypeCode) {
+		return nil, RepositoryNotEditableMessage{Reason: "repo.editor.fork_code_disabled", Repository: userRepo.FullName()}, nil
+	}
+	if userRepo.IsArchived {
+		return nil, RepositoryNotEditableMessage{Reason: "repo.editor.fork_is_archived", Repository: userRepo.FullName()}, nil
+	}
+	permission, err := access_model.GetUserRepoPermission(ctx, userRepo, user)
+	if err != nil {
+		return nil, RepositoryNotEditableMessage{}, fmt.Errorf("access_model.GetUserRepoPermission: %v", err)
+	}
+	if !permission.CanWrite(unit_model.TypeCode) {
+		return nil, RepositoryNotEditableMessage{Reason: "repo.editor.fork_no_permission", Repository: userRepo.FullName()}, nil
+	}
+
+	return userRepo, RepositoryNotEditableMessage{}, nil
 }
 
-// CanEnableEditor returns true if repository is editable and user has proper access level.
+// CanEnableEditor returns true if the web editor can be enabled for this repository,
+// either by directly writing to the repository or to a user fork.
 func (r *Repository) CanEnableEditor(ctx context.Context, user *user_model.User) bool {
-	return r.RefFullName.IsBranch() && r.CanWriteToBranch(ctx, user, r.BranchName) && r.Repository.CanEnableEditor() && !r.Repository.IsArchived
+	return r.RefFullName.IsBranch() && r.Repository.CanEnableEditor() &&
+		(CanWriteToBranch(ctx, user, r.Repository, r.BranchName) || (r.Permission.CanRead(unit_model.TypeCode) && r.Permission.CanRead(unit_model.TypePullRequests)))
 }
 
 // CanCreateBranch returns true if repository is editable and user has proper access level.
@@ -94,10 +153,31 @@ func RepoMustNotBeArchived() func(ctx *Context) {
 	}
 }
 
+// MustEnableEditor checks if the web editor can be enabled for this repository
+func MustEnableEditor() func(ctx *Context) {
+	return func(ctx *Context) {
+		if !ctx.Repo.CanEnableEditor(ctx, ctx.Doer) {
+			ctx.NotFound(nil)
+		}
+	}
+}
+
+// MustBeAbleToUpload check that upload is enabled on this site and useful for editing
+func MustBeAbleToUpload() func(ctx *Context) {
+	return func(ctx *Context) {
+		if !setting.Repository.Upload.Enabled || !ctx.Repo.Repository.CanEnableEditor() {
+			ctx.NotFound(nil)
+		}
+		editRepo, _, _ := GetEditableRepository(ctx, ctx.Doer, ctx.Repo.Repository, ctx.Repo.BranchName)
+		if editRepo == nil {
+			ctx.NotFound(nil)
+		}
+	}
+}
+
 // CanCommitToBranchResults represents the results of CanCommitToBranch
 type CanCommitToBranchResults struct {
 	CanCommitToBranch bool
-	EditorEnabled     bool
 	UserCanPush       bool
 	RequireSigned     bool
 	WillSign          bool
@@ -106,24 +186,23 @@ type CanCommitToBranchResults struct {
 }
 
 // CanCommitToBranch returns true if repository is editable and user has proper access level
-//
 // and branch is not protected for push
-func (r *Repository) CanCommitToBranch(ctx context.Context, doer *user_model.User) (CanCommitToBranchResults, error) {
-	protectedBranch, err := git_model.GetFirstMatchProtectedBranchRule(ctx, r.Repository.ID, r.BranchName)
+func CanCommitToBranch(ctx context.Context, doer *user_model.User, repo *repo_model.Repository, branchName string) (CanCommitToBranchResults, error) {
+	protectedBranch, err := git_model.GetFirstMatchProtectedBranchRule(ctx, repo.ID, branchName)
 	if err != nil {
 		return CanCommitToBranchResults{}, err
 	}
 	userCanPush := true
 	requireSigned := false
 	if protectedBranch != nil {
-		protectedBranch.Repo = r.Repository
+		protectedBranch.Repo = repo
 		userCanPush = protectedBranch.CanUserPush(ctx, doer)
 		requireSigned = protectedBranch.RequireSignedCommits
 	}
 
-	sign, keyID, _, err := asymkey_service.SignCRUDAction(ctx, r.Repository.RepoPath(), doer, r.Repository.RepoPath(), git.BranchPrefix+r.BranchName)
+	sign, keyID, _, err := asymkey_service.SignCRUDAction(ctx, repo.RepoPath(), doer, repo.RepoPath(), git.BranchPrefix+branchName)
 
-	canCommit := r.CanEnableEditor(ctx, doer) && userCanPush
+	canCommit := repo.CanEnableEditor() && CanWriteToBranch(ctx, doer, repo, branchName) && userCanPush
 	if requireSigned {
 		canCommit = canCommit && sign
 	}
@@ -139,7 +218,6 @@ func (r *Repository) CanCommitToBranch(ctx context.Context, doer *user_model.Use
 
 	return CanCommitToBranchResults{
 		CanCommitToBranch: canCommit,
-		EditorEnabled:     r.CanEnableEditor(ctx, doer),
 		UserCanPush:       userCanPush,
 		RequireSigned:     requireSigned,
 		WillSign:          sign,
diff --git a/services/forms/repo_form.go b/services/forms/repo_form.go
index a2827e516a5d8..6bd1c9cef0549 100644
--- a/services/forms/repo_form.go
+++ b/services/forms/repo_form.go
@@ -716,6 +716,18 @@ func (f *EditPreviewDiffForm) Validate(req *http.Request, errs binding.Errors) b
 	return middleware.Validate(errs, ctx.Data, f, ctx.Locale)
 }
 
+// ForkToEditRepoFileForm form for forking the repo to edit a file
+type ForkToEditRepoFileForm struct {
+	TreePath      string `binding:"Required;MaxSize(500)"`
+	EditOperation string `binding:"Required;MaxSize(20)"`
+}
+
+// Validate validates the fields
+func (f *ForkToEditRepoFileForm) Validate(req *http.Request, errs binding.Errors) binding.Errors {
+	ctx := context.GetValidateContext(req)
+	return middleware.Validate(errs, ctx.Data, f, ctx.Locale)
+}
+
 // _________ .__                                 __________.__        __
 // \_   ___ \|  |__   __________________ ___.__. \______   \__| ____ |  | __
 // /    \  \/|  |  \_/ __ \_  __ \_  __ <   |  |  |     ___/  |/ ___\|  |/ /
diff --git a/services/lfs/server.go b/services/lfs/server.go
index 0a99287ed9cd5..40456cbbbb3d6 100644
--- a/services/lfs/server.go
+++ b/services/lfs/server.go
@@ -254,6 +254,26 @@ func BatchHandler(ctx *context.Context) {
 			responseObject = buildObjectResponse(rc, p, false, !exists, err)
 		} else {
 			var err *lfs_module.ObjectError
+
+			if exists && meta == nil {
+				accessible, accessibleErr := git_model.LFSObjectAccessible(ctx, ctx.Doer, p.Oid)
+				if accessibleErr != nil {
+					log.Error("Unable to check if LFS MetaObject [%s] is accessible. Error: %v", p.Oid, err)
+					writeStatus(ctx, http.StatusInternalServerError)
+					return
+				}
+				if accessible {
+					_, newMetaObjErr := git_model.NewLFSMetaObject(ctx, repository.ID, p)
+					if newMetaObjErr != nil {
+						log.Error("Unable to create LFS MetaObject [%s] for %s/%s. Error: %v", p.Oid, rc.User, rc.Repo, err)
+						writeStatus(ctx, http.StatusInternalServerError)
+						return
+					}
+				} else {
+					exists = false
+				}
+			}
+
 			if !exists || meta == nil {
 				err = &lfs_module.ObjectError{
 					Code:    http.StatusNotFound,
diff --git a/services/pull/reviewer.go b/services/pull/reviewer.go
index 52f2f3401c26f..8794a787fc6c9 100644
--- a/services/pull/reviewer.go
+++ b/services/pull/reviewer.go
@@ -85,5 +85,5 @@ func GetReviewerTeams(ctx context.Context, repo *repo_model.Repository) ([]*orga
 		return nil, nil
 	}
 
-	return organization.GetTeamsWithAccessToAnyRepoUnit(ctx, repo.OwnerID, repo.ID, perm.AccessModeRead, unit.TypePullRequests)
+	return organization.FilterLargeTeams(organization.GetTeamsWithAccessToAnyRepoUnit(ctx, repo.OwnerID, repo.ID, perm.AccessModeRead, unit.TypePullRequests))
 }
diff --git a/services/user/badge.go b/services/user/badge.go
new file mode 100644
index 0000000000000..be6124a7fed65
--- /dev/null
+++ b/services/user/badge.go
@@ -0,0 +1,55 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package user
+
+import (
+	"context"
+	"fmt"
+
+	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/log"
+)
+
+// BLENDER: sync user badges
+// This function works in a best-effort fashion:
+// it tolerates all errors and tries to perform all badge changes one-by-one.
+func UpdateBadgesBestEffort(ctx context.Context, u *user_model.User, newBadges []*user_model.Badge) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		oldUserBadges, _, err := user_model.GetUserBadges(ctx, u)
+		if err != nil {
+			return fmt.Errorf("failed to fetch local badges for %s: %w", u.LoginName, err)
+		}
+
+		oldBadgeSlugs := map[string]struct{}{}
+		for _, badge := range oldUserBadges {
+			oldBadgeSlugs[badge.Slug] = struct{}{}
+		}
+
+		newBadgeSlugs := map[string]struct{}{}
+		for _, badge := range newBadges {
+			newBadgeSlugs[badge.Slug] = struct{}{}
+		}
+
+		for slug := range newBadgeSlugs {
+			if _, has := oldBadgeSlugs[slug]; has {
+				continue
+			}
+			if err := user_model.AddUserBadge(ctx, u, &user_model.Badge{Slug: slug}); err != nil {
+				// Don't escalate, continue processing other badges
+				log.Error("Failed to add badge slug %s to user %s: %v", slug, u.LoginName, err)
+			}
+		}
+		for slug := range oldBadgeSlugs {
+			if _, has := newBadgeSlugs[slug]; has {
+				continue
+			}
+			if err := user_model.RemoveUserBadge(ctx, u, &user_model.Badge{Slug: slug}); err != nil {
+				// Don't escalate, continue processing other badges
+				log.Error("Failed to remove badge slug %s from user %s: %v", slug, u.LoginName, err)
+			}
+		}
+		return nil
+	})
+}
diff --git a/services/user/badge_test.go b/services/user/badge_test.go
new file mode 100644
index 0000000000000..9744355390d1b
--- /dev/null
+++ b/services/user/badge_test.go
@@ -0,0 +1,80 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: sync user badges
+
+package user
+
+import (
+	"fmt"
+	"slices"
+	"sync"
+	"testing"
+
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestUpdateBadgesBestEffort executes UpdateBadgesBestEffort concurrently.
+//
+// This test illustrates the need for a database transaction around AddUserBadge and RemoveUserBadge calls.
+// This test is not deterministic, but at least it can demonstrate the problem after a few non-cached runs:
+//
+//     go test -count=1 -v -tags sqlite -run TestUpdateBadgesBestEffort ./services/user/...
+func TestUpdateBadgesBestEffort(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+	badges := []*user_model.Badge{}
+	for i := range 5 {
+		badge := &user_model.Badge{Slug: fmt.Sprintf("update-badges-test-%d", i)}
+		user_model.CreateBadge(db.DefaultContext, badge)
+		badges = append(badges, badge)
+	}
+	var wg sync.WaitGroup
+	start := make(chan struct{})
+	f := func(wg *sync.WaitGroup, badges []*user_model.Badge) {
+		<-start
+		defer wg.Done()
+		UpdateBadgesBestEffort(db.DefaultContext, user, badges)
+	}
+	updateSets := [][]*user_model.Badge{
+		badges[0:1],
+		badges[1:3],
+		badges[3:5],
+	}
+	for _, s := range updateSets {
+		wg.Add(1)
+		go f(&wg, s)
+	}
+	t.Log("start")
+	// Use the channel to start goroutines' execution as close as possible.
+	close(start)
+	wg.Wait()
+
+	result, _, _ := user_model.GetUserBadges(db.DefaultContext, user)
+	resultSlugs := make([]string, 0, len(result))
+	for _, b := range result {
+		resultSlugs = append(resultSlugs, b.Slug)
+	}
+
+	match := false
+	for _, set := range updateSets {
+		setSlugs := make([]string, 0, len(set))
+		for _, b := range set {
+			setSlugs = append(setSlugs, b.Slug)
+		}
+		// Expecting to confirm that what we get at the end is not a mish-mash of different update attempts,
+		// but one complete attempt.
+		if slices.Equal(setSlugs, resultSlugs) {
+			match = true
+			break
+		}
+	}
+	if !match {
+		t.Fail()
+	}
+}
diff --git a/services/user/spamreport.go b/services/user/spamreport.go
new file mode 100644
index 0000000000000..b28825118d125
--- /dev/null
+++ b/services/user/spamreport.go
@@ -0,0 +1,230 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: spam reporting
+
+package user
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	"code.gitea.io/gitea/models/db"
+	issues_model "code.gitea.io/gitea/models/issues"
+	"code.gitea.io/gitea/models/organization"
+	project_model "code.gitea.io/gitea/models/project"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/optional"
+	"code.gitea.io/gitea/modules/structs"
+	issue_service "code.gitea.io/gitea/services/issue"
+	repo_service "code.gitea.io/gitea/services/repository"
+)
+
+// IsTrustedUser tells if a user is trusted to report spam and to be excluded from others' spam reports.
+func IsTrustedUser(ctx context.Context, user *user_model.User) (bool, error) {
+	if user.IsAdmin {
+		return true, nil
+	}
+	count, err := organization.GetOrganizationCount(ctx, user)
+	if err != nil {
+		return false, fmt.Errorf("GetOrganizationCount: %w", err)
+	}
+	return count > 0, nil
+}
+
+// CreateSpamReport checks that a reporter can report a user,
+// and inserts a new record in default status=pending
+// for further processing.
+// If a record for a given user already exists, it will be returned.
+func CreateSpamReport(ctx context.Context, reporter, user *user_model.User) (*user_model.SpamReport, error) {
+	reporterIsTrusted, err := IsTrustedUser(ctx, reporter)
+	if err != nil {
+		return nil, fmt.Errorf("failed IsTrustedUser: %w", err)
+	}
+	if !reporterIsTrusted {
+		return nil, fmt.Errorf("reporter %s is not trusted", reporter.Name)
+	}
+	userIsTrusted, err := IsTrustedUser(ctx, user)
+	if err != nil {
+		return nil, fmt.Errorf("failed IsTrustedUser: %w", err)
+	}
+	if userIsTrusted {
+		return nil, fmt.Errorf("can't report a trusted user %s", user.Name)
+	}
+
+	spamReport := &user_model.SpamReport{
+		ReporterID: reporter.ID,
+		UserID:     user.ID,
+	}
+	insertErr := db.Insert(ctx, spamReport)
+	if insertErr != nil {
+		// Normally the error may happen due to a duplicate record.
+		// Let's try to fetch the existing record, and if it doesn't exist, escalate the original error.
+		existingSpamReport := &user_model.SpamReport{}
+		if has, _ := db.GetEngine(ctx).Where("user_id = ?", user.ID).Get(existingSpamReport); has {
+			return existingSpamReport, nil
+		}
+		return nil, insertErr
+	}
+	return spamReport, nil
+}
+
+// ProcessSpamReports performs the cleanup of a reported user account and the content it created.
+// Only the reports in "pending" status are processed to avoid race conditions.
+// A processed user account becomes inactive, restricted, login prohibited, profile fields erased,
+// and the following objects that were created by the user are deleted:
+//   - issues and pulls
+//   - comments
+//   - personal repositories
+//   - personal projects
+//
+// If the processing code fails it leaves the SpamReport record that was being processed in "locked" status.
+// It would need to be handled manually, as the error is assumed to be unrecoverable
+// (which may not always be true, e.g. during transient db downtime).
+//
+// We will have to revisit this approach if it actually causes problems.
+// E.g. we could
+//   - either try to unlock the record on failure (this may not always be possible),
+//     or unlock after some timeout (according to the record's UpdatedUnix)
+//   - add a new field to keep track of an attempt count per record
+//   - retry on subsequent runs, until the attempt budget is exhausted
+func ProcessSpamReports(ctx context.Context, doer *user_model.User, spamReportIDs []int64) error {
+	var spamReports []user_model.SpamReport
+	err := db.GetEngine(ctx).In("id", spamReportIDs).Find(&spamReports)
+	if err != nil {
+		return fmt.Errorf("failed to fetch SpamReports: %w", err)
+	}
+
+	for _, spamReport := range spamReports {
+		id := spamReport.ID
+		count, err := db.GetEngine(ctx).ID(id).And("status = ?", user_model.SpamReportStatusTypePending).
+			Update(&user_model.SpamReport{Status: user_model.SpamReportStatusTypeLocked})
+		if err != nil {
+			return fmt.Errorf("failed to set SpamReport.Status to locked for id=%d: %w", id, err)
+		}
+		if count < 1 {
+			log.Info("Skipping SpamReport id=%d, status wasn't pending", id)
+			continue
+		}
+
+		userID := spamReport.UserID
+		user := &user_model.User{ID: userID}
+		has, err := db.GetEngine(ctx).Get(user)
+		if err != nil {
+			return fmt.Errorf("failed to fetch user  userID=%d: %w", userID, err)
+		}
+		if !has {
+			return fmt.Errorf("user id=%d was not found", userID)
+		}
+
+		// Clean up everything and update report status if there were no errors.
+		// On failure the transaction will be rolled back, and the report will be stuck in locked status.
+		log.Info("Processing SpamReport id=%d for user %s", id, user.Name)
+		err = db.WithTx(ctx, func(ctx context.Context) error {
+			if err := cleanupSpam(ctx, user, doer); err != nil {
+				return err
+			}
+			// Everything is cleaned up, marking the spam report as processed.
+			count, err = db.GetEngine(ctx).ID(id).And("status = ?", user_model.SpamReportStatusTypeLocked).
+				Update(&user_model.SpamReport{Status: user_model.SpamReportStatusTypeProcessed})
+			if err != nil {
+				return fmt.Errorf("failed to set SpamReport.Status to processed for id=%d: %w", id, err)
+			}
+			if count < 1 {
+				return fmt.Errorf("SpamReport id=%d status wasn't locked, rolling back the transaction", id)
+			}
+			return nil
+		})
+		if err != nil {
+			return fmt.Errorf("failed to process SpamReport id=%d: %w", id, err)
+		}
+
+		log.Info("Processed SpamReport id=%d for user %s", id, user.Name)
+	}
+	return nil
+}
+
+// cleanupSpam is supposed to be called as a part of a database transaction.
+func cleanupSpam(ctx context.Context, user, doer *user_model.User) error {
+	// UpdateUser and UpdateAuth to clean the profile and prohibit logins.
+	if err := UpdateUser(ctx, user,
+		&UpdateOptions{
+			Description:     optional.Some(""),
+			FullName:        optional.Some("Confirmed Spammer"),
+			IsActive:        optional.Some(false),
+			IsRestricted:    optional.Some(true),
+			Location:        optional.Some(""),
+			MaxRepoCreation: optional.Some(0),
+			Visibility:      optional.Some(structs.VisibleTypeLimited),
+			Website:         optional.Some(""),
+		},
+	); err != nil {
+		return fmt.Errorf("failed to UpdateUser: %w", err)
+	}
+	if err := UpdateAuth(ctx, user, &UpdateAuthOptions{ProhibitLogin: optional.Some(true)}); err != nil {
+		return fmt.Errorf("failed to UpdateAuth: %w", err)
+	}
+
+	log.Info("Cleaning up issues and pulls by user %s", user.Name)
+	issues, err := issues_model.Issues(ctx, &issues_model.IssuesOptions{
+		PosterID: strconv.FormatInt(user.ID, 10),
+	})
+
+	if err != nil {
+		return fmt.Errorf("failed to fetch IssueIDs: %w", err)
+	}
+	for _, issue := range issues {
+		if err := issue_service.DeleteIssue(ctx, doer, nil, issue); err != nil {
+			return fmt.Errorf("failed to delete issue: %w", err)
+		}
+	}
+
+	log.Info("Cleaning up comments by user %s", user.Name)
+	const batchSize = 50
+	for {
+		comments := make([]*issues_model.Comment, 0, batchSize)
+		if err := db.GetEngine(ctx).
+			Where("type=? AND poster_id=?", issues_model.CommentTypeComment, user.ID).
+			Limit(batchSize, 0).
+			Find(&comments); err != nil {
+			return fmt.Errorf("failed to find comments to delete: %w", err)
+		}
+		if len(comments) == 0 {
+			break
+		}
+
+		for _, comment := range comments {
+			if err := issues_model.DeleteComment(ctx, comment); err != nil {
+				return fmt.Errorf("failed to delete comment: %w", err)
+			}
+		}
+	}
+
+	log.Info("Cleaning up personal repositories of user %s", user.Name)
+	if err := repo_service.DeleteOwnerRepositoriesDirectly(ctx, user); err != nil {
+		return fmt.Errorf("failed to clean up repositories: %w", err)
+	}
+
+	log.Info("Cleaning up personal projects of user %s", user.Name)
+	projectIDs, err := project_model.GetAllProjectsIDsByOwnerIDAndType(ctx, user.ID, project_model.TypeIndividual)
+	if err != nil {
+		return fmt.Errorf("failed to fetch personal project ids: %w", err)
+	}
+	for _, projectID := range projectIDs {
+		if err := project_model.DeleteProjectByID(ctx, projectID); err != nil {
+			return fmt.Errorf("failed to clean up personal project id=%d: %w", projectID, err)
+		}
+	}
+	return nil
+}
+
+// DismissSpamReports updates only reports in "pending" status to avoid race conditions
+// with the actual processing.
+func DismissSpamReports(ctx context.Context, spamReportIDs []int64) error {
+	_, err := db.GetEngine(ctx).In("id", spamReportIDs).
+		And("status = ?", user_model.SpamReportStatusTypePending).
+		Update(&user_model.SpamReport{Status: user_model.SpamReportStatusTypeDismissed})
+	return err
+}
diff --git a/services/user/spamreport_test.go b/services/user/spamreport_test.go
new file mode 100644
index 0000000000000..2f4ebcdc86b2c
--- /dev/null
+++ b/services/user/spamreport_test.go
@@ -0,0 +1,93 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// BLENDER: spam reporting
+
+package user
+
+import (
+	"context"
+	"testing"
+
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsTrustedUser(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	userWithOrgs := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	isTrusted, err := IsTrustedUser(context.Background(), userWithOrgs)
+	assert.NoError(t, err)
+	assert.True(t, isTrusted)
+
+	userWithoutOrgs := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 8})
+	isTrusted, err = IsTrustedUser(context.Background(), userWithoutOrgs)
+	assert.NoError(t, err)
+	assert.False(t, isTrusted)
+
+	userWithoutOrgs.IsAdmin = true // now becomes trusted
+	isTrusted, err = IsTrustedUser(context.Background(), userWithoutOrgs)
+	assert.NoError(t, err)
+	assert.True(t, isTrusted)
+}
+
+func TestCreateSpamReport(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	// Prevent interaction between tests, for whatever reason db is not reset.
+	db.GetEngine(db.DefaultContext).Exec("delete from user_spamreport")
+
+	userWithOrgs := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	userWithoutOrgs := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 8})
+
+	// An untrusted user can't report.
+	_, err := CreateSpamReport(context.Background(), userWithoutOrgs, userWithoutOrgs)
+	assert.Error(t, err)
+
+	// A trusted user can't be reported.
+	_, err = CreateSpamReport(context.Background(), userWithOrgs, userWithOrgs)
+	assert.Error(t, err)
+
+	spamReport, err := CreateSpamReport(context.Background(), userWithOrgs, userWithoutOrgs)
+	assert.NoError(t, err)
+	assert.NotNil(t, spamReport)
+
+	// Try to create a duplicate report by a different reporter.
+	adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+	spamReport2, err := CreateSpamReport(context.Background(), adminUser, userWithoutOrgs)
+	assert.NoError(t, err)
+	assert.NotNil(t, spamReport2)
+	assert.Equal(t, spamReport.ID, spamReport2.ID)
+}
+
+func TestProcessSpamReports(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	// Prevent interaction between tests, for whatever reason db is not reset.
+	db.GetEngine(db.DefaultContext).Exec("delete from user_spamreport")
+
+	userWithOrgs := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})    // reporter
+	userWithoutOrgs := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 9}) // spammer, and a different one
+	_, err := CreateSpamReport(context.Background(), userWithOrgs, userWithoutOrgs)
+	assert.NoError(t, err)
+
+	ids, err := user_model.GetPendingSpamReportIDs(context.Background())
+	assert.Len(t, ids, 1)
+	assert.NoError(t, err)
+	cronDoer := &user_model.User{
+		ID:        -1,
+		Name:      "(Cron)",
+		LowerName: "(cron)",
+	}
+	err = ProcessSpamReports(context.Background(), cronDoer, ids)
+	assert.NoError(t, err)
+	userWithoutOrgs = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 9}) // reload from db
+	assert.Equal(t, "Confirmed Spammer", userWithoutOrgs.FullName)
+	assert.True(t, userWithoutOrgs.ProhibitLogin)
+
+	ids, err = user_model.GetPendingSpamReportIDs(context.Background())
+	assert.Empty(t, ids)
+	assert.NoError(t, err)
+}
diff --git a/services/user/user.go b/services/user/user.go
index 1aeebff142d32..5763cf015feae 100644
--- a/services/user/user.go
+++ b/services/user/user.go
@@ -36,12 +36,13 @@ func RenameUser(ctx context.Context, u *user_model.User, newUserName string) err
 	}
 
 	// Non-local users are not allowed to change their username.
-	if !u.IsOrganization() && !u.IsLocal() {
-		return user_model.ErrUserIsNotLocal{
-			UID:  u.ID,
-			Name: u.Name,
-		}
-	}
+	// BLENDER: allow renaming local users.
+	//if !u.IsOrganization() && !u.IsLocal() {
+	//	return user_model.ErrUserIsNotLocal{
+	//		UID:  u.ID,
+	//		Name: u.Name,
+	//	}
+	//}
 
 	if err := user_model.IsUsableUsername(newUserName); err != nil {
 		return err
diff --git a/templates/admin/navbar.tmpl b/templates/admin/navbar.tmpl
index 72584ec799cc3..6cee23f79cf8d 100644
--- a/templates/admin/navbar.tmpl
+++ b/templates/admin/navbar.tmpl
@@ -13,7 +13,7 @@
 				</a>
 			</div>
 		</details>
-		<details class="item toggleable-item" {{if or .PageIsAdminUsers .PageIsAdminEmails .PageIsAdminOrganizations .PageIsAdminAuthentications}}open{{end}}>
+		<details class="item toggleable-item" {{if or .PageIsAdminUsers .PageIsAdminEmails .PageIsAdminOrganizations .PageIsAdminAuthentications .PageIsSpamReports}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "admin.identity_access"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsAdminAuthentications}}active {{end}}item" href="{{AppSubUrl}}/-/admin/auths">
@@ -28,6 +28,9 @@
 				<a class="{{if .PageIsAdminEmails}}active {{end}}item" href="{{AppSubUrl}}/-/admin/emails">
 					{{ctx.Locale.Tr "admin.emails"}}
 				</a>
+				<a class="{{if .PageIsSpamReports}}active {{end}}item" href="{{AppSubUrl}}/-/admin/spamreports">
+					{{ctx.Locale.Tr "admin.spamreports"}}
+				</a>
 			</div>
 		</details>
 		<details class="item toggleable-item" {{if or .PageIsAdminRepositories (and .EnablePackages .PageIsAdminPackages)}}open{{end}}>
diff --git a/templates/admin/spamreports/list.tmpl b/templates/admin/spamreports/list.tmpl
new file mode 100644
index 0000000000000..dc8240ba3fc9a
--- /dev/null
+++ b/templates/admin/spamreports/list.tmpl
@@ -0,0 +1,88 @@
+{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin user")}}
+
+<script>
+document.addEventListener('DOMContentLoaded', function(event) {
+	const selectAll = document.getElementsByClassName('select-all')[0];
+	selectAll.addEventListener('change', function() {
+		const checkboxes = document.getElementsByClassName('managed-by-select-all');
+		for (const checkbox of checkboxes) {
+			checkbox.checked = selectAll.checked;
+		}
+	});
+});
+</script>
+<div class="admin-setting-content">
+	<h4 class="ui top attached header">
+		{{ctx.Locale.Tr "admin.spamreports.spamreport_manage_panel"}}
+		<div class="small-menu-items ui compact tiny menu">
+			{{range .StatusCounts}}
+				<a class="{{if eq .Status $.FilterStatus}}active {{end}}item flex-text-inline" href="?status={{printf "%d" .Status}}">
+					{{.Count}} {{.Status}}
+				</a>
+			{{end}}
+		</div>
+	</h4>
+	{{if .SpamReports}}
+		<form method="post">
+			{{.CsrfTokenHtml}}
+			<div class="ui attached table segment">
+				<table class="ui very basic striped table unstackable">
+					<thead>
+						<tr>
+							{{if eq $.FilterStatus 0}}
+								<th><input type="checkbox" class="select-all" /></th>
+							{{end}}
+							<th>{{ctx.Locale.Tr "admin.spamreports.user"}}</th>
+							<th>{{ctx.Locale.Tr "admin.spamreports.user_created"}}</th>
+							<th>{{ctx.Locale.Tr "admin.spamreports.reporter"}}</th>
+							<th>{{ctx.Locale.Tr "admin.spamreports.created"}}</th>
+							<th>{{ctx.Locale.Tr "admin.spamreports.updated"}}</th>
+							<th>{{ctx.Locale.Tr "admin.spamreports.status"}}</th>
+						</tr>
+					</thead>
+					<tbody>
+						{{range .SpamReports}}
+							<tr>
+								{{if eq $.FilterStatus 0}}
+									<td><input type="checkbox" class="managed-by-select-all" name="spamreport_id" value="{{.ID}}" /></td>
+								{{end}}
+								<td><a href="{{AppSubUrl}}/{{.UserName | PathEscape}}">{{.UserName}}</a></td>
+								<td title="{{DateUtils.FullTime .UserCreatedUnix}}">{{DateUtils.TimeSince .UserCreatedUnix}}</td>
+								<td><a href="{{AppSubUrl}}/{{.ReporterName | PathEscape}}">{{.ReporterName}}</a></td>
+								<td title="{{DateUtils.FullTime .CreatedUnix}}">{{DateUtils.TimeSince .CreatedUnix}}</td>
+								<td title="{{DateUtils.FullTime .UpdatedUnix}}">{{DateUtils.TimeSince .UpdatedUnix}}</td>
+								<td>
+									{{if eq .Status 0}}
+										{{svg "octicon-clock" 16 "tw-mr-2 text primary"}}
+									{{end}}
+									{{if eq .Status 1}}
+										{{svg "octicon-lock" 16 "tw-mr-2 text grey"}}
+									{{end}}
+									{{if eq .Status 2}}
+										{{svg "octicon-check" 16 "tw-mr-2 text green"}}
+									{{end}}
+									{{if eq .Status 3}}
+										{{svg "octicon-trash" 16 "tw-mr-2 text red"}}
+									{{end}}
+									{{.Status}}
+								</td>
+							</tr>
+						{{end}}
+					</tbody>
+				</table>
+			</div>
+			{{if eq $.FilterStatus 0}}
+				<br />
+				<button type="submit" name="action" value="process" class="ui submit primary button btn-submit red" onclick="return confirm('Purge selected accounts?');">Purge accounts</button>
+				<button type="submit" name="action" value="dismiss" class="ui submit primary button btn-submit">Dismiss reports</button>
+			{{end}}
+		</form>
+		{{template "base/paginate" .}}
+	{{else}}
+		<div class="ui info message align center">
+			No {{$.FilterStatus}} reports.
+		</div>
+	{{end}}
+</div>
+
+{{template "admin/layout_footer" .}}
diff --git a/templates/base/head_navbar.tmpl b/templates/base/head_navbar.tmpl
index 35e14d38d3b10..15f1b655e530e 100644
--- a/templates/base/head_navbar.tmpl
+++ b/templates/base/head_navbar.tmpl
@@ -94,6 +94,13 @@
 			</a>
 			{{end}}
 
+			{{if and .IsAdmin .PendingSpamReports}}
+			<a class="item tw-mx-0" href="{{AppSubUrl}}/-/admin/spamreports">
+				<strong class="tw-relative attention-important">
+					pending spam reports: {{.PendingSpamReports}}
+				</strong>
+			</a>
+			{{end}}
 			<a class="item not-mobile" href="{{AppSubUrl}}/notifications" data-tooltip-content="{{ctx.Locale.Tr "notifications"}}" aria-label="{{ctx.Locale.Tr "notifications"}}">
 				<div class="tw-relative">
 					{{svg "octicon-bell"}}
diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 7e89db0005d54..413f3065857b9 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -17,6 +17,16 @@
 				"TextFilterMatchAny" (ctx.Locale.Tr "repo.issues.filter_assignee_any_assignee")
 			}}
 		</div>
+			<div class="ui compact mini menu" style="margin-left: auto; margin-right: 1em;">
+				<button class="item btn" onclick="clickDetailsView()">
+					<span class="issue-card-details">Show Details</span>
+					<span class="issue-card-details tw-hidden">Hide Details</span>
+				</button>
+				<button class="item btn" onclick="clickClosedView()">
+					<span class="issue-card-closed">Show Closed</span>
+					<span class="issue-card-closed tw-hidden">Hide Closed</span>
+				</button>
+			</div>
 		{{if $canWriteProject}}
 			<div class="ui compact mini menu">
 				<a class="item screen-full">
@@ -112,7 +122,7 @@
 				<div class="divider"{{if .Color}} style="color: {{ContrastColor .Color}} !important"{{end}}></div>
 				<div class="ui cards" data-url="{{$.Link}}/{{.ID}}" data-project="{{$.Project.ID}}" data-board="{{.ID}}" id="board_{{.ID}}">
 					{{range (index $.IssuesMap .ID)}}
-						<div class="issue-card tw-break-anywhere {{if $canWriteProject}}tw-cursor-grab{{end}}" data-issue="{{.ID}}">
+						<div class="issue-card tw-break-anywhere {{if $canWriteProject}}tw-cursor-grab{{end}} {{if .IsClosed}}issue-card-closed tw-hidden{{end}}" data-issue="{{.ID}}">
 							{{template "repo/issue/card" (dict "Issue" . "Page" $)}}
 						</div>
 					{{end}}
@@ -122,6 +132,37 @@
 	</div>
 </div>
 
+<script>
+	keyDetails = 'project-show-issue-details:{{.Repository.FullName | JSEscape}}:{{.Project.ID}}';
+	keyClosed = 'project-show-issue-closed:{{.Repository.FullName | JSEscape}}:{{.Project.ID}}';
+
+	function toggleDetailsView() {
+		for (const elem of document.querySelectorAll('.issue-card-details')) {
+			elem.classList.toggle('tw-hidden');
+		}
+	}
+	function clickDetailsView() {
+		localStorage.setItem(keyDetails, (localStorage.getItem(keyDetails) === 'true') ? 'false' : 'true');
+		toggleDetailsView();
+	}
+	if (localStorage.getItem(keyDetails) === 'true') {
+		toggleDetailsView();
+	}
+
+	function toggleClosedView() {
+		for (const elem of document.querySelectorAll('.issue-card-closed')) {
+			elem.classList.toggle('tw-hidden');
+		}
+	}
+	function clickClosedView() {
+		localStorage.setItem(keyClosed, (localStorage.getItem(keyClosed) === 'true') ? 'false' : 'true');
+		toggleClosedView();
+	}
+	if (localStorage.getItem(keyClosed) === 'true') {
+		toggleClosedView();
+	}
+</script>
+
 {{if $canWriteProject}}
 <div class="ui small modal" id="project-column-modal-edit">
 	<div class="header">edit</div>
diff --git a/templates/repo/diff/box.tmpl b/templates/repo/diff/box.tmpl
index f8d0804bf06d5..abd510e93b65e 100644
--- a/templates/repo/diff/box.tmpl
+++ b/templates/repo/diff/box.tmpl
@@ -148,7 +148,7 @@
 												<a class="item" rel="nofollow" href="{{$.BeforeSourcePath}}/{{PathEscapeSegments .Name}}">{{ctx.Locale.Tr "repo.diff.view_file"}}</a>
 											{{else}}
 												<a class="item" rel="nofollow" href="{{$.SourcePath}}/{{PathEscapeSegments .Name}}">{{ctx.Locale.Tr "repo.diff.view_file"}}</a>
-												{{if and $.Repository.CanEnableEditor $.CanEditFile (not $file.IsLFSFile) (not $file.IsBin)}}
+												{{if and $.CanEnableEditor $.CanEditFile (not $file.IsLFSFile) (not $file.IsBin)}}
 													<a class="item" rel="nofollow" href="{{$.HeadRepoLink}}/_edit/{{PathEscapeSegments $.HeadBranchName}}/{{PathEscapeSegments $file.Name}}?return_uri={{print $.BackToLink "#diff-" $file.NameHash | QueryEscape}}">{{ctx.Locale.Tr "repo.editor.edit_this_file"}}</a>
 												{{end}}
 											{{end}}
diff --git a/templates/repo/editor/commit_form.tmpl b/templates/repo/editor/commit_form.tmpl
index 8f46c47b96bf2..20e19b2cecc38 100644
--- a/templates/repo/editor/commit_form.tmpl
+++ b/templates/repo/editor/commit_form.tmpl
@@ -13,6 +13,58 @@
 		</div>
 		<div class="field">
 			<textarea name="commit_message" placeholder="{{ctx.Locale.Tr "repo.editor.commit_message_desc"}}" rows="5">{{.commit_message}}</textarea>
+			<script>
+				(function () {
+					const textarea = document.querySelector('.commit-form textarea[name="commit_message"]');
+					if (!textarea) return;
+
+					const statusbar = document.createElement('div');
+					statusbar.className = 'editor-statusbar';
+
+					const autosave = document.createElement('span');
+					autosave.className = 'autosave';
+
+					const lines = document.createElement('span');
+					lines.className = 'lines';
+					lines.textContent = '1';
+
+					const words = document.createElement('span');
+					words.className = 'words';
+					words.textContent = '1';
+
+					const cursor = document.createElement('span');
+					cursor.className = 'cursor';
+					cursor.textContent = '1:1';
+
+					statusbar.appendChild(autosave);
+					statusbar.appendChild(lines);
+					statusbar.appendChild(words);
+					statusbar.appendChild(cursor);
+					textarea.parentElement.appendChild(statusbar);
+
+					function updateStatus() {
+						const value = textarea.value;
+						const pos = textarea.selectionStart;
+
+						const linesArray = value.substr(0, pos).split('\n');
+						const line = linesArray.length;
+						const column = linesArray[linesArray.length - 1].length + 1;
+
+						const totalLines = value.split('\n').length;
+						const totalWords = (value.match(/\b\w+\b/g) || []).length;
+
+						lines.textContent = totalLines.toString();
+						words.textContent = totalWords.toString();
+						cursor.textContent = `${line}:${column}`;
+					}
+
+					textarea.addEventListener('input', updateStatus);
+					textarea.addEventListener('click', updateStatus);
+					textarea.addEventListener('keyup', updateStatus);
+					updateStatus();
+				})();
+			</script>
+
 		</div>
 		<div class="inline field">
 			<div class="ui checkbox">
diff --git a/templates/repo/editor/delete.tmpl b/templates/repo/editor/delete.tmpl
index 2c0c2fc792e07..4e532e94a0970 100644
--- a/templates/repo/editor/delete.tmpl
+++ b/templates/repo/editor/delete.tmpl
@@ -5,6 +5,11 @@
 		{{template "base/alert" .}}
 		<form class="ui form" method="post">
 			{{.CsrfTokenHtml}}
+			{{if .ForkRepo}}
+				<div class="ui blue message">
+					<p>{{ctx.Locale.Tr "repo.editor.fork_edit_description" .ForkRepo.FullName}}</p>
+				</div>
+			{{end}}
 			<input type="hidden" name="last_commit" value="{{.last_commit}}">
 			{{template "repo/editor/commit_form" .}}
 		</form>
diff --git a/templates/repo/editor/edit.tmpl b/templates/repo/editor/edit.tmpl
index ae8a60c20c116..16a5988716327 100644
--- a/templates/repo/editor/edit.tmpl
+++ b/templates/repo/editor/edit.tmpl
@@ -10,6 +10,11 @@
 			{{.CsrfTokenHtml}}
 			<input type="hidden" name="last_commit" value="{{.last_commit}}">
 			<input type="hidden" name="page_has_posted" value="{{.PageHasPosted}}">
+			{{if .ForkRepo}}
+				<div class="ui blue message">
+					<p>{{ctx.Locale.Tr "repo.editor.fork_edit_description" .ForkRepo.FullName}}</p>
+				</div>
+			{{end}}
 			<div class="repo-editor-header">
 				<div class="ui breadcrumb field{{if .Err_TreePath}} error{{end}}">
 					<a class="section" href="{{$.BranchLink}}">{{.Repository.Name}}</a>
diff --git a/templates/repo/editor/fork.tmpl b/templates/repo/editor/fork.tmpl
new file mode 100644
index 0000000000000..a056fa3d3bb94
--- /dev/null
+++ b/templates/repo/editor/fork.tmpl
@@ -0,0 +1,40 @@
+{{template "base/head" .}}
+<div role="main" aria-label="{{.Title}}" class="page-content repository file editor edit">
+	{{template "repo/header" .}}
+	<div class="ui container">
+		{{template "base/alert" .}}
+		<form class="ui edit form" method="post" action="{{.RepoLink}}/_fork_to_edit/{{.BranchName | PathEscapeSegments}}">
+			{{.CsrfTokenHtml}}
+			<div class="repo-editor-header">
+				<div class="ui breadcrumb field{{if .Err_TreePath}} error{{end}}">
+					<a class="section" href="{{$.BranchLink}}">{{.Repository.Name}}</a>
+					{{$n := len .TreeNames}}
+					{{$l := Eval $n "-" 1}}
+					{{range $i, $v := .TreeNames}}
+						<div class="breadcrumb-divider">/</div>
+						{{if eq $i $l}}
+							<span class="section">{{$v}}</span>
+						{{else}}
+							<span class="section"><a href="{{$.BranchLink}}/{{index $.TreePaths $i | PathEscapeSegments}}">{{$v}}</a></span>
+						{{end}}
+					{{end}}
+					<input type="hidden" name="tree_path" value="{{.TreePath}}" required>
+					<input type="hidden" name="edit_operation" value="{{.EditOperation}}" required>
+				</div>
+			</div>
+			<div class="field center">
+				{{if .CanForkRepo}}
+					<h3>{{ctx.Locale.Tr "repo.editor.fork_create"}}</h3>
+					<p>{{ctx.Locale.Tr "repo.editor.fork_create_description"}}</p>
+					<button class="ui primary button">
+						{{ctx.Locale.Tr "repo.fork_repo"}}
+					</button>
+				{{else}}
+					<h3>{{ctx.Locale.Tr "repo.editor.fork_not_editable"}}</h3>
+					<p>{{.NotEditableMessage}}</p>
+				{{end}}
+			</div>
+		</form>
+	</div>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/repo/editor/patch.tmpl b/templates/repo/editor/patch.tmpl
index 33a7c2a89d8c7..58160e30e5aa9 100644
--- a/templates/repo/editor/patch.tmpl
+++ b/templates/repo/editor/patch.tmpl
@@ -10,6 +10,11 @@
 			{{.CsrfTokenHtml}}
 			<input type="hidden" name="last_commit" value="{{.last_commit}}">
 			<input type="hidden" name="page_has_posted" value="{{.PageHasPosted}}">
+			{{if .ForkRepo}}
+				<div class="ui blue message">
+					<p>{{ctx.Locale.Tr "repo.editor.fork_edit_description" .ForkRepo.FullName}}</p>
+				</div>
+			{{end}}
 			<div class="repo-editor-header">
 				<div class="ui breadcrumb field {{if .Err_TreePath}}error{{end}}">
 					{{ctx.Locale.Tr "repo.editor.patching"}}
diff --git a/templates/repo/editor/upload.tmpl b/templates/repo/editor/upload.tmpl
index 572502040678a..2b3737eeac32d 100644
--- a/templates/repo/editor/upload.tmpl
+++ b/templates/repo/editor/upload.tmpl
@@ -5,6 +5,11 @@
 		{{template "base/alert" .}}
 		<form class="ui comment form" method="post">
 			{{.CsrfTokenHtml}}
+			{{if .ForkRepo}}
+				<div class="ui blue message">
+					<p>{{ctx.Locale.Tr "repo.editor.fork_edit_description" .ForkRepo.FullName}}</p>
+				</div>
+			{{end}}
 			<div class="repo-editor-header">
 				<div class="ui breadcrumb field {{if .Err_TreePath}}error{{end}}">
 					<a class="section" href="{{$.BranchLink}}">{{.Repository.Name}}</a>
diff --git a/templates/repo/empty.tmpl b/templates/repo/empty.tmpl
index 32b5c8401b3f2..64ac9700d664b 100644
--- a/templates/repo/empty.tmpl
+++ b/templates/repo/empty.tmpl
@@ -26,7 +26,7 @@
 							<h3>{{ctx.Locale.Tr "repo.clone_this_repo"}} <small>{{ctx.Locale.Tr "repo.clone_helper" "http://git-scm.com/book/en/v2/Git-Basics-Getting-a-Git-Repository"}}</small></h3>
 
 							<div class="repo-button-row">
-								{{if and .CanWriteCode (not .Repository.IsArchived)}}
+								{{if and .CanWriteCode .CanEnableEditor}}
 									<a class="ui small button" href="{{.RepoLink}}/_new/{{.BranchName | PathEscapeSegments}}/">
 										{{ctx.Locale.Tr "repo.editor.new_file"}}
 									</a>
diff --git a/templates/repo/issue/card.tmpl b/templates/repo/issue/card.tmpl
index 41fe6cea8fbae..99d77f4adfbc8 100644
--- a/templates/repo/issue/card.tmpl
+++ b/templates/repo/issue/card.tmpl
@@ -10,6 +10,14 @@
 		{{end}}
 	{{end}}
 	<div class="content tw-w-full">
+		<!-- BLENDER: Assignees here for more compact display -->
+		{{if .Assignees}}
+		<div class="issue-card-assignees">
+			{{range .Assignees}}
+				<a target="_blank" href="{{.HomeLink}}" data-tooltip-content="{{ctx.Locale.Tr "repo.projects.column.assigned_to"}} {{.Name}}">{{ctx.AvatarUtils.Avatar . 28 "mini gt-mr-3"}}</a>
+			{{end}}
+		</div>
+		{{end}}
 		<div class="tw-flex tw-items-start tw-gap-[5px]">
 			<div class="issue-card-icon">
 				{{template "shared/issueicon" .}}
@@ -22,7 +30,7 @@
 			{{end}}
 		</div>
 		<div class="meta">
-			<span class="text light grey muted-links">
+			<span class="text light grey muted-links issue-card-details tw-hidden">
 				{{if not $.Page.Repository}}{{.Repo.FullName}}{{end}}#{{.Index}}
 				{{$timeStr := DateUtils.TimeSince .GetLastEventTimestamp}}
 				{{if .OriginalAuthor}}
@@ -35,7 +43,7 @@
 			</span>
 		</div>
 		{{if .MilestoneID}}
-		<div class="meta tw-my-1">
+		<div class="meta tw-my-1 issue-card-details tw-hidden">
 			<a class="milestone" href="{{.Repo.Link}}/milestone/{{.MilestoneID}}">
 				{{svg "octicon-milestone" 16 "tw-mr-1 tw-align-middle"}}
 				<span class="tw-align-middle">{{.Milestone.Name}}</span>
@@ -44,7 +52,7 @@
 		{{end}}
 		{{if $.Page.LinkedPRs}}
 		{{range index $.Page.LinkedPRs .ID}}
-		<div class="meta tw-my-1">
+		<div class="meta tw-my-1 issue-card-details tw-hidden">
 			<a href="{{.Repo.Link}}/pulls/{{.Index}}">
 				<span class="tw-m-0 text {{if .PullRequest.HasMerged}}purple{{else if .IsClosed}}red{{else}}green{{end}}">{{svg "octicon-git-merge" 16 "tw-mr-1 tw-align-middle"}}</span>
 				<span class="tw-align-middle">{{.Title}} <span class="text light grey">#{{.Index}}</span></span>
@@ -54,25 +62,20 @@
 		{{end}}
 		{{$tasks := .GetTasks}}
 		{{if gt $tasks 0}}
-			<div class="meta tw-my-1">
+			<div class="meta tw-my-1 issue-card-details tw-hidden">
 				{{svg "octicon-checklist" 16 "tw-mr-1 tw-align-middle"}}
 				<span class="tw-align-middle">{{.GetTasksDone}} / {{$tasks}}</span>
 			</div>
 		{{end}}
 	</div>
 
-	{{if or .Labels .Assignees}}
+	{{if or .Labels}}
 	<div class="issue-card-bottom">
-		<div class="labels-list">
+		<div class="labels-list issue-card-details tw-hidden">
 			{{range .Labels}}
 				<a target="_blank" href="{{$.Issue.Repo.Link}}/issues?labels={{.ID}}">{{ctx.RenderUtils.RenderLabel .}}</a>
 			{{end}}
 		</div>
-		<div class="issue-card-assignees">
-			{{range .Assignees}}
-				<a target="_blank" href="{{.HomeLink}}" data-tooltip-content="{{ctx.Locale.Tr "repo.projects.column.assigned_to"}} {{.Name}}">{{ctx.AvatarUtils.Avatar . 28}}</a>
-			{{end}}
-		</div>
 	</div>
 	{{end}}
 {{end}}
diff --git a/templates/repo/issue/filter_actions.tmpl b/templates/repo/issue/filter_actions.tmpl
index 8e2410393d871..0d196d1f8751f 100644
--- a/templates/repo/issue/filter_actions.tmpl
+++ b/templates/repo/issue/filter_actions.tmpl
@@ -22,15 +22,15 @@
 				<div class="item issue-action" data-action="clear" data-url="{{$.RepoLink}}/issues/labels">
 					{{ctx.Locale.Tr "repo.issues.new.clear_labels"}}
 				</div>
-				{{$previousExclusiveScope := "_no_scope"}}
+				{{$previousScope := "_no_scope"}}
 				{{range .Labels}}
-					{{$exclusiveScope := .ExclusiveScope}}
-					{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
+					{{$scope := .Scope}}
+					{{if and (ne $previousScope "_no_scope") (ne $previousScope $scope)}}
 						<div class="divider"></div>
 					{{end}}
-					{{$previousExclusiveScope = $exclusiveScope}}
+					{{$previousScope = $scope}}
 					<div class="item issue-action tw-flex tw-justify-between" data-action="toggle" data-element-id="{{.ID}}" data-url="{{$.RepoLink}}/issues/labels">
-						{{if SliceUtils.Contains $.SelLabelIDs .ID}}{{svg (Iif $exclusiveScope "octicon-dot-fill" "octicon-check")}}{{end}} {{ctx.RenderUtils.RenderLabel .}}
+						{{if SliceUtils.Contains $.SelLabelIDs .ID}}{{svg (Iif .ExclusiveScope "octicon-dot-fill" "octicon-check")}}{{end}} {{ctx.RenderUtils.RenderLabel .}}
 						{{template "repo/issue/labels/label_archived" .}}
 					</div>
 				{{end}}
diff --git a/templates/repo/issue/filter_item_label.tmpl b/templates/repo/issue/filter_item_label.tmpl
index 04c3605a6afa1..f0bffcd155d95 100644
--- a/templates/repo/issue/filter_item_label.tmpl
+++ b/templates/repo/issue/filter_item_label.tmpl
@@ -26,19 +26,19 @@
 		{{/* The logic here is not the same as the label selector in the issue sidebar.
 		The one in the issue sidebar renders "repo labels | divider | org labels".
 		Maybe the logic should be updated to be consistent.*/}}
-		{{$previousExclusiveScope := "_no_scope"}}
+		{{$previousScope := "_no_scope"}}
 		{{range .Labels}}
-			{{$exclusiveScope := .ExclusiveScope}}
-			{{if and (ne $previousExclusiveScope $exclusiveScope)}}
+			{{$scope := .Scope}}
+			{{if and (ne $previousScope $scope)}}
 				<div class="divider" data-scope="{{.ExclusiveScope}}"></div>
 			{{end}}
-			{{$previousExclusiveScope = $exclusiveScope}}
+			{{$previousScope = $scope}}
 			<a class="item label-filter-query-item" data-label-id="{{.ID}}" data-scope="{{.ExclusiveScope}}" {{if .IsArchived}}data-is-archived{{end}}
 				href="{{QueryBuild $queryLink "labels" .QueryString}}">
 				{{if .IsExcluded}}
 					{{svg "octicon-circle-slash"}}
 				{{else if .IsSelected}}
-					{{Iif $exclusiveScope (svg "octicon-dot-fill") (svg "octicon-check")}}
+					{{Iif .ExclusiveScope (svg "octicon-dot-fill") (svg "octicon-check")}}
 				{{end}}
 				{{ctx.RenderUtils.RenderLabel .}}
 				<p class="tw-ml-auto">{{template "repo/issue/labels/label_archived" .}}</p>
diff --git a/templates/repo/issue/sidebar/label_list.tmpl b/templates/repo/issue/sidebar/label_list.tmpl
index ed514f6725c8c..2b3255371a38c 100644
--- a/templates/repo/issue/sidebar/label_list.tmpl
+++ b/templates/repo/issue/sidebar/label_list.tmpl
@@ -19,23 +19,25 @@
 				<div class="scrolling menu">
 					<a class="item clear-selection" data-text="" href="#">{{ctx.Locale.Tr "repo.issues.new.clear_labels"}}</a>
 					<div class="divider"></div>
-					{{$previousExclusiveScope := "_no_scope"}}
+					{{$previousScope := "_no_scope"}}
 					{{range $data.RepoLabels}}
+						{{$scope := .Scope}}
 						{{$exclusiveScope := .ExclusiveScope}}
-						{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
+						{{if and (ne $previousScope "_no_scope") (ne $previousScope $scope)}}
 							<div class="divider" data-scope="{{.ExclusiveScope}}"></div>
 						{{end}}
-						{{$previousExclusiveScope = $exclusiveScope}}
+						{{$previousScope = $scope}}
 						{{template "repo/issue/sidebar/label_list_item" dict "Label" .}}
 					{{end}}
 					{{if and $data.RepoLabels $data.OrgLabels}}<div class="divider"></div>{{end}}
-					{{$previousExclusiveScope = "_no_scope"}}
+					{{$previousScope = "_no_scope"}}
 					{{range $data.OrgLabels}}
+						{{$scope := .Scope}}
 						{{$exclusiveScope := .ExclusiveScope}}
-						{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
+						{{if and (ne $previousScope "_no_scope") (ne $previousScope $scope)}}
 							<div class="divider" data-scope="{{.ExclusiveScope}}"></div>
 						{{end}}
-						{{$previousExclusiveScope = $exclusiveScope}}
+						{{$previousScope = $scope}}
 						{{template "repo/issue/sidebar/label_list_item" dict "Label" .}}
 					{{end}}
 				</div>
diff --git a/templates/repo/issue/view_title.tmpl b/templates/repo/issue/view_title.tmpl
index b8f28dfd9bd3a..27be7ed3349e4 100644
--- a/templates/repo/issue/view_title.tmpl
+++ b/templates/repo/issue/view_title.tmpl
@@ -118,6 +118,7 @@
 								</div>
 							</div>
 						</div>
+						<div>Remember to rebase the branch in your fork, see&nbsp;<a href="https://wiki.blender.org/wiki/Tools/Pull_Requests">documentation</a>.</div>
 					</span>
 				{{end}}
 			{{else}}
diff --git a/templates/repo/view_content.tmpl b/templates/repo/view_content.tmpl
index 292a2f878c800..ff122ca065d53 100644
--- a/templates/repo/view_content.tmpl
+++ b/templates/repo/view_content.tmpl
@@ -41,8 +41,8 @@
 		<a href="{{.Repository.Link}}/find/{{.RefTypeNameSubURL}}" class="ui compact basic button">{{ctx.Locale.Tr "repo.find_file.go_to_file"}}</a>
 	{{end}}
 
-	{{if and .CanWriteCode .RefFullName.IsBranch (not .Repository.IsMirror) (not .Repository.IsArchived) (not .IsViewFile)}}
-		<button class="ui dropdown basic compact jump button"{{if not .Repository.CanEnableEditor}} disabled{{end}}>
+	{{if and .RefFullName.IsBranch (not .IsViewFile) .CanEnableEditor .IsSigned}}
+		<button class="ui dropdown basic compact jump button">
 			{{ctx.Locale.Tr "repo.editor.add_file"}}
 			{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 			<div class="menu">
diff --git a/templates/repo/view_file.tmpl b/templates/repo/view_file.tmpl
index b49818c6b7c63..544819cf32b47 100644
--- a/templates/repo/view_file.tmpl
+++ b/templates/repo/view_file.tmpl
@@ -61,7 +61,7 @@
 					{{svg "octicon-rss"}}
 				</a>
 				{{end}}
-				{{if .Repository.CanEnableEditor}}
+				{{if .CanEnableEditor}}
 					{{if .CanEditFile}}
 						<a class="btn-octicon" data-tooltip-content="{{.EditFileTooltip}}" href="{{.RepoLink}}/_edit/{{PathEscapeSegments .BranchName}}/{{PathEscapeSegments .TreePath}}">{{svg "octicon-pencil"}}</a>
 					{{else}}
@@ -77,8 +77,12 @@
 				<button class="ui mini basic button unescape-button tw-mr-1 tw-hidden">{{ctx.Locale.Tr "repo.unescape_control_characters"}}</button>
 				<button class="ui mini basic button escape-button tw-mr-1">{{ctx.Locale.Tr "repo.escape_control_characters"}}</button>
 			{{end}}
-			{{if and .ReadmeInList .CanEditReadmeFile}}
-				<a class="btn-octicon" data-tooltip-content="{{ctx.Locale.Tr "repo.editor.edit_this_file"}}" href="{{.RepoLink}}/_edit/{{PathEscapeSegments .BranchName}}/{{PathEscapeSegments .FileTreePath}}">{{svg "octicon-pencil"}}</a>
+			{{if and .ReadmeInList .CanEnableEditor}}
+				{{if .CanEditReadmeFile}}
+					<a class="btn-octicon" data-tooltip-content="{{.EditReadmeFileTooltip}}" href="{{.RepoLink}}/_edit/{{PathEscapeSegments .BranchName}}/{{PathEscapeSegments .FileTreePath}}">{{svg "octicon-pencil"}}</a>
+				{{else}}
+					<span class="btn-octicon disabled" data-tooltip-content="{{.EditReadmeFileTooltip}}">{{svg "octicon-pencil"}}</span>
+				{{end}}
 			{{end}}
 		</div>
 	</h4>
diff --git a/templates/shared/user/profile_big_avatar.tmpl b/templates/shared/user/profile_big_avatar.tmpl
index 91f04e0b53dc6..e322e4a788290 100644
--- a/templates/shared/user/profile_big_avatar.tmpl
+++ b/templates/shared/user/profile_big_avatar.tmpl
@@ -130,9 +130,26 @@
 						<a class="muted" href="{{AppSubUrl}}/user/settings/blocked_users">{{ctx.Locale.Tr "user.block.unblock"}}</a>
 					{{end}}
 				</li>
+				{{if .CanReportSpam}}
+					<li>
+						{{if .ExistingSpamReport}}
+							<span>
+								{{ctx.Locale.Tr "user.spamreport.existing_status" .ExistingSpamReport.Status}}
+							</span>
+						{{else}}
+						  {{if .IsAdmin}}
+								<a class="muted show-modal" href="#" data-modal="#purgespammer-user-modal" data-modal-modal-username="{{.ContextUser.Name}}" data-modal-modal-form.action="{{AppSubUrl}}/-/admin/purge_spammer">{{ctx.Locale.Tr "user.purgespammer.profile_button"}}</a>
+							{{else}}
+								<a class="muted show-modal" href="#" data-modal="#spamreport-user-modal" data-modal-modal-username="{{.ContextUser.Name}}" data-modal-modal-form.action="{{AppSubUrl}}/user/settings/spamreport">{{ctx.Locale.Tr "user.spamreport.profile_button"}}</a>
+							{{end}}
+						{{end}}
+					</li>
+				{{end}}
 			{{end}}
 		</ul>
 	</div>
 </div>
 
 {{template "shared/user/block_user_dialog" .}}
+{{template "shared/user/purgespammer_user_dialog" .}}
+{{template "shared/user/spamreport_user_dialog" .}}
diff --git a/templates/shared/user/purgespammer_user_dialog.tmpl b/templates/shared/user/purgespammer_user_dialog.tmpl
new file mode 100644
index 0000000000000..77960ae49ef40
--- /dev/null
+++ b/templates/shared/user/purgespammer_user_dialog.tmpl
@@ -0,0 +1,14 @@
+<div class="ui small modal" id="purgespammer-user-modal">
+	<div class="header">{{ctx.Locale.Tr "user.purgespammer.modal_title"}}</div>
+	<div class="content">
+		<div class="ui warning message">{{ctx.Locale.Tr "user.purgespammer.modal_info"}}</div>
+		<form class="ui form modal-form" method="post">
+			{{.CsrfTokenHtml}}
+			<input type="hidden" name="username" class="modal-username" />
+			<div class="text right actions">
+				<button class="ui cancel button">{{ctx.Locale.Tr "cancel"}}</button>
+				<button class="ui red button">{{ctx.Locale.Tr "user.purgespammer.modal_action"}}</button>
+			</div>
+		</form>
+	</div>
+</div>
diff --git a/templates/shared/user/spamreport_user_dialog.tmpl b/templates/shared/user/spamreport_user_dialog.tmpl
new file mode 100644
index 0000000000000..e9015fd16c431
--- /dev/null
+++ b/templates/shared/user/spamreport_user_dialog.tmpl
@@ -0,0 +1,14 @@
+<div class="ui small modal" id="spamreport-user-modal">
+	<div class="header">{{ctx.Locale.Tr "user.spamreport.modal_title"}}</div>
+	<div class="content">
+		<div class="ui warning message">{{ctx.Locale.Tr "user.spamreport.modal_info"}}</div>
+		<form class="ui form modal-form" method="post">
+			{{.CsrfTokenHtml}}
+			<input type="hidden" name="username" class="modal-username" />
+			<div class="text right actions">
+				<button class="ui cancel button">{{ctx.Locale.Tr "cancel"}}</button>
+				<button class="ui red button">{{ctx.Locale.Tr "user.spamreport.modal_action"}}</button>
+			</div>
+		</form>
+	</div>
+</div>
diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl
index 3615edf771172..86b04e59b022b 100644
--- a/templates/swagger/v1_json.tmpl
+++ b/templates/swagger/v1_json.tmpl
@@ -19380,6 +19380,42 @@
         }
       }
     },
+    "/users/{username}/contributor-agreements/{slug}": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "user"
+        ],
+        "summary": "Check if contributor agreement is signed by the user",
+        "operationId": "userCheckContributorAgreement",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "username of user",
+            "name": "username",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "slug of a contributor agreement to check",
+            "name": "slug",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/string"
+          },
+          "404": {
+            "$ref": "#/responses/notFound"
+          }
+        }
+      }
+    },
     "/users/{username}/followers": {
       "get": {
         "produces": [
diff --git a/templates/user/settings/account.tmpl b/templates/user/settings/account.tmpl
index 2c01c88d47c1c..7bac2c97d1661 100644
--- a/templates/user/settings/account.tmpl
+++ b/templates/user/settings/account.tmpl
@@ -4,7 +4,7 @@
 			{{ctx.Locale.Tr "settings.password"}}
 		</h4>
 		<div class="ui attached segment">
-			{{if and (not ($.UserDisabledFeatures.Contains "manage_credentials")) (or (.SignedUser.IsLocal) (.SignedUser.IsOAuth2))}}
+			{{if and (not ($.UserDisabledFeatures.Contains "manage_password")) (or (.SignedUser.IsLocal) (.SignedUser.IsOAuth2))}}
 			<form class="ui form ignore-dirty" action="{{AppSubUrl}}/user/settings/account" method="post">
 				{{template "base/disable_form_autofill"}}
 				{{.CsrfTokenHtml}}
diff --git a/templates/user/settings/contributor_agreements.tmpl b/templates/user/settings/contributor_agreements.tmpl
new file mode 100644
index 0000000000000..3d621c2d1898a
--- /dev/null
+++ b/templates/user/settings/contributor_agreements.tmpl
@@ -0,0 +1,45 @@
+{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings contributor-agreements")}}
+	<div class="user-setting-content">
+		<h4 class="ui top attached header">
+			{{ctx.Locale.Tr "settings.contributor_agreements"}}
+		</h4>
+		<div class="ui attached segment">
+			<div class="ui list">
+				{{range .ContributorAgreements}}
+					<div class="item">
+						<div class="tw-mb-2">
+							<h4 class="ui header"><strong>{{.Slug}}</strong></h4>
+							{{if .SignedAt}}
+								<div class="text light-3">{{ctx.Locale.Tr "contributor_agreements.signed_at" (DateUtils.FullTime .SignedAt)}}</div>
+							{{end}}
+						</div>
+						<details>
+							<summary>
+								{{if not .SignedAt}}
+									{{ctx.Locale.Tr "contributor_agreements.view_and_sign"}}
+								{{else}}
+									{{ctx.Locale.Tr "contributor_agreements.view"}}
+								{{end}}
+							</summary>
+							<pre>{{.Content}}</pre>
+							{{if not .SignedAt}}
+								<form method="post" action="{{AppSubUrl}}/user/settings/contributor_agreements/{{.Slug}}/sign" class="ui form">
+									{{$.CsrfTokenHtml}}
+									<div class="field">
+										<div class="ui checkbox">
+											<label>{{ctx.Locale.Tr "contributor_agreements.confirm"}}</label>
+											<input type="checkbox" required name="confirm" />
+										</div>
+									</div>
+									<button class="ui primary button" type="submit">
+										{{ctx.Locale.Tr "contributor_agreements.sign"}}
+									</button>
+								</form>
+							{{end}}
+						</details>
+					</div>
+				{{end}}
+			</div>
+		</div>
+	</div>
+{{template "user/settings/layout_footer" .}}
diff --git a/templates/user/settings/navbar.tmpl b/templates/user/settings/navbar.tmpl
index c6c15512abdab..f8ba22bfebc47 100644
--- a/templates/user/settings/navbar.tmpl
+++ b/templates/user/settings/navbar.tmpl
@@ -60,5 +60,8 @@
 		<a class="{{if .PageIsSettingsRepos}}active {{end}}item" href="{{AppSubUrl}}/user/settings/repos">
 			{{ctx.Locale.Tr "settings.repos"}}
 		</a>
+		<a class="{{if .PageIsSettingsContributorAgreements}}active {{end}}item" href="{{AppSubUrl}}/user/settings/contributor_agreements">
+			{{ctx.Locale.Tr "settings.contributor_agreements"}}
+		</a>
 	</div>
 </div>
diff --git a/tests/integration/editor_test.go b/tests/integration/editor_test.go
index a5936d86de225..3c54228a134de 100644
--- a/tests/integration/editor_test.go
+++ b/tests/integration/editor_test.go
@@ -20,6 +20,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/json"
+	"code.gitea.io/gitea/modules/test"
 	"code.gitea.io/gitea/modules/translation"
 	"code.gitea.io/gitea/tests"
 
@@ -30,13 +31,26 @@ import (
 func TestCreateFile(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user2")
-		testCreateFile(t, session, "user2", "repo1", "master", "test.txt", "Content")
+		testCreateFile(t, session, "user2", "user2", "repo1", "master", "master", "direct", "test.txt", "Content", "")
+		testCreateFile(
+			t, session, "user2", "user2", "repo1", "master", "master", "direct", "test.txt", "Content",
+			`A file named "test.txt" already exists in this repository.`)
+		testCreateFile(t, session, "user2", "user2", "repo1", "master", "master", "commit-to-new-branch", "test2.txt", "Content",
+			`Branch "master" already exists in this repository.`)
 	})
 }
 
-func testCreateFile(t *testing.T, session *TestSession, user, repo, branch, filePath, content string) *httptest.ResponseRecorder {
+func TestCreateFileFork(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user4")
+		forkToEdit(t, session, "user2", "repo1", "_new", "master", "test.txt")
+		testCreateFile(t, session, "user4", "user2", "repo1", "master", "feature/test", "commit-to-new-branch", "test.txt", "Content", "")
+	})
+}
+
+func testCreateFile(t *testing.T, session *TestSession, user, owner, repo, branch, targetBranch, commitChoice, filePath, content, expectedError string) {
 	// Request editor page
-	newURL := fmt.Sprintf("/%s/%s/_new/%s/", user, repo, branch)
+	newURL := fmt.Sprintf("/%s/%s/_new/%s/", owner, repo, branch)
 	req := NewRequest(t, "GET", newURL)
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
@@ -46,70 +60,97 @@ func testCreateFile(t *testing.T, session *TestSession, user, repo, branch, file
 
 	// Save new file to master branch
 	req = NewRequestWithValues(t, "POST", newURL, map[string]string{
-		"_csrf":         doc.GetCSRF(),
-		"last_commit":   lastCommit,
-		"tree_path":     filePath,
-		"content":       content,
-		"commit_choice": "direct",
+		"_csrf":           doc.GetCSRF(),
+		"last_commit":     lastCommit,
+		"tree_path":       filePath,
+		"content":         content,
+		"commit_choice":   commitChoice,
+		"new_branch_name": targetBranch,
 	})
-	return session.MakeRequest(t, req, http.StatusSeeOther)
+
+	if expectedError != "" {
+		resp := session.MakeRequest(t, req, http.StatusOK)
+
+		// Check for expextecd error message
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		assert.Contains(t, htmlDoc.doc.Find(".ui.flash-message").Text(), expectedError)
+		return
+	}
+
+	session.MakeRequest(t, req, http.StatusSeeOther)
+
+	// Check new file exists
+	req = NewRequestf(t, "GET", "/%s/%s/src/branch/%s/%s", user, repo, targetBranch, filePath)
+	session.MakeRequest(t, req, http.StatusOK)
 }
 
 func TestCreateFileOnProtectedBranch(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user2")
+		testCreateFileOnProtectedBranch(t, session, "user2", "user2", "repo1", "master", "master", "direct")
+	})
+}
 
-		csrf := GetUserCSRFToken(t, session)
-		// Change master branch to protected
-		req := NewRequestWithValues(t, "POST", "/user2/repo1/settings/branches/edit", map[string]string{
-			"_csrf":       csrf,
-			"rule_name":   "master",
-			"enable_push": "true",
-		})
-		session.MakeRequest(t, req, http.StatusSeeOther)
-		// Check if master branch has been locked successfully
-		flashMsg := session.GetCookieFlashMessage()
-		assert.Equal(t, `Branch protection for rule "master" has been updated.`, flashMsg.SuccessMsg)
+func TestCreateFileOnProtectedBranchFork(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user4")
+		forkToEdit(t, session, "user2", "repo1", "_new", "master", "test.txt")
+		testCreateFileOnProtectedBranch(t, session, "user4", "user2", "repo1", "master", "feature/test", "commit-to-new-branch")
+	})
+}
 
-		// Request editor page
-		req = NewRequest(t, "GET", "/user2/repo1/_new/master/")
-		resp := session.MakeRequest(t, req, http.StatusOK)
+func testCreateFileOnProtectedBranch(t *testing.T, session *TestSession, user, owner, repo, branch, targetBranch, commitChoice string) {
+	csrf := GetUserCSRFToken(t, session)
+	// Change target branch to protected
+	req := NewRequestWithValues(t, "POST", path.Join(user, repo, "settings", "branches", "edit"), map[string]string{
+		"_csrf":       csrf,
+		"rule_name":   targetBranch,
+		"enable_push": "true",
+	})
+	session.MakeRequest(t, req, http.StatusSeeOther)
+	// Check if target branch has been locked successfully
+	flashMsg := session.GetCookieFlashMessage()
+	assert.Equal(t, fmt.Sprintf(`Branch protection for rule "%s" has been updated.`, targetBranch), flashMsg.SuccessMsg)
 
-		doc := NewHTMLParser(t, resp.Body)
-		lastCommit := doc.GetInputValueByName("last_commit")
-		assert.NotEmpty(t, lastCommit)
+	// Request editor page
+	req = NewRequest(t, "GET", path.Join(owner, repo, "_new", branch))
+	resp := session.MakeRequest(t, req, http.StatusOK)
 
-		// Save new file to master branch
-		req = NewRequestWithValues(t, "POST", "/user2/repo1/_new/master/", map[string]string{
-			"_csrf":         doc.GetCSRF(),
-			"last_commit":   lastCommit,
-			"tree_path":     "test.txt",
-			"content":       "Content",
-			"commit_choice": "direct",
-		})
+	doc := NewHTMLParser(t, resp.Body)
+	lastCommit := doc.GetInputValueByName("last_commit")
+	assert.NotEmpty(t, lastCommit)
 
-		resp = session.MakeRequest(t, req, http.StatusOK)
-		// Check body for error message
-		assert.Contains(t, resp.Body.String(), "Cannot commit to protected branch &#34;master&#34;.")
+	// Save new file to target branch
+	req = NewRequestWithValues(t, "POST", path.Join(owner, repo, "_new", branch), map[string]string{
+		"_csrf":           doc.GetCSRF(),
+		"last_commit":     lastCommit,
+		"tree_path":       "test.txt",
+		"content":         "Content",
+		"commit_choice":   commitChoice,
+		"new_branch_name": targetBranch,
+	})
 
-		// remove the protected branch
-		csrf = GetUserCSRFToken(t, session)
+	resp = session.MakeRequest(t, req, http.StatusOK)
+	// Check body for error message
+	assert.Contains(t, resp.Body.String(), fmt.Sprintf("Cannot commit to protected branch &#34;%s&#34;.", targetBranch))
 
-		// Change master branch to protected
-		req = NewRequestWithValues(t, "POST", "/user2/repo1/settings/branches/1/delete", map[string]string{
-			"_csrf": csrf,
-		})
+	// remove the protected branch
+	csrf = GetUserCSRFToken(t, session)
+
+	// Change target branch to protected
+	req = NewRequestWithValues(t, "POST", path.Join(user, repo, "settings", "branches", "1", "delete"), map[string]string{
+		"_csrf": csrf,
+	})
 
-		resp = session.MakeRequest(t, req, http.StatusOK)
+	resp = session.MakeRequest(t, req, http.StatusOK)
 
-		res := make(map[string]string)
-		assert.NoError(t, json.NewDecoder(resp.Body).Decode(&res))
-		assert.Equal(t, "/user2/repo1/settings/branches", res["redirect"])
+	res := make(map[string]string)
+	assert.NoError(t, json.NewDecoder(resp.Body).Decode(&res))
+	assert.Equal(t, "/"+path.Join(user, repo, "settings", "branches"), res["redirect"])
 
-		// Check if master branch has been locked successfully
-		flashMsg = session.GetCookieFlashMessage()
-		assert.Equal(t, `Removing branch protection rule "1" failed.`, flashMsg.ErrorMsg)
-	})
+	// Check if target branch has been locked successfully
+	flashMsg = session.GetCookieFlashMessage()
+	assert.Equal(t, `Removing branch protection rule "1" failed.`, flashMsg.ErrorMsg)
 }
 
 func testEditFile(t *testing.T, session *TestSession, user, repo, branch, filePath, newContent string) *httptest.ResponseRecorder {
@@ -141,9 +182,9 @@ func testEditFile(t *testing.T, session *TestSession, user, repo, branch, filePa
 	return resp
 }
 
-func testEditFileToNewBranch(t *testing.T, session *TestSession, user, repo, branch, targetBranch, filePath, newContent string) *httptest.ResponseRecorder {
+func testEditFileToNewBranch(t *testing.T, session *TestSession, user, owner, repo, branch, targetBranch, filePath, newContent string) *httptest.ResponseRecorder {
 	// Get to the 'edit this file' page
-	req := NewRequest(t, "GET", path.Join(user, repo, "_edit", branch, filePath))
+	req := NewRequest(t, "GET", path.Join(owner, repo, "_edit", branch, filePath))
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	htmlDoc := NewHTMLParser(t, resp.Body)
@@ -151,7 +192,7 @@ func testEditFileToNewBranch(t *testing.T, session *TestSession, user, repo, bra
 	assert.NotEmpty(t, lastCommit)
 
 	// Submit the edits
-	req = NewRequestWithValues(t, "POST", path.Join(user, repo, "_edit", branch, filePath),
+	req = NewRequestWithValues(t, "POST", path.Join(owner, repo, "_edit", branch, filePath),
 		map[string]string{
 			"_csrf":           htmlDoc.GetCSRF(),
 			"last_commit":     lastCommit,
@@ -181,10 +222,168 @@ func TestEditFile(t *testing.T) {
 func TestEditFileToNewBranch(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user2")
-		testEditFileToNewBranch(t, session, "user2", "repo1", "master", "feature/test", "README.md", "Hello, World (Edited)\n")
+		testEditFileToNewBranch(t, session, "user2", "user2", "repo1", "master", "feature/test", "README.md", "Hello, World (Edited)\n")
 	})
 }
 
+func TestEditFileToNewBranchFork(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user4")
+		forkToEdit(t, session, "user2", "repo1", "_edit", "master", "README.md")
+		testEditFileToNewBranch(t, session, "user4", "user2", "repo1", "master", "feature/test", "README.md", "Hello, World (Edited)\n")
+	})
+}
+
+func testEditFileDiffPreview(t *testing.T, session *TestSession, user, repo, branch, filePath string) {
+	// Get to the 'edit this file' page
+	req := NewRequest(t, "GET", path.Join(user, repo, "_edit", branch, filePath))
+	resp := session.MakeRequest(t, req, http.StatusOK)
+
+	htmlDoc := NewHTMLParser(t, resp.Body)
+	lastCommit := htmlDoc.GetInputValueByName("last_commit")
+	assert.NotEmpty(t, lastCommit)
+
+	// Preview the changes
+	req = NewRequestWithValues(t, "POST", path.Join(user, repo, "_preview", branch, filePath),
+		map[string]string{
+			"_csrf":   htmlDoc.GetCSRF(),
+			"content": "Hello, World (Edited)\n",
+		},
+	)
+	resp = session.MakeRequest(t, req, http.StatusOK)
+
+	assert.Contains(t, resp.Body.String(), `<span class="added-code">Hello, World (Edited)</span>`)
+}
+
+func TestEditFileDiffPreview(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user2")
+		testEditFileDiffPreview(t, session, "user2", "repo1", "master", "README.md")
+	})
+}
+
+func TestDeleteFile(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user2")
+		testDeleteFile(t, session, "user2", "user2", "repo1", "master", "master", "direct", "README.md", "")
+		testDeleteFile(t, session, "user2", "user2", "repo1", "master", "master", "direct", "MISSING.md",
+			`The file being deleted, "MISSING.md", no longer exists in this repository.`)
+	})
+}
+
+func TestDeleteFileFork(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user4")
+		forkToEdit(t, session, "user2", "repo1", "_delete", "master", "README.md")
+		testDeleteFile(t, session, "user4", "user2", "repo1", "master", "feature/test", "commit-to-new-branch", "README.md", "")
+		testDeleteFile(t, session, "user4", "user2", "repo1", "master", "feature/missing", "commit-to-new-branch", "MISSING.md",
+			`The file being deleted, "MISSING.md", no longer exists in this repository.`)
+	})
+}
+
+func testDeleteFile(t *testing.T, session *TestSession, user, owner, repo, branch, targetBranch, commitChoice, filePath, expectedError string) {
+	if expectedError == "" {
+		// Check file exists
+		req := NewRequestf(t, "GET", "/%s/%s/src/branch/%s/%s", owner, repo, branch, filePath)
+		session.MakeRequest(t, req, http.StatusOK)
+	}
+
+	// Request editor page
+	newURL := fmt.Sprintf("/%s/%s/_delete/%s/%s", owner, repo, branch, filePath)
+	req := NewRequest(t, "GET", newURL)
+	resp := session.MakeRequest(t, req, http.StatusOK)
+
+	doc := NewHTMLParser(t, resp.Body)
+	lastCommit := doc.GetInputValueByName("last_commit")
+	assert.NotEmpty(t, lastCommit)
+
+	// Save deleted file to target branch
+	req = NewRequestWithValues(t, "POST", newURL, map[string]string{
+		"_csrf":           doc.GetCSRF(),
+		"last_commit":     lastCommit,
+		"tree_path":       filePath,
+		"commit_choice":   commitChoice,
+		"new_branch_name": targetBranch,
+	})
+
+	if expectedError != "" {
+		resp := session.MakeRequest(t, req, http.StatusOK)
+
+		// Check for expextecd error message
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		assert.Contains(t, htmlDoc.doc.Find(".ui.flash-message").Text(), expectedError)
+		return
+	}
+
+	session.MakeRequest(t, req, http.StatusSeeOther)
+
+	// Check file was deleted
+	req = NewRequestf(t, "GET", "/%s/%s/src/branch/%s/%s", user, repo, targetBranch, filePath)
+	session.MakeRequest(t, req, http.StatusNotFound)
+}
+
+func TestPatchFile(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user2")
+		testPatchFile(t, session, "user2", "user2", "repo1", "master", "feature/test", "Contents", "")
+		testPatchFile(t, session, "user2", "user2", "repo1", "master", "feature/test", "Contents",
+			`Branch "feature/test" already exists in this repository.`)
+		testPatchFile(t, session, "user2", "user2", "repo1", "feature/test", "feature/again", "Conflict",
+			`Unable to apply patch`)
+	})
+}
+
+func TestPatchFileFork(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user4")
+		forkToEdit(t, session, "user2", "repo1", "_diffpatch", "master", "README.md")
+		testPatchFile(t, session, "user4", "user2", "repo1", "master", "feature/test", "Contents", "")
+	})
+}
+
+func testPatchFile(t *testing.T, session *TestSession, user, owner, repo, branch, targetBranch, contents, expectedError string) {
+	// Request editor page
+	newURL := fmt.Sprintf("/%s/%s/_diffpatch/%s/", owner, repo, branch)
+	req := NewRequest(t, "GET", newURL)
+	resp := session.MakeRequest(t, req, http.StatusOK)
+
+	doc := NewHTMLParser(t, resp.Body)
+	lastCommit := doc.GetInputValueByName("last_commit")
+	assert.NotEmpty(t, lastCommit)
+
+	// Save new file to master branch
+	req = NewRequestWithValues(t, "POST", newURL, map[string]string{
+		"_csrf":       doc.GetCSRF(),
+		"last_commit": lastCommit,
+		"tree_path":   "__dummy__",
+		"content": fmt.Sprintf(`diff --git a/patch-file-1.txt b/patch-file-1.txt
+new file mode 100644
+index 0000000000..aaaaaaaaaa
+--- /dev/null
++++ b/patch-file-1.txt
+@@ -0,0 +1 @@
++%s
+`, contents),
+		"commit_choice":   "commit-to-new-branch",
+		"new_branch_name": targetBranch,
+	})
+
+	if expectedError != "" {
+		resp := session.MakeRequest(t, req, http.StatusOK)
+
+		// Check for expextecd error message
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		assert.Contains(t, htmlDoc.doc.Find(".ui.flash-message").Text(), expectedError)
+		return
+	}
+
+	session.MakeRequest(t, req, http.StatusSeeOther)
+
+	// Check new file exists
+	req = NewRequestf(t, "GET", "/%s/%s/src/branch/%s/%s", user, repo, targetBranch, "patch-file-1.txt")
+	session.MakeRequest(t, req, http.StatusOK)
+}
+
 func TestWebGitCommitEmail(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, _ *url.URL) {
 		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
@@ -337,3 +536,95 @@ index 0000000000..bbbbbbbbbb
 		})
 	})
 }
+
+func forkToEdit(t *testing.T, session *TestSession, owner, repo, operation, branch, filePath string) {
+	// Attempt to edit file
+	req := NewRequest(t, "GET", path.Join(owner, repo, operation, branch, filePath))
+	resp := session.MakeRequest(t, req, http.StatusOK)
+	htmlDoc := NewHTMLParser(t, resp.Body)
+
+	// Fork
+	req = NewRequestWithValues(t, "POST", path.Join(owner, repo, "_fork_to_edit", branch),
+		map[string]string{
+			"_csrf":          htmlDoc.GetCSRF(),
+			"tree_path":      filePath,
+			"edit_operation": operation,
+		},
+	)
+	resp = session.MakeRequest(t, req, http.StatusSeeOther)
+	assert.Equal(t, "/"+path.Join(owner, repo, operation, branch, filePath), test.RedirectURL(resp))
+}
+
+func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, branch, filePath string) {
+	// Fork repository because we can't edit it
+	forkToEdit(t, session, owner, repo, "_edit", branch, filePath)
+
+	// Check the existence of the forked repo
+	req := NewRequestf(t, "GET", "/%s/%s/settings", user, repo)
+	resp := session.MakeRequest(t, req, http.StatusOK)
+	htmlDoc := NewHTMLParser(t, resp.Body)
+
+	// Archive the repository
+	req = NewRequestWithValues(t, "POST", path.Join(user, repo, "settings"),
+		map[string]string{
+			"_csrf":     htmlDoc.GetCSRF(),
+			"repo_name": repo,
+			"action":    "archive",
+		},
+	)
+	session.MakeRequest(t, req, http.StatusSeeOther)
+
+	// Check editing archived repository is disabled
+	req = NewRequest(t, "GET", path.Join(owner, repo, "_edit", branch, filePath))
+	resp = session.MakeRequest(t, req, http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "Fork Repository Not Editable")
+
+	// Unfork the repository
+	req = NewRequestWithValues(t, "POST", path.Join(user, repo, "settings"),
+		map[string]string{
+			"_csrf":     htmlDoc.GetCSRF(),
+			"repo_name": repo,
+			"action":    "convert_fork",
+		},
+	)
+	session.MakeRequest(t, req, http.StatusSeeOther)
+
+	// Fork repository again
+	forkToEdit(t, session, owner, repo, "_edit", branch, filePath)
+
+	// Check the existence of the forked repo with unique name
+	req = NewRequestf(t, "GET", "/%s/%s-1", user, repo)
+	session.MakeRequest(t, req, http.StatusOK)
+}
+
+func TestForkToEditFile(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user4")
+		testForkToEditFile(t, session, "user4", "user2", "repo1", "master", "README.md")
+	})
+}
+
+func TestEditFileNotAllowed(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user4")
+
+		operations := []string{"_new", "_edit", "_delete", "_upload", "_diffpatch", "_cherrypick"}
+
+		for _, operation := range operations {
+			// Branch does not exist
+			url := path.Join("user2", "repo1", operation, "missing", "README.md")
+			req := NewRequest(t, "GET", url)
+			session.MakeRequest(t, req, http.StatusNotFound)
+
+			// Private repository
+			url = path.Join("user2", "repo2", operation, "master", "Home.md")
+			req = NewRequest(t, "GET", url)
+			session.MakeRequest(t, req, http.StatusNotFound)
+
+			// Empty repository
+			url = path.Join("org41", "repo61", operation, "master", "README.md")
+			req = NewRequest(t, "GET", url)
+			session.MakeRequest(t, req, http.StatusNotFound)
+		}
+	})
+}
diff --git a/tests/integration/pull_compare_test.go b/tests/integration/pull_compare_test.go
index 86bdd1b9e351c..c29d2001ad7f0 100644
--- a/tests/integration/pull_compare_test.go
+++ b/tests/integration/pull_compare_test.go
@@ -104,7 +104,7 @@ func TestPullCompare_EnableAllowEditsFromMaintainer(t *testing.T) {
 		assert.True(t, forkedRepo.IsPrivate)
 
 		// user4 creates a new branch and a PR
-		testEditFileToNewBranch(t, user4Session, "user4", forkedRepoName, "master", "user4/update-readme", "README.md", "Hello, World\n(Edited by user4)\n")
+		testEditFileToNewBranch(t, user4Session, "user4", "user4", forkedRepoName, "master", "user4/update-readme", "README.md", "Hello, World\n(Edited by user4)\n")
 		resp := testPullCreateDirectly(t, user4Session, repo3.OwnerName, repo3.Name, "master", "user4", forkedRepoName, "user4/update-readme", "PR for user4 forked repo3")
 		prURL := test.RedirectURL(resp)
 
diff --git a/tests/integration/pull_merge_test.go b/tests/integration/pull_merge_test.go
index b642f0682f5e8..bf0f80294c21c 100644
--- a/tests/integration/pull_merge_test.go
+++ b/tests/integration/pull_merge_test.go
@@ -181,7 +181,7 @@ func TestPullCleanUpAfterMerge(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "feature/test", "README.md", "Hello, World (Edited - TestPullCleanUpAfterMerge)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "feature/test", "README.md", "Hello, World (Edited - TestPullCleanUpAfterMerge)\n")
 
 		resp := testPullCreate(t, session, "user1", "repo1", false, "master", "feature/test", "This is a pull title")
 
@@ -235,8 +235,8 @@ func TestCantMergeConflict(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "conflict", "README.md", "Hello, World (Edited Once)\n")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "base", "README.md", "Hello, World (Edited Twice)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "conflict", "README.md", "Hello, World (Edited Once)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "base", "README.md", "Hello, World (Edited Twice)\n")
 
 		// Use API to create a conflicting pr
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
@@ -281,7 +281,7 @@ func TestCantMergeUnrelated(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "base", "README.md", "Hello, World (Edited Twice)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "base", "README.md", "Hello, World (Edited Twice)\n")
 
 		// Now we want to create a commit on a branch that is totally unrelated to our current head
 		// Drop down to pure code at this point
@@ -344,7 +344,7 @@ func TestCantMergeUnrelated(t *testing.T) {
 		_, _, err = git.NewCommand("branch", "unrelated").AddDynamicArguments(commitSha).RunStdString(git.DefaultContext, &git.RunOpts{Dir: path})
 		assert.NoError(t, err)
 
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "conflict", "README.md", "Hello, World (Edited Once)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "conflict", "README.md", "Hello, World (Edited Once)\n")
 
 		// Use API to create a conflicting pr
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
@@ -376,7 +376,7 @@ func TestFastForwardOnlyMerge(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "update", "README.md", "Hello, World 2\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "update", "README.md", "Hello, World 2\n")
 
 		// Use API to create a pr from update to master
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
@@ -417,7 +417,7 @@ func TestCantFastForwardOnlyMergeDiverging(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "diverging", "README.md", "Hello, World diverged\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "diverging", "README.md", "Hello, World diverged\n")
 		testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World 2\n")
 
 		// Use API to create a pr from diverging to update
@@ -539,9 +539,9 @@ func TestConflictChecking(t *testing.T) {
 func TestPullRetargetChildOnBranchDelete(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user1")
-		testEditFileToNewBranch(t, session, "user2", "repo1", "master", "base-pr", "README.md", "Hello, World\n(Edited - TestPullRetargetOnCleanup - base PR)\n")
+		testEditFileToNewBranch(t, session, "user2", "user2", "repo1", "master", "base-pr", "README.md", "Hello, World\n(Edited - TestPullRetargetOnCleanup - base PR)\n")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "base-pr", "child-pr", "README.md", "Hello, World\n(Edited - TestPullRetargetOnCleanup - base PR)\n(Edited - TestPullRetargetOnCleanup - child PR)")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "base-pr", "child-pr", "README.md", "Hello, World\n(Edited - TestPullRetargetOnCleanup - base PR)\n(Edited - TestPullRetargetOnCleanup - child PR)")
 
 		respBasePR := testPullCreate(t, session, "user2", "repo1", true, "master", "base-pr", "Base Pull Request")
 		elemBasePR := strings.Split(test.RedirectURL(respBasePR), "/")
@@ -574,8 +574,8 @@ func TestPullDontRetargetChildOnWrongRepo(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "base-pr", "README.md", "Hello, World\n(Edited - TestPullDontRetargetChildOnWrongRepo - base PR)\n")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "base-pr", "child-pr", "README.md", "Hello, World\n(Edited - TestPullDontRetargetChildOnWrongRepo - base PR)\n(Edited - TestPullDontRetargetChildOnWrongRepo - child PR)")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "base-pr", "README.md", "Hello, World\n(Edited - TestPullDontRetargetChildOnWrongRepo - base PR)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "base-pr", "child-pr", "README.md", "Hello, World\n(Edited - TestPullDontRetargetChildOnWrongRepo - base PR)\n(Edited - TestPullDontRetargetChildOnWrongRepo - child PR)")
 
 		respBasePR := testPullCreate(t, session, "user1", "repo1", false, "master", "base-pr", "Base Pull Request")
 		elemBasePR := strings.Split(test.RedirectURL(respBasePR), "/")
@@ -611,7 +611,7 @@ func TestPullRequestMergedWithNoPermissionDeleteBranch(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		session := loginUser(t, "user4")
 		testRepoFork(t, session, "user2", "repo1", "user4", "repo1", "")
-		testEditFileToNewBranch(t, session, "user4", "repo1", "master", "base-pr", "README.md", "Hello, World\n(Edited - TestPullDontRetargetChildOnWrongRepo - base PR)\n")
+		testEditFileToNewBranch(t, session, "user4", "user4", "repo1", "master", "base-pr", "README.md", "Hello, World\n(Edited - TestPullDontRetargetChildOnWrongRepo - base PR)\n")
 
 		respBasePR := testPullCreate(t, session, "user4", "repo1", false, "master", "base-pr", "Base Pull Request")
 		elemBasePR := strings.Split(test.RedirectURL(respBasePR), "/")
diff --git a/tests/integration/pull_review_test.go b/tests/integration/pull_review_test.go
index 1121751c88bc7..7ae0c655760e4 100644
--- a/tests/integration/pull_review_test.go
+++ b/tests/integration/pull_review_test.go
@@ -228,7 +228,7 @@ func TestPullView_GivenApproveOrRejectReviewOnClosedPR(t *testing.T) {
 
 		t.Run("Submit approve/reject review on closed PR", func(t *testing.T) {
 			// Created a closed PR (made by user1) in the upstream repo1.
-			testEditFileToNewBranch(t, user1Session, "user1", "repo1", "master", "a-test-branch", "README.md", "Hello, World (Editied...again)\n")
+			testEditFileToNewBranch(t, user1Session, "user1", "user1", "repo1", "master", "a-test-branch", "README.md", "Hello, World (Editied...again)\n")
 			resp := testPullCreate(t, user1Session, "user1", "repo1", false, "master", "a-test-branch", "This is a pull title")
 			elem := strings.Split(test.RedirectURL(resp), "/")
 			assert.Equal(t, "pulls", elem[3])
diff --git a/tests/integration/pull_status_test.go b/tests/integration/pull_status_test.go
index 4d43847f1bee7..a659c4e5026dc 100644
--- a/tests/integration/pull_status_test.go
+++ b/tests/integration/pull_status_test.go
@@ -28,7 +28,7 @@ func TestPullCreate_CommitStatus(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "status1", "README.md", "status1")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "status1", "README.md", "status1")
 
 		url := path.Join("user1", "repo1", "compare", "master...status1")
 		req := NewRequestWithValues(t, "POST", url,
@@ -127,8 +127,8 @@ func TestPullCreate_EmptyChangesWithDifferentCommits(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user1")
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "status1", "README.md", "status1")
-		testEditFileToNewBranch(t, session, "user1", "repo1", "status1", "status1", "README.md", "# repo1\n\nDescription for repo1")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "status1", "README.md", "status1")
+		testEditFile(t, session, "user1", "repo1", "status1", "README.md", "# repo1\n\nDescription for repo1")
 
 		url := path.Join("user1", "repo1", "compare", "master...status1")
 		req := NewRequestWithValues(t, "POST", url,
diff --git a/tests/integration/repo_activity_test.go b/tests/integration/repo_activity_test.go
index d5025decba078..85110e064c32c 100644
--- a/tests/integration/repo_activity_test.go
+++ b/tests/integration/repo_activity_test.go
@@ -29,10 +29,10 @@ func TestRepoActivity(t *testing.T) {
 		assert.Equal(t, "pulls", elem[3])
 		testPullMerge(t, session, elem[1], elem[2], elem[4], repo_model.MergeStyleMerge, false)
 
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "feat/better_readme", "README.md", "Hello, World (Edited Again)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "feat/better_readme", "README.md", "Hello, World (Edited Again)\n")
 		testPullCreate(t, session, "user1", "repo1", false, "master", "feat/better_readme", "This is a pull title")
 
-		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "feat/much_better_readme", "README.md", "Hello, World (Edited More)\n")
+		testEditFileToNewBranch(t, session, "user1", "user1", "repo1", "master", "feat/much_better_readme", "README.md", "Hello, World (Edited More)\n")
 		testPullCreate(t, session, "user1", "repo1", false, "master", "feat/much_better_readme", "This is a pull title")
 
 		// Create issues (3 new issues)
diff --git a/tests/integration/repo_webhook_test.go b/tests/integration/repo_webhook_test.go
index 3ccc34f20f514..ac742ab172a05 100644
--- a/tests/integration/repo_webhook_test.go
+++ b/tests/integration/repo_webhook_test.go
@@ -359,7 +359,7 @@ func Test_WebhookPush(t *testing.T) {
 		testAPICreateWebhookForRepo(t, session, "user2", "repo1", provider.URL(), "push")
 
 		// 2. trigger the webhook
-		testCreateFile(t, session, "user2", "repo1", "master", "test_webhook_push.md", "# a test file for webhook push")
+		testCreateFile(t, session, "user2", "user2", "repo1", "master", "master", "direct", "test_webhook_push.md", "# a test file for webhook push", "")
 
 		// 3. validate the webhook is triggered
 		assert.Equal(t, "push", triggeredEvent)
@@ -762,7 +762,7 @@ func Test_WebhookStatus_NoWrongTrigger(t *testing.T) {
 		testCreateWebhookForRepo(t, session, "gitea", "user2", "repo1", provider.URL(), "push_only")
 
 		// 2. trigger the webhook with a push action
-		testCreateFile(t, session, "user2", "repo1", "master", "test_webhook_push.md", "# a test file for webhook push")
+		testCreateFile(t, session, "user2", "user2", "repo1", "master", "master", "direct", "test_webhook_push.md", "# a test file for webhook push", "")
 
 		// 3. validate the webhook is triggered with right event
 		assert.Equal(t, "push", trigger)
diff --git a/web_src/css/features/projects.css b/web_src/css/features/projects.css
index 25cb530f85975..bfffa31138fe0 100644
--- a/web_src/css/features/projects.css
+++ b/web_src/css/features/projects.css
@@ -20,6 +20,14 @@
 }
 
 .project-column {
+  background-color: var(--color-project-column-bg) !important;
+  border: 1px solid var(--color-secondary) !important;
+  border-radius: var(--border-radius);
+  margin: 0 0.5rem !important;
+  padding: 0.5rem !important;
+  width: 320px;
+  height: initial;
+  min-height: max(calc(100vh - 225px), 300px);
   flex: 0 0 auto;
   display: flex;
   flex-direction: column;
diff --git a/web_src/css/repo/issue-card.css b/web_src/css/repo/issue-card.css
index 27f3c2d554e60..cfce0cea1b1bd 100644
--- a/web_src/css/repo/issue-card.css
+++ b/web_src/css/repo/issue-card.css
@@ -38,4 +38,6 @@
   gap: 0.25em;
   justify-content: end;
   flex-wrap: wrap;
+  float: right;
+  margin-left: 0.5em;
 }
diff --git a/web_src/js/components/PullRequestMergeForm.vue b/web_src/js/components/PullRequestMergeForm.vue
index 4f291f5ca1c13..efe37b21c782a 100644
--- a/web_src/js/components/PullRequestMergeForm.vue
+++ b/web_src/js/components/PullRequestMergeForm.vue
@@ -26,6 +26,12 @@ const mergeStyleAllowedCount = ref(0);
 const showMergeStyleMenu = ref(false);
 const showActionForm = ref(false);
 
+const mergeMessageTextarea = ref<HTMLTextAreaElement | null>(null);
+const cursorLine = ref(1);
+const cursorColumn = ref(1);
+const wordCount = ref(1);
+const lineCount = ref(1);
+
 const mergeButtonStyleClass = computed(() => {
   if (mergeForm.value.allOverridableChecksOk) return 'primary';
   return autoMergeWhenSucceed.value ? 'primary' : 'red';
@@ -76,6 +82,22 @@ function switchMergeStyle(name: string, autoMerge = false) {
 function clearMergeMessage() {
   mergeMessageFieldValue.value = mergeForm.value.defaultMergeMessage;
 }
+
+function updateCursorPosition() {
+  const textarea = mergeMessageTextarea.value;
+  if (!textarea) return;
+
+  const pos = textarea.selectionStart ?? 0;
+  const value = textarea.value;
+
+  const lines = value.substring(0, pos).split('\n');
+  cursorLine.value = lines.length;
+  cursorColumn.value = lines[lines.length - 1].length + 1;
+
+  lineCount.value = textarea.value.split('\n').length;
+  wordCount.value = textarea.value.trim().split(/\s+/).filter(Boolean).length;
+}
+
 </script>
 
 <template>
@@ -105,7 +127,22 @@ function clearMergeMessage() {
           <input type="text" name="merge_title_field" v-model="mergeTitleFieldValue">
         </div>
         <div class="field">
-          <textarea name="merge_message_field" rows="5" :placeholder="mergeForm.mergeMessageFieldPlaceHolder" v-model="mergeMessageFieldValue"/>
+          <textarea
+            ref="mergeMessageTextarea"
+            name="merge_message_field"
+            rows="5"
+            :placeholder="mergeForm.mergeMessageFieldPlaceHolder"
+            v-model="mergeMessageFieldValue"
+            @click="updateCursorPosition"
+            @keyup="updateCursorPosition"
+            @input="updateCursorPosition"
+          />
+          <div class="editor-statusbar">
+            <span class="autosave"></span>
+            <span class="lines">{{ lineCount }}</span>
+            <span class="words">{{ wordCount }}</span>
+            <span class="cursor">{{ cursorLine }}:{{ cursorColumn }}</span>
+          </div>
           <template v-if="mergeMessageFieldValue !== mergeForm.defaultMergeMessage">
             <button @click.prevent="clearMergeMessage" class="btn tw-mt-1 tw-p-1 interact-fg" :data-tooltip-content="mergeForm.textClearMergeMessageHint">
               {{ mergeForm.textClearMergeMessage }}
diff --git a/web_src/js/features/repo-issue.ts b/web_src/js/features/repo-issue.ts
index bc7d4dee1976f..08aed35ad861d 100644
--- a/web_src/js/features/repo-issue.ts
+++ b/web_src/js/features/repo-issue.ts
@@ -547,7 +547,14 @@ function initIssueTemplateCommentEditors(commentForm: HTMLFormElement) {
       // deactivate all markdown editors
       showElem(commentForm.querySelectorAll('.combo-editor-dropzone .form-field-real'));
       hideElem(commentForm.querySelectorAll('.combo-editor-dropzone .combo-markdown-editor'));
-      hideElem(commentForm.querySelectorAll('.combo-editor-dropzone .form-field-dropzone'));
+      queryElems(commentForm, '.combo-editor-dropzone .form-field-dropzone', (dropzoneContainer) => {
+        const dropzoneEl = dropzoneContainer.closest<HTMLElement>('.combo-editor-dropzone')?.querySelector<HTMLElement>('.dropzone');
+        const dzInstance = dropzoneEl?.dropzone;
+
+        if (dzInstance && dzInstance.files.length === 0) {
+          hideElem(dropzoneContainer);
+        }
+      });
 
       // activate this markdown editor
       hideElem(fieldTextarea);