Merge from stable

hg: Redirect Mercurial stdout/stderr to logging when running as WSGI Any "console" output from Mercurial when Kallithea is running from WSGI should end up in Kallithea's logs. That seems like a nice general feature. This will however also solve another rare but more critical problem: Mercurial is writing to sys.stdout / sys.stderr, using several layers of wrapping. Since Mercurial 5.5 (with https://repo.mercurial-scm.org/hg/rev/8e04607023e5 ), all writes are given a memoryview. Apache httpd mod_wsgi is invoking the WSGI with a custom mod_wsgi.Log injected in sys.stdout / sys.stderr . This logger can however not handle memoryview - https://github.com/GrahamDumpleton/mod_wsgi/issues/863 .

wsgi: Refactor to introduce make_app_raw function with the essentials of make_app Command line commands and WSGI applications have different environments and runtime models. They deserve different handling. Keep make_app doing as before so WSGI scripts keep working as before. All "app" usage from command line is changed to use make_app_raw directly.

docs: Make mod_wsgi description more clear and actionable

py3.13: Fix DeprecationWarning: 'maxsplit' is passed as positional argument

py3.13: Fix DeprecationWarning: 'count' is passed as positional argument

controller: Handle UnicodeDecodeError from webob decoding invalid URLs webob will try to utf-8 decode all %-encoded bytes in URL-parameters, but will not handle Unicode erors ... and neither did Kallithea. Visiting a URL like http://localhost:5000/?%AD would thus give an unhandled exception showing "Internal Server Error" to the user, and logging the full traceback and: WebApp Error: UnicodeDecodeError: 'utf-8' codec can't decode byte 0xad in position 0: invalid start byte This has been seen a lot recently from attackers probing for a php vulnerability https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ . Now handle these exceptions more nicely and reject with "400 Bad Request".

hg: support new clonebundles_manifest write protocol command A new wire protocol command was introduced with Mercurial 6.5 - https://repo.mercurial-scm.org/hg/rev/4238e6b22fc4 . When a client (after negotiation with the server) decided to use this new command, Kallithea would fail safely and require write permissions. Fixed by adding it to the list of known read-only commands.

Merge from stable

front-end: update package.json to trust semver and package-lock.json