From 200527b37e31f2b22b2c2d649f0349e290d08ea0 Mon Sep 17 00:00:00 2001
From: SandObserver <260779319+SandObserver@users.noreply.github.com>
Date: Sat, 24 Oct 2026 14:34:53 -0400
Subject: [PATCH 1/2] Add Gitea, Forgejo and GitLab to the Git widget

The GitHub widget is now named Git and reads GitHub, Gitea, Forgejo or
GitLab. Gitea and Forgejo offer pull requests and the contribution
heatmap. GitLab offers merge requests. The fetch helper returns response
headers on request, for the total counts.
---
 api/src/proxy.js                     |  15 ++-
 api/test/github-data.test.js         | 164 +++++++++++++++++++++++
 api/test/proxy.test.js               |  17 +++
 api/test/secret-scope.test.js        |   8 ++
 ui/test/widget-toolbox-link.test.mjs |   7 +-
 ui/widgets/github/contributions.html |  19 +--
 ui/widgets/github/data.js            | 191 ++++++++++++++++++++++++---
 ui/widgets/github/i18n/de.json       |  24 +++-
 ui/widgets/github/i18n/en.json       |  24 +++-
 ui/widgets/github/i18n/es.json       |  24 +++-
 ui/widgets/github/i18n/fa.json       |  24 +++-
 ui/widgets/github/i18n/fr.json       |  24 +++-
 ui/widgets/github/i18n/zh-Hans.json  |  24 +++-
 ui/widgets/github/pullrequests.html  |  18 ++-
 ui/widgets/github/widget.json        | 105 ++++++++++++++-
 15 files changed, 605 insertions(+), 83 deletions(-)

diff --git a/api/src/proxy.js b/api/src/proxy.js
index d75cf239..3e4c7c87 100644
--- a/api/src/proxy.js
+++ b/api/src/proxy.js
@@ -357,12 +357,17 @@ function fetchJSON(raw, opts = {}) {
               contentType: (res.headers['content-type'] || '').toLowerCase(),
             });
           const body = Buffer.concat(bufs).toString('utf8');
-          if (opts.raw) return done(resolve, { status: res.statusCode, data: body });
+          /* Keep headers opt-in. Some widgets return the reply as is, and headers can carry cookies. */
+          const reply = data =>
+            opts.withHeaders
+              ? { status: res.statusCode, data, headers: res.headers }
+              : { status: res.statusCode, data };
+          if (opts.raw) return done(resolve, reply(body));
           const ct = (res.headers['content-type'] || '').toLowerCase();
           try {
-            done(resolve, { status: res.statusCode, data: JSON.parse(body) });
+            done(resolve, reply(JSON.parse(body)));
           } catch {
-            if (looksLikeMetrics(ct, body)) done(resolve, { status: res.statusCode, data: parsePrometheus(body) });
+            if (looksLikeMetrics(ct, body)) done(resolve, reply(parsePrometheus(body)));
             else if (ct.includes('xml') || body.trimStart().startsWith('<')) {
               const parsed = parseXml(body);
               if (parsed['#truncated']) {
@@ -373,8 +378,8 @@ function fetchJSON(raw, opts = {}) {
                   bytes: body.length,
                 });
               }
-              done(resolve, { status: res.statusCode, data: parsed });
-            } else done(resolve, { status: res.statusCode, data: body });
+              done(resolve, reply(parsed));
+            } else done(resolve, reply(body));
           }
         });
       },
diff --git a/api/test/github-data.test.js b/api/test/github-data.test.js
index ec39b3af..876ffa2e 100644
--- a/api/test/github-data.test.js
+++ b/api/test/github-data.test.js
@@ -49,3 +49,167 @@ test('an empty search is a valid empty list', async () => {
   const r = await dataFn(ctxFor(PRS, { status: 200, data: { total_count: 0, items: [] } }));
   assert.deepEqual(r.items, []);
 });
+
+const { normalizeBase } = require('../src/widget-data');
+const { serviceLink } = require('../../ui/js/service-link.js');
+
+function recordingCtx(config, reply) {
+  const calls = [];
+  const ctx = {
+    config,
+    normalizeBase,
+    serviceLink,
+    fetchJSON: async (url, opts) => {
+      calls.push({ url: new URL(url), opts });
+      return typeof reply === 'function' ? reply(url) : reply;
+    },
+    ...errorParts(),
+  };
+  return { ctx, calls };
+}
+
+const GITEA = { githubService: 'gitea', githubUrl: 'https://git.lan/', githubUser: 'me', githubToken: 't' };
+
+for (const service of ['gitea', 'forgejo']) {
+  test(`${service} pull requests search the token owner's open pull requests`, async () => {
+    const { ctx, calls } = recordingCtx(
+      { ...GITEA, githubService: service, githubPrFilters: ['created', 'review-requested'] },
+      {
+        status: 200,
+        headers: { 'x-total-count': '31' },
+        data: [
+          { number: 4, title: 'Fix', repository: { full_name: 'me/app' }, html_url: 'https://git.lan/me/app/pulls/4' },
+        ],
+      },
+    );
+    const r = await dataFn(ctx);
+    const { url, opts } = calls[0];
+    assert.equal(url.origin + url.pathname, 'https://git.lan/api/v1/repos/issues/search');
+    assert.equal(url.searchParams.get('type'), 'pulls');
+    assert.equal(url.searchParams.get('state'), 'open');
+    assert.equal(url.searchParams.get('created'), 'true');
+    assert.equal(url.searchParams.get('review_requested'), 'true');
+    assert.equal(opts.headers.Authorization, 'token t');
+    assert.equal(r.totalCount, 31);
+    assert.deepEqual(r.items, [{ number: 4, title: 'Fix', repo: 'me/app', url: 'https://git.lan/me/app/pulls/4' }]);
+    assert.equal(r.allUrl, 'https://git.lan/pulls');
+  });
+}
+
+test('gitea counts the listed pull requests when the total header is missing', async () => {
+  const { ctx } = recordingCtx(GITEA, {
+    status: 200,
+    data: [
+      { number: 1, title: 'a' },
+      { number: 2, title: 'b' },
+    ],
+  });
+  assert.equal((await dataFn(ctx)).totalCount, 2);
+});
+
+test('gitea without a server URL fails as a setup problem', async () => {
+  const { ctx } = recordingCtx({ ...GITEA, githubUrl: '' }, { status: 200, data: [] });
+  await assert.rejects(dataFn(ctx), e => e.kind === ctx.KIND.INVALID && /URL/.test(e.message));
+});
+
+for (const [status, kind] of [
+  [401, 'AUTH'],
+  [403, 'AUTH'],
+  [404, 'INVALID'],
+]) {
+  test(`gitea answering ${status} fails as ${kind}`, async () => {
+    const { ctx } = recordingCtx(GITEA, { status, data: { message: 'x' } });
+    await assert.rejects(dataFn(ctx), e => e.kind === ctx.KIND[kind]);
+  });
+}
+
+test('gitea contributions add the heatmap slots up per day', async () => {
+  const now = new Date();
+  const at = (daysAgo, hour) => {
+    const d = new Date(now);
+    d.setDate(d.getDate() - daysAgo);
+    d.setHours(hour, 15, 0, 0);
+    return Math.floor(d.getTime() / 1000);
+  };
+  const { ctx, calls } = recordingCtx(
+    { ...GITEA, githubView: 'contributions' },
+    {
+      status: 200,
+      data: [
+        { timestamp: at(0, 9), contributions: 2 },
+        { timestamp: at(0, 10), contributions: 3 },
+        { timestamp: at(3, 12), contributions: 4 },
+        { timestamp: at(400, 12), contributions: 9 },
+      ],
+    },
+  );
+  const r = await dataFn(ctx);
+  assert.equal(calls[0].url.pathname, '/api/v1/users/me/heatmap');
+  assert.equal(r.view, 'contributions');
+  assert.equal(r.totalContributions, 9);
+  const days = r.weeks.flatMap(w => w.contributionDays);
+  assert.equal(days.at(-1).contributionCount, 5);
+  assert.ok(r.weeks.every(w => new Date(w.contributionDays[0].date + 'T00:00:00Z').getUTCDay() === 0));
+  assert.equal(r.profileUrl, 'https://git.lan/me');
+});
+
+const GITLAB = { githubService: 'gitlab', githubUrl: 'https://gitlab.com', githubUser: 'me', githubToken: 't' };
+
+test('gitlab lists open merge requests by the chosen filters', async () => {
+  const { ctx, calls } = recordingCtx(
+    { ...GITLAB, githubPrFilters: ['assigned', 'mentioned'] },
+    {
+      status: 200,
+      headers: { 'x-total': '12' },
+      data: [
+        {
+          iid: 9,
+          title: 'Bump',
+          references: { full: 'me/app!9' },
+          web_url: 'https://gitlab.com/me/app/-/merge_requests/9',
+        },
+      ],
+    },
+  );
+  const r = await dataFn(ctx);
+  const { url, opts } = calls[0];
+  assert.equal(url.pathname, '/api/v4/merge_requests');
+  assert.equal(url.searchParams.get('state'), 'opened');
+  assert.equal(url.searchParams.get('assignee_username'), 'me');
+  assert.equal(url.searchParams.has('author_username'), false);
+  assert.equal(opts.headers['PRIVATE-TOKEN'], 't');
+  assert.deepEqual(r.filters, ['assigned']);
+  assert.equal(r.totalCount, 12);
+  assert.deepEqual(r.items, [
+    { number: 9, title: 'Bump', repo: 'me/app', url: 'https://gitlab.com/me/app/-/merge_requests/9' },
+  ]);
+  assert.equal(r.allUrl, 'https://gitlab.com/dashboard/merge_requests');
+});
+
+test('gitlab with a saved contributions view fails as a setup problem', async () => {
+  const { ctx, calls } = recordingCtx({ ...GITLAB, githubView: 'contributions' }, { status: 200, data: [] });
+  await assert.rejects(dataFn(ctx), e => e.kind === ctx.KIND.INVALID && /contribution/.test(e.message));
+  assert.equal(calls.length, 0);
+});
+
+test('gitlab with only unsupported filters searches by author', async () => {
+  const { ctx, calls } = recordingCtx({ ...GITLAB, githubPrFilters: ['mentioned'] }, { status: 200, data: [] });
+  assert.deepEqual((await dataFn(ctx)).filters, ['created']);
+  assert.equal(calls[0].url.searchParams.get('author_username'), 'me');
+});
+
+test('an unknown service reads GitHub', async () => {
+  const { ctx, calls } = recordingCtx({ ...PRS, githubService: 'svn' }, { status: 200, data: { items: [] } });
+  await dataFn(ctx);
+  assert.equal(calls[0].url.host, 'api.github.com');
+});
+
+test('github contributions link the profile unless a link URL is set', async () => {
+  const reply = {
+    status: 200,
+    data: { data: { user: { contributionsCollection: { contributionCalendar: { weeks: [] } } } } },
+  };
+  assert.equal((await dataFn(recordingCtx(CONTRIBUTIONS, reply).ctx)).profileUrl, 'https://github.com/octo');
+  const own = { ...CONTRIBUTIONS, githubHref: 'https://me.example' };
+  assert.equal((await dataFn(recordingCtx(own, reply).ctx)).profileUrl, 'https://me.example');
+});
diff --git a/api/test/proxy.test.js b/api/test/proxy.test.js
index 3244fdd3..aa0856c1 100644
--- a/api/test/proxy.test.js
+++ b/api/test/proxy.test.js
@@ -202,6 +202,23 @@ test('getHostIp returns an empty string when no config file exists', () => {
   assert.equal(getHostIp(), '');
 });
 
+test('fetchJSON returns response headers only when asked', async () => {
+  const server = http.createServer((req, res) => {
+    res.writeHead(200, { 'Content-Type': 'application/json', 'X-Total-Count': '7', 'Set-Cookie': 'sid=1' });
+    res.end('[]');
+  });
+  await new Promise(r => server.listen(0, '127.0.0.1', r));
+  const port = server.address().port;
+  try {
+    const plain = await fetchJSON(`http://127.0.0.1:${port}/`, { timeout: 3000 });
+    assert.deepEqual(Object.keys(plain).sort(), ['data', 'status']);
+    const withHeaders = await fetchJSON(`http://127.0.0.1:${port}/`, { withHeaders: true, timeout: 3000 });
+    assert.equal(withHeaders.headers['x-total-count'], '7');
+  } finally {
+    server.close();
+  }
+});
+
 test('fetchJSON returns the untouched body with opts.raw, and auto-parses without it', async () => {
   const metrics = '# TYPE conduit_connected_clients gauge\nconduit_connected_clients 5\n';
   const server = http.createServer((req, res) => {
diff --git a/api/test/secret-scope.test.js b/api/test/secret-scope.test.js
index 5fa73847..3c655dca 100644
--- a/api/test/secret-scope.test.js
+++ b/api/test/secret-scope.test.js
@@ -229,6 +229,14 @@ test('changing the github view, user or filters keeps the stored token in scope'
   }
 });
 
+test('changing the git service or server URL takes the stored token out of scope', () => {
+  const github = getRegistry().github;
+  const saved = { githubService: 'gitea', githubUrl: 'https://git.a', githubUser: 'me', githubToken: 'STORED' };
+  for (const over of [{ githubService: 'forgejo' }, { githubUrl: 'https://git.b' }]) {
+    assert.equal(widgetConfigMatchesSaved({ ...saved, ...over }, saved, github), false, JSON.stringify(over));
+  }
+});
+
 test('a field that reaches the request still takes the stored credential out of scope', () => {
   const r = getRegistry();
   const cases = [
diff --git a/ui/test/widget-toolbox-link.test.mjs b/ui/test/widget-toolbox-link.test.mjs
index 01f06788..a32e824f 100644
--- a/ui/test/widget-toolbox-link.test.mjs
+++ b/ui/test/widget-toolbox-link.test.mjs
@@ -125,10 +125,9 @@ test('the DNS link is described by its summary', () => {
 });
 
 test('the pull request header link is named by its visible label first', () => {
-  assert.match(
-    widget('github/pullrequests.html'),
-    /'aria-label',\s*`\$\{wt\('ui\.pullRequests', 'Pull requests'\)\}, /,
-  );
+  const src = widget('github/pullrequests.html');
+  assert.match(src, /lbl\.textContent = noun;/);
+  assert.match(src, /'aria-label',\s*`\$\{noun\}, /);
 });
 
 test('a pull request row without a number is named without one', () => {
diff --git a/ui/widgets/github/contributions.html b/ui/widgets/github/contributions.html
index c9953fce..0fc54d90 100644
--- a/ui/widgets/github/contributions.html
+++ b/ui/widgets/github/contributions.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>GitHub Contributions</title>
+<title>Git Contributions</title>
 <script src="/js/widget-theme.js?v=645f280f"></script>
 <style>
   *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
@@ -85,7 +85,6 @@
 
 const TICK_MS = 300000;
 const params = new URLSearchParams(location.search);
-const id = params.get('id') || '';
 const LANG = params.get('lang') || 'en';
 const MOBILE = params.get('mobile') === '1';
 const size = ['small', 'medium', 'large'].includes(params.get('size')) ? params.get('size') : 'small';
@@ -221,11 +220,12 @@
   const weeks = Array.isArray(data.weeks) ? data.weeks : [];
   const total = formatNumber(Math.max(0, Number(data.totalContributions) || 0));
   endHover();
+  linkTo(linkEl, data.profileUrl);
   if (GRID.cols) drawGrid(weeks);
   num.textContent = total;
   fitText(num);
   sub.textContent = wt('ui.lastYear', 'Past 12 months');
-  name(wt('ui.contributionsAria', 'GitHub contributions: {total} in the past 12 months').replace('{total}', total));
+  name(wt('ui.contributionsAria', 'Contributions: {total} in the past 12 months').replace('{total}', total));
   if (!arrived) {
     arrived = true;
     w.classList.add('arrive');
@@ -235,18 +235,9 @@
 
 const state = errorState({ root: document.body, caption: cap, content: () => [w] });
 
-async function boot() {
-  let href = '';
-  try {
-    const r = await fetch(`/api/widget-config/${encodeURIComponent(id)}`);
-    if (r.ok) {
-      const wc = (await r.json())?.widgetConfig || {};
-      href = wc.githubHref || (wc.githubUser ? `https://github.com/${encodeURIComponent(wc.githubUser)}` : '');
-    }
-  } catch {}
+function boot() {
   linkEl = MOBILE ? w : head;
-  const linked = linkTo(linkEl, href);
-  linkEl.setAttribute('role', linked ? 'link' : 'img');
+  linkEl.setAttribute('role', 'img');
   if (MOBILE) head.setAttribute('aria-hidden', 'true');
   name(wt('view.contributions.label', 'Contributions'));
   if (GRID.cols) drawGrid([]);
diff --git a/ui/widgets/github/data.js b/ui/widgets/github/data.js
index 2283a45f..50b0011c 100644
--- a/ui/widgets/github/data.js
+++ b/ui/widgets/github/data.js
@@ -1,18 +1,56 @@
+const SERVICE_NAME = { github: 'GitHub', gitea: 'Gitea', forgejo: 'Forgejo', gitlab: 'GitLab' };
+
 module.exports = async function (ctx) {
-  const { config, fetchJSON } = ctx;
+  const { config } = ctx;
+  const service = Object.hasOwn(SERVICE_NAME, config.githubService) ? config.githubService : 'github';
+  const name = SERVICE_NAME[service];
   const token = config.githubToken;
-  if (!token) ctx.fail('GitHub token not configured', { kind: ctx.KIND.INVALID });
+  if (!token) ctx.fail(`${name} token not configured`, { kind: ctx.KIND.INVALID });
 
   const username = config.githubUser;
-  if (!username) ctx.fail('GitHub username not configured', { kind: ctx.KIND.INVALID });
+  if (!username) ctx.fail(`${name} username not configured`, { kind: ctx.KIND.INVALID });
 
-  if (config.githubView === 'contributions') return contributions(ctx, token, username, fetchJSON);
-  return pullRequests(ctx, token, username, config, fetchJSON);
+  if (service === 'github') {
+    if (config.githubView === 'contributions') return contributions(ctx, token, username);
+    return pullRequests(ctx, token, username, config);
+  }
+  const base = ctx.normalizeBase(config.githubUrl);
+  if (!base) ctx.fail(`${name} URL not configured`, { kind: ctx.KIND.INVALID });
+  if (service === 'gitlab') {
+    if (config.githubView === 'contributions')
+      ctx.fail('GitLab offers no contribution calendar. Save the widget again to show merge requests.', {
+        kind: ctx.KIND.INVALID,
+      });
+    return gitlabMergeRequests(ctx, base, token, username, config);
+  }
+  if (config.githubView === 'contributions') return giteaContributions(ctx, base, token, username, name);
+  return giteaPullRequests(ctx, base, token, config, name);
 };
 
+function prFilters(config) {
+  const raw =
+    Array.isArray(config.githubPrFilters) && config.githubPrFilters.length
+      ? config.githubPrFilters
+      : [config.githubPrFilter || 'created'];
+  return Array.isArray(raw) ? raw : [raw];
+}
+
+function replyStatus(ctx, r, name) {
+  if (r.status === 401) ctx.fail(`Invalid ${name} token`, { kind: ctx.KIND.AUTH });
+  if (r.status === 403) ctx.fail(`${name} refused the token, check its scopes`, { kind: ctx.KIND.AUTH });
+  if (r.status === 404)
+    ctx.fail(`${name} has no such user or API, check the URL and username`, { kind: ctx.KIND.INVALID });
+  if (r.status >= 400) ctx.fail(`${name} HTTP ${r.status}`);
+}
+
+function headerCount(r, header, fallback) {
+  const n = Number(r.headers?.[header]);
+  return Number.isInteger(n) && n >= 0 ? n : fallback;
+}
+
 /* Needs a classic PAT with read:user, or a fine-grained PAT with "User
    contributions" read access. */
-async function contributions(ctx, token, username, fetchJSON) {
+async function contributions(ctx, token, username) {
   const query = `query($login: String!) {
     user(login: $login) {
       contributionsCollection {
@@ -23,7 +61,7 @@ async function contributions(ctx, token, username, fetchJSON) {
       }
     }
   }`;
-  const r = await fetchJSON('https://api.github.com/graphql', {
+  const r = await ctx.fetchJSON('https://api.github.com/graphql', {
     method: 'POST',
     headers: {
       Authorization: `Bearer ${token}`,
@@ -40,16 +78,16 @@ async function contributions(ctx, token, username, fetchJSON) {
 
   const cal = r.data?.data?.user?.contributionsCollection?.contributionCalendar;
   if (!cal || !Array.isArray(cal.weeks)) ctx.fail('GitHub returned no contribution calendar');
-  return { view: 'contributions', weeks: cal.weeks, totalContributions: cal.totalContributions || 0 };
+  return {
+    view: 'contributions',
+    weeks: cal.weeks,
+    totalContributions: cal.totalContributions || 0,
+    profileUrl: ctx.config.githubHref || `https://github.com/${encodeURIComponent(username)}`,
+  };
 }
 
-async function pullRequests(ctx, token, username, config, fetchJSON) {
-  const raw =
-    Array.isArray(config.githubPrFilters) && config.githubPrFilters.length
-      ? config.githubPrFilters
-      : [config.githubPrFilter || 'created'];
-  const filterArr = Array.isArray(raw) ? raw : [raw];
-
+async function pullRequests(ctx, token, username, config) {
+  const filterArr = prFilters(config);
   const qualifiers = filterArr.map(f => {
     if (f === 'assigned') return `assignee:${username}`;
     if (f === 'mentioned') return `mentions:${username}`;
@@ -60,7 +98,7 @@ async function pullRequests(ctx, token, username, config, fetchJSON) {
   const q = encodeURIComponent(`is:open is:pr ${qualifier}`);
   const url = `https://api.github.com/search/issues?q=${q}&advanced_search=true&sort=updated&order=desc&per_page=20`;
 
-  const r = await fetchJSON(url, {
+  const r = await ctx.fetchJSON(url, {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: 'application/vnd.github+json',
@@ -86,3 +124,124 @@ async function pullRequests(ctx, token, username, config, fetchJSON) {
      that already holds the translation. */
   return { view: 'prs', totalCount: r.data?.total_count ?? items.length, filters: filterArr, allUrl, items };
 }
+
+const GITEA_FILTER = {
+  created: 'created',
+  assigned: 'assigned',
+  mentioned: 'mentioned',
+  'review-requested': 'review_requested',
+};
+
+async function giteaPullRequests(ctx, base, token, config, name) {
+  const filterArr = prFilters(config).filter(f => Object.hasOwn(GITEA_FILTER, f));
+  if (!filterArr.length) filterArr.push('created');
+  const q = new URLSearchParams({ type: 'pulls', state: 'open', limit: '20' });
+  for (const f of filterArr) q.set(GITEA_FILTER[f], 'true');
+  const r = await ctx.fetchJSON(`${base}/api/v1/repos/issues/search?${q}`, {
+    headers: { Authorization: `token ${token}`, Accept: 'application/json' },
+    withHeaders: true,
+    timeout: 10000,
+  });
+  replyStatus(ctx, r, name);
+  if (!Array.isArray(r.data)) ctx.fail(`${name} returned no search results`);
+
+  const items = r.data.map(pr => ({
+    number: pr?.number,
+    title: pr?.title,
+    repo: pr?.repository?.full_name || '—',
+    url: pr?.html_url,
+  }));
+  return {
+    view: 'prs',
+    totalCount: headerCount(r, 'x-total-count', items.length),
+    filters: filterArr,
+    allUrl: ctx.serviceLink(config.githubHref, config.githubUrl, '/pulls'),
+    items,
+  };
+}
+
+function isoDay(d) {
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+}
+
+function giteaCalendar(slots, now = new Date()) {
+  const perDay = new Map();
+  for (const s of slots) {
+    const t = Number(s?.timestamp);
+    const c = Number(s?.contributions);
+    if (!Number.isFinite(t) || !Number.isFinite(c) || c <= 0) continue;
+    const day = isoDay(new Date(t * 1000));
+    perDay.set(day, (perDay.get(day) || 0) + c);
+  }
+  const today = new Date(now);
+  today.setHours(0, 0, 0, 0);
+  const day = new Date(today);
+  day.setDate(day.getDate() - 52 * 7 - today.getDay());
+  const weeks = [];
+  let total = 0;
+  while (day <= today) {
+    if (day.getDay() === 0) weeks.push({ contributionDays: [] });
+    const date = isoDay(day);
+    const count = perDay.get(date) || 0;
+    total += count;
+    weeks[weeks.length - 1].contributionDays.push({ contributionCount: count, date });
+    day.setDate(day.getDate() + 1);
+  }
+  return { weeks, totalContributions: total };
+}
+
+async function giteaContributions(ctx, base, token, username, name) {
+  const r = await ctx.fetchJSON(`${base}/api/v1/users/${encodeURIComponent(username)}/heatmap`, {
+    headers: { Authorization: `token ${token}`, Accept: 'application/json' },
+    timeout: 10000,
+  });
+  replyStatus(ctx, r, name);
+  if (!Array.isArray(r.data)) ctx.fail(`${name} returned no contribution heatmap`);
+  return {
+    view: 'contributions',
+    ...giteaCalendar(r.data),
+    profileUrl: ctx.serviceLink(ctx.config.githubHref, ctx.config.githubUrl, '/' + encodeURIComponent(username)),
+  };
+}
+
+const GITLAB_FILTER = {
+  created: 'author_username',
+  assigned: 'assignee_username',
+  'review-requested': 'reviewer_username',
+};
+
+async function gitlabMergeRequests(ctx, base, token, username, config) {
+  const filterArr = prFilters(config).filter(f => Object.hasOwn(GITLAB_FILTER, f));
+  if (!filterArr.length) filterArr.push('created');
+  const q = new URLSearchParams({
+    state: 'opened',
+    scope: 'all',
+    order_by: 'updated_at',
+    sort: 'desc',
+    per_page: '20',
+  });
+  for (const f of filterArr) q.set(GITLAB_FILTER[f], username);
+  const r = await ctx.fetchJSON(`${base}/api/v4/merge_requests?${q}`, {
+    headers: { 'PRIVATE-TOKEN': token, Accept: 'application/json' },
+    withHeaders: true,
+    timeout: 10000,
+  });
+  replyStatus(ctx, r, 'GitLab');
+  if (!Array.isArray(r.data)) ctx.fail('GitLab returned no merge requests');
+
+  const items = r.data.map(mr => ({
+    number: mr?.iid,
+    title: mr?.title,
+    repo: String(mr?.references?.full || '').replace(/!\d+$/, '') || '—',
+    url: mr?.web_url,
+  }));
+  return {
+    view: 'prs',
+    totalCount: headerCount(r, 'x-total', items.length),
+    filters: filterArr,
+    allUrl: ctx.serviceLink(config.githubHref, config.githubUrl, '/dashboard/merge_requests'),
+    items,
+  };
+}
+
+module.exports._internals = { giteaCalendar };
diff --git a/ui/widgets/github/i18n/de.json b/ui/widgets/github/i18n/de.json
index 954b9936..5912a048 100644
--- a/ui/widgets/github/i18n/de.json
+++ b/ui/widgets/github/i18n/de.json
@@ -1,27 +1,39 @@
 {
-  "widget.label": "GitHub",
+  "widget.label": "Git",
   "widget.description": "Zeigt deine offenen Pull Requests oder dein Beitragsdiagramm.",
   "view.prs.label": "Pull Requests",
   "view.contributions.label": "Beiträge",
+  "githubService.label": "Dienst",
+  "githubService.opt.github": "GitHub",
+  "githubService.opt.gitea": "Gitea",
+  "githubService.opt.forgejo": "Forgejo",
+  "githubService.opt.gitlab": "GitLab",
+  "githubUrl.label": "Server-URL",
+  "githubUrl.placeholder": "https://git.example.com",
   "githubView.label": "Ansicht",
   "githubView.opt.prs": "Pull Requests",
   "githubView.opt.contributions": "Beiträge",
-  "githubUser.label": "GitHub-Benutzername",
+  "githubUser.label": "Benutzername",
   "githubUser.placeholder": "octocat",
   "githubToken.label": "Persönliches Zugriffstoken",
   "githubToken.hint": "Klassischer PAT mit den Berechtigungen repo und read:user (oder ein feingranularer PAT mit gleichwertigem Lesezugriff). Wird nur von diesem Widget verwendet.",
+  "githubToken.hint.gitea": "Zugriffstoken mit den Berechtigungen read:user und read:issue. Wird nur von diesem Widget verwendet.",
+  "githubToken.hint.gitlab": "Persönliches Zugriffstoken mit der Berechtigung read_api. Wird nur von diesem Widget verwendet.",
   "githubHref.label": "Link-URL",
-  "githubHref.hint": "Wohin ein Klick auf das Widget führt. Leer lassen, um das GitHub-Profil zu öffnen.",
+  "githubHref.hint": "Wohin ein Klick auf das Widget führt. Leer lassen, um dein Profil zu öffnen.",
   "githubPrFilters.label": "Pull-Request-Filter",
   "githubPrFilters.hint": "Welche offenen Pull Requests angezeigt werden. Mehrere Filter werden kombiniert.",
+  "githubPrFilters.label.gitlab": "Merge-Request-Filter",
+  "githubPrFilters.hint.gitlab": "Welche offenen Merge Requests angezeigt werden. Mehrere Filter werden kombiniert.",
   "githubPrFilters.opt.created": "Erstellt",
   "githubPrFilters.opt.assigned": "Zugewiesen",
   "githubPrFilters.opt.mentioned": "Erwähnt",
   "githubPrFilters.opt.review-requested": "Review angefragt",
-  "ui.prAria": "GitHub-Pull-Requests",
   "ui.pullRequests": "Pull Requests",
   "ui.lastYear": "Letzte 12 Monate",
   "ui.noPrs": "Keine offenen Pull Requests",
-  "ui.contributionsAria": "GitHub-Beiträge: {total} in den letzten 12 Monaten",
-  "ui.viewAll": "alle anzeigen"
+  "ui.contributionsAria": "Beiträge: {total} in den letzten 12 Monaten",
+  "ui.viewAll": "alle anzeigen",
+  "ui.mergeRequests": "Merge Requests",
+  "ui.noMrs": "Keine offenen Merge Requests"
 }
diff --git a/ui/widgets/github/i18n/en.json b/ui/widgets/github/i18n/en.json
index 81761945..751a0090 100644
--- a/ui/widgets/github/i18n/en.json
+++ b/ui/widgets/github/i18n/en.json
@@ -1,27 +1,39 @@
 {
-  "widget.label": "GitHub",
+  "widget.label": "Git",
   "widget.description": "Follow your open pull requests or your contribution graph.",
   "view.prs.label": "Pull Requests",
   "view.contributions.label": "Contributions",
+  "githubService.label": "Service",
+  "githubService.opt.github": "GitHub",
+  "githubService.opt.gitea": "Gitea",
+  "githubService.opt.forgejo": "Forgejo",
+  "githubService.opt.gitlab": "GitLab",
+  "githubUrl.label": "Server URL",
+  "githubUrl.placeholder": "https://git.example.com",
   "githubView.label": "View",
   "githubView.opt.prs": "Pull Requests",
   "githubView.opt.contributions": "Contributions",
-  "githubUser.label": "GitHub Username",
+  "githubUser.label": "Username",
   "githubUser.placeholder": "octocat",
   "githubToken.label": "Personal Access Token",
   "githubToken.hint": "Classic PAT with repo + read:user scope (or a fine-grained PAT with the equivalent read access). Used only by this widget.",
+  "githubToken.hint.gitea": "Access token with the read:user and read:issue scopes. Used only by this widget.",
+  "githubToken.hint.gitlab": "Personal access token with the read_api scope. Used only by this widget.",
   "githubHref.label": "Link URL",
-  "githubHref.hint": "Where clicking the widget opens. Leave blank to open the GitHub profile.",
+  "githubHref.hint": "Where clicking the widget opens. Leave blank to open your profile.",
   "githubPrFilters.label": "Pull request filters",
   "githubPrFilters.hint": "Which open PRs to show. Multiple filters are combined.",
+  "githubPrFilters.label.gitlab": "Merge request filters",
+  "githubPrFilters.hint.gitlab": "Which open merge requests to show. Multiple filters are combined.",
   "githubPrFilters.opt.created": "Created",
   "githubPrFilters.opt.assigned": "Assigned",
   "githubPrFilters.opt.mentioned": "Mentioned",
   "githubPrFilters.opt.review-requested": "Review requested",
-  "ui.prAria": "GitHub pull requests",
   "ui.pullRequests": "Pull requests",
   "ui.lastYear": "Past 12 months",
   "ui.noPrs": "No open pull requests",
-  "ui.contributionsAria": "GitHub contributions: {total} in the past 12 months",
-  "ui.viewAll": "view all"
+  "ui.contributionsAria": "Contributions: {total} in the past 12 months",
+  "ui.viewAll": "view all",
+  "ui.mergeRequests": "Merge requests",
+  "ui.noMrs": "No open merge requests"
 }
diff --git a/ui/widgets/github/i18n/es.json b/ui/widgets/github/i18n/es.json
index 606f8890..9a206175 100644
--- a/ui/widgets/github/i18n/es.json
+++ b/ui/widgets/github/i18n/es.json
@@ -1,27 +1,39 @@
 {
-  "widget.label": "GitHub",
+  "widget.label": "Git",
   "widget.description": "Sigue tus pull requests abiertas o tu gráfico de contribuciones.",
   "view.prs.label": "Pull requests",
   "view.contributions.label": "Contribuciones",
+  "githubService.label": "Servicio",
+  "githubService.opt.github": "GitHub",
+  "githubService.opt.gitea": "Gitea",
+  "githubService.opt.forgejo": "Forgejo",
+  "githubService.opt.gitlab": "GitLab",
+  "githubUrl.label": "URL del servidor",
+  "githubUrl.placeholder": "https://git.example.com",
   "githubView.label": "Vista",
   "githubView.opt.prs": "Pull requests",
   "githubView.opt.contributions": "Contribuciones",
-  "githubUser.label": "Usuario de GitHub",
+  "githubUser.label": "Usuario",
   "githubUser.placeholder": "octocat",
   "githubToken.label": "Token de acceso personal",
   "githubToken.hint": "PAT clásico con permisos repo y read:user (o un PAT granular con el acceso de lectura equivalente). Solo lo usa este widget.",
+  "githubToken.hint.gitea": "Token de acceso con permisos read:user y read:issue. Solo lo usa este widget.",
+  "githubToken.hint.gitlab": "Token de acceso personal con el permiso read_api. Solo lo usa este widget.",
   "githubHref.label": "URL del enlace",
-  "githubHref.hint": "Adónde lleva al hacer clic en el widget. Déjalo en blanco para abrir el perfil de GitHub.",
+  "githubHref.hint": "Adónde lleva al hacer clic en el widget. Déjalo en blanco para abrir tu perfil.",
   "githubPrFilters.label": "Filtros de pull requests",
   "githubPrFilters.hint": "Qué pull requests abiertas mostrar. Los filtros se combinan entre sí.",
+  "githubPrFilters.label.gitlab": "Filtros de solicitudes de fusión",
+  "githubPrFilters.hint.gitlab": "Qué solicitudes de fusión abiertas mostrar. Los filtros se combinan entre sí.",
   "githubPrFilters.opt.created": "Creadas",
   "githubPrFilters.opt.assigned": "Asignadas",
   "githubPrFilters.opt.mentioned": "Mencionadas",
   "githubPrFilters.opt.review-requested": "Revisión solicitada",
-  "ui.prAria": "Pull requests de GitHub",
   "ui.pullRequests": "Pull requests",
   "ui.lastYear": "Último año",
   "ui.noPrs": "No hay pull requests abiertas",
-  "ui.contributionsAria": "Contribuciones de GitHub: {total} en el último año",
-  "ui.viewAll": "ver todo"
+  "ui.contributionsAria": "Contribuciones: {total} en el último año",
+  "ui.viewAll": "ver todo",
+  "ui.mergeRequests": "Solicitudes de fusión",
+  "ui.noMrs": "No hay solicitudes de fusión abiertas"
 }
diff --git a/ui/widgets/github/i18n/fa.json b/ui/widgets/github/i18n/fa.json
index aa463939..b662ab8b 100644
--- a/ui/widgets/github/i18n/fa.json
+++ b/ui/widgets/github/i18n/fa.json
@@ -1,27 +1,39 @@
 {
-  "widget.label": "GitHub",
+  "widget.label": "Git",
   "widget.description": "درخواست‌های ادغام باز یا نمودار مشارکتتان را دنبال کنید.",
   "view.prs.label": "درخواست‌های ادغام",
   "view.contributions.label": "مشارکت‌ها",
+  "githubService.label": "سرویس",
+  "githubService.opt.github": "GitHub",
+  "githubService.opt.gitea": "Gitea",
+  "githubService.opt.forgejo": "Forgejo",
+  "githubService.opt.gitlab": "GitLab",
+  "githubUrl.label": "آدرس سرور",
+  "githubUrl.placeholder": "https://git.example.com",
   "githubView.label": "نما",
   "githubView.opt.prs": "درخواست‌های ادغام",
   "githubView.opt.contributions": "مشارکت‌ها",
-  "githubUser.label": "نام کاربری GitHub",
+  "githubUser.label": "نام کاربری",
   "githubUser.placeholder": "octocat",
   "githubToken.label": "توکن دسترسی شخصی",
   "githubToken.hint": "توکن کلاسیک با دسترسی repo و read:user (یا توکن fine-grained با همان دسترسی خواندن). فقط همین ویجت از آن استفاده می‌کند.",
+  "githubToken.hint.gitea": "توکن دسترسی با دسترسی read:user و read:issue. فقط همین ویجت از آن استفاده می‌کند.",
+  "githubToken.hint.gitlab": "توکن دسترسی شخصی با دسترسی read_api. فقط همین ویجت از آن استفاده می‌کند.",
   "githubHref.label": "آدرس پیوند",
-  "githubHref.hint": "جایی که با کلیک روی ویجت باز می‌شود. برای بازشدن پروفایل GitHub خالی بگذارید.",
+  "githubHref.hint": "جایی که با کلیک روی ویجت باز می‌شود. برای بازشدن پروفایلتان خالی بگذارید.",
   "githubPrFilters.label": "فیلترهای درخواست ادغام",
   "githubPrFilters.hint": "کدام درخواست‌های ادغام باز نمایش داده شوند. چند فیلتر با هم ترکیب می‌شوند.",
+  "githubPrFilters.label.gitlab": "فیلترهای درخواست ادغام",
+  "githubPrFilters.hint.gitlab": "کدام درخواست‌های ادغام باز نمایش داده شوند. چند فیلتر با هم ترکیب می‌شوند.",
   "githubPrFilters.opt.created": "ساخته‌شده",
   "githubPrFilters.opt.assigned": "واگذارشده",
   "githubPrFilters.opt.mentioned": "منشن‌شده",
   "githubPrFilters.opt.review-requested": "درخواست بازبینی",
-  "ui.prAria": "درخواست‌های ادغام GitHub",
   "ui.pullRequests": "درخواست‌های ادغام",
   "ui.lastYear": "یک سال اخیر",
   "ui.noPrs": "درخواست ادغام بازی نیست",
-  "ui.contributionsAria": "مشارکت‌های GitHub: {total} در یک سال اخیر",
-  "ui.viewAll": "مشاهده همه"
+  "ui.contributionsAria": "مشارکت‌ها: {total} در یک سال اخیر",
+  "ui.viewAll": "مشاهده همه",
+  "ui.mergeRequests": "درخواست‌های ادغام",
+  "ui.noMrs": "درخواست ادغام بازی نیست"
 }
diff --git a/ui/widgets/github/i18n/fr.json b/ui/widgets/github/i18n/fr.json
index f06a0262..a1a8dd89 100644
--- a/ui/widgets/github/i18n/fr.json
+++ b/ui/widgets/github/i18n/fr.json
@@ -1,27 +1,39 @@
 {
-  "widget.label": "GitHub",
+  "widget.label": "Git",
   "widget.description": "Suivez vos pull requests ouvertes ou votre graphique de contributions.",
   "view.prs.label": "Pull requests",
   "view.contributions.label": "Contributions",
+  "githubService.label": "Service",
+  "githubService.opt.github": "GitHub",
+  "githubService.opt.gitea": "Gitea",
+  "githubService.opt.forgejo": "Forgejo",
+  "githubService.opt.gitlab": "GitLab",
+  "githubUrl.label": "URL du serveur",
+  "githubUrl.placeholder": "https://git.example.com",
   "githubView.label": "Vue",
   "githubView.opt.prs": "Pull requests",
   "githubView.opt.contributions": "Contributions",
-  "githubUser.label": "Nom d’utilisateur GitHub",
+  "githubUser.label": "Nom d’utilisateur",
   "githubUser.placeholder": "octocat",
   "githubToken.label": "Jeton d’accès personnel",
   "githubToken.hint": "PAT classique avec les portées repo et read:user (ou un PAT granulaire avec l’accès en lecture équivalent). Utilisé uniquement par ce widget.",
+  "githubToken.hint.gitea": "Jeton d’accès avec les portées read:user et read:issue. Utilisé uniquement par ce widget.",
+  "githubToken.hint.gitlab": "Jeton d’accès personnel avec la portée read_api. Utilisé uniquement par ce widget.",
   "githubHref.label": "URL du lien",
-  "githubHref.hint": "Où mène un clic sur le widget. Laissez vide pour ouvrir le profil GitHub.",
+  "githubHref.hint": "Où mène un clic sur le widget. Laissez vide pour ouvrir votre profil.",
   "githubPrFilters.label": "Filtres de pull requests",
   "githubPrFilters.hint": "Quelles pull requests ouvertes afficher. Plusieurs filtres se combinent.",
+  "githubPrFilters.label.gitlab": "Filtres de requêtes de fusion",
+  "githubPrFilters.hint.gitlab": "Quelles requêtes de fusion ouvertes afficher. Plusieurs filtres se combinent.",
   "githubPrFilters.opt.created": "Créées",
   "githubPrFilters.opt.assigned": "Assignées",
   "githubPrFilters.opt.mentioned": "Mentionnées",
   "githubPrFilters.opt.review-requested": "Revue demandée",
-  "ui.prAria": "Pull requests GitHub",
   "ui.pullRequests": "Pull requests",
   "ui.lastYear": "12 derniers mois",
   "ui.noPrs": "Aucune pull request ouverte",
-  "ui.contributionsAria": "Contributions GitHub : {total} au cours des 12 derniers mois",
-  "ui.viewAll": "tout afficher"
+  "ui.contributionsAria": "Contributions : {total} au cours des 12 derniers mois",
+  "ui.viewAll": "tout afficher",
+  "ui.mergeRequests": "Requêtes de fusion",
+  "ui.noMrs": "Aucune requête de fusion ouverte"
 }
diff --git a/ui/widgets/github/i18n/zh-Hans.json b/ui/widgets/github/i18n/zh-Hans.json
index beb54490..f31ac717 100644
--- a/ui/widgets/github/i18n/zh-Hans.json
+++ b/ui/widgets/github/i18n/zh-Hans.json
@@ -1,27 +1,39 @@
 {
-  "widget.label": "GitHub",
+  "widget.label": "Git",
   "widget.description": "关注待处理的拉取请求或贡献图。",
   "view.prs.label": "拉取请求",
   "view.contributions.label": "贡献",
+  "githubService.label": "服务",
+  "githubService.opt.github": "GitHub",
+  "githubService.opt.gitea": "Gitea",
+  "githubService.opt.forgejo": "Forgejo",
+  "githubService.opt.gitlab": "GitLab",
+  "githubUrl.label": "服务器地址",
+  "githubUrl.placeholder": "https://git.example.com",
   "githubView.label": "视图",
   "githubView.opt.prs": "拉取请求",
   "githubView.opt.contributions": "贡献",
-  "githubUser.label": "GitHub 用户名",
+  "githubUser.label": "用户名",
   "githubUser.placeholder": "octocat",
   "githubToken.label": "个人访问令牌",
   "githubToken.hint": "具有 repo 和 read:user 权限的经典 PAT（或具有同等读取权限的细粒度 PAT）。仅此小组件使用。",
+  "githubToken.hint.gitea": "具有 read:user 和 read:issue 权限的访问令牌。仅此小组件使用。",
+  "githubToken.hint.gitlab": "具有 read_api 权限的个人访问令牌。仅此小组件使用。",
   "githubHref.label": "链接地址",
-  "githubHref.hint": "点击此小组件后打开的地址。留空则打开 GitHub 个人主页。",
+  "githubHref.hint": "点击此小组件后打开的地址。留空则打开你的个人主页。",
   "githubPrFilters.label": "拉取请求筛选",
   "githubPrFilters.hint": "显示哪些未关闭的拉取请求。多个筛选条件会合并。",
+  "githubPrFilters.label.gitlab": "合并请求筛选",
+  "githubPrFilters.hint.gitlab": "显示哪些未关闭的合并请求。多个筛选条件会合并。",
   "githubPrFilters.opt.created": "我创建的",
   "githubPrFilters.opt.assigned": "指派给我的",
   "githubPrFilters.opt.mentioned": "提到我的",
   "githubPrFilters.opt.review-requested": "请求我评审的",
-  "ui.prAria": "GitHub 拉取请求",
   "ui.pullRequests": "拉取请求",
   "ui.lastYear": "过去 12 个月",
   "ui.noPrs": "没有打开的拉取请求",
-  "ui.contributionsAria": "GitHub 贡献：过去 12 个月 {total} 次",
-  "ui.viewAll": "查看全部"
+  "ui.contributionsAria": "贡献：过去 12 个月 {total} 次",
+  "ui.viewAll": "查看全部",
+  "ui.mergeRequests": "合并请求",
+  "ui.noMrs": "没有打开的合并请求"
 }
diff --git a/ui/widgets/github/pullrequests.html b/ui/widgets/github/pullrequests.html
index 4577556d..fb66eb1a 100644
--- a/ui/widgets/github/pullrequests.html
+++ b/ui/widgets/github/pullrequests.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>GitHub Pull Requests</title>
+<title>Git Pull Requests</title>
 <script src="/js/widget-theme.js?v=645f280f"></script>
 <style>
   *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
@@ -53,7 +53,7 @@
 </style>
 </head>
 <body>
-<div class="widget" id="widget" role="group" aria-label="GitHub pull requests"></div>
+<div class="widget" id="widget" role="group" aria-label="Pull requests"></div>
 <div class="cap" id="cap"></div>
 <script type="module">
 import { poll, fetchData, linkTo, loadStrings, wt, errorState, formatNumber, fitText, placeholder, formatList } from '/js/widget-toolbox.js?v=ce372f4d';
@@ -68,8 +68,9 @@
 const FILTER_FALLBACK = { created: 'Created', assigned: 'Assigned', mentioned: 'Mentioned', 'review-requested': 'Review requested' };
 
 const w = document.getElementById('widget');
-w.setAttribute('aria-label', wt('ui.prAria', 'GitHub pull requests'));
 let user = '';
+let gitlab = false;
+let noun = wt('ui.pullRequests', 'Pull requests');
 let arrived = false;
 
 function el(tag, cls, text) {
@@ -92,7 +93,8 @@
 const num = el('div', 'num');
 const sub = el('div', 'sub');
 fig.append(num, sub);
-head.append(el('div', 'lbl', wt('ui.pullRequests', 'Pull requests')), fig);
+const lbl = el('div', 'lbl', noun);
+head.append(lbl, fig);
 const list = el('div', 'list');
 w.className = 'widget size-' + size;
 w.append(head);
@@ -123,7 +125,7 @@
   if (linkTo(target, data.allUrl))
     target.setAttribute(
       'aria-label',
-      `${wt('ui.pullRequests', 'Pull requests')}, ${total} ${label}, ${wt('ui.viewAll', 'view all')}`,
+      `${noun}, ${total} ${label}, ${wt('ui.viewAll', 'view all')}`,
     );
   if (!arrived) {
     arrived = true;
@@ -136,7 +138,7 @@
   list.replaceChildren();
   if (!items.length) {
     list.removeAttribute('role');
-    list.append(el('div', 'none', wt('ui.noPrs', 'No open pull requests')));
+    list.append(el('div', 'none', gitlab ? wt('ui.noMrs', 'No open merge requests') : wt('ui.noPrs', 'No open pull requests')));
     return;
   }
   list.setAttribute('role', 'list');
@@ -160,8 +162,12 @@
     if (r.ok) {
       const wc = (await r.json())?.widgetConfig || {};
       user = String(wc.githubUser || '');
+      gitlab = wc.githubService === 'gitlab';
     }
   } catch {}
+  if (gitlab) noun = wt('ui.mergeRequests', 'Merge requests');
+  lbl.textContent = noun;
+  w.setAttribute('aria-label', noun);
   poll({
     fetch: () => fetchData('data'),
     interval: TICK_MS,
diff --git a/ui/widgets/github/widget.json b/ui/widgets/github/widget.json
index f87592a4..5934e35c 100644
--- a/ui/widgets/github/widget.json
+++ b/ui/widgets/github/widget.json
@@ -22,6 +22,44 @@
     }
   },
   "fields": [
+    {
+      "key": "githubService",
+      "type": "select",
+      "label": "githubService.label",
+      "default": "github",
+      "options": [
+        {
+          "value": "github",
+          "label": "githubService.opt.github"
+        },
+        {
+          "value": "gitea",
+          "label": "githubService.opt.gitea"
+        },
+        {
+          "value": "forgejo",
+          "label": "githubService.opt.forgejo"
+        },
+        {
+          "value": "gitlab",
+          "label": "githubService.opt.gitlab"
+        }
+      ]
+    },
+    {
+      "key": "githubUrl",
+      "type": "text",
+      "label": "githubUrl.label",
+      "placeholder": "githubUrl.placeholder",
+      "showIf": {
+        "field": "githubService",
+        "in": [
+          "gitea",
+          "forgejo",
+          "gitlab"
+        ]
+      }
+    },
     {
       "key": "githubView",
       "type": "select",
@@ -37,7 +75,15 @@
           "label": "githubView.opt.contributions"
         }
       ],
-      "cosmetic": true
+      "cosmetic": true,
+      "showIf": {
+        "field": "githubService",
+        "in": [
+          "github",
+          "gitea",
+          "forgejo"
+        ]
+      }
     },
     {
       "key": "githubUser",
@@ -50,7 +96,34 @@
       "key": "githubToken",
       "type": "secret",
       "label": "githubToken.label",
-      "hint": "githubToken.hint"
+      "hint": "githubToken.hint",
+      "showIf": {
+        "field": "githubService",
+        "equals": "github"
+      }
+    },
+    {
+      "key": "githubToken",
+      "type": "secret",
+      "label": "githubToken.label",
+      "hint": "githubToken.hint.gitea",
+      "showIf": {
+        "field": "githubService",
+        "in": [
+          "gitea",
+          "forgejo"
+        ]
+      }
+    },
+    {
+      "key": "githubToken",
+      "type": "secret",
+      "label": "githubToken.label",
+      "hint": "githubToken.hint.gitlab",
+      "showIf": {
+        "field": "githubService",
+        "equals": "gitlab"
+      }
     },
     {
       "key": "githubHref",
@@ -91,6 +164,34 @@
         }
       ],
       "cosmetic": true
+    },
+    {
+      "key": "githubPrFilters",
+      "type": "multiselect",
+      "label": "githubPrFilters.label.gitlab",
+      "default": [
+        "created"
+      ],
+      "showIf": {
+        "field": "githubService",
+        "equals": "gitlab"
+      },
+      "hint": "githubPrFilters.hint.gitlab",
+      "options": [
+        {
+          "value": "created",
+          "label": "githubPrFilters.opt.created"
+        },
+        {
+          "value": "assigned",
+          "label": "githubPrFilters.opt.assigned"
+        },
+        {
+          "value": "review-requested",
+          "label": "githubPrFilters.opt.review-requested"
+        }
+      ],
+      "cosmetic": true
     }
   ]
 }

From 84a167ec6005a7827a597b26b66f467dcea53c6c Mon Sep 17 00:00:00 2001
From: SandObserver <260779319+SandObserver@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:26:54 -0400
Subject: [PATCH 2/2] Keep stored secrets for configs saved before a defaulted
 field

Fill manifest defaults into a saved widget config before the secret scope
check and before the data function reads it. Count Gitea and Forgejo heatmap
days in the browser's time zone. Read a Git server address without a scheme
over https.
---
 api/src/secret-scope.js                |   4 +-
 api/src/widget-data.js                 |   3 +-
 api/src/widget-defaults.js             |  58 ++++++++++++
 api/test/github-data.test.js           |  38 ++++----
 api/test/secret-scope.test.js          |  28 ++++++
 api/test/widget-defaults.test.js       | 117 +++++++++++++++++++++++++
 tsconfig.frontend.json                 |   6 ++
 ui/js/contribution-calendar.js         |  31 +++++++
 ui/test/contribution-calendar.test.mjs |  59 +++++++++++++
 ui/test/widget-toolbox-link.test.mjs   |   2 +-
 ui/widgets/github/contributions.html   |   6 +-
 ui/widgets/github/data.js              |  51 +++--------
 12 files changed, 345 insertions(+), 58 deletions(-)
 create mode 100644 api/src/widget-defaults.js
 create mode 100644 api/test/widget-defaults.test.js
 create mode 100644 ui/js/contribution-calendar.js
 create mode 100644 ui/test/contribution-calendar.test.mjs

diff --git a/api/src/secret-scope.js b/api/src/secret-scope.js
index 804e890a..cb346787 100644
--- a/api/src/secret-scope.js
+++ b/api/src/secret-scope.js
@@ -5,6 +5,7 @@
 
 const { SAVED_ROW, secretSpec, cosmeticSpec, transientSpec } = require('./widget-secrets');
 const { toRows, loginOf } = require('./badge-headers');
+const { withManifestDefaults } = require('./widget-defaults');
 
 function stableEqual(a, b) {
   if (a === b) return true;
@@ -89,7 +90,8 @@ function alignSavedConfig(newConfig, savedConfig, entry) {
 
 function widgetConfigMatchesSaved(newConfig, savedConfig, entry) {
   if (!entry) return false;
-  return stableEqual(stripWidgetSecrets(newConfig, entry), stripWidgetSecrets(savedConfig, entry));
+  const stripped = c => stripWidgetSecrets(withManifestDefaults(c, entry), entry);
+  return stableEqual(stripped(newConfig), stripped(savedConfig));
 }
 
 const blankStored = (obj, old, k) => !!old && old[k] != null && old[k] !== '' && !(obj && obj[k]);
diff --git a/api/src/widget-data.js b/api/src/widget-data.js
index 595b4b62..e3321c3b 100644
--- a/api/src/widget-data.js
+++ b/api/src/widget-data.js
@@ -10,6 +10,7 @@ const { preserveWidgetSecrets } = require('./widget-secrets');
 const { alignSavedConfig, leavesStoredSecretBlank, RETYPE_MESSAGE } = require('./secret-scope');
 const { dispatchProvider } = require('./provider-dispatch');
 const { widgetSettings } = require('./widget-settings');
+const { withManifestDefaults } = require('./widget-defaults');
 const { IS_DEMO } = require('./demo');
 const demoData = require('./demo-data');
 const log = require('./log');
@@ -128,7 +129,7 @@ function widgetParams(searchParams, manifest) {
 const KEPT_PER_WIDGET = 16;
 
 async function getWidgetData(item, entry, endpointName, searchParams, fetch, row = null, isOptions = false) {
-  const wc = item.widgetConfig || {};
+  const wc = withManifestDefaults(item.widgetConfig, entry);
   /* An options fetch must run the real path, or the editor shows fabricated
      options. */
   if (IS_DEMO && !isOptions && entry.hasDemoFn) {
diff --git a/api/src/widget-defaults.js b/api/src/widget-defaults.js
new file mode 100644
index 00000000..80fa2bb5
--- /dev/null
+++ b/api/src/widget-defaults.js
@@ -0,0 +1,58 @@
+/* The secret check and the data function must both read a config through this.
+   If only one does, a stored secret can be restored for one destination and
+   sent to another. */
+
+function defaultsOf(fields) {
+  const seen = new Map();
+  for (const f of Array.isArray(fields) ? fields : []) {
+    if (!f || typeof f.key !== 'string' || !f.key) continue;
+    const usable = f.default !== undefined && f.cosmetic !== true && f.transient !== true && f.type !== 'secret';
+    const value = usable ? JSON.stringify(f.default) : null;
+    const prev = seen.get(f.key);
+    seen.set(f.key, prev === undefined || prev === value ? value : null);
+  }
+  const out = new Map();
+  for (const [k, v] of seen) if (v !== null) out.set(k, v);
+  return out;
+}
+
+function fill(obj, defaults) {
+  let out = obj;
+  for (const [k, v] of defaults) {
+    if (Object.hasOwn(obj, k) && obj[k] !== undefined) continue;
+    if (out === obj) out = { ...obj };
+    out[k] = JSON.parse(v);
+  }
+  return out;
+}
+
+const isObj = v => !!v && typeof v === 'object' && !Array.isArray(v);
+
+function withManifestDefaults(config, entry) {
+  const fields = (entry && entry.manifest && entry.manifest.fields) || [];
+  let out = fill(isObj(config) ? config : {}, defaultsOf(fields));
+  const nested = new Map();
+  for (const f of fields) {
+    if (!f || typeof f.key !== 'string' || !Array.isArray(f.fields)) continue;
+    if (f.type !== 'group' && f.type !== 'object') continue;
+    const prev = nested.get(f.key);
+    nested.set(f.key, { type: f.type, fields: (prev ? prev.fields : []).concat(f.fields) });
+  }
+  for (const [k, { type, fields: sub }] of nested) {
+    const defaults = defaultsOf(sub);
+    if (!defaults.size) continue;
+    const v = out[k];
+    let next = v;
+    if (type === 'group' && Array.isArray(v)) {
+      const rows = v.map(row => (isObj(row) ? fill(row, defaults) : row));
+      if (rows.some((row, i) => row !== v[i])) next = rows;
+    } else if (type === 'object' && isObj(v)) next = fill(v, defaults);
+    if (next !== v) {
+      if (out === config) out = { ...out };
+      out[k] = next;
+    }
+  }
+  return out;
+}
+
+module.exports = { withManifestDefaults };
diff --git a/api/test/github-data.test.js b/api/test/github-data.test.js
index 876ffa2e..13f696b4 100644
--- a/api/test/github-data.test.js
+++ b/api/test/github-data.test.js
@@ -123,36 +123,42 @@ for (const [status, kind] of [
   });
 }
 
-test('gitea contributions add the heatmap slots up per day', async () => {
-  const now = new Date();
-  const at = (daysAgo, hour) => {
-    const d = new Date(now);
-    d.setDate(d.getDate() - daysAgo);
-    d.setHours(hour, 15, 0, 0);
-    return Math.floor(d.getTime() / 1000);
-  };
+test('gitea contributions pass the recent heatmap slots on as pairs', async () => {
+  const now = Math.floor(Date.now() / 1000);
   const { ctx, calls } = recordingCtx(
     { ...GITEA, githubView: 'contributions' },
     {
       status: 200,
       data: [
-        { timestamp: at(0, 9), contributions: 2 },
-        { timestamp: at(0, 10), contributions: 3 },
-        { timestamp: at(3, 12), contributions: 4 },
-        { timestamp: at(400, 12), contributions: 9 },
+        { timestamp: now - 3600, contributions: 2 },
+        { timestamp: now - 3 * 86400, contributions: '4' },
+        { timestamp: now - 400 * 86400, contributions: 9 },
+        { timestamp: now, contributions: 0 },
+        { timestamp: 'x', contributions: 1 },
+        null,
       ],
     },
   );
   const r = await dataFn(ctx);
   assert.equal(calls[0].url.pathname, '/api/v1/users/me/heatmap');
   assert.equal(r.view, 'contributions');
-  assert.equal(r.totalContributions, 9);
-  const days = r.weeks.flatMap(w => w.contributionDays);
-  assert.equal(days.at(-1).contributionCount, 5);
-  assert.ok(r.weeks.every(w => new Date(w.contributionDays[0].date + 'T00:00:00Z').getUTCDay() === 0));
+  assert.deepEqual(r.slots, [
+    [now - 3600, 2],
+    [now - 3 * 86400, 4],
+  ]);
   assert.equal(r.profileUrl, 'https://git.lan/me');
 });
 
+test('a server address without a scheme is read and linked over https', async () => {
+  const { ctx, calls } = recordingCtx({ ...GITEA, githubUrl: 'git.lan' }, { status: 200, data: [] });
+  const r = await dataFn(ctx);
+  assert.equal(calls[0].url.origin, 'https://git.lan');
+  assert.equal(r.allUrl, 'https://git.lan/pulls');
+  const plain = recordingCtx({ ...GITEA, githubUrl: 'http://git.lan' }, { status: 200, data: [] });
+  await dataFn(plain.ctx);
+  assert.equal(plain.calls[0].url.origin, 'http://git.lan');
+});
+
 const GITLAB = { githubService: 'gitlab', githubUrl: 'https://gitlab.com', githubUser: 'me', githubToken: 't' };
 
 test('gitlab lists open merge requests by the chosen filters', async () => {
diff --git a/api/test/secret-scope.test.js b/api/test/secret-scope.test.js
index 3c655dca..35e5f33a 100644
--- a/api/test/secret-scope.test.js
+++ b/api/test/secret-scope.test.js
@@ -237,6 +237,34 @@ test('changing the git service or server URL takes the stored token out of scope
   }
 });
 
+test('a github widget saved before the service field keeps its token when the editor sends the default', () => {
+  const github = getRegistry().github;
+  const saved = { githubView: 'prs', githubUser: 'me', githubToken: 'STORED' };
+  const posted = { githubService: 'github', githubView: 'prs', githubUser: 'me' };
+  assert.equal(widgetConfigMatchesSaved(posted, saved, github), true);
+  assert.equal(alignSavedConfig(posted, saved, github).config.githubToken, 'STORED');
+  assert.equal(widgetConfigMatchesSaved({ ...posted, githubService: 'gitea' }, saved, github), false);
+});
+
+test('a row or object saved before a defaulted field keeps its secret when the editor sends the default', () => {
+  const saved = {
+    services: [{ id: 'a', url: 'http://vpn', token: 'STORED' }],
+    vpn: { url: 'http://vpn', apiKey: 'K' },
+  };
+  const posted = {
+    services: [{ id: 'a', url: 'http://vpn', type: 'gluetun' }],
+    vpn: { url: 'http://vpn', service: 'gluetun' },
+  };
+  assert.equal(widgetConfigMatchesSaved(posted, saved, connections), true);
+  assert.equal(alignSavedConfig(posted, saved, connections).config.services[0].token, 'STORED');
+  const moved = { ...posted, services: [{ ...posted.services[0], type: 'conduit' }] };
+  assert.equal(alignSavedConfig(moved, saved, connections).config.services[0].token, undefined);
+  assert.equal(
+    widgetConfigMatchesSaved({ ...posted, vpn: { ...posted.vpn, service: 'netbird' } }, saved, connections),
+    false,
+  );
+});
+
 test('a field that reaches the request still takes the stored credential out of scope', () => {
   const r = getRegistry();
   const cases = [
diff --git a/api/test/widget-defaults.test.js b/api/test/widget-defaults.test.js
new file mode 100644
index 00000000..91123959
--- /dev/null
+++ b/api/test/widget-defaults.test.js
@@ -0,0 +1,117 @@
+const path = require('node:path');
+const fs = require('node:fs');
+const { tmpDir } = require('../test-support/tmp');
+const _tmp = tmpDir('wdef');
+process.env.CONFIG_PATH = path.join(_tmp, 'apps.json');
+process.env.WIDGETS_PATH = path.join(_tmp, 'widgets');
+
+const MANIFEST = {
+  name: 'fixture',
+  label: 'Fixture',
+  sizes: ['medium'],
+  views: { main: { src: 'index.html' } },
+  fields: [
+    {
+      key: 'provider',
+      type: 'select',
+      label: 'Provider',
+      default: 'a',
+      options: [
+        { value: 'a', label: 'A' },
+        { value: 'b', label: 'B' },
+      ],
+    },
+    { key: 'url', type: 'text', label: 'URL' },
+  ],
+};
+const _fx = path.join(_tmp, 'widgets', 'fixture');
+fs.mkdirSync(_fx, { recursive: true });
+fs.writeFileSync(path.join(_fx, 'widget.json'), JSON.stringify(MANIFEST));
+fs.writeFileSync(path.join(_fx, 'index.html'), '');
+fs.writeFileSync(path.join(_fx, 'data.js'), 'module.exports = async ctx => ({ config: ctx.config });\n');
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { withManifestDefaults } = require('../src/widget-defaults');
+
+const entry = fields => ({ manifest: { fields } });
+
+test('an absent field gets its default and a set one keeps its value', () => {
+  const e = entry([
+    { key: 'provider', type: 'select', default: 'a' },
+    { key: 'on', type: 'toggle', default: false },
+  ]);
+  assert.deepEqual(withManifestDefaults({}, e), { provider: 'a', on: false });
+  assert.deepEqual(withManifestDefaults({ provider: 'b', on: true }, e), { provider: 'b', on: true });
+  assert.deepEqual(withManifestDefaults({ provider: '' }, e), { provider: '', on: false });
+});
+
+test('the input config is left unchanged', () => {
+  const cfg = { rows: [{ url: 'x' }] };
+  const out = withManifestDefaults(
+    cfg,
+    entry([
+      { key: 'provider', type: 'select', default: 'a' },
+      { key: 'rows', type: 'group', fields: [{ key: 'type', type: 'select', default: 'cpu' }] },
+    ]),
+  );
+  assert.deepEqual(cfg, { rows: [{ url: 'x' }] });
+  assert.deepEqual(out, { provider: 'a', rows: [{ url: 'x', type: 'cpu' }] });
+});
+
+test('cosmetic, transient and secret fields get no default', () => {
+  const e = entry([
+    { key: 'units', type: 'select', default: 'c', cosmetic: true },
+    { key: 'search', type: 'text', default: '', transient: true },
+    { key: 'key', type: 'secret', default: 'x' },
+  ]);
+  assert.deepEqual(withManifestDefaults({}, e), {});
+});
+
+test('a key declared with differing defaults, or once without one, gets none', () => {
+  assert.deepEqual(
+    withManifestDefaults(
+      {},
+      entry([
+        { key: 'p', type: 'select', default: 'a' },
+        { key: 'p', type: 'select', default: 'b' },
+        { key: 'q', type: 'select', default: 'a' },
+        { key: 'q', type: 'select' },
+        { key: 'r', type: 'select', default: 'a' },
+        { key: 'r', type: 'select', default: 'a' },
+      ]),
+    ),
+    { r: 'a' },
+  );
+});
+
+test('rows of a group and the keys of an object get their defaults', () => {
+  const e = entry([
+    { key: 'slots', type: 'group', fields: [{ key: 'type', type: 'select', default: 'cpu' }] },
+    { key: 'slots', type: 'group', fields: [{ key: 'type', type: 'select', default: 'cpu' }] },
+    { key: 'vpn', type: 'object', fields: [{ key: 'service', type: 'select', default: 'gluetun' }] },
+  ]);
+  assert.deepEqual(withManifestDefaults({ slots: [{}, { type: 'disk' }, 'junk'], vpn: {} }, e), {
+    slots: [{ type: 'cpu' }, { type: 'disk' }, 'junk'],
+    vpn: { service: 'gluetun' },
+  });
+});
+
+test('a default array is copied, not shared', () => {
+  const e = entry([{ key: 'list', type: 'multiselect', default: ['a'] }]);
+  withManifestDefaults({}, e).list.push('b');
+  assert.deepEqual(withManifestDefaults({}, e).list, ['a']);
+});
+
+test('the data function reads a saved config with its defaults filled in', async () => {
+  const { getRegistry } = require('../src/widgets');
+  const { getWidgetData } = require('../src/widget-data');
+  const out = await getWidgetData(
+    { widgetType: 'fixture', widgetConfig: { url: 'http://x' } },
+    getRegistry().fixture,
+    '',
+    new URLSearchParams(),
+    null,
+  );
+  assert.deepEqual(out.body.config, { provider: 'a', url: 'http://x' });
+});
diff --git a/tsconfig.frontend.json b/tsconfig.frontend.json
index d12aee19..d5b3399b 100644
--- a/tsconfig.frontend.json
+++ b/tsconfig.frontend.json
@@ -210,6 +210,12 @@
       "/js/host-names.js?v=*": [
         "./ui/js/host-names.js"
       ],
+      "/js/contribution-calendar.js": [
+        "./ui/js/contribution-calendar.js"
+      ],
+      "/js/contribution-calendar.js?v=*": [
+        "./ui/js/contribution-calendar.js"
+      ],
       "/js/service-link.js": [
         "./ui/js/service-link.js"
       ],
diff --git a/ui/js/contribution-calendar.js b/ui/js/contribution-calendar.js
new file mode 100644
index 00000000..02e1c4d2
--- /dev/null
+++ b/ui/js/contribution-calendar.js
@@ -0,0 +1,31 @@
+function isoDay(d) {
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+}
+
+/** @param {unknown} slots [unix seconds, count] pairs @param {Date} [now]
+    @returns {{ weeks: { contributionDays: { contributionCount: number, date: string }[] }[], totalContributions: number }} */
+export function slotWeeks(slots, now = new Date()) {
+  const perDay = new Map();
+  for (const s of Array.isArray(slots) ? slots : []) {
+    const t = Number(Array.isArray(s) ? s[0] : NaN);
+    const c = Number(Array.isArray(s) ? s[1] : NaN);
+    if (!Number.isFinite(t) || !Number.isFinite(c) || c <= 0) continue;
+    const day = isoDay(new Date(t * 1000));
+    perDay.set(day, (perDay.get(day) || 0) + c);
+  }
+  const y = now.getFullYear();
+  const m = now.getMonth();
+  const today = now.getDate();
+  const weeks = [];
+  let total = 0;
+  /* Noon, not midnight. Midnight does not exist on some daylight-saving days. */
+  for (let d = today - 52 * 7 - now.getDay(); d <= today; d++) {
+    const day = new Date(y, m, d, 12);
+    if (day.getDay() === 0 || !weeks.length) weeks.push({ contributionDays: [] });
+    const date = isoDay(day);
+    const count = perDay.get(date) || 0;
+    total += count;
+    weeks[weeks.length - 1].contributionDays.push({ contributionCount: count, date });
+  }
+  return { weeks, totalContributions: total };
+}
diff --git a/ui/test/contribution-calendar.test.mjs b/ui/test/contribution-calendar.test.mjs
new file mode 100644
index 00000000..6e97d9b2
--- /dev/null
+++ b/ui/test/contribution-calendar.test.mjs
@@ -0,0 +1,59 @@
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { slotWeeks } from '../js/contribution-calendar.js';
+
+const TZ = process.env.TZ;
+after(() => {
+  if (TZ === undefined) delete process.env.TZ;
+  else process.env.TZ = TZ;
+});
+
+const at = (y, m, d, h) => Math.floor(new Date(y, m - 1, d, h).getTime() / 1000);
+const days = cal => cal.weeks.flatMap(w => w.contributionDays);
+
+test('slots are summed per local day, and the grid runs Sunday-first weeks up to today', () => {
+  process.env.TZ = 'UTC';
+  const now = new Date(2026, 9, 24, 15);
+  const cal = slotWeeks(
+    [
+      [at(2026, 10, 24, 9), 2],
+      [at(2026, 10, 24, 10), 3],
+      [at(2026, 10, 21, 12), 4],
+      [at(2025, 1, 1, 12), 9],
+      [at(2026, 10, 24, 11), 0],
+      ['x', 1],
+      null,
+    ],
+    now,
+  );
+  const all = days(cal);
+  assert.equal(all.at(-1).date, '2026-10-24');
+  assert.equal(all.at(-1).contributionCount, 5);
+  assert.equal(all.find(d => d.date === '2026-10-21').contributionCount, 4);
+  assert.equal(cal.totalContributions, 9);
+  assert.equal(cal.weeks.length, 53);
+  assert.ok(cal.weeks.every(w => new Date(`${w.contributionDays[0].date}T00:00:00Z`).getUTCDay() === 0));
+});
+
+test("a slot counts on the viewer's day, not the server's", () => {
+  const t = Date.UTC(2026, 9, 24, 1) / 1000;
+  process.env.TZ = 'America/Los_Angeles';
+  const west = days(slotWeeks([[t, 1]], new Date(2026, 9, 24, 12)));
+  assert.equal(west.find(d => d.contributionCount).date, '2026-10-23');
+  process.env.TZ = 'UTC';
+  const utc = days(slotWeeks([[t, 1]], new Date(2026, 9, 24, 12)));
+  assert.equal(utc.find(d => d.contributionCount).date, '2026-10-24');
+});
+
+for (const zone of ['America/Santiago', 'Asia/Beirut', 'America/Havana']) {
+  test(`today stays on the grid in ${zone}, where daylight saving starts at midnight`, () => {
+    process.env.TZ = zone;
+    const now = new Date();
+    const cal = slotWeeks([[Math.floor(now.getTime() / 1000), 4]], now);
+    const all = days(cal);
+    assert.equal(all.length, 52 * 7 + now.getDay() + 1);
+    assert.equal(new Set(all.map(d => d.date)).size, all.length);
+    assert.equal(all.at(-1).contributionCount, 4);
+    assert.equal(cal.totalContributions, 4);
+  });
+}
diff --git a/ui/test/widget-toolbox-link.test.mjs b/ui/test/widget-toolbox-link.test.mjs
index a32e824f..4798a147 100644
--- a/ui/test/widget-toolbox-link.test.mjs
+++ b/ui/test/widget-toolbox-link.test.mjs
@@ -150,7 +150,7 @@ test('the pull request list holds list items', () => {
 test('the contributions summary uses the yearly total', () => {
   assert.match(
     widget('github/contributions.html'),
-    /const total = formatNumber\(Math\.max\(0, Number\(data\.totalContributions\) \|\| 0\)\);/,
+    /const total = formatNumber\(Math\.max\(0, Number\(cal\.totalContributions\) \|\| 0\)\);/,
   );
 });
 
diff --git a/ui/widgets/github/contributions.html b/ui/widgets/github/contributions.html
index 0fc54d90..866a0a39 100644
--- a/ui/widgets/github/contributions.html
+++ b/ui/widgets/github/contributions.html
@@ -81,6 +81,7 @@
 <div class="cap" id="cap"></div>
 <script type="module">
 import { poll, fetchData, linkTo, loadStrings, wt, formatNumber, errorState, fitText, cssZoom } from '/js/widget-toolbox.js?v=ce372f4d';
+import { slotWeeks } from '/js/contribution-calendar.js?v=c88b8def';
 await loadStrings();
 
 const TICK_MS = 300000;
@@ -217,8 +218,9 @@
 
 let arrived = false;
 function render(data) {
-  const weeks = Array.isArray(data.weeks) ? data.weeks : [];
-  const total = formatNumber(Math.max(0, Number(data.totalContributions) || 0));
+  const cal = Array.isArray(data.slots) ? slotWeeks(data.slots) : data;
+  const weeks = Array.isArray(cal.weeks) ? cal.weeks : [];
+  const total = formatNumber(Math.max(0, Number(cal.totalContributions) || 0));
   endHover();
   linkTo(linkEl, data.profileUrl);
   if (GRID.cols) drawGrid(weeks);
diff --git a/ui/widgets/github/data.js b/ui/widgets/github/data.js
index 50b0011c..7bb1abef 100644
--- a/ui/widgets/github/data.js
+++ b/ui/widgets/github/data.js
@@ -14,7 +14,9 @@ module.exports = async function (ctx) {
     if (config.githubView === 'contributions') return contributions(ctx, token, username);
     return pullRequests(ctx, token, username, config);
   }
-  const base = ctx.normalizeBase(config.githubUrl);
+  const raw = String(config.githubUrl || '').trim();
+  /* Never send the token over http unless the address says so. */
+  const base = ctx.normalizeBase(!raw || /^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`);
   if (!base) ctx.fail(`${name} URL not configured`, { kind: ctx.KIND.INVALID });
   if (service === 'gitlab') {
     if (config.githubView === 'contributions')
@@ -155,41 +157,11 @@ async function giteaPullRequests(ctx, base, token, config, name) {
     view: 'prs',
     totalCount: headerCount(r, 'x-total-count', items.length),
     filters: filterArr,
-    allUrl: ctx.serviceLink(config.githubHref, config.githubUrl, '/pulls'),
+    allUrl: ctx.serviceLink(config.githubHref, base, '/pulls'),
     items,
   };
 }
 
-function isoDay(d) {
-  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
-}
-
-function giteaCalendar(slots, now = new Date()) {
-  const perDay = new Map();
-  for (const s of slots) {
-    const t = Number(s?.timestamp);
-    const c = Number(s?.contributions);
-    if (!Number.isFinite(t) || !Number.isFinite(c) || c <= 0) continue;
-    const day = isoDay(new Date(t * 1000));
-    perDay.set(day, (perDay.get(day) || 0) + c);
-  }
-  const today = new Date(now);
-  today.setHours(0, 0, 0, 0);
-  const day = new Date(today);
-  day.setDate(day.getDate() - 52 * 7 - today.getDay());
-  const weeks = [];
-  let total = 0;
-  while (day <= today) {
-    if (day.getDay() === 0) weeks.push({ contributionDays: [] });
-    const date = isoDay(day);
-    const count = perDay.get(date) || 0;
-    total += count;
-    weeks[weeks.length - 1].contributionDays.push({ contributionCount: count, date });
-    day.setDate(day.getDate() + 1);
-  }
-  return { weeks, totalContributions: total };
-}
-
 async function giteaContributions(ctx, base, token, username, name) {
   const r = await ctx.fetchJSON(`${base}/api/v1/users/${encodeURIComponent(username)}/heatmap`, {
     headers: { Authorization: `token ${token}`, Accept: 'application/json' },
@@ -197,10 +169,17 @@ async function giteaContributions(ctx, base, token, username, name) {
   });
   replyStatus(ctx, r, name);
   if (!Array.isArray(r.data)) ctx.fail(`${name} returned no contribution heatmap`);
+  const since = Date.now() / 1000 - 380 * 86400;
+  const slots = [];
+  for (const s of r.data) {
+    const t = Number(s?.timestamp);
+    const c = Number(s?.contributions);
+    if (Number.isFinite(t) && t >= since && Number.isFinite(c) && c > 0) slots.push([t, c]);
+  }
   return {
     view: 'contributions',
-    ...giteaCalendar(r.data),
-    profileUrl: ctx.serviceLink(ctx.config.githubHref, ctx.config.githubUrl, '/' + encodeURIComponent(username)),
+    slots,
+    profileUrl: ctx.serviceLink(ctx.config.githubHref, base, '/' + encodeURIComponent(username)),
   };
 }
 
@@ -239,9 +218,7 @@ async function gitlabMergeRequests(ctx, base, token, username, config) {
     view: 'prs',
     totalCount: headerCount(r, 'x-total', items.length),
     filters: filterArr,
-    allUrl: ctx.serviceLink(config.githubHref, config.githubUrl, '/dashboard/merge_requests'),
+    allUrl: ctx.serviceLink(config.githubHref, base, '/dashboard/merge_requests'),
     items,
   };
 }
-
-module.exports._internals = { giteaCalendar };