BREAKING Fix(git)!: route Git network operations through an internal proxy and update egress settings (#39426) Feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs (#38855) SECURITY Fix(git): reject invalid and duplicate Git objects on push (#39472) Fix(git)!: route Git network operations through an internal proxy and update egress settings (#39426) Fix(ssh): identify presented public…
docs: Add changelog for 28.0.0 (#39474)
SECURITY fix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058) fix(attachments): enforce owning repository path (#39048) (#39077) fix(markup): enforce same-repository issue access (#39045) (#39054) fix(actions): verify raw artifact signatures first (#39049) (#39053) fix(api): hide limited users from restricted viewers (#39004) (#39039) fix(repo): limi…
SECURITY Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895) Refactor: external render (#38885) (#38898) Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897) Refactor: markup render (#38864) (#38869) Fix(deps): update dependency mermaid to v11.16.1 (#38816) Fix(auth): set WebAuthn user verification per request (#38805) (#38810) F…
SECURITY Fix: orgmode render include path (#38642) (#38645) Fix: git patch apply (#38637) (#38638) API fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592) ENHANCEMENTS enhance: improve diff contrast in light and dark themes (#37477) (#38574) BUGFIXES fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666) fix: make Actions log parser…
BREAKING Feat(actions)!: improve support for reusable workflows (#37478) Use Content-Security-Policy: script nonce (#37232) SECURITY Fix: various security fixes (#38406) (#38426) Fix(security): harden access checks and migration validation (#38324) (#38400) Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399) Fix(pull): re-evaluate review official flag on…
BREAKING Feat(actions)!: improve support for reusable workflows (#37478) Use Content-Security-Policy: script nonce (#37232) SECURITY Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786) Fix(oauth): restrict introspection to the token's client (#38042) Fix(api): don't expose private org membership via public_members (#38145) Fix(actions): deny fork-PR cross-repo acces…
fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2…
SECURITY fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183) BUGFIXES fix: walk git log context error handling (#38182) (#38185) Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.
WarningPlease upgrade to 1.26.4 directly. A regression in this release can cause "context deadline exceeded" errors when opening any repository's code pages (#38177). Please hold off on upgrading until a fix is released. BREAKING fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041) SECURITY fix(hostmatcher): patch incorrect private list (#38170) (#38173) fix: Various…
SECURITY fix(permissions): Fix reading permission (#37769) fix(actions): make artifact signature payloads unambiguous (#37707) fix: Unify public-only token filtering in API queries and repo access checks (#37118) fix: Add missed token scope checking (#37735) fix(oauth): bind token exchanges to the original client request (#37704) fix(oauth): strengthen PKCE validation and refresh token replay prot…
BUGFIXES Add event.schedule context for schedule actions task (#37320) (#37348) Fix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#37324) (#37344) Use modern "git update-index --cacheinfo" syntax to support more file names (#37338) (#37343) Fix URL related escaping for oauth2 (#37334) (#37340) When the requested arch rpm is missing fa…
BREAKING Correct swagger annotations for enums, status codes, and notification state (#37030) Remove GET API registration-token (#36801) Support Actions concurrency syntax (#32751) Make PUBLIC_URL_DETECTION default to "auto" (#36955) SECURITY Bound PageSize in ListUnadoptedRepositories (#36884) FEATURES Support Actions concurrency syntax (#32751) Add terraform state registry (#36710) Instance-wide…
BREAKING Correct swagger annotations for enums, status codes, and notification state (#37030) Remove GET API registration-token (#36801) Support Actions concurrency syntax (#32751) Make PUBLIC_URL_DETECTION default to "auto" (#36955) SECURITY Bound PageSize in ListUnadoptedRepositories (#36884) FEATURES Support Actions concurrency syntax (#32751) Add terraform state registry (#36710) Instance-wide…
Fix #37128 Manually tested with various cases (issue, pr) X (close, reopen) Fix #36792 Fix the comment Fix #36755 Add a "sleep 3" Follow up #36697 Clarify the "attachment uploading" problem and function call Signed-off-by: wxiaoguang wxiaoguang@gmail.com Co-authored-by: TheFox0x7 thefox0x7@gmail.com
SECURITY Toolchain Update to Go 1.25.6 (#36480) (#36487) Adjust the toolchain version (#36537) (#36542) Update toolchain to 1.25.8 for v1.25 (#36888) Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716) Fix get release draft permission check (#36659) (#36715) Fix a bug user could change another user's primary email (#36586) (#36607) Fix OAuth2 authorization code expiry and reuse…