Gitea 1.25.0 → 1.27.0
11 releases · 29 breaking changes · 31 security fixes · 68 advisories fixed
31security29breaking1deprecated63feature142fix
Vulnerabilities fixed by this upgrade
- 4.3 CVE-2026-109844 Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade
- low GHSA-qg66-h68v-5x2h Arbitrary File Read via Path Traversal in gitea restore-repo
- 5.3 CVE-2026-78231 Unauthenticated Blind SSRF via OpenID Sign-In Verification
- 3.7 GHSA-m984-2424-x6vw Generic attachment downloads bypass draft-release visibility checks
- 8.1 CVE-2026-73804 User-scoped tokens can mint unscoped HTTP signature API credentials
- 8.1 CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
- high CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
- 4.9 CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
- 3.1 CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
- medium CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
- 5.9 CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
- 2.7 CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API
- 6.5 CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
- medium CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
- medium CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- 7.1 CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
- 4.3 CVE-2026-58425 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
- 5.3 CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint
- high CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
- 6.5 CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
- high CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
- 8.5 CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
- medium CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
- 5.9 CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
- low CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
- medium CVE-2026-56657 Gitea SSH Key Parser Denial of Service
- 4.3 CVE-2026-58431 Public-only API token restriction is not enforced on team API routes
- medium CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
- 8.1 CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
- 4.3 CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
- high CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
- 6.7 CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore
- 5.4 CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions
- 2.7 CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
- 7.5 CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
- low CVE-2026-58417 REST API exposes organization membership of private organizations to public
- 4.3 CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
- 6.3 CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
- 2.7 CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
- medium CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
- 9.6 CVE-2026-58443 Public-only repository tokens can update private PR head branches
- 6.5 CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
- 6.3 CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
- 6.8 CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
- medium CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
- high CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
- 9.6 CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
- 8.9 CVE-2026-58424 Permanent Fork PR Workflow Approval Gate Bypass
- 7.7 CVE-2026-58423 LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
- 7.6 CVE-2026-58422 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
- medium CVE-2026-58421 Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
- 6.5 CVE-2026-58418 SSRF via HTTP Redirect in Repository Migration
- 4.3 CVE-2026-27761 API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
- 7.1 CVE-2026-28740 Git LFS object reuse allows non-Code access to authorize private source objects
- 7.1 CVE-2026-20779 TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
- 9.8 CVE-2026-20896 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
- 9.6 CVE-2026-22874 Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
- 5.1 CVE-2026-25779 Open Redirect via redirect_to in Gitea
- 8.7 CVE-2026-28737 Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
- 8.1 CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
- 8.1 CVE-2026-22555 API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
- 4.3 CVE-2026-27783 Missing repository-unit authorization on issue-template API endpoints
- medium CVE-2026-20706 Token scope bypass on web archive download endpoint (variant of PR #37698)
- 4.3 CVE-2026-25714 Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
- 8.5 CVE-2026-26231 Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
- 8.1 CVE-2026-28699 OAuth2 access token scope enforcement bypass via HTTP Basic authentication
- 8.2 CVE-2026-27771 Critical Vulnerability - Already emailed
- 8.1 CVE-2026-28744 Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
Breaking changes
- breaking BREAKING in 1.27.0
- breaking Feat(actions)!: improve support for reusable workflows (#37478) in 1.27.0
- breaking Remove external service dependencies in migration tests (#36866) in 1.27.0
- breaking Remove htmx (#37224) in 1.27.0
- breaking Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364) in 1.27.0
- breaking Remove SubmitEvent polyfill (#37276) in 1.27.0
- breaking Remove dead code identified by deadcode tool (#37271) in 1.27.0
- breaking Remove error returns from crypto random helpers and callers (#37240) in 1.27.0
- breaking Remove outdated RunUser logic (#37180) in 1.27.0
- breaking BREAKING in 1.26.3
- breaking fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041) in 1.26.3
- breaking fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465) in 1.26.2
- breaking Remove excessive quote from terraform instructions (#37424) (#37426) in 1.26.2
- breaking BREAKING in 1.26.0
- breaking Remove GET API registration-token (#36801) in 1.26.0
- breaking Remove striped tables in UI (#36509) in 1.26.0
- breaking Remove dead CSS rules (#37173) (#37177) in 1.26.0
- breaking Remove unnecessary function parameter (#35765) in 1.26.0
- breaking Remove undocumented support of signing key in the repository git configuration file (#36143) in 1.26.0
- breaking Remove mermaid margin workaround (#35732) in 1.26.0
- breaking Remove unused functions (#36672) in 1.26.0
- breaking Remove util.URLJoin and replace all callers with direct path concatenation (#36867) in 1.26.0
- breaking Remove nolint (#36252) in 1.26.0
- breaking Remove fomantic form module (#36222) in 1.26.0
- breaking Remove redundant linter rules (#36658) in 1.26.0
- breaking Remove and forbid @ts-expect-error (#36513) in 1.26.0
- breaking Remove i18n backport tool at the moment because of translation format changed (#36643) in 1.26.0
- breaking Remove padding override on .ui .sha.label (#35864) (#35873) in 1.25.2
- breaking Remove wrong code (#35846) in 1.25.1
Security changes
- security Fixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in 1.27.0
- security Use Content-Security-Policy: script nonce (#37232) in 1.27.0
- security SECURITY in 1.27.0
- security Fix: various security fixes (#38406) (#38426) in 1.27.0
- security Fix(security): harden access checks and migration validation (#38324) (#38400) in 1.27.0
- security Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786) in 1.27.0
- security Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219) in 1.27.0
- security Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097) in 1.27.0
- security Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904) in 1.27.0
- security Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806) in 1.27.0
- security Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662) in 1.27.0
- security SECURITY in 1.26.4
- security Fixes CVE-2026-20779: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in 1.26.3
- security SECURITY in 1.26.3
- security fix: Various security fixes (#38103) (#38151) in 1.26.3
- security fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829) in 1.26.3
- security Fixes CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in 1.26.2
- security SECURITY in 1.26.2
- security fix(security): enforce wiki git writes and LFS token access at request time (#37695) in 1.26.2
- security fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test in 1.26.2
- security Fix attachment Content-Security-Policy (#37455) (#37464) in 1.26.2
- security Fixes CVE-2026-28737: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in 1.26.0
- security Fixes CVE-2026-22555: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in 1.26.0
- security SECURITY in 1.26.0
- security Move X_FRAME_OPTIONS setting from cors to security section (#30256) in 1.26.0
- security Replace CSRF cookie with CrossOriginProtection (#36183) in 1.26.0
- security SECURITY in 1.25.5
- security Make security-check informational only (#36681) (#36852) in 1.25.5
- security SECURITY in 1.25.4
- security SECURITY in 1.25.3
- security SECURITY in 1.25.2
Deprecations
- deprecated Update JS deps, fix deprecations (#36040) in 1.26.0
Every release in between
securityFixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
breakingBREAKING
breakingFeat(actions)!: improve support for reusable workflows (#37478)
securityUse Content-Security-Policy: script nonce (#37232)
securitySECURITY
securityFix: various security fixes (#38406) (#38426)
securityFix(security): harden access checks and migration validation (#38324) (#38400)
securityFix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
featureFeat(actions): add workflow status badge modal (#38196)
featureFeat(actions): support owner-level and global scoped workflows (#38154)
featureFeat(api): support ref suffixes in compare (#38148)
featureFeat(actions): implement jobs..continue-on-error (#38100)
featureFeat(actions): show run status on browser tab favicon (#38071)
featureFeat(api): add token introspection and self-deletion endpoint (#37995)
featureFeat(api): add q parameter to list branches API for server-side filtering (#37982)
featureFeat(repo): split repository creation limit into user and org scopes (#37872)
featureFeat(actions): bulk delete, disable and enable runners in admin UI (#37869)
featureFeat(actions): List workflows that were executed once but got removed from the default branch (#37835)
featureFeat(org): add team visibility so org members can discover teams (#37680)
featureFeat: add raw diff/patch endpoint for repository comparisons (#37632)
featureFeat: Add avatar stacks (#37594)
featureFeat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
featureFeat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
featureSupport for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
featureFeat(orgs): Add search bar for organization members tab page (#37347)
featureFeat(api): Add assignees APIs (#37330)
featureFeat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
featureAdd project column picker to issue and pull request sidebar (#37037)
featureAllow multiple projects per issue and pull requests (#36784)
securityFix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
securityFix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
securityFix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
breakingRemove external service dependencies in migration tests (#36866)
breakingRemove htmx (#37224)
securityFix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
securityFix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
breakingRemove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
breakingRemove SubmitEvent polyfill (#37276)
breakingRemove dead code identified by deadcode tool (#37271)
breakingRemove error returns from crypto random helpers and callers (#37240)
+252 more items in the release notessecuritySECURITY
fixfix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)
otherBUGFIXES
fixfix: walk git log context error handling (#38182) (#38185)
securityFixes CVE-2026-20779: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
breakingBREAKING
breakingfix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)
securitySECURITY
fixfix(hostmatcher): patch incorrect private list (#38170) (#38173)
securityfix: Various security fixes (#38103) (#38151)
fixfix: Various sec fixes (#38108) (#38147)
fixfix: allow git clone of private repos with anonymous code access (#38074) (#38146)
fixfix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
fixfix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
fixfix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
fixfix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
fixfix: bound CODEOWNERS regex match time (#38011) (#38025)
fixfix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
securityfix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)
otherAPI
featurefeat(api): add Link header in ListForks (#38052) (#38063)
otherBUGFIXES
fixfix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
fixfix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
fixfix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
fixfix: parse HEAD ref (#38119)
fixfix: git cmd (#38084) (#38087)
fixfix(releases): generate notes for initial tag (#37697) (#37986)
fixfix(actions): return 404 when job log blob is missing (#38003) (#38004)
fixfix(actions): exclude workflow_call from workflow trigger detection (#37894) (#37899)
fixfix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
fixfix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
fixfix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892)
fixfix: http content file render (#37850) (#37856)
fixfix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
fixfix: Fix issue target branch selection for non-collaborators (#36916) (#38164)
otherBUILD
fixfix(deps): update @playwright/test to 1.60.0 (#38144)
otherci: add tools/ci-tools.ts for the PR labeler workflow (#37831)
fixfix(build): swagger css import (#37801) (#37803)
securityFixes CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
securitySECURITY
fixfix(permissions): Fix reading permission (#37769)
fixfix(actions): make artifact signature payloads unambiguous (#37707)
fixfix: Unify public-only token filtering in API queries and repo access checks (#37118)
fixfix: Add missed token scope checking (#37735)
fixfix(oauth): bind token exchanges to the original client request (#37704)
fixfix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
fixfix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
securityfix(security): enforce wiki git writes and LFS token access at request time (#37695)
featurefeat(api): encrypt AWS creds (#37679)
securityfix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
fixfix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
fixfix(git): Fix smart http request scope bug (#37583)
fixFix basic auth bug (#37503)
fixFix allow maintainer edit permission check (#37479) (#37484)
fixFix URL sanitization to handle schemeless credentials (#37440) (#37471)
securityFix attachment Content-Security-Policy (#37455) (#37464)
fixfix(pull): handle empty pull request files view to allow reviews (#37783)
fixfix(markup): make RenderString never fail (#37779)
fixfix: add natural sort to sortTreeViewNodes (#37772)
fixfix: package creation unique conflict (#37774)
breakingfix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
fixfix: Allow direct commits for unprotected files with push restrictions (#37657)
fixfix(actions): wrong assumption that run id always >= job id (#37737)
fixfix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
fixfix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
fixfix(repo): /generate must sync the branch table for the new repo (#37693)
fixfix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
fixfix show correct mergebase
fixfix: make clone URL respect public URL detection setting (#37615)
fixfix: "run as root" check (#37622)
fixfix: treat email addresses case-insensitively (#37600)
fixfix(actions): fix blank lines after ::endgroup:: (#37597)
fixfix(actions): report individual step status in workflow job API response (#37592)
fixfix: Invalid UTF-8 commit messages in JSON API responses (#37542)
fixfix: use consistent GetUser family functions (#37553)
fixfix(api): return 409 message instead of empty JSON for wrong commit id (#37572)
fixfix(actions): prevent panic when workflow contains null jobs (#37570)
breakingRemove excessive quote from terraform instructions (#37424) (#37426)
+18 more items in the release notesotherBUGFIXES
featureAdd event.schedule context for schedule actions task (#37320) (#37348)
fixFix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#37324) (#37344)
otherUse modern "git update-index --cacheinfo" syntax to support more file names (#37338) (#37343)
fixFix URL related escaping for oauth2 (#37334) (#37340)
otherWhen the requested arch rpm is missing fall back to noarch (#37236) (#37339)
fixFix actions concurrency groups cross-branch leak (#37311) (#37331)
fixFix bug when accessing user badges (#37321) (#37329)
fixFix AppFullLink (#37325) (#37328)
fixFix container auth for public instance (#37290) (#37294)
otherEnhance GetActionWorkflow to support fallback references (#37189) (#37283)
fixFix vite manifest update masking build errors (#37279) (#37310)
fixFix Mermaid diagrams failing when node labels contain line breaks (#37296) (#37299)
otherUse TriggerEvent instead of Event in workflow runs API response for scheduled runs (#37288) #37360
featureAdd URL to Learn more about blocking a user. (#37355) #37367
fixFix button layout shift when collapsing file tree in editor (#37363) #37375
fixFix org team assignee/reviewer lookups for team member permissions (#37365) #37391
fixFix repo init README EOL (#37388) #37399
fixFix: dump with default zip type produces uncompressed zip (#37401)#37402
securityFixes CVE-2026-28737: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
securityFixes CVE-2026-22555: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
breakingBREAKING
breakingRemove GET API registration-token (#36801)
securitySECURITY
featureAdd terraform state registry (#36710)
featureAdd keyboard shortcuts for repository file and code search (#36416)
featureAdd support for archive-upload rpc (#36391)
featureAdd ability to download subpath archive (#36371)
featureAdd workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
featureAdd "Go to file", "Delete Directory" to repo file list page (#35911)
featureIntroduce "config edit-ini" sub command to help maintaining INI config file (#35735)
featureAdd button to re-run failed jobs in Actions (#36924)
featureAdd summary to action runs view (#36883)
featureAdd user badges (#36752)
featureAdd configurable permissions for Actions automatic tokens (#36173)
featureAdd per-runner "Disable/Pause" (#36776)
featureAdd render cache for SVG icons (#36863)
featureImplement logout redirection for reverse proxy auth setups (#36085) (#37171)
featureAdds option to force update new branch in contents routes (#35592)
featureAdd viewer controller for mermaid (zoom, drag) (#36557)
featureAdd code editor setting dropdowns (#36534)
featureAdd elk layout support to mermaid (#36486)
featureAdd resolve/unresolve review comment API endpoints (#36441)
featureAllow configuring default PR base branch (fixes #36412) (#36425)
featureAdd support for RPM Errata (updateinfo.xml) (#37125)
featureAdd actions.WORKFLOW_DIRS setting (#36619)
securityMove X_FRAME_OPTIONS setting from cors to security section (#30256)
breakingRemove striped tables in UI (#36509)
breakingRemove dead CSS rules (#37173) (#37177)
securityReplace CSRF cookie with CrossOriginProtection (#36183)
breakingRemove unnecessary function parameter (#35765)
breakingRemove undocumented support of signing key in the repository git configuration file (#36143)
breakingRemove mermaid margin workaround (#35732)
breakingRemove unused functions (#36672)
breakingRemove util.URLJoin and replace all callers with direct path concatenation (#36867)
breakingRemove nolint (#36252)
breakingRemove fomantic form module (#36222)
deprecatedUpdate JS deps, fix deprecations (#36040)
breakingRemove redundant linter rules (#36658)
+358 more items in the release notessecuritySECURITY
otherToolchain Update to Go 1.25.6 (#36480) (#36487)
otherAdjust the toolchain version (#36537) (#36542)
otherUpdate toolchain to 1.25.8 for v1.25 (#36888)
otherPrevent redirect bypasses via backslash-encoded paths (#36660) (#36716)
fixFix get release draft permission check (#36659) (#36715)
fixFix a bug user could change another user's primary email (#36586) (#36607)
fixFix OAuth2 authorization code expiry and reuse handling (#36797) (#36851)
featureAdd validation constraints for repository creation fields (#36671) (#36757)
fixFix bug to check whether user can update pull request branch or rebase branch (#36465) (#36838)
featureAdd migration http transport for push/sync mirror lfs (#36665) (#36691)
fixFix track time list permission check (#36662) (#36744)
fixFix track time issue id (#36664) (#36689)
fixFix path resolving (#36734) (#36746)
fixFix dump release asset bug (#36799) (#36839)
fixFix org permission API visibility checks for hidden members and private orgs (#36798) (#36841)
fixFix forwarded proto handling for public URL detection (#36810) (#36836)
featureAdd a git grep search timeout (#36809) (#36835)
fixFix oauth2 s256 (#36462) (#36477)
otherENHANCEMENTS
securityMake security-check informational only (#36681) (#36852)
otherUpgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (#36840)
featureAdd some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (#36688) (#36692)
featureAdd wrap to runner label list (#36565) (#36574)
featureAdd dnf5 command for Fedora in RPM package instructions (#36527) (#36572)
featureAllow scroll propagation outside code editor (#36502) (#36510)
fixFix non-admins unable to automerge PRs from forks (#36833) (#36843)
fixFix bug when pushing mirror with wiki (#36795) (#36807)
fixFix artifacts v4 backend upload problems (#36805) (#36834)
fixFix CRAN package version validation to allow more than 4 version components (#36813) (#36821)
fixFix force push time-line commit comments of pull request (#36653) (#36717)
fixFix SVG height calculation in diff viewer (#36748) (#36750)
fixFix push time bug (#36693) (#36713)
fixFix bug the protected branch rule name is conflicted with renamed branch name (#36650) (#36661)
fixFix bug when do LFS GC (#36500) (#36608)
fixFix focus lost bugs in the Monaco editor (#36609)
fixFix assignee sidebar links and empty placeholder (#36559) (#36563)
fixFix issues filter dropdown showing empty label scope section (#36535) (#36544)
fixFix various mermaid bugs (#36547) (#36552)
fixFix data race when uploading container blobs concurrently (#36524) (#36526)
+4 more items in the release notessecuritySECURITY
otherRelease attachments must belong to the intended repo (#36347) (#36375)
fixFix permission check on org project operations (#36318) (#36373)
otherClean watches when make a repository private and check permission when send release emails (#36319) (#36370)
featureAdd more check for stopwatch read or list (#36340) (#36368)
fixFix openid setting check (#36346) (#36361)
fixFix cancel auto merge bug (#36341) (#36356)
fixFix delete attachment check (#36320) (#36355)
otherLFS locks must belong to the intended repo (#36344) (#36349)
fixFix bug on notification read (#36339) #36387
otherENHANCEMENTS
featureAdd more routes to the "expensive" list (#36290)
otherMake "commit statuses" API accept slashes in "ref" (#36264) (#36275)
otherBUGFIXES
fixFix markdown newline handling during IME composition (#36421) #36424
fixFix missing repository id when migrating release attachments (#36389)
fixFix bug when compare in the pull request (#36363) (#36372)
fixFix incorrect text content detection (#36364) (#36369)
otherFill missing has_code in repository api (#36338) (#36359)
fixFix notifications pagination query parameters (#36351) (#36358)
fixFix some trivial problems (#36336) (#36337)
otherPrevent panic when GitLab release has more links than sources (#36295) (#36305)
fixFix stats bug when syncing release (#36285) (#36294)
otherAlways honor user's choice for "delete branch after merge" (#36281) (#36286)
otherUse the requested host for LFS links (#36242) (#36258)
fixFix panic when get editor config file (#36241) (#36247)
fixFix regression in writing authorized principals (#36213) (#36218)
fixFix WebAuthn error checking (#36219) (#36235)
securitySECURITY
otherBump toolchain to go1.25.5, misc fixes (#36082)
otherENHANCEMENTS
featureAdd strikethrough button to markdown editor (#36087) (#36104)
featureAdd "site admin" back to profile menu (#36010) (#36013)
otherImprove math rendering (#36124) (#36125)
otherBUGFIXES
otherCheck user visibility when redirecting to a renamed user (#36148) (#36159)
fixFix various bugs (#36139) (#36151)
fixFix bug when viewing the commit diff page with non-ANSI files (#36149) (#36150)
otherHide RSS icon when viewing a file not under a branch (#36135) (#36141)
fixFix SVG size calulation, only use style attribute (#36133) (#36134)
otherMake Golang correctly delete temp files during uploading (#36128) (#36129)
fixFix the bug when ssh clone with redirect user or repository (#36039) (#36090)
otherUse Golang net/smtp instead of gomail's smtp to send email (#36055) (#36083)
fixFix edit user email bug in API (#36068) (#36081)
fixFix bug when updating user email (#36058) (#36066)
fixFix incorrect viewed files counter if file has changed (#36009) (#36047)
fixFix container registry error handling (#36021) (#36037)
fixFix webAuthn insecure error view (#36165) (#36179)
fixFix some file icon ui (#36078) (#36088)
fixFix Actions pull_request.paths being triggered incorrectly by rebase (#36045) (#36054)
fixFix error handling in mailer and wiki services (#36041) (#36053)
fixFix bugs when comparing and creating pull request (#36166) (#36144)
securitySECURITY
otherUpgrade golang.org/x/crypto to 0.45.0 (#35985) (#35988)
fixFix various permission & login related bugs (#36002) (#36004)
otherENHANCEMENTS
otherDisplay source code downloads last for release attachments (#35897) (#35903)
otherChange project default column icon to 'star' (#35967) (#35979)
otherBUGFIXES
featureAllow empty commit when merging pull request with squash style (#35989) (#36003)
fixFix container push tag overwriting (#35936) (#35954)
fixFix corrupted external render content (#35946) and upgrade golang.org/x packages (#35950)
otherLimit reading bytes instead of ReadAll (#35928) (#35934)
otherUse correct form field for allowed force push users in branch protection API (#35894) (#35908)
fixFix team member access check (#35899) (#35905)
fixFix conda null depend issue (#35900) (#35902)
otherSet the dates to now when not specified by the caller (#35861) (#35874)
fixFix gogit ListEntriesRecursiveWithSize (#35862)
otherMisc CSS fixes (#35888) (#35981)
otherDon't show unnecessary error message to end users for DeleteBranchAfterMerge (#35937) (#35941)
otherLoad jQuery as early as possible to support custom scripts (#35926) (#35929)
featureAllow to display embed images/pdfs when SERVE_DIRECT was enabled on MinIO storage (#35882) (#35917)
otherMake OAuth2 issuer configurable (#35915) (#35916)
fixFix #35763: Add proper page title for project pages (#35773) (#35909)
fixFix avatar upload error handling (#35887) (#35890)
otherContribution heatmap improvements (#35876) (#35880)
breakingRemove padding override on .ui .sha.label (#35864) (#35873)
fixFix pull description code label background (#35865) (#35870)
otherBUGFIXES
otherMake ACME email optional (#35849) #35857
featureAdd a doctor command to fix inconsistent run status (#35840) (#35845)
breakingRemove wrong code (#35846)
fixFix viewed files number is not right if not all files loaded (#35821) (#35844)
fixFix incorrect pull request counter (#35819) (#35841)
fixUpgrade go mail to 0.7.2 and fix the bug (#35833) (#35837)
otherRevert gomail to v0.7.0 to fix sending mail failed (#35816) (#35824)
fixFix clone mixed bug (#35810) (#35822)
fixFix cli "Before" handling (#35797) (#35808)
otherImprove and fix markup code preview rendering (#35777) (#35787)
fixFix actions rerun bug (#35783) (#35784)
fixFix actions schedule update issue (#35767) (#35774)
fixFix circular spin animation direction (#35785) (#35823)
fixFix file extension on gogs.png (#35793) (#35799)
featureAdd pnpm to Snapcraft (#35778)