Gitea 1.25.5 → 28.2.0
12 releases · 30 breaking changes · 42 security fixes · 137 advisories fixed
42security30breaking2deprecated82feature243fix
Vulnerabilities fixed by this upgrade
- low CVE-2026-97859 API routes for user social graph, keys, and starred repos bypass private visibility check
- low CVE-2026-107618 Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`
- 3.5 CVE-2026-97204 DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels
- 4.3 CVE-2026-109844 Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade
- 6.5 CVE-2026-110324 Private profile information leaks on POST request
- 6.5 CVE-2026-105964 Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS
- 4.3 CVE-2026-110311 Draft releases include attachment metadata from other repositories
- 5.3 CVE-2026-105661 Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users
- 6.3 CVE-2026-110494 Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases
- 4.3 CVE-2026-107686 Locked issues and comments still accept reactions through the web UI
- 8.1 CVE-2026-104627 Cross-Session OpenID Credential Linking Enables Account Takeover
- 7.5 CVE-2026-109553 VerifyCert maps SSH certificate principals onto other users' SSH public keys
- 6.5 CVE-2026-104633 A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenticated request
- 6.5 CVE-2026-105267 POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs
- medium CVE-2026-97626 Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs
- 4.3 CVE-2026-105268 Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments
- medium CVE-2026-101023 OAuth access tokens can be exchanged as refresh tokens
- 8.5 CVE-2026-96594 Stored XSS via Repository Media API
- 7.1 CVE-2026-86684 Push-mirror API checks local-path permission on the repository owner instead of the caller
- 8.1 CVE-2026-97208 Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy
- medium CVE-2026-95112 Algorithmic Complexity DoS in Issue Reference Parsing
- medium CVE-2026-103504 API team demotion does not reset unit permissions
- medium CVE-2026-79960 Deploy keys impersonate the repository owner in the hook pipeline
- 4.3 CVE-2026-104636 Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches
- 4.3 CVE-2026-96400 Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false
- 4.3 CVE-2026-96589 Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access
- 8.1 CVE-2026-96404 Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification
- 7.1 CVE-2026-96399 Uncaught Exception and Out-of-bounds Read results in Gitea crash
- 8.5 CVE-2026-89430 Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories
- 8.5 CVE-2026-101029 Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings
- 7.7 CVE-2026-101027 SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS
- high CVE-2026-70357 Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection
- 9.0 CVE-2026-95106 Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one
- 9.0 CVE-2026-103667 Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)
- 9.1 CVE-2026-103059 Built-in SSH server auth bypass via case-insensitive LIKE key lookup
- 8.7 CVE-2026-94205 Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull request author)
- medium CVE-2026-96580 Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation
- high CVE-2026-103670 Unapproved fork PR cancels trusted in-progress runs via run-level concurrency
- 9.0 CVE-2026-104626 Cancelled fork-PR Actions jobs are revived by later approval
- 9.0 CVE-2026-104632 Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun
- low GHSA-qg66-h68v-5x2h Arbitrary File Read via Path Traversal in gitea restore-repo
- 5.3 CVE-2026-78231 Unauthenticated Blind SSRF via OpenID Sign-In Verification
- 3.7 GHSA-m984-2424-x6vw Generic attachment downloads bypass draft-release visibility checks
- 7.7 CVE-2026-70406 Public-only tokens can read private head repositories via compare and pull request creation (incomplete fix of CVE-2026-58443)
- 5.4 CVE-2026-70396 Organization repository creation endpoint skips repository token scope
- 5.4 CVE-2026-70400 Repository migration skips public-only token guard for private repository creation
- 5.8 CVE-2026-70402 Permissive Git hook directory and script modes may allow local code execution as the Gitea service account
- medium CVE-2026-70407 Token Scope Bypass on `GET /api/v1/orgs`
- 8.8 CVE-2026-71184 Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)
- low CVE-2026-71301 Wiki-only members can read private pull request titles through markup preview
- low CVE-2026-73504 Unauthenticated artifact-to-repository oracle in raw Actions downloads
- 4.3 CVE-2026-73126 Gitea workflow badge bypasses API token scopes
- medium CVE-2026-73130 Unbounded gitignores repository-creation field enables linear template-read amplification
- 5.3 CVE-2026-73135 Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate
- 4.3 CVE-2026-73273 Package size quota bypass and unbounded memory read in the Maven checksum upload path
- 8.1 CVE-2026-60010 Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess
- 6.5 CVE-2026-60018 Authenticated DoS in OneDev migration via unbounded version response body
- 6.5 CVE-2026-60021 Authenticated DoS in GitLab migration via uncancelable version probe
- 6.5 CVE-2026-62925 Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory
- 6.5 CVE-2026-63021 Swift registry per-file 128KiB manifest guard bypassed by aggregation
- 6.3 CVE-2026-63792 Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)
- medium CVE-2026-66849 Package registry: restricted users can read packages of limited-visibility users (authorization bypass)
- low CVE-2026-66853 Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)
- 6.5 CVE-2026-66874 A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request HEAD posts a `skipped` commit status that counts as success
- 8.7 CVE-2026-66877 RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation
- 4.3 CVE-2026-67577 Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API
- high CVE-2026-68957 Restricted users can read limited-visibility users' issue titles and bodies through issue search
- 4.3 CVE-2026-68964 Restricted users can read limited-visibility users’ SSH and GPG keys through the API
- 9.9 CVE-2026-73802 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
- 8.1 CVE-2026-73278 WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)
- 8.8 CVE-2026-73535 2FA bypass and persistent account takeover via OpenID identity linking
- 7.5 CVE-2026-73539 Remote Code Execution via unescaped markup `Context` into external renderer argv
- 8.8 CVE-2026-73800 Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events
- 8.1 CVE-2026-73804 User-scoped tokens can mint unscoped HTTP signature API credentials
- 6.5 CVE-2026-73814 Admin repository collaborator can self-escalate to Owner and transfer the repository
- 9.8 CVE-2026-59774 Unauthenticated Arbitrary File Read can lead to RCE
- 8.1 CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
- high CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
- 4.9 CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
- 3.1 CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
- medium CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
- 5.9 CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
- 2.7 CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API
- 6.5 CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
- medium CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
- medium CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- 7.1 CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
- 4.3 CVE-2026-58425 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
- 5.3 CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint
- high CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
- 6.5 CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
- high CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
- 8.5 CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
- medium CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
- 5.9 CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
- low CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
- medium CVE-2026-56657 Gitea SSH Key Parser Denial of Service
- 4.3 CVE-2026-58431 Public-only API token restriction is not enforced on team API routes
- medium CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
- 8.1 CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
- 4.3 CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
- high CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
- 6.7 CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore
- 5.4 CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions
- 2.7 CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
- 7.5 CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
- low CVE-2026-58417 REST API exposes organization membership of private organizations to public
- 4.3 CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
- 6.3 CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
- 2.7 CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
- medium CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
- 9.6 CVE-2026-58443 Public-only repository tokens can update private PR head branches
- 6.5 CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
- 6.3 CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
- 6.8 CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
- medium CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
- high CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
- 9.6 CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
- 8.9 CVE-2026-58424 Permanent Fork PR Workflow Approval Gate Bypass
- 7.7 CVE-2026-58423 LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
- 7.6 CVE-2026-58422 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
- medium CVE-2026-58421 Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
- 4.3 CVE-2026-27761 API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
- 7.1 CVE-2026-28740 Git LFS object reuse allows non-Code access to authorize private source objects
- 7.1 CVE-2026-20779 TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
- 9.8 CVE-2026-20896 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
- 9.6 CVE-2026-22874 Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
- 8.7 CVE-2026-28737 Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
- 8.1 CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
- 8.1 CVE-2026-22555 API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
- 4.3 CVE-2026-27783 Missing repository-unit authorization on issue-template API endpoints
- medium CVE-2026-20706 Token scope bypass on web archive download endpoint (variant of PR #37698)
- 4.3 CVE-2026-25714 Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
- 8.5 CVE-2026-26231 Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
- 8.1 CVE-2026-28699 OAuth2 access token scope enforcement bypass via HTTP Basic authentication
- 8.2 CVE-2026-27771 Critical Vulnerability - Already emailed
- 8.1 CVE-2026-28744 Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
Breaking changes
- breaking BREAKING in 28.0.0
- breaking Fix(git)!: route Git network operations through an internal proxy and update egress settings () in 28.0.0
- breaking Feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs () in 28.0.0
- breaking BREAKING in 1.27.0
- breaking Feat(actions)!: improve support for reusable workflows (#37478) in 1.27.0
- breaking Remove external service dependencies in migration tests (#36866) in 1.27.0
- breaking Remove htmx (#37224) in 1.27.0
- breaking Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364) in 1.27.0
- breaking Remove SubmitEvent polyfill (#37276) in 1.27.0
- breaking Remove dead code identified by deadcode tool (#37271) in 1.27.0
- breaking Remove error returns from crypto random helpers and callers (#37240) in 1.27.0
- breaking Remove outdated RunUser logic (#37180) in 1.27.0
- breaking BREAKING in 1.26.3
- breaking fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041) in 1.26.3
- breaking fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465) in 1.26.2
- breaking Remove excessive quote from terraform instructions (#37424) (#37426) in 1.26.2
- breaking BREAKING in 1.26.0
- breaking Remove GET API registration-token (#36801) in 1.26.0
- breaking Remove striped tables in UI (#36509) in 1.26.0
- breaking Remove dead CSS rules (#37173) (#37177) in 1.26.0
- breaking Remove unnecessary function parameter (#35765) in 1.26.0
- breaking Remove undocumented support of signing key in the repository git configuration file (#36143) in 1.26.0
- breaking Remove mermaid margin workaround (#35732) in 1.26.0
- breaking Remove unused functions (#36672) in 1.26.0
- breaking Remove util.URLJoin and replace all callers with direct path concatenation (#36867) in 1.26.0
- breaking Remove nolint (#36252) in 1.26.0
- breaking Remove fomantic form module (#36222) in 1.26.0
- breaking Remove redundant linter rules (#36658) in 1.26.0
- breaking Remove and forbid @ts-expect-error (#36513) in 1.26.0
- breaking Remove i18n backport tool at the moment because of translation format changed (#36643) in 1.26.0
Security changes
- security Fixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in 28.0.0
- security SECURITY in 28.0.0
- security Fix(deps): update module golang.org/x/image to v0.45.0 [security] () in 28.0.0
- security Fix(deps): update module golang.org/x/mod to v0.40.0 [security] () in 28.0.0
- security Fix(deps): update dependency mermaid to v11.16.1 [security] () in 28.0.0
- security Fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] () in 28.0.0
- security Fix(deps): update dependency js-yaml to v5.2.2 [security] () in 28.0.0
- security Fix(deps): update module google.golang.org/grpc to v1.82.1 [security] () in 28.0.0
- security Fixes CVE-2026-60018: Authenticated DoS in OneDev migration via unbounded version response body in 1.27.3
- security Fixes CVE-2026-60021: Authenticated DoS in GitLab migration via uncancelable version probe in 1.27.3
- security SECURITY in 1.27.3
- security Fixes CVE-2026-73800: Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events in 1.27.2
- security SECURITY in 1.27.2
- security Fixes CVE-2026-60004: Remote Code Execution via diffpatch Git Hook Installation in 1.27.1
- security Fixes CVE-2026-59774: Unauthenticated Arbitrary File Read can lead to RCE in 1.27.1
- security SECURITY in 1.27.1
- security Fixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in 1.27.0
- security Use Content-Security-Policy: script nonce (#37232) in 1.27.0
- security SECURITY in 1.27.0
- security Fix: various security fixes (#38406) (#38426) in 1.27.0
- security Fix(security): harden access checks and migration validation (#38324) (#38400) in 1.27.0
- security Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786) in 1.27.0
- security Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219) in 1.27.0
- security Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097) in 1.27.0
- security Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904) in 1.27.0
- security Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806) in 1.27.0
- security Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662) in 1.27.0
- security SECURITY in 1.26.4
- security Fixes CVE-2026-20779: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in 1.26.3
- security SECURITY in 1.26.3
- security fix: Various security fixes (#38103) (#38151) in 1.26.3
- security fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829) in 1.26.3
- security Fixes CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in 1.26.2
- security SECURITY in 1.26.2
- security fix(security): enforce wiki git writes and LFS token access at request time (#37695) in 1.26.2
- security fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test in 1.26.2
- security Fix attachment Content-Security-Policy (#37455) (#37464) in 1.26.2
- security Fixes CVE-2026-28737: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in 1.26.0
- security Fixes CVE-2026-22555: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in 1.26.0
- security SECURITY in 1.26.0
- security Move X_FRAME_OPTIONS setting from cors to security section (#30256) in 1.26.0
- security Replace CSRF cookie with CrossOriginProtection (#36183) in 1.26.0
Deprecations
- deprecated Enhance(packages/npm): expand version metadata and support npm deprecate () in 28.0.0
- deprecated Update JS deps, fix deprecations (#36040) in 1.26.0
Every release in between
feature(oauth) Pre-register a builtin OAuth2 application for gitea-vscode (#39785) (#39801)
featureAllow custom watches to bypass on-mention email restriction (#39652) (#39837)
fixVarious bugs (#39661) (#39667)
fix(markup) Display MathML has no space below it (#39663) (#39668)
fixCorrect websocket notification for change password page (#39671) (#39670)
fix(webhook) Keep line breaks in Telegram rich messages (#39650) (#39677)
fixCorrect "go get" URL ssh scheme, fix form binding (#39674, #39528) (#39676)
fixOIDC discovery advertises unsupported id_token response_type (#39498) (#39689)
fix(deps) Update module golang.org/x/net to v0.60.0 [security] (#39695) (#39701)
fix(git) Leave reflog expiry to git's defaults (#39703) (#39711)
fix(actions) Settle cancelled reusable workflow runs stuck in cancelling (#39706) (#39717)
fix(git) Match git config values exactly when syncing (#39728) (#39729)
fix(actions) Harden log cursor, activity type and actor filter handling (#39721) (#39731)
fix(packages) Copy selected Debian installation values (#39718) (#39734)
fix(auth) Prevent competing remember-me token rotations (#39686) (#39688)
fix(packages/npm) Restore former tarball URLs (#39681) (#39749)
fix(issues) Allow selecting a tag in the issue Branch/Tag dropdown (#39747) (#39753)
fixValidate "state" for OpenID (#39642) (#39744)
fixCorrect label deletion and release attachment load (#39743) (#39752)
fix(markup) Resolve and proxy srcset links of elements (#39708) (#39756)
fix(lfs) Validate OID before building filesystem object path (#39762) (#39766)
fix(markup) Restore code copy newline strip and fix copying rendered blocks (#39755) (#39765)
fix(user) Don't match a commit with an empty author email to a user (#39777) (#39780)
fix(gitdiff) Unquote C-quoted paths from git diff-tree --raw (#39781) (#39783)
fix(actions) Fix schedule cleanup and default branch switch (#39740) (#39786)
fixSkip commit-graph write when fetching remote commits (#39798)
fix(webauthn) Accept unsolicited client extension outputs from WebKit clients (#39792) (#39806)
fix(pull) Fix code context of review comments on unchanged lines (#39799) (#39805)
fix(pull) Don't auto-detect empty pull requests as manually merged (#39807) (#39812)
fix(actions) Keep folded block scalars intact across serialization (#39787) (#39817)
fix(actions) Bound request body size in artifacts v4 twirp handlers (#39818) (#39822)
fixPrevent Gitea from crashing by notification panic (#39835)
fix(pull) Recover PRs whose recorded merge commit never reached the base repo (#39831) (#39840)
fixUse correct template variable on milestone page (#39834) (#39843)
fix(mailer) Reject incoming email tokens of users who cannot sign in (#39833) (#39841)
fixAdd missing checks to several handlers and models (#39839) (#39847)
feature(packages/npm) Improve npm client compatibility (#39434) (#39522)
fix(actions) Keep runs order after auto refresh (#39479) (#39481)
fixNpm route (#39488) (#39490)
fixCopy new access token to clipboard (#39496) (#39499)
fix(markup) Skip post-processing inside MathML (#39497) (#39502)
fix(markup) Don't escape ambiguous characters in MathML (#39493) (#39505)
fixAdd missing checks to several API and web handlers (#39501) (#39507)
fixHandle git branch name with special chars correctly (#39483) (#39515)
fixTrace git command correctly (#39520) (#39524)
fix(git) Reindex go-git storage when a concurrent repack removes packs (#39510) (#39534)
fix(oauth2) Allow users to approve scope changes (#38942) (#39521)
fix(api) Add index tiebreaker to commit status ordering (#39508) (#39525)
fix(git) Avoid unnecessary timers during language stats (#39531) (#39535)
fixUse READ COMMITTED transactions on MySQL and MariaDB (#39506) (#39537)
fix(markup) Use installed math fonts for MathML in Chromium (#39491) (#39547)
fix(git) Tolerate concurrent repacks in go-git storage (#39536) (#39556)
fixMake image captcha work with csp (#39555)
fixUse READ_COMMITTED_SNAPSHOT on MSSQL (#39512) (#39558)
fixMake navbar stopwatch button can show popup (#39562)
fix(actions) Restore pushes to protected branches (#39564) (#39567)
fix(api) Allow bots with pending password changes (#39551) (#39566)
fix(user) Restore organizations tab on user profile (#39577) (#39581)
fix(actions) Return 401 for unregistered runner (#39578) (#39585)
fix(markup) Link team mentions that use a different org name case (#39436) (#39588)
fix(httpcache) Raw files return 304 after a change when the new commit is older (#39435) (#39591)
fix(git) Return no submodule web link when the URL cannot be parsed (#39274) (#39592)
fix(pull) Fetch PR head refs instead of pushing them (#39603) (#39607)
fixMigrate broken team authorize access mode (#39579) (#39580)
fix(actions) Refresh reusable caller status when children are skipped (#39589) (#39609)
fixMake "edit pr title & target branch" get correct branch (#39612) (#39621)
fix(egress) Expose more ranges as restricted rather than reserved (#39560) (#39624)
fix(web) Normalize content for edit history diff and fix comment history dropdown (#39616) (#39627)
fixCorrect RemoveWithRetry error handling (#39619) (#39626)
fix(pull) Refresh commits behind when an AGit pull request is updated (#39613) (#39625)
fix(models) Chunk commit status queries to avoid SQLite expression depth limit (#39611) (#39638)
fixShow "merge" form for empty PR (#39640) (#39645)
otherReturn 401 for unregistered runner (#39599)
securityFixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
breakingBREAKING
breakingFix(git)!: route Git network operations through an internal proxy and update egress settings ()
breakingFeat(actions)!: add RUN_RETENTION_DAYS to delete old action runs ()
securitySECURITY
featureFeat(actions): update actionslib, support self:, misc fixes ()
featureFeat(api): list all packages for site administrators ()
featureFeat: manage bot accounts from the admin UI, API and CLI ()
featureFeat(user): Personal access tokens can be regenerated ()
featureFeat(actions): support $/ prefix in reusable workflow uses: ()
featureFeat(actions): add force-cancel workflow run API ()
featureFeat(licenses): support REUSE specification in licenses ()
featureFeat(api): add project APIs ()
featureFeat(webhook): fire repository event on repo rename ()
featureFeat: admin impersonates a user ()
featureFeat(actions): add build queue view ()
featureFeat(setting): add shared [redis] section as default for redis-backed subsystems ()
featureFeat(repo): prioritize well-known READMEs and optimize discovery ()
featureFeat(actions): implement adaptive auto-refresh for workflow runs list ()
featureFeat(auth): add disable-2fa command ()
featureFeat: Add audit logging ()
featureFeat(repo): add quick repository switcher to repo header ()
featureFeat(repo): support file exclusion logic in .gitea/template in template generation ()
featureFeat(web): Add org removal functionality to admin user details page ()
featureFeat: add watch options ()
featureFeat: add deploy tokens ()
featureFeat(diff): Add search and extension filter to diff sidebar ()
featureFeat: Replace SSE with WebSocket for UI notifications ()
featureFeat(actions): Add artifact preview in Actions run view ()
featureFeat(packages): add support for uploading helm provenance files ()
featureFeat: Add support for dynamic matrix evaluation in Gitea Actions workflows ()
featureFeat: Add max-parallel Support for Gitea Actions ()
featureFeat(actions): Add Actions API endpoints for workflow run management and logs ()
featureFeat: Add block on pending codeowner reviews branch protection ()
deprecatedEnhance(packages/npm): expand version metadata and support npm deprecate ()
securityFix(deps): update module golang.org/x/image to v0.45.0 [security] ()
securityFix(deps): update module golang.org/x/mod to v0.40.0 [security] ()
securityFix(deps): update dependency mermaid to v11.16.1 [security] ()
securityFix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] ()
securityFix(deps): update dependency js-yaml to v5.2.2 [security] ()
+198 more items in the release notessecurityFixes CVE-2026-60018: Authenticated DoS in OneDev migration via unbounded version response body
securityFixes CVE-2026-60021: Authenticated DoS in GitLab migration via uncancelable version probe
securitySECURITY
fixfix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058)
fixfix(attachments): enforce owning repository path (#39048) (#39077)
fixfix(markup): enforce same-repository issue access (#39045) (#39054)
fixfix(actions): verify raw artifact signatures first (#39049) (#39053)
fixfix(api): hide limited users from restricted viewers (#39004) (#39039)
fixfix(repo): limit gitignore template selections (#39027) (#39040)
fixfix(migrations): cancel GitLab version probes (#39023) (#39035)
fixfix(packages): limit Swift package manifests (#39025) (#39032)
fixfix(migrations): bound OneDev version responses (#39024) (#39033)
fixfix(packages): limit Maven checksum uploads (#39028) (#39031)
fixfix(packages): bound Alpine metadata entries (#39026) (#39029)
fixfix(actions): enforce fork pull request trust boundaries (#39005) (#39018)
fixfix(git): restrict hook permissions (#39008) (#39016)
fixfix(api): enforce repository creation token authorization (#39007) (#39014)
fixfix(api): enforce public-only scope for compare heads (#39006) (#39013)
fixfix(repo): hide repositories of hidden owners (#39009) (#39012)
fixfix: avoid enumerating every public repository in issue search (#38992) (#39000)
otherrefactor: private endpoints (#38964) (#38965)
featureenhance: add permalinks to pull request reviews (#38849) (#39036)
fixfix: add missing query parameters on runner list page (#39163)
fixfix(actions): keep step-level continue-on-error expressions unevaluated (#39141) (#39148
fixfix(packages): preserve SemVer prerelease identifiers in Swift Registry (#39156) (#39158)
fixfix(repo): prevent MarkAsBrokenEmpty when repository is being migrated (#39091) (#39092)
fixfix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086)
fixfix(pull): keep the merged state in sync with git (#39062) (#39118)
fixfix(pull): name the head repository in default compare links (#39075) (#39079)
fixfix(git): parse co-author trailers that are not RFC 5322 addresses (#39076) (#39081)
fixfix(actions): show "Complete job" logs when the last step is skipped (#38939) (#39003)
fixfix(actions): Fix how jobs in matrixes are grouped (#38980) (#38998)
fixfix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996)
fixfix: honor environment variables during install (#38974) (#38976)
fixfix: grant limited-org unit read access to authenticated non-members (#38871) (#38963)
fixfix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956) (#38961)
fixfix(actions): drop wrapper span around the action status icon (#38957) (#38959)
fixfix(issues): sort scoped labels by exclusive order in dropdowns (#38893) (#38954)
fixfix(indexer): correct bleve indexer token filters (#38853) (#38951)
fixfix: make "login_name" field optional for API edit user (#38917) (#38945)
+8 more items in the release notessecurityFixes CVE-2026-73800: Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events
securitySECURITY
fixFix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
otherRefactor: external render (#38885) (#38898)
fixFix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
otherRefactor: markup render (#38864) (#38869)
fixFix(deps): update dependency mermaid to v11.16.1 (#38816)
fixFix(auth): set WebAuthn user verification per request (#38805) (#38810)
fixFix: render highlight language (#38793) (#38795)
otherENHANCEMENTS
featureenhance: add missing npm package metadata properties (#38826) (#38831)
otherBUGFIXES
fixfix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
fixfix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901)
fixfix(lfs): accept successful transfer responses (#38866) (#38875)
fixfix(packages): ignore nested Package.swift (#38788) (#38836)
fixfix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
fixfix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
fixfix(migration): migration deletion returned json redirection (#38796) (#38825)
fixfix(ui): change underlines to default browser style (#38819) (#38823)
fixfix(actions): allow cancelling runs without running jobs (#35842) (#38812)
fixfix(actions): evaluate each ${{ }} part on its own (#38754) (#38797)
fixfix(actions): write an action task report in one transaction (#38792) (#38794)
fixfix: markup link (#38764) (#38765)
fixfix: set a minio part size when the content size is unknown (#38753) (#38755)
fixfix: bad path escape in subpath archive download (#38749) (#38750)
fixfix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744)
fixfix(markdown): fix double strikethough on code (#38707) (#38729)
fixfix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722)
fixfix: correct full url when using sub-path (#38712) (#38716)
fixfix: avoid markup render panic (#38698) (#38703)
fixfix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
fixfix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)
fixfix(migrations): use all configured GitHub tokens (#38841) (#38846)
securityFixes CVE-2026-60004: Remote Code Execution via diffpatch Git Hook Installation
securityFixes CVE-2026-59774: Unauthenticated Arbitrary File Read can lead to RCE
securitySECURITY
fixFix: orgmode render include path (#38642) (#38645)
fixFix: git patch apply (#38637) (#38638)
fixfix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
fixfix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
fixfix: make Actions log parser support multiple line message encoding (#38659) (#38664)
fixfix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
fixfix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)
fixfix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
fixfix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
fixfix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
fixfix(actions): correctness and hardening fixes (#38518) (#38631)
fixfix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
fixfix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
fixfix(webhook): remove slack channel name check (#38608) (#38612)
fixfix: download dropdown menu clipped on the branches page (#38604) (#38609)
fixfix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
fixfix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
fixfix(file-tree): handle submodule links and missing view container (#38033) (#38589)
fixfix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
fixfix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
fixfix: branch protection user list (#38570) (#38584)
fixfix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
fixfix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
fixfix(actions): support matrix when evaluating workflow if expression (#38474) (#38557)
fixfix(actions): align status icon span for Safari rendering (#38558) (#38562)
fixfix: revert git clone http redirection forbidden (#38530) (#38545)
fixfix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
fixfix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
fixfix: make the merge box button red if some checks fail (#38508) (#38516)
fixfix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
fixfix: make commit message merge correctly (#38490) (#38502)
fixfix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
fixfix(actions): make cancelled() work in job if evaluation (#38495) (#38497)
fixfix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
fixfix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
fixfix: full file highlighting for git diff with CR char (#38484) (#38491)
fixfix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
+13 more items in the release notessecurityFixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
breakingBREAKING
breakingFeat(actions)!: improve support for reusable workflows (#37478)
securityUse Content-Security-Policy: script nonce (#37232)
securitySECURITY
securityFix: various security fixes (#38406) (#38426)
securityFix(security): harden access checks and migration validation (#38324) (#38400)
securityFix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
featureFeat(actions): add workflow status badge modal (#38196)
featureFeat(actions): support owner-level and global scoped workflows (#38154)
featureFeat(api): support ref suffixes in compare (#38148)
featureFeat(actions): implement jobs..continue-on-error (#38100)
featureFeat(actions): show run status on browser tab favicon (#38071)
featureFeat(api): add token introspection and self-deletion endpoint (#37995)
featureFeat(api): add q parameter to list branches API for server-side filtering (#37982)
featureFeat(repo): split repository creation limit into user and org scopes (#37872)
featureFeat(actions): bulk delete, disable and enable runners in admin UI (#37869)
featureFeat(actions): List workflows that were executed once but got removed from the default branch (#37835)
featureFeat(org): add team visibility so org members can discover teams (#37680)
featureFeat: add raw diff/patch endpoint for repository comparisons (#37632)
featureFeat: Add avatar stacks (#37594)
featureFeat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
featureFeat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
featureSupport for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
featureFeat(orgs): Add search bar for organization members tab page (#37347)
featureFeat(api): Add assignees APIs (#37330)
featureFeat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
featureAdd project column picker to issue and pull request sidebar (#37037)
featureAllow multiple projects per issue and pull requests (#36784)
securityFix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
securityFix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
securityFix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
breakingRemove external service dependencies in migration tests (#36866)
breakingRemove htmx (#37224)
securityFix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
securityFix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
breakingRemove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
breakingRemove SubmitEvent polyfill (#37276)
breakingRemove dead code identified by deadcode tool (#37271)
breakingRemove error returns from crypto random helpers and callers (#37240)
+252 more items in the release notessecuritySECURITY
fixfix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)
otherBUGFIXES
fixfix: walk git log context error handling (#38182) (#38185)
securityFixes CVE-2026-20779: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
breakingBREAKING
breakingfix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)
securitySECURITY
fixfix(hostmatcher): patch incorrect private list (#38170) (#38173)
securityfix: Various security fixes (#38103) (#38151)
fixfix: Various sec fixes (#38108) (#38147)
fixfix: allow git clone of private repos with anonymous code access (#38074) (#38146)
fixfix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
fixfix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
fixfix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
fixfix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
fixfix: bound CODEOWNERS regex match time (#38011) (#38025)
fixfix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
securityfix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)
otherAPI
featurefeat(api): add Link header in ListForks (#38052) (#38063)
otherBUGFIXES
fixfix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
fixfix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
fixfix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
fixfix: parse HEAD ref (#38119)
fixfix: git cmd (#38084) (#38087)
fixfix(releases): generate notes for initial tag (#37697) (#37986)
fixfix(actions): return 404 when job log blob is missing (#38003) (#38004)
fixfix(actions): exclude workflow_call from workflow trigger detection (#37894) (#37899)
fixfix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
fixfix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
fixfix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892)
fixfix: http content file render (#37850) (#37856)
fixfix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
fixfix: Fix issue target branch selection for non-collaborators (#36916) (#38164)
otherBUILD
fixfix(deps): update @playwright/test to 1.60.0 (#38144)
otherci: add tools/ci-tools.ts for the PR labeler workflow (#37831)
fixfix(build): swagger css import (#37801) (#37803)
securityFixes CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
securitySECURITY
fixfix(permissions): Fix reading permission (#37769)
fixfix(actions): make artifact signature payloads unambiguous (#37707)
fixfix: Unify public-only token filtering in API queries and repo access checks (#37118)
fixfix: Add missed token scope checking (#37735)
fixfix(oauth): bind token exchanges to the original client request (#37704)
fixfix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
fixfix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
securityfix(security): enforce wiki git writes and LFS token access at request time (#37695)
featurefeat(api): encrypt AWS creds (#37679)
securityfix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
fixfix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
fixfix(git): Fix smart http request scope bug (#37583)
fixFix basic auth bug (#37503)
fixFix allow maintainer edit permission check (#37479) (#37484)
fixFix URL sanitization to handle schemeless credentials (#37440) (#37471)
securityFix attachment Content-Security-Policy (#37455) (#37464)
fixfix(pull): handle empty pull request files view to allow reviews (#37783)
fixfix(markup): make RenderString never fail (#37779)
fixfix: add natural sort to sortTreeViewNodes (#37772)
fixfix: package creation unique conflict (#37774)
breakingfix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
fixfix: Allow direct commits for unprotected files with push restrictions (#37657)
fixfix(actions): wrong assumption that run id always >= job id (#37737)
fixfix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
fixfix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
fixfix(repo): /generate must sync the branch table for the new repo (#37693)
fixfix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
fixfix show correct mergebase
fixfix: make clone URL respect public URL detection setting (#37615)
fixfix: "run as root" check (#37622)
fixfix: treat email addresses case-insensitively (#37600)
fixfix(actions): fix blank lines after ::endgroup:: (#37597)
fixfix(actions): report individual step status in workflow job API response (#37592)
fixfix: Invalid UTF-8 commit messages in JSON API responses (#37542)
fixfix: use consistent GetUser family functions (#37553)
fixfix(api): return 409 message instead of empty JSON for wrong commit id (#37572)
fixfix(actions): prevent panic when workflow contains null jobs (#37570)
breakingRemove excessive quote from terraform instructions (#37424) (#37426)
+18 more items in the release notesotherBUGFIXES
featureAdd event.schedule context for schedule actions task (#37320) (#37348)
fixFix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#37324) (#37344)
otherUse modern "git update-index --cacheinfo" syntax to support more file names (#37338) (#37343)
fixFix URL related escaping for oauth2 (#37334) (#37340)
otherWhen the requested arch rpm is missing fall back to noarch (#37236) (#37339)
fixFix actions concurrency groups cross-branch leak (#37311) (#37331)
fixFix bug when accessing user badges (#37321) (#37329)
fixFix AppFullLink (#37325) (#37328)
fixFix container auth for public instance (#37290) (#37294)
otherEnhance GetActionWorkflow to support fallback references (#37189) (#37283)
fixFix vite manifest update masking build errors (#37279) (#37310)
fixFix Mermaid diagrams failing when node labels contain line breaks (#37296) (#37299)
otherUse TriggerEvent instead of Event in workflow runs API response for scheduled runs (#37288) #37360
featureAdd URL to Learn more about blocking a user. (#37355) #37367
fixFix button layout shift when collapsing file tree in editor (#37363) #37375
fixFix org team assignee/reviewer lookups for team member permissions (#37365) #37391
fixFix repo init README EOL (#37388) #37399
fixFix: dump with default zip type produces uncompressed zip (#37401)#37402
securityFixes CVE-2026-28737: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
securityFixes CVE-2026-22555: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
breakingBREAKING
breakingRemove GET API registration-token (#36801)
securitySECURITY
featureAdd terraform state registry (#36710)
featureAdd keyboard shortcuts for repository file and code search (#36416)
featureAdd support for archive-upload rpc (#36391)
featureAdd ability to download subpath archive (#36371)
featureAdd workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
featureAdd "Go to file", "Delete Directory" to repo file list page (#35911)
featureIntroduce "config edit-ini" sub command to help maintaining INI config file (#35735)
featureAdd button to re-run failed jobs in Actions (#36924)
featureAdd summary to action runs view (#36883)
featureAdd user badges (#36752)
featureAdd configurable permissions for Actions automatic tokens (#36173)
featureAdd per-runner "Disable/Pause" (#36776)
featureAdd render cache for SVG icons (#36863)
featureImplement logout redirection for reverse proxy auth setups (#36085) (#37171)
featureAdds option to force update new branch in contents routes (#35592)
featureAdd viewer controller for mermaid (zoom, drag) (#36557)
featureAdd code editor setting dropdowns (#36534)
featureAdd elk layout support to mermaid (#36486)
featureAdd resolve/unresolve review comment API endpoints (#36441)
featureAllow configuring default PR base branch (fixes #36412) (#36425)
featureAdd support for RPM Errata (updateinfo.xml) (#37125)
featureAdd actions.WORKFLOW_DIRS setting (#36619)
securityMove X_FRAME_OPTIONS setting from cors to security section (#30256)
breakingRemove striped tables in UI (#36509)
breakingRemove dead CSS rules (#37173) (#37177)
securityReplace CSRF cookie with CrossOriginProtection (#36183)
breakingRemove unnecessary function parameter (#35765)
breakingRemove undocumented support of signing key in the repository git configuration file (#36143)
breakingRemove mermaid margin workaround (#35732)
breakingRemove unused functions (#36672)
breakingRemove util.URLJoin and replace all callers with direct path concatenation (#36867)
breakingRemove nolint (#36252)
breakingRemove fomantic form module (#36222)
deprecatedUpdate JS deps, fix deprecations (#36040)
breakingRemove redundant linter rules (#36658)
+358 more items in the release notes