Gitea 1.26.1 → 28.2.0
10 releases · 16 breaking changes · 37 security fixes · 136 advisories fixed
37security16breaking1deprecated58feature231fix
Vulnerabilities fixed by this upgrade
- low CVE-2026-97859 API routes for user social graph, keys, and starred repos bypass private visibility check
- low CVE-2026-107618 Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`
- 3.5 CVE-2026-97204 DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels
- 4.3 CVE-2026-109844 Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade
- 6.5 CVE-2026-110324 Private profile information leaks on POST request
- 6.5 CVE-2026-105964 Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS
- 4.3 CVE-2026-110311 Draft releases include attachment metadata from other repositories
- 5.3 CVE-2026-105661 Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users
- 6.3 CVE-2026-110494 Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases
- 4.3 CVE-2026-107686 Locked issues and comments still accept reactions through the web UI
- 8.1 CVE-2026-104627 Cross-Session OpenID Credential Linking Enables Account Takeover
- 7.5 CVE-2026-109553 VerifyCert maps SSH certificate principals onto other users' SSH public keys
- 6.5 CVE-2026-104633 A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenticated request
- 6.5 CVE-2026-105267 POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs
- medium CVE-2026-97626 Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs
- 4.3 CVE-2026-105268 Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments
- medium CVE-2026-101023 OAuth access tokens can be exchanged as refresh tokens
- 8.5 CVE-2026-96594 Stored XSS via Repository Media API
- 7.1 CVE-2026-86684 Push-mirror API checks local-path permission on the repository owner instead of the caller
- 8.1 CVE-2026-97208 Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy
- medium CVE-2026-95112 Algorithmic Complexity DoS in Issue Reference Parsing
- medium CVE-2026-103504 API team demotion does not reset unit permissions
- medium CVE-2026-79960 Deploy keys impersonate the repository owner in the hook pipeline
- 4.3 CVE-2026-104636 Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches
- 4.3 CVE-2026-96400 Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false
- 4.3 CVE-2026-96589 Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access
- 8.1 CVE-2026-96404 Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification
- 7.1 CVE-2026-96399 Uncaught Exception and Out-of-bounds Read results in Gitea crash
- 8.5 CVE-2026-89430 Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories
- 8.5 CVE-2026-101029 Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings
- 7.7 CVE-2026-101027 SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS
- high CVE-2026-70357 Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection
- 9.0 CVE-2026-95106 Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one
- 9.0 CVE-2026-103667 Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)
- 9.1 CVE-2026-103059 Built-in SSH server auth bypass via case-insensitive LIKE key lookup
- 8.7 CVE-2026-94205 Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull request author)
- medium CVE-2026-96580 Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation
- high CVE-2026-103670 Unapproved fork PR cancels trusted in-progress runs via run-level concurrency
- 9.0 CVE-2026-104626 Cancelled fork-PR Actions jobs are revived by later approval
- 9.0 CVE-2026-104632 Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun
- low GHSA-qg66-h68v-5x2h Arbitrary File Read via Path Traversal in gitea restore-repo
- 5.3 CVE-2026-78231 Unauthenticated Blind SSRF via OpenID Sign-In Verification
- 3.7 GHSA-m984-2424-x6vw Generic attachment downloads bypass draft-release visibility checks
- 7.7 CVE-2026-70406 Public-only tokens can read private head repositories via compare and pull request creation (incomplete fix of CVE-2026-58443)
- 5.4 CVE-2026-70396 Organization repository creation endpoint skips repository token scope
- 5.4 CVE-2026-70400 Repository migration skips public-only token guard for private repository creation
- 5.8 CVE-2026-70402 Permissive Git hook directory and script modes may allow local code execution as the Gitea service account
- medium CVE-2026-70407 Token Scope Bypass on `GET /api/v1/orgs`
- 8.8 CVE-2026-71184 Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)
- low CVE-2026-71301 Wiki-only members can read private pull request titles through markup preview
- low CVE-2026-73504 Unauthenticated artifact-to-repository oracle in raw Actions downloads
- 4.3 CVE-2026-73126 Gitea workflow badge bypasses API token scopes
- medium CVE-2026-73130 Unbounded gitignores repository-creation field enables linear template-read amplification
- 5.3 CVE-2026-73135 Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate
- 4.3 CVE-2026-73273 Package size quota bypass and unbounded memory read in the Maven checksum upload path
- 8.1 CVE-2026-60010 Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess
- 6.5 CVE-2026-60018 Authenticated DoS in OneDev migration via unbounded version response body
- 6.5 CVE-2026-60021 Authenticated DoS in GitLab migration via uncancelable version probe
- 6.5 CVE-2026-62925 Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory
- 6.5 CVE-2026-63021 Swift registry per-file 128KiB manifest guard bypassed by aggregation
- 6.3 CVE-2026-63792 Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)
- medium CVE-2026-66849 Package registry: restricted users can read packages of limited-visibility users (authorization bypass)
- low CVE-2026-66853 Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)
- 6.5 CVE-2026-66874 A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request HEAD posts a `skipped` commit status that counts as success
- 8.7 CVE-2026-66877 RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation
- 4.3 CVE-2026-67577 Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API
- high CVE-2026-68957 Restricted users can read limited-visibility users' issue titles and bodies through issue search
- 4.3 CVE-2026-68964 Restricted users can read limited-visibility users’ SSH and GPG keys through the API
- 5.9 CVE-2026-78433 Attachments created before the January 2026 cutoff skip the cross repository check entirely, and permission is then evaluated against the repository named in the URL rather than the repository owning the attachment, so a private repository's attachment is served through any public repository's path
- 9.9 CVE-2026-73802 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
- 8.1 CVE-2026-73278 WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)
- 8.8 CVE-2026-73535 2FA bypass and persistent account takeover via OpenID identity linking
- 7.5 CVE-2026-73539 Remote Code Execution via unescaped markup `Context` into external renderer argv
- 8.8 CVE-2026-73800 Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events
- 8.1 CVE-2026-73804 User-scoped tokens can mint unscoped HTTP signature API credentials
- 6.5 CVE-2026-73814 Admin repository collaborator can self-escalate to Owner and transfer the repository
- 9.8 CVE-2026-59774 Unauthenticated Arbitrary File Read can lead to RCE
- 8.1 CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
- high CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
- 4.9 CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
- 3.1 CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
- medium CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
- 5.9 CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
- 2.7 CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API
- 6.5 CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
- medium CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
- medium CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- 7.1 CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
- 4.3 CVE-2026-58425 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
- 5.3 CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint
- high CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
- 6.5 CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
- high CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
- 8.5 CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
- medium CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
- 5.9 CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
- low CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
- medium CVE-2026-56657 Gitea SSH Key Parser Denial of Service
- 4.3 CVE-2026-58431 Public-only API token restriction is not enforced on team API routes
- medium CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
- 8.1 CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
- 4.3 CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
- high CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
- 6.7 CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore
- 5.4 CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions
- 2.7 CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
- 7.5 CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
- low CVE-2026-58417 REST API exposes organization membership of private organizations to public
- 4.3 CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
- 6.3 CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
- 2.7 CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
- medium CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
- 9.6 CVE-2026-58443 Public-only repository tokens can update private PR head branches
- 6.5 CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
- 6.3 CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
- 6.8 CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
- medium CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
- high CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
- 9.6 CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
- 8.9 CVE-2026-58424 Permanent Fork PR Workflow Approval Gate Bypass
- 7.7 CVE-2026-58423 LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
- 7.6 CVE-2026-58422 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
- medium CVE-2026-58421 Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
- 4.3 CVE-2026-27761 API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
- 7.1 CVE-2026-28740 Git LFS object reuse allows non-Code access to authorize private source objects
- 7.1 CVE-2026-20779 TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
- 9.8 CVE-2026-20896 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
- 9.6 CVE-2026-22874 Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
- 8.1 CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
- 4.3 CVE-2026-27783 Missing repository-unit authorization on issue-template API endpoints
- medium CVE-2026-20706 Token scope bypass on web archive download endpoint (variant of PR #37698)
- 4.3 CVE-2026-25714 Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
- 8.5 CVE-2026-26231 Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
- 8.1 CVE-2026-28699 OAuth2 access token scope enforcement bypass via HTTP Basic authentication
- 8.2 CVE-2026-27771 Critical Vulnerability - Already emailed
- 8.1 CVE-2026-28744 Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
Breaking changes
- breaking BREAKING in 28.0.0
- breaking Fix(git)!: route Git network operations through an internal proxy and update egress settings () in 28.0.0
- breaking Feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs () in 28.0.0
- breaking BREAKING in 1.27.0
- breaking Feat(actions)!: improve support for reusable workflows (#37478) in 1.27.0
- breaking Remove external service dependencies in migration tests (#36866) in 1.27.0
- breaking Remove htmx (#37224) in 1.27.0
- breaking Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364) in 1.27.0
- breaking Remove SubmitEvent polyfill (#37276) in 1.27.0
- breaking Remove dead code identified by deadcode tool (#37271) in 1.27.0
- breaking Remove error returns from crypto random helpers and callers (#37240) in 1.27.0
- breaking Remove outdated RunUser logic (#37180) in 1.27.0
- breaking BREAKING in 1.26.3
- breaking fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041) in 1.26.3
- breaking fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465) in 1.26.2
- breaking Remove excessive quote from terraform instructions (#37424) (#37426) in 1.26.2
Security changes
- security Fixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in 28.0.0
- security SECURITY in 28.0.0
- security Fix(deps): update module golang.org/x/image to v0.45.0 [security] () in 28.0.0
- security Fix(deps): update module golang.org/x/mod to v0.40.0 [security] () in 28.0.0
- security Fix(deps): update dependency mermaid to v11.16.1 [security] () in 28.0.0
- security Fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] () in 28.0.0
- security Fix(deps): update dependency js-yaml to v5.2.2 [security] () in 28.0.0
- security Fix(deps): update module google.golang.org/grpc to v1.82.1 [security] () in 28.0.0
- security Fixes CVE-2026-60018: Authenticated DoS in OneDev migration via unbounded version response body in 1.27.3
- security Fixes CVE-2026-60021: Authenticated DoS in GitLab migration via uncancelable version probe in 1.27.3
- security SECURITY in 1.27.3
- security Fixes CVE-2026-73800: Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events in 1.27.2
- security SECURITY in 1.27.2
- security Fixes CVE-2026-60004: Remote Code Execution via diffpatch Git Hook Installation in 1.27.1
- security Fixes CVE-2026-59774: Unauthenticated Arbitrary File Read can lead to RCE in 1.27.1
- security SECURITY in 1.27.1
- security Fixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in 1.27.0
- security Use Content-Security-Policy: script nonce (#37232) in 1.27.0
- security SECURITY in 1.27.0
- security Fix: various security fixes (#38406) (#38426) in 1.27.0
- security Fix(security): harden access checks and migration validation (#38324) (#38400) in 1.27.0
- security Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786) in 1.27.0
- security Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219) in 1.27.0
- security Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097) in 1.27.0
- security Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904) in 1.27.0
- security Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806) in 1.27.0
- security Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662) in 1.27.0
- security SECURITY in 1.26.4
- security Fixes CVE-2026-20779: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in 1.26.3
- security SECURITY in 1.26.3
- security fix: Various security fixes (#38103) (#38151) in 1.26.3
- security fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829) in 1.26.3
- security Fixes CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in 1.26.2
- security SECURITY in 1.26.2
- security fix(security): enforce wiki git writes and LFS token access at request time (#37695) in 1.26.2
- security fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test in 1.26.2
- security Fix attachment Content-Security-Policy (#37455) (#37464) in 1.26.2
Deprecations
- deprecated Enhance(packages/npm): expand version metadata and support npm deprecate () in 28.0.0
Every release in between
feature(oauth) Pre-register a builtin OAuth2 application for gitea-vscode (#39785) (#39801)
featureAllow custom watches to bypass on-mention email restriction (#39652) (#39837)
fixVarious bugs (#39661) (#39667)
fix(markup) Display MathML has no space below it (#39663) (#39668)
fixCorrect websocket notification for change password page (#39671) (#39670)
fix(webhook) Keep line breaks in Telegram rich messages (#39650) (#39677)
fixCorrect "go get" URL ssh scheme, fix form binding (#39674, #39528) (#39676)
fixOIDC discovery advertises unsupported id_token response_type (#39498) (#39689)
fix(deps) Update module golang.org/x/net to v0.60.0 [security] (#39695) (#39701)
fix(git) Leave reflog expiry to git's defaults (#39703) (#39711)
fix(actions) Settle cancelled reusable workflow runs stuck in cancelling (#39706) (#39717)
fix(git) Match git config values exactly when syncing (#39728) (#39729)
fix(actions) Harden log cursor, activity type and actor filter handling (#39721) (#39731)
fix(packages) Copy selected Debian installation values (#39718) (#39734)
fix(auth) Prevent competing remember-me token rotations (#39686) (#39688)
fix(packages/npm) Restore former tarball URLs (#39681) (#39749)
fix(issues) Allow selecting a tag in the issue Branch/Tag dropdown (#39747) (#39753)
fixValidate "state" for OpenID (#39642) (#39744)
fixCorrect label deletion and release attachment load (#39743) (#39752)
fix(markup) Resolve and proxy srcset links of elements (#39708) (#39756)
fix(lfs) Validate OID before building filesystem object path (#39762) (#39766)
fix(markup) Restore code copy newline strip and fix copying rendered blocks (#39755) (#39765)
fix(user) Don't match a commit with an empty author email to a user (#39777) (#39780)
fix(gitdiff) Unquote C-quoted paths from git diff-tree --raw (#39781) (#39783)
fix(actions) Fix schedule cleanup and default branch switch (#39740) (#39786)
fixSkip commit-graph write when fetching remote commits (#39798)
fix(webauthn) Accept unsolicited client extension outputs from WebKit clients (#39792) (#39806)
fix(pull) Fix code context of review comments on unchanged lines (#39799) (#39805)
fix(pull) Don't auto-detect empty pull requests as manually merged (#39807) (#39812)
fix(actions) Keep folded block scalars intact across serialization (#39787) (#39817)
fix(actions) Bound request body size in artifacts v4 twirp handlers (#39818) (#39822)
fixPrevent Gitea from crashing by notification panic (#39835)
fix(pull) Recover PRs whose recorded merge commit never reached the base repo (#39831) (#39840)
fixUse correct template variable on milestone page (#39834) (#39843)
fix(mailer) Reject incoming email tokens of users who cannot sign in (#39833) (#39841)
fixAdd missing checks to several handlers and models (#39839) (#39847)
feature(packages/npm) Improve npm client compatibility (#39434) (#39522)
fix(actions) Keep runs order after auto refresh (#39479) (#39481)
fixNpm route (#39488) (#39490)
fixCopy new access token to clipboard (#39496) (#39499)
fix(markup) Skip post-processing inside MathML (#39497) (#39502)
fix(markup) Don't escape ambiguous characters in MathML (#39493) (#39505)
fixAdd missing checks to several API and web handlers (#39501) (#39507)
fixHandle git branch name with special chars correctly (#39483) (#39515)
fixTrace git command correctly (#39520) (#39524)
fix(git) Reindex go-git storage when a concurrent repack removes packs (#39510) (#39534)
fix(oauth2) Allow users to approve scope changes (#38942) (#39521)
fix(api) Add index tiebreaker to commit status ordering (#39508) (#39525)
fix(git) Avoid unnecessary timers during language stats (#39531) (#39535)
fixUse READ COMMITTED transactions on MySQL and MariaDB (#39506) (#39537)
fix(markup) Use installed math fonts for MathML in Chromium (#39491) (#39547)
fix(git) Tolerate concurrent repacks in go-git storage (#39536) (#39556)
fixMake image captcha work with csp (#39555)
fixUse READ_COMMITTED_SNAPSHOT on MSSQL (#39512) (#39558)
fixMake navbar stopwatch button can show popup (#39562)
fix(actions) Restore pushes to protected branches (#39564) (#39567)
fix(api) Allow bots with pending password changes (#39551) (#39566)
fix(user) Restore organizations tab on user profile (#39577) (#39581)
fix(actions) Return 401 for unregistered runner (#39578) (#39585)
fix(markup) Link team mentions that use a different org name case (#39436) (#39588)
fix(httpcache) Raw files return 304 after a change when the new commit is older (#39435) (#39591)
fix(git) Return no submodule web link when the URL cannot be parsed (#39274) (#39592)
fix(pull) Fetch PR head refs instead of pushing them (#39603) (#39607)
fixMigrate broken team authorize access mode (#39579) (#39580)
fix(actions) Refresh reusable caller status when children are skipped (#39589) (#39609)
fixMake "edit pr title & target branch" get correct branch (#39612) (#39621)
fix(egress) Expose more ranges as restricted rather than reserved (#39560) (#39624)
fix(web) Normalize content for edit history diff and fix comment history dropdown (#39616) (#39627)
fixCorrect RemoveWithRetry error handling (#39619) (#39626)
fix(pull) Refresh commits behind when an AGit pull request is updated (#39613) (#39625)
fix(models) Chunk commit status queries to avoid SQLite expression depth limit (#39611) (#39638)
fixShow "merge" form for empty PR (#39640) (#39645)
otherReturn 401 for unregistered runner (#39599)
securityFixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
breakingBREAKING
breakingFix(git)!: route Git network operations through an internal proxy and update egress settings ()
breakingFeat(actions)!: add RUN_RETENTION_DAYS to delete old action runs ()
securitySECURITY
featureFeat(actions): update actionslib, support self:, misc fixes ()
featureFeat(api): list all packages for site administrators ()
featureFeat: manage bot accounts from the admin UI, API and CLI ()
featureFeat(user): Personal access tokens can be regenerated ()
featureFeat(actions): support $/ prefix in reusable workflow uses: ()
featureFeat(actions): add force-cancel workflow run API ()
featureFeat(licenses): support REUSE specification in licenses ()
featureFeat(api): add project APIs ()
featureFeat(webhook): fire repository event on repo rename ()
featureFeat: admin impersonates a user ()
featureFeat(actions): add build queue view ()
featureFeat(setting): add shared [redis] section as default for redis-backed subsystems ()
featureFeat(repo): prioritize well-known READMEs and optimize discovery ()
featureFeat(actions): implement adaptive auto-refresh for workflow runs list ()
featureFeat(auth): add disable-2fa command ()
featureFeat: Add audit logging ()
featureFeat(repo): add quick repository switcher to repo header ()
featureFeat(repo): support file exclusion logic in .gitea/template in template generation ()
featureFeat(web): Add org removal functionality to admin user details page ()
featureFeat: add watch options ()
featureFeat: add deploy tokens ()
featureFeat(diff): Add search and extension filter to diff sidebar ()
featureFeat: Replace SSE with WebSocket for UI notifications ()
featureFeat(actions): Add artifact preview in Actions run view ()
featureFeat(packages): add support for uploading helm provenance files ()
featureFeat: Add support for dynamic matrix evaluation in Gitea Actions workflows ()
featureFeat: Add max-parallel Support for Gitea Actions ()
featureFeat(actions): Add Actions API endpoints for workflow run management and logs ()
featureFeat: Add block on pending codeowner reviews branch protection ()
deprecatedEnhance(packages/npm): expand version metadata and support npm deprecate ()
securityFix(deps): update module golang.org/x/image to v0.45.0 [security] ()
securityFix(deps): update module golang.org/x/mod to v0.40.0 [security] ()
securityFix(deps): update dependency mermaid to v11.16.1 [security] ()
securityFix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] ()
securityFix(deps): update dependency js-yaml to v5.2.2 [security] ()
+198 more items in the release notessecurityFixes CVE-2026-60018: Authenticated DoS in OneDev migration via unbounded version response body
securityFixes CVE-2026-60021: Authenticated DoS in GitLab migration via uncancelable version probe
securitySECURITY
fixfix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058)
fixfix(attachments): enforce owning repository path (#39048) (#39077)
fixfix(markup): enforce same-repository issue access (#39045) (#39054)
fixfix(actions): verify raw artifact signatures first (#39049) (#39053)
fixfix(api): hide limited users from restricted viewers (#39004) (#39039)
fixfix(repo): limit gitignore template selections (#39027) (#39040)
fixfix(migrations): cancel GitLab version probes (#39023) (#39035)
fixfix(packages): limit Swift package manifests (#39025) (#39032)
fixfix(migrations): bound OneDev version responses (#39024) (#39033)
fixfix(packages): limit Maven checksum uploads (#39028) (#39031)
fixfix(packages): bound Alpine metadata entries (#39026) (#39029)
fixfix(actions): enforce fork pull request trust boundaries (#39005) (#39018)
fixfix(git): restrict hook permissions (#39008) (#39016)
fixfix(api): enforce repository creation token authorization (#39007) (#39014)
fixfix(api): enforce public-only scope for compare heads (#39006) (#39013)
fixfix(repo): hide repositories of hidden owners (#39009) (#39012)
fixfix: avoid enumerating every public repository in issue search (#38992) (#39000)
otherrefactor: private endpoints (#38964) (#38965)
featureenhance: add permalinks to pull request reviews (#38849) (#39036)
fixfix: add missing query parameters on runner list page (#39163)
fixfix(actions): keep step-level continue-on-error expressions unevaluated (#39141) (#39148
fixfix(packages): preserve SemVer prerelease identifiers in Swift Registry (#39156) (#39158)
fixfix(repo): prevent MarkAsBrokenEmpty when repository is being migrated (#39091) (#39092)
fixfix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086)
fixfix(pull): keep the merged state in sync with git (#39062) (#39118)
fixfix(pull): name the head repository in default compare links (#39075) (#39079)
fixfix(git): parse co-author trailers that are not RFC 5322 addresses (#39076) (#39081)
fixfix(actions): show "Complete job" logs when the last step is skipped (#38939) (#39003)
fixfix(actions): Fix how jobs in matrixes are grouped (#38980) (#38998)
fixfix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996)
fixfix: honor environment variables during install (#38974) (#38976)
fixfix: grant limited-org unit read access to authenticated non-members (#38871) (#38963)
fixfix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956) (#38961)
fixfix(actions): drop wrapper span around the action status icon (#38957) (#38959)
fixfix(issues): sort scoped labels by exclusive order in dropdowns (#38893) (#38954)
fixfix(indexer): correct bleve indexer token filters (#38853) (#38951)
fixfix: make "login_name" field optional for API edit user (#38917) (#38945)
+8 more items in the release notessecurityFixes CVE-2026-73800: Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events
securitySECURITY
fixFix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
otherRefactor: external render (#38885) (#38898)
fixFix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
otherRefactor: markup render (#38864) (#38869)
fixFix(deps): update dependency mermaid to v11.16.1 (#38816)
fixFix(auth): set WebAuthn user verification per request (#38805) (#38810)
fixFix: render highlight language (#38793) (#38795)
otherENHANCEMENTS
featureenhance: add missing npm package metadata properties (#38826) (#38831)
otherBUGFIXES
fixfix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
fixfix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901)
fixfix(lfs): accept successful transfer responses (#38866) (#38875)
fixfix(packages): ignore nested Package.swift (#38788) (#38836)
fixfix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
fixfix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
fixfix(migration): migration deletion returned json redirection (#38796) (#38825)
fixfix(ui): change underlines to default browser style (#38819) (#38823)
fixfix(actions): allow cancelling runs without running jobs (#35842) (#38812)
fixfix(actions): evaluate each ${{ }} part on its own (#38754) (#38797)
fixfix(actions): write an action task report in one transaction (#38792) (#38794)
fixfix: markup link (#38764) (#38765)
fixfix: set a minio part size when the content size is unknown (#38753) (#38755)
fixfix: bad path escape in subpath archive download (#38749) (#38750)
fixfix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744)
fixfix(markdown): fix double strikethough on code (#38707) (#38729)
fixfix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722)
fixfix: correct full url when using sub-path (#38712) (#38716)
fixfix: avoid markup render panic (#38698) (#38703)
fixfix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
fixfix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)
fixfix(migrations): use all configured GitHub tokens (#38841) (#38846)
securityFixes CVE-2026-60004: Remote Code Execution via diffpatch Git Hook Installation
securityFixes CVE-2026-59774: Unauthenticated Arbitrary File Read can lead to RCE
securitySECURITY
fixFix: orgmode render include path (#38642) (#38645)
fixFix: git patch apply (#38637) (#38638)
fixfix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
fixfix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
fixfix: make Actions log parser support multiple line message encoding (#38659) (#38664)
fixfix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
fixfix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)
fixfix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
fixfix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
fixfix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
fixfix(actions): correctness and hardening fixes (#38518) (#38631)
fixfix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
fixfix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
fixfix(webhook): remove slack channel name check (#38608) (#38612)
fixfix: download dropdown menu clipped on the branches page (#38604) (#38609)
fixfix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
fixfix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
fixfix(file-tree): handle submodule links and missing view container (#38033) (#38589)
fixfix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
fixfix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
fixfix: branch protection user list (#38570) (#38584)
fixfix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
fixfix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
fixfix(actions): support matrix when evaluating workflow if expression (#38474) (#38557)
fixfix(actions): align status icon span for Safari rendering (#38558) (#38562)
fixfix: revert git clone http redirection forbidden (#38530) (#38545)
fixfix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
fixfix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
fixfix: make the merge box button red if some checks fail (#38508) (#38516)
fixfix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
fixfix: make commit message merge correctly (#38490) (#38502)
fixfix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
fixfix(actions): make cancelled() work in job if evaluation (#38495) (#38497)
fixfix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
fixfix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
fixfix: full file highlighting for git diff with CR char (#38484) (#38491)
fixfix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
+13 more items in the release notessecurityFixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
breakingBREAKING
breakingFeat(actions)!: improve support for reusable workflows (#37478)
securityUse Content-Security-Policy: script nonce (#37232)
securitySECURITY
securityFix: various security fixes (#38406) (#38426)
securityFix(security): harden access checks and migration validation (#38324) (#38400)
securityFix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
featureFeat(actions): add workflow status badge modal (#38196)
featureFeat(actions): support owner-level and global scoped workflows (#38154)
featureFeat(api): support ref suffixes in compare (#38148)
featureFeat(actions): implement jobs..continue-on-error (#38100)
featureFeat(actions): show run status on browser tab favicon (#38071)
featureFeat(api): add token introspection and self-deletion endpoint (#37995)
featureFeat(api): add q parameter to list branches API for server-side filtering (#37982)
featureFeat(repo): split repository creation limit into user and org scopes (#37872)
featureFeat(actions): bulk delete, disable and enable runners in admin UI (#37869)
featureFeat(actions): List workflows that were executed once but got removed from the default branch (#37835)
featureFeat(org): add team visibility so org members can discover teams (#37680)
featureFeat: add raw diff/patch endpoint for repository comparisons (#37632)
featureFeat: Add avatar stacks (#37594)
featureFeat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
featureFeat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
featureSupport for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
featureFeat(orgs): Add search bar for organization members tab page (#37347)
featureFeat(api): Add assignees APIs (#37330)
featureFeat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
featureAdd project column picker to issue and pull request sidebar (#37037)
featureAllow multiple projects per issue and pull requests (#36784)
securityFix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
securityFix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
securityFix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
breakingRemove external service dependencies in migration tests (#36866)
breakingRemove htmx (#37224)
securityFix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
securityFix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
breakingRemove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
breakingRemove SubmitEvent polyfill (#37276)
breakingRemove dead code identified by deadcode tool (#37271)
breakingRemove error returns from crypto random helpers and callers (#37240)
+252 more items in the release notessecuritySECURITY
fixfix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)
otherBUGFIXES
fixfix: walk git log context error handling (#38182) (#38185)
securityFixes CVE-2026-20779: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
breakingBREAKING
breakingfix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)
securitySECURITY
fixfix(hostmatcher): patch incorrect private list (#38170) (#38173)
securityfix: Various security fixes (#38103) (#38151)
fixfix: Various sec fixes (#38108) (#38147)
fixfix: allow git clone of private repos with anonymous code access (#38074) (#38146)
fixfix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
fixfix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
fixfix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
fixfix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
fixfix: bound CODEOWNERS regex match time (#38011) (#38025)
fixfix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
securityfix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)
otherAPI
featurefeat(api): add Link header in ListForks (#38052) (#38063)
otherBUGFIXES
fixfix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
fixfix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
fixfix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
fixfix: parse HEAD ref (#38119)
fixfix: git cmd (#38084) (#38087)
fixfix(releases): generate notes for initial tag (#37697) (#37986)
fixfix(actions): return 404 when job log blob is missing (#38003) (#38004)
fixfix(actions): exclude workflow_call from workflow trigger detection (#37894) (#37899)
fixfix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
fixfix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
fixfix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892)
fixfix: http content file render (#37850) (#37856)
fixfix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
fixfix: Fix issue target branch selection for non-collaborators (#36916) (#38164)
otherBUILD
fixfix(deps): update @playwright/test to 1.60.0 (#38144)
otherci: add tools/ci-tools.ts for the PR labeler workflow (#37831)
fixfix(build): swagger css import (#37801) (#37803)
securityFixes CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
securitySECURITY
fixfix(permissions): Fix reading permission (#37769)
fixfix(actions): make artifact signature payloads unambiguous (#37707)
fixfix: Unify public-only token filtering in API queries and repo access checks (#37118)
fixfix: Add missed token scope checking (#37735)
fixfix(oauth): bind token exchanges to the original client request (#37704)
fixfix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
fixfix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
securityfix(security): enforce wiki git writes and LFS token access at request time (#37695)
featurefeat(api): encrypt AWS creds (#37679)
securityfix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
fixfix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
fixfix(git): Fix smart http request scope bug (#37583)
fixFix basic auth bug (#37503)
fixFix allow maintainer edit permission check (#37479) (#37484)
fixFix URL sanitization to handle schemeless credentials (#37440) (#37471)
securityFix attachment Content-Security-Policy (#37455) (#37464)
fixfix(pull): handle empty pull request files view to allow reviews (#37783)
fixfix(markup): make RenderString never fail (#37779)
fixfix: add natural sort to sortTreeViewNodes (#37772)
fixfix: package creation unique conflict (#37774)
breakingfix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
fixfix: Allow direct commits for unprotected files with push restrictions (#37657)
fixfix(actions): wrong assumption that run id always >= job id (#37737)
fixfix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
fixfix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
fixfix(repo): /generate must sync the branch table for the new repo (#37693)
fixfix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
fixfix show correct mergebase
fixfix: make clone URL respect public URL detection setting (#37615)
fixfix: "run as root" check (#37622)
fixfix: treat email addresses case-insensitively (#37600)
fixfix(actions): fix blank lines after ::endgroup:: (#37597)
fixfix(actions): report individual step status in workflow job API response (#37592)
fixfix: Invalid UTF-8 commit messages in JSON API responses (#37542)
fixfix: use consistent GetUser family functions (#37553)
fixfix(api): return 409 message instead of empty JSON for wrong commit id (#37572)
fixfix(actions): prevent panic when workflow contains null jobs (#37570)
breakingRemove excessive quote from terraform instructions (#37424) (#37426)
+18 more items in the release notes