# Gitea changelog

> A painless self-hosted Git service.

- Vendor: Gitea
- Category: Developer Tools
- Official site: https://about.gitea.com
- Tracked by: What's New (https://whatsnew.fyi/product/gitea)
- Harvested from: GitHub (go-gitea/gitea)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v1.27.1

- Date: 2026-07-27
- Version: v1.27.1
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.1
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.27.1

- **security** — enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints
- **fixed** — skip OIDC end-session after password login for OAuth2 users
- **fixed** — make Actions log parser support multiple line message encoding
- **fixed** — use base branch ref for pull_request_target context
- **fixed** — skip already-approved runs in ApproveRuns
- **fixed** — orgmode render include path
- **fixed** — cancel tasks immediately when the runner stopped reporting
- **fixed** — fix label bulk-load key and reduce log noise in LoadLabel
- **fixed** — improve runner list status sorting, labels and task job links
- **fixed** — correctness and hardening fixes in Actions
- **fixed** — prevent double-write redirect collisions on dependency errors and fix UI
- **fixed** — delete repo-scoped rows of seven more tables when deleting a repository
- **fixed** — remove slack channel name check from webhook
- **fixed** — download dropdown menu clipped on the branches page
- **fixed** — prevent database mutations on invalid MoveIssues payload
- **fixed** — make SingleWorkflow.Marshal round-trip multi-line run blocks
- **fixed** — handle submodule links and missing view container in file-tree
- **fixed** — fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing
- **fixed** — keep serving valid ACME cert when renewal fails at startup
- **fixed** — branch protection user list
- **changed** — improve diff contrast in light and dark themes

* SECURITY
  * fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)

* API
  * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)

* ENHANCEMENTS
  * enhance: improve diff contrast in light and dark themes (#37477) (#38574)

* BUGFIXES
  * fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
  * fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
  * fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
  * fix(actions): skip already-approved runs in `ApproveRuns` (#38653) (#38654)
  * fix: orgmode render include path (#38642) (#38645)
  * fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
  * fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
  * fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
  * fix(actions): correctness and hardening fixes (#38518) (#38631)
  * fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
  * fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
  * fix(webhook): remove slack channel name check (#38608) (#38612)
  * fix: download dropdown menu clipped on the branches page (#38604) (#38609)
  * fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
  * fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
  * fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
  * fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
  * fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
  * fix: branch protection user list (#38570) (#38584)
  * fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
  * fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
  * fix(actions): support `matrix` when evaluating workflow `if` expression (#38474) (#38557)
  * fix(actions): align status icon span for Safari rendering (#38558) (#38562)
  * fix: revert git clone http redirection forbidden (#38530) (#38545)
  * fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
  * fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
  * fix: make the merge box button red if some checks fail (#38508) (#38516)
  * fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
  * fix: make commit message merge correctly (#38490) (#38502)
  * fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
  * fix(actions): make `cancelled()` work in job `if` evaluation (#38495) (#38497)
  * fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
  * fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
  * fix: full file highlighting for git diff with CR char (#38484) (#38491)
  * fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
  * fix: 500 error when updating user visibility (#38480) (#38483)
  * fix(actions): make job list item fully clickable (#38462) (#38471)
  * fix: mail template for push event (#38467) (#38468)
  * fix: make "test push webhook" always work (#38425) (#38455)
  * fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
  * fix(org): align follow button and wrap description (#38448) (#38454)
  * fix(actions): populate `github.event` for scheduled runs (#38446) (#38452)

* MISC
  * refactor: git patch apply (#38637) (#38638)

Instances on **[Gitea Cloud](https://cloud.gite

_[Truncated at 4000 characters — full notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.1]_

### v1.27.0

- Date: 2026-07-13
- Version: v1.27.0
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.0
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.27.0

- **security** — Harden access checks and migration validation
- **security** — Enforce public-only token scope and harden push options and locale parsing
- **security** — Re-evaluate review official flag on target branch change
- **security** — Stop leaking private repo metadata after access revocation
- **security** — Require proof of possession for cross-repo LFS objects
- **security** — Disable HTTP redirects on pull mirror sync
- **security** — Fix golang html template url escaping
- **security** — Validate web attachment renames against allowed types
- **security** — Gate draft release attachments on web download endpoints
- **security** — Update module github.com/go-git/go-git/v5 to v5.19.1
- **security** — Restrict OAuth introspection to the token's client
- **security** — Don't expose private org membership via public_members
- **security** — Deny fork-PR cross-repo access via collaborative owner
- **security** — Prevent path traversal in repository restore
- **changed** — Improve support for reusable workflows
- **changed** — Use Content-Security-Policy script nonce
- **added** — Add workflow status badge modal
- **added** — Support owner-level and global scoped workflows
- **added** — Support ref suffixes in compare API
- **added** — Implement jobs.<job_id>.continue-on-error in actions
- **added** — Show run status on browser tab favicon
- **added** — Add token introspection and self-deletion endpoint

* BREAKING   
  * Feat(actions)!: improve support for reusable workflows (#37478)   
  * Use Content-Security-Policy: script nonce (#37232)

* SECURITY
  * Fix: various security fixes (#38406) (#38426)
  * Fix(security): harden access checks and migration validation (#38324) (#38400)
  * Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
  * Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
  * Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
  * Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
  * Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
  * Fix: golang html template url escaping (#38363) (#38369)
  * Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
  * Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
  * Fix(oauth): restrict introspection to the token's client (#38042)
  * Fix(api): don't expose private org membership via public_members (#38145)
  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
  * Fix(migrations): prevent path traversal in repository restore (#38215)

* FEATURES
  * Feat(actions): add workflow status badge modal (#38196)
  * Feat(actions): support owner-level and global scoped workflows (#38154)
  * Feat(api): support ref suffixes in compare (#38148)
  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
  * Feat(actions): show run status on browser tab favicon (#38071)
  * Feat(api): add token introspection and self-deletion endpoint (#37995)
  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
  * Feat(repo): split repository creation limit into user and org scopes (#37872)
  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
  * Feat(org): add team visibility so org members can discover teams (#37680)
  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
  * Feat: Add avatar stacks (#37594)
  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
  * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
  * Feat(orgs): Add search bar for organization members tab page (#37347)
  * Feat(api): Add assignees APIs (#37330)
  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
  * Add project column picker to issue and pull request sidebar (#37037)
  * Allow multiple projects per issue and pull requests (#36784)
  * Feat(ui): add "follow rename" to file commit history list (#34994)
  * Feat(ssh): auto generate additional ssh keys (#33974)

* ENHANCEMENTS
  * Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
  * Enhance: allow builtin default git config options to be overridden (#38172)
  * Enhance: allow MathML core elements (#38034)
  * Enhance(markup): improve issue title rendering (#37908)
  * Enhance(actions): set descriptive browser tab title on run view (#37870)
  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
  * Feat(actions): add before/after to PR synchronize event payload (#37827)
  * Enhance(actions): add branch filters to run list (#37826)
  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
  * Feat: add copy button to action step header, improve other copy buttons (#37744)
  * Fix(icon):

_[Truncated at 4000 characters — full notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.0]_

### v1.27.0-rc0

- Date: 2026-06-30
- Version: v1.27.0-rc0
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.0-rc0
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.27.0-rc0
- Labels: Pre-release

- **security** — Update go-git/go-git/v5 to v5.19.1 for security fixes
- **security** — Restrict OAuth introspection to the token's client
- **security** — Do not expose private org membership via public_members API
- **security** — Deny fork-PR cross-repo access via collaborative owner in actions
- **security** — Prevent path traversal in repository restore migrations
- **changed** — Improve support for reusable workflows
- **changed** — Use Content-Security-Policy with script nonce
- **added** — Add workflow status badge modal
- **added** — Support owner-level and global scoped workflows
- **added** — Support ref suffixes in compare API
- **added** — Implement jobs.<job_id>.continue-on-error in actions
- **added** — Show run status on browser tab favicon
- **added** — Add token introspection and self-deletion endpoint
- **added** — Add q parameter to list branches API for server-side filtering
- **added** — Split repository creation limit into user and org scopes
- **added** — Bulk delete, disable and enable runners in admin UI
- **added** — List workflows that were executed once but got removed from the default branch
- **added** — Add team visibility so org members can discover teams
- **added** — Add raw diff/patch endpoint for repository comparisons
- **added** — Add avatar stacks

* BREAKING
  * Feat(actions)!: improve support for reusable workflows (#37478)   
  * Use Content-Security-Policy: script nonce (#37232)

* SECURITY
  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
  * Fix(oauth): restrict introspection to the token's client (#38042)
  * Fix(api): don't expose private org membership via public_members (#38145)
  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
  * Fix(migrations): prevent path traversal in repository restore (#38215)

* FEATURES
  * Feat(actions): add workflow status badge modal (#38196)
  * Feat(actions): support owner-level and global scoped workflows (#38154)
  * Feat(api): support ref suffixes in compare (#38148)
  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
  * Feat(actions): show run status on browser tab favicon (#38071)
  * Feat(api): add token introspection and self-deletion endpoint (#37995)
  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
  * Feat(repo): split repository creation limit into user and org scopes (#37872)
  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
  * Feat(org): add team visibility so org members can discover teams (#37680)
  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
  * Feat: Add avatar stacks (#37594)
  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
  * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
  * Feat(orgs): Add search bar for organization members tab page (#37347)
  * Feat(api): Add assignees APIs (#37330)
  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
  * Add project column picker to issue and pull request sidebar (#37037)
  * Allow multiple projects per issue and pull requests (#36784)
  * Feat(ui): add "follow rename" to file commit history list (#34994)
  * Feat(ssh): auto generate additional ssh keys (#33974)

* ENHANCEMENTS
  * Enhance: allow builtin default git config options to be overridden (#38172)
  * Enhance: allow MathML core elements (#38034)
  * Enhance(markup): improve issue title rendering (#37908)
  * Enhance(actions): set descriptive browser tab title on run view (#37870)
  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
  * Feat(actions): add before/after to PR synchronize event payload (#37827)
  * Enhance(actions): add branch filters to run list (#37826)
  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
  * Feat: add copy button to action step header, improve other copy buttons (#37744)
  * Fix(icon): use repo-forked icon to display forks count (#37731)
  * Feat(api): add sort and order query parameters to job list endpoints (#37672)
  * Feat(api): add last_sync to repository API (#37566)
  * Enhance: Adjust Workflow Graph styling (#37497)
  * Improve code editor text selection and clean up lint enablement (#37474)
  * Add mirror auth updates to repo edit API and settings (#37468)
  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
  * Feat: Add default PR branch update style setting (#37410)
  * Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
  * Allow fast-forward-only merge when signed commits are required (#37335)
  * Enhance styling in actions page (#37323)
  * Fix: improve actions status icons and texts (#37206)
  * Make Markdown fenced code block work with more syntaxes (#37154)
  * Fix: Sort action run jobs by JobID and Name with matrix examples

_[Truncated at 4000 characters — full notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.0-rc0]_

### v1.26.4

- Date: 2026-06-21
- Version: v1.26.4
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.4
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.26.4

- **security** — Do not auto-reactivate disabled users on OAuth2 callback
- **fixed** — Walk git log context error handling

* SECURITY   
  * fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)

* BUGFIXES
  * fix: walk git log context error handling (#38182) (#38185)

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

### v1.26.3

- Date: 2026-06-20
- Version: v1.26.3
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.3
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.26.3

- **security** — Patch incorrect private list in hostmatcher
- **security** — Apply various security fixes
- **security** — Allow git clone of private repositories with anonymous code access
- **security** — Ignore stale OIDC external login links to organizations in authentication
- **security** — Block reserved IP ranges from external and private filters in hostmatcher
- **security** — Require Code-unit access for cross-repository LFS object reuse
- **security** — Reject unknown SSH LFS sub-verbs to prevent authentication bypass
- **security** — Bound CODEOWNERS regex match time
- **security** — Bound debian ParseControlFile to a single control stanza
- **security** — Update golang.org/x/net module to v0.55.0
- **changed** — Require merged PR to bypass fork PR approval gate in actions
- **added** — Add Link header in ListForks API endpoint
- **fixed** — Fix panic when SSH remote LFS endpoint parsing fails
- **fixed** — Fix nil pointer panic when filtering tracked times by a non-existent user
- **fixed** — Keep literal false value displayed in workflow_dispatch choice dropdowns
- **fixed** — Parse HEAD ref correctly
- **fixed** — Generate notes for initial tag in releases
- **fixed** — Return 404 when action job log blob is missing
- **fixed** — Exclude workflow_call from workflow trigger detection in actions
- **fixed** — Clear stale ReviewTypeRequest when submitting pending review on issues

> [!WARNING]
> **Please upgrade to 1.26.4 directly.** A regression in this release can cause **"context deadline exceeded"** errors when opening any repository's code pages ([#38177](https://github.com/go-gitea/gitea/issues/38177)). Please hold off on upgrading until a fix is released.


* BREAKING

  * fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)

* SECURITY
  * fix(hostmatcher): patch incorrect private list (#38170) (#38173)
  * fix: Various security fixes (#38103) (#38151)
  * fix: Various sec fixes (#38108) (#38147)
  * fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
  * fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
  * fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
  * fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
  * fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
  * fix: bound CODEOWNERS regex match time (#38011) (#38025)
  * fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
  * fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)

* API
  * feat(api): add Link header in ListForks (#38052) (#38063)

* BUGFIXES
  * fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
  * fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
  * fix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
  * fix: parse HEAD ref (#38119)
  * fix: git cmd (#38084) (#38087)
  * fix(releases): generate notes for initial tag (#37697) (#37986)
  * fix(actions): return 404 when job log blob is missing (#38003) (#38004)
  * fix(actions): exclude `workflow_call` from workflow trigger detection (#37894) (#37899)
  * fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
  * fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
  * fix(actions): ack re-sent `UpdateLog` finalize idempotently (#37885) (#37892)
  * fix: http content file render (#37850) (#37856)
  * fix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
  * fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)

* BUILD
  * fix(deps): update `@playwright/test` to 1.60.0 (#38144)
  * ci: add `tools/ci-tools.ts` for the PR labeler workflow (#37831)
  * fix(build): swagger css import (#37801) (#37803)

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

### v1.26.2

- Date: 2026-05-20
- Version: v1.26.2
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.2
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.26.2

- **security** — Fix reading permission
- **security** — Make artifact signature payloads unambiguous
- **security** — Unify public-only token filtering in API queries and repo access checks
- **security** — Add missed token scope checking
- **security** — Bind token exchanges to the original client request
- **security** — Strengthen PKCE validation and refresh token replay protection
- **security** — Enforce token scopes on raw, media, and attachment downloads
- **security** — Enforce wiki git writes and LFS token access at request time
- **security** — Encrypt AWS credentials
- **security** — Update dependency mermaid to v11.15.0 for security
- **security** — Add label for private and internal package and fix composer package source permission check
- **security** — Fix smart HTTP request scope bug
- **security** — Fix basic auth bug
- **security** — Fix allow maintainer edit permission check
- **security** — Fix URL sanitization to handle schemeless credentials
- **security** — Fix attachment Content-Security-Policy
- **fixed** — Handle empty pull request files view to allow reviews
- **fixed** — Make RenderString never fail
- **fixed** — Add natural sort to sortTreeViewNodes
- **fixed** — Fix package creation unique conflict

* SECURITY
  * fix(permissions): Fix reading permission (#37769)
  * fix(actions): make artifact signature payloads unambiguous (#37707)
  * fix: Unify public-only token filtering in API queries and repo access checks (#37118)
  * fix: Add missed token scope checking (#37735)
  * fix(oauth): bind token exchanges to the original client request (#37704)
  * fix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
  * fix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
  * fix(security): enforce wiki git writes and LFS token access at request time (#37695)
  * feat(api): encrypt AWS creds (#37679)
  * fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
  * fix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
  * fix(git): Fix smart http request scope bug (#37583)
  * Fix basic auth bug (#37503)
  * Fix allow maintainer edit permission check (#37479) (#37484)
  * Fix URL sanitization to handle schemeless credentials (#37440) (#37471)
  * Fix attachment Content-Security-Policy (#37455) (#37464)
  * chore(deps): bump go-git/go-git/v5 to 5.19.0 (#37608)

* BUGFIXES
  * fix(pull): handle empty pull request files view to allow reviews (#37783)
  * fix(markup): make RenderString never fail (#37779)
  * fix: add natural sort to sortTreeViewNodes (#37772)
  * fix: package creation unique conflict (#37774)
  * fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
  * fix: Allow direct commits for unprotected files with push restrictions (#37657)
  * fix(actions): wrong assumption that run id always >= job id (#37737)
  * fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
  * fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
  * fix(repo): /generate must sync the branch table for the new repo (#37693)
  * build: Fix snap build (1.26)
  * fix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
  * fix show correct mergebase
  * fix: make clone URL respect public URL detection setting (#37615)
  * fix: "run as root" check (#37622)
  * chore(deps): update dependency go to v1.26.3 (#37601)
  * Compare dropdown fails when selecting branch with no common merge-base (#37470)
  * fix: treat email addresses case-insensitively (#37600)
  * fix(actions): fix blank lines after ::endgroup:: (#37597)
  * fix(actions): report individual step status in workflow job API response (#37592)
  * fix: Invalid UTF-8 commit messages in JSON API responses (#37542)
  * fix: use consistent GetUser family functions (#37553)
  * fix(api): return 409 message instead of empty JSON for wrong commit id (#37572)
  * fix(actions): prevent panic when workflow contains null jobs (#37570)
  * Make ServeSetHeaders default to download attachment if filename exists (#37552) (#37555)
  * Fix(actions): validate workflow param to prevent 500 error (#37546) (#37554)
  * Don't unblock run-level-concurrency-blocked runs in the resolver (#37461) (#37538)
  * Fix(packages): use file names for generic web downloads (#37514) (#37520)
  * Fix merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once (#37512) (#37516)
  * Fix update branch protection order (#37508) (#37513)
  * Fix mCaptcha broken after Vite migration (#37492) (#37509)
  * Fix review submission from single-commit PR view (#37475) (#37485)
  * Fix scheduled action panic with null event payload (#37459) (#37466)
  * Make GetPossibleUserByID can handle deleted user (#37430) (#37431)
  * Remove excessive quote from terraform instructions (#37424) (#37426)
  * Fix color regressions, add `priority` color (#37417) (#37421)

* MISC
  * Add CurrentURL template variable back (#37444) (#37449)

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatical

_[Truncated at 4000 characters — full notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.2]_

### v1.26.1

- Date: 2026-04-24
- Version: v1.26.1
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.1
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.26.1

- **fixed** — Add event.schedule context for schedule actions task
- **fixed** — Fix an issue where changing an organization's visibility caused problems when users had forked its repositories
- **fixed** — Use modern "git update-index --cacheinfo" syntax to support more file names
- **fixed** — Fix URL related escaping for oauth2
- **fixed** — When the requested arch rpm is missing fall back to noarch
- **fixed** — Fix actions concurrency groups cross-branch leak
- **fixed** — Fix bug when accessing user badges
- **fixed** — Fix AppFullLink
- **fixed** — Fix container auth for public instance
- **fixed** — Enhance GetActionWorkflow to support fallback references
- **fixed** — Fix vite manifest update masking build errors
- **fixed** — Fix Mermaid diagrams failing when node labels contain line breaks
- **fixed** — Use TriggerEvent instead of Event in workflow runs API response for scheduled runs
- **changed** — Add URL to Learn more about blocking a user
- **fixed** — Fix button layout shift when collapsing file tree in editor
- **fixed** — Fix org team assignee/reviewer lookups for team member permissions
- **fixed** — Fix repo init README EOL
- **fixed** — Fix dump with default zip type produces uncompressed zip

* BUGFIXES
  * Add event.schedule context for schedule actions task (#37320) (#37348)
  * Fix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#37324) (#37344)
  * Use modern "git update-index --cacheinfo" syntax to support more file names (#37338) (#37343)
  * Fix URL related escaping for oauth2 (#37334) (#37340)
  * When the requested arch rpm is missing fall back to noarch (#37236) (#37339)
  * Fix actions concurrency groups cross-branch leak (#37311) (#37331)
  * Fix bug when accessing user badges (#37321) (#37329)
  * Fix AppFullLink (#37325) (#37328)
  * Fix container auth for public instance (#37290) (#37294)
  * Enhance GetActionWorkflow to support fallback references (#37189) (#37283)
  * Fix vite manifest update masking build errors (#37279) (#37310)
  * Fix Mermaid diagrams failing when node labels contain line breaks (#37296) (#37299)
  * Use TriggerEvent instead of Event in workflow runs API response for scheduled runs (#37288) #37360
  * Add URL to Learn more about blocking a user. (#37355) #37367
  * Fix button layout shift when collapsing file tree in editor (#37363) #37375
  * Fix org team assignee/reviewer lookups for team member permissions (#37365) #37391
  * Fix repo init README EOL (#37388) #37399
  * Fix: dump with default zip type produces uncompressed zip (#37401)#37402

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

### v1.26.0

- Date: 2026-04-18
- Version: v1.26.0
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.0
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.26.0

- **removed** — Remove GET API registration-token
- **changed** — Make PUBLIC_URL_DETECTION default to "auto"
- **security** — Bound PageSize in ListUnadoptedRepositories
- **added** — Support Actions concurrency syntax
- **added** — Add terraform state registry
- **added** — Instance-wide (global) info banner and maintenance mode
- **added** — Support rendering OpenAPI spec
- **added** — Add keyboard shortcuts for repository file and code search
- **added** — Add support for archive-upload rpc
- **added** — Add ability to download subpath archive
- **added** — Add workflow dependencies visualization and Restyle Workflow Graph
- **added** — Automatic generation of release notes
- **added** — Add "Go to file" and "Delete Directory" to repo file list page
- **added** — Introduce "config edit-ini" sub command to help maintaining INI config file
- **added** — Add button to re-run failed jobs in Actions
- **added** — Support actions and reusable workflows from private repos
- **added** — Add summary to action runs view
- **added** — Add user badges
- **added** — Add configurable permissions for Actions automatic tokens
- **added** — Add per-runner "Disable/Pause"
- **added** — Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0)

* BREAKING
  * Correct swagger annotations for enums, status codes, and notification state (#37030)
  * Remove GET API registration-token (#36801)
  * Support Actions `concurrency` syntax (#32751)
  * Make PUBLIC_URL_DETECTION default to "auto" (#36955)
* SECURITY
  * Bound PageSize in `ListUnadoptedRepositories` (#36884)
* FEATURES
  * Support Actions `concurrency` syntax (#32751)
  * Add terraform state registry (#36710)
  * Instance-wide (global) info banner and maintenance mode (#36571)
  * Support rendering OpenAPI spec (#36449)
  * Add keyboard shortcuts for repository file and code search (#36416)
  * Add support for archive-upload rpc (#36391)
  * Add ability to download subpath archive (#36371)
  * Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
  * Automatic generation of release notes (#35977)
  * Add "Go to file", "Delete Directory" to repo file list page (#35911)
  * Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
  * Add button to re-run failed jobs in Actions (#36924)
  * Support actions and reusable workflows from private repos (#32562)
  * Add summary to action runs view (#36883)
  * Add user badges (#36752)
  * Add configurable permissions for Actions automatic tokens (#36173)
  * Add per-runner "Disable/Pause"  (#36776)
  * Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
* PERFORMANCE
  * WorkflowDispatch API optionally return runid (#36706)
  * Add render cache for SVG icons (#36863)
  * Load `mentionValues` asynchronously (#36739)
  * Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
  * Load heatmap data asynchronously (#36622)
  * Use prev/next pagination for user profile activities page to speed up (#36642)
  * Refactor cat-file batch operations and support `--batch-command` approach (#35775)
  * Use merge tree to detect conflicts when possible (#36400)
* ENHANCEMENTS
  * Implement logout redirection for reverse proxy auth setups (#36085) (#37171)
  * Adds option to force update new branch in contents routes (#35592)
  * Add viewer controller for mermaid (zoom, drag) (#36557)
  * Add code editor setting dropdowns (#36534)
  * Add `elk` layout support to mermaid (#36486)
  * Add resolve/unresolve review comment API endpoints (#36441)
  * Allow configuring default PR base branch (fixes #36412) (#36425)
  * Add support for RPM Errata (updateinfo.xml) (#37125)
  * Require additional user confirmation for making repo private (#36959)
  * Add `actions.WORKFLOW_DIRS` setting (#36619)
  * Avoid opening new tab when downloading actions logs (#36740)
  * Implements OIDC RP-Initiated Logout (#36724)
  * Show workflow link (#37070)
  * Desaturate dark theme background colors (#37056)
  * Refactor "org teams" page and help new users to "add member" to an org (#37051)
  * Add webhook name field to improve webhook identification (#37025) (#37040)
  * Make task list checkboxes clickable in the preview tab (#37010)
  * Improve severity labels in Actions logs and tweak colors (#36993)
  * Linkify URLs in Actions workflow logs (#36986)
  * Allow text selection on checkbox labels (#36970)
  * Support dark/light theme images in markdown (#36922)
  * Enable native dark mode for swagger-ui (#36899)
  * Rework checkbox styling, remove `input` border hover effect (#36870)
  * Refactor storage content-type handling of ServeDirectURL (#36804)
  * Use "Enable Gravatar" but not "Disable" (#36771)
  * Use case-insensitive matching for Git error "Not a valid object name" (#36728)
  * Add "Copy Source" to markup comment menu (#36726)
  * Change image transparency grid to CSS (#36711)
  * Add "Run" prefix for unnamed action steps (#36624)
  * Persist actions log time display settings in `localStorage` (#36623)
  * Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
  * Improve BuildCaseInsensitiveL

_[Truncated at 4000 characters — full notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.0]_

### v1.26.0-rc0

- Date: 2026-04-08
- Version: v1.26.0-rc0
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.0-rc0
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.26.0-rc0
- Labels: Pre-release

- **removed** — Remove GET API registration-token
- **changed** — Support Actions concurrency syntax
- **changed** — Make PUBLIC_URL_DETECTION default to auto
- **security** — Bound PageSize in ListUnadoptedRepositories
- **added** — Add terraform state registry
- **added** — Instance-wide global info banner and maintenance mode
- **added** — Support rendering OpenAPI spec
- **added** — Add keyboard shortcuts for repository file and code search
- **added** — Add support for archive-upload rpc
- **added** — Add ability to download subpath archive
- **added** — Add workflow dependencies visualization and restyle workflow graph
- **added** — Automatic generation of release notes
- **added** — Add Go to file and Delete Directory to repo file list page
- **added** — Introduce config edit-ini sub command to help maintaining INI config file
- **added** — Add button to re-run failed jobs in Actions
- **added** — Support actions and reusable workflows from private repos
- **added** — Add summary to action runs view
- **added** — Add user badges
- **added** — Add configurable permissions for Actions automatic tokens
- **added** — Add per-runner Disable/Pause

* BREAKING
  * Correct swagger annotations for enums, status codes, and notification state (#37030)
  * Remove GET API registration-token (#36801)
  * Support Actions `concurrency` syntax (#32751)
  * Make PUBLIC_URL_DETECTION default to "auto" (#36955)
* SECURITY
  * Bound PageSize in `ListUnadoptedRepositories` (#36884)
* FEATURES
  * Support Actions `concurrency` syntax (#32751)
  * Add terraform state registry (#36710)
  * Instance-wide (global) info banner and maintenance mode (#36571)
  * Support rendering OpenAPI spec (#36449)
  * Add keyboard shortcuts for repository file and code search (#36416)
  * Add support for archive-upload rpc (#36391)
  * Add ability to download subpath archive (#36371)
  * Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
  * Automatic generation of release notes (#35977)
  * Add "Go to file", "Delete Directory" to repo file list page (#35911)
  * Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
  * Add button to re-run failed jobs in Actions (#36924)
  * Support actions and reusable workflows from private repos (#32562)
  * Add summary to action runs view (#36883)
  * Add user badges (#36752)
  * Add configurable permissions for Actions automatic tokens (#36173)
  * Add per-runner “Disable/Pause”  (#36776)
* PERFORMANCE
  * WorkflowDispatch API optionally return runid (#36706)
  * Add render cache for SVG icons (#36863)
  * Load `mentionValues` asynchronously (#36739)
  * Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
  * Load heatmap data asynchronously (#36622)
  * Use prev/next pagination for user profile activities page to speed up (#36642)
  * Refactor cat-file batch operations and support `--batch-command` approach (#35775)
  * Use merge tree to detect conflicts when possible (#36400)
* ENHANCEMENTS
  * Adds option to force update new branch in contents routes (#35592)
  * Add viewer controller for mermaid (zoom, drag) (#36557)
  * Add code editor setting dropdowns (#36534)
  * Add `elk` layout support to mermaid (#36486)
  * Add resolve/unresolve review comment API endpoints (#36441)
  * Allow configuring default PR base branch (fixes #36412) (#36425)
  * Add support for RPM Errata (updateinfo.xml) (#37125)
  * Require additional user confirmation for making repo private (#36959)
  * Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
  * Add `actions.WORKFLOW_DIRS` setting (#36619)
  * Avoid opening new tab when downloading actions logs (#36740)
  * Implements OIDC RP-Initiated Logout (#36724)
  * Show workflow link (#37070)
  * Desaturate dark theme background colors (#37056)
  * Refactor "org teams" page and help new users to "add member" to an org (#37051)
  * Add webhook name field to improve webhook identification (#37025) (#37040)
  * Make task list checkboxes clickable in the preview tab (#37010)
  * Improve severity labels in Actions logs and tweak colors (#36993)
  * Linkify URLs in Actions workflow logs (#36986)
  * Allow text selection on checkbox labels (#36970)
  * Support dark/light theme images in markdown (#36922)
  * Enable native dark mode for swagger-ui (#36899)
  * Rework checkbox styling, remove `input` border hover effect (#36870)
  * Refactor storage content-type handling of ServeDirectURL (#36804)
  * Use "Enable Gravatar" but not "Disable" (#36771)
  * Use case-insensitive matching for Git error "Not a valid object name" (#36728)
  * Add “Copy Source” to markup comment menu (#36726)
  * Change image transparency grid to CSS (#36711)
  * Add "Run" prefix for unnamed action steps (#36624)
  * Persist actions log time display settings in `localStorage` (#36623)
  * Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
  * Improve BuildCaseInsensitiveLike with lowercase (#36598)
  * Improve diff highlighting (#36583)
  * Exclude c

_[Truncated at 4000 characters — full notes: https://github.com/go-gitea/gitea/releases/tag/v1.26.0-rc0]_

### v1.25.5

- Date: 2026-03-13
- Version: v1.25.5
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.25.5
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.25.5

- **security** — Update toolchain to Go 1.25.8
- **security** — Prevent redirect bypasses via backslash-encoded paths
- **security** — Fix get release draft permission check
- **security** — Fix a bug where user could change another user's primary email
- **security** — Fix OAuth2 authorization code expiry and reuse handling
- **security** — Add validation constraints for repository creation fields
- **security** — Fix bug to check whether user can update pull request branch or rebase branch
- **security** — Add migration http transport for push/sync mirror lfs
- **security** — Fix track time list permission check
- **security** — Fix org permission API visibility checks for hidden members and private orgs
- **security** — Fix forwarded proto handling for public URL detection
- **security** — Add a git grep search timeout
- **security** — Fix oauth2 s256
- **changed** — Make security-check informational only
- **changed** — Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0
- **changed** — Upgrade gogit to 5.16.5
- **added** — Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES
- **added** — Add wrap to runner label list
- **added** — Allow scroll propagation outside code editor
- **fixed** — Fix non-admins unable to automerge PRs from forks

* SECURITY 
  * Toolchain Update to Go 1.25.6 (#36480) (#36487)   
  * Adjust the toolchain version (#36537) (#36542)   
  * Update toolchain to 1.25.8 for v1.25 (#36888)   
  * Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716)   
  * Fix get release draft permission check (#36659) (#36715)   
  * Fix a bug user could change another user's primary email (#36586) (#36607)   
  * Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851)   
  * Add validation constraints for repository creation fields (#36671) (#36757)   
  * Fix bug to check whether user can update pull request branch or rebase branch (#36465) (#36838)   
  * Add migration http transport for push/sync mirror lfs (#36665) (#36691)   
  * Fix track time list permission check (#36662) (#36744)   
  * Fix track time issue id (#36664) (#36689)   
  * Fix path resolving (#36734) (#36746)   
  * Fix dump release asset bug (#36799) (#36839)   
  * Fix org permission API visibility checks for hidden members and private orgs (#36798) (#36841)   
  * Fix forwarded proto handling for public URL detection (#36810) (#36836)   
  * Add a git grep search timeout (#36809) (#36835)   
  * Fix oauth2 s256 (#36462) (#36477) 
 
* ENHANCEMENTS   
  * Make `security-check` informational only (#36681) (#36852)   
  * Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (#36840)   
  * Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (#36688) (#36692)
  * Upgrade gogit to 5.16.5 (#36687)   
  * Add wrap to runner label list (#36565) (#36574)   
  * Add dnf5 command for Fedora in RPM package instructions (#36527) (#36572)   
  * Allow scroll propagation outside code editor (#36502) (#36510) 
  
* BUGFIXES   
  * Fix non-admins unable to automerge PRs from forks (#36833) (#36843)   
  * Fix bug when pushing mirror with wiki (#36795) (#36807)   
  * Fix artifacts v4 backend upload problems (#36805) (#36834)   
  * Fix CRAN package version validation to allow more than 4 version components (#36813) (#36821)   
  * Fix force push time-line commit comments of pull request (#36653) (#36717)   
  * Fix SVG height calculation in diff viewer (#36748) (#36750)   
  * Fix push time bug (#36693) (#36713)   
  * Fix bug the protected branch rule name is conflicted with renamed branch name (#36650) (#36661)   
  * Fix bug when do LFS GC (#36500) (#36608)   
  * Fix focus lost bugs in the Monaco editor (#36609)   
  * Reprocess htmx content after loading more files (#36568) (#36577)   
  * Fix assignee sidebar links and empty placeholder (#36559) (#36563)   
  * Fix issues filter dropdown showing empty label scope section (#36535) (#36544)  
  * Fix various mermaid bugs (#36547) (#36552)   
  * Fix data race when uploading container blobs concurrently (#36524) (#36526)   
  * Correct spacing between username and bot label (#36473) (#36484)

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.