Gitea v1.26.3

v1.26.3
Added 1
  • Add Link header in ListForks API endpoint
Changed 1
  • Require merged PR to bypass fork PR approval gate in actions
Fixed 8
  • Fix panic when SSH remote LFS endpoint parsing fails
  • Fix nil pointer panic when filtering tracked times by a non-existent user
  • Keep literal false value displayed in workflow_dispatch choice dropdowns
  • Parse HEAD ref correctly
  • Generate notes for initial tag in releases
  • Return 404 when action job log blob is missing
  • Exclude workflow_call from workflow trigger detection in actions
  • Clear stale ReviewTypeRequest when submitting pending review on issues
Security 10
  • Patch incorrect private list in hostmatcher
  • Apply various security fixes
  • Allow git clone of private repositories with anonymous code access
  • Ignore stale OIDC external login links to organizations in authentication
  • Block reserved IP ranges from external and private filters in hostmatcher
  • Require Code-unit access for cross-repository LFS object reuse

[!WARNING] Please upgrade to 1.26.4 directly. A regression in this release can cause "context deadline exceeded" errors when opening any repository's code pages (#38177). Please hold off on upgrading until a fix is released.

  • BREAKING

    • fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)

  • SECURITY

    • fix(hostmatcher): patch incorrect private list (#38170) (#38173)
    • fix: Various security fixes (#38103) (#38151)
    • fix: Various sec fixes (#38108) (#38147)
    • fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
    • fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
    • fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
    • fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
    • fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
    • fix: bound CODEOWNERS regex match time (#38011) (#38025)
    • fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
    • fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)

  • API

    • feat(api): add Link header in ListForks (#38052) (#38063)

  • BUGFIXES

    • fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
    • fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
    • fix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
    • fix: parse HEAD ref (#38119)
    • fix: git cmd (#38084) (#38087)
    • fix(releases): generate notes for initial tag (#37697) (#37986)
    • fix(actions): return 404 when job log blob is missing (#38003) (#38004)
    • fix(actions): exclude workflow_call from workflow trigger detection (#37894) (#37899)
    • fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
    • fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
    • fix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892)
    • fix: http content file render (#37850) (#37856)
    • fix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
    • fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)

  • BUILD

    • fix(deps): update @playwright/test to 1.60.0 (#38144)
    • ci: add tools/ci-tools.ts for the PR labeler workflow (#37831)
    • fix(build): swagger css import (#37801) (#37803)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

View original

Upgraded? How did it go?

Discussion