# Gitea v1.27.2

- Product: Gitea (https://whatsnew.fyi/product/gitea)
- Vendor: Gitea
- Date: 2026-08-13
- Version: v1.27.2
- Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.2
- Permalink: https://whatsnew.fyi/product/gitea/releases/v1.27.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix collaborator access mode and httpsign
- **security** — Refactor external render
- **security** — Resolve pull_request_target reusable workflows at the base commit
- **security** — Refactor markup render
- **security** — Set WebAuthn user verification per request
- **added** — Add missing npm package metadata properties
- **fixed** — Keep github.event.inputs as strings for workflow_dispatch
- **fixed** — Let a rerun of selected jobs read the previous attempt's artifacts
- **fixed** — Accept successful transfer responses in LFS
- **fixed** — Ignore nested Package.swift
- **fixed** — Drop newline-bearing member names in arch ParsePackage
- **fixed** — Fix Azure Blob dump failing with file does not exist
- **fixed** — Fix migration deletion returned json redirection
- **fixed** — Change underlines to default browser style in UI
- **fixed** — Allow cancelling runs without running jobs
- **fixed** — Evaluate each ${{ }} part on its own in actions
- **fixed** — Write an action task report in one transaction
- **fixed** — Fix markup link
- **fixed** — Set a minio part size when the content size is unknown
- **fixed** — Fix bad path escape in subpath archive download

* SECURITY  
  * Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
  * Refactor: external render (#38885) (#38898)
  * Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
  * Refactor: markup render (#38864) (#38869)
  * Fix(deps): update dependency mermaid to v11.16.1 (#38816)
  * Fix(auth): set WebAuthn user verification per request (#38805) (#38810)
  * Fix: render highlight language (#38793) (#38795)

* ENHANCEMENTS
  * enhance: add missing npm package metadata properties (#38826) (#38831)

* BUGFIXES
  * fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
  * fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901)
  * fix(lfs): accept successful transfer responses (#38866) (#38875)
  * fix(packages): ignore nested Package.swift (#38788) (#38836)
  * fix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
  * fix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
  * fix(migration): migration deletion returned json redirection (#38796) (#38825)
  * fix(ui): change underlines to default browser style (#38819) (#38823)
  * fix(actions): allow cancelling runs without running jobs (#35842) (#38812)
  * fix(actions): evaluate each `${{ }}` part on its own (#38754) (#38797)
  * fix(actions): write an action task report in one transaction (#38792) (#38794)
  * fix: markup link (#38764) (#38765)
  * fix: set a minio part size when the content size is unknown (#38753) (#38755)
  * fix: bad path escape in subpath archive download (#38749) (#38750)
  * fix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744)
  * fix(markdown): fix double strikethough on code (#38707) (#38729)
  * fix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722)
  * fix: correct full url when using sub-path (#38712) (#38716)
  * fix: avoid markup render panic (#38698) (#38703)
  * fix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
  * fix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)
  * fix(migrations): use all configured GitHub tokens (#38841) (#38846)

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.