# Gitea v1.27.3 - Product: Gitea (https://whatsnew.fyi/product/gitea) - Vendor: Gitea - Date: 2026-08-29 - Version: v1.27.3 - Original notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.3 - Permalink: https://whatsnew.fyi/product/gitea/releases/v1.27.3 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Restrict and limit token scope access for packages - **security** — Enforce owning repository path for attachments - **security** — Enforce same-repository issue access in markup - **security** — Verify raw artifact signatures first in actions - **security** — Hide limited users from restricted viewers in API - **security** — Limit gitignore template selections in repositories - **security** — Cancel GitLab version probes during migrations - **security** — Limit Swift package manifests - **security** — Bound OneDev version responses in migrations - **security** — Limit Maven checksum uploads for packages - **security** — Bound Alpine metadata entries for packages - **security** — Enforce fork pull request trust boundaries in actions - **security** — Restrict hook permissions in git - **security** — Enforce repository creation token authorization in API - **security** — Enforce public-only scope for compare heads in API - **security** — Hide repositories of hidden owners - **security** — Avoid enumerating every public repository in issue search - **security** — Refactor private endpoints - **added** — Add permalinks to pull request reviews - **fixed** — Add missing query parameters on runner list page - **fixed** — Keep step-level continue-on-error expressions unevaluated in actions - **fixed** — Preserve SemVer prerelease identifiers in Swift Registry for packages - **fixed** — Prevent MarkAsBrokenEmpty when repository is being migrated - **fixed** — Do not verify OpenPGP signatures with an SSH instance key - **fixed** — Keep the merged state in sync with git in pull requests - **fixed** — Name the head repository in default compare links - **fixed** — Parse co-author trailers that are not RFC 5322 addresses in git - **fixed** — Show Complete job logs when the last step is skipped in actions - **fixed** — Fix how jobs in matrixes are grouped in actions - **fixed** — Resolve YAML anchors and aliases in Actions workflows - **fixed** — Honor environment variables during install - **fixed** — Grant limited-org unit read access to authenticated non-members - **fixed** — Allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set - **fixed** — Drop wrapper span around the action status icon - **fixed** — Sort scoped labels by exclusive order in dropdowns - **fixed** — Correct bleve indexer token filters - **fixed** — Make login_name field optional for API edit user - **fixed** — Reject non-mapping matrix include/exclude in actions - **fixed** — Respect FEED_PAGING_NUM on the dashboard feed - **changed** — Pre-register a builtin OAuth2 application for the official Gitea mobile app * SECURITY * fix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058) * fix(attachments): enforce owning repository path (#39048) (#39077) * fix(markup): enforce same-repository issue access (#39045) (#39054) * fix(actions): verify raw artifact signatures first (#39049) (#39053) * fix(api): hide limited users from restricted viewers (#39004) (#39039) * fix(repo): limit gitignore template selections (#39027) (#39040) * fix(migrations): cancel GitLab version probes (#39023) (#39035) * fix(packages): limit Swift package manifests (#39025) (#39032) * fix(migrations): bound OneDev version responses (#39024) (#39033) * fix(packages): limit Maven checksum uploads (#39028) (#39031) * fix(packages): bound Alpine metadata entries (#39026) (#39029) * fix(actions): enforce fork pull request trust boundaries (#39005) (#39018) * fix(git): restrict hook permissions (#39008) (#39016) * fix(api): enforce repository creation token authorization (#39007) (#39014) * fix(api): enforce public-only scope for compare heads (#39006) (#39013) * fix(repo): hide repositories of hidden owners (#39009) (#39012) * fix: avoid enumerating every public repository in issue search (#38992) (#39000) * refactor: private endpoints (#38964) (#38965) * ENHANCEMENTS * enhance: add permalinks to pull request reviews (#38849) (#39036) * BUGFIXES * fix: add missing query parameters on runner list page (#39163) * fix(actions): keep step-level continue-on-error expressions unevaluated (#39141) (#39148 * fix(packages): preserve SemVer prerelease identifiers in Swift Registry (#39156) (#39158) * fix(repo): prevent MarkAsBrokenEmpty when repository is being migrated (#39091) (#39092) * fix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086) * fix(pull): keep the merged state in sync with git (#39062) (#39118) * fix(pull): name the head repository in default compare links (#39075) (#39079) * fix(git): parse co-author trailers that are not RFC 5322 addresses (#39076) (#39081) * fix(actions): show "Complete job" logs when the last step is skipped (#38939) (#39003) * fix(actions): Fix how jobs in matrixes are grouped (#38980) (#38998) * fix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996) * fix: honor environment variables during install (#38974) (#38976) * fix: grant limited-org unit read access to authenticated non-members (#38871) (#38963) * fix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956) (#38961) * fix(actions): drop wrapper span around the action status icon (#38957) (#38959) * fix(issues): sort scoped labels by exclusive order in dropdowns (#38893) (#38954) * fix(indexer): correct bleve indexer token filters (#38853) (#38951) * fix: make "login_name" field optional for API edit user (#38917) (#38945) * fix(actions): reject non-mapping matrix include/exclude (#38933) * fix(ui): respect FEED_PAGING_NUM on the dashboard feed (#38935) (#38936) * MISC * chore: repo compare link (#39088) (#39119) * ci: remove AWS S3 uploads from release workflows (#38928) (#38929) * chore: Pre-register a builtin OAuth2 application for the official Gitea mobile app (#38880) (#38922) Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.