Gitea 28.0.0

Original release notes

BREAKING
Fix(git)!: route Git network operations through an internal proxy and update egress settings (#39426)
Feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs (#38855)

SECURITY
Fix(git): reject invalid and duplicate Git objects on push (#39472)
Fix(git)!: route Git network operations through an internal proxy and update egress settings (#39426)
Fix(ssh): identify presented public keys by fingerprint (#39423)
Fix(actions): keep cancelled and unapproved fork PR runs behind the approval gate (#39399)
Fix(deps): update golang.org/x/crypto SSH to address denial of service (#39219)
Fix(repo): enforce repository-scoped authorization for team access, deletion, and package unlinking (#39063)

FEATURES
Feat(actions): update actionslib, support self:, misc fixes (#39358)
Feat(api): list all packages for site administrators (#38968)
Feat: manage bot accounts from the admin UI, API and CLI (#38966)
Feat(user): Personal access tokens can be regenerated (#38907)
Feat(actions): support $/ prefix in reusable workflow uses: (#38822)
Feat(actions): add force-cancel workflow run API (#38756)
Feat(licenses): support REUSE specification in licenses (#38720)
Feat(api): add project APIs (#38691)
Feat(webhook): fire repository event on repo rename (#38641)
Feat: admin impersonates a user (#38614)
Feat(actions): add build queue view (#38585)
Feat(setting): add shared [redis] section as default for redis-backed subsystems (#38550)
Feat(repo): prioritize well-known READMEs and optimize discovery (#38532)
Feat(actions): implement adaptive auto-refresh for workflow runs list (#38329)
Feat(auth): add disable-2fa command (#38275)
Feat: Add audit logging (#38189)
Feat(repo): add quick repository switcher to repo header (#38188)
Feat(repo): support file exclusion logic in .gitea/template in template generation (#38064)
Feat(web): Add org removal functionality to admin user details page (#38013)
Feat: add watch options (#37571)
Feat: add deploy tokens (#37306)
Feat(diff): Add search and extension filter to diff sidebar (#37068)
Feat: Replace SSE with WebSocket for UI notifications (#36965)
Feat(actions): Add artifact preview in Actions run view (#36754)
Feat(packages): add support for uploading helm provenance files (#36695)
Feat: Add support for dynamic matrix evaluation in Gitea Actions workflows (#36564)
Feat: Add max-parallel Support for Gitea Actions (#36357)
Feat(actions): Add Actions API endpoints for workflow run management and logs (#35382)
Feat: Add block on pending codeowner reviews branch protection (#34995)

ENHANCEMENTS
Enhance: allow auto-closing PRs from PRs (#39393)
Enhance(actions): add pending job status and align job statuses with GitHub (#39376)
Enhance(acme): add configurable ACME profile (#39375)
Enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)
Enhance: improve issue-pattern capture groups and support both internal&external trackers enabled (#39354)
Enhance: update mermaid to v12 (#39331)
Enhance(notifications): mark current notification page as read (#39294)
Enhance: support ETag on streamed repository archives, support If-None-Match: * (#39289)
Enhance: truncate but show long lines in diffs (#39279)
Enhance(packages): implement npm single-version API and add per-version repository (#39267)
Enhance: move window.config to JSON, improve CSP format (#39236)
Enhance: improve commit page header (#39229)
Enhance: Improve validation errors for secrets/variables (#39221)
Enhance(repo): check full repo name for dangerous operations (#39213)
Enhance(web): hide attachment dropzone on preview tab in combo editor (#39204)
Enhance(web): show attachment URL and UUID in dropzone preview (#39203)
Enhance(actions): make workflow dispatch choice dropdown support search (#39154)
Enhance(repo): unify diff stats on commit pages, misc diff tweaks (#39134)
Enhance: use browser's locale to detect week's first day for the contribution map (#38995)
Enhance(ui): forced colors mode enhancements (#38991)
Enhance: user-friendly packages setup manual (#38946)
Enhance: inherit team access for all units (#38938)
Enhance(admin): show impersonation banner and keep password change with the user (#38924)
Enhance(ui): tint toast backgrounds by level (#38919)
Enhance(repo): add default object format setting (#38877)
Enhance(actions): set ref_protected in context (#38852)
Enhance(ui): restyle toasts (#38842)
Enhance: refine repo watching (#38835)
Enhance: fall back to DEFAULT_TEMPLATE.md when style-specific template is missing (#38803)
Enhance(api): add GitHub-compatible /repos/{owner}/{repo}/commits/{ref} endpoint (#38770)
Enhance(api): expose file mode in contents API response (#38713)
Enhance(tls): use go's tls defaults (#38687)
Enhance(ui): improve luminance calculations (#38682)
Enhance(api): add tag_filter query parameter to release list API (#38681)
Enhance(actions): replace ansi_up with first-party code (#38619)
Enhance: keep status check list scrolled on merge box reload (#38597)
Enhance(actions): action view enhancements (#38594)
Enhance(ui): tweak tooltip style and misc fixes (#38524)
Enhance: improve e-mail templates (#38396)
Enhance(webhook): add reviewer name to MS Teams review request notifications (#38289)
Enhance: extend <video> tag allowed attributes (#38279)
Enhance(packages/npm): expand version metadata and support npm deprecate (#37890)

PERFORMANCE
Perf(references): scan only the keyword window before a reference (#39396)
Perf(frontend): enable vite module preload (#39332)
Perf(gitdiff): optimize inline diff highlighting using cache (#38706)

BUGFIXES
Fix(actions): preserve admitted jobs and runs in their concurrency group (#39461)
Fix(api): commit tree SHA is the commit ID (#39449)
Fix: PR merge (#39442)
Fix(actions): evaluate job-level if: before concurrency check (#39437)
Fix(api): allow pending-inline-comment-only reviews (#39433)
Fix: sanitize external render command line arguments (#39417)
Fix(LFS): recalculate repo LFSSize after gc-lfs removes orphaned data (#39406)
Fix(indexer): index full file paths and real offsets in bleve (#39405)
Fix(git): keep leading dashes in git grep search patterns (#39404)
Fix: use clearer message for ldap auth failure (#39392)
Fix(repo): commit page fails to render unsigned commits with a different committer (#39381)
Fix: focus confirm button and use red for delete confirmations (#39350)
Fix(migrations): preserve SHA-256 pull request commit IDs (#39343)
Fix(ui): misc ui fixes (#39336)
Fix(actions): use gitea's clock for actions durations (#39323)
Fix(actions): never show negative running durations (#39322)
Fix: package registry keypair creation race (#39319)
Fix: add default timeout and handle errors for HaveIBeenPwned API (#39316)
Fix(user): unify email validation for registration and settings (#39304)
Fix(ui): use button elements for branch and tag dropdown tabs (#39285)
Fix(auth): fix ssh and gpg key verification on windows (#39283)
Fix(feed): use meaningful lines as comment excerpt (#39276)
Fix(projects): allow max columns to the limit (#39272)
Fix: pass merge commit messages to git via stdin (#39269)
Fix(repo): surface unrelated histories on Sync Fork (#39258)
Fix: avoid nil panic and refactor some trivial problems (#39251)
Fix: restore missing blob file when re-publishing a package (#39239)
Fix(automerge): validate head commit before merge (#39235)
Fix(httplib): prevent leaking localhost:3000 in public links (#39217)
Fix(setting): honor bare -1 for timeout settings (#39181)
Fix: correct repo/attatchment absolute url and release layout (#39178)
Fix(web): populate the reason for "cannot commit to branch" in web editor commit form (#39155)
Fix(process): reap entire process group on cmd.Cancel (#39143)
Fix: recognize linguist language aliases (#39135)
Fix(repo): preserve transfer recipient collaboration (#39042)
Fix(db): make paginated database reads always require "order" option (#39017)
Fix: make local queue PopItem can be notified (#39011)
Fix: classify git failures on stderr, restrict migration failure detail (#39010)

Gitea 28.0.0

More in Self-hosting

Gitea 28.2.0

Gitea 28.1.0

Karakeep 0.34.1