Gitea 28.1.0

[28.1.0] - 2026-10-06

Enhancements

• *(packages/npm)* Improve npm client compatibility (#39434) (#39522)

Bug Fixes

• *(actions)* Keep runs order after auto refresh (#39479) (#39481)
• Npm route (#39488) (#39490)
• Copy new access token to clipboard (#39496) (#39499)
• *(markup)* Skip post-processing inside MathML (#39497) (#39502)
• *(markup)* Don't escape ambiguous characters in MathML (#39493) (#39505)
• Add missing checks to several API and web handlers (#39501) (#39507)
• Handle git branch name with special chars correctly (#39483) (#39515)
• Trace git command correctly (#39520) (#39524)
• *(git)* Reindex go-git storage when a concurrent repack removes packs (#39510) (#39534)
• *(oauth2)* Allow users to approve scope changes (#38942) (#39521)
• *(api)* Add index tiebreaker to commit status ordering (#39508) (#39525)
• *(git)* Avoid unnecessary timers during language stats (#39531) (#39535)
• Use READ COMMITTED transactions on MySQL and MariaDB (#39506) (#39537)
• *(markup)* Use installed math fonts for MathML in Chromium (#39491) (#39547)
• *(git)* Tolerate concurrent repacks in go-git storage (#39536) (#39556)
• Make image captcha work with csp (#39555)
• Use READ_COMMITTED_SNAPSHOT on MSSQL (#39512) (#39558)
• Make navbar stopwatch button can show popup (#39562)
• *(actions)* Restore pushes to protected branches (#39564) (#39567)
• *(api)* Allow bots with pending password changes (#39551) (#39566)
• *(user)* Restore organizations tab on user profile (#39577) (#39581)
• *(markup)* Link team mentions that use a different org name case (#39436) (#39588)
• *(httpcache)* Raw files return 304 after a change when the new commit is older (#39435) (#39591)
• *(git)* Return no submodule web link when the URL cannot be parsed (#39274) (#39592)
• *(pull)* Fetch PR head refs instead of pushing them (#39603) (#39607)
• Migrate broken team authorize access mode (#39579) (#39580)
• *(actions)* Refresh reusable caller status when children are skipped (#39589) (#39609)
• Make "edit pr title & target branch" get correct branch (#39612) (#39621)
• *(egress)* Expose more ranges as restricted rather than reserved (#39560) (#39624)
• *(web)* Normalize content for edit history diff and fix comment history dropdown (#39616) (#39627)
• Correct RemoveWithRetry error handling (#39619) (#39626)
• *(pull)* Refresh commits behind when an AGit pull request is updated (#39613) (#39625)
• *(models)* Chunk commit status queries to avoid SQLite expression depth limit (#39611) (#39638)
• Show "merge" form for empty PR (#39640) (#39645)