Skip to content

Gitea Enterprise 26.4.4 is released

Gitea Enterprise 26.4.4 is released
Gitea Team
4 min read

We are excited to announce the release of Gitea Enterprise 26.4.4! This release rolls up the 26.4.1, 26.4.2 and 26.4.3 patch releases. It focuses on authentication policy, LDAP synchronization and audit logging, adds APIs for owner-level branch protection rules, and makes path-based push restrictions considerably more expressive. We strongly recommend upgrading to benefit from the latest hardening work — especially the fixes called out below.

Authentication & Directory Hardening

  • Administrators can now restrict which authentication sources may be used to sign in
  • Users created by LDAP synchronization are marked inactive until they are reviewed
  • Several correctness fixes in LDAP user-group synchronization, including only inspecting ldap-group elements when user groups are enabled

Audit Log Completeness

  • Promoting and demoting site administrators is now recorded as set_admin / unset_admin
  • The activate/deactivate audit entries now record the correct operator
  • Audit records no longer lose the client IP for certain event types

Dependency Update

  • Go was upgraded to 1.26.5

Major Breaking changes

No breaking changes are introduced in 26.4.4. Upgrades from 26.3.x and earlier 26.x releases should be seamless, with the usual recommendation to back up critical data before deploying. The embedded Gitea remains on v1.26.4, unchanged since Gitea Enterprise 26.4.0.

Major Highlights

🚀 APIs for owner-level branch protection rules

Owner-level branch protection rules are now fully manageable over the REST API. Organizations get GET, POST, PATCH and DELETE endpoints under /orgs/{org}/branch_protections, including a priority-ordered listing and a dedicated endpoint for reordering rule priorities. Rule names containing slashes are supported, and creating or updating a rule re-checks affected pull requests and emits an organization notification.

Inheritance is exposed too. /orgs/{org}/branch_protection_inheritance reads and sets whether an organization forces its rules onto repositories, while /repos/{owner}/{repo}/branch_protection_inheritance reports the effective value for a repository and lets it opt in or out — unless the organization has forced inheritance, in which case opting out is rejected.

🚀 Multiple path-permission rules per branch protection rule

A single branch protection rule can now carry several path-permission rules instead of just one, so a branch can express different push restrictions for different parts of the tree in one place. A "Test a path" helper lets administrators check, before saving, whether changes to a given file path would be allowed on that branch.

🚀 Choose how users are allowed to sign in

A new LOCAL_LOGIN_MODE setting controls the local password form. Set it to collapsed to fold the password form away behind the external sign-in methods, or to admin_only to allow password sign-in for site administrators only. When several sign-in methods are configured, administrators can also designate a primary sign-in method, which is listed first and visually highlighted.

🚀 Safer LDAP onboarding

Users created by LDAP synchronization are now marked inactive, so a new entry in your directory no longer grants immediate access to the instance — an administrator reviews and activates the account first. This release also corrects several issues in LDAP user-group synchronization, including only inspecting ldap-group elements when user groups are actually enabled. If your onboarding process relies on synchronized users being able to sign in right away, review your activation workflow before rolling this release out.

🚀 Enterprise license consistency in HA deployments

The enterprise license cache is now refreshed from the dynamic setting revision, so every pod in a high-availability deployment picks up a license update immediately instead of serving a stale copy. A related fix prevents the installer page from panicking when the license is read before the database is initialized.

How to install or update

Download our pre-built binaries from the Gitea Enterprise downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation

Changelog

26.4.4 - 2026-08-04

Enterprise

  • Features
    • Add APIs for owner-level branch protection rules
    • Support adding multiple path-permission rules to one branch protection rule
    • Only allow users to log in via specified auth source
    • Add set_admin/unset_admin audit log
    • Add UTF8 BOM to exported audit log CSV files
    • LDAP sync should mark new users as inactive
  • BugFixes
    • Fix missing client IP for some audit log types
    • Fixes for LDAP user group sync
    • Only check ldap-group elems when user groups are enabled
    • Fix wrong operator of activate/deactivate audit log
    • Fix audit log UI panic
    • Fix stale enterprise license cache across HA pods
    • Fix installer page panic when reading enterprise license before DB init
    • Fix Actions log background
    • Fix organization home overview members and teams
    • Fix theme
    • Backport #38480: fix 500 error when updating user visibility
    • Backport #38200: ensure all waiting jobs get runners in large workflows
  • Dependency
    • Upgrade Go to 1.26.5

This release is built on Gitea v1.26.4, unchanged since Gitea Enterprise 26.4.0.