Skip to content

Gitea Enterprise 27.3.0 is released

Gitea Enterprise 27.3.0 is released
Gitea Team
20 min read

We are excited to announce the release of Gitea Enterprise 27.3.0! This is the first release of the 27.x line. It moves the community base from Gitea v1.26.4 to the Gitea v1.27 series, bringing every feature, performance and security fix delivered in Gitea 1.27.0, 1.27.1 and 1.27.2, while keeping all of the enterprise capabilities shipped in the 26.x line.

Because this release contains a very large number of security fixes, we strongly recommend upgrading. The full list of CVEs addressed by the new community base is disclosed below.

Major Breaking changes

Gitea Enterprise itself introduces no breaking changes in 27.3.0. However, the embedded Gitea moves from v1.26.4 to v1.27.2, so the upstream breaking changes of Gitea v1.27.0 apply:

  • Actions: improved support for reusable workflows (#37478) — reusable workflow resolution and job graph handling changed; review workflows that use uses: ./...
  • Content-Security-Policy now uses a script nonce (#37232) — custom templates that inject inline scripts must be updated

As always, back up your database and repository storage before upgrading.

Major Highlights

🚀 Reusable workflows, job summaries and scoped workflows

Actions gained first-class reusable workflow support, job summaries via GITHUB_STEP_SUMMARY, jobs.<job_id>.continue-on-error, workflow status badges, run status on the browser tab favicon, and owner-level and global scoped workflows so a whole organization can share one workflow definition.

🚀 Projects, assignees and issue workflow improvements

An issue or pull request can now belong to multiple projects, the sidebar has a project column picker, and new APIs cover assignees, review-comment replies and raw diff/patch for repository comparisons.

🚀 Branch protection bypass allowlist

Branch protection rules can define a bypass allowlist, which pairs naturally with the owner-level branch protection rules and multiple path-permission rules already available in Gitea Enterprise.

🚀 Search, discovery and UI polish

Organization members and teams pages gained search, teams can be made discoverable to organization members through team visibility, repository lists show pull request counts, Jupyter notebooks render in the web UI, and avatar stacks and the reworked commit and diff views make review faster.

🚀 Performance and platform work

Runner heartbeats are debounced, task picking is throttled, dashboard feeds use a wider index, and Elasticsearch was replaced by a REST client with OpenSearch support. OpenAPI 3.0 is served at /openapi.v1.json, and the API adds token introspection and self-deletion.

Security fixes and disclosed CVEs

The Gitea 1.27 series addressed a large number of security advisories. All of them are included in Gitea Enterprise 27.3.0.

Fixed in the Gitea 1.27.2 base

  • CVE-2026-73804: A token with only write:user scope could add an SSH key to its own account and then use HTTP Signature authentication to make API requests without any token scope enforcement, bypassing the API token scope boundary entirely.
  • CVE-2026-73539: The markup Context field was passed unescaped into the external renderer command line, allowing argument injection into the rendering process and remote code execution as the Gitea service user on instances that use $GITEA_PREFIX_SRC / $GITEA_PREFIX_RAW in a RENDER_COMMAND.
  • CVE-2026-73800: pull_request_target workflows resolved local reusable workflows (uses: ./...) from the fork’s HEAD commit instead of the base branch, letting attacker-controlled workflow code run with access to repository and organization secrets.
  • CVE-2026-73278: The OAuth2 and OpenID Connect sign-in paths only checked TOTP enrollment, so users whose sole second factor was WebAuthn received a full session without ever being challenged.
  • CVE-2026-73535: POST /user/openid/connect did not enforce second-factor authentication, so an attacker who knew a victim’s password could obtain a full session and permanently link an attacker-controlled OpenID identifier to the victim’s account — access that survived a password change.
  • CVE-2026-60008: The Jupyter notebook renderer interpolated the notebook’s language_info.name into a class attribute without the safe-attribute protection, on a path where the sanitizer is disabled, letting a repository file overlay and intercept clicks on a repository page.
  • CVE-2026-73814: A repository collaborator with Admin access could submit mode=4 to the collaboration access-mode endpoint to escalate to effective Owner permissions and transfer the repository to their own account.

Fixed in the Gitea 1.27.1 base

  • CVE-2026-59774: Unauthenticated arbitrary file read via the Org-mode #+INCLUDE directive.
  • CVE-2026-60004: Remote code execution via the diffpatch API through Git hook installation.

Fixed in the Gitea 1.27.0 base

  • CVE-2026-58443: Public-only repository tokens could update private pull-request head branches.
  • CVE-2026-58433: The team-repository linking endpoint bypassed the RepoAdminChangeTeamAccess organization setting.
  • CVE-2026-58435: Privilege escalation through LFS deploy keys.
  • CVE-2026-58436: Unauthenticated denial of service via quadratic-time parsing of the Accept-Language header.
  • CVE-2026-58437: Repository visibility could be manipulated via Git push options.
  • CVE-2026-58439: Branch protection bypass — retargeting a pull request preserved a stale official approval flag.
  • CVE-2026-54481: The internal API HTTP client no longer skips TLS certificate verification.
  • CVE-2026-55987: OAuth2 sign-in could reactivate an administrator-deactivated account on authentication sources that do not issue refresh tokens.
  • CVE-2026-57894: Repository migration followed Git HTTP redirects after URL allow/block validation, enabling internal repository exfiltration.
  • CVE-2026-58314: Two SSRF issues in repository migration.
  • CVE-2026-59765: SSRF via migration asset downloads that bypassed the host matcher, allowing internal files and cloud metadata to be read.
  • CVE-2026-58416: A fork pull-request Actions task could read a third private repository through the collaborative-owner branch.
  • CVE-2026-58420: Local file inclusion via a file:// URI in migration restore.
  • CVE-2026-58425: OAuth token introspection returned metadata for tokens issued to other clients.
  • CVE-2026-58427: The private organization member list could be leaked via the /members API endpoint.
  • CVE-2026-58428: The release-attachment extension allowlist could be bypassed through the web release edit form.
  • CVE-2026-58429: Public-only personal access tokens could bypass scope restrictions on organization and permission endpoints.
  • CVE-2026-58431: The public-only API token restriction was not enforced on team API routes.
  • CVE-2026-58432: Missing authorization checks allowed access to sensitive resources through user-controlled keys.
  • CVE-2026-58438: Cross-repository IDOR in issue-dependency removal let an attacker tamper with and comment on private repositories they could not access.
  • CVE-2026-58440: Webhooks created by a collaborator kept firing after that collaborator’s repository access was revoked.
  • CVE-2026-58441: SSRF in restore-repo via an unsanitized clone URL.
  • CVE-2026-58442: Repository-migration SSRF via a multi-answer DNS allow-list bypass.
  • CVE-2026-58444: A personal access token scope-enforcement bypass on the repository home page could disclose private repository contents.
  • CVE-2026-42931: Denial of service via unbounded request-body reading in the npm package tag endpoint.
  • CVE-2026-50105: The RSS/Atom feed handlers bypassed API-token scope and public-only confinement.
  • CVE-2026-55982: The OIDC userinfo endpoint returned identity claims without enforcing API-token scopes.
  • CVE-2026-55986: The email-management API bypassed the manage-credentials feature restriction.
  • CVE-2026-56443: A residual public-only token scope bypass on limited-visibility owners.
  • CVE-2026-56654: Privilege escalation via access-token scope escalation in the API.
  • CVE-2026-56657: Denial of service in the SSH key parser.
  • CVE-2026-56755: Denial of service caused by quadratic string concatenation in Debian package uploads.
  • CVE-2026-57886: Cross-repository issue and comment attachment re-linking could expose private attachment content.
  • CVE-2026-57897: Cross-repository information disclosure via the organization-level Actions run/job APIs.
  • CVE-2026-58507: Private repository existence disclosure via the go-get meta endpoint.
  • CVE-2026-58508: Two SSRF issues in migration/mirror (DNS rebinding and missing re-validation).
  • CVE-2026-58510: The repository watch-cleanup fix was not applied to the API EditRepo path, leaving stale watches when a repository became private.
  • CVE-2026-59763: Unbounded Arch package file metadata could cause resource amplification during package uploads.
  • CVE-2026-23603: Blind SSRF in OAuth2 avatar synchronization via an unvalidated OIDC picture claim.
  • CVE-2026-58417: The REST API exposed the membership of private organizations.
  • CVE-2026-58434: Private repository metadata remained accessible after access was revoked.
  • CVE-2026-58445: A cross-repository label-ID enumeration oracle in the delete-issue-label API.
  • CVE-2026-55984: A null-pointer dereference in the AddTime API could cause an authenticated denial of service.
  • CVE-2026-56750: Remember-me tokens were not invalidated correctly, allowing session reuse.
  • CVE-2026-58511: Webhook authorization headers were returned in plaintext via the API.

Full details, including reporter and patch credits, are published in the upstream release announcements for 1.27.0, 1.27.1 and 1.27.2.

How to install or update

Download our pre-built binaries from the Gitea Enterprise downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation

Changelog

27.3.0 - 2026-08-27

Enterprise

  • Changes
    • Upgrade the community base from Gitea 1.26.4 to Gitea 1.27.2
    • Carry over all enterprise features and fixes released in the 26.4.x line

Gitea 1.27.2

  • SECURITY
    • Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
    • Refactor: external render (#38885) (#38898)
    • Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
    • Refactor: markup render (#38864) (#38869)
    • Fix(deps): update dependency mermaid to v11.16.1 (#38816)
    • Fix(auth): set WebAuthn user verification per request (#38805) (#38810)
    • Fix: render highlight language (#38793) (#38795)
  • ENHANCEMENTS
    • enhance: add missing npm package metadata properties (#38826) (#38831)
  • BUGFIXES
    • fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
    • fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901)
    • fix(lfs): accept successful transfer responses (#38866) (#38875)
    • fix(packages): ignore nested Package.swift (#38788) (#38836)
    • fix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
    • fix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
    • fix(migration): migration deletion returned json redirection (#38796) (#38825)
    • fix(ui): change underlines to default browser style (#38819) (#38823)
    • fix(actions): allow cancelling runs without running jobs (#35842) (#38812)
    • fix(actions): evaluate each ${{ }} part on its own (#38754) (#38797)
    • fix(actions): write an action task report in one transaction (#38792) (#38794)
    • fix: markup link (#38764) (#38765)
    • fix: set a minio part size when the content size is unknown (#38753) (#38755)
    • fix: bad path escape in subpath archive download (#38749) (#38750)
    • fix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744)
    • fix(markdown): fix double strikethough on code (#38707) (#38729)
    • fix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722)
    • fix: correct full url when using sub-path (#38712) (#38716)
    • fix: avoid markup render panic (#38698) (#38703)
    • fix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
    • fix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)
    • fix(migrations): use all configured GitHub tokens (#38841) (#38846)

Gitea 1.27.1

  • SECURITY
  • API
    • fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
  • ENHANCEMENTS
    • enhance: improve diff contrast in light and dark themes (#37477) (#38574)
  • BUGFIXES
    • fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
    • fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
    • fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
    • fix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)
    • fix: orgmode render include path (#38642) (#38645)
    • fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
    • fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
    • fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
    • fix(actions): correctness and hardening fixes (#38518) (#38631)
    • fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
    • fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
    • fix(webhook): remove slack channel name check (#38608) (#38612)
    • fix: download dropdown menu clipped on the branches page (#38604) (#38609)
    • fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
    • fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
    • fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
    • fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
    • fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
    • fix: branch protection user list (#38570) (#38584)
    • fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
    • fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
    • fix(actions): support matrix when evaluating workflow if expression (#38474) (#38557)
    • fix(actions): align status icon span for Safari rendering (#38558) (#38562)
    • fix: revert git clone http redirection forbidden (#38530) (#38545)
    • fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
    • fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
    • fix: make the merge box button red if some checks fail (#38508) (#38516)
    • fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
    • fix: make commit message merge correctly (#38490) (#38502)
    • fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
    • fix(actions): make cancelled() work in job if evaluation (#38495) (#38497)
    • fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
    • fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
    • fix: full file highlighting for git diff with CR char (#38484) (#38491)
    • fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
    • fix: 500 error when updating user visibility (#38480) (#38483)
    • fix(actions): make job list item fully clickable (#38462) (#38471)
    • fix: mail template for push event (#38467) (#38468)
    • fix: make "test push webhook" always work (#38425) (#38455)
    • fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
    • fix(org): align follow button and wrap description (#38448) (#38454)
    • fix(actions): populate github.event for scheduled runs (#38446) (#38452)
  • MISC

Gitea 1.27.0

  • BREAKING
    • Feat(actions)!: improve support for reusable workflows (#37478)
    • Use Content-Security-Policy: script nonce (#37232)
  • SECURITY
    • Fix: various security fixes (#38406) (#38426)
    • Fix(security): harden access checks and migration validation (#38324) (#38400)
    • Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
    • Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
    • Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
    • Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
    • Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
    • Fix: golang html template url escaping (#38363) (#38369)
    • Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
    • Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
    • Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 security (#37786)
    • Fix(oauth): restrict introspection to the token's client (#38042)
    • Fix(api): don't expose private org membership via public_members (#38145)
    • Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
    • Fix(migrations): prevent path traversal in repository restore (#38215)
  • FEATURES
    • Feat(actions): add workflow status badge modal (#38196)
    • Feat(actions): support owner-level and global scoped workflows (#38154)
    • Feat(api): support ref suffixes in compare (#38148)
    • Feat(actions): implement jobs.<job_id>.continue-on-error (#38100)
    • Feat(actions): show run status on browser tab favicon (#38071)
    • Feat(api): add token introspection and self-deletion endpoint (#37995)
    • Feat(api): add q parameter to list branches API for server-side filtering (#37982)
    • Feat(repo): split repository creation limit into user and org scopes (#37872)
    • Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
    • Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
    • Feat(org): add team visibility so org members can discover teams (#37680)
    • Feat: add raw diff/patch endpoint for repository comparisons (#37632)
    • Feat: Add avatar stacks (#37594)
    • Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
    • Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
    • Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
    • Feat(orgs): Add search bar for organization members tab page (#37347)
    • Feat(api): Add assignees APIs (#37330)
    • Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
    • Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
    • Add project column picker to issue and pull request sidebar (#37037)
    • Allow multiple projects per issue and pull requests (#36784)
    • Feat(ui): add "follow rename" to file commit history list (#34994)
    • Feat(ssh): auto generate additional ssh keys (#33974)
  • ENHANCEMENTS
    • Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
    • Enhance: allow builtin default git config options to be overridden (#38172)
    • Enhance: allow MathML core elements (#38034)
    • Enhance(markup): improve issue title rendering (#37908)
    • Enhance(actions): set descriptive browser tab title on run view (#37870)
    • Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
    • Enhance(actions): show workflow name from YAML instead of filename (#37833)
    • Feat(actions): add before/after to PR synchronize event payload (#37827)
    • Enhance(actions): add branch filters to run list (#37826)
    • Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
    • Feat: add copy button to action step header, improve other copy buttons (#37744)
    • Fix(icon): use repo-forked icon to display forks count (#37731)
    • Feat(api): add sort and order query parameters to job list endpoints (#37672)
    • Feat(api): add last_sync to repository API (#37566)
    • Enhance: Adjust Workflow Graph styling (#37497)
    • Improve code editor text selection and clean up lint enablement (#37474)
    • Add mirror auth updates to repo edit API and settings (#37468)
    • Replace olivere/elastic with REST API client, add OpenSearch support (#37411)
    • Feat: Add default PR branch update style setting (#37410)
    • Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
    • Allow fast-forward-only merge when signed commits are required (#37335)
    • Enhance styling in actions page (#37323)
    • Fix: improve actions status icons and texts (#37206)
    • Make Markdown fenced code block work with more syntaxes (#37154)
    • Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
    • Add API endpoint to reply to pull request review comments (#36683)
  • PERFORMANCE
    • Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)
    • Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
    • Perf: Various performance regression fixes (#38078)
    • Perf: extend action c_u index to include created_unix for faster dashboard feeds (#38076)
    • Batch-load related data in actions run, job, and task API endpoints (#37032)
  • BUGFIXES
    • Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
    • Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)
    • Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)
    • Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)
    • Fix: actions task state concurrent update (#38405) (#38409)
    • Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)
    • Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)
    • Fix: co-author detection (#38392) (#38397)
    • Fix: incorrect co-author detection on commit page (#38386) (#38387)
    • Fix(ui): restore commits table column widths (#38379) (#38383)
    • Fix: minio init check (#38355) (#38361)
    • Fix: org project view assignee list (#38357) (#38360)
    • Fix(actions): release claimed task if context is cancelled during FetchTask (#38343) (#38347)
    • Fix(actions): make runner list pagination order deterministic (#38313) (#38327)
    • Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)
    • Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)
    • Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
    • Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)
    • Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)
    • Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)
    • Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)
    • Fix: update npm dependencies, fix misc issues (#38257)
    • Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
    • Fix: codemirror regressions (#38248)
    • Fix(api): support HEAD requests on all API GET endpoints (#38245)
    • Fix(actions): Cleanup workflow status badge code (#38241)
    • Fix(web): Correctly align the "disabled" label on larger workflow names (#38240)
    • Fix(actions): don't swallow HTML entities into linkified URLs (#38239)
    • Fix(packages): accept npm "repository" and "bin" in string form (#38236)
    • Fix(actions): fix 500 error when canceling a canceling task (#38223)
    • Fix(deps): update module golang.org/x/image to v0.43.0 security (#38219)
    • Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
    • Fix(api): deny private org member enumeration via /members (#38213)
    • Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
    • Fix(deps): update go dependencies (#38194)
    • Fix(deps): update npm dependencies (#38193)
    • Fix(cli): default must-change-password to false for bot users (#38175)
    • Fix(actions): show run index in run view and fix summary graph height (#38165)
    • Fix: csp (#38162)
    • Fix(deps): update npm dependencies (#38123)
    • Fix(mssql): expand legacy issue and comment long-text columns (#38120)
    • Fix(packages): validate debian distribution and component names (#38116)
    • Fix(packages): validate module version in goproxy ParsePackage (#38104)
    • Fix(deps): update dependency esbuild to v0.28.1 security (#38097)
    • Fix: git push hook post receive (#38089)
    • Fix(ui): prevent commit status popup overflowing its row (#38081)
    • Fix: validate gem name in rubygems parseMetadataFile (#38061)
    • Fix: commit display name (#38057)
    • Fix: csp regressions (#38047)
    • Fix: api error message (#38031)
    • Fix(deps): update npm dependencies (#38029)
    • Fix: pgsql lint (#38022)
    • Fix(indexer): fix assignee filters in issue search (#38021)
    • Fix: various dropdown problems (#38020)
    • Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
    • Fix: raise git required version to 2.13 (#37996)
    • Fix: remove "no-transfrom" from the cache-control header (#37985)
    • Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
    • Fix: use committer time where ever possible as default (#37969)
    • Fix(deps): update npm dependencies, remove nolyfill (#37968)
    • Fix(deps): update go dependencies (#37967)
    • Fix(pull): preserve squash message trailers and additional commit messages (#37954)
    • Fix(deps): update module golang.org/x/image to v0.41.0 security (#37904)
    • Fix: support ##command log prefix in action run UI (#37882)
    • Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
    • Fix(deps): update npm dependencies (#37844)
    • Fix(deps): update go dependencies (#37841)
    • Fix(frontend): resolve Vite assets by manifest source path (#37836)
    • Fix(locales): Replace hardcoded strings (#37788)
    • Fix(packages): render markdown links relative to linked repo (#37676)
    • Fix: persist mirror repository metadata (#37519)
    • Fix cmd tests by mocking builtin paths (#37369)
    • Add form-fetch-action to some forms, fix "fetch action" resp bug (#37305)
    • Feat: execute post run cleanup when workflow is cancelled (#37275)
    • Fix relative-time error and improve global error handler (#37241)
    • Refactor flash message and remove SanitizeHTML template func (#37179)
  • TESTING
    • Test(e2e): fix race in pdf file render test (#38380) (#38381)
    • Test: compare key file contents instead of FileInfo in TestInitKeys (#38330) (#38331)
    • Test: speed up two tests (#37905)
    • Test: Fix random failure test (#37887)
    • Test: fix flaky issue-comment close test (#37880)
    • Test: enable WAL for sqlite integration tests (#37861)
    • Test: fix flaky TestResourceIndex and reduce its runtime (#37847)
    • Test: run TestAPIRepoMigrate offline via a local clone source (#37817)
    • Ci: shard tests and reduce redundant work (#37618)
    • Test(e2e): run playwright via container (#37300)
    • Remove external service dependencies in migration tests (#36866)
  • BUILD
    • Fix(actions): authenticate snapcraft before nightly remote build (#38252)
    • Ci: cap Elasticsearch heap in db-tests (#37816)
    • Build(snap): publish nightly version to snapcraft via actions (#37814)
    • Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
    • Ci: narrow files-changed frontend filter (#37749)
    • Ci: add zizmor to lint-actions (#37720)
    • Chore: clean up "contrib" dir (#37690)
    • Fix: snap build (main branch) (#37685)
    • Ci: Also lint json5 files (#37659)
    • Feat(editor): broaden language detection in web code editor (#37619)
    • Build: update pnpm to v11 (#37591)
    • Refactor(deps): migrate from nektos/act fork to gitea/runner (#37557)
    • Refactor: lint bare fill/stroke colors, add vars for git graph color series (#37543)
    • Update go js py dependencies (#37525)
    • Ci: lint PR titles with commitlint (#37498)
    • Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
    • Update GitHub Actions to latest major versions (#37313)
    • Update go js dependencies (#37312)
    • Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
    • Remove htmx (#37224)
    • Replace custom Go formatter with golangci-lint fmt (#37194)
    • Refactor htmx and fetch-action related code (#37186)
    • Integrate renovate bot for all dependency updates (#37050)
    • Build(sign): move to sigstore (#38250)
  • DOCS
    • Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
    • Docs: fix duplicated word in foreachref doc comment (#38161)
    • Docs: Clarify criteria for becoming a merger (#38113)
    • Docs: Publish TOC Election Result 2026 (#38111)
    • Docs: mark openapi3 as autogenerated in attributes (#37963)
    • Docs: add development setup guide (#37960)
  • MISC
    • Revert(sign): restore gpg (#38251)
    • Refactor: replace legacy delete-button with link-action (#38143)
    • Refactor(actions): read runner capabilities from proto field (#38068)
    • Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
    • Refactor: Use db.Get instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
    • Fix(deps): update go dependencies (#37851)
    • Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
    • Ci: tweak files-changed, add free-disk-space (#37819)
    • Fix(deps): update module golang.org/x/crypto to v0.52.0 security (#37806)
    • Test(e2e): add comment, release, star, PR and fork tests (#37800)
    • Chore: simplify issue and pull request templates (#37799)
    • Chore: Update giteabot to fix failure when backport (#37789)
    • Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
    • Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
    • Ci: split giteabot workflow (#37770)
    • Fix(deps): update npm dependencies (#37768)
    • Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
    • Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
    • Ci: fix cache-related issues (#37761)
    • Chore: fix tests (#37760)
    • Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
    • Fix(deps): update npm dependencies (#37753)
    • Fix(deps): update go dependencies (#37752)
    • Chore(deps): update action dependencies (#37751)
    • Fix(markup): wrap indented code blocks for the code-copy button (#37748)
    • Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
    • Feat(web): also display PR counts in repo list (#37739)
    • Refactor(glob): use strings.Builder for regexp compilation (#37730)
    • Chore(doctor): remove four obsolete doctor check implementations (#37728)
    • Refactor(org): simplify owner-team org repo creation logic (#37727)
    • Refactor: move workflowpattern into modules/actions (#37717)
    • Chore: clean up tests (#37715)
    • Style: misc UI fixes (#37691)
    • Ci: add shellcheck linter (#37682)
    • Fix: catch and fix more lint problems (#37674)
    • Fix(deps): update dependency mermaid to v11.15.0 security, add e2e test (#37662)
    • Fix(deps): update npm dependencies (#37647)
    • Ci(renovate): update Go import paths on major bumps (#37641)
    • Fix(deps): update go dependencies (major) (#37639)
    • Chore(deps): update action dependencies (major) (#37638)
    • Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
    • Fix(deps): update npm dependencies (#37636)
    • Refactor(log): replace log.Critical with log.Error (#37624)
    • Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
    • Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
    • Chore(deps): update action dependencies (#37603)
    • Ci: allow chore type in PR title lint (#37575)
    • Refactor: only reset a database table when the table's data was changed (#37573)
    • Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
    • Refactor: use modernc sqlite driver as default (#37562)
    • Docs: fix 4 typos in CHANGELOG.md (#37549)
    • Fix(deps): update go dependencies (#37541)
    • Chore(deps): update action dependencies (#37540)
    • Refactor pull request view (6) (#37522)
    • Fix: redirect early CLI console logger to stderr (#37507)
    • Refactor "flex-list" to "flex-divided-list" (#37505)
    • Refactor compare diff/pull page (1) (#37481)
    • Refactor pull request view (4) (#37451)
    • Update 1.26.1 changelog in main (#37442)
    • Refactor: use named Permission field in Repository struct instead of anonymous embedding (#37441)
    • Refactor: serve site manifest via /assets/site-manifest.json endpoint (#37405)
    • Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
    • Update Block a user form (#37359)
    • Move review request functions to a standalone file (#37358)
    • Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
    • Enable strict TypeScript, add errorMessage helper (#37292)
    • Refactor frontend tw-justify-between layouts to flex-left-right (#37291)
    • Update Nix flake (#37284)
    • Fix Repository transferring page (#37277)
    • Remove SubmitEvent polyfill (#37276)
    • Remove dead code identified by deadcode tool (#37271)
    • Upgrade go-git to v5.18.0 (#37268)
    • Don't add useless labels which will bother changelog generation (#37267)
    • Move heatmap to first-party code (#37262)
    • Tests/integration: simplify code (#37249)
    • Add pagination and search box to org teams list (#37245)
    • Remove error returns from crypto random helpers and callers (#37240)
    • Add ExternalIDClaim option for OAuth2 OIDC auth source (#37229)
    • Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
    • Refactor "htmx" to "fetch action" (#37208)
    • Update go js py dependencies (#37204)
    • Add comment for the design of "user activity time" (#37195)
    • Remove outdated RunUser logic (#37180)
    • Models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150)
    • Update javascript dependencies (#37142)
    • Update go dependencies (#37141)
    • Frontport changelog of v1.26.0-rc0 (#37138)
    • Introduce ActionRunAttempt to represent each execution of a run (#37119)
    • Workflow Artifact Info Hover (#37100)
    • Extend issue context popup beyond markdown content (#36908)
    • Add bulk repository deletion for organizations (#36763)
    • Feat: Add bypass allowlist for branch protection (#36514)