Gitea Enterprise 27.3.9 is released

We are excited to announce the release of Gitea Enterprise 27.3.9! This release fixes ten CVEs, adds migration from Bitbucket Server (Data Center), makes Gitea Agents more capable and predictable, gives you finer control over Semgrep code scanning, and speeds up pull request pages.

We strongly recommend upgrading. Every CVE fixed in this release is disclosed below.

Major Highlights

🚀 Migrate from Bitbucket Server (Data Center)

Gitea can now migrate repositories from Bitbucket Server (Data Center), backported from the Gitea community (#39913). Teams moving off Bitbucket can bring their repositories into Gitea Enterprise with the same migration workflow used for other sources.

🚀 Gitea Agents get smarter and safer

This release includes many improvements to Gitea Agents:

• More ways to start an agent: agents mentioned in a new issue or pull request are started and shown right away, and mentions on merged or closed pull requests are answered.
• Cross-repository work: agents look up related repositories and ask when none is found, open related-repository pull requests directly, request the configured reviewers on cross-repository pull requests, and name cross-repository subtasks in planner notices. Plan approval now defaults to never.
• Better review: review effort and recall are raised, a replayable review evaluation set was added, and a reviewer agent can opt out of approving agent pull requests.
• Easier configuration: the .agent config repository is created together with the agent and its README explains how to use it. Agent runs are recorded under a fixed workflow (.agents/workflow.yaml) and listed, and agent runs can start on an empty repository.
• Control over volume: a per-repository limit caps the number of open fix pull requests, and the advisories of one dependency are fixed in a single pull request.
• Smarter security sweeps: the most severe findings are swept first, then the busiest repositories; scheduled finding fixes and a bulk fix of open findings are available; findings that never got an automatic run are picked up.
• Fewer surprises: CI auto fix and branch maintenance skip work-in-progress pull requests, pull maintenance stops on unassign, a session is not marked failed when only some actions were refused, and agent session tokens are bound to the session of their attempt.

🚀 More control over Semgrep code scanning

Repositories can now choose which Semgrep rule sets they scan with, set a minimum confidence for findings, and exclude individual rules in their SAST ruleset file. Rules with MEDIUM-style severity labels are accepted, a sample of the rules is validated with a warning instead of a failure, and Semgrep gets a writable HOME. Code scanning and dependency details now show the finding fingerprint, and the scan allowlist settings are reworded as ignored paths and findings.

🚀 Pull request experience and performance

• The merge box shows the number of unresolved review conversations.
• Viewing a pull request with many push comments does far fewer queries: N+1 queries are cut, commits are loaded in batches, and only the combined commit status is loaded.
• Latest commit statuses are fetched with a single IN query, and the Actions job lookup is skipped for success and skipped statuses.
• Fewer redundant queries are made when creating Actions runs for a new pull request.

🚀 Other improvements

• runner controller inspect reports each runner's running tasks.
• A built-in OAuth2 application is pre-registered for gitea-vscode, and users can approve scope changes (#39801, #39521).
• Built-in theme names are translated in theme selectors, and error pages fall back to the raw theme name when no locale is available.
• The Docker image installs OpenSSH 10.4 or newer.

Security fixes and disclosed CVEs

• SECURITY
  • Only delete labels within their own repository or organization (CVE-2026-97204)
  • Return 404 for the repositories tab of individual users (CVE-2026-105661)
  • Require a user-bound state for the OpenID association callback (CVE-2026-104627)
  • Only match principal keys for SSH certificate principals (CVE-2026-109553)
  • Bound request body size in Actions artifacts v4 handlers (CVE-2026-105964)
  • Reject already linked attachments when adding release attachments (CVE-2026-110494)
  • Share permission checks for issue content and reactions, and reject locked issues (CVE-2026-107686)
  • Update golang.org/x/net to v0.60.0 (CVE-2026-78659)
  • Apply cross-origin protection to the repository topics endpoint (CVE-2026-107618)
  • Don't return all attachments for unsaved releases (CVE-2026-110311)
• DEPENDENCIES AND HARDENING
  • Install OpenSSH >= 10.4 from Alpine edge in the Docker image
  • Bump gitea.com/gitea/runner to fix a container.options privilege bypass
  • Bump happy-dom to 21.0.4, dompurify to 3.4.17, kin-openapi to v0.146.0 and seroval to 1.6.2

Download

Binaries for Gitea Enterprise 27.3.9 are available on the release page.