Gitea Blog Blog

Gitea Runner 1.0.0 is released

Tue, 05 May 2026 21:00:00 GMT

We are happy to announce the release of Gitea Runner 1.0.0.

This is the first stable release of the official Gitea Actions runner under its new name. The project formerly known as act_runner has been renamed to Gitea Runner, with the repository now available at gitea/runner.

Why the rename?

The original act_runner name reflected the project's early implementation history and its relationship with nektos/act. Since then, Gitea Actions and the runner have grown into a core part of the Gitea ecosystem.

The new name makes the purpose clearer: this is the official runner for Gitea Actions.

Note: the last act_runner releases were on the v0.6.x line. Gitea Runner v1.0.0 is an intentional reset and starts a new stable versioning scheme under the new name.

What changed?

The most visible changes are the project, binary, and container image names:

Repository: gitea/runner
Binary: gitea-runner
Download path: https://dl.gitea.com/gitea-runner/
Docker image: gitea/runner

For example, registering and starting a runner now looks like this:

./gitea-runner register
./gitea-runner daemon

Docker users can use the new image name:

docker run \
  -e GITEA_INSTANCE_URL=https://gitea.example.com \
  -e GITEA_RUNNER_REGISTRATION_TOKEN= \
  -v /var/run/docker.sock:/var/run/docker.sock \
  --name gitea-runner \
  gitea/runner:1.0.0

Configuration

Gitea Runner continues to support the familiar registration flow, while encouraging explicit YAML configuration for runner settings.

You can generate a starting configuration with:

./gitea-runner generate-config > config.yaml

Then pass it to the commands that load runner configuration:

./gitea-runner -c config.yaml register
./gitea-runner -c config.yaml daemon
./gitea-runner -c config.yaml cache-server

If you prefer an environment-only setup (no config file), the runner still supports the environment variables shown above (GITEA_INSTANCE_URL and GITEA_RUNNER_REGISTRATION_TOKEN). A config file is the recommended way to manage runner behavior going forward.

Upgrade notes

If you already run act_runner, plan to update scripts, service files, Docker Compose files, Kubernetes manifests, and monitoring references to the new gitea-runner and gitea/runner names.

For many deployments, the migration is a straight rename. For example:

- act_runner daemon
+ gitea-runner daemon

- gitea/act_runner:0.2.x
+ gitea/runner:1.0.0

The old repository URL redirects to the new repository, but new documentation and release artifacts use the new naming.

As always, please test the new runner in your environment before rolling it out broadly, especially if your workflows depend on custom labels, Docker-in-Docker setups, rootless Docker, or external cache configuration.

Download

Pre-built binaries are available from the Gitea Runner downloads page.

The release is also available from the Gitea Runner release page.

Thank you

Thank you to everyone who contributed code, testing, bug reports, documentation, and feedback while the runner matured from its first releases to 1.0.0.

We would also like to thank the nektos/act project and contributors, whose work continues to be an important part of the Gitea Actions runner.

Gitea 1.26.1 is released

Tue, 21 Apr 2026 18:36:00 GMT

We are excited to announce the release of Gitea 1.26.1! We strongly recommend all users upgrade to this version, as it includes important fixes that address several significant issues since 1.26.0 and improves overall stability.

This release includes 22 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.26.1 - 2026-04-21

BUGFIXES
- Enhance GetActionWorkflow to support fallback references (#37283)
- Fix container auth for public instance (#37294)
- Fix Mermaid diagrams failing when node labels contain line breaks (#37299)
- Fix vite manifest update masking build errors (#37310)
- Fix button layout shift when collapsing file tree in editor (#37375)
- fix: commit status reporting (#37386)
- Fix org team assignee/reviewer lookups for team member permissions (#37391)
- Fix repo init README EOL (#37399)
- fix: dump with default zip type produces uncompressed zip (#37402)
- Fix AppFullLink (#37328)
- Fix bug when accessing user badges (#37329)
- Fix actions concurrency groups cross-branch leak (#37331)
- Fix an issue where changing an organization‘s visibility caused problems when users had forked its repositories. (#37344)
- fix(oauth): Error on auth sources with spaces (#37332)
- When the requested arch rpm is missing fall back to noarch (#37339)
- Fix URL related escaping for oauth2 (#37340)
- Use modern git update-index --cacheinfo syntax to support more file names (#37343)
- fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (#37360)
ENHANCEMENTS
- Add event.schedule context for schedule actions task (#37348)
DOCS
- Add URL to Learn more about blocking a user. (#37367)

Contributors

Gitea 1.26.0 is released

Sat, 18 Apr 2026 20:04:00 GMT

We are thrilled to announce the latest release of Gitea v1.26.0.

Gitea 1.26.0 brings exciting new features, performance improvements, and quality-of-life enhancements. Here are some notable changes and features in Gitea 1.26; for the full list, refer to the full release notes.

We are very thankful for the many people who have contributed to the project by sending code patches, reporting issues, translating, and supporting us in many other ways.

Security

This release addresses several important security vulnerabilities:

CVE-2026-28737: Stored XSS in the Gitea 3D File Viewer via the glTF extensionsRequired field. Fixed by #37233. Thanks to @yonatan-pl for reporting the issue, and to @silverwind and @wxiaoguang for the patch.
CVE-2026-22555: Missing CanCreateOrgRepo check in the API fork flow allowed exfiltration of organization secrets. Fixed by #36950. Thanks to @andrejtomci for reporting the issue, and to @lunny for the patch.
CVE-2026-27780: Branch protection bypass caused by silent truncation in bufio.Scanner during pre-receive hook processing. Fixed by #36963. Thanks to @yonatan-pl for reporting the issue, and to @lunny for the patch.
Bound PageSize in ListUnadoptedRepositories to prevent unbounded API responses (#36884).

How to Update

You can download it for example from our downloads page. Please read our installation guide for more information on installation. To upgrade, as always, back up your data and then replace the binary or Docker container and restart.

Special Thanks

We would like to thank all of our supporters on Open Collective who are helping to sustain the project financially.

As always, the changes are sorted descending by what we deem most important for users and admins, so the most important change comes first.

Are you looking for a seamless, hassle-free solution to manage your Git repositories? Look no further! Gitea Cloud is here to revolutionize your development experience.

Major Breaking Changes

⚠️ Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)

The standalone environment-to-ini tool was removed and a sub command of gitea has been introduced. If you need to re-create the configuration file with only a subset of keys, you can provide an INI template file and use the "--config-keep-keys" flag.

⚠️ Correct Swagger annotations for enums, status codes, and notification state (#37030)

The generated OpenAPI description is now aligned with the actual API: enum values, HTTP status codes, and notification state are documented more accurately. If you rely on the published Swagger spec for code generation or contract tests, regenerate clients and re-check any assumptions about optional fields or response shapes.

Thank you to @myers for contributing this change.

⚠️ Remove GET API registration-token (#36801)

The GET endpoint used to retrieve a registration token has been removed. Automation that still calls it needs to be updated to the supported registration flow for your deployment.

Thank you to @lunny for contributing this change.

⚠️ Support Actions `concurrency` syntax (#32751)

Workflows can now use GitHub-style concurrency groups so that new runs cancel or queue relative to in-progress jobs. That changes runtime behavior compared with earlier releases, so review existing workflows after upgrading—especially long-running or overlapping pipelines.

Thank you to @Zettat123 for contributing this feature.

⚠️ Make `PUBLIC_URL_DETECTION` default to `auto` (#36955)

New installations now default to automatic public URL detection. If you depend on a specific explicit URL configuration behind reverse proxies or alternate hostnames, confirm your [server] settings after upgrade so links, webhooks, and redirects still match your environment.

Thank you to @wxiaoguang for contributing this change.

Major Highlights (Code)

🚀 Add keyboard shortcuts for repository file and code search (#36416)

Navigate the code browser and search faster from the keyboard, similar to familiar shortcuts in other Git hosts.

Thank you to @micahkepe for contributing this feature.

🚀 Add support for archive-upload RPC (#36391)

Gitea now supports git archive --remote against the repository URL, so clients can fetch archives through Git’s remote archive protocol (not only through the HTTP download endpoints).

Thank you to @TheFox0x7 for contributing this feature.

🚀 Add ability to download subpath archive (#36371)

Download a zip or tarball for a subdirectory of the repository instead of the full tree, which is ideal for monorepos and partial checkouts.

Thank you to @TheFox0x7 for contributing this feature.

🚀 Automatic generation of release notes (#35977)

The release editor can generate Markdown notes server-side from merged pull requests and contributors, similar to GitHub, so publishing a version takes less manual editing.

Thank you to @dawidgora for contributing this feature.

🚀 Add "Go to file" and "Delete directory" on the repo file list (#35911)

Jump directly to a file by name and remove a whole directory from the browser when you have permission, streamlining everyday repository maintenance.

Your browser does not support embedded video

Thank you to @brymut for contributing this feature.

Major Highlights (Actions)

🚀 Support Actions `concurrency` syntax (#32751)

Workflows can declare concurrency groups so new runs cancel or queue behind in-flight jobs, closely matching GitHub Actions. Because this changes how overlapping runs behave, pair this with the migration notes in Major Breaking Changes above.

Thank you to @Zettat123 for contributing this feature.

🚀 Workflow dependency visualization and graph refresh (#26062) (#36248) (#36912)

Complex workflows are easier to understand: the run view can show how jobs depend on each other, and the workflow graph styling has been updated for clarity.

Thank you to @xDarkmanx and @bircni for contributing these improvements.

🚀 Add button to re-run failed jobs (#36924)

Retry only the jobs that failed instead of restarting the entire workflow when something flakes or is fixed out of band.

Thank you to @bircni for contributing this feature.

🚀 Support Actions and reusable workflows from private repositories (#32562)

Pipelines can reference actions and reusable workflows stored in private repos you can access, matching common CI patterns on other platforms.

Thank you to @Zettat123 for contributing this feature.

🚀 Configurable permissions for Actions automatic tokens (#36173)

Tune what the automatic GITHUB_TOKEN-style credential may do so you can follow least-privilege defaults per instance or organization.

Thank you to @Excellencedev for contributing this feature.

🚀 Per-runner disable and pause (#36776)

Administrators can pause or disable individual runners without removing them, which helps during maintenance or when isolating a bad host.

Thank you to @bircni for contributing this feature.

🚀 Non-zipped Actions artifacts (#36786)

Artifact upload/download can avoid zip wrapping where appropriate (with updated actions runner components), simplifying consumption from downstream jobs or external tools.

Thank you to @ChristopherHX for contributing this feature.

🚀 Summary on the Actions run view (#36883)

Run summaries surface key outcome information at a glance alongside logs and job status.

Thank you to @bircni for contributing this feature.

Major Highlights (Performance)

🚀 Refactor `cat-file` batch operations (#35775)

Git object reads use the newer --batch-command style where possible, cutting overhead for operations that touch many objects.

Thank you to @wxiaoguang for contributing this improvement.

🚀 Use merge tree to detect merge conflicts when possible (#36400)

Conflict detection can take a faster path by leveraging merge-tree when Git supports it, which speeds up pull request and merge previews on busy instances.

Thank you to @lunny for contributing this improvement.

Major Highlights (Administration)

🚀 Instance-wide info banner and maintenance mode (#36571)

Show a global notice to all users and optionally steer traffic while you perform maintenance, without ad-hoc proxy tricks.

Thank you to @bircni for contributing this feature.

🚀 User badges (#36752)

Profiles can display badges so teams can recognize roles, achievements, or internal designations at a glance.

Thank you to @bircni for contributing this feature.

Major Highlights (Build)

🚀 Migrate from webpack to Vite (#37002)

The front-end toolchain now builds with Vite for faster development feedback and leaner production bundles.

Thank you to @silverwind for contributing this migration.

🚀 Replace Monaco with CodeMirror (#36764)

In-browser editing uses CodeMirror instead of Monaco, improving consistency with the rest of the UI and bundle layout.

Thank you to @silverwind for contributing this change.

🚀 Replace CSRF cookie with `CrossOriginProtection` (#36183)

Cross-site request protections are modernized: the old CSRF cookie mechanism gives way to CrossOriginProtection, which may affect custom reverse-proxy or embedding setups—see upgrade notes if you tune CORS or cookies manually.

Thank you to @silverwind for contributing this change.

Major Highlights (Others)

🚀 Terraform state registry (#36710)

Host Terraform state in Gitea’s package registry so teams can coordinate infrastructure with the same access controls as code.

Thank you to @TheFox0x7 for contributing this feature.

🚀 Render OpenAPI specifications in the browser (#36449)

OpenAPI documents attached to the repository can be rendered for reading and exploration without leaving Gitea.

Thank you to @wxiaoguang for contributing this feature.

Changelog

BREAKING
- Correct swagger annotations for enums, status codes, and notification state (#37030)
- Remove GET API registration-token (#36801)
- Support Actions concurrency syntax (#32751)
- Make PUBLIC_URL_DETECTION default to "auto" (#36955)
SECURITY
- Bound PageSize in ListUnadoptedRepositories (#36884)
FEATURES
- Support Actions concurrency syntax (#32751)
- Add Terraform state registry (#36710)
- Instance-wide (global) info banner and maintenance mode (#36571)
- Support rendering OpenAPI spec (#36449)
- Add keyboard shortcuts for repository file and code search (#36416)
- Add support for archive-upload rpc (#36391)
- Add ability to download subpath archive (#36371)
- Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
- Automatic generation of release notes (#35977)
- Add "Go to file", "Delete directory" to repo file list page (#35911)
- Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
- Add button to re-run failed jobs in Actions (#36924)
- Support actions and reusable workflows from private repos (#32562)
- Add summary to action runs view (#36883)
- Add user badges (#36752)
- Add configurable permissions for Actions automatic tokens (#36173)
- Add per-runner "Disable/Pause" (#36776)
- Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
PERFORMANCE
- WorkflowDispatch API optionally return runid (#36706)
- Add render cache for SVG icons (#36863)
- Load mentionValues asynchronously (#36739)
- Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
- Load heatmap data asynchronously (#36622)
- Use prev/next pagination for user profile activities page to speed up (#36642)
- Refactor cat-file batch operations and support --batch-command approach (#35775)
- Use merge tree to detect conflicts when possible (#36400)
ENHANCEMENTS
- Implement logout redirection for reverse proxy auth setups (#36085) (#37171)
- Adds option to force update new branch in contents routes (#35592)
- Add viewer controller for mermaid (zoom, drag) (#36557)
- Add code editor setting dropdowns (#36534)
- Add elk layout support to mermaid (#36486)
- Add resolve/unresolve review comment API endpoints (#36441)
- Allow configuring default PR base branch (fixes #36412) (#36425)
- Add support for RPM Errata (updateinfo.xml) (#37125)
- Require additional user confirmation for making repo private (#36959)
- Add actions.WORKFLOW_DIRS setting (#36619)
- Avoid opening new tab when downloading actions logs (#36740)
- Implements OIDC RP-Initiated Logout (#36724)
- Show workflow link (#37070)
- Desaturate dark theme background colors (#37056)
- Refactor "org teams" page and help new users to "add member" to an org (#37051)
- Add webhook name field to improve webhook identification (#37025) (#37040)
- Make task list checkboxes clickable in the preview tab (#37010)
- Improve severity labels in Actions logs and tweak colors (#36993)
- Linkify URLs in Actions workflow logs (#36986)
- Allow text selection on checkbox labels (#36970)
- Support dark/light theme images in markdown (#36922)
- Enable native dark mode for swagger-ui (#36899)
- Rework checkbox styling, remove input border hover effect (#36870)
- Refactor storage content-type handling of ServeDirectURL (#36804)
- Use "Enable Gravatar" but not "Disable" (#36771)
- Use case-insensitive matching for Git error "Not a valid object name" (#36728)
- Add "Copy Source" to markup comment menu (#36726)
- Change image transparency grid to CSS (#36711)
- Add "Run" prefix for unnamed action steps (#36624)
- Persist actions log time display settings in localStorage (#36623)
- Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
- Improve BuildCaseInsensitiveLike with lowercase (#36598)
- Improve diff highlighting (#36583)
- Exclude cancelled runs from failure-only email notifications (#36569)
- Use full-file highlighting for diff sections (#36561)
- Color command/error logs in Actions log (#36538)
- Add paging headers (#36521)
- Improve timeline entries for WIP prefix changes in pull requests (#36518)
- Add FOLDER_ICON_THEME configuration option (#36496)
- Normalize guessed languages for code highlighting (#36450)
- Add chunked transfer encoding support for LFS uploads (#36380)
- Indicate when only optional checks failed (#36367)
- Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
- Support closing keywords with URL references (#36221)
- Improve diff file headers (#36215)
- Fix and enhance comment editor monospace toggle (#36181)
- Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#36164)
- Add matching pair insertion to markdown textarea (#36121)
- Add sorting/filtering to admin user search API endpoint (#36112)
- Allow action user have read permission in public repo like other user (#36095)
- Disable matchBrackets in monaco (#36089)
- Use GitHub-style commit message for squash merge (#35987)
- Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)
- Add GITEA_PR_INDEX env variable to githooks (#35938)
- Add proper error message if session provider can not be created (#35520)
- Add button to copy file name in PR files (#35509)
- Move X_FRAME_OPTIONS setting from cors to security section (#30256)
- Add placeholder content for empty content page (#37114)
- Add DEFAULT_DELETE_BRANCH_AFTER_MERGE setting (#36917)
- Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901)
- Add admin badge to navbar avatar (#36790)
- Add never option to PUBLIC_URL_DETECTION configuration (#36785)
- Add background and run count to actions list page (#36707)
- Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#36654)
- Add support for in_progress event in workflow_run webhook (#36979)
- Report commit status for pull_request_review events (#36589)
- Render merged pull request title as such in dashboard feed (#36479)
- Feature to be able to filter project boards by milestones (#36321)
- Use user id in noreply emails (#36550)
- Enable pagination on GiteaDownloader.getIssueReactions() (#36549)
- Remove striped tables in UI (#36509)
- Improve control char rendering and escape button styling (#37094)
- Support legacy run/job index-based URLs and refactor migration 326 (#37008)
- Add date to "No Contributions" tooltip (#36190)
- Show edit page confirmation dialog on tree view file change (#36130)
- Mention proc-receive in text for dashboard.resync_all_hooks func (#35991)
- Reuse selectable style for wiki (#35990)
- Support blue yellow colorblind theme (#35910)
- Support selecting theme on the footer (#35741)
- Improve online runner check (#35722)
- Add quick approve button on PR page (#35678)
- Enable commenting on expanded lines in PR diffs (#35662)
- Print PR-Title into tooltip for actions (#35579)
- Use explicit, stronger defaults for newly generated repo signing keys for Debian (#36236)
- Improve the compare page (#36261)
- Unify repo names in system notices (#36491)
- Move package settings to package instead of being tied to version (#37026)
- Add Actions API rerun endpoints for runs and jobs (#36768)
- Add branch_count to repository API (#35351) (#36743)
- Add created_by filter to SearchIssues (#36670)
- Allow admins to rename non-local users (#35970)
- Support updating branch via API (#35951)
- Add an option to automatically verify SSH keys from LDAP (#35927)
- Make "update file" API can create a new file when SHA is not set (#35738)
- Update issue.go with labels documentation (labels content, not ids) (#35522)
- Expose content_version for optimistic locking on issue and PR edits (#37035)
- Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
BUGFIXES
- Frontend iframe renderer framework: 3D models, OpenAPI (#37233) (#37273)
- Fix CODEOWNERS absolute path matching. (#37244) (#37264)
- Swift registry metadata: preserve more JSON fields and accept empty metadata (#37254) (#37261)
- Fix user ssh key exporting and tests (#37256) (#37258)
- Fix team member avatar size and add tooltip (#37253)
- Fix commit title rendering in action run and blame (#37243) (#37251)
- Fix corrupted JSON caused by goccy library (#37214) (#37220)
- Add test for "fetch redirect", add CSS value validation for external render (#37207) (#37216)
- Fix incorrect concurrency check (#37205) (#37215)
- Fix handle missing base branch in PR commits API (#37193) (#37203)
- Fix encoding for Matrix Webhooks (#37190) (#37201)
- Fix handle fork-only commits in compare API (#37185) (#37199)
- Indicate form field readonly via background, fix RunUser config (#37175, #37180) (#37178)
- Report structurally invalid workflows to users (#37116) (#37164)
- Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
- Rename CSS variables and improve colorblind themes (#36353)
- Hide add-matcher and remove-matcher from actions job logs (#36520)
- Prevent navigation keys from triggering actions during IME composition (#36540)
- Fix vertical alignment of .commit-sign-badge children (#36570)
- Fix duplicate startup warnings in admin panel (#36641)
- Fix CODEOWNERS review request attribution using comment metadata (#36348)
- Fix HTML tags appearing in wiki table of contents (#36284)
- Fix various bugs (#37096)
- Fix various legacy problems (#37092)
- Fix RPM Registry 404 when package name contains 'package' (#37087)
- Merge some standalone Vite entries into index.js (#37085)
- Fix various problems (#37077)
- Fix issue label deletion with Actions tokens (#37013)
- Hide delete branch or tag buttons in mirror or archived repositories. (#37006)
- Fix org contact email not clearable once set (#36975)
- Fix a bug when forking a repository in an organization (#36950)
- Preserve sort order of exclusive labels from template repo (#36931)
- Make container registry support Apple Container (basic auth) (#36920)
- Fix the wrong push commits in the pull request when force push (#36914)
- Add class "list-header-filters" to the div for projects (#36889)
- Fix dbfs error handling (#36844)
- Fix incorrect viewed files counter if reverted change was viewed (#36819)
- Refactor avatar package, support default avatar fallback (#36788)
- Fix README symlink resolution in subdirectories like .github (#36775)
- Fix CSS stacking context issue in actions log (#36749)
- Add gpg signing for merge rebase and update by rebase (#36701)
- Delete non-exist branch should return 404 (#36694)
- Fix TestActionsCollaborativeOwner (#36657)
- Fix multi-arch Docker build SIGILL by splitting frontend stage (#36646)
- Fix linguist-detectable attribute being ignored for configuration files (#36640)
- Fix state desync in ComboMarkdownEditor (#36625)
- Unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#36597)
- Pull Request Pusher should be the author of the merge (#36581)
- Fix various version parsing problems (#36553)
- Fix highlight diff result (#36539)
- Fix mirror sync parser and fix mirror messages (#36504)
- Fix bug when list pull request commits (#36485)
- Fix various bugs (#36446)
- Fix issue filter menu layout (#36426)
- Restrict branch naming when new change matches with protection rules (#36405)
- Fix link/origin referrer and login redirect (#36279)
- Generate IDs for HTML headings without id attribute (#36233)
- Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
- Fix issue close timeline icon (#36138)
- Fix diff blob excerpt expansion (#35922)
- Fix external render (#35727)
- Fix review request webhook bug (#35339) (#35723)
- Fix shutdown waitgroup panic (#35676)
- Cleanup ActionRun creation (#35624)
- Fix possible bug when migrating issues/pull requests (#33487)
- Various fixes (#36697)
- Apply notify/register mail flags during install load (#37120)
- Repair duration display for bad stopped timestamps (#37121)
- Fix(upgrade.sh): use HTTPS for GPG key import and restore SELinux context after upgrade (#36930)
- Fix various trivial problems (#36921)
- Fix various trivial problems (#36953)
- Fix NuGet package upload error handling (#37074)
- Fix CodeQL code scanning alerts (#36858)
- Refactor issue sidebar and fix various problems (#37045)
- Fix various problems (#37029)
- Fix relative-time RangeError (#37021)
- Fix chroma lexer mapping (#36629)
- Fix typos and grammar in English locale (#36751)
- Fix milestone/project text overflow in issue sidebar (#36741)
- Fix no-content message not rendering after comment edit (#36733)
- Fix theme loading in development (#36605)
- Fix workflow run jobs API returning null steps (#36603)
- Fix timeline event layout overflow with long content (#36595)
- Fix minor UI issues in runner edit page (#36590)
- Fix incorrect vendored detections (#36508)
- Fix editorconfig not respected in PR Conversation view (#36492)
- Don't create self-references in merged PRs (#36490)
- Fix potential incorrect runID in run status update (#36437)
- Fix file-tree ui error when adding files to repo without commits (#36312)
- Improve image captcha contrast for dark mode (#36265)
- Fix panic in blame view when a file has only a single commit (#36230)
- Fix spelling error in migrate-storage cmd utility (#36226)
- Fix code highlighting on blame page (#36157)
- Fix nilnil in onedev downloader (#36154)
- Fix actions lint (#36029)
- Fix oauth2 session gob register (#36017)
- Fix Arch repo pacman.conf snippet (#35825)
- Fix a number of strictNullChecks-related issues (#35795)
- Fix URLJoin, markup render link resolving, sign-in/up/linkaccount page common data (#36861)
- Hide delete directory button for mirror or archive repository and disable the menu item if user have no permission (#36384)
- Update message severity colors, fix navbar double border (#37019)
- Inline and lazy-load EasyMDE CSS, fix border colors (#36714)
- Closed milestones with no issues now show as 100% completed (#36220)
- Add test for ExtendCommentTreePathLength migration and fix bugs (#35791)
- Only turn links to current instance into hash links (#36237)
- Fix typos in code comments: doesnt, dont, wont (#36890)
REFACTOR
- Clean up and improve non-gitea js error filter (#37148) (#37155)
- Always show owner/repo name in compare page dropdowns (#37172) (#37200)
- Remove dead CSS rules (#37173) (#37177)
- Replace Monaco with CodeMirror (#36764)
- Replace CSRF cookie with CrossOriginProtection (#36183)
- Replace index with id in actions routes (#36842)
- Remove unnecessary function parameter (#35765)
- Move jobparser from act repository to Gitea (#36699)
- Refactor compare router param parse (#36105)
- Optimize 'refreshAccesses' to perform update without removing then adding (#35702)
- Clean up checkbox cursor styles (#37016)
- Remove undocumented support of signing key in the repository git configuration file (#36143)
- Switch cmd/ to use constructor functions. (#36962)
- Use relative-time to render absolute dates (#36238)
- Some refactors about GetMergeBase (#36186)
- Some small refactors (#36163)
- Use gitRepo as parameter instead of repopath when invoking sign functions (#36162)
- Move blame to gitrepo (#36161)
- Move some functions to gitrepo package to reduce RepoPath reference directly (#36126)
- Use gitrepo's clone and push when possible (#36093)
- Remove mermaid margin workaround (#35732)
- Move some functions to gitrepo package (#35543)
- Move GetDiverging functions to gitrepo (#35524)
- Use global lock instead of status pool for cron lock (#35507)
- Use explicit mux instead of DefaultServeMux (#36276)
- Use gitrepo's push function (#36245)
- Pass request context to generateAdditionalHeadersForIssue (#36274)
- Move assign project when creating pull request to the same database transaction (#36244)
- Move catfile batch to a sub package of git module (#36232)
- Use gitrepo.Repository instead of wikipath (#35398)
- Use experimental go json v2 library (#35392)
- Refactor template render (#36438)
- Refactor GetRepoRawDiffForFile to avoid unnecessary pipe or goroutine (#36434)
- Refactor text utility classes to Tailwind CSS (#36703)
- Refactor git command stdio pipe (#36422)
- Refactor git command context & pipeline (#36406)
- Refactor git command stdio pipe (#36393)
- Remove unused functions (#36672)
- Refactor Actions Token Access (#35688)
- Move commit related functions to gitrepo package (#35600)
- Move archive function to repo_model and gitrepo (#35514)
- Move some functions to gitrepo package (#35503)
- Use git model to detect whether branch exist instead of gitrepo method (#35459)
- Some refactor for repo path (#36251)
- Extract helper functions from SearchIssues (#36158)
- Refactor merge conan and container auth preserve actions taskID (#36560)
- Refactor Nuget Auth to reuse Basic Auth Token Validation (#36558)
- Refactor ActionsTaskID (#36503)
- Refactor auth middleware (#36848)
- Refactor code render and render control chars (#37078)
- Clean up AppURL, remove legacy origin-url webcomponent (#37090)
- Remove util.URLJoin and replace all callers with direct path concatenation (#36867)
- Replace legacy tw-flex utility classes with flex-text-block/inline (#36778)
- Mark unused&immature activitypub as "not implemented" (#36789)
TESTING
- Add e2e tests for server push events (#36879)
- Rework e2e tests (#36634)
- Add e2e reaction test, improve accessibility, enable parallel testing (#37081)
- Increase e2e test timeouts on CI to fix flaky tests (#37053)
BUILD
- Upgrade go-git to v5.18.0 (#37269)
- Replace rollup-plugin-license with rolldown-license-plugin (#37130) (#37158)
- Bump min go version to 1.26.2 (#37139) (#37143)
- Convert locale files from ini to json format (#35489)
- Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#36180)
- Port away from flake-utils (#35675)
- Remove nolint (#36252)
- Update the Unlicense copy to latest version (#36636)
- Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)
- Replace google/go-licenses with custom generation (#36575)
- Update go dependencies (#36548)
- Bump appleboy/git-push-action from 1.0.0 to 1.2.0 (#36306)
- Remove fomantic form module (#36222)
- Bump setup-node to v6, re-enable cache (#36207)
- Bump crowdin/github-action from 1 to 2 (#36204)
- Revert "Bump alpine to 3.23 (#36185)" (#36202)
- Update chroma to v2.21.1 (#36201)
- Bump astral-sh/setup-uv from 6 to 7 (#36198)
- Bump docker/build-push-action from 5 to 6 (#36197)
- Bump aws-actions/configure-aws-credentials from 4 to 5 (#36196)
- Bump dev-hanz-ops/install-gh-cli-action from 0.1.0 to 0.2.1 (#36195)
- Add JSON linting (#36192)
- Enable dependabot for actions (#36191)
- Bump alpine to 3.23 (#36185)
- Update chroma to v2.21.0 (#36171)
- Update JS deps and eslint enhancements (#36147)
- Update JS deps (#36091)
- update golangci-lint to v2.7.0 (#36079)
- Update JS deps, fix deprecations (#36040)
- Update JS deps (#35978)
- Add toolchain directive to go.mod (#35901)
- Move gitea-vet to use go tool (#35878)
- Update to go 1.25.4 (#35877)
- Enable TypeScript strictNullChecks (#35843)
- Enable vue/require-typed-ref eslint rule (#35764)
- Update JS dependencies (#35759)
- Move codeformat folder to tools (#35758)
- Update dependencies (#35733)
- Bump happy-dom from 20.0.0 to 20.0.2 (#35677)
- Bump setup-go to v6 (#35660)
- Update JS deps, misc tweaks (#35643)
- Bump happy-dom from 19.0.2 to 20.0.0 (#35625)
- Use bundled version of spectral (#35573)
- Update JS and PY deps (#35565)
- Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#35557)
- Migrate from webpack to vite (#37002)
- Update JS dependencies and misc tweaks (#37064)
- Update to eslint 10 (#36925)
- Optimize Docker build with dependency layer caching (#36864)
- Update JS deps (#36850)
- Update tool dependencies and fix new lint issues (#36702)
- Remove redundant linter rules (#36658)
- Move Fomantic dropdown CSS to custom module (#36530)
- Remove and forbid @ts-expect-error (#36513)
- Refactor git command stderr handling (#36402)
- Enable gocheckcompilerdirectives linter (#36156)
- Replace lint-go-gopls with additional govet linters (#36028)
- Update golangci-lint to v2.6.0 (#35801)
- Misc tool tweaks (#35734)
- Add cache to container build (#35697)
- Upgrade vite (#37126)
- Update setup-uv to v8.0.0 (#37101)
- Upgrade go-git to v5.17.2 and related dependencies (#37060)
- Raise minimum Node.js version to 22.18.0 (#37058)
- Upgrade golang.org/x/image to v0.38.0 (#37054)
- Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#36876)
- Enable eslint concurrency (#36878)
- Vendor relative-time-element as local web component (#36853)
- Update material-icon-theme v5.32.0 (#36832)
- Update Go dependencies (#36781)
- Upgrade minimatch (#36760)
- Remove i18n backport tool at the moment because of translation format changed (#36643)
- Update emoji data for Unicode 16 (#36596)
- Update JS dependencies, adjust webpack config, misc fixes (#36431)
- Update material-icon-theme to v5.31.0 (#36427)
- Update JS and PY deps (#36383)
- Bump alpine to 3.23, add platforms to docker-dryrun (#36379)
- Update JS deps (#36354)
- Update goldmark to v1.7.16 (#36343)
- Update chroma to v2.22.0 (#36342)
DOCS
- Update AI Contribution Policy (#37022)
- Update AGENTS.md with additional guidelines (#37018)
- Add missing cron tasks to example ini (#37012)
- Add AI Contribution Policy to CONTRIBUTING.md (#36651)
- Minor punctuation improvement in CONTRIBUTING.md (#36291)
- Add documentation for markdown anchor post-processing (#36443)
MISC
- Correct spelling (#36783)
- Update Nix flake (#37110)
- Update Nix flake (#37024)
- Add valid github scopes (#36977)
- Update Nix flake (#36943)
- Update Nix flake (#36902)
- Update Nix flake (#36857)
- Update Nix flake (#36787)

Contributors for this release

We thank all contributors who helped make this release possible!

And many more contributors who have helped with testing, reporting issues, and translating!

We will thank all original contributors of backport pull requests on next release.

Gitea 1.25.5 is released

Mon, 16 Mar 2026 18:36:00 GMT

We're excited to announce the release of Gitea 1.25.5! We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements.

CVE-2026-25779: Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716). Thanks to @quirmz for the report, and thanks to @lunny for the fix.
CVE-2026-27660: Fix the release draft permission check (#36659) (#36715). Thanks to @anticomputer for the report, and thanks to @lunny for the fix.
CVE-2026-27657: Fix an issue where a user could change another user's primary email address (#36586) (#36607). Thanks to @CsEnox for the report, and thanks to @lunny for the fix.
CVE-2026-26232: Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851). Thanks to @sammiee5311 for the report, and thanks to @lunny for the fix.
CVE-2026-22547: Add validation constraints for repository creation fields (#36671) (#36757). Thanks to @brettm220 for the report, and thanks to @lunny for the fix.
CVE-2026-24690: Fix permission checks for updating or rebasing pull request branches (#36465) (#36838). Thanks to the CodeThreat Security Research Team and @Alexander Girgis for the report, and thanks to @lunny for the fix.
CVE-2026-26292: Add HTTP transport support for LFS in push/sync mirror migrations (#36665) (#36691). Thanks to @allsmog for the report, and thanks to @lunny for the fix.
CVE-2026-20909: Fix the track time list permission check (#36662) (#36744).
CVE-2026-25782: Fix incorrect issue ID handling in time tracking (#36664) (#36689). Thanks to @CsEnox for the report, and thanks to @lunny for the fix.
CVE-2026-25718: Fix path resolution handling (#36734) (#36746). Thanks to @yonatan-pl for the report, and thanks to @wxiaoguang for the fix.
CVE-2026-28705: Fix a bug affecting release asset dumping (#36799) (#36839). Thanks to Robert Flosbach from Neodyme AG for the report, and thanks to @lunny for the fix.
CVE-2026-25712: Fix org permission API visibility checks for hidden members and private organizations (#36798) (#36841). Thanks to Maximilian Luff (https://github.com/maluff), Daniel Zahl (https://github.com/Sai2r), Marcus Gelderie (https://github.com/mgelde) for the report, and thanks to @lunny for the fix.
CVE-2026-27779: Fix forwarded proto handling for public URL detection (#36810) (#36836). Thanks to fed01k for the report and thanks to @lunny for the fix.
CVE-2026-26307: Add a timeout for git grep searches (#36809) (#36835). Thanks to uug4na for the report, and thanks to @lunny for the fix.
CVE-2026-26247: Fix OAuth2 S256 handling (#36462) (#36477). Thanks to Aisle Research for the report, and thanks to @lunny for the fix.

Dependency Update

Go upgrades to 1.25.8 which includes security fixes

This release includes 42 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Download our pre-built binaries from the Gitea downloads page - make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud - A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

SECURITY
- Toolchain Update to Go 1.25.6 (#36480) (#36487)
- Adjust the toolchain version (#36537) (#36542)
- Update toolchain to 1.25.8 for v1.25 (#36888)
- Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716)
- Fix get release draft permission check (#36659) (#36715)
- Fix a bug user could change another user's primary email (#36586) (#36607)
- Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851)
- Add validation constraints for repository creation fields (#36671) (#36757)
- Fix bug to check whether user can update pull request branch or rebase branch (#36465) (#36838)
- Add migration http transport for push/sync mirror lfs (#36665) (#36691)
- Fix track time list permission check (#36662) (#36744)
- Fix track time issue id (#36664) (#36689)
- Fix path resolving (#36734) (#36746)
- Fix dump release asset bug (#36799) (#36839)
- Fix org permission API visibility checks for hidden members and private orgs (#36798) (#36841)
- Fix forwarded proto handling for public URL detection (#36810) (#36836)
- Add a git grep search timeout (#36809) (#36835)
- Fix oauth2 s256 (#36462) (#36477)
ENHANCEMENTS
- Make security-check informational only (#36681) (#36852)
- Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (#36840)
- Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (#36688) (#36692)
- Upgrade gogit to 5.16.5 (#36687)
- Add wrap to runner label list (#36565) (#36574)
- Add dnf5 command for Fedora in RPM package instructions (#36527) (#36572)
- Allow scroll propagation outside code editor (#36502) (#36510)
BUGFIXES
- Fix non-admins unable to automerge PRs from forks (#36833) (#36843)
- Fix bug when pushing mirror with wiki (#36795) (#36807)
- Fix artifacts v4 backend upload problems (#36805) (#36834)
- Fix CRAN package version validation to allow more than 4 version components (#36813) (#36821)
- Fix force push time-line commit comments of pull request (#36653) (#36717)
- Fix SVG height calculation in diff viewer (#36748) (#36750)
- Fix push time bug (#36693) (#36713)
- Fix bug the protected branch rule name is conflicted with renamed branch name (#36650) (#36661)
- Fix bug when do LFS GC (#36500) (#36608)
- Fix focus lost bugs in the Monaco editor (#36609)
- Reprocess htmx content after loading more files (#36568) (#36577)
- Fix assignee sidebar links and empty placeholder (#36559) (#36563)
- Fix issues filter dropdown showing empty label scope section (#36535) (#36544)
- Fix various mermaid bugs (#36547) (#36552)
- Fix data race when uploading container blobs concurrently (#36524) (#36526)
- Correct spacing between username and bot label (#36473) (#36484)

Contributors

Gitea 1.25.4 is released

Thu, 22 Jan 2026 18:32:00 GMT

We're excited to announce the release of Gitea 1.25.4! We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements.

Permission & Protection Checks

CVE-2026-20736: Release attachments must belong to the intended repo (#36347) (#36375)
CVE-2026-20750: Fix permission check on org project operations (#36318) (#36373)
CVE-2026-20883: Add more check for stopwatch read or list (#36340) (#36368)
CVE-2026-20904: Fix openid setting check (#36346) (#36361)
CVE-2026-20888: Fix cancel auto merge bug (#36341) (#36356)
CVE-2026-20912: Fix delete attachment check (#36320) (#36355)
CVE-2026-20897: LFS locks must belong to the intended repo (#36344) (#36349)

Information Leakage Prevention

CVE-2026-0798: Clean watches when make a repository private and check permission when send release emails (#36319) (#36370)
CVE-2026-20800: Fix bug on notification read (#36339) (#36387)

Dependency Update

Go upgrades to 1.25.6 which includes security fixes to the go command, and the archive/zip, crypto/tls, and net/url packages, as well as bug fixes.

Thanks for spingARbor to report these security vulnerabilities.

This release includes 27 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

SECURITY
- Release attachments must belong to the intended repo (#36347) (#36375)
- Fix permission check on org project operations (#36318) (#36373)
- Clean watches when make a repository private and check permission when send release emails (#36319) (#36370)
- Add more check for stopwatch read or list (#36340) (#36368)
- Fix openid setting check (#36346) (#36361)
- Fix cancel auto merge bug (#36341) (#36356)
- Fix delete attachment check (#36320) (#36355)
- LFS locks must belong to the intended repo (#36344) (#36349)
- Fix bug on notification read (#36339) #36387
ENHANCEMENTS
- Add more routes to the "expensive" list (#36290)
- Make "commit statuses" API accept slashes in "ref" (#36264) (#36275)
BUGFIXES
- Fix markdown newline handling during IME composition (#36421) #36424
- Fix missing repository id when migrating release attachments (#36389)
- Fix bug when compare in the pull request (#36363) (#36372)
- Fix incorrect text content detection (#36364) (#36369)
- Fill missing has_code in repository api (#36338) (#36359)
- Fix notifications pagination query parameters (#36351) (#36358)
- Fix some trivial problems (#36336) (#36337)
- Prevent panic when GitLab release has more links than sources (#36295) (#36305)
- Fix stats bug when syncing release (#36285) (#36294)
- Always honor user's choice for "delete branch after merge" (#36281) (#36286)
- Use the requested host for LFS links (#36242) (#36258)
- Fix panic when get editor config file (#36241) (#36247)
- Fix regression in writing authorized principals (#36213) (#36218)
- Fix WebAuthn error checking (#36219) (#36235)

Contributors

Gitea 1.25.3 is released

Thu, 18 Dec 2025 18:31:00 GMT

We’re excited to announce the release of Gitea 1.25.3! We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements.

In this release, Gitea has been upgraded to Go 1.25.5, which addresses two security vulnerabilities in crypto/x509: GO-2025-4175 and GO-2025-4155. We would like to thank @silverwind for providing the patches.

This release includes 23 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

SECURITY
- Bump toolchain to go1.25.5, misc fixes (#36082)
ENHANCEMENTS
- Add strikethrough button to markdown editor (#36087) (#36104)
- Add "site admin" back to profile menu (#36010) (#36013)
- Improve math rendering (#36124) (#36125)
BUGFIXES
- Check user visibility when redirecting to a renamed user (#36148) (#36159)
- Fix various bugs (#36139) (#36151)
- Fix bug when viewing the commit diff page with non-ANSI files (#36149) (#36150)
- Hide RSS icon when viewing a file not under a branch (#36135) (#36141)
- Fix SVG size calulation, only use style attribute (#36133) (#36134)
- Make Golang correctly delete temp files during uploading (#36128) (#36129)
- Fix the bug when ssh clone with redirect user or repository (#36039) (#36090)
- Use Golang net/smtp instead of gomail's smtp to send email (#36055) (#36083)
- Fix edit user email bug in API (#36068) (#36081)
- Fix bug when updating user email (#36058) (#36066)
- Fix incorrect viewed files counter if file has changed (#36009) (#36047)
- Fix container registry error handling (#36021) (#36037)
- Fix webAuthn insecure error view (#36165) (#36179)
- Fix some file icon ui (#36078) (#36088)
- Fix Actions pull_request.paths being triggered incorrectly by rebase (#36045) (#36054)
- Fix error handling in mailer and wiki services (#36041) (#36053)
- Fix bugs when comparing and creating pull request (#36166) (#36144)

Contributors

Gitea 1.25.2 is released

Sun, 23 Nov 2025 04:05:00 GMT

We are excited to announce the release of Gitea 1.25.2! We strongly recommend all users upgrade to this version, as it includes important security fixes and improves overall stability.

We've fixed a number of permission and authentication issues to improve security and consistency across the platform:

Permission & Protection Checks

Fixed permission validation for deleting releases.
Corrected branch protection checks when updating pull requests via rebase.
Fixed permission checks for issue dependencies.
Fixed validation for deleting comment history entries.

Information Leakage Prevention

Unified the error message for "non-existing user" and "invalid password" to avoid revealing account existence.
- Resolves issue #35984
Prevented draft releases from being visible to users without write access.
Updated API behavior to return the signature's email address rather than the user profile's email.

Dependency Update

Updated golang.org/x/crypto from v0.43.0 -> v0.45.0 to address the critical security issue GO-2025-4134.

Thanks @d3struct1v3-create, @tartas1995 and forgejo team for the security information. Thanks @wxiaoguang and @lunny for the patches.

This release includes 23 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.25.2 - 2025-11-23

SECURITY
- Upgrade golang.org/x/crypto to 0.45.0 (#35985) (#35988)
- Fix various permission & login related bugs (#36002) (#36004)
ENHANCEMENTS
- Display source code downloads last for release attachments (#35897) (#35903)
- Change project default column icon to 'star' (#35967) (#35979)
BUGFIXES
- Disabled GCM OAuth2 flow attempts when OAuth2 itself is disabled which is part of (#36002) (#36004)
- Allow empty commit when merging pull request with squash style (#35989) (#36003)
- Fix container push tag overwriting (#35936) (#35954)
- Fix corrupted external render content (#35946) and upgrade golang.org/x packages (#35950)
- Limit reading bytes instead of ReadAll (#35928) (#35934)
- Use correct form field for allowed force push users in branch protection API (#35894) (#35908)
- Fix team member access check (#35899) (#35905)
- Fix conda null depend issue (#35900) (#35902)
- Set the dates to now when not specified by the caller (#35861) (#35874)
- Fix gogit ListEntriesRecursiveWithSize (#35862)
- Misc CSS fixes (#35888) (#35981)
- Don't show unnecessary error message to end users for DeleteBranchAfterMerge (#35937) (#35941)
- Load jQuery as early as possible to support custom scripts (#35926) (#35929)
- Allow to display embed images/pdfs when SERVE_DIRECT was enabled on MinIO storage (#35882) (#35917)
- Make OAuth2 issuer configurable (#35915) (#35916)
- Fix #35763: Add proper page title for project pages (#35773) (#35909)
- Fix avatar upload error handling (#35887) (#35890)
- Contribution heatmap improvements (#35876) (#35880)
- Remove padding override on .ui .sha.label (#35864) (#35873)
- Fix pull description code label background (#35865) (#35870)

Contributors

Gitea 1.25.1 is released

Tue, 04 Nov 2025 17:24:00 GMT

We are excited to announce the release of Gitea 1.25.1! We strongly recommend all users upgrade to this version, as it includes important fixes that address several significant issues introduced in 1.25.0 and improves overall stability.

In particular, issue #35832 has been resolved. A new doctor sub-command, introduced in #35845, is now available to help automatically repair affected environments.

This release includes 15 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.25.1 - 2025-11-04

BUGFIXES
- Make ACME email optional (#35849) #35857
- Add a doctor command to fix inconsistent run status (#35840) (#35845)
- Remove wrong code (#35846)
- Fix viewed files number is not right if not all files loaded (#35821) (#35844)
- Fix incorrect pull request counter (#35819) (#35841)
- Upgrade go mail to 0.7.2 and fix the bug (#35833) (#35837)
- Revert gomail to v0.7.0 to fix sending mail failed (#35816) (#35824)
- Fix clone mixed bug (#35810) (#35822)
- Fix cli "Before" handling (#35797) (#35808)
- Improve and fix markup code preview rendering (#35777) (#35787)
- Fix actions rerun bug (#35783) (#35784)
- Fix actions schedule update issue (#35767) (#35774)
- Fix circular spin animation direction (#35785) (#35823)
- Fix file extension on gogs.png (#35793) (#35799)
- Add pnpm to Snapcraft (#35778)

Contributors

Gitea 1.25.0 is released

Wed, 29 Oct 2025 18:03:00 GMT

We are thrilled to announce the latest release of Gitea v1.25.0.

Gitea 1.25.0 brings exciting new features, performance improvements, and quality-of-life enhancements. Here are some notable changes and features in Gitea 1.25; for the full list, refer to the full release notes.

We are very thankful for the many people who have contributed to the project from sending code patches, reporting issues, translating, and in supporting us in many other ways too.

How to Update

You can download it for example from our downloads page. Please read our installation guide for more information on installation. For upgrade, as always, backup your data and then replace the binary or docker container and restart.

Special Thanks

We would like to thank all of our supporters on Open Collective who are helping to sustain the project financially.

As always, the changes are sorted descending by what we deem most important for users and admins, so the most important change comes first.

Are you looking for a seamless, hassle-free solution to manage your Git repositories? Look no further! Gitea Cloud is here to revolutionize your development experience.

Major Breaking changes

⚠️ Remove deprecated auth sources (#35272)

Deprecated authentication sources have been removed in this version. Please ensure your authentication configuration is up to date before upgrading.

⚠️ Refactor and update mail templates (#35150)

Mail templates have been refactored to improve maintainability. If you have customized mail templates, please note that this is a breaking change.

Thank you to @techknowlogick for contributing this feature.

Major Highlights (Code)

🚀 Stream repository archives by default (#35487)

Repository archives (zip/tar.gz/bundle) are now streamed by default, significantly improving performance and reducing memory usage when downloading large repositories. This enhancement provides a better user experience, especially for large projects.

Thank you to @ChristopherHX for contributing this feature.

🚀 Add support for 3D/CAD file formats preview (#34794)

Gitea now supports previewing 3D and CAD file formats directly in the web interface! This includes support for STL, OBJ, and other common 3D file formats, making it easier for engineering and design teams to collaborate on 3D models and CAD designs without leaving Gitea.

Thank you to @kerwin612 for contributing this feature.

🚀 Edit file workflow for creating a fork and proposing changes (#34240)

A streamlined edit file workflow has been introduced, allowing users to create a fork and propose changes more easily. When editing a file in a repository you don't have write access to, Gitea will now automatically offer to create a fork and open a pull request with your changes.

Thank you to @brechtvl for contributing this feature.

🚀 Follow file symlinks in the UI to their target (#28835)

The UI now follows file symlinks to their target files, making it easier to navigate repositories with symbolic links. When viewing a symlink in the file browser, you can now click through to see the actual file content.

Thank you to @delvh for contributing this feature.

🚀 Support Basic Authentication for archive downloads (#35087)

Repository archive downloads now support Basic Authentication, making it easier to integrate with automation tools and scripts that need to download repository archives programmatically.

Thank you to @pvgoran for contributing this feature.

🚀 Use configurable remote name for git commands (#35172)

Git commands now support configurable remote names instead of being hardcoded to "origin". This provides better flexibility for users with custom git workflows.

Thank you to @ilya-nurullin for contributing this feature.

🚀 Display pull request in merged commit view (#35202)

When viewing a merged commit, Gitea now displays the associated pull request information, making it easier to trace changes back to their original pull requests.

Thank you to @na-Itms for contributing this feature.

🚀 Improve submodule relative path handling (#35056)

Submodule handling has been improved with better support for relative paths, making it easier to work with repositories that use relative submodule URLs.

Thank you to @wxiaoguang for contributing this feature.

Major Highlights (Actions)

🚀 Send email on Workflow Run Success/Failure (#34982)

Gitea Actions now supports sending email notifications when workflows succeed or fail! This highly requested feature allows teams to stay informed about their CI/CD pipeline status without constantly checking the web interface.

Thank you to @NorthRealm for contributing this feature.

Major Highlights (Authentication & Security)

🚀 Improve instance wide SSH commit signing (#34341)

Instance-wide SSH commit signing has been improved with better configuration options and verification capabilities, enhancing security for organizations that require signed commits.

[repository.signing]
SIGNING_KEY = /data/id_ed25519.pub
SIGNING_NAME = Gitea
SIGNING_EMAIL = git@domain.com
SIGNING_FORMAT = ssh
INITIAL_COMMIT = always
CRUD_ACTIONS = always
WIKI = always
MERGES = always

Thank you to @ChristopherHX for contributing this feature.

🚀 Refactor OpenIDConnect to support SSH/FullName sync (#34978)

OpenID Connect integration has been enhanced to support synchronizing SSH keys and full names from identity providers, streamlining user management for organizations using OIDC.

Thank you to @wxiaoguang for contributing this feature.

🚀 Support base64-encoded agit push options (#35037)

AGit push options now support base64 encoding, providing better compatibility with special characters and binary data in push options.

Thank you to @wxiaoguang for contributing this feature.

Major Highlights (API)

🚀 Refactor repo contents API and add "contents-ext" API (#34822)

The repository contents API has been refactored with the addition of a new "contents-ext" API endpoint, providing more flexibility and better performance for retrieving file contents and repository data.

Thank you to @wxiaoguang for contributing this feature.

🚀 Add `has_code` to repository REST API (#35214)

The repository REST API now includes a has_code field, making it easier to identify repositories that contain code versus empty repositories or those with only wikis.

Thank you to @6543 for contributing this feature.

Major Highlights (User Experience)

🚀 Enable more markdown paste features in textarea editor (#35494)

The markdown textarea editor now supports more paste features, including automatic markdown formatting for pasted content, making it easier to create well-formatted comments and documentation.

Thank you to @silverwind for contributing this feature.

🚀 Refactor time tracker UI (#34983)

The time tracker user interface has been refactored with a cleaner, more intuitive design, making it easier to track time spent on issues and pull requests.

Thank you to @wxiaoguang for contributing this feature.

🚀 Partially refresh notifications list (#35010)

The notifications list now supports partial refresh, reducing page load times and improving responsiveness when checking for new notifications.

Thank you to @anbraten for contributing this feature.

🚀 Also display "recently pushed branch" alert on PR view (#35001)

The "recently pushed branch" alert is now also displayed on the pull request view page, making it easier to create pull requests from recently pushed branches.

Thank you to @Naxdy for contributing this feature.

🚀 Use monospace font in PR command line instructions (#35074)

Command line instructions in pull requests now use a monospace font for better readability and easier copying.

Thank you to @silverwind for contributing this feature.

Major Highlights (Administration)

🚀 Don't store repo archives on `gitea dump` (#35467)

The gitea dump command no longer stores repository archives by default, significantly reducing backup size and time. Repository data can still be backed up, but pre-generated archives are excluded.

Thank you to @h7x4 for contributing this feature.

🚀 Avoid emoji mismatch and allow to only enable chosen emojis (#35705)

Emoji configuration has been improved, allowing administrators to enable only specific emojis and avoid mismatches between custom and default emoji sets.

Thank you to @wxiaoguang for contributing this feature.

Changelog

BREAKING
- Remove deprecated auth sources (#35272)
FEATURES
- Stream repo zip/tar.gz/bundle archives by default (#35487)
- Add support for 3D/CAD file formats preview (#34794)
- Send email on Workflow Run Success/Failure (#34982)
- Edit file workflow for creating a fork and proposing changes (#34240)
- Improve instance wide ssh commit signing (#34341)
- Refactor repo contents API and add "contents-ext" API (#34822)
- Follow file symlinks in the UI to their target (#28835)
- Use configurable remote name for git commands (#35172)
- Refactor OpenIDConnect to support SSH/FullName sync (#34978)
ENHANCEMENTS
- Code
  - Display pull request in merged commit view (#35202)
  - Support Basic Authentication for archive downloads (#35087)
  - Improve submodule relative path handling (#35056)
  - Support base64-encoded agit push options (#35037)
  - Add has_code to repository REST API (#35214)
- Actions
  - Prevent duplicate actions email (#35215)
  - Use inputs context when parsing workflows (#35595)
  - The status icon of the Action step is consistent with GitHub (#35618) #35621
- User Experience
  - Enable more markdown paste features in textarea editor (#35494)
  - Refactor time tracker UI (#34983)
  - Partially refresh notifications list (#35010)
  - Also display "recently pushed branch" alert on PR view (#35001)
  - Use monospace font in PR command line instructions (#35074)
  - UI: add hover background to table rows in user and repo admin page (#35072)
  - Make restricted users can access public repositories (#35693)
- Administration
  - Don't store repo archives on gitea dump (#35467)
  - Avoid emoji mismatch and allow to only enable chosen emojis (#35705)
  - Always return the relevant status information, even if no status exists (#35335)
  - Disable Field count validation of CSV viewer (#35228)
  - Don't block site admin's operation if SECRET_KEY is lost (#35721)
- Issues & Pull Requests
  - When sorting issues by nearest due date, issues without due date should be sorted ascending (#35267)
BUGFIXES
- Update tab title when navigating file tree (#35757) #35772
- Fix "ref-issue" handling in markup (#35739) #35771
- Fix webhook to prevent tag events from bypassing branch filters targets (#35567) #35577
- Fix markup init after issue comment editing (#35536) #35537
- Fix creating pull request failure when the target branch name is the same as some tag (#35552) #35582
- Fix auto-expand and auto-scroll for actions logs (#35570) (#35583) #35586
- Use inputs context when parsing workflows (#35590) #35595
- Fix diffpatch API endpoint (#35610) #35613
- Creating push comments before invoke pull request checking (#35647) #35668
- Fix missing Close when error occurs and abused connection pool (#35658) #35670
- Fix build (#35674)
- Fix workflow run event status while rerunning a failed job (#35689)
- Avoid emoji mismatch and allow to only enable chosen emojis (#35692)
- Refactor legacy code, fix LFS auth bypass, fix symlink bypass (#35708)
- Fix various trivial problems (#35714)
- Fix attachment file size limit in server backend (#35519)
- Honor delete branch on merge repo setting when using merge API (#35488)
- Fix external render, make iframe render work (#35727, #35730)
- Upgrade go mail to 0.7.2 (#35748)
- Revert #18491, fix oauth2 client link account (#35745)
- Fix workflow run event status while rerunning a failed job (#35703)
- Fix various bugs (#35696)
- Use LFS object size instead of blob size when viewing a LFS file (#35680)
- Fix code tag style problem and LFS view bug (#35636)
- Fix inputing review comment will remove reviewer (#35615)
- Fix diffpatch API endpoint (#35613)
- Fix: auto-expand and auto-scroll for actions logs (#35586)
- Fix creating pull request failure when the target branch name is the same as some tag (#35582)
- Fix rebase push display wrong comments bug (#35580)
- Fix webhook: prevent tag events from bypassing branch filters targets (#35577)
- Fix markup init after issue comment editing (#35537)
- Fix different behavior in status check pattern matching with double stars (#35474)
- Fix overflow in notifications list (#35446)
REFACTORS
- Move updateref and removeref to gitrepo and remove unnecessary open repository (#35511)
- Move git command to git/gitcmd (#35483)
- Replace gobwas/glob package (#35478)
- Correctly override user unitmodes (#35501)
- Fix various typos in codebase (#35480)
MISC
- Clean up npm dependencies (#35508, #35484)
- Update eslint to v9 (#35485)
- Replace webpack with rspack (#35460)
- Bump setup-node to v5 (#35448)
- Bump archives&rar dep (#35638)
- Fix build (#35674)
- Fix missing Close when error occurs and abused connection pool (#35670)
- Creating push comments before invoke pull request checking (#35668)
- Fix a bug missed return (#35667)
- Always create Actions logs stepsContainer (#35672)
- Mock external service in hcaptcha TestCaptcha (#35614)
- Fixing issue: Password Leak in Log Messages (#35609)
- Exposing TimeEstimate field in the API (#35475)
- Vertically center date in file view latest commit (#35456)
- The status icon of the Action step is consistent with GitHub (#35621)
- Add perf trace start time (#35282)

Contributors for this release

We thank all contributors who helped make this release possible!

And many more contributors who have helped with testing, reporting issues, and translating!

We will thank all original contributors of backport pull requests on next release.

Gitea 1.24.7 is released

Sun, 26 Oct 2025 04:04:00 GMT

We are excited to announce the release of Gitea version 1.24.7! We strongly recommend all users upgrade to this version for improved stability and security.

This release includes 7 merged pull requests, thanks to the amazing contributions from our community.

Security

This release addresses several important security vulnerabilities:

LFS Authentication Bypass

A user without valid credentials could upload or download LFS files by submitting a malformed JWT token. Thanks to Scott Tolley from Black Duck for reporting this issue, and to @wxiaoguang for the fix in https://github.com/go-gitea/gitea/pull/35708.

Arbitrary File Access via Malicious Template Repositories

An authenticated user could create a crafted template repository that processes arbitrary files on the filesystem. Thanks to Clément Hamada for reporting this issue, and to @wxiaoguang for the fix in https://github.com/go-gitea/gitea/pull/35708.

Invalidated OAuth2 Tokens Still Accepted

An invalidated OAuth2 token could incorrectly pass validation. Thanks to TIA for reporting this issue, and to @lunny for the fix in https://github.com/go-gitea/gitea/pull/35655.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.24.7 - 2025-09-12

SECURITY
- Refactor legacy code, fix LFS auth bypass, fix symlink bypass (#35708) (#35713)
- Fix password leak in log messages (#35584) (#35665)
- Fix a missed return in OAuth2 (#35655) (#35671)
BUGFIXES
- Fix inputing review comment will remove reviewer (#35591) (#35664)
TESTING
- Mock external service in hcaptcha TestCaptcha (#35604) (#35663)
- Fix build (#35669)

Contributors

Gitea 1.24.6 is released

Fri, 12 Sep 2025 18:43:00 GMT

We are excited to announce the release of Gitea version 1.24.6!

This release includes 17 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.24.6 - 2025-09-12

SECURITY
- Upgrade xz to v0.5.15 (#35385)
BUGFIXES
- Fix a compare page 404 bug when the pull request disabled (#35441) (#35453)
- Fix bug when issue disabled, pull request number in the commit message cannot be redirected (#35420) (#35442)
- Add author.name field to Swift Package Registry API response (#35410) (#35431)
- Remove usernames when empty in discord webhook (#35412) (#35417)
- Allow foreachref parser to grow its buffer (#35365) (#35376)
- Allow deleting comment with content via API like web did (#35346) (#35354)
- Fix atom/rss mixed error (#35345) (#35347)
- Fix review request webhook bug (#35339)
- Remove duplicate html IDs (#35210) (#35325)
- Fix LFS range size header response (#35277) (#35293)
- Fix GitHub release assets URL validation (#35287) (#35290)
- Fix token lifetime, closes #35230 (#35271) (#35281)
- Fix push commits comments when changing the pull request target branch (#35386) (#35443)

Contributors

Gitea 1.24.5 is released

Wed, 13 Aug 2025 18:43:00 GMT

We are excited to announce the release of Gitea version 1.24.5!

This release includes 9 merged pull requests, thanks to the amazing contributions from our community.

Security

In this release, the official binaries and images have been compiled with Golang 1.24.6, addressing the following security vulnerabilities:

CVE-2025-4790 os/exec: LookPath may return unexpected paths
CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.24.5 - 2025-08-12

BUGFIXES
- Fix a bug where lfs gc never worked. (#35198) (#35255)
- Reload issue when sending webhook to make num comments is right. (#35243) (#35248)
- Fix bug when review pull request commits (#35192) (#35246)
MISC
- Vertically center "Show Resolved" (#35211) (#35218)

Contributors

Gitea 1.24.4 is released

Tue, 05 Aug 2025 00:18:00 GMT

We are excited to announce the release of Gitea version 1.24.4!

This release includes 9 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.24.4 - 2025-08-03

BUGFIXES
- Fix various bugs (1.24) (#35186)
- Fix migrate input box bug (#35166) (#35171)
- Only hide dropzone when no files have been uploaded (#35156) (#35167)
- Fix review comment/dimiss comment x reference can be refereced back (#35094) (#35099)
- Fix submodule nil check (#35096) (#35098)
MISC
- Don't use full-file highlight when there is a git diff textconv (#35114) (#35119)
- Increase gap on latest commit (#35104) (#35113)

Contributors

Gitea 1.24.3 is released

Tue, 15 Jul 2025 16:45:00 GMT

We are excited to announce the release of Gitea version 1.24.3!

This release includes 30 merged pull requests, thanks to the amazing contributions from our community.

Security

The official Docker image has been updated to include Git 2.49.1, addressing CVE-2025-46334. If you’re using a custom Git installation, we strongly recommend upgrading to the latest version to ensure your instance remains secure.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.24.3 - 2025-07-15

BUGFIXES
- Fix form property assignment edge case (#35073) (#35078)
- Improve submodule relative path handling (#35056) (#35075)
- Fix incorrect comment diff hunk parsing, fix github asset ID nil panic (#35046) (#35055)
- Fix updating user visibility (#35036) (#35044)
- Support base64-encoded agit push options (#35037) (#35041)
- Make submodule link work with relative path (#35034) (#35038)
- Fix bug when displaying git user avatar in commits list (#35006)
- Fix API response for swagger spec (#35029)
- Start automerge check again after the conflict check and the schedule (#34988) (#35002)
- Fix the response format for actions/workflows (#35009) (#35016)
- Fix repo settings and protocol log problems (#35012) (#35013)
- Fix project images scroll (#34971) (#34972)
- Mark old reviews as stale on agit pr updates (#34933) (#34965)
- Fix git graph page (#34948) (#34949)
- Don't send trigger for a pending review's comment create/update/delete (#34928) (#34939)
- Fix some log and UI problems (#34863) (#34868)
- Fix archive API (#34853) (#34857)
- Ignore force pushes for changed files in a PR review (#34837) (#34843)
- Fix SSH LFS timeout (#34838) (#34842)
- Fix team permissions (#34827) (#34836)
- Fix job status aggregation logic (#34823) (#34835)
- Fix issue filter (#34914) (#34915)
- Fix typo in pull request merge warning message text (#34899) (#34903)
- Support the open-icon of folder (#34168) (#34896)
- Optimize flex layout of release attachment area (#34885) (#34886)
- Fix the issue of abnormal interface when there is no issue-item on the project page (#34791) (#34880)
- Skip updating timestamp when sync branch (#34875)
- Fix required contexts and commit status matching bug (#34815) (#34829)

Contributors

Gitea 1.24.2 is released

Sat, 21 Jun 2025 00:25:00 GMT

We are excited to announce the release of Gitea version 1.24.2! This is a quick bug fix release that resolves a Docker push issue present in v1.24.1.

A total of 3 pull requests have been merged into this release, thanks to the continued contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.24.2 - 2025-06-19

BUGFIXES
- Fix container range bug (#34795) (#34796)
- Upgrade chi to v5.2.2 (#34798) (#34799)
BUILD
- Bump poetry feature to new url for dev container (#34787) (#34790)

Contributors

Gitea 1.24.1 is released

Thu, 19 Jun 2025 21:14:00 GMT

We are excited to announce the release of Gitea version 1.24.1!

This update includes important bug fixes and improvements. We strongly recommend all users upgrade to this version to ensure optimal stability and performance.

A total of 17 pull requests have been merged into this release, thanks to the continued contributions from our community.

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.24.1 - 2025-06-19

ENHANCEMENTS
- Improve alignment of commit status icon on commit page (#34750) (#34757)
- Support title and body query parameters for new PRs (#34537) (#34752)
BUGFIXES
- When using rules to delete packages, remove unclean bugs (#34632) (#34761)
- Fix ghost user in feeds when pushing in an actions, it should be gitea-actions (#34703) (#34756)
- Prevent double markdown link brackets when pasting URL (#34745) (#34748)
- Prevent duplicate form submissions when creating forks (#34714) (#34735)
- Fix markdown wrap (#34697) (#34702)
- Fix pull requests API convert panic when head repository is deleted. (#34685) (#34687)
- Fix commit message rendering and some UI problems (#34680) (#34683)
- Fix container range bug (#34725) (#34732)
- Fix incorrect cli default values (#34765) (#34766)
- Fix dropdown filter (#34708) (#34711)
- Hide href attribute of a tag if there is no target_url (#34556) (#34684)
- Fix tag target (#34781) #34783

Contributors

Gitea 1.24.0 is released

Wed, 04 Jun 2025 17:16:00 GMT

We are thrilled to announce the latest release of Gitea v1.24.0.

Gitea 1.24 is packed with new features, improvements, and significant performance increases. Here are some notable changes and features in Gitea 1.24; for the full list, refer to the full release notes.

We are very thankful for the many people who have contributed to the project from sending code patches, reporting issues, translating, and in supporting us in many other ways too.

How to Update

Special Thanks

We would like to thank all of our supporters on Open Collective who are helping to sustain the project financially.

As always, the changes are sorted descending by what we deem most important for users and admins, so the most important change comes first.

Are you looking for a seamless, hassle-free solution to manage your Git repositories? Look no further! Gitea Cloud is here to revolutionize your development experience.

Major Breaking changes

⚠️ Make Gitea always use its internal config, ignore `/etc/gitconfig` (#33076)

Historically, Gitea has been able to use the system config under /etc/gitconfig to support some edge-case customizations. However, it sometimes causes conflicts, which have arisen multiple times lately. Therefore, we decided to switch away from this practice, adding GIT_CONFIG_NOSYSTEM=1 to all git commands.

If you have made changes to /etc/gitconfig to affect Gitea's behavior, you need to move these config options to Gitea's internal git config file, it is usually in Gitea's {AppDataPath}/home/.gitconfig.

Thank you to @wxiaoguang for contributing this feature.

⚠️ Improve log format (#33814)

The router log format was changed from

2025/03/06 22:21:12 ...eb/routing/logger.go:102:func1() [I] router: completed GET / for [::1]:52693, 200 OK in 15.9ms @ web/home.go:32(web.Home)

2025/03/06 22:20:35 HTTPRequest [I] router: completed GET / for [::1]:52631, 200 OK in 7.5ms @ web/home.go:32(web.Home)

Thank you to @wxiaoguang for contributing this feature.

⚠️ Fix markdown render behaviors (#34122)

Add config options MATH_CODE_BLOCK_DETECTION, problematic syntaxes are disabled by default.

Some markdown rendering behaviors are improved to match GitHub, please refer to the latest document's "Markdown" page to see the details.

Thank you to @wxiaoguang for contributing this feature.

⚠️ Add package version api endpoints (#34173)

Two new API endpoints to list versions of a package and to get the latest version of a package were added.

The size field for this endpoint changes case from Size to size for consistency.

Thank you to @KN4CK3R for contributing this feature.

Major Highlights (Security)

🚀 Enforce two-factor auth (2FA: TOTP or WebAuthn) (#34187)

A global setting security.TWO_FACTOR_AUTH has been introduced to require 2FA for all the users. Users login without 2FA can login and visit explore but can NOT read or write to any repositories via API/web.

Thank you to @wxiaoguang for contributing this feature.

Major Highlights (Code)

🚀 Add anonymous access support for private/unlisted repositories (#33127, #34051)

Admins of private repositories are now able to allow limited public access to code, issues and wikis.

Thank you to @wxiaoguang for contributing this feature.

🚀 Add file tree to file view page (#32721)

When reviewing the files of a repository, there now is a file tree on the left side of the page.

Thank you to @kerwin612 for contributing this feature.

🚀 Add material icons for file list (#33837)

Icon themes have been introduced, with the Material icon theme set as the default. To switch to the Basic icon theme, update your app.ini configuration by setting:

[ui]
; The icons for file list (basic/material)
FILE_ICON_THEME = basic

Thank you to @wxiaoguang for contributing this feature, and yardenshoham for their work on the inital PR.

🚀 Support choose email when creating a commit via web UI (#33432)

If users have multiple emails, they are now able to choose which email address to use for committing when updating files via web UI.

Thank you to @wxiaoguang for contributing this feature.

🚀 Add basic auth support to rss/atom feeds (#33371)

Thank you to @misthios for contributing this feature.

🚀 Private README.md for organization (#32872)

We now support two types of organization README repositories: .profile and .profile-private.

.profile-private is the private version, accessible only to organization members.

Thank you to @changchaishi for contributing this feature.

🚀 Email option to embed images as base64 instead of link (#32061)

A new configuration option mailer.EMBED_ATTACHMENT_IMAGES has been introduced to allow the images to be embedded.

Thank you to @sommerf-lf for contributing this feature.

Major Highlights (Issues)

🚀 Add sorting by exclusive labels (issue priority) (#33206)

When creating or updating exclusive labels, you can specify a Sort Order to enable sorting issues by priority based on their assigned exclusive labels.

Thank you to @telackey for contributing this feature.

🚀 Add sub issue list support (#32940)

When listing issues with a markdown syntax in issue, pull request or comment content, the issues will be expanded with titles.

Thank you to @wxiaoguang for contributing this feature.

Major Highlights (Pull Requests)

🚀 Option to delay conflict checking of old pull requests until page view (#27779)

[repository.pull-request] DELAY_CHECK_FOR_INACTIVE_DAYS is a new setting to delay the mergeable check for pull requests that have been inactive for the specified number of days.

This avoids potentially long delays for big repositories with many pull requests and reduces system load overall when there are many repositories or pull requests.

When viewing the PR, checking will start immediately and the PR merge box will automatically reload when complete. Accessing the PR through the API will also start checking immediately.

Thank you to @brechtvl for contributing this feature.

Major Highlights (Actions)

🚀 Artifacts download api for artifact actions v4 #33510

The following API endpoints for retrieving and managing actions artifacts have been added:

GET /runs/{run}/artifacts
GET /artifacts
GET + DELETE /artifacts/{artifact_id}
GET /artifacts/{artifact_id}/zip

Thank you to @ChristopherHX for contributing this feature.

🚀 Actions Runner rest APIs #33873

New API endpoints for generating registration tokens and managing action runners have been added.

Thank you to @ChristopherHX for contributing this feature.

🚀 Support workflow event dispatch via API #33545

Now the workflow_dispatch event can be triggered via API.

Thank you to @wxiaoguang for contributing this feature.

Major Highlights (Projects)

🚀 Add fullscreen mode as a more efficient operation way to view projects (#34081)

A fullscreen mode has been introduced for project kanban view.

Thank you to @kerwin612 for contributing this feature.

🚀 Worktime tracking for the organization level (#19808)

A worktime summary tab has been added on organization level, enabling better assessment of spent time for organization admins. It can also filtered by time, repositories, milestones and members.

Thank you to @kkovacs for contributing this feature.

Major Highlights (Others)

🚀 Add cli flags LDAP group configuration (#33933)

Add 7 new flags to ldap subcommands corresponding to UI options

Thank you to @TheFox0x7 for contributing this feature.

🚀 Add middleware for request prioritization (#33951)

This adds a middleware for overload protection, that is intended to help protecting against malicious scrapers.

Thank you to @bohde for contributing this feature.

Improved Performance

As more and more big instances are reporting performances issues, some performance improvements have been achieved in this version.

🚀 Improve commits list performance to reduce unnecessary database queries (#33528)

When listing commits, Gitea attempts to retrieve the actual user based on the commit email. Querying users one by one from the database is inefficient. This PR optimized the process by batch querying users by email, reducing the number of database queries.

Thank you to @lunny for contributing this feature.

🚀 Cache GPG keys, emails and users when list commits (#34086)

When listing commits, some of the commits authors are the same at many situations, but current logic will always fetch GPG keys from database. This PR enables caching GPG keys, emails and users for the context, thus reducing the database queries.

Thank you to @lunny for contributing this feature.

Two SQL queries were very slow when action table has over 5M records.

database duration=1.8881s db.sql="SELECT created_unix DIV 900 * 900 AS timestamp, count(user_id) as contributions FROM `action` WHERE user_id=? AND act_user_id=? AND (created_unix > ?) GROUP BY timestamp ORDER BY timestamp"

database duration=1.5408s db.sql="SELECT count(*) FROM `action` WHERE (user_id = ?) AND (is_deleted = ?)"

Now the count is being cached for the first loading or when the activities changed.

Thank you to @lunny for contributing this feature.

🚀 Optimize heatmap query (#33853)

When there are over 5M records in action table, the heatmap on dashboard was very slow per below SQL.

database duration=1.8881s db.sql="SELECT created_unix DIV 900 * 900 AS timestamp, count(user_id) as contributions FROM `action` WHERE user_id=? AND act_user_id=? AND (created_unix > ?) GROUP BY timestamp ORDER BY timestamp"

This PR added a new index for action table with columns user_id, act_user_id and created_unix so that this query will became about 6 times faster than before.

Thank you to @lunny for contributing this feature.

🚀 Only use prev and next buttons for pagination on user dashboard (#33981)

The pagination on the user dashboard was unnecessary from a UX standpoint and was changed to prev/next buttons. For instances with around 10 million records in the action table, this option affects how the user dashboard is loaded on first visit.

Thank you to @lunny and @wxiaoguang for contributing this feature.

🚀 Add cache for common package queries (#22491)

A cache for common package queries was added in GetPackageDescriptor. Code which needs to process a list of packages benefits from this change. This skips 350 queries in the package integration tests for example.

Thank you to @KN4CK3R and @wxiaoguang for contributing this feature.

🚀 Move issue pin to an standalone table for querying performance (#33452)

Both is_pull and pin_order were not indexed columns in the database, making the following SQL query have additional load.

SELECT `id`, `repo_id`, `index`, `poster_id`, `original_author`, `original_author_id`, `name`, `content`, `content_version`, `milestone_id`, `priority`, `is_closed`, `is_pull`, `num_comments`, `ref`, `pin_order`, `deadline_unix`, `created_unix`, `updated_unix`, `closed_unix`, `is_locked`, `time_estimate` FROM `issue` WHERE (repo_id =?) AND (is_pull = 0) AND (pin_order > 0) ORDER BY pin_order

Based on this, this PR migrated all issue and pull request pin data from the issue table to the issue_pin table. This change benefits larger Gitea instances by improving scalability and performance.

Thank you to @lunny for contributing this feature.

🚀 Improve pull request list API performance (#34052)

The pull request list API was slow, needing to open a git repository for every pull request. Assuming 30 records, there were 30 sub-processes because every repository opened a git cat-file --batch sub-process. This PR uses a base git repository to get the head commit id rather than reading it from head repository to avoid opening any head git repository.

Thank you to @lunny for contributing this feature.

🚀 Refactor Git Attribute & performance optimization (#34154)

This PR introduced a performance improvement using git check-attr --source, which can be run in a bare git repository so that we don't need to create a git index file. The new parameter needs a git version >= 2.40 . If git version less than 2.40, it will fall back to previous implementation.

Before:

git-run duration=1.2684s func.caller=git.(*Repository).readTreeToIndex git.command="/opt/homebrew/bin/git ...global... read-tree 70187f7727d4ddd8282b576ece93ca233e88b19e"
git-run duration=0.1633s func.caller=git.(*CheckAttributeReader).Run git.command="/opt/homebrew/bin/git ...global... check-attr --stdin -z --cached linguist-vendored linguist-generated linguist-documentation linguist-detectable linguist-language gitlab-language"

After:

git-run duration=0.1271s func.caller=attribute.(*BatchChecker).run git.command="/opt/homebrew/bin/git ...global... check-attr -z --source 70187f7727d4ddd8282b576ece93ca233e88b19e linguist-vendored linguist-generated linguist-language gitlab-language --stdin"

Thank you to @lunny for contributing this feature.

Changelog

BREAKING
- Make Gitea always use its internal config, ignore /etc/gitconfig (#33076)
- Improve log format (#33814)
- Fix markdown render behaviors (#34122)
- Add package version api endpoints (#34173)
FEATURES
- Enforce two-factor auth (2FA: TOTP or WebAuthn) (#34187)
- Add fullscreen mode as a more efficient operation way to view projects (#34081)
- Add anonymous access support for private/unlisted repositories (#34051)
- Support public code/issue access for private repositories (#33127)
- Add middleware for request prioritization (#33951)
- Add cli flags LDAP group configuration (#33933)
- Add file tree to file view page (#32721)
- Add material icons for file list (#33837)
- Artifacts download api for artifact actions v4 (#33510)
- Support choose email when creating a commit via web UI (#33432)
- Add basic auth support to rss/atom feeds (#33371)
- Add sorting by exclusive labels (issue priority) (#33206)
- Add sub issue list support (#32940)
- Private README.md for organization (#32872)
- Email option to embed images as base64 instead of link (#32061)
- Option to delay conflict checking of old pull requests until page view (#27779)
- Worktime tracking for the organization level (#19808)
PERFORMANCE
- Add cache for common package queries (#22491)
- Move issue pin to an standalone table for querying performance (#33452)
- Improve commits list performance to reduce unnecessary database queries (#33528)
- Optimize total count of feed when loading activities in user dashboard. (#33841)
- Optimize heatmap query (#33853)
- Only use prev and next buttons for pagination on user dashboard (#33981)
- Improve pull request list API performance (#34052)
- Cache GPG keys, emails and users when list commits (#34086)
- Refactor Git Attribute & performance optimization (#34154)
- Performance optimization for tags synchronization (#34355) #34522
ENHANCEMENTS
- Code
  - Display when a release attachment was uploaded (#34261)
  - Support creating relative link to raw path in markdown (#34105)
  - Improve code block readability and isolate copy button (#34009)
  - Improve repository commit view (#33877)
  - Full-file syntax highlighting for diff pages (#33766)
  - Clone repository with Tea CLI (#33725)
  - Improve sync fork behavior (#33319)
  - Make git clone URL could use current signed-in user (#33091)
  - Add submodule diff links (#33097)
  - Link to tree views of submodules if possible (#33424)
  - Only keep popular licenses (#33832)
  - De-emphasize signed commits (#31160)
- Actions
  - Add flat-square action badge style (#34062)
  - Update action status badge layout (#34018)
  - Download actions job logs from API (#33858)
  - Always show the "rerun" button for action jobs (#33692)
  - Add auto-expanding running actions step (#30058)
  - Update status check for all supported on.pull_request.types in Gitea (#33117)
  - Workflow_dispatch use workflow from trigger branch (#33098)
  - Add action auto-scroll (#30057)
  - Add workflow_job webhook (#33694)
  - Add a button editing action secret (#34462)
- Pull Request
  - Auto expand "New PR" form (#33971)
  - Mark parent directory as viewed when all files are viewed (#33958)
  - Show info about maintainers are allowed to edit a PR (#33738)
  - Automerge supports deleting branch automatically after merging (#32343)
  - Add additional command hints for PowerShell & CMD (#33548)
- Issues
  - Allow filtering issues by any assignee (#33343)
  - Show warning on navigation if currently editing comment or title (#32920)
  - Make tracked time representation display as hours (#33315)
  - Add No Results Prompt Message on Issue List Page (#33699)
  - Add sort option recentclose for issues and pulls (#34525) #34539
- Packages
  - Link to nuget dependencies (#26554)
  - Add composor source field (#33502)
- Administration
  - Improve navbar: add "admin" tip, add "active" style (#32927)
  - Add a option "--user-type bot" to admin user create, improve role display (#27885)
  - Improve admin user view page (#33735)
  - Support performance trace (#32973)
  - Change pprof labels to be prometheus compatible (#32865)
  - Allow admins and org owners to change org member public status (#28294)
  - Optimize the installation page (#32994)
  - Make public URL generation configurable (#34250)
  - Add a --fullname arg to gitea admin user create. (#34241)
- Others
  - Improve oauth2 error handling (#33969)
  - Fail mirroring more gracefully (#34002)
  - Align User Details Page Header Layout with Design Specifications (#34192)
  - Webhook add X-Gitea-Hook-Installation-Target-Type Header (#33752)
  - Optimize the dashboard (#32990)
  - Improve button layout on small screens (#33633)
  - Add cropping support when modifying the user/org/repo avatar (#33498)
  - Make ROOT_URL support using request Host header (#32564)
  - Add show more organizations icon in user's profile (#32986)
  - Introduce --page-space-bottom at 64px (#30692)
  - Improve theme display (#30671)
  - Add alphabetical project sorting (#33504)
  - Add global lock for migrations to make upgrade more safe with multiple replications (#33706)
  - Add descriptions for private repo public access settings and improve the UI (#34057)
API
- Actions Runner rest api (#33873)
- Inclusion of rename organization api (#33303)
- Add API to support link package to repository and unlink it (#33481)
- Add API endpoint to request contents of multiple files simultaniously (#34139)
- Actions artifacts API list/download check status upload confirmed (#34273)
- Add API routes to lock and unlock issues (#34165)
- Fix some user name usages (#33689)
- Allow filtering /repos/{owner}/{repo}/pulls by target base branch queryparam (#33684)
- Improve swagger generation (#33664)
- Support Ephemeral action runners (#33570)
- Support workflow event dispatch via API (#33545)
- Support workflow event dispatch via API (#32059)
- Added Description Field for Secrets and Variables (#33526)
- Reject star-related requests if stars are disabled (#33208)
- Let API create and edit system webhooks, attempt 2 (#33180)
- Use Project-URL metadata field to get a PyPI package's homepage URL (#33089)
- Add last_committer_date and last_author_date for file contents API (#32921)
REFACTORS
- Remove context from git struct (#33793)
- Refactor admin/common.ts (#33788)
- Refactor repo-settings.ts (#33785)
- Refactor repo-issue.ts (#33784)
- Small refactor to reduce unnecessary database queries and remove duplicated functions (#33779)
- Refactor initRepoBranchTagSelector to use new init framework (#33776)
- Refactor buttons to use new init framework (#33774)
- Refactor markup and pdf-viewer to use new init framework (#33772)
- Refactor error system (#33771)
- Refactor mail code (#33768)
- Update TypeScript types (#33799)
- Refactor older tests to use testify (#33140)
- Move notifywatch to service layer (#33825)
- Decouple context from repository related structs (#33823)
- Remove context from mail struct (#33811)
- Refactor dropdown ellipsis (#34123)
- Refactor functions to reduce repopath expose (#33892)
- Refactor repo-diff.ts (#33746)
- Refactor web route handler (#33488)
- Refactor user & avatar (#33433)
- Refactor user package (#33423)
- Refactor decouple context from migration structs (#33399)
- Refactor context flash msg and global variables (#33375)
- Refactor response writer & access logger (#33323)
- Refactor ref type (#33242)
- Refactor context repository (#33202)
- Refactor legacy JS (#33115)
- Refactor legacy line-number and scroll code (#33094)
- Refactor env var related code (#33075)
- Move SetMerged to service layer (#33045)
- Merge updatecommentattachment functions (#33044)
- Refactor pull-request compare&create page (#33071)
- Refactor repo-new.ts (#33070)
- Refactor pagination (#33037)
- Refactor tests (#33021)
- Refactor markup render to fix various path problems (#34114)
- Refactor Branch struct in package modules/git (#33980)
- Don't create duplicated functions for code repositories and wiki repositories (#33924)
- Move git references checking to gitrepo packages to reduce expose of repository path (#33891)
- Refactor cache-control (#33861)
- Decouple diff stats query from actual diffing (#33810)
- Move part of updating protected branch logic to service layer (#33742)
- Decouple Batch from git.Repository to simplify usage without requiring the creation of a Repository struct. (#34001)
- Refactor tmpl and blob_excerpt (#32967)
- Refactor template & test related code (#32938)
- Refactor db package and remove unnecessary DumpTables (#32930)
- Refactor pprof labels and process desc (#32909)
- Refactor repo-projects.ts (#32892)
- Refactor getpatch/getdiff functions and remove unnecessary fallback (#32817)
- Uniform all temporary directories and allow customizing temp path (#32352)
- Remove context from retry downloader (#33871)
- Refactor global init code and add more comments (#33755)
- Remove some unnecessary template helpers (#33069)
- Move and rename UpdateRepository (#34136)
- Move hooks function to gitrepo and reduce expose repopath (#33890)
- Add abstraction layer to delete repository from disk (#33879)
- Add abstraction layer to check if the repository exists on disk (#33874)
- Move ParseCommitWithSSHSignature to service layer (#34087)
- Move duplicated functions (#33977)
- Extract code to their own functions for push update (#33944)
- Move gitgraph from modules to services layer (#33527)
- Move commits signature and verify functions to service layers (#33605)
- Use CloseIssue and ReopenIssue instead of ChangeStatus (#32467)
- Refactor arch route handlers (#32993)
- Refactor "string truncate" (#32984)
- Refactor arch route handlers (#32972)
- Clarify path param naming (#32969)
- Refactor request context (#32956)
- Move some errors to their own sub packages (#32880)
- Move RepoTransfer from models to models/repo sub package (#32506)
- Move delete deploy keys into service layer (#32201)
- Refactor webhook events (#33337)
- Move some Actions related functions from routers to services (#33280)
- Refactor RefName (#33234)
- Refactor context RefName and RepoAssignment (#33226)
- Refactor repository transfer (#33211)
- Refactor error system (#33626)
- Refactor error system (#33610)
- Refactor package (routes and error handling, npm peer dependency) (#33111)
- Use test context in tests and new loop system in benchmarks (#33648)
- Some small refactors (#33144)
- Simplify context ref name (#33267)
BUGFIXES
- Fix some dropdown problems on the issue sidebar (#34308) #34327
- Do not return archive download URLs in API if downloads are disabled (#34324) #34338
- Fix LFS files being editable in web UI (#34356) #34362
- Fix only text/* being viewable in web UI (#34374) #34378
- Fix LFS file not stored in LFS when uploaded/edited via API or web UI (#34367)
- Grey out expired artifact on Artifacts list (#34314) #34404
- Fix incorrect divergence cache after switching default branch (#34370) #34406
- Refactor commit message rendering and fix bugs (#34412) #34414
- Merge and tweak markup editor expander CSS (#34409) #34415
- Fix GetUsersByEmails (#34423) #34425
- Only git operations should update last changed of a repository (#34388) #34427
- Fix comment textarea scroll issue in Firefox (#34438) #34446
- Fix repo broken check (#34444) #34452
- Fix remove org user failure on mssql (#34449) #34453
- Fix Workflow run Not Found page (#34459) #34466
- When updating comment, if the content is the same, just return and not update the database (#34422) #34464
- Fix project board view (#34470) #34475
- Fix get / delete runner to use consistent http 404 and 500 status (#34480) #34488
- Fix url validation in webhook add/edit API (#34492) #34496
- Fix edithook api can not update package, status and workflow_job events (#34495) #34499
- Fix ephemeral runner deletion (#34447) #34513
- Don't display error log when .git-blame-ignore-revs doesn't exist (#34457)
- Only allow admins to rename default/protected branches (#33276)
- Improve "lock conversation" UI (#34207)
- Fix incorrect file links (#34189)
- Optimize Overflow Menu (#34183)
- Check user/org repo limit instead of doer (#34147)
- Make markdown render match GitHub's behavior (#34129)
- Fix team permission (#34128)
- Correctly handle submodule view and avoid throwing 500 error (#34121)
- Fix users being able bypass limits with repo transfers (#34031)
- Avoid creating unnecessary temporary cat file sub process (#33942)
- Refactor organization menu (#33928)
- Fix various Fomantic UI and htmx problems (#33851)
- Fix 500 error when error occurred in migration page (#33256)
- Validate that the tag doesn't exist when creating a tag via the web (#33241)
- Add missed transaction on setmerged (#33079)
- Rework create/fork/adopt/generate repository to make sure resources will be cleanup once failed (#31035)
- Valid email address should only start with alphanumeric (#28174)
- Fix webhook url (#34186)
- Fix "toAbsoluteLocaleDate" test when system locale is not en-US (#33939)
- Fix file name could not be searched if the file was not a text file when using the Bleve indexer (#33959)
- Fix cannot delete runners via the modal dialog (#33895)
- Fix unpin hint on the pinned pull requests (#33207)
- Fix parentCommit invalid memory address or nil pointer dereference. (#33204)
- Fix comment header padding (#33377)
- Fix some migration and repo name problems (#33986)
- Fix various trivial frontend problems (#34263)
- Fix Set Email Preference dropdown and button placement (#34255)
- Fix quoted replies incorrectly render user input as part of the quote (#34216)
- Fix button alignments and remove unnecessary styles (#34206)
- Restore form inputs on organization create error (#34201)
- Try to fix ACME (3rd) (#33807)
- Fix incorrect ref "blob" (#33240)
- Fix dynamic content loading init problem (#33748)
- Fix git empty check and HEAD request (#33690)
- Fix Untranslated Text on Actions Page (#33635)
- Fix issue label delete incorrect labels webhook payload (#34575)
- Fix incorrect page navigation with up and down arrow on last item of dashboard repos (#34570)
- Fix/improve avatar sync from LDAP (#34573)
- Fix some trivial problems (#34579)
- Retain issue sort type when a keyword search is introduced (#34559)
- Always use an empty line to separate the commit message and trailer (#34512)
- Fix line-button issue after file selection in file tree (#34574)
- Fix doctor deleting orphaned issues attachments (#34142)
- Add webhook assigning test and fix possible bug (#34420)
- Fix possible nil description of pull request when migrating from CodeCommit (#34541)
- Refactor commit reader (#34542)
- Fix possible pull request broken when leave the page immediately after clicking the update button #34509
MISC
- Make pull request and issue history more compact (#34588)
- Run integration tests against postgres 14 (#34514) #34536
- Enable addtional linters (#34085)
- Enable testifylint rules (#34075)
- Enable staticcheck QFxxxx rules (#34064)
- Improve Actions test (#32883)
- Drop fomantic build (#33845)
- Go1.24 (#33562)
- Run yamllint with strict mode, fix issue (#33551)
- Disable cron task to update license (#33486)
- Optimize makefile help information generation (#33390)
- Convert github.com/xanzy/go-gitlab into gitlab.com/gitlab-org/api/client-go (#33126)
- Add missed changelogs (#33649)
- Update .changelog file to add performance label group (#33472)
- Add missing POPULATE_SQUASH_COMMENT_WITH_COMMIT_MESSAGES in app.example.ini (#33363)
- Update README screenshots (#33347)
- Update unrs-resolver (#34279)
- Update go&js dependencies (#34262)
- Optimize the calling code of queryElems (#34235)
- Update protected_branch.tmpl (#34193)
- Feat/optimize span svg layout (#34185)
- Set MERMAID_MAX_SOURCE_CHARACTERS to 50000 (#34152)
- Update JS and PY deps (#34143)
- Add Chinese translations for README files (#34132)
- Use overflow-wrap: anywhere to replace word-break: break-all (#34126)
- Clarify ownership in password change error messages (#34092)
- Add toggleClass function in dom.ts (#34063)
- Update to golangci-lint v2 (#34054)
- Update Makefile test comments (#34013)
- Update go mod dependencies (#33988)
- Use filepath.Join instead of path.Join for file system file operations (#33978)
- Prepare common tmpl functions in a middleware (#33957)
- Remove unused or abused styles (#33918)
- Update JS and PY deps, misc tweaks (#33903)
- Try to figure out attribute checker problem (#33901)
- Add lock for a repository pull mirror (#33876)
- Fine tune push mirror UI (#33866)
- Improve issue & code search (#33860)
- Use pullrequestlist instead of []*pullrequest (#33765)
- Upgrade act to 0.261.4 and actions-proto-go to v0.4.1 (#33760)
- Align sidebar gears to the right (#33721)
- Update Go dependencies (skip blevesearch, meilisearch) (#33655)
- Add migrations and doctor fixes (#33556)
- Remove "class-name" from svg icon (#33540)
- Update MAINTAINERS (#33529)
- Add "No data available" display when list is empty (#33517)
- Use git diff-tree for DiffFileTree on diff pages (#33514)
- Give organisation members access to organisation feeds (#33508)
- Update feishu icon (#33470)
- Hide/disable unusable UI elements when a repository is archived (#33459)
- Update @github/text-expander-element to 2.9.0 (#33435)
- Do not access GitRepo when a repo is being created (#33380)
- Fix incorrect ref usages (#33301)
- Prepare for support performance trace (#33286)
- Enable Typescript noImplicitThis (#33250)
- Remove unused CSS styles and move some styles to proper files (#33217)
- Add .run to gitignore (#33175)
- Fix typo in gitea downloader test and add missing codebase in ToGitServiceType (#33146)
- Remove extended glob pattern from branch protection UI (#33125)
- Clean up legacy form CSS styles (#33081)
- Unset XDG_HOME_CONFIG as gitea manages configuration locations (#33067)
- Add IntelliJ Gateway's .uuid to gitignore (#33052)
- User facing messages for AGit errors (#33012)
- Always show assignees on right (#33006)
- Fix eslint (#33002)
- Update JS dependencies (#32914)
- Bump x/net (#32896) (#32900)

Contributors for this release

We will thank all original contributors of backport pull requests on next release.

Gitea 1.23.8 is released

Tue, 13 May 2025 17:52:00 GMT

We are pleased to announce the release of Gitea version 1.23.8.

This update includes critical bug fixes and a Go version upgrade that addresses multiple security vulnerabilities. We strongly recommend all users upgrade as soon as possible to benefit from these important improvements.

A total of 23 pull requests were merged in this release.

Notable Changes

riscv64 Support: Official Linux binaries and Docker images for riscv64 will now be provided starting with this version. Special thanks to @mengzhuo for the contribution.
New Docker Registry: Docker images will now also be published to GitHub Container Registry (GHCR). You can find the new official docker image from this blog https://blog.gitea.com/docker-registry-update/ . Thanks to @a1994sc for this enhancement.

Security Fixes

This release addresses the following vulnerabilities:

Fixed a bug when uploading files via the LFS SSH command (affects 1.23) - #34408
Resolved CVE-2025-22873 in the Go os package, which previously allowed improper access to parent directories under certain conditions

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.23.8 - 2025-05-11

SECURITY
- Fix a bug when uploading file via lfs ssh command (#34408) (#34411)
- Update net package (#34228) (#34232)
BUGFIXES
- Fix releases sidebar navigation link (#34436) #34439
- Fix bug webhook milestone is not right. (#34419) #34429
- Fix two missed null value checks on the wiki page. (#34205) (#34215)
- Swift files can be passed either as file or as form value (#34068) (#34236)
- Fix bug when API get pull changed files for deleted head repository (#34333) (#34368)
- Upgrade github v61 -> v71 to fix migrating bug (#34389)
- Fix bug when visiting comparation page (#34334) (#34364)
- Fix wrong review requests when updating the pull request (#34286) (#34304)
- Fix github migration error when using multiple tokens (#34144) (#34302)
- Explicitly not update indexes when sync database schemas (#34281) (#34295)
- Fix panic when comment is nil (#34257) (#34277)
- Fix project board links to related Pull Requests (#34213) (#34222)
- Don't assume the default wiki branch is master in the wiki API (#34244) (#34245)
DOCUMENTATION
- Update token creation API swagger documentation (#34288) (#34296)
MISC
- Fix CI Build (#34315)
- Add riscv64 support (#34199) (#34204)
- Bump go version in go.mod (#34160)
- remove hardcoded 'code' string in clone_panel.tmpl (#34153) (#34158)

Contributors

Gitea 1.24.0 Release Candidate

Wed, 30 Apr 2025 17:01:00 GMT

We are very excited to release the first release candidate (RC) of Gitea 1.24! Gitea 1.24 is packed with new features, improvements, performances and amount of refactors. Getting the RC (release candidate) allows you to experiment with it early, try it on your workloads, and report any issues before the final release. Here are some notable changes and features in Gitea 1.24; for the full list, refer to the full release notes.

We are very thankful for the many people who have contributed to the project from sending code patches, reporting issues, translating, and in supporting us in many other ways too.

Major Breaking changes

Make Gitea always use its internal config, ignore /etc/gitconfig (#33076)
Improve log format (#33814)
Fix markdown render behaviors (#34122)
Add package version api endpoints (#34173)

Major Highlights

Security

Enforce two-factor auth (2FA: TOTP or WebAuthn) (#34187)

Code

Add anonymous access support for private/unlisted repositories (#33127, #34051) This will allow public code/issues/wikis access of private repositories.
Add file tree to file view page (#32721)

This pull request introduces a file tree on the left side when reviewing files of a repository.

Add material icons for file list (#33837)

This introduced the matierial icons theme rather than the default one. It could be enabled by ui.FILE_ICON_THEME=material.

Support choose email when creating a commit via web UI (#33432)

If users have multiple emails, this PR allowes users to choose email when updating files with web UI.

Add basic auth support to rss/atom feeds (#33371)
Private README.md for organization (#32872)

We now support two types of organization README repositories: .profile and .profile-private.

.profile-private is the private version, accessible only to organization members.

Email option to embed images as base64 instead of link (#32061)

A new configuration mailer.EMBED_ATTACHMENT_IMAGES has been introduced to allow the images to be embedded.

Issues

Add sorting by exclusive labels (issue priority) (#33206)

When creating or updating exclusive labels, you can specify a Sort Order to enable sorting issues by priority based on their assigned exclusive labels.

Add sub issue list support (#32940)

When list issues with a markdown syntax on issue, pull request or comment, the issues will be expanded with titles.

Pull Requests

Option to delay conflict checking of old pull requests until page view (#27779)

[repository.pull-request] DELAY_CHECK_FOR_INACTIVE_DAYS is a new setting to delay the mergeable check for pull requests that have been inactive for the specified number of days.

This avoids potentially long delays for big repositories with many pull requests. and reduces system load overall when there are many repositories or pull requests.

When viewing the PR, checking will start immediately and the PR merge box will automatically reload when complete. Accessing the PR through the API will also start checking immediately.

Actions

Artifacts download api for artifact actions v4 #33510
Actions Runner rest APIs #33873
Support workflow event dispatch via API #33545

Projects

Add fullscreen mode as a more efficient operation way to view projects (#34081) A fullscreen mode has been introduced for project kanban view.
Worktime tracking for the organization level (#19808) Worktime summary tab has been added in the organization level. It can also filter by time, repositories, milestones and members.

Others

Add cli flags LDAP group configuration (#33933)
Add middleware for request prioritization (#33951) This adds a middleware for overload protection, that is intended to help protect against malicious scrapers.

Improved Performance

As more and more big instances are reporting performances issues, some performances improvements have been resolved in this version.

Commits list page performance optimization.

Improve commits list performance to reduce unnecessary database queries (#33528)
Cache GPG keys, emails and users when list commits (#34086)

User dashboard performance optimization.

Optimize total count of feed when loading activities in user dashboard. (#33841)
Optimize heatmap query (#33853)
Only use prev and next buttons for pagination on user dashboard (#33981)

Others

Add cache for common package queries (#22491)
Move issue pin to an standalone table for querying performance (#33452)
Improve pull request list API performance (#34052)
Refactor Git Attribute & performance optimization (#34154)

Contributors

Gitea 1.23.7 is released

Tue, 08 Apr 2025 05:29:00 GMT

We are proud to present the release of Gitea version 1.23.7.

This update fixed some bugs with a new Golang upgrade, so we strongly recommend all users upgrade as soon as possible.

We have merged 22 pull requests to release this version.

This release addresses the following security vulnerabilities:

CVE-2025-22871 in Golang net/http: reject bare LF in chunked encoding

How to install or update

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.23.7 - 2025-04-07

SECURITY
- Compile with Go 1.23.8
Enhancements
- Add a config option to block "expensive" pages for anonymous users (#34024) (#34071)
- Also check default ssh-cert location for host (#34099) (#34100) (#34116)
BUGFIXES
- Fix discord webhook 400 status code when description limit is exceeded (#34084) (#34124)
- Get changed files based on merge base when checking pull_request actions trigger (#34106) (#34120)
- Fix invalid version in RPM package path (#34112) (#34115)
- Return default avatar url when user id is zero rather than updating database (#34094) (#34095)
- Add additional ReplaceAll in pathsep to cater for different pathsep (#34061) (#34070)
- Try to fix check-attr bug (#34029) (#34033)
- Git client will follow 301 but 307 (#34005) (#34010)
- Fix block expensive for 1.23 (#34127)
- Fix markdown frontmatter rendering (#34102) (#34107)
- Add new CLI flags to set name and scopes when creating a user with access token (#34080) (#34103)
- Do not show 500 error when default branch doesn't exist (#34096) (#34097)
- Hide activity contributors, recent commits and code frequrency left tabs if there is no code permission (#34053) (#34065)
- Simplify emoji rendering (#34048) (#34049)
- Adjust the layout of the toolbar on the Issues/Projects page (#33667) (#34047)
- Pull request updates will also trigger code owners review requests (#33744) (#34045)
- Fix org repo creation being limited by user limits (#34030) (#34044)
- Fix git client accessing renamed repo (#34034) (#34043)
- Fix the issue with error message logging for the check-attr command on Windows OS. (#34035) (#34036)
- Polyfill WeakRef (#34025) (#34028)

Gitea Blog Blog

Gitea Runner 1.0.0 is released

Why the rename?​

What changed?​

Configuration​

Upgrade notes​

Download​

Thank you​

Gitea 1.26.1 is released

How to install or update​

Special Thanks​

Changelog​

1.26.1 - 2026-04-21​

Contributors​

Gitea 1.26.0 is released

Security​

How to Update​

Special Thanks​

Major Breaking Changes​

⚠️ Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)​

⚠️ Correct Swagger annotations for enums, status codes, and notification state (#37030)​

⚠️ Remove GET API registration-token (#36801)​

⚠️ Support Actions concurrency syntax (#32751)​

⚠️ Make PUBLIC_URL_DETECTION default to auto (#36955)​

Major Highlights (Code)​

🚀 Add keyboard shortcuts for repository file and code search (#36416)​

🚀 Add support for archive-upload RPC (#36391)​

🚀 Add ability to download subpath archive (#36371)​

🚀 Automatic generation of release notes (#35977)​

🚀 Add "Go to file" and "Delete directory" on the repo file list (#35911)​

Major Highlights (Actions)​

🚀 Support Actions concurrency syntax (#32751)​

🚀 Workflow dependency visualization and graph refresh (#26062) (#36248) (#36912)​

🚀 Add button to re-run failed jobs (#36924)​

🚀 Support Actions and reusable workflows from private repositories (#32562)​

🚀 Configurable permissions for Actions automatic tokens (#36173)​

🚀 Per-runner disable and pause (#36776)​

🚀 Non-zipped Actions artifacts (#36786)​

🚀 Summary on the Actions run view (#36883)​

Major Highlights (Performance)​

🚀 Refactor cat-file batch operations (#35775)​

🚀 Use merge tree to detect merge conflicts when possible (#36400)​

Major Highlights (Administration)​

🚀 Instance-wide info banner and maintenance mode (#36571)​

🚀 User badges (#36752)​

Major Highlights (Build)​

🚀 Migrate from webpack to Vite (#37002)​

🚀 Replace Monaco with CodeMirror (#36764)​

🚀 Replace CSRF cookie with CrossOriginProtection (#36183)​

Major Highlights (Others)​

🚀 Terraform state registry (#36710)​

🚀 Render OpenAPI specifications in the browser (#36449)​

Changelog​

Contributors for this release​

Gitea 1.25.5 is released

How to install or update​

Special Thanks​

Changelog​

Contributors​

Gitea 1.25.4 is released

How to install or update​

Special Thanks​

Changelog​

Contributors​

Gitea 1.25.3 is released

How to install or update​

Special Thanks​

Changelog​

Contributors​

Gitea 1.25.2 is released

How to install or update​

Special Thanks​

Changelog​

1.25.2 - 2025-11-23​

Contributors​

Gitea 1.25.1 is released

How to install or update​

Special Thanks​

Changelog​

1.25.1 - 2025-11-04​

Why the rename?

What changed?

Configuration

Upgrade notes

Download

Thank you

How to install or update

Special Thanks

Changelog

1.26.1 - 2026-04-21

Contributors

Security

How to Update

Special Thanks

Major Breaking Changes

⚠️ Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)

⚠️ Correct Swagger annotations for enums, status codes, and notification state (#37030)

⚠️ Remove GET API registration-token (#36801)

⚠️ Support Actions `concurrency` syntax (#32751)

⚠️ Make `PUBLIC_URL_DETECTION` default to `auto` (#36955)

Major Highlights (Code)

🚀 Add keyboard shortcuts for repository file and code search (#36416)

🚀 Add support for archive-upload RPC (#36391)

🚀 Add ability to download subpath archive (#36371)

🚀 Automatic generation of release notes (#35977)

🚀 Add "Go to file" and "Delete directory" on the repo file list (#35911)

Major Highlights (Actions)

🚀 Support Actions `concurrency` syntax (#32751)

🚀 Workflow dependency visualization and graph refresh (#26062) (#36248) (#36912)

🚀 Add button to re-run failed jobs (#36924)

🚀 Support Actions and reusable workflows from private repositories (#32562)

🚀 Configurable permissions for Actions automatic tokens (#36173)

🚀 Per-runner disable and pause (#36776)

🚀 Non-zipped Actions artifacts (#36786)

🚀 Summary on the Actions run view (#36883)

Major Highlights (Performance)

🚀 Refactor `cat-file` batch operations (#35775)

🚀 Use merge tree to detect merge conflicts when possible (#36400)

Major Highlights (Administration)

🚀 Instance-wide info banner and maintenance mode (#36571)

🚀 User badges (#36752)

Major Highlights (Build)

🚀 Migrate from webpack to Vite (#37002)

🚀 Replace Monaco with CodeMirror (#36764)

🚀 Replace CSRF cookie with `CrossOriginProtection` (#36183)

Major Highlights (Others)

🚀 Terraform state registry (#36710)

🚀 Render OpenAPI specifications in the browser (#36449)

Changelog

Contributors for this release

How to install or update

Special Thanks

Changelog

Contributors

How to install or update

Special Thanks

Changelog

Contributors

How to install or update

Special Thanks

Changelog

Contributors

How to install or update

Special Thanks

Changelog

1.25.2 - 2025-11-23

Contributors

How to install or update

Special Thanks

Changelog

1.25.1 - 2025-11-04

Contributors

How to Update

Special Thanks

Major Breaking changes

⚠️ Remove deprecated auth sources (#35272)

⚠️ Refactor and update mail templates (#35150)

Major Highlights (Code)

🚀 Stream repository archives by default (#35487)

🚀 Add support for 3D/CAD file formats preview (#34794)