• BREAKING
  • Correct swagger annotations for enums, status codes, and notification state (#37030)
  • Remove GET API registration-token (#36801)
  • Support Actions concurrency syntax (#32751)
  • Make PUBLIC_URL_DETECTION default to "auto" (#36955)
• SECURITY
  • Bound PageSize in ListUnadoptedRepositories (#36884)
• FEATURES
  • Support Actions concurrency syntax (#32751)
  • Add terraform state registry (#36710)
  • Instance-wide (global) info banner and maintenance mode (#36571)
  • Support rendering OpenAPI spec (#36449)
  • Add keyboard shortcuts for repository file and code search (#36416)
  • Add support for archive-upload rpc (#36391)
  • Add ability to download subpath archive (#36371)
  • Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
  • Automatic generation of release notes (#35977)
  • Add "Go to file", "Delete Directory" to repo file list page (#35911)
  • Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
  • Add button to re-run failed jobs in Actions (#36924)
  • Support actions and reusable workflows from private repos (#32562)
  • Add summary to action runs view (#36883)
  • Add user badges (#36752)
  • Add configurable permissions for Actions automatic tokens (#36173)
  • Add per-runner “Disable/Pause” (#36776)
• PERFORMANCE
  • WorkflowDispatch API optionally return runid (#36706)
  • Add render cache for SVG icons (#36863)
  • Load mentionValues asynchronously (#36739)
  • Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
  • Load heatmap data asynchronously (#36622)
  • Use prev/next pagination for user profile activities page to speed up (#36642)
  • Refactor cat-file batch operations and support --batch-command approach (#35775)
  • Use merge tree to detect conflicts when possible (#36400)
• ENHANCEMENTS
  • Adds option to force update new branch in contents routes (#35592)
  • Add viewer controller for mermaid (zoom, drag) (#36557)
  • Add code editor setting dropdowns (#36534)
  • Add elk layout support to mermaid (#36486)
  • Add resolve/unresolve review comment API endpoints (#36441)
  • Allow configuring default PR base branch (fixes #36412) (#36425)
  • Add support for RPM Errata (updateinfo.xml) (#37125)
  • Require additional user confirmation for making repo private (#36959)
  • Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
  • Add actions.WORKFLOW_DIRS setting (#36619)
  • Avoid opening new tab when downloading actions logs (#36740)
  • Implements OIDC RP-Initiated Logout (#36724)
  • Show workflow link (#37070)
  • Desaturate dark theme background colors (#37056)
  • Refactor "org teams" page and help new users to "add member" to an org (#37051)
  • Add webhook name field to improve webhook identification (#37025) (#37040)
  • Make task list checkboxes clickable in the preview tab (#37010)
  • Improve severity labels in Actions logs and tweak colors (#36993)
  • Linkify URLs in Actions workflow logs (#36986)
  • Allow text selection on checkbox labels (#36970)
  • Support dark/light theme images in markdown (#36922)
  • Enable native dark mode for swagger-ui (#36899)
  • Rework checkbox styling, remove input border hover effect (#36870)
  • Refactor storage content-type handling of ServeDirectURL (#36804)
  • Use "Enable Gravatar" but not "Disable" (#36771)
  • Use case-insensitive matching for Git error "Not a valid object name" (#36728)
  • Add “Copy Source” to markup comment menu (#36726)
  • Change image transparency grid to CSS (#36711)
  • Add "Run" prefix for unnamed action steps (#36624)
  • Persist actions log time display settings in localStorage (#36623)
  • Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
  • Improve BuildCaseInsensitiveLike with lowercase (#36598)
  • Improve diff highlighting (#36583)
  • Exclude cancelled runs from failure-only email notifications (#36569)
  • Use full-file highlighting for diff sections (#36561)
  • Color command/error logs in Actions log (#36538)
  • Add paging headers (#36521)
  • Improve timeline entries for WIP prefix changes in pull requests (#36518)
  • Add FOLDER_ICON_THEME configuration option (#36496)
  • Normalize guessed languages for code highlighting (#36450)
  • Add chunked transfer encoding support for LFS uploads (#36380)
  • Indicate when only optional checks failed (#36367)
  • Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
  • Support closing keywords with URL references (#36221)
  • Improve diff file headers (#36215)
  • Fix and enhance comment editor monospace toggle (#36181)
  • Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#36164)
  • Add matching pair insertion to markdown textarea (#36121)
  • Add sorting/filtering to admin user search API endpoint (#36112)
  • Allow action user have read permission in public repo like other user (#36095)
  • Disable matchBrackets in monaco (#36089)
  • Use GitHub-style commit message for squash merge (#35987)
  • Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)
  • Add GITEA_PR_INDEX env variable to githooks (#35938)
  • Add proper error message if session provider can not be created (#35520)
  • Add button to copy file name in PR files (#35509)
  • Move X_FRAME_OPTIONS setting from cors to security section (#30256)
  • Add placeholder content for empty content page (#37114)
  • Add DEFAULT_DELETE_BRANCH_AFTER_MERGE setting (#36917)
  • Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901)
  • Add admin badge to navbar avatar (#36790)
  • Add never option to PUBLIC_URL_DETECTION configuration (#36785)
  • Add background and run count to actions list page (#36707)
  • Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#36654)
  • Add support for in_progress event in workflow_run webhook (#36979)
  • Report commit status for pull_request_review events (#36589)
  • Render merged pull request title as such in dashboard feed (#36479)
  • Feature to be able to filter project boards by milestones (#36321)
  • Use user id in noreply emails (#36550)
  • Enable pagination on GiteaDownloader.getIssueReactions() (#36549)
  • Remove striped tables in UI (#36509)
  • Improve control char rendering and escape button styling (#37094)
  • Support legacy run/job index-based URLs and refactor migration 326 (#37008)
  • Add date to "No Contributions" tooltip (#36190)
  • Show edit page confirmation dialog on tree view file change (#36130)
  • Mention proc-receive in text for dashboard.resync_all_hooks func (#35991)
  • Reuse selectable style for wiki (#35990)
  • Support blue yellow colorblind theme (#35910)
  • Support selecting theme on the footer (#35741)
  • Improve online runner check (#35722)
  • Add quick approve button on PR page (#35678)
  • Enable commenting on expanded lines in PR diffs (#35662)
  • Print PR-Title into tooltip for actions (#35579)
  • Use explicit, stronger defaults for newly generated repo signing keys for Debian (#36236)
  • Improve the compare page (#36261)
  • Unify repo names in system notices (#36491)
  • Move package settings to package instead of being tied to version (#37026)
  • Add Actions API rerun endpoints for runs and jobs (#36768)
  • Add branch_count to repository API (#35351) (#36743)
  • Add created_by filter to SearchIssues (#36670)
  • Allow admins to rename non-local users (#35970)
  • Support updating branch via API (#35951)
  • Add an option to automatically verify SSH keys from LDAP (#35927)
  • Make "update file" API can create a new file when SHA is not set (#35738)
  • Update issue.go with labels documentation (labels content, not ids) (#35522)
  • Expose content_version for optimistic locking on issue and PR edits (#37035)
  • Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
• BUGFIXES
  • Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
  • Rename CSS variables and improve colorblind themes (#36353)
  • Hide add-matcher and remove-matcher from actions job logs (#36520)
  • Prevent navigation keys from triggering actions during IME composition (#36540)
  • Fix vertical alignment of .commit-sign-badge children (#36570)
  • Fix duplicate startup warnings in admin panel (#36641)
  • Fix CODEOWNERS review request attribution using comment metadata (#36348)
  • Fix HTML tags appearing in wiki table of contents (#36284)
  • Fix various bugs (#37096)
  • Fix various legacy problems (#37092)
  • Fix RPM Registry 404 when package name contains 'package' (#37087)
  • Merge some standalone Vite entries into index.js (#37085)
  • Fix various problems (#37077)
  • Fix issue label deletion with Actions tokens (#37013)
  • Hide delete branch or tag buttons in mirror or archived repositories. (#37006)
  • Fix org contact email not clearable once set (#36975)
  • Fix a bug when forking a repository in an organization (#36950)
  • Preserve sort order of exclusive labels from template repo (#36931)
  • Make container registry support Apple Container (basic auth) (#36920)
  • Fix the wrong push commits in the pull request when force push (#36914)
  • Add class "list-header-filters" to the div for projects (#36889)
  • Fix dbfs error handling (#36844)
  • Fix incorrect viewed files counter if reverted change was viewed (#36819)
  • Refactor avatar package, support default avatar fallback (#36788)
  • Fix README symlink resolution in subdirectories like .github (#36775)
  • Fix CSS stacking context issue in actions log (#36749)
  • Add gpg signing for merge rebase and update by rebase (#36701)
  • Delete non-exist branch should return 404 (#36694)
  • Fix `TestActionsCollab...

• SECURITY

  • Toolchain Update to Go 1.25.6 (#36480) (#36487)
  • Adjust the toolchain version (#36537) (#36542)
  • Update toolchain to 1.25.8 for v1.25 (#36888)
  • Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716)
  • Fix get release draft permission check (#36659) (#36715)
  • Fix a bug user could change another user's primary email (#36586) (#36607)
  • Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851)
  • Add validation constraints for repository creation fields (#36671) (#36757)
  • Fix bug to check whether user can update pull request branch or rebase branch (#36465) (#36838)
  • Add migration http transport for push/sync mirror lfs (#36665) (#36691)
  • Fix track time list permission check (#36662) (#36744)
  • Fix track time issue id (#36664) (#36689)
  • Fix path resolving (#36734) (#36746)
  • Fix dump release asset bug (#36799) (#36839)
  • Fix org permission API visibility checks for hidden members and private orgs (#36798) (#36841)
  • Fix forwarded proto handling for public URL detection (#36810) (#36836)
  • Add a git grep search timeout (#36809) (#36835)
  • Fix oauth2 s256 (#36462) (#36477)

• ENHANCEMENTS

  • Make security-check informational only (#36681) (#36852)
  • Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (#36840)
  • Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (#36688) (#36692)
  • Upgrade gogit to 5.16.5 (#36687)
  • Add wrap to runner label list (#36565) (#36574)
  • Add dnf5 command for Fedora in RPM package instructions (#36527) (#36572)
  • Allow scroll propagation outside code editor (#36502) (#36510)

• BUGFIXES

  • Fix non-admins unable to automerge PRs from forks (#36833) (#36843)
  • Fix bug when pushing mirror with wiki (#36795) (#36807)
  • Fix artifacts v4 backend upload problems (#36805) (#36834)
  • Fix CRAN package version validation to allow more than 4 version components (#36813) (#36821)
  • Fix force push time-line commit comments of pull request (#36653) (#36717)
  • Fix SVG height calculation in diff viewer (#36748) (#36750)
  • Fix push time bug (#36693) (#36713)
  • Fix bug the protected branch rule name is conflicted with renamed branch name (#36650) (#36661)
  • Fix bug when do LFS GC (#36500) (#36608)
  • Fix focus lost bugs in the Monaco editor (#36609)
  • Reprocess htmx content after loading more files (#36568) (#36577)
  • Fix assignee sidebar links and empty placeholder (#36559) (#36563)
  • Fix issues filter dropdown showing empty label scope section (#36535) (#36544)
  • Fix various mermaid bugs (#36547) (#36552)
  • Fix data race when uploading container blobs concurrently (#36524) (#36526)
  • Correct spacing between username and bot label (#36473) (#36484)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

• SECURITY

  • Release attachments must belong to the intended repo (#36347) (#36375)
  • Fix permission check on org project operations (#36318) (#36373)
  • Clean watches when make a repository private and check permission when send release emails (#36319) (#36370)
  • Add more check for stopwatch read or list (#36340) (#36368)
  • Fix openid setting check (#36346) (#36361)
  • Fix cancel auto merge bug (#36341) (#36356)
  • Fix delete attachment check (#36320) (#36355)
  • LFS locks must belong to the intended repo (#36344) (#36349)
  • Fix bug on notification read (#36339) #36387

• ENHANCEMENTS

  • Add more routes to the "expensive" list (#36290)
  • Make "commit statuses" API accept slashes in "ref" (#36264) (#36275)

• BUGFIXES

  • Fix markdown newline handling during IME composition (#36421) #36424
  • Fix missing repository id when migrating release attachments (#36389)
  • Fix bug when compare in the pull request (#36363) (#36372)
  • Fix incorrect text content detection (#36364) (#36369)
  • Fill missing has_code in repository api (#36338) (#36359)
  • Fix notifications pagination query parameters (#36351) (#36358)
  • Fix some trivial problems (#36336) (#36337)
  • Prevent panic when GitLab release has more links than sources (#36295) (#36305)
  • Fix stats bug when syncing release (#36285) (#36294)
  • Always honor user's choice for "delete branch after merge" (#36281) (#36286)
  • Use the requested host for LFS links (#36242) (#36258)
  • Fix panic when get editor config file (#36241) (#36247)
  • Fix regression in writing authorized principals (#36213) (#36218)
  • Fix WebAuthn error checking (#36219) (#36235)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

• SECURITY
  • Bump toolchain to go1.25.5, misc fixes (#36082)
• ENHANCEMENTS
  • Add strikethrough button to markdown editor (#36087) (#36104)
  • Add "site admin" back to profile menu (#36010) (#36013)
  • Improve math rendering (#36124) (#36125)
• BUGFIXES
  • Check user visibility when redirecting to a renamed user (#36148) (#36159)
  • Fix various bugs (#36139) (#36151)
  • Fix bug when viewing the commit diff page with non-ANSI files (#36149) (#36150)
  • Hide RSS icon when viewing a file not under a branch (#36135) (#36141)
  • Fix SVG size calulation, only use style attribute (#36133) (#36134)
  • Make Golang correctly delete temp files during uploading (#36128) (#36129)
  • Fix the bug when ssh clone with redirect user or repository (#36039) (#36090)
  • Use Golang net/smtp instead of gomail's smtp to send email (#36055) (#36083)
  • Fix edit user email bug in API (#36068) (#36081)
  • Fix bug when updating user email (#36058) (#36066)
  • Fix incorrect viewed files counter if file has changed (#36009) (#36047)
  • Fix container registry error handling (#36021) (#36037)
  • Fix webAuthn insecure error view (#36165) (#36179)
  • Fix some file icon ui (#36078) (#36088)
  • Fix Actions pull_request.paths being triggered incorrectly by rebase (#36045) (#36054)
  • Fix error handling in mailer and wiki services (#36041) (#36053)
  • Fix bugs when comparing and creating pull request (#36166) (#36144)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

• SECURITY
  • Upgrade golang.org/x/crypto to 0.45.0 (#35985) (#35988)
  • Fix various permission & login related bugs (#36002) (#36004)
• ENHANCEMENTS
  • Display source code downloads last for release attachments (#35897) (#35903)
  • Change project default column icon to 'star' (#35967) (#35979)
• BUGFIXES
  • Allow empty commit when merging pull request with squash style (#35989) (#36003)
  • Fix container push tag overwriting (#35936) (#35954)
  • Fix corrupted external render content (#35946) and upgrade golang.org/x packages (#35950)
  • Limit reading bytes instead of ReadAll (#35928) (#35934)
  • Use correct form field for allowed force push users in branch protection API (#35894) (#35908)
  • Fix team member access check (#35899) (#35905)
  • Fix conda null depend issue (#35900) (#35902)
  • Set the dates to now when not specified by the caller (#35861) (#35874)
  • Fix gogit ListEntriesRecursiveWithSize (#35862)
  • Misc CSS fixes (#35888) (#35981)
  • Don't show unnecessary error message to end users for DeleteBranchAfterMerge (#35937) (#35941)
  • Load jQuery as early as possible to support custom scripts (#35926) (#35929)
  • Allow to display embed images/pdfs when SERVE_DIRECT was enabled on MinIO storage (#35882) (#35917)
  • Make OAuth2 issuer configurable (#35915) (#35916)
  • Fix #35763: Add proper page title for project pages (#35773) (#35909)
  • Fix avatar upload error handling (#35887) (#35890)
  • Contribution heatmap improvements (#35876) (#35880)
  • Remove padding override on .ui .sha.label (#35864) (#35873)
  • Fix pull description code label background (#35865) (#35870)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

• BUGFIXES
  • Make ACME email optional (#35849) #35857
  • Add a doctor command to fix inconsistent run status (#35840) (#35845)
  • Remove wrong code (#35846)
  • Fix viewed files number is not right if not all files loaded (#35821) (#35844)
  • Fix incorrect pull request counter (#35819) (#35841)
  • Upgrade go mail to 0.7.2 and fix the bug (#35833) (#35837)
  • Revert gomail to v0.7.0 to fix sending mail failed (#35816) (#35824)
  • Fix clone mixed bug (#35810) (#35822)
  • Fix cli "Before" handling (#35797) (#35808)
  • Improve and fix markup code preview rendering (#35777) (#35787)
  • Fix actions rerun bug (#35783) (#35784)
  • Fix actions schedule update issue (#35767) (#35774)
  • Fix circular spin animation direction (#35785) (#35823)
  • Fix file extension on gogs.png (#35793) (#35799)
  • Add pnpm to Snapcraft (#35778)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

• BREAKING
  • Return 201 Created for CreateVariable API responses (#34517)
  • Add label 'state' to metric 'gitea_users' (#34326)
• SECURITY
  • Upgrade security public key (#34956)
  • Also include all security fixes in 1.24.x after 1.25.0-rc0
• FEATURES
  • Stream repo zip/tar.gz/bundle achives by default (#35487)
  • Use configurable remote name for git commands (#35172)
  • Send email on Workflow Run Success/Failure (#34982)
  • Refactor OpenIDConnect to support SSH/FullName sync (#34978)
  • Refactor repo contents API and add "contents-ext" API (#34822)
  • Add support for 3D/CAD file formats preview (#34794)
  • Improve instance wide ssh commit signing (#34341)
  • Edit file workflow for creating a fork and proposing changes (#34240)
  • Follow file symlinks in the UI to their target (#28835)
  • Allow renaming/moving binary/LFS files in the UI (#34350)
• PERFORMANCE
  • Improve the performance when detecting the file editable (#34653)
• ENHANCEMENTS
  • Enable more markdown paste features in textarea editor (#35494)
  • Don't store repo archives on gitea dump (#35467)
  • Always return the relevant status information, even if no status exists. (#35335)
  • Add start time on perf trace because it seems some steps haven't been recorded. (#35282)
  • Remove deprecated auth sources (#35272)
  • When sorting issues by nearest due date, issues without due date should be sorted ascending (#35267)
  • Disable field count validation of CSV viewer (#35228)
  • Add has_code to repository REST API (#35214)
  • Display pull request in merged commit view (#35202)
  • Support Basic Authentication for archive downloads (#35087)
  • Add hover background to table rows in user and repo admin page (#35072)
  • Partially refresh notifications list (#35010)
  • Also display "recently pushed branch" alert on PR view (#35001)
  • Refactor time tracker UI (#34983)
  • Improve CLI commands (#34973)
  • Improve project & label color picker and image scroll (#34971)
  • Improve NuGet API Parity (#21291) (#34940)
  • Support getting last commit message using contents-ext API (#34904)
  • Adds title on branch commit counts (#34869)
  • Add "Cancel workflow run" button to Actions list page (#34817)
  • Improve img lazy loading (#34804)
  • Forks repository list page follow other repositories page (#34784)
  • Add ff_only parameter to POST /repos/{owner}/{repo}/merge-upstream (#34770)
  • Rework delete org and rename org UI (#34762)
  • Improve nuget/rubygems package registries (#34741)
  • Add repo file tree item link behavior (#34730)
  • Add issue delete notifier (#34592)
  • Improve Actions list (#34530)
  • Add a default tab on repo header when migrating (#34503)
  • Add post-installation redirect based on admin account status (#34493)
  • Trigger 'unlabeled' event when label is Deleted from PR (#34316)
  • Support annotated tags when using create release API (#31840)
  • Use lfs label for lfs file rather than a long description (#34363)
  • Add "View workflow file" to Actions list page (#34538)
  • Move organization's visibility change to danger zone. (#34814)
  • Don't block site admin's operation if SECRET_KEY is lost (#35721)
  • Make restricted users can access public repositories (#35693)
  • The status icon of the Action step is consistent with GitHub (#35618) #35621
• BUGFIXES
  • Update tab title when navigating file tree (#35757) #35772
  • Fix "ref-issue" handling in markup (#35739) #35771
  • Fix webhook to prevent tag events from bypassing branch filters targets (#35567) #35577
  • Fix markup init after issue comment editing (#35536) #35537
  • Fix creating pull request failure when the target branch name is the same as some tag (#35552) #35582
  • Fix auto-expand and auto-scroll for actions logs (#35570) (#35583) #35586
  • Use inputs context when parsing workflows (#35590) #35595
  • Fix diffpatch API endpoint (#35610) #35613
  • Creating push comments before invoke pull request checking (#35647) #35668
  • Fix missing Close when error occurs and abused connection pool (#35658) #35670
  • Fix build (#35674)
  • Use LFS object size instead of blob size when viewing a LFS file (#35679)
  • Fix workflow run event status while rerunning a failed job (#35689)
  • Avoid emoji mismatch and allow to only enable chosen emojis (#35692)
  • Refactor legacy code, fix LFS auth bypass, fix symlink bypass (#35708)
  • Fix various trivial problems (#35714)
  • Fix attachment file size limit in server backend (#35519)
  • Honor delete branch on merge repo setting when using merge API (#35488)
  • Fix external render, make iframe render work (#35727, #35730)
  • Upgrade go mail to 0.7.2 (#35748)
  • Revert #18491, fix oauth2 client link account (#35745)
  • Fix different behavior in status check pattern matching with double stars (#35474)
  • Fix overflow in notifications list (#35446)
  • Fix package link setting can only list limited repositories (#35394)
  • Extend comment treepath length (#35389)
  • Fix font-size in inline code comment preview (#35209)
  • Move git config/remote to gitrepo package and add global lock to resolve possible conflict when updating repository git config file (#35151)
  • Change some columns from text to longtext and fix column wrong type caused by xorm (#35141)
  • Redirect to a presigned URL of HEAD for HEAD requests (#35088)
  • Fix git commit committer parsing and add some tests (#35007)
  • Fix OCI manifest parser (#34797)
  • Refactor FindOrgOptions to use enum instead of bool, fix membership visibility (#34629)
  • Fix notification count positioning for variable-width elements (#34597)
  • Keeping consistent between UI and API about combined commit status state and fix some bugs (#34562)
  • Fix possible panic (#34508)
  • Fix autofocus behavior (#34397)
  • Fix Actions API (#35204)
  • Fix ListWorkflowRuns OpenAPI response model. (#35026)
  • Small fix in Pull Requests page (#34612)
  • Fix http auth header parsing (#34936)
  • Fix modal + form abuse (#34921)
  • Fix PR toggle WIP (#34920)
  • Fix log fmt (#34810)
  • Replace stopwatch toggle with explicit start/stop actions (#34818)
  • Fix some package registry problems (#34759)
  • Fix RPM package download routing & missing package version count (#34909)
  • Fix repo search input height (#34330)
  • Fix "The sidebar of the repository file list does not have a fixed height #34298" (#34321)
  • Fix minor typos in two files #HSFDPMUW (#34944)
  • Fix actions skipped commit status indicator (#34507)
  • Fix job status aggregation logic (#35000)
  • Fix broken OneDev migration caused by various REST API changes in OneDev 7.8.0 and later (#35216)
  • Fix typo in oauth2_full_name_claim_name string (#35199)
  • Fix typo in locale_en-US.ini (#35196)
• API
  • Exposing TimeEstimate field in the API (#35475)
  • UpdateBranch API supports renaming a branch (#35374)
  • Add owner and parent fields clarification to docs (#35023)
  • Improve OAuth2 provider (correct Issuer, respect ENABLED) (#34966)
  • Add a login/login-name/username disambiguation to affected endpoint parameters and response/request models (#34901)
  • Do not mutate incoming options to SearchRepositoryByName (#34553)
  • Do not mutate incoming options to RenderUserSearch and SearchUsers (#34544)
  • Export repo's manual merge settings (#34502)
  • Add date range filtering to commit retrieval endpoints (#34497)
  • Add endpoint deleting workflow run (#34337)
  • Add workflow_run api + webhook (#33964)
• REFACTOR
  • Move updateref and removeref to gitrepo and remove unnecessary open repository (#35511)
  • Remove unused param doer (#34545)
  • Split GetLatestCommitStatus as two functions (#34535)
  • Use gitrepo.SetDefaultBranch when set default branch of wiki repository (#33911)
  • Refactor editor (#34780)
  • Refactor packages (#34777)
  • Refactor container package (#34877)
  • Refactor "change file" API (#34855)
  • Rename pull request GetGitRefName to GetGitHeadRefName to prepare introducing GetGitMergeRefName (#35093)
  • Move git command to git/gitcmd (#35483)
  • Use db.WithTx/WithTx2 instead of TxContext when possible (#35428)
  • Support Node.js 22.6 with type stripping (#35427)
  • Migrate tools and configs to typescript, require node.js >= 22.18.0 (#35421)
  • Check user and repo for redirects when using git via SSH transport (#35416)
  • Remove the duplicated function GetTags (#35375)
  • Refactor to use reflect.TypeFor (#35370)
  • Deleting branch could delete broken branch which has database record but git branch is missing (#35360)
  • Exit with success when already up to date (#35312)
  • Split admin config settings templates to make it maintain easier (#35294)
  • A small refactor to use context in the service layer (#35179)
  • Refactor and update mail templates (#35150)
  • Use db.WithTx/WithTx2 instead of TxContext when possible (#35130)
  • Align issue-title-buttons with list-header (#35018)
  • Add Notifications section in User Settings (#35008)
  • Tweak placement of diff file menu (#34999)
  • Refactor mail template and support preview (#34990)
  • Rerun job only when run is done (#34970)
  • Merge index.js (#34963)
  • Refactor "delete-button" to "link-action" (#34962)
  • Refactor webhook and fix feishu/lark secret (#34961)
  • Exclude devtest.ts from tailwindcss (#34935)
  • Refactor head navbar icons (#34922)
  • Improve html escape (#34911)
  • Improve tags list page (#34898)
  • Improve labels-list rendering (#34846)
  • Remove unused variable HUGO_VERSION (#34840)
  • Correct migration tab name (#34826)
  • Refactor template helper (#34819)
  • Use shallowRef instead of ref in .vue files where possible (#34813)
  • Use standalone function to update repository cols (#34811)
  • Refactor wiki (#34805)
  • Remove unnecessary duplicate code (#34733)
  • Refacto...

• SECURITY
  • Refactor legacy code, fix LFS auth bypass, fix symlink bypass (#35708) (#35713)
  • Fix password leak in log messages (#35584) (#35665)
  • Fix a missed return in OAuth2 (#35655) (#35671)
• BUGFIXES
  • Fix inputing review comment will remove reviewer (#35591) (#35664)
• TESTING
  • Mock external service in hcaptcha TestCaptcha (#35604) (#35663)
  • Fix build (#35669)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

• BREAKING
  • Return 201 Created for CreateVariable API responses (#34517)
  • Add label 'state' to metric 'gitea_users' (#34326)
• SECURITY
  • Upgrade security public key (#34956)
• FEATURES
  • Stream repo zip/tar.gz/bundle achives by default (#35487)
  • Use configurable remote name for git commands (#35172)
  • Send email on Workflow Run Success/Failure (#34982)
  • Refactor OpenIDConnect to support SSH/FullName sync (#34978)
  • Refactor repo contents API and add "contents-ext" API (#34822)
  • Add support for 3D/CAD file formats preview (#34794)
  • Improve instance wide ssh commit signing (#34341)
  • Edit file workflow for creating a fork and proposing changes (#34240)
  • Follow file symlinks in the UI to their target (#28835)
  • Allow renaming/moving binary/LFS files in the UI (#34350)
• PERFORMANCE
  • Improve the performance when detecting the file editable (#34653)
• ENHANCEMENTS
  • Enable more markdown paste features in textarea editor (#35494)
  • Don't store repo archives on gitea dump (#35467)
  • Always return the relevant status information, even if no status exists. (#35335)
  • Add start time on perf trace because it seems some steps haven't been recorded. (#35282)
  • Remove deprecated auth sources (#35272)
  • When sorting issues by nearest due date, issues without due date should be sorted ascending (#35267)
  • Disable field count validation of CSV viewer (#35228)
  • Add has_code to repository REST API (#35214)
  • Display pull request in merged commit view (#35202)
  • Support Basic Authentication for archive downloads (#35087)
  • Add hover background to table rows in user and repo admin page (#35072)
  • Partially refresh notifications list (#35010)
  • Also display "recently pushed branch" alert on PR view (#35001)
  • Refactor time tracker UI (#34983)
  • Improve CLI commands (#34973)
  • Improve project & label color picker and image scroll (#34971)
  • Improve NuGet API Parity (#21291) (#34940)
  • Support getting last commit message using contents-ext API (#34904)
  • Adds title on branch commit counts (#34869)
  • Add "Cancel workflow run" button to Actions list page (#34817)
  • Improve img lazy loading (#34804)
  • Forks repository list page follow other repositories page (#34784)
  • Add ff_only parameter to POST /repos/{owner}/{repo}/merge-upstream (#34770)
  • Rework delete org and rename org UI (#34762)
  • Improve nuget/rubygems package registries (#34741)
  • Add repo file tree item link behavior (#34730)
  • Add issue delete notifier (#34592)
  • Improve Actions list (#34530)
  • Add a default tab on repo header when migrating (#34503)
  • Add post-installation redirect based on admin account status (#34493)
  • Trigger 'unlabeled' event when label is Deleted from PR (#34316)
  • Support annotated tags when using create release API (#31840)
  • Use lfs label for lfs file rather than a long description (#34363)
  • Add "View workflow file" to Actions list page (#34538)
  • Move organization's visibility change to danger zone. (#34814)
• BUGFIXES
  • Fix different behavior in status check pattern matching with double stars (#35474)
  • Fix overflow in notifications list (#35446)
  • Fix package link setting can only list limited repositories (#35394)
  • Extend comment treepath length (#35389)
  • Fix font-size in inline code comment preview (#35209)
  • Move git config/remote to gitrepo package and add global lock to resolve possible conflict when updating repository git config file (#35151)
  • Change some columns from text to longtext and fix column wrong type caused by xorm (#35141)
  • Redirect to a presigned URL of HEAD for HEAD requests (#35088)
  • Fix git commit committer parsing and add some tests (#35007)
  • Fix OCI manifest parser (#34797)
  • Refactor FindOrgOptions to use enum instead of bool, fix membership visibility (#34629)
  • Fix notification count positioning for variable-width elements (#34597)
  • Keeping consistent between UI and API about combined commit status state and fix some bugs (#34562)
  • Fix possible panic (#34508)
  • Fix autofocus behavior (#34397)
  • Fix Actions API (#35204)
  • Fix ListWorkflowRuns OpenAPI response model. (#35026)
  • Small fix in Pull Requests page (#34612)
  • Fix http auth header parsing (#34936)
  • Fix modal + form abuse (#34921)
  • Fix PR toggle WIP (#34920)
  • Fix log fmt (#34810)
  • Replace stopwatch toggle with explicit start/stop actions (#34818)
  • Fix some package registry problems (#34759)
  • Fix RPM package download routing & missing package version count (#34909)
  • Fix repo search input height (#34330)
  • Fix "The sidebar of the repository file list does not have a fixed height #34298" (#34321)
  • Fix minor typos in two files #HSFDPMUW (#34944)
  • Fix actions skipped commit status indicator (#34507)
  • Fix job status aggregation logic (#35000)
  • Fix broken OneDev migration caused by various REST API changes in OneDev 7.8.0 and later (#35216)
  • Fix typo in oauth2_full_name_claim_name string (#35199)
  • Fix typo in locale_en-US.ini (#35196)
• API
  • Exposing TimeEstimate field in the API (#35475)
  • UpdateBranch API supports renaming a branch (#35374)
  • Add owner and parent fields clarification to docs (#35023)
  • Improve OAuth2 provider (correct Issuer, respect ENABLED) (#34966)
  • Add a login/login-name/username disambiguation to affected endpoint parameters and response/request models (#34901)
  • Do not mutate incoming options to SearchRepositoryByName (#34553)
  • Do not mutate incoming options to RenderUserSearch and SearchUsers (#34544)
  • Export repo's manual merge settings (#34502)
  • Add date range filtering to commit retrieval endpoints (#34497)
  • Add endpoint deleting workflow run (#34337)
  • Add workflow_run api + webhook (#33964)
• REFACTOR
  • Move updateref and removeref to gitrepo and remove unnecessary open repository (#35511)
  • Remove unused param doer (#34545)
  • Split GetLatestCommitStatus as two functions (#34535)
  • Use gitrepo.SetDefaultBranch when set default branch of wiki repository (#33911)
  • Refactor editor (#34780)
  • Refactor packages (#34777)
  • Refactor container package (#34877)
  • Refactor "change file" API (#34855)
  • Rename pull request GetGitRefName to GetGitHeadRefName to prepare introducing GetGitMergeRefName (#35093)
  • Move git command to git/gitcmd (#35483)
  • Use db.WithTx/WithTx2 instead of TxContext when possible (#35428)
  • Support Node.js 22.6 with type stripping (#35427)
  • Migrate tools and configs to typescript, require node.js >= 22.18.0 (#35421)
  • Check user and repo for redirects when using git via SSH transport (#35416)
  • Remove the duplicated function GetTags (#35375)
  • Refactor to use reflect.TypeFor (#35370)
  • Deleting branch could delete broken branch which has database record but git branch is missing (#35360)
  • Exit with success when already up to date (#35312)
  • Split admin config settings templates to make it maintain easier (#35294)
  • A small refactor to use context in the service layer (#35179)
  • Refactor and update mail templates (#35150)
  • Use db.WithTx/WithTx2 instead of TxContext when possible (#35130)
  • Align issue-title-buttons with list-header (#35018)
  • Add Notifications section in User Settings (#35008)
  • Tweak placement of diff file menu (#34999)
  • Refactor mail template and support preview (#34990)
  • Rerun job only when run is done (#34970)
  • Merge index.js (#34963)
  • Refactor "delete-button" to "link-action" (#34962)
  • Refactor webhook and fix feishu/lark secret (#34961)
  • Exclude devtest.ts from tailwindcss (#34935)
  • Refactor head navbar icons (#34922)
  • Improve html escape (#34911)
  • Improve tags list page (#34898)
  • Improve labels-list rendering (#34846)
  • Remove unused variable HUGO_VERSION (#34840)
  • Correct migration tab name (#34826)
  • Refactor template helper (#34819)
  • Use shallowRef instead of ref in .vue files where possible (#34813)
  • Use standalone function to update repository cols (#34811)
  • Refactor wiki (#34805)
  • Remove unnecessary duplicate code (#34733)
  • Refactor embedded assets and drop unnecessary dependencies (#34692)
  • Update x/crypto package and make builtin SSH use default parameters (#34667)
  • Add --color-logo, matching the logo's primary color (#34639)
  • Add openssh-keygen to rootless image (#34625)
  • Replace update repository function in some places (#34566)
  • Change "rejected" to "changes requested" in 3rd party PR review notification (#34481)
  • Remove legacy template helper functions (#34426)
  • Use run-name and evaluate workflow variables (#34301)
  • Move HasWiki to repository service package (#33912)
  • Move some functions from package git to gitrepo (#33910)
• TESTING
  • Add webhook test for push event (#34442)
  • Add a webhook push test for dev branch (#34421)
  • Add migrations tests (#34456) (#34498)
• STYLE
  • Enforce explanation for necessary nolints and fix bugs (#34883)
  • Fix remaining issues after gopls modernize formatting (#34771)
  • Update gofumpt, add go.mod ignore directive (#35434)
  • Enforce nolint scope (#34851)
  • Enable gocritic equalFold and fix issues (#34952)
  • Run gopls modernize on codebase (#34751)
  • Upgrade gopls to v0.19.0, add make fix (#34772)
• BUILD
  • Use github.com/mholt/archives replace github.com/mholt/archiver (#35390)
  • Update JS and PY dependencies (#35444)
  • Upgrade devcontainer go version to 1.24.6 (#35298)
  • Upgrade golang to 1.25.1 and add descriptions for the swagger structs' fields (#35418)
  • Update JS and PY deps (#35191)
  • Update JS and PY dependencies (#34391)
  • Update go tool dependencies (#34845)
  • Update uint8-to-base64, remove type stub (#34844)
  • Switch to @resvg/resvg-wasm...

• SECURITY
  • Upgrade xz to v0.5.15 (#35385)
• BUGFIXES
  • Fix a compare page 404 bug when the pull request disabled (#35441) (#35453)
  • Fix bug when issue disabled, pull request number in the commit message cannot be redirected (#35420) (#35442)
  • Add author.name field to Swift Package Registry API response (#35410) (#35431)
  • Remove usernames when empty in discord webhook (#35412) (#35417)
  • Allow foreachref parser to grow its buffer (#35365) (#35376)
  • Allow deleting comment with content via API like web did (#35346) (#35354)
  • Fix atom/rss mixed error (#35345) (#35347)
  • Fix review request webhook bug (#35339)
  • Remove duplicate html IDs (#35210) (#35325)
  • Fix LFS range size header response (#35277) (#35293)
  • Fix GitHub release assets URL validation (#35287) (#35290)
  • Fix token lifetime, closes #35230 (#35271) (#35281)
  • Fix push commits comments when changing the pull request target branch (#35386) (#35443)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.