发布日期: 2024-04-16
版本号: v1.21.11

本次更新包含安全修复、错误修正及功能优化。安全方面升级至Go 1.21.9以修复漏洞，优化Git推送权限检查并修复渲染器潜在安全问题。错误修复涉及文件上传关闭异常、数学块格式冲突、GPG密钥前缀缺失、附件加载失败、里程碑重复、仓库头像误删、数据竞争等多项问题，同时修正了提交状态缓存、分支重命名异常、镜像仓库空数据等场景的处理逻辑。文档更新了Actions变量说明，杂项包括Katex数学库和SQLite驱动升级。Gitea云端实例将在维护时段自动完成版本升级。

更新内容 （中文）

  • 安全
    • 使用 go1.21.9 以包含 Golang 安全修复
    • 修复可能的渲染器安全问题 (#30136) (#30315)
    • 优化 git push 性能并检查推送选项的权限 (#30104) (#30354)
  • 缺陷修复
    • 修复 Upload 函数中的文件关闭问题 (#30262) (#30269)
    • 修复行内数学块前后不能包含字母数字字符的问题 (#30175) (#30250)
    • 修复 GPG 密钥 ID 缺失前导零的问题 (#30245) (#30247)
    • 在签名有效载荷中包含编码信息 (#30174) (#30181)
    • 将最新提交状态查询从 max( id ) 改为 max( index ) (#30076) (#30155)
    • 加载代码评论中的附件 (#30124) (#30126)
    • 修复 gitea doctor 执行 storage-archives 命令时会删除仓库头像文件的问题 (#30094) (#30120)
    • 修复测试中可能的数据竞争问题 (#30093) (#30108)
    • 修复重复迁移的里程碑 (#30102) (#30105)
    • 修复 fixBrokenRepoUnits16961 的 panic 问题 (#30068) (#30100)
    • 修复不正确的 SVG 文件 (#30087) (#30086)
    • 修复创建提交状态 (#30225) (#30340)
    • 修复全局变量误用问题 (#30402)
    • 修复当 AppSubURL 非空时删除 cookie 的问题 (#30375) (#30468)
    • 当提交作者是外部用户时，避免检测定时任务时出现用户不存在错误 (#30357) (#30408)
    • 修改 gitbucket 的默认 maxPerPage 值 (#30392) (#30471)
    • 注册 runner 时检查令牌所有者和仓库 (#30406) (#30412)
    • 避免更新镜像设置时丢失令牌 (#30429) (#30466)
    • 修复缺失 target_url 的提交状态缓存问题 (#30426) (#30445)
    • 修复当目标分支已被删除但数据库仍存在时重命名分支导致的 500 错误 (#30430) (#30437)
    • 修复镜像仓库为空时的镜像错误 (#30432) (#30467)
    • 直接使用 db.ListOptions 替代 Paginator 接口以优化 /pulls 和 /issues 的性能 (#29990) (#30447)
    • 修复来自分叉仓库的 PR 不会提及代码所有者的问题 (#30476) (#30497)
  • 文档
    • 更新 Actions 变量文档 (#30394) (#30405)
  • 其他
    • 升级 katex 至 0.16.10 (#30089)
    • 升级 go-sqlite 至 v1.14.22 (#30462)

Gitea Cloud 上的实例将在指定维护窗口期间自动升级至此版本。

更新内容 （原始）

  • SECURITY
    • Use go1.21.9 to include Golang security fix
    • Fix possible renderer security problem (#30136) (#30315)
    • Performance optimization for git push and check permissions for push options (#30104) (#30354)
  • BUGFIXES
    • Fix close file in the Upload func (#30262) (#30269)
    • Fix inline math blocks can’t be preceeded/followed by alphanumerical characters (#30175) (#30250)
    • Fix missing 0 prefix of GPG key id (#30245) (#30247)
    • Include encoding in signature payload (#30174) (#30181)
    • Move from max( id ) to max( index ) for latest commit statuses (#30076) (#30155)
    • Load attachments for code comments (#30124) (#30126)
    • Fix gitea doctor will remove repo-avatar files when executing command storage-archives (#30094) (#30120)
    • Fix possible data race on tests (#30093) (#30108)
    • Fix duplicate migrated milestones (#30102) (#30105)
    • Fix panic for fixBrokenRepoUnits16961 (#30068) (#30100)
    • Fix incorrect SVGs (#30087) (#30086)
    • Fix create commit status (#30225) (#30340)
    • Fix misuse of unsupported global variables (#30402)
    • Fix to delete the cookie when AppSubURL is non-empty (#30375) (#30468)
    • Avoid user does not exist error when detecting schedule actions when the commit author is an external user (#30357) (#30408)
    • Change the default maxPerPage for gitbucket (#30392) (#30471)
    • Check the token’s owner and repository when registering a runner (#30406) (#30412)
    • Avoid losing token when updating mirror settings (#30429) (#30466)
    • Fix commit status cache which missed target_url (#30426) (#30445)
    • Fix rename branch 500 when the target branch is deleted but exist in database (#30430) (#30437)
    • Fix mirror error when mirror repo is empty (#30432) (#30467)
    • Use db.ListOptions directly instead of Paginator interface to make it easier to use and fix performance of /pulls and /issues (#29990) (#30447)
    • Fix code owners will not be mentioned when a pull request comes from a forked repository (#30476) (#30497)
  • DOCS
    • Update actions variables documents (#30394) (#30405)
  • MISC
    • Update katex to 0.16.10 (#30089)
    • Upgrade go-sqlite to v1.14.22 (#30462)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

下载链接