发布日期: 2026-05-20
版本号: v1.26.2

Gitea发布了一次包含安全修复、错误修复及杂项改进的版本更新。安全方面，主要修复了权限读取、令牌作用域验证、OAuth安全以及上传文件安全策略等多个问题，增强了系统整体安全性。错误修复涉及广泛，包括改进拉取请求视图、修复渲染与排序、解决Actions工作流运行中的死锁与错误假设、修正包管理器与Git操作的相关问题，以及处理克隆URL、时区不敏感比较等细节。此外，还包含一些杂项更新，如恢复模板变量。该版本将自动部署到Gitea Cloud实例。

更新内容 （中文）

  • 安全

    • 修复(权限)：修复读取权限 (#37769)
    • 修复(操作)：使制品签名载荷无歧义 (#37707)
    • 修复：统一API查询和仓库访问检查中的公共令牌过滤 (#37118)
    • 修复：添加遗漏的令牌范围检查 (#37735)
    • 修复(OAuth)：将令牌交换绑定到原始客户端请求 (#37704)
    • 修复(OAuth)：加强PKCE验证和刷新令牌重放保护 (#37706)
    • 修复(网页)：对原始文件、媒体和附件下载实施令牌范围限制 (#37698)
    • 修复(安全)：在请求时实施Wiki Git写入和LFS令牌访问限制 (#37695)
    • 功能(API)：加密AWS凭证 (#37679)
    • 修复(依赖)：将依赖项mermaid更新至v11.15.0 [安全]，并添加端到端测试
    • 修复(包)：为私有和内部包添加标签，并修复Composor包源权限检查 (#37610)
    • 修复(Git)：修复智能HTTP请求范围错误 (#37583)
    • 修复基础认证错误 (#37503)
    • 修复维护者编辑权限检查 (#37479) (#37484)
    • 修复URL清理以处理无协议凭证 (#37440) (#37471)
    • 修复附件内容安全策略 (#37455) (#37464)
    • 维护(依赖)：将go-git/go-git/v5升级至5.19.0 (#37608)

  • 错误修复

    • 修复(拉取请求)：处理空拉取请求文件视图以允许评审 (#37783)
    • 修复(标记)：使RenderString永不失败 (#37779)
    • 修复：为sortTreeViewNodes添加自然排序 (#37772)
    • 修复：包创建唯一性冲突 (#37774)
    • 重大修复：为拉取请求标题默认行为添加DEFAULT_TITLE_SOURCE设置 (#37465)
    • 修复：允许对受推送限制的未受保护文件进行直接提交 (#37657)
    • 修复(操作)：错误假设运行ID始终大于等于作业ID (#37737)
    • 修复(认证)：在获取头像和链接账户注册时同步设置用户代理 (#37564) (#37588)
    • 修复(操作)：PrepareRunAndInsert与UpdateTaskByState之间的死锁 (#37692)
    • 修复(仓库)：/generate必须为新仓库同步分支表 (#37693)
    • 构建：修复Snap构建 (1.26)
    • 修复(操作)：在UpdateLog{Rows:[], NoMore:true}时运行TransferLogs (#37631)
    • 修复：显示正确的合并基础
    • 修复：使克隆URL尊重公共URL检测设置 (#37615)
    • 修复：“以root身份运行"检查 (#37622)
    • 维护(依赖)：更新依赖go至v1.26.3 (#37601)
    • 比较下拉菜单在选择无共同合并基础的分支时失败 (#37470)
    • 修复：不区分大小写处理电子邮件地址 (#37600)
    • 修复(操作)：修复::endgroup::后的空行 (#37597)
    • 修复(操作)：在工作流作业API响应中报告各个步骤状态 (#37592)
    • 修复：JSON API响应中的无效UTF-8提交消息 (#37542)
    • 修复：使用一致的GetUser系列函数 (#37553)
    • 修复(API)：对错误的提交ID返回409消息而非空JSON (#37572)
    • 修复(操作)：防止工作流包含空作业时发生panic (#37570)
    • 使ServeSetHeaders在文件名存在时默认下载附件 (#37552) (#37555)
    • 修复(操作)：验证工作流参数以防止500错误 (#37546) (#37554)
    • 不要在解析器中解除运行级并发阻塞运行 (#37461) (#37538)
    • 修复(包)：对通用网页下载使用文件名 (#37514) (#37520)
    • 修复合并自动检测在同时推送多个PR时无法关闭其他PR而仅关闭最后一个的问题 (#37512) (#37516)
    • 修复更新分支保护顺序 (#37508) (#37513)
    • 修复Vite迁移后mCaptcha损坏的问题 (#37492) (#37509)
    • 修复从单次提交PR视图提交评审 (#37475) (#37485)
    • 修复计划操作在事件载荷为空时发生panic (#37459) (#37466)
    • 使GetPossibleUserByID能够处理已删除用户 (#37430) (#37431)
    • 从Terraform说明中移除多余引号 (#37424) (#37426)
    • 修复颜色回归，添加priority颜色 (#37417) (#37421)

  • 杂项

    • 恢复CurrentURL模板变量 (#37444) (#37449)

**Gitea云**上的实例将在指定的维护窗口期间自动升级到此版本。

更新内容 （原始）

  • SECURITY

    • fix(permissions): Fix reading permission (#37769)
    • fix(actions): make artifact signature payloads unambiguous (#37707)
    • fix: Unify public-only token filtering in API queries and repo access checks (#37118)
    • fix: Add missed token scope checking (#37735)
    • fix(oauth): bind token exchanges to the original client request (#37704)
    • fix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
    • fix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
    • fix(security): enforce wiki git writes and LFS token access at request time (#37695)
    • feat(api): encrypt AWS creds (#37679)
    • fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
    • fix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
    • fix(git): Fix smart http request scope bug (#37583)
    • Fix basic auth bug (#37503)
    • Fix allow maintainer edit permission check (#37479) (#37484)
    • Fix URL sanitization to handle schemeless credentials (#37440) (#37471)
    • Fix attachment Content-Security-Policy (#37455) (#37464)
    • chore(deps): bump go-git/go-git/v5 to 5.19.0 (#37608)

  • BUGFIXES

    • fix(pull): handle empty pull request files view to allow reviews (#37783)
    • fix(markup): make RenderString never fail (#37779)
    • fix: add natural sort to sortTreeViewNodes (#37772)
    • fix: package creation unique conflict (#37774)
    • fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
    • fix: Allow direct commits for unprotected files with push restrictions (#37657)
    • fix(actions): wrong assumption that run id always >= job id (#37737)
    • fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
    • fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
    • fix(repo): /generate must sync the branch table for the new repo (#37693)
    • build: Fix snap build (1.26)
    • fix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
    • fix show correct mergebase
    • fix: make clone URL respect public URL detection setting (#37615)
    • fix: “run as root” check (#37622)
    • chore(deps): update dependency go to v1.26.3 (#37601)
    • Compare dropdown fails when selecting branch with no common merge-base (#37470)
    • fix: treat email addresses case-insensitively (#37600)
    • fix(actions): fix blank lines after ::endgroup:: (#37597)
    • fix(actions): report individual step status in workflow job API response (#37592)
    • fix: Invalid UTF-8 commit messages in JSON API responses (#37542)
    • fix: use consistent GetUser family functions (#37553)
    • fix(api): return 409 message instead of empty JSON for wrong commit id (#37572)
    • fix(actions): prevent panic when workflow contains null jobs (#37570)
    • Make ServeSetHeaders default to download attachment if filename exists (#37552) (#37555)
    • Fix(actions): validate workflow param to prevent 500 error (#37546) (#37554)
    • Don’t unblock run-level-concurrency-blocked runs in the resolver (#37461) (#37538)
    • Fix(packages): use file names for generic web downloads (#37514) (#37520)
    • Fix merge autodetect can’t close other PRs but only the last one when multiple PRs are pushed at once (#37512) (#37516)
    • Fix update branch protection order (#37508) (#37513)
    • Fix mCaptcha broken after Vite migration (#37492) (#37509)
    • Fix review submission from single-commit PR view (#37475) (#37485)
    • Fix scheduled action panic with null event payload (#37459) (#37466)
    • Make GetPossibleUserByID can handle deleted user (#37430) (#37431)
    • Remove excessive quote from terraform instructions (#37424) (#37426)
    • Fix color regressions, add priority color (#37417) (#37421)

  • MISC

    • Add CurrentURL template variable back (#37444) (#37449)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

下载链接