发布日期: 2026-06-20
版本号: v1.26.3

Gitea 1.26.3 版本发布，但存在一个严重回归错误，可能导致在访问代码页面时出现“context deadline exceeded”错误，因此强烈建议用户直接升级至 1.26.4。本次更新包含一个不兼容变更、多项安全修复、API 新增功能、大量错误修复以及构建依赖更新。安全修复涉及私有列表错误、私有仓库匿名代码访问克隆、OIDC 外部登录链接处理、外部/私有过滤器的保留 IP 地址范围阻止、跨仓库 LFS 对象重用的代码单元访问要求、拒绝未知 SSH LFS 子动词、CODEOWNERS 正则表达式匹配时间限制以及 debian ParseControlFile 单控制段限制等。API 更新在 ListForks 中添加了 Link 头。错误修复涵盖了 SSH 远程 LFS 端点解析失败导致的空指针 panic、按不存在用户过滤追踪时间时的空指针 panic、工作流分派下拉列表中保持字面“false”值显示、HEAD 引用解析、git 命令、初始标签的发布说明生成、工作流触发检测、作业日志 blob 缺失时的响应等多个方面。构建方面更新了 @playwright/test 版本、添加了 PR 标签器工作流工具并修复了 swagger CSS 导入。Gitea Cloud 实例将在指定维护窗口自动升级至此版本。

更新内容 （中文）

[!WARNING] 请直接升级到1.26.4版本。 当前版本存在一个回归问题，可能导致打开任何仓库的代码页面时出现**“context deadline exceeded”**错误（#38177）。请暂缓升级，等待修复版本发布。

  • 破坏性更新

    • 修复(actions)!: 合并后的拉取请求需绕过叉式拉取请求审批门控 (#38010) (#38041)

  • 安全修复

    • 修复(hostmatcher)：修补错误的私有列表 (#38170) (#38173)
    • 修复：多项安全问题修复 (#38103) (#38151)
    • 修复：多项安全修复 (#38108) (#38147)
    • 修复：允许使用匿名代码访问权限克隆私有仓库 (#38074) (#38146)
    • 修复(auth)：忽略组织的过时OIDC外部登录链接 (#37875) (#38141)
    • 修复(hostmatcher)：阻止来自外部/私有筛选器的保留IP地址范围 (#38039) (#38059)
    • 修复(lfs)：跨仓库LFS对象复用需代码单元访问权限 (#38006) (#38050)
    • 修复(lfs)：拒绝未知SSH LFS子动词以防止认证绕过 (#38008) (#38015)
    • 修复：限制CODEOWNERS正则表达式匹配时间 (#38011) (#38025)
    • 修复：限制debian ParseControlFile解析单个控制段落 (#38044) (#38055)
    • 修复(deps)：更新模块golang.org/x/net至v0.55.0 [安全] (#37813) (#37829)

  • API

    • 新特性(api)：在ListForks中添加Link响应头 (#38052) (#38063)

  • 缺陷修复

    • 修复：解决SSH远程LFS端点解析失败时的崩溃问题 (#38026) (#38158)
    • 修复(api)：按不存在的用户筛选跟踪时间时的空指针崩溃 (#38112) (#38115)
    • 修复：在workflow_dispatch选项下拉菜单中保留字面量"false"值的显示 (#38080) (#38096)
    • 修复：解析HEAD引用 (#38119)
    • 修复：git命令 (#38084) (#38087)
    • 修复(releases)：为初始标签生成发布说明 (#37697) (#37986)
    • 修复(actions)：作业日志blob缺失时返回404 (#38003) (#38004)
    • 修复(actions)：从工作流触发检测中排除workflow_call (#37894) (#37899)
    • 修复(actions)：当提交主题为URL时保持操作运行标题可点击 (#37867) (#37898)
    • 修复(actions)：拒绝为没有该触发器的工作流执行workflow_dispatch (#37660) (#37895)
    • 修复(actions)：幂等确认重新发送的UpdateLog终结操作 (#37885) (#37892)
    • 修复：HTTP内容文件渲染 (#37850) (#37856)
    • 修复(issues)：提交待处理评审时清除过时的ReviewTypeRequest (#37809) (#37815)
    • 修复：解决非协作者的问题目标分支选择问题 (#36916) (#38164)

  • 构建

    • 修复(deps)：更新@playwright/test至1.60.0 (#38144)
    • 持续集成：为PR标签工作流添加tools/ci-tools.ts (#37831)
    • 修复(构建)：swagger CSS导入问题 (#37801) (#37803)

Gitea Cloud 上的实例将在指定维护窗口期内自动升级到此版本。

更新内容 （原始）

[!WARNING] Please upgrade to 1.26.4 directly. A regression in this release can cause “context deadline exceeded” errors when opening any repository’s code pages (#38177). Please hold off on upgrading until a fix is released.

  • BREAKING

    • fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)

  • SECURITY

    • fix(hostmatcher): patch incorrect private list (#38170) (#38173)
    • fix: Various security fixes (#38103) (#38151)
    • fix: Various sec fixes (#38108) (#38147)
    • fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
    • fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
    • fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
    • fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
    • fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
    • fix: bound CODEOWNERS regex match time (#38011) (#38025)
    • fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
    • fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)

  • API

    • feat(api): add Link header in ListForks (#38052) (#38063)

  • BUGFIXES

    • fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
    • fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
    • fix: keep literal “false” value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
    • fix: parse HEAD ref (#38119)
    • fix: git cmd (#38084) (#38087)
    • fix(releases): generate notes for initial tag (#37697) (#37986)
    • fix(actions): return 404 when job log blob is missing (#38003) (#38004)
    • fix(actions): exclude workflow_call from workflow trigger detection (#37894) (#37899)
    • fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
    • fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
    • fix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892)
    • fix: http content file render (#37850) (#37856)
    • fix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
    • fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)

  • BUILD

    • fix(deps): update @playwright/test to 1.60.0 (#38144)
    • ci: add tools/ci-tools.ts for the PR labeler workflow (#37831)
    • fix(build): swagger css import (#37801) (#37803)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

下载链接