发布日期: 2026-06-30
版本号: v1.27.0-rc0

Gitea 1.27版本发布，带来多项重要更新。破坏性变更（Breaking）改进了可重用工作流支持，并引入了Content-Security-Policy脚本nonce。安全（Security）方面修复了多个漏洞，包括限制OAuth内省、防止公开暴露私有组织成员信息、以及加固Actions工作流安全性以防止跨仓库访问和路径遍历。功能（Features）上新增了工作流状态徽章、支持所有者级和全局作用域工作流、作业错误继续执行、Jupyter笔记本渲染、以及大量Actions与API增强。增强（Enhancements）部分改进了MathML支持、Actions界面与摘要显示、代码编辑器、以及集成了OpenSearch。性能（Performance）优化了Actions运行查询和处理了多项性能回归。修复（Bugfixes）解决了大量问题，涵盖API、UI、各种包管理器（如npm、debian、gem）、以及依赖安全更新。此外，测试、构建配置、文档和项目维护（如大量依赖更新和代码重构）也得到全面改进，体现了项目的持续演进和活跃度。

更新内容 （中文）

  • 重大变更

    • 新功能(actions)!: 改进对可复用工作流的支持 (#37478)
    • 使用 Content-Security-Policy: script nonce (#37232)

  • 安全

    • 修复(deps): 更新模块 github.com/go-git/go-git/v5 至 v5.19.1 [安全] (#37786)
    • 修复(oauth): 将内省操作限制在令牌的客户端范围内 (#38042)
    • 修复(api): 不再通过 public_members 暴露私有组织成员身份 (#38145)
    • 修复(actions): 禁止通过协作所有者访问 fork-PR 的跨仓库操作 (#38214)
    • 修复(migrations): 防止在仓库恢复过程中出现路径遍历攻击 (#38215)

  • 新功能

    • 新功能(actions): 添加工作流状态徽章模态框 (#38196)
    • 新功能(actions): 支持所有者级别和全局作用域的工作流 (#38154)
    • 新功能(api): 在 compare 中支持引用后缀 (#38148)
    • 新功能(actions): 实现 jobs.<job_id>.continue-on-error (#38100)
    • 新功能(actions): 在浏览器标签页图标上显示运行状态 (#38071)
    • 新功能(api): 添加令牌内省和自删除端点 (#37995)
    • 新功能(api): 为列出分支的 API 添加 q 参数以支持服务端过滤 (#37982)
    • 新功能(repo): 将仓库创建限制按用户和组织范围拆分 (#37872)
    • 新功能(actions): 在管理界面中批量删除、禁用和启用运行器 (#37869)
    • 新功能(actions): 列出曾执行过但已从默认分支移除的工作流 (#37835)
    • 新功能(org): 添加团队可见性，使组织成员能够发现团队 (#37680)
    • 新功能: 添加用于仓库比较的原始差异/补丁端点 (#37632)
    • 新功能: 添加头像堆栈 (#37594)
    • 新功能(actions): 添加作业摘要 (GITHUB_STEP_SUMMARY) (#37500)
    • 新功能(web): 添加 Jupyter Notebook (.ipynb) 渲染支持 (#37433)
    • 支持在 OAuth2 重定向 URI 中使用自定义 URI 方案 (#37356)
    • 新功能(orgs): 为组织成员标签页添加搜索栏 (#37347)
    • 新功能(api): 添加指派人 API (#37330)
    • 新功能(api): 添加 GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
    • 在 /openapi.v1.json 提供 OpenAPI 3.0 规范 (#37038)
    • 在议题和拉取请求侧边栏添加项目列选择器 (#37037)
    • 允许每个议题和拉取请求关联多个项目 (#36784)
    • 新功能(ui): 在文件提交历史列表中添加“跟随重命名” (#34994)
    • 新功能(ssh): 自动生成额外的 SSH 密钥 (#33974)

  • 增强

    • 增强: 允许覆盖内置的默认 Git 配置选项 (#38172)
    • 增强: 允许 MathML 核心元素 (#38034)
    • 增强(markup): 改进议题标题渲染 (#37908)
    • 增强(actions): 在运行视图中设置描述性的浏览器标签页标题 (#37870)
    • 增强: 将剩余的 gopkg.in/yaml.v3 用法迁移到 go.yaml.in/yaml/v4 (#37866)
    • 增强(actions): 从 YAML 而非文件名显示工作流名称 (#37833)
    • 新功能(actions): 在 PR synchronize 事件负载中添加 before/after (#37827)
    • 增强(actions): 为运行列表添加分支过滤器 (#37826)
    • 增强(actions): 使摘要 UI 更美观并包含更多信息 (#37824)
    • 新功能: 为操作步骤标题添加复制按钮，改进其他复制按钮 (#37744)
    • 修复(icon): 使用 repo-forked 图标显示 fork 计数 (#37731)
    • 新功能(api): 为作业列表端点添加 sort 和 order 查询参数 (#37672)
    • 新功能(api): 在仓库 API 中添加 last_sync (#37566)
    • 增强: 调整工作流图样式 (#37497)
    • 改进代码编辑器的文本选择并清理 lint 启用状态 (#37474)
    • 将镜像认证更新添加到仓库编辑 API 和设置中 (#37468)
    • 将 olivere/elastic 替换为 REST API 客户端，并添加 OpenSearch 支持 (#37411)
    • 新功能: 添加默认的 PR 分支更新样式设置 (#37410)
    • 修复已登出仓库头部按钮的禁用样式不一致问题 (#37406)
    • 当需要签名提交时允许仅快进合并 (#37335)
    • 增强 actions 页面的样式 (#37323)
    • 修复: 改进 actions 状态图标和文本 (#37206)
    • 使 Markdown 围栏代码块支持更多语法 (#37154)
    • 修复: 按 JobID 和 Name 对 actions 运行作业进行排序，包含 matrix 示例 (#37046)
    • 添加用于回复拉取请求评审评论的 API 端点 (#36683)

  • 性能

    • 性能(web): 当可能时，按仓库作用域索引对 action_run 查询进行排序 (#38155)
    • 性能: 修复多种性能回退问题 (#38078)
    • 性能: 扩展 action c_u 索引以包含 created_unix，从而加快仪表板提要 (#38076)
    • 在 actions 运行、作业和任务 API 端点中批量加载相关数据 (#37032)

  • 缺陷修复

    • 修复: 更新 npm 依赖，修复各种问题 (#38257)
    • 修复(api): 在计算 X-Total-Count 时尊重 since/until 参数 (#38204)
    • 修复: codemirror 回退问题 (#38248)
    • 修复(api): 支持所有 API GET 端点的 HEAD 请求 (#38245)
    • 修复(actions): 清理工作流状态徽章代码 (#38241)
    • 修复(web): 正确对齐较大工作流名称上的“禁用”标签 (#38240)
    • 修复(actions): 不将 HTML 实体吞入链接化的 URL (#38239)
    • 修复(packages): 接受字符串形式的 npm “repository” 和 “bin” (#38236)
    • 修复(actions): 修复取消一个正在取消的任务时出现的 500 错误 (#38223)
    • 修复(deps): 更新模块 golang.org/x/image 至 v0.43.0 [安全] (#38219)
    • 修复(mssql): 将旧版 DATETIME 列转换为 DATETIME2 (#38216)
    • 修复(api): 禁止通过 /members 枚举私有组织成员 (#38213)
    • 修复(actions): 确保所有等待的作业在大型工作流中获得运行器 (#38200)
    • 修复(deps): 更新 go 依赖 (#38194)
    • 修复(deps): 更新 npm 依赖 (#38193)
    • 修复(cli): 将 bot 用户的 must-change-password 默认值设置为 false (#38175)
    • 修复(actions): 在运行视图中显示运行索引并修复摘要图高度 (#38165)
    • 修复: csp (#38162)
    • 修复(deps): 更新 npm 依赖 (#38123)
    • 修复(mssql): 扩展旧版议题和评论的长文本列 (#38120)
    • 修复(packages): 验证 debian distribution 和 component 名称 (#38116)
    • 修复(packages): 在 goproxy ParsePackage 中验证模块版本 (#38104)
    • 修复(deps): 更新依赖 esbuild 至 v0.28.1 [安全] (#38097)
    • 修复: git push 钩子 post receive (#38089)
    • 修复(ui): 防止提交状态弹出窗口溢出其行 (#38081)
    • 修复: 在 rubygems parseMetadataFile 中验证 gem 名称 (#38061)
    • 修复: 提交显示名称 (#38057)
    • 修复: csp 回退问题 (#38047)
    • 修复: api 错误消息 (#38031)
    • 修复(deps): 更新 npm 依赖 (#38029)
    • 修复: pgsql lint (#38022)
    • 修复(indexer): 修复议题搜索中的指派人过滤器 (#38021)
    • 修复: 各种下拉菜单问题 (#38020)
    • 修复: 重构 git 错误处理并使归档流处理处理不存在的提交 ID (#38007)
    • 修复: 将 git 所需版本提高到 2.13 (#37996)
    • 修复: 从 cache-control 头中移除 “no-transfrom” (#37985)
    • 修复(deps): 更新模块 github.com/google/go-github/v87 至 v88 (#37971)
    • 修复: 尽可能使用提交者时间作为默认值 (#37969)
    • 修复(deps): 更新 npm 依赖，移除 nolyfill (#37968)
    • 修复(deps): 更新 go 依赖 (#37967)
    • 修复(pull): 保留 squash 消息尾注和额外的提交消息 (#37954)
    • 修复(deps): 更新模块 golang.org/x/image 至 v0.41.0 [安全] (#37904)
    • 修复: 支持在 action 运行 UI 中使用 ##[command] 日志前缀 (#37882)
    • 修复(deps): 更新模块 github.com/google/go-github/v86 至 v87 (#37845)
    • 修复(deps): 更新 npm 依赖 (#37844)
    • 修复(deps): 更新 go 依赖 (#37841)
    • 修复(frontend): 通过清单源路径解析 Vite 资源 (#37836)
    • 修复(locales): 替换硬编码字符串 (#37788)
    • 修复(packages): 渲染相对于链接仓库的 Markdown 链接 (#37676)
    • 修复: 持久化镜像仓库元数据 (#37519)
    • 通过模拟内置路径修复 cmd 测试 (#37369)
    • 为某些表单添加 form-fetch-action，修复 “fetch action” 响应错误 (#37305)
    • 新功能: 在工作流取消时执行 post run 清理 (#37275)
    • 修复 relative-time 错误并改进全局错误处理程序 (#37241)
    • 重构闪现消息并移除 SanitizeHTML 模板函数 (#37179)

  • 测试

    • 测试: 加快两个测试速度 (#37905)
    • 测试: 修复随机失败的测试 (#37887)
    • 测试: 修复不稳定的 issue-comment 关闭测试 (#37880)
    • 测试: 为 sqlite 集成测试启用 WAL (#37861)
    • 测试: 修复不稳定的 TestResourceIndex 并缩短其运行时间 (#37847)
    • 测试: 通过本地克隆源离线运行 TestAPIRepoMigrate (#37817)
    • CI: 分片测试并减少冗余工作 (#37618)
    • 测试(e2e): 通过容器运行 playwright (#37300)
    • 移除迁移测试中的外部服务依赖 (#36866)

  • 构建

    • 修复(actions): 在 nightly 远程构建前对 snapcraft 进行认证 (#38252)
    • CI: 在 db-tests 中限制 Elasticsearch 堆内存 (#37816)
    • 构建(snap): 通过 actions 将 nightly 版本发布到 snapcraft (#37814)
    • CI: 将 pgsql 分片拆分为普通作业，消除重复的设置操作 (#37802)
    • CI: 缩小 files-changed 前端过滤器范围 (#37749)
    • CI: 将 zizmor 添加到 lint-actions (#37720)
    • 杂务: 清理 “contrib” 目录 (#37690)
    • 修复: snap 构建 (主分支) (#37685)
    • CI: 同时 lint json5 文件 (#37659)
    • 新功能(editor): 拓宽 Web 代码编辑器的语言检测范围 (#37619)
    • 构建: 更新 pnpm 至 v11 (#37591)
    • 重构(deps): 从 nektos/act 分支迁移到 gitea/runner (#37557)
    • 重构: lint 裸 fill/stroke 颜色，为 git 图形颜色系列添加变量 (#37543)
    • 更新 go js py 依赖 (#37525)
    • CI: 使用 commitlint 对 PR 标题进行 lint (#37498)
    • 杂务: 升级 devcontainer 镜像中的 Go 版本至 1.26 (#37374)
    • 更新 GitHub Actions 至最新主要版本 (#37313)
    • 更新 go js 依赖 (#37312)
    • 通过 NODE_ENV=test 在 vite 构建中因 rolldown 警告而失败 (#37270)
    • 移除 htmx (#37224)
    • 将自定义 Go 格式化程序替换为 golangci-lint fmt (#37194)
    • 重构 htmx 和 fetch-action 相关代码 (#37186)
    • 为所有依赖更新集成 renovate 机器人 (#37050)
    • 构建(sign): 迁移到 sigstore (#38250)

  • 文档

    • 文档: 更新 1.26.3 和 1.26.4 的变更日志 (#38178)
    • 文档: 修复 foreachref 文档注释中的重复单词 (#38161)
    • 文档: 阐明成为 merger 的标准 (#38113)
    • 文档: 发布 TOC 选举结果 2026 (#38111)
    • 文档: 在属性中将 openapi3 标记为自动生成 (#37963)
    • 文档: 添加开发设置指南 (#37960)

  • 其他

    • 回滚(sign): 恢复 gpg (#38251)
    • 重构: 将旧版 delete-button 替换为 link-action (#38143)
    • 重构(actions): 从 proto 字段读取运行器能力 (#38068)
    • 重构(api): 澄清 APIError 消息用法并修复旧版 lint 错误 (#38012)
    • 重构: 使用 db.Get[] 而不是 db.GetEngine(ctx).Get(bean)，以避免零值获取错误的数据库记录 (#37977)
    • 修复(deps): 更新 go 依赖 (#37851)
    • CI: 从 conventional-commit 标题同步 PR 标签时修复 (#37784) (#37825)
    • CI: 调整 files-changed，添加 free-disk-space (#37819)
    • 修复(deps): 更新模块 golang.org/x/crypto 至 v0.52.0 [安全] (#37806)
    • 测试(e2e): 添加评论、发布、星标、PR 和 fork 测试 (#37800)
    • 杂务: 简化议题和拉取请求模板 (#37799)
    • 杂务: 更新 giteabot 以修复回退时的失败 (#37789)
    • 修复(api): 优雅地处理推送镜像同步中的部分失败 (#37782)
    • 修复(deps): 更新模块 gitlab.com/gitlab-org/api/client-go/v2 至 v2.26.0 (#37771)
    • CI: 拆分 giteabot 工作流 (#37770)
    • 修复(deps): 更新 npm 依赖 (#37768)
    • 重构(waitgroup): 使用 WaitGroup.Go 替换 Add/Done 协程 (#37764)
    • 修复(deps): 更新模块 google.golang.org/grpc 至 v1.81.1 (#37762)
    • CI: 修复缓存相关问题 (#37761)
    • 杂务: 修复测试 (#37760)
    • 修复(deps): 更新模块 github.com/google/go-github/v85 至 v86 (#37754)
    • 修复(deps): 更新 npm 依赖 (#37753)
    • 修复(deps): 更新 go 依赖 (#37752)
    • 杂务(deps): 更新 action 依赖 (#37751)
    • 修复(markup): 为代码复制按钮包装缩进代码块 (#37748)
    • 杂务(db): 引入 db.Session 和 db.EngineMigration 接口 (#37746)
    • 新功能(web): 在仓库列表中也显示 PR 计数 (#37739)
    • 重构(glob): 使用 strings.Builder 进行正则表达式编译 (#37730)
    • 杂务(doctor): 移除四个过时的 doctor 检查实现 (#37728)
    • 重构(org): 简化所有者-团队组织仓库创建逻辑 (#37727)
    • 重构: 将 workflowpattern 移至 modules/actions (#37717)
    • 杂务: 清理测试 (#37715)
    • 风格: 各种 UI 修复 (#37691)
    • CI: 添加 shellcheck linter (#37682)
    • 修复: 捕获并修复更多 lint 问题 (#37674)
    • 修复(deps): 更新依赖 mermaid 至 v11.15.0 [安全]，并添加 e2e 测试 (#37662)
    • 修复(deps): 更新 npm 依赖 (#37647)
    • CI(renovate): 在主要版本升级时更新 Go import 路径 (#37641)
    • 修复(deps): 更新 go 依赖（主要版本） (#37639)
    • 杂务(deps): 更新 action 依赖（主要版本） (#37638)
    • 修复(deps): 更新模块 code.gitea.io/sdk/gitea 至 v0.25.0 (#37637)
    • 修复(deps): 更新 npm 依赖 (#37636)
    • 重构(log): 将 log.Critical 替换为 log.Error (#37624)
    • 构建(deps): 将 fast-uri 从 3.1.0 升级到 3.1.2 (#37616)
    • 新功能(oauth): 支持 AWS Cognito OAuth2 提供者 (#37607)
    • 杂务(deps): 更新 action 依赖 (#37603)
    • CI: 允许 chore 类型出现在 PR 标题 lint 中 (#37575)
    • 重构: 仅当表数据发生更改时才重置数据库表 (#37573)
    • CI: 提高 renovate 频率并修复 RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
    • 重构: 使用 modernc sqlite 驱动程序作为默认值 (#37562)
    • 文档: 修复 CHANGELOG.md 中的 4 个错别字 (#37549)
    • 修复(deps): 更新 go 依赖 (#37541)
    • 杂务(deps): 更新 action 依赖 (#37540)
    • 重构拉取请求视图 (6) (#37522)
    • 修复: 将早期 CLI 控制台记录器重定向到 stderr (#37507)
    • 重构 “flex-list” 为 “flex-divided-list” (#37505)
    • 重构比较差异/拉取页面 (1) (#37481)
    • 重构拉取请求视图 (4) (#37451)
    • 在 main 分支中更新 1.26.1 变更日志 (#37442)
    • 重构: 在 Repository 结构体中使用命名的 Permission 字段代替匿名嵌入 (#37441)
    • 重构: 通过 /assets/site-manifest.json 端点提供站点清单 (#37405)
    • 移除 IsValidExternalURL/IsAPIURL 并在调用点使用 IsValidURL (#37364)
    • 更新 Block a user 表单 (#37359)
    • 将评审请求函数移至独立文件 (#37358)
    • 新功能(security): 默认设置 X-Content-Type-Options: nosniff (#37354)
    • 启用严格 TypeScript，添加 errorMessage 辅助函数 (#37292)
    • 重构前端 tw-justify-between 布局为 flex-left-right (#37291)
    • 更新 Nix flake (#37284)
    • 修复仓库转移页面 (#37277)
    • 移除 SubmitEvent polyfill (#37276)
    • 移除由 deadcode 工具识别的死代码 (#37271)
    • 将 go-git 升级到 v5.18.0 (#37268)
    • 不添加会干扰变更日志生成的无用标签 (#37267)
    • 将热图移至一方代码 (#37262)
    • 测试/集成: 简化代码 (#37249)
    • 为组织团队列表添加分页和搜索框 (#37245)
    • 从加密随机辅助函数及其调用者中移除错误返回值 (#37240)
    • 为 OAuth2 OIDC 认证源添加 ExternalIDClaim 选项 (#37229)
    • 重构: 简化 ParseCatFileTreeLine 和 catBatchParseTreeEntries (#37210)
    • 重构 “htmx” 为 “fetch action” (#37208)
    • 更新 go js py 依赖 (#37204)
    • 为“用户活动时间”设计添加注释 (#37195)
    • 移除过时的 RunUser 逻辑 (#37180)
    • 模型/固件: 在所有 yml 固件文件中添加“不要添加更多测试数据”注释 (#37150)
    • 更新 javascript 依赖 (#37142)
    • 更新 go 依赖 (#37141)
    • 前向移植 v1.26.0-rc0 的变更日志 (#37138)
    • 引入 ActionRunAttempt 以表示运行的每次执行 (#37119)
    • 工作流工件信息悬停 (#37100)
    • 将议题上下文弹出窗口扩展到 Markdown 内容之外 (#36908)
    • 为组织添加批量仓库删除功能 (#36763)
    • 新功能: 为分支保护添加绕过允许列表 (#36514)

更新内容 （原始）

  • BREAKING

    • Feat(actions)!: improve support for reusable workflows (#37478)
    • Use Content-Security-Policy: script nonce (#37232)

  • SECURITY

    • Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
    • Fix(oauth): restrict introspection to the token’s client (#38042)
    • Fix(api): don’t expose private org membership via public_members (#38145)
    • Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
    • Fix(migrations): prevent path traversal in repository restore (#38215)

  • FEATURES

    • Feat(actions): add workflow status badge modal (#38196)
    • Feat(actions): support owner-level and global scoped workflows (#38154)
    • Feat(api): support ref suffixes in compare (#38148)
    • Feat(actions): implement jobs.<job_id>.continue-on-error (#38100)
    • Feat(actions): show run status on browser tab favicon (#38071)
    • Feat(api): add token introspection and self-deletion endpoint (#37995)
    • Feat(api): add q parameter to list branches API for server-side filtering (#37982)
    • Feat(repo): split repository creation limit into user and org scopes (#37872)
    • Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
    • Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
    • Feat(org): add team visibility so org members can discover teams (#37680)
    • Feat: add raw diff/patch endpoint for repository comparisons (#37632)
    • Feat: Add avatar stacks (#37594)
    • Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
    • Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
    • Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
    • Feat(orgs): Add search bar for organization members tab page (#37347)
    • Feat(api): Add assignees APIs (#37330)
    • Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
    • Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
    • Add project column picker to issue and pull request sidebar (#37037)
    • Allow multiple projects per issue and pull requests (#36784)
    • Feat(ui): add “follow rename” to file commit history list (#34994)
    • Feat(ssh): auto generate additional ssh keys (#33974)

  • ENHANCEMENTS

    • Enhance: allow builtin default git config options to be overridden (#38172)
    • Enhance: allow MathML core elements (#38034)
    • Enhance(markup): improve issue title rendering (#37908)
    • Enhance(actions): set descriptive browser tab title on run view (#37870)
    • Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
    • Enhance(actions): show workflow name from YAML instead of filename (#37833)
    • Feat(actions): add before/after to PR synchronize event payload (#37827)
    • Enhance(actions): add branch filters to run list (#37826)
    • Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
    • Feat: add copy button to action step header, improve other copy buttons (#37744)
    • Fix(icon): use repo-forked icon to display forks count (#37731)
    • Feat(api): add sort and order query parameters to job list endpoints (#37672)
    • Feat(api): add last_sync to repository API (#37566)
    • Enhance: Adjust Workflow Graph styling (#37497)
    • Improve code editor text selection and clean up lint enablement (#37474)
    • Add mirror auth updates to repo edit API and settings (#37468)
    • Replace olivere/elastic with REST API client, add OpenSearch support (#37411)
    • Feat: Add default PR branch update style setting (#37410)
    • Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
    • Allow fast-forward-only merge when signed commits are required (#37335)
    • Enhance styling in actions page (#37323)
    • Fix: improve actions status icons and texts (#37206)
    • Make Markdown fenced code block work with more syntaxes (#37154)
    • Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
    • Add API endpoint to reply to pull request review comments (#36683)

  • PERFORMANCE

    • Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
    • Perf: Various performance regression fixes (#38078)
    • Perf: extend action c_u index to include created_unix for faster dashboard feeds (#38076)
    • Batch-load related data in actions run, job, and task API endpoints (#37032)

  • BUGFIXES

    • Fix: update npm dependencies, fix misc issues (#38257)
    • Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
    • Fix: codemirror regressions (#38248)
    • Fix(api): support HEAD requests on all API GET endpoints (#38245)
    • Fix(actions): Cleanup workflow status badge code (#38241)
    • Fix(web): Correctly align the “disabled” label on larger workflow names (#38240)
    • Fix(actions): don’t swallow HTML entities into linkified URLs (#38239)
    • Fix(packages): accept npm “repository” and “bin” in string form (#38236)
    • Fix(actions): fix 500 error when canceling a canceling task (#38223)
    • Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
    • Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
    • Fix(api): deny private org member enumeration via /members (#38213)
    • Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
    • Fix(deps): update go dependencies (#38194)
    • Fix(deps): update npm dependencies (#38193)
    • Fix(cli): default must-change-password to false for bot users (#38175)
    • Fix(actions): show run index in run view and fix summary graph height (#38165)
    • Fix: csp (#38162)
    • Fix(deps): update npm dependencies (#38123)
    • Fix(mssql): expand legacy issue and comment long-text columns (#38120)
    • Fix(packages): validate debian distribution and component names (#38116)
    • Fix(packages): validate module version in goproxy ParsePackage (#38104)
    • Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
    • Fix: git push hook post receive (#38089)
    • Fix(ui): prevent commit status popup overflowing its row (#38081)
    • Fix: validate gem name in rubygems parseMetadataFile (#38061)
    • Fix: commit display name (#38057)
    • Fix: csp regressions (#38047)
    • Fix: api error message (#38031)
    • Fix(deps): update npm dependencies (#38029)
    • Fix: pgsql lint (#38022)
    • Fix(indexer): fix assignee filters in issue search (#38021)
    • Fix: various dropdown problems (#38020)
    • Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
    • Fix: raise git required version to 2.13 (#37996)
    • Fix: remove “no-transfrom” from the cache-control header (#37985)
    • Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
    • Fix: use committer time where ever possible as default (#37969)
    • Fix(deps): update npm dependencies, remove nolyfill (#37968)
    • Fix(deps): update go dependencies (#37967)
    • Fix(pull): preserve squash message trailers and additional commit messages (#37954)
    • Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
    • Fix: support ##[command] log prefix in action run UI (#37882)
    • Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
    • Fix(deps): update npm dependencies (#37844)
    • Fix(deps): update go dependencies (#37841)
    • Fix(frontend): resolve Vite assets by manifest source path (#37836)
    • Fix(locales): Replace hardcoded strings (#37788)
    • Fix(packages): render markdown links relative to linked repo (#37676)
    • Fix: persist mirror repository metadata (#37519)
    • Fix cmd tests by mocking builtin paths (#37369)
    • Add form-fetch-action to some forms, fix “fetch action” resp bug (#37305)
    • Feat: execute post run cleanup when workflow is cancelled (#37275)
    • Fix relative-time error and improve global error handler (#37241)
    • Refactor flash message and remove SanitizeHTML template func (#37179)

  • TESTING

    • Test: speed up two tests (#37905)
    • Test: Fix random failure test (#37887)
    • Test: fix flaky issue-comment close test (#37880)
    • Test: enable WAL for sqlite integration tests (#37861)
    • Test: fix flaky TestResourceIndex and reduce its runtime (#37847)
    • Test: run TestAPIRepoMigrate offline via a local clone source (#37817)
    • Ci: shard tests and reduce redundant work (#37618)
    • Test(e2e): run playwright via container (#37300)
    • Remove external service dependencies in migration tests (#36866)

  • BUILD

    • Fix(actions): authenticate snapcraft before nightly remote build (#38252)
    • Ci: cap Elasticsearch heap in db-tests (#37816)
    • Build(snap): publish nightly version to snapcraft via actions (#37814)
    • Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
    • Ci: narrow files-changed frontend filter (#37749)
    • Ci: add zizmor to lint-actions (#37720)
    • Chore: clean up “contrib” dir (#37690)
    • Fix: snap build (main branch) (#37685)
    • Ci: Also lint json5 files (#37659)
    • Feat(editor): broaden language detection in web code editor (#37619)
    • Build: update pnpm to v11 (#37591)
    • Refactor(deps): migrate from nektos/act fork to gitea/runner (#37557)
    • Refactor: lint bare fill/stroke colors, add vars for git graph color series (#37543)
    • Update go js py dependencies (#37525)
    • Ci: lint PR titles with commitlint (#37498)
    • Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
    • Update GitHub Actions to latest major versions (#37313)
    • Update go js dependencies (#37312)
    • Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
    • Remove htmx (#37224)
    • Replace custom Go formatter with golangci-lint fmt (#37194)
    • Refactor htmx and fetch-action related code (#37186)
    • Integrate renovate bot for all dependency updates (#37050)
    • Build(sign): move to sigstore (#38250)

  • DOCS

    • Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
    • Docs: fix duplicated word in foreachref doc comment (#38161)
    • Docs: Clarify criteria for becoming a merger (#38113)
    • Docs: Publish TOC Election Result 2026 (#38111)
    • Docs: mark openapi3 as autogenerated in attributes (#37963)
    • Docs: add development setup guide (#37960)

  • MISC

    • Revert(sign): restore gpg (#38251)
    • Refactor: replace legacy delete-button with link-action (#38143)
    • Refactor(actions): read runner capabilities from proto field (#38068)
    • Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
    • Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
    • Fix(deps): update go dependencies (#37851)
    • Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
    • Ci: tweak files-changed, add free-disk-space (#37819)
    • Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
    • Test(e2e): add comment, release, star, PR and fork tests (#37800)
    • Chore: simplify issue and pull request templates (#37799)
    • Chore: Update giteabot to fix failure when backport (#37789)
    • Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
    • Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
    • Ci: split giteabot workflow (#37770)
    • Fix(deps): update npm dependencies (#37768)
    • Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
    • Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
    • Ci: fix cache-related issues (#37761)
    • Chore: fix tests (#37760)
    • Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
    • Fix(deps): update npm dependencies (#37753)
    • Fix(deps): update go dependencies (#37752)
    • Chore(deps): update action dependencies (#37751)
    • Fix(markup): wrap indented code blocks for the code-copy button (#37748)
    • Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
    • Feat(web): also display PR counts in repo list (#37739)
    • Refactor(glob): use strings.Builder for regexp compilation (#37730)
    • Chore(doctor): remove four obsolete doctor check implementations (#37728)
    • Refactor(org): simplify owner-team org repo creation logic (#37727)
    • Refactor: move workflowpattern into modules/actions (#37717)
    • Chore: clean up tests (#37715)
    • Style: misc UI fixes (#37691)
    • Ci: add shellcheck linter (#37682)
    • Fix: catch and fix more lint problems (#37674)
    • Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
    • Fix(deps): update npm dependencies (#37647)
    • Ci(renovate): update Go import paths on major bumps (#37641)
    • Fix(deps): update go dependencies (major) (#37639)
    • Chore(deps): update action dependencies (major) (#37638)
    • Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
    • Fix(deps): update npm dependencies (#37636)
    • Refactor(log): replace log.Critical with log.Error (#37624)
    • Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
    • Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
    • Chore(deps): update action dependencies (#37603)
    • Ci: allow chore type in PR title lint (#37575)
    • Refactor: only reset a database table when the table’s data was changed (#37573)
    • Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
    • Refactor: use modernc sqlite driver as default (#37562)
    • Docs: fix 4 typos in CHANGELOG.md (#37549)
    • Fix(deps): update go dependencies (#37541)
    • Chore(deps): update action dependencies (#37540)
    • Refactor pull request view (6) (#37522)
    • Fix: redirect early CLI console logger to stderr (#37507)
    • Refactor “flex-list” to “flex-divided-list” (#37505)
    • Refactor compare diff/pull page (1) (#37481)
    • Refactor pull request view (4) (#37451)
    • Update 1.26.1 changelog in main (#37442)
    • Refactor: use named Permission field in Repository struct instead of anonymous embedding (#37441)
    • Refactor: serve site manifest via /assets/site-manifest.json endpoint (#37405)
    • Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
    • Update Block a user form (#37359)
    • Move review request functions to a standalone file (#37358)
    • Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
    • Enable strict TypeScript, add errorMessage helper (#37292)
    • Refactor frontend tw-justify-between layouts to flex-left-right (#37291)
    • Update Nix flake (#37284)
    • Fix Repository transferring page (#37277)
    • Remove SubmitEvent polyfill (#37276)
    • Remove dead code identified by deadcode tool (#37271)
    • Upgrade go-git to v5.18.0 (#37268)
    • Don’t add useless labels which will bother changelog generation (#37267)
    • Move heatmap to first-party code (#37262)
    • Tests/integration: simplify code (#37249)
    • Add pagination and search box to org teams list (#37245)
    • Remove error returns from crypto random helpers and callers (#37240)
    • Add ExternalIDClaim option for OAuth2 OIDC auth source (#37229)
    • Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
    • Refactor “htmx” to “fetch action” (#37208)
    • Update go js py dependencies (#37204)
    • Add comment for the design of “user activity time” (#37195)
    • Remove outdated RunUser logic (#37180)
    • Models/fixtures: add “DO NOT add more test data” comment to all yml fixture files (#37150)
    • Update javascript dependencies (#37142)
    • Update go dependencies (#37141)
    • Frontport changelog of v1.26.0-rc0 (#37138)
    • Introduce ActionRunAttempt to represent each execution of a run (#37119)
    • Workflow Artifact Info Hover (#37100)
    • Extend issue context popup beyond markdown content (#36908)
    • Add bulk repository deletion for organizations (#36763)
    • Feat: Add bypass allowlist for branch protection (#36514)

下载链接