发布日期: 2026-07-13
版本号: v1.27.0

本次更新包含多项安全修复、功能增强、性能优化和问题修复。安全方面加强了访问控制和令牌管理，修复了私有仓库信息泄露和跨仓库对象访问等问题。功能上改进了工作流支持，新增了API端点和UI组件，如工作流状态徽章、任务摘要和头像堆叠显示。性能优化包括运行器心跳处理、查询索引改进和批量加载数据。此外还修复了大量界面显示、API处理和依赖相关的问题，并更新了测试、构建和文档内容。

更新内容 （中文）

  • 重大变更

    • 特性(actions)：改进对可重用工作流的支持 (#37478)
    • 使用 Content-Security-Policy：脚本随机数 (#37232)

  • 安全

    • 修复：多项安全修复 (#38406) (#38426)
    • 修复(安全)：强化访问检查和迁移验证 (#38324) (#38400)
    • 修复：强制公共令牌范围并强化推送选项/语言环境解析 (#38323) (#38399)
    • 修复(拉取)：在目标分支变更时重新评估审查官方标记 (#38319) (#38402)
    • 修复(应用接口)：停止在访问撤销后泄露私有仓库元数据 (#38321) (#38390)
    • 修复(LFS)：要求跨仓库对象的所有权证明 (#38322) (#38389)
    • 修复(镜像)：在拉取镜像同步时禁用HTTP重定向 (#38320) (#38367)
    • 修复：golang HTML模板URL转义 (#38363) (#38369)
    • 修复(发布)：针对允许的类型验证Web附件重命名 (#38314) (#38328)
    • 修复(发布)：在Web下载端点上限制草稿发布附件 (#38318) (#38325)
    • 修复(依赖)：将模块 github.com/go-git/go-git/v5 更新至 v5.19.1 [安全] (#37786)
    • 修复(OAuth)：将内省限制在令牌的客户端 (#38042)
    • 修复(应用接口)：不要通过 public_members 暴露私有组织成员资格 (#38145)
    • 修复(Actions)：拒绝通过协作所有者进行叉子拉取请求的跨仓库访问 (#38214)
    • 修复(迁移)：防止在仓库恢复中出现路径遍历 (#38215)

  • 功能

    • 特性(actions)：添加工作流状态徽章模态框 (#38196)
    • 特性(actions)：支持所有者级别和全局范围的工作流 (#38154)
    • 特性(应用接口)：在比较中支持引用后缀 (#38148)
    • 特性(actions)：实现 jobs.<job_id>.continue-on-error (#38100)
    • 特性(actions)：在浏览器标签页图标上显示运行状态 (#38071)
    • 特性(应用接口)：添加令牌内省和自删除端点 (#37995)
    • 特性(应用接口)：在列出分支的API中添加 q 参数以支持服务器端过滤 (#37982)
    • 特性(仓库)：将仓库创建限制拆分为用户和组织范围 (#37872)
    • 特性(actions)：在管理UI中批量删除、禁用和启用运行器 (#37869)
    • 特性(actions)：列出曾执行过但已从默认分支移除的工作流 (#37835)
    • 特性(组织)：添加团队可见性以便组织成员可以发现团队 (#37680)
    • 特性：为仓库比较添加原始差异/补丁端点 (#37632)
    • 特性：添加头像堆栈 (#37594)
    • 特性(actions)：添加作业摘要 (GITHUB_STEP_SUMMARY) (#37500)
    • 特性(网络)：添加Jupyter Notebook (.ipynb) 渲染支持 (#37433)
    • 支持OAuth2重定向URI中的自定义URI方案 (#37356)
    • 特性(组织)：为组织成员标签页页面添加搜索栏 (#37347)
    • 特性(应用接口)：添加指派人API (#37330)
    • 特性(应用接口)：添加 GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
    • 在 /openapi.v1.json 提供 OpenAPI 3.0 规范 (#37038)
    • 在议题和拉取请求侧边栏中添加项目列选择器 (#37037)
    • 允许每个议题和拉取请求关联多个项目 (#36784)
    • 特性(用户界面)：在文件提交历史列表中添加"跟随重命名" (#34994)
    • 特性(SSH)：自动生成额外的SSH密钥 (#33974)

  • 增强

    • 增强(actions)：仅为必需的上下文创建被过滤掉的工作流提交状态 (#38371) (#38385)
    • 增强：允许覆盖内置的默认git配置选项 (#38172)
    • 增强：允许MathML核心元素 (#38034)
    • 增强(标记)：改进议题标题渲染 (#37908)
    • 增强(actions)：在运行视图中设置描述性的浏览器标签页标题 (#37870)
    • 增强：将剩余的 gopkg.in/yaml.v3 用法迁移到 go.yaml.in/yaml/v4 (#37866)
    • 增强(actions)：显示YAML中的工作流名称而非文件名 (#37833)
    • 特性(actions)：在拉取请求同步事件负载中添加 before/after (#37827)
    • 增强(actions)：在运行列表中添加分支过滤器 (#37826)
    • 增强(actions)：使用更多信息美化摘要用户界面 (#37824)
    • 特性：为操作步骤标题添加复制按钮，改进其他复制按钮 (#37744)
    • 修复(图标)：使用 repo-forked 图标显示叉子计数 (#37731)
    • 特性(应用接口)：为作业列表端点添加排序和排序查询参数 (#37672)
    • 特性(应用接口)：在仓库API中添加 last_sync (#37566)
    • 增强：调整工作流图样式 (#37497)
    • 改进代码编辑器文本选择并清理lint启用状态 (#37474)
    • 在仓库编辑API和设置中添加镜像认证更新 (#37468)
    • 将 olivere/elastic 替换为REST API客户端，添加OpenSearch支持 (#37411)
    • 特性：添加默认拉取请求分支更新样式设置 (#37410)
    • 修复登出状态下仓库头按钮样式不一致的问题 (#37406)
    • 当要求签名提交时允许仅快进合并 (#37335)
    • 增强Actions页面样式 (#37323)
    • 修复：改进Actions状态图标和文本 (#37206)
    • 使Markdown围栏代码块支持更多语法 (#37154)
    • 修复：按作业ID和名称对Action运行作业进行排序，包含矩阵示例 (#37046)
    • 添加API端点以回复拉取请求审查评论 (#36683)

  • 性能

    • 性能(actions)：对运行器心跳写入进行防抖并限制任务选取 (#38281) (#38368)
    • 性能(网络)：在可能的情况下按仓库范围的索引对action_run查询进行排序 (#38155)
    • 性能：修复多项性能回归问题 (#38078)
    • 性能：扩展action c_u 索引以包含 created_unix，加速仪表板馈送 (#38076)
    • 在Actions运行、作业和任务API端点中批量加载相关数据 (#37032)

  • 错误修复

    • 修复(工具)：拒绝时间估算单位之间的无效字符 (#38416) (#38423)
    • 修复：将已删除的指派团队表示为幽灵团队 (#38413) (#38419)
    • 修复(人机验证)：将CAPTCHA验证路由通过配置的代理 (#38412) (#38420)
    • 修复：当提交状态挂起时刷新拉取请求合并框 (#38410) (#38411)
    • 修复：Actions任务状态并发更新 (#38405) (#38409)
    • 修复(actions)：在长分支名称时保持工作流运行尾部在一行显示 (#38382) (#38403)
    • 修复(网络)：使用区域感知的日期格式化贡献日历工具提示 (#38398) (#38401)
    • 修复：共同作者检测 (#38392) (#38397)
    • 修复：提交页面上不正确的共同作者检测 (#38386) (#38387)
    • 修复(用户界面)：恢复提交表列宽 (#38379) (#38383)
    • 修复：minio初始化检查 (#38355) (#38361)
    • 修复：组织项目视图指派人列表 (#38357) (#38360)
    • 修复(actions)：如果上下文在 FetchTask 期间被取消则释放已领取的任务 (#38343) (#38347)
    • 修复(actions)：使运行器列表分页顺序确定 (#38313) (#38327)
    • 修复：改进X-Total-Count计算提交时的since/until (#38243) (#38304)
    • 修复(actions)：启用时间戳时防止箭头与日志文本重叠 (#38227) (#38307)
    • 修复(工作流)：当工作流使用on:路径过滤器时分支保护状态检查失败 (#38237) (#38302)
    • 修复(oauth2)：在自动链接2FA流程期间持久化linkAccountData (#38274) (#38295)
    • 修复(actions)：允许Actions机器人推送到受保护的分支 (#38284) (#38293)
    • 修复(actions)：在状态过滤器中包含所有可聚合的运行状态 (#38280) (#38287)
    • 修复(归档器)：使用可序列化的仓库归档队列负载 (#38273) (#38283)
    • 修复：更新npm依赖项，修复杂项问题 (#38257)
    • 修复(应用接口)：在计算X-Total-Count提交时尊重since/until (#38204)
    • 修复：codemirror回归问题 (#38248)
    • 修复(应用接口)：支持所有API GET端点的HEAD请求 (#38245)
    • 修复(actions)：清理工作流状态徽章代码 (#38241)
    • 修复(网络)：正确对齐较大工作流名称的"已禁用"标签 (#38240)
    • 修复(actions)：不要将HTML实体吞入链接化的URL中 (#38239)
    • 修复(软件包)：接受字符串形式的npm “repository"和"bin” (#38236)
    • 修复(actions)：修复取消取消中任务时出现的500错误 (#38223)
    • 修复(依赖)：将模块 golang.org/x/image 更新至 v0.43.0 [安全] (#38219)
    • 修复(mssql)：将遗留的DATETIME列转换为DATETIME2 (#38216)
    • 修复(应用接口)：拒绝通过 /members 进行私有组织成员枚举 (#38213)
    • 修复(actions)：确保在大型工作流中所有等待的作业都获得运行器 (#38200)
    • 修复(依赖)：更新go依赖项 (#38194)
    • 修复(依赖)：更新npm依赖项 (#38193)
    • 修复(命令行界面)：为机器人用户将must-change-password默认设为false (#38175)
    • 修复(actions)：在运行视图中显示运行索引并修复摘要图高度 (#38165)
    • 修复：csp (#38162)
    • 修复(依赖)：更新npm依赖项 (#38123)
    • 修复(mssql)：扩展遗留议题和评论长文本列 (#38120)
    • 修复(软件包)：验证debian发行版和组件名称 (#38116)
    • 修复(软件包)：在goproxy ParsePackage中验证模块版本 (#38104)
    • 修复(依赖)：将依赖项 esbuild 更新至 v0.28.1 [安全] (#38097)
    • 修复：git推送钩子接收后 (#38089)
    • 修复(用户界面)：防止提交状态弹出窗口溢出其行 (#38081)
    • 修复：在rubygems parseMetadataFile中验证gem名称 (#38061)
    • 修复：提交显示名称 (#38057)
    • 修复：csp回归问题 (#38047)
    • 修复：api错误消息 (#38031)
    • 修复(依赖)：更新npm依赖项 (#38029)
    • 修复：pgsql lint (#38022)
    • 修复(索引器)：修复议题搜索中的指派人过滤器 (#38021)
    • 修复：各种下拉菜单问题 (#38020)
    • 修复：重构git错误处理并使归档流处理不存在的提交ID (#38007)
    • 修复：将git所需版本提高到2.13 (#37996)
    • 修复：从缓存控制头中移除"no-transform" (#37985)
    • 修复(依赖)：将模块 github.com/google/go-github/v87 更新至 v88 (#37971)
    • 修复：尽可能使用提交者时间作为默认值 (#37969)
    • 修复(依赖)：更新npm依赖项，移除nolyfill (#37968)
    • 修复(依赖)：更新go依赖项 (#37967)
    • 修复(拉取)：保留压缩消息尾注和其他提交消息 (#37954)
    • 修复(依赖)：将模块 golang.org/x/image 更新至 v0.41.0 [安全] (#37904)
    • 修复：在Action运行UI中支持 ##[command] 日志前缀 (#37882)
    • 修复(依赖)：将模块 github.com/google/go-github/v86 更新至 v87 (#37845)
    • 修复(依赖)：更新npm依赖项 (#37844)
    • 修复(依赖)：更新go依赖项 (#37841)
    • 修复(前端)：通过清单源路径解析Vite资源 (#37836)
    • 修复(语言环境)：替换硬编码字符串 (#37788)
    • 修复(软件包)：相对于链接仓库渲染markdown链接 (#37676)
    • 修复：持久化镜像仓库元数据 (#37519)
    • 通过模拟内置路径修复cmd测试 (#37369)
    • 为某些表单添加 form-fetch-action，修复"fetch action"响应bug (#37305)
    • 特性：在工作流取消时执行后运行清理 (#37275)
    • 修复 relative-time 错误并改进全局错误处理程序 (#37241)
    • 重构flash消息并移除SanitizeHTML模板函数 (#37179)

  • 测试

    • 测试(端到端)：修复PDF文件渲染测试中的竞态条件 (#38380) (#38381)
    • 测试：在 TestInitKeys 中比较密钥文件内容而非 FileInfo (#38330) (#38331)
    • 测试：加快两个测试速度 (#37905)
    • 测试：修复随机失败测试 (#37887)
    • 测试：修复不稳定的 issue-comment 关闭测试 (#37880)
    • 测试：为sqlite集成测试启用WAL (#37861)
    • 测试：修复不稳定的 TestResourceIndex 并减少其运行时间 (#37847)
    • 测试：通过本地克隆源离线运行 TestAPIRepoMigrate (#37817)
    • 持续集成：分片测试并减少冗余工作 (#37618)
    • 测试(端到端)：通过容器运行playwright (#37300)
    • 移除迁移测试中的外部服务依赖 (#36866)

  • 构建

    • 修复(actions)：在夜间远程构建之前对snapcraft进行身份验证 (#38252)
    • 持续集成：在数据库测试中限制Elasticsearch堆 (#37816)
    • 构建(snap)：通过actions将夜间版本发布到snapcraft (#37814)
    • 持续集成：将pgsql分片拆分为普通作业，去除设置操作的冗余 (#37802)
    • 持续集成：缩小files-changed前端过滤器范围 (#37749)
    • 持续集成：在 lint-actions 中添加 zizmor (#37720)
    • 杂务：清理"contrib"目录 (#37690)
    • 修复：snap构建（主分支） (#37685)
    • 持续集成：也为json5文件进行lint (#37659)
    • 特性(编辑器)：扩大web代码编辑器中的语言检测范围 (#37619)
    • 构建：将pnpm更新至v11 (#37591)
    • 重构(依赖)：从 nektos/act 分叉迁移到 gitea/runner (#37557)
    • 重构：对裸 fill/stroke 颜色进行lint，为git图形颜色系列添加变量 (#37543)
    • 更新go js py依赖项 (#37525)
    • 持续集成：使用commitlint对PR标题进行lint (#37498)
    • 杂务：将devcontainer镜像中的Go版本升级至1.26 (#37374)
    • 将GitHub Actions更新至最新主要版本 (#37313)
    • 更新go js依赖项 (#37312)
    • 通过NODE_ENV=test在rolldown警告时使vite构建失败 (#37270)
    • 移除htmx (#37224)
    • 将自定义Go格式化器替换为 golangci-lint fmt (#37194)
    • 重构htmx和fetch-action相关代码 (#37186)
    • 为所有依赖项更新集成renovate机器人 (#37050)
    • 构建(签名)：迁移至sigstore (#38250)

  • 文档

    • 文档：更新1.26.3和1.26.4的变更日志 (#38178)
    • 文档：修复foreachref文档注释中的重复单词 (#38161)
    • 文档：阐明成为合并者的标准 (#38113)
    • 文档：发布2026年TOC选举结果 (#38111)
    • 文档：在属性中将openapi3标记为自动生成 (#37963)
    • 文档：添加开发设置指南 (#37960)

  • 杂项

    • 撤回(签名)：恢复gpg (#38251)
    • 重构：将遗留的 delete-button 替换为 link-action (#38143)
    • 重构(actions)：从proto字段读取运行器能力 (#38068)
    • 重构(应用接口)：阐明APIError消息用法并修复遗留lint错误 (#38012)
    • 重构：使用 db.Get[] 代替 db.GetEngine(ctx).Get(bean) 以避免零值获取错误的数据库记录 (#37977)
    • 修复(依赖)：更新go依赖项 (#37851)
    • 持续集成：修复从传统提交标题同步PR标签的问题 (#37784) (#37825)
    • 持续集成：调整 files-changed，添加 free-disk-space (#37819)
    • 修复(依赖)：将模块 golang.org/x/crypto 更新至 v0.52.0 [安全] (#37806)
    • 测试(端到端)：添加评论、发布、星标、拉取请求和叉子测试 (#37800)
    • 杂务：简化议题和拉取请求模板 (#37799)
    • 杂务：更新giteabot以修复回退时的失败 (#37789)
    • 修复(应用接口)：优雅地处理推送镜像同步中的部分失败 (#37782)
    • 修复(依赖)：将模块 gitlab.com/gitlab-org/api/client-go/v2 更新至 v2.26.0 (#37771)
    • 持续集成：拆分giteabot工作流 (#37770)
    • 修复(依赖)：更新npm依赖项 (#37768)
    • 重构(waitgroup)：将Add/Done协程替换为WaitGroup.Go (#37764)
    • 修复(依赖)：将模块 google.golang.org/grpc 更新至 v1.81.1 (#37762)
    • 持续集成：修复缓存相关问题 (#37761)
    • 杂务：修复测试 (#37760)
    • 修复(依赖)：将模块 github.com/google/go-github/v85 更新至 v86 (#37754)
    • 修复(依赖)：更新npm依赖项 (#37753)
    • 修复(依赖)：更新go依赖项 (#37752)
    • 杂务(依赖)：更新action依赖项 (#37751)
    • 修复(标记)：为代码复制按钮包装缩进的代码块 (#37748)
    • 杂务(数据库)：引入db.Session和db.EngineMigration接口 (#37746)
    • 特性(网络)：在仓库列表中也显示拉取请求计数 (#37739)
    • 重构(全局)：使用strings.Builder进行正则表达式编译 (#37730)
    • 杂务(医生)：移除四个过时的医生检查实现 (#37728)
    • 重构(组织)：简化所有者-团队组织仓库创建逻辑 (#37727)
    • 重构：将 workflowpattern 移入 modules/actions (#37717)
    • 杂务：清理测试 (#37715)
    • 样式：杂项UI修复 (#37691)
    • 持续集成：添加shellcheck linter (#37682)
    • 修复：捕获并修复更多lint问题 (#37674)
    • 修复(依赖)：将依赖项 mermaid 更新至 v11.15.0 [安全]，添加端到端测试 (#37662)
    • 修复(依赖)：更新npm依赖项 (#37647)
    • 持续集成(renovate)：在主要版本升级时更新Go导入路径 (#37641)
    • 修复(依赖)：更新go依赖项（主要） (#37639)
    • 杂务(依赖)：更新action依赖项（主要） (#37638)
    • 修复(依赖)：将模块 code.gitea.io/sdk/gitea 更新至 v0.25.0 (#37637)
    • 修复(依赖)：更新npm依赖项 (#37636)
    • 重构(日志)：将log.Critical替换为log.Error (#37624)
    • 构建(依赖)：将fast-uri从3.1.0提升至3.1.2 (#37616)
    • 特性(oauth)：支持AWS Cognito OAuth2提供程序 (#37607)
    • 杂务(依赖)：更新action依赖项 (#37603)
    • 持续集成：允许PR标题lint中的 chore 类型 (#37575)
    • 重构：仅在表数据更改时重置数据库表 (#37573)
    • 持续集成：增加renovate频率并修复RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
    • 重构：使用modernc sqlite驱动作为默认值 (#37562)
    • 文档：修复CHANGELOG.md中的4处拼写错误 (#37549)
    • 修复(依赖)：更新go依赖项 (#37541)
    • 杂务(依赖)：更新action依赖项 (#37540)
    • 重构拉取请求视图 (6) (#37522)
    • 修复：将早期CLI控制台日志记录器重定向到标准错误 (#37507)
    • 重构"flex-list"为"flex-divided-list" (#37505)
    • 重构比较差异/拉取页面 (1) (#37481)
    • 重构拉取请求视图 (4) (#37451)
    • 在主分支中更新1.26.1变更日志 (#37442)
    • 重构：使用 Repository 结构体中命名的 Permission 字段代替匿名嵌入 (#37441)
    • 重构：通过 /assets/site-manifest.json 端点提供站点清单 (#37405)
    • 移除IsValidExternalURL/IsAPIURL并在调用点使用IsValidURL (#37364)
    • 更新"阻止用户"表单 (#37359)
    • 将审查请求函数移动到独立文件 (#37358)
    • 特性(安全)：默认设置X-Content-Type-Options: nosniff (#37354)
    • 启用严格TypeScript，添加 errorMessage 辅助函数 (#37292)
    • 重构前端 tw-justify-between 布局为 flex-left-right (#37291)
    • 更新Nix flake (#37284)
    • 修复仓库转移页面 (#37277)
    • 移除 SubmitEvent polyfill (#37276)
    • 移除 deadcode 工具识别的死代码 (#37271)
    • 将go-git升级至v5.18.0 (#37268)
    • 不添加会干扰变更日志生成的无用标签 (#37267)
    • 将热图移动到第一方代码 (#37262)
    • 测试/集成：简化代码 (#37249)
    • 为组织团队列表添加分页和搜索框 (#37245)
    • 从加密随机辅助函数和调用者中移除错误返回 (#37240)
    • 为OAuth2 OIDC认证源添加 ExternalIDClaim 选项 (#37229)
    • 重构：简化ParseCatFileTreeLine和catBatchParseTreeEntries (#37210)
    • 重构"htmx"为"fetch action" (#37208)
    • 更新go js py依赖项 (#37204)
    • 为"用户活动时间"设计添加注释 (#37195)
    • 移除过时的RunUser逻辑 (#37180)
    • 模型/夹具：为所有yml夹具文件添加"不要添加更多测试数据"注释 (#37150)
    • 更新javascript依赖项 (#37142)
    • 更新go依赖项 (#37141)
    • 正向移植v1.26.0-rc0的变更日志 (#37138)
    • 引入 ActionRunAttempt 以表示运行的每次执行 (#37119)
    • 工作流制品信息悬停 (#37100)
    • 将议题上下文弹出窗口扩展到markdown内容之外 (#36908)
    • 为组织添加批量仓库删除功能 (#36763)
    • 特性：为分支保护添加绕过允许列表 (#36514)

Gitea Cloud 上的实例将在指定的维护窗口期间自动升级到此版本。

更新内容 （原始）

  • BREAKING

    • Feat(actions)!: improve support for reusable workflows (#37478)
    • Use Content-Security-Policy: script nonce (#37232)

  • SECURITY

    • Fix: various security fixes (#38406) (#38426)
    • Fix(security): harden access checks and migration validation (#38324) (#38400)
    • Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
    • Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
    • Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
    • Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
    • Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
    • Fix: golang html template url escaping (#38363) (#38369)
    • Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
    • Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
    • Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
    • Fix(oauth): restrict introspection to the token’s client (#38042)
    • Fix(api): don’t expose private org membership via public_members (#38145)
    • Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
    • Fix(migrations): prevent path traversal in repository restore (#38215)

  • FEATURES

    • Feat(actions): add workflow status badge modal (#38196)
    • Feat(actions): support owner-level and global scoped workflows (#38154)
    • Feat(api): support ref suffixes in compare (#38148)
    • Feat(actions): implement jobs.<job_id>.continue-on-error (#38100)
    • Feat(actions): show run status on browser tab favicon (#38071)
    • Feat(api): add token introspection and self-deletion endpoint (#37995)
    • Feat(api): add q parameter to list branches API for server-side filtering (#37982)
    • Feat(repo): split repository creation limit into user and org scopes (#37872)
    • Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
    • Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
    • Feat(org): add team visibility so org members can discover teams (#37680)
    • Feat: add raw diff/patch endpoint for repository comparisons (#37632)
    • Feat: Add avatar stacks (#37594)
    • Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
    • Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
    • Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
    • Feat(orgs): Add search bar for organization members tab page (#37347)
    • Feat(api): Add assignees APIs (#37330)
    • Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
    • Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
    • Add project column picker to issue and pull request sidebar (#37037)
    • Allow multiple projects per issue and pull requests (#36784)
    • Feat(ui): add “follow rename” to file commit history list (#34994)
    • Feat(ssh): auto generate additional ssh keys (#33974)

  • ENHANCEMENTS

    • Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
    • Enhance: allow builtin default git config options to be overridden (#38172)
    • Enhance: allow MathML core elements (#38034)
    • Enhance(markup): improve issue title rendering (#37908)
    • Enhance(actions): set descriptive browser tab title on run view (#37870)
    • Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
    • Enhance(actions): show workflow name from YAML instead of filename (#37833)
    • Feat(actions): add before/after to PR synchronize event payload (#37827)
    • Enhance(actions): add branch filters to run list (#37826)
    • Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
    • Feat: add copy button to action step header, improve other copy buttons (#37744)
    • Fix(icon): use repo-forked icon to display forks count (#37731)
    • Feat(api): add sort and order query parameters to job list endpoints (#37672)
    • Feat(api): add last_sync to repository API (#37566)
    • Enhance: Adjust Workflow Graph styling (#37497)
    • Improve code editor text selection and clean up lint enablement (#37474)
    • Add mirror auth updates to repo edit API and settings (#37468)
    • Replace olivere/elastic with REST API client, add OpenSearch support (#37411)
    • Feat: Add default PR branch update style setting (#37410)
    • Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
    • Allow fast-forward-only merge when signed commits are required (#37335)
    • Enhance styling in actions page (#37323)
    • Fix: improve actions status icons and texts (#37206)
    • Make Markdown fenced code block work with more syntaxes (#37154)
    • Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
    • Add API endpoint to reply to pull request review comments (#36683)

  • PERFORMANCE

    • Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)
    • Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
    • Perf: Various performance regression fixes (#38078)
    • Perf: extend action c_u index to include created_unix for faster dashboard feeds (#38076)
    • Batch-load related data in actions run, job, and task API endpoints (#37032)

  • BUGFIXES

    • Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
    • Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)
    • Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)
    • Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)
    • Fix: actions task state concurrent update (#38405) (#38409)
    • Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)
    • Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)
    • Fix: co-author detection (#38392) (#38397)
    • Fix: incorrect co-author detection on commit page (#38386) (#38387)
    • Fix(ui): restore commits table column widths (#38379) (#38383)
    • Fix: minio init check (#38355) (#38361)
    • Fix: org project view assignee list (#38357) (#38360)
    • Fix(actions): release claimed task if context is cancelled during FetchTask (#38343) (#38347)
    • Fix(actions): make runner list pagination order deterministic (#38313) (#38327)
    • Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)
    • Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)
    • Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
    • Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)
    • Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)
    • Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)
    • Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)
    • Fix: update npm dependencies, fix misc issues (#38257)
    • Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
    • Fix: codemirror regressions (#38248)
    • Fix(api): support HEAD requests on all API GET endpoints (#38245)
    • Fix(actions): Cleanup workflow status badge code (#38241)
    • Fix(web): Correctly align the “disabled” label on larger workflow names (#38240)
    • Fix(actions): don’t swallow HTML entities into linkified URLs (#38239)
    • Fix(packages): accept npm “repository” and “bin” in string form (#38236)
    • Fix(actions): fix 500 error when canceling a canceling task (#38223)
    • Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
    • Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
    • Fix(api): deny private org member enumeration via /members (#38213)
    • Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
    • Fix(deps): update go dependencies (#38194)
    • Fix(deps): update npm dependencies (#38193)
    • Fix(cli): default must-change-password to false for bot users (#38175)
    • Fix(actions): show run index in run view and fix summary graph height (#38165)
    • Fix: csp (#38162)
    • Fix(deps): update npm dependencies (#38123)
    • Fix(mssql): expand legacy issue and comment long-text columns (#38120)
    • Fix(packages): validate debian distribution and component names (#38116)
    • Fix(packages): validate module version in goproxy ParsePackage (#38104)
    • Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
    • Fix: git push hook post receive (#38089)
    • Fix(ui): prevent commit status popup overflowing its row (#38081)
    • Fix: validate gem name in rubygems parseMetadataFile (#38061)
    • Fix: commit display name (#38057)
    • Fix: csp regressions (#38047)
    • Fix: api error message (#38031)
    • Fix(deps): update npm dependencies (#38029)
    • Fix: pgsql lint (#38022)
    • Fix(indexer): fix assignee filters in issue search (#38021)
    • Fix: various dropdown problems (#38020)
    • Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
    • Fix: raise git required version to 2.13 (#37996)
    • Fix: remove “no-transfrom” from the cache-control header (#37985)
    • Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
    • Fix: use committer time where ever possible as default (#37969)
    • Fix(deps): update npm dependencies, remove nolyfill (#37968)
    • Fix(deps): update go dependencies (#37967)
    • Fix(pull): preserve squash message trailers and additional commit messages (#37954)
    • Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
    • Fix: support ##[command] log prefix in action run UI (#37882)
    • Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
    • Fix(deps): update npm dependencies (#37844)
    • Fix(deps): update go dependencies (#37841)
    • Fix(frontend): resolve Vite assets by manifest source path (#37836)
    • Fix(locales): Replace hardcoded strings (#37788)
    • Fix(packages): render markdown links relative to linked repo (#37676)
    • Fix: persist mirror repository metadata (#37519)
    • Fix cmd tests by mocking builtin paths (#37369)
    • Add form-fetch-action to some forms, fix “fetch action” resp bug (#37305)
    • Feat: execute post run cleanup when workflow is cancelled (#37275)
    • Fix relative-time error and improve global error handler (#37241)
    • Refactor flash message and remove SanitizeHTML template func (#37179)

  • TESTING

    • Test(e2e): fix race in pdf file render test (#38380) (#38381)
    • Test: compare key file contents instead of FileInfo in TestInitKeys (#38330) (#38331)
    • Test: speed up two tests (#37905)
    • Test: Fix random failure test (#37887)
    • Test: fix flaky issue-comment close test (#37880)
    • Test: enable WAL for sqlite integration tests (#37861)
    • Test: fix flaky TestResourceIndex and reduce its runtime (#37847)
    • Test: run TestAPIRepoMigrate offline via a local clone source (#37817)
    • Ci: shard tests and reduce redundant work (#37618)
    • Test(e2e): run playwright via container (#37300)
    • Remove external service dependencies in migration tests (#36866)

  • BUILD

    • Fix(actions): authenticate snapcraft before nightly remote build (#38252)
    • Ci: cap Elasticsearch heap in db-tests (#37816)
    • Build(snap): publish nightly version to snapcraft via actions (#37814)
    • Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
    • Ci: narrow files-changed frontend filter (#37749)
    • Ci: add zizmor to lint-actions (#37720)
    • Chore: clean up “contrib” dir (#37690)
    • Fix: snap build (main branch) (#37685)
    • Ci: Also lint json5 files (#37659)
    • Feat(editor): broaden language detection in web code editor (#37619)
    • Build: update pnpm to v11 (#37591)
    • Refactor(deps): migrate from nektos/act fork to gitea/runner (#37557)
    • Refactor: lint bare fill/stroke colors, add vars for git graph color series (#37543)
    • Update go js py dependencies (#37525)
    • Ci: lint PR titles with commitlint (#37498)
    • Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
    • Update GitHub Actions to latest major versions (#37313)
    • Update go js dependencies (#37312)
    • Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
    • Remove htmx (#37224)
    • Replace custom Go formatter with golangci-lint fmt (#37194)
    • Refactor htmx and fetch-action related code (#37186)
    • Integrate renovate bot for all dependency updates (#37050)
    • Build(sign): move to sigstore (#38250)

  • DOCS

    • Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
    • Docs: fix duplicated word in foreachref doc comment (#38161)
    • Docs: Clarify criteria for becoming a merger (#38113)
    • Docs: Publish TOC Election Result 2026 (#38111)
    • Docs: mark openapi3 as autogenerated in attributes (#37963)
    • Docs: add development setup guide (#37960)

  • MISC

    • Revert(sign): restore gpg (#38251)
    • Refactor: replace legacy delete-button with link-action (#38143)
    • Refactor(actions): read runner capabilities from proto field (#38068)
    • Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
    • Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
    • Fix(deps): update go dependencies (#37851)
    • Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
    • Ci: tweak files-changed, add free-disk-space (#37819)
    • Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
    • Test(e2e): add comment, release, star, PR and fork tests (#37800)
    • Chore: simplify issue and pull request templates (#37799)
    • Chore: Update giteabot to fix failure when backport (#37789)
    • Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
    • Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
    • Ci: split giteabot workflow (#37770)
    • Fix(deps): update npm dependencies (#37768)
    • Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
    • Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
    • Ci: fix cache-related issues (#37761)
    • Chore: fix tests (#37760)
    • Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
    • Fix(deps): update npm dependencies (#37753)
    • Fix(deps): update go dependencies (#37752)
    • Chore(deps): update action dependencies (#37751)
    • Fix(markup): wrap indented code blocks for the code-copy button (#37748)
    • Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
    • Feat(web): also display PR counts in repo list (#37739)
    • Refactor(glob): use strings.Builder for regexp compilation (#37730)
    • Chore(doctor): remove four obsolete doctor check implementations (#37728)
    • Refactor(org): simplify owner-team org repo creation logic (#37727)
    • Refactor: move workflowpattern into modules/actions (#37717)
    • Chore: clean up tests (#37715)
    • Style: misc UI fixes (#37691)
    • Ci: add shellcheck linter (#37682)
    • Fix: catch and fix more lint problems (#37674)
    • Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
    • Fix(deps): update npm dependencies (#37647)
    • Ci(renovate): update Go import paths on major bumps (#37641)
    • Fix(deps): update go dependencies (major) (#37639)
    • Chore(deps): update action dependencies (major) (#37638)
    • Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
    • Fix(deps): update npm dependencies (#37636)
    • Refactor(log): replace log.Critical with log.Error (#37624)
    • Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
    • Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
    • Chore(deps): update action dependencies (#37603)
    • Ci: allow chore type in PR title lint (#37575)
    • Refactor: only reset a database table when the table’s data was changed (#37573)
    • Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
    • Refactor: use modernc sqlite driver as default (#37562)
    • Docs: fix 4 typos in CHANGELOG.md (#37549)
    • Fix(deps): update go dependencies (#37541)
    • Chore(deps): update action dependencies (#37540)
    • Refactor pull request view (6) (#37522)
    • Fix: redirect early CLI console logger to stderr (#37507)
    • Refactor “flex-list” to “flex-divided-list” (#37505)
    • Refactor compare diff/pull page (1) (#37481)
    • Refactor pull request view (4) (#37451)
    • Update 1.26.1 changelog in main (#37442)
    • Refactor: use named Permission field in Repository struct instead of anonymous embedding (#37441)
    • Refactor: serve site manifest via /assets/site-manifest.json endpoint (#37405)
    • Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
    • Update Block a user form (#37359)
    • Move review request functions to a standalone file (#37358)
    • Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
    • Enable strict TypeScript, add errorMessage helper (#37292)
    • Refactor frontend tw-justify-between layouts to flex-left-right (#37291)
    • Update Nix flake (#37284)
    • Fix Repository transferring page (#37277)
    • Remove SubmitEvent polyfill (#37276)
    • Remove dead code identified by deadcode tool (#37271)
    • Upgrade go-git to v5.18.0 (#37268)
    • Don’t add useless labels which will bother changelog generation (#37267)
    • Move heatmap to first-party code (#37262)
    • Tests/integration: simplify code (#37249)
    • Add pagination and search box to org teams list (#37245)
    • Remove error returns from crypto random helpers and callers (#37240)
    • Add ExternalIDClaim option for OAuth2 OIDC auth source (#37229)
    • Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
    • Refactor “htmx” to “fetch action” (#37208)
    • Update go js py dependencies (#37204)
    • Add comment for the design of “user activity time” (#37195)
    • Remove outdated RunUser logic (#37180)
    • Models/fixtures: add “DO NOT add more test data” comment to all yml fixture files (#37150)
    • Update javascript dependencies (#37142)
    • Update go dependencies (#37141)
    • Frontport changelog of v1.26.0-rc0 (#37138)
    • Introduce ActionRunAttempt to represent each execution of a run (#37119)
    • Workflow Artifact Info Hover (#37100)
    • Extend issue context popup beyond markdown content (#36908)
    • Add bulk repository deletion for organizations (#36763)
    • Feat: Add bypass allowlist for branch protection (#36514)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

下载链接