Gitea 28.0.0 is launched | Gitea Weblog

We are thrilled to announce the newest launch of Gitea v28.0.0.

Gitea drops the historic 1. prefix from its model numbers, so this launch is 28.0.0 fairly than 1.28.0.

Highlights embody audit logging, bot accounts, HTTPS deploy tokens, consumer impersonation for directors, code-owner approval guidelines, diff file filters, and an Actions queue view. See the changelog for every thing else.

We are very grateful for the many individuals who’ve contributed to the venture by sending code patches, reporting points, translating, and supporting us in lots of different methods.

This launch incorporates safety fixes. To give everybody time to improve, particulars will likely be added to this put up in a couple of week.

You can obtain Gitea from our downloads page. Please learn our installation guide for extra data. Before upgrading, learn the breaking changes. Then again up your information, exchange the binary or Docker container, and restart.

Release binaries not embody 32-bit x86 or gogit builds, and the Snap is not constructed for armhf. Download file names additionally not carry an OS model suffix, for instance gitea-28.0.0-windows-amd64.exe, so replace any obtain scripts.

We wish to thank all of our supporters on Open Collective who’re serving to to maintain the venture financially.

Migrations, mirrors, and different Git community operations now undergo an inner proxy that applies the egress settings to direct connections. Review your permit and block lists earlier than upgrading:

• The exterior preset is eliminated. For a deny-by-default coverage, set EGRESS_MODE = strict and checklist the allowed hosts. [migrations] EGRESS_MODE covers migrations and mirrors, and [security] EGRESS_MODE covers webhooks and OAuth2.
• In strict mode, entries with out a port solely permit ports 80 and 443.
• In the default lax mode, [security] ALLOWED_HOST_LIST not restricts public hosts. Set [security] EGRESS_MODE = strict to maintain it as an unique allowlist. Gitea logs a startup warning when the checklist is about with out an specific EGRESS_MODE.
• IP tackle entries not settle for wildcards, and * is not a sound entry.
• Domain entries comply with curl syntax: instance.com matches the area and all subdomains, *.instance.com matches solely subdomains, and instance.* is invalid.
• Invalid [migrations] BLOCKED_HOST_LIST entries now cease Gitea from beginning.
• [migrations] ALLOWED_DOMAINS, BLOCKED_DOMAINS, and ALLOW_LOCALNETWORKS are deprecated in favor of [migrations] ALLOWED_HOST_LIST and BLOCKED_HOST_LIST.

Thank you to @TheFox0x7 for contributing this alteration.

Completed Actions runs at the moment are deleted after 400 days by default, along with their jobs, logs, and artifacts. The new cleanup_action_runs cron process deletes them, by default at midnight. To hold all runs, set the next earlier than upgrading:

0 now means “hold ceaselessly” for RUN_RETENTION_DAYS, LOG_RETENTION_DAYS, and ARTIFACT_RETENTION_DAYS. Logs and artifacts are all the time deleted together with their run.

Thank you to @facorazza for contributing this alteration.

Gitea now refuses to start out with a Git model older than 2.25.0. If you put in Git your self, examine git --version earlier than upgrading.

Thank you to @silverwind for contributing this alteration.

• Self-registration is now disabled until [service] DISABLE_REGISTRATION = false is about explicitly.
• Gitea not reads [server] DOMAIN. The occasion area, together with the default SSH area, now comes from ROOT_URL, so set ROOT_URL in the event you relied on DOMAIN.

Thank you to @wxiaoguang for contributing this alteration.

• Job-level if: is now evaluated earlier than the matrix is expanded and should solely use the github, gitea, wants, vars, and inputs contexts. Move matrix circumstances to technique.matrix.embody/exclude or to step-level if:.
• Matrix fail-fast is now enforced, so a failing job can cancel the remaining combos. Set technique.fail-fast: false to let all of them end.
• Workflows in public repositories can not name reusable workflows from personal repositories, and nested workflows can not exceed the caller’s token permissions.

Thank you to @silverwind for contributing these adjustments.

Administrators can now impersonate a consumer to see Gitea as that consumer does, which helps reproduce entry issues with out asking for the consumer’s password. A banner marks the session and hyperlinks again to the administrator account. Everything accomplished within the session is carried out because the impersonated consumer, and with audit logging enabled, occasions report each accounts.

Thank you to @wxiaoguang and @bircni for contributing these enhancements.

Gitea can now report security-relevant occasions and present them within the admin, group, repository, and consumer settings. Events may be filtered by actor, motion, and origin, and directors can export them as JSONL.

Audit logging is off by default. Enable it with:

Events are stored for 30 days by default. Change this with [audit] RETENTION_DAYS, the place 0 retains them ceaselessly.

Thank you to @bircni for contributing this function.

A brand new [redis] part units one CONN_STR because the default for cache, session, queue, international lock, and WebSocket pub/sub. It applies to subsystems which can be already configured to make use of Redis however don’t set their very own connection string.

CONN_STR = redis://127.0.0.1:6379/0

Thank you to @mohammad-rj and @wxiaoguang for contributing this function.

Bot accounts are meant for automation. They authenticate with entry tokens, can’t sign up interactively, and obtain no notifications or emails. Administrators can create bots, handle their tokens, and convert eligible native accounts between customers and bots from the admin UI, API, or CLI.

Thank you to @joestump and @bircni for contributing this function.

Notification counts, stopwatch updates, and logout occasions now use a WebSocket at /-/ws as an alternative of server-sent occasions at /consumer/occasions. Reverse proxies should ahead WebSocket improve headers, in any other case notification counts and stopwatch updates fall again to polling. Deployments with a number of Gitea processes want [websocket] PUBSUB_TYPE = redis and a Redis connection. The [ui.notification] EVENT_SOURCE_UPDATE_TIME setting is eliminated.

Thank you to @mohammad-rj for contributing this alteration.

Deploy tokens are the HTTPS counterpart to SSH deploy keys. Each token is scoped to 1 repository with learn or read-write entry and serves because the password for Git and LFS over HTTPS. Both deploy tokens and private entry tokens (#38907) may be regenerated in place.

Thank you to @ToastyTheBot and @gomitrah for contributing these options.

The diff file tree beneficial properties a search field and a file-extension filter. Both slender the file tree and the diff, and the extension filter is stored within the URL, so a filtered view may be shared.

Thank you to @McMichalK, @silverwind, and @wxiaoguang for contributing this function.

A brand new department safety choice blocks merging till each matching CODEOWNERS rule is authorised by one in every of its code homeowners or a member of a listed crew.

Thank you to @Naxdy, @bircni, and @wxiaoguang for contributing this function.

The watch button is now a menu with Participating and mentions, All exercise, Ignore, and Custom. Custom provides notifications for any of points, pull requests, and releases. These selections apply to each UI and e mail notifications.

Thank you to @schonwetter for contributing this function.

A dropdown subsequent to the repository title enables you to search and swap between repositories of the identical proprietor.

Thank you to @bircni for contributing this function.

Template repositories can checklist information and directories in an [exclude] part of .gitea/template to go away them out of generated repositories.

Thank you to @paarth-k2002 for contributing this function.

Closing references akin to Fixes: #123 can now shut pull requests, not solely points.

Thank you to @silverwind for contributing this enchancment.

Repositories can now use Gitea’s built-in points along with an exterior tracker whose references use an alphanumeric or regular-expression format, akin to JIRA-123. Leave the exterior tracker URL empty, in any other case the Issues tab nonetheless redirects to the exterior tracker.

Thank you to @breken-ai for contributing this enchancment.

Gitea now detects REUSE-style license information named by their SPDX identifier and exhibits each detected license with a hyperlink to its file.

Thank you to @TheFox0x7 for contributing this function.

The new queue view lists operating jobs first, then ready jobs within the order runners decide them up. Administrators get an instance-wide view with proprietor, repository, and standing filters, and every repository has its personal queue within the Actions tab. Both views refresh in place.

Thank you to @bircni for contributing this function.

The Actions run checklist now refreshes mechanically, besides whereas the browser tab is within the background.

Thank you to @SudhanshuMatrix for contributing this function.

The Actions run view can now browse artifacts and preview textual content, pictures, PDFs, and generated HTML akin to take a look at studies. Previews require sign-in and skim entry to the run. HTML previews run in a sandboxed body. ZIP downloads stay accessible.

[actions] ARTIFACT_PREVIEW_MAX_SIZE limits previews to artifacts of as much as 10 MiB by default. 0 disables previews and -1 removes the restrict. Individual information are additionally topic to [ui] MAX_DISPLAY_FILE_SIZE.

Thank you to @bircni for contributing this function.

A job matrix can now be constructed from the outputs of earlier jobs, and technique.max-parallel limits what number of matrix jobs run without delay. Properties akin to runs-on can rely upon wants and are resolved as soon as these jobs end. makes use of: accepts self: to reference actions and workflows on the identical occasion, and reusable workflow calls settle for $/ for a similar repository (#38822). Pushing an invalid workflow file now creates a failed run that exhibits the error.

Thank you to @ZPascal and @silverwind for contributing these enhancements.

New REST endpoints handle venture boards at repository, group, and consumer stage.

Thank you to @silverwind for contributing this function.

New Actions endpoints handle workflow runs, fetch their logs, and force-cancel them.

Thank you to @rossigee and @Zettat123 for contributing these enhancements.

The npm registry helps npm deprecate, richer model metadata, and the single-version API. Helm charts may be uploaded with provenance information, and web site directors can checklist all packages by a brand new API.

Thank you to @philip-x-rutkowski-intel-com, @silverwind, @TheFox0x7, and @lunny for contributing these enhancements.

• BREAKING

  • Fix(git)!: route Git community operations by an inner proxy and replace egress settings (#39426)
  • Feat(actions)!: add RUN_RETENTION_DAYS to delete previous motion runs (#38855)
  • Refactor: “set up” web page (#39400)
  • Chore: elevate minimal git model to 2.25 (#39131)

• SECURITY

  • Fix(git): reject invalid and duplicate Git objects on push (#39472)
  • Fix(git)!: route Git community operations by an inner proxy and replace egress settings (#39426)
  • Fix(ssh): establish offered public keys by fingerprint (#39423)
  • Fix(actions): hold cancelled and unapproved fork PR runs behind the approval gate (#39399)
  • Fix(deps): replace golang.org/x/crypto SSH to handle denial of service (#39219)
  • Fix(repo): implement repository-scoped authorization for crew entry, deletion, and package deal unlinking (#39063)

• FEATURES

  • Feat(actions): replace actionslib, assist self:, misc fixes (#39358)
  • Feat(api): checklist all packages for web site directors (#38968)
  • Feat: handle bot accounts from the admin UI, API and CLI (#38966)
  • Feat(consumer): Personal entry tokens may be regenerated (#38907)
  • Feat(actions): assist $/ prefix in reusable workflow makes use of: (#38822)
  • Feat(actions): add force-cancel workflow run API (#38756)
  • Feat(licenses): assist REUSE specification in licenses (#38720)
  • Feat(api): add venture APIs (#38691)
  • Feat(webhook): fireplace repository occasion on repo rename (#38641)
  • Feat: admin impersonates a consumer (#38614)
  • Feat(actions): add construct queue view (#38585)
  • Feat(setting): add shared [redis] part as default for redis-backed subsystems (#38550)
  • Feat(repo): prioritize well-known READMEs and optimize discovery (#38532)
  • Feat(actions): implement adaptive auto-refresh for workflow runs checklist (#38329)
  • Feat(auth): add disable-2fa command (#38275)
  • Feat: Add audit logging (#38189)
  • Feat(repo): add fast repository switcher to repo header (#38188)
  • Feat(repo): assist file exclusion logic in .gitea/template in template era (#38064)
  • Feat(internet): Add org removing performance to admin consumer particulars web page (#38013)
  • Feat: add watch choices (#37571)
  • Feat: add deploy tokens (#37306)
  • Feat(diff): Add search and extension filter to diff sidebar (#37068)
  • Feat: Replace SSE with WebSocket for UI notifications (#36965)
  • Feat(actions): Add artifact preview in Actions run view (#36754)
  • Feat(packages): add assist for importing helm provenance information (#36695)
  • Feat: Add assist for dynamic matrix analysis in Gitea Actions workflows (#36564)
  • Feat: Add max-parallel Support for Gitea Actions (#36357)
  • Feat(actions): Add Actions API endpoints for workflow run administration and logs (#35382)
  • Feat: Add block on pending codeowner opinions department safety (#34995)

• ENHANCEMENTS

  • Enhance: permit auto-closing PRs from PRs (#39393)
  • Enhance(actions): add pending job standing and align job statuses with GitHub (#39376)
  • Enhance(acme): add configurable ACME profile (#39375)
  • Enhance(emoji): replace to Unicode 17, unify and lazy-load emoji information (#39363)
  • Enhance: enhance issue-pattern seize teams and assist each inner&exterior trackers enabled (#39354)
  • Enhance: replace mermaid to v12 (#39331)
  • Enhance(notifications): mark present notification web page as learn (#39294)
  • Enhance: assist ETag on streamed repository archives, assist If-None-Match: * (#39289)
  • Enhance: truncate however present lengthy traces in diffs (#39279)
  • Enhance(packages): implement npm single-version API and add per-version repository (#39267)
  • Enhance: transfer window.config to JSON, enhance CSP format (#39236)
  • Enhance: enhance commit web page header (#39229)
  • Enhance: Improve validation errors for secrets and techniques/variables (#39221)
  • Enhance(repo): examine full repo title for harmful operations (#39213)
  • Enhance(internet): disguise attachment dropzone on preview tab in combo editor (#39204)
  • Enhance(internet): present attachment URL and UUID in dropzone preview (#39203)
  • Enhance(actions): make workflow dispatch alternative dropdown assist search (#39154)
  • Enhance(repo): unify diff stats on commit pages, misc diff tweaks (#39134)
  • Enhance: use browser’s locale to detect week’s first day for the contribution map (#38995)
  • Enhance(ui): compelled colours mode enhancements (#38991)
  • Enhance: user-friendly packages setup guide (#38946)
  • Enhance: inherit crew entry for all models (#38938)
  • Enhance(admin): present impersonation banner and hold password change with the consumer (#38924)
  • Enhance(ui): tint toast backgrounds by stage (#38919)
  • Enhance(repo): add default object format setting (#38877)
  • Enhance(actions): set ref_protected in context (#38852)
  • Enhance(ui): restyle toasts (#38842)
  • Enhance: refine repo watching (#38835)
  • Enhance: fall again to DEFAULT_TEMPLATE.md when style-specific template is lacking (#38803)
  • Enhance(api): add GitHub-compatible /repos/{proprietor}/{repo}/commits/{ref} endpoint (#38770)
  • Enhance(api): expose file mode in contents API response (#38713)
  • Enhance(tls): use go’s tls defaults (#38687)
  • Enhance(ui): enhance luminance calculations (#38682)
  • Enhance(api): add tag_filter question parameter to launch checklist API (#38681)
  • Enhance(actions): exchange ansi_up with first-party code (#38619)
  • Enhance: hold standing examine checklist scrolled on merge field reload (#38597)
  • Enhance(actions): motion view enhancements (#38594)
  • Enhance(ui): tweak tooltip model and misc fixes (#38524)
  • Enhance: enhance e-mail templates (#38396)
  • Enhance(webhook): add reviewer title to MS Teams assessment request notifications (#38289)
  • Enhance: prolong tag allowed attributes (#38279)
  • Enhance(packages/npm): increase model metadata and assist npm deprecate (#37890)

• PERFORMANCE

  • Perf(references): scan solely the key phrase window earlier than a reference (#39396)
  • Perf(frontend): allow vite module preload (#39332)
  • Perf(gitdiff): optimize inline diff highlighting utilizing cache (#38706)

• BUGFIXES

  • Fix(actions): protect admitted jobs and runs of their concurrency group (#39461)
  • Fix(api): commit tree SHA is the commit ID (#39449)
  • Fix: PR merge (#39442)
  • Fix(actions): consider job-level if: earlier than concurrency examine (#39437)
  • Fix(api): permit pending-inline-comment-only opinions (#39433)
  • Fix: sanitize exterior render command line arguments (#39417)
  • Fix(LFS): recalculate repo LFSSize after gc-lfs removes orphaned information (#39406)
  • Fix(indexer): index full file paths and actual offsets in bleve (#39405)
  • Fix(git): hold main dashes in git grep search patterns (#39404)
  • Fix: use clearer message for ldap auth failure (#39392)
  • Fix(repo): commit web page fails to render unsigned commits with a distinct committer (#39381)
  • Fix: focus verify button and use crimson for delete confirmations (#39350)
  • Fix(migrations): protect SHA-256 pull request commit IDs (#39343)
  • Fix(ui): misc ui fixes (#39336)
  • Fix(actions): use gitea’s clock for actions durations (#39323)
  • Fix(actions): by no means present detrimental operating durations (#39322)
  • Fix: package deal registry keypair creation race (#39319)
  • Fix: add default timeout and deal with errors for HaveIBeenPwned API (#39316)
  • Fix(consumer): unify e mail validation for registration and settings (#39304)
  • Fix(ui): use button parts for department and tag dropdown tabs (#39285)
  • Fix(auth): repair ssh and gpg key verification on home windows (#39283)
  • Fix(feed): use significant traces as remark excerpt (#39276)
  • Fix(tasks): permit max columns to the restrict (#39272)
  • Fix: move merge commit messages to git through stdin (#39269)
  • Fix(repo): floor unrelated histories on Sync Fork (#39258)
  • Fix: keep away from nil panic and refactor some trivial issues (#39251)
  • Fix: restore lacking blob file when re-publishing a package deal (#39239)
  • Fix(automerge): validate head commit earlier than merge (#39235)
  • Fix(httplib): forestall leaking localhost:3000 in public hyperlinks (#39217)
  • Fix(setting): honor naked -1 for timeout settings (#39181)
  • Fix: appropriate repo/attatchment absolute url and launch structure (#39178)
  • Fix(internet): populate the explanation for “can’t decide to department” in internet editor commit kind (#39155)
  • Fix(course of): reap complete course of group on cmd.Cancel (#39143)
  • Fix: acknowledge linguist language aliases (#39135)
  • Fix(repo): protect switch recipient collaboration (#39042)
  • Fix(db): make paginated database reads all the time require “order” choice (#39017)
  • Fix: make native queue PopItem may be notified (#39011)
  • Fix: classify git failures on stderr, limit migration failure element (#39010)
  • Fix: permit re-requesting uncounted assessment approvals (#38988)
  • Fix(actions): permit bigger scheduled workflows (#38985)
  • Fix: resolve actions commit standing permission per repository (#38977)
  • Fix(deps): replace module golang.org/x/picture to v0.45.0 [security] (#38930)
  • Fix(deps): replace module golang.org/x/mod to v0.40.0 [security] (#38914)
  • Fix: dedupe difficulty cross-reference timeline entries (#38881)
  • Fix(server): set ReadHeaderTimeout on HTTP servers (#38878)
  • Fix(repo): keep away from a repo-sized temp file for each bundle obtain (#38863)
  • Fix(lfs): guarantee lock itemizing paginates with a complete order (#38850)
  • Fix(avatar): use sha256 and inline the federated avatar lookup (#38843)
  • Fix(gitdiff): render exact-limit diffs and zero-limit feedback (#38838)
  • Fix(deps): replace dependency mermaid to v11.16.1 [security] (#38813)
  • Fix: misc fixes in pub/gpg/checks (#38809)
  • Fix: git diff blob excerpt (#38808)
  • Fix(packages): present error for duplicate cleanup guidelines #37820 (#38786)
  • Fix(actions): repair runner docs hyperlink (#38783)
  • Fix: git cache (#38763)
  • Fix(actions): consider every ${{ }} half by itself (#38754)
  • Fix: don’t report failed community requests as JavaScript errors (#38732)
  • Fix(gitdiff): forestall index out of vary panic in GetLineTypeMarker (#38728)
  • Fix(api): doc X-Total-Count as an alternative of non-existent X-Total header (#38717)
  • Fix(actions): dynamic matrix growth correctness fixes (#38690)
  • Fix(auth): report final sign-in on reverse proxy login (#38672)
  • Fix(api): settle for fully-qualified refs in contents API (#38650)
  • Fix(deps): replace module github.com/getkin/kin-openapi to v0.144.0 [security] (#38623)
  • Fix(deps): replace dependency js-yaml to v5.2.2 [security] (#38622)
  • Fix: abort outmoded difficulty suggestion requests (#38620)
  • Fix(difficulty): show error toast on batch motion failures as an alternative of reloading web page (#38593)
  • Fix(deps): replace module google.golang.org/grpc to v1.82.1 [security] (#38567)
  • Fix(deps): replace module github.com/google/go-github/v88 to v89 (#38433)
  • Fix(deps): replace go dependencies (#38429)
  • Fix(deps): replace go dependencies (#38346)
  • Fix(deps): replace npm dependencies (#38342)
  • Fix(base): appropriate pure type of numbers with main zeros (#38163)
  • Fix(ui): keep away from structure shifts in overflow-menu and repo filter (#37818)
  • Fix: make auth supply group sync accurately deal with crew removing (#37161)
  • Fix(launch): separate publication time from the discharge date (#36761)

• TESTING

  • Test: cease checks from writing into ~/.ssh (#39348)
  • Test(e2e): log off to modify customers in pr-review take a look at (#39328)
  • Test: launch fixtures loader lock earlier than database work (#39263)
  • Test: pace up checks, repair transaction bug (#39030)
  • Test: run frontend unit checks in browsers (#38860)
  • Test(pubsub): cease racing the Redis SUBSCRIBE ack (#38661)
  • Test(e2e): add pull request merge field take a look at, replace AGENTS.md (#38576)
  • Test(e2e): deterministically await occasion stream in logout propagation take a look at (#38535)

• BUILD

  • Refactor: repair go vet errors associated to composite literals (#39341)
  • Build(gogit): disable gogit builds for steady releases (#39324)
  • Refactor: exchange jquery.are-you-sure with first-party code (#39233)
  • Refactor: http request binding (#38971)
  • Refactor: clear up git repo and mannequin migration packages (#38564)
  • Refactor: put together to decouple the “mannequin migration” package deal and “fashions” package deal (#38533)
  • Build: repair snapcraft launch (#38260)
  • Build(launch): use native golang toolchain for official launch builds (#37828)

• DOCS

  • Docs(webhook): assessment.kind remark lists values the webhook by no means sends (#39451)
  • Docs(api): doc verification and information on the examine endpoint (#39440)
  • Docs(api): title the unadopted-repository search parameter question (#39370)
  • Docs: take away unused COOKIE_USERNAME from app.instance.ini (#39365)
  • Docs: doc NOTICE_ON_SUCCESS for each cron process (#39352)
  • Docs: appropriate ALLOW_LOCALNETWORKS description in app.instance.ini (#39240)
  • Docs: repair typo in README about app.ini restart (#39223)
  • Docs: repair lifeless localization doc hyperlink within the READMEs (#39211)
  • Docs: Update CHANGELOG for launch 1.27.3 (#39170)
  • Docs: Update CHANGELOG for model 1.27.2 (#38923)
  • Docs: Update PGP key expiration date to July 23, 2027 (#38747)
  • Docs(api): doc 401/403 responses for consumer key endpoints (#38711)
  • Docs: Update Changelog for launch v1.27.1 (#38670)
  • Docs: Update Changelog for 1.27 (#38440)
  • Docs: Update Security docs (#38422)

• MISC

  • Refactor: make git http reply error message (#39390)
  • Refactor(api): convert bot accounts by the admin consumer edit endpoint (#39355)
  • Refactor: exchange AWS SDK with a REST shopper for CodeCommit migration (#39330)
  • Refactor: exchange Azure Blob SDK with a REST shopper (#39315)
  • Refactor: npm route handlers (#39275)
  • Refactor: GetDiffShortStat and repair panic attributable to inconsistent “modified file quantity” (#39248)
  • Refactor(templates): replace djlint to 1.46.0 and resolve its new findings (#39231)
  • Refactor: pagination/pager (#39162)
  • Refactor: share package deal registry error standing classification (#39133)
  • Refactor: drop two unmaintained dependencies, rename the byte measurement helpers (#39083)
  • Refactor(automerge): repair error dealing with, populate latest automerge duties on restart (#39001)
  • Refactor: deploy key and personal route handlers (#38999)
  • Refactor: wiki edit kind (#38918)
  • Refactor: clear up kind binding & validation (#38873)
  • Refactor: markup render (#38864)
  • Refactor: api token scope examine (#38862)
  • Refactor: exchange gliderlabs/ssh with golang.org/x/crypto/ssh (#38837)
  • Refactor: kind binding validation (#38832)
  • Refactor: put together vue parts for vapor mode (#38798)
  • Refactor: use the shared workflow mannequin from actionslib (#38768)
  • Refactor(modelmigration): thread context by migration features (#38758)
  • Refactor: migrate remaining Vue parts to
    
    Source link