https://blog.gitea.com/Gitea Blog Blog2026-06-30T08:00:00.000Zhttps://github.com/jpmonette/feedGitea Blog Bloghttps://blog.gitea.com/img/favicon.svg<![CDATA[Gitea Runner 2.0.0 is released]]>https://blog.gitea.com/release-of-runner-2.0.02026-06-30T08:00:00.000Z
We are happy to announce the release of Gitea Runner 2.0.0.
This release brings job summaries, improved cancellation handling, job-level workflow syntax that was previously ignored, and a long list of reliability fixes since the 1.0.0 stable release.
Several headline features in 2.0.0 pair with Gitea 1.27 on the server side. The runner remains wire-compatible with older Gitea versions; when the server does not advertise a capability, the runner simply skips the related feature.
Workflow steps can now write to GITHUB_STEP_SUMMARY, and the runner uploads the rendered markdown when Gitea advertises support. Summaries appear in the Actions run view alongside job logs.
info
Requires Gitea 1.27 for storing and displaying summaries. On older Gitea versions the runner skips the upload when the server does not advertise the job-summary capability.
The runner advertises a cancelling capability so Gitea can use a transitional Cancelling state before a job is finalized as cancelled.
Post steps and if: always() / if: cancelled() main steps now run on cancellation, matching GitHub Actions behavior.
Unix and Windows step process trees are torn down reliably when a job is cancelled, avoiding hung runners.
info
Requires Gitea 1.27 for the transitional Cancelling job state and capability negotiation. The runner remains wire-compatible with older servers; without Gitea 1.27, cancellation still works but without the full server-side semantics.
Two jobs.<job_id> fields that were parsed from YAML but silently ignored are now implemented:
timeout-minutes — applies a deadline around the entire job (container start, pre-steps, main steps, and post-steps). Supports expression interpolation. Runner-only; no Gitea upgrade required.
continue-on-error — when a job is allowed to fail, dependent jobs gated on if: success() still run, matching GitHub Actions semantics.
info
Requires Gitea 1.27 for workflow run aggregation that treats tolerated job failures as success for needs.
A new optional runner.post_task_script setting runs a host executable after each task's built-in cleanup (post steps, container teardown, bind-workdir removal). This is useful for pruning Docker images, vacuuming ephemeral disks, or resetting VM state between jobs. See the post-task script documentation for lifecycle details and timeout behavior.
ssh:// action URLs — clone actions over SSH in addition to HTTPS and HTTP.
Shallow action clones — remote actions are shallow-cloned by default (runner.action_shallow_clone, default true), with automatic fallback to a full clone when needed.
Docker pull credentials: Gitea Runner no longer implicitly uses DOCKER_USERNAME and DOCKER_PASSWORD workflow secrets for image pulls (#1007). These names are commonly used for registry login during image pushes, and sending them to every pull caused authentication failures against Docker Hub.
If you relied on the old implicit behavior, migrate to explicit credentials:
jobs:
build:
container:
image: registry.example.com/image:tag
credentials:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
For private Docker actions or service containers, use credentials on the service definition, or run docker login on the runner host before jobs start.
Re-fetch cached reusable workflow on every run (#930)
]]>Zettahttps://gitea.com/Zettat123bircnihttps://github.com/bircni<![CDATA[Gitea 1.26.3 and 1.26.4 are released]]>https://blog.gitea.com/release-of-1.26.3-and-1.26.42026-06-21T08:00:00.000Z
We are excited to announce the release of Gitea 1.26.3 and Gitea 1.26.4. Version 1.26.3 delivers a large set of security fixes alongside important bug fixes and stability improvements. Version 1.26.4 follows immediately with a fix for a repository code-page regression introduced in 1.26.3 and an additional security fix.
We strongly recommend upgrading directly to 1.26.4. If you are already on 1.26.3, please upgrade to 1.26.4 as soon as possible.
This release fixes the "context deadline exceeded" regression from 1.26.3, where repository code pages could fail to load (#38177). WalkGitLog now handles EOF and context errors correctly (#38185). Thanks to @wxiaoguang for the fix.
It also addresses the following security advisory:
Do not auto-reactivate disabled users on the OAuth2 sign-in callback (#38183). Thanks to @chndlrx for the report, and @bircni for the fix.
This release addresses a number of security advisories. Several of them bundle multiple fixes into combined pull requests (#38151 and #38147).
CVE-2026-20896: The Docker images shipped a REVERSE_PROXY_TRUSTED_PROXIES = * default, which let any source IP impersonate any user via the X-WEBAUTH-USER header. Reverse-proxy authentication is now opt-in and admin-configured (#38151). Thanks to @rz1027 for the report, and @bircni for the fix.
CVE-2026-22874: Tighten the default allow-list filter used by webhooks and migrations to close an incomplete SSRF protection that could reach internal addresses (#38173, #38059). Thanks to @JLLeitschuh for the report, and @TheFox0x7 and @bircni for the fix.
CVE-2026-27775: Re-check branch write permission for every ref in a push; the pre-receive hook cached the first ref's result, letting a per-branch maintainer-edit grant escalate to full repository write (#38151). Thanks to @adrian-doyensec for the report, and @bircni for the fix.
CVE-2026-24451: Block fork synchronization (merge-upstream) when the base repository is no longer readable, so a fork can no longer pull commits made after its parent was switched from public to private (#38151). Thanks to @ybsun0215 for the report, and @bircni for the fix.
CVE-2026-20779: Enforce single-use TOTP passcodes across web login, password reset, and the Basic-Auth X-Gitea-OTP surface, closing a TOCTOU race and a stateless replay window (#38151). Thanks to @Kript0r3x for the report, and @bircni for the fix.
CVE-2026-28740: Require Code-unit access for cross-repository LFS object reuse, so a non-Code grant can no longer authorize private source objects (#38050). Thanks to @m2hcz for the report, and @bircni for the fix.
Reject unknown SSH LFS sub-verbs to close an authentication bypass that allowed unauthorized read access to private repositories (#38015). Thanks to @Tomer-PL for the report, and @bircni for the fix.
Require a fork pull request to be merged before it can bypass the workflow approval gate, fixing a permanent approval-gate bypass (#38041). Thanks to @prakhar0x01 for the report, and @bircni for the fix. See the breaking-change note below.
CVE-2026-27761: Enforce repository token scope on the RSS/Atom feed endpoints, so a personal access token without repository scope can no longer read private repository commit data (#38147). Thanks to @babakizo420 for the report, and @bircni for the fix.
CVE-2026-25038: Enforce organization visibility on the organization label read endpoints so private organization labels no longer leak to non-members (#38151). Thanks to @ybsun0215 for the report, and @bircni for the fix.
Block HTTP redirects during repository migration clones to prevent SSRF reaching internal addresses through an attacker-controlled redirect (#38147). Thanks to @moltenbit for the report, and @bircni for the fix.
Bound CODEOWNERS pattern matching time to prevent an unauthenticated ReDoS denial of service (#38025). Thanks to @AdamKorcz for the report, and @bircni for the fix.
Redact the notification subject after repository access is revoked, so private issue and pull request metadata is no longer leaked through the notification API (#38147). Thanks to @ybsun0215 for the report, and @bircni for the fix.
This release also includes additional security hardening that bounds Debian control-file parsing to a single stanza (#38055) and updates golang.org/x/net to v0.55.0 (#37829).
This release includes 31 merged pull requests, thanks to the amazing contributions from our community.
This release tightens the fork pull request approval gate: a pull request from a fork must now be merged before it can bypass the approval gate (#38041). Review your workflow approval settings if you rely on the previous behavior.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>bircnihttps://github.com/bircni<![CDATA[TOC Election 2026]]>https://blog.gitea.com/toc-election-20262026-06-14T14:10:00.000ZAs is tradition, each year we have a new election for our Technical Oversight Committee. This past year, the elected members were (in alphabetical order) 6543, delvh, and lafriks. We'd like to thank them for their service in continuing to ensure that Gitea is the best it can be.
Our election process started this May where maintainers nominated other maintainers, or themselves to be put up as options for the election. The candidates who accepted the nominations were ChristopherHX, delvh, TheFox0x7 and bircni.
This year, for the first time, we had a tie between two candidates, ChristopherHX and TheFox0x7, which was resolved by a new script that randomly selects one of the tied candidates as the winner. This has been documented in our election process for future elections, and the script is available in our repository for transparency.
The elected TOC members are incumbent delvh, and two new members, TheFox0x7 and bircni. Congratulations to the elected members and thank you for your willingness to serve the Gitea community in this important role.
]]>delvhhttps://gitea.com/delvhbircnihttps://github.com/bircniTheFox0x7https://github.com/TheFox0x7techknowlogickhttps://gitea.com/techknowlogick<![CDATA[Gitea 1.26.2 is released]]>https://blog.gitea.com/release-of-1.26.22026-05-20T08:29:00.000Z
We are excited to announce the release of Gitea 1.26.2! We strongly recommend all users upgrade to this version, as it contains a number of security fixes alongside important bug fixes and stability improvements.
CVE-2026-27783: fix(permissions): Fix reading permission (#37769) (#37781). Thanks to @hoangperry for the report, and thanks to @lunny for the fix.
fix(actions): make artifact signature payloads unambiguous (#37707) Thanks to @lunny for the fix.
CVE-2026-25714: fix: Unify public-only token filtering in API queries and repo access checks (#37118) Thanks to Medoedus for the report. Thanks to @lunny for the fix.
CVE-2026-20706: fix: Add missed token scope checking (#37735) Thanks to geoo115 for the report. Thanks to @lunny for the fix.
fix(oauth): bind token exchanges to the original client request (#37704) Thanks to @lunny for the fix.
fix(oauth): strengthen PKCE validation and refresh token replay protection (#37706) Thanks to @lunny for the fix.
fix(web): enforce token scopes on raw, media, and attachment downloads (#37698) Thanks to @kamil-sawicki
for the report. Thanks to @lunny for the fix.
fix(security): enforce wiki git writes and LFS token access at request time (#37695) Thanks to @lunny for the fix.
feat(api): encrypt AWS creds (#37679) Thanks to @Exgene for the report and the fix.
CVE-2026-27771: fix(packages): Add label for private and internal package and fix composor package source permission check (#37610) Thanks to NoScope for the report. Thanks to @lunny for the fix.
CVE-2026-28744: fix(git): Fix smart http request scope bug (#37583) Thanks to ohxorud-dev for the report. Thanks to @lunny for the fix.
CVE-2026-28699: Fix basic auth bug (#37503) Thanks to Wesley Colquitt / ByteShyftStudios LLC / @Alardiians for the report. Thanks to @lunny for the fix.
CVE-2026-26231: Fix allow maintainer edit permission check (#37479) (#37484) Thanks to Arvin Shivram of Brutecat Security for the report. Thanks to @lunny for the fix.
Fix URL sanitization to handle schemeless credentials (#37440) (#37471) Thanks @bircni for the fix.
chore(deps): bump go-git/go-git/v5 to 5.19.0 (#37608)
fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
This release includes 54 merged pull requests, thanks to the amazing contributions from our community.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>bircnihttps://github.com/bircnilunnyhttps://gitea.com/lunny<![CDATA[Gitea Runner 1.0.0 is released]]>https://blog.gitea.com/release-of-runner-1.0.02026-05-05T21:00:00.000Z
We are happy to announce the release of Gitea Runner 1.0.0.
This is the first stable release of the official Gitea Actions runner under its new name. The project formerly known as act_runner has been renamed to Gitea Runner, with the repository now available at gitea/runner.
The original act_runner name reflected the project's early implementation history and its relationship with nektos/act. Since then, Gitea Actions and the runner have grown into a core part of the Gitea ecosystem.
The new name makes the purpose clearer: this is the official runner for Gitea Actions.
Note: the last act_runner releases were on the v0.6.x line. Gitea Runner v1.0.0 is an intentional reset and starts a new stable versioning scheme under the new name.
Gitea Runner continues to support the familiar registration flow, while encouraging explicit YAML configuration for runner settings.
You can generate a starting configuration with:
./gitea-runner generate-config > config.yaml
Then pass it to the commands that load runner configuration:
./gitea-runner -c config.yaml register
./gitea-runner -c config.yaml daemon
./gitea-runner -c config.yaml cache-server
If you prefer an environment-only setup (no config file), the runner still supports the environment variables shown above (GITEA_INSTANCE_URL and GITEA_RUNNER_REGISTRATION_TOKEN). A config file is the recommended way to manage runner behavior going forward.
If you already run act_runner, plan to update scripts, service files, Docker Compose files, Kubernetes manifests, and monitoring references to the new gitea-runner and gitea/runner names.
For many deployments, the migration is a straight rename. For example:
- act_runner daemon
+ gitea-runner daemon
- gitea/act_runner:0.2.x
+ gitea/runner:1.0.0
The old repository URL redirects to the new repository, but new documentation and release artifacts use the new naming.
As always, please test the new runner in your environment before rolling it out broadly, especially if your workflows depend on custom labels, Docker-in-Docker setups, rootless Docker, or external cache configuration.
Thank you to everyone who contributed code, testing, bug reports, documentation, and feedback while the runner matured from its first releases to 1.0.0.
We would also like to thank the nektos/act project and contributors, whose work continues to be an important part of the Gitea Actions runner.
]]>bircnihttps://github.com/bircni<![CDATA[Gitea 1.26.1 is released]]>https://blog.gitea.com/release-of-1.26.12026-04-21T18:36:00.000Z
We are excited to announce the release of Gitea 1.26.1! We strongly recommend all users upgrade to this version, as it includes important fixes that address several significant issues since 1.26.0 and improves overall stability.
This release includes 22 merged pull requests, thanks to the amazing contributions from our community.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>bircnihttps://github.com/bircni<![CDATA[Gitea 1.26.0 is released]]>https://blog.gitea.com/release-of-1.26.02026-04-18T20:04:00.000Z
We are thrilled to announce the latest release of Gitea v1.26.0.
Gitea 1.26.0 brings exciting new features, performance improvements, and quality-of-life enhancements. Here are some notable changes and features in Gitea 1.26; for the full list, refer to the full release notes.
We are very thankful for the many people who have contributed to the project by sending code patches, reporting issues, translating, and supporting us in many other ways.
This release addresses several important security vulnerabilities:
CVE-2026-28737: Stored XSS in the Gitea 3D File Viewer via the glTF extensionsRequired field. Fixed by #37233. Thanks to @yonatan-pl for reporting the issue, and to @silverwind and @wxiaoguang for the patch.
CVE-2026-22555: Missing CanCreateOrgRepo check in the API fork flow allowed exfiltration of organization secrets. Fixed by #36950. Thanks to @andrejtomci for reporting the issue, and to @lunny for the patch.
CVE-2026-27780: Branch protection bypass caused by silent truncation in bufio.Scanner during pre-receive hook processing. Fixed by #36963. Thanks to @yonatan-pl for reporting the issue, and to @lunny for the patch.
Bound PageSize in ListUnadoptedRepositories to prevent unbounded API responses (#36884).
You can download it for example from our downloads page. Please read our installation guide for more information on installation. To upgrade, as always, back up your data and then replace the binary or Docker container and restart.
We would like to thank all of our supporters on Open Collective who are helping to sustain the project financially.
As always, the changes are sorted descending by what we deem most important for users and admins, so the most important change comes first.
Are you looking for a seamless, hassle-free solution to manage your Git repositories? Look no further! Gitea Cloud is here to revolutionize your development experience.
⚠️ Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
The standalone environment-to-ini tool was removed and a sub command of gitea has been introduced. If you need to re-create the configuration file with only a subset of keys, you can provide an INI template file and use the "--config-keep-keys" flag.
⚠️ Correct Swagger annotations for enums, status codes, and notification state (#37030)
The generated OpenAPI description is now aligned with the actual API: enum values, HTTP status codes, and notification state are documented more accurately. If you rely on the published Swagger spec for code generation or contract tests, regenerate clients and re-check any assumptions about optional fields or response shapes.
The GET endpoint used to retrieve a registration token has been removed. Automation that still calls it needs to be updated to the supported registration flow for your deployment.
Workflows can now use GitHub-style concurrency groups so that new runs cancel or queue relative to in-progress jobs. That changes runtime behavior compared with earlier releases, so review existing workflows after upgrading—especially long-running or overlapping pipelines.
Thank you to @Zettat123 for contributing this feature.
⚠️ Make PUBLIC_URL_DETECTION default to auto (#36955)
New installations now default to automatic public URL detection. If you depend on a specific explicit URL configuration behind reverse proxies or alternate hostnames, confirm your [server] settings after upgrade so links, webhooks, and redirects still match your environment.
Thank you to @wxiaoguang for contributing this change.
Gitea now supports git archive --remote against the repository URL, so clients can fetch archives through Git’s remote archive protocol (not only through the HTTP download endpoints).
Thank you to @TheFox0x7 for contributing this feature.
🚀 Add ability to download subpath archive (#36371)
Download a zip or tarball for a subdirectory of the repository instead of the full tree, which is ideal for monorepos and partial checkouts.
Thank you to @TheFox0x7 for contributing this feature.
The release editor can generate Markdown notes server-side from merged pull requests and contributors, similar to GitHub, so publishing a version takes less manual editing.
Thank you to @dawidgora for contributing this feature.
🚀 Add "Go to file" and "Delete directory" on the repo file list (#35911)
Jump directly to a file by name and remove a whole directory from the browser when you have permission, streamlining everyday repository maintenance.
Thank you to @brymut for contributing this feature.
Workflows can declare concurrency groups so new runs cancel or queue behind in-flight jobs, closely matching GitHub Actions. Because this changes how overlapping runs behave, pair this with the migration notes in Major Breaking Changes above.
Thank you to @Zettat123 for contributing this feature.
🚀 Workflow dependency visualization and graph refresh (#26062) (#36248) (#36912)
Complex workflows are easier to understand: the run view can show how jobs depend on each other, and the workflow graph styling has been updated for clarity.
Thank you to @xDarkmanx and @bircni for contributing these improvements.
Artifact upload/download can avoid zip wrapping where appropriate (with updated actions runner components), simplifying consumption from downstream jobs or external tools.
Thank you to @ChristopherHX for contributing this feature.
Git object reads use the newer --batch-command style where possible, cutting overhead for operations that touch many objects.
Thank you to @wxiaoguang for contributing this improvement.
🚀 Use merge tree to detect merge conflicts when possible (#36400)
Conflict detection can take a faster path by leveraging merge-tree when Git supports it, which speeds up pull request and merge previews on busy instances.
Thank you to @lunny for contributing this improvement.
In-browser editing uses CodeMirror instead of Monaco, improving consistency with the rest of the UI and bundle layout.
Thank you to @silverwind for contributing this change.
🚀 Replace CSRF cookie with CrossOriginProtection (#36183)
Cross-site request protections are modernized: the old CSRF cookie mechanism gives way to CrossOriginProtection, which may affect custom reverse-proxy or embedding setups—see upgrade notes if you tune CORS or cookies manually.
Thank you to @silverwind for contributing this change.
And many more contributors who have helped with testing, reporting issues, and translating!
We will thank all original contributors of backport pull requests on next release.
]]>lunnyhttps://gitea.com/lunnybircnihttps://github.com/bircni<![CDATA[Gitea 1.25.5 is released]]>https://blog.gitea.com/release-of-1.25.52026-03-16T18:36:00.000Z
We're excited to announce the release of Gitea 1.25.5! We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements.
CVE-2026-25779: Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716). Thanks to @quirmz for the report, and thanks to @lunny for the fix.
CVE-2026-27660: Fix the release draft permission check (#36659) (#36715). Thanks to @anticomputer for the report, and thanks to @lunny for the fix.
CVE-2026-27657: Fix an issue where a user could change another user's primary email address (#36586) (#36607). Thanks to @CsEnox for the report, and thanks to @lunny for the fix.
CVE-2026-26232: Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851). Thanks to @sammiee5311 for the report, and thanks to @lunny for the fix.
CVE-2026-22547: Add validation constraints for repository creation fields (#36671) (#36757). Thanks to @brettm220 for the report, and thanks to @lunny for the fix.
CVE-2026-26292: Add HTTP transport support for LFS in push/sync mirror migrations (#36665) (#36691). Thanks to @allsmog for the report, and thanks to @lunny for the fix.
CVE-2026-20909: Fix the track time list permission check (#36662) (#36744).
CVE-2026-25782: Fix incorrect issue ID handling in time tracking (#36664) (#36689). Thanks to @CsEnox for the report, and thanks to @lunny for the fix.
CVE-2026-25718: Fix path resolution handling (#36734) (#36746). Thanks to @yonatan-pl for the report, and thanks to @wxiaoguang for the fix.
CVE-2026-28705: Fix a bug affecting release asset dumping (#36799) (#36839). Thanks to Robert Flosbach from Neodyme AG for the report, and thanks to @lunny for the fix.
CVE-2026-27779: Fix forwarded proto handling for public URL detection (#36810) (#36836). Thanks to fed01k for the report and thanks to @lunny for the fix.
CVE-2026-26307: Add a timeout for git grep searches (#36809) (#36835). Thanks to uug4na for the report, and thanks to @lunny for the fix.
CVE-2026-26247: Fix OAuth2 S256 handling (#36462) (#36477). Thanks to Aisle Research for the report, and thanks to @lunny for the fix.
Dependency Update
Go upgrades to 1.25.8 which includes security fixes
This release includes 42 merged pull requests, thanks to the amazing contributions from our community.
Download our pre-built binaries from the Gitea downloads page - make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud - A fully-managed, scalable platform designed to streamline your development workflow.
]]>lunnyhttps://gitea.com/lunny<![CDATA[Gitea 1.25.4 is released]]>https://blog.gitea.com/release-of-1.25.42026-01-22T18:32:00.000Z
We're excited to announce the release of Gitea 1.25.4! We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements.
Permission & Protection Checks
CVE-2026-20736: Release attachments must belong to the intended repo (#36347) (#36375)
CVE-2026-20750: Fix permission check on org project operations (#36318) (#36373)
CVE-2026-20883: Add more check for stopwatch read or list (#36340) (#36368)
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>lunnyhttps://gitea.com/lunny<![CDATA[Gitea 1.25.3 is released]]>https://blog.gitea.com/release-of-1.25.32025-12-18T18:31:00.000Z
We’re excited to announce the release of Gitea 1.25.3! We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements.
In this release, Gitea has been upgraded to Go 1.25.5, which addresses two security vulnerabilities in crypto/x509: GO-2025-4175 and GO-2025-4155. We would like to thank @silverwind for providing the patches.
This release includes 23 merged pull requests, thanks to the amazing contributions from our community.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>lunnyhttps://gitea.com/lunny<![CDATA[Gitea 1.25.2 is released]]>https://blog.gitea.com/release-of-1.25.22025-11-23T04:05:00.000Z
We are excited to announce the release of Gitea 1.25.2! We strongly recommend all users upgrade to this version, as it includes important security fixes and improves overall stability.
We've fixed a number of permission and authentication issues to improve security and consistency across the platform:
Permission & Protection Checks
Fixed permission validation for deleting releases.
Corrected branch protection checks when updating pull requests via rebase.
Fixed permission checks for issue dependencies.
Fixed validation for deleting comment history entries.
Information Leakage Prevention
Unified the error message for "non-existing user" and "invalid password" to avoid revealing account existence.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>lunnyhttps://gitea.com/lunny<![CDATA[Gitea 1.25.1 is released]]>https://blog.gitea.com/release-of-1.25.12025-11-04T17:24:00.000Z
We are excited to announce the release of Gitea 1.25.1! We strongly recommend all users upgrade to this version, as it includes important fixes that address several significant issues introduced in 1.25.0 and improves overall stability.
In particular, issue #35832 has been resolved. A new doctor sub-command, introduced in #35845, is now available to help automatically repair affected environments.
This release includes 15 merged pull requests, thanks to the amazing contributions from our community.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>lunnyhttps://gitea.com/lunny<![CDATA[Gitea 1.25.0 is released]]>https://blog.gitea.com/release-of-1.25.02025-10-29T18:03:00.000Z
We are thrilled to announce the latest release of Gitea v1.25.0.
Gitea 1.25.0 brings exciting new features, performance improvements, and quality-of-life enhancements. Here are some notable changes and features in Gitea 1.25; for the full list, refer to the full release notes.
We are very thankful for the many people who have contributed to the project from sending code patches, reporting issues, translating, and in supporting us in many other ways too.
You can download it for example from our downloads page. Please read our installation guide for more information on installation. For upgrade, as always, backup your data and then replace the binary or docker container and restart.
We would like to thank all of our supporters on Open Collective who are helping to sustain the project financially.
As always, the changes are sorted descending by what we deem most important for users and admins, so the most important change comes first.
Are you looking for a seamless, hassle-free solution to manage your Git repositories? Look no further! Gitea Cloud is here to revolutionize your development experience.
Repository archives (zip/tar.gz/bundle) are now streamed by default, significantly improving performance and reducing memory usage when downloading large repositories. This enhancement provides a better user experience, especially for large projects.
Thank you to @ChristopherHX for contributing this feature.
🚀 Add support for 3D/CAD file formats preview (#34794)
Gitea now supports previewing 3D and CAD file formats directly in the web interface! This includes support for STL, OBJ, and other common 3D file formats, making it easier for engineering and design teams to collaborate on 3D models and CAD designs without leaving Gitea.
Thank you to @kerwin612 for contributing this feature.
🚀 Edit file workflow for creating a fork and proposing changes (#34240)
A streamlined edit file workflow has been introduced, allowing users to create a fork and propose changes more easily. When editing a file in a repository you don't have write access to, Gitea will now automatically offer to create a fork and open a pull request with your changes.
Thank you to @brechtvl for contributing this feature.
🚀 Follow file symlinks in the UI to their target (#28835)
The UI now follows file symlinks to their target files, making it easier to navigate repositories with symbolic links. When viewing a symlink in the file browser, you can now click through to see the actual file content.
Thank you to @delvh for contributing this feature.
🚀 Support Basic Authentication for archive downloads (#35087)
Repository archive downloads now support Basic Authentication, making it easier to integrate with automation tools and scripts that need to download repository archives programmatically.
Thank you to @pvgoran for contributing this feature.
🚀 Use configurable remote name for git commands (#35172)
Git commands now support configurable remote names instead of being hardcoded to "origin". This provides better flexibility for users with custom git workflows.
Thank you to @ilya-nurullin for contributing this feature.
🚀 Display pull request in merged commit view (#35202)
When viewing a merged commit, Gitea now displays the associated pull request information, making it easier to trace changes back to their original pull requests.
Thank you to @na-Itms for contributing this feature.
Submodule handling has been improved with better support for relative paths, making it easier to work with repositories that use relative submodule URLs.
Thank you to @wxiaoguang for contributing this feature.
🚀 Send email on Workflow Run Success/Failure (#34982)
Gitea Actions now supports sending email notifications when workflows succeed or fail! This highly requested feature allows teams to stay informed about their CI/CD pipeline status without constantly checking the web interface.
Thank you to @NorthRealm for contributing this feature.
Instance-wide SSH commit signing has been improved with better configuration options and verification capabilities, enhancing security for organizations that require signed commits.
[repository.signing]
SIGNING_KEY=/data/id_ed25519.pub
SIGNING_NAME=Gitea
SIGNING_EMAIL=git@domain.com
SIGNING_FORMAT=ssh
INITIAL_COMMIT=always
CRUD_ACTIONS=always
WIKI=always
MERGES=always
Thank you to @ChristopherHX for contributing this feature.
🚀 Refactor OpenIDConnect to support SSH/FullName sync (#34978)
OpenID Connect integration has been enhanced to support synchronizing SSH keys and full names from identity providers, streamlining user management for organizations using OIDC.
Thank you to @wxiaoguang for contributing this feature.
🚀 Support base64-encoded agit push options (#35037)
AGit push options now support base64 encoding, providing better compatibility with special characters and binary data in push options.
Thank you to @wxiaoguang for contributing this feature.
🚀 Refactor repo contents API and add "contents-ext" API (#34822)
The repository contents API has been refactored with the addition of a new "contents-ext" API endpoint, providing more flexibility and better performance for retrieving file contents and repository data.
Thank you to @wxiaoguang for contributing this feature.
The repository REST API now includes a has_code field, making it easier to identify repositories that contain code versus empty repositories or those with only wikis.
🚀 Enable more markdown paste features in textarea editor (#35494)
The markdown textarea editor now supports more paste features, including automatic markdown formatting for pasted content, making it easier to create well-formatted comments and documentation.
Thank you to @silverwind for contributing this feature.
The time tracker user interface has been refactored with a cleaner, more intuitive design, making it easier to track time spent on issues and pull requests.
Thank you to @wxiaoguang for contributing this feature.
The notifications list now supports partial refresh, reducing page load times and improving responsiveness when checking for new notifications.
Thank you to @anbraten for contributing this feature.
🚀 Also display "recently pushed branch" alert on PR view (#35001)
The "recently pushed branch" alert is now also displayed on the pull request view page, making it easier to create pull requests from recently pushed branches.
Thank you to @Naxdy for contributing this feature.
🚀 Use monospace font in PR command line instructions (#35074)
Command line instructions in pull requests now use a monospace font for better readability and easier copying.
Thank you to @silverwind for contributing this feature.
🚀 Don't store repo archives on gitea dump (#35467)
The gitea dump command no longer stores repository archives by default, significantly reducing backup size and time. Repository data can still be backed up, but pre-generated archives are excluded.
🚀 Avoid emoji mismatch and allow to only enable chosen emojis (#35705)
Emoji configuration has been improved, allowing administrators to enable only specific emojis and avoid mismatches between custom and default emoji sets.
Thank you to @wxiaoguang for contributing this feature.
And many more contributors who have helped with testing, reporting issues, and translating!
We will thank all original contributors of backport pull requests on next release.
]]>lunnyhttps://gitea.com/lunny<![CDATA[Gitea 1.24.7 is released]]>https://blog.gitea.com/release-of-1.24.72025-10-26T04:04:00.000Z
We are excited to announce the release of Gitea version 1.24.7! We strongly recommend all users upgrade to this version for improved stability and security.
This release includes 7 merged pull requests, thanks to the amazing contributions from our community.
This release addresses several important security vulnerabilities:
LFS Authentication Bypass
A user without valid credentials could upload or download LFS files by submitting a malformed JWT token.
Thanks to Scott Tolley from Black Duck for reporting this issue, and to @wxiaoguang for the fix in https://github.com/go-gitea/gitea/pull/35708.
Arbitrary File Access via Malicious Template Repositories
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
The official Docker image has been updated to include Git 2.49.1, addressing CVE-2025-46334. If you’re using a custom Git installation, we strongly recommend upgrading to the latest version to ensure your instance remains secure.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
]]>lunnyhttps://gitea.com/lunny<![CDATA[Gitea 1.24.1 is released]]>https://blog.gitea.com/release-of-1.24.12025-06-19T21:14:00.000Z
We are excited to announce the release of Gitea version 1.24.1!
This update includes important bug fixes and improvements. We strongly recommend all users upgrade to this version to ensure optimal stability and performance.
A total of 17 pull requests have been merged into this release, thanks to the continued contributions from our community.
Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation
We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.
Looking for a seamless, hassle-free solution to manage your Git repositories?
Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.
