Gitea 1.18.0 → 1.27.3

• Add loading yaml label template files (#22976) (#23232)
• Make issue and code search support camel case for Bleve (#22829)
• Repositories: by default disable all units except code and pulls on forks (#22541)
• Support template for merge message description (#22248)
• Remove ONLY_SHOW_RELEVANT_REPOS setting (#21962)
• Implement actions (#21937)
• Remove deprecated DSA host key from Docker Container (#21522)
• Improve valid user name check (#20136)

Incorrectly documented default value for update checker (#22084)

[cron.update_checker].ENABLED is true by default. Previously, the documentation indicated that it would be disabled by default, which was incorrect.

Newly reserved username: gitea-actions (#21937)

With the implementation of Gitea Actions (see below), Gitea needed a user to run the actions. The username gitea-actions was chosen and is thus now reserved. If a user with that name exists, an admin should rename them, i.e. using the admin panel.

Remove DSA host key from Docker Container (#21522)

The DSA host key has been removed from the OpenSSH daemon configuration file in the Docker container for Gitea. This change is a result of the deprecation of the DSA public key algorithm since OpenSSH >= 7.0. As a result, any client that uses DSA for authentication will no longer be able to connect to the Docker container. We recommend users to use a different public key algorithm such as RSA or ECDSA for authentication.

Remove ReverseProxy authentication from the API (#22219)

ReverseProxy-authentication was an insecure way of authenticating a user. Hence, it was dropped without replacement. Any user that relied on it must switch to basic or token authentication now.

Remove [ui].ONLY_SHOW_RELEVANT_REPOS setting. (#21962)

On the explore page, you can switch whether you only want to see relevant repos, or all repos. As this page already offers a link to switch between these two options, this setting only had a negligible effect and complicated the logic by a lot. Hence, it was dropped without replacement. You can now remove it from your app.ini if present.

Restrict valid user names (#20136)

Valid user names now follow the following rules:

• allowed letters are -,., _, 0-9, a-z, A-Z
• names must not start or end with -,., or _
• names must not have consecutive -,., or _. (i.e. a-.b is illegal)

No action must be taken for existing users. This is only enforced for newly created users.

Separate allowed units for normal repos and forks (#22541)

Previously, fork repositories had all default units. Now, forks only enable code access and pull requests by default. If you want everything to behave like before, please set the setting [repository].DEFAULT_FORK_REPO_UNITS to the value of [repository].DEFAULT_REPO_UNITS.

Support camel case for issue and code search when using Bleve (#22829)

In order to be able to support queries that include camel case tokens, the indexes must be rebuilt. This is an automatic process that will be done on the first startup without any user interaction.

Support commit description in the merge template (#22248)

Previously, your whole default_merge_message template file was considered to be the commit title. Now, only the first line is the commit title, and the rest (from line 3 on) is the commit description, just like in normal commits.

• Rename actions unit to repo.actions and add docs for it (#23733) (#23881)

• Fix WORK_DIR for docker (root) image (#25738) (#25811)
• Restrict [actions].DEFAULT_ACTIONS_URL to only github or self (#25581) (#25604)
• Refactor path & config system (#25330) (#25416)
• Fix all possible setting error related storages and added some tests (#23911) (#25244)
• Use a separate admin page to show global stats, remove actions stat (#25062)
• Remove the service worker (#25010)
• Remove meta tags theme-color and default-theme (#24960)
• Use [git.config] for reflog cleaning up (#24958)
• Allow all URL schemes in Markdown links by default (#24805)
• Redesign Scoped Access Tokens (#24767)
• Fix team members API endpoint pagination (#24754)
• Rewrite logger system (#24726)
• Increase default LFS auth timeout from 20m to 24h (#24628)
• Rewrite queue (#24505)
• Remove unused setting time.FORMAT (#24430)
• Refactor setting.Other and remove unused SHOW_FOOTER_BRANDING (#24270)
• Correct the access log format (#24085)
• Reserve ".png" suffix for user/org names (#23992)
• Prefer native parser for SSH public key parsing (#23798)
• Editor preview support for external renderers (#23333)
• Add Gitea Profile Readmes (#23260)
• Refactor ctx in templates (#23105)

Refactored scoped tokens mechanism (#24767)

As will be described down below in more detail, the permissions for Personal Access Tokens (PATs) have changed. While we have migrated all old tokens to the new format as close as possible, there are edge cases where an old token now has more/less permissions than before as the two systems have a completely different design. If that's the case for you, please consider regenerating your token to prevent API calls from failing or your token having a too broad scope.

Removed/changed config entries (#25010, #24958, #24754, #24628, #24505, #24430, #24270, #23798, #23733, #23333, #25604)

• We've removed the service worker functionality as it didn't bring any noticeable benefit, mostly added bugs, and was disabled since 1.17 by default already.

Removed config key: [ui].USE_SERVICE_WORKER

• The default value of [server].LFS_HTTP_AUTH_EXPIRY has been increased from 20m to 24h.

If you want to use the previous value, please set the setting.

• As will be described below, you can now set any git config also in your app.ini.

As such, we removed the section [git.reflog] and its keys have been moved to the following replacements:

• [git.reflog].ENABLED → [git.config].core.logAllRefUpdates
• [git.reflog].EXPIRATION → [git.config].gc.reflogExpire

• In addition to the already deprecated options inside [queue], many options have been dropped as well.

Those are WRAP_IF_NECESSARY, MAX_ATTEMPTS, TIMEOUT, WORKERS, BLOCK_TIMEOUT, BOOST_TIMEOUT, BOOST_WORKERS. You can remove them from your app.ini now. Additionally, some default values have changed in this section.

• The setting [time].FORMAT is no longer used

• The setting [other].SHOW_FOOTER_BRANDING was removed, as its intended purpose was superseded by [other].SHOW_FOOTER_VERSION

• The default value of [server].SSH_KEYGEN_PATH has changed from ssh-keygen to (empty), meaning that Gitea parses public keys by default itself rather than passing it to the system as previously.

• [repository].DEFAULT_REPO_UNITS and [repository].DISABLED_REPO_UNITS accepted the key actions.actions for a short time.

However, the correct key should be repo.actions.

• [repository.editor].PREVIEWABLE_FILE_MODES was buggy and didn't work.

As such, it is now removed.

• [actions].DEFAULT_ACTIONS_URL could previously be set to any custom URLs like https://gitea.com or http://your-git-server, and the default value was https://gitea.com. But now, DEFAULT_ACTIONS_URL only supports github (https://github.com) or self (the root url of current Gitea instance), and the default value is github. This change was made to make action names globally resolvable in most cases.

Publication of README.md in .profile repos (#23260)

As will be discussed below in the new features, Gitea now displays user profile READMEs. The displayed content is that of the README.md of a .profile repo. If you already have a repo with that name, its README.md will be publically accessible, even if the repo is private. If you don't want to leak that information, consider renaming your existing repo.

Any URL scheme may be used for links (#24805)

Previously, we would not render non-standard URLs (like matrix:) by default. We allowed adding custom URLs by modifying markdown.CUSTOM_URL_SCHEMES and these would then render as links in markdown, but there was no option to allow all schemes.

With this change in place, if markdown.CUSTOM_URL_SCHEMES is not configured, we will render all explicit markdown links ([label](URL)) as links.

Before

The matrix: and cbthunderlink:// didn't render as links.

[image: Special links are not rendered]

After

The matrix: and cbthunderlink:// render as links, when we use the [label](URL) form.

[image: Special links are rendered]

Newly reserved usernames (#23992)

User and organization names can no longer end with .png.

Changed access log format (#24085)

Logs from the access logger were previously escaped in unnecessary places. Now, they no longer are. Furthermore, the field {{.Ctx.RemoteAddr}} has been renamed to {{.Ctx.RemoteHost}} to omit the port.

Correct pagination in API route teams/{id}/members (#24754)

Previously, this endpoint was 0-based paginated unlike all other routes. This bug has now been fixed.

Refactored path and config system (#25416)

The Gitea path system has been fairly complicated for a long time: It tried to guess paths quite often, which lead to countless problems. Instead, Gitea now automatically tries to store the path inside the config. If it fails to do so, it won't start. In that case, please do what the error message in the logs tells you to do and the issue should be resolved.

actions table metrics collector was removed (#25062)

The statistic of how many entries are in the actions table that records activities has always been rather useless as this table will always be (ridiculuously) large. As such, we removed the metrics collector for promethues for them. Please do not rely on its output anymore. This is not related to Gitea Actions.

Rework storage settings (#23911)

All storage settings should be stored in one section, and one section only. You cannot use multiple sections anymore to override settings. The storage settings priority is now

1. [attachment]
2. [storage.attachments] | [storage.<another>]
3. [storage]
4. default

For extra override configuration items, currently only are SERVE_DIRECT, MINIO_BASE_PATH, MINIO_BUCKET, which could be configured in another section. The prioioty of the override configuration is [attachment] > [storage.attachments] > default.

Refactor ctx in templates (#23105)

If you use custom templates, you may need to change them: We've changed all occurring .ctx inside parameters to .ctxData. Any custom template currently using .ctx will need to follow suit.

Rewrite logger system (#24726)

The log.<mode>.<logger> style config has been dropped. If you used it, please check the new config manual & app.example.ini to make your instance output logs as expected.

The SMTP logger is deleted because SMTP is not suitable to collect logs.

• Fix the wrong derive path (#26271) (#26318)

In #23912, we missed that PATH can be inherited from its parent sections. This means that if admins define a global [storage].PATH configuration and don't override it in subsections (i.e. [storage.lfs].PATH), all data will be stored exactly in this PATH without any attachments, lfs, … subfolders. In other words, files can be overwritten unintentionally. Fortunately, most instances will not be affected by this.

With #26271, this is now fixed. However, we cannot migrate existing data into subfolders. Please check your configuration. If you notice that you set [storage].PATH but not the concrete child section paths, please move the files into the respective default subfolders as detailed in the documentation. Additionally, you can think about explicitly setting the concrete storage PATHs or unsetting [storage].PATH.

• Restrict certificate type for builtin SSH server (#26789)
• Refactor to use urfave/cli/v2 (#25959)
• Move public asset files to the proper directory (#25907)
• Remove commit status running and warning to align GitHub (#25839) (partially reverted: Restore warning commit status (#27504) (#27529))
• Remove "CHARSET" config option for MySQL, always use "utf8mb4" (#25413)
• Set SSH_AUTHORIZED_KEYS_BACKUP to false (#25412)

These changes are likely to affect the way Gitea works for at least some users. These changes are sorted by importance, with the top ones likely requiring some actions from you, and the bottom ones mostly not affecting anyone.

⚠️ Move public asset files to the proper directory (#25907)

At some point, a folder structure emerged for Gitea where files stored in custom/public/* have been served under https://gitea.example.com/assets/*, which lead to a lot of confusion for new users trying to customize their instances. To correct this behavior, we changed the default assets folder to custom/public/assets/*.

If you have custom asset files, e. g. custom themes, inside custom/public/*, you need to transfer these files to custom/public/assets/* for them to be detected by Gitea v1.21.

⚠️ Set SSH_AUTHORIZED_KEYS_BACKUP to false (#25412)

Previously, the configuration option [server].SSH_AUTHORIZED_KEYS_BACKUP, which makes Gitea automatically create backups of the authorized_keys file every time a new SSH key is added by a user, was set to true by default. However, this lead to the backup folder getting enormously large on instances with many users.

As a consequence, we decided to change the default value of this parameter to false. Please ensure to set it to true manually inside your app.ini if you want for Gitea to continue creating backups of this file.

⚠️ Remove CHARSET config option for MySQL, always use utf8mb4 (#25413)

Using utf8 as a charset for MySQL may result in issues, e. g. with emoji characters, however a new installation can still end up using it through the [database].CHARSET configuration option. The superior utf8mb4 character set is being supported since MySQL v5.5, and as Gitea only supports MySQL v5.7+, support for utf8 is no longer needed in Gitea. To eliminate such issues, we decided to remove this configuration option completely.

Existing utf8 databases will continue to work without modifications, however we strongly recommend you to convert them to utf8mb4 using the gitea doctor convert command.

⚠️ Refactor Gitea cli (#25959)

A refactoring of Gitea's cli package lead to some changes in the way it treats command options:

• gitea without subcommands no longer accepts gitea web options.
• --install-port, --pid, --port, --quiet, and --verbose belong to the web sub-command
• use ./gitea web --pid … instead
• ./gitea can still run the web sub-command as shorthand, with default options
• The sub-command's options must follow the sub-command
• before: ./gitea --sub-opt subcmd might equal to ./gitea subcmd --sub-opt
• after: only ./gitea subcmd --sub-opt can be used
• global options like --config are not affected

⚠️ Restrict certificate type for builtin SSH server (#26789)

When using certificate authentication, the OpenSSH server automatically rejects host certificates which are being used as client certificates. Similarly to OpenSSH, Gitea's built-in SSH server now also requires you to use proper client certificates when connecting. Most users should be unaffected by this change.

⚠️ Remove commit status running to align with GitHub (#25839)

When implementing Gitea Actions, the additional commit status "running" was introduced in Gitea v1.19, which resulted in partially confusing aggregated commit status behavior if compared to GitHub. We decided to remove "running" with this release to simplify the commit status and make it more consistent with GitHub.

• Improve reverse proxy documents and clarify the AppURL guessing behavior (#31003) (#31020)
• Remember log in for a month by default (#30150)
• Breaking summary for template refactoring (#29395)
• All custom templates need to follow these changes
• Recommend/convert to use case-sensitive collation for MySQL/MSSQL (#28662)
• Make offline mode as default to not connect external avatar service by default (#28548)
• Include public repos in the doer's dashboard for issue search (#28304)
• Use restricted sanitizer for repository description (#28141)
• Support storage base path as prefix (#27827)
• Enhanced auth token / remember me (#27606)
• Rename the default themes to gitea-light, gitea-dark, gitea-auto (#27419)
• If you didn't see the new themes, please remove the [ui].THEMES config option from app.ini
• Require MySQL 8.0, PostgreSQL 12, MSSQL 2012 (#27337)

Increased DB requirements (#27337)

Gitea only officially supports DBs that have not reached EOL. There are many database versions that have reached End of Life.

• Ref: https://endoflife.date/mysql
• Ref: https://endoflife.date/postgresql
• Ref: https://endoflife.date/mssqlserver

As such, we have increased the DB requirements as follows:

• MySQL 5.7 → MySQL 8.0
• PostgreSQL 10 → PostgreSQL 12
• MSSQL 2008 → MSSQL 2012

Caution

Support for MySQL 5.7, PostgreSQL 10/11, and MSSQL 2008 is dropped. You are encouraged to upgrade to supported versions.

If you have to use an unsupported database version, please get in touch with us for information on our Extended Support Contracts. We can provide testing and support for older databases and integrate those fixes into the Gitea codebase.

MySQL/MSSQL DBs should be case sensitive (#28662)

MySQL (including MariaDB) and MSSQL create databases case-insensitively by default, meaning for example that gitea is equal to GITea.

Historically, this led to many bug reports of functionality behaving unexpectedly, i.e. branches not being able to be inserted because a new branch only differed in casing compared to an existing branch. Gitea was never intended to be used in a case-insensitive DB.

Now, Gitea will explicitly warn you if it detects being run in a case-insensitive DB. If you haven't done so already, please convert your DB to a case-sensitive one.

Note

Postgres and SQLite users are most likely unaffected as those DBs are already case-sensitive by default.

Breaking summary for template refactoring (#29395)

The template system has been refactored, and some template functions may have been changed or removed.

• Safe is renamed to SafeHTML, and in most cases it shouldn't be used.
• Escape is renamed to HTMLEscape, and in most cases it shouldn't be used. The template should escape most variables automatically.
• Str2html is renamed to SanitizeHTML, only use it when necessary, it only "sanitizes" the input by pre-defined rules, but it doesn't "render" or "convert" the content.
• Use HTMLFormat instead of printf when processing HTML-related contents.

Caution

If you use custom templates (either for the UI or for emails), please read through #29395 to ensure your custom templates will work again.

Default theme change (#27419)

Gitea simplified its theme naming in this release.

The available themes are now gitea-light (previously gitea), gitea-dark (previously arc-green), gitea-auto (previously auto).

This has multiple effects:

• If you have any custom themes named like that, please rename them to continue using them.

• It is now possible to check which theme is active by querying the attribute

html[data-theme] instead of the previous html.theme-<theme> when expressing the query as a CSS selector. This change is especially important for third-party tooling whose behavior depends on which theme is active.

• If you set [ui].DEFAULT_THEME previously, you need to change it to the new theme name.

If you see a black-and-white UI after the update, it is likely that you need to update this setting as the theme cannot be found.

Changed markdown highlighting syntax (#29121)

As we will explain in more detail in the new features, Gitea is now capable of additional alert types using a new syntax.

At the same time, the old syntax > **Note** A note/> **Warning** A warning has been removed, so please rewrite your existing markdown documents to the new syntax where applicable.

If you used:

> **Note** My note

or

> **Warning** My warning

Rewrite these as:

> [!NOTE]
> My note

or

> [!WARNING]
> My warning

Only minimal markdown allowed in repo descriptions (#28141)

Previously, the repository description accepted any sort of markdown. Now, you can only use basic markdown features such as bold, italic, or highlighted text.

Breaking API changes (#27153, #28339)

There were two minor breaking changes to the API in this release:

• Previously, the push mirror API returned timestamps in an incorrect format. This has now been updated to behave exactly like any other timestamp.
• The already deprecated (and due to a bug, unusable) pagination parameter per_page has been removed from the list releases endpoint. Instead, you should use the limit parameter.

Login is now remembered for a month by default (#30150)

Previously, your login was only remembered for a week by default. However, many instances don't set the setting and have no explicit security requirements, so having such a short interval is not user-friendly.

If your instance requires a high level of security, you may want to set

[security]
// highlight-next-line
LOGIN_REMEMBER_DAYS = 7

or something similar again.

Removed configurations (#27606, #28527)

Some settings are no longer used. If you previously set any of them, you can now safely remove them from your config:

• ~~[security].COOKIE_USERNAME~~
• ~~[cache].ENABLED~~
• ~~[cache.last_commit].ENABLED~~

Caution

Caches are now enabled by default and cannot be disabled. The default adapter is memory, you can change it to redis, etc. More details are in https://docs.gitea.com/administration/config-cheat-sheet#cache-cache

Support storage base path as prefix (#27827)

This PR will affect all configurations having base_path in the storage section but no base_path in the derived storage configuration sections. The base_path on [storage] will become a prefix for them but will not share the same base_path.

[storage]
; Now it becomes a prefix of derived base_path but not share the name
// highlight-next-line
base_path = xxx 

No Gravatar by default (#28548)

The default value of [server].OFFLINE_MODE has been changed to true, so Gitea will not allow Gravatar queries by default.

However, most existing instances won't be affected by this, as this setting is only used as the default value for the Gravatar settings, not the actual value.

Additionally, it is saved into the config when you install Gitea.

• Rename config option [camo].Allways to [camo].Always (#32097)
• Remove SHA1 for support for SSH RSA signing (#31857)
• Use UTC as the default timezone when scheduling Actions cron tasks (#31742)
• Delete Actions logs older than 1 year by default (#31735)
• Make OIDC introspection authentication strictly require Client ID and secret (#31632)

Actions logs expired will be cleaned up in background. (#31735)

A new configuration [actions].LOG_RETENTION_DAYS = 365 was introduced to control how long the logs should be deleted. The default value is 365 days. If you want to keep the logs longer, you need to change the configurations once you upgrade.

Configuration [camo].Allways was corrected to [camo].Always (#32097)

The configuration setting [camo].Allways contained a typo and has been corrected to [camo].Always. Users should update their configuration files to reflect this change to ensure compatibility with the latest version. This adjustment improves clarity and prevents potential misconfigurations caused by the incorrect spelling.

Make OIDC introspection authentication strictly require Client ID and secret (#31632)

OIDC introspection authentication now strictly requires a Client ID and secret, enhancing security. Update your configuration to ensure compatibility.

Remove SHA1 for support for ssh rsa signing (#31857)

Support for SHA1 in SSH RSA signing has been removed due to security concerns. Users should ensure their environments and keys are updated to use more secure algorithms.

Use UTC as default timezone when schedule Actions cron tasks (#31742)

Actions cron tasks now default to UTC for scheduling, ensuring consistency across environments. If the server's local time zone is not UTC, a scheduled task would run at a different time after upgrading Gitea to this version.

Administration URL changed from /admin to /-/admin to allow accounts named admin. (#32189) This maybe a break change for those instances which have customized site header.

The administration URL has been updated to /-/admin to allow accounts named admin. This change may affect instances with customized site headers. Update your configurations or customizations accordingly to prevent disruptions.

• Add tests for webhook and fix some webhook bugs (#33396) (#33442)
• Package webhook’s Organization was incorrectly used as the User struct. This PR fixes the issue.
• This changelog is just a hint. The change is not really breaking because most fields are the same, most users are not affected.

• Make Gitea always use its internal config, ignore /etc/gitconfig (#33076)
• Improve log format (#33814)
• Fix markdown render behaviors (#34122)
• Add package version api endpoints (#34173)

Make Gitea always use its internal config, ignore /etc/gitconfig (#33076)

Historically, Gitea has been able to use the system config under /etc/gitconfig to support some edge-case customizations. However, it sometimes causes conflicts, which have arisen multiple times lately. Therefore, we decided to switch away from this practice, adding GIT_CONFIG_NOSYSTEM=1 to all git commands.

If you have made changes to /etc/gitconfig to affect Gitea's behavior, you need to move these config options to Gitea's internal git config file, it is usually in Gitea's {AppDataPath}/home/.gitconfig.

Thank you to @wxiaoguang for contributing this feature.

Improve log format (#33814)

The router log format was changed from

2025/03/06 22:21:12 ...eb/routing/logger.go:102:func1() [I] router: completed GET / for [::1]:52693, 200 OK in 15.9ms @ web/home.go:32(web.Home)

to

2025/03/06 22:20:35 HTTPRequest [I] router: completed GET / for [::1]:52631, 200 OK in 7.5ms @ web/home.go:32(web.Home)

Thank you to @wxiaoguang for contributing this feature.

Fix markdown render behaviors (#34122)

Add config options MATH_CODE_BLOCK_DETECTION, problematic syntaxes are disabled by default.

Some markdown rendering behaviors are improved to match GitHub, please refer to the latest document's "Markdown" page to see the details.

Thank you to @wxiaoguang for contributing this feature.

Add package version api endpoints (#34173)

Two new API endpoints to list versions of a package and to get the latest version of a package were added.

The size field for this endpoint changes case from Size to size for consistency.

Thank you to @KN4CK3R for contributing this feature.

• Return 201 Created for CreateVariable API responses (#34517)
• Add label 'state' to metric 'gitea_users' (#34326)

Remove deprecated auth sources (#35272)

Deprecated authentication sources have been removed in this version. Please ensure your authentication configuration is up to date before upgrading.

Refactor and update mail templates (#35150)

Mail templates have been refactored to improve maintainability. If you have customized mail templates, please note that this is a breaking change.

Thank you to @techknowlogick for contributing this feature.

• Correct swagger annotations for enums, status codes, and notification state (#37030)
• Remove GET API registration-token (#36801)
• Support Actions concurrency syntax (#32751)
• Make PUBLIC_URL_DETECTION default to "auto" (#36955)

Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)

The standalone environment-to-ini tool was removed and a sub command of gitea has been introduced. If you need to re-create the configuration file with only a subset of keys, you can provide an INI template file and use the "--config-keep-keys" flag.

Correct Swagger annotations for enums, status codes, and notification state (#37030)

The generated OpenAPI description is now aligned with the actual API: enum values, HTTP status codes, and notification state are documented more accurately. If you rely on the published Swagger spec for code generation or contract tests, regenerate clients and re-check any assumptions about optional fields or response shapes.

Thank you to @myers for contributing this change.

Remove GET API registration-token (#36801)

The GET endpoint used to retrieve a registration token has been removed. Automation that still calls it needs to be updated to the supported registration flow for your deployment.

Thank you to @lunny for contributing this change.

Support Actions concurrency syntax (#32751)

Workflows can now use GitHub-style concurrency groups so that new runs cancel or queue relative to in-progress jobs. That changes runtime behavior compared with earlier releases, so review existing workflows after upgrading—especially long-running or overlapping pipelines.

Thank you to @Zettat123 for contributing this feature.

Make PUBLIC_URL_DETECTION default to auto (#36955)

New installations now default to automatic public URL detection. If you depend on a specific explicit URL configuration behind reverse proxies or alternate hostnames, confirm your [server] settings after upgrade so links, webhooks, and redirects still match your environment.

Thank you to @wxiaoguang for contributing this change.

Please upgrade to 1.26.4 directly. A regression in this release can cause "context deadline exceeded" errors when opening any repository's code pages (#38177). Please hold off on upgrading until a fix is released.

• fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)

This release tightens the fork pull request approval gate: a pull request from a fork must now be merged before it can bypass the approval gate (#38041). Review your workflow approval settings if you rely on the previous behavior.

• Feat(actions)!: improve support for reusable workflows (#37478)
• Use Content-Security-Policy: script nonce (#37232)

Move release artifact signing to sigstore (#38250)

Gitea release artifacts are now signed with sigstore instead of the previous GPG flow. If you verify downloaded binaries or Docker images as part of your deployment pipeline, update your verification step to the sigstore-based process.

Thank you to @TheFox0x7 for contributing this change.

Improve support for reusable workflows (#37478)

Reusable workflows referenced with uses: are now parsed on the Gitea side rather than on the runner. Each called (child) job is inserted as its own ActionRunJob and dispatched as an independent task, so callee logs surface as separate job entries instead of being inlined into the caller's "Set up job" step. Review workflows that rely on reusable-workflow behavior after upgrading.

External reusable workflows (uses: https://other-gitea-instance/OWNER/REPO/.gitea/workflows/test.yaml@REF) are no longer supported. To keep using them, clone the repositories to the local instance and reference them there.

Thank you to @Zettat123 for contributing this change.

Use a Content-Security-Policy script nonce (#37232)

Inline scripts are now allowed via a per-request CSP nonce instead of a broader policy. Custom templates, themes, or embeds that inject inline <script> tags may stop executing until they are updated to carry the nonce. Review custom front-end customizations after upgrading.

Thank you to @wxiaoguang for contributing this change.

X-Content-Type-Options: nosniff is now sent by default (#37354)

All responses now include the X-Content-Type-Options: nosniff header, which stops browsers from MIME-sniffing responses away from their declared Content-Type. If a reverse proxy, embed, or custom asset relied on content sniffing, set X_CONTENT_TYPE_OPTIONS = unset under [security] to remove the header, or override its value as needed.

Thank you to @SAY-5 for contributing this change.