Gitea 1.22.0 → 1.27.3

• Rename config option [camo].Allways to [camo].Always (#32097)
• Remove SHA1 for support for SSH RSA signing (#31857)
• Use UTC as the default timezone when scheduling Actions cron tasks (#31742)
• Delete Actions logs older than 1 year by default (#31735)
• Make OIDC introspection authentication strictly require Client ID and secret (#31632)

Actions logs expired will be cleaned up in background. (#31735)

A new configuration [actions].LOG_RETENTION_DAYS = 365 was introduced to control how long the logs should be deleted. The default value is 365 days. If you want to keep the logs longer, you need to change the configurations once you upgrade.

Configuration [camo].Allways was corrected to [camo].Always (#32097)

The configuration setting [camo].Allways contained a typo and has been corrected to [camo].Always. Users should update their configuration files to reflect this change to ensure compatibility with the latest version. This adjustment improves clarity and prevents potential misconfigurations caused by the incorrect spelling.

Make OIDC introspection authentication strictly require Client ID and secret (#31632)

OIDC introspection authentication now strictly requires a Client ID and secret, enhancing security. Update your configuration to ensure compatibility.

Remove SHA1 for support for ssh rsa signing (#31857)

Support for SHA1 in SSH RSA signing has been removed due to security concerns. Users should ensure their environments and keys are updated to use more secure algorithms.

Use UTC as default timezone when schedule Actions cron tasks (#31742)

Actions cron tasks now default to UTC for scheduling, ensuring consistency across environments. If the server's local time zone is not UTC, a scheduled task would run at a different time after upgrading Gitea to this version.

Administration URL changed from /admin to /-/admin to allow accounts named admin. (#32189) This maybe a break change for those instances which have customized site header.

The administration URL has been updated to /-/admin to allow accounts named admin. This change may affect instances with customized site headers. Update your configurations or customizations accordingly to prevent disruptions.

• Add tests for webhook and fix some webhook bugs (#33396) (#33442)
• Package webhook’s Organization was incorrectly used as the User struct. This PR fixes the issue.
• This changelog is just a hint. The change is not really breaking because most fields are the same, most users are not affected.

• Make Gitea always use its internal config, ignore /etc/gitconfig (#33076)
• Improve log format (#33814)
• Fix markdown render behaviors (#34122)
• Add package version api endpoints (#34173)

Make Gitea always use its internal config, ignore /etc/gitconfig (#33076)

Historically, Gitea has been able to use the system config under /etc/gitconfig to support some edge-case customizations. However, it sometimes causes conflicts, which have arisen multiple times lately. Therefore, we decided to switch away from this practice, adding GIT_CONFIG_NOSYSTEM=1 to all git commands.

If you have made changes to /etc/gitconfig to affect Gitea's behavior, you need to move these config options to Gitea's internal git config file, it is usually in Gitea's {AppDataPath}/home/.gitconfig.

Thank you to @wxiaoguang for contributing this feature.

Improve log format (#33814)

The router log format was changed from

2025/03/06 22:21:12 ...eb/routing/logger.go:102:func1() [I] router: completed GET / for [::1]:52693, 200 OK in 15.9ms @ web/home.go:32(web.Home)

to

2025/03/06 22:20:35 HTTPRequest [I] router: completed GET / for [::1]:52631, 200 OK in 7.5ms @ web/home.go:32(web.Home)

Thank you to @wxiaoguang for contributing this feature.

Fix markdown render behaviors (#34122)

Add config options MATH_CODE_BLOCK_DETECTION, problematic syntaxes are disabled by default.

Some markdown rendering behaviors are improved to match GitHub, please refer to the latest document's "Markdown" page to see the details.

Thank you to @wxiaoguang for contributing this feature.

Add package version api endpoints (#34173)

Two new API endpoints to list versions of a package and to get the latest version of a package were added.

The size field for this endpoint changes case from Size to size for consistency.

Thank you to @KN4CK3R for contributing this feature.

• Return 201 Created for CreateVariable API responses (#34517)
• Add label 'state' to metric 'gitea_users' (#34326)

Remove deprecated auth sources (#35272)

Deprecated authentication sources have been removed in this version. Please ensure your authentication configuration is up to date before upgrading.

Refactor and update mail templates (#35150)

Mail templates have been refactored to improve maintainability. If you have customized mail templates, please note that this is a breaking change.

Thank you to @techknowlogick for contributing this feature.

• Correct swagger annotations for enums, status codes, and notification state (#37030)
• Remove GET API registration-token (#36801)
• Support Actions concurrency syntax (#32751)
• Make PUBLIC_URL_DETECTION default to "auto" (#36955)

Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)

The standalone environment-to-ini tool was removed and a sub command of gitea has been introduced. If you need to re-create the configuration file with only a subset of keys, you can provide an INI template file and use the "--config-keep-keys" flag.

Correct Swagger annotations for enums, status codes, and notification state (#37030)

The generated OpenAPI description is now aligned with the actual API: enum values, HTTP status codes, and notification state are documented more accurately. If you rely on the published Swagger spec for code generation or contract tests, regenerate clients and re-check any assumptions about optional fields or response shapes.

Thank you to @myers for contributing this change.

Remove GET API registration-token (#36801)

The GET endpoint used to retrieve a registration token has been removed. Automation that still calls it needs to be updated to the supported registration flow for your deployment.

Thank you to @lunny for contributing this change.

Support Actions concurrency syntax (#32751)

Workflows can now use GitHub-style concurrency groups so that new runs cancel or queue relative to in-progress jobs. That changes runtime behavior compared with earlier releases, so review existing workflows after upgrading—especially long-running or overlapping pipelines.

Thank you to @Zettat123 for contributing this feature.

Make PUBLIC_URL_DETECTION default to auto (#36955)

New installations now default to automatic public URL detection. If you depend on a specific explicit URL configuration behind reverse proxies or alternate hostnames, confirm your [server] settings after upgrade so links, webhooks, and redirects still match your environment.

Thank you to @wxiaoguang for contributing this change.

Please upgrade to 1.26.4 directly. A regression in this release can cause "context deadline exceeded" errors when opening any repository's code pages (#38177). Please hold off on upgrading until a fix is released.

• fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)

This release tightens the fork pull request approval gate: a pull request from a fork must now be merged before it can bypass the approval gate (#38041). Review your workflow approval settings if you rely on the previous behavior.

• Feat(actions)!: improve support for reusable workflows (#37478)
• Use Content-Security-Policy: script nonce (#37232)

Move release artifact signing to sigstore (#38250)

Gitea release artifacts are now signed with sigstore instead of the previous GPG flow. If you verify downloaded binaries or Docker images as part of your deployment pipeline, update your verification step to the sigstore-based process.

Thank you to @TheFox0x7 for contributing this change.

Improve support for reusable workflows (#37478)

Reusable workflows referenced with uses: are now parsed on the Gitea side rather than on the runner. Each called (child) job is inserted as its own ActionRunJob and dispatched as an independent task, so callee logs surface as separate job entries instead of being inlined into the caller's "Set up job" step. Review workflows that rely on reusable-workflow behavior after upgrading.

External reusable workflows (uses: https://other-gitea-instance/OWNER/REPO/.gitea/workflows/test.yaml@REF) are no longer supported. To keep using them, clone the repositories to the local instance and reference them there.

Thank you to @Zettat123 for contributing this change.

Use a Content-Security-Policy script nonce (#37232)

Inline scripts are now allowed via a per-request CSP nonce instead of a broader policy. Custom templates, themes, or embeds that inject inline <script> tags may stop executing until they are updated to carry the nonce. Review custom front-end customizations after upgrading.

Thank you to @wxiaoguang for contributing this change.

X-Content-Type-Options: nosniff is now sent by default (#37354)

All responses now include the X-Content-Type-Options: nosniff header, which stops browsers from MIME-sniffing responses away from their declared Content-Type. If a reverse proxy, embed, or custom asset relied on content sniffing, set X_CONTENT_TYPE_OPTIONS = unset under [security] to remove the header, or override its value as needed.

Thank you to @SAY-5 for contributing this change.