GITEA-1.27.0 release notes and known issues

Summary

BREAKING Feat(actions)!: improve support for reusable workflows ( #37478 ) Use Content-Security-Policy: script nonce ( #37232 ) SECURITY Fix: various security fixes ( #38406 ) ( #38426 ) Fix(security): harden access checks and migration validation ( #38324 ) ( #38400 ) Fix: enforce public-only token scope and harden push options / locale parsing ( #38323 ) ( #38399 ) Fix(pull): re-evaluate review official flag on target branch change ( #38319 ) ( #38402 ) Fix(api): stop leaking private repo metadata after access revocation ( #38321 ) ( #38390 ) Fix(lfs): require proof of possession for cross-repo objects ( #38322 ) ( #38389 ) Fix(mirror): disable HTTP redirects on pull mirror sync ( #38320 ) ( #38367 ) Fix: golang html template url escaping ( #38363 ) ( #38369 ) Fix(release): validate web attachment renames against allowed types ( #38314 ) ( #38328 ) Fix(release): gate draft release attachments on web download endpoints ( #38318 ) ( #38325 ) Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] ( #37786 ) Fix(oauth): restrict introspection to the token's client ( #38042 ) Fix(api): don't expose private org membership via public_members ( #38145 ) Fix(actions): deny fork-PR cross-repo access via collaborative owner ( #38214 ) Fix(migrations): prevent path traversal in repository restore ( #38215 ) FEATURES Feat(actions): add workflow status badge modal ( #38196 ) Feat(actions): support owner-level and global scoped workflows ( #38154 ) Feat(api): support ref suffixes in compare ( #38148 ) Feat(actions): implement jobs.<job_id>.continue-on-error ( #38100 ) Feat(actions): show run status on browser tab favicon ( #38071 ) Feat(api): add token introspection and self-deletion endpoint ( #37995 ) Feat(api): add q parameter to list branches API for server-side filtering ( #37982 ) Feat(repo): split repository creation limit into user and org scopes ( #37872 ) Feat(actions): bulk delete, disable and enable runners in admin UI ( #37869 ) Feat(actions): List workflows that were executed once but got removed from the default branch ( #37835 ) Feat(org): add team visibility so org members can discover teams ( #37680 ) Feat: add raw diff/patch endpoint for repository comparisons ( #37632 ) Feat: Add avatar stacks ( #37594 ) Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) ( #37500 ) Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support ( #37433 ) Support for Custom URI Schemes in OAuth2 Redirect URIs ( #37356 ) Feat(orgs): Add search bar for organization members tab page ( #37347 ) Feat(api): Add assignees APIs ( #37330 ) Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs ( #37196 ) Serve OpenAPI 3.0 spec at /openapi.v1.json ( #37038 ) Add project column picker to issue and pull request sidebar ( #37037 ) Allow multiple projects per issue and pull requests ( #36784 ) Feat(ui): add "follow rename" to file commit history list ( #34994 ) Feat(ssh): auto generate additional ssh keys ( #33974 ) ENHANCEMENTS Enhance(actions): only create filtered-out workflow commit status for required contexts ( #38371 ) ( #38385 ) Enhance: allow builtin default git config options to be overridden ( #38172 ) Enhance: allow MathML core elements ( #38034 ) Enhance(markup): improve issue title rendering ( #37908 ) Enhance(actions): set descriptive browser tab title on run view ( #37870 ) Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 ( #37866 ) Enhance(actions): show workflow name from YAML instead of filename ( #37833 ) Feat(actions): add before/after to PR synchronize event payload ( #37827 ) Enhance(actions): add branch filters to run list ( #37826 ) Enhance(actions): Make Summary UI more beautiful with more infos ( #37824 ) Feat: add copy button to action step header, improve other copy buttons ( #37744 ) Fix(icon): use repo-forked icon to display forks count ( #37731 ) Feat(api): add sort and order query parameters to job list endpoints ( #37672 ) Feat(api): add last_sync to r

Improvements and security content

• BREAKING Feat(actions)!: improve support for reusable workflows ( #37478 ) Use Content-Security-Policy: script nonce ( #37232 ) SECURITY Fix: various security fixes ( #38406 ) ( #38426 ) Fix(security): harden access checks and migration validation ( #38324 ) ( #38400 ) Fix: enforce public-only token scope and harden push options / locale parsing ( #38323 ) ( #38399 ) Fix(pull): re-evaluate review official flag on target branch change ( #38319 ) ( #38402 ) Fix(api): stop leaking private repo metadata after access revocation ( #38321 ) ( #38390 ) Fix(lfs): require proof of possession for cross-repo objects ( #38322 ) ( #38389 ) Fix(mirror): disable HTTP redirects on pull mirror sync ( #38320 ) ( #38367 ) Fix: golang html template url escaping ( #38363 ) ( #38369 ) Fix(release): validate web attachment renames against allowed types ( #38314 ) ( #38328 ) Fix(release): gate draft release attachments on web download endpoints ( #38318 ) ( #38325 ) Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] ( #37786 ) Fix(oauth): restrict introspection to the token's client ( #38042 ) Fix(api): don't expose private org membership via public_members ( #38145 ) Fix(actions): deny fork-PR cross-repo access via collaborative owner ( #38214 ) Fix(migrations): prevent path traversal in repository restore ( #38215 ) FEATURES Feat(actions): add workflow status badge modal ( #38196 ) Feat(actions): support owner-level and global scoped workflows ( #38154 ) Feat(api): support ref suffixes in compare ( #38148 ) Feat(actions): implement jobs.<job_id>.continue-on-error ( #38100 ) Feat(actions): show run status on browser tab favicon ( #38071 ) Feat(api): add token introspection and self-deletion endpoint ( #37995 ) Feat(api): add q parameter to list branches API for server-side filtering ( #37982 ) Feat(repo): split repository creation limit into user and org scopes ( #37872 ) Feat(actions): bulk delete, disable and enable runners in admin UI ( #37869 ) Feat(actions): List workflows that were executed once but got removed from the default branch ( #37835 ) Feat(org): add team visibility so org members can discover teams ( #37680 ) Feat: add raw diff/patch endpoint for repository comparisons ( #37632 ) Feat: Add avatar stacks ( #37594 ) Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) ( #37500 ) Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support ( #37433 ) Support for Custom URI Schemes in OAuth2 Redirect URIs ( #37356 ) Feat(orgs): Add search bar for organization members tab page ( #37347 ) Feat(api): Add assignees APIs ( #37330 ) Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs ( #37196 ) Serve OpenAPI 3.0 spec at /openapi.v1.json ( #37038 ) Add project column picker to issue and pull request sidebar ( #37037 ) Allow multiple projects per issue and pull requests ( #36784 ) Feat(ui): add "follow rename" to file commit history list ( #34994 ) Feat(ssh): auto generate additional ssh keys ( #33974 ) ENHANCEMENTS Enhance(actions): only create filtered-out workflow commit status for required contexts ( #38371 ) ( #38385 ) Enhance: allow builtin default git config options to be overridden ( #38172 ) Enhance: allow MathML core elements ( #38034 ) Enhance(markup): improve issue title rendering ( #37908 ) Enhance(actions): set descriptive browser tab title on run view ( #37870 ) Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 ( #37866 ) Enhance(actions): show workflow name from YAML instead of filename ( #37833 ) Feat(actions): add before/after to PR synchronize event payload ( #37827 ) Enhance(actions): add branch filters to run list ( #37826 ) Enhance(actions): Make Summary UI more beautiful with more infos ( #37824 ) Feat: add copy button to action step header, improve other copy buttons ( #37744 ) Fix(icon): use repo-forked icon to display forks count ( #37731 ) Feat(api): add sort and order query parameters to job list endpoints ( #37672 ) Feat(api): add last_sync to r

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence