GITEA-1.27.0-RC0 release notes and known issues

Summary

BREAKING Feat(actions)!: improve support for reusable workflows ( #37478 ) Use Content-Security-Policy: script nonce ( #37232 ) SECURITY Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] ( #37786 ) Fix(oauth): restrict introspection to the token's client ( #38042 ) Fix(api): don't expose private org membership via public_members ( #38145 ) Fix(actions): deny fork-PR cross-repo access via collaborative owner ( #38214 ) Fix(migrations): prevent path traversal in repository restore ( #38215 ) FEATURES Feat(actions): add workflow status badge modal ( #38196 ) Feat(actions): support owner-level and global scoped workflows ( #38154 ) Feat(api): support ref suffixes in compare ( #38148 ) Feat(actions): implement jobs.<job_id>.continue-on-error ( #38100 ) Feat(actions): show run status on browser tab favicon ( #38071 ) Feat(api): add token introspection and self-deletion endpoint ( #37995 ) Feat(api): add q parameter to list branches API for server-side filtering ( #37982 ) Feat(repo): split repository creation limit into user and org scopes ( #37872 ) Feat(actions): bulk delete, disable and enable runners in admin UI ( #37869 ) Feat(actions): List workflows that were executed once but got removed from the default branch ( #37835 ) Feat(org): add team visibility so org members can discover teams ( #37680 ) Feat: add raw diff/patch endpoint for repository comparisons ( #37632 ) Feat: Add avatar stacks ( #37594 ) Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) ( #37500 ) Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support ( #37433 ) Support for Custom URI Schemes in OAuth2 Redirect URIs ( #37356 ) Feat(orgs): Add search bar for organization members tab page ( #37347 ) Feat(api): Add assignees APIs ( #37330 ) Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs ( #37196 ) Serve OpenAPI 3.0 spec at /openapi.v1.json ( #37038 ) Add project column picker to issue and pull request sidebar ( #37037 ) Allow multiple projects per issue and pull requests ( #36784 ) Feat(ui): add "follow rename" to file commit history list ( #34994 ) Feat(ssh): auto generate additional ssh keys ( #33974 ) ENHANCEMENTS Enhance: allow builtin default git config options to be overridden ( #38172 ) Enhance: allow MathML core elements ( #38034 ) Enhance(markup): improve issue title rendering ( #37908 ) Enhance(actions): set descriptive browser tab title on run view ( #37870 ) Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 ( #37866 ) Enhance(actions): show workflow name from YAML instead of filename ( #37833 ) Feat(actions): add before/after to PR synchronize event payload ( #37827 ) Enhance(actions): add branch filters to run list ( #37826 ) Enhance(actions): Make Summary UI more beautiful with more infos ( #37824 ) Feat: add copy button to action step header, improve other copy buttons ( #37744 ) Fix(icon): use repo-forked icon to display forks count ( #37731 ) Feat(api): add sort and order query parameters to job list endpoints ( #37672 ) Feat(api): add last_sync to repository API ( #37566 ) Enhance: Adjust Workflow Graph styling ( #37497 ) Improve code editor text selection and clean up lint enablement ( #37474 ) Add mirror auth updates to repo edit API and settings ( #37468 ) Replace olivere/elastic with REST API client, add OpenSearch support ( #37411 ) Feat: Add default PR branch update style setting ( #37410 ) Fix inconsistent disabled styling on logged-out repo header buttons ( #37406 ) Allow fast-forward-only merge when signed commits are required ( #37335 ) Enhance styling in actions page ( #37323 ) Fix: improve actions status icons and texts ( #37206 ) Make Markdown fenced code block work with more syntaxes ( #37154 ) Fix: Sort action run jobs by JobID and Name with matrix examples ( #37046 ) Add API endpoint to reply to pull request review comments ( #36683 ) PERFORMANCE Perf(web): sort the action_run query by a repo-scoped index when possible ( #38155 ) Perf: Various

Improvements and security content

• BREAKING Feat(actions)!: improve support for reusable workflows ( #37478 ) Use Content-Security-Policy: script nonce ( #37232 ) SECURITY Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] ( #37786 ) Fix(oauth): restrict introspection to the token's client ( #38042 ) Fix(api): don't expose private org membership via public_members ( #38145 ) Fix(actions): deny fork-PR cross-repo access via collaborative owner ( #38214 ) Fix(migrations): prevent path traversal in repository restore ( #38215 ) FEATURES Feat(actions): add workflow status badge modal ( #38196 ) Feat(actions): support owner-level and global scoped workflows ( #38154 ) Feat(api): support ref suffixes in compare ( #38148 ) Feat(actions): implement jobs.<job_id>.continue-on-error ( #38100 ) Feat(actions): show run status on browser tab favicon ( #38071 ) Feat(api): add token introspection and self-deletion endpoint ( #37995 ) Feat(api): add q parameter to list branches API for server-side filtering ( #37982 ) Feat(repo): split repository creation limit into user and org scopes ( #37872 ) Feat(actions): bulk delete, disable and enable runners in admin UI ( #37869 ) Feat(actions): List workflows that were executed once but got removed from the default branch ( #37835 ) Feat(org): add team visibility so org members can discover teams ( #37680 ) Feat: add raw diff/patch endpoint for repository comparisons ( #37632 ) Feat: Add avatar stacks ( #37594 ) Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) ( #37500 ) Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support ( #37433 ) Support for Custom URI Schemes in OAuth2 Redirect URIs ( #37356 ) Feat(orgs): Add search bar for organization members tab page ( #37347 ) Feat(api): Add assignees APIs ( #37330 ) Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs ( #37196 ) Serve OpenAPI 3.0 spec at /openapi.v1.json ( #37038 ) Add project column picker to issue and pull request sidebar ( #37037 ) Allow multiple projects per issue and pull requests ( #36784 ) Feat(ui): add "follow rename" to file commit history list ( #34994 ) Feat(ssh): auto generate additional ssh keys ( #33974 ) ENHANCEMENTS Enhance: allow builtin default git config options to be overridden ( #38172 ) Enhance: allow MathML core elements ( #38034 ) Enhance(markup): improve issue title rendering ( #37908 ) Enhance(actions): set descriptive browser tab title on run view ( #37870 ) Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 ( #37866 ) Enhance(actions): show workflow name from YAML instead of filename ( #37833 ) Feat(actions): add before/after to PR synchronize event payload ( #37827 ) Enhance(actions): add branch filters to run list ( #37826 ) Enhance(actions): Make Summary UI more beautiful with more infos ( #37824 ) Feat: add copy button to action step header, improve other copy buttons ( #37744 ) Fix(icon): use repo-forked icon to display forks count ( #37731 ) Feat(api): add sort and order query parameters to job list endpoints ( #37672 ) Feat(api): add last_sync to repository API ( #37566 ) Enhance: Adjust Workflow Graph styling ( #37497 ) Improve code editor text selection and clean up lint enablement ( #37474 ) Add mirror auth updates to repo edit API and settings ( #37468 ) Replace olivere/elastic with REST API client, add OpenSearch support ( #37411 ) Feat: Add default PR branch update style setting ( #37410 ) Fix inconsistent disabled styling on logged-out repo header buttons ( #37406 ) Allow fast-forward-only merge when signed commits are required ( #37335 ) Enhance styling in actions page ( #37323 ) Fix: improve actions status icons and texts ( #37206 ) Make Markdown fenced code block work with more syntaxes ( #37154 ) Fix: Sort action run jobs by JobID and Name with matrix examples ( #37046 ) Add API endpoint to reply to pull request review comments ( #36683 ) PERFORMANCE Perf(web): sort the action_run query by a repo-scoped index when possible ( #38155 ) Perf: Various

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence