GITEA-1.27.2 release notes and known issues

v1.27.2

Scope: Gitea. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

SECURITY Fix: update collaborator access mode and httpsign ( #38894 , #38862 ) ( #38895 ) Refactor: external render ( #38885 ) ( #38898 ) Fix(actions): resolve pull_request_target reusable workflows at the base commit ( #38886 ) ( #38897 ) Refactor: markup render ( #38864 ) ( #38869 ) Fix(deps): update dependency mermaid to v11.16.1 ( #38816 ) Fix(auth): set WebAuthn user verification per request ( #38805 ) ( #38810 ) Fix: render highlight language ( #38793 ) ( #38795 ) ENHANCEMENTS enhance: add missing npm package metadata properties ( #38826 ) ( #38831 ) BUGFIXES fix(actions): keep github.event.inputs as strings for workflow_dispatch ( #38899 ) ( #38908 ) fix(actions): let a rerun of selected jobs read the previous attempt's artifacts ( #38857 ) ( #38901 ) fix(lfs): accept successful transfer responses ( #38866 ) ( #38875 ) fix(packages): ignore nested Package.swift ( #38788 ) ( #38836 ) fix: drop newline-bearing member names in arch ParsePackage ( #38102 ) ( #38830 ) fix(storage): fix Azure Blob dump failing with file does not exist ( #38814 ) ( #38828 ) fix(migration): migration deletion returned json redirection ( #38796 ) ( #38825 ) fix(ui): change underlines to default browser style ( #38819 ) ( #38823 ) fix(actions): allow cancelling runs without running jobs ( #35842 ) ( #38812 ) fix(actions): evaluate each ${{ }} part on its own ( #38754 ) ( #38797 ) fix(actions): write an action task report in one transaction ( #38792 ) ( #38794 ) fix: markup link ( #38764 ) ( #38765 ) fix: set a minio part size when the content size is unknown ( #38753 ) ( #38755 ) fix: bad path escape in subpath archive download ( #38749 ) ( #38750 ) fix: remove the pull merge box from UI when the refreshed page doesn't contain it ( #38742 ) ( #38744 ) fix(markdown): fix double strikethough on code ( #38707 ) ( #38729 ) fix(lfs): failed upload deletes a concurrent upload's meta object ( #38693 ) ( #38722 ) fix: correct full url when using sub-path ( #38712 ) ( #38716 ) fix: avoid markup render panic ( #38698 ) ( #38703 ) fix(ui): too many participants shown in commit avatar stacks ( #38689 ) ( #38700 ) fix: support HEAD requests on Alpine registry APKINDEX.tar.gz ( #38686 ) ( #38688 ) fix(migrations): use all configured GitHub tokens ( #38841 ) ( #38846 ) Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

Improvements and security content

SECURITY Fix: update collaborator access mode and httpsign ( #38894 , #38862 ) ( #38895 ) Refactor: external render ( #38885 ) ( #38898 ) Fix(actions): resolve pull_request_target reusable workflows at the base commit ( #38886 ) ( #38897 ) Refactor: markup render ( #38864 ) ( #38869 ) Fix(deps): update dependency mermaid to v11.16.1 ( #38816 ) Fix(auth): set WebAuthn user verification per request ( #38805 ) ( #38810 ) Fix: render highlight language ( #38793 ) ( #38795 ) ENHANCEMENTS enhance: add missing npm package metadata properties ( #38826 ) ( #38831 ) BUGFIXES fix(actions): keep github.event.inputs as strings for workflow_dispatch ( #38899 ) ( #38908 ) fix(actions): let a rerun of selected jobs read the previous attempt's artifacts ( #38857 ) ( #38901 ) fix(lfs): accept successful transfer responses ( #38866 ) ( #38875 ) fix(packages): ignore nested Package.swift ( #38788 ) ( #38836 ) fix: drop newline-bearing member names in arch ParsePackage ( #38102 ) ( #38830 ) fix(storage): fix Azure Blob dump failing with file does not exist ( #38814 ) ( #38828 ) fix(migration): migration deletion returned json redirection ( #38796 ) ( #38825 ) fix(ui): change underlines to default browser style ( #38819 ) ( #38823 ) fix(actions): allow cancelling runs without running jobs ( #35842 ) ( #38812 ) fix(actions): evaluate each ${{ }} part on its own ( #38754 ) ( #38797 ) fix(actions): write an action task report in one transaction ( #38792 ) ( #38794 ) fix: markup link ( #38764 ) ( #38765 ) fix: set a minio part size when the content size is unknown ( #38753 ) ( #38755 ) fix: bad path escape in subpath archive download ( #38749 ) ( #38750 ) fix: remove the pull merge box from UI when the refreshed page doesn't contain it ( #38742 ) ( #38744 ) fix(markdown): fix double strikethough on code ( #38707 ) ( #38729 ) fix(lfs): failed upload deletes a concurrent upload's meta object ( #38693 ) ( #38722 ) fix: correct full url when using sub-path ( #38712 ) ( #38716 ) fix: avoid markup render panic ( #38698 ) ( #38703 ) fix(ui): too many participants shown in commit avatar stacks ( #38689 ) ( #38700 ) fix: support HEAD requests on Alpine registry APKINDEX.tar.gz ( #38686 ) ( #38688 ) fix(migrations): use all configured GitHub tokens ( #38841 ) ( #38846 ) Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

Gitea

Affected versions

1.27.2
11.16.1

Fixed versions or updates

No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Official publisher evidence

GITEAVERIFIED

v1.27.2

Checked 4 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source