Gitea - Package Updates

[Package Updates]

[1.37.2]

• Update gitea to 1.25.2
• Full Changelog
• Upgrade golang.org/x/crypto to 0.45.0 (#35985) (#35988)
• Fix various permission & login related bugs (#36002) (#36004)
• Display source code downloads last for release attachments (#35897) (#35903)
• Change project default column icon to 'star' (#35967) (#35979)
• Allow empty commit when merging pull request with squash style (#35989) (#36003)
• Fix container push tag overwriting (#35936) (#35954)
• Fix corrupted external render content (#35946) and upgrade golang.org/x packages (#35950)
• Limit reading bytes instead of ReadAll (#35928) (#35934)
• Use correct form field for allowed force push users in branch protection API (#35894) (#35908)
• Fix team member access check (#35899) (#35905)

[Package Updates]

[1.37.3]

• Update gitea to 1.25.3
• Full Changelog
• SECURITY Bump toolchain to go1.25.5, misc fixes (#​36082)
• ENHANCEMENTS Add strikethrough button to markdown editor (#​36087) (#​36104)
• ENHANCEMENTS Add "site admin" back to profile menu (#​36010) (#​36013)
• ENHANCEMENTS Improve math rendering (#​36124) (#​36125)
• BUGFIXES Check user visibility when redirecting to a renamed user (#​36148) (#​36159)
• BUGFIXES Fix various bugs (#​36139) (#​36151)
• BUGFIXES Fix bug when viewing the commit diff page with non-ANSI files (#​36149) (#​36150)
• BUGFIXES Hide RSS icon when viewing a file not under a branch (#​36135) (#​36141)
• BUGFIXES Fix SVG size calulation, only use style attribute (#​36133) (#​36134)
• BUGFIXES Make Golang correctly delete temp files during uploading (#​36128) (#​36129)

[Package Updates]

[1.37.4]

• Update gitea to 1.25.4
• Full Changelog
• Release attachments must belong to the intended repo (#36347) (#36375)
• Fix permission check on org project operations (#36318) (#36373)
• Clean watches when make a repository private and check permission when send release emails (#36319) (#36370)
• Add more check for stopwatch read or list (#36340) (#36368)
• Fix openid setting check (#36346) (#36361)
• Fix cancel auto merge bug (#36341) (#36356)
• Fix delete attachment check (#36320) (#36355)
• LFS locks must belong to the intended repo (#36344) (#36349)
• Fix bug on notification read (#36339) #36387
• Add more routes to the "expensive" list (#36290)

[Package Updates]

[1.38.0]

• Update gitea to 1.26.0
• Full Changelog
• Correct swagger annotations for enums, status codes, and notification state (#37030)
• Remove GET API registration-token (#36801)
• Support Actions concurrency syntax (#32751)
• Make PUBLIC_URL_DETECTION default to "auto" (#36955)
• Add terraform state registry (#36710)
• Instance-wide (global) info banner and maintenance mode (#36571)
• Support rendering OpenAPI spec (#36449)
• Add keyboard shortcuts for repository file and code search (#36416)
• Automatic generation of release notes (#35977)
• Add button to re-run failed jobs in Actions (#36924)

[Package Updates]

[1.38.1]

• Update gitea to 1.26.1
• Full Changelog
• Add event.schedule context for schedule actions task (#37320) (#37348)
• Fix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#37324) (#37344)
• Use modern "git update-index --cacheinfo" syntax to support more file names (#37338) (#37343)
• Fix URL related escaping for oauth2 (#37334) (#37340)
• When the requested arch rpm is missing fall back to noarch (#37236) (#37339)
• Fix actions concurrency groups cross-branch leak (#37311) (#37331)
• Fix bug when accessing user badges (#37321) (#37329)
• Fix container auth for public instance (#37290) (#37294)
• Fix Mermaid diagrams failing when node labels contain line breaks (#37296) (#37299)
• Fix: dump with default zip type produces uncompressed zip (#37401) #37402

[Package Updates]

[1.38.2]

• Update gitea to 1.26.2
• Full Changelog
• fix(permissions): Fix reading permission (#37769)
• fix(actions): make artifact signature payloads unambiguous (#37707)
• fix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
• fix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
• feat(api): encrypt AWS creds (#37679)
• fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
• fix(pull): handle empty pull request files view to allow reviews (#37783)
• fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
• fix: treat email addresses case-insensitively (#37600)
• Fix color regressions, add priority color (#37417) (#37421)

[Package Updates]

[1.38.3]

• Update gitea to 1.26.3
• Full Changelog
• fix(actions)!: require merged MR to bypass fork MR approval gate (#38010) (#38041)
• fix(hostmatcher): patch incorrect private list (#38170) (#38173)
• fix: Various security fixes (#38103) (#38151)
• fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
• fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
• feat(api): add Link header in ListForks (#38052) (#38063)
• fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
• fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
• fix(releases): generate notes for initial tag (#37697) (#37986)
• fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)

[Package Updates]

[1.38.4]

• Update gitea to 1.26.4
• Full Changelog
• fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)
• fix: walk git log context error handling (#38182) (#38185)

[Package Updates]

[1.39.0]

• Update gitea to 1.27.0
• Full Changelog
• Feat(actions)!: improve support for reusable workflows (#37478)
• Use Content-Security-Policy: script nonce (#37232)
• Feat(actions): add workflow status badge modal (#38196)
• Feat(actions): support owner-level and global scoped workflows (#38154)
• Feat(repo): split repository creation limit into user and org scopes (#37872)
• Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
• Allow multiple projects per issue and pull requests (#36784)
• Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
• Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
• Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)

[Package Updates]

[1.39.1]

• Update gitea to 1.27.1
• Full Changelog
• fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
• fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
• enhance: improve diff contrast in light and dark themes (#37477) (#38574)
• fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
• fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
• fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
• fix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)
• fix: orgmode render include path (#38642) (#38645)
• fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
• fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)