v1.20.2

• ENHANCEMENTS
  • Calculate MAX_WORKERS default value by CPU number (#26177) (#26183)
  • Display deprecated warning in admin panel pages as well as in the log file (#26094) (#26154)
• BUGFIXES
  • Fix allowed user types setting problem (#26200) (#26206)
  • Fix handling of plenty Nuget package versions (#26075) (#26173)
  • Fix UI regression of asciinema player (#26159) (#26162)
  • Fix LFS object list style (#26133) (#26147)
  • Fix allowed user types setting problem (#26200) (#26206)
  • Prevent primary key update on migration (#26192) (#26199)
  • Fix bug when pushing to a pull request which enabled dismiss approval automatically (#25882) (#26158)
  • Fix bugs in LFS meta garbage collection (#26122) (#26157)
  • Update xorm version (#26128) (#26150)
  • Remove "misc" scope check from public API endpoints (#26134) (#26149)
  • Fix CLI allowing creation of access tokens with existing name (#26071) (#26144)
  • Fix incorrect router logger (#26137) (#26143)
  • Improve commit graph alignment and truncating (#26112) (#26127)
  • Avoid writing config file if not installed (#26107) (#26113)
  • Fix escape problems in the branch selector (#25875) (#26103)
  • Fix handling of Debian files with trailing slash (#26087) (#26098)
  • Fix Missing 404 swagger response docs for /admin/users/{username} (#26086) (#26089)
  • Use stderr as fallback if the log file can't be opened (#26074) (#26083)
  • Increase table cell horizontal padding (#26140) (#26142)
  • Fix wrong workflow status when rerun a job in an already finished workflow (#26119) (#26124)
  • Fix duplicated url prefix on issue context menu (#26066) (#26067)

v1.20.1

• SECURITY
  • Disallow dangerous URL schemes (#25960) (#25964)
• ENHANCEMENTS
  • Show the mismatched ROOT_URL warning on the sign-in page if OAuth2 is enabled (#25947) (#25972)
  • Make pending commit status yellow again (#25935) (#25968)
• BUGFIXES
  • Fix version in rpm repodata/primary.xml.gz (#26009) (#26048)
  • Fix env config parsing for "GITEA____APP_NAME" (#26001) (#26013)
  • ParseScope with owner/repo always sets owner to zero (#25987) (#25989)
  • Fix SSPI auth panic (#25955) (#25969)
  • Avoid creating directories when loading config (#25944) (#25957)
  • Make environment-to-ini work with INSTALL_LOCK=true (#25926) (#25937)
  • Ignore runs-on with expressions when warning no matched runners (#25917) (#25933)
  • Avoid opening/closing PRs which are already merged (#25883) (#25903)
• DOCS
  • RPM Registry: Show zypper commands for SUSE based distros as well (#25981) (#26020)
  • Correctly refer to dev tags as nightly in the docker docs (#26004) (#26019)
  • Update path related documents (#25417) (#25982)
• MISC
  • Adding remaining enum for migration repo model type. (#26021) (#26034)
  • Fix the route for pull-request's authors (#26016) (#26018)
  • Fix commit status color on dashboard repolist (#25993) (#25998)
  • Avoid hard-coding height in language dropdown menu (#25986) (#25997)
  • Add shutting down notice (#25920) (#25922)
  • Fix incorrect milestone count when provide a keyword (#25880) (#25904)

v1.20.0

For more in-depth information, check out the blog post!

• BREAKING
  • Fix WORK_DIR for docker (root) image (#25738) (#25811)
  • Restrict [actions].DEFAULT_ACTIONS_URL to only github or self (#25581) (#25604)
  • Refactor path & config system (#25330) (#25416)
  • Fix all possible setting error related storages and added some tests (#23911) (#25244)
  • Use a separate admin page to show global stats, remove actions stat (#25062)
  • Remove the service worker (#25010)
  • Remove meta tags theme-color and default-theme (#24960)
  • Use [git.config] for reflog cleaning up (#24958)
  • Allow all URL schemes in Markdown links by default (#24805)
  • Redesign Scoped Access Tokens (#24767)
  • Fix team members API endpoint pagination (#24754)
  • Rewrite logger system (#24726)
  • Increase default LFS auth timeout from 20m to 24h (#24628)
  • Rewrite queue (#24505)
  • Remove unused setting time.FORMAT (#24430)
  • Refactor setting.Other and remove unused SHOW_FOOTER_BRANDING (#24270)
  • Correct the access log format (#24085)
  • Reserve ".png" suffix for user/org names (#23992)
  • Prefer native parser for SSH public key parsing (#23798)
  • Editor preview support for external renderers (#23333)
  • Add Gitea Profile Readmes (#23260)
  • Refactor ctx in templates (#23105)
• SECURITY
  • Test if container blob is accessible before mounting (#22759) (#25784)
  • Set type="password" on all auth_token fields (#22175)
• FEATURES
  • Add button on diff header to copy file name, misc diff header tweaks (#24986)
  • API endpoint for changing/creating/deleting multiple files (#24887)
  • Support changing git config through app.ini, use diff.algorithm=histogram by default (#24860)
  • Add up and down arrows to selected lookup repositories (#24727)
  • Add Go package registry (#24687)
  • Add status indicator on main home screen for each repo (#24638)
  • Support for status check pattern (#24633)
  • Implement Cargo HTTP index (#24452)
  • Add Debian package registry (#24426)
  • Add the ability to pin Issues (#24406)
  • Add follow organization and fix the logic of following page (#24345)
  • Allow webp images as avatars (#24248)
  • Support upload outputs and use needs context on Actions (#24230)
  • Allow adding new files to an empty repo (#24164)
  • Make wiki title supports dashes and improve wiki name related features (#24143)
  • Add monospace toggle button to textarea (#24034)
  • Use auto-updating, natively hoverable, localized time elements (#23988)
  • Add ntlm authentication support for mail (#23811)
  • Add CLI command to register runner tokens (#23762)
  • Add Alpine package registry (#23714)
  • Expand/Collapse all changed files (#23639)
  • Add unset default project column (#23531)
  • Add activity feeds API (#23494)
  • Add RPM registry (#23380)
  • Add meilisearch support (#23136)
  • Add API for License templates (#23009)
  • Add admin API email endpoints (#22792)
  • Add user rename endpoint to admin api (#22789)
  • Add API for gitignore templates (#22783)
  • Implement actions artifacts (#22738)
  • Add RSS Feeds for branches and files (#22719)
  • Display when a repo was archived (#22664)
  • Add Swift package registry (#22404)
  • Add CRAN package registry (#22331)
  • Add user webhooks (#21563)
  • Implement systemd-notify protocol (#21151)
  • Implement Issue Config (#20956)
  • Add API to manage issue dependencies (#17935)
• API
  • Use correct response code in push mirror creation response in v1_json.tmpl (#25476) (#25571)
  • Fix Permission in API returned repository struct (#25388) (#25441)
  • Add API for Label templates (#24602)
  • Filters for GetAllCommits (#24568)
  • Add ability to specify '--not' from GetAllCommits (#24409)
  • Support uploading file to empty repo by API (#24357)
  • Add absent repounits to create/edit repo API (#23500)
  • Add login name and source id for admin user searching API (#23376)
  • Create a branch directly from commit on the create branch API (#22956)
• ENHANCEMENTS
  • Make add line comment buttons focusable (#25894) (#25896)
  • Always pass 6-digit hex color to monaco (#25780) (#25782)
  • Clarify "text-align" CSS helpers, fix clone button padding (#25763) (#25764)
  • Hide add file button for pull mirrors (#25748) (#25751)
  • Allow/fix review (approve/reject) of empty PRs (#25690) (#25732)
  • Fix tags header and pretty format numbers (#25624) (#25694)
  • Actions list enhancements (#25601) (#25678)
  • Fix show more for image on diff page (#25672) (#25673)
  • Prevent SVG shrinking (#25652) (#25669)
  • Fix UI misalignment on user setting page (#25629) (#25656)
  • Use css on labels (#25626) (#25636)
  • Read-only checkboxes don't appear and don't entirely act the way one might expect (#25573) (#25602)
  • Redirect to package after version deletion (#25594) (#25599)
  • Reduce table padding globally (#25568) (#25577)
  • Change Regenerate Secret button display (#25534) (#25541)
  • Fix rerun icon on action view component (#25531) (#25536)
  • Move some regexp out of functions (#25430) (#25445)
  • Diff page enhancements (#25398) (#25437)
  • Various UI fixes (#25264) (#25431)
  • Fix label list divider (#25312) (#25372)
  • Fix UI on mobile view (#25315) (#25340)
  • When viewing a file, hide the add button (#25320) (#25339)
  • Show if File is Executable (#25287) (#25300)
  • Fix edit OAuth application width (#25262) (#25263)
  • Use flex to align SVG and text (#25163) (#25260)
  • Revert overflow: overlay (revert #21850) (#25231) (#25239)
  • Use inline SVG for built-in OAuth providers (#25171) (#25234)
  • Change access token UI to select dropdowns (#25109) (#25230)
  • Remove hacky patch for "safari emoji glitch fix" (#25208) (#25211)
  • Minor arc-green color tweaks (#25175) (#25205)
  • Button and color enhancements (#24989) (#25176)
  • Fix mobile navbar and misc cleanups (#25134) (#25169)
  • Modify OAuth login ui and fix display name, iconurl related logic (#25030) (#25161)
  • Improve notification icon and navbar (#25111) (#25124)
  • Add details summary for vertical menus in settings to allow toggling (#25098)
  • Don't display select all issues checkbox when no issues are available (#25086)
  • Use RepositoryList instead of []*Repository (#25074)
  • Add ability to set multiple redirect URIs in OAuth application UI (#25072)
  • Use git command instead of the ini package to remove the origin remote (#25066)
  • Remove cancel button from branch protection form (#25063)
  • Show file tree by default (#25052)
  • Add Progressbar to Milestone Page (#25050)
  • Minor UI improvements: logo alignment, auth map editor, auth name display (#25043)
  • Allow for PKCE flow without client secret + add docs (#25033)
  • Refactor INI package (first step) (#25024)
  • Various style fixes (#25008)
  • Fix delete user account modal (#25004)
  • Refactor diffFileInfo / DiffTreeStore (#24998)
  • Add user level action runners (#24995)
  • Rename NotifyPullReviewRequest to NotifyPullRequestReviewRequest (#24988)
  • Add step start time to ViewStepLog (#24980)
  • Add dark mode to API Docs (#24971)
  • Display file mode for new file and file mode changes (#24966)
  • Make the 500 page load themes (#24953)
  • Show bot label next to username when rendering autor link if the user is a bot (#24943)
  • Repo list improvements, fix bold helper classes (#24935)
  • Improve queue and logger context (#24924)
  • Improve RunMode / dev mode (#24886)
  • Improve some Forms (#24878)
  • Add show timestamp/seconds and fullscreen options to action page (#24876)
  • Fix double border and adjust width for user profile page (#24870)
  • Improve Actions CSS (#24864)
  • Fix @font-face overrides (#24855)
  • Remove In your repositories link in milestones dashboard (#24853)
  • Fix missing yes/no in delete time log modal (#24851)
  • Show new pull request button also on subdirectories and files (#24842)
  • Make environment-to-ini support loading key value from file (#24832)
  • Support wildcard in email domain allow/block list (#24831)
  • Use CommentList instead of []*Comment (#24828)
  • Add RTL rendering support to Markdown (#24816)
  • Rework notifications list (#24812)
  • Mute repo names in dashboard repo list (#24811)
  • Fix max width and margin of comment box on conversation page (#24809)
  • Some refactors for issues stats (#24793)
  • Rework label colors (#24790)
  • Fix OAuth login loading state (#24788)
  • Remove duplicated issues options and some more refactors (#24787)
  • Decouple the different contexts from each other (#24786)
  • Remove background on user dashboard filter bar (#24779)
  • Improve and fix bugs surrounding reactions (#24760)
  • Make the color of zero-contribution-squares in the activity heatmap more subtle (#24758)
  • Fix WEBP image copying (#24743)
  • Rework OAuth login buttons, swap github logo to monocolor (#24740)
  • Consolidate the two review boxes into one (#24738)
  • Unification of registration fields order (#24737)
  • Refactor Pull Mirror and fix out-of-sync bugs (#24732)
  • Improvements for action detail page (#24718)
  • Fix flash of unstyled content in action view page (#24712)
  • Don't filter action runs based on state (#24711)
  • Optimize actions list by removing an unnecessary git call (#24710)
  • Support no label/assignee filter and batch clearing labels/assignees (#24707)
  • Add icon support for safari (#24697)
  • Use standard HTTP library to serve files (#24693)
  • Improve button-ghost, remove tertiary button (#24692)
  • Only hide tooltip tippy instances (#24688)
  • Support migrating storage for actions log via command line (#24679)
  • Remove highlight in repo list (#24675)
  • Add markdown preview to Submit Review Textarea (#24672)
  • ...

v1.19.4

• SECURITY
  • Fix open redirect check for more cases (#25143) (#25155)
• API
  • Return 404 in the API if the requested webhooks were not found (#24823) (#24830)
  • Fix organization field being null in GET /api/v1/teams/{id} (#24694) (#24696)
• ENHANCEMENTS
  • Set --font-weight-bold to 600 (#24840)
  • Make mailer SMTP check have timed context (#24751) (#24759)
  • Do not select line numbers when selecting text from the action run logs (#24594) (#24596)
• BUGFIXES
  • Fix bug when change user name (#25637) (#25645)
  • Fix task list checkbox toggle to work with YAML front matter (#25184) (#25236)
  • Hide limited users if viewed by anonymous ghost (#25214) (#25224)
  • Add WithPullRequest for actionsNotifier (#25144) (#25196)
  • Fix parallelly generating index failure with Mysql (#24567) (#25081)
  • GitLab migration: Sanitize response for reaction list (#25054) (#25059)
  • Fix users cannot visit issue attachment bug (#25019) (#25027)
  • Fix missing reference prefix of commits when sync mirror repository (#24994)
  • Only validate changed columns when update user (#24867) (#24903)
  • Make DeleteIssue use correct context (#24885)
  • Fix topics deleted via API not being deleted in org page (#24825) (#24829)
  • Fix Actions being enabled accidentally (#24802) (#24810)
  • Fix missed table name on iterate lfs meta objects (#24768) (#24774)
  • Fix safari cookie session bug (#24772)
  • Respect original content when creating secrets (#24745) (#24746)
  • Fix Pull Mirror out-of-sync bugs (#24732) (#24733)
  • Fix run list broken when trigger user deleted (#24706) (#24709)
  • Fix issues list page multiple selection update milestones (#24660) (#24663)
  • Fix: release page for empty or non-existing target (#24659)
  • Fix close org projects (#24588) (#24591)
  • Refresh the refernce of the closed PR when reopening (#24231) (#24587)
  • Fix the permission of team's Actions unit issue (#24536) (#24545)
  • Bump go.etcd.io/bbolt and blevesearch deps (#23062) (#24519)
  • Fix new wiki page mirror (#24518)
  • Match unqualified references when syncing pulls as well (#23070)
• DOCS
  • Change branch name from master to main in some documents' links (#25126) (#25139)
  • Remove unnecessary content on docs (#24976) (#25001)
  • Unify doc links to use paths relative to doc folder (#24979) (#25000)
  • Fix docs documenting invalid @every for OLDER_THAN cron settings (#24695) (#24698)
• MISC
  • Merge different languages for language stats (#24900) (#24921)
  • Hiding Secrets options when Actions feature is disabled (#24792)
  • Improve decryption failure message (#24573) (#24575)
  • Makefile: Use portable !, not GNUish -not, with find(1). (#24565) (#24572)

v1.20.0-rc2

Third release candidate for 1.20

v1.20.0-rc1

Second release candidate for 1.20

v1.20.0-rc0

release candidate 0

v1.19.3

• SECURITY
  • Use golang 1.20.4 to fix CVE-2023-24539, CVE-2023-24540, and CVE-2023-29400
• ENHANCEMENTS
  • Enable whitespace rendering on selection in Monaco (#24444) (#24485)
  • Improve milestone filter on issues page (#22423) (#24440)
• BUGFIXES
  • Fix api error message if fork exists (#24487) (#24493)
  • Fix user-cards format (#24428) (#24431)
  • Fix incorrect CurrentUser check for docker rootless (#24435)
  • Getting the tag list does not require being signed in (#24413) (#24416)

v1.19.2

• SECURITY
  • Require repo scope for PATs for private repos and basic authentication (#24362) (#24364)
  • Only delete secrets belonging to its owner (#24284) (#24286)
• API
  • Fix typo in API route (#24310) (#24332)
  • Fix access token issue on some public endpoints (#24194) (#24259)
• ENHANCEMENTS
  • Fix broken clone script on an empty archived repo (#24339) (#24348)
  • Fix Monaco IOS keyboard button (#24341) (#24347)
  • Don't set meta theme-color by default (#24340) (#24346)
  • Wrap too long push mirror addresses (#21120) (#24334)
  • Add --font-weight-bold and set previous bold to 601 (#24307) (#24331)
  • Unify nightly naming across binaries and docker images (#24116) (#24308)
  • Fix footer display (#24251) (#24269)
  • Fix label color, fix divider in dropdown (#24215) (#24244)
  • Vertical widths of containers removed (#24184) (#24211)
  • Use correct locale key for forks page (#24172) (#24175)
  • Sort repo topic labels by name (#24123) (#24153)
  • Highlight selected file in the PR file tree (#23947) (#24126)
• BUGFIXES
  • Fix auth check bug (#24382) (#24387)
  • Add tags list for repos whose release setting is disabled (#23465) (#24369)
  • Fix wrong error info in RepoRefForAPI (#24344) (#24351)
  • Fix no edit/close/delete button in org repo project view page (#24349)
  • Respect the REGISTER_MANUAL_CONFIRM setting when registering via OIDC (#24035) (#24333)
  • Remove org users who belong to no teams (#24247) (#24313)
  • Fix bug when deleting wiki with no code write permission (#24274) (#24295)
  • Handle canceled workflow as a warning instead of a fail (#24282) (#24292)
  • Load reviewer for comments when dismissing a review (#24281) (#24288)
  • Show commit history for closed/merged PRs (#24238) (#24261)
  • Fix owner team access mode value in team_unit table (#24224)
  • Fix issue attachment handling (#24202) (#24221)
  • Fix incorrect CORS default values (#24206) (#24217)
  • Fix template error in pull request with deleted head repo (#24192) (#24216)
  • Don't list root repository on compare page if pulls not allowed (#24183) (#24210)
  • Fix calReleaseNumCommitsBehind (#24148) (#24197)
  • Fix Org edit page bugs: renaming detection, maxlength (#24161) (#24171)
  • Update redis library to support redis v7 (#24114) (#24156)
  • Use 1.18's aria role for dropdown menus (#24144) (#24155)
  • Fix 2-dot direct compare to use the right base commit (#24133) (#24150)
  • Fix incorrect server error content in RunnersList (#24118) (#24121)
  • Fix mismatch between hook events and github event types (#24048) (#24091)
• BUILD
  • Support converting varchar to nvarchar for mssql database (#24105) (#24168)

v1.19.1

• BREAKING
  • Rename actions unit to repo.actions and add docs for it (#23733) (#23881)
• ENHANCEMENTS
  • Add card type to org/user level project on creation, edit and view (#24043) (#24066)
  • Refactor commit status for Actions jobs (#23786) (#24060)
  • Show errors for KaTeX and mermaid on the preview tab (#24009) (#24019)
  • Show protected branch rule names again (#23907) (#24018)
  • Adjust sticky PR header to cover background (#23956) (#23999)
  • Discolor pull request tab labels (#23950) (#23987)
  • Treat PRs with agit flow as fork PRs when triggering actions. (#23884) (#23967)
  • Left-align review comments (#23937)
  • Fix image border-radius (#23886) (#23930)
  • Scroll collapsed file into view (#23702) (#23929)
  • Fix code view (diff) broken layout (#23096) (#23918)
  • Org pages style fixes (#23901) (#23914)
  • Fix user profile description rendering (#23882) (#23902)
  • Fix review box viewport overflow issue (#23800) (#23898)
  • Prefill input values in OAuth settings as intended (#23829) (#23871)
  • CSS color tweaks (#23828) (#23842)
  • Fix incorrect visibility dropdown list in add/edit user page (#23804) (#23833)
  • Add CSS rules for basic colored labels (#23774) (#23777)
  • Add creation time in tag list page (#23693) (#23773)
  • Fix br display for packages curls (#23737) (#23764)
  • Fix issue due date edit toggle bug (#23723) (#23758)
  • Improve commit graph page UI alignment (#23751) (#23754)
  • Use GitHub Actions compatible globbing for branches, tag, path filter (#22804) (#23740)
  • Redirect to project again after editing it (#23326) (#23739)
  • Remove row clicking from notification table (#22695) (#23706)
  • Remove conflicting CSS rules on notifications, improve notifications table (#23565) (#23621)
  • Fix diff tree height and adjust target file style (#23616)
• BUGFIXES
  • Improve error logging for LFS (#24072) (#24082)
  • Fix custom mailer template on Windows platform (#24081)
  • Update the value of diffEnd when clicking the Show More button in the DiffFileTree (#24069) (#24078)
  • Make label templates have consistent behavior and priority (#23749)
  • Fix accidental overwriting of LDAP team memberships (#24050) (#24065)
  • Fix branch protection priority (#24045) (#24061)
  • Use actions job link as commit status URL instead of run link (#24023) (#24032)
  • Add actions support to package auth verification (#23729) (#24028)
  • Fix protected branch for API (#24013) (#24027)
  • Do not escape space between PyPI repository URL and package name… (#23981) (#24008)
  • Fix redirect bug when creating issue from a project (#23971) (#23997)
  • Set ref to fully-formed of the tag when trigger event is release (#23944) (#23989)
  • Use Get/Set instead of Rename when regenerating session ID (#23975) (#23983)
  • Ensure RSS icon is present on all repo tabs (#23904) (#23973)
  • Remove Repository.getFilesChanged to fix Actions paths and paths-ignore filter (#23920) (#23969)
  • Delete deleted release attachments immediately from storage (#23913) (#23958)
  • Use ghost user if package creator does not exist (#23822) (#23915)
  • User/Org Feed render description as per web (#23887) (#23906)
  • Fix cases.Title crash for concurrency (#23885) (#23903)
  • Convert .Source.SkipVerify to $cfg.SkipVerify (#23839) (#23899)
  • Support "." char as user name for User/Orgs in RSS/ATOM/GPG/KEYS path ... (#23874) (#23878)
  • Fix JS error when changing PR's target branch (#23862) (#23864)
  • Fix 500 error if there is a name conflict when editing authentication source (#23832) (#23852)
  • Fix closed PR also triggers Webhooks and actions (#23782) (#23834)
  • Fix checks for needs in Actions (#23789) (#23831)
  • Fix "Updating branch by merge" bug in "update_branch_by_merge.tmpl" (#23790) (#23825)
  • Fix cancel button in the page of project edit not work (#23655) (#23813)
  • Don't apply the group filter when listing LDAP group membership if it is empty (#23745) (#23788)
  • Fix profile page email display, respect settings (#23747) (#23756)
  • Fix project card preview select and template select (#23684) (#23731)
  • Check LFS/Packages settings in dump and doctor command (#23631) (#23730)
  • Add git dashes separator to some "log" and "diff" commands (#23606) (#23720)
  • Create commit status when event is pull_request_sync (#23683) (#23691)
  • Fix incorrect HookEventType of pull request review comments (#23650) (#23678)
  • Fix incorrect show-modal and show-panel class (#23660) (#23663)
  • Improve workflow event triggers (#23613) (#23648)
  • Introduce path Clean/Join helper functions, partially backport&refactor (#23495) (#23607)
  • Fix pagination on /notifications/watching (#23564) (#23603)
  • Fix submodule is nil panic (#23588) (#23601)
  • Polyfill the window.customElements (#23592) (#23595)
  • Avoid too long names for actions (#23162) (#23190)
• TRANSLATION
  • Backport locales (with manual fixes) (#23808, #23634, #24083)
• BUILD
  • Hardcode the path to docker images (#23955) (#23968)
• DOCS
  • Update documentation to explain which projects allow Gitea to host static pages (#23993) (#24058)
  • Merge push to create, open PR from push, and push options docs articles into one (#23744) (#23959)
  • Fix code blocks in the cheat sheet (#23664) (#23669)
• MISC
  • Do not crash when parsing an invalid workflow file (#23972) (#23976)
  • Remove assertion debug code for show/hide refactoring (#23576) (#23868)
  • Add ONLY_SHOW_RELEVANT_REPOS back, fix explore page bug, make code more strict (#23766) (#23791)
  • Make minio package support legacy MD5 checksum (#23768) (#23770)
  • Improve template error reporting (#23396) (#23600)