v1.21.11

• SECURITY
  • Use go1.21.9 to include Golang security fix
  • Fix possible renderer security problem (#30136) (#30315)
  • Performance optimization for git push and check permissions for push options (#30104) (#30354)
• BUGFIXES
  • Fix close file in the Upload func (#30262) (#30269)
  • Fix inline math blocks can't be preceeded/followed by alphanumerical characters (#30175) (#30250)
  • Fix missing 0 prefix of GPG key id (#30245) (#30247)
  • Include encoding in signature payload (#30174) (#30181)
  • Move from max( id ) to max( index ) for latest commit statuses (#30076) (#30155)
  • Load attachments for code comments (#30124) (#30126)
  • Fix gitea doctor will remove repo-avatar files when executing command storage-archives (#30094) (#30120)
  • Fix possible data race on tests (#30093) (#30108)
  • Fix duplicate migrated milestones (#30102) (#30105)
  • Fix panic for fixBrokenRepoUnits16961 (#30068) (#30100)
  • Fix incorrect SVGs (#30087) (#30086)
  • Fix create commit status (#30225) (#30340)
  • Fix misuse of unsupported global variables (#30402)
  • Fix to delete the cookie when AppSubURL is non-empty (#30375) (#30468)
  • Avoid user does not exist error when detecting schedule actions when the commit author is an external user (#30357) (#30408)
  • Change the default maxPerPage for gitbucket (#30392) (#30471)
  • Check the token's owner and repository when registering a runner (#30406) (#30412)
  • Avoid losing token when updating mirror settings (#30429) (#30466)
  • Fix commit status cache which missed target_url (#30426) (#30445)
  • Fix rename branch 500 when the target branch is deleted but exist in database (#30430) (#30437)
  • Fix mirror error when mirror repo is empty (#30432) (#30467)
  • Use db.ListOptions directly instead of Paginator interface to make it easier to use and fix performance of /pulls and /issues (#29990) (#30447)
  • Fix code owners will not be mentioned when a pull request comes from a forked repository (#30476) (#30497)
• DOCS
  • Update actions variables documents (#30394) (#30405)
• MISC
  • Update katex to 0.16.10 (#30089)
  • Upgrade go-sqlite to v1.14.22 (#30462)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.10

• BUGFIXES
  • Fix Add/Remove WIP on pull request title failure (#29999) (#30066)
  • Fix misuse of TxContext (#30061) (#30062)
  • Respect DEFAULT_ORG_MEMBER_VISIBLE setting when adding creator to org (#30013) (#30035)
• MISC
  • Escape paths for find file correctly (#30026) (#30031)
  • Remove duplicate option in admin screen and now-unused translation keys (#28492) (#30024)
  • Fix manual merge form and 404 page templates (#30000)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.9

• PERFORMANCE
  • Only do counting when count_only=true for repo dashboard (#29884) (#29905)
  • Add cache for dashboard commit status (#29932)
• ENHANCEMENT
  • Make runs-on support variable expression (#29468) (#29782)
  • Show Actions post step when it's running (#29926) (#29928)
• BUGFIXES
  • Fix PR creation via API between branches of the same repo with head field namespaced (#26986) (#29857)
  • Fix and rewrite markup anchor processing (#29931) (#29946)
  • Notify reviewers added via CODEOWNERS (#29842) (#29902)
  • Fix template error when comment review doesn't exist (#29888) (#29889)
  • Fix user id column case (#29863) (#29867)
  • Make meilisearch do exact search for issues (#29740 & #29671) (#29846)
  • Fix the for attribute not pointing to the ID of the color picker (#29813) (#29815)
  • Fix codeowner detected diff base branch to mergebase (#29783) (#29807)
  • Fix Safari spinner rendering (#29801) (#29802)
  • Fix missing translation on milestones (#29785) (#29789)
  • Fix user router possible panic (#29751) (#29786)
  • Fix possible NPE in ToPullReviewList (#29759) (#29775)
  • Fix the wrong default value of ENABLE_OPENID_SIGNIN on docs (#29925) (#29927)
  • Solving the issue of UI disruption when the review is deleted without refreshing (#29951) (#29968)
  • Fix loadOneBranch panic (#29938) (#29939)
  • Fix invalid link of the commit status when ref is tagged (#29752) (#29908)
  • Editor error message misleading due to re-used key. (#29859) (#29876)
  • Fix double border and border-radius on empty action steps (#29845) (#29850)
  • Use Temporal.PlainDate for absolute dates (#29804) (#29808)
  • Fix incorrect package link method calls in templates (#29580) (#29764)
  • Fix the bug that the user may log out if GetUserByID returns unknown error (#29962) (#29964)
  • Performance improvements for pull request list page (#29900) (#29972)
  • Fix bugs in rerunning jobs (#29983) (#29955)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.8

• KNOWN ISSUES
  • Browsing "packages" pages might cause 500 error, it could be fixed by updating to 1.21.9:
• SECURITY
  • Only use supported sort orders for "/explore/users" page (#29430) (#29443)
• ENHANCEMENTS
  • Fix wrong line number in code search result (#29260) (#29623)
• BUGFIXES
  • Use Get but not Post to get actions artifacts (#29734) (#29737)
  • Fix inconsistent rendering of block mathematical expressions (#29677) (#29711)
  • Fix rendering internal file links in org (#29669) (#29705)
  • Don't show AbortErrors on logout (#29639) (#29667)
  • Fix user-defined markup links targets (#29305) (#29666)
  • Fix incorrect rendering csv file when file size is larger than UI.CSV.MaxFileSize (#29653) (#29663)
  • Fix hidden test's failure (#29254) (#29662)
  • Add empty repo check-in DetectAndHandleSchedules (#29606) (#29659)
  • Fix 500 when deleting an account with an incorrect password or unsupported login type (#29579) (#29656)
  • Use strict protocol check when redirect (#29642) (#29644)
  • Avoid issue info panic (#29625) (#29632)
  • Avoid unexpected panic in graceful manager (#29629) (#29630)
  • Make "/user/login" page redirect if the current user has signed in (#29583) (#29599)
  • Fix workflow trigger event IssueChangeXXX bug (#29559) (#29565)
  • Fix incorrect cookie path for AppSubURL (#29534) (#29552)
  • Fix queue worker incorrectly stopped when there are still more items in the queue (#29532) (#29546)
  • Fix incorrect redirection when creating a PR fails (#29537) (#29543)
  • Fix incorrect subpath in links (#29535) (#29541)
  • Fix issue link does not support quotes (#29484) (#29487) (#29536)
  • Fix issue & comment history bugs (#29525) (#29527)
  • Set pre-step status to skipped if the job is skipped (#29489) (#29523)
  • Fix/Improve processWindowErrorEvent (#29407) (#29480)
  • Fix counter display number incorrectly displayed on the page (#29448) (#29478)
  • Fix workflow trigger event bugs (#29467) (#29475)
  • Fix URL calculation in the clone input box (#29470) (#29473)
  • The job should always run when if is always() (#29464) (#29469)
  • Fix template bug (#27581) (#29446)
  • Not trigger all jobs anymore when re-running the first job (#29439) (#29441)
  • Ignore empty repo for CreateRepository in action notifier (#29416) (#29424)
  • Fix incorrect tree path value for patch editor (#29377) (#29421)
  • Add missing database transaction for new issues (#29490) (#29607)
  • Fix 500 when pushing release to an empty repo (#29554) (#29564)
  • Fix incorrect relative/absolute URL usages (#29531) (#29547)
  • Fix wrong test usage of AppSubURL (#29459) (#29488)
  • Fix missed return (#29450) (#29453)
  • Fixing the issue when status checks per rule matches multiple actions (#29631) (#29655)
  • Improve contrast on blame timestamp, fix double border (#29482) (#29485)

v1.21.7

• ENHANCEMENTS
  • Users with read permission of pull requests can be assigned too (#27263) (#29372)
• BUGFIXES
  • Do not double close reader (#29354) (#29370)
  • Display friendly error message (#29105) (#29363)
  • Fix project counter in organization/individual profile (#28068) (#29361)
  • Fix validity of the FROM email address not being checked (#29347) (#29360)
  • Fix tarball/zipball download bug (#29342) (#29352)
• DOCS
  • Docker Tag Information in Docs (#29047) (#29362)
• MISC
  • Enforce maxlength in frontend (#29389) (#29396)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.6

• SECURITY
  • Fix XSS vulnerabilities (#29336)
  • Use general token signing secret (#29205) (#29325)
• ENHANCEMENTS
  • Refactor git version functions and check compatibility (#29155) (#29157)
  • Improve user experience for outdated comments (#29050) (#29086)
  • Hide code links on release page if user cannot read code (#29064) (#29066)
  • Wrap contained tags and branches again (#29021) (#29026)
  • Fix incorrect button CSS usages (#29015) (#29023)
  • Strip trailing newline in markdown code copy (#29019) (#29022)
  • Implement some action notifier functions (#29173) (#29308)
  • Load outdated comments when (un)resolving conversation on PR timeline (#29203) (#29221)
• BUGFIXES
  • Refactor issue template parsing and fix API endpoint (#29069) (#29140)
  • Fix swift packages not resolving (#29095) (#29102)
  • Remove SSH workaround (#27893) (#29332)
  • Only log error when tag sync fails (#29295) (#29327)
  • Fix SSPI user creation (#28948) (#29323)
  • Improve the issue_comment workflow trigger event (#29277) (#29322)
  • Discard unread data of git cat-file (#29297) (#29310)
  • Fix error display when merging PRs (#29288) (#29309)
  • Prevent double use of git cat-file session. (#29298) (#29301)
  • Fix missing link on outgoing new release notifications (#29079) (#29300)
  • Fix debian InRelease Acquire-By-Hash newline (#29204) (#29299)
  • Always write proc-receive hook for all git versions (#29287) (#29291)
  • Do not show delete button when time tracker is disabled (#29257) (#29279)
  • Workaround to clean up old reviews on creating a new one (#28554) (#29264)
  • Fix bug when the linked account was disactived and list the linked accounts (#29263)
  • Do not use lower tag names to find releases/tags (#29261) (#29262)
  • Fix missed edit issues event for actions (#29237) (#29251)
  • Only delete scheduled workflows when needed (#29091) (#29235)
  • Make submit event code work with both jQuery event and native event (#29223) (#29234)
  • Fix push to create with capitalize repo name (#29090) (#29206)
  • Use ghost user if user was not found (#29161) (#29169)
  • Dont load Review if Comment is CommentTypeReviewRequest (#28551) (#29160)
  • Refactor parseSignatureFromCommitLine (#29054) (#29108)
  • Avoid showing unnecessary JS errors when there are elements with different origin on the page (#29081) (#29089)
  • Fix gitea-origin-url with default ports (#29085) (#29088)
  • Fix orgmode link resolving (#29024) (#29076)
  • Fix: Elasticsearch: Request Entity Too Large #28117 (#29062) (#29075)
  • Do not render empty comments (#29039) (#29049)
  • Avoid sending update/delete release notice when it is draft (#29008) (#29025)
  • Fix gitea-action user avatar broken on edited menu (#29190) (#29307)
  • Disallow merge when required checked are missing (#29143) (#29268)
  • Fix incorrect link to swift doc and swift package-registry login command (#29096) (#29103)
• DOCS
  • Rm outdated docs from some languages (#27530) (#29208)
  • Fix typos in the documentation (#29048) (#29056)
  • Explained where create issue/PR template (#29035)
• MISC
  • Convert visibility to number (#29226) (#29244)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.5

• SECURITY
  • Prevent anonymous container access if RequireSignInView is enabled (#28877) (#28882)
  • Update go dependencies and fix go-git (#28893) (#28934)
• BUGFIXES
  • Revert "Speed up loading the dashboard on mysql/mariadb (#28546)" (#29006) (#29007)
  • Fix an actions schedule bug (#28942) (#28999)
  • Fix update enable_prune even if mirror_interval is not provided (#28905) (#28929)
  • Fix uploaded artifacts should be overwritten (#28726) backport v1.21 (#28832)
  • Preserve BOM in web editor (#28935) (#28959)
  • Strip / from relative links (#28932) (#28952)
  • Don't remove all mirror repository's releases when mirroring (#28817) (#28939)
  • Implement MigrateRepository for the actions notifier (#28920) (#28923)
  • Respect branch info for relative links (#28909) (#28922)
  • Don't reload timeline page when (un)resolving or replying conversation (#28654) (#28917)
  • Only migrate the first 255 chars of a Github issue title (#28902) (#28912)
  • Fix sort bug on repository issues list (#28897) (#28901)
  • Fix DeleteCollaboration transaction behaviour (#28886) (#28889)
  • Fix schedule not trigger bug because matching full ref name with short ref name (#28874) (#28888)
  • Fix migrate storage bug (#28830) (#28867)
  • Fix archive creating LFS hooks and breaking pull requests (#28848) (#28851)
  • Fix reverting a merge commit failing (#28794) (#28825)
  • Upgrade xorm to v1.3.7 to fix a resource leak problem caused by Iterate (#28891) (#28895)
  • Fix incorrect PostgreSQL connection string for Unix sockets (#28865) (#28870)
• ENHANCEMENTS
  • Make loading animation less aggressive (#28955) (#28956)
  • Avoid duplicate JS error messages on UI (#28873) (#28881)
  • Bump @github/relative-time-element to 4.3.1 (#28819) (#28826)
• MISC
  • Warn that DISABLE_QUERY_AUTH_TOKEN is false only if it's explicitly defined (#28783) (#28868)
  • Remove duplicated checkinit on git module (#28824) (#28831)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.4

• SECURITY
  • Update github.com/cloudflare/circl (#28789) (#28790)
  • Require token for GET subscription endpoint (#28765) (#28768)
• BUGFIXES
  • Use refname:strip-2 instead of refname:short when syncing tags (#28797) (#28811)
  • Fix links in issue card (#28806) (#28807)
  • Fix nil pointer panic when exec some gitea cli command (#28791) (#28795)
  • Require token for GET subscription endpoint (#28765) (#28778)
  • Fix button size in "attached header right" (#28770) (#28774)
  • Fix convert.ToTeams on empty input (#28426) (#28767)
  • Hide code related setting options in repository when code unit is disabled (#28631) (#28749)
  • Fix incorrect URL for "Reference in New Issue" (#28716) (#28723)
  • Fix panic when parsing empty pgsql host (#28708) (#28709)
  • Upgrade xorm to new version which supported update join for all supported databases (#28590) (#28668)
  • Fix alpine package files are not rebuilt (#28638) (#28665)
  • Avoid cycle-redirecting user/login page (#28636) (#28658)
  • Fix empty ref for cron workflow runs (#28640) (#28647)
  • Remove unnecessary syncbranchToDB with tests (#28624) (#28629)
  • Use known issue IID to generate new PR index number when migrating from GitLab (#28616) (#28618)
  • Fix flex container width (#28603) (#28605)
  • Fix the scroll behavior for emoji/mention list (#28597) (#28601)
  • Fix wrong due date rendering in issue list page (#28588) (#28591)
  • Fix status_check_contexts matching bug (#28582) (#28589)
  • Fix 500 error of searching commits (#28576) (#28579)
  • Use information from previous blame parts (#28572) (#28577)
  • Update mermaid for 1.21 (#28571)
  • Fix 405 method not allowed CORS / OIDC (#28583) (#28586) (#28587) (#28611)
  • Fix GetCommitStatuses (#28787) (#28804)
  • Forbid removing the last admin user (#28337) (#28793)
  • Fix schedule tasks bugs (#28691) (#28780)
  • Fix issue dependencies (#27736) (#28776)
  • Fix system webhooks API bug (#28531) (#28666)
  • Fix when private user following user, private user will not be counted in his own view (#28037) (#28792)
  • Render code block in activity tab (#28816) (#28818)
• ENHANCEMENTS
  • Rework markup link rendering (#26745) (#28803)
  • Modernize merge button (#28140) (#28786)
  • Speed up loading the dashboard on mysql/mariadb (#28546) (#28784)
  • Assign pull request to project during creation (#28227) (#28775)
  • Show description as tooltip instead of title for labels (#28754) (#28766)
  • Make template DateTime show proper tooltip (#28677) (#28683)
  • Switch destination directory for apt signing keys (#28639) (#28642)
  • Include heap pprof in diagnosis report to help debugging memory leaks (#28596) (#28599)
• DOCS
  • Suggest to use Type=simple for systemd service (#28717) (#28722)
  • Extend description for ARTIFACT_RETENTION_DAYS (#28626) (#28630)
• MISC
  • Add -F to commit search to treat keywords as strings (#28744) (#28748)
  • Add download attribute to release attachments (#28739) (#28740)
  • Concatenate error in checkIfPRContentChanged (#28731) (#28737)
  • Improve 1.21 document for Database Preparation (#28643) (#28644)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.3

• SECURITY
  • Update golang.org/x/crypto (#28519)
• API
  • chore(api): support ignore password if login source type is LDAP for creating user API (#28491) (#28525)
  • Add endpoint for not implemented Docker auth (#28457) (#28462)
• ENHANCEMENTS
  • Add option to disable ambiguous unicode characters detection (#28454) (#28499)
  • Refactor SSH clone URL generation code (#28421) (#28480)
  • Polyfill SubmitEvent for PaleMoon (#28441) (#28478)
• BUGFIXES
  • Fix the issue ref rendering for wiki (#28556) (#28559)
  • Fix duplicate ID when deleting repo (#28520) (#28528)
  • Only check online runner when detecting matching runners in workflows (#28286) (#28512)
  • Initalize stroage for orphaned repository doctor (#28487) (#28490)
  • Fix possible nil pointer access (#28428) (#28440)
  • Don't show unnecessary citation JS error on UI (#28433) (#28437)
• DOCS
  • Update actions document about comparsion as Github Actions (#28560) (#28564)
  • Fix documents for "custom/public/assets/" (#28465) (#28467)
• MISC
  • Fix inperformant query on retrifing review from database. (#28552) (#28562)
  • Improve the prompt for "ssh-keygen sign" (#28509) (#28510)
  • Update docs for DISABLE_QUERY_AUTH_TOKEN (#28485) (#28488)
  • Fix Chinese translation of config cheat sheet[API] (#28472) (#28473)
  • Retry SSH key verification with additional CRLF if it failed (#28392) (#28464)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

v1.21.2

• SECURITY
  • Rebuild with recently released golang version
  • Fix missing check (#28406) (#28411)
  • Do some missing checks (#28423) (#28432)
• BUGFIXES
  • Fix margin in server signed signature verification view (#28379) (#28381)
  • Fix object does not exist error when checking citation file (#28314) (#28369)
  • Use filepath instead of path to create SQLite3 database file (#28374) (#28378)
  • Fix the runs will not be displayed bug when the main branch have no workflows but other branches have (#28359) (#28365)
  • Handle repository.size column being NULL in migration v263 (#28336) (#28363)
  • Convert git commit summary to valid UTF8. (#28356) (#28358)
  • Fix migration panic due to an empty review comment diff (#28334) (#28362)
  • Add HEAD support for rpm repo files (#28309) (#28360)
  • Fix RPM/Debian signature key creation (#28352) (#28353)
  • Keep profile tab when clicking on Language (#28320) (#28331)
  • Fix missing issue search index update when changing status (#28325) (#28330)
  • Fix wrong link in protect_branch_name_pattern_desc (#28313) (#28315)
  • Read previous info from git blame (#28306) (#28310)
  • Ignore "non-existing" errors when getDirectorySize calculates the size (#28276) (#28285)
  • Use appSubUrl for OAuth2 callback URL tip (#28266) (#28275)
  • Meilisearch: require all query terms to be matched (#28293) (#28296)
  • Fix required error for token name (#28267) (#28284)
  • Fix issue will be detected as pull request when checking First-time contributor (#28237) (#28271)
  • Use full width for project boards (#28225) (#28245)
  • Increase "version" when update the setting value to a same value as before (#28243) (#28244)
  • Also sync DB branches on push if necessary (#28361) (#28403)
  • Make gogit Repository.GetBranchNames consistent (#28348) (#28386)
  • Recover from panic in cron task (#28409) (#28425)
  • Deprecate query string auth tokens (#28390) (#28430)
• ENHANCEMENTS
  • Improve doctor cli behavior (#28422) (#28424)
  • Fix margin in server signed signature verification view (#28379) (#28381)
  • Refactor template empty checks (#28351) (#28354)
  • Read previous info from git blame (#28306) (#28310)
  • Use full width for project boards (#28225) (#28245)
  • Enable system users search via the API (#28013) (#28018)