What go-gitea/gitea shipped
Written by FoxPlug from the repository's own releases; not affiliated with Gitea. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/go-gitea/gitea; Gitea did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Added a private Terraform module registry package type so terraform init and Terragrunt tfr:// can resolve modules from the project. Pull request #38040
- Limited failed TOTP attempts to 5 per account, after which TOTP is refused until 15 minutes after the last failed attempt. Pull request #39993
- Stopped pull mirror credentials from being reused when the mirror address changes to a new host. Pull request #39991
- Enforced user blocks on pull request reviews, code comments and replies through web, API and email. Pull request #40194
- Added a Set as Latest Release option and GitHub's
make_latestfield so the latest release can be chosen explicitly. Pull request #40214 - Truncated strings on character boundaries so team descriptions and other stored fields no longer cut multi-byte characters into invalid UTF-8. Pull request #40267
- Added a unique index on team
org_idandlower_nameso concurrent requests can no longer create duplicate team names. Pull request #40228 - Recognized issue references next to non-ASCII characters such as CJK punctuation, creating links and cross references where none were made before. Pull request #40097
- Created a commit status for
workflow_dispatchruns so the commit shows that a workflow ran on it. Pull request #39961 - Removed the repository adopt feature, which assumed a fixed repository storage path on disk. Pull request #40181
Why it matters
This week closed several security gaps: TOTP guessing, pull mirror credential reuse, missing user block checks on reviews, and duplicate team names. It also added a Terraform module registry, explicit latest release selection, and better handling of CJK issue references and multi-byte text. Two obsolete features were removed: repository adopt and the OpenID 2.0 draft.
Changelog entry
- Add private Terraform module registry package type Pull request #38040
- Limit failed TOTP attempts per account Pull request #39993
- Do not reuse pull mirror credentials for a new host Pull request #39991
- Enforce user blocks on pull request reviews Pull request #40194
- Allow setting a release as the latest Pull request #40214
- Truncate strings on character boundaries Pull request #40267
- Enforce unique team names in the database Pull request #40228
- Recognize issue references next to CJK punctuation Pull request #40097
- Create commit status for
workflow_dispatchruns Pull request #39961 - Remove repository adopt feature Pull request #40181
- Remove support for obsolete OpenID 2.0 draft Pull request #40231
- Support JPEG XL images Pull request #40283
This week: a Terraform module registry package type, failed TOTP attempts limited per account, pull mirror credentials no longer reused on a new host, user blocks enforced on reviews, and an explicit Set as Latest Release option. The repository adopt feature and OpenID 2.0 suppor
This week's changes include a private Terraform module registry package type, so terraform init and Terragrunt tfr:// can resolve modules from the project, and an explicit Set as Latest Release option with GitHub's make_latest field. Security and correctness fixes landed too: failed TOTP attempts are limited to 5 per account, pull mirror credentials are no longer reused when the address points at a new host, user blocks are enforced on pull request reviews and code comments, and team names are unique in the database. Issue references next to CJK punctuation now link. The repository adopt feature and OpenID 2.0 draft support were removed.
Week of October 26, 2026
What shipped
- Added migration from bitbucket.org as the Cloud variant of the Bitbucket entry, available in the web UI and via the migrate API with service=bitbucket, covering the repository and pull requests with their comments and reviews. Pull request #38607
- Added read:commitstatus and write:commitstatus token scopes so CI and other integrations can report commit statuses without a token that grants full repository access. Pull request #40144
- The API now rejects pull requests between branches without a common history again, returning 400, matching the web form. Pull request #39872
- With
oauth2_clientaccount linking set to auto, the external identity is now only linked to the existing account it points to, rather than any account matching the submitted user name or email. Pull request #40137 - Deleting a push mirror through the API now also removes the
remote_mirrorgit remotes, which embed the mirror credentials, from the repository and wiki config. Pull request #40049 - With the built-in SSH server, pushes now finish when the client disconnects early, so branches, pull requests, webhooks and Actions are still updated. Pull request #40105
- Moving a card on a project board requires project write again, as repository boards already show every card to project writers. Pull request #40161
- Project board cards no longer show linked pull requests the viewer cannot read, including private pull requests mentioning a public issue. Pull request #40134
- The repository clone panel offers gt repo clone under a Gitea CLI tab, and the built-in OAuth2 application is renamed from tea to gitea-cli. Pull request #40036
- Gitea admin user list and the admin users API now include bot users, matching the admin web UI. Pull request #40147
Why it matters
This week's changes tighten permissions around projects, OAuth2 auto-linking and context user access, while fixing pushes that could be lost or leave branches stale. Users also get a Bitbucket Cloud migration, narrower commit status token scopes and faster repository issue and pull request lists.
Changelog entry
- Add repository migration from bitbucket.org in the web UI and the migrate API, with pull requests, comments and reviews. Pull request #38607
- Add read:commitstatus and write:commitstatus token scopes for the commit status endpoints. Pull request #40144
- Reject pull requests without a common history in the API and crafted compare POSTs. Pull request #39872
- Only auto-link the account an external identity points to when account linking is set to auto. Pull request #40137
- Only auto-link the account an external identity points to when account linking is set to auto. Pull request #40121
- Remove the
remote_mirrorgit remotes when deleting a push mirror through the API. Pull request #40049 - Let SSH pushes finish when the client disconnects early so post-receive updates run. Pull request #40105
- Require only project write to move project board cards. Pull request #40161
- Hide linked pull requests on project boards from viewers who cannot read them. Pull request #40134
- Replace tea with gt, adding a Gitea CLI tab to the clone panel and renaming the built-in OAuth2 application. Pull request #40036
- List bot users in gitea admin user list and the admin users API. Pull request #40147
- Release the contributor stats lock after a failed generation instead of getting stuck. Pull request #40156
This week: Bitbucket Cloud migration, new commitstatus token scopes, pull requests without common history rejected again, safer OAuth2 auto-linking, project board permissions fixed, and pushes that finish even if the SSH client disconnects early.
This week's changes to the project: repository migration from bitbucket.org is available in the web UI and the migrate API, covering pull requests with their comments and reviews. New read:commitstatus and write:commitstatus token scopes let CI report commit statuses without full repository access. The API rejects pull requests between branches without a common history, OAuth2 auto-linking only links the account an external identity points to, and deleting a push mirror through the API now removes the stored git remotes and their credentials. Project board card moves require project write again, boards hide linked pull requests the viewer cannot read, and built-in SSH pushes finish when the client disconnects early.
Week of October 19, 2026
What shipped
- Added REST API endpoints for repository webhook delivery history, so request and response data, status and timestamp can be fetched programmatically instead of only through the repo settings UI. Pull request #38775
- Added migration from Bitbucket Server (Data Center), including git data with tags and LFS, and pull requests with state, draft flag, merge commit and base, comments, approvals and inline code comments for resolved threads. Pull request #39913
- Added a batched GraphQL path for GitHub migrations that fetches each issue or pull request with its comments, reviews, reactions and timeline events instead of the REST N+1 pattern, reducing rate-limit pressure on large repositories. Pull request #38694
- Improved Gitea-compatible forge migrations, supporting Forgejo-style sources and fixing bugs with pre-release and suffixed server versions, review states, dismissals, scoped and archived labels, merge bases and disabled units. Pull request #39424
- Added project workflows that let users configure event-based automations with filters and actions from the UI, and duplicate existing events when needed. Pull request #30205
- Cached successful runner token verification so Actions runner RPCs no longer spend most of their CPU on repeated PBKDF2 hashing on instances with many runners. Pull request #39934
- Replaced the unmaintained chi-middleware/proxy with an in-tree handler that handles repeated header lines, comma-separated proxy hops and ip:port values when detecting client IPs behind reverse proxies. Pull request #39190
- Fixed the file view, blame and web editor to use the viewed ref's editorconfig instead of the default branch, so branch-specific settings like tab width apply. Pull request #39973
- Fixed a 500 on the compare page when rendering diffs of renamed files by loading both blobs. Pull request #39969
- Bounded requested artifact retention so an
expires_atfrom upload-artifact v4 or later computed on a runner clock cannot make artifacts expire too early or outlive ARTIFACT_RETENTION_DAYS. Pull request #39894
Why it matters
This week brings migration support for Bitbucket Server alongside faster and more resilient GitHub and Gitea-compatible migrations, which matters to teams moving large repositories in. Webhook delivery history is now reachable through the API, and project workflows add event-based automation from the UI. Several fixes also address diffs of renamed files, editorconfig per branch, runner token verification CPU and artifact retention.
Changelog entry
- Add REST API endpoints for repository webhook delivery history. Pull request #38775
- Add migration from Bitbucket Server (Data Center), including git data, tags, LFS and pull requests with comments and approvals. Pull request #39913
- Use a batched GraphQL path for GitHub migrations to reduce rate-limit pressure. Pull request #38694
- Improve Gitea-compatible forge migrations and fix review, label and merge base migration bugs. Pull request #39424
- Allow automatic project actions on events through configurable workflows. Pull request #30205
- Cache successful runner token verification to reduce CPU use on instances with many runners. Pull request #39934
- Parse and validate forwarded client IPs behind reverse proxies in an in-tree handler. Pull request #39190
- Use the viewed ref's editorconfig in the file view, blame and web editor. Pull request #39973
- Load both blobs of renamed files so diff rendering no longer returns 500. Pull request #39969
- Bound requested artifact retention sent by upload-artifact v4 and later. Pull request #39894
- Attach only the repo label, not both repo and org labels, when adding issue labels by name that collide. Pull request #39873
- Hide release notes in the tags feed for users without releases read access. Pull request #39944
This week: Bitbucket Server migration arrives, GitHub and Gitea-compatible migrations get faster, webhook delivery history gets REST endpoints, and project workflows let you automate on events. Plus fixes for renamed-file diffs, per-branch editorconfig and artifact retention.
This week in Gitea: Migration from Bitbucket Server (Data Center) is now supported, including git data with tags and LFS, and pull requests with comments, approvals and inline code comments. GitHub migrations gained a batched GraphQL path that cuts rate-limit pressure on large repositories, and Gitea-compatible forge migrations were improved with many bug fixes. Webhook delivery history is now available through two REST API endpoints, so delivery request and response data can be fetched for debugging integrations or auditing. Project workflows add event-based automations configured from the UI. Also fixed: diffs of renamed files no longer fail on the compare page, the file view and editor use the viewed ref's editorconfig, successful runner token verification is cached, and requested artif
Week of October 12, 2026
What shipped
- Gitea Actions now supports OpenID Connect workload identity, letting jobs that declare id-token write request short-lived tokens instead of storing cloud credentials. Pull request #39052
- Fixed a WebAuthn validation problem that made security-key and passkey sign-ins from Safari on iOS fail with a 403 since 28.0.0. Pull request #39792
- Pull requests whose recorded merge commit never reached the base repository can now be recovered instead of leaving a missing commit reference. Pull request #39831
- Incoming email reply tokens are now rejected for accounts that are deactivated or blocked from signing in. Pull request #39833
- Custom repository watches can now bypass the only email on mention restriction, and the setting was renamed to Only Email on Mention and Custom Watches. Pull request #39652
- Empty pull requests are no longer auto-detected as manually merged when autodetect manual merge is enabled. Pull request #39807
- The new issue and new pull request pages can prefill labels, milestone, project and assignee from query parameters. Pull request #39804
- The CRAN PACKAGES index now lists the highest version of each package instead of the most recently uploaded one. Pull request #39793
- Fixed a webhook panic caused by indexing an empty assignee list when formatting assigned issue and pull request payloads. Pull request #39827
- A builtin OAuth2 application for the gitea-vscode extension is now pre-registered, avoiding grant scope conflicts for users who already signed in with the tea CLI. Pull request #39785
Why it matters
This week brought a new capability for Actions jobs that need cloud credentials without stored secrets, and closed a sign-in failure that affected Safari users on iOS. It also fixed several correctness problems in pull request merging, email notifications and package listings that people would hit during normal work.
Changelog entry
- Add OpenID Connect workload identity support to Gitea Actions Pull request #39052
- Accept unsolicited client extension outputs from WebKit clients so Safari on iOS passkey and security-key sign-in works Pull request #39792
- Recover pull requests whose recorded merge commit never reached the base repository Pull request #39831
- Reject incoming email tokens of users who cannot sign in Pull request #39833
- Allow custom watches to bypass the on-mention email restriction and rename the setting Pull request #39652
- Do not auto-detect empty pull requests as manually merged Pull request #39807
- Prefill new issue and pull request sidebars from query parameters Pull request #39804
- List the highest CRAN version in the PACKAGES index Pull request #39793
- Avoid an index out-of-range panic in webhook assignee formatting Pull request #39827
- Pre-register a builtin OAuth2 application for gitea-vscode Pull request #39785
- Bound memory used when parsing uploaded packages Pull request #39366
- Batch per-row queries in Actions run, job and cancellation paths Pull request #39723
This week: OpenID Connect workload identity for Actions jobs, WebAuthn sign-in fixed for Safari on iOS, recovery for pull requests with missing merge commits, and email reply tokens rejected for suspended accounts.
This week's changes in Gitea: Actions jobs can now use OpenID Connect workload identity to get short-lived tokens instead of stored secrets. Security-key and passkey sign-in from Safari on iOS works again. Pull requests whose merge commit never reached the base repository can be recovered, incoming email tokens are rejected for accounts that cannot sign in, custom watches can bypass the email-on-mention restriction, and the CRAN PACKAGES index now lists each package's highest version. The new issue pages also accept query parameters for labels, milestone, project and assignee.
Week of October 5, 2026
What shipped
- Released version v28.1.0 with npm client compatibility improvements and numerous bug fixes across actions, markup, and packages. Release
- Left reflog expiry to git's defaults, fixing an issue where Gitea's default gc.reflogExpire was misparsed and reachable reflog entries never expired. Pull request #39703
- Fixed git config value matching during sync to be exact, preventing startup failures and unintended removal of values like 90.days. Pull request #39728
- Hardened Actions log cursor, activity type filters, and actor filter handling to prevent panics and 500 errors from out-of-range or malformed input. Pull request #39721
- Fixed cancelled reusable workflow runs that remained stuck in the cancelling state, ensuring they settle correctly. Pull request #39706
- Removed the unsupported
id_tokenresponse type from the OIDC discovery document, aligning it with the implemented authorization code flow. Pull request #39498 - Fixed go get clone URL for SSH on the default port, using the ssh:// form so go-import meta tags are accepted. Pull request #39674
- Preserved line breaks in Telegram rich messages so multi-line issue and PR bodies, comments, and commit lists arrive correctly. Pull request #39650
- Added margin to display MathML to provide spacing below it, similar to KaTeX-rendered math. Pull request #39663
- Introduced global shortcut support that can be added to elements via data-shortcut-keys. Pull request #39604
Why it matters
This week brought a new release and important fixes for git configuration, Actions reliability, and OIDC discovery, along with improvements to markdown rendering and webhook messaging. Users benefit from fewer startup failures, more robust workflow handling, and corrected behavior in go get and Telegram notifications.
Changelog entry
- Release: v28.1.0 Release
- Fix(git): leave reflog expiry to git's defaults Pull request #39703
- Fix(git): match git config values exactly when syncing Pull request #39728
- Fix(actions): harden log cursor, activity type and actor filter handling Pull request #39721
- Fix(actions): settle cancelled reusable workflow runs stuck in cancelling Pull request #39706
- Fix: OIDC discovery advertises unsupported
id_tokenresponse_typePull request #39498 - Fix: go get fails with GO_GET_CLONE_URL_PROTOCOL=ssh on the default SSH port Pull request #39674
- Fix(webhook): keep line breaks in Telegram rich messages Pull request #39650
- Fix(markup): display MathML has no space below it Pull request #39663
- Feat: global shortcut support Pull request #39604
- Ci: reject breaking marker on non-breaking PR types Pull request #39584
- Fix(build): use the VERSION file consistently in docker builds and source tarballs Pull request #39683
Gitea v28.1.0 released with npm client compatibility and many bug fixes. Also fixed git config sync, Actions log cursors, stuck reusable workflows, OIDC discovery, and more. Update for a smoother experience.
Gitea v28.1.0 is now available, including enhanced npm client compatibility and a range of bug fixes. This week we addressed critical issues in git config synchronization, Actions workflow reliability, and OIDC discovery. We also improved markdown rendering for MathML, preserved line breaks in Telegram messages, and fixed go get over SSH on the default port. These changes help ensure a more stable and predictable experience for self-hosted Gitea installations.
Week of September 28, 2026
What shipped
- Minimum git version raised to 2.34, enabling AGit by default and removing fallbacks for older versions. Pull request #39565
- Go-git backend removed, consolidating all builds to use the git CLI backend. Pull request #39487
- Citation rendering moved server-side with a Go port replacing citation-js, supporting APA and BibTeX formats. Pull request #39373
- CITATION.cff rendering optimized to skip files over 256 KiB that consume excessive memory. Pull request #39575
- Session management refactored by moving go-chi/session into modules/session for direct bug fixes. Pull request #39504
- Cache implementation moved from go-chi/cache into modules/cache with TTL and Redis adapter improvements. Pull request #39530
- Actions API filtering by
head_shanow indexed oncommit_sha, reducing query time from 35-52 seconds to 0.14 seconds. Pull request #39559 - Label sorting corrected to use open issue count instead of total including closed issues. Pull request #39464
- Actions token permissions restored for pushes to protected branches. Pull request #39567
- HTTP caching fixed to respect RFC 9110 when both ETag and If-Modified-Since headers are present. Pull request #39435
Why it matters
This week includes foundational changes to git compatibility and backend infrastructure. The removal of the go-git backend and raising minimum git version to 2.34 simplifies the codebase while three module refactorings bring commonly-used packages under direct maintenance. Performance improvements to actions and citations address real-world usage patterns.
Changelog entry
- BREAKING: Minimum git version raised to 2.34. AGit now always enabled, diff --skip-to and apply -3 used unconditionally, default branch set via git init --initial-branch. Pull request #39565
- BREAKING: Go-git backend removed. All builds now use git CLI backend exclusively. Pull request #39487
- Citations now render server-side as APA and BibTeX, replacing citation-js and matching GitHub output on 1568 of 1571 real-world CITATION.cff files. Pull request #39373
- CITATION.cff files over 256 KiB are skipped to prevent excessive memory usage during rendering. Pull request #39575
- Actions API
head_shafilter now uses index oncommit_sha, reducing query times from 35-52 seconds to 0.14 seconds. Pull request #39559 - Session management moved from go-chi/session into modules/session. Sessions only written when changed, preventing reversions on read-only requests. Pull request #39504
- Cache implementation moved from go-chi/cache into modules/cache. Two-queue in-memory cache replaces MacaronCache hash. Pull request #39530
- Image captcha moved from go-chi/captcha into modules/imagecaptcha. Expired challenges now show new image instead of broken one. Pull request #39529
- Form binding moved from go-chi/binding into modules/web/binding. GET/HEAD always bind query, JSON null elements bind correctly. Pull request #39528
- Label pages sort by open issue count instead of total, fixing most/least issues lists. Pull request #39464
- Actions workflows can now push to protected branches using loaded token write permissions. Pull request #39567
- MySQL and MariaDB transactions use READ COMMITTED isolation level to prevent failures with
innodb_snapshot_isolationenabled. Pull request #39506
This week: git minimum raised to 2.34, go-git backend removed, citations render server-side, and three utility modules moved into core for easier maintenance.
This week in Gitea: minimum git version raised to 2.34, go-git backend consolidated into CLI-only, server-side citation rendering with APA/BibTeX support, and major infrastructure improvements including moving session, cache, and binding modules into core for direct maintenance and bug fixes.
Week of September 21, 2026
What shipped
- Actions jobs waiting on unfinished dependencies now show a persisted pending status instead of blocked, aligning the UI and API with GitHub. Pull request #39376
- A read-only Actions job queue view shows running and waiting jobs instance-wide in admin settings and per-repository, with filters and live refresh. Pull request #38585
- Actions artifact previews in the run view let you browse and render artifact files directly in the browser without downloading the ZIP. Pull request #36754
- Workflow parsing moved to actionslib with support for self: references, $/ paths, and expressions in strategy, matrix, max-parallel, and fail-fast. Pull request #39358
- Reusable workflow jobs now receive the caller's event type and with: inputs correctly instead of seeing
workflow_callas the event. Pull request #39452 - Fork pull request run approval no longer revives cancelled jobs when approving and treats cancelled runs correctly in the merge box and API. Pull request #39399
- Pull requests can now auto-close other pull requests via Fixes: references, matching GitHub behavior. Pull request #39393
- Emoji data updated to Unicode 17 with unified storage in a single JSON file and lazy-loading support. Pull request #39363
- Duplicate cross-reference timeline entries no longer appear when removing and re-adding mentions or changing reference types. Pull request #38881
- Pull request merge status is now managed by Gitea's code where the operation is triggered, fixing several merge-related bugs. Pull request #39442
Why it matters
This week includes significant improvements to Actions workflows with better job status tracking and queue visibility, artifact preview capabilities for workflow runs, and corrections to how workflows handle events and inputs. Several bug fixes address pull request operations, cross-references, and API consistency with GitHub behavior.
Changelog entry
- CHANGED: Actions jobs waiting on unfinished dependencies show pending status instead of blocked Pull request #39376
- ADDED: Actions job queue view showing running and waiting jobs with filters Pull request #38585
- ADDED: Browser preview for Actions artifacts with file browsing and rendering Pull request #36754
- CHANGED: Workflow parsing supports self: references and expressions in strategy fields Pull request #39358
- FIXED: Reusable workflow jobs receive caller's event and inputs correctly Pull request #39452
- FIXED: Fork PR run approval no longer revives cancelled jobs Pull request #39399
- ADDED: Pull requests can auto-close other PRs via Fixes: references Pull request #39393
- CHANGED: Emoji data updated to Unicode 17 with unified JSON storage Pull request #39363
- FIXED: API now accepts reviews with pending inline comments but no summary Pull request #39433
- FIXED: Commit page renders correctly for unsigned commits with different committer Pull request #39381
This week: Actions jobs now show pending status, reusable workflows receive correct event data, artifact previews in run views, and PR auto-close via Fixes: references.
This week's Gitea updates improve Actions workflows with pending job status tracking, a job queue view for monitoring, artifact previews in run views, and correct event handling in reusable workflows. Also: PR auto-close via Fixes: references, better approval handling, Unicode 17 emoji support, and fixes for cross-references and merge operations.
Week of September 14, 2026
What shipped
- Bot accounts are now first-class users that can be created and managed through the admin UI, API, and CLI for automation that authenticate only with access tokens. Pull request #38966
- Merge commit messages are now passed via stdin instead of command-line arguments, fixing failures on long messages that exceeded OS limits. Pull request #39269
- CodeCommit migration now uses a minimal REST client instead of the AWS SDK, reducing binary size by 3.1 MB. Pull request #39330
- Azure Blob SDK replaced with a minimal REST client, reducing binary size by 1.2 MB on main and 4.7 MB compared to the latest SDK. Pull request #39315
- Issue pattern capture groups improved and now support both internal and external trackers being enabled simultaneously. Pull request #39354
- Repository archive downloads now support weak ETag headers and If-None-Match conditional requests. Pull request #39289
- Mermaid updated to v12 with ELK as the default layout and the new neo design applied to diagrams. Pull request #39331
- Notifications can now be marked as read for the current page only, with an option to mark all as read preserved. Pull request #39294
- Actions job and step durations now use Gitea's clock instead of runner timestamps to avoid incorrect durations from clock skew. Pull request #39323
- SHA-256 pull request commit IDs are preserved during migrations. Pull request #39343
Why it matters
This week brings infrastructure improvements that reduce binary size and fix long-standing issues with message handling and clock synchronization. New first-class bot accounts enable better automation workflows, while better error handling and diagram rendering improve the user experience.
Changelog entry
- Add bot account management in admin UI, API, and CLI for automation with token-only authentication Pull request #38966
- Fix merge commit messages exceeding OS command-line limits by passing via stdin Pull request #39269
- Replace AWS SDK with REST client in CodeCommit migration, reduce binary by 3.1 MB Pull request #39330
- Replace Azure Blob SDK with REST client, reduce binary by 1.2 MB Pull request #39315
- Improve issue pattern capture groups and support both internal and external trackers Pull request #39354
- Add ETag support and If-None-Match conditional requests to repository archive downloads Pull request #39289
- Update Mermaid to v12 with ELK default layout and neo design Pull request #39331
- Add page-level notification read action, preserve all-read option Pull request #39294
- Use Gitea's clock for actions job and step durations to avoid clock skew issues Pull request #39323
- Focus confirm button in modals and mark delete actions with red warning Pull request #39350
- Preserve SHA-256 pull request commit IDs in migrations Pull request #39343
- Document NOTICE_ON_SUCCESS for cron tasks in app.example.ini Pull request #39352
- Unify email validation between registration and settings forms Pull request #39304
- Classify git failures on stderr and restrict migration failure details from hostile servers Pull request #39010
Gitea this week: bot accounts arrive for automation, long merge messages work reliably, and binary size shrinks by switching to REST clients from heavy SDKs.
Gitea's latest updates introduce first-class bot accounts for automation workflows, fix merge message handling on long commits, and significantly reduce binary size by replacing AWS and Azure SDKs with lightweight REST clients. Additional improvements include better error classification for migrations, ETag support for archive downloads, and Mermaid v12 integration with improved diagram rendering.