v1.20.3

• BREAKING
  • Fix the wrong derive path (#26271) (#26318)
• SECURITY
  • Fix API leaking Usermail if not logged in (#25097) (#26350)
• FEATURES
  • Add ThreadID parameter for Telegram webhooks (#25996) (#26480)
• ENHANCEMENTS
  • Add minimum polyfill to support "relative-time-element" in PaleMoon (#26575) (#26578)
  • Fix dark theme highlight for "NameNamespace" (#26519) (#26527)
  • Detect ogg mime-type as audio or video (#26494) (#26505)
  • Use object-fit: contain for oauth2 custom icons (#26493) (#26498)
  • Move dropzone progress bar to bottom to show filename when uploading (#26492) (#26497)
  • Remove last newline from config file (#26468) (#26471)
  • Minio: add missing region on client initialization (#26412) (#26438)
  • Add pull request review request webhook event (#26401) (#26407)
  • Fix text truncate (#26354) (#26384)
  • Fix incorrect color of selected assignees when create issue (#26324) (#26372)
  • Display human-readable text instead of cryptic filemodes (#26352) (#26358)
  • Hide last indexed SHA when a repo could not be indexed yet (#26340) (#26345)
  • Fix the topic validation rule and suport dots (#26286) (#26303)
  • Fix due date rendering the wrong date in issue (#26268) (#26274)
  • Don't autosize textarea in diff view (#26233) (#26244)
  • Fix commit compare style (#26209) (#26226)
  • Warn instead of reporting an error when a webhook cannot be found (#26039) (#26211)
• BUGFIXES
  • Use "input" event instead of "keyup" event for migration form (#26602) (#26605)
  • Do not use deprecated log config options by default (#26592) (#26600)
  • Fix "issueReposQueryPattern does not match query" (#26556) (#26564)
  • Sync repo's IsEmpty status correctly (#26517) (#26560)
  • Fix project filter bugs (#26490) (#26558)
  • Use hidden over clip for text truncation (#26520) (#26522)
  • Set "type=button" for editor's toolbar buttons (#26510) (#26518)
  • Fix NuGet search endpoints (#25613) (#26499)
  • Fix storage path logic especially for relative paths (#26441) (#26481)
  • Close stdout correctly for "git blame" (#26470) (#26473)
  • Check first if minio bucket exists before trying to create it (#26420) (#26465)
  • Avoiding accessing undefined tributeValues #26461 (#26462)
  • Call git.InitSimple for runRepoSyncReleases (#26396) (#26450)
  • Add transaction when creating pull request created dirty data (#26259) (#26437)
  • Fix wrong middleware sequence (#26428) (#26436)
  • Fix admin queue page title and fix CI failures (#26409) (#26421)
  • Introduce ctx.PathParamRaw to avoid incorrect unescaping (#26392) (#26405)
  • Bypass MariaDB performance bug of the "IN" sub-query, fix incorrect IssueIndex (#26279) (#26368)
  • Fix incorrect CLI exit code and duplicate error message (#26346) (#26347)
  • Prevent newline errors with Debian packages (#26332) (#26342)
  • Fix bug with sqlite load read (#26305) (#26339)
  • Make git batch operations use parent context timeout instead of default timeout (#26325) (#26330)
  • Support getting changed files when commit ID is EmptySHA (#26290) (#26316)
  • Clarify the logger's MODE config option (#26267) (#26281)
  • Use shared template for webhook icons (#26242) (#26246)
  • Fix pull request check list is limited (#26179) (#26245)
  • Fix attachment clipboard copy on insecure origin (#26224) (#26231)
  • Fix access check for org-level project (#26182) (#26223)
• MISC
  • Improve profile readme rendering (#25988) (#26453)
  • [docs] Add missing backtick in quickstart.zh-cn.md (#26349) (#26357)
  • Upgrade x/net to 0.13.0 (#26301)

v1.20.2

• ENHANCEMENTS
  • Calculate MAX_WORKERS default value by CPU number (#26177) (#26183)
  • Display deprecated warning in admin panel pages as well as in the log file (#26094) (#26154)
• BUGFIXES
  • Fix allowed user types setting problem (#26200) (#26206)
  • Fix handling of plenty Nuget package versions (#26075) (#26173)
  • Fix UI regression of asciinema player (#26159) (#26162)
  • Fix LFS object list style (#26133) (#26147)
  • Fix allowed user types setting problem (#26200) (#26206)
  • Prevent primary key update on migration (#26192) (#26199)
  • Fix bug when pushing to a pull request which enabled dismiss approval automatically (#25882) (#26158)
  • Fix bugs in LFS meta garbage collection (#26122) (#26157)
  • Update xorm version (#26128) (#26150)
  • Remove "misc" scope check from public API endpoints (#26134) (#26149)
  • Fix CLI allowing creation of access tokens with existing name (#26071) (#26144)
  • Fix incorrect router logger (#26137) (#26143)
  • Improve commit graph alignment and truncating (#26112) (#26127)
  • Avoid writing config file if not installed (#26107) (#26113)
  • Fix escape problems in the branch selector (#25875) (#26103)
  • Fix handling of Debian files with trailing slash (#26087) (#26098)
  • Fix Missing 404 swagger response docs for /admin/users/{username} (#26086) (#26089)
  • Use stderr as fallback if the log file can't be opened (#26074) (#26083)
  • Increase table cell horizontal padding (#26140) (#26142)
  • Fix wrong workflow status when rerun a job in an already finished workflow (#26119) (#26124)
  • Fix duplicated url prefix on issue context menu (#26066) (#26067)

v1.20.1

• SECURITY
  • Disallow dangerous URL schemes (#25960) (#25964)
• ENHANCEMENTS
  • Show the mismatched ROOT_URL warning on the sign-in page if OAuth2 is enabled (#25947) (#25972)
  • Make pending commit status yellow again (#25935) (#25968)
• BUGFIXES
  • Fix version in rpm repodata/primary.xml.gz (#26009) (#26048)
  • Fix env config parsing for "GITEA____APP_NAME" (#26001) (#26013)
  • ParseScope with owner/repo always sets owner to zero (#25987) (#25989)
  • Fix SSPI auth panic (#25955) (#25969)
  • Avoid creating directories when loading config (#25944) (#25957)
  • Make environment-to-ini work with INSTALL_LOCK=true (#25926) (#25937)
  • Ignore runs-on with expressions when warning no matched runners (#25917) (#25933)
  • Avoid opening/closing PRs which are already merged (#25883) (#25903)
• DOCS
  • RPM Registry: Show zypper commands for SUSE based distros as well (#25981) (#26020)
  • Correctly refer to dev tags as nightly in the docker docs (#26004) (#26019)
  • Update path related documents (#25417) (#25982)
• MISC
  • Adding remaining enum for migration repo model type. (#26021) (#26034)
  • Fix the route for pull-request's authors (#26016) (#26018)
  • Fix commit status color on dashboard repolist (#25993) (#25998)
  • Avoid hard-coding height in language dropdown menu (#25986) (#25997)
  • Add shutting down notice (#25920) (#25922)
  • Fix incorrect milestone count when provide a keyword (#25880) (#25904)

v1.20.0

For more in-depth information, check out the blog post!

• BREAKING
  • Fix WORK_DIR for docker (root) image (#25738) (#25811)
  • Restrict [actions].DEFAULT_ACTIONS_URL to only github or self (#25581) (#25604)
  • Refactor path & config system (#25330) (#25416)
  • Fix all possible setting error related storages and added some tests (#23911) (#25244)
  • Use a separate admin page to show global stats, remove actions stat (#25062)
  • Remove the service worker (#25010)
  • Remove meta tags theme-color and default-theme (#24960)
  • Use [git.config] for reflog cleaning up (#24958)
  • Allow all URL schemes in Markdown links by default (#24805)
  • Redesign Scoped Access Tokens (#24767)
  • Fix team members API endpoint pagination (#24754)
  • Rewrite logger system (#24726)
  • Increase default LFS auth timeout from 20m to 24h (#24628)
  • Rewrite queue (#24505)
  • Remove unused setting time.FORMAT (#24430)
  • Refactor setting.Other and remove unused SHOW_FOOTER_BRANDING (#24270)
  • Correct the access log format (#24085)
  • Reserve ".png" suffix for user/org names (#23992)
  • Prefer native parser for SSH public key parsing (#23798)
  • Editor preview support for external renderers (#23333)
  • Add Gitea Profile Readmes (#23260)
  • Refactor ctx in templates (#23105)
• SECURITY
  • Test if container blob is accessible before mounting (#22759) (#25784)
  • Set type="password" on all auth_token fields (#22175)
• FEATURES
  • Add button on diff header to copy file name, misc diff header tweaks (#24986)
  • API endpoint for changing/creating/deleting multiple files (#24887)
  • Support changing git config through app.ini, use diff.algorithm=histogram by default (#24860)
  • Add up and down arrows to selected lookup repositories (#24727)
  • Add Go package registry (#24687)
  • Add status indicator on main home screen for each repo (#24638)
  • Support for status check pattern (#24633)
  • Implement Cargo HTTP index (#24452)
  • Add Debian package registry (#24426)
  • Add the ability to pin Issues (#24406)
  • Add follow organization and fix the logic of following page (#24345)
  • Allow webp images as avatars (#24248)
  • Support upload outputs and use needs context on Actions (#24230)
  • Allow adding new files to an empty repo (#24164)
  • Make wiki title supports dashes and improve wiki name related features (#24143)
  • Add monospace toggle button to textarea (#24034)
  • Use auto-updating, natively hoverable, localized time elements (#23988)
  • Add ntlm authentication support for mail (#23811)
  • Add CLI command to register runner tokens (#23762)
  • Add Alpine package registry (#23714)
  • Expand/Collapse all changed files (#23639)
  • Add unset default project column (#23531)
  • Add activity feeds API (#23494)
  • Add RPM registry (#23380)
  • Add meilisearch support (#23136)
  • Add API for License templates (#23009)
  • Add admin API email endpoints (#22792)
  • Add user rename endpoint to admin api (#22789)
  • Add API for gitignore templates (#22783)
  • Implement actions artifacts (#22738)
  • Add RSS Feeds for branches and files (#22719)
  • Display when a repo was archived (#22664)
  • Add Swift package registry (#22404)
  • Add CRAN package registry (#22331)
  • Add user webhooks (#21563)
  • Implement systemd-notify protocol (#21151)
  • Implement Issue Config (#20956)
  • Add API to manage issue dependencies (#17935)
• API
  • Use correct response code in push mirror creation response in v1_json.tmpl (#25476) (#25571)
  • Fix Permission in API returned repository struct (#25388) (#25441)
  • Add API for Label templates (#24602)
  • Filters for GetAllCommits (#24568)
  • Add ability to specify '--not' from GetAllCommits (#24409)
  • Support uploading file to empty repo by API (#24357)
  • Add absent repounits to create/edit repo API (#23500)
  • Add login name and source id for admin user searching API (#23376)
  • Create a branch directly from commit on the create branch API (#22956)
• ENHANCEMENTS
  • Make add line comment buttons focusable (#25894) (#25896)
  • Always pass 6-digit hex color to monaco (#25780) (#25782)
  • Clarify "text-align" CSS helpers, fix clone button padding (#25763) (#25764)
  • Hide add file button for pull mirrors (#25748) (#25751)
  • Allow/fix review (approve/reject) of empty PRs (#25690) (#25732)
  • Fix tags header and pretty format numbers (#25624) (#25694)
  • Actions list enhancements (#25601) (#25678)
  • Fix show more for image on diff page (#25672) (#25673)
  • Prevent SVG shrinking (#25652) (#25669)
  • Fix UI misalignment on user setting page (#25629) (#25656)
  • Use css on labels (#25626) (#25636)
  • Read-only checkboxes don't appear and don't entirely act the way one might expect (#25573) (#25602)
  • Redirect to package after version deletion (#25594) (#25599)
  • Reduce table padding globally (#25568) (#25577)
  • Change Regenerate Secret button display (#25534) (#25541)
  • Fix rerun icon on action view component (#25531) (#25536)
  • Move some regexp out of functions (#25430) (#25445)
  • Diff page enhancements (#25398) (#25437)
  • Various UI fixes (#25264) (#25431)
  • Fix label list divider (#25312) (#25372)
  • Fix UI on mobile view (#25315) (#25340)
  • When viewing a file, hide the add button (#25320) (#25339)
  • Show if File is Executable (#25287) (#25300)
  • Fix edit OAuth application width (#25262) (#25263)
  • Use flex to align SVG and text (#25163) (#25260)
  • Revert overflow: overlay (revert #21850) (#25231) (#25239)
  • Use inline SVG for built-in OAuth providers (#25171) (#25234)
  • Change access token UI to select dropdowns (#25109) (#25230)
  • Remove hacky patch for "safari emoji glitch fix" (#25208) (#25211)
  • Minor arc-green color tweaks (#25175) (#25205)
  • Button and color enhancements (#24989) (#25176)
  • Fix mobile navbar and misc cleanups (#25134) (#25169)
  • Modify OAuth login ui and fix display name, iconurl related logic (#25030) (#25161)
  • Improve notification icon and navbar (#25111) (#25124)
  • Add details summary for vertical menus in settings to allow toggling (#25098)
  • Don't display select all issues checkbox when no issues are available (#25086)
  • Use RepositoryList instead of []*Repository (#25074)
  • Add ability to set multiple redirect URIs in OAuth application UI (#25072)
  • Use git command instead of the ini package to remove the origin remote (#25066)
  • Remove cancel button from branch protection form (#25063)
  • Show file tree by default (#25052)
  • Add Progressbar to Milestone Page (#25050)
  • Minor UI improvements: logo alignment, auth map editor, auth name display (#25043)
  • Allow for PKCE flow without client secret + add docs (#25033)
  • Refactor INI package (first step) (#25024)
  • Various style fixes (#25008)
  • Fix delete user account modal (#25004)
  • Refactor diffFileInfo / DiffTreeStore (#24998)
  • Add user level action runners (#24995)
  • Rename NotifyPullReviewRequest to NotifyPullRequestReviewRequest (#24988)
  • Add step start time to ViewStepLog (#24980)
  • Add dark mode to API Docs (#24971)
  • Display file mode for new file and file mode changes (#24966)
  • Make the 500 page load themes (#24953)
  • Show bot label next to username when rendering autor link if the user is a bot (#24943)
  • Repo list improvements, fix bold helper classes (#24935)
  • Improve queue and logger context (#24924)
  • Improve RunMode / dev mode (#24886)
  • Improve some Forms (#24878)
  • Add show timestamp/seconds and fullscreen options to action page (#24876)
  • Fix double border and adjust width for user profile page (#24870)
  • Improve Actions CSS (#24864)
  • Fix @font-face overrides (#24855)
  • Remove In your repositories link in milestones dashboard (#24853)
  • Fix missing yes/no in delete time log modal (#24851)
  • Show new pull request button also on subdirectories and files (#24842)
  • Make environment-to-ini support loading key value from file (#24832)
  • Support wildcard in email domain allow/block list (#24831)
  • Use CommentList instead of []*Comment (#24828)
  • Add RTL rendering support to Markdown (#24816)
  • Rework notifications list (#24812)
  • Mute repo names in dashboard repo list (#24811)
  • Fix max width and margin of comment box on conversation page (#24809)
  • Some refactors for issues stats (#24793)
  • Rework label colors (#24790)
  • Fix OAuth login loading state (#24788)
  • Remove duplicated issues options and some more refactors (#24787)
  • Decouple the different contexts from each other (#24786)
  • Remove background on user dashboard filter bar (#24779)
  • Improve and fix bugs surrounding reactions (#24760)
  • Make the color of zero-contribution-squares in the activity heatmap more subtle (#24758)
  • Fix WEBP image copying (#24743)
  • Rework OAuth login buttons, swap github logo to monocolor (#24740)
  • Consolidate the two review boxes into one (#24738)
  • Unification of registration fields order (#24737)
  • Refactor Pull Mirror and fix out-of-sync bugs (#24732)
  • Improvements for action detail page (#24718)
  • Fix flash of unstyled content in action view page (#24712)
  • Don't filter action runs based on state (#24711)
  • Optimize actions list by removing an unnecessary git call (#24710)
  • Support no label/assignee filter and batch clearing labels/assignees (#24707)
  • Add icon support for safari (#24697)
  • Use standard HTTP library to serve files (#24693)
  • Improve button-ghost, remove tertiary button (#24692)
  • Only hide tooltip tippy instances (#24688)
  • Support migrating storage for actions log via command line (#24679)
  • Remove highlight in repo list (#24675)
  • Add markdown preview to Submit Review Textarea (#24672)
  • ...

v1.19.4

• SECURITY
  • Fix open redirect check for more cases (#25143) (#25155)
• API
  • Return 404 in the API if the requested webhooks were not found (#24823) (#24830)
  • Fix organization field being null in GET /api/v1/teams/{id} (#24694) (#24696)
• ENHANCEMENTS
  • Set --font-weight-bold to 600 (#24840)
  • Make mailer SMTP check have timed context (#24751) (#24759)
  • Do not select line numbers when selecting text from the action run logs (#24594) (#24596)
• BUGFIXES
  • Fix bug when change user name (#25637) (#25645)
  • Fix task list checkbox toggle to work with YAML front matter (#25184) (#25236)
  • Hide limited users if viewed by anonymous ghost (#25214) (#25224)
  • Add WithPullRequest for actionsNotifier (#25144) (#25196)
  • Fix parallelly generating index failure with Mysql (#24567) (#25081)
  • GitLab migration: Sanitize response for reaction list (#25054) (#25059)
  • Fix users cannot visit issue attachment bug (#25019) (#25027)
  • Fix missing reference prefix of commits when sync mirror repository (#24994)
  • Only validate changed columns when update user (#24867) (#24903)
  • Make DeleteIssue use correct context (#24885)
  • Fix topics deleted via API not being deleted in org page (#24825) (#24829)
  • Fix Actions being enabled accidentally (#24802) (#24810)
  • Fix missed table name on iterate lfs meta objects (#24768) (#24774)
  • Fix safari cookie session bug (#24772)
  • Respect original content when creating secrets (#24745) (#24746)
  • Fix Pull Mirror out-of-sync bugs (#24732) (#24733)
  • Fix run list broken when trigger user deleted (#24706) (#24709)
  • Fix issues list page multiple selection update milestones (#24660) (#24663)
  • Fix: release page for empty or non-existing target (#24659)
  • Fix close org projects (#24588) (#24591)
  • Refresh the refernce of the closed PR when reopening (#24231) (#24587)
  • Fix the permission of team's Actions unit issue (#24536) (#24545)
  • Bump go.etcd.io/bbolt and blevesearch deps (#23062) (#24519)
  • Fix new wiki page mirror (#24518)
  • Match unqualified references when syncing pulls as well (#23070)
• DOCS
  • Change branch name from master to main in some documents' links (#25126) (#25139)
  • Remove unnecessary content on docs (#24976) (#25001)
  • Unify doc links to use paths relative to doc folder (#24979) (#25000)
  • Fix docs documenting invalid @every for OLDER_THAN cron settings (#24695) (#24698)
• MISC
  • Merge different languages for language stats (#24900) (#24921)
  • Hiding Secrets options when Actions feature is disabled (#24792)
  • Improve decryption failure message (#24573) (#24575)
  • Makefile: Use portable !, not GNUish -not, with find(1). (#24565) (#24572)

v1.20.0-rc2

Third release candidate for 1.20

v1.20.0-rc1

Second release candidate for 1.20

v1.20.0-rc0

release candidate 0

v1.19.3

• SECURITY
  • Use golang 1.20.4 to fix CVE-2023-24539, CVE-2023-24540, and CVE-2023-29400
• ENHANCEMENTS
  • Enable whitespace rendering on selection in Monaco (#24444) (#24485)
  • Improve milestone filter on issues page (#22423) (#24440)
• BUGFIXES
  • Fix api error message if fork exists (#24487) (#24493)
  • Fix user-cards format (#24428) (#24431)
  • Fix incorrect CurrentUser check for docker rootless (#24435)
  • Getting the tag list does not require being signed in (#24413) (#24416)

v1.19.2

• SECURITY
  • Require repo scope for PATs for private repos and basic authentication (#24362) (#24364)
  • Only delete secrets belonging to its owner (#24284) (#24286)
• API
  • Fix typo in API route (#24310) (#24332)
  • Fix access token issue on some public endpoints (#24194) (#24259)
• ENHANCEMENTS
  • Fix broken clone script on an empty archived repo (#24339) (#24348)
  • Fix Monaco IOS keyboard button (#24341) (#24347)
  • Don't set meta theme-color by default (#24340) (#24346)
  • Wrap too long push mirror addresses (#21120) (#24334)
  • Add --font-weight-bold and set previous bold to 601 (#24307) (#24331)
  • Unify nightly naming across binaries and docker images (#24116) (#24308)
  • Fix footer display (#24251) (#24269)
  • Fix label color, fix divider in dropdown (#24215) (#24244)
  • Vertical widths of containers removed (#24184) (#24211)
  • Use correct locale key for forks page (#24172) (#24175)
  • Sort repo topic labels by name (#24123) (#24153)
  • Highlight selected file in the PR file tree (#23947) (#24126)
• BUGFIXES
  • Fix auth check bug (#24382) (#24387)
  • Add tags list for repos whose release setting is disabled (#23465) (#24369)
  • Fix wrong error info in RepoRefForAPI (#24344) (#24351)
  • Fix no edit/close/delete button in org repo project view page (#24349)
  • Respect the REGISTER_MANUAL_CONFIRM setting when registering via OIDC (#24035) (#24333)
  • Remove org users who belong to no teams (#24247) (#24313)
  • Fix bug when deleting wiki with no code write permission (#24274) (#24295)
  • Handle canceled workflow as a warning instead of a fail (#24282) (#24292)
  • Load reviewer for comments when dismissing a review (#24281) (#24288)
  • Show commit history for closed/merged PRs (#24238) (#24261)
  • Fix owner team access mode value in team_unit table (#24224)
  • Fix issue attachment handling (#24202) (#24221)
  • Fix incorrect CORS default values (#24206) (#24217)
  • Fix template error in pull request with deleted head repo (#24192) (#24216)
  • Don't list root repository on compare page if pulls not allowed (#24183) (#24210)
  • Fix calReleaseNumCommitsBehind (#24148) (#24197)
  • Fix Org edit page bugs: renaming detection, maxlength (#24161) (#24171)
  • Update redis library to support redis v7 (#24114) (#24156)
  • Use 1.18's aria role for dropdown menus (#24144) (#24155)
  • Fix 2-dot direct compare to use the right base commit (#24133) (#24150)
  • Fix incorrect server error content in RunnersList (#24118) (#24121)
  • Fix mismatch between hook events and github event types (#24048) (#24091)
• BUILD
  • Support converting varchar to nvarchar for mssql database (#24105) (#24168)