Starstruk Logo MarkStarstruk

v28.0.0 v1.7.7

high risk

tobychui/zoraxySep 29, 2026 → Sep 30, 20261 day between releases

What's New

Gitea v28.0.0 added Git proxy and audit logging; better-auth v1.7.7 fixed a critical Magic Link takeover vulnerability.

New Features

  • validateRedirectUri for OAuth
  • verifyOAuthQueryParams
  • OAuth Proxy validation features

Improvements

  • Fixed Magic Link account-takeover vulnerability
  • Added OAuth Proxy validation features
  • Fixed CAPTCHA and rate-limit headers

Bug Fixes

  • Fixed Magic Link account-takeover vulnerability
  • Fixed ID-token sign-in ignoring social provider's disableSignUp setting
  • Fixed OAuth Proxy accepting sign-in state incorrectly
  • Fixed CAPTCHA errors missing JSON Content-Type header
  • Fixed rate-limit errors missing JSON Content-Type header

Upgrade Notes

Upgrade servers sharing Magic Link verification storage and restart pending OAuth/SAML sign-ins; ensure all OAuth Proxy participants are upgraded together.

The Two Releases

v28.0.0

v28.0.0

Sep 29, 2026· 22 days ago

A major version update introducing significant breaking changes regarding Git network operations and security, alongside new features like audit logging and deploy tokens.

Full release notes
v1.7.7

v1.7.7

Sep 30, 2026· 21 days ago

A critical security patch release addressing a Magic Link account-takeover vulnerability and fixing various authentication-related bugs.

Full release notes