v1.27.3
tobychui/zoraxyv1.27.3Aug 29, 2026by GiteaBot
Upgrading?
AI Summary
Security and bugfix release focusing on package scope restrictions, artifact signatures, and repository visibility.
Key Highlights
- Security fixes for package scope access and artifact signatures
- Fixes YAML anchors and aliases in Actions workflows
- Enhances PR review with permalinks
- Fixes OpenPGP signature verification with SSH instances
Breaking Changes
- Restricted package access may break existing integrations
- Git hook permissions are now restricted
New Features
- Permalinks to pull request reviews
- Pre-registration of OAuth2 application for Gitea mobile app
- Anonymous theme switching with REQUIRE_SIGNIN_VIEW
Full Release Notes
* SECURITY * fix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058) * fix(attachments): enforce owning repository path (#39048) (#39077) * fix(markup): enforce same-repository issue access (#39045) (#39054) * fix(actions): verify raw artifact signatures first (#39049) (#39053) * fix(api): hide limited users from restricted viewers (#39004) (#39039) * fix(repo): limit gitignore template selections (#39027) (#39040) * fix(migrations): cancel GitLab version probes (#39023) (#39035) * fix(packages): limit Swift package manifests (#39025) (#39032) * fix(migrations): bound OneDev version responses (#39024) (#39033) * fix(packages): limit Maven checksum uploads (#39028) (#39031) * fix(packages): bound Alpine metadata entries (#39026) (#39029) * fix(actions): enforce fork pull request trust boundaries (#39005) (#39018) * fix(git): restrict hook permissions (#39008) (#39016) * fix(api): enforce repository creation token authorization (#39007) (#39014) * fix(api): enforce public-only scope for compare heads (#39006) (#39013) * fix(repo): hide repositories of hidden owners (#39009) (#39012) * fix: avoid enumerating every public repository in issue search (#38992) (#39000) * refactor: private endpoints (#38964) (#38965) * ENHANCEMENTS * enhance: add permalinks to pull request reviews (#38849) (#39036) * BUGFIXES * fix: add missing query parameters on runner list page (#39163) * fix(actions): keep step-level continue-on-error expressions unevaluated (#39141) (#39148 * fix(packages): preserve SemVer prerelease identifiers in Swift Registry (#39156) (#39158) * fix(repo): prevent MarkAsBrokenEmpty when repository is being migrated (#39091) (#39092) * fix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086) * fix(pull): keep the merged state in sync with git (#39062) (#39118) * fix(pull): name the head repository in default compare links (#39075) (#39079) * fix(git): parse co-author trailers that are not RFC 5322 addresses (#39076) (#39081) * fix(actions): show "Complete job" logs when the last step is skipped (#38939) (#39003) * fix(actions): Fix how jobs in matrixes are grouped (#38980) (#38998) * fix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996) * fix: honor environment variables during install (#38974) (#38976) * fix: grant limited-org unit read access to authenticated non-members (#38871) (#38963) * fix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956) (#38961) * fix(actions): drop wrapper span around the action status icon (#38957) (#38959) * fix(issues): sort scoped labels by exclusive order in dropdowns (#38893) (#38954) * fix(indexer): correct bleve indexer token filters (#38853) (#38951) * fix: make "login_name" field optional for API edit user (#38917) (#38945) * fix(actions): reject non-mapping matrix include/exclude (#38933) * fix(ui): respect FEED_PAGING_NUM on the dashboard feed (#38935) (#38936) * MISC * chore: repo compare link (#39088) (#39119) * ci: remove AWS S3 uploads from release workflows (#38928) (#38929) * chore: Pre-register a builtin OAuth2 application for the official Gitea mobile app (#38880) (#38922) Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.
Related Repositories
f.k.a. Awesome ChatGPT Prompts. Share, discover, and collect prompts from the community. Free and open source — self-host for your organization with complete privacy.
Open-source foundation of ToolJet AI - the enterprise app generation platform for internal tools, dashboards, business applications, workflows and AI agents. Build visually, from a prompt, or from Claude Code, Codex and Cursor over MCP 🚀
1,324-exercise fitness dataset — animation GIFs, 180×180 thumbnails, muscle-group & equipment data, and step-by-step instructions in 6 languages. The exercise data layer behind the LogPress app.
A complete web-based remote monitoring and management web site. Once setup you can install agents and perform remote desktop session to devices on the local network or over the Internet.
Human: AI-powered 3D Face Detection & Rotation Tracking, Face Description & Recognition, Body Pose Tracking, 3D Hand & Finger Tracking, Iris Analysis, Age & Gender & Emotion Prediction, Gaze Tracking, Gesture Recognition