v1.5.0

• SECURITY
  • Check that repositories can only be migrated to own user or organizations (#4366) (#4370)
  • Limit uploaded avatar image-size to 4096px x 3072px by default (#4353)
  • Do not allow to reuse TOTP passcode (#3878)
• BUGFIXES
  • Fix column droping for MSSQL that need new transaction for that (#4440) (#4484)
  • Redirect to correct page after using scratch token (#4458) (#4472)
  • Replace src with raw to fix image paths (#4377) (#4386)
  • Fixes repo membership check in API (#4341) (#4379)
  • Add default merge options when adding new repository (#4369) (#4373)
  • Fix repository last updated time update when delete a user who watched the repo (#4363) (#4371)
  • Fix html entity escaping in branch deletion message (#4471) (#4485)
  • Fix out-of-transaction query in removeOrgUser (#4521) (#4524)
  • Fix incorrect MergeWhitelistTeamIDs check in CanUserMerge function (#4519)
  • Fix panic issue on update avatar email (#4580) (#4590)
  • Fix bugs when too many IN variables (#4594) (#4597)
  • Push whitelist now doesn't apply to branch deletion (#4601) (#4640)
  • Site admin could create repos even MAX_CREATION_LIMIT=0 (#4645) (#4650)
• FEATURE
  • Add cli commands to regen hooks & keys (#3979)
  • Add support for FIDO U2F (#3971)
  • Added user language setting (#3875)
  • LDAP Public SSH Keys synchronization (#1844)
  • Add topic support (#3711)
  • Multiple assignees (#3705)
  • Add protected branch whitelists for merging (#3689)
  • Global code search support (#3664)
  • Add label descriptions (#3662)
  • Add issue search via API (#3612)
  • Add repository setting to enable/disable health checks (#3607)
  • Emoji Autocomplete (#3433)
  • Implements generator cli for secrets (#3531)
• ENHANCEMENT
  • Add more webhooks support and refactor webhook templates directory (#3929)
  • Add new option to allow only OAuth2/OpenID user registration (#3910)
  • Add option to use paged LDAP search when synchronizing users (#3895)
  • Symlink icons (#1416)
  • Improve release page UI (#3693)
  • Add admin dashboard option to run health checks (#3606)
  • Add branch link in branch list (#3576)
  • Reduce sql query times in retrieveFeeds (#3547)
  • Option to enable or disable swagger endpoints (#3502)
  • Add missing licenses (#3497)
  • Reduce repo indexer disk usage (#3452)
  • Enable caching on assets and avatars (#3376)
  • Add repository search ordered by stars/forks. Forks column in admin repo list (#3969)
  • Add Environment Variables to Docker template (#4012)
  • LFS: make HTTP auth period configurable (#4035)
  • Add config path as an optionial flag when changing pass via CLI (#4184)
  • Refactor User Settings sections (#3900)
  • Allow square brackets in external issue patterns (#3408)
  • Add Attachment API (#3478)
  • Add EnableTimetracking option to app settings (#3719)
  • Add config option to enable or disable log executed SQL (#3726)
  • Shows total tracked time in issue and milestone list (#3341)
• TRANSLATION
  • Improve English grammar and consistency (#3614)
• DEPLOYMENT
  • Allow Gitea to run as different USER in Docker (#3961)
  • Provide compressed release binaries (#3991)
  • Sign release binaries (#4188)

v1.5.0-rc2

• SECURITY
  • Check that repositories can only be migrated to own user or organizations (#4366) (#4370)
• BUGFIXES
  • Fix column droping for MSSQL that need new transaction for that (#4440) (#4484)
  • Redirect to correct page after using scratch token (#4458) (#4472)
  • Replace src with raw to fix image paths (#4377) (#4386)
  • Fixes repo membership check in API (#4341) (#4379)
  • Add default merge options when adding new repository (#4369) (#4373)
  • Fix repository last updated time update when delete a user who watched the repo (#4363) (#4371)
  • Fix html entity escaping in branch deletion message (#4471) (#4485)

v1.5.0-rc1

• SECURITY
  • Limit uploaded avatar image-size to 4096x3072 by default (#4353)
  • Do not allow to reuse TOTP passcode (#3878)
• FEATURE
  • Add cli commands to regen hooks & keys (#3979)
  • Add support for FIDO U2F (#3971)
  • Added user language setting (#3875)
  • LDAP Public SSH Keys synchronization (#1844)
  • Add topic support (#3711)
  • Multiple assignees (#3705)
  • Add protected branch whitelists for merging (#3689)
  • Global code search support (#3664)
  • Add label descriptions (#3662)
  • Add issue search via API (#3612)
  • Add repository setting to enable/disable health checks (#3607)
  • Emoji Autocomplete (#3433)
  • Implements generator cli for secrets (#3531)
• ENHANCEMENT
  • Add more webhooks support and refactor webhook templates directory (#3929)
  • Add new option to allow only OAuth2/OpenID user registration (#3910)
  • Add option to use paged LDAP search when synchronizing users (#3895)
  • Symlink icons (#1416)
  • Improve release page UI (#3693)
  • Add admin dashboard option to run health checks (#3606)
  • Add branch link in branch list (#3576)
  • Reduce sql query times in retrieveFeeds (#3547)
  • Option to enable or disable swagger endpoints (#3502)
  • Add missing licenses (#3497)
  • Reduce repo indexer disk usage (#3452)
  • Enable caching on assets and avatars (#3376)
  • Add repository search ordered by stars/forks. Forks column in admin repo list (#3969)
  • Add Environment Variables to Docker template (#4012)
  • LFS: make HTTP auth period configurable (#4035)
  • Add config path as an optionial flag when changing pass via CLI (#4184)
  • Refactor User Settings sections (#3900)
  • Allow square brackets in external issue patterns (#3408)
  • Add Attachment API (#3478)
  • Add EnableTimetracking option to app settings (#3719)
  • Add config option to enable or disable log executed SQL (#3726)
  • Shows total tracked time in issue and milestone list (#3341)
• TRANSLATION
  • Improve English grammar and consistency (#3614)
• DEPLOYMENT
  • Allow Gitea to run as different USER in Docker (#3961)
  • Provide compressed release binaries (#3991)
  • Sign release binaries (#4188)

v1.5.0-dev

• SECURITY
  • Limit uploaded avatar image-size to 4096x3072 by default (#4353)
  • Do not allow to reuse TOTP passcode (#3878)
• FEATURE
  • Add cli commands to regen hooks & keys (#3979)
  • Add support for FIDO U2F (#3971)
  • Added user language setting (#3875)
  • LDAP Public SSH Keys synchronization (#1844)
  • Add topic support (#3711)
  • Multiple assignees (#3705)
  • Add protected branch whitelists for merging (#3689)
  • Global code search support (#3664)
  • Add label descriptions (#3662)
  • Add issue search via API (#3612)
  • Add repository setting to enable/disable health checks (#3607)
  • Emoji Autocomplete (#3433)
  • Implements generator cli for secrets (#3531)
• ENHANCEMENT
  • Add more webhooks support and refactor webhook templates directory (#3929)
  • Add new option to allow only OAuth2/OpenID user registration (#3910)
  • Add option to use paged LDAP search when synchronizing users (#3895)
  • Symlink icons (#1416)
  • Improve release page UI (#3693)
  • Add admin dashboard option to run health checks (#3606)
  • Add branch link in branch list (#3576)
  • Reduce sql query times in retrieveFeeds (#3547)
  • Option to enable or disable swagger endpoints (#3502)
  • Add missing licenses (#3497)
  • Reduce repo indexer disk usage (#3452)
  • Enable caching on assets and avatars (#3376)
  • Add repository search ordered by stars/forks. Forks column in admin repo list (#3969)
  • Add Environment Variables to Docker template (#4012)
  • LFS: make HTTP auth period configurable (#4035)
  • Add config path as an optionial flag when changing pass via CLI (#4184)
  • Refactor User Settings sections (#3900)
  • Allow square brackets in external issue patterns (#3408)
  • Add Attachment API (#3478)
  • Add EnableTimetracking option to app settings (#3719)
  • Add config option to enable or disable log executed SQL (#3726)
  • Shows total tracked time in issue and milestone list (#3341)
• TRANSLATION
  • Improve English grammar and consistency (#3614)
• DEPLOYMENT
  • Allow Gitea to run as different USER in Docker (#3961)
  • Provide compressed release binaries (#3991)
  • Sign release binaries (#4188)

v1.4.3

• SECURITY
  • HTML-escape plain-text READMEs (#4192) (#4214)
  • Fix open redirect vulnerability on login screen (#4312) (#4312)
• BUGFIXES
  • Fix broken monitoring page when running processes are shown (#4203) (#4208)
  • Fix delete comment bug (#4216) (#4228)
  • Delete reactions added to issues and comments when deleting repository (#4232) (#4237)
  • Fix wiki URL encoding bug (#4091) (#4254)
  • Fix code tab link when viewing tags (#3908) (#4263)
  • Fix webhook type conflation (#4285) (#4285)

v1.4.2

Add 1.4.2 changelog (#4115)

v1.4.1

• BREAKING
  • Add "error" as reserved username (#3882) (#3886)
• SECURITY
  • Do not allow inactive users to access repositories using private key (#3887) (#3889)
  • Fix path cleanup in file editor, when initilizing new repository and LFS oids (#3871) (#3873)
  • Remove unnecessary allowed safe HTML (#3778) (#3779)
  • Correctly check http git access rights for reverse proxy authorized users (#3721) (#3743)
• BUGFIXES
  • Fix to use only needed columns from tables to get repository git paths (#3870) (#3883)
  • Fix GPG expire time display when time is zero (#3584) (#3884)
  • Fix to update only issue last update time when adding a comment (#3855) (#3860)
  • Fix repository star count after deleting user (#3781) (#3783)
  • Use the active branch for the code tab (#3720) (#3776)
  • Set default branch name on first push (#3715) (#3723)
  • Show clipboard button if disable HTTP of git protocol (#3773) (#3774)

v1.4.0

• BREAKING
  • Drop deprecated GOGS_WORK_DIR use (#2946)
  • Fix API status code for hook creation (#2814)
• SECURITY
  • Escape branch name in dropdown menu (#3691) (#3692)
  • Refactor and simplify to correctly validate redirect to URL (#3674) (#3676)
  • Fix escaping changed title in comments (#3530) (#3534)
     * Escape search query (#3486) (#3488)
  • Sanitize logs for mirror sync (#3057)
• FEATURE
  • Serve .patch and .diff for pull requests (#3305, #3293)
  • Add repo-sync-releases admin command (#3254)
  • Support default private when creating or migrating repository (#3239)
  • Writable deploy keys (closes #671) (#3225)
  • Add Pull Request merge options - Ignore white-space for conflict checking, Rebase, Squash merge (#3188)
  • Added progressbar for issues with checkboxes (#1146). (#3171)
  • Mention completion for issue editor. (#3136)
  • Add 'mark all read' option to notifications (#3097)
  • Git LFS lock api (#2938)
  • Add reactions to issues/PR and comments (#2856)
  • Add dingtalk webhook (#2777)
  • Responsive view (#2750)
• BUGFIXES
  • Fix wiki inter-links with spaces (#3560) (#3632)
  • Fix query protected branch bug (#3563) (#3571)
  • Fix remove team member issue (#3566) (#3570)
  • Fix the protected branch panic issue (#3567) (#3569)
  • If Mirrors repository no content is fetched, updated time should not be changed (#3551) (#3565)
  • Bug fix for mirrored repository releases sorted (#3522) (#3555)
  • Add issue closed time column to fix activity closed issues list (#3537) (#3540)
     * Update markbates/goth library to support OAuth2 with new dropbox API (#3533) (#3539)
     * Fixes missing avatars in offline mode (#3471) (#3477)
     * Fix synchronization bug in repo indexer (#3455) (#3461)
     * Fix rendering of wiki page list if wiki repo contains other files (#3454) (#3463)
  • Fix webhook X-GitHub-* headers casing for better compatibility (#3429)
  • Add content type and doctype to requests made with go-get (#3426, #3423)
  • Fix SQL type error for webhooks (#3424)
  • Fix PR merge error (#3421)
  • Recognize more characters in crossreferenced repo name (#3413)
  • Fix MSSQL bug on org (#3405)
  • HTML escape all lines of the search result (#3402)
  • Change local copy origin url after repository rename (#3399)
  • Force-push to base repo's ref/pull/#/head (#3393)
  • Fix bug when a user delete but assigned on issue (#3318)
  • Use issue number/index instead of id for API URL. Fix #3297 (#3298)
  • Fix repo-transfer-and-team-repo-count bug (#3241)
  • Fix always-on SSL Mode checkbox in admin page (#3208)
  • Fix source download link when no code unit allowed (#3166)
  • Fix org owner cannot be removed if he is not in owner team (#3164)
  • Fix run web with -p push failed (#3154)
  • Fix gpg tmpl (#3153)
  • Fix SSH auth lfs locks (#3152)
  • Improvements for supporting UI Location (#3146)
  • Fix new pull request link (#3133)
  • Fix missing branch in release bug (#3108)
  • Allow adding collaborators with (fullname) (#3103)
  • Fix repo links (#3093)
  • fix lfs url refs + keep path upper/lowercase in db. (#3092)
  • Fix redis session failed (#3086)
  • Fix bugs in issue dashboard stats (#3073)
  • Fix avatar URLs (#3069)
  • Fix ref parsing in commit messages (#3067)
  • Fix issue list branch link broken (#3061)
  • sendmail: correct option to set envelope-sender (#3044)
  • Fix missing password length check when change password (#3039)
  • Fix git lfs path (#3016)
  • Fix API-Endpoint release (#3005) (#3012)
  • Set OpenID support on by default when installing new instance (#3010)
  • Various wiki bug fixes (#2996)
  • Fix go-get, src and raw urls to new scheme (#2978)
  • Fix error when add user has full name to team (#2973)
  • Fix memcache support when value is returned as string always (#2924)
• ENHANCEMENT
  • Use GiteaServer as the user agent for http requests (#3404)
  • Delete indexer DB entries when (re)creating index (#3385)
  • Change how merged PR commit info are prepared (#3368)
  • Asynchronously populate the repo indexer (#3366)
  • Make the default action for the gitea executable that of running the webserver (#3331)
  • Templates for extra links in top navbar and repo tool tabs. (#3308)
  • Fixed asterisk based tasklist items #3295 (#3296)
  • Add more additional template snippets (#3286)
  • Open external tracker in blank window, consistently with wiki (#3227)
  • Fix repo links on user profile (#3197)
  • Enable emoji for wiki view (#3158)
  • Small improve on deleting attachements (#3145)
  • Reduce overhead of upgrades for users with custom stylesheets/JS (#3051)
  • Default log level to Info without hardcoding it in installer (#3041)
  • Memory usage improvements (#3013)
  • Add fingerprint to ssh key endpoints. (#3009)
  • Improve memory usage when reaching diff limits (#2990)
  • Expandable commit bodies (#2980)
  • Update gitgraph.js to fix blurry commit graph on HiDPI screens (#2957)
  • Fix language names (#2955)
  • Remove render issue link (#2954)
  • Page parameter for repo search API (#2915)
  • Apply LANDING_PAGE config options for logged in users (#2894)
  • Enable admin to search by email (#2888)
  • Hide add key button if SSH is disabled (#2873)
  • Fix comment API paths (#2813)
  • Add an option to allow redirect of http port 80 to https. (#1928)
• MISC
  • Fix organization profile on mobile devices (#3332)
  • Fix guide link for webhooks in repository settings (#3291) (#3292)
  • Enable Libravatar by default in new installations (#3287)
  • Improve suppressed diff boxes (#3193)
  • fix button heights on commits page (#3091)
  • Minor copy changes (#3074)
  • Sort repos in issues dashboard sidebar (#3072)
  • Remove box-shadow from UI, fix dashboard issue (#3065)
  • Adjust branch button size (#3063)
  • Fix misalignment issue in repo header (#3062)
  • Delete a user's public key via admin api (closes #3014) (#3059)
  • Dashboard: Fix line height problem in issue titles (#3054)
  • Remove duplicate "Max Diff Lines" from config view (#2987)
  • Drop unmaintained gogs migration script (#2947)
  • App restarts to quickly if it fails to start. (#2945)
  • Add owner to delete repo message (#2886)

v1.4.0-rc3

• SECURITY
  • Refactor and simplify to correctly validate redirect to URL (#3674) (#3676)
• BUGFIXES
  • Update markbates/goth library to fix OAuth2 support (#3661) (#3663)
  • Fix column removal in MSSQL (#3638) (#3640)
  • Fix wiki inter-links with spaces (#3560) (#3632)

v1.4.0-rc2

• SECURITY
  • Fix escaping changed title in comments (#3530) (#3534)
  • Escape search query (#3486) (#3488)
• BUGFIXES
  • Fix query protected branch bug (#3563) (#3571)
  • Fix remove team member issue (#3566) (#3570)
  • Fix the protected branch panic issue (#3567) (#3569)
  • If Mirrors repository no content is fetched, updated time should not be changed (#3551) (#3565)
  • Bug fix for mirrored repository releases sorted (#3522) (#3555)
  • Add issue closed time column to fix activity closed issues list (#3537) (#3540)
  • Update markbates/goth library to support OAuth2 with new dropbox API (#3533) (#3539)
  • Fixes missing avatars in offline mode (#3471) (#3477)
  • Fix synchronization bug in repo indexer (#3455) (#3461)
  • Fix rendering of wiki page list if wiki repo contains other files (#3454) (#3463)