Skip to content
Try Gitea Cloud ☁️ for 30 days → Accelerate your Development & Deploys!
GiteaGitea Blog

Gitea 1.27.1 is released

bircni
bircniTechnical Oversight Committee
TheFox0x7
TheFox0x7Technical Oversight Committee
1.27.1Release

We are excited to announce the release of Gitea 1.27.1, the first patch release for the 1.27 series. It contains security fixes and a large batch of bug fixes, many of them for Gitea Actions. We strongly recommend that all users upgrade as soon as possible.

Security

Section titled “Security”

This release addresses the following security vulnerabilities. Please upgrade as soon as possible.

Notable fixes

Section titled “Notable fixes”

Actions

Section titled “Actions”
  • pull_request_target runs now build their context from the base branch ref instead of the fork head (#38657).
  • Jobs no longer get stuck in cancelling after a Gitea restart: tasks are cancelled immediately once a runner stops reporting (#38644).
  • Multi-line run: blocks now round-trip correctly through workflow serialization, which previously stranded jobs without any visible error (#38599).
  • A batch of correctness and hardening fixes (#38631): reusable-workflow expansion now respects the per-run job limit, rerun-failed no longer re-runs every job on a green run, and externally posted commit statuses are no longer adopted into the legacy status hash.
  • Expression fixes: matrix is available when evaluating workflow-level if (#38557), cancelled() works in job if (#38497), and workflow_dispatch boolean inputs are coerced to native types (#38521).
  • Scheduled runs now populate github.event (#38452), blocked or waiting jobs explain why they have not started (#38498), and the runner list gained better status sorting, labels and task job links (#38633).
  • The log parser handles multi-line messages again, so they render correctly in the run view instead of being collapsed (#38664).

Repositories, pull requests and auth

Section titled “Repositories, pull requests and auth”
  • Cloning over HTTP redirects works again — the 1.27.0 restriction was reverted to the 1.26 behavior (#38545).
  • The mandatory two-factor policy is now enforced on the OAuth2 authorize and grant endpoints (#38606).
  • Signing out of an OAuth2-linked account that signed in with the password form no longer redirects through the provider’s end-session endpoint; RP-initiated OIDC logout is now keyed off the sign-in method of the session (#38666).
  • Deleting a repository or a user now cleans up the rows that were previously left orphaned in several tables (#38618, #38514).
  • Gitea keeps serving a valid ACME certificate when renewal fails at startup instead of failing to start (#38583).
  • Updating a branch by merge now signs the resulting commit (#38499), commit messages merge correctly (#38502), the merge box button turns red when checks fail (#38516), and the diff file tree respects diff.orderFile (#38578).
  • Diff contrast was improved in both the light and dark themes (#38574).

This release includes 48 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Section titled “How to install or update”

Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation

Special Thanks

Section titled “Special Thanks”

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

Section titled “Changelog”

1.27.1 - 2026-07-27

Section titled “1.27.1 - 2026-07-27”

  • SECURITY

  • BUGFIXES

    • Fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
    • Fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
    • Fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
    • Fix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)
    • Fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
    • Fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
    • Fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
    • Fix(actions): correctness and hardening fixes (#38518) (#38631)
    • Fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
    • Fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
    • Fix(webhook): remove slack channel name check (#38608) (#38612)
    • Fix: download dropdown menu clipped on the branches page (#38604) (#38609)
    • Fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
    • Fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
    • Fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
    • Fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
    • Fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
    • Fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter’s cross-run processing (#38565) (#38587)
    • Fix: branch protection user list (#38570) (#38584)
    • Fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
    • Fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
    • Fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
    • Fix(actions): align status icon span for Safari rendering (#38558) (#38562)
    • Fix(actions): support matrix when evaluating workflow if expression (#38474) (#38557)
    • Fix: revert git clone http redirection forbidden (#38530) (#38545)
    • Fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
    • Fix: make the merge box button red if some checks fail (#38508) (#38516)
    • Fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
    • Fix: make commit message merge correctly (#38490) (#38502)
    • Fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
    • Fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
    • Fix(actions): make cancelled() work in job if evaluation (#38495) (#38497)
    • Fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
    • Fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
    • Fix: full file highlighting for git diff with CR char (#38484) (#38491)
    • Fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
    • Fix: 500 error when updating user visibility (#38480) (#38483)
    • Fix(actions): make job list item fully clickable (#38462) (#38471)
    • Fix: mail template for push event (#38467) (#38468)
    • Fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
    • Fix: make “test push webhook” always work (#38425) (#38455)
    • Fix(org): align follow button and wrap description (#38448) (#38454)
    • Fix(actions): populate github.event for scheduled runs (#38446) (#38452)

  • ENHANCEMENTS

    • Enhance: improve diff contrast in light and dark themes (#37477) (#38574)

Contributors

Section titled “Contributors”

Subscribe to our newsletter

Stay up to date with all things Gitea