This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [gitea/gitea](https://github.com/go-gitea/gitea) | major | `1.27.3` → `28.0.0` |
---
### Release Notes
<details>
<summary>go-gitea/gitea (gitea/gitea)</summary>
### [`v28.0.0`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#2800---2026-09-30)
[Compare Source](https://github.com/go-gitea/gitea/compare/v1.27.3...v28.0.0)
- BREAKING
- Fix(git)!: route Git network operations through an internal proxy and update egress settings ([#​39426](https://github.com/go-gitea/gitea/pull/39426))
- Feat(actions)!: add RUN\_RETENTION\_DAYS to delete old action runs ([#​38855](https://github.com/go-gitea/gitea/pull/38855))
- SECURITY
- Fix(git): reject invalid and duplicate Git objects on push ([#​39472](https://github.com/go-gitea/gitea/pull/39472))
- Fix(git)!: route Git network operations through an internal proxy and update egress settings ([#​39426](https://github.com/go-gitea/gitea/pull/39426))
- Fix(ssh): identify presented public keys by fingerprint ([#​39423](https://github.com/go-gitea/gitea/pull/39423))
- Fix(actions): keep cancelled and unapproved fork PR runs behind the approval gate ([#​39399](https://github.com/go-gitea/gitea/pull/39399))
- Fix(deps): update golang.org/x/crypto SSH to address denial of service ([#​39219](https://github.com/go-gitea/gitea/pull/39219))
- Fix(repo): enforce repository-scoped authorization for team access, deletion, and package unlinking ([#​39063](https://github.com/go-gitea/gitea/pull/39063))
- FEATURES
- Feat(actions): update actionslib, support `self:`, misc fixes ([#​39358](https://github.com/go-gitea/gitea/pull/39358))
- Feat(api): list all packages for site administrators ([#​38968](https://github.com/go-gitea/gitea/pull/38968))
- Feat: manage bot accounts from the admin UI, API and CLI ([#​38966](https://github.com/go-gitea/gitea/pull/38966))
- Feat(user): Personal access tokens can be regenerated ([#​38907](https://github.com/go-gitea/gitea/pull/38907))
- Feat(actions): support `$/` prefix in reusable workflow `uses:` ([#​38822](https://github.com/go-gitea/gitea/pull/38822))
- Feat(actions): add force-cancel workflow run API ([#​38756](https://github.com/go-gitea/gitea/pull/38756))
- Feat(licenses): support REUSE specification in licenses ([#​38720](https://github.com/go-gitea/gitea/pull/38720))
- Feat(api): add project APIs ([#​38691](https://github.com/go-gitea/gitea/pull/38691))
- Feat(webhook): fire repository event on repo rename ([#​38641](https://github.com/go-gitea/gitea/pull/38641))
- Feat: admin impersonates a user ([#​38614](https://github.com/go-gitea/gitea/pull/38614))
- Feat(actions): add build queue view ([#​38585](https://github.com/go-gitea/gitea/pull/38585))
- Feat(setting): add shared \[redis] section as default for redis-backed subsystems ([#​38550](https://github.com/go-gitea/gitea/pull/38550))
- Feat(repo): prioritize well-known READMEs and optimize discovery ([#​38532](https://github.com/go-gitea/gitea/pull/38532))
- Feat(actions): implement adaptive auto-refresh for workflow runs list ([#​38329](https://github.com/go-gitea/gitea/pull/38329))
- Feat(auth): add `disable-2fa` command ([#​38275](https://github.com/go-gitea/gitea/pull/38275))
- Feat: Add audit logging ([#​38189](https://github.com/go-gitea/gitea/pull/38189))
- Feat(repo): add quick repository switcher to repo header ([#​38188](https://github.com/go-gitea/gitea/pull/38188))
- Feat(repo): support file exclusion logic in .gitea/template in template generation ([#​38064](https://github.com/go-gitea/gitea/pull/38064))
- Feat(web): Add org removal functionality to admin user details page ([#​38013](https://github.com/go-gitea/gitea/pull/38013))
- Feat: add watch options ([#​37571](https://github.com/go-gitea/gitea/pull/37571))
- Feat: add deploy tokens ([#​37306](https://github.com/go-gitea/gitea/pull/37306))
- Feat(diff): Add search and extension filter to diff sidebar ([#​37068](https://github.com/go-gitea/gitea/pull/37068))
- Feat: Replace SSE with WebSocket for UI notifications ([#​36965](https://github.com/go-gitea/gitea/pull/36965))
- Feat(actions): Add artifact preview in Actions run view ([#​36754](https://github.com/go-gitea/gitea/pull/36754))
- Feat(packages): add support for uploading helm provenance files ([#​36695](https://github.com/go-gitea/gitea/pull/36695))
- Feat: Add support for dynamic matrix evaluation in Gitea Actions workflows ([#​36564](https://github.com/go-gitea/gitea/pull/36564))
- Feat: Add max-parallel Support for Gitea Actions ([#​36357](https://github.com/go-gitea/gitea/pull/36357))
- Feat(actions): Add Actions API endpoints for workflow run management and logs ([#​35382](https://github.com/go-gitea/gitea/pull/35382))
- Feat: Add block on pending codeowner reviews branch protection ([#​34995](https://github.com/go-gitea/gitea/pull/34995))
- ENHANCEMENTS
- Enhance: allow auto-closing PRs from PRs ([#​39393](https://github.com/go-gitea/gitea/pull/39393))
- Enhance(actions): add pending job status and align job statuses with GitHub ([#​39376](https://github.com/go-gitea/gitea/pull/39376))
- Enhance(acme): add configurable ACME profile ([#​39375](https://github.com/go-gitea/gitea/pull/39375))
- Enhance(emoji): update to Unicode 17, unify and lazy-load emoji data ([#​39363](https://github.com/go-gitea/gitea/pull/39363))
- Enhance: improve issue-pattern capture groups and support both internal\&external trackers enabled ([#​39354](https://github.com/go-gitea/gitea/pull/39354))
- Enhance: update mermaid to v12 ([#​39331](https://github.com/go-gitea/gitea/pull/39331))
- Enhance(notifications): mark current notification page as read ([#​39294](https://github.com/go-gitea/gitea/pull/39294))
- Enhance: support `ETag` on streamed repository archives, support `If-None-Match: *` ([#​39289](https://github.com/go-gitea/gitea/pull/39289))
- Enhance: truncate but show long lines in diffs ([#​39279](https://github.com/go-gitea/gitea/pull/39279))
- Enhance(packages): implement npm single-version API and add per-version repository ([#​39267](https://github.com/go-gitea/gitea/pull/39267))
- Enhance: move window\.config to JSON, improve CSP format ([#​39236](https://github.com/go-gitea/gitea/pull/39236))
- Enhance: improve commit page header ([#​39229](https://github.com/go-gitea/gitea/pull/39229))
- Enhance: Improve validation errors for secrets/variables ([#​39221](https://github.com/go-gitea/gitea/pull/39221))
- Enhance(repo): check full repo name for dangerous operations ([#​39213](https://github.com/go-gitea/gitea/pull/39213))
- Enhance(web): hide attachment dropzone on preview tab in combo editor ([#​39204](https://github.com/go-gitea/gitea/pull/39204))
- Enhance(web): show attachment URL and UUID in dropzone preview ([#​39203](https://github.com/go-gitea/gitea/pull/39203))
- Enhance(actions): make workflow dispatch choice dropdown support search ([#​39154](https://github.com/go-gitea/gitea/pull/39154))
- Enhance(repo): unify diff stats on commit pages, misc diff tweaks ([#​39134](https://github.com/go-gitea/gitea/pull/39134))
- Enhance: use browser's locale to detect week's first day for the contribution map ([#​38995](https://github.com/go-gitea/gitea/pull/38995))
- Enhance(ui): forced colors mode enhancements ([#​38991](https://github.com/go-gitea/gitea/pull/38991))
- Enhance: user-friendly packages setup manual ([#​38946](https://github.com/go-gitea/gitea/pull/38946))
- Enhance: inherit team access for all units ([#​38938](https://github.com/go-gitea/gitea/pull/38938))
- Enhance(admin): show impersonation banner and keep password change with the user ([#​38924](https://github.com/go-gitea/gitea/pull/38924))
- Enhance(ui): tint toast backgrounds by level ([#​38919](https://github.com/go-gitea/gitea/pull/38919))
- Enhance(repo): add default object format setting ([#​38877](https://github.com/go-gitea/gitea/pull/38877))
- Enhance(actions): set ref\_protected in context ([#​38852](https://github.com/go-gitea/gitea/pull/38852))
- Enhance(ui): restyle toasts ([#​38842](https://github.com/go-gitea/gitea/pull/38842))
- Enhance: refine repo watching ([#​38835](https://github.com/go-gitea/gitea/pull/38835))
- Enhance: fall back to DEFAULT\_TEMPLATE.md when style-specific template is missing ([#​38803](https://github.com/go-gitea/gitea/pull/38803))
- Enhance(api): add GitHub-compatible /repos/{owner}/{repo}/commits/{ref} endpoint ([#​38770](https://github.com/go-gitea/gitea/pull/38770))
- Enhance(api): expose file mode in contents API response ([#​38713](https://github.com/go-gitea/gitea/pull/38713))
- Enhance(tls): use go's tls defaults ([#​38687](https://github.com/go-gitea/gitea/pull/38687))
- Enhance(ui): improve luminance calculations ([#​38682](https://github.com/go-gitea/gitea/pull/38682))
- Enhance(api): add `tag_filter` query parameter to release list API ([#​38681](https://github.com/go-gitea/gitea/pull/38681))
- Enhance(actions): replace `ansi_up` with first-party code ([#​38619](https://github.com/go-gitea/gitea/pull/38619))
- Enhance: keep status check list scrolled on merge box reload ([#​38597](https://github.com/go-gitea/gitea/pull/38597))
- Enhance(actions): action view enhancements ([#​38594](https://github.com/go-gitea/gitea/pull/38594))
- Enhance(ui): tweak tooltip style and misc fixes ([#​38524](https://github.com/go-gitea/gitea/pull/38524))
- Enhance: improve e-mail templates ([#​38396](https://github.com/go-gitea/gitea/pull/38396))
- Enhance(webhook): add reviewer name to MS Teams review request notifications ([#​38289](https://github.com/go-gitea/gitea/pull/38289))
- Enhance: extend <video> tag allowed attributes ([#​38279](https://github.com/go-gitea/gitea/pull/38279))
- Enhance(packages/npm): expand version metadata and support npm deprecate ([#​37890](https://github.com/go-gitea/gitea/pull/37890))
- PERFORMANCE
- Perf(references): scan only the keyword window before a reference ([#​39396](https://github.com/go-gitea/gitea/pull/39396))
- Perf(frontend): enable vite module preload ([#​39332](https://github.com/go-gitea/gitea/pull/39332))
- Perf(gitdiff): optimize inline diff highlighting using cache ([#​38706](https://github.com/go-gitea/gitea/pull/38706))
- BUGFIXES
- Fix(actions): preserve admitted jobs and runs in their concurrency group ([#​39461](https://github.com/go-gitea/gitea/pull/39461))
- Fix(api): commit tree SHA is the commit ID ([#​39449](https://github.com/go-gitea/gitea/pull/39449))
- Fix: PR merge ([#​39442](https://github.com/go-gitea/gitea/pull/39442))
- Fix(actions): evaluate job-level `if:` before concurrency check ([#​39437](https://github.com/go-gitea/gitea/pull/39437))
- Fix(api): allow pending-inline-comment-only reviews ([#​39433](https://github.com/go-gitea/gitea/pull/39433))
- Fix: sanitize external render command line arguments ([#​39417](https://github.com/go-gitea/gitea/pull/39417))
- Fix(LFS): recalculate repo LFSSize after gc-lfs removes orphaned data ([#​39406](https://github.com/go-gitea/gitea/pull/39406))
- Fix(indexer): index full file paths and real offsets in bleve ([#​39405](https://github.com/go-gitea/gitea/pull/39405))
- Fix(git): keep leading dashes in git grep search patterns ([#​39404](https://github.com/go-gitea/gitea/pull/39404))
- Fix: use clearer message for ldap auth failure ([#​39392](https://github.com/go-gitea/gitea/pull/39392))
- Fix(repo): commit page fails to render unsigned commits with a different committer ([#​39381](https://github.com/go-gitea/gitea/pull/39381))
- Fix: focus confirm button and use red for delete confirmations ([#​39350](https://github.com/go-gitea/gitea/pull/39350))
- Fix(migrations): preserve SHA-256 pull request commit IDs ([#​39343](https://github.com/go-gitea/gitea/pull/39343))
- Fix(ui): misc ui fixes ([#​39336](https://github.com/go-gitea/gitea/pull/39336))
- Fix(actions): use gitea's clock for actions durations ([#​39323](https://github.com/go-gitea/gitea/pull/39323))
- Fix(actions): never show negative running durations ([#​39322](https://github.com/go-gitea/gitea/pull/39322))
- Fix: package registry keypair creation race ([#​39319](https://github.com/go-gitea/gitea/pull/39319))
- Fix: add default timeout and handle errors for HaveIBeenPwned API ([#​39316](https://github.com/go-gitea/gitea/pull/39316))
- Fix(user): unify email validation for registration and settings ([#​39304](https://github.com/go-gitea/gitea/pull/39304))
- Fix(ui): use button elements for branch and tag dropdown tabs ([#​39285](https://github.com/go-gitea/gitea/pull/39285))
- Fix(auth): fix ssh and gpg key verification on windows ([#​39283](https://github.com/go-gitea/gitea/pull/39283))
- Fix(feed): use meaningful lines as comment excerpt ([#​39276](https://github.com/go-gitea/gitea/pull/39276))
- Fix(projects): allow max columns to the limit ([#​39272](https://github.com/go-gitea/gitea/pull/39272))
- Fix: pass merge commit messages to git via stdin ([#​39269](https://github.com/go-gitea/gitea/pull/39269))
- Fix(repo): surface unrelated histories on Sync Fork ([#​39258](https://github.com/go-gitea/gitea/pull/39258))
- Fix: avoid nil panic and refactor some trivial problems ([#​39251](https://github.com/go-gitea/gitea/pull/39251))
- Fix: restore missing blob file when re-publishing a package ([#​39239](https://github.com/go-gitea/gitea/pull/39239))
- Fix(automerge): validate head commit before merge ([#​39235](https://github.com/go-gitea/gitea/pull/39235))
- Fix(httplib): prevent leaking localhost:3000 in public links ([#​39217](https://github.com/go-gitea/gitea/pull/39217))
- Fix(setting): honor bare -1 for timeout settings ([#​39181](https://github.com/go-gitea/gitea/pull/39181))
- Fix: correct repo/attatchment absolute url and release layout ([#​39178](https://github.com/go-gitea/gitea/pull/39178))
- Fix(web): populate the reason for "cannot commit to branch" in web editor commit form ([#​39155](https://github.com/go-gitea/gitea/pull/39155))
- Fix(process): reap entire process group on cmd.Cancel ([#​39143](https://github.com/go-gitea/gitea/pull/39143))
- Fix: recognize linguist language aliases ([#​39135](https://github.com/go-gitea/gitea/pull/39135))
- Fix(repo): preserve transfer recipient collaboration ([#​39042](https://github.com/go-gitea/gitea/pull/39042))
- Fix(db): make paginated database reads always require "order" option ([#​39017](https://github.com/go-gitea/gitea/pull/39017))
- Fix: make local queue PopItem can be notified ([#​39011](https://github.com/go-gitea/gitea/pull/39011))
- Fix: classify git failures on stderr, restrict migration failure detail ([#​39010](https://github.com/go-gitea/gitea/pull/39010))
- Fix: allow re-requesting uncounted review approvals ([#​38988](https://github.com/go-gitea/gitea/pull/38988))
- Fix(actions): allow larger scheduled workflows ([#​38985](https://github.com/go-gitea/gitea/pull/38985))
- Fix: resolve actions commit status permission per repository ([#​38977](https://github.com/go-gitea/gitea/pull/38977))
- Fix(deps): update module golang.org/x/image to v0.45.0 \[security] ([#​38930](https://github.com/go-gitea/gitea/pull/38930))
- Fix(deps): update module golang.org/x/mod to v0.40.0 \[security] ([#​38914](https://github.com/go-gitea/gitea/pull/38914))
- Fix: dedupe issue cross-reference timeline entries ([#​38881](https://github.com/go-gitea/gitea/pull/38881))
- Fix(server): set `ReadHeaderTimeout` on HTTP servers ([#​38878](https://github.com/go-gitea/gitea/pull/38878))
- Fix(repo): avoid a repo-sized temp file for every bundle download ([#​38863](https://github.com/go-gitea/gitea/pull/38863))
- Fix(lfs): ensure lock listing paginates with a total order ([#​38850](https://github.com/go-gitea/gitea/pull/38850))
- Fix(avatar): use sha256 and inline the federated avatar lookup ([#​38843](https://github.com/go-gitea/gitea/pull/38843))
- Fix(gitdiff): render exact-limit diffs and zero-limit comments ([#​38838](https://github.com/go-gitea/gitea/pull/38838))
- Fix(deps): update dependency mermaid to v11.16.1 \[security] ([#​38813](https://github.com/go-gitea/gitea/pull/38813))
- Fix: misc fixes in pub/gpg/tests ([#​38809](https://github.com/go-gitea/gitea/pull/38809))
- Fix: git diff blob excerpt ([#​38808](https://github.com/go-gitea/gitea/pull/38808))
- Fix(packages): show error for duplicate cleanup rules [#​37820](https://github.com/go-gitea/gitea/issues/37820) ([#​38786](https://github.com/go-gitea/gitea/pull/38786))
- Fix(actions): fix runner docs link ([#​38783](https://github.com/go-gitea/gitea/pull/38783))
- Fix: git cache ([#​38763](https://github.com/go-gitea/gitea/pull/38763))
- Fix(actions): evaluate each `${{ }}` part on its own ([#​38754](https://github.com/go-gitea/gitea/pull/38754))
- Fix: don't report failed network requests as JavaScript errors ([#​38732](https://github.com/go-gitea/gitea/pull/38732))
- Fix(gitdiff): prevent index out of range panic in GetLineTypeMarker ([#​38728](https://github.com/go-gitea/gitea/pull/38728))
- Fix(api): document X-Total-Count instead of non-existent X-Total header ([#​38717](https://github.com/go-gitea/gitea/pull/38717))
- Fix(actions): dynamic matrix expansion correctness fixes ([#​38690](https://github.com/go-gitea/gitea/pull/38690))
- Fix(auth): record last sign-in on reverse proxy login ([#​38672](https://github.com/go-gitea/gitea/pull/38672))
- Fix(api): accept fully-qualified refs in contents API ([#​38650](https://github.com/go-gitea/gitea/pull/38650))
- Fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 \[security] ([#​38623](https://github.com/go-gitea/gitea/pull/38623))
- Fix(deps): update dependency js-yaml to v5.2.2 \[security] ([#​38622](https://github.com/go-gitea/gitea/pull/38622))
- Fix: abort superseded issue suggestion requests ([#​38620](https://github.com/go-gitea/gitea/pull/38620))
- Fix(issue): display error toast on batch action failures instead of reloading page ([#​38593](https://github.com/go-gitea/gitea/pull/38593))
- Fix(deps): update module google.golang.org/grpc to v1.82.1 \[security] ([#​38567](https://github.com/go-gitea/gitea/pull/38567))
- Fix(deps): update module github.com/google/go-github/v88 to v89 ([#​38433](https://github.com/go-gitea/gitea/pull/38433))
- Fix(deps): update go dependencies ([#​38429](https://github.com/go-gitea/gitea/pull/38429))
- Fix(deps): update go dependencies ([#​38346](https://github.com/go-gitea/gitea/pull/38346))
- Fix(deps): update npm dependencies ([#​38342](https://github.com/go-gitea/gitea/pull/38342))
- Fix(base): correct natural sort of numbers with leading zeros ([#​38163](https://github.com/go-gitea/gitea/pull/38163))
- Fix(ui): avoid layout shifts in `overflow-menu` and repo filter ([#​37818](https://github.com/go-gitea/gitea/pull/37818))
- Fix: make auth source group sync correctly handle team removal ([#​37161](https://github.com/go-gitea/gitea/pull/37161))
- Fix(release): separate publication time from the release date ([#​36761](https://github.com/go-gitea/gitea/pull/36761))
- TESTING
- Test: stop tests from writing into `~/.ssh` ([#​39348](https://github.com/go-gitea/gitea/pull/39348))
- Test(e2e): log out to switch users in pr-review test ([#​39328](https://github.com/go-gitea/gitea/pull/39328))
- Test: release fixtures loader lock before database work ([#​39263](https://github.com/go-gitea/gitea/pull/39263))
- Test: speed up tests, fix transaction bug ([#​39030](https://github.com/go-gitea/gitea/pull/39030))
- Test: run frontend unit tests in browsers ([#​38860](https://github.com/go-gitea/gitea/pull/38860))
- Test(pubsub): stop racing the Redis SUBSCRIBE ack ([#​38661](https://github.com/go-gitea/gitea/pull/38661))
- Test(e2e): add pull request merge box test, update AGENTS.md ([#​38576](https://github.com/go-gitea/gitea/pull/38576))
- Test(e2e): deterministically wait for event stream in logout propagation test ([#​38535](https://github.com/go-gitea/gitea/pull/38535))
- BUILD
- Refactor: fix `go vet` errors related to composite literals ([#​39341](https://github.com/go-gitea/gitea/pull/39341))
- Build(gogit): disable gogit builds for stable releases ([#​39324](https://github.com/go-gitea/gitea/pull/39324))
- Refactor: replace jquery.are-you-sure with first-party code ([#​39233](https://github.com/go-gitea/gitea/pull/39233))
- Refactor: http request binding ([#​38971](https://github.com/go-gitea/gitea/pull/38971))
- Refactor: clean up git repo and model migration packages ([#​38564](https://github.com/go-gitea/gitea/pull/38564))
- Refactor: prepare to decouple the "model migration" package and "models" package ([#​38533](https://github.com/go-gitea/gitea/pull/38533))
- Build: fix snapcraft release ([#​38260](https://github.com/go-gitea/gitea/pull/38260))
- Build(release): use native golang toolchain for official release builds ([#​37828](https://github.com/go-gitea/gitea/pull/37828))
- DOCS
- Docs(webhook): review\.type comment lists values the webhook never sends ([#​39451](https://github.com/go-gitea/gitea/pull/39451))
- Docs(api): document verification and files on the compare endpoint ([#​39440](https://github.com/go-gitea/gitea/pull/39440))
- Docs(api): name the unadopted-repository search parameter query ([#​39370](https://github.com/go-gitea/gitea/pull/39370))
- Docs: remove unused COOKIE\_USERNAME from app.example.ini ([#​39365](https://github.com/go-gitea/gitea/pull/39365))
- Docs: document NOTICE\_ON\_SUCCESS for every cron task ([#​39352](https://github.com/go-gitea/gitea/pull/39352))
- Docs: correct ALLOW\_LOCALNETWORKS description in app.example.ini ([#​39240](https://github.com/go-gitea/gitea/pull/39240))
- Docs: fix typo in README about app.ini restart ([#​39223](https://github.com/go-gitea/gitea/pull/39223))
- Docs: fix dead localization doc link in the READMEs ([#​39211](https://github.com/go-gitea/gitea/pull/39211))
- Docs: Update CHANGELOG for release 1.27.3 ([#​39170](https://github.com/go-gitea/gitea/pull/39170))
- Docs: Update CHANGELOG for version 1.27.2 ([#​38923](https://github.com/go-gitea/gitea/pull/38923))
- Docs: Update PGP key expiration date to July 23, 2027 ([#​38747](https://github.com/go-gitea/gitea/pull/38747))
- Docs(api): document 401/403 responses for user key endpoints ([#​38711](https://github.com/go-gitea/gitea/pull/38711))
- Docs: Update Changelog for release v1.27.1 ([#​38670](https://github.com/go-gitea/gitea/pull/38670))
- Docs: Update Changelog for 1.27 ([#​38440](https://github.com/go-gitea/gitea/pull/38440))
- Docs: Update Security docs ([#​38422](https://github.com/go-gitea/gitea/pull/38422))
- MISC
- Refactor: make git http respond error message ([#​39390](https://github.com/go-gitea/gitea/pull/39390))
- Refactor(api): convert bot accounts through the admin user edit endpoint ([#​39355](https://github.com/go-gitea/gitea/pull/39355))
- Refactor: replace AWS SDK with a REST client for CodeCommit migration ([#​39330](https://github.com/go-gitea/gitea/pull/39330))
- Refactor: replace Azure Blob SDK with a REST client ([#​39315](https://github.com/go-gitea/gitea/pull/39315))
- Refactor: npm route handlers ([#​39275](https://github.com/go-gitea/gitea/pull/39275))
- Refactor: GetDiffShortStat and fix panic caused by inconsistent "changed file number" ([#​39248](https://github.com/go-gitea/gitea/pull/39248))
- Refactor(templates): update djlint to 1.46.0 and resolve its new findings ([#​39231](https://github.com/go-gitea/gitea/pull/39231))
- Refactor: pagination/pager ([#​39162](https://github.com/go-gitea/gitea/pull/39162))
- Refactor: share package registry error status classification ([#​39133](https://github.com/go-gitea/gitea/pull/39133))
- Refactor: drop two unmaintained dependencies, rename the byte size helpers ([#​39083](https://github.com/go-gitea/gitea/pull/39083))
- Refactor(automerge): fix error handling, populate recent automerge tasks on restart ([#​39001](https://github.com/go-gitea/gitea/pull/39001))
- Refactor: deploy key and private route handlers ([#​38999](https://github.com/go-gitea/gitea/pull/38999))
- Refactor: wiki edit form ([#​38918](https://github.com/go-gitea/gitea/pull/38918))
- Refactor: clean up form binding & validation ([#​38873](https://github.com/go-gitea/gitea/pull/38873))
- Refactor: markup render ([#​38864](https://github.com/go-gitea/gitea/pull/38864))
- Refactor: api token scope check ([#​38862](https://github.com/go-gitea/gitea/pull/38862))
- Refactor: replace `gliderlabs/ssh` with `golang.org/x/crypto/ssh` ([#​38837](https://github.com/go-gitea/gitea/pull/38837))
- Refactor: form binding validation ([#​38832](https://github.com/go-gitea/gitea/pull/38832))
- Refactor: prepare vue components for vapor mode ([#​38798](https://github.com/go-gitea/gitea/pull/38798))
- Refactor: use the shared workflow model from actionslib ([#​38768](https://github.com/go-gitea/gitea/pull/38768))
- Refactor(modelmigration): thread context through migration functions ([#​38758](https://github.com/go-gitea/gitea/pull/38758))
- Refactor: migrate remaining Vue components to `<script setup>` ([#​38752](https://github.com/go-gitea/gitea/pull/38752))
- Refactor: introduce trString for frontend ([#​38741](https://github.com/go-gitea/gitea/pull/38741))
- Refactor(diff): drive diff DOM init from the global selector observer ([#​38740](https://github.com/go-gitea/gitea/pull/38740))
- Refactor(git): clarify GetBranch behavior to make it only gets an existing branch ([#​38662](https://github.com/go-gitea/gitea/pull/38662))
- Refactor: replace debounce/throttle deps with first-party code ([#​38610](https://github.com/go-gitea/gitea/pull/38610))
- Refactor: hide git repo path details from more packages ([#​38601](https://github.com/go-gitea/gitea/pull/38601))
- Refactor: retry file remove/rename when a file is busy and clean up os detection ([#​38588](https://github.com/go-gitea/gitea/pull/38588))
- Perf(emoji): optimize FindEmojiSubmatchIndex using slice-based Trie ([#​38573](https://github.com/go-gitea/gitea/pull/38573))
- Refactor: implement mcaptcha client and add comments/tests ([#​38561](https://github.com/go-gitea/gitea/pull/38561))
- Refactor: use WithRepo instead of WithDir for most git operations, clean up model migrations ([#​38555](https://github.com/go-gitea/gitea/pull/38555))
- Refactor: remove Path field from git.Repository ([#​38552](https://github.com/go-gitea/gitea/pull/38552))
- Refactor: make git package handle all git operations ([#​38543](https://github.com/go-gitea/gitea/pull/38543))
- Refactor: remove unnecessary git command wrapper functions ([#​38531](https://github.com/go-gitea/gitea/pull/38531))
- Refactor: git repo and relative path handling ([#​38522](https://github.com/go-gitea/gitea/pull/38522))
- Refactor: clean up fragile diff render templates, use backend typed structs ([#​38517](https://github.com/go-gitea/gitea/pull/38517))
- Refactor: correct git repo design and fix some legacy problems ([#​38512](https://github.com/go-gitea/gitea/pull/38512))
- Refactor: fix legacy problems in cmd/serv.go ([#​38505](https://github.com/go-gitea/gitea/pull/38505))
- Refactor: remove Ctx field from git.Repository ([#​38500](https://github.com/go-gitea/gitea/pull/38500))
- Refactor: decouple git.Repository(ctx) from git.Commit & git.Tree ([#​38464](https://github.com/go-gitea/gitea/pull/38464))
- Refactor: introduce ActivePageTimer to help to do partial page refresh ([#​38372](https://github.com/go-gitea/gitea/pull/38372))
</details>
---
### Configuration
📅 **Schedule**: (in timezone Europe/Oslo)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
1.27.3→28.0.0Release Notes
go-gitea/gitea (gitea/gitea)
v28.0.0Compare Source
BREAKING
SECURITY
FEATURES
self:, misc fixes (#39358)$/prefix in reusable workflowuses:(#38822)disable-2facommand (#38275)ENHANCEMENTS
ETagon streamed repository archives, supportIf-None-Match: *(#39289)tag_filterquery parameter to release list API (#38681)ansi_upwith first-party code (#38619)PERFORMANCE
BUGFIXES
if:before concurrency check (#39437)ReadHeaderTimeouton HTTP servers (#38878)${{ }}part on its own (#38754)overflow-menuand repo filter (#37818)TESTING
~/.ssh(#39348)BUILD
go veterrors related to composite literals (#39341)DOCS
MISC
gliderlabs/sshwithgolang.org/x/crypto/ssh(#38837)<script setup>(#38752)Configuration
📅 Schedule: (in timezone Europe/Oslo)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.