Gitea v1.26.3 released on 20-06-2026
Gitea v1.26.3 is out now. It introduces a breaking Actions change that stops forks from bypassing PR approval gates unless the PR has been merged, and ships a broad set of workflow reliability, security and API fixes affecting CI, LFS and host/address access controls.
See the release notes on Gitea’s GitHub for full details and the list of patched issues and dependency updates.
What’s in this release
- Breaking Actions change: require merged PR to bypass fork PR approval gate (fix(actions)! require merged PR to bypass fork PR approval gate).
- Workflow and Actions reliability fixes: exclude workflow_call from trigger detection; reject workflow_dispatch for workflows that lack that trigger; return 404 when a job log blob is missing; keep action run titles clickable when the commit subject is a URL; preserve literal “false” choices in workflow_dispatch dropdowns; make UpdateLog finalize idempotent.
- Security hardening and access fixes: patch incorrect private host lists and block reserved IP ranges from external/private filters; fix anonymous code-access cloning of private repos; ignore stale OIDC external login links to organisations; LFS fixes require Code-unit access for cross-repo LFS object reuse and reject unknown SSH LFS sub-verbs; update golang.org/x/net to v0.55.0 and bound expensive parsing (CODEOWNERS regex, Debian control stanza parsing).
Upgrade notes
- Breaking change: forks can no longer bypass PR approval gates unless the PR has been merged — review your Actions and PR approval settings and check affected workflows; see the GitHub release notes for the exact change and related issue numbers.
- Test CI and workflow behaviour after upgrading: dependency updates (golang.org/x/net -> v0.55.0, @playwright/test to 1.60.0) and the Actions trigger fixes may change how workflows fire; validate workflow_dispatch and workflow_call usage in a staging environment before rolling out to production.
Share your experience upgrading or report any regressions on the Gitea issue tracker; community feedback helps catch edge cases and improves follow-up fixes.
