Gitea v1.27.0 released on 13-07-2026
Gitea v1.27.0 is out now. It delivers a set of breaking changes around Actions (notably improved support for reusable workflows) alongside broad security hardening such as stricter access checks, token-scope enforcement and a move to Content-Security-Policy script nonces.
See the Gitea project on GitHub for the full release notes and upgrade guidance; Gitea Cloud instances will be auto-upgraded during the scheduled maintenance window.
What’s in this release
- Actions and workflows: improved support for reusable workflows (breaking change), owner-level and global scoped workflows, workflow status badge modal and job summaries via GITHUB_STEP_SUMMARY.
- Security hardening: fixes for access checks and migration validation, enforcement of public-only token scopes, prevention of private metadata leakage after access revocation, proof-of-possession for cross-repo LFS objects, disabled HTTP redirects on mirror syncs and multiple dependency updates addressing CVEs.
- API and integrations: token introspection and self-deletion endpoint, raw diff/patch and ref-suffix support for comparisons, OpenAPI 3.0 served at /openapi.v1.json, and OAuth/OIDC updates including custom URI scheme support and an AWS Cognito provider.
Upgrade notes
- Breaking changes: the improved reusable-workflow support in Actions is a breaking change—test workflows in a staging environment and review any workflow reuse or invocation patterns that may need adjustment; also check integrations that rely on script execution for the new CSP script nonce behaviour.
- Rollback and cloud upgrades: Gitea Cloud instances will be auto-upgraded during the maintenance window; if you need to roll back, follow your normal restore procedure (restore backups or redeploy the previous release) and consult the release notes for migration details.
Share any issues or experiences you have with the upgrade on the Gitea issue tracker or community channels so maintainers and operators can follow up.
