Gitea v1.27.1 released on 27-07-2026
Gitea v1.27.1 is out now. It tightens OAuth2/OIDC security — enforcing mandatory two‑factor authentication on OAuth2 authorize/grant endpoints and preventing an unexpected OIDC end‑session after password login — and includes a broad set of Actions, API, UI and backend fixes to improve reliability and maintainability.
See the release notes on Gitea’s GitHub for full details, including upgrade guidance and the complete list of fixes.
What’s in this release
- Security: mandatory 2FA enforcement for OAuth2 authorize/grant endpoints and an OIDC fix that skips an end‑session call after password login for OAuth2 users.
- Actions reliability and hardening: multi‑line log parsing, use of base branch ref for pull_request_target, skipping already‑approved runs, immediate cancellation when runners stop reporting, improved runner sorting and links, decoupled cross‑run job emission to avoid stranded jobs, better matrix support and if/cancelled() evaluation, and other execution fixes.
- API, UI and backend fixes: aligned Swagger schemas, improved diff contrast, multiple UI fixes (download dropdown, status icon alignment, org follow button), repository and user cleanup on delete, ACME certificate handling, package index fixes, merge/signing fixes and a refactor of git patch apply for maintainability.
Upgrade notes
- Mandatory 2FA enforcement can affect existing OAuth2 flows — review OAuth2 client behaviour and account 2FA settings before upgrading and consult the GitHub release notes for specifics.
- If you encounter issues after upgrading, consider downgrading to the previous release while you investigate; ensure you have recent backups of your database and configuration before making changes.
Share any upgrade experiences or issues on Gitea’s issue tracker so maintainers and the community can follow up.
