Gitea v1.27.3 released on 29-08-2026
Gitea v1.27.3 is out now. It tightens security across packages, Actions, APIs and migrations while fixing workflow and artifact handling.
See the Gitea GitHub release notes for full details and upgrade instructions.
What’s in this release
- Security hardening: tighter package token-scope restrictions; enforcement of repository ownership for attachments and markup/issue access; hiding limited users and repositories of hidden owners; and bounds on migration and probe responses to reduce information exposure.
- Actions and workflows fixes: raw artifact signatures are verified first; fork pull-request trust boundaries are enforced; matrix job grouping, YAML anchors/aliases resolution and step-level behaviours (including preserved “Complete job” logs) have been corrected.
- Packages and registry protections: limits applied to Swift package manifests and Maven checksum uploads, Alpine metadata entries bounded, and SemVer prerelease identifiers preserved in the Swift registry.
Upgrade notes
- Review token scopes and repository-creation tokens before upgrading: v1.27.3 enforces token-scope restrictions and repository-creation token authorization which may affect automation and CI.
- Gitea Cloud instances will be automatically upgraded to v1.27.3 during the scheduled maintenance window.
Share any upgrade experiences, issues or feedback on the project’s GitHub so maintainers and the community can follow up.
