Gitea v1.27.3 released on 29-08-2026
Gitea v1.27.3 is out now. It tightens security and access controls across packages, attachments, Actions workflows and migrations to reduce attack surface and restrict unintended access.
See the release notes on Gitea’s GitHub repository for full technical details and changelog items.
What’s in this release
- Security hardening and access restrictions: package token scopes are limited; attachments and markup now enforce repository ownership and same-repository issue access; raw artifact signatures are verified earlier.
- Actions, workflows and CI reliability fixes: preserves unevaluated continue-on-error expressions, shows “Complete job” logs when the last step is skipped, fixes matrix job grouping and resolves YAML anchors and aliases correctly.
- Packages, repositories and migration safeguards: limits on package uploads and manifest parsing (Swift, Maven, Alpine), hides repositories of hidden owners, enforces repository-creation token authorisation and restricts git hook permissions; migrations now cancel or bound upstream probes.
Upgrade notes
- Tighter token scopes and enforced hook and repository-creation checks may affect CI, automation and integrations — review tokens, hook permissions and any repository-creation workflows before upgrading; consult the full release notes for affected endpoints.
- Instances on Gitea Cloud will be automatically upgraded to v1.27.3 during the scheduled maintenance window; self-hosted instances should follow normal maintenance and backup procedures.
Share any issues or observations on the release page or in the project discussions — input from operators and maintainers helps catch edge cases early.
