v3.21.0

Features

• 12-hour / 24-hour time format option (#342). Timestamps were hardcoded to en-US, forcing 12-hour AM/PM on everyone regardless of locale. The UI now follows your browser locale by default (24-hour locales get 24-hour time automatically), and a new clock toggle in the header — next to the theme switch — lets you force Auto / 12-hour / 24-hour. The preference is stored in your browser like the theme and applies instantly across the dashboard, activity log, and scheduler views. Thanks @LeviSnoot for the request.

Bug Fixes

• GITEA_MIRROR_INTERVAL no longer resets to 8h after touching Settings (#338). The Configuration page auto-saves the full config on any field change, and the save path hardcoded the mirror interval back to its default since the form has no field for it — the next sync then pushed that default to every Gitea mirror. Saves now preserve every setting the form doesn't manage, which also protects the other env-only options (GITEA_CREATE_ORG, GITEA_ADD_TOPICS, GITEA_TOPIC_PREFIX, GITEA_TEMPLATE_OWNER/REPO, GITEA_PRESERVE_VISIBILITY, GITEA_FORK_STRATEGY=full-copy, GITHUB_TYPE, INCLUDE_ARCHIVED, PUBLIC_REPOSITORIES) from being silently wiped. Thanks @benprisby for the precise repro.

• Repositories no longer get stuck on "Syncing" forever (#339). If the app was interrupted mid-sync (container update, OOM kill, reboot), the repo's status stayed syncing in the database and nothing ever recovered it — the scheduler skips in-flight repos and the UI disables the Sync button. Stuck-status recovery now resets stranded repos (and organizations) to failed with an explanation, on container start and continuously in the scheduler, guarded by a liveness window so real in-flight work is never touched. Existing stuck repos self-heal on first boot after upgrading. Thanks @mike-m24 for the report.

• Bulk "Mirror Organization" honors destination overrides (#343). The bulk path picked its target purely from the mirror strategy: org-level and per-repo destination overrides were silently ignored, the mixed strategy sent every org repo to the user's personal account (the migrate request was missing its uid, which Gitea defaults to the authenticated user), and starred repos swept up in a bulk mirror didn't follow starred-repo mode. Bulk mirroring and crash recovery now route through the same canonical destination resolver as single-repo mirroring. Huge thanks to @YuzuZensai for an exceptional root-cause analysis and the fix (#344).

Security & Dependencies

• better-auth 1.6.11 → 1.6.23 — fixes a stored XSS in the auth-server origin via javascript: redirect_uri (GHSA, high severity).
• esbuild ≥ 0.28.1 forced for the website build — dev-server file read on Windows (GHSA, low severity).
• Framework updates across the app and website: Astro 7, @astrojs/node 11, @astrojs/react 6, @astrojs/mdx 7, lucide-react 1.x, Tailwind 4.3.3, plus all minor/patch updates (#348).
• Note: the remaining @better-auth/oauth-provider advisory (medium) is patched upstream only in the 1.7 release candidate; it will be picked up when better-auth 1.7 goes stable.

Full Changelog: v3.20.4...v3.21.0