v1.27.1

• SECURITY

  • fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)

• API

  • fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)

• ENHANCEMENTS

  • enhance: improve diff contrast in light and dark themes (#37477) (#38574)

• BUGFIXES

  • fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
  • fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
  • fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
  • fix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)
  • fix: orgmode render include path (#38642) (#38645)
  • fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
  • fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
  • fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
  • fix(actions): correctness and hardening fixes (#38518) (#38631)
  • fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
  • fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
  • fix(webhook): remove slack channel name check (#38608) (#38612)
  • fix: download dropdown menu clipped on the branches page (#38604) (#38609)
  • fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
  • fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
  • fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
  • fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
  • fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
  • fix: branch protection user list (#38570) (#38584)
  • fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
  • fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
  • fix(actions): support matrix when evaluating workflow if expression (#38474) (#38557)
  • fix(actions): align status icon span for Safari rendering (#38558) (#38562)
  • fix: revert git clone http redirection forbidden (#38530) (#38545)
  • fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
  • fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
  • fix: make the merge box button red if some checks fail (#38508) (#38516)
  • fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
  • fix: make commit message merge correctly (#38490) (#38502)
  • fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
  • fix(actions): make cancelled() work in job if evaluation (#38495) (#38497)
  • fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
  • fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
  • fix: full file highlighting for git diff with CR char (#38484) (#38491)
  • fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
  • fix: 500 error when updating user visibility (#38480) (#38483)
  • fix(actions): make job list item fully clickable (#38462) (#38471)
  • fix: mail template for push event (#38467) (#38468)
  • fix: make "test push webhook" always work (#38425) (#38455)
  • fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
  • fix(org): align follow button and wrap description (#38448) (#38454)
  • fix(actions): populate github.event for scheduled runs (#38446) (#38452)

• MISC

  • refactor: git patch apply (#38637) (#38638)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.