Skip to content

v0.4.0

Choose a tag to compare

View all tags
@mkappworks mkappworks released this 01 Oct 19:06
v0.4.0
9bf569d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.4.0 (2026-10-01)

Features

  • account: hand a deleted account's content to a ghost user (#79) (cb3e0ae)
  • auth: connect and disconnect Google from account settings (#72) (1383bdd)
  • auth: verify email addresses and link Google sign-in to verified ones (#73) (202800d)
  • org: make organizations own their repositories (#80) (cd87f2e)
  • repos: require the recipient to accept a repository transfer (#97) (2003218)
  • settings: keep commit author email private by default (#56) (2c97530)
  • ui: UI overhaul phase 7 — gists (#43) (90504f3)
  • ui: UI overhaul phase 8 — dashboard (#44) (bdcee6b)
  • ui: UI overhaul phase 9 — profile and organizations (#45) (0b8cc69)

Bug Fixes

  • accept thin packs in git receive-pack (HTTP + SSH) (#47) (52a6f21)
  • api: bind line-comment IDs to the pull request in the URL (#63) (33a1ae1)
  • api: give non-readers the missing-repo 404 on repo API routes (#59) (d5ead16)
  • api: stop serving users' emails and email settings to other people (#53) (34b4384)
  • auth: close email disclosures and add email-verified signup (#60) (56c7ec8)
  • auth: drop the 'owner' role from repository permissions (#102) (f2bdac8)
  • auth: enforce OAuth-app token scopes (#58) (9fcb6e3)
  • auth: enforce personal access token scopes (#87) (7d19146)
  • auth: harden the OAuth authorization-code flow (#61) (0310ae0)
  • auth: hide owner-only admin controls from admin collaborators (#95) (9bbaa6a)
  • auth: let the account menu's Sign out submit and redirect home (#51) (45f1f7f)
  • auth: list only repos the viewer can read (#90) (23ffd98)
  • auth: make TOTP backup codes verifiable (#74) (61d13fb)
  • auth: mark /oauth/token responses Cache-Control: no-store (#65) (9f59073)
  • auth: only repo owners grant, change or remove the admin role (#93) (f388e23)
  • auth: require TOTP on API login (#70) (325a2c4)
  • auth: require TOTP on LDAP, SAML and Google sign-in (#69) (d68c4b1)
  • auth: return RFC 6749 errors from /oauth/token and accept Basic client auth (#64) (8d144df)
  • auth: return to the requested page after sign-in (#62) (660bcd6)
  • git: accept delete-only pushes without a pack (#82) (3ffa670)
  • git: check pushed history is connected, not just its tip (#78) (b2815b8)
  • git: enforce branch protection before receive-pack writes the ref (#68) (9ccd79e)
  • git: keep server paths out of receive-pack unpack errors (#85) (7dcab34)
  • git: refuse protected-branch pushes that can't be proven fast-forward (#71) (292b7ff)
  • git: refuse pushes to missing objects and keep server errors out of push status (#77) (cc4b466)
  • git: refuse pushes whose ref moved after the client read it (#67) (1d2912f)
  • git: refuse web commits when a push moved the branch mid-write (#66) (6ff2f26)
  • git: refuse web deletes of branches that block force pushes (#76) (9c5c0a4)
  • hide database errors on forms and require read access on new issue/PR pages (#57) (6c013e9)
  • issues: hide private issues from pinned and milestone lists (#98) (e4731c7)
  • issues: hide private issues from PR linked issues and the Issues tab count (#101) (a215b07)
  • issues: show private issues to repo and org owners (#94) (e75fb46)
  • notifications: only notify users who can still read the repo (#92) (39ed6f4)
  • search: hide private issues and soft-deleted repos from search (#91) (bfdebf1)
  • ssh: send session errors to stderr so git shows them (#88) (7707a8f)
  • stats: dedupe commit stats per SHA and add stats backfill command (#48) (f890283)
  • store: remove broken, unused ListReposByTopic (#75) (95c2e28)
  • ui: callers' classes reach component elements (#50) (efa2bfc)
  • ui: let callers override type on CommandItem, Toggle and DropdownMenuTrigger (#52) (16297fe)

Technical

Tests

  • clean up organizations that integration tests leak (#83) (3760784)
  • clean up users and repositories that integration tests leak (#81) (0efdb3e)
  • router: keep an account alive in newVerificationRouter (#99) (21b0704)
  • ssh: add a receive-pack harness that drives pushes over SSH (#89) (71f203c)
  • stop seeding an 'owner' permissions row for repo owners (#96) (0075e3c)
  • stop the repo handler tests writing repos into the source tree (#84) (9050db4)
  • use UniqueSuffix for test data names so -count>1 passes (#49) (180db1d)
Assets 10
Loading