Gitea 1.27.1 已发布
· 阅读需 11 分钟
我们很高兴宣布 Gitea 1.27.1 发布，这是 1.27 系列的第一个补丁版本。它包含安全修复和大量错误修复，其中许多是针对 Gitea Actions 的。我们强烈建议所有用户尽快升级。
安全性
本发布版本解决了以下安全漏洞。请尽快升级。
- CVE-2026-59774：通过 Org-mode 的
#+INCLUDE指令实现的未经身份验证的任意文件读取漏洞。修复于 [#38642]https://github.com/go-gitea/gitea/pull/38642 / [#38645]https://github.com/go-gitea/gitea/pull/38645。感谢 [@xbow-security]https://github.com/xbow-security 以及独立报告的 [@NightRang3r]https://github.com/NightRang3r 报告此问题，以及 [@wxiaoguang]https://github.com/wxiaoguang 和 [@TheFox0x7]https://github.com/TheFox0x7 提供的补丁。 - CVE-2026-60004：通过 Git 钩子安装利用
diffpatchAPI 实现的远程代码执行漏洞。修复于 [#38637]https://github.com/go-gitea/gitea/pull/38637 / [#38638]https://github.com/go-gitea/gitea/pull/38638。感谢 [@NightRang3r]https://github.com/NightRang3r 报告此问题，以及 [@wxiaoguang]https://github.com/wxiaoguang 提供的补丁。
重要修复
Actions
pull_request_target运行现在基于基础分支引用构建上下文，而非派生仓库的头部（#38657）。- Gitea 重启后，任务不再卡在
cancelling状态：一旦 runner 停止上报，任务立即取消（#38644）。 - 多行
run:代码块现在能正确通过工作流序列化完整往返，此前会导致任务无声卡住而无任何可见错误（#38599）。 - 一批正确性和加固修复（#38631）：可复用工作流展开现在遵守每次运行的任务限制；
rerun-failed不再在成功运行时重新运行每个任务；外部提交的状态不再被纳入旧版状态哈希。 - 表达式修复：
matrix在计算工作流级if时可用（#38557），cancelled()在任务if中可用（#38497），以及workflow_dispatch布尔型输入被强制转换为原生类型（#38521）。 - 定时运行现在会填充
github.event（#38452），被阻止或等待中的任务会解释为何尚未启动（#38498），runner 列表获得了更好的状态排序、标签与任务链接（#38633）。 - 日志解析器重新处理多行消息，使其在运行视图中正确显示而不再折叠（#38664）。
仓库、合并请求与认证
- 通过 HTTP 重定向克隆再次可用——1.27.0 的限制已恢复为 1.26 的行为（#38545）。
- 强制双因素认证策略现已在 OAuth2 授权和颁发端点上强制执行（#38606）。
- 使用密码表单登录的 OAuth2 关联账户退出登录时，不再通过提供商的会话结束端点进行重定向；RP 发起的 OIDC 注销现在基于会话的登录方法（#38666）。
- 删除仓库或用户现在会清理之前遗留在多个表中的孤立记录（#38618，#38514）。
- 当启动时证书续期失败，Gitea 仍继续提供有效的 ACME 证书，而非启动失败（#38583）。
- 通过合并更新分支现在会对生成的提交进行签名（#38499），提交消息合并正确（#38502），检查失败时合并框按钮变红（#38516），差异文件树遵守
diff.orderFile（#38578）。 - 差异对比度在浅色和深色主题中都得到了改善（#38574）。
此版本包含 48 个已合并的合并请求，感谢社区贡献者的精彩贡献。
如何安装或升级
从 Gitea 下载页面 获取我们的预编译二进制文件 — 请确保选择与您的平台兼容的版本。有关安装或升级的详细指南，请查阅我们的安装文档。
特别鸣谢
我们也要感谢所有在 Open Collective 上给予资金支持的支持者们。
正在寻找无缝、无忧的 Git 仓库管理方案？ 了解 Gitea Cloud —— 一个全托管、可扩展的平台，助你高效简化开发工作流。
以下 Changelog 保留英文原文，未作翻译，请与上游逐字核对。
Changelog
1.27.1 - 2026-07-27
-
SECURITY
-
BUGFIXES
- Fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
- Fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
- Fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
- Fix(actions): skip already-approved runs in
ApproveRuns(#38653) (#38654) - Fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
- Fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
- Fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
- Fix(actions): correctness and hardening fixes (#38518) (#38631)
- Fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
- Fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
- Fix(webhook): remove slack channel name check (#38608) (#38612)
- Fix: download dropdown menu clipped on the branches page (#38604) (#38609)
- Fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
- Fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
- Fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
- Fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
- Fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
- Fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
- Fix: branch protection user list (#38570) (#38584)
- Fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
- Fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
- Fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
- Fix(actions): align status icon span for Safari rendering (#38558) (#38562)
- Fix(actions): support
matrixwhen evaluating workflowifexpression (#38474) (#38557) - Fix: revert git clone http redirection forbidden (#38530) (#38545)
- Fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
- Fix: make the merge box button red if some checks fail (#38508) (#38516)
- Fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
- Fix: make commit message merge correctly (#38490) (#38502)
- Fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
- Fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
- Fix(actions): make
cancelled()work in jobifevaluation (#38495) (#38497) - Fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
- Fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
- Fix: full file highlighting for git diff with CR char (#38484) (#38491)
- Fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
- Fix: 500 error when updating user visibility (#38480) (#38483)
- Fix(actions): make job list item fully clickable (#38462) (#38471)
- Fix: mail template for push event (#38467) (#38468)
- Fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
- Fix: make "test push webhook" always work (#38425) (#38455)
- Fix(org): align follow button and wrap description (#38448) (#38454)
- Fix(actions): populate
github.eventfor scheduled runs (#38446) (#38452)
-
ENHANCEMENTS