Skip to content

release/v1.25 #36102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
xnox wants to merge 88 commits into from
Closed

release/v1.25 #36102

xnox wants to merge 88 commits into from
+5,446 −2,437

Conversation

@xnox
Copy link

@xnox xnox commented Dec 7, 2025

lunny and others added 30 commits September 25, 2025 09:32
@lunny
Add changelog for 1.25.0-rc0 (go-gitea#35531)
94a6da3
@GiteaBot @wxiaoguang
Fix markup init after issue comment editing (go-gitea#35536) (go-gite…
6c8879b 
…a#35537)

Backport go-gitea#35536 by wxiaoguang

Fix go-gitea#35533

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @Exgene
@wxiaoguang @silverwind
fix(webhook): prevent tag events from bypassing branch filters targets (
d94faf6 
go-gitea#35567) (go-gitea#35577)

Backport go-gitea#35567 by Exgene

Co-authored-by: Kausthubh J Rao <105716675+Exgene@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
@GiteaBot @lunny @wxiaoguang
Add rebase push display wrong comments bug (go-gitea#35560) (go-gitea…
006fe2a 
…#35580)

Backport go-gitea#35560 by @lunny

Fix go-gitea#35518

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @ita004 @wxiaoguang
fix: auto-expand and auto-scroll for actions logs (go-gitea#35583) (g…
aa57531 
…o-gitea#35586)

Backport go-gitea#35583 by ita004

Co-authored-by: Shafi Ahmed <98274448+ita004@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @lunny
Fix creating pull request failure when the target branch name is the …
8d1c04b 
…same as some tag (go-gitea#35552) (go-gitea#35582)

Backport go-gitea#35552 by @lunny

Use full reference name in the git command to avoid ambiguity.

Fix go-gitea#35470

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@GiteaBot @Zettat123
Use inputs context when parsing workflows (go-gitea#35590) (go-gite…
a99761d 
…a#35595)

Backport go-gitea#35590 by @Zettat123

Depends on [gitea/act#143](https://gitea.com/gitea/act/pulls/143)

The [`inputs`
context](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#inputs-context)
is used when parsing workflows so that `run-name` like `run-name: Deploy
to ${{ inputs.deploy_target }}` can be parsed correctly.

Co-authored-by: Zettat123 <zettat123@gmail.com>
@GiteaBot @shashank-netapp @lunny
Fixing issue go-gitea#35530: Password Leak in Log Messages (go-gitea#…
6de2151 
…35584) (go-gitea#35609)

Backport go-gitea#35584 by @shashank-netapp

# Summary
The Gitea codebase was logging `Elasticsearch` and `Meilisearch`
connection strings directly to log files without sanitizing them. Since
connection strings often contain credentials in the format
`protocol://username:password@host:port`, this resulted in passwords
being exposed in plain text in log output.

Fix:
- wrapped all instances of setting.Indexer.RepoConnStr and
setting.Indexer.IssueConnStr with the `util.SanitizeCredentialURLs()`
function before logging them.

Fixes: go-gitea#35530

Co-authored-by: shashank-netapp <108022276+shashank-netapp@users.noreply.github.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@GiteaBot @surya-purohit
@wxiaoguang @lunny
Fix diffpatch API endpoint (go-gitea#35610) (go-gitea#35613)
b7bb0fa 
Backport go-gitea#35610 by @surya-purohit

Updates the swagger documentation for the `diffpatch` API endpoint.

The request body is corrected from the outdated `UpdateFileOptions` to
the current `ApplyDiffPatchOptions` to match the code implementation.

Closes [issue#35602](go-gitea#35602)

---------

Co-authored-by: Surya Purohit <suryaprakash.sharma@sourcefuse.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@GiteaBot @silverwind
Mock external service in hcaptcha TestCaptcha (go-gitea#35604) (go-gi…
3c78598 
…tea#35614)

Backport go-gitea#35604 by silverwind

The test calls out to a web service which may be down or unreachable as
seen in the linked issue. It's better for tests to not have such
external dependencies to make them absolutely stable.

Fixes: go-gitea#35571

Co-authored-by: silverwind <me@silverwind.io>
@GiteaBot @lunny
Fix inputing review comment will remove reviewer (go-gitea#35591) (go…
609d88f 
…-gitea#35615)

Backport go-gitea#35591 by @lunny

Fix go-gitea#34617

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@GiteaBot @lutinglt
The status icon of the Action step is consistent with GitHub (go-gite…
a3458c6 
…a#35618) (go-gitea#35621)

Backport go-gitea#35618 by @lutinglt

go-gitea#35616
Before:
running:
<img width="45" height="34" alt="image"
src="https://github.com/user-attachments/assets/e2508f98-2f1f-4b7e-a80c-30b406f42531"
/>
waiting:
<img width="44" height="33" alt="image"
src="https://github.com/user-attachments/assets/e7c8164e-fdc3-4546-b088-31166544edb0"
/>

---
After:
running:
<img width="49" height="43" alt="image"
src="https://github.com/user-attachments/assets/b5a9b245-a995-458a-af23-d1723daa3692"
/>
waiting:
<img width="42" height="44" alt="image"
src="https://github.com/user-attachments/assets/ff72551e-cfb5-4665-af52-938ef0cf8f1c"
/>

`gitea-running.svg` is not an icon from the @ primer/octicon library,
extracted from the Github page. Github did not assign a clear class name
to this icon

Signed-off-by: 鲁汀 <131967983+lutinglt@users.noreply.github.com>
Co-authored-by: 鲁汀 <131967983+lutinglt@users.noreply.github.com>
Co-authored-by: lutinglt <lutinglt@users.noreply.github.com>
@GiteaBot @lutinglt @wxiaoguang
Fix code tag style problem and LFS view bug (go-gitea#35628) (go-gite…
f451242 
…a#35636)

Backport go-gitea#35628 by lutinglt

Signed-off-by: 鲁汀 <131967983+lutinglt@users.noreply.github.com>
Co-authored-by: 鲁汀 <131967983+lutinglt@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@techknowlogick
bump archives&rar dep (go-gitea#35637) (go-gitea#35638)
602af14
@GiteaBot @wxiaoguang
Always create Actions logs stepsContainer (go-gitea#35654) (go-gitea#…
ae2e8c1 
…35672)

Backport go-gitea#35654 by wxiaoguang

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @lunny
Fix a bug missed return (go-gitea#35655) (go-gitea#35667)
5ae9bb4 
Backport go-gitea#35655 by @lunny

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@wxiaoguang
Fix missing Close when error occurs and abused connection pool (go-gi…
53a2aae 
…tea#35658) (go-gitea#35670)

Backport go-gitea#35658
@lunny
Fix build (go-gitea#35674)
1644b87 
backport go-gitea#35656
@lunny @wxiaoguang
Creating push comments before invoke pull request checking (go-gitea#…
18b178e 
…35647) (go-gitea#35668)

Backport go-gitea#35647 

This PR moved the creation of pushing comments before pull request
mergeable checking. So that when the pull request status changed, the
comments should have been created.

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @surya-purohit @wxiaoguang
Use LFS object size instead of blob size when viewing a LFS file (go-…
f71df88 
…gitea#35679) (go-gitea#35680)

Backport go-gitea#35679 by surya-purohit

shows the main LFS filesize instead of the pointer filesize when viewing
a file

Co-authored-by: Surya Purohit <suryaprakash.sharma@sourcefuse.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot
Fix various bugs (go-gitea#35684) (go-gitea#35696)
4af1d58 
Backport go-gitea#35684 by wxiaoguang
@ChristopherHX
Fix workflow run event status while rerunning a failed job (go-gitea#…
46f695a 
…35689) (go-gitea#35703)

The event reported a completion status instead of requested, therefore
sent an email

Backport go-gitea#35689
@GiteaBot @wxiaoguang
Avoid emoji mismatch and allow to only enable chosen emojis (go-gitea…
6df51d4 
…#35692) (go-gitea#35705)

Backport go-gitea#35692 by wxiaoguang

Fix go-gitea#23635

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @wxiaoguang
Refactor legacy code (go-gitea#35708) (go-gitea#35716)
ac6d38e 
Backport go-gitea#35708 by wxiaoguang

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @wxiaoguang
Fix various trivial problems (go-gitea#35714) (go-gitea#35718)
387a4e7 
Backport go-gitea#35714 by wxiaoguang

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @wxiaoguang
Make restricted users can access public repositories (go-gitea#35693) (…
16f4f0d 
…go-gitea#35719)

Backport go-gitea#35693 by wxiaoguang

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @a1012112796 @wxiaoguang
fix attachment file size limit in server backend (go-gitea#35519) (go…
cb338a2 
…-gitea#35720)

Backport go-gitea#35519 by @a1012112796

fix go-gitea#35512

Co-authored-by: a1012112796 <1012112796@qq.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @wxiaoguang
Don't block site admin's operation if SECRET_KEY is lost (go-gitea#35721
c84d17b 
) (go-gitea#35724)

Backport go-gitea#35721 by wxiaoguang

Related: go-gitea#24573

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @kemzeb @wxiaoguang
Honor delete branch on merge repo setting when using merge API (go-gi…
0925089 
…tea#35488) (go-gitea#35726)

Backport go-gitea#35488 by @kemzeb

Fix go-gitea#35463.

---------

Co-authored-by: Kemal Zebari <60799661+kemzeb@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@wxiaoguang
Fix external render, make iframe render work (go-gitea#35727, go-gite…
b2f2f85 
…a#35730) (go-gitea#35731)

Backport go-gitea#35727 and go-gitea#35730

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
GiteaBot and others added 17 commits November 19, 2025 10:43
@GiteaBot @DrMaxNix
Change project default column icon to 'star' (go-gitea#35967) (go-git…
e3bfee8 
…ea#35979)

Backport go-gitea#35967 by @DrMaxNix

Consistently use a `star` icon to highlight the default column of a
project.
The icon is both shown while viewing the project, as well as while
changing the default status of this column.

<img width="1065" height="370" alt="image"
src="https://github.com/user-attachments/assets/1ca5773d-8eec-4b90-ad0b-22b1f4bd4cfd"
/>

Co-authored-by: DrMaxNix <git@drmaxnix.de>
@lunny
upgrade golang.org/x/crypto to 0.45.0 (go-gitea#35988)
5e7207d
@lunny @wxiaoguang
Fix various permission & login related bugs (go-gitea#36002) (go-gite…
20cf4b7 
…a#36004)

Backport go-gitea#36002 

Permission & protection check:

- Fix Delete Release permission check
- Fix Update Pull Request with rebase branch protection check
- Fix Issue Dependency permission check
- Fix Delete Comment History ID check

Information leaking:

- Show unified message for non-existing user and invalid password
    - Fix go-gitea#35984
- Don't expose release draft to non-writer users.
- Make API returns signature's email address instead of the user
profile's.

Auth & Login:

- Avoid GCM OAuth2 attempt when OAuth2 is disabled
    - Fix go-gitea#35510

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@lunny
Allow empty commit when merging pull request with squash style (go-gi…
91901c2 
…tea#35989) (go-gitea#36003)
@lunny @wxiaoguang
release notes for 1.25.2 (go-gitea#35986)
eaa916a 
~Wait go-gitea#35988~

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @wxiaoguang
Add "site admin" back to profile menu (go-gitea#36010) (go-gitea#36013)
f6895f6 
Backport go-gitea#36010 by @wxiaoguang

Fix go-gitea#35904

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @wxiaoguang
Fix container registry error handling (go-gitea#36021) (go-gitea#36037)
d4d338f 
Backport go-gitea#36021 by wxiaoguang

1. the `if` check in `handleCreateManifestResult` didn't handler err
correctly
2. add more error details for debugging

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @bytedream @lunny
Fix incorrect viewed files counter if file has changed (go-gitea#36009)…
f164e38 
… (go-gitea#36047)

Backport go-gitea#36009 by @bytedream

File changes since last review didn't decrease the viewed files counter

---
<img width="440" height="178" alt="image"
src="https://github.com/user-attachments/assets/da34fcf4-452f-4f71-8da2-97edbfc31fdd"
/>

Also reported here ->
go-gitea#35803 (comment)

Co-authored-by: bytedream <me@bytedream.dev>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@GiteaBot @hamkido
Fix error handling in mailer and wiki services (go-gitea#36041) (go-g…
46d1d15 
…itea#36053)

Backport go-gitea#36041 by @hamkido

- Updated error message in `incoming.go` to remove unnecessary wrapping
of the error.
- Corrected typo in error message in `wiki.go` for clarity.

Co-authored-by: hamkido <hamki.do2000@gmail.com>
@Zettat123
Fix Actions pull_request.paths being triggered incorrectly by rebase (
b276849 
go-gitea#36045) (go-gitea#36054)

Backport go-gitea#36045

Partially fix go-gitea#34710

The bug described in go-gitea#34710 can be divided into two parts: `push.paths`
and `pull_request.paths`. This PR fixes the issue related to
`pull_request.paths`. The root cause is that the check for whether the
workflow can be triggered happens **before** updating the PR’s merge
base. This causes the file-change detection to use the old merge base.
Therefore, we need to update the merge base first and then check whether
the workflow can be triggered.
@GiteaBot @lunny
Fix bug when updating user email (go-gitea#36058) (go-gitea#36066)
45cdc5d 
Backport go-gitea#36058 by @lunny

Fix go-gitea#20390 

We should use `ReplacePrimaryEmailAddress` instead of
`AdminAddOrSetPrimaryEmailAddress` when modify user's email from admin
panel. And also we need a database transaction to keep deletion and
insertion succeed at the same time.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@silverwind
Bump toolchain to go1.25.5, misc fixes (go-gitea#36082)
0e91c8a 
Backport toolchain change into 1.25. This is needed because of the
govulncheck issue
[present](https://github.com/go-gitea/gitea/actions/runs/19921920886/job/57112316941)
in the branch.

---------

Signed-off-by: silverwind <me@silverwind.io>
@GiteaBot @lunny
Fix edit user email bug in API (go-gitea#36068) (go-gitea#36081)
52902d4 
Backport go-gitea#36068 by @lunny

Follow go-gitea#36058 for API edit user bug when editing email.

- The Admin Edit User API includes a breaking change. Previously, when
updating a user with an email from an unallowed domain, the request
would succeed but return a warning in the response headers. Now, the
request will fail and return an error in the response body instead.
- Removed `AdminAddOrSetPrimaryEmailAddress` because it will not be used
any where.

Fix go-gitea#36058 (comment)

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@GiteaBot @lunny
Use Golang net/smtp instead of gomail's smtp to send email (go-gitea#…
0ab4470 
…36055) (go-gitea#36083)

Backport go-gitea#36055 by @lunny

Replace go-gitea#36032
Fix go-gitea#36030

This PR use `net/smtp` instead of gomail's smtp. Now
github.com/wneessen/go-mail will be used only for generating email
message body.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@GiteaBot @a1012112796 @wxiaoguang
fix some file icon ui (go-gitea#36078) (go-gitea#36088)
544450a 
Backport go-gitea#36078 by @a1012112796

fix go-gitea#36071

looks that's because if an svg in hiden env, it's color added by
`fill="url(#a)"` will become not usefull. by ai helping, I think moving
it out of page by position is a good solution. fell free creat a new
pull request if you have a better soluton. Thanks.
<img width="2198" height="1120" alt="image"
src="https://github.com/user-attachments/assets/bbf7c171-0b7f-412a-a1bc-aea3f1629636"
/>

Signed-off-by: a1012112796 <1012112796@qq.com>
Co-authored-by: a1012112796 <1012112796@qq.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot @lunny
Fix the bug when ssh clone with redirect user or repository (go-gitea…
b1b35e9 
…#36039) (go-gitea#36090)

Backport go-gitea#36039 by @lunny

Fix go-gitea#36026 

The redirect should be checked when original user/repo doesn't exist.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@xnox
pnpm-lock: upgrade deps to address vulnerabilities
24e5d2c 
There are a few vulnerabilities reported with:

```
npx pnpm audit
...
6 vulnerabilities found
Severity: 2 moderate | 3 high | 1 critical
```

Fix them by upgrading.
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Dec 7, 2025
@xnox xnox closed this Dec 7, 2025
@github-actions github-actions bot added modifies/translation modifies/api This PR adds API routes or modifies them modifies/go Pull requests that update Go code modifies/cli PR changes something on the CLI, i.e. gitea doctor or gitea admin modifies/templates This PR modifies the template files modifies/docs modifies/migrations modifies/internal modifies/dependencies modifies/frontend docs-update-needed The document needs to be updated synchronously labels Dec 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

docs-update-needed The document needs to be updated synchronously lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. modifies/api This PR adds API routes or modifies them modifies/cli PR changes something on the CLI, i.e. gitea doctor or gitea admin modifies/dependencies modifies/docs modifies/frontend modifies/go Pull requests that update Go code modifies/internal modifies/migrations modifies/templates This PR modifies the template files modifies/translation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Gitea Actions paths filters incorrectly trigger during rebase operations Review comment removes the reviewer for the PR Action schedule option to disable emoji replacements The user's home page pointed to in the commit message is wrong
Merging a PR via the API does not honor the Delete pull request branch after merge by default setting PR Error 500 with branch and tag sharing the same name if the tag create by git tag -a Can't add User with "Owner" permissions on repo to branch protection rule problem with Git Credential Manager when [oauth2].ENABLED=false, because of Www-Authenticate: Basic realm="Gitea" Attachment size limit in app.ini not enforced for REST API uploads

8 participants

@xnox @GiteaBot @lunny @techknowlogick @wxiaoguang @ChristopherHX @Zettat123 @silverwind