# content
Just a few weeks after the last patch, the Gitea team shipped version 1.26.0, a substantial update touching security, usability, and CI/CD capabilities.

Three vulnerabilities patched

Security comes first. This release fixes three CVEs: a stored XSS in the 3D viewer (glTF format), an issue in the fork API that allowed exfiltrating organization secrets, and a branch protection bypass caused by silent truncation during hook processing. Updating is recommended.

Repository interface improvements

Several of the most useful additions affect day-to-day repository work. You can now download a zip or tarball for a single subdirectory without grabbing the entire file tree, which is especially handy in monorepos.

The file browser adds two context menu options: “Go to file” to jump directly to a file by searching its name, and “Delete directory” to remove an entire folder from the web interface. Small conveniences that save a few clicks.

There’s also automatic release note generation straight from the editor. Gitea composes the Markdown from merged pull requests and contributor names, much like GitHub already does.

Actions: CI/CD grows up

The biggest feature set lands in Actions. Workflows can now declare concurrency groups, so new runs either cancel or queue against already-running jobs. Fair warning: this changes runtime behavior and should be tested on existing pipelines after upgrading.

Other additions include a visual dependency graph for jobs, selective re-run of failed jobs only without restarting the whole workflow, references to Actions and reusable workflows stored in private repositories, configurable permissions for automatic tokens, and the ability to pause or disable individual runners without removing them.

For administrators

Admins get two new tools: a global banner visible to all users, paired with a maintenance mode for managing access during upkeep, and user profile badges, handy for marking roles or internal designations.

Under the hood

On the technical side, the frontend toolchain migrated from webpack to Vite, cutting build times. The embedded editor switches from Monaco to CodeMirror, reducing bundle weight. A Terraform state registry was also added, letting you centralize infrastructure management using the same access controls as your code.

If you run Gitea on a VPS, proceed with the standard upgrade path: backup, swap the binary or update your Docker image, restart.

Full release notes are on the official blog.

SOURCE:// blog.gitea.com

Support Yoota · affiliate link

Suggestion The VPN that doesn't spy on you
Hover / Tap

# contentMap.en
Just a few weeks after the last patch, the Gitea team shipped version 1.26.0, a substantial update touching security, usability, and CI/CD capabilities.

Three vulnerabilities patched

Security comes first. This release fixes three CVEs: a stored XSS in the 3D viewer (glTF format), an issue in the fork API that allowed exfiltrating organization secrets, and a branch protection bypass caused by silent truncation during hook processing. Updating is recommended.

Repository interface improvements

Several of the most useful additions affect day-to-day repository work. You can now download a zip or tarball for a single subdirectory without grabbing the entire file tree, which is especially handy in monorepos.

The file browser adds two context menu options: “Go to file” to jump directly to a file by searching its name, and “Delete directory” to remove an entire folder from the web interface. Small conveniences that save a few clicks.

There’s also automatic release note generation straight from the editor. Gitea composes the Markdown from merged pull requests and contributor names, much like GitHub already does.

Actions: CI/CD grows up

The biggest feature set lands in Actions. Workflows can now declare concurrency groups, so new runs either cancel or queue against already-running jobs. Fair warning: this changes runtime behavior and should be tested on existing pipelines after upgrading.

Other additions include a visual dependency graph for jobs, selective re-run of failed jobs only without restarting the whole workflow, references to Actions and reusable workflows stored in private repositories, configurable permissions for automatic tokens, and the ability to pause or disable individual runners without removing them.

For administrators

Admins get two new tools: a global banner visible to all users, paired with a maintenance mode for managing access during upkeep, and user profile badges, handy for marking roles or internal designations.

Under the hood

On the technical side, the frontend toolchain migrated from webpack to Vite, cutting build times. The embedded editor switches from Monaco to CodeMirror, reducing bundle weight. A Terraform state registry was also added, letting you centralize infrastructure management using the same access controls as your code.

If you run Gitea on a VPS, proceed with the standard upgrade path: backup, swap the binary or update your Docker image, restart.

Full release notes are on the official blog.

SOURCE:// blog.gitea.com

Support Yoota · affiliate link

Suggestion The VPN that doesn't spy on you
Hover / Tap

# name
Gitea 1.26.0: Auto-Generated Release Notes, Mature Actions, and Three Security Fixes

# nameMap.en
Gitea 1.26.0: Auto-Generated Release Notes, Mature Actions, and Three Security Fixes

# preview.content
Gitea 1.26.0 adds automatic release note generation, major improvements to Actions, subdirectory archive downloads, and fixes three security vulnerabilities.

# summary
Gitea 1.26.0 adds automatic release note generation, major improvements to Actions, subdirectory archive downloads, and fixes three security vulnerabilities.

# summaryMap.en
Gitea 1.26.0 adds automatic release note generation, major improvements to Actions, subdirectory archive downloads, and fixes three security vulnerabilities.