3

.env

@@ -1 +1 @@
-VERSION='1.26.4'
+VERSION='1.27.0'

.gitea/workflows/release.yml

@@ -46,7 +46,7 @@ jobs:
         if: steps.cache-gitea.outputs.cache-hit != 'true'
         run: |
           /usr/bin/install --directory --verbose './sources'
-          /usr/bin/wget --verbose --output-document='./sources/gitea' 'https://dl.gitea.com/gitea/${{ steps.environment.outputs.version }}/gitea-${{ steps.environment.outputs.version }}-linux-${{ matrix.architecture }}'
+          /usr/bin/curl --verbose --location --output './sources/gitea' 'https://dl.gitea.com/gitea/${{ steps.environment.outputs.version }}/gitea-${{ steps.environment.outputs.version }}-linux-${{ matrix.architecture }}'
       - name: Gitea [Action Cache Save]
         if: steps.cache-gitea.outputs.cache-hit != 'true'
         uses: actions/cache/save@v5

gitea/etc/gitea/app.ini

@@ -159,6 +159,16 @@ WORK_PATH = /var/lib/gitea
 ;; Domain name to be exposed in clone URL, defaults to DOMAIN or the domain part of ROOT_URL
 ;SSH_DOMAIN =
 ;;
+;; Port number to be exposed in clone URL.
+;; If you need a different "SSH clone port" from the real "SSH listen port", set the SSH_LISTEN_PORT separately.
+;SSH_PORT = 22
+;;
+;; The network interface that the builtin SSH server should listen on
+;SSH_LISTEN_HOST =
+;;
+;; The port number that the builtin SSH server should listen on, defaults to SSH_PORT
+;SSH_LISTEN_PORT =
+;;
 ;; SSH username displayed in clone URLs. It defaults to BUILTIN_SSH_SERVER_USER or RUN_USER.
 ;; If it is set to "(DOER_USERNAME)", it will use current signed-in user's username.
 ;; This option is only for some advanced users who have configured their SSH reverse-proxy
@@ -166,15 +176,6 @@ WORK_PATH = /var/lib/gitea
 ;; Most users should just leave it blank.
 ;SSH_USER =
 ;;
-;; The network interface the builtin SSH server should listen on
-;SSH_LISTEN_HOST =
-;;
-;; Port number to be exposed in clone URL
-;SSH_PORT = 22
-;;
-;; The port number the builtin SSH server should listen on, defaults to SSH_PORT
-;SSH_LISTEN_PORT =
-;;
 ;; Root path of SSH user directory for the system's standalone SSH server if Gitea is not using its builtin SSH server.
 ;; Default is the '.ssh' directory in the run user's home directory.
 ;SSH_ROOT_PATH =
@@ -530,6 +531,17 @@ INTERNAL_TOKEN =
 ;;
 ;; The value of the X-Content-Type-Options HTTP header for all responses. Use "unset" to remove the header.
 ;X_CONTENT_TYPE_OPTIONS = nosniff
+;;
+;; The value of the general Content-Security-Policy for most web pages.
+;; Leave it empty to apply the default policy, or set it to "unset" to disable Content-Security-Policy.
+;CONTENT_SECURITY_POLICY_GENERAL =
+
+;; Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
+;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
+;; CIDR list: 1.2.3.0/8, 2001:db8::/32
+;; Wildcard hosts: *.mydomain.com, 192.168.100.*
+;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
+;ALLOWED_HOST_LIST = external
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -757,7 +769,12 @@ ENABLE_SSH_LOG = true
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Git config options
-;; This section only does "set" config, a removed config key from this section won't be removed from git config automatically. The format is `some.configKey = value`.
+;; The format is `some.configKey = value`.
+;; These options will be written into the gitconfig file under "[git] HOME_PATH" when Gitea web starts.
+;; ATTENTION:
+;; * It only does "set" config, a removed config key from this section won't be removed from git config automatically.
+;; * Some config options might affect the behavior of git and fail Gitea's git operation,
+;;   make sure you know what you are doing before making changes.
 ;[git.config]
 ;diff.algorithm = histogram
 ;core.logAllRefUpdates = true
@@ -1023,9 +1040,18 @@ ENABLE_SSH_LOG = true
 ;; Default private when using push-to-create
 ;DEFAULT_PUSH_CREATE_PRIVATE = true
 ;;
-;; Global limit of repositories per user, applied at creation time. -1 means no limit
+;; Global limit of repositories per user or org, applied at creation time. -1 means no limit
+;; To configure independent limits for users and orgs, use USER_MAX_CREATION_LIMIT and ORG_MAX_CREATION_LIMIT
 ;MAX_CREATION_LIMIT = -1
 ;;
+;; Global limit of repositories per user, applied at creation time. -1 means no limit
+;; Takes precedence over MAX_CREATION_LIMIT when set
+;USER_MAX_CREATION_LIMIT = -1
+;;
+;; Global limit of repositories per organization, applied at creation time. -1 means no limit
+;; Takes precedence over MAX_CREATION_LIMIT when set
+;ORG_MAX_CREATION_LIMIT = -1
+;;
 ;; Preferred Licenses to place at the top of the List
 ;; The name here must match the filename in options/license or custom/options/license
 ;PREFERRED_LICENSES = Apache License 2.0,MIT License
@@ -1172,6 +1198,7 @@ ENABLE_SSH_LOG = true
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
+;; "branch-name" always uses the PR's branch name.
 ;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
@@ -2658,19 +2685,21 @@ ENABLE_SSH_LOG = true
 ;FILE_EXTENSIONS = .adoc,.asciidoc
 ;; External command to render all matching extensions
 ;RENDER_COMMAND = "asciidoc --out-file=- -"
-;; Don't pass the file on STDIN, pass the filename as argument instead.
+;; Whether Gitea should write the content into a local temp file for the render command's input.
+;; * false: the content will be passed via STDIN to the command.
+;; * true: write the content into a local temp file, and pass the temp filename as argument to the command.
 ;IS_INPUT_FILE = false
 ;; How the content will be rendered.
 ;; * sanitized: Sanitize the content and render it inside current page, default to only allow a few HTML tags and attributes. Customized sanitizer rules can be defined in [markup.sanitizer.*] .
 ;; * no-sanitizer: Disable the sanitizer and render the content inside current page. It's **insecure** and may lead to XSS attack if the content contains malicious code.
 ;; * iframe: Render the content in a separate standalone page and embed it into current page by iframe. The iframe is in sandbox mode with same-origin disabled, and the JS code are safely isolated from parent page.
 ;RENDER_CONTENT_MODE = sanitized
-;; The sandbox applied to the iframe and Content-Security-Policy header when RENDER_CONTENT_MODE is `iframe`.
+;; The sandbox applied to the Content-Security-Policy for the rendered content when RENDER_CONTENT_MODE is `iframe`.
 ;; It defaults to a safe set of "allow-*" restrictions (space separated).
 ;; You can also set it by your requirements or use "disabled" to disable the sandbox completely.
 ;; When set it, make sure there is no security risk:
 ;; * PDF-only content: generally safe to use "disabled", and it needs to be "disabled" because PDF only renders with no sandbox.
-;; * HTML content with JS: if the "RENDER_COMMAND" can guarantee there is no XSS, then it is safe, otherwise, you need to fine tune the "allow-*" restrictions.
+;; * HTML content with JS: do not set "allow-same-origin" unless the "RENDER_COMMAND" can guarantee there is no XSS.
 ;RENDER_CONTENT_SANDBOX =
 ;; Whether post-process the rendered HTML content, including:
 ;; resolve relative links and image sources, recognizing issue/commit references, escaping invisible characters,
@@ -2981,8 +3010,16 @@ ENABLE_SSH_LOG = true
 ;; Comma-separated list of workflow directories, the first one to exist
 ;; in a repo is used to find Actions workflow files
 ;WORKFLOW_DIRS = .gitea/workflows,.github/workflows
+;; Comma-separated list of scoped workflow directories in a source repository, the first one to exist is used.
+;; Files here are picked up only when the repo is registered as a scoped-workflow source; in any other repo they neither run repo-level nor scope-level.
+;; Must not overlap with WORKFLOW_DIRS. Leave empty so no directory is scanned; no scoped workflows are found or run.
+;SCOPED_WORKFLOW_DIRS = .gitea/scoped_workflows
 ;; Maximum number of attempts a single workflow run can have. Default value is 50.
 ;MAX_RERUN_ATTEMPTS = 50
+;; Maximum number of runners that may run the task-assignment query concurrently, per Gitea instance.
+;; Caps this instance's DB load when many runners poll at once; excess runners retry on their next poll.
+;; In a multi-instance deployment the cluster-wide limit is this value times the number of instances. Default value is 16.
+;MAX_CONCURRENT_TASK_PICKS = 16
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;