Gitea 28.0
Gitea 28.0.0 drops the '1.' version prefix, introduces audit logging and bot accounts, and enforces strict breaking changes for Git network egress.
summary is enough Self-hosters must review the breaking changes before upgrading, while others only need the headline highlights.
summary
Gitea released version 28.0.0, dropping the historical '1.' prefix and adding features like audit logging, user impersonation, bot accounts, and an Actions queue view. The update brings significant breaking changes, including mandatory proxy routing for Git network operations, a 400-day expiration default for Actions run history, and a requirement for Git 2.25 or newer. Security fix details are withheld for a week to give administrators time to patch. Commenters debated the version jump, compared Gitea to Forgejo, and criticized the delayed vulnerability disclosure policy.
key points
- Version numbering drops the '1.' prefix, jumping straight from 1.27.3 to 28.0.0.
- Breaking changes include stricter egress proxy rules for Git network operations and a requirement for Git 2.25+.
- Major additions feature admin user impersonation, dedicated bot accounts, audit logging, and Action queue improvements.
who should read it
Self-hosted infrastructure administrators and DevOps engineers.
discussion mixed
consensus
Commenters cracked jokes about the massive version number jump and discussed the ongoing software split and governance debate between Gitea and Forgejo.
pushback
Users pushed back against Gitea's policy of withholding security vulnerability details for a week, noting that attackers can extract the information directly from public patch diffs.
Bizarre policy. Any bad guys unaware of the security implications are analyzing the patch diffs as we speak, so this seems nonsensical to me.
It points out the futility of withholding security disclosures when threat actors can reverse engineer patch diffs immediately.
Generated by an LLM from the article and thread. Check the sources before relying on it.