Gitea 28.2.0: many bug fixes, clean Docker upgrade from 28.1.0

released
lab run
upgraded from
28.1.0
guest
Ubuntu 26.04 VM
tested
yes, in our lab

Summary

Gitea 28.2.0 is mostly bug fixes (about 33 items in the release notes), plus two enhancements. One dependency update, golang.org/x/net v0.60.0, is marked as a security fix in the notes.

Notable items from the notes:

  • A built-in OAuth2 application is pre-registered for gitea-vscode.
  • Custom watches can bypass the on-mention email restriction.
  • Hardening: OpenID state is now validated, LFS object IDs are validated before building a file path, the Actions artifacts v4 request body is size-limited, and incoming-email tokens of users who cannot sign in are rejected.
  • OIDC discovery no longer advertises an unsupported id_token response type.
  • A crash caused by a notification panic is fixed.
  • Several Actions, pull request, markup and package fixes (for example, npm tarball URLs are restored to their former form).

Breaking changes and deprecations

The release notes list no breaking changes or deprecations. One behaviour change to be aware of: npm package tarball URLs are restored to their former form (#39681), which could matter if you have tooling that stored the newer URLs. We did not test this.

Tested in our lab

We installed Gitea 28.1.0 with Docker Compose, created an admin user, a repository and an issue, then stopped the stack with docker compose down, changed the image tag to 28.2.0, pulled it and started it again.

Results after the upgrade:

  • The API reported version 28.2.0.
  • The repository and issue created before the upgrade were still there.
  • The repository web page returned HTTP 200.
  • The container logs contained no lines matching “error”, “panic” or “fail”.
  • OIDC discovery answered and listed RS256 signing.

This was a basic single-container test with the default SQLite database. We did not test Actions, packages, LFS, webhooks, OpenID login, mail or an external database, so the fixes in those areas are not verified by us.

Lab log

$ curl -s localhost:3000/api/v1/version
{"version":"28.1.0"}
$ docker compose down
[...]
 Container gitea-server-1  Removed
$ sed -i "s/gitea:28.1.0/gitea:28.2.0/" compose.yml
$ docker compose pull
[...]
 server Pulled 
$ docker compose up -d
 Container gitea-server-1  Starting
 Container gitea-server-1  Started
$ curl -s localhost:3000/api/v1/version
{"version":"28.2.0"}
$ curl -s localhost:3000/api/v1/repos/lab/demo/issues | head -c 100
[{"id":1,"url":"http://localhost:3000/api/v1/repos/lab/demo/issues/1","html_url":"http://localh
$ curl -s -o /dev/null -w "%{http_code}\n" localhost:3000/lab/demo
200
$ docker compose logs 2>&1 | grep -ciE "error|panic|fail"
0

Reported by others

We did not look for user reports for this release. The items under Summary are taken from the release notes.

Verdict

Upgrade now. The release is bug-fix and hardening focused, lists no breaking changes, and our basic Docker upgrade from 28.1.0 kept data and logged no errors. As always, back up your data directory and database first. If you rely on Actions, packages or OpenID login, check those after upgrading, since we did not test them.

sources