Gitea 28.0 Released, Drops 1.x Prefix, Adds Audit Logging and Bot Accounts

Version Numbering Change and Key Features

Gitea has released version 28.0.0, marking a change in its versioning scheme by dropping the historical "1." prefix. This release introduces several new functionalities, including comprehensive audit logging, support for bot accounts, and the ability to use HTTPS deploy tokens.

Other notable additions are user impersonation capabilities for administrators, code-owner approval rules for pull requests, diff file filters, and an improved Actions queue view. The full list of changes is available in the changelog.

Security Updates and Upgrade Considerations

Version 28.0.0 contains security fixes. Specific details regarding these fixes will be published approximately one week after the release to allow users time to upgrade their installations. Users are advised to review the breaking changes and back up their data before upgrading.

The upgrade process involves replacing the Gitea binary or Docker container and restarting the service. Release binaries no longer support 32-bit x86 or gogit builds, and the Snap package is no longer built for armhf. Download file names have also changed, removing the OS version suffix.

Changes to Git Network Operations and Egress Rules

A significant change in Gitea 28.0 is that Git network operations, such as migrations and mirrors, now route through an internal proxy. This proxy applies new egress settings, requiring administrators to review and potentially adjust their allow and block lists before upgrading.

The "external" preset has been removed. For a deny-by-default policy, users must set EGRESS_MODE = strict and explicitly list allowed hosts. In strict mode, entries without a port only permit ports 80 and 443. The default "lax" mode no longer restricts public hosts via ALLOWED_HOST_LIST unless EGRESS_MODE is set to strict. IP address entries no longer accept wildcards, and domain entries now follow curl syntax.