go-gitea/gitea
Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
How gitea is put together
Gitea is a self-hosted all-in-one software development service (Git hosting, code review, issue tracking, wiki, package registry, and CI/CD) written primarily in Go with a browser frontend. The Go backend is a monolithic web application entered via main.go/cmd, using the go-chi router and XORM ORM over multiple SQL databases, with pluggable storage (local, MinIO/S3, Azure Blob) and search (Bleve, Meilisearch). The frontend is a Vue 3 + TypeScript SPA-ish layer bundled with Vite, styled with Tailwind and Fomantic, and templates rendered server-side. Data flows from CLI/web/API requests through chi routers and service modules into models persisted via XORM, with background queues (levelqueue/Redis) driving async work.
Languages
Frameworks
Datastores
Infrastructure
Major components
cmd
CLI entrypoints for web server, admin, hooks, serv (SSH), migration, doctor, dump and cert management.
routers
HTTP request routing and handlers for web UI, API, and Git protocols (initialized via routers/init.go).
models
Domain data models and persistence layer over XORM, initialized in models/init.go.
modelmigration
Versioned database schema migrations organized by release (v1_10, v1_11, ...).
modules
Reusable backend libraries: setting/config, logging, markup rendering (markdown, orgmode, csv, jupyter), storage, and more.
web frontend (web_src)
Vue 3 + TypeScript client code, CSS/Tailwind themes, and CodeMirror/editor integrations bundled by Vite.
admin auth (cmd/admin_auth_*)
Configuration of authentication sources including LDAP, OAuth, and SMTP.
build/tools
Code generation (bindata, emoji, gitignores, OpenAPI, go-licenses) and lint/test tooling scripts.
A round of targeted correctness fixes plus the platform's upgrade to Go 1.27.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A round of targeted correctness fixes plus the platform's upgrade to Go 1.27.
Week of 2026-08-17
A sweeping security-hardening push tightened access controls and token permissions across the whole platform.
Week of 2026-08-10
A mix of admin usability improvements, Actions workflow fixes, and internal form-handling cleanup.
Week of 2026-08-03
New package and Actions capabilities landed alongside a broad UI polish and code-modernization effort.
Week of 2026-07-27
Major additions to the Actions engine, plus stronger code-review controls and many reliability fixes.
Over the past several weeks Gitea has shipped a large wave of security hardening—tightening who can see private repositories, organizations, users, and packages, and enforcing token permissions across its API and Actions system—alongside steady improvements to its CI/CD Actions engine and code-diff viewing experience. The project also modernized its foundations, upgrading to Go 1.27, raising the minimum required Git version, and refactoring large portions of the codebase. Throughout, the team kept fixing everyday reliability issues in packages, migrations, and file storage while translations were continuously updated.
Week by week
2026-08-24A round of targeted correctness fixes plus the platform's upgrade to Go 1.27.latest6 changes
Chore
Upgraded to Go 1.27
The underlying programming language runtime was updated to its latest version, with related housekeeping tweaks.
Fix
Safer commit signature checks
Corrected how OpenPGP commit signatures are verified and now requires a modern Git version for reliability.
Fix
Repositories mid-migration no longer flagged as broken
A repository still being imported is no longer mistakenly marked as empty or broken.
Fix
Better handling of co-author credits
Commit co-author information that doesn't follow the strict email format is now read correctly.
Fix
File attachments locked to their repository
Attachments are now confined to their owning repository's storage path for correctness and safety.
Fix
npm package download links fixed
Package names with special characters are now properly encoded in download URLs.
2026-08-17A sweeping security-hardening push tightened access controls and token permissions across the whole platform.6 changes
Fix
Hide private repositories, users, and organizations
Repositories, users, and organizations belonging to hidden or limited owners are no longer exposed to people who shouldn't see them.
Fix
Stricter API access-token permissions
Multiple API endpoints now properly enforce the scope and authorization tied to each access token.
Fix
Safer handling of untrusted pull requests in Actions
Automated workflows now respect trust boundaries for pull requests coming from forks.
Feature
Search and filter in the diff sidebar
When reviewing code changes, users can now search and filter files by extension in the sidebar.
Feature
Automatic cleanup of old Actions runs
Administrators can set a retention period so old automated build/CI runs are deleted automatically.
Feature
Permalinks to pull request reviews
Individual pull-request reviews can now be linked to directly.
2026-08-10A mix of admin usability improvements, Actions workflow fixes, and internal form-handling cleanup.6 changes
Feature
Impersonation banner for admins
Administrators now see a clear banner when acting as another user, reducing the risk of confusion.
Fix
Several Actions workflow fixes
Reruns can read earlier attempts' artifacts, workflow inputs stay as text, and reusable workflows resolve at the correct commit.
Fix
Security update to image library
A bundled image-processing dependency was updated to patch a security issue.
Fix
More efficient repository bundle downloads
Downloading a repository bundle no longer creates a large temporary file each time.
Fix
Harder-to-guess avatar hashing
Avatar lookups now use the stronger SHA-256 method.
Refactor
Cleaned up form validation
Internal form-binding and validation code was tidied up for maintainability.
2026-08-03New package and Actions capabilities landed alongside a broad UI polish and code-modernization effort.6 changes
Feature
Project management APIs
New programmatic endpoints were added for working with projects.
Feature
Helm provenance file uploads
The package registry can now accept Helm provenance files for signed chart verification.
Feature
More control over Actions runs
New abilities include force-cancelling a workflow run and supporting shorthand references in reusable workflows.
Chore
Restyled toast notifications
The small pop-up notifications were visually refreshed.
Refactor
Modernized front-end components
Remaining interface components were migrated to a newer, more maintainable coding style.
Fix
Switched SSH library
The underlying SSH handling was replaced with a more standard, better-maintained library.
2026-07-27Major additions to the Actions engine, plus stronger code-review controls and many reliability fixes.6 changes
Feature
Expanded Actions API and dynamic matrices
New endpoints manage workflow runs and logs, and workflows can now generate their job combinations dynamically with a parallelism limit.
Feature
Require code-owner reviews before merging
A new branch protection option can block merges while code-owner reviews are still pending.
Feature
Webhook fires when a repository is renamed
External integrations are now notified when a repository changes its name.
Fix
Fixed several crash and error conditions
Resolved crashes in diff rendering and markup, and a 500 error on repository home pages caused by slow commit lookups.
Refactor
Faster inline diff highlighting
Code-difference highlighting was sped up by adding caching.
Fix
Correct URLs when running under a sub-path
Full links are now generated correctly for installations hosted on a sub-path.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 118 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required