Update gitea/gitea Docker tag to v1.26.3 #730

2026-06-21T03:07:55Z

renovate commented

2026-06-21 03:07:55 +00:00

This PR contains the following updates:

Package	Update	Change
gitea/gitea	patch	`1.26.2` → `1.26.3`

Release Notes

go-gitea/gitea (gitea/gitea)

`v1.26.3`

Compare Source

BREAKING
- fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)
SECURITY
- fix(hostmatcher): patch incorrect private list (#38170) (#38173)
- fix: Various security fixes (#38103) (#38151)
- fix: Various sec fixes (#38108) (#38147)
- fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
- fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
- fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
- fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
- fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
- fix: bound CODEOWNERS regex match time (#38011) (#38025)
- fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
- fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)
API
- feat(api): add Link header in ListForks (#38052) (#38063)
BUGFIXES
- fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
- fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
- fix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
- fix: parse HEAD ref (#38119)
- fix: git cmd (#38084) (#38087)
- fix(releases): generate notes for initial tag (#37697) (#37986)
- fix(actions): return 404 when job log blob is missing (#38003) (#38004)
- fix(actions): exclude workflow_call from workflow trigger detection (#37894) (#37899)
- fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
- fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
- fix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892)
- fix: http content file render (#37850) (#37856)
- fix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
- fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)
BUILD
- fix(deps): update @playwright/test to 1.60.0 (#38144)
- ci: add tools/ci-tools.ts for the PR labeler workflow (#37831)
- fix(build): swagger css import (#37801) (#37803)

Instances on Gitea Cloud will be automatically upgraded to this version during the specified maintenance window.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gitea/gitea](https://github.com/go-gitea/gitea) | patch | `1.26.2` → `1.26.3` | --- ### Release Notes <details> <summary>go-gitea/gitea (gitea/gitea)</summary> ### [`v1.26.3`](https://github.com/go-gitea/gitea/releases/tag/v1.26.3) [Compare Source](https://github.com/go-gitea/gitea/compare/v1.26.2...v1.26.3) - BREAKING - fix(actions)!: require merged PR to bypass fork PR approval gate ([#38010](https://github.com/go-gitea/gitea/issues/38010)) ([#38041](https://github.com/go-gitea/gitea/issues/38041)) - SECURITY - fix(hostmatcher): patch incorrect private list ([#38170](https://github.com/go-gitea/gitea/issues/38170)) ([#38173](https://github.com/go-gitea/gitea/issues/38173)) - fix: Various security fixes ([#38103](https://github.com/go-gitea/gitea/issues/38103)) ([#38151](https://github.com/go-gitea/gitea/issues/38151)) - fix: Various sec fixes ([#38108](https://github.com/go-gitea/gitea/issues/38108)) ([#38147](https://github.com/go-gitea/gitea/issues/38147)) - fix: allow git clone of private repos with anonymous code access ([#38074](https://github.com/go-gitea/gitea/issues/38074)) ([#38146](https://github.com/go-gitea/gitea/issues/38146)) - fix(auth): ignore stale OIDC external login links to organizations ([#37875](https://github.com/go-gitea/gitea/issues/37875)) ([#38141](https://github.com/go-gitea/gitea/issues/38141)) - fix(hostmatcher): block reserved IP ranges from external/private filters ([#38039](https://github.com/go-gitea/gitea/issues/38039)) ([#38059](https://github.com/go-gitea/gitea/issues/38059)) - fix(lfs): require Code-unit access for cross-repo LFS object reuse ([#38006](https://github.com/go-gitea/gitea/issues/38006)) ([#38050](https://github.com/go-gitea/gitea/issues/38050)) - fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass ([#38008](https://github.com/go-gitea/gitea/issues/38008)) ([#38015](https://github.com/go-gitea/gitea/issues/38015)) - fix: bound CODEOWNERS regex match time ([#38011](https://github.com/go-gitea/gitea/issues/38011)) ([#38025](https://github.com/go-gitea/gitea/issues/38025)) - fix: bound debian ParseControlFile to a single control stanza ([#38044](https://github.com/go-gitea/gitea/issues/38044)) ([#38055](https://github.com/go-gitea/gitea/issues/38055)) - fix(deps): update module golang.org/x/net to v0.55.0 \[security] ([#37813](https://github.com/go-gitea/gitea/issues/37813)) ([#37829](https://github.com/go-gitea/gitea/issues/37829)) - API - feat(api): add Link header in ListForks ([#38052](https://github.com/go-gitea/gitea/issues/38052)) ([#38063](https://github.com/go-gitea/gitea/issues/38063)) - BUGFIXES - fix: Fix the panic when ssh remote lfs endpoint parsing failure ([#38026](https://github.com/go-gitea/gitea/issues/38026)) ([#38158](https://github.com/go-gitea/gitea/issues/38158)) - fix(api): nil pointer panic when filtering tracked times by a non-existent user ([#38112](https://github.com/go-gitea/gitea/issues/38112)) ([#38115](https://github.com/go-gitea/gitea/issues/38115)) - fix: keep literal "false" value displayed in workflow\_dispatch choice dropdowns ([#38080](https://github.com/go-gitea/gitea/issues/38080)) ([#38096](https://github.com/go-gitea/gitea/issues/38096)) - fix: parse HEAD ref ([#38119](https://github.com/go-gitea/gitea/issues/38119)) - fix: git cmd ([#38084](https://github.com/go-gitea/gitea/issues/38084)) ([#38087](https://github.com/go-gitea/gitea/issues/38087)) - fix(releases): generate notes for initial tag ([#37697](https://github.com/go-gitea/gitea/issues/37697)) ([#37986](https://github.com/go-gitea/gitea/issues/37986)) - fix(actions): return 404 when job log blob is missing ([#38003](https://github.com/go-gitea/gitea/issues/38003)) ([#38004](https://github.com/go-gitea/gitea/issues/38004)) - fix(actions): exclude `workflow_call` from workflow trigger detection ([#37894](https://github.com/go-gitea/gitea/issues/37894)) ([#37899](https://github.com/go-gitea/gitea/issues/37899)) - fix(actions): keep action run title clickable when commit subject is a URL ([#37867](https://github.com/go-gitea/gitea/issues/37867)) ([#37898](https://github.com/go-gitea/gitea/issues/37898)) - fix(actions): reject workflow\_dispatch for workflows without that trigger ([#37660](https://github.com/go-gitea/gitea/issues/37660)) ([#37895](https://github.com/go-gitea/gitea/issues/37895)) - fix(actions): ack re-sent `UpdateLog` finalize idempotently ([#37885](https://github.com/go-gitea/gitea/issues/37885)) ([#37892](https://github.com/go-gitea/gitea/issues/37892)) - fix: http content file render ([#37850](https://github.com/go-gitea/gitea/issues/37850)) ([#37856](https://github.com/go-gitea/gitea/issues/37856)) - fix(issues): clear stale ReviewTypeRequest when submitting pending review ([#37809](https://github.com/go-gitea/gitea/issues/37809)) ([#37815](https://github.com/go-gitea/gitea/issues/37815)) - fix: Fix issue target branch selection for non-collaborators ([#36916](https://github.com/go-gitea/gitea/issues/36916)) ([#38164](https://github.com/go-gitea/gitea/issues/38164)) - BUILD - fix(deps): update `@playwright/test` to 1.60.0 ([#38144](https://github.com/go-gitea/gitea/issues/38144)) - ci: add `tools/ci-tools.ts` for the PR labeler workflow ([#37831](https://github.com/go-gitea/gitea/issues/37831)) - fix(build): swagger css import ([#37801](https://github.com/go-gitea/gitea/issues/37801)) ([#37803](https://github.com/go-gitea/gitea/issues/37803)) Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-06-21 03:07:56 +00:00

Update gitea/gitea Docker tag to v1.26.3 ef914c8b10

AverageMarcus merged commit 090683de93 into master

2026-06-21 18:42:09 +00:00

AverageMarcus deleted branch renovate/gitea-gitea-1.x

2026-06-21 18:42:10 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: AverageMarcus/cluster.fun#730