0.12.1

ℹ️ Heads up! There is a new patch release 0.12.11 available, we recommend directly installing or upgrading to that version.

---

Fixed

• The updated_at field is now correctly updated when updates an issue. #6209
• Fixed a regression which created login_source.cfg column to have VARCHAR(255) instead of TEXT in MySQL. #6280

---

0.12.0

Added

• Support for Git LFS, you can read documentation for both user and admin. #1322
• Allow admin to remove observers from the repository. #5803
• Use Last-Modified HTTP header for raw files. #5811
• Support syntax highlighting for SAS code files (i.e. .r, .sas, .tex, .yaml). #5856
• Able to fill in pull request title with a template. #5901
• Able to override static files under public/ directory, please refer to documentation for usage. #5920
• New API endpoint GET /admin/teams/:teamid/members to list members of a team. #5877
• Support backup with retention policy for Docker deployments. #6140

Changed

• The organization profile page has changed to display at most 12 members. #5506
• The required Go version to compile source code changed to 1.14.
• All assets are now embedded into binary and served from memory by default. Set [server] LOAD_ASSETS_FROM_DISK = true to load them from disk. #5920
• Application and Go versions are removed from page footer and only show in the admin dashboard.
• Build tag for running as Windows Service has been changed from miniwinsvc to minwinsvc.
• Configuration option APP_NAME is deprecated and will end support in 0.13.0, please start using BRAND_NAME.
• Configuration option [server] ROOT_URL is deprecated and will end support in 0.13.0, please start using [server] EXTERNAL_URL.
• Configuration option [server] LANDING_PAGE is deprecated and will end support in 0.13.0, please start using [server] LANDING_URL.
• Configuration option [database] DB_TYPE is deprecated and will end support in 0.13.0, please start using [database] TYPE.
• Configuration option [database] PASSWD is deprecated and will end support in 0.13.0, please start using [database] PASSWORD.
• Configuration option [security] REVERSE_PROXY_AUTHENTICATION_USER is deprecated and will end support in 0.13.0, please start using [auth] REVERSE_PROXY_AUTHENTICATION_HEADER.
• Configuration section [mailer] is deprecated and will end support in 0.13.0, please start using [email].
• Configuration section [service] is deprecated and will end support in 0.13.0, please start using [auth].
• Configuration option [auth] ACTIVE_CODE_LIVE_MINUTES is deprecated and will end support in 0.13.0, please start using [auth] ACTIVATE_CODE_LIVES.
• Configuration option [auth] RESET_PASSWD_CODE_LIVE_MINUTES is deprecated and will end support in 0.13.0, please start using [auth] RESET_PASSWORD_CODE_LIVES.
• Configuration option [auth] ENABLE_CAPTCHA is deprecated and will end support in 0.13.0, please start using [auth] ENABLE_REGISTRATION_CAPTCHA.
• Configuration option [auth] ENABLE_NOTIFY_MAIL is deprecated and will end support in 0.13.0, please start using [user] ENABLE_EMAIL_NOTIFICATION.
• Configuration option [session] GC_INTERVAL_TIME is deprecated and will end support in 0.13.0, please start using [session] GC_INTERVAL.
• Configuration option [session] SESSION_LIFE_TIME is deprecated and will end support in 0.13.0, please start using [session] MAX_LIFE_TIME.
• The name - is reserved and cannot be used for users or organizations.

Fixed

• [Security] Potential open redirection with i18n.
• [Security] Potential ability to delete files outside a repository.
• [Security] Potential ability to set primary email on others' behalf from their verified emails.
• [Security] Potential XSS attack via .ipynb. #5170
• [Security] Potential SSRF attack via webhooks. #5366
• [Security] Potential CSRF attack in admin panel. #5367
• [Security] Potential stored XSS attack in some browsers. #5397
• [Security] Potential RCE on mirror repositories. #5767
• [Security] Potential XSS attack with raw markdown API. #5907
• File both modified and renamed within a commit treated as separate files. #5056
• Unable to restore the database backup to MySQL 8.0 with syntax error. #5602
• Open/close milestone redirects to a 404 page. #5677
• Disallow multiple tokens with same name. #5587 #5820
• Enable Federated Avatar Lookup could cause server to crash. #5848
• Private repositories are hidden in the organization's view. #5869
• Users have access to base repository cannot view commits in forks. #5878
• Server error when changing email address in user settings page. #5899
• Fall back to use RFC 3339 as time layout when misconfigured. #6098
• Unable to update team with server error. #6185
• Webhooks are not fired after push when [service] REQUIRE_SIGNIN_VIEW = true.
• Files with identical content are randomly displayed one of them.

Removed

• Configuration option [other] SHOW_FOOTER_VERSION
• Configuration option [server] STATIC_ROOT_PATH
• Configuration option [repository] MIRROR_QUEUE_LENGTH
• Configuration option [repository] PULL_REQUEST_QUEUE_LENGTH
• Configuration option [session] ENABLE_SET_COOKIE
• Configuration option [release.attachment] PATH
• Configuration option [webhook] QUEUE_LENGTH
• Build tag sqlite, which means CGO is now required.

0.12.0

ℹ️ Heads up! There is a new patch release 0.12.11 available, we recommend directly installing or upgrading to that version.

---

Added

• Support for Git LFS, you can read documentation for both user and admin. #1322
• Allow admin to remove observers from the repository. #5803
• Use Last-Modified HTTP header for raw files. #5811
• Support syntax highlighting for SAS code files (i.e. .r, .sas, .tex, .yaml). #5856
• Able to fill in pull request title with a template. #5901
• Able to override static files under public/ directory, please refer to documentation for usage. #5920
• New API endpoint GET /admin/teams/:teamid/members to list members of a team. #5877
• Support backup with retention policy for Docker deployments. #6140

Changed

• The organization profile page has changed to display at most 12 members. #5506
• The required Go version to compile source code changed to 1.14.
• All assets are now embedded into binary and served from memory by default. Set [server] LOAD_ASSETS_FROM_DISK = true to load them from disk. #5920
• Application and Go versions are removed from page footer and only show in the admin dashboard.
• Build tag for running as Windows Service has been changed from miniwinsvc to minwinsvc.
• Configuration option APP_NAME is deprecated and will end support in 0.13.0, please start using BRAND_NAME.
• Configuration option [server] ROOT_URL is deprecated and will end support in 0.13.0, please start using [server] EXTERNAL_URL.
• Configuration option [server] LANDING_PAGE is deprecated and will end support in 0.13.0, please start using [server] LANDING_URL.
• Configuration option [database] DB_TYPE is deprecated and will end support in 0.13.0, please start using [database] TYPE.
• Configuration option [database] PASSWD is deprecated and will end support in 0.13.0, please start using [database] PASSWORD.
• Configuration option [security] REVERSE_PROXY_AUTHENTICATION_USER is deprecated and will end support in 0.13.0, please start using [auth] REVERSE_PROXY_AUTHENTICATION_HEADER.
• Configuration section [mailer] is deprecated and will end support in 0.13.0, please start using [email].
• Configuration section [service] is deprecated and will end support in 0.13.0, please start using [auth].
• Configuration option [auth] ACTIVE_CODE_LIVE_MINUTES is deprecated and will end support in 0.13.0, please start using [auth] ACTIVATE_CODE_LIVES.
• Configuration option [auth] RESET_PASSWD_CODE_LIVE_MINUTES is deprecated and will end support in 0.13.0, please start using [auth] RESET_PASSWORD_CODE_LIVES.
• Configuration option [auth] ENABLE_CAPTCHA is deprecated and will end support in 0.13.0, please start using [auth] ENABLE_REGISTRATION_CAPTCHA.
• Configuration option [auth] ENABLE_NOTIFY_MAIL is deprecated and will end support in 0.13.0, please start using [user] ENABLE_EMAIL_NOTIFICATION.
• Configuration option [session] GC_INTERVAL_TIME is deprecated and will end support in 0.13.0, please start using [session] GC_INTERVAL.
• Configuration option [session] SESSION_LIFE_TIME is deprecated and will end support in 0.13.0, please start using [session] MAX_LIFE_TIME.
• The name - is reserved and cannot be used for users or organizations.

Fixed

• [Security] Potential open redirection with i18n.
• [Security] Potential ability to delete files outside a repository.
• [Security] Potential ability to set primary email on others' behalf from their verified emails.
• [Security] Potential XSS attack via .ipynb. #5170
• [Security] Potential SSRF attack via webhooks. #5366
• [Security] Potential CSRF attack in admin panel. #5367
• [Security] Potential stored XSS attack in some browsers. #5397
• [Security] Potential RCE on mirror repositories. #5767
• [Security] Potential XSS attack with raw markdown API. #5907
• File both modified and renamed within a commit treated as separate files. #5056
• Unable to restore the database backup to MySQL 8.0 with syntax error. #5602
• Open/close milestone redirects to a 404 page. #5677
• Disallow multiple tokens with same name. #5587 #5820
• Enable Federated Avatar Lookup could cause server to crash. #5848
• Private repositories are hidden in the organization's view. #5869
• Users have access to base repository cannot view commits in forks. #5878
• Server error when changing email address in user settings page. #5899
• Fall back to use RFC 3339 as time layout when misconfigured. #6098
• Unable to update team with server error. #6185
• Webhooks are not fired after push when [service] REQUIRE_SIGNIN_VIEW = true.
• Files with identical content are randomly displayed one of them.

Removed

• Configuration option [other] SHOW_FOOTER_VERSION
• Configuration option [server] STATIC_ROOT_PATH
• Configuration option [repository] MIRROR_QUEUE_LENGTH
• Configuration option [repository] PULL_REQUEST_QUEUE_LENGTH
• Configuration option [session] ENABLE_SET_COOKIE
• Configuration option [release.attachment] PATH
• Configuration option [webhook] QUEUE_LENGTH
• Build tag sqlite, which means CGO is now required.

0.11.91

Bug fixes

• MySQL: invalid connection #5532
• Docker: Deprecation Notice OpenSSH #5647
• Copyright is behind the times #5674
• [Security] Incorrect API access control #5764

Improvements

• Assignee receives email updates of issue thread #4220
• Render Markdown in emails #4552
• Add rsync to the Docker image #5773

0.11.86

Bug fixes

• Layout misalignment in Firefox for Linux #5299
• Unexpected issue index parsing error while using external issue tracker #5551
• [Security] Remote Code execution or/and Denial of Service #5558

Features

• Support GitHub (Enterprise) authentication source #5340
• Add API endpoint to get commit details by SHA #5546

Others

• Add new languages support: Portuguese

0.11.79

Bug fixes

• LDAP group verification doesn't work when using 'dn' as user attribute #4684
• LDAP group verification fails #4792
• Emoji's do not work in wiki #4869
• Log level not applied from configuration #5007
• Not able to go get a repository with non-80 port #5305
• Fix critical CSRF vulnerabilities on API routes #5355
• Wrong redirect after updated protect branch setting whose name contains # #5442
• Clear labels not working #5445
• [Security] Remote command execution #5469
• Push event webhook is not triggered when new branch fetched to mirror repository #5473
• Large issue comment exceeds dashboard section #5502
• List collaborator API does not contain permission information #5538
• [Security] Log out only deletes browser cookies #5540
• [Security] Some routes need to be POST #5541
• [Security] Stored XSS in external issue tracker URL format #5545

Improvements

• Support prefilling the title and body of new issues using query parameters #5302
• Support data URL of base64 encoded images in Markdown #5391
• Allow non logged in users to call repository information API /repos/:username/:reponame #5475

0.11.66

Bug fixes

• Web editor doesn't execute hooks after commit #4338
• Release attachments are deleted when delete any random comment #4627
• Private repository with public wiki or issue does not show in search result #4973
• Cannot start with MySQL 8.0 #5187
• Webhook and its tasks are not cleaned up when delete repository #5229
• Time set to current after restored from backup #5264
• Delete branch after merged pull request does no trigger webhook #5331
• Fork repository does not check of the limit of users #5345
• Unable to delete user with PostgreSQL #5376

Features

• Able to add avatar for repository #2340
• Add basic Go runtime metrics provided by Prometheus #4141

Improvements

• Ignore configuration inline comment by default
• Add deletion of an empty line at the end of file in file view #5270
• Able to set default authentication method for login #5274
• Able to add custom merge commit description #5276

Others

• Security fixes

0.11.53

Bug fixes

• The branch name contains '#' not work correctly #4601
• Issue mention does not render with square brackets #4706
• 500 when merge branch when the base branch is not the default branch #5138
• Gravatar URLs are badly generated #5157
• Able to reuse two factor passcode
• Config option [git] GC_ARGS does not take effect

Features

• Show mirror updates in activity timeline #2017
• Support authentication source config file #3142
• Trigger webhook after mirror sync #4528

Others

• Changed import path from "gogits/gogs" to "gogs/gogs"
• Security fixes
• Add new languages support: Vietnamese

0.11.43

Bug fixes

• Protected branch can be deleted from the web after merge request #4514
• Does not recognise SYSNAME datatype in MSSQL #4642
• Quick guide is only showed for repository admin #4646
• Wrong branch URL for name contains # in branches view #4874
• Commits not merged after accepting pull request using rebase #5051
• Once branch was protected "Lock" icon will never be removed #5053
• SVG support in IPython notebook #5077

Improvements

• Support HTTP HEAD requests #2857
• Add option to rewrite authorized_keys file at start #4435
• Add option to prepend global prefix to the email subject #4524
• Disable federated avatar lookup by default #5126

Others

• Add new languages support: Indonesian, Persian

0.11.34

Bug fixes

• Regression: Pull request is not working between different repositories #4890

0.11.33

Bug fixes

• Some security fixes
• Wrong commit ID in webhook payload after merging pull request #4442
• Meta tag go-import does not response correct value #4832

Features

• Add Dingtalk webhook support #4773
• Allow rebase and merge pull request #4798

Improvements

• Add placeholder '%s' for username in LDAP BindDN #2526
• Allow UID for git user in Docker container to be specified via ENV variable #3520
• Add repository setting to ignore whitespace when check pull request conflict #4834

Others

• Add new language support: Slovak