* SECURITY

  * Prevent multiple `To` recipients (go-gitea#22566) (go-gitea#22569)
* BUGFIXES
  * Truncate commit summary on repo files table. (go-gitea#22551) (go-gitea#22552)
  * Mute all links in issue timeline (go-gitea#22534)

* BUGFIXES

  * When updating by rebase we need to set the environment for head repo (go-gitea#22535) (go-gitea#22536)
  * Fix issue not auto-closing when it includes a reference to a branch (go-gitea#22514) (go-gitea#22521)
  * Fix invalid issue branch reference if not specified in template (go-gitea#22513) (go-gitea#22520)
  * Fix 500 error viewing pull request when fork has pull requests disabled (go-gitea#22512) (go-gitea#22515)
  * Reliable selection of admin user (go-gitea#22509) (go-gitea#22511)
  * Set disable_gravatar/enable_federated_avatar when offline mode is true (go-gitea#22479) (go-gitea#22496)
* BUILD
  * cgo cross-compile for freebsd (go-gitea#22397) (go-gitea#22519)

* API

  * Add `sync_on_commit` option for push mirrors api (go-gitea#22271) (go-gitea#22292)
* BUGFIXES
  * Update `github.com/zeripath/zapx/v15` (go-gitea#22485)
  * Fix pull request API field `closed_at` always being `null` (go-gitea#22482) (go-gitea#22483)
  * Fix container blob mount (go-gitea#22226) (go-gitea#22476)
  * Fix error when calculating repository size (go-gitea#22392) (go-gitea#22474)
  * Fix Operator does not exist bug on explore page with ONLY_SHOW_RELEVANT_REPOS (go-gitea#22454) (go-gitea#22472)
  * Fix environments for KaTeX and error reporting (go-gitea#22453) (go-gitea#22473)
  * Remove the netgo tag for Windows build (go-gitea#22467) (go-gitea#22468)
  * Fix migration from GitBucket (go-gitea#22477) (go-gitea#22465)
  * Prevent panic on looking at api "git" endpoints for empty repos (go-gitea#22457) (go-gitea#22458)
  * Fix PR status layout on mobile (go-gitea#21547) (go-gitea#22441)
  * Fix wechatwork webhook sends empty content in PR review (go-gitea#21762) (go-gitea#22440)
  * Remove duplicate "Actions" label in mobile view (go-gitea#21974) (go-gitea#22439)
  * Fix leaving organization bug on user settings -> orgs (go-gitea#21983) (go-gitea#22438)
  * Fixed colour transparency regex matching in project board sorting (go-gitea#22092) (go-gitea#22437)
  * Correctly handle select on multiple channels in Queues (go-gitea#22146) (go-gitea#22428)
  * Prepend refs/heads/ to issue template refs (go-gitea#20461) (go-gitea#22427)
  * Restore function to "Show more" buttons (go-gitea#22399) (go-gitea#22426)
  * Continue GCing other repos on error in one repo (go-gitea#22422) (go-gitea#22425)
  * Allow HOST has no port (go-gitea#22280) (go-gitea#22409)
  * Fix omit avatar_url in discord payload when empty (go-gitea#22393) (go-gitea#22394)
  * Don't display stop watch top bar icon when disabled and hidden when click other place (go-gitea#22374) (go-gitea#22387)
  * Don't lookup mail server when using sendmail (go-gitea#22300) (go-gitea#22383)
  * Fix gravatar disable bug (go-gitea#22337)
  * Fix update settings table on install (go-gitea#22326) (go-gitea#22327)
  * Fix sitemap (go-gitea#22272) (go-gitea#22320)
  * Fix code search title translation (go-gitea#22285) (go-gitea#22316)
  * Fix due date rendering the wrong date in issue (go-gitea#22302) (go-gitea#22306)
  * Fix get system setting bug when enabled redis cache (go-gitea#22298)
  * Fix bug of DisableGravatar default value (go-gitea#22297)
  * Fix key signature error page (go-gitea#22229) (go-gitea#22230)
* TESTING
  * Remove test session cache to reduce possible concurrent problem (go-gitea#22199) (go-gitea#22429)
* MISC
  * Restore previous official review when an official review is deleted (go-gitea#22449) (go-gitea#22460)
  * Log STDERR of external renderer when it fails (go-gitea#22442) (go-gitea#22444)

* SECURITY

  * Remove ReverseProxy authentication from the API (go-gitea#22219) (go-gitea#22251)
  * Support Go Vulnerability Management (go-gitea#21139)
  * Forbid HTML string tooltips (go-gitea#20935)
* BREAKING
  * Rework mailer settings (go-gitea#18982)
  * Remove U2F support (go-gitea#20141)
  * Refactor `i18n` to `locale` (go-gitea#20153)
  * Enable contenthash in filename for dynamic assets (go-gitea#20813)
* FEATURES
  * Add color previews in markdown (go-gitea#21474)
  * Allow package version sorting (go-gitea#21453)
  * Add support for Chocolatey/NuGet v2 API (go-gitea#21393)
  * Add API endpoint to get changed files of a PR (go-gitea#21177)
  * Add filetree on left of diff view (go-gitea#21012)
  * Support Issue forms and PR forms (go-gitea#20987)
  * Add support for Vagrant packages (go-gitea#20930)
  * Add support for `npm unpublish` (go-gitea#20688)
  * Add badge capabilities to users (go-gitea#20607)
  * Add issue filter for Author (go-gitea#20578)
  * Add KaTeX rendering to Markdown. (go-gitea#20571)
  * Add support for Pub packages (go-gitea#20560)
  * Support localized README (go-gitea#20508)
  * Add support mCaptcha as captcha provider (go-gitea#20458)
  * Add team member invite by email (go-gitea#20307)
  * Added email notification option to receive all own messages (go-gitea#20179)
  * Switch Unicode Escaping to a VSCode-like system (go-gitea#19990)
  * Add user/organization code search (go-gitea#19977)
  * Only show relevant repositories on explore page (go-gitea#19361)
  * User keypairs and HTTP signatures for ActivityPub federation using go-ap (go-gitea#19133)
  * Add sitemap support (go-gitea#18407)
  * Allow creation of OAuth2 applications for orgs (go-gitea#18084)
  * Add system setting table with cache and also add cache supports for user setting (go-gitea#18058)
  * Add pages to view watched repos and subscribed issues/PRs (go-gitea#17156)
  * Support Proxy protocol (go-gitea#12527)
  * Implement sync push mirror on commit (go-gitea#19411)
* API
  * Allow empty assignees on pull request edit (go-gitea#22150) (go-gitea#22214)
  * Make external issue tracker regexp configurable via API (go-gitea#21338)
  * Add name field for org api (go-gitea#21270)
  * Show teams with no members if user is admin (go-gitea#21204)
  * Add latest commit's SHA to content response (go-gitea#20398)
  * Add allow_rebase_update, default_delete_branch_after_merge to repository api response (go-gitea#20079)
  * Add new endpoints for push mirrors management (go-gitea#19841)
* ENHANCEMENTS
  * Add setting to disable the git apply step in test patch (go-gitea#22130) (go-gitea#22170)
  * Multiple improvements for comment edit diff (go-gitea#21990) (go-gitea#22007)
  * Fix button in branch list, avoid unexpected page jump before restore branch actually done (go-gitea#21562) (go-gitea#21928)
  * Fix flex layout for repo list icons (go-gitea#21896) (go-gitea#21920)
  * Fix vertical align of committer avatar rendered by email address (go-gitea#21884) (go-gitea#21918)
  * Fix setting HTTP headers after write (go-gitea#21833) (go-gitea#21877)
  * Color and Style enhancements (go-gitea#21784, go-gitea#21799) (go-gitea#21868)
  * Ignore line anchor links with leading zeroes (go-gitea#21728) (go-gitea#21776)
  * Quick fixes monaco-editor error: "vs.editor.nullLanguage" (go-gitea#21734) (go-gitea#21738)
  * Use CSS color-scheme instead of invert (go-gitea#21616) (go-gitea#21623)
  * Respect user's locale when rendering the date range in the repo activity page (go-gitea#21410)
  * Change `commits-table` column width (go-gitea#21564)
  * Refactor git command arguments and make all arguments to be safe to be used (go-gitea#21535)
  * CSS color enhancements (go-gitea#21534)
  * Add link to user profile in markdown mention only if user exists (go-gitea#21533, go-gitea#21554)
  * Add option to skip index dirs (go-gitea#21501)
  * Diff file tree tweaks (go-gitea#21446)
  * Localize all timestamps (go-gitea#21440)
  * Add `code` highlighting in issue titles (go-gitea#21432)
  * Use Name instead of DisplayName in LFS Lock (go-gitea#21415)
  * Consolidate more CSS colors into variables (go-gitea#21402)
  * Redirect to new repository owner (go-gitea#21398)
  * Use ISO date format instead of hard-coded English date format for date range in repo activity page (go-gitea#21396)
  * Use weighted algorithm for string matching when finding files in repo (go-gitea#21370)
  * Show private data in feeds (go-gitea#21369)
  * Refactor parseTreeEntries, speed up tree list (go-gitea#21368)
  * Add GET and DELETE endpoints for Docker blob uploads (go-gitea#21367)
  * Add nicer error handling on template compile errors (go-gitea#21350)
  * Add `stat` to `ToCommit` function for speed (go-gitea#21337)
  * Support instance-wide OAuth2 applications (go-gitea#21335)
  * Record OAuth client type at registration (go-gitea#21316)
  * Add new CSS variables --color-accent and --color-small-accent (go-gitea#21305)
  * Improve error descriptions for unauthorized_client (go-gitea#21292)
  * Case-insensitive "find files in repo" (go-gitea#21269)
  * Consolidate more CSS rules, fix inline code on arc-green (go-gitea#21260)
  * Log real ip of requests from ssh (go-gitea#21216)
  * Save files in local storage as group readable (go-gitea#21198)
  * Enable fluid page layout on medium size viewports (go-gitea#21178)
  * File header tweaks (go-gitea#21175)
  * Added missing headers on user packages page (go-gitea#21172)
  * Display image digest for container packages (go-gitea#21170)
  * Skip dirty check for team forms (go-gitea#21154)
  * Keep path when creating a new branch (go-gitea#21153)
  * Remove fomantic image module (go-gitea#21145)
  * Make labels clickable in the comments section. (go-gitea#21137)
  * Sort branches and tags by date descending (go-gitea#21136)
  * Better repo API unit checks (go-gitea#21130)
  * Improve commit status icons (go-gitea#21124)
  * Limit length of repo description and repo url input fields (go-gitea#21119)
  * Show .editorconfig errors in frontend (go-gitea#21088)
  * Allow poster to choose reviewers (go-gitea#21084)
  * Remove black labels and CSS cleanup (go-gitea#21003)
  * Make e-mail sanity check more precise (go-gitea#20991)
  * Use native inputs in whitespace dropdown (go-gitea#20980)
  * Enhance package date display (go-gitea#20928)
  * Display total blob size of a package version (go-gitea#20927)
  * Show language name on hover (go-gitea#20923)
  * Show instructions for all generic package files (go-gitea#20917)
  * Refactor AssertExistsAndLoadBean to use generics (go-gitea#20797)
  * Move the official website link at the footer of gitea (go-gitea#20777)
  * Add support for full name in reverse proxy auth (go-gitea#20776)
  * Remove useless JS operation for relative time tooltips (go-gitea#20756)
  * Replace some icons with SVG (go-gitea#20741)
  * Change commit status icons to SVG (go-gitea#20736)
  * Improve single repo action for issue and pull requests (go-gitea#20730)
  * Allow multiple files in generic packages (go-gitea#20661)
  * Add option to create new issue from /issues page (go-gitea#20650)
  * Background color of private list-items updated (go-gitea#20630)
  * Added search input field to issue filter (go-gitea#20623)
  * Increase default item listing size `ISSUE_PAGING_NUM` to 20 (go-gitea#20547)
  * Modify milestone search keywords to be case insensitive again (go-gitea#20513)
  * Show hint to link package to repo when viewing empty repo package list (go-gitea#20504)
  * Add Tar ZSTD support (go-gitea#20493)
  * Make code review checkboxes clickable (go-gitea#20481)
  * Add "X-Gitea-Object-Type" header for GET `/raw/` & `/media/` API (go-gitea#20438)
  * Display project in issue list (go-gitea#20434)
  * Prepend commit message to template content when opening a new PR (go-gitea#20429)
  * Replace fomantic popup module with tippy.js (go-gitea#20428)
  * Allow to specify colors for text in markup (go-gitea#20363)
  * Allow access to the Public Organization Member lists with minimal permissions (go-gitea#20330)
  * Use default values when provided values are empty (go-gitea#20318)
  * Vertical align navbar avatar at middle (go-gitea#20302)
  * Delete cancel button in repo creation page (go-gitea#21381)
  * Include login_name in adminCreateUser response (go-gitea#20283)
  * fix: icon margin in user/settings/repos (go-gitea#20281)
  * Remove blue text on migrate page (go-gitea#20273)
  * Modify milestone search keywords to be case insensitive (go-gitea#20266)
  * Move some files into models' sub packages (go-gitea#20262)
  * Add tooltip to repo icons in explore page (go-gitea#20241)
  * Remove deprecated licenses (go-gitea#20222)
  * Webhook for Wiki changes (go-gitea#20219)
  * Share HTML template renderers and create a watcher framework (go-gitea#20218)
  * Allow enable LDAP source and disable user sync via CLI (go-gitea#20206)
  * Adds a checkbox to select all issues/PRs (go-gitea#20177)
  * Refactor `i18n` to `locale` (go-gitea#20153)
  * Disable status checks in template if none found (go-gitea#20088)
  * Allow manager logging to set SQL (go-gitea#20064)
  * Add order by for assignee no sort issue (go-gitea#20053)
  * Take a stab at porting existing components to Vue3 (go-gitea#20044)
  * Add doctor command to write commit-graphs (go-gitea#20007)
  * Add support for authentication based on reverse proxy email (go-gitea#19949)
  * Enable spellcheck for EasyMDE, use contenteditable mode (go-gitea#19776)
  * Allow specifying SECRET_KEY_URI, similar to INTERNAL_TOKEN_URI (go-gitea#19663)
  * Rework mailer settings (go-gitea#18982)
  * Add option to purge users (go-gitea#18064)
  * Add author search input (go-gitea#21246)
  * Make rss/atom identifier globally unique (go-gitea#21550)
* BUGFIXES
  * Auth interface return error when verify failure (go-gitea#22119) (go-gitea#22259)
  * Use complete SHA to create and query commit status (go-gitea#22244) (go-gitea#22257)
  * Update bleve and zapx to fix unaligned atomic (go-gitea#22031) (go-gitea#22218)
  * Prevent panic in doctor command when running default checks (go-gitea#21791) (go-gitea#21807)
  * Load GitRepo in API before deleting issue (go-gitea#21720) (go-gitea#21796)
  * Ignore line anchor links with leading zeroes (go-gitea#21728) (go-gitea#21776)
  * Set last login when activating account (go-gitea#21731) (go-gitea#21755)
  * Fix UI language switching bug (go-gitea#21597) (go-gitea#21749)
  * Quick fixes monaco-editor error: "vs.editor.nullLanguage" (go-gitea#21734) (go-gitea#21738)
  * Allow local package identifiers for PyPI packages (go-gitea#21690) (go-gitea#21727)
  * Deal with markdown template without metadata (go-gitea#21639) (go-gitea#21654)
  * Fix opaque background on mermaid diagrams (go-gitea#21642) (go-gitea#21652)
  * Fix repository adoption on Windows (go-gitea#21646) (go-gitea#21650)
  * Sync git hooks when config file path changed (go-gitea#21619) (go-gitea#21626)
  * Fix 500 on PR files API (go-gitea#21602) (go-gitea#21607)
  * Fix `Timestamp.IsZero` (go-gitea#21593) (go-gitea#21603)
  * Fix viewing user subscriptions (go-gitea#21482)
  * Fix mermaid-related bugs (go-gitea#21431)
  * Fix branch dropdown shifting on page load (go-gitea#21428)
  * Fix default theme-auto selector when nologin (go-gitea#21346)
  * Fix and improve incorrect error messages (go-gitea#21342)
  * Fix formatted link for PR review notifications to matrix (go-gitea#21319)
  * Center-aligning content of WebAuthN page (go-gitea#21127)
  * Remove follow from commits by file (go-gitea#20765)
  * Fix commit status popup (go-gitea#20737)
  * Fix init mail render logic (go-gitea#20704)
  * Use correct page size for link header pagination (go-gitea#20546)
  * Preserve unix socket file (go-gitea#20499)
  * Use tippy.js for context popup (go-gitea#20393)
  * Add missing parameter for error in log message (go-gitea#20144)
  * Do not allow organisation owners add themselves as collaborator (go-gitea#20043)
  * Rework file highlight rendering and fix yaml copy-paste (go-gitea#19967)
  * Improve code diff highlight, fix incorrect rendered diff result (go-gitea#19958)
* TESTING
  * Improve OAuth integration tests (go-gitea#21390)
  * Add playwright tests (go-gitea#20123)
* BUILD
  * Switch to building with go1.19 (go-gitea#20695)
  * Update JS dependencies, adjust eslint (go-gitea#20659)
  * Add more linters to improve code readability (go-gitea#19989)

* SECURITY

  * Do not allow Ghost access to limited visible user/org (go-gitea#21849) (go-gitea#21875)
  * Fix package access for admins and inactive users (go-gitea#21580) (go-gitea#21592)
* ENHANCEMENTS
  * Fix button in branch list, avoid unexpected page jump before restore branch actually done (go-gitea#21562) (go-gitea#21927)
  * Fix vertical align of committer avatar rendered by email address (go-gitea#21884) (go-gitea#21919)
  * Fix setting HTTP headers after write (go-gitea#21833) (go-gitea#21874)
  * Ignore line anchor links with leading zeroes (go-gitea#21728) (go-gitea#21777)
  * Enable Monaco automaticLayout (go-gitea#21516)
* BUGFIXES
  * Do not list active repositories as unadopted (go-gitea#22034) (go-gitea#22167)
  * Correctly handle moved files in apply patch (go-gitea#22118) (go-gitea#22136)
  * Fix condition for is_internal (go-gitea#22095) (go-gitea#22131)
  * Fix permission check on issue/pull lock (go-gitea#22114)
  * Fix sorting admin user list by last login (go-gitea#22081) (go-gitea#22106)
  * Workaround for container registry push/pull errors (go-gitea#21862) (go-gitea#22069)
  * Fix issue/PR numbers (go-gitea#22037) (go-gitea#22045)
  * Handle empty author names (go-gitea#21902) (go-gitea#22028)
  * Fix ListBranches to handle empty case (go-gitea#21921) (go-gitea#22025)
  * Fix enabling partial clones on 1.17 (go-gitea#21809)
  * Prevent panic in doctor command when running default checks (go-gitea#21791) (go-gitea#21808)
  * Upgrade golang.org/x/crypto (go-gitea#21792) (go-gitea#21794)
  * Init git module before database migration (go-gitea#21764) (go-gitea#21766)
  * Set last login when activating account (go-gitea#21731) (go-gitea#21754)
  * Add HEAD fix to gitea doctor (go-gitea#21352) (go-gitea#21751)
  * Fix UI language switching bug (go-gitea#21597) (go-gitea#21748)
  * Remove semver compatible flag and change pypi to an array of test cases (go-gitea#21708) (go-gitea#21729)
  * Allow local package identifiers for PyPI packages (go-gitea#21690) (go-gitea#21726)
  * Fix repository adoption on Windows (go-gitea#21646) (go-gitea#21651)
  * Sync git hooks when config file path changed (go-gitea#21619) (go-gitea#21625)
  * Added check for disabled Packages (go-gitea#21540) (go-gitea#21614)
  * Fix `Timestamp.IsZero` (go-gitea#21593) (go-gitea#21604)
  * Fix issues count bug (go-gitea#21600)
  * Support binary deploy in npm packages (go-gitea#21589)
  * Update milestone counters when issue is deleted (go-gitea#21459) (go-gitea#21586)
  * SessionUser protection against nil pointer dereference (go-gitea#21581)
  * Case-insensitive NuGet symbol file GUID (go-gitea#21409) (go-gitea#21575)
  * Suppress `ExternalLoginUserNotExist` error (go-gitea#21504) (go-gitea#21572)
  * Prevent Authorization header for presigned LFS urls (go-gitea#21531) (go-gitea#21569)
  * Update binding to fix bugs (go-gitea#21560)
  * Fix generating compare link (go-gitea#21519) (go-gitea#21530)
  * Ignore error when retrieving changed PR review files (go-gitea#21487) (go-gitea#21524)
  * Fix incorrect notification commit url (go-gitea#21479) (go-gitea#21483)
  * Display total commit count in hook message (go-gitea#21400) (go-gitea#21481)
  * Enforce grouped NuGet search results (go-gitea#21442) (go-gitea#21480)
  * Return 404 when user is not found on avatar (go-gitea#21476) (go-gitea#21477)
  * Normalize NuGet package version on upload (go-gitea#22186) (go-gitea#22201)
* MISC
  * Check for zero time instant in TimeStamp.IsZero() (go-gitea#22171) (go-gitea#22173)
  * Fix warn in database structs sync (go-gitea#22111)
  * Allow for resolution of NPM registry paths that match upstream (go-gitea#21568) (go-gitea#21723)

* BREAKING

  * Remove U2F support (go-gitea#20141)
* FEATURES
  * Add color previews in markdown (go-gitea#21474)
  * Allow package version sorting (go-gitea#21453)
  * Add support for Chocolatey/NuGet v2 API (go-gitea#21393)
  * Add API endpoint to get changed files of a PR (go-gitea#21177)
  * Add filetree on left of diff view (go-gitea#21012)
  * Support Issue forms and PR forms (go-gitea#20987)
  * Add support for Vagrant packages (go-gitea#20930)
  * Add support for `npm unpublish` (go-gitea#20688)
  * Add badge capabilities to users (go-gitea#20607)
  * Add issue filter for Author (go-gitea#20578)
  * Add KaTeX rendering to Markdown. (go-gitea#20571)
  * Add support for Pub packages (go-gitea#20560)
  * Support localized README (go-gitea#20508)
  * Add support mCaptcha as captcha provider (go-gitea#20458)
  * Add team member invite by email (go-gitea#20307)
  * Added email notification option to receive all own messages (go-gitea#20179)
  * Switch Unicode Escaping to a VSCode-like system (go-gitea#19990)
  * Add user/organization code search (go-gitea#19977)
  * Only show relevant repositories on explore page (go-gitea#19361)
  * User keypairs and HTTP signatures for ActivityPub federation using go-ap (go-gitea#19133)
  * Add sitemap support (go-gitea#18407)
  * Allow creation of OAuth2 applications for orgs (go-gitea#18084)
  * Add system setting table with cache and also add cache supports for user setting (go-gitea#18058)
  * Add pages to view watched repos and subscribed issues/PRs (go-gitea#17156)
  * Support Proxy protocol (go-gitea#12527)
  * Implement sync push mirror on commit (go-gitea#19411)
* API
  * Make external issue tracker regexp configurable via API (go-gitea#21338)
  * Add name field for org api (go-gitea#21270)
  * Show teams with no members if user is admin (go-gitea#21204)
  * Add latest commit's SHA to content response (go-gitea#20398)
  * Add allow_rebase_update, default_delete_branch_after_merge to repository api response (go-gitea#20079)
  * Add new endpoints for push mirrors management (go-gitea#19841)
* ENHANCEMENTS
  * Use CSS color-scheme instead of invert (go-gitea#21616) (go-gitea#21623)
  * Respect user's locale when rendering the date range in the repo activity page (go-gitea#21410)
  * Change `commits-table` column width (go-gitea#21564)
  * Refactor git command arguments and make all arguments to be safe to be used (go-gitea#21535)
  * CSS color enhancements (go-gitea#21534)
  * Add link to user profile in markdown mention only if user exists (go-gitea#21533, go-gitea#21554)
  * Add option to skip index dirs (go-gitea#21501)
  * Diff file tree tweaks (go-gitea#21446)
  * Localize all timestamps (go-gitea#21440)
  * Add `code` highlighting in issue titles (go-gitea#21432)
  * Use Name instead of DisplayName in LFS Lock (go-gitea#21415)
  * Consolidate more CSS colors into variables (go-gitea#21402)
  * Redirect to new repository owner (go-gitea#21398)
  * Use ISO date format instead of hard-coded English date format for date range in repo activity page (go-gitea#21396)
  * Use weighted algorithm for string matching when finding files in repo (go-gitea#21370)
  * Show private data in feeds (go-gitea#21369)
  * Refactor parseTreeEntries, speed up tree list (go-gitea#21368)
  * Add GET and DELETE endpoints for Docker blob uploads (go-gitea#21367)
  * Add nicer error handling on template compile errors (go-gitea#21350)
  * Add `stat` to `ToCommit` function for speed (go-gitea#21337)
  * Support instance-wide OAuth2 applications (go-gitea#21335)
  * Record OAuth client type at registration (go-gitea#21316)
  * Add new CSS variables --color-accent and --color-small-accent (go-gitea#21305)
  * Improve error descriptions for unauthorized_client (go-gitea#21292)
  * Case-insensitive "find files in repo" (go-gitea#21269)
  * Consolidate more CSS rules, fix inline code on arc-green (go-gitea#21260)
  * Log real ip of requests from ssh (go-gitea#21216)
  * Save files in local storage as group readable (go-gitea#21198)
  * Enable fluid page layout on medium size viewports (go-gitea#21178)
  * File header tweaks (go-gitea#21175)
  * Added missing headers on user packages page (go-gitea#21172)
  * Display image digest for container packages (go-gitea#21170)
  * Skip dirty check for team forms (go-gitea#21154)
  * Keep path when creating a new branch (go-gitea#21153)
  * Remove fomantic image module (go-gitea#21145)
  * Make labels clickable in the comments section. (go-gitea#21137)
  * Sort branches and tags by date descending (go-gitea#21136)
  * Better repo API unit checks (go-gitea#21130)
  * Improve commit status icons (go-gitea#21124)
  * Limit length of repo description and repo url input fields (go-gitea#21119)
  * Show .editorconfig errors in frontend (go-gitea#21088)
  * Allow poster to choose reviewers (go-gitea#21084)
  * Remove black labels and CSS cleanup (go-gitea#21003)
  * Make e-mail sanity check more precise (go-gitea#20991)
  * Use native inputs in whitespace dropdown (go-gitea#20980)
  * Enhance package date display (go-gitea#20928)
  * Display total blob size of a package version (go-gitea#20927)
  * Show language name on hover (go-gitea#20923)
  * Show instructions for all generic package files (go-gitea#20917)
  * Refactor AssertExistsAndLoadBean to use generics (go-gitea#20797)
  * Move the official website link at the footer of gitea (go-gitea#20777)
  * Add support for full name in reverse proxy auth (go-gitea#20776)
  * Remove useless JS operation for relative time tooltips (go-gitea#20756)
  * Replace some icons with SVG (go-gitea#20741)
  * Change commit status icons to SVG (go-gitea#20736)
  * Improve single repo action for issue and pull requests (go-gitea#20730)
  * Allow multiple files in generic packages (go-gitea#20661)
  * Add option to create new issue from /issues page (go-gitea#20650)
  * Background color of private list-items updated (go-gitea#20630)
  * Added search input field to issue filter (go-gitea#20623)
  * Increase default item listing size `ISSUE_PAGING_NUM` to 20 (go-gitea#20547)
  * Modify milestone search keywords to be case insensitive again (go-gitea#20513)
  * Show hint to link package to repo when viewing empty repo package list (go-gitea#20504)
  * Add Tar ZSTD support (go-gitea#20493)
  * Make code review checkboxes clickable (go-gitea#20481)
  * Add "X-Gitea-Object-Type" header for GET `/raw/` & `/media/` API (go-gitea#20438)
  * Display project in issue list (go-gitea#20434)
  * Prepend commit message to template content when opening a new PR (go-gitea#20429)
  * Replace fomantic popup module with tippy.js (go-gitea#20428)
  * Allow to specify colors for text in markup (go-gitea#20363)
  * Allow access to the Public Organization Member lists with minimal permissions (go-gitea#20330)
  * Use default values when provided values are empty (go-gitea#20318)
  * Vertical align navbar avatar at middle (go-gitea#20302)
  * Delete cancel button in repo creation page (go-gitea#21381)
  * Include login_name in adminCreateUser response (go-gitea#20283)
  * fix: icon margin in user/settings/repos (go-gitea#20281)
  * Remove blue text on migrate page (go-gitea#20273)
  * Modify milestone search keywords to be case insensitive (go-gitea#20266)
  * Move some files into models' sub packages (go-gitea#20262)
  * Add tooltip to repo icons in explore page (go-gitea#20241)
  * Remove deprecated licenses (go-gitea#20222)
  * Webhook for Wiki changes (go-gitea#20219)
  * Share HTML template renderers and create a watcher framework (go-gitea#20218)
  * Allow enable LDAP source and disable user sync via CLI (go-gitea#20206)
  * Adds a checkbox to select all issues/PRs (go-gitea#20177)
  * Refactor `i18n` to `locale` (go-gitea#20153)
  * Disable status checks in template if none found (go-gitea#20088)
  * Allow manager logging to set SQL (go-gitea#20064)
  * Add order by for assignee no sort issue (go-gitea#20053)
  * Take a stab at porting existing components to Vue3 (go-gitea#20044)
  * Add doctor command to write commit-graphs (go-gitea#20007)
  * Add support for authentication based on reverse proxy email (go-gitea#19949)
  * Enable spellcheck for EasyMDE, use contenteditable mode (go-gitea#19776)
  * Allow specifying SECRET_KEY_URI, similar to INTERNAL_TOKEN_URI (go-gitea#19663)
  * Rework mailer settings (go-gitea#18982)
  * Add option to purge users (go-gitea#18064)
  * Add author search input (go-gitea#21246)
  * Make rss/atom identifier globally unique (go-gitea#21550)
* BUGFIXES
  * Prevent panic in doctor command when running default checks (go-gitea#21791) (go-gitea#21807)
  * Load GitRepo in API before deleting issue (go-gitea#21720) (go-gitea#21796)
  * Ignore line anchor links with leading zeroes (go-gitea#21728) (go-gitea#21776)
  * Set last login when activating account (go-gitea#21731) (go-gitea#21755)
  * Fix UI language switching bug (go-gitea#21597) (go-gitea#21749)
  * Quick fixes monaco-editor error: "vs.editor.nullLanguage" (go-gitea#21734) (go-gitea#21738)
  * Allow local package identifiers for PyPI packages (go-gitea#21690) (go-gitea#21727)
  * Deal with markdown template without metadata (go-gitea#21639) (go-gitea#21654)
  * Fix opaque background on mermaid diagrams (go-gitea#21642) (go-gitea#21652)
  * Fix repository adoption on Windows (go-gitea#21646) (go-gitea#21650)
  * Sync git hooks when config file path changed (go-gitea#21619) (go-gitea#21626)
  * Fix 500 on PR files API (go-gitea#21602) (go-gitea#21607)
  * Fix `Timestamp.IsZero` (go-gitea#21593) (go-gitea#21603)
  * Fix viewing user subscriptions (go-gitea#21482)
  * Fix mermaid-related bugs (go-gitea#21431)
  * Fix branch dropdown shifting on page load (go-gitea#21428)
  * Fix default theme-auto selector when nologin (go-gitea#21346)
  * Fix and improve incorrect error messages (go-gitea#21342)
  * Fix formatted link for PR review notifications to matrix (go-gitea#21319)
  * Center-aligning content of WebAuthN page (go-gitea#21127)
  * Remove follow from commits by file (go-gitea#20765)
  * Fix commit status popup (go-gitea#20737)
  * Fix init mail render logic (go-gitea#20704)
  * Use correct page size for link header pagination (go-gitea#20546)
  * Preserve unix socket file (go-gitea#20499)
  * Use tippy.js for context popup (go-gitea#20393)
  * Add missing parameter for error in log message (go-gitea#20144)
  * Do not allow organisation owners add themselves as collaborator (go-gitea#20043)
  * Rework file highlight rendering and fix yaml copy-paste (go-gitea#19967)
  * Improve code diff highlight, fix incorrect rendered diff result (go-gitea#19958)
* TESTING
  * Improve OAuth integration tests (go-gitea#21390)
  * Add playwright tests (go-gitea#20123)
* BUILD
  * Switch to building with go1.19 (go-gitea#20695)
  * Update JS dependencies, adjust eslint (go-gitea#20659)
  * Add more linters to improve code readability (go-gitea#19989)

Changelog

* SECURITY
  * Sanitize and Escape refs in git backend (go-gitea#21464) (go-gitea#21463)
  * Bump `golang.org/x/text` (go-gitea#21412) (go-gitea#21413)
  * Update bluemonday (go-gitea#21281) (go-gitea#21287)
* ENHANCEMENTS
  * Fix empty container layer history and UI (go-gitea#21251) (go-gitea#21278)
  * Use en-US as fallback when using other default language (go-gitea#21200) (go-gitea#21256)
  * Make the vscode clone link respect transport protocol (go-gitea#20557) (go-gitea#21128)
* BUGFIXES
  * Do DB update after merge in hammer context (go-gitea#21401) (go-gitea#21416)
  * Add Num{Issues,Pulls} stats checks (go-gitea#21404) (go-gitea#21414)
  * Stop logging CheckPath returns error: context canceled (go-gitea#21064) (go-gitea#21405)
  * Parse OAuth Authorization header when request omits client secret (go-gitea#21351) (go-gitea#21374)
  * Ignore port for loopback redirect URIs (go-gitea#21293) (go-gitea#21373)
  * Set SemverCompatible to false for Conan packages (go-gitea#21275) (go-gitea#21366)
  * Tag list should include draft releases with existing tags (go-gitea#21263) (go-gitea#21365)
  * Fix linked account translation (go-gitea#21331) (go-gitea#21334)
  * Make NuGet service index publicly accessible (go-gitea#21242) (go-gitea#21277)
  * Foreign ID conflicts if ID is 0 for each item (go-gitea#21271) (go-gitea#21272)
  * Use absolute links in feeds (go-gitea#21229) (go-gitea#21265)
  * Prevent invalid behavior for file reviewing when loading more files (go-gitea#21230) (go-gitea#21234)
  * Respect `REQUIRE_SIGNIN_VIEW` for packages (go-gitea#20873) (go-gitea#21232)
  * Treat git object mode 40755 as directory (go-gitea#21195) (go-gitea#21218)
  * Allow uppercase ASCII alphabet in PyPI package names (go-gitea#21095) (go-gitea#21217)
  * Fix limited user cannot view himself's profile (go-gitea#21212)
  * Fix template bug of admin monitor (go-gitea#21209)
  * Fix reaction of issues (go-gitea#21185) (go-gitea#21196)
  * Fix CSV diff for added/deleted files (go-gitea#21189) (go-gitea#21193)
  * Fix pagination limit parameter problem (go-gitea#21111)
* TESTING
  * Fix missing m.Run() in TestMain (go-gitea#21341)
* BUILD
  * Use Go 1.19 fmt for Gitea 1.17, sync emoji data (go-gitea#21239)

* SECURITY

  * Double check CloneURL is acceptable (go-gitea#20869) (go-gitea#20892)
  * Add more checks in migration code (go-gitea#21011) (go-gitea#21050)
* ENHANCEMENTS
  * Fix hard-coded timeout and error panic in API archive download endpoint (go-gitea#20925) (go-gitea#21051)
  * Improve arc-green code theme (go-gitea#21039) (go-gitea#21042)
  * Enable contenthash in filename for dynamic assets (go-gitea#20813) (go-gitea#20932)
  * Don't open new page for ext wiki on same repository (go-gitea#20725) (go-gitea#20910)
  * Disable doctor logging on panic (go-gitea#20847) (go-gitea#20898)
  * Remove calls to load Mirrors in user.Dashboard (go-gitea#20855) (go-gitea#20897)
  * Update codemirror to 5.65.8 (go-gitea#20875)
  * Rework repo buttons (go-gitea#20602, go-gitea#20718) (go-gitea#20719)
* BUGFIXES
  * Ensure delete user deletes all comments (go-gitea#21067) (go-gitea#21068)
  * Delete unreferenced packages when deleting a package version (go-gitea#20977) (go-gitea#21060)
  * Redirect if user does not exist on admin pages (go-gitea#20981) (go-gitea#21059)
  * Set uploadpack.allowFilter etc on gitea serv to enable partial clones with ssh (go-gitea#20902) (go-gitea#21058)
  * Fix 500 on time in timeline API (go-gitea#21052) (go-gitea#21057)
  * Fill the specified ref in webhook test payload (go-gitea#20961) (go-gitea#21055)
  * Add another index for Action table on postgres (go-gitea#21033) (go-gitea#21054)
  * Fix broken insecureskipverify handling in redis connection uris (go-gitea#20967) (go-gitea#21053)
  * Add Dev, Peer and Optional dependencies to npm PackageMetadataVersion (go-gitea#21017) (go-gitea#21044)
  * Do not add links to Posters or Assignees with ID < 0 (go-gitea#20577) (go-gitea#21037)
  * Fix modified due date message (go-gitea#20388) (go-gitea#21032)
  * Fix missed sort bug (go-gitea#21006)
  * Fix input.value attr for RequiredClaimName/Value (go-gitea#20946) (go-gitea#21001)
  * Change review buttons to icons to make space for text (go-gitea#20934) (go-gitea#20978)
  * Fix download archiver of a commit (go-gitea#20962) (go-gitea#20971)
  * Return 404 NotFound if requested attachment does not exist (go-gitea#20886) (go-gitea#20941)
  * Set no-tags in git fetch on compare (go-gitea#20893) (go-gitea#20936)
  * Allow multiple metadata files for Maven packages (go-gitea#20674) (go-gitea#20916)
  * Increase Content field size of gpg_key and public_key to MEDIUMTEXT (go-gitea#20896) (go-gitea#20911)
  * Fix mirror address setting not working (go-gitea#20850) (go-gitea#20904)
  * Fix push mirror address backend get error Address cause setting page display error (go-gitea#20593) (go-gitea#20901)
  * Fix panic when an invalid oauth2 name is passed (go-gitea#20820) (go-gitea#20900)
  * In PushMirrorsIterate and MirrorsIterate if limit is negative do not set it (go-gitea#20837) (go-gitea#20899)
  * Ensure that graceful start-up is informed of unused SSH listener (go-gitea#20877) (go-gitea#20888)
  * Pad GPG Key ID with preceding zeroes (go-gitea#20878) (go-gitea#20885)
  * Fix SQL Query for `SearchTeam` (go-gitea#20844) (go-gitea#20872)
  * Fix the mode of custom dir to 0700 in docker-rootless (go-gitea#20861) (go-gitea#20867)
  * Fix UI mis-align for PR commit history (go-gitea#20845) (go-gitea#20859)