## go-gitea/gitea — v1.27.0-rc0…v1.27.0

_37 commits._

### Fixes
- **fix: various security fixes (#38406) (#38426)** (de4b827)
- **fix(util): reject invalid characters between time-estimate units (#38416) (#38423)** (acbc75e)
- **fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)** (c3325be)
- **fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)** (d4250ba)
- **fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)** (6815d16)
- **fix: actions task state concurrent update (#38405) (#38409)** (8ba4d4e)
- **fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)** (b2794f9)
- **fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)** (b6aa2b6)
- **fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)** (74ad781)
- **fix(security): harden access checks and migration validation (#38324) (#38400)** (ed493f0)
- **fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)** (af7ba2e)
- **fix: co-author detection (#38392) (#38397)** (8b4252e)
- **fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)** (500a09e)
- **fix: incorrect co-author detection on commit page (#38386) (#38387)** (bfebc4b)
- **fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)** (d9534e7)
- **fix(ui): restore commits table column widths (#38379) (#38383)** (8cf988f)
- **fix: golang html template url escaping (#38363) (#38369)** (fc4eac3)
- **perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)** (64d559a)
- **fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)** (0337283)
- **fix: minio init check (#38355) (#38361)** (1af1e06)
- **fix: org project view assignee list (#38357) (#38360)** (e07a5de)
- **fix(actions): release claimed task if context is cancelled during `FetchTask` (#38343) (#38347)** (d4d81af)
- **fix(release): validate web attachment renames against allowed types (#38314) (#38328)** (37c8604)
- **fix(actions): make runner list pagination order deterministic (#38313) (#38327)** (a9814e7)
- **fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)** (ab10e37)
- **fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)** (f7bc6b8)
- **fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)** (fabc5e6)
- **fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)** (a016d67)
- **fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)** (b6e409b)
- **fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)** (2734504)
- **fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)** (eee7967)
- **fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)** (1df8f91)

### Backend
- **enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)** (532828c)

### Tests
- **test(e2e): fix race in pdf file render test (#38380) (#38381)** (04a26f4)
- **test: compare key file contents instead of `FileInfo` in `TestInitKeys` (#38330) (#38331)** (6cd2c64)

### Docs
- **docs: update changelog for 1.27.0 (#38427)** (c6627af)

### Chore
- **chore: don't auto refresh the merge box when user has interacted with it (#38436)** (b969123)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/go-gitea/gitea?utm_source=github-action)._