Feature release for the issues filed after 3.36.2, plus one scheduler fix that matters for large accounts.
Fixed
- Scheduler stuck as "already running" after a GitHub rate limit (#437). Every rate-limited request used to sleep for the full reset window inside the scheduler run, so a large sync could hold the lock for hours and only a restart helped. Waits of up to two minutes are still slept off; a longer reset pauses the source, the run stops at the next batch or repository, and the next run is moved to just after the reset. Repositories that failed only on the limit go back to their previous status and are retried on their own.
Added
- Sync Organization (#429). The organization card menu can re-sync an organization that is already mirrored: it re-lists the repositories from the source, mirrors the imported ones and syncs the rest.
- CSV export (#428). Export CSV buttons on the repositories and organizations pages, backed by
GET /api/repositories/exportandGET /api/organizations/export. The table minus the internal fields; API keys work on both routes. Values a spreadsheet would run as a formula are prefixed with a quote. - Login page can open on SSO (#438).
AUTH_DEFAULT_METHOD=ssosets the instance default, and each browser remembers the method it last signed in with.
Security
- devalue floor raised to 5.9.2 in the application and the documentation site (GHSA-9rgm-9g3h-6x36). Both lockfiles resolve 5.9.4.
Upgrading
Docker: docker pull ghcr.io/raylabshq/gitea-mirror:latest or :v3.37.0. Nix and bare metal: pull main or the tag and rebuild. No migration. The new environment variable is optional.