[28.4.0] - 2026-11-15
Enhancements
Bug Fixes
- (api) Return language of starred and watched repositories (#40127) (#40157)
- (web) Read the wiki blob excerpt from the wiki repository (#40165) (#40178)
- (actions) Make Actions API work with repo admin permission (#40174) (#40180)
- (repo) Avoid deadlock when updating language stats concurrently (#40167) (#40202)
- (notifications) Avoid deadlock when creating issue notifications concurrently (#40166) (#40203)
- (api) Don't panic on null milestone due_on (#40171)
- (actions) Evaluate job
if:against needs finished in the same pass (#40126) (#40221) - (web) Build issue popup request from parsed link (#40207) (#40225)
- Allow clearing the full name in profile settings (#40186) (#40191)
- (packages) Return empty Chef dependencies instead of null (#40237) (#40242)
- (deps) Update module github.com/andybalholm/brotli to v1.2.7 [security] (#40246) (#40249)
- Upgrade Alpine base packages in Docker images (#40252) (#40253)
- Don't roll back branches on out-of-order post-receive hooks (#40110) (#40255)
- (repo) Mark repository as non-empty before git push returns (#40102) (#40266)
- Add missing checks to several handlers and services (#40120) (#40268)
- (pull) Don't add a timeline entry for pending API reviews (#40260) (#40272)
- Paste copied code as text, not as a markdown table (#40053) (#40280)
- (deps) Update clippie to 4.3.1 (#40293)
- Don't log network error in console when loading issue popup (#40288) (#40294)
- (markup) Correct character escaping at read buffer boundaries (#40209)
- (api) Lock and unlock issues as the signed-in user, not the repository owner (#40291) (#40298)
- (ui) Consistent spacing between labels (#40261) (#40330)
- Add missing checks to more handlers and services (#40131) (#40281)
- Handle task list items checked with uppercase X (#40334) (#40339)
- (queue) Bump levelqueue to v0.5.1 and remove workarounds (#40219) (#40350)
- (web) Fix memory leak in dropdown ARIA patch (#40349) (#40364)
- Correctly apply team admin permission to doer (#40353) (#40356)
- (packages) Accept OCI 1.1 container image names (#40363) (#40369)
- (api) Hide org roles from non-members (#40042) (#40365)
- (git) List affected files NUL-separated so special names are not quoted (#40362)
- (repo) Do not reuse pull mirror credentials for a new host (#39991) (#40373)
- (issues) Hide unreadable issue types in search and milestone views (#40192) (#40375)
- (api) Do not allow renaming the Owners team (#40381) (#40387)
- (repo) Limit the commit status fields returned by repo search (#40377) (#40384)
- (audit) Record missing repository and content events (#40322) (#40390)
- (auth) Limit failed TOTP attempts per account (#39993) (#40374)
- (repo) Do not check out existing repo content during auto-init (#40376) (#40383)