CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

www/gitea 28.2.0

Compact self-hosted Git service

Port info

Maintainer
ports@foss-daily.org
Packages
latest: 28.2.0
Upstream
up to date
Last update
to 28.2.0 · 20e15280c7
Quarterly
not in the 2026Q4 packages
WWW
https://gitea.com/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install gitea
installs 28.2.0 from latest
Port
# cd /usr/ports/www/gitea && make install clean
# make -C /usr/ports/www/gitea config  # change options first
Size
34 MiB download · 138 MiB installed
Depends on
devel/git 2.56.0, devel/git-lfs 3.6.1_24
License
MIT
Creates
user git, group git
Options
3 of 4 on in the package: GIT_LFS PAM SQLITE
Show the 1 options that are off
BINDATA
pkg-message
Shown after upgrading
Please make sure to empty or maintain the contents of the
/usr/local/share/gitea folder between your upgrades of gitea.
Changes between versions can break the web UI due to residual
files from earlier versions.

1.21.0 has a breaking change regarding the public assets folder. In case
you use a proxying webserver serving the files, you need to update your
configuration:

https://github.com/go-gitea/gitea/pull/25907
Shown after upgrading
When upgrading from Gitea 1.7 or earlier, Gitea requires the addition of
another secret to the config file in order to start up.  Either manually add
JWT_SECRET to the /usr/local/etc/gitea/conf/app.ini config file (see
app.ini.sample), or allow Gitea to make the change for you by making the
config file writable to the git user.
Shown after upgrading
Some config file options have been changed in Gitea 1.15. Please refer to
the documentation at https://docs.gitea.io/en-us/customizing-gitea/ and
the release notes.
Shown after upgrading
We remind users that a bug was discovered with gitea dump in 1.14.3-1.14.6
and 1.15.0.  Database dumps from these versions cause broken fields in the
repo_unit and login_source tables causing the issue identified in #16961.
Users on 1.14.x must upgrade to 1.14.7 before running gitea dump.  See the
release notes for more information.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1628.2.0✗–
FreeBSD 1528.2.01.27.3_1–
FreeBSD 1428.2.01.27.3_128.2.0

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 15✗1.27.3_1–
FreeBSD 14✗1.27.3_1✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 28.2.0.

Fixed (63)

Show 63 fixed
VuXML entries whose affected range the packaged version has left.

CVE-2026-23603, CVE-2026-42931, CVE-2026-50105, CVE-2026-54481, CVE-2026-55982, CVE-2026-55984, CVE-2026-55986, CVE-2026-55987, CVE-2026-56443, CVE-2026-56654, CVE-2026-56657, CVE-2026-56750, CVE-2026-56755, CVE-2026-57886, CVE-2026-57894, CVE-2026-57897, CVE-2026-58314, CVE-2026-58416, CVE-2026-58417, CVE-2026-58420, CVE-2026-58425, CVE-2026-58427, CVE-2026-58428, CVE-2026-58429, CVE-2026-58431, CVE-2026-58432, CVE-2026-58433, CVE-2026-58434, CVE-2026-58435, CVE-2026-58436, CVE-2026-58437, CVE-2026-58438, CVE-2026-58439, CVE-2026-58440, CVE-2026-58441, CVE-2026-58442, CVE-2026-58443, CVE-2026-58444, CVE-2026-58445, CVE-2026-58507, CVE-2026-58508, CVE-2026-58510, CVE-2026-58511, CVE-2026-59763, CVE-2026-59765

Problem reports (3) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
297640maintainer-feedback? www/gitea 1.27.2 complains bash not found on startupNew2026-08-20
294089maintainer-feedback? www/gitea: service gitea restart fails, leaves gitea stoppedNew2026-08-18
296739maintainer-feedback? www/gitea: startup on boot failsNew2026-07-14

Commits (210)

Florian Smeets (flo) · 1.16.4
www/gitea: Update to 1.16.4

PR:		261576
Approved by:	maintainer timeout
801b2b6299
Guangyuan Yang (ygy) · 1.15.10
www/gitea: Update to 1.15.10

Changelog:	https://github.com/go-gitea/gitea/releases/tag/v1.15.10

PR:		261208
1f085a3650
Guangyuan Yang (ygy) · 1.15.9_1
www/gitea: Re-release 1.15.9

The Gitea project updated the release reusing the same version/tag.
Update the distinfo to the new values. Information provided through
their Discord.

PR:		261085
MFH:		2022Q1
ab4f1a6fb5
Adam Weinberger (adamw) · 1.15.9
www/gitea: Update to 1.15.9

PR:		260846
9fc7359b78
Guangyuan Yang (ygy) · 1.15.8
www/gitea: Update to 1.15.8

Changelog:	https://github.com/go-gitea/gitea/releases/tag/v1.15.8

PR:		260592
3eaba5c0fb
Adam Weinberger (adamw) · 1.15.7
www/gitea: Update to 1.15.7

1.15.7 includes 20 bugsfixea and two enhancements.

Release notes:
https://blog.gitea.io/2021/12/gitea-1.15.7-is-released/

PR:		260205
16bd0d001f
Li-Wen Hsu (lwhsu) · 1.15.6
www/gitea: Update to 1.15.6

PR:		259548
MFH:		2021Q4
Security:	df794e5d-3975-11ec-84e8-0800273f11ea
60ab5da545
Adam Weinberger (adamw) · 1.15.4
www/gitea: Update to 1.15.4

Release notes: https://blog.gitea.io/2021/10/gitea-1.15.4-is-released/

PR:		259043
19068496a9
Guangyuan Yang (ygy) · 1.15.3
www/gitea: Update to 1.15.3

Changelog:	https://github.com/go-gitea/gitea/releases/tag/v1.15.3

PR:		258681
28d8638ac3
Joseph Mingrone (jrm) · 1.15.2
www/gitea: Update to 1.15.2

https://blog.gitea.io/2021/09/gitea-1.15.1-and-1.14.7-are-released/
https://github.com/go-gitea/gitea/releases/tag/v1.15.2

PR:		258248
fe3de8afca
Bernhard Froehlich (decke) · 1.15.0
www/gitea: Add CPE information

Approved by:	portmgr (blanket)
4c12008915
Adam Weinberger (adamw) · 1.15.0
www/gitea: Update to 1.15.0

PR:		257994
5e5e6b9aab
Adam Weinberger (adamw) · 1.14.6
www/gitea: Update to 1.14.6

PR:		257973
Security:	https://blog.gitea.io/2021/08/gitea-1.14.6-is-released/
7553ad1a0e
Guangyuan Yang (ygy) · 1.14.5
www/gitea: Update to 1.14.5

Changelog:	https://blog.gitea.io/2021/07/gitea-1.14.5-is-released/

PR:		257221
MFH:		2021Q3 (security fixes)
Security:	943d23b6-e65e-11eb-ad30-0800273f11ea
Approved by:	lwhsu (mentor)
9aa9252021
Guangyuan Yang (ygy) · 1.14.4
www/gitea: Update to 1.14.4

Changelog:	https://blog.gitea.io/2021/07/gitea-1.14.4-is-released/

PR:		257059
Approved by:	lwhsu (mentor, implicit)
4651c3413b
Adam Weinberger (adamw) · 1.14.3
www/gitea: Update to 1.14.3

PR:		256720
MFH:		2021Q2
ee4c6a7461
Guangyuan Yang (ygy) · 1.14.2
www/gitea: Update to 1.14.2

Changelog:	https://github.com/go-gitea/gitea/releases/tag/v1.14.2

PR:		256353
Approved by:	stb@lassitu.de (maintainer), lwhsu (mentor, implicit)
447bf1139f
Rainer Hurling (rhurlin) · 1.14.1
www/gitea: Update to 1.14.1

Changelog: https://blog.gitea.io/2021/04/gitea-1.14.1-is-released/

PR:		255170
Submitted by:	stb@lassitu.de (maintainer)
2f09b716f2
Adam Weinberger (adamw) · 1.14.0
www/gitea: Update to 1.14.0

PR:		254976
Submitted by:	maintainer
b4c58c5e86
Adam Weinberger (adamw) · 1.13.7
www/gitea: Update to 1.13.7

PR:	254930
Submitted by:	maintainer
1b3c61ca16
Mathieu Arnold (mat) · 1.13.6
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 1.13.6
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 1.13.6
Remove # $FreeBSD$ from Makefiles.
305f148f48
Adam Weinberger (adamw) · 1.13.6
www/gitea: Update to 1.13.16

This is a security release.

PR:		254515
Submitted by:	maintainer
MFH:		2021Q1
Security:	yes
fc6fe77601
Adam Weinberger (adamw) · 1.13.5
www/gitea: Update to 1.13.5

PR:		254468
Submitted by:	maintainer
MFH:		2021Q1
Security:	yes
a05070fea9
Neel Chauhan (nc) · 1.13.4
www/gitea: Update to 1.13.4

This update fixes security vulnerabilities

 * https://blog.gitea.io/2021/03/gitea-1.13.3-is-released/
 * https://blog.gitea.io/2021/03/gitea-1.13.4-is-released/

PR:		254130
Submitted by:	stb AT lassitu DOT de (maintainer)
MFH:		2021Q1
Security:	502ba001-7ffa-11eb-911c-0800278d94f
614e066239
Adam Weinberger (adamw) · 1.13.2
www/gitea: Update to 1.13.2

PR:		253295
Submitted by:	maintainer
MFH:		2020Q1
Security:	https://blog.gitea.io/2021/02/gitea-1.13.2-is-released/
d70bd815a7
Adam Weinberger (adamw) · 1.13.1
www/gitea: Update to 1.13.1

PR:		252310
Submitted by:	maintainer
Security:	https://blog.gitea.io/2020/12/gitea-1.13.1-is-released/
c046e95ebd
Adam Weinberger (adamw) · 1.13.0
www/gitea: Update to 1.13.0

PR:		251577
Submitted by:	maintainer
MFH:		2020Q4
Security:	https://blog.gitea.io/2020/12/gitea-1.13.0-is-released
5f48a06a78
Adam Weinberger (adamw) · 1.12.6
www/gitea: Update to 1.12.6

SECURITY
        Prevent git operations for inactive users (#13527) (#13537)
        Disallow urlencoded new lines in git protocol paths if there is a port (#13521) (#13525)
    BUGFIXES
        API should only return Json (#13511) (#13564)
        Fix before and since query arguments at API (#13559) (#13560)
        Prevent panic on git blame by limiting lines to 4096 bytes at most (#13470) (#13492)
        Fix link detection in repository description with tailing ‘_’ (#13407) (#13408)
        Remove obsolete change of email on profile page (#13341) (#13348)
        Fix permission check on get Reactions API endpoints (#13344) (#13346)
        Add migrated pulls to pull request task queue (#13331) (#13335)
        API deny wrong pull creation options (#13308) (#13327)
        Fix initial commit page & binary munching problem (#13249) (#13259)
        Fix diff parsing (#13157) (#13136) (#13139)
        Return error 404 not 500 from API if team does not exist (#13118) (#13119)
        Prohibit automatic downgrades (#13108) (#13111)
        Fix GitLab Migration Option AuthToken (#13101)
        GitLab Label Color Normalizer (#12793) (#13100)
        Log the underlying panic in runMigrateTask (#13096) (#13098)
        Fix attachments list in edit comment (#13036) (#13097)
        Fix deadlock when deleting team user (#13093)
        Fix error create comment on outdated file (#13041) (#13042)
        Fix repository create/delete event webhooks (#13008) (#13027)
        Fix internal server error on README in submodule (#13006) (#13016)

PR:		251296
Submitted by:	maintainer
MFH:		2020Q4
Security:	https://github.com/go-gitea/gitea/pull/13527
		https://github.com/go-gitea/gitea/pull/13521
1e5ab6e2de
Adam Weinberger (adamw) · 1.12.5
www/gitea: Update to 1.12.5

Changes: https://github.com/go-gitea/gitea/releases/tag/v1.12.5

PR:		250372
Approved by:	maintainer
0ef1308967
Adam Weinberger (adamw) · 1.12.4
www/gitea: Update to 1.12.4

v1.12.4: * SECURITY
  * Escape provider name in oauth2 provider redirect (#12648) (#12650)
  * Escape Email on password reset page (#12610) (#12612)
  * When reading expired sessions - expire them (#12686) (#12690)
* ENHANCEMENTS
  * StaticRootPath configurable at compile time (#12371) (#12652)
* BUGFIXES
  * Fix to show an issue that is related to a deleted issue (#12651) (#12692)
  * Expire time acknowledged for cache (#12605) (#12611)
  * Fix diff path unquoting (#12554) (#12575)
  * Improve HTML escaping helper (#12562)
  * models: break out of loop (#12386) (#12561)
  * Default empty merger list to those with write permissions (#12535) (#12560)
  * Skip SSPI authentication attempts for /api/internal (#12556) (#12559)
  * Prevent NPE on commenting on lines with invalidated comments (#12549) (#12550)
  * Remove hardcoded ES indexername (#12521) (#12526)
  * Fix bug preventing transfer to private organization (#12497) (#12501)
  * Keys should not verify revoked email addresses (#12486) (#12495)
  * Do not add prefix on http/https submodule links (#12477) (#12479)
  * Fix ignored login on compare (#12476) (#12478)
  * Fix incorrect error logging in Stats indexer and OAuth2 (#12387) (#12422)
  * Upgrade google/go-github to v32.1.0 (#12361) (#12390)
  * Render emoji's of Commit message on feed-page (#12373)
  * Fix handling of diff on unrelated branches when Git 2.28 used (#12370)

PR:		249095
Submitted by:	Greg Fitzgerald
Approved by:	maintainer (implicit)
910dc7db15
Adam Weinberger (adamw) · 1.12.3
gitea: Update to 1.12.3

1.12.3 - 2020-07-28

    BUGFIXES
        Don't change creation date when updating Release (#12343) (#12351)
        Show 404 page when release not found (#12328) (#12332)
        Fix emoji detection in certain cases (#12320) (#12327)
        Reduce emoji size (#12317) (#12327)
        Fix double-indirection bug in logging IDs (#12294) (#12308)
        Link to pull list page on sidebar when view pr (#12256) (#12263)
        Extend Notifications API and return pinned notifications by default (#12164) (#12232)

PR:		248375
Submitted by:	Greg Fitzgerald
Approved by:	maintainer
aa4843b774
Adam Weinberger (adamw) · 1.12.2
gitea: Update to 1.12.2

This release fixes a large number of bugs and introduces many new features.

Release notes:
- https://blog.gitea.io/2020/06/gitea-1.12.0-and-1.12.1-are-released/
- https://blog.gitea.io/2020/07/gitea-1.12.2-is-released/

Additional changes to the port:
- Use PORTDATA to avoid enumerating the extensive DATADIR
- Add option to rc file for custom path [1]
- Turn the BINDATA option on by default

PR:		247613, 247989 [1]
Submitted by:	maintainer, mikeg bsd-box net [1]
Approved by:	maintainer [1]
bea827cf4c
Adam Weinberger (adamw) · 1.11.8
www/gitea: Update to 1.11.8

Update Gitea to 1.11.8

This release fixes five bugs.

Release notes: https://blog.gitea.io/2020/06/gitea-1.11.7-is-released/
https://github.com/go-gitea/gitea/releases/tag/v1.11.8

PR:		247612
Submitted by:	maintainer
04cfe3a23c
Adam Weinberger (adamw) · 1.11.6_1
gitea: Update to 1.11.6

Update Gitea to 1.11.6

This release fixes two security issues and 14 bugs.

Release notes: https://github.com/go-gitea/gitea/releases/tag/v1.11.6

And despite /some/ work being done on the invalid Go template syntax for the
Wiki pages, the main bug has not been fixed and merged, so the patch still is
required.

PR:		246892
Submitted by:	maintainer
MFH:		2020Q2
Relnotes:	https://github.com/go-gitea/gitea/releases/tag/v1.11.6
Security:	yes, see Relnotes
2701a28ca5
Kyle Evans (kevans) · 1.11.5_1
www/gitea: Fix viewing of branches with a slash in the name

An issue[0] was filed upstream in January that branches with a slash in
their name (e.g. stable/11) result in a 500 error when attempting to view
them.

I tracked down the issue to the fact that read(2) on a directory fd in
FreeBSD will actually succeed, while it will not on Linux/other OS. I have
filed a PR[1] with go-git to remedy the problem there, and then we
(hopefully) convince gitea maintainers to accept the patch as well once it's
upstreamed.

The attached patch brings it into the ports tree as well, so that FreeBSD
users can more immediately get the fix. It should still apply to the version
in 2020Q2, more or less, with version numbers changed to protect the
innocent.

[0] https://github.com/go-gitea/gitea/issues/9938
[1] https://github.com/go-git/go-git/pull/39

PR:		245863
Approved by:	<stb lassitu de> (maintainer)
Aoorived by:	koobs (mentor, ports)
MFH:		2020Q2 (minor bugfix patch)
ceecbb4c57
Adam Weinberger (adamw) · 1.11.5
gitea: Update to 1.11.5

This release fixes 22 bugs, and includes two enhancements.

Release notes: https://github.com/go-gitea/gitea/releases/tag/v1.11.5

PR:		246353
Submitted by:	maintainer
e410dd1dbe
Adam Weinberger (adamw) · 1.11.4_1
gitea: Fix wiki page display

From the PR:

Right now, the version of gitea shipped in ports fails to display wiki
pages. Any wiki page opened results in the following error:

template: repo/wiki/view:48:14: executing "repo/wiki/view" at <(not
$.DisableHTTP) (and (not $.DisableSSH) (or $.IsSigned
$.ExposeAnonSSH))>: can't give argument to non-function not
$.DisableHTTP

This is due to extra parentheses in templates/repo/wiki/view.tmpl and
has already been fixed upstream in [1], [2].

I've pulled the single line template fix from upstream and added the
patch to our port. As a workaround, users can also fix the problem by
placing the corrected template in
/usr/local/etc/gitea/templates/repo/wiki/view.tmpl.

Cheers,
Sascha

[1] https://github.com/go-gitea/gitea/issues/10552
[2] https://github.com/zeripath/gitea/commit/1830d0ed5f4a67e3360ecbb55933b5540b6affce

PR:		246020
Submitted by:	Sascha Biberhofer
Approved by:	maintainer
a87523b031
Adam Weinberger (adamw) · 1.11.4
gitea: Add GIT_LFS option

Add a GIT_LFS option (on by default) for environments that don't want to
make LFS available.

While here, change the pkg-message UCL to only show when upgrading from
< 1.8.0.

Approved by:	maintainer
ed0175b66c
Adam Weinberger (adamw) · 1.11.4
gitea: Update to 1.1.4

Update Gitea to 1.11.4

This release fixes ten bugs.

Release notes: https://blog.gitea.io/2020/04/gitea-1.11.4-is-released/

PR:		245602
Submitted by:	maintainer
7ffdd02ada
Adam Weinberger (adamw) · 1.11.3
gitea: Remove test that snuck in (no functional change)
37d2ca98d6
Adam Weinberger (adamw) · 1.11.3
gitea: Update to 1.11.3

This release fixes three bugs.

Release notes: https://blog.gitea.io/2020/03/gitea-1.11.3-and-1.10.6-released/

Also fix LDFLAGS so that the version number (among other things) is built into
the binary correctly, and make the regexp used in the Makefile work with
bsdgrep (both thanks to adamw).

Will MFH due to bsdgrep build failure and stopwatch panic fix.

PR:		244898
Submitted by:	maintainer
MFH:		2020Q1
a57fc6cd2c
Tobias Kortkamp (tobik) · 1.11.2
www/gitea: Use OPTIONS_SUB
bd17d197d3
Adam Weinberger (adamw) · 1.11.2
gitea: Update to 1.11.2, contains security fixes

https://blog.gitea.io/2020/02/gitea-1.11.0-is-released
https://blog.gitea.io/2020/02/gitea-1.11.1-is-released
https://blog.gitea.io/2020/02/gitea-1.11.2-is-released

PR:		244025
Submitted by:	maintainer
MFH:		2020Q1
Security:	yes (see links above)
481a799f6b
Dmitri Goutnik (dmgk) · 1.10.4
www/gitea: Update to 1.10.4

Changes:	https://github.com/go-gitea/gitea/releases/tag/v1.10.4
PR:		244246
Submitted by:	stb@lassitu.de (maintainer)
a6586ac3c6
Jochen Neumeister (joneum) · 1.10.3
Update to 1.10.3

PR:		243437
Submitted by:	stb@lassitu.de (maintainer)
MFH:		2020Q1
Security:	a512a412-3a33-11ea-af63-0800274e5f20
Sponsored by:	Netzkommune GmbH
24a22adb72
Jochen Neumeister (joneum) · 1.10.2
Update to 1.10.2

PR:		243061
Submitted by:	stb@lassitu.de (maintainer)
Sponsored by:	Netzkommune GmbH
f3b03fa12d
Dan Langille (dvl) · 1.10.1
Fixed a typo in the sample configuration file.

Approved by:	maintainer via private email
3b57d07955
Tobias Kortkamp (tobik) · 1.10.1
www/gitea: Unbreak on arm64

# golang.org/x/sys/unix
vendor/golang.org/x/sys/unix/ztypes_freebsd_arm64.go:400:12: undefined: uint128

PR:		242312
9bc6b4dc18