* SECURITY

  * Check that repositories can only be migrated to own user or organizations (go-gitea#4366) (go-gitea#4370)
* BUGFIXES
  * Fix column droping for MSSQL that need new transaction for that (go-gitea#4440) (go-gitea#4484)
  * Redirect to correct page after using scratch token (go-gitea#4458) (go-gitea#4472)
  * Replace src with raw to fix image paths (go-gitea#4377) (go-gitea#4386)
  * Fixes repo membership check in API (go-gitea#4341) (go-gitea#4379)
  * Add default merge options when adding new repository (go-gitea#4369) (go-gitea#4373)
  * Fix repository last updated time update when delete a user who watched the repo (go-gitea#4363) (go-gitea#4371)
  * Fix html entity escaping in branch deletion message (go-gitea#4471) (go-gitea#4485)

* SECURITY

  * Limit uploaded avatar image-size to 4096x3072 by default (go-gitea#4353)
  * Do not allow to reuse TOTP passcode (go-gitea#3878)
* FEATURE
  * Add cli commands to regen hooks & keys (go-gitea#3979)
  * Add support for FIDO U2F (go-gitea#3971)
  * Added user language setting (go-gitea#3875)
  * LDAP Public SSH Keys synchronization (go-gitea#1844)
  * Add topic support (go-gitea#3711)
  * Multiple assignees (go-gitea#3705)
  * Add protected branch whitelists for merging (go-gitea#3689)
  * Global code search support (go-gitea#3664)
  * Add label descriptions (go-gitea#3662)
  * Add issue search via API (go-gitea#3612)
  * Add repository setting to enable/disable health checks (go-gitea#3607)
  * Emoji Autocomplete (go-gitea#3433)
  * Implements generator cli for secrets (go-gitea#3531)
* ENHANCEMENT
  * Add more webhooks support and refactor webhook templates directory (go-gitea#3929)
  * Add new option to allow only OAuth2/OpenID user registration (go-gitea#3910)
  * Add option to use paged LDAP search when synchronizing users (go-gitea#3895)
  * Symlink icons (go-gitea#1416)
  * Improve release page UI (go-gitea#3693)
  * Add admin dashboard option to run health checks (go-gitea#3606)
  * Add branch link in branch list (go-gitea#3576)
  * Reduce sql query times in retrieveFeeds (go-gitea#3547)
  * Option to enable or disable swagger endpoints (go-gitea#3502)
  * Add missing licenses (go-gitea#3497)
  * Reduce repo indexer disk usage (go-gitea#3452)
  * Enable caching on assets and avatars (go-gitea#3376)
  * Add repository search ordered by stars/forks. Forks column in admin repo list (go-gitea#3969)
  * Add Environment Variables to Docker template (go-gitea#4012)
  * LFS: make HTTP auth period configurable (go-gitea#4035)
  * Add config path as an optionial flag when changing pass via CLI (go-gitea#4184)
  * Refactor User Settings sections (go-gitea#3900)
  * Allow square brackets in external issue patterns (go-gitea#3408)
  * Add Attachment API (go-gitea#3478)
  * Add EnableTimetracking option to app settings (go-gitea#3719)
  * Add config option to enable or disable log executed SQL (go-gitea#3726)
  * Shows total tracked time in issue and milestone list (go-gitea#3341)
* TRANSLATION
  * Improve English grammar and consistency (go-gitea#3614)
* DEPLOYMENT
  * Allow Gitea to run as different USER in Docker (go-gitea#3961)
  * Provide compressed release binaries (go-gitea#3991)
  * Sign release binaries (go-gitea#4188)

* SECURITY

  * Limit uploaded avatar image-size to 4096x3072 by default (go-gitea#4353)
  * Do not allow to reuse TOTP passcode (go-gitea#3878)
* FEATURE
  * Add cli commands to regen hooks & keys (go-gitea#3979)
  * Add support for FIDO U2F (go-gitea#3971)
  * Added user language setting (go-gitea#3875)
  * LDAP Public SSH Keys synchronization (go-gitea#1844)
  * Add topic support (go-gitea#3711)
  * Multiple assignees (go-gitea#3705)
  * Add protected branch whitelists for merging (go-gitea#3689)
  * Global code search support (go-gitea#3664)
  * Add label descriptions (go-gitea#3662)
  * Add issue search via API (go-gitea#3612)
  * Add repository setting to enable/disable health checks (go-gitea#3607)
  * Emoji Autocomplete (go-gitea#3433)
  * Implements generator cli for secrets (go-gitea#3531)
* ENHANCEMENT
  * Add more webhooks support and refactor webhook templates directory (go-gitea#3929)
  * Add new option to allow only OAuth2/OpenID user registration (go-gitea#3910)
  * Add option to use paged LDAP search when synchronizing users (go-gitea#3895)
  * Symlink icons (go-gitea#1416)
  * Improve release page UI (go-gitea#3693)
  * Add admin dashboard option to run health checks (go-gitea#3606)
  * Add branch link in branch list (go-gitea#3576)
  * Reduce sql query times in retrieveFeeds (go-gitea#3547)
  * Option to enable or disable swagger endpoints (go-gitea#3502)
  * Add missing licenses (go-gitea#3497)
  * Reduce repo indexer disk usage (go-gitea#3452)
  * Enable caching on assets and avatars (go-gitea#3376)
  * Add repository search ordered by stars/forks. Forks column in admin repo list (go-gitea#3969)
  * Add Environment Variables to Docker template (go-gitea#4012)
  * LFS: make HTTP auth period configurable (go-gitea#4035)
  * Add config path as an optionial flag when changing pass via CLI (go-gitea#4184)
  * Refactor User Settings sections (go-gitea#3900)
  * Allow square brackets in external issue patterns (go-gitea#3408)
  * Add Attachment API (go-gitea#3478)
  * Add EnableTimetracking option to app settings (go-gitea#3719)
  * Add config option to enable or disable log executed SQL (go-gitea#3726)
  * Shows total tracked time in issue and milestone list (go-gitea#3341)
* TRANSLATION
  * Improve English grammar and consistency (go-gitea#3614)
* DEPLOYMENT
  * Allow Gitea to run as different USER in Docker (go-gitea#3961)
  * Provide compressed release binaries (go-gitea#3991)
  * Sign release binaries (go-gitea#4188)

* SECURITY

  * HTML-escape plain-text READMEs (go-gitea#4192) (go-gitea#4214)
  * Fix open redirect vulnerability on login screen (go-gitea#4312) (go-gitea#4312)
* BUGFIXES
  * Fix broken monitoring page when running processes are shown (go-gitea#4203) (go-gitea#4208)
  * Fix delete comment bug (go-gitea#4216) (go-gitea#4228)
  * Delete reactions added to issues and comments when deleting repository (go-gitea#4232) (go-gitea#4237)
  * Fix wiki URL encoding bug (go-gitea#4091) (go-gitea#4254)
  * Fix code tab link when viewing tags (go-gitea#3908) (go-gitea#4263)
  * Fix webhook type conflation (go-gitea#4285) (go-gitea#4285)

* BUGFIXES
  * Adjust z-index for floating labels (go-gitea#3939) (go-gitea#3950)
  * Add missing token validation on application settings page (go-gitea#3976) go-gitea#3978
  * Webhook and hook_task clean up (go-gitea#4006)
  * Fix webhook bug of response info is not displayed in UI (go-gitea#4023)
  * Fix writer cannot read bare repo guide (go-gitea#4033) (go-gitea#4039)
  * Don't force due date to current time (go-gitea#3830) (go-gitea#4057)
  * Fix wiki redirects (go-gitea#3919) (go-gitea#4065)
  * Fix attachment ENABLED (go-gitea#4064) (go-gitea#4066)
  * Added deletion of an empty line at the end of file (go-gitea#4054) (go-gitea#4074)
  * Use ResolveReference instead of path.Join (go-gitea#4073)
  * Fix go-gitea#4081 Check for leading / in base before removing it (go-gitea#4083)
  * Respository's home page not updated after first push (go-gitea#4075)

Add 1.4.2 changelog (go-gitea#4115)

* BREAKING

  * Add "error" as reserved username (go-gitea#3882) (go-gitea#3886)
* SECURITY
  * Do not allow inactive users to access repositories using private key (go-gitea#3887) (go-gitea#3889)
  * Fix path cleanup in file editor, when initilizing new repository and LFS oids  (go-gitea#3871) (go-gitea#3873)
  * Remove unnecessary allowed safe HTML (go-gitea#3778) (go-gitea#3779)
  * Correctly check http git access rights for reverse proxy authorized users (go-gitea#3721) (go-gitea#3743)
* BUGFIXES
  * Fix to use only needed columns from tables to get repository git paths (go-gitea#3870) (go-gitea#3883)
  * Fix GPG expire time display when time is zero (go-gitea#3584) (go-gitea#3884)
  * Fix to update only issue last update time when adding a comment (go-gitea#3855) (go-gitea#3860)
  * Fix repository star count after deleting user (go-gitea#3781) (go-gitea#3783)
  * Use the active branch for the code tab (go-gitea#3720) (go-gitea#3776)
  * Set default branch name on first push (go-gitea#3715) (go-gitea#3723)
  * Show clipboard button if disable HTTP of git protocol (go-gitea#3773) (go-gitea#3774)

* BREAKING

  * Drop deprecated GOGS\_WORK\_DIR use (go-gitea#2946)
  * Fix API status code for hook creation (go-gitea#2814)
* SECURITY
  * Escape branch name in dropdown menu (go-gitea#3691) (go-gitea#3692)
  * Refactor and simplify to correctly validate redirect to URL (go-gitea#3674) (go-gitea#3676)
  * Fix escaping changed title in comments (go-gitea#3530) (go-gitea#3534)
  * Escape search query (go-gitea#3486) (go-gitea#3488)
  * Sanitize logs for mirror sync (go-gitea#3057)
* FEATURE
  * Serve .patch and .diff for pull requests (go-gitea#3305, go-gitea#3293)
  * Add repo-sync-releases admin command (go-gitea#3254)
  * Support default private when creating or migrating repository (go-gitea#3239)
  * Writable deploy keys (closes go-gitea#671) (go-gitea#3225)
  * Add Pull Request merge options - Ignore white-space for conflict checking, Rebase, Squash merge (go-gitea#3188)
  * Added progressbar for issues with checkboxes (go-gitea#1146). (go-gitea#3171)
  * Mention completion for issue editor. (go-gitea#3136)
  * Add 'mark all read' option to notifications (go-gitea#3097)
  * Git LFS lock api (go-gitea#2938)
  * Add reactions to issues/PR and comments (go-gitea#2856)
  * Add dingtalk webhook  (go-gitea#2777)
  * Responsive view (go-gitea#2750)
* BUGFIXES
  * Fix wiki inter-links with spaces (go-gitea#3560) (go-gitea#3632)
  * Fix query protected branch bug (go-gitea#3563) (go-gitea#3571)
  * Fix remove team member issue (go-gitea#3566) (go-gitea#3570)
  * Fix the protected branch panic issue (go-gitea#3567) (go-gitea#3569)
  * If Mirrors repository no content is fetched, updated time should not be changed (go-gitea#3551) (go-gitea#3565)
  * Bug fix for mirrored repository releases sorted (go-gitea#3522) (go-gitea#3555)
  * Add issue closed time column to fix activity closed issues list (go-gitea#3537) (go-gitea#3540)
  * Update markbates/goth library to support OAuth2 with new dropbox API (go-gitea#3533) (go-gitea#3539)
  * Fixes missing avatars in offline mode (go-gitea#3471) (go-gitea#3477)
  * Fix synchronization bug in repo indexer (go-gitea#3455) (go-gitea#3461)
  * Fix rendering of wiki page list if wiki repo contains other files (go-gitea#3454) (go-gitea#3463)
  * Fix webhook X-GitHub-* headers casing for better compatibility (go-gitea#3429)
  * Add content type and doctype to requests made with go-get (go-gitea#3426, go-gitea#3423)
  * Fix SQL type error for webhooks (go-gitea#3424)
  * Fix PR merge error (go-gitea#3421)
  * Recognize more characters in crossreferenced repo name (go-gitea#3413)
  * Fix MSSQL bug on org (go-gitea#3405)
  * HTML escape all lines of the search result (go-gitea#3402)
  * Change local copy origin url after repository rename (go-gitea#3399)
  * Force-push to base repo's ref/pull/#/head (go-gitea#3393)
  * Fix bug when a user delete but assigned on issue (go-gitea#3318)
  * Use issue number/index instead of id for API URL. Fix go-gitea#3297 (go-gitea#3298)
  * Fix repo-transfer-and-team-repo-count bug (go-gitea#3241)
  * Fix always-on SSL Mode checkbox in admin page (go-gitea#3208)
  * Fix source download link when no code unit allowed (go-gitea#3166)
  * Fix org owner cannot be removed if he is not in owner team (go-gitea#3164)
  * Fix run web with -p push failed (go-gitea#3154)
  * Fix gpg tmpl (go-gitea#3153)
  * Fix SSH auth lfs locks (go-gitea#3152)
  * Improvements for supporting UI Location (go-gitea#3146)
  * Fix new pull request link (go-gitea#3133)
  * Fix missing branch in release bug (go-gitea#3108)
  * Allow adding collaborators with (fullname) (go-gitea#3103)
  * Fix repo links (go-gitea#3093)
  * fix lfs url refs + keep path upper/lowercase in db. (go-gitea#3092)
  * Fix redis session failed (go-gitea#3086)
  * Fix bugs in issue dashboard stats (go-gitea#3073)
  * Fix avatar URLs (go-gitea#3069)
  * Fix ref parsing in commit messages (go-gitea#3067)
  * Fix issue list branch link broken (go-gitea#3061)
  * sendmail: correct option to set envelope-sender (go-gitea#3044)
  * Fix missing password length check when change password (go-gitea#3039)
  * Fix git lfs path (go-gitea#3016)
  * Fix API-Endpoint release (go-gitea#3005) (go-gitea#3012)
  * Set OpenID support on by default when installing new instance (go-gitea#3010)
  * Various wiki bug fixes (go-gitea#2996)
  * Fix go-get, src and raw urls to new scheme (go-gitea#2978)
  * Fix error when add user has full name to team (go-gitea#2973)
  * Fix memcache support when value is returned as string always (go-gitea#2924)
* ENHANCEMENT
  * Use GiteaServer as the user agent for http requests (go-gitea#3404)
  * Delete indexer DB entries when (re)creating index (go-gitea#3385)
  * Change how merged PR commit info are prepared (go-gitea#3368)
  * Asynchronously populate the repo indexer (go-gitea#3366)
  * Make the default action for the gitea executable that of running the webserver (go-gitea#3331)
  * Templates for extra links in top navbar and repo tool tabs. (go-gitea#3308)
  * Fixed asterisk based tasklist items go-gitea#3295 (go-gitea#3296)
  * Add more additional template snippets (go-gitea#3286)
  * Open external tracker in blank window, consistently with wiki (go-gitea#3227)
  * Fix repo links on user profile (go-gitea#3197)
  * Enable emoji for wiki view (go-gitea#3158)
  * Small improve on deleting attachements (go-gitea#3145)
  * Reduce overhead of upgrades for users with custom stylesheets/JS (go-gitea#3051)
  * Default log level to Info without hardcoding it in installer (go-gitea#3041)
  * Memory usage improvements (go-gitea#3013)
  * Add fingerprint to ssh key endpoints. (go-gitea#3009)
  * Improve memory usage when reaching diff limits (go-gitea#2990)
  * Expandable commit bodies (go-gitea#2980)
  * Update gitgraph.js to fix blurry commit graph on HiDPI screens (go-gitea#2957)
  * Fix language names (go-gitea#2955)
  * Remove render issue link (go-gitea#2954)
  * Page parameter for repo search API (go-gitea#2915)
  * Apply LANDING\_PAGE config options for logged in users (go-gitea#2894)
  * Enable admin to search by email (go-gitea#2888)
  * Hide add key button if SSH is disabled (go-gitea#2873)
  * Fix comment API paths (go-gitea#2813)
  * Add an option to allow redirect of http port 80 to https. (go-gitea#1928)
* MISC
  * Fix organization profile on mobile devices (go-gitea#3332)
  * Fix guide link for webhooks in repository settings (go-gitea#3291) (go-gitea#3292)
  * Enable Libravatar by default in new installations (go-gitea#3287)
  * Improve suppressed diff boxes (go-gitea#3193)
  * fix button heights on commits page (go-gitea#3091)
  * Minor copy changes (go-gitea#3074)
  * Sort repos in issues dashboard sidebar (go-gitea#3072)
  * Remove box-shadow from UI, fix dashboard issue (go-gitea#3065)
  * Adjust branch button size (go-gitea#3063)
  * Fix misalignment issue in repo header (go-gitea#3062)
  * Delete a user's public key via admin api (closes go-gitea#3014) (go-gitea#3059)
  * Dashboard: Fix line height problem in issue titles (go-gitea#3054)
  * Remove duplicate "Max Diff Lines" from config view (go-gitea#2987)
  * Drop unmaintained gogs migration script (go-gitea#2947)
  * App restarts to quickly if it fails to start. (go-gitea#2945)
  * Add owner to delete repo message (go-gitea#2886)

* SECURITY

  * Refactor and simplify to correctly validate redirect to URL (go-gitea#3674) (go-gitea#3676)
* BUGFIXES
  * Update markbates/goth library to fix OAuth2 support (go-gitea#3661) (go-gitea#3663)
  * Fix column removal in MSSQL (go-gitea#3638) (go-gitea#3640)
  * Fix wiki inter-links with spaces (go-gitea#3560) (go-gitea#3632)

* SECURITY

  * Fix escaping changed title in comments (go-gitea#3530) (go-gitea#3534)
  * Escape search query (go-gitea#3486) (go-gitea#3488)
* BUGFIXES
  * Fix query protected branch bug (go-gitea#3563) (go-gitea#3571)
  * Fix remove team member issue (go-gitea#3566) (go-gitea#3570)
  * Fix the protected branch panic issue (go-gitea#3567) (go-gitea#3569)
  * If Mirrors repository no content is fetched, updated time should not be changed (go-gitea#3551) (go-gitea#3565)
  * Bug fix for mirrored repository releases sorted (go-gitea#3522) (go-gitea#3555)
  * Add issue closed time column to fix activity closed issues list (go-gitea#3537) (go-gitea#3540)
  * Update markbates/goth library to support OAuth2 with new dropbox API (go-gitea#3533) (go-gitea#3539)
  * Fixes missing avatars in offline mode (go-gitea#3471) (go-gitea#3477)
  * Fix synchronization bug in repo indexer (go-gitea#3455) (go-gitea#3461)
  * Fix rendering of wiki page list if wiki repo contains other files (go-gitea#3454) (go-gitea#3463)

* SECURITY

  * Fix escaping changed title in comments (go-gitea#3530) (go-gitea#3535)
  * Escape search query display (go-gitea#3486) (go-gitea#3489)
* BUGFIXES
  * Fix repo-transfer-and-team-repo-count bug (go-gitea#3241) (go-gitea#3244)
  * Open external tracker in blank window, consistently with wiki (go-gitea#3227) (go-gitea#3228)
  * Change SSL Mode from checkbox to string in admin page (go-gitea#3208) (go-gitea#3211)