without substantial changes to our git log; to see the highlights of what has
been added to each release, please refer to the [blog](https://blog.gitea.io).
+## [1.6.0-rc1](https://github.com/go-gitea/gitea/releases/tag/v1.6.0-rc1) - 2018-10-17
+* BREAKING
+ * Respect email privacy option in user search via API (#4512)
+ * Simply remove tidb and deps (#3993)
+ * Swagger.v1.json template (#3572)
+* FEATURE
+ * Pull request review/approval and comment on code (#3748)
+ * Added dependencies for issues (#2196) (#2531)
+ * Add the ability to have built in themes in Gitea and provide dark theme arc-green (#4198)
+ * Add sudo functionality to the API (#4809)
+ * Add oauth providers via cli (#4591)
+ * Disable merging a WIP Pull request (#4529)
+ * Force user to change password (#4489)
+ * Add letsencrypt to Gitea (#4189)
+ * Add push webhook support for mirrored repositories (#4127)
+ * Add csv file render support defaultly (#4105)
+ * Add Recaptcha functionality to Gitea (#4044)
+* BUGFIXES
+ * Fix release creation via API (#5076)
+ * Remove links from topics in edit mode (#5026)
+ * Fix missing AppSubUrl in few more templates (fixup) (#5021)
+ * Fix missing AppSubUrl in some templates (#5020)
+ * Hide outdated comments in file view (#5017)
+ * Upgrade gopkg.in/testfixtures.v2 (#4999)
+ * Disable debug routes unless PPROF is enabled in configuration (#4995)
+ * Fix user menu item styling (#4985)
+ * Fix layout of the topics editing form (#4971)
+ * Fix null pointer dereference in ParseCommitWithSignature (#4962)
+ * Fix url in discord webhook (#4953)
+ * Detect charset and convert non UTF-8 files for display (#4950)
+ * Make sure to catch the right error so it is displayed on the UI (#4945)
+ * Fix(topics): don't redirect to explore page. (#4938)
+ * Fix bug forget to remove Stopwatch when remove repository (#4928)
+ * Fix bug when repo remained bare if multiple branches pushed in single push (#4923)
+ * Fix: Let's Encrypt configuration settings (#4911)
+ * Fix: Crippled diff (#4726) (#4900)
+ * Fix trimming of markup section names (#4863)
+ * Issues api allow pulls and fix #4832 (#4852)
+ * Do not autocreate directory for new users/orgs (#4828) (#4849)
+ * Fix redirect with non-ascii branch names (#4764) (#4810)
+ * Fix missing release title in webhook (#4783) (#4796)
+ * User shouldn't be able to approve or reject his/her own PR (#4729)
+ * Make sure to reset commit count in the cache on mirror syncing (#4720)
+ * Fixed bug where team with admin privelege type doesn't get any unit (#4719)
+ * Fix incorrect caption of webhook setting (#4701) (#4717)
+ * Allow WIP marker to contains < or > (#4709)
+ * Hide org/create menu item in Dashboard if user has no rights (#4678) (#4680)
+ * Site admin could create repos even MAX_CREATION_LIMIT=0 (#4645)
+ * Fix custom templates being ignored (#4638)
+ * Fix starring icon after semantic ui update (#4628)
+ * Fix Split-View line adjustment (#4622)
+ * Fix integer constant overflows in tests (#4616)
+ * Push whitelist now doesn't apply to branch deletion (#4601) (#4607)
+ * Fix bugs when too many IN variables (#4594)
+ * Fix failure on creating pull request with assignees (#4419) (#4583)
+ * Fix panic issue on update avatar email (#4580) (#4581)
+ * Fix status code label for a successful webhook (#4540)
+ * An inactive user shouldn't be able to be added as a collaborator (#4535)
+ * Don't fail silently if trying to add a collaborator twice (#4533)
+ * Fix incorrect MergeWhitelistTeamIDs check in CanUserMerge function (#4519) (#4525)
+ * Fix out-of-transaction query in removeOrgUser (#4521) (#4522)
+ * Fix migration from older releases (#4495)
+ * Accept 'Data:' in commit graph (#4487)
+ * Update xorm to latest version and fix correct `user` table referencing in sql (#4473)
+ * Relative URLs for LibreJS page (#4460)
+ * Redirect to correct page after using scratch token (#4458)
+ * Fix column droping for MSSQL that need new transaction for that (#4440)
+ * Replace src with raw to fix image paths (#4377)
+ * Add default merge options when creating new repository (#4369)
+ * Fix docker build (#4358)
+ * Fixes repo membership check in API (#4341)
+ * Dep upgrade mysql lib (#4161)
+ * Fix some issues with special chars in branch names (#3767)
+ * Responsive design fixes (#4508)
+* ENHANCEMENT
+ * Fix milestones sorted wrongly (#4987)
+ * Allow api to create tags for releases if they don't exist (#4890)
+ * Fix #4877 to follow the OpenID Connect Audiences spec (#4878)
+ * Enforce token on api routes [fixed critical security issue #4357] (#4840)
+ * Update legacy branch and tag URLs in dashboard to new format (#4812)
+ * Slack webhook channel name cannot be empty or just contain an hashtag (#4786)
+ * Add whitespace handling to PR-comparsion (#4683)
+ * Make reverse proxy auth optional (#4643)
+ * MySQL TLS (#4642)
+ * Make sure to set PR split view when creating/previewing a pull request (#4617)
+ * Log user in after a successful sign up (#4615)
+ * Fix typo IsPullReuqestBroken -> IsPullRequestBroken (#4578)
+ * Allow admin toggle forcing a password change for newly created users (#4563)
+ * Update jQuery to v1.12.4 (#4551)
+ * Env var GITEA_PUSHER_EMAIL (#4516)
+ * Feat(repo): support search repository by topic name (#4505)
+ * Small improvements to dependency UI (#4503)
+ * Make max commits in graph configurable (#4498)
+ * Add valid for lfs oid (#4461)
+ * Add shortcut to save wiki page (#4452)
+ * Allow administrator to create repository for any organization (#4368)
+ * Fix repository last updated time update when delete a user who watched the repo (#4363)
+ * Switch plaintext scratch tokens to use hash instead (#4331)
+ * Increase default TOTP secret size to 320 bits (#4287)
+ * Keep preseeded database password (#4284)
+ * Implemented hover text showing user FullName (#4261)
+ * Add ability to delete a token (#4235)
+ * Fix typos in i18n variable names. (#4080)
+ * Api: repos/search: add parameters to control the sort order (#3964)
+ * Add missing path in the Docker app.ini template (#2181)
+ * Add file name and branch to page title (#4902)
+ * Offline use of google fonts (#4872)
+ * Add missing History link to directory listings v2 (#4829)
+ * Locale for Edit and Remove due date issue (#4802)
+ * Disable 'May Import Local Repository' when is disabled by setting (Is… (#4780)
+ * API /admin/users/{username} missing parameter (#4775)
+ * Display error when adding a user to a team twice (#4746)
+ * Remove UsePrivilegeSeparation from the Docker sshd_config, see #2876 (#4722)
+ * Focus title input when clicking helper link (#4696)
+ * Add vendor to user reserved words and format words list according alphabet (#4685)
+ * Add gitea/issues link to 500 page (#4654)
+ * Hide home button when landing page is not set to home (#4651)
+ * Remove link to GitHub issues in 404 template (#4639)
+ * Cmd/serve: pprof cpu and memory profile dumps to disk (#4560)
+ * Add flash message after an account has been successfully activated (#4510)
+ * Prevent html entity escaping on delete branch (#4471)
+ * Locale for button Edit on protected branch (#4442)
+ * Update notification icon (#4343)
+ * Added front-end topics validation (#4316)
+ * Don't display buttons if there are no system notifications (#4280)
+ * Issue due date api (#3890)
+* SECURITY
+ * Improve URL validation for external wiki and external issues (#4710)
+ * Make cookies HttpOnly and obey COOKIE_SECURE flag (#4706)
+ * Don't disclose emails of all users when sending out emails (#4664)
+ * Check that repositories can only be migrated to own user or organizations (#4366)
+* TRANSLATION
+ * Fix punctuation in English translation (#4958)
+ * Fix translation (#4355)
+
## [1.5.2](https://github.com/go-gitea/gitea/releases/tag/v1.5.2) - 2018-10-09
* SECURITY
* Enforce token on api routes (#4840) (#4905)