* SECURITY * Fix comment permissions (#28213) (#28217) * Dont leak private users via extensions (#28023) (#28028) * Unify two factor check (#27915) (#27939) * Support allowed hosts for webhook to work with proxy (#27655) (#27674) * BUGFIXES * Fix no ActionTaskOutput table waring (#28149) (#28151) * Restricted users only see repos in orgs which their team was assigned to (#28025) (#28050) * Fix DownloadFunc when migrating releases (#27887) (#27889) * Fix http protocol auth (#27875) (#27878) * Revert "fix orphan check for deleted branch (#27310) (#27320)" (#27763) * Fix label render containing invalid HTML (#27752) (#27761) * Fix poster is not loaded in get default merge message (#27657) (#27665) * Fix 404 when deleting Docker package with an internal version (#27615) (#27629) * Fix attachment download bug (#27486) (#27570) * When comparing with an non-exist repository, return 404 but 500 (#27437) (#27441) * API * Fix package webhook (#27839) (#27854) * Fix org team endpoint (#27721) (#27729) * ENHANCEMENTS * Render email addresses as such if followed by punctuation (#27987) (#27991) * Fix mermaid flowchart margin issue (#27503) (#27517) * Fix panic in storageHandler (#27446) (#27478) * DOCS * Update agit-support.en-us.md (#27652) * MISC * Fix wrong xorm Delete usage(backport for 1.20) (#28003) * Remove duplicated button in Install web page (#27941) * Avoid run change title process when the title is same (#27467) (#27557)