Forgejo v16.0 is available
Forgejo version 16.0 was released on 16 July 2026. Forgejo is a lightweight, community-developed, self-hosted platform for code collaboration. This release includes several changes, with a complete list available in the release notes. A dedicated test instance is available for evaluation. Before upgrading, a full backup is strongly recommended, and users should carefully read all breaking changes from the release notes. A key change in this version is the hardening of mirrors against Server-Side Request Forgery (SSRF). Administrators can determine which hosts Forgejo can access for Git mirroring via the config settings [migrations].ALLOWED_DOMAINS, LOCKED_DOMAINS, and ALLOW_LOCALNETWORKS. However, there were edge cases where these settings were ineffective, and multiple such cases were fixed in this version. One edge case involved Git accessing a repository over HTTP(S), where Git would follow HTTP redirects, allowing a violation of the mentioned config settings. The Git option http.followRedirects=false is now set to prevent Git from following these redirects. Mirroring involving remote Forgejo repositories that have been renamed or transferred to a new owner will trigger redirects that will now be treated as errors. These mirrors must be updated to the new repository location.
Administrators must update mirrors of renamed or transferred repositories to avoid errors.