,

Forgejo v16.0 Ships SSRF Hardening, Granular Notifications, and JWT-Based Actions Integrations

Christian Rakoot

4 min read

Close-up of code running on computer screens in a modern server room, illustrating a self-hosted Git service like Forgejo

Lire cet article en français : Forgejo v16.0 : durcissement SSRF, notifications par dépôt et intégrations Actions via JWT

Forgejo, the community-driven fork of Gitea, shipped version 16.0 on July 16, 2026. It’s a regular release rather than an LTS build, so support runs out on October 29, 2026, in line with the project’s three-month cadence (see the official release notes). The update leads with three breaking changes aimed at tightening default security, then adds a batch of collaboration features, pull request fixes, and expanded Actions and API capabilities.

Breaking changes in Forgejo v16.0

SSRF hardening for Git mirrors

Forgejo now forces http.followRedirects=false on Git mirror operations. Admins who leaned on ALLOWED_DOMAINS, LOCKED_DOMAINS, or ALLOW_LOCALNETWORKS to control where mirrors could pull from had a problem: those restrictions could be bypassed through an HTTP redirect. Turning off redirect-following by default closes that gap.

EXIF stripping removed from avatar uploads

The automatic EXIF stripping added to avatar uploads in v13.0 is gone. Per the release notes, the feature depended on an AGPL-licensed library that had been pulled in by mistake, and keeping Forgejo’s licensing clean meant removing it. If you were counting on that stripping for privacy, you’ll need to scrub EXIF data yourself before uploading.

Reverse proxy trust must now be explicit in containers

Forgejo’s official container images used to default REVERSE_PROXY_TRUSTED_PROXIES to *. Pair that with ENABLE_REVERSE_PROXY_AUTHENTICATION=true and a Forgejo port exposed without a properly configured reverse proxy sitting in front of it, and an attacker could impersonate any user through the X-WebAuth-User header. As of v16.0, Forgejo requires an explicit value for REVERSE_PROXY_TRUSTED_PROXIES; the wildcard default is no longer accepted silently.

It’s a similar pattern to CVE-2026-20896, an authentication bypass disclosed this week in Gitea’s official Docker image, the project Forgejo forked from back in 2022. Both cases come down to a container shipping a permissive default for reverse-proxy trust. They’re not the same event, though: Gitea’s was an actively disclosed vulnerability in a shipped default, while Forgejo’s change here is preventive, closing a similar theoretical hole before anyone had to exploit it. Either way, if you run Gitea or Forgejo behind a reverse proxy, it’s worth a minute to confirm REVERSE_PROXY_TRUSTED_PROXIES is set correctly.

New features

  • Granular notification settings per repository. Subscribers can now follow Issues, Pull Requests, and Releases independently instead of getting all of it or none of it.
  • A progress bar during repository migrations, so batch-migrated issues and pull requests no longer leave admins staring at a blank screen wondering if anything is happening.
  • Avatars now ship in two reduced sizes alongside the original, which should trim bandwidth and speed up page loads.
  • A simplified dialog for adding organization members, with the option to assign someone to multiple teams in one step.

Pull request improvements

  • The commits view has been redesigned for readability and now works properly on smaller screens.
  • Reviewers can select multiple lines at once for a single comment by holding Shift and clicking the add-comment button.
  • Long-standing bugs in where review comments land have finally been fixed, thanks to a git blame --reverse implementation that keeps tracking a line even after it’s been moved or deleted elsewhere in the file.

Forgejo Actions improvements

  • Workflow runs can now be manually prioritized, so admins can push an urgent job ahead of the queue.
  • A new “Authorized Integrations” system offers JWT-based authentication for API and Git operations as an alternative to static tokens, useful for external systems like AWS, GitHub Actions, or GitLab CI that need to talk to a Forgejo instance without holding onto long-lived secrets.
  • Old workflow runs, including their logs and artifacts, can be deleted through the UI or the API.
  • Cron syntax for scheduled workflows now supports time zones.

API and admin additions

  • New endpoints cover workflow logs, artifact management, and cancelling workflow runs.
  • Organizations now expose their creation date through the API.
  • Pull requests can be searched by source or target branch.
  • Admins can manage users’ personal access tokens directly.
  • The user list can be filtered by two-factor authentication status.

Release cadence

Forgejo puts out a major release every three months. v16.0 lands on the exact day v11.0, the previous LTS branch, reaches end of support: July 16, 2026. The current LTS is still v15.0, supported through July 2027, and the next major release, v17.0, is due October 15, 2026.

For more on the project, see selfhostlab’s Forgejo and Gitea pages. Forgejo has been developed as a community fork of Gitea since 2022.

Related guides