Forgejo 16.0 Enhances Self-Hosted Code Platform with Security and Collaboration Upgrades

Forgejo, the community-driven, open-source platform for self-hosted Git repositories, has released version 16.0, bringing a suite of enhancements focused on security, workflow efficiency, and collaboration. This update is particularly relevant for developers and organizations prioritizing control over their code infrastructure and seeking advanced tools for team development.

Security Improvements

A primary focus of Forgejo 16.0 is bolstering its security posture. The update introduces stronger protection against Server-Side Request Forgery (SSRF) vulnerabilities within Git mirrors. This addresses potential exploits where malicious requests could be made from the server to internal or external resources. To further mitigate risks, redirects are now disabled for Git operations over HTTP and HTTPS. This means that if a repository is renamed or transferred, mirrors will require manual updating, preventing implicit redirection to potentially compromised locations.

For deployments utilizing Docker and Podman with reverse proxy authentication, explicit configuration of trusted proxy addresses is now mandatory. This ensures that only authorized proxies can authenticate requests, adding another layer of security for these common deployment scenarios.

Workflow and Collaboration Enhancements

Forgejo 16.0 also streamlines developer workflows with improved notification management and code review features. Users can now manage notifications on a more granular level, separating alerts for issues, pull requests, and releases. This allows developers to tailor their notification settings to focus on the most relevant updates, reducing noise and improving productivity.

The pull request review process has been refined to support comments across multiple changed lines within a single review. This is further enhanced by reverse Git blame tracking, which helps in accurately attributing code changes and context, making collaborative code reviews more effective and informative.

For repository administrators, the release offers better control over past development activities. They can now delete completed workflow runs, logs, and artifacts through the user interface or via the API. This capability aids in managing storage and maintaining a clean project history.

Administrative and Operational Updates

Administrators will also benefit from enhanced visibility into repository migrations. The platform now allows for tracking migration progress in batches, providing a clearer overview of large-scale data transfers. Additionally, Git itself has been updated to check incoming objects for inconsistencies before they impact the repository’s state, preventing potential corruption issues early in the process.

Support and Availability

Forgejo 16.0 is not designated as a Long-Term Support (LTS) release. It will be supported until October 29, 2026. Daily test builds are available, allowing early adopters to verify fixes and provide feedback.

Key facts

The advancements in Forgejo 16.0 are significant for teams using self-hosted Git solutions. The increased security measures, particularly SSRF protection and controlled redirects, address critical vulnerabilities common in web-facing applications. The refined collaboration tools, such as multi-line comments in pull requests and better notification management, aim to improve team productivity and the quality of code reviews. These updates reinforce Forgejo’s position as a capable and secure alternative for developers seeking an open-source, self-managed code hosting platform.

Source: Forgejo 16.0 adds SSRF protection, granular notifications, and refined review tools – AlternativeTo AI Tools – https://alternativeto.net/news/2026/7/forgejo-16-0-adds-ssrf-protection-granular-notifications-and-refined-review-tools/