Forgejo v16.0 is available

Forgejo version 16.0 was released on 16 July 2026. Forgejo is a lightweight, community-developed, self-hosted platform for code collaboration. This article contains a selection of the changes that were introduced. A complete list of changes is available in the release notes. A dedicated test instance is available to try it out. Before upgrading, it is strongly recommended to make a full backup as explained in the upgrade guide and carefully read all breaking changes from the release notes. If in doubt, do not hesitate to ask for help in the chat room.

Forgejo 16.0 版本于 2026 年 7 月 16 日发布。Forgejo 是一个轻量级、由社区驱动、可自托管的代码协作平台。本文精选了此次更新的部分内容，完整变更列表请参阅发布说明。我们提供了一个专门的测试实例供您试用。在升级之前，强烈建议按照升级指南进行完整备份，并仔细阅读发布说明中所有破坏性变更。如有疑问，请随时在聊天室寻求帮助。

Breaking changes / 破坏性变更

Hardening mirrors against SSRF Administrators can determine which hosts can be accessed by Forgejo for Git mirroring via the config settings [migrations].ALLOWED_DOMAINS/LOCKED_DOMAINS/ALLOW_LOCALNETWORKS. However, there were edge cases where these settings were ineffective. Multiple of such cases were fixed in this version. One of these edge cases was involving Git accessing a repository over HTTP(S), where Git would follow HTTP redirects, allowing a violation of the mentioned config settings. The Git option http.followRedirects=false is now set to prevent Git from following these redirects. Mirroring involving remote Forgejo repositories that have been renamed or transferred to a new owner will trigger redirects that will now be treated as errors. These mirrors must be updated to the new repository location.

针对 SSRF 的镜像加固 管理员可以通过配置项 [migrations].ALLOWED_DOMAINS/LOCKED_DOMAINS/ALLOW_LOCALNETWORKS 来决定 Forgejo 在进行 Git 镜像时可以访问哪些主机。然而，此前存在一些边缘情况导致这些设置失效。本版本修复了多个此类问题。其中一个边缘情况涉及 Git 通过 HTTP(S) 访问仓库时，Git 会自动跟随 HTTP 重定向，从而绕过上述配置限制。现在已设置 Git 选项 http.followRedirects=false 以禁止 Git 跟随这些重定向。涉及已重命名或转移所有者的远程 Forgejo 仓库的镜像操作将触发重定向，现在这些重定向将被视为错误。这些镜像必须更新为新的仓库地址。

EXIF Stripping Removed Forgejo v13.0 added the capability to remove EXIF metadata from images that are uploaded in a user’s avatar. Unfortunately, a licensing mistake was made and Forgejo relied on an AGPL-licensed library to accomplish this work. While other options are being pursued, Forgejo has removed this capability to bring us into license compliance.

移除 EXIF 清除功能 Forgejo v13.0 曾增加了清除用户头像上传图片中 EXIF 元数据的功能。遗憾的是，由于授权许可方面的疏忽，Forgejo 依赖了一个 AGPL 协议的库来实现此功能。在寻求其他替代方案的同时，Forgejo 已移除了该功能以确保符合开源协议合规性。

Trusted proxies setting in containers Forgejo containers had REVERSE_PROXY_TRUSTED_PROXIES = * configured by default. In the event that the Forgejo sysadmin set the container environment variable FORGEJO__service__ENABLE_REVERSE_PROXY_AUTHENTICATION to the value true, and an unauthorized user could access Forgejo without traversing a reverse proxy performing authentication, then an unauthorized user could use the X-WebAuth-User HTTP header to impersonate any user. While this is an unlikely set of configuration settings, it seems more prudent for the Forgejo to require a sysadmin to choose an appropriate value for REVERSE_PROXY_TRUSTED_PROXIES. Even in a containerized environment, this value can be used safely and set to reasonable values if firewall-level networking is in use (eg. using Docker with iptables), which is the common default for Docker installations in 2026.

容器中的受信任代理设置 Forgejo 容器默认配置了 REVERSE_PROXY_TRUSTED_PROXIES = *。如果系统管理员将容器环境变量 FORGEJO__service__ENABLE_REVERSE_PROXY_AUTHENTICATION 设置为 true，且未经授权的用户可以在不经过反向代理认证的情况下访问 Forgejo，那么该用户就可以利用 X-WebAuth-User HTTP 请求头冒充任何用户。虽然这种情况下的配置组合不太常见，但为了安全起见，Forgejo 现在要求系统管理员为 REVERSE_PROXY_TRUSTED_PROXIES 选择合适的值。即使在容器化环境中，如果使用了防火墙级别的网络（例如 2026 年 Docker 安装中常见的 iptables），该值也可以被安全地设置为合理的值。

New features / 新功能

Granular repository watch settings Forgejo makes major strides towards improving its notifications. Now users may select what parts of a repo to receive notifications from! For now there are three categories: Issues, Pull requests and Releases. However, a reworked notification backend paves the way for further granularity.

细粒度的仓库关注设置 Forgejo 在改进通知功能方面迈出了重要一步。现在用户可以选择接收仓库中哪些部分的通知！目前分为三个类别：议题 (Issues)、合并请求 (Pull requests) 和发布 (Releases)。此外，重构后的通知后端为实现更细粒度的控制铺平了道路。

Repository migration progress The repository migration screen now shows the progress of migrations. It provides the progress of migrated issues and pull requests from the source in batches. This allows to verify that long-running migrations are not stuck. Default batch size is 45, which is a minimum amount of items for progress to be displayed.

仓库迁移进度 仓库迁移界面现在可以显示迁移进度。它以批次形式提供从源端迁移的议题和合并请求的进度，这有助于确认长时间运行的迁移任务是否卡住。默认批次大小为 45，这是显示进度所需的最小项目数量。

Downsized avatar variants Two downscaled avatar variants are now generated and served instead of the large primary one in all places where full size isn’t required, decreasing bandwidth usage and improving loading speeds.

头像缩略图 在所有不需要显示完整尺寸头像的地方，系统现在会生成并提供两个缩小的头像版本，以替代原始的大尺寸头像，从而减少带宽占用并提高加载速度。

Easier way to add team members Adding members to organizations became easier thanks to a dialog reachable directly on the list of organization members. This dialog also lets you add the new member to multiple teams of your organization in one go.

更便捷的团队成员添加方式 得益于组织成员列表页面直接可用的对话框，向组织添加成员变得更加容易。该对话框还允许您一次性将新成员添加到组织内的多个团队中。

Consistency check of incoming objects Git is now configured to check for various inconsistencies in incoming objects to reject them and prevent repository from getting into an inconsistent or corrupt state.

传入对象的一致性检查 Git 现在被配置为检查传入对象中的各种不一致性，以便拒绝它们，防止仓库进入不一致或损坏的状态。

Prevent Git hook examples in repositories Forgejo no longer populates Git’s example hook files on backend repositories. Additionally, instance-wide Git hooks are now stored in a centralized location instead of being duplicated in each repository. Combined, these changes result in saving of about 20 KiB of storage per repository.

防止仓库中出现 Git 钩子示例文件 Forgejo 不再在后端仓库中填充 Git 的示例钩子文件。此外，实例范围的 Git 钩子现在存储在集中位置，而不是在每个仓库中重复存储。这些更改合计可为每个仓库节省约 20 KiB 的存储空间。

Repository units hint A hint about adding repository units available to be enabled was initially added in Forgejo v7.0.0, however, because of a bug it was not displayed to newly registered users. This bug was now fixed.

仓库单元提示 关于启用可用仓库单元的提示最初是在 Forgejo v7.0.0 中添加的，但由于一个 Bug，它没有向新注册用户显示。该 Bug 现已修复。