adam/foundry
1
0
Fork 0
Code Issues 7 Pull requests 6 Projects 1 Releases Packages Wiki Activity Actions

Upgrade Forgejo to v16.0 (LTS) #13

New issue
Open
opened 2026-07-17 15:17:28 -05:00 by adam · 0 comments
adam commented 2026-07-17 15:17:28 -05:00
Owner
Copy link

Forgejo v16.0.0 released 2026-07-16 (LTS, supported ~until July 2027).

Why it matters here: our Forgejo at git.adamayala.work is the git remote Dockhand pulls from, sitting behind Pangolin/Traefik.

Breaking changes to handle before/during upgrade:

  • REVERSE_PROXY_TRUSTED_PROXIES = * default removed — must set trusted proxy IPs explicitly or reverse-proxy auth/header handling breaks. This is the one to watch given the tunnel/proxy in front.
  • SSRF hardening for Git mirroring: new [migrations].ALLOWED_DOMAINS/LOCKED_DOMAINS/ALLOW_LOCALNETWORKS; Git now blocks HTTP redirects on mirrors (can break renamed/transferred/redirecting mirror sources).
  • Avatar EXIF-stripping removed (licensing).

Nice new features: multi-line PR review comments, Authorized Integrations (JWT auth for API/Git), prioritized Actions runs, redesigned commit list, granular notifications, migration progress tracking.

Upgrade steps: full backup first; review full breaking-changes notes; verify REVERSE_PROXY_TRUSTED_PROXIES set explicitly; note infra stack is deliberately not git-backed (apply via Dockhand UI).

Release notes: https://forgejo.org/2026-07-release-v16-0/

Forgejo v16.0.0 released 2026-07-16 (LTS, supported ~until July 2027). **Why it matters here:** our Forgejo at git.adamayala.work is the git remote Dockhand pulls from, sitting behind Pangolin/Traefik. **Breaking changes to handle before/during upgrade:** - `REVERSE_PROXY_TRUSTED_PROXIES = *` default removed — must set trusted proxy IPs explicitly or reverse-proxy auth/header handling breaks. **This is the one to watch given the tunnel/proxy in front.** - SSRF hardening for Git mirroring: new `[migrations].ALLOWED_DOMAINS`/`LOCKED_DOMAINS`/`ALLOW_LOCALNETWORKS`; Git now blocks HTTP redirects on mirrors (can break renamed/transferred/redirecting mirror sources). - Avatar EXIF-stripping removed (licensing). **Nice new features:** multi-line PR review comments, Authorized Integrations (JWT auth for API/Git), prioritized Actions runs, redesigned commit list, granular notifications, migration progress tracking. **Upgrade steps:** full backup first; review full breaking-changes notes; verify `REVERSE_PROXY_TRUSTED_PROXIES` set explicitly; note infra stack is deliberately not git-backed (apply via Dockhand UI). Release notes: https://forgejo.org/2026-07-release-v16-0/
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
add-qrcode2stl-stack
add-ntfy-stack
fix-stackyard-image-tag
add-stackyard-stack
fix-omniroute-key-docs
add-omniroute-stack
add-ntfy-notifications
feat/obico-ml-detection
docs/lan-endpoints
printing-infra
homeassistant-vm
No results found.
Labels
Clear labels   
lab-honing
Lab-access honing backlog (from 2026-07-11 session review)

No labels
lab-honing
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
adam/foundry#13
No description provided.