Forgejo 15.0.0 → 16.0.5

Also see a security announcement. Manual action is needed for some v15 deployments, as well as for upgrade to v16.0.0.

Learn more about most notable changes and addressing the breaking changes in our news post: Forgejo v16.0 is available.

Git hooks are now stored in a centralized location instead of being duplicated in every repository, and Git hook example files are no longer generated for new repositories. While a backwards-compatible change, your instance can benefit from following an upgrade guide to clean up these files for the existing repositories. As always, make sure you to have a usable backup before upgrading!

• Breaking security bug fixes
• PR: remove default 'REVERSE_PROXY_TRUSTED_PROXIES = *' from docker config
• PR: Improved compliance with the config settings [migrations].ALLOWED_DOMAINS, [migrations].BLOCKED_DOMAINS, and [migrations].ALLOW_LOCALNETWORKS, which control the remotes that Forgejo can access for git & LFS migration and mirroring operations, fixing time-of-check vs. time-of-use issue and missing checks in LFS. git mirror HTTP operations have been adjusted to never follow HTTP redirects in order to ensure that these settings are followed, which will break HTTP mirroring if a redirect is served by the git HTTP remote.

• Breaking bug fixes
• PR: use proper ${{ forgejo.ref }} in scheduled workflows
• PR: return API URL in the url field for pull requests using the API