CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

www/forgejo16 16.0.6_1

Compact self-hosted Git forge

0
unaddressed
0
VuXML only
3
fixed
0
open problem reports

Port info

Maintainer
des@FreeBSD.org
Packages
latest: 16.0.6_1
Upstream
up to date
Last update
to 16.0.6_1 · d81b7ba3c3
Quarterly
2026Q4: 16.0.6_1 · last MFH 60647eff54
WWW
https://forgejo.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install forgejo16
installs 16.0.6_1 from latest; from quarterly (2026Q4) 16.0.6_1
Port
# cd /usr/ports/www/forgejo16 && make install clean
# make -C /usr/ports/www/forgejo16 config  # change options first
Size
38 MiB download · 115 MiB installed
Depends on
devel/git 2.56.0, devel/git-lfs 3.6.1_24
License
GPLv3+
Creates
user git, group git
Options
4 of 4 on in the package: BINDATA GIT_LFS PAM SQLITE
pkg-message
Shown after installing
Before starting forgejo for the first time, you must set a number of
secrets in the configuration file. For your convenience, a sample file
has been copied to /usr/local/etc/forgejo/conf/app.ini.

You need to replace every occurence of CHANGE_ME in the file with
sensible values. Please refer to the official documentation at
https://forgejo.org for details.

You will also likely need to create directories for persistent
storage.  Run
    service forgejo doctor check
to check if all prerequisites have been met.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1616.0.6_116.0.5_1–
FreeBSD 1516.0.6_116.0.6–
FreeBSD 1416.0.6_116.0.5_116.0.6_1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1516.0.6_116.0.6–
FreeBSD 1416.0.6_116.0.5_116.0.6_1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 16.0.6_1.

Fixed (3)

Show 3 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-890949.92026-09-10Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
CVE-2026-906794.32026-09-13Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or con…
CVE-2026-891513.52026-09-11Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (13)

Dag-Erling Smørgrav (des) · 16.0.6_1 MFH 2026Q4 ✓
various: Bump Go ports for Go 1.26.10 / 1.27.3
d81b7ba3c3
Dag-Erling Smørgrav (des) · 16.0.6 MFH 2026Q4 ✓
www/forgejo15: Update to 16.0.6

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.6.md

MFH:		2026Q4
afefd34435
Dag-Erling Smørgrav (des) · 16.0.5
various: Drop Go 1.26+ version pin

This is a nop since 1.26 is the oldest supported version.
2c73fa4d6e
Dag-Erling Smørgrav (des) · 16.0.5
www/forgejo16: Update to 16.0.5

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.5.md
c7dda1bce5
Dag-Erling Smørgrav (des) · 16.0.4
www/forgejo16: Update to 16.0.4

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.4.md
8dffe01cf4
Adam Weinberger (adamw) · 16.0.3_1
many: Bump go ports for 1.26.8 and 1.27.1
dd0905142a
Dag-Erling Smørgrav (des) · 16.0.3
www/forgejo16: Update to 16.0.3

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.3.md
f8725c1685
Dag-Erling Smørgrav (des) · 16.0.2_2 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.14 / 1.26.7
4867821cd6
Dag-Erling Smørgrav (des) · 16.0.2_1 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.13 / 1.26.6
6d39dcf04e
Dag-Erling Smørgrav (des) · 16.0.2
www/forgejo16: Update to 16.0.2

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.2.md
359b1052c7
Dag-Erling Smørgrav (des) · 16.0.1 MFH 2026Q3 requested
www/forgejo16: Update to 16.0.1

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.1.md

MFH:		2026Q3
60a214a4ce
Dag-Erling Smørgrav (des) · 16.0.0
www/forgejo16: New port

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.0.md
0dfbb738da