Skip to main content
Reference
Changelog

Changelog

This page documents user-visible changes to fremforge: new features, breaking changes (rare), and the weekly runner-image rebuild manifest. Entries are added in reverse-chronological order.

For the full firehose of operational changes, anchor cron runs, sub-processor announcements, edge-rule adjustments, see the trust page and the status page.

Conventions

Each release entry has five blocks:

  • Version, the SemVer this change shipped under, e.g. v1.0.0. This is the version shown in the fremforge app footer (see below). Operational-only changes that don’t move the product version (e.g. a weekly runner-image rebuild) omit it.
  • Date, the day the change went live to customers (UTC).
  • Surface, runners, admin, api, ssh, docs, pricing, trust, etc., the customer-facing area affected.
  • Change, what changed, in language a customer recognises.
  • Action required, what (if anything) the customer must do. Omitted when none.

Breaking changes carry a ⚠ breaking tag. Customers with active subscriptions also receive an email a minimum of 14 days before any breaking change ships.

Versions and the app footer

The fremforge app footer shows a build stamp like v1.0.0 · a5c7733:

  • v1.0.0 is the product SemVer. It maps to the entries on this page, and links here. We bump it deliberately at meaningful milestones, not on every deploy.
  • a5c7733 is the exact source commit that’s currently deployed. fremforge deploys continuously, so this short hash changes on every release; it links to the source commit (which references the pull request it came from). Use it when reporting an issue so we know precisely what you were running.

In short: the version is the human-readable milestone you’ll find on this page; the commit hash is the machine-precise “what’s live right now”. A full per-commit technical changelog is generated from pull-request history and kept in the product repository.

Entries

v1.2.0 — 2026-07-07, Forgejo 15.0.3 + out-of-band, EU-sovereign scanning

  • Version: v1.2.0
  • Surface: git, actions, security
  • Change:
    • Forgejo upgraded to 15.0.3 — the latest upstream release, with its security hardening and stability fixes.
    • Faster pull requests. Security scanning (dependencies, code/SAST, licenses, containers, and SBOM) now runs out-of-band — off your CI pipeline’s critical path — so it no longer adds time to your workflows. Results still land as clear pass/fail fremforge/* checks on every PR.
    • EU-sovereign dependency scanning. Dependency-vulnerability checks now run entirely within our European infrastructure, with the vulnerability database refreshed daily — stronger data residency, always-current coverage.
    • More resilient at scale — the scanning service was hardened to absorb bursts of concurrent pull requests smoothly.
  • Action required: None. Scanning is automatic; the pass/fail checks appear on each PR exactly as before.

v1.1.0 — 2026-07-02, Free cross-org readers + sign-in hardening

  • Version: v1.1.0
  • Surface: admin, billing, sso
  • Change:
    • Free cross-organisation readers. Members can be granted read-only access across organisations without consuming a paid seat — auditors, collaborators, and stakeholders get the read access they need while paid seats stay reserved for contributors. Reader access is read-only (the Viewers team) and never grants write.
    • Cross-organisation sign-in hardening. Per-organisation sign-in can require a fresh identity-provider re-authentication when a session originates from a different organisation. Enforcement is automatic and capability-gated: it activates only once your IdP is confirmed to support step-up re-auth and never blocks sign-in for a provider that doesn’t — no configuration, no lock-out risk.
  • Action required: None.

2026-06-24, Runners moved to ECS-per-job on Debian + Node 24

  • Surface: runners, actions
  • Change: The hosted Forgejo Actions runner pool is now ECS-per-job (a fresh Elastic Cloud Server VM per job, kernel-isolated) instead of the previous pod model. The hosted runner image moved to a Debian (glibc) base with Node 24 LTS. Docker is pre-installed and runs natively on the runner VM — docker build, docker run, and docker/build-push-action all work without Kaniko workarounds. Toolchains, git-lfs, jq, yq, gitleaks, trivy, skopeo, shellcheck, shfmt remain pre-installed; see docs.frem.sh/build/actions/runner-image/ for the current list.
  • Action required: Workflows that previously called kaniko for image builds can switch to native docker build or docker/build-push-action@v5. The Kaniko path continues to work for the migration window.

v1.0.0 — 2026-06-19, SSO auth sources over the API

  • Version: v1.0.0
  • Surface: api, admin
  • Change: You can now create and update an organisation’s OIDC single-sign-on source over the REST API (POST / PUT /api/v1/orgs/{org}/sso), in addition to the admin UI wizard. This works with any standards-compliant OIDC provider, registers the group→team mapping, and enforces MFA verification on the resulting source by default. This release also introduces the version/commit build stamp in the app footer (see Versions and the app footer).
  • Action required: None. The admin UI SSO wizard continues to work unchanged.

2026-05-08, Hosted CI runners online

  • Surface: runners, actions
  • Change: fremforge’s hosted Forgejo Actions runners are now live. Workflows targeting runs-on: fremforge execute inside our hosted runner image (Alpine 3.22 + bash, GNU coreutils, git + git-lfs, build-essentials, Node 22 LTS, jq, yq, gitleaks, trivy, kaniko, shellcheck, shfmt). See docs.frem.sh/build/actions/runner-image/ for the full tooling list and how to install language toolchains via standard setup-* actions. The image rebuilds weekly with a Trivy CVE gate; per-build manifests publish to the runner-image manifests linked below.
  • Action required: None for now. The first sandbox-tenant onboarding flow uses the full path. Existing self-hosted (BYO) runner setups continue to work unchanged.

2026-05-06, Initial publication

  • Surface: trust, infra
  • Change: First publication of this changelog at docs.frem.sh/reference/changelog/. Referenced from docs/runners/ for the weekly runner-image manifest. Pre-launch operations changes from before this date are not back-published.
  • Action required: None. Bookmark this page or subscribe to its RSS feed (link below) once Hugo renders one.

Subscribing

This page emits an RSS feed at https://docs.frem.sh/reference/changelog/index.xml once the Hugo build ships. Add it to your reader of choice. We don’t send a separate changelog email, the security mailing list is the only push channel, and it covers sub-processor changes (per DPA §10.2), security advisories, and upcoming breaking changes.

Runner image manifests

Each weekly hosted-runner image rebuild publishes its manifest under /changelog/runner-images/, that sub-section is auto-generated by the rebuild pipeline rather than hand-written, so the manifest never goes stale relative to the container image digest. The manifest includes:

  • The hosted runner image digest + base image (Debian major.minor)
  • Pre-installed tool versions (node, npm, jq, yq, git, gitleaks, trivy, kaniko, shellcheck, shfmt)
  • CVE scan summary (HIGH/CRITICAL fail with --ignore-unfixed; MEDIUM disclosed)
  • CycloneDX SBOM (linked from each manifest entry)
  • Diff vs previous week’s manifest

The pipeline shipped 2026-05-08; the bootstrap image (20260508-142738-bootstrap) was the first push, its manifest entry will be backfilled before the first weekly auto-rebuild lands. Subsequent rebuilds (Mon 06:00 UTC) auto-publish.

Why docs.frem.sh/changelog and not www.frem.sh/changelog

The audience for release notes is operators and developers using fremforge, the same audience already reading docs.frem.sh. Marketing copy lives at www.frem.sh. Keeping the changelog colocated with the docs site means: (1) one Hugo build, one navigation surface; (2) the runner-image manifest sub-page can be auto-generated by the rebuild pipeline writing to the same content tree; (3) deep-links from runbooks and docs pages stay same-origin.

Related

Last updated: 2026-07-07.