The hardware and governance risks of the Forgejo 10.0 surge

GitLab requires 16 GB of RAM for a single-node deployment, while Forgejo operates on 512 MB. This difference defines the hardware choice for most self-hosters. GitLab bundles PostgreSQL, Redis, Sidekiq, Puma, Nginx, and Gitaly into one massive container to support its features. Because GitLab’s Omnibus container bundles PostgreSQL, Redis, Sidekiq, Puma, Nginx, and Gitaly into a single image, the entire platform scales its resource requirements together, which often forces users toward expensive, high-spec servers. I would skip GitLab if your budget only covers a $5 VPS. Forgejo runs easily on a Raspberry Pi or a low-cost VPS. Gitea also runs on a Raspberry Pi 3 for small workloads. Gitea requires 1 GB of RAM and 2 CPU cores for small teams. Forgejo and Gitea are both written in Go, which allows them to remain lightweight. The governance split in 2022 created this distinction. Gitea moved toward a commercial model under Gitea Ltd., leading contributors to form Forgejo under the nonprofit Codeberg e.V. Gitea has roughly 57,500 stars on GitHub, while Forgejo mirror repositories show around 11,000 stars. Codeberg grew from 300,000 repositories in November 2025 to over 650,000 projects by June 2026. The Netherlands government chose Forgejo for its code.overheid.nl instance in May 2026 to keep code under domestic jurisdiction.

A 2026 benchmark study by independent DevOps performance analysts found that GitLab requires 4 GB of RAM and 4 CPU cores for moderate workloads. In a test with 1,000 concurrent users and 100 active repositories, GitLab’s average response time increased by 40% under peak load. Gitea demonstrated 30-50% faster response times than GitLab in similar 2026 tests. Gitea achieved an average response time of 120 ms for 50 concurrent users, whereas GitLab hit 200 ms. A 2026 benchmark report from the Open Source Software Performance Lab found that Gitea requires as little as 1 GB of RAM and 1 CPU core for basic operations.

Vulnerabilities and Versioning Risks

Security patches present a direct risk for teams using older Forgejo versions. The CVE-2026-82556 vulnerability affects the Repository Migration Handler through the net.LookupIP function in services/migrations/allowlist/is_migrate_allowed.go. This server-side request forgery flaw allows remote attackers to exploit the system. The vulnerability was published on August 30, 2026. The vulnerability was reserved on August 29, 2026. Maintainers stated that the fix will not be backported to versions 15 or 16. This makes the patch a breaking change. If you run Forgejo 15 or 16, you cannot apply this specific fix without upgrading to a newer version. Public PoC code was available on August 30, 2026, and this code provides a method for weaponization that could lead to ransomware.

Migration from Gitea also carries versioning risks. Forgejo only supports a drop-in upgrade from Gitea v1.22 or earlier. If you use Gitea 1.23 or higher, you must use the Forgejo migration tool to import your repositories, issues, and pull requests. GitLab also faces security concerns. GitLab issued a coordinated security release on July 29, 2026, for versions 19.2.1, 19.1.3, and 19.0.5. These flaws involved data exposure and CI/CD pipeline manipulation. GitLab has a larger attack surface because it bundles so many features. Forgejo remains licensed under GPLv3+, while Gitea uses the MIT license.

Pipeline and Workflow Choices

Pipeline configuration differs between the monolithic GitLab and the lightweight forges. GitLab has advanced features like epics, roadmaps, and advanced boards. It also includes container and package registries with deep integration. GitLab 16.10 includes performance optimizations for large-scale deployments. However, a 2026 test of 1,000 concurrent users showed GitLab’s average response time increased by 40% under peak load. GitLab also has access to SAST, DAST, and dependency scanning. Forgejo and Gitea use GitHub-compatible YAML for their actions. Forgejo Actions uses the .forgejo/workflows/ directory. Forgejo released Runner 13.0.0 in August 2026. Gitea released Runner 3.0.0 in July 2026. Forgejo’s v16 line added HTTP APIs for Actions artifacts and workflow logs. Forgejo’s v16 line also added OIDC tokens and concurrency blocks. These features help during hybrid migrations. GitLab CI/CD remains more mature with features like DAG pipelines and multi-project pipelines.

SourceHut offers a different model entirely. It uses email-driven workflows and mailing-list patches instead of web pull requests. You pay between $4 and $12 per month for access to all services. Gentoo Linux moved to Codeberg in February 2026 to avoid mandatory Copilot integration. Do you actually need a full DevOps suite for a simple repo? I recommend Forgejo for most small teams.