Forgejo: API call for statuses causes 400 errors

[Freddy500]

How are you running Renovate?

Self-hosted Renovate

Which platform you running Renovate on?

Forgejo

Which version of Renovate are you using?

42.62.0

Please tell us more about your question or problem

I'm setting up Renovate on a self-hosted Forgejo repo hosting Podman Quadlet files. Renovate is setup to merge minor updates automatically. It creates the branches but then fails to update with a Response code 400 (Bad Request) error. An example of the urls that fail ishttps://forgejo.xx.com/api/v1/repos/xx/repo/commits/renovate%2Fghcr.io-mealie-recipes-mealie-3.x/statuses.

Could this be a bug in the current version of Renovate related to the api path being renovate%2Fghcr.io-mealie-recipes-mealie-3.x/statuses instead of renovate/ghcr.io-mealie-recipes-mealie-3.x/statuses or is this is a misconfiguration on my end? In a browser the first path gives me a 400 error as well and the second path seems to work.

Thank you.

Logs (if relevant)

Logs

DEBUG: syncBranchState(): Branch cache not found, creating minimal branchState (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: getBranchPr(renovate/ghcr.io-mealie-recipes-mealie-3.x) (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: findPr(renovate/ghcr.io-mealie-recipes-mealie-3.x, undefined, open) (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: branchExists=false (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: dependencyDashboardCheck=undefined (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Check for closed PR because recreating closed PRs is disabled. (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: findPr(renovate/ghcr.io-mealie-recipes-mealie-3.x, Update ghcr.io/mealie-recipes/mealie Docker tag to v3.7.0, !open) (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: prAlreadyExisted=false (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Open PR Count: 0, Existing Branch Count: 5, Hourly PR Count: 0 (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: prHourlyLimit of the upgrades present in this branch (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "limits": [{"depName": "ghcr.io/mealie-recipes/mealie", "prHourlyLimit": 10}]
DEBUG: Calculated lowest prHourlyLimit among the upgrades present in this branch is 10. (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: branchConcurrentLimit of the upgrades present in this branch (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "limits": [{"depName": "ghcr.io/mealie-recipes/mealie", "branchConcurrentLimit": null}]
DEBUG: Calculated lowest branchConcurrentLimit among the upgrades present in this branch is 10. (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Checking schedule(schedule=at any time, tz=null, now=2025-12-18T13:30:53.518Z) (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: No schedule defined (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Converting rebaseWhen=auto to rebaseWhen=behind-base-branch because automerge=true (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Branch needs creating (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Using reuseExistingBranch: false (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Setting current branch to main (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: latest commit (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "branchName": "main",
       "latestCommitDate": "2025-12-18T14:19:58+01:00",
       "sha": "b235f11cd5af2f1e5b48014128a725fd769a34fb"
DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Starting search at index 176 (repository=xx/repo, packageFile=mealie/mealie-server.container, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "depName": "ghcr.io/mealie-recipes/mealie"
DEBUG: Found match at index 176 (repository=xx/repo, packageFile=mealie/mealie-server.container, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "depName": "ghcr.io/mealie-recipes/mealie"
DEBUG: Contents updated (repository=xx/repo, packageFile=mealie/mealie-server.container, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "depName": "ghcr.io/mealie-recipes/mealie"
DEBUG: updateArtifacts for updatedPackageFiles (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Updated 1 package files (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: No updated lock files in branch (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: 1 file(s) to commit (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: Preparing files for committing to branch renovate/ghcr.io-mealie-recipes-mealie-3.x (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: git commit (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "deletedFiles": [],
       "ignoredFiles": [],
       "result": {
         "author": null,
         "branch": "renovate/ghcr.io-mealie-recipes-mealie-3.x",
         "commit": "672f1828e1ab4d67ffd11fe1889e40df92e41045",
         "root": false,
         "summary": {"changes": 1, "insertions": 1, "deletions": 0}
       }
DEBUG: Pushing refSpec renovate/ghcr.io-mealie-recipes-mealie-3.x:renovate/ghcr.io-mealie-recipes-mealie-3.x (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: git push (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "result": {
         "pushed": [
           {
             "deleted": false,
             "tag": false,
             "branch": true,
             "new": true,
             "alreadyUpdated": false,
             "local": "refs/heads/renovate/ghcr.io-mealie-recipes-mealie-3.x",
             "remote": "refs/heads/renovate/ghcr.io-mealie-recipes-mealie-3.x"
           }
         ],
         "ref": {
           "local": "refs/remotes/origin/renovate/ghcr.io-mealie-recipes-mealie-3.x"
         },
         "remoteMessages": {
           "all": [
             "Create a new pull request for 'renovate/ghcr.io-mealie-recipes-mealie-3.x':",
             "https://forgejo.xx.com/xx/repo/compare/main...renovate/ghcr.io-mealie-recipes-mealie-3.x"
           ]
         }
       }
DEBUG: Setting current branch to main (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
DEBUG: latest commit (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "branchName": "main",
       "latestCommitDate": "2025-12-18T14:19:58+01:00",
       "sha": "b235f11cd5af2f1e5b48014128a725fd769a34fb"
 INFO: Branch created (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "commitSha": "672f1828e1ab4d67ffd11fe1889e40df92e41045"
DEBUG: GET https://forgejo.xx.com/api/v1/repos/xx/repo/commits/renovate%2Fghcr.io-mealie-recipes-mealie-3.x/statuses = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=400 retryCount=0, duration=1) (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
 WARN: Error updating branch (repository=xx/repo, branch=renovate/ghcr.io-mealie-recipes-mealie-3.x)
       "err": {
         "name": "HTTPError",
         "code": "ERR_NON_2XX_3XX_RESPONSE",
         "timings": {
           "start": 1766064654243,
           "socket": 1766064654243,
           "lookup": 1766064654243,
           "connect": 1766064654243,
           "secureConnect": 1766064654243,
           "upload": 1766064654243,
           "response": 1766064654243,
           "end": 1766064654244,
           "phases": {
             "wait": 0,
             "dns": 0,
             "tcp": 0,
             "tls": 0,
             "request": 0,
             "firstByte": 0,
             "download": 1,
             "total": 1
           }
         },
         "message": "Response code 400 (Bad Request)",
         "stack": "HTTPError: Response code 400 (Bad Request)\n    at Request.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:103:5)",
         "options": {
           "headers": {
             "user-agent": "Renovate/42.62.0 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "authorization": "***********",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://forgejo.xx.com/api/v1/repos/xx/repo/commits/renovate%2Fghcr.io-mealie-recipes-mealie-3.x/statuses",
           "hostType": "forgejo",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         },
         "response": {
           "statusCode": 400,
           "statusMessage": "Bad Request",
           "body": "",
           "headers": {
             "alt-svc": "h3=\":443\"; ma=2592000",
             "date": "Thu, 18 Dec 2025 13:30:55 GMT",
             "content-length": "0"
           },
           "httpVersion": "1.1",
           "retryCount": 0
         }
       }

[jortgies]

I am observing the same problem. Are you using traefik and have recently upgraded to v3.6.4? It looks like the new update changed some things regarding encoded characters in the request path. See this upgrade notice.

What fixed this for me was adding the allowEncodedSlash: true option to my config. I updated my helm values with the following:

ports:
  websecure:
    http:
      encodedCharacters:
        allowEncodedSlash: true

[Freddy500]

Thank you @jortgies, this security update in Traefik v3.6.4 was indeed the cause. Adding allowEncodedSlash: true to the entrypoint solved it.

If it would be viable to remove this one encoded slash in the statuses path then an issue could be created for that. Otherwise the above works (not sure how much of a security issue it poses to enable this).