Changelog and downloads for version 2.16.0

This page does not refer to the most recent version of SCM-Manager.

Go to the download of the latest Version

You never want to miss a release again? Subscribe to our release feed

2.16.0 - (2021-03-26)

This version contains several known security vulnerabilities.

If you are looking for an other version of SCM-Manager, please have a look at the archive.


Generic Linux/Unix users:

Download the package and follow the installation instructions.

Checksum (SHA256):

Windows users:

Download the package and follow the installation instructions.

Checksum (SHA256):



  • Metrics for http requests (#1586)
  • Metrics for executor services (#1586)
  • Metrics about logging, file descriptors, process threads and process memory (#1609)
  • Metrics for events (#1601)
  • Authentication and access metrics (#1595)
  • Adds metrics over lifetime duration of working copies (#1591)
  • Collect guava caching statistics as metrics (#1590)
  • Add global flag to enable/disable api keys (#1606)


  • Adjust path and filename validation to prevent path traversal (#1604)
  • Wrong subject context for asynchronous subscriber (#1601)
  • Fix repository creation route from repository namespace overview page (#1602)
  • external nav links now correctly collapse when used in a menu (#1596)
  • Response with exception stack trace for invalid urls (#1605)
  • Do not show repositories on overview for not existing namespace (#1608)


  • Show "CUSTOM" name instead empty entry for permission roles (#1597)
  • Improve error messages for invalid media types (#1607)
  • Allow all UTF-8 characters except URL identifiers as user and group names and for namespaces. (#1600)