GitLab - Package Updates

[Package Updates]

[1.116.0]

• Update gitlab-foss to 19.0.0
• Full Changelog

[Package Updates]

[1.116.1]

• Update gitlab-foss to 19.0.1
• Full Changelog

[Package Updates]

[1.116.2]

• Update gitlab-foss to 19.0.2
• Make CI cache limit per job configurable by admins
• Allow job token basic auth for generic package upload
• Add fat manifest types to container registry Accept
• Ensure uploads.id has the correct default
• Patching deployment bigint swap for missing index

[Package Updates]

[1.117.0]

• Update gitlab-foss to 19.1.0
• Full Changelog

[Package Updates]

[1.117.1]

• Update gitlab-foss to 19.1.1
• Fix versionless Maven metadata protected package bypass (merge request)
• Filter notes by readable_by? in Rapid Diffs commit discussions (merge request)
• Detect encoding collisions in snippet hidden file detection (merge request)
• Fix DNS rebinding SSRF in pull and push mirror services (merge request)
• Fix IDOR in virtual registry cleanup policy REST API (merge request)
• Exclude registry-disabled projects from group packages endpoints (merge request)
• Restrict DAST site profile modification when secrets are present (merge request)
• Fix Web IDE asset security header bypass (merge request)
• Restrict value_stream data source filters to known fields (merge request)
• Mask pipeline schedule variable values in API logs (merge request)
• Prevent protected environments access when CI/CD is disabled (merge request)
• Stop leaking detected secrets in Duo workflow job traces (merge request)
• Fix authorization bypass in securityMetrics.riskScore.byProject (merge request)

[Package Updates]

[1.117.2]

• scale puma worker count to the processor count
• increase queue concurrency

[Package Updates]

[1.117.3]

• Reduce puma worker count

[Package Updates]

[1.117.4]

• Reduce logging

[Package Updates]

[1.117.5]

• Update gitlab-foss to 19.1.2
• Full Changelog
• Fix approval rule override regression for Developer MR authors GitLab Enterprise Edition
• Remove ActiveUserCountThresholdWorker cron schedule GitLab Enterprise Edition
• Backfill NULL organization_id on oauth_applications
• Make ci_finished_builds engine swap work on ClickHouse 23.x
• Clear stored password when pull mirror destination changes (merge request)
• Address private project cross-references visibility issue (merge request)
• Treat failing markup renders as plain text (merge request)
• Sanitize vulnerability detail keys to prevent XSS via thAttr injection (merge request)
• Fix tag/branch ambiguity in blob view (merge request)
• Fix WorkItems auth bypass for Minimal Access users (merge request)

[Package Updates]

[1.117.6]

• hardcap worker to 4

[Package Updates]

[1.118.0]

• Update gitlab-foss to 19.2.0
• Full Changelog
• Make automatic rebase before merge generally available (merge request)
• Promote granular personal access tokens to GA (merge request)
• Update custom flows from beta to GA (merge request)
• Promote dependency management auto-remediation to Beta (merge request)
• Remove securityPoliciesSyncStatus GraphQL query (merge request)
• Dropping security_training_providers table (merge request)
• Drop trending_projects table and remove FK (merge request)
• Fix branches API offset pagination returning empty pages (merge request)
• Fix rules:changes net diff for reverted files in MR pipelines (merge request)
• Prevent no-op rebase collapse from deleting MR source branch (merge request)