Release notes

1.17.5

Release date: 2026-11-11
GitLab build: 19.5.5_0

Highlights

GitLab CE 19.5.5 updates the Git bundled with Gitaly to 2.56.1, which closes a critical heap-based buffer overflow (CVE-2026-105437) through which arbitrary commands could run in the Gitaly environment; update every installation.

Improvements

GitLab trusts the CA certificates of the system trust store on its gRPC connections over TLS, to Gitaly among others.

Fixes

• On an installation served under a relative URL root, such as /gitlab, the streamed Rapid Diffs paths keep the root.
• GitLab retries the Google Cloud Storage default credentials after a timeout of the metadata server.

Security updates

CVE-2026-105437, critical: a heap-based buffer overflow in Git could cause out-of-bounds writes to the heap and run arbitrary commands in the Gitaly environment. Gitaly 19.5.5 bundles Git 2.56.1, which closes the vulnerability, in every delivery.

Dependencies

GitLab CE: 19.5.3 → 19.5.5.

1.17.4

Release date: 2026-11-08
GitLab build: 19.5.3_3

Highlights

• With Istio STRICT mTLS on, the ingress controller must run in the Istio mesh: the chart no longer opens a plaintext exception for the workhorse port, so an ingress controller outside the mesh cannot reach the installation (Helm Chart).
• Epics, work item weights and health status are on by default: issues, tasks, tickets and epics get a weight, parents and milestones roll it up, and projects and groups get epics as early access behind the fe_epics feature flag.
• System emails are sent by Deckhouse Code <deckhouse-code@host>: the old default sender is replaced even where it was set explicitly.
• The scanner images of scan execution policies are served from the Deckhouse registry registry.deckhouse.ru/deckhouse/ee/packages/code/images; an installation that mirrors them changes the path with the FE_SCANS_IMAGE_REGISTRY environment variable (Enterprise Edition).
• Advanced search no longer returns error 500 to group members on instances upgraded from GitLab older than 17.4.

New features

• The security policy editor names, under the save button, the policy project the merge request goes to and warns with the reason when the save cannot create it, as early access (Enterprise Edition).
• The policy editor lists the reasons a security policy cannot be saved in the form and in .yaml mode: a YAML parse error with its line, a missing name or trigger, an invalid cadence or CI stage, scan options that fail their checks, and the missing include or schedule of pipeline execution policies, as early access (Enterprise Edition).
• Project-level and group epics, as early access behind the fe_epics feature flag: projects get their own epics, issues convert into epics and back, advanced search finds them, boards show them as cards, and group epics carry fixed or inherited dates, a color and blocking links between work items.
• The PT AI and CodeScoring integrations take the registry login and password of their scan image, as a CI/CD variable name or as the value itself (Enterprise Edition).
• The admin Web IDE section gets the Enable host domain setting: with it off, the Web IDE loads from the GitLab origin without pinging the extension host; Enable single origin fallback is on by default, and turning both settings off is rejected.
• A beta AppSec.Hub integration behind the appsec_hub_integration feature flag, off by default: an appsec_hub scan fails the pipeline when the application’s quality gates fail and writes its findings as the pipeline’s security reports, and the reports of the other scanners go to the application (Enterprise Edition).
• Helm Chart:
  • The helm notes warn when the release runs fewer than three Gitaly or Praefect replicas, the configuration without high availability, and name the current values.

Improvements

• A level word or a CVSS label in a case name of a custom JUnit report no longer turns an ordinary failed test into a finding: the Tests tab reads a test case’s severity only from its severity property.
• The scanner images shipped for scan execution policies are served from the Deckhouse registry registry.deckhouse.ru/deckhouse/ee/packages/code/images: CodeScoring and PT AI run them by default, the policy editor fills a new Trivy action with the Trivy image, and the registry credentials of a policy or an integration apply to them; an installation that mirrors the images changes the path with the FE_SCANS_IMAGE_REGISTRY environment variable (Enterprise Edition).
• Secrets found by the Trivy image scan are moved to a separate secret_detection report that names the image each secret was found in, so DefectDojo no longer refuses the whole import; the Vulnerability report no longer links these secrets to a file of the repository (Enterprise Edition).
• A scanner image named with both a tag and a digest, as Renovate and Dependabot pin images, is accepted in the Opengrep, Gitleaks and PT AI integrations, the Trivy and AppSec.Hub scan images and the images of the container scan, and a single Docker Hub name such as postgres:15-alpine is accepted everywhere, as early access (Enterprise Edition).
• The certificate trust section of the CodeScoring, PT AI and DefectDojo integration forms is renamed to “TLS settings” (Enterprise Edition).
• System emails are sent by Deckhouse Code <deckhouse-code@host> by default: the name “GitLab” and the address gitlab@host are replaced even where they were set explicitly, and any other name or address is kept.
• Epics, work item weights and health status are on by default: issues, tasks, tickets and epics get a weight, and issues, tickets and epics a health status; parents show the rolled-up weight of their children, epics count the health status of their open children, boards and lists show both, and milestones show the total weight, group milestones including group epics; search results label comments on epics as epic comments, an open epic page shows new dates as soon as its children change them, and the REST work items API adds and removes links after an item is created.
• Helm Chart:
  • The pod and container securityContext of every component matches the module: the HAProxy load balancer, the certificates init container, toolbox, sidekiq, migrations, Gitaly with its capabilities and the privileged init-cgroups init container, Praefect, GitLab Pages, gitlab-exporter, mailroom and the container registry; Deckhouse SecurityPolicyException bindings cover the Gitaly cgroups and certificates containers.
  • The ServiceMonitors label the scraped jobs with stable component names and carry the release name on the series, so several releases in one namespace are monitored and alerted independently, and the workhorse metrics get a job of their own instead of being shadowed by webservice; the alert rules and the Grafana dashboard use the stable job names.
  • The registry storage config Secret generated from externalSecrets is connected to the registry automatically: registry.storage.secret and key no longer need to be set.

Fixes

• The error shown when adding a work item of a type that cannot be a child names the type again instead of reporting the item as not found.
• Advanced search no longer returns error 500 to group members on instances upgraded from GitLab older than 17.4.
• The vulnerability report warns above the severity tiles which scan jobs did not finish or whose report could not be read, marks such a pipeline in the Pipelines card, and takes each day of the trend from the last pipeline whose scans all finished, instead of counting an unfinished scan as a scan with no findings, as early access (Enterprise Edition).
• A link to a finding of the vulnerability report opens the same pipeline and the same finding after a newer pipeline ran on the same day: the link names the pipeline by its ID and the finding by its key; links copied before the update stop opening the same finding, as early access (Enterprise Edition).
• The security policy editor stays open with the error and the submitted YAML when a save is refused, instead of redirecting to the settings page and losing the input; the raw policy YAML field on the settings page keeps the refused text, as early access (Enterprise Edition).
• The registry login of a scan policy only pulls the scanner image and no longer replaces the runner’s and project’s DOCKER_AUTH_CONFIG in scanner jobs, as early access (Enterprise Edition).
• Findings of PT AI scans reach DefectDojo: the PT AI scan job marks the report of a finished scan as successful, except a black box scan whose sign-in failed, so the upload no longer skips them, as early access (Enterprise Edition).
• The merge request test summary title names what the summary holds, tests, security scans, or both, instead of always saying “Security scans summary”.
• The protected tags page, the protected branch and tag access level lists and the account deletion page of the Russian interface no longer show English strings.
• Search results include group wiki pages for members of the group’s projects.
• Search results include the group epics and milestones of a private group for members of its projects.
• A scan execution policy that names a scanner more than once shows the first action of the scanner, the one the pipeline runs, in the policy details and the editor, and a changed policy that repeats a scanner can no longer be saved, as early access (Enterprise Edition).
• A new scan execution policy opens with no scanner selected instead of Gitleaks preselected and cannot be saved until a scanner is picked, as early access (Enterprise Edition).
• A policy whose scanner image path has capital letters, which Docker refuses, can no longer be saved, and a policy already stored with one is not applied until the image reference is fixed, as early access (Enterprise Edition).
• Helm Chart:
  • Setting two sources for one secret fails the render: remove registry.storage.secret and key when externalSecrets provides the registry storage config, and likewise the object storage connection together with externalSecrets.s3, and the PostgreSQL, Redis, Praefect and Registry database password secrets together with their externalSecrets entries.
  • The render fails with an explanation when global.codeHelm.kubeRbacProxy.enabled is set without global.serviceAccount.enabled, the configuration in which every metrics scrape returned 401.
  • The tls.internal check lists the components that have tls.enabled and no secretName while internal TLS generation is off, and Gitaly TLS without Praefect and a secretName fails the render.

Upgrade notes

• A custom JUnit report that sets a test case’s level only by the first word of the case name must add a severity property: a level word or a CVSS label in a case name no longer marks the test as a finding.
• The DefectDojo product type is required while automatic context creation is on: settings without a product type, including ones saved earlier, can no longer be saved or tested, and the project and group PUT …/integrations/defect-dojo requests answer 400; the integration form picks the product type from the types DefectDojo has or takes a typed name, and changing the URL clears the saved API token unless a new one is entered with it, as early access (Enterprise Edition).
• Pipeline execution policies left in .deckhouse_code/security-policies/policy.yml are ignored: they are stored in .deckhouse_code/execution-policies/policy.yml now, as early access (Enterprise Edition).
• CodeScoring policies no longer set the registry credentials of the scan image: move them from FE_SCANS_REGISTRY_LOGIN_VARIABLE and FE_SCANS_REGISTRY_PASSWORD_VARIABLE to the integration; the CodeScoring scan job image is required now (Enterprise Edition).
• Secrets found by the Trivy image scan are counted as new findings once, on the first scan after the update (Enterprise Edition).
• Helm Chart:
  • In the STRICT mode of the Istio integration the workhorse port is no longer excepted from mTLS: the ingress controller must run in the Istio mesh with an injected sidecar, otherwise it cannot reach the installation (see Configuration).

Docs

• Deckhouse Kubernetes Platform module:
  • The documentation describes the Git storage high availability requirement: at least three Gitaly replicas and three Praefect replicas, with spec.gitData.replicas=3 because the HA mode defaults to two Gitaly replicas.

1.17.3

Release date: 2026-10-28
GitLab build: 19.5.3_0

Highlights

• GitLab CE is updated to 19.5.3.
• Helm Chart: the HAProxy load balancer can pass the client IP address to ingress-nginx and GitLab Shell with PROXY protocol v2, and GitLab Shell runs gitlab-sshd by default.
• The component images of the Helm Chart and the Deckhouse Kubernetes Platform module distrust the CA certificates of the eMudhra key compromise of October 2026; check the certificate chains of the servers the installation connects to.
• Deckhouse Kubernetes Platform module: a Gitaly replicas value below 3 in the HA mode is accepted with a warning.

New features

• Helm Chart:
  • The global.codeHelm.loadbalancer.proxyProtocol value makes HAProxy send PROXY protocol v2 to ingress-nginx and GitLab Shell, so they see the client IP address. Turn use-proxy-protocol on in the external ingress-nginx before the value, or web traffic fails; GitLab Shell must run gitlab-sshd with config.proxyProtocol: true, which checkConfig enforces.
  • The global.codeHelm.loadbalancer.frontendProxyProtocol value makes HAProxy require the PROXY protocol header on ports 80, 443 and 22, for an upstream proxy or a cloud load balancer that sends it. With a transparent load balancer in front, all traffic fails.
• Deckhouse Kubernetes Platform module:
  • The module namespace carries the extended-monitoring.deckhouse.io/enabled label, so the extended monitoring of Deckhouse Kubernetes Platform covers it.

Improvements

• Helm Chart:
  • The HAProxy load balancer Service has externalTrafficPolicy: Local: the client IP address is kept and traffic goes only to the nodes that run an HAProxy pod.
• Deckhouse Kubernetes Platform module:
  • A Gitaly replicas value below 3 in the HA mode is accepted with a warning; a value below 2 was rejected before.

Fixes

• Omnibus Docker:
  • The files needed only for developing GitLab are removed from /opt/gitlab/embedded/service/gitlab-rails in the package.
• Helm Chart and Deckhouse Kubernetes Platform module:
  • The files needed only for developing GitLab are removed from the gitlab-rails image.
  • Ruby in the component images carries two patches to its garbage collector: it no longer writes to call caches and environments that are already marked, so the memory pages Puma and Sidekiq share with their forked workers stay shared and the processes use less memory.

Security updates

• Helm Chart and Deckhouse Kubernetes Platform module:
  • The component images distrust the CA certificates of the eMudhra key compromise of October 2026. They are removed from the system trust store at build and from the mounted custom CA bundles at start, so a TLS connection to a webhook, mirror, SMTP, LDAP or OIDC server whose chain ends in one of them fails.

Upgrade notes

• Helm Chart:
  • GitLab Shell runs gitlab-sshd with config.proxyProtocol: true by default instead of OpenSSH. gitlab-sshd also accepts plain connections, so SSH keeps working with the load balancer off; set gitlab.gitlab-shell.sshDaemon to keep OpenSSH.

Dependencies

• GitLab CE: 19.5.1 → 19.5.3.
• Helm Chart and Deckhouse Kubernetes Platform module:
  • Go in the component images: 1.27.2 → 1.27.3.

1.17.2

Release date: 2026-10-26
GitLab build: 19.5.1_2

Highlights

• GitLab CE 19.5.1 closes a critical integer overflow in the regular expression compiler of Ruby (CVE-2026-110264) and an authentication bypass through the LDAP email lookup used when linking OmniAuth accounts (CVE-2026-15723); update every installation.
• Code Owners approval is set per branch rule with the “Require code owner approval” toggle; the project-wide checkbox that disabled the checks is gone, and a project that had it on gets the toggle off on every branch rule after the upgrade.
• Pipeline execution policies arrive as early access, off by default: a policy adds the jobs of a CI/CD file from another project to the pipelines of the projects it covers, and those projects cannot skip or change the jobs (Enterprise Edition).
• A push mirror in the “Mirror matching branches” mode pushes only the branches that match its regular expression.
• The Helm Chart and the Deckhouse Kubernetes Platform module no longer set the tlskyber GODEBUG setting that Go 1.24 removed, so the Go components built with Go 1.27 start.

New features

• Pipeline execution policies, as early access, off by default behind the fe_pipeline_execution_policies feature flag: a policy adds the jobs of a CI/CD file from another project to every pipeline of the projects it covers, or runs them on a schedule, and those projects cannot skip or change the jobs; the admin setting “Pipeline execution policies” under Admin > Settings > CI/CD limits how many policies apply, and the project settings section “Pipeline execution policies” is renamed to “Pipeline execution policy file access” (Enterprise Edition).
• Registry credentials for the Trivy image of scan execution policies, as early access: the action variables FE_SCANS_REGISTRY_LOGIN_VARIABLE and FE_SCANS_REGISTRY_PASSWORD_VARIABLE apply to every Trivy scan, including the Trivy image shipped with the product, and the policy editor shows them in the common Trivy settings; the container image scan and the cluster scan keep using the project’s DOCKER_AUTH_CONFIG for the images they scan (Enterprise Edition).

Improvements

• The project checkbox “Disable Code Owners approval checks” is replaced with the “Require code owner approval” toggle on each branch rule; Code Owners are skipped only when the toggle is off in every rule that matches the target branch, so a * rule does not override a separate rule for the default branch; in a project that had the checkbox on, the toggle is off on all branch rules after the upgrade.
• The hints of the Trivy scan form in the scan execution policy editor and their Russian translation are rewritten, as early access: each hint says what the field does and how to fill it, and the English texts use “license” throughout (Enterprise Edition).

Fixes

• The lifecycle metrics panel of the Value streams dashboard showed “Something went wrong” for users with the Russian locale (Enterprise Edition).
• Russian emails about expiring access and deploy tokens and about projects and groups scheduled for deletion: the number of days reads “7 дней” instead of “7 деньs”, and the token emails build their reason, role and subject in the recipient’s language.
• A push mirror in the “Mirror matching branches” mode pushed every branch; it now pushes only the branches that match its regular expression, rejects an expression that is not valid RE2, and reports an error and pushes nothing when no branch matches.
• The approval rule of a protected environment is kept when its only approver, a user or a group, is deleted: the rule switches to the Maintainer role, deployments to the environment still require approval, and the change is recorded in the audit log.
• The save mode dropdown in the wiki page editor: screen readers read out the source of a translation call instead of its label; the label is translated into Russian.
• Jaga smart commits, as early access, logged work time and ran the remaining commands when the task could not move to the named status; such a commit now stops at the status command, and a failed Jaga sign-in logs the authentication endpoint.
• The Test settings button of the CodeScoring integration, as early access, reported “Connected” for any API token; it checks the token against the CodeScoring API and says when CodeScoring rejects it (Enterprise Edition).
• Scan execution policies that fail validation, as early access, looked enabled; the policy list and the policy details mark such a policy as invalid and not enforced and list the errors, and the warning in the log names the policy project that holds the file (Enterprise Edition).
• Helm Chart:
  • The GODEBUG variable of the webservice, sidekiq and toolbox pods no longer carries the tlskyber setting that Go 1.24 removed; Workhorse built with Go 1.27 failed at start with it, and now keeps the chart default tlsmlkem=0.
• Deckhouse Kubernetes Platform module:
  • Gitaly, Praefect, Shell, Workhorse, the container registry and Pages start with GODEBUG=tlsmlkem=0; the tlskyber setting that Go 1.24 removed made a component built with Go 1.27 fail at start.

Security updates

• CVE-2026-110264, critical: an integer overflow in the regular expression compiler of Ruby. The product and the component images of the module carry the patch.
• CVE-2026-15723, high: improper authentication in the email lookup that links an OmniAuth sign-in to an LDAP account.
• CVE-2026-112212, high: cache poisoning of the OAuth and OIDC discovery endpoints; their URLs are now built from the configured instance address.
• CVE-2026-12664, medium: the work item email address field in GraphQL was readable with a read-only token.
• CVE-2026-105777, medium: internal credentials in response headers were not stripped when the header name used a different casing.
• CVE-2026-13319, medium: an authorization bypass in the group milestones API through an unchecked parameter.
• CVE-2026-105711, low: the merge request title stayed in a cached page fragment.

Docs

• Deckhouse Kubernetes Platform module:
  • The Russian network page describes the headless Service of Gitaly: Praefect reaches each Gitaly node through its pod DNS name, and in the Istio STRICT mode the sidecars set up mutual TLS between Praefect and Gitaly per pod.

Dependencies

GitLab CE: 19.5.0 → 19.5.1.

1.17.0

Release date: 2026-10-19
GitLab build: 19.5.0_0

Highlights

• Security scanning comes to projects as early access: scan execution policies run Opengrep, Trivy and CodeScoring in a project’s pipelines, and the findings reach the Dependency list, License compliance and DefectDojo (Enterprise Edition).
• GitLab CE 19.5.0 closes a timing attack on alert webhook tokens and a CI configuration path readable without the read_code permission.
• The Deckhouse Kubernetes Platform module no longer holds an upgrade while GitLab background migrations are failed or still running.

New features

• SAST scanning with Opengrep, as early access: a scan execution policy adds a mandated scan to a project’s pipelines that looks for vulnerabilities in its source code; the project cannot switch the scan off or change its settings (Enterprise Edition).
• Scanning with Trivy, as early access: a scan execution policy runs Trivy in a project’s pipelines to check its dependencies for vulnerabilities and licenses, its repository for committed secrets and its container images for vulnerabilities (Enterprise Edition).
• The Dependency list and License compliance pages of a project, as early access: they show the components of the SBOM a security scan uploaded to the latest pipeline, and the licenses those components are distributed under (Enterprise Edition).
• The CodeScoring integration, as early access: a project connects to a self-hosted CodeScoring server, and a scan execution policy runs its software composition analysis and secret search in the project’s pipelines (Enterprise Edition).
• Security scanner integrations for CodeScoring, PT AI and DefectDojo, as early access: they hold the server address, the token and the certificate trust that the mandated scans need, so a scan policy keeps no secrets in its repository (Enterprise Edition).
• The DefectDojo integration, as early access: the security scan reports of a project’s pipelines are sent to a DefectDojo instance, and the findings there are kept up to date as pipelines run (Enterprise Edition).

Improvements

• Helm Chart:
  • The container registry migrations job runs as a post-install and post-upgrade hook and is recreated on every upgrade, so a change of values no longer fails the upgrade on the immutable job template.
• Deckhouse Kubernetes Platform module:
  • An upgrade proceeds when GitLab background migrations have failed or are still running; the operator writes a warning to its log instead of stopping.

Security updates

GitLab CE 19.5.0 closes a timing attack on alert webhook tokens and a CI configuration path readable through GraphQL without the read_code permission; sidekiq-cron, Gitaly and GitLab Pages are upgraded with their own security fixes.

Docs

The module documentation keeps the module-specific pages only; the sections on security recommendations, maintenance and the FAQ that the product documentation now covers are replaced with links to it.

Dependencies

• GitLab CE: 19.4.2 → 19.5.0.
• GitLab Elasticsearch Indexer: 5.14.14 → 5.14.17.
• Helm Chart and Deckhouse Kubernetes Platform module:
  • Go in the component images: 1.26.9 → 1.27.2.

1.16.9

Release date: 2026-11-12
GitLab build: 19.4.7_0

Highlights

• An installation that keeps object storage in Google Cloud Storage with application default credentials gets its credentials again after a metadata server timeout, without a restart.
• A push that creates many branches or tags is checked against the protected branch rules without a Redis request per ref.

Improvements

• When a push creates many refs, GitLab matches them against the protected branch rules in memory, without a Redis request per ref.
• In a project that never produced Language Server Index Format (LSIF) artifacts, code navigation skips the Gitaly and pipeline lookups.

Fixes

• With object storage in Google Cloud Storage and application default credentials, a metadata server timeout no longer breaks every later credentials lookup until the process restarts: GitLab resets the cached result and retries once.
• The oj JSON library is updated to 3.17.8, which fixes memory handling bugs.

Dependencies

GitLab CE: 19.4.6 → 19.4.7.

1.16.8

Release date: 2026-11-11
GitLab build: 19.4.6_0

Highlights

GitLab CE 19.4.6 updates the Git bundled with Gitaly to 2.56.1, which closes a critical heap-based buffer overflow (CVE-2026-105437) through which arbitrary commands could run in the Gitaly environment; update every installation.

Improvements

GitLab trusts the CA certificates of the system trust store on its gRPC connections over TLS, to Gitaly among others.

Fixes

On an installation served under a relative URL root, such as /gitlab, the streamed Rapid Diffs paths keep the root.

Security updates

CVE-2026-105437, critical: a heap-based buffer overflow in Git could cause out-of-bounds writes to the heap and run arbitrary commands in the Gitaly environment. Gitaly 19.4.6 bundles Git 2.56.1, which closes the vulnerability, in every delivery.

Dependencies

GitLab CE: 19.4.5 → 19.4.6.

1.16.7

Release date: 2026-11-05
GitLab build: 19.4.5_1

Highlights

Advanced search no longer returns error 500 to group members on instances upgraded from GitLab older than 17.4.

Fixes

On instances upgraded from GitLab older than 17.4, group members get search results again instead of error 500.

1.16.6

Release date: 2026-10-28
GitLab build: 19.4.5_0

Highlights

• The component images of the Helm Chart and the Deckhouse Kubernetes Platform module distrust the CA certificates of the eMudhra key compromise of October 2026, including the AAA Certificate Services root that cross-signs them; check the certificate chains of the servers the installation connects to.
• Ruby in the component images no longer breaks the memory pages Puma and Sidekiq share with their forked workers during garbage collection, so the processes use less memory.
• The files needed only for developing GitLab are removed from the Omnibus Docker package.

Fixes

• Omnibus Docker:
  • The files needed only for developing GitLab are removed from /opt/gitlab/embedded/service/gitlab-rails in the package.
• Helm Chart and Deckhouse Kubernetes Platform module:
  • Ruby in the component images carries two patches to its garbage collector: it no longer writes to call caches and environments that are already marked, so the memory pages Puma and Sidekiq share with their forked workers stay shared and the processes use less memory.

Security updates

• Helm Chart and Deckhouse Kubernetes Platform module:
  • The component images distrust the CA certificates of the eMudhra key compromise of October 2026: the emSign root certificates, the EM DV, OV and EV TLS and OV CS intermediates and the AAA Certificate Services root that cross-signs them. They are removed from the system trust store at build and from the mounted custom CA bundles at start, so a TLS connection to a webhook, mirror, SMTP, LDAP or OIDC server whose chain ends in one of them fails.

Dependencies

• GitLab CE: 19.4.3 → 19.4.5.
• Helm Chart and Deckhouse Kubernetes Platform module:
  • Go in the component images: 1.26.9 → 1.26.10.

1.16.5

Release date: 2026-10-22
GitLab build: 19.4.3_0

Highlights

• GitLab CE 19.4.3 closes a critical integer overflow in the regular expression compiler (CVE-2026-110264) and an authentication bypass through the LDAP email lookup used when linking OmniAuth accounts (CVE-2026-15723); update every installation that uses LDAP auto-linking.
• Six further vulnerabilities are closed, among them cache poisoning of the OAuth and OIDC discovery endpoints and an authorization bypass in the group milestones API.
• The Helm Chart mounts OpenSearch credentials given as a secret reference, and its backup, reindex and geo-logcursor jobs run the product’s toolbox image.

Improvements

• Helm Chart:
  • The upgrade check job gets default resource requests and limits (upgradeCheck.resources: 64Mi memory requested, 200m CPU and 128Mi memory limits), so clusters whose quota or admission policies reject pods without them no longer block the upgrade.

Fixes

• A fast-forward merge succeeds when a tag shares the name of the target branch.
• Workhorse answers an archive request with 429 instead of an error when Gitaly rejects it as resource exhausted.
• The sub claim of CI/CD ID tokens of fork merge request pipelines carries the job and source project claims.
• Helm Chart:
  • OpenSearch credentials given as a secret reference (username and password with secret and key) are mounted into the Rails pods; inline credentials take precedence when both are set, and a reference with one of the two missing fails the render.
  • The backup job, the database reindex job and the geo-logcursor deployment run the toolbox image listed in global.codeHelm.images; they used to compose the upstream GitLab image name and so pulled an image the installation does not ship.

Security updates

• CVE-2026-110264, critical: an integer overflow in the regular expression compiler of Ruby. The product and the component images of the module carry the patch.
• CVE-2026-15723, high: improper authentication in the email lookup that links an OmniAuth sign-in to an LDAP account.
• CVE-2026-112212, high: cache poisoning of the OAuth and OIDC discovery endpoints; their URLs are now built from the configured instance address.
• CVE-2026-12664, medium: the work item email address field in GraphQL was readable with a read-only token.
• CVE-2026-105777, medium: internal credentials in response headers were not stripped when the header name used a different casing.
• CVE-2026-13319, medium: an authorization bypass in the group milestones API through an unchecked parameter.
• CVE-2026-105711, low: the merge request title stayed in a cached page fragment.

Dependencies

• GitLab CE: 19.4.2 → 19.4.3.

1.15.5

Release date: 2026-10-28
GitLab build: 19.3.7_0

Highlights

• Jira cross-references are created when the Jira API URL of the integration differs from the address Jira reports for itself, and the integration sends no request to a host other than the configured one.
• A reply to a merge request discussion through the API no longer renders the whole thread, so replies to long threads stop loading the server.
• The component images of the Helm Chart and the Deckhouse Kubernetes Platform module distrust the CA certificates of the eMudhra key compromise of October 2026, including the AAA Certificate Services root that cross-signs them; check the certificate chains of the servers the installation connects to.

Fixes

• Jira cross-references when the Jira API URL of the integration differs from the host or context path that Jira reports in its self field: the remote link list and the update of an existing remote link are requested at the configured URL, so the comment and the remote link are created instead of failing with HTTParty::UnsafeURIError. A Jira request to another scheme, host or port than the configured site is refused before it is sent.
• A reply to a discussion through POST /projects/:id/merge_requests/:iid/discussions/:discussion_id/notes rendered every note of the thread to read the first one; the handler loads only the first note, so the cost of a reply no longer grows with the length of the thread.

Security updates

• Helm Chart and Deckhouse Kubernetes Platform module:
  • The component images distrust the CA certificates of the eMudhra key compromise of October 2026: the emSign root certificates, the EM DV, OV and EV TLS and OV CS intermediates and the AAA Certificate Services root that cross-signs them. They are removed from the system trust store at build and from the mounted custom CA bundles at start, so a TLS connection to a webhook, mirror, SMTP, LDAP or OIDC server whose chain ends in one of them fails.

Dependencies

• GitLab CE: 19.3.6 → 19.3.7.
• Helm Chart and Deckhouse Kubernetes Platform module:
  • Go in the component images: 1.26.9 → 1.26.10.

1.15.4

Release date: 2026-10-22
GitLab build: 19.3.6_0

Highlights

• GitLab CE 19.3.6 closes a critical integer overflow in the regular expression compiler (CVE-2026-110264) and an authentication bypass through the LDAP email lookup used when linking OmniAuth accounts (CVE-2026-15723); update every installation that uses LDAP auto-linking.
• Six further vulnerabilities are closed, among them cache poisoning of the OAuth and OIDC discovery endpoints and an authorization bypass in the group milestones API.

Fixes

• A fast-forward merge succeeds when a tag shares the name of the target branch.
• Workhorse answers an archive request with 429 instead of an error when Gitaly rejects it as resource exhausted.
• The sub claim of CI/CD ID tokens of fork merge request pipelines carries the job and source project claims.

Security updates

• CVE-2026-110264, critical: an integer overflow in the regular expression compiler of Ruby. The product and the component images of the module carry the patch.
• CVE-2026-15723, high: improper authentication in the email lookup that links an OmniAuth sign-in to an LDAP account.
• CVE-2026-112212, high: cache poisoning of the OAuth and OIDC discovery endpoints; their URLs are now built from the configured instance address.
• CVE-2026-12664, medium: the work item email address field in GraphQL was readable with a read-only token.
• CVE-2026-105777, medium: internal credentials in response headers were not stripped when the header name used a different casing.
• CVE-2026-13319, medium: an authorization bypass in the group milestones API through an unchecked parameter.
• CVE-2026-105711, low: the merge request title stayed in a cached page fragment.

Dependencies

• GitLab CE: 19.3.5 → 19.3.6.