Deprecations and removals by version

GitLab Runner registration token in Runner Operator

The runner-registration-token parameter that uses the OpenShift and Kubernetes Vanilla Operator to install a runner on Kubernetes is deprecated. Authentication tokens will be used to register runners instead. Registration tokens, and support for certain configuration arguments, will be removed in GitLab 18.0. For more information, see Migrating to the new runner registration workflow. The configuration arguments disabled for authentication tokens are:

• --locked
• --access-level
• --run-untagged
• --tag-list

This change is a breaking change. You should use an authentication token in the gitlab-runner register command instead.

Registration tokens and server-side runner arguments in gitlab-runner register command

Registration tokens and certain configuration arguments in the command gitlab-runner register that registers a runner, are deprecated. Authentication tokens will be used to register runners instead. Registration tokens, and support for certain configuration arguments, will be removed in GitLab 18.0. For more information, see Migrating to the new runner registration workflow. The configuration arguments disabled for authentication tokens are:

• --locked
• --access-level
• --run-untagged
• --maximum-timeout
• --paused
• --tag-list
• --maintenance-note

This change is a breaking change. You should create a runner in the UI to add configurations, and use the authentication token in the gitlab-runner register command instead.

Support for REST API endpoints that reset runner registration tokens

The support for runner registration tokens is deprecated. As a consequence, the REST API endpoints to reset a registration token are also deprecated and will return the HTTP 410 Gone status code in GitLab 18.0. The deprecated endpoints are:

• POST /runners/reset_registration_token
• POST /projects/:id/runners/reset_registration_token
• POST /groups/:id/runners/reset_registration_token

We plan to implement a new method to bind runners to a GitLab instance as part of the new GitLab Runner token architecture. The work is planned in this epic. This new architecture introduces a new method for registering runners and will eliminate the legacy runner registration token. From GitLab 18.0 and later, the runner registration methods implemented by the new GitLab Runner token architecture will be the only supported methods.

runnerRegistrationToken parameter for GitLab Runner Helm Chart

The runnerRegistrationToken parameter to use the GitLab Helm Chart to install a runner on Kubernetes is deprecated.

We plan to implement a new method to bind runners to a GitLab instance leveraging runnerToken as part of the new GitLab Runner token architecture. The work is planned in this epic.

From GitLab 18.0 and later, the methods to register runners introduced by the new GitLab Runner token architecture will be the only supported methods.

Atlassian Crowd OmniAuth provider

The omniauth_crowd gem that provides GitLab with the Atlassian Crowd OmniAuth provider will be removed in our next major release, GitLab 16.0. This gem sees very little use and its lack of compatibility with OmniAuth 2.0 is blocking our upgrade.

Auto DevOps support for Herokuish is deprecated

Auto DevOps support for Herokuish is deprecated in favor of Cloud Native Buildpacks. You should migrate your builds from Herokuish to Cloud Native Buildpacks. From GitLab 14.0, Auto Build uses Cloud Native Buildpacks by default.

Because Cloud Native Buildpacks do not support automatic testing, the Auto Test feature of Auto DevOps is also deprecated.

CiRunner.projects default sort is changing to id_desc

The CiRunner.projects’s field default sort order value will change from id_asc to id_desc. If you rely on the order of the returned projects to be id_asc, change your scripts to make the choice explicit.

CiRunnerUpgradeStatusType GraphQL type renamed to CiRunnerUpgradeStatus

The CiRunnerUpgradeStatusType GraphQL type has been renamed to CiRunnerUpgradeStatus. In GitLab 17.0, the aliasing for the CiRunnerUpgradeStatusType type will be removed.

DAST ZAP advanced configuration variables deprecation

With the new browser-based DAST analyzer GA in GitLab 15.7, we are working towards making it the default DAST analyzer at some point in the future. In preparation for this, the following legacy DAST variables are being deprecated and scheduled for removal in GitLab 17.0: DAST_ZAP_CLI_OPTIONS and DAST_ZAP_LOG_CONFIGURATION. These variables allowed for advanced configuration of the legacy DAST analyzer, which was based on OWASP ZAP. The new browser-based analyzer will not include the same functionality, as these were specific to how ZAP worked.

These three variables will be removed in GitLab 17.0.

Default CI/CD job token (CI_JOB_TOKEN) scope changed

In GitLab 14.4 we introduced the ability to limit your project’s CI/CD job token (CI_JOB_TOKEN) access to make it more secure. You can prevent job tokens from your project’s pipelines from being used to access other projects. When enabled with no other configuration, your pipelines cannot access other projects. To use the job token to access other projects from your pipeline, you must list those projects explicitly in the Limit CI_JOB_TOKEN access setting’s allowlist, and you must be a maintainer in all the projects.

The job token functionality was updated in 15.9 with a better security setting to allow access to your project with a job token. When enabled with no other configuration, job tokens from other projects cannot access your project. Similar to the older setting, you can optionally allow other projects to access your project with a job token if you list those projects explicitly in the Allow access to this project with a CI_JOB_TOKEN setting’s allowlist. With this new setting, you must be a maintainer in your own project, but only need to have the Guest role in the other projects.

The Limit setting was deprecated in 16.0 in preference of the better Allow access setting and Limit setting was disabled by default for all new projects. From this point forward, if the Limit setting is disabled in any project, it will not be possible to re-enable this setting in 16.0 or later.

In 17.0, we will remove the Limit setting completely, and set the Allow access setting to enabled for all projects. This change ensures a higher level of security between projects. If you currently use the Limit setting, you should update your projects to use the Allow access setting instead. If other projects access your project with a job token, you must add them to the Allow access allowlist.

To prepare for this change, users on GitLab.com or self-managed GitLab 15.9 or later can enable the Allow access setting now and add the other projects. It will not be possible to disable the setting in 17.0 or later.

In 16.3, the names of these settings were changed to clarify their meanings: the deprecated Limit CI_JOB_TOKEN access setting is now called Limit access from this project, and the newer Allow access to this project with a CI_JOB_TOKEN setting is now called Limit access to this project.

Deprecate Windows CMD in GitLab Runner

In GitLab 11.11 the Windows Batch executor, the CMD shell was deprecated in GitLab Runner in favor of PowerShell. Since then, the CMD shell has continued to be supported in GitLab Runner. However this has resulted in additional complexity for both the engineering team and customers using the Runner on Windows. We plan to fully remove support for Windows CMD from GitLab Runner in 17.0. Customers should plan to use PowerShell when using the runner on Windows with the shell executor. Customers can provide feedback or ask questions in the removal issue, issue 29479.

Deprecate CiRunner GraphQL fields duplicated in CiRunnerManager

These fields (architectureName, ipAddress, platformName, revision, version) are now deprecated from the GraphQL CiRunner type as they are duplicated with the introduction of runner managers grouped within a runner configuration.

Deprecate message field from Vulnerability Management features

This MR deprecates the message field on the VulnerabilityCreate GraphQL mutation, and in the AdditionalInfo column of the vulnerability export. The message field was removed from security reports schema in GitLab 16.0 and is no longer being used elsewhere.

Deprecate change vulnerability status from the Developer role

The ability for Developers to change the status of vulnerabilities is now deprecated. We plan to make a breaking change in the upcoming GitLab 17.0 release to remove this ability from the Developer role. Users who wish to continue to grant this permission to developers can create a custom role for their developers and add in the admin_vulnerability permission to give them this access.

Deprecate field hasSolutions from GraphQL VulnerabilityType

The GraphQL field Vulnerability.hasSolutions is deprecated and will be removed in GitLab 17.0. Use Vulnerability.hasRemediations instead.

Deprecated parameters related to custom text in the sign-in page

The parameters, sign_in_text and help_text, are deprecated in the Settings API. To add a custom text to the sign-in and sign-up pages, use the description field in the Appearance API.

DingTalk OmniAuth provider

The omniauth-dingtalk gem that provides GitLab with the DingTalk OmniAuth provider will be removed in our next major release, GitLab 17.0. This gem sees very little use and is better suited for JiHu edition.

Filepath field in Releases and Release Links APIs

Support for specifying a filepath for a direct asset link in the Releases API and Release Links API is deprecated in GitLab 15.9 and will be removed in GitLab 17.0. GitLab introduced a new field called direct_asset_path in GitLab 15.9 to replace filepath until it is finally removed.

To avoid any disruptions, you should replace filepath with direct_asset_path in your calls to the following endpoints:

• Releases API:
  • Create a release
  • Download a release asset
• Release Links API:
  • Create a release link
  • Update a release link

Geo: Legacy replication details routes for designs and projects deprecated

As part of the migration of legacy data types to the Geo self-service framework, the following replication details routes are deprecated:

• Designs /admin/geo/replication/designs replaced by /admin/geo/sites/<Geo Node/Site ID>/replication/design_management_repositories
• Projects /admin/geo/replication/projects replaced by /admin/geo/sites/<Geo Node/Site ID>/replication/projects

From GitLab 16.4 to 17.0, lookups for the legacy routes will automatically be redirected to the new routes. We will remove the redirections in 17.0. Please update any bookmarks or scripts that may use the legacy routes.

GitLab Helm chart values gitlab.kas.privateApi.* are deprecated

We introduced the global.kas.tls.* Helm values to facilitate TLS communication between KAS and your Helm chart components. The old values gitlab.kas.privateApi.tls.enabled and gitlab.kas.privateApi.tls.secretName are deprecated and scheduled for removal in GitLab 17.0.

Because the new values provide a streamlined, comprehensive method to enable TLS for KAS, you should use global.kas.tls.* instead of gitlab.kas.privateApi.tls.*. The gitlab.kas.privateApi.tls.* For more information, see:

• The merge request that introduces the global.kas.tls.* values.
• The deprecated gitlab.kas.privateApi.tls.* documentation.
• The new global.kas.tls.* documentation.

GitLab Runner platforms and setup instructions in GraphQL API

The runnerPlatforms and runnerSetup queries to get GitLab Runner platforms and installation instructions are deprecated and will be removed from the GraphQL API. For installation instructions, you should use the GitLab Runner documentation

GraphQL deprecation of dependencyProxyTotalSizeInBytes field

You can use GraphQL to query the amount of storage used by the GitLab Dependency Proxy. However, the dependencyProxyTotalSizeInBytes field is limited to ~2Gb (in bytes), which is not always large enough for the Dependency Proxy. As a result, dependencyProxyTotalSizeInBytes is deprecated and will be removed in GitLab 17.0.

Use dependencyProxyTotalSizeBytes instead, introduced in GitLab 16.1.

GraphQL field registrySizeEstimated has been deprecated

For clarity, the GraphQL field registrySizeEstimated was renamed to containerRegistrySizeIsEstimated, to match its counterpart. registrySizeEstimated was deprecated in GitLab 16.2 and will be removed in GitLab 17.0. Use containerRegistrySizeIsEstimated introduced in GitLab 16.2 instead.

GraphQL field totalWeight is deprecated

You can use GraphQL to query the total weight of issues in an issue board. However, the totalWeight field is limited to the maximum size 2147483647. As a result, totalWeight is deprecated and will be removed in GitLab 17.0.

Use totalIssueWeight instead, introduced in GitLab 16.2.

GraphQL networkPolicies resource deprecated

The networkPolicies GraphQL resource has been deprecated and will be removed in GitLab 17.0. Since GitLab 15.0 this field has returned no data.

GraphQL type, RunnerMembershipFilter renamed to CiRunnerMembershipFilter

The GraphQL type, RunnerMembershipFilter, has been renamed to CiRunnerMembershipFilter. In GitLab 17.0, the aliasing for the RunnerMembershipFilter type will be removed.

GraphQL: The DISABLED_WITH_OVERRIDE value of the SharedRunnersSetting enum is deprecated. Use DISABLED_AND_OVERRIDABLE instead

In GitLab 17.0, the DISABLED_WITH_OVERRIDE value of the SharedRunnersSetting GraphQL enum type will be replaced with the value, DISABLED_AND_OVERRIDABLE.

HashiCorp Vault integration will no longer use CI_JOB_JWT by default

As part of our effort to improve the security of your CI workflows using JWT and OIDC, the native HashiCorp integration is also being updated in GitLab 16.0. Any projects that use the secrets:vault keyword to retrieve secrets from Vault will need to be configured to use the ID tokens. ID tokens were introduced in 15.7.

To prepare for this change, use the new id_tokens keyword and configure the aud claim. Ensure the bound audience is prefixed with https://.

In GitLab 15.9 to 15.11, you can enable the Limit JSON Web Token (JWT) access setting, which prevents the old tokens from being exposed to any jobs and enables ID token authentication for the secrets:vault keyword.

In GitLab 16.0 and later:

• This setting will be removed.
• CI/CD jobs that use the id_tokens keyword can use ID tokens with secrets:vault, and will not have any CI_JOB_JWT* tokens available.
• Jobs that do not use the id_tokens keyword will continue to have the CI_JOB_JWT* tokens available until GitLab 17.0.

Internal Container Registry API tag deletion endpoint

The Docker Registry HTTP API V2 Spec, later replaced by the OCI Distribution Spec did not include a tag delete operation, and an unsafe and slow workaround (involving deleting manifests, not tags) had to be used to achieve the same end.

Tag deletion is an important function, so we added a tag deletion operation to the GitLab Container Registry, extending the V2 API beyond the scope of the Docker and OCI distribution spec.

Since then, the OCI Distribution Spec has had some updates and it now has a tag delete operation, using the DELETE /v2/<name>/manifests/<tag> endpoint.

This leaves the container registry with two endpoints that provide the exact same functionality. DELETE /v2/<name>/tags/reference/<tag> is the custom GitLab tag delete endpoint and DELETE /v2/<name>/manifests/<tag>, the OCI compliant tag delete endpoint introduced in GitLab 16.4.

Support for the custom GitLab tag delete endpoint is deprecated in GitLab 16.4, and it will be removed in GitLab 17.0.

This endpoint is used by the internal Container Registry application API, not the public GitLab Container Registry API. No action should be required by the majority of container registry users. All the GitLab UI and API functionality related to tag deletions will remain intact as we transition to the new OCI-compliant endpoint.

If you do access the internal container registry API and use the original tag deletion endpoint, you must update to the new endpoint.

Maintainer role providing the ability to change Package settings using GraphQL API

The ability for users with the Maintainer role to change the Packages and registries settings for a group using the GraphQL API is deprecated in GitLab 15.8 and will be removed in GitLab 17.0. These settings include:

• Allowing or preventing duplicate package uploads.
• Package request forwarding.
• Enabling lifecycle rules for the Dependency Proxy.

In GitLab 17.0 and later, you must have the Owner role for a group to change the Packages and registries settings for the group using either the GitLab UI or GraphQL API.

Old versions of JSON web tokens are deprecated

ID tokens with OIDC support were introduced in GitLab 15.7. These tokens are more configurable than the old JSON web tokens (JWTs), are OIDC compliant, and only available in CI/CD jobs that explictly have ID tokens configured. ID tokens are more secure than the old CI_JOB_JWT* JSON web tokens which are exposed in every job, and as a result these old JSON web tokens are deprecated:

• CI_JOB_JWT
• CI_JOB_JWT_V1
• CI_JOB_JWT_V2

To prepare for this change, configure your pipelines to use ID tokens instead of the deprecated tokens. For OIDC compliance, the iss claim now uses the fully qualified domain name, for example https://example.com, previously introduced with the CI_JOB_JWT_V2 token.

In GitLab 15.9 to 15.11, you can enable the Limit JSON Web Token (JWT) access setting, which prevents the old tokens from being exposed to any jobs and enables ID token authentication for the secrets:vault keyword.

In GitLab 16.0 and later:

• This setting will be removed.
• CI/CD jobs that use the id_tokens keyword can use ID tokens with secrets:vault, and will not have any CI_JOB_JWT* tokens available.
• Jobs that do not use the id_tokens keyword will continue to have the CI_JOB_JWT* tokens available until GitLab 17.0.

In GitLab 17.0, the deprecated tokens will be completely removed and will no longer be available in CI/CD jobs.

OmniAuth Facebook is deprecated

OmniAuth Facebook support will be removed in GitLab 17.0. The last gem release was in 2021 and it is currently unmaintained. The current usage is less than 0.1%. If you use OmniAuth Facebook, switch to a supported provider in advance of support removal.

Package pipelines in API payload is paginated

A request to the API for /api/v4/projects/:id/packages returns a paginated result of packages. Each package lists all of its pipelines in this response. This is a performance concern, as it’s possible for a package to have hundreds or thousands of associated pipelines.

In milestone 17.0, we will remove the pipelines attribute from the API response.

PipelineSecurityReportFinding projectFingerprint GraphQL field

The project_fingerprint attribute of vulnerability findings is being deprecated in favor of a uuid attribute. By using UUIDv5 values to identify findings, we can easily associate any related entity with a finding. The project_fingerprint attribute is no longer being used to track findings, and will be removed in GitLab 17.0. Starting in 16.1, the output of project_fingerprint returns the same value as the uuid field.

PostgreSQL 13 deprecated

GitLab follows an annual upgrade cadence for PostgreSQL.

Support for PostgreSQL 13 is scheduled for removal in GitLab 17.0. In GitLab 17.0, PostgreSQL 14 becomes the minimum required PostgreSQL version.

PostgreSQL 13 will be supported for the full GitLab 16 release cycle. PostgreSQL 14 will also be supported for instances that want to upgrade prior to GitLab 17.0.

Queue selector for running Sidekiq is deprecated

Running Sidekiq with a queue selector (having multiple processes listening to a set of queues) and negate settings is deprecated and will be fully removed in 17.0.

You can migrate away from queue selectors to listening to all queues in all processes. For example, if Sidekiq is currently running with 4 processes (denoted by 4 elements in sidekiq['queue_groups'] in /etc/gitlab/gitlab.rb) with queue selector (sidekiq['queue_selector'] = true), you can change Sidekiq to listen to all queues in all 4 processes,for example sidekiq['queue_groups'] = ['*'] * 4. This approach is also recommended in our Reference Architecture. Note that Sidekiq can effectively run as many processes as the number of CPUs in the machine.

While the above approach is recommended for most instances, Sidekiq can also be run using routing rules which is also being used on GitLab.com. You can follow the migration guide from queue selectors to routing rules. You need to take care with the migration to avoid losing jobs entirely.

Registration tokens and server-side runner arguments in POST /api/v4/runners endpoint

The support for registration tokens and certain runner configuration arguments in the POST method operation on the /api/v4/runners endpoint is deprecated. This endpoint registers a runner with a GitLab instance at the instance, group, or project level through the API. Registration tokens, and support for certain configuration arguments, will start returning the HTTP 410 Gone status code in GitLab 17.0. For more information, see Migrating to the new runner registration workflow.

The configuration arguments disabled for authentication tokens are:

• --locked
• --access-level
• --run-untagged
• --maximum-timeout
• --paused
• --tag-list
• --maintenance-note

This change is a breaking change. You should create a runner in the UI to add configurations, and use the authentication token in the gitlab-runner register command instead.

Required Pipeline Configuration is deprecated

Required Pipeline Configuration will be removed in the 17.0 release. This impacts self-managed users on the Ultimate license.

We recommend replacing this with an alternative compliance solution that is available now. We recommend this alternative solution because it provides greater flexibility, allowing required pipelines to be assigned to specific compliance framework labels.

Running a single database is deprecated

From GitLab 17.0, we will require a separate database for CI features. We recommend running both databases on the same Postgres instance(s) due to ease of management for most deployments.

We are providing this as an informational advance notice but we do not recommend taking action yet. We will have another update communicated (as well as the deprecation note) when we recommend admins to start the migration process.

This change provides additional scalability for the largest of GitLab instances, like GitLab.com. This change applies to all installation methods: Omnibus GitLab, GitLab Helm chart, GitLab Operator, GitLab Docker images, and installation from source. Before upgrading to GitLab 17.0, please ensure you have migrated to two databases.

Self-managed certificate-based integration with Kubernetes

The certificate-based integration with Kubernetes will be deprecated and removed.

As a self-managed customer, we are introducing the feature flag certificate_based_clusters in GitLab 15.0 so you can keep your certificate-based integration enabled. However, the feature flag will be disabled by default, so this change is a breaking change.

In GitLab 17.0 we will remove both the feature and its related code. Until the final removal in 17.0, features built on this integration will continue to work, if you enable the feature flag. Until the feature is removed, GitLab will continue to fix security and critical issues as they arise.

For a more robust, secure, forthcoming, and reliable integration with Kubernetes, we recommend you use the agent for Kubernetes to connect Kubernetes clusters with GitLab. How do I migrate?

Although an explicit removal date is set, we don’t plan to remove this feature until the new solution has feature parity. For more information about the blockers to removal, see this issue.

For updates and details about this deprecation, follow this epic.

Single database connection is deprecated

This deprecation is now superseded by another deprecation notice.

Previously, GitLab’s database configuration had a single main: section. This is being deprecated. The new configuration has both a main: and a ci: section.

This deprecation affects users compiling GitLab from source, who will need to add the ci: section. Omnibus, the Helm chart, and Operator will handle this configuration automatically from GitLab 16.0 onwards.

Slack notifications integration

As we’re consolidating all Slack capabilities into the GitLab for Slack app, we’re deprecating the Slack notifications integration. GitLab.com users can now use the GitLab for Slack app to manage notifications to their Slack workspace. For self-managed users of the Slack notifications integration, we’ll be introducing support in this epic.

The GitLab legacy requirement IID is deprecated in favor of work item IID

We will be transitioning to a new IID as a result of moving requirements to a work item type. Users should begin using the new IID as support for the legacy IID and existing formatting will end in GitLab 17.0. The legacy requirement IID remains available until its removal in GitLab 17.0.

The Visual Reviews tool is deprecated

Due to limited customer usage and capabilities, the Visual Reviews feature for Review Apps is deprecated and will be removed. There is no planned replacement and users should stop using Visual Reviews before GitLab 17.0.

The ci_job_token_scope_enabled projects API attribute is deprecated

GitLab 16.1 introduced API endpoints for the job token scope. In the projects API, the ci_job_token_scope_enabled attribute is deprecated, and will be removed in 17.0. You should use the job token scope APIs instead.

The gitlab-runner exec command is deprecated

The gitlab-runner exec command is deprecated and will be fully removed from GitLab Runner in 16.0. The gitlab-runner exec feature was initially developed to provide the ability to validate a GitLab CI pipeline on a local system without needing to commit the updates to a GitLab instance. However, with the continued evolution of GitLab CI, replicating all GitLab CI features into gitlab-runner exec was no longer viable. Pipeline syntax and validation simulation are available in the GitLab pipeline editor.

The pull-based deployment features of the GitLab agent for Kubernetes is deprecated

We are deprecating the built-in pull-based deployment features of the GitLab agent for Kubernetes in favor of Flux and related integrations.

The GitLab agent for Kubernetes is not deprecated. This change affects only the pull-based functionality of the agent. All other functionality will remain intact, and GitLab will continue to support the agent for Kubernetes.

If you use the agent for pull-based deployments, you should migrate to Flux. Because Flux is a mature CNCF project for GitOps, we decided to integrate Flux with GitLab in February 2023.

Trigger jobs can mirror downstream pipeline status exactly

In some cases, like when a downstream pipeline had the passed with warnings status, trigger jobs that were using strategy: depend did not mirror the status of the downstream pipeline exactly. In GitLab 17.0 trigger jobs will show the exact same status as the the downstream pipeline. If your pipeline relied on this behavior, you should update your pipeline to handle the more accurate status.

Twitter OmniAuth login option is deprecated from self-managed GitLab

Twitter OAuth 1.0a OmniAuth is deprecated and will be removed for self-managed GitLab instances in GitLab 17.0 due to low use and lack of gem support. Use another supported OmniAuth provider instead.

Unified approval rules are deprecated

Unified approval rules are deprecated in favor of multiple approval rules, which provide more flexibility. You might not be able to migrate your Unified approval rules to multiple approval rules without breaking changes. To help you migrate manually, we introduced migration documentation. If you don’t migrate manually before unified approval rules are removed, GitLab will automatically migrate your settings.

In GitLab 15.11, UI support for unified approval rules was removed. You can still access unified approval rules with the API.

Vulnerability confidence field

In GitLab 15.3, security report schemas below version 15 were deprecated. The confidence attribute on vulnerability findings exists only in schema versions before 15-0-0, and therefore is effectively deprecated since GitLab 15.4 supports schema version 15-0-0. To maintain consistency between the reports and our public APIs, the confidence attribute on any vulnerability-related components of our GraphQL API is now deprecated and will be removed in 17.0.

sidekiq delivery method for incoming_email and service_desk_email is deprecated

The sidekiq delivery method for incoming_email and service_desk_email is deprecated and is scheduled for removal in GitLab 17.0.

GitLab uses a separate process called mail_room to ingest emails. Currently, GitLab administrators can configure their GitLab instances to use sidekiq or webhook delivery methods to deliver ingested emails from mail_room to GitLab.

Using the deprecated sidekiq delivery method, mail_room writes the job data directly to the GitLab Redis queue. This means that there is a hard coupling between the delivery method and the Redis configuration. Another disadvantage is that framework optimizations such as job payload compression are missed.

Using the webhook delivery method, mail_room pushes the ingested email body to the GitLab API. That way mail_room does not need to know your Redis configuration and the GitLab application adds the processing job. mail_room authenticates with a shared secret key.

Reconfiguring an Omnibus installation generates this secret key file automatically, so no secret file configuration setting is needed.

You can configure a custom secret key file (32 characters base 64 encoded) by running a command like below and referencing the secret file in incoming_email_secret_file and service_desk_email_secret_file (always specify the absolute path):

echo $( ruby -rsecurerandom -e "puts SecureRandom.base64(32)" ) > ~/.gitlab-mailroom-secret

If you run GitLab on more than one machine, you need to provide the secret key file for each machine.

We encourage GitLab administrators to switch to the webhook delivery method for incoming_email_delivery_method and service_desk_email_delivery_method instead of sidekiq.

Issue 393157 tracks improving email ingestion in general. We hope this will simplify infrastructure setup and add several improvements to how you manage GitLab in the near future.

project.pipeline.securityReportFindings GraphQL query

Previous work helped align the vulnerabilities calls for pipeline security tabs to match the vulnerabilities calls for project-level and group-level vulnerability reports. This helped the frontend have a more consistent interface. The old project.pipeline.securityReportFindings query was formatted differently than other vulnerability data calls. Now that it has been replaced with the new project.pipeline.vulnerabilities field, the old project.pipeline.securityReportFindings is being deprecated and will be removed in GitLab 17.0.

Job token allowlist covers public and internal projects

Starting in 16.6, projects that are public or internal will no longer authorize job token requests from projects that are not on the project’s allowlist when Limit access to this project is enabled.

If you have public or internal projects with the Limit access to this project setting enabled, you must add any projects which make job token requests to your project’s allowlist for continued authorization.

Bundled Grafana deprecated and disabled

The version of Grafana bundled with Omnibus GitLab is deprecated and disabled in 16.0 and will be removed in 16.3. If you are using the bundled Grafana, you must migrate to either:

• Another implementation of Grafana. For more information, see Switch to new Grafana instance.
• Another observability platform of your choice.

The version of Grafana that is currently provided is no longer a supported version.

In GitLab versions 16.0 to 16.2, you can still re-enable the bundled Grafana. However, enabling the bundled Grafana will no longer work from GitLab 16.3.

License Compliance CI Template

Update: We previously announced we would remove the existing License Compliance CI template in GitLab 16.0. However, due to performance issues with the license scanning of CycloneDX files we will do this in 16.3 instead.

The GitLab License Compliance CI/CD template is now deprecated and is scheduled for removal in the GitLab 16.3 release.

To continue using GitLab for license compliance, remove the License Compliance template from your CI/CD pipeline and add the Dependency Scanning template. The Dependency Scanning template is now capable of gathering the required license information, so it is no longer necessary to run a separate license compliance job.

Before you remove the License Compliance CI/CD template, verify that the instance has been upgraded to a version that supports the new method of license scanning.

To begin using the Dependency Scanner quickly at scale, you may set up a scan execution policy at the group level to enforce the SBOM-based license scan for all projects in the group. Then, you may remove the inclusion of the Jobs/License-Scanning.gitlab-ci.yml template from your CI/CD configuration.

If you wish to continue using the legacy license compliance feature, you can do so by setting the LICENSE_MANAGEMENT_VERSION CI variable to 4. This variable can be set at the project, group, or instance level. This configuration change will allow you to continue using an existing version of license compliance without having to adopt the new approach.

Bugs and vulnerabilities in this legacy analyzer will no longer be fixed.

RSA key size limits

Go versions 1.20.7 and later add a maxRSAKeySize constant that limits RSA keys to a maximum of 8192 bits. As a result, RSA keys larger than 8192 bits will no longer work with GitLab. Any RSA keys larger than 8192 bits must be regenerated at a smaller size.

You might notice this issue because your logs include an error like tls: server sent certificate containing RSA key larger than 8192 bits. To test the length of your key, use this command: openssl rsa -in <your-key-file> -text -noout | grep "Key:".

Twitter OmniAuth login option is removed from GitLab.com

Twitter OAuth 1.0a OmniAuth is being deprecated and removed on GitLab.com in GitLab 16.3 due to low use, lack of gem support, and the lack of a functional sign-in option for this feature. If you sign into GitLab.com with Twitter, you can sign in with a password or another supported OmniAuth provider.

Auto DevOps no longer provisions a PostgreSQL database by default

Currently, Auto DevOps provisions an in-cluster PostgreSQL database by default. In GitLab 16.0, databases will be provisioned only for users who opt in. This change supports production deployments that require more robust database management.

If you want Auto DevOps to provision an in-cluster database, set the POSTGRES_ENABLED CI/CD variable to true.

Azure Storage Driver defaults to the correct root prefix

The Azure Storage Driver writes to // as the default root directory. This default root directory appears in some places within the Azure UI as /<no-name>/. We have maintained this legacy behavior to support older deployments using this storage driver. However, when moving to Azure from another storage driver, this behavior hides all your data until you configure the storage driver to build root paths without an extra leading slash by setting trimlegacyrootprefix: true.

The new default configuration for the storage driver will set trimlegacyrootprefix: true, and / will be the default root directory. You can add trimlegacyrootprefix: false to your current configuration to avoid any disruptions.

This breaking change will happen in GitLab 16.0.

Bundled Grafana Helm Chart is deprecated

The Grafana Helm chart that is bundled with the GitLab Helm Chart is deprecated and will be removed in the GitLab Helm Chart 7.0 release (releasing along with GitLab 16.0).

The bundled Grafana Helm chart is an optional service that can be turned on to provide the Grafana UI connected to the GitLab Helm Chart’s Prometheus metrics.

The version of Grafana that the GitLab Helm Chart is currently providing is no longer a supported Grafana version. If you’re using the bundled Grafana, you should switch to the newer chart version from Grafana Labs or a Grafana Operator from a trusted provider.

In your new Grafana instance, you can configure the GitLab provided Prometheus as a data source and connect Grafana to the GitLab UI.

CAS OmniAuth provider

The omniauth-cas3 gem that provides GitLab with the CAS OmniAuth provider will be removed in our next major release, GitLab 16.0. This gem sees very little use and its lack of upstream maintenance is preventing GitLab’s upgrade to OmniAuth 2.0.

CI/CD jobs will fail when no secret is returned from Hashicorp Vault

When using the native HashiCorp Vault integration, CI/CD jobs will fail when no secret is returned from Vault. Make sure your configuration always return a secret, or update your pipeline to handle this change, before GitLab 16.0.

Changing MobSF-based SAST analyzer behavior in multi-module Android projects

Update: We previously announced a change to how the MobSF-based GitLab SAST analyzer would scan multi-module Android projects. We’ve cancelled that change, and no action is required.

Instead of changing which single module would be scanned, we improved multi-module support.

Changing merge request approvals with the /approvals API endpoint

To change the approvals required for a merge request, you should no longer use the /approvals API endpoint, which was deprecated in GitLab 14.0.

Instead, use the /approval_rules endpoint to create or update the approval rules for a merge request.

Conan project-level search endpoint returns project-specific results

You can use the GitLab Conan repository with project-level or instance-level endpoints. Each level supports the conan search command. However, the search endpoint for the project level is also returning packages from outside the target project.

This unintended functionality is deprecated in GitLab 15.8 and will be removed in GitLab 16.0. The search endpoint for the project level will only return packages from the target project.

Configuration fields in GitLab Runner Helm Chart

From GitLab 13.6, users can specify any runner configuration in the GitLab Runner Helm chart. When we implemented this feature, we deprecated values in the GitLab Helm Chart configuration that were specific to GitLab Runner. These fields are deprecated and we plan to remove them in v1.0 of the GitLab Runner Helm chart.

Configuring Redis config file paths using environment variables is deprecated

You can no longer specify Redis configuration file locations using the environment variables like GITLAB_REDIS_CACHE_CONFIG_FILE or GITLAB_REDIS_QUEUES_CONFIG_FILE. Use the default config file locations instead, for example config/redis.cache.yml or config/redis.queues.yml.

Container Registry pull-through cache

The Container Registry pull-through cache is deprecated in GitLab 15.8 and will be removed in GitLab 16.0. The pull-through cache is part of the upstream Docker Distribution project. However, we are removing the pull-through cache in favor of the GitLab Dependency Proxy, which allows you to proxy and cache container images from Docker Hub. Removing the pull-through cache allows us also to remove the upstream client code without sacrificing functionality.

Container Scanning variables that reference Docker

All Container Scanning variables that are prefixed by DOCKER_ in variable name are deprecated. This includes the DOCKER_IMAGE, DOCKER_PASSWORD, DOCKER_USER, and DOCKERFILE_PATH variables. Support for these variables will be removed in the GitLab 16.0 release. Use the new variable names CS_IMAGE, CS_REGISTRY_PASSWORD, CS_REGISTRY_USER, and CS_DOCKERFILE_PATH in place of the deprecated names.

Cookie authorization in the GitLab for Jira Cloud app

Cookie authentication in the GitLab for Jira Cloud app is now deprecated in favor of OAuth authentication. On self-managed, you must set up OAuth authentication to continue to use the GitLab for Jira Cloud app. Without OAuth, you can’t manage linked namespaces.

DAST API scans using DAST template is deprecated

With the move to the new DAST API analyzer and the DAST-API.gitlab-ci.yml template for DAST API scans, we will be removing the ability to scan APIs with the DAST analyzer. Use of the DAST.gitlab-ci.yml or DAST-latest.gitlab-ci.yml templates for API scans is deprecated as of GitLab 15.7 and will no longer work in GitLab 16.0. Please use DAST-API.gitlab-ci.yml template and refer to the DAST API analyzer documentation for configuration details.

DAST API variables

With the switch to the new DAST API analyzer in GitLab 15.6, two legacy DAST API variables are being deprecated. The variables DAST_API_HOST_OVERRIDE and DAST_API_SPECIFICATION will no longer be used for DAST API scans.

DAST_API_HOST_OVERRIDE has been deprecated in favor of using the DAST_API_TARGET_URL to automatically override the host in the OpenAPI specification.

DAST_API_SPECIFICATION has been deprecated in favor of DAST_API_OPENAPI. To continue using an OpenAPI specification to guide the test, users must replace the DAST_API_SPECIFICATION variable with the DAST_API_OPENAPI variable. The value can remain the same, but the variable name must be replaced.

These two variables will be removed in GitLab 16.0.

DAST report variables deprecation

With the new browser-based DAST analyzer GA in GitLab 15.7, we are working towards making it the default DAST analyzer at some point in the future. In preparation for this, the following legacy DAST variables are being deprecated and scheduled for removal in GitLab 16.0: DAST_HTML_REPORT, DAST_XML_REPORT, and DAST_MARKDOWN_REPORT. These reports relied on the legacy DAST analyzer and we do not plan to implement them in the new browser-based analyzer. As of GitLab 16.0, these report artifacts will no longer be generated.

These three variables will be removed in GitLab 16.0.

Default CI/CD job token (CI_JOB_TOKEN) scope changed

In GitLab 14.4 we introduced the ability to limit your project’s CI/CD job token (CI_JOB_TOKEN) access to make it more secure. You can prevent job tokens from your project’s pipelines from being used to access other projects. When enabled with no other configuration, your pipelines cannot access other projects. To use the job token to access other projects from your pipeline, you must list those projects explicitly in the Limit CI_JOB_TOKEN access setting’s allowlist, and you must be a maintainer in all the projects.

The job token functionality was updated in 15.9 with a better security setting to allow access to your project with a job token. When enabled with no other configuration, job tokens from other projects cannot access your project. Similar to the older setting, you can optionally allow other projects to access your project with a job token if you list those projects explicitly in the Allow access to this project with a CI_JOB_TOKEN setting’s allowlist. With this new setting, you must be a maintainer in your own project, but only need to have the Guest role in the other projects.

As a result, the Limit setting is deprecated in preference of the better Allow access setting. In GitLab 16.0 the Limit setting will be disabled by default for all new projects. In projects with this setting currently enabled, it will continue to function as expected, but you will not be able to add any more projects to the allowlist. If the setting is disabled in any project, it will not be possible to re-enable this setting in 16.0 or later.

In 17.0, we plan to remove the Limit setting completely, and set the Allow access setting to enabled for all projects. This change ensures a higher level of security between projects. If you currently use the Limit setting, you should update your projects to use the Allow access setting instead. If other projects access your project with a job token, you must add them to the Allow access allowlist.

To prepare for this change, users on GitLab.com or self-managed GitLab 15.9 or later can enable the Allow access setting now and add the other projects. It will not be possible to disable the setting in 17.0 or later.

In 16.3, the names of these settings were changed to clarify their meanings: the deprecated Limit CI_JOB_TOKEN access setting is now called Limit access from this project, and the newer Allow access to this project with a CI_JOB_TOKEN setting is now called Limit access to this project.

Dependency Scanning support for Java 13, 14, 15, and 16

GitLab has deprecated Dependency Scanning support for Java versions 13, 14, 15, and 16 and plans to remove that support in the upcoming GitLab 16.0 release. This is consistent with Oracle’s support policy as Oracle Premier and Extended Support for these versions has ended. This also allows GitLab to focus Dependency Scanning Java support on LTS versions moving forward.

Deployment API returns error when updated_at and updated_at are not used together

The Deployment API will now return an error when updated_at filtering and updated_at sorting are not used together. Some users were using filtering by updated_at to fetch “latest” deployment without using updated_at sorting, which may produce wrong results. You should instead use them together, or migrate to filtering by finished_at and sorting by finished_at which will give you “latest deployments” in a consistent way.

Deprecate legacy Gitaly configuration methods

Using environment variables GIT_CONFIG_SYSTEM and GIT_CONFIG_GLOBAL to configure Gitaly is deprecated. These variables are being replaced with standard config.toml Gitaly configuration.

GitLab instances that use GIT_CONFIG_SYSTEM and GIT_CONFIG_GLOBAL to configure Gitaly should switch to configuring using config.toml.

Deprecated Consul http metrics

The Consul provided in the GitLab Omnibus package will no longer provide older deprecated Consul metrics starting in GitLab 16.0.

In GitLab 14.0, Consul was updated to 1.9.6, which deprecated some telemetry metrics from being at the consul.http path. In GitLab 16.0, the consul.http path will be removed.

If you have monitoring that consumes Consul metrics, update them to use consul.api.http instead of consul.http. For more information, see the deprecation notes for Consul 1.9.0.

Deprecation and planned removal for CI_PRE_CLONE_SCRIPT variable on GitLab SaaS

The CI_PRE_CLONE_SCRIPT variable supported by GitLab SaaS Runners is deprecated as of GitLab 15.9 and will be removed in 16.0. The CI_PRE_CLONE_SCRIPT variable enables you to run commands in your CI/CD job prior to the runner executing Git init and get fetch. For more information about how this feature works, see Pre-clone script. As an alternative, you can use the pre_get_sources_script.

Developer role providing the ability to import projects to a group

The ability for users with the Developer role for a group to import projects to that group is deprecated in GitLab 15.8 and will be removed in GitLab 16.0. From GitLab 16.0, only users with at least the Maintainer role for a group will be able to import projects to that group.

Development dependencies reported for PHP and Python

In GitLab 16.0 the GitLab Dependency Scanning analyzer will begin reporting development dependencies for both Python/pipenv and PHP/composer projects. Users who do not wish to have these development dependencies reported should set DS_INCLUDE_DEV_DEPENDENCIES: false in their CI/CD file.

Embedding Grafana panels in Markdown is deprecated

The ability to add Grafana panels in GitLab Flavored Markdown is deprecated in 15.9 and will be removed in 16.0. We intend to replace this feature with the ability to embed charts with the GitLab Observability UI.

Enforced validation of CI/CD parameter character lengths

While CI/CD job names have a strict 255 character limit, other CI/CD parameters do not yet have validations ensuring they also stay under the limit.

In GitLab 16.0, validation will be added to strictly limit the following to 255 characters as well:

• The stage keyword.
• The ref, which is the Git branch or tag name for the pipeline.
• The description and target_url parameter, used by external CI/CD integrations.

Users on self-managed instances should update their pipelines to ensure they do not use parameters that exceed 255 characters. Users on GitLab.com do not need to make any changes, as these are already limited in that database.

Environment search query requires at least three characters

From GitLab 16.0, when you search for environments with the API, you must use at least three characters. This change helps us ensure the scalability of the search operation.

External field in GraphQL ReleaseAssetLink type

In the GraphQL API, the external field of ReleaseAssetLink type was used to indicate whether a release link is internal or external to your GitLab instance. As of GitLab 15.9, we treat all release links as external, and therefore, this field is deprecated in GitLab 15.9, and will be removed in GitLab 16.0. To avoid any disruptions to your workflow, please stop using the external field because it will be removed and will not be replaced.

External field in Releases and Release Links APIs

In Releases API and Release Links API, the external field was used to indicate whether a release link is internal or external to your GitLab instance. As of GitLab 15.9, we treat all release links as external, and therefore, this field is deprecated in GitLab 15.9, and will be removed in GitLab 16.0. To avoid any disruptions to your workflow, please stop using the external field because it will be removed and will not be replaced.

GitLab self-monitoring project

GitLab self-monitoring gives administrators of self-hosted GitLab instances the tools to monitor the health of their instances. This feature is deprecated in GitLab 14.9, and is scheduled for removal in 16.0.

GraphQL API Runner status will not return paused

The GitLab Runner GraphQL API endpoints will not return paused or active as a status in GitLab 16.0. In a future v5 of the REST API, the endpoints for GitLab Runner will also not return paused or active.

A runner’s status will only relate to runner contact status, such as: online, offline, or not_connected. Status paused or active will no longer appear.

When checking if a runner is paused, API users are advised to check the boolean attribute paused to be true instead. When checking if a runner is active, check if paused is false.

GraphQL API legacyMode argument for Runner status

The legacyMode argument to the status field in RunnerType will be rendered non-functional in the 16.0 release as part of the deprecations details in the issue.

In GitLab 16.0 and later, the status field will act as if legacyMode is null. The legacyMode argument will be present during the 16.x cycle to avoid breaking the API signature, and will be removed altogether in the 17.0 release.

GraphQL field confidential changed to internal on notes

The confidential field for a Note will be deprecated and renamed to internal.

Jira DVCS connector for Jira Cloud

The Jira DVCS connector for Jira Cloud has been deprecated and will be removed in GitLab 16.0. If you’re using the Jira DVCS connector with Jira Cloud, migrate to the GitLab for Jira Cloud app.

The Jira DVCS connector is also deprecated for Jira 8.13 and earlier. You can only use the Jira DVCS connector with Jira Server or Jira Data Center in Jira 8.14 and later.

KAS Metrics Port in GitLab Helm Chart

The gitlab.kas.metrics.port has been deprecated in favor of the new gitlab.kas.observability.port configuration field for the GitLab Helm Chart. This port is used for much more than just metrics, which warranted this change to avoid confusion in configuration.

Legacy Gitaly configuration method

Gitaly configuration within Omnibus GitLab has been updated such that all Gitaly related configuration keys are in a single configuration structure that matches the standard Gitaly configuration. As such, the previous configuration structure is deprecated.

The single configuration structure is available from GitLab 15.10, though backwards compatibility is maintained. Once removed, Gitaly must be configured using the single configuration structure. You should update the configuration of Gitaly at your earliest convenience.

The change improves consistency between Omnibus GitLab and source installs and enables us to provide better documentation and tooling for both.

You should update to the new configuration structure as soon as possible using the upgrade instructions.

Legacy Praefect configuration method

Previously, Praefect configuration keys were scattered throughout the configuration file. Now, these are in a single configuration structure that matches Praefect configuration so the previous configuration method is deprecated.

The single configuration structure available from GitLab 15.9, though backwards compatibility is maintained. Once removed, Praefect must be configured using the single configuration structure. You should update your Praefect configuration as soon as possible using the upgrade instructions.

This change brings Praefect configuration in Omnibus GitLab in line with the configuration structure of Praefect. Previously, the hierarchies and configuration keys didn’t match. The change improves consistency between Omnibus GitLab and source installs and enables us to provide better documentation and tooling for both.

Legacy URLs replaced or removed

GitLab 16.0 removes legacy URLs from the GitLab application.

When subgroups were introduced in GitLab 9.0, a /-/ delimiter was added to URLs to signify the end of a group path. All GitLab URLs now use this delimiter for project, group, and instance level features.

URLs that do not use the /-/ delimiter are planned for removal in GitLab 16.0. For the full list of these URLs, along with their replacements, see issue 28848.

Update any scripts or bookmarks that reference the legacy URLs. GitLab APIs are not affected by this change.

License-Check and the Policies tab on the License Compliance page

The License-Check feature is now deprecated and is scheduled for removal in GitLab 16.0. Additionally, the Policies tab on the License Compliance page and all APIs related to the License-Check feature are deprecated and planned for removal in GitLab 16.0. Users who wish to continue to enforce approvals based on detected licenses are encouraged to create a new License Approval policy instead.

Limit personal access token and deploy token’s access with external authorization

With external authorization enabled, personal access tokens (PATs) and deploy tokens must no longer be able to access container or package registries. This defense-in-depth security measure will be deployed in 16.0. For users that use PATs and deploy tokens to access these registries, this measure breaks this use of these tokens. Disable external authorization to use tokens with container or package registries.

Major bundled Helm Chart updates for the GitLab Helm Chart

To coincide with GitLab 16.0, the GitLab Helm Chart will release the 7.0 major version. The following major bundled chart updates will be included:

• In GitLab 16.0, PostgreSQL 12 support is being removed, and PostgreSQL 13 is becoming the new minimum.
  • Installs using production-ready external databases will need to complete their migration to a newer PostgreSQL version before upgrading.
  • Installs using the non-production bundled PostgreSQL 12 chart will have the chart upgraded to the new version. For more information, see issue 4118
• Installs using the non-production bundled Redis chart will have the chart upgraded to a newer version. For more information, see issue 3375
• Installs using the bundled cert-manager chart will have the chart upgraded to a newer version. For more information, see issue 4313

The full GitLab Helm Chart 7.0 upgrade steps will be available in the upgrade docs.

Managed Licenses API

The Managed Licenses API is now deprecated and is scheduled for removal in GitLab 16.0.

Monitor performance metrics through Prometheus

By displaying data stored in a Prometheus instance, GitLab allows users to view performance metrics. GitLab also displays visualizations of these metrics in dashboards. The user can connect to a previously-configured external Prometheus instance, or set up Prometheus as a GitLab Managed App. However, since certificate-based integration with Kubernetes clusters is deprecated in GitLab, the metrics functionality in GitLab that relies on Prometheus is also deprecated. This includes the metrics visualizations in dashboards. GitLab is working to develop a single user experience based on Opstrace. An issue exists for you to follow work on the Opstrace integration.

Non-expiring access tokens

Access tokens that have no expiration date are valid indefinitely, which presents a security risk if the access token is divulged. Because access tokens that have an exipiration date are better, from GitLab 15.3 we populate a default expiration date.

In GitLab 16.0, any personal, project, or group access token that does not have an expiration date will automatically have an expiration date set at one year.

We recommend giving your access tokens an expiration date in line with your company’s security policies before the default is applied:

• On GitLab.com during the 16.0 milestone.
• On GitLab self-managed instances when they are upgraded to 16.0.

Non-standard default Redis ports are deprecated

If GitLab starts without any Redis configuration file present, GitLab assumes it can connect to three Redis servers at localhost:6380, localhost:6381 and localhost:6382. We are changing this behavior so GitLab assumes there is one Redis server at localhost:6379.

Administrators who want to keep the three servers must configure the Redis URLs by editing the config/redis.cache.yml,config/redis.queues.yml and config/redis.shared_state.yml files.

Option to delete projects immediately is deprecated from deletion protection settings

The group and project deletion protection setting in the Admin Area had an option to delete groups and projects immediately. Starting with 16.0, this option will no longer be available, and delayed group and project deletion will become the default behavior.

The option will no longer appear as a group setting. Self-managed users will still have the option to define the deletion delay period, and SaaS users have a non-adjustable default retention period of 7 days. Users can still immediately delete the project from the project settings, and the group from the group settings.

The option to delete groups and projects immediately by default was deprecated to prevent users from accidentally taking this action and permanently losing groups and projects.

PipelineSecurityReportFinding name GraphQL field

Previously, the PipelineSecurityReportFinding GraphQL type was updated to include a new title field. This field is an alias for the current name field, making the less specific name field redundant. The name field will be removed from the PipelineSecurityReportFinding type in GitLab 16.0.

PostgreSQL 12 deprecated

Support for PostgreSQL 12 is scheduled for removal in GitLab 16.0. In GitLab 16.0, PostgreSQL 13 becomes the minimum required PostgreSQL version.

PostgreSQL 12 will be supported for the full GitLab 15 release cycle. PostgreSQL 13 will also be supported for instances that want to upgrade prior to GitLab 16.0.

Support for PostgreSQL 13 was added to Geo in GitLab 15.2.

Projects API field operations_access_level is deprecated

We are deprecating the operations_access_level field in the Projects API. This field has been replaced by fields to control specific features: releases_access_level, environments_access_level, feature_flags_access_level, infrastructure_access_level, and monitor_access_level.

Redis 5 deprecated

With GitLab 13.9, in the Omnibus GitLab package and GitLab Helm chart 4.9, the Redis version was updated to Redis 6. Redis 5 has reached the end of life in April 2022 and will no longer be supported as of GitLab 15.6. If you are using your own Redis 5.0 instance, you should upgrade it to Redis 6.0 or higher before upgrading to GitLab 16.0 or higher.

Remove job_age parameter from POST /jobs/request Runner endpoint

The job_age parameter, returned from the POST /jobs/request API endpoint used in communication with GitLab Runner, was never used by any GitLab or Runner feature. This parameter will be removed in GitLab 16.0.

This could be a breaking change for anyone that developed their own runner that relies on this parameter being returned by the endpoint. This is not a breaking change for anyone using an officially released version of GitLab Runner, including public shared runners on GitLab.com.

SAST analyzer coverage changing in GitLab 16.0

GitLab SAST uses various analyzers to scan code for vulnerabilities.

We’re reducing the number of supported analyzers used by default in GitLab SAST. This is part of our long-term strategy to deliver a faster, more consistent user experience across different programming languages.

Starting in GitLab 16.0, the GitLab SAST CI/CD template will no longer use the Security Code Scan-based analyzer for .NET, and it will enter End of Support status. We’ll remove this analyzer from the SAST CI/CD template and replace it with GitLab-supported detection rules for C# in the Semgrep-based analyzer.

Effective immediately, this analyzer will receive only security updates; other routine improvements or updates are not guaranteed. After this analyzer reaches End of Support in GitLab 16.0, no further updates will be provided. However, we won’t delete container images previously published for this analyzer or remove the ability to run it by using a custom CI/CD pipeline job.

If you’ve already dismissed a vulnerability finding from the deprecated analyzer, the replacement attempts to respect your previous dismissal. The system behavior depends on:

• whether you’ve excluded the Semgrep-based analyzer from running in the past.
• which analyzer first discovered the vulnerabilities shown in the project’s Vulnerability Report.

See Vulnerability translation documentation for further details.

If you applied customizations to the affected analyzer, or if you currently disable the Semgrep-based analyzer in your pipelines, you must take action as detailed in the deprecation issue for this change.

Update: We’ve reduced the scope of this change. We will no longer make the following changes in GitLab 16.0:

1. Remove support for the analyzer based on PHPCS Security Audit and replace it with GitLab-managed detection rules in the Semgrep-based analyzer.
2. Remove Scala from the scope of the SpotBugs-based analyzer and replace it with GitLab-managed detection rules in the Semgrep-based analyzer.

Work to replace the PHPCS Security Audit-based analyzer is tracked in issue 364060 and work to migrate Scala scanning to the Semgrep-based analyzer is tracked in issue 362958.

Secure analyzers major version update

The Secure stage will be bumping the major versions of its analyzers in tandem with the GitLab 16.0 release. This bump will enable a clear delineation for analyzers, between:

• Those released prior to May 22, 2023
• Those released after May 22, 2023

If you are not using the default included templates, or have pinned your analyzer versions you will need to update your CI/CD job definition to either remove the pinned version or to update the latest major version. Users of GitLab 13.0-15.10 will continue to experience analyzer updates as normal until the release of GitLab 16.0, following which all newly fixed bugs and released features will be released only in the new major version of the analyzers. We do not backport bugs and features to deprecated versions as per our maintenance policy. As required, security patches will be backported within the latest 3 minor releases. Specifically, the following are being deprecated and will no longer be updated after 16.0 GitLab release:

• API Fuzzing: version 2
• Container Scanning: version 5
• Coverage-guided fuzz testing: version 3
• Dependency Scanning: version 3
• Dynamic Application Security Testing (DAST): version 3
• DAST API: version 2
• IaC Scanning: version 3
• License Scanning: version 4
• Secret Detection: version 4
• Static Application Security Testing (SAST): version 3 of all analyzers
  • brakeman: version 3
  • flawfinder: version 3
  • kubesec: version 3
  • mobsf: version 3
  • nodejs-scan: version 3
  • phpcs-security-audit: version 3
  • pmd-apex: version 3
  • security-code-scan: version 3
  • semgrep: version 3
  • sobelow: version 3
  • spotbugs: version 3

Secure scanning CI/CD templates will use new job rules

GitLab-managed CI/CD templates for security scanning will be updated in the GitLab 16.0 release. The updates will include improvements already released in the Latest versions of the CI/CD templates. We released these changes in the Latest template versions because they have the potential to disrupt customized CI/CD pipeline configurations.

In all updated templates, we’re updating the definition of variables like SAST_DISABLED and DEPENDENCY_SCANNING_DISABLED to disable scanning only if the value is "true". Previously, even if the value were "false", scanning would be disabled.

The following templates will be updated:

• API Fuzzing: API-Fuzzing.gitlab-ci.yml
• Container Scanning: Container-Scanning.gitlab-ci.yml
• Coverage-Guided Fuzzing: Coverage-Fuzzing.gitlab-ci.yml
• DAST: DAST.gitlab-ci.yml
• DAST API: DAST-API.gitlab-ci.yml
• Dependency Scanning: Dependency-Scanning.gitlab-ci.yml
• IaC Scanning: SAST-IaC.gitlab-ci.yml
• SAST: SAST.gitlab-ci.yml
• Secret Detection: Secret-Detection.gitlab-ci.yml

We recommend that you test your pipelines before the 16.0 release if you use one of the templates listed above and you use the _DISABLED variables but set a value other than "true".

Update: We previously announced that we would update the rules on the affected templates to run in merge request pipelines by default. However, due to compatibility issues discussed in the deprecation issue, we will no longer make this change in GitLab 16.0. We will still release the changes to the _DISABLED variables as described above.

Security report schemas version 14.x.x

Version 14.x.x security report schemas are deprecated.

In GitLab 15.8 and later, security report scanner integrations that use schema version 14.x.x will display a deprecation warning in the pipeline’s Security tab.

In GitLab 16.0 and later, the feature will be removed. Security reports that use schema version 14.x.x will cause an error in the pipeline’s Security tab.

For more information, refer to security report validation.

Shimo integration

The Shimo Workspace integration has been deprecated and will be moved to the JiHu GitLab codebase.

Starboard directive in the config for the GitLab Agent for Kubernetes

GitLab’s operational container scanning capabilities no longer require starboard to be installed. Consequently, use of the starboard: directive in the configuration file for the GitLab Agent for Kubernetes is now deprecated and is scheduled for removal in GitLab 16.0. Update your configuration file to use the container_scanning: directive.

Support for Praefect custom metrics endpoint configuration

Support for using the prometheus_exclude_database_from_default_metrics configuration value is deprecated in GitLab 15.9 and will be removed in GitLab 16.0. We are removing this configuration value because using it is non-performant. This change means the following metrics will become unavailable on /metrics:

• gitaly_praefect_unavailable_repositories.
• gitaly_praefect_verification_queue_depth.
• gitaly_praefect_replication_queue_depth.

This may require updating your metrics collection targets to also scrape /db_metrics.

Support for periods (.) in Terraform state names might break existing states

Previously, Terraform state names containing periods were not supported. However, you could still use state names with periods via a workaround.

GitLab 15.7 adds full support for state names that contain periods. If you used a workaround to handle these state names, your jobs might fail, or it might look like you’ve run Terraform for the first time.

To resolve the issue:

1. Change any references to the state file by excluding the period and any characters that follow.
   • For example, if your state name is state.name, change all references to state.
2. Run your Terraform commands.

To use the full state name, including the period, migrate to the full state file.

The API no longer returns revoked tokens for the agent for Kubernetes

Currently, GET requests to the Cluster Agents API endpoints can return revoked tokens. In GitLab 16.0, GET requests will not return revoked tokens.

You should review your calls to these endpoints and ensure you do not use revoked tokens.

This change affects the following REST and GraphQL API endpoints:

• REST API:
  • List tokens
  • Get a single token
• GraphQL:
  • ClusterAgent.tokens

The Phabricator task importer is deprecated

The Phabricator task importer is being deprecated. Phabricator itself as a project is no longer actively maintained since June 1, 2021. We haven’t observed imports using this tool. There has been no activity on the open related issues on GitLab.

The latest Terraform templates will overwrite current stable templates

With every major GitLab version, we update the stable Terraform templates with the current latest templates. This change affects the quickstart and the base templates.

Because the new templates ship with default rules, the update might break your Terraform pipelines. For example, if your Terraform jobs are triggered as a downstream pipeline, the rules won’t trigger your jobs in GitLab 16.0.

To accommodate the changes, you might need to adjust the rules in your .gitlab-ci.yml file.

Toggle behavior of /draft quick action in merge requests

In order to make the behavior of toggling the draft status of a merge request more clear via a quick action, we’re deprecating and removing the toggle behavior of the /draft quick action. Beginning with the 16.0 release of GitLab, /draft will only set a merge request to Draft and a new /ready quick action will be used to remove the draft status.

Toggle notes confidentiality on APIs

Toggling notes confidentiality with REST and GraphQL APIs is being deprecated. Updating notes confidential attribute is no longer supported by any means. We are changing this to simplify the experience and prevent private information from being unintentionally exposed.

Use of id field in vulnerabilityFindingDismiss mutation

You can use the vulnerabilityFindingDismiss GraphQL mutation to set the status of a vulnerability finding to Dismissed. Previously, this mutation used the id field to identify findings uniquely. However, this did not work for dismissing findings from the pipeline security tab. Therefore, using the id field as an identifier has been dropped in favor of the uuid field. Using the ‘uuid’ field as an identifier allows you to dismiss the finding from the pipeline security tab.

Use of third party container registries is deprecated

Using third-party container registries with GitLab as an auth endpoint is deprecated in GitLab 15.8 and the end of support is scheduled for GitLab 16.0. This impacts self-managed customers that have connected their external registry to the GitLab user interface to find, view, and delete container images.

Supporting both GitLab’s Container Registry as well as third-party container registries is challenging for maintenance, code quality, and backward compatibility. This hinders our ability to stay efficient. As a result we will not support this functionality moving forward.

This change will not impact your ability to pull and push container images to external registries using pipelines.

Since we released the new GitLab Container Registry version for GitLab.com, we’ve started to implement additional features that are not available in third-party container registries. These new features have allowed us to achieve significant performance improvements, such as cleanup policies. We are focusing on delivering new features, most of which will require functionalities only available on the GitLab Container Registry. This deprecation allows us to reduce fragmentation and user frustration in the long term by focusing on delivering a more robust integrated registry experience and feature set.

Moving forward, we’ll continue to invest in developing and releasing new features that will only be available in the GitLab Container Registry.

Work items path with global ID at the end of the path is deprecated

Usage of global IDs in work item URLs is deprecated. In the future, only internal IDs (IID) will be supported.

Because GitLab supports multiple work item types, a path such as https://gitlab.com/gitlab-org/gitlab/-/work_items/<global_id> can display, for example, a task or an OKR.

In GitLab 15.10 we added support for using internal IDs (IID) in that path by appending a query param at the end (iid_path) in the following format: https://gitlab.com/gitlab-org/gitlab/-/work_items/<iid>?iid_path=true.

In GitLab 16.0 we will remove the ability to use a global ID in the work items path. The number at the end of the path will be considered an internal ID (IID) without the need of adding a query param at the end. Only the following format will be supported: https://gitlab.com/gitlab-org/gitlab/-/work_items/<iid>.

ZenTao integration

The ZenTao product integration has been deprecated and will be moved to the JiHu GitLab codebase.

CI_BUILD_* predefined variables

The predefined CI/CD variables that start with CI_BUILD_* were deprecated in GitLab 9.0, and will be removed in GitLab 16.0. If you still use these variables, be sure to change to the replacement predefined variables which are functionally identical:

POST ci/lint API endpoint deprecated

The POST ci/lint API endpoint is deprecated in 15.7, and will be removed in 16.0. This endpoint does not validate the full range of CI/CD configuration options. Instead, use POST /projects/:id/ci/lint, which properly validates CI/CD configuration.

environment_tier parameter for DORA API

To avoid confusion and duplication, the environment_tier parameter is deprecated in favor of the environment_tiers parameter. The new environment_tiers parameter allows DORA APIs to return aggregated data for multiple tiers at the same time. The environment_tier parameter will be removed in GitLab 16.0.

started iteration state

The started iteration state in the iterations GraphQL API and iterations REST API is deprecated.

The GraphQL API version will be removed in GitLab 16.0. This state is being replaced with the current state (already available) which aligns with the naming for other time-based entities, such as milestones.

We plan to continue to support the started state in REST API version until the next v5 REST API version.

vulnerabilityFindingDismiss GraphQL mutation

The VulnerabilityFindingDismiss GraphQL mutation is being deprecated and will be removed in GitLab 16.0. This mutation was not used often as the Vulnerability Finding ID was not available to users (this field was deprecated in 15.3). Users should instead use VulnerabilityDismiss to dismiss vulnerabilities in the Vulnerability Report or SecurityFindingDismiss for security findings in the CI Pipeline Security tab.

Automatic backup upload using Openstack Swift and Rackspace APIs

We are deprecating support for uploading backups to remote storage using Openstack Swift and Rackspace APIs. The support for these APIs depends on third-party libraries that are no longer actively maintained and have not been updated for Ruby 3. GitLab is switching over to Ruby 3 prior to EOL of Ruby 2 in order to stay up to date on security patches.

• If you’re using OpenStack, you need to change you configuration to use the S3 API instead of Swift.
• If you’re using Rackspace storage, you need to switch to a different provider or manually upload the backup file after the backup task is complete.

Live Preview no longer available in the Web IDE

The Live Preview feature of the Web IDE was intended to provide a client-side preview of static web applications. However, complex configuration steps and a narrow set of supported project types have limited its utility. With the introduction of the Web IDE Beta in GitLab 15.7, you can now connect to a full server-side runtime environment. With upcoming support for installing extensions in the Web IDE, we’ll also support more advanced workflows than those available with Live Preview. As of GitLab 15.9, Live Preview is no longer available in the Web IDE.

SaaS certificate-based integration with Kubernetes

The certificate-based integration with Kubernetes will be deprecated and removed. As a GitLab SaaS customer, on new namespaces, you will no longer be able to integrate GitLab and your cluster using the certificate-based approach as of GitLab 15.0. The integration for current users will be enabled per namespace.

For a more robust, secure, forthcoming, and reliable integration with Kubernetes, we recommend you use the agent for Kubernetes to connect Kubernetes clusters with GitLab. How do I migrate?

Although an explicit removal date is set, we don’t plan to remove this feature until the new solution has feature parity. For more information about the blockers to removal, see this issue.

For updates and details about this deprecation, follow this epic.

GitLab self-managed customers can still use the feature with a feature flag.

File Type variable expansion in .gitlab-ci.yml

Previously, variables that referenced or applied alias file variables expanded the value of the File type variable. For example, the file contents. This behavior was incorrect because it did not comply with typical shell variable expansion rules. To leak secrets or sensitive information stored in File type variables, a user could run an $echo command with the variable as an input parameter.

This breaking change fixes this issue but could disrupt user workflows that work around the behavior. With this change, job variable expansions that reference or apply alias file variables, expand to the file name or path of the File type variable, instead of its value, such as the file contents.

SAST analyzer consolidation and CI/CD template changes

GitLab SAST uses various analyzers to scan code for vulnerabilities.

We are reducing the number of analyzers used in GitLab SAST as part of our long-term strategy to deliver a better and more consistent user experience. Streamlining the set of analyzers will also enable faster iteration, better results, and greater efficiency (including a reduction in CI runner usage in most cases).

In GitLab 15.4, GitLab SAST will no longer use the following analyzers:

• ESLint (JavaScript, TypeScript, React)
• Gosec (Go)
• Bandit (Python)

These analyzers will be removed from the GitLab-managed SAST CI/CD template and replaced with the Semgrep-based analyzer. Effective immediately, they will receive only security updates; other routine improvements or updates are not guaranteed. After these analyzers reach End of Support, no further updates will be provided. We will not delete container images previously published for these analyzers; any such change would be announced as a deprecation, removal, or breaking change announcement.

We will also remove Java from the scope of the SpotBugs analyzer and replace it with the Semgrep-based analyzer. This change will make it simpler to scan Java code; compilation will no longer be required. This change will be reflected in the automatic language detection portion of the GitLab-managed SAST CI/CD template. Note that the SpotBugs-based analyzer will continue to cover Groovy, Kotlin, and Scala.

If you’ve already dismissed a vulnerability finding from one of the deprecated analyzers, the replacement attempts to respect your previous dismissal. The system behavior depends on:

• whether you’ve excluded the Semgrep-based analyzer from running in the past.
• which analyzer first discovered the vulnerabilities shown in the project’s Vulnerability Report.

See Vulnerability translation documentation for further details.

If you applied customizations to any of the affected analyzers or if you currently disable the Semgrep analyzer in your pipelines, you must take action as detailed in the deprecation issue for this change.

Audit events for repository push events

Audit events for repository events are now deprecated and will be removed in GitLab 15.0.

These events have always been disabled by default and had to be manually enabled with a feature flag. Enabling them can cause too many events to be generated which can dramatically slow down GitLab instances. For this reason, they are being removed.

Background upload for object storage

To reduce the overall complexity and maintenance burden of GitLab’s object storage feature, support for using background_upload to upload files is deprecated and will be fully removed in GitLab 15.0. Review the 15.0 specific changes for the removed background uploads settings for object storage.

This impacts a small subset of object storage providers:

• OpenStack Customers using OpenStack need to change their configuration to use the S3 API instead of Swift.
• RackSpace Customers using RackSpace-based object storage need to migrate data to a different provider.

GitLab will publish additional guidance to assist affected customers in migrating.

CI/CD job name length limit

In GitLab 15.0 we are going to limit the number of characters in CI/CD job names to 255. Any pipeline with job names that exceed the 255 character limit will stop working after the 15.0 release.

Changing an instance (shared) runner to a project (specific) runner

In GitLab 15.0, you can no longer change an instance (shared) runner to a project (specific) runner.

Users often accidentally change instance runners to project runners, and they’re unable to change them back. GitLab does not allow you to change a project runner to a shared runner because of the security implications. A runner meant for one project could be set to run jobs for an entire instance.

Administrators who need to add runners for multiple projects can register a runner for one project, then go to the Admin view and choose additional projects.

Container Network and Host Security

All functionality related to GitLab’s Container Network Security and Container Host Security categories is deprecated in GitLab 14.8 and scheduled for removal in GitLab 15.0. Users who need a replacement for this functionality are encouraged to evaluate the following open source projects as potential solutions that can be installed and managed outside of GitLab: AppArmor, Cilium, Falco, FluentD, Pod Security Admission. To integrate these technologies into GitLab, add the desired Helm charts into your copy of the Cluster Management Project Template. Deploy these Helm charts in production by calling commands through GitLab CI/CD.

As part of this change, the following specific capabilities within GitLab are now deprecated, and are scheduled for removal in GitLab 15.0:

• The Security & Compliance > Threat Monitoring page.
• The Network Policy security policy type, as found on the Security & Compliance > Policies page.
• The ability to manage integrations with the following technologies through GitLab: AppArmor, Cilium, Falco, FluentD, and Pod Security Policies.
• All APIs related to the above functionality.

For additional context, or to provide feedback regarding this change, please reference our open deprecation issue.

Dependency Scanning Python 3.9 and 3.6 image deprecation

For those using Dependency Scanning for Python projects, we are deprecating the default gemnasium-python:2 image which uses Python 3.6 as well as the custom gemnasium-python:2-python-3.9 image which uses Python 3.9. The new default image as of GitLab 15.0 will be for Python 3.9 as it is a supported version and 3.6 is no longer supported.

For users using Python 3.9 or 3.9-compatible projects, you should not need to take action and dependency scanning should begin to work in GitLab 15.0. If you wish to test the new container now please run a test pipeline in your project with this container (which will be removed in 15.0). Use the Python 3.9 image:

gemnasium-python-dependency_scanning:
  image:
    name: registry.gitlab.com/gitlab-org/security-products/analyzers/gemnasium-python:2-python-3.9

For users using Python 3.6, as of GitLab 15.0 you will no longer be able to use the default template for dependency scanning. You will need to switch to use the deprecated gemnasium-python:2 analyzer image. If you are impacted by this please comment in this issue so we can extend the removal if needed.

For users using the 3.9 special exception image, you must instead use the default value and no longer override your container. To verify if you are using the 3.9 special exception image, check your .gitlab-ci.yml file for the following reference:

gemnasium-python-dependency_scanning:
  image:
    name: registry.gitlab.com/gitlab-org/security-products/analyzers/gemnasium-python:2-python-3.9

Dependency Scanning default Java version changed to 17

In GitLab 15.0, for Dependency Scanning, the default version of Java that the scanner expects will be updated from 11 to 17. Java 17 is the most up-to-date Long Term Support (LTS) version. Dependency scanning continues to support the same range of versions (8, 11, 13, 14, 15, 16, 17), only the default version is changing. If your project uses the previous default of Java 11, be sure to set the DS_Java_Version variable to match.

Deprecate feature flag PUSH_RULES_SUPERSEDE_CODE_OWNERS

The feature flag PUSH_RULES_SUPERSEDE_CODE_OWNERS is being removed in GitLab 15.0. Upon its removal, push rules will supersede Code Owners. Even if Code Owner approval is required, a push rule that explicitly allows a specific user to push code supersedes the Code Owners setting.

Elasticsearch 6.8

Elasticsearch 6.8 is deprecated in GitLab 14.8 and scheduled for removal in GitLab 15.0. Customers using Elasticsearch 6.8 need to upgrade their Elasticsearch version to 7.x prior to upgrading to GitLab 15.0. We recommend using the latest version of Elasticsearch 7 to benefit from all Elasticsearch improvements.

Elasticsearch 6.8 is also incompatible with Amazon OpenSearch, which we plan to support in GitLab 15.0.

External status check API breaking changes

The external status check API was originally implemented to support pass-by-default requests to mark a status check as passing. Pass-by-default requests are now deprecated. Specifically, the following are deprecated:

• Requests that do not contain the status field.
• Requests that have the status field set to approved.

Beginning in GitLab 15.0, status checks will only be updated to a passing state if the status field is both present and set to passed. Requests that:

• Do not contain the status field will be rejected with a 422 error. For more information, see the relevant issue.
• Contain any value other than passed will cause the status check to fail. For more information, see the relevant issue.

To align with this change, API calls to list external status checks will also return the value of passed rather than approved for status checks that have passed.

GitLab Serverless

GitLab Serverless is a feature set to support Knative-based serverless development with automatic deployments and monitoring.

We decided to remove the GitLab Serverless features as they never really resonated with our users. Besides, given the continuous development of Kubernetes and Knative, our current implementations do not even work with recent versions.

GraphQL ID and GlobalID compatibility

We are removing a non-standard extension to our GraphQL processor, which we added for backwards compatibility. This extension modifies the validation of GraphQL queries, allowing the use of the ID type for arguments where it would normally be rejected. Some arguments originally had the type ID. These were changed to specific kinds of ID. This change may be a breaking change if you:

• Use GraphQL.
• Use the ID type for any argument in your query signatures.

Some field arguments still have the ID type. These are typically for IID values, or namespace paths. An example is Query.project(fullPath: ID!).

For a list of affected and unaffected field arguments, see the deprecation issue.

You can test if this change affects you by validating your queries locally, using schema data fetched from a GitLab server. You can do this by using the GraphQL explorer tool for the relevant GitLab instance. For example: https://gitlab.com/-/graphql-explorer.

For example, the following query illustrates the breaking change:

# a query using the deprecated type of Query.issue(id:)
# WARNING: This will not work after GitLab 15.0
query($id: ID!) {
  deprecated: issue(id: $id) {
    title, description
  }
}

The query above will not work after GitLab 15.0 is released, because the type of Query.issue(id:) is actually IssueID!.

Instead, you should use one of the following two forms:

# This will continue to work
query($id: IssueID!) {
  a: issue(id: $id) {
    title, description
  }
  b: issue(id: "gid://gitlab/Issue/12345") {
    title, description
  }
}

This query works now, and will continue to work after GitLab 15.0. You should convert any queries in the first form (using ID as a named type in the signature) to one of the other two forms (using the correct appropriate type in the signature, or using an inline argument expression).

GraphQL permissions change for Package settings

The GitLab Package stage offers a Package Registry, Container Registry, and Dependency Proxy to help you manage all of your dependencies using GitLab. Each of these product categories has a variety of settings that can be adjusted using the API.

The permissions model for GraphQL is being updated. After 15.0, users with the Guest, Reporter, and Developer role can no longer update these settings:

• Package Registry settings
• Container Registry cleanup policy
• Dependency Proxy time-to-live policy
• Enabling the Dependency Proxy for your group

Known host required for GitLab Runner SSH executor

In GitLab 14.3, we added a configuration setting in the GitLab Runner config.toml file. This setting, [runners.ssh.disable_strict_host_key_checking], controls whether or not to use strict host key checking with the SSH executor.

In GitLab 15.0 and later, the default value for this configuration option will change from true to false. This means that strict host key checking will be enforced when using the GitLab Runner SSH executor.

Legacy approval status names from License Compliance API

We deprecated legacy names for approval status of license policy (blacklisted, approved) in the managed_licenses API but they are still used in our API queries and responses. They will be removed in 15.0.

If you are using our License Compliance API you should stop using the approved and blacklisted query parameters, they are now allowed and denied. In 15.0 the responses will also stop using approved and blacklisted so you need to adjust any of your custom tools to use the old and new values so they do not break with the 15.0 release.

Legacy database configuration

The syntax of GitLabs database configuration located in database.yml is changing and the legacy format is deprecated. The legacy format supported using a single PostgreSQL adapter, whereas the new format is changing to support multiple databases. The main: database needs to be defined as a first configuration item.

This deprecation mainly impacts users compiling GitLab from source because Omnibus will handle this configuration automatically.

Logging in GitLab

The logging features in GitLab allow users to install the ELK stack (Elasticsearch, Logstash, and Kibana) to aggregate and manage application logs. Users can search for relevant logs in GitLab. However, since deprecating certificate-based integration with Kubernetes clusters and GitLab Managed Apps, we don’t have a recommended solution for logging within GitLab. For more information, you can follow the issue for integrating Opstrace with GitLab.

OAuth implicit grant

The OAuth implicit grant authorization flow will be removed in our next major release, GitLab 15.0. Any applications that use OAuth implicit grant should switch to alternative supported OAuth flows.

OAuth tokens without expiration

By default, all new applications expire access tokens after 2 hours. In GitLab 14.2 and earlier, OAuth access tokens had no expiration. In GitLab 15.0, an expiry will be automatically generated for any existing token that does not already have one.

You should opt in to expiring tokens before GitLab 15.0 is released:

1. Edit the application.
2. Select Expire access tokens to enable them. Tokens must be revoked or they don’t expire.

OmniAuth Kerberos gem

The omniauth-kerberos gem will be removed in our next major release, GitLab 15.0.

This gem has not been maintained and has very little usage. We therefore plan to remove support for this authentication method and recommend using the Kerberos SPNEGO integration instead. You can follow the upgrade instructions to upgrade from the omniauth-kerberos integration to the supported one.

Note that we are not deprecating the Kerberos SPNEGO integration, only the old password-based Kerberos integration.

Optional enforcement of PAT expiration

The feature to disable enforcement of PAT expiration is unusual from a security perspective. We have become concerned that this unusual feature could create unexpected behavior for users. Unexpected behavior in a security feature is inherently dangerous, so we have decided to remove this feature.

Optional enforcement of SSH expiration

The feature to disable enforcement of SSH expiration is unusual from a security perspective. We have become concerned that this unusual feature could create unexpected behavior for users. Unexpected behavior in a security feature is inherently dangerous, so we have decided to remove this feature.

Out-of-the-box SAST support for Java 8

The GitLab SAST SpotBugs analyzer scans Java, Scala, Groovy, and Kotlin code for security vulnerabilities. For technical reasons, the analyzer must first compile the code before scanning. Unless you use the pre-compilation strategy, the analyzer attempts to automatically compile your project’s code.

In GitLab versions prior to 15.0, the analyzer image includes Java 8 and Java 11 runtimes to facilitate compilation.

In GitLab 15.0, we will:

• Remove Java 8 from the analyzer image to reduce the size of the image.
• Add Java 17 to the analyzer image to make it easier to compile with Java 17.

If you rely on Java 8 being present in the analyzer environment, you must take action as detailed in the deprecation issue for this change.

Outdated indices of Advanced Search migrations

As Advanced Search migrations usually require support multiple code paths for a long period of time, it’s important to clean those up when we safely can. We use GitLab major version upgrades as a safe time to remove backward compatibility for indices that have not been fully migrated. See the upgrade documentation for details.

Querying Usage Trends via the instanceStatisticsMeasurements GraphQL node

The instanceStatisticsMeasurements GraphQL node has been renamed to usageTrendsMeasurements in 13.10 and the old field name has been marked as deprecated. To fix the existing GraphQL queries, replace instanceStatisticsMeasurements with usageTrendsMeasurements.

Request profiling

Request profiling is deprecated in GitLab 14.8 and scheduled for removal in GitLab 15.0.

We’re working on consolidating our profiling tools and making them more easily accessible. We evaluated the use of this feature and we found that it is not widely used. It also depends on a few third-party gems that are not actively maintained anymore, have not been updated for the latest version of Ruby, or crash frequently when profiling heavy page loads.

For more information, check the summary section of the deprecation issue.

Required pipeline configurations in Premium tier

The required pipeline configuration feature is deprecated in GitLab 14.8 for Premium customers and is scheduled for removal in GitLab 15.0. This feature is not deprecated for GitLab Ultimate customers.

This change to move the feature to GitLab’s Ultimate tier is intended to help our features better align with our pricing philosophy as we see demand for this feature originating primarily from executives.

This change will also help GitLab remain consistent in its tiering strategy with the other related Ultimate-tier features of: Security policies and compliance framework pipelines.

Retire-JS Dependency Scanning tool

As of 14.8 the retire.js job is being deprecated from Dependency Scanning. It will continue to be included in our CI/CD template while deprecated. We are removing retire.js from Dependency Scanning on May 22, 2022 in GitLab 15.0. JavaScript scanning functionality will not be affected as it is still being covered by Gemnasium.

If you have explicitly excluded retire.js using DS_EXCLUDED_ANALYZERS you will need to clean up (remove the reference) in 15.0. If you have customized your pipeline’s Dependency Scanning configuration related to the retire-js-dependency_scanning job you will want to switch to gemnasium-dependency_scanning before the removal in 15.0, to prevent your pipeline from failing. If you have not used the DS_EXCLUDED_ANALYZERS to reference retire.js, or customized your template specifically for retire.js, you will not need to take action.

SAST support for .NET 2.1

The GitLab SAST Security Code Scan analyzer scans .NET code for security vulnerabilities. For technical reasons, the analyzer must first build the code to scan it.

In GitLab versions prior to 15.0, the default analyzer image (version 2) includes support for:

• .NET 2.1
• .NET 3.0 and .NET Core 3.0
• .NET Core 3.1
• .NET 5.0

In GitLab 15.0, we will change the default major version for this analyzer from version 2 to version 3. This change:

• Adds severity values for vulnerabilities along with other new features and improvements.
• Removes .NET 2.1 support.
• Adds support for .NET 6.0, Visual Studio 2019, and Visual Studio 2022.

Version 3 was announced in GitLab 14.6 and made available as an optional upgrade.

If you rely on .NET 2.1 support being present in the analyzer image by default, you must take action as detailed in the deprecation issue for this change.

Secure and Protect analyzer images published in new location

GitLab uses various analyzers to scan for security vulnerabilities. Each analyzer is distributed as a container image.

Starting in GitLab 14.8, new versions of GitLab Secure and Protect analyzers are published to a new registry location under registry.gitlab.com/security-products.

We will update the default value of GitLab-managed CI/CD templates to reflect this change:

• For all analyzers except Container Scanning, we will update the variable SECURE_ANALYZERS_PREFIX to the new image registry location.
• For Container Scanning, the default image address is already updated. There is no SECURE_ANALYZERS_PREFIX variable for Container Scanning.

In a future release, we will stop publishing images to registry.gitlab.com/gitlab-org/security-products/analyzers. Once this happens, you must take action if you manually pull images and push them into a separate registry. This is commonly the case for offline deployments. Otherwise, you won’t receive further updates.

See the deprecation issue for more details.

Secure and Protect analyzer major version update

The Secure and Protect stages will be bumping the major versions of their analyzers in tandem with the GitLab 15.0 release. This major bump will enable a clear delineation for analyzers, between:

• Those released prior to May 22, 2022, which generate reports that are not subject to stringent schema validation.
• Those released after May 22, 2022, which generate reports that are subject to stringent schema validation.

If you are not using the default inclusion templates, or have pinned your analyzer versions you will need to update your CI/CD job definition to either remove the pinned version or to update the latest major version. Users of GitLab 12.0-14.10 will continue to experience analyzer updates as normal until the release of GitLab 15.0, following which all newly fixed bugs and newly released features in the new major versions of the analyzers will not be available in the deprecated versions because we do not backport bugs and new features as per our maintenance policy. As required security patches will be backported within the latest 3 minor releases. Specifically, the following are being deprecated and will no longer be updated after 15.0 GitLab release:

• API Security: version 1
• Container Scanning: version 4
• Coverage-guided fuzz testing: version 2
• Dependency Scanning: version 2
• Dynamic Application Security Testing (DAST): version 2
• Infrastructure as Code (IaC) Scanning: version 1
• License Scanning: version 3
• Secret Detection: version 3
• Static Application Security Testing (SAST): version 2 of all analyzers, except gosec which is currently at version 3
  • bandit: version 2
  • brakeman: version 2
  • eslint: version 2
  • flawfinder: version 2
  • gosec: version 3
  • kubesec: version 2
  • mobsf: version 2
  • nodejs-scan: version 2
  • phpcs-security-audit: version 2
  • pmd-apex: version 2
  • security-code-scan: version 2
  • semgrep: version 2
  • sobelow: version 2
  • spotbugs: version 2

Sidekiq metrics and health checks configuration

Exporting Sidekiq metrics and health checks using a single process and port is deprecated. Support will be removed in 15.0.

We have updated Sidekiq to export metrics and health checks from two separate processes to improve stability and availability and prevent data loss in edge cases. As those are two separate servers, a configuration change will be required in 15.0 to explicitly set separate ports for metrics and health-checks. The newly introduced settings for sidekiq['health_checks_*'] should always be set in gitlab.rb. For more information, check the documentation for configuring Sidekiq.

These changes also require updates in either Prometheus to scrape the new endpoint or k8s health-checks to target the new health-check port to work properly, otherwise either metrics or health-checks will disappear.

For the deprecation period those settings are optional and GitLab will default the Sidekiq health-checks port to the same port as sidekiq_exporter and only run one server (not changing the current behaviour). Only if they are both set and a different port is provided, a separate metrics server will spin up to serve the Sidekiq metrics, similar to the way Sidekiq will behave in 15.0.

Support for SLES 12 SP2

Long term service and support (LTSS) for SUSE Linux Enterprise Server (SLES) 12 SP2 ended on March 31, 2021. The CA certificates on SP2 include the expired DST root certificate, and it’s not getting new CA certificate package updates. We have implemented some workarounds, but we will not be able to continue to keep the build running properly.

Support for gRPC-aware proxy deployed between Gitaly and rest of GitLab

Although not recommended or documented, it was possible to deploy a gRPC-aware proxy between Gitaly and the rest of GitLab. For example, NGINX and Envoy. The ability to deploy a gRPC-aware proxy is deprecated. If you currently use a gRPC-aware proxy for Gitaly connections, you should change your proxy configuration to use TCP or TLS proxying (OSI layer 4) instead.

Gitaly Cluster became incompatible with gRPC-aware proxies in GitLab 13.12. Now all GitLab installations will be incompatible with gRPC-aware proxies, even without Gitaly Cluster.

By sending some of our internal RPC traffic through a custom protocol (instead of gRPC) we increase throughput and reduce Go garbage collection latency. For more information, see the relevant epic.

Test coverage project CI/CD setting

To simplify setting a test coverage pattern, in GitLab 15.0 the project setting for test coverage parsing is being removed.

Instead, using the project’s .gitlab-ci.yml, provide a regular expression with the coverage keyword to set testing coverage results in merge requests.

Tracing in GitLab

Tracing in GitLab is an integration with Jaeger, an open-source end-to-end distributed tracing system. GitLab users can navigate to their Jaeger instance to gain insight into the performance of a deployed application, tracking each function or microservice that handles a given request. Tracing in GitLab is deprecated in GitLab 14.7, and scheduled for removal in 15.0. To track work on a possible replacement, see the issue for Opstrace integration with GitLab.

Update to the Container Registry group-level API

In milestone 15.0, support for the tags and tags_count parameters will be removed from the Container Registry API that gets registry repositories from a group.

The GET /groups/:id/registry/repositories endpoint will remain, but won’t return any info about tags. To get the info about tags, you can use the existing GET /registry/repositories/:id endpoint, which will continue to support the tags and tag_count options as it does today. The latter must be called once per image repository.

Value Stream Analytics filtering calculation change

We are changing how the date filter works in Value Stream Analytics. Instead of filtering by the time that the issue or merge request was created, the date filter will filter by the end event time of the given stage. This will result in completely different figures after this change has rolled out.

If you monitor Value Stream Analytics metrics and rely on the date filter, to avoid losing data, you must save the data prior to this change.

Vulnerability Check

The vulnerability check feature is deprecated in GitLab 14.8 and scheduled for removal in GitLab 15.0. We encourage you to migrate to the new security approvals feature instead. You can do so by navigating to Security & Compliance > Policies and creating a new Scan Result Policy.

The new security approvals feature is similar to vulnerability check. For example, both can require approvals for MRs that contain security vulnerabilities. However, security approvals improve the previous experience in several ways:

• Users can choose who is allowed to edit security approval rules. An independent security or compliance team can therefore manage rules in a way that prevents development project maintainers from modifying the rules.
• Multiple rules can be created and chained together to allow for filtering on different severity thresholds for each scanner type.
• A two-step approval process can be enforced for any desired changes to security approval rules.
• A single set of security policies can be applied to multiple development projects to allow for ease in maintaining a single, centralized ruleset.

Versions on base PackageType

As part of the work to create a Package Registry GraphQL API, the Package group deprecated the Version type for the basic PackageType type and moved it to PackageDetailsType.

In milestone 15.0, we will completely remove Version from PackageType.

artifacts:reports:cobertura keyword

Currently, test coverage visualizations in GitLab only support Cobertura reports. Starting 15.0, the artifacts:reports:cobertura keyword will be replaced by artifacts:reports:coverage_report. Cobertura will be the only supported report file in 15.0, but this is the first step towards GitLab supporting other report types.

defaultMergeCommitMessageWithDescription GraphQL API field

The GraphQL API field defaultMergeCommitMessageWithDescription has been deprecated and will be removed in GitLab 15.0. For projects with a commit message template set, it will ignore the template.

dependency_proxy_for_private_groups feature flag

We added a feature flag because GitLab-#11582 changed how public groups use the Dependency Proxy. Prior to this change, you could use the Dependency Proxy without authentication. The change requires authentication to use the Dependency Proxy.

In milestone 15.0, we will remove the feature flag entirely. Moving forward, you must authenticate when using the Dependency Proxy.

pipelines field from the version field

In GraphQL, there are two pipelines fields that you can use in a PackageDetailsType to get the pipelines for package versions:

• The versions field’s pipelines field. This returns all the pipelines associated with all the package’s versions, which can pull an unbounded number of objects in memory and create performance concerns.
• The pipelines field of a specific version. This returns only the pipelines associated with that single package version.

To mitigate possible performance problems, we will remove the versions field’s pipelines field in milestone 15.0. Although you will no longer be able to get all pipelines for all versions of a package, you can still get the pipelines of a single version through the remaining pipelines field for that version.

projectFingerprint in PipelineSecurityReportFinding GraphQL

The projectFingerprint field in the PipelineSecurityReportFinding GraphQL object is being deprecated. This field contains a “fingerprint” of security findings used to determine uniqueness. The method for calculating fingerprints has changed, resulting in different values. Going forward, the new values will be exposed in the UUID field. Data previously available in the projectFingerprint field will eventually be removed entirely.

promote-db command from gitlab-ctl

In GitLab 14.5, we introduced the command gitlab-ctl promote to promote any Geo secondary node to a primary during a failover. This command replaces gitlab-ctl promote-db which is used to promote database nodes in multi-node Geo secondary sites. gitlab-ctl promote-db will continue to function as-is and be available until GitLab 15.0. We recommend that Geo customers begin testing the new gitlab-ctl promote command in their staging environments and incorporating the new command in their failover procedures.

promote-to-primary-node command from gitlab-ctl

In GitLab 14.5, we introduced the command gitlab-ctl promote to promote any Geo secondary node to a primary during a failover. This command replaces gitlab-ctl promote-to-primary-node which was only usable for single-node Geo sites. gitlab-ctl promote-to-primary-node will continue to function as-is and be available until GitLab 15.0. We recommend that Geo customers begin testing the new gitlab-ctl promote command in their staging environments and incorporating the new command in their failover procedures.

type and types keyword in CI/CD configuration

The type and types CI/CD keywords will be removed in GitLab 15.0. Pipelines that use these keywords will stop working, so you must switch to stage and stages, which have the same behavior.

apiFuzzingCiConfigurationCreate GraphQL mutation

The API Fuzzing configuration snippet is now being generated client-side and does not require an API request anymore. We are therefore deprecating the apiFuzzingCiConfigurationCreate mutation which isn’t being used in GitLab anymore.

bundler-audit Dependency Scanning tool

As of 14.6 bundler-audit is being deprecated from Dependency Scanning. It will continue to be in our CI/CD template while deprecated. We are removing bundler-audit from Dependency Scanning on May 22, 2022 in 15.0. After this removal Ruby scanning functionality will not be affected as it is still being covered by Gemnasium.

If you have explicitly excluded bundler-audit using DS_EXCLUDED_ANALYZERS you will need to clean up (remove the reference) in 15.0. If you have customized your pipeline’s Dependency Scanning configuration, for example to edit the bundler-audit-dependency_scanning job, you will want to switch to gemnasium-dependency_scanning before removal in 15.0, to prevent your pipeline from failing. If you have not used the DS_EXCLUDED_ANALYZERS to reference bundler-audit, or customized your template specifically for bundler-audit, you will not need to take action.

htpasswd Authentication for the Container Registry

The Container Registry supports authentication with htpasswd. It relies on an Apache htpasswd file, with passwords hashed using bcrypt.

Since it isn’t used in the context of GitLab (the product), htpasswd authentication will be deprecated in GitLab 14.9 and removed in GitLab 15.0.

user_email_lookup_limit API field

The user_email_lookup_limit API field is deprecated and will be removed in GitLab 15.0. Until GitLab 15.0, user_email_lookup_limit is aliased to search_rate_limit and existing workflows will continue to work.

Any API calls attempting to change the rate limits for user_email_lookup_limit should use search_rate_limit instead.

Permissions change for downloading Composer dependencies

The GitLab Composer repository can be used to push, search, fetch metadata about, and download PHP dependencies. All these actions require authentication, except for downloading dependencies.

Downloading Composer dependencies without authentication is deprecated in GitLab 14.9, and will be removed in GitLab 15.0. Starting with GitLab 15.0, you must authenticate to download Composer dependencies.