EN PT-BR
← Voltar ao feed
low

GitLab ships bug-fix patch release 19.5.3 and backports, distrusting compromised eMudhra CA certificates

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 21:00 · coletado há 3 dias

GitLab released versions 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 and 18.11.14 for Community and Enterprise Edition on October 29, 2026. The release contains no security fixes, but does include trust-store hardening: all supported branches now distrust compromised eMudhra CA certificates and bump the bundled cacerts to the 2026-10-20 set. Several branches also backport Go 1.26.10 and Ruby GC fixes, and switch gRPC to use the system CA bundle. Operators should note that the release contains database migrations that will cause downtime on single-node instances. Versions 19.5.2 and 19.4.4 were skipped and do not exist.

Detalhes técnicos

Key trust and runtime changes: distrust of compromised eMudhra CA certificates across 19.5 through 18.11, cacerts bumped to 2026-10-20, Go upgraded to 1.26.10 on several stable branches, GOFIPS140=off forced for the golang-fips toolchain on 19.3-stable, and use of the system CA bundle for gRPC default roots on 19.0–19.2. Other items are functional regressions (Geo replication, CI job token audit events, security report ingestion, SBOM indexing).

Remediação

Upgrade to the corresponding patch version for your branch. Plan for downtime on single-node installations due to regular database migrations; multi-node deployments can follow zero-downtime upgrade procedures.

Linha do tempo

  1. docs.gitlab.com ↗ · pub. 28/10/2026 21:00 · coletado 29/10 13:01 primeiro registro

    GitLab ships bug-fix patch release 19.5.3 and backports, distrusting compromised eMudhra CA certificates

    ler a análise desta fonte

    GitLab released versions 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 and 18.11.14 for Community and Enterprise Edition on October 29, 2026. The release contains no security fixes, but does include trust-store hardening: all supported branches now distrust compromised eMudhra CA certificates and bump the bundled cacerts to the 2026-10-20 set. Several branches also backport Go 1.26.10 and Ruby GC fixes, and switch gRPC to use the system CA bundle. Operators should note that the release contains database migrations that will cause downtime on single-node instances. Versions 19.5.2 and 19.4.4 were skipped and do not exist.

    Technical Details

    Key trust and runtime changes: distrust of compromised eMudhra CA certificates across 19.5 through 18.11, cacerts bumped to 2026-10-20, Go upgraded to 1.26.10 on several stable branches, GOFIPS140=off forced for the golang-fips toolchain on 19.3-stable, and use of the system CA bundle for gRPC default roots on 19.0–19.2. Other items are functional regressions (Geo replication, CI job token audit events, security report ingestion, SBOM indexing).

    Remediation

    Upgrade to the corresponding patch version for your branch. Plan for downtime on single-node installations due to regular database migrations; multi-node deployments can follow zero-downtime upgrade procedures.