Skip to content
Heist/ feed
Back to feed
UnratedFix available

GitLab 16.9 release notes

Type: patchSources: GitLab releases

GitLab 16.9 updates more than 40 default SAST rules to improve detection results and includes DAST analyzer bug fixes. The SAST update is automatically applied to GitLab 16.0 or newer unless analyzers are pinned.

Products
GitLab, Semgrep-based GitLab SAST analyzer
Affected versions
GitLab 16.0 or newer
Fixed versions
GitLab 16.9, updated versions
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 00:45 UTC · Revision 1

Source evidence

GitLab 16.9 release notes

official-gitlab-releases · Original source

Published 15 Feb 2024, 00:00 UTC

GitLab 16.9 updates more than 40 default SAST rules to improve detection results and includes DAST analyzer bug fixes. The SAST update is automatically applied to GitLab 16.0 or newer unless analyzers are pinned.

We’ve updated more than 40 default GitLab SAST rules to: Increase true-positive results (correctly identified vulnerabilities) and reduce false-negative results (incorrectly identified vulnerabilities) by updating the detection logic rules for C#, Go, Java, JavaScript, and Python.

GitLab

Fixed versions: GitLab 16.9

Prerequisites: unless you’ve pinned SAST analyzers to a specific version

Semgrep-based GitLab SAST analyzer

Fixed versions: updated versions

Complete source record
{
  "id": "6e8d2aa8c7c45088de1d2137158488cfccf3e4d238d8037a5d79ed8cc73c1839",
  "url": "https://docs.gitlab.com/releases/16/gitlab-16-9-released/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "GitLab 16.9 release notes",
    "summary": "GitLab 16.9 updates more than 40 default SAST rules to improve detection results and includes DAST analyzer bug fixes. The SAST update is automatically applied to GitLab 16.0 or newer unless analyzers are pinned.",
    "evidence": "We’ve updated more than 40 default GitLab SAST rules to: Increase true-positive results (correctly identified vulnerabilities) and reduce false-negative results (incorrectly identified vulnerabilities) by updating the detection logic rules for C#, Go, Java, JavaScript, and Python.",
    "products": [
      {
        "name": {
          "value": "GitLab",
          "evidence": "This update is automatically applied on GitLab 16.0 or newer unless you’ve pinned SAST analyzers to a specific version."
        },
        "prerequisites": [
          {
            "value": "unless you’ve pinned SAST analyzers to a specific version",
            "evidence": "This update is automatically applied on GitLab 16.0 or newer unless you’ve pinned SAST analyzers to a specific version."
          }
        ],
        "fixed_versions": [
          {
            "value": "GitLab 16.9",
            "evidence": "On February 15, 2024, GitLab 16.9 was released with the following features."
          }
        ],
        "affected_versions": [
          {
            "value": "GitLab 16.0 or newer",
            "evidence": "This update is automatically applied on GitLab 16.0 or newer unless you’ve pinned SAST analyzers to a specific version."
          }
        ]
      },
      {
        "name": {
          "value": "Semgrep-based GitLab SAST analyzer",
          "evidence": "The rule changes are included in updated versions of the Semgrep-based GitLab SAST analyzer."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "updated versions",
            "evidence": "The rule changes are included in updated versions of the Semgrep-based GitLab SAST analyzer."
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-gitlab-releases",
  "document_id": 23720,
  "published_at": "2024-02-15T00:00:00+00:00"
}