GitLab 19.4 release notes

{
  "id": "a3e599160a9b51d9ac2741b9e75b5e22518aad708ee42fc5fcad14655cb02f44",
  "url": "https://docs.gitlab.com/releases/19/gitlab-19-4-released/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "GitLab 19.4 release notes",
    "summary": "GitLab 19.4 expands automatic revocation of leaked personal access tokens to routable formats and adds beta detection of malicious packages in Dependency Scanning. It also enables Geo SSH proxying by default, with a deployment-specific action required to avoid possible SSH hangs or timeouts.",
    "evidence": "In GitLab 19.4 and later, revocation recognizes all three GitLab personal access token detection rules:",
    "products": [
      {
        "name": {
          "value": "GitLab",
          "evidence": "GitLab 19.4 release notes"
        },
        "prerequisites": [
          {
            "value": "Instances with automatic response enabled",
            "evidence": "Instances with automatic response enabled get this wider coverage immediately."
          },
          {
            "value": "Cloud Native GitLab deployments using the bundled NGINX Ingress must either: upgrade to use the Gateway API with Envoy Gateway before this rollout, or disable both feature flags after the rollout.",
            "evidence": "Cloud Native GitLab deployments using the bundled NGINX Ingress must either: upgrade to use the Gateway API with Envoy Gateway before this rollout, or disable both feature flags after the rollout."
          }
        ],
        "fixed_versions": [
          {
            "value": "GitLab 19.4",
            "evidence": "In GitLab 19.4 and later, revocation recognizes all three GitLab personal access token detection rules:"
          }
        ],
        "affected_versions": [
          {
            "value": "GitLab versions earlier than 19.4",
            "evidence": "In GitLab versions earlier than 19.4, revocation used only one detection rule and revoked only the legacy token format."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-gitlab-releases",
  "document_id": 23689,
  "published_at": "2026-09-17T00:00:00+00:00"
}