What changed in GitLab Runner from 18 to 19

New features

• Enable GitLab Functions on the shell executor !6964
• Echo Job Router last_update for long-poll coalescing !7130
• Add config lint command to validate config.toml files !6916 (Ashmit Sharma @4shm1td06)
• Add logging for snowplow_billing usage events syncing !7101
• Support zipzstd cache compression format !6892 (Rafael Fonseca @rafael.fonseca1)
• Add No docker prune env var !6828 (Pishel @pishel65)
• Clear CI token in git credential managers !6609 (Guillaume Chauvel @guillaume.chauvel)

Security fixes

• Go: Update module k8s.io/client-go to v0.36.2 !6838

Bug fixes

• Retry TestBuildPowerShellCatchesExceptions get_sources failure !7002
• Close connections leaked on setup error paths !6955
• Fix concrete scriptwriter aborting on else branches under errexit !6970
• Propagate artifact read errors to user instead of hiding them (closes #27922) !6910 (Ashmit Sharma @4shm1td06)
• Fix(packaging): prevent pre-remove script aborting when service not installed !6890 (Gourab Singha @gourabsingha1)
• Fix platform key breaking image inspect on Podman backend !6990
• Fix print_pod_warning_events not suppressing pod scheduling warnings !6927
• Avoid buggy Remove-Item -Recurse in PsWriter.RmDir !7145
• Retry TestBuildCacheHelper's git fetch on transient reset !6997
• Quiet git rm/clean output when clearing worktree on retry !7180
• Log successful network disconnect at Info level !7008 (Pishel @pishel65)
• Fix gitlab-runner verify failing when CI_SERVER_TOKEN is set !6928
• Allow spaces in Linux volume path names (closes #4442) !7005 (Ashmit Sharma @4shm1td06)
• Fail fast on a missing build-container stage script (attach strategy) !6941
• Apply isolation config to service containers (closes #39620) !7013 (Ashmit Sharma @4shm1td06)
• Kubernetes executor: write attach-mode stage scripts atomically !7090 (Cyprian Bergonia @nikoku)
• Restore IMAGE_FILTER_FLAGS default to label filter (closes #39621) !6985 (Ashmit Sharma @4shm1td06)
• Fix bare platform strings resolving to the runner host's OS !6993
• Send runner info with the verify request !7186
• Retry image pulls on a mid-connection reset, not just dial failures !6998
• Key S3 client cache by config value, not pointer !6961
• Auto-select the concrete helper image flavor on Kubernetes !7103
• Fix git config failures when HOME is unreadable with FF_GIT_URLS_WITHOUT_TOKENS enabled !7020 (Guillaume Chauvel @guillaume.chauvel)
• Expand service variables against all job variables !7102
• Default unset step when to on_success in concrete builder !6900
• Scope network-faults job to only run its own test !6996
• Fail job immediately on CreateContainerConfigError in k8s executor (closes #39361) !7014 (Ashmit Sharma @4shm1td06)

Maintenance

• Go: Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.107.0 !7174
• Enable Go modernizer stringscut !7121
• Patch regex. allow-all requires double star to also enable deeper nested... !7086 (Thomas Rooijakkers @ThomasTNO)
• Correct grammar in zip_extract.go comment !7009 (Pishel @pishel65)
• Go: Update module github.com/kardianos/service to v1.3.0 !7052
• Remove EOL spaces in doc files - 2026-08-14 !7181
• Correct typo in executor interface documentation !7042 (Mridankan Mandal @RedZapdos123)
• Go: Update module github.com/aws/aws-sdk-go-v2/credentials to v1.19.33 !7132
• Retry more real-network integration tests on gitlab.com 502s !7001
• Update dependency ruby to v4 !7087
• Go: Update module github.com/prometheus/procfs to v0.21.1 !7060
• Add 8 newly observed flaky tests to the auto-retry list !6994
• Go: Update gitlab.com/gitlab-org/fleeting/taskscaler/metrics/prometheus digest to 8295dd4 !7167
• Keep step-runner operator logs out of docker job traces !6901
• Enable Go modernizer rangeint !7117
• Go: Update module github.com/openbao/openbao/api/v2 to v2.6.0 !7057
• Go: Update module go.mozilla.org/pkcs7 to v0.10.0 !7064
• Go: Update module gitlab.com/gitlab-org/fleeting/nesting to v0.5.0 !6443
• Restructure Operator configuration page and document UID mismatch workarounds !7030 (Ben Bodenmiller @bbodenmiller)
• Go: Update module github.com/docker/cli to v29.6.2+incompatible !7023
• Go: Update module github.com/aws/aws-sdk-go-v2/service/sts to v1.45.3 !7151
• Add merge request template rule to AGENTS.md !7147 (Ben Bodenmiller @bbodenmiller)
• Go: Update module github.com/Azure/azure-sdk-for-go/sdk/azidentity to v1.14.0 !7034
• Also authenticate docker.io image checks against Docker Hub !6968
• Fix retry loop bashisms in clone test repo CI job !6943
• Go: Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.106.4 !7126
• Enable Go modernizer slicescontains !7119
• Enable Go linter errname !7110
• Update dependency yq to v4.53.3 !7074
• Wrap plain errors in some executors' Prepare() with BuildError !6965
• Go: Update module github.com/docker/go-connections to v0.8.1 !7104
• Identify helper image config errors during tests !6852 (Anthony Juckel @ajuckel)
• Go: Update module github.com/aws/aws-sdk-go-v2/credentials to v1.19.34 !7172
• Update dependency node to v24.18.1 !7106
• Go: Update module cloud.google.com/go/iam to v1.12.0 !7029
• Poll for exited container in prune integration test !6945
• Run docs Hugo test with latest docs Hugo container image !6963
• Go: Update module github.com/aws/aws-sdk-go-v2/credentials to v1.19.35 !7198
• Enable Go modernizer stringsseq !7122
• Wrap plain errors in parallels/virtualbox validateConfig() with BuildError !6966
• Update Go version references to 1.26.5 in development docs !7068
• Go: Update module github.com/fatih/color to v1.19.0 !7037
• Update dependency golangci/golangci-lint to v2.12.2 !7026
• Go: Update module github.com/aws/aws-sdk-go-v2 to v1.42.1 !6489
• Go: Update module gitlab.com/gitlab-org/step-runner to v0.41.0 !7063
• Go: Update module google.golang.org/api to v0.289.0 !6449
• Go: Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 !7157
• Remove completed-rollout feature flags (FF_USE_NEW_BASH_EVAL_STRATEGY, FF_SKIP_NOOP_BUILD_STAGES, FF_SET_PERMISSIONS_BEFORE_CLEANUP) !7144
• Product Docs AI Translation: GITTECHA-880 #1 !7088 …

Maintenance

• Verify resources: authenticate Docker Hub image checks !7162

Bug fixes

• [19.0] Key S3 client cache by config value, not pointer !6983

Bug fixes

• [19.1] Key S3 client cache by config value, not pointer !6982

New features

• Add Snowplow writer for usage-based billing !5886
• Add nanoserver:ltsc2025 and nanoserver:ltsc2025-arm64 helper images !6717 (Shanush Prema Thasarathan @shanushpt)
• Add native steps support to the instance executor !6807
• Add ability to push image indexes with pusher !5316 (Anthony Juckel @ajuckel)
• Make git credential helper visible to user-authored commands !6729
• Improve error message for wrong-architecture container images (closes #38824) !6907 (Ashmit Sharma @4shm1td06)
• Add circuit breaker for runner fallback to Rails on Relay failures !6839
• Add feature_qualified_name to Snowplow billing metadata !6898
• Add runner-side Job Router metrics !6841
• Eliminate duplicate ContainerInspect calls in resume flow (closes #39458) !6790 (Ashmit Sharma @4shm1td06)
• Auto-select arm64 Windows helper image on ARM64 hosts !6854 (Shanush Prema Thasarathan @shanushpt)
• Add concrete-mode pod assembly for the Kubernetes executor !6817
• Allow multiple/alternative filter flags in clear-docker-cache script (closes #39234) !6912 (Ashmit Sharma @4shm1td06)
• Run a synthetic job at startup before reporting Ready !6756
• Read sentry_dsn from SENTRY_DSN environment variable !6899
• Enable metrics for Snowplow writer for usage logging !6649

Security fixes

• Bump golang.org/x/net to v0.56.0 to resolve CVEs !6856
• Bump go-jose/go-jose/v4 to v4.1.4 to resolve CVE-2026-34986 !6857

Bug fixes

• Point default helper image tag at latest Alpine base !6897
• Remove Docker stop-kill timeout and add duration logging !6951
• Bump github.com/moby/spdystream to v0.5.1 !6885
• Reclassify benign WaitDelay outcome in script_legacy step !6848
• Update labkit/v2 to 2.26.1 !6914
• Fix powershell generate save script !6713 (Sean Fausett @gitfool)
• Stage concrete scratch under the build mount, not os.TempDir() !6832
• Use Runner UUID as subject in snowplow billing event !6903
• Fix disconnectNetwork container ID matching !6872 (Pishel @pishel65)
• Fix autoscaler pruning active instances on token rotation !6810
• Docker+machine: Fix VM leak when shutdown races a machine create or remove !6754
• Increase Docker stop timeout to 2m and improve error messaging !6868
• Add --docker-pull-policy flag to register command (closes #39304) !6930 (Ashmit Sharma @4shm1td06)
• Classify invalid docker DNS/MAC address as ConfigurationError !6942
• Retry transient docker image pull failures !6873
• Update module github.com/go-git/go-git/v5 to 5.19.1 !6884
• Classify secret-resolution failures by cause !6904

Maintenance

• 202606 - Fix broken external links !6843
• Product Docs AI Translation: GITTECHA-835 #1 !6866
• Enable minmax modernizer in golangci-lint !6875
• Migrate from .tool-versions to mise.toml !6880
• Classify invalid docker container-create requests as ConfigurationError !6958
• Install splitic from its canonical module path !6935
• Add FreeBSD supported versions statement !6908
• Update grpc to v1.81.1 in runner_wrapper (CVE-2026-33186) !6940
• [FixPipeline] https://gitlab.com/gitlab-org/gitlab-runner/-/pipelines/2637656030 !6894
• Wrap plain errors in image-pull paths with BuildError !6844
• Add TLS, DNS, and many-exposed-ports integration tests for moby v29 !6925
• Bump base-images to 0.0.45 !6845
• Wrap remaining plain errors in Kubernetes Prepare() with BuildError !6881
• Fix nonexistent timeout key names in Custom executor !6938
• Update RUNNER_IMAGES_VERSION to 0.0.47 to resolve ubi-fips CVEs !6950
• Adds GITTECHC to use for CI Translations !6909
• Product Docs AI Translation: GITTECHA-703 #1 !6783
• Stop pinning exact digest in helper image config test !6944
• Fix UBI image trigger artifact ref for merge train and detached pipelines !6877
• (docsi18n) - Monthly maintenance - fix markdown lint errors in docs-locale !6959
• Update the version or the logging field validator !6956
• Retry jobs interrupted by external termination !6921
• Remove dead code from CI pipeline definitions !6826
• Update docker Docker tag to v27.5.1 !6461
• Pass git clean args as separate args in submodule foreach !6949
• Product Docs AI Translation: GITTECHA-834 #1 !6865
• Add AGENTS.md and CLAUDE.md files for documentation !6860
• Improve Go build caching strategy in CI !6906
• Add RHEL-family libvirt base image, fix --os-variant !6937
• Document dns and mac_address validation behavior !6947
• Migrate Docker SDK to moby/moby v29 to fix docker/* CVEs !6902
• Use per-branch Go build cache with main fallback !6915
• Rootless Podman resource limits (cgroups v2) and socket safety !6936
• Builtin functions implement BuiltinFunction interface !6874
• Product Docs AI Translation: GITTECHA-836 #1 !6867
• Classify image-pull access-denied errors as ConfigurationError !6850

Bug fixes

• Fix Bash script body leak on job cancellation !6870

Maintenance

• Disable TestKubernetesBuildPodResources !6879

Bug fixes

• Increase Docker stop timeout to 2m and improve error messaging !6868

New features

• feat(kubernetes): add MatchLabelKeys & MismatchLabelKeys for PodAffinityTerm !6711 (Tobias Germer @germert)
• Fall back to direct polling when the Job Router is disabled !6811
• Add native windows/arm64 helper binary build target !6697 (Shanush Prema Thasarathan @shanushpt)
• Add suspend/resume support to the Docker Autoscaler executor !6719
• Skip job request and warn when runner token is empty !6821
• Use fresh context in StopKillWait when build ctx is cancelled !6636
• Retry secrets retrieval !6072 (Syed Saif Ali Alvi @syedsaifalialvi)
• Bundle native arm64 helper binary in windows-servercore-ltsc2025-arm64 image !6716 (Shanush Prema Thasarathan @shanushpt)
• docker+machine: Add discovered placement labels to autoscaling metrics !6740
• Kubernetes executor: add imagePullSecrets support for pause pods !6672 (Ashmit Sharma @4shm1td06)
• Docker: support PidMode for setting PID namespace !6694 (Diego Becciolini @itizir)
• Send environment key as part of job status update !6813
• Add get_sources timeout to runner config !6822
• Introduce gitlab_runner_process_state_info metric !6793

Bug fixes

• Fix jobs stuck in canceling due to missing final update !6770
• clear-docker-cache: fall back to podman when docker is absent !6755
• Fix concrete execution divergences from abstract shell !6801
• Silence exec-cleanup warning under Podman !6773
• Fix Bash script body leak on job cancellation !6784
• clear-docker-cache: drop unsupported -a from podman volume prune !6808
• Update to Go 1.26.3 !6760
• Forward job variables to concrete's nested run: dispatch !6825
• Scope http.proactiveAuth to remote host !6798
• docker+machine: cap finalizeRemoval retries !6791
• Remove need for grep to enable pipefail !6739 (Matt Clarkson @mattyclarkson)
• Update warning for alias overlap in executors/docker/services.go !6742
• Expand variables in image_name log fields !6809
• Fix flaky test !6786

Maintenance

• Product Docs AI Translation: GITTECHA-704 #1 !6785
• Product Docs AI Translation: GITTECHA-707 #1 !6796
• Add artifact timeout options !6761
• Refactor prepare_timeout !6778
• Update docker-machine version to the latest one !6775
• Update redirecting links to resolved URLs !6831
• Docs - May 2026 maintenance - fix links !6803
• Add french and korean seed content !6751
• Update FF_USE_ADAPTIVE_REQUEST_CONCURRENCY section for accuracy !6820
• docs(docker): document dind MTU inheritance gap and workaround !6737
• Manage golangci-lint via mise !6824
• Honor FF_TIMESTAMPS and reclassify benign exec outcomes in concrete !6769
• Explicitly tell to move away from the Fargate driver !6667
• Clarify FIPS Runner support across distributions !6812
• go: Update module k8s.io/apimachinery to v0.35.2 !6482
• Set explicit FailureReason on BuildError constructions across executors !6724
• Update base images version to pick up CVE fixes !6765
• Product Docs AI Translation: GITTECHA-708 #1 !6797
• Argo Translations from GITTECHA-647 #1 !6777
• Add missing appsec labels !5680
• Docs Follow-Up: Supported shells !6718 (Pishel @pishel65)
• Restore ShellWriter CommandWithStdin !6608 (Guillaume Chauvel @guillaume.chauvel)
• Fix cidr typo !6676 (Paul Gear @paulgear)
• Disable TestKubernetesBuildPodResources !6827
• Product Docs AI Translation: GITTECHA-702 #1 !6789
• Product Docs AI Translation: GITTECHA-706 #1 !6795
• Update docker-machine version !6800
• Add a few more flaky tests to .flaky-tests !6780

Bug fixes

• Update to go 1.26.3 [backport to 19.0] !6788

New features

• Document prepare_timeout setting !6731
• Add OpenTelemetry tracing for CI job execution !6518
• Add LTSC2025 and LTSC2025-arm64 based gitlab-runner-helper images for windows !6033 (Shanush Prema Thasarathan @shanushpt)
• Use Pipeline ID form job payload for logging and similar !6631
• Allow configuring parallelism and chunk sizes for cache uploads and... !6401 (Rafael Fonseca @rafael.fonseca1)
• Dispatch run: through concrete via a nested step-runner job !6703
• Add mount propagation option to emptyDir volumes !6553 (Rafael Fonseca @rafael.fonseca1)
• Add StepRunnerStream writer that detects pre-stamped lines !6710
• Enforce prepare_timeout config field !6708
• Add mode label to failed_jobs_total and job_duration_seconds metrics !6620
• User Job Cancellation Calls Cancel API !6681
• Treat span id as required !6692
• Map step-runner errors to job failure reasons !6597
• Add support for nfs mounts !6544 (Julian Rettelbach @rettelbachj)
• Cache: list valid types and accept any case for cache Type !6736
• Add suspend/resume support for instance autoscaler executor !6570
• Add prepare_timeout config field !6653
• Add variable with network name when using FF_NETWORK_PER_BUILD !6632 (Pishel @pishel65)

Bug fixes

• Merge branch 'sh-fix-role-arn-injection' into 'main' !6714
• Update Kubernetes executor service container naming documentation !6730
• Recover helper argv when image entrypoint drops CMD !6725
• Adaptive request concurrency: do not treat retried requests as capacity !6677
• Restore timeout-warning trace parity with legacy in concrete mode !6704
• Go Dependency update: github.com/invopop/jsonschema to resolve CVE-2026-32285 !6696
• Merge branch 'security-fix-k8s-uid-gid-root-bypass' into 'main' !6643
• Add support for specifying seccomp profile path in Docker executor !6602 (Felix Geyer @debfx)
• Fix proxy-exec and step-runner hangs when scripts spawn background processes !6707
• Fix per secret overrides for role_arn and role_session_name AWS Secrets Manager integration !6067 (derikwang @derik01)
• Pass proactiveAuth to git checkout for partial-clone lazy fetches !6695
• Normalize Windows exit codes from unsigned to signed 32-bit !6587
• Scope CONFIG_FILE default to manager command structs !6741
• Update the parallels executor to work with Windows guests !105 (Chris Rose @cdrx)
• Fix S3 cache broken on third-party providers by SDK checksum defaults !6691
• Fix dependencies on UBI downstream pipeline trigger job !6684
• Expose service variables in custom executor CUSTOM_ENV_CI_JOB_SERVICES !6556 (Sepehr Heydari @sepehrheydari72)
• Fix the randomize shell selection in Windows shell executor !6644 (Pishel @pishel65)
• Fix slice size !6732
• Fix gaps in the abstract shell to concrete migration !6688
• Add HEAD method support to S3v2 presign URL !6682 (Sepehr Heydari @sepehrheydari72)
• Escape $ as $$ in Kubernetes env var values to prevent $(VAR) expansion !6640
• Fix home environment variable !101

Maintenance

• Fix typo: simlar → similar in troubleshooting docs !6654 (Bob Singh @bobsingh.dev)
• Fix typos and grammar in templates !6658 (Bob Singh @bobsingh.dev)
• Simplify CI job architecture for Go linting !6752
• Add Node.js to dev tools !6750
• Add French and Korean to Argo !6612
• Cache: select newer remote artifact when FF_HASH_CACHE_KEYS is toggled !6574
• Add shellcheck for shell script linting !6625
• Timestamper improvements (perf, potential bug fix) !6698
• Set explicit FailureReason on BuildError constructions across executors !6683
• Update base images version to pick up CVE fixes (19.0 backport) !6776
• Resolve shell script issues flagged by shellcheck !6734
• Fix missing 'to' in sentence !6656 (Bob Singh @bobsingh.dev)
• Followup MR for MR 6663 !6673
• Fix race in TestPodWatcher on Windows: listen before Create !6623
• Common: make executor retry sleep interruptible by context cancellation !6610 (Bob Singh @bobsingh.dev)
• Clarify gitlab com version !6720
• Reference kuberenetes executor service account permissions required for certain feature flags !6668
• Docker machine version 46 !6693
• Fix RPM package architecture names in download docs !6634
• Fix grammar in feature flag rollout template !6661 (Bob Singh @bobsingh.dev)
• Fix grammar in bug issue template !6664 (Bob Singh @bobsingh.dev)
• Remove erroneous entry from changelog !6728
• Fix hyphenation in Cross-Functional Programs heading !6660 (Bob Singh @bobsingh.dev)
• Reorder executor tables to surface actively developed executors first !6638
• Fix grammar in documentation issue template !6663 (Bob Singh @bobsingh.dev)
• Fix goroutine variable capture in shutdownUsedExecutorProviders !6606 (Bob Singh @bobsingh.dev)
• Fix typos and grammar in security template !6659 (Bob Singh @bobsingh.dev)
• Automatically retry flaky tests !6687
• Reorganize TestCredSetup !6607 (Guillaume Chauvel @guillaume.chauvel)
• Update file docker.md !6627
• Update RUNNER_IMAGES_VERSION to 0.0.42 to resolve ubi-fips CVEs !6733
• Docs(docker-machine): update docs !6689
• Update shell support in docs !6647 (Pishel @pishel65)
• Remove EOL spaces in doc files - 2026-04-28 !6686
• Fix context propagation in Kubernetes executor !6364 (Emmanuel 326 @Emmanuel326)
• Clarify documention on default shell in windows !6645 (Pishel @pishel65)
• Clean up Podman with Kubernetes examples !6626
• Update file docker.md !6738
• Update linting tools and linting container image for documentation !6706
• Add overview descriptions to executor pages !6702
• Fix grammar in feature flag cleanup template !6662 (Bob Singh @bobsingh.dev)
• Add hadolint for Dockerfile linting !6635
• Go: Update module github.com/jedib0t/go-pretty/v6 to v6.7.9 !6671
• Creates a gitlab_runner_cache_s3_assume_role_failures_total metric !6655
• Cache: shard S3 object paths by first two chars of hash when FF_HASH_CACHE_KEYS is enabled !6628
• Fix duplicate word typos in various source file comments !6586 (Igor Eccard @iseccard) …