# GitLab Runner changelog

> GitLab Runner is the open source project that is used to run your CI/CD jobs and send the results back to GitLab

- Vendor: GitLab
- Category: Developer Tools
- Official site: https://gitlab.com/gitlab-org/gitlab-runner
- Tracked by: What's New (https://whatsnew.fyi/product/gitlab-runner)
- Harvested from: Blog (https://gitlab.com/gitlab-org/gitlab-runner/-/tags?format=atom)
- Entries below: 15 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v19.2.2

- Date: 2026-08-12
- Version: v19.2.2
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.2.2
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.2.2

Version v19.2.2

- **changed** — Authenticate Docker Hub image checks when verifying resources

###### Maintenance

- Verify resources: authenticate Docker Hub image checks [!7162](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/7162)

### v19.0.3

- Date: 2026-07-28
- Version: v19.0.3
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.0.3
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.0.3

Version v19.0.3

- **fixed** — Key S3 client cache by config value, not pointer

###### Bug fixes

- [19.0] Key S3 client cache by config value, not pointer [!6983](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6983)

### v19.1.2

- Date: 2026-07-28
- Version: v19.1.2
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.1.2
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.1.2

Version v19.1.2

- **fixed** — Key S3 client cache by config value, not pointer

###### Bug fixes

- [19.1] Key S3 client cache by config value, not pointer [!6982](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6982)

### v19.2.1

- Date: 2026-07-28
- Version: v19.2.1
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.2.1
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.2.1

Version v19.2.1

### v19.2.0

- Date: 2026-07-10
- Version: v19.2.0
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.2.0
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.2.0

Version v19.2.0

- **added** — Add Snowplow writer for usage-based billing
- **added** — Add nanoserver:ltsc2025 and nanoserver:ltsc2025-arm64 helper images
- **added** — Add native steps support to the instance executor
- **added** — Add ability to push image indexes with pusher
- **added** — Make git credential helper visible to user-authored commands
- **added** — Improve error message for wrong-architecture container images
- **added** — Add circuit breaker for runner fallback to Rails on Relay failures
- **added** — Add feature_qualified_name to Snowplow billing metadata
- **added** — Add runner-side Job Router metrics
- **added** — Eliminate duplicate ContainerInspect calls in resume flow
- **added** — Auto-select arm64 Windows helper image on ARM64 hosts
- **added** — Add concrete-mode pod assembly for the Kubernetes executor
- **added** — Allow multiple/alternative filter flags in clear-docker-cache script
- **added** — Run a synthetic job at startup before reporting Ready
- **added** — Read sentry_dsn from SENTRY_DSN environment variable
- **added** — Enable metrics for Snowplow writer for usage logging
- **security** — Bump golang.org/x/net to v0.56.0 to resolve CVEs
- **security** — Bump go-jose/go-jose/v4 to v4.1.4 to resolve CVE-2026-34986
- **fixed** — Point default helper image tag at latest Alpine base
- **fixed** — Remove Docker stop-kill timeout and add duration logging

###### New features

- Add Snowplow writer for usage-based billing [!5886](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/5886)
- Add nanoserver:ltsc2025 and nanoserver:ltsc2025-arm64 helper images [!6717](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6717) (Shanush Prema Thasarathan @shanushpt)
- Add native steps support to the instance executor [!6807](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6807)
- Add ability to push image indexes with pusher [!5316](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/5316) (Anthony Juckel @ajuckel)
- Make git credential helper visible to user-authored commands [!6729](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6729)
- Improve error message for wrong-architecture container images (closes #38824) [!6907](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6907) (Ashmit Sharma @4shm1td06)
- Add circuit breaker for runner fallback to Rails on Relay failures [!6839](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6839)
- Add feature_qualified_name to Snowplow billing metadata [!6898](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6898)
- Add runner-side Job Router metrics [!6841](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6841)
- Eliminate duplicate ContainerInspect calls in resume flow (closes #39458) [!6790](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6790) (Ashmit Sharma @4shm1td06)
- Auto-select arm64 Windows helper image on ARM64 hosts [!6854](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6854) (Shanush Prema Thasarathan @shanushpt)
- Add concrete-mode pod assembly for the Kubernetes executor [!6817](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6817)
- Allow multiple/alternative filter flags in clear-docker-cache script (closes #39234) [!6912](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6912) (Ashmit Sharma @4shm1td06)
- Run a synthetic job at startup before reporting Ready [!6756](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6756)
- Read sentry_dsn from SENTRY_DSN environment variable [!6899](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6899)
- Enable metrics for Snowplow writer for usage logging [!6649](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6649)

###### Security fixes

- Bump golang.org/x/net to v0.56.0 to resolve CVEs [!6856](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6856)
- Bump go-jose/go-jose/v4 to v4.1.4 to resolve CVE-2026-34986 [!6857](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6857)

###### Bug fixes

- Point default helper image tag at latest Alpine base [!6897](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6897)
- Remove Docker stop-kill timeout and add duration logging [!6951](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6951)
- Bump github.com/moby/spdystream to v0.5.1 [!6885](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6885)
- Reclassify benign WaitDelay outcome in script_legacy step [!6848](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6848)
- Update labkit/v2 to 2.26.1 [!6914](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6914)
- Fix powershell generate save script [!6713](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6713) (Sean Fausett @gitfool)
- Stage concrete scratch under the build mount, not os.TempDir() [!6832](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6832)
- Use Runner UUID as subject in snowplow billing event [!6903](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6903)
- Fix disconnectNetwork container ID matching [!6872](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6872) (Pishel @pishel65)
- Fix autoscaler pruning active instances on token rotation [!6810](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6810)
- Docker+machin

_[Truncated at 4000 characters — full notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.2.0]_

### v18.11.4

- Date: 2026-06-29
- Version: v18.11.4
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v18.11.4
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v18.11.4

Version v18.11.4

- **fixed** — Fix Bash script body leak on job cancellation

###### Bug fixes

- Fix Bash script body leak on job cancellation [!6861](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6861)

###### Maintenance

- Disable TestKubernetesBuildPodResources [!6878](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6878)

### v19.0.2

- Date: 2026-06-29
- Version: v19.0.2
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.0.2
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.0.2

Version v19.0.2

- **fixed** — Fix Bash script body leak on job cancellation

###### Bug fixes

- Fix Bash script body leak on job cancellation [!6870](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6870)

###### Maintenance

- Disable TestKubernetesBuildPodResources [!6879](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6879)

### v19.1.1

- Date: 2026-06-25
- Version: v19.1.1
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.1.1
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.1.1

Version v19.1.1

- **fixed** — Increase Docker stop timeout to 2m and improve error messaging

###### Bug fixes

- Increase Docker stop timeout to 2m and improve error messaging [!6868](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6868)

### v19.1.0

- Date: 2026-06-16
- Version: v19.1.0
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.1.0
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.1.0

Version v19.1.0

- **added** — Add MatchLabelKeys and MismatchLabelKeys support for PodAffinityTerm in Kubernetes executor
- **added** — Fall back to direct polling when the Job Router is disabled
- **added** — Add native windows/arm64 helper binary build target
- **added** — Add suspend/resume support to the Docker Autoscaler executor
- **added** — Skip job request and warn when runner token is empty
- **added** — Retry secrets retrieval
- **added** — Bundle native arm64 helper binary in windows-servercore-ltsc2025-arm64 image
- **added** — Add discovered placement labels to autoscaling metrics in docker+machine
- **added** — Add imagePullSecrets support for pause pods in Kubernetes executor
- **added** — Support PidMode for setting PID namespace in Docker
- **added** — Send environment key as part of job status update
- **added** — Add get_sources timeout to runner config
- **added** — Introduce gitlab_runner_process_state_info metric
- **changed** — Use fresh context in StopKillWait when build context is cancelled
- **changed** — Update to Go 1.26.3
- **changed** — Update docker-machine version to the latest one
- **fixed** — Fix jobs stuck in canceling due to missing final update
- **fixed** — Clear-docker-cache: fall back to podman when docker is absent
- **fixed** — Fix concrete execution divergences from abstract shell
- **fixed** — Silence exec-cleanup warning under Podman
- **fixed** — Fix Bash script body leak on job cancellation

###### New features

- feat(kubernetes): add MatchLabelKeys & MismatchLabelKeys for PodAffinityTerm [!6711](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6711) (Tobias Germer @germert)
- Fall back to direct polling when the Job Router is disabled [!6811](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6811)
- Add native windows/arm64 helper binary build target [!6697](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6697) (Shanush Prema Thasarathan @shanushpt)
- Add suspend/resume support to the Docker Autoscaler executor [!6719](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6719)
- Skip job request and warn when runner token is empty [!6821](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6821)
- Use fresh context in StopKillWait when build ctx is cancelled [!6636](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6636)
- Retry secrets retrieval [!6072](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6072) (Syed Saif Ali Alvi @syedsaifalialvi)
- Bundle native arm64 helper binary in windows-servercore-ltsc2025-arm64 image [!6716](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6716) (Shanush Prema Thasarathan @shanushpt)
- docker+machine: Add discovered placement labels to autoscaling metrics [!6740](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6740)
- Kubernetes executor: add imagePullSecrets support for pause pods [!6672](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6672) (Ashmit Sharma @4shm1td06)
- Docker: support `PidMode` for setting PID namespace [!6694](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6694) (Diego Becciolini @itizir)
- Send environment key as part of job status update [!6813](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6813)
- Add get_sources timeout to runner config [!6822](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6822)
- Introduce gitlab_runner_process_state_info metric [!6793](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6793)

###### Bug fixes

- Fix jobs stuck in canceling due to missing final update [!6770](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6770)
- clear-docker-cache: fall back to podman when docker is absent [!6755](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6755)
- Fix concrete execution divergences from abstract shell [!6801](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6801)
- Silence exec-cleanup warning under Podman [!6773](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6773)
- Fix Bash script body leak on job cancellation [!6784](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6784)
- clear-docker-cache: drop unsupported -a from podman volume prune [!6808](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6808)
- Update to Go 1.26.3 [!6760](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6760)
- Forward job variables to concrete's nested run: dispatch [!6825](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6825)
- Scope http.proactiveAuth to remote host [!6798](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6798)
- docker+machine: cap finalizeRemoval retries [!6791](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6791)
- Remove need for `grep` to enable `pipefail` [!6739](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6739) (Matt Clarkson @mattyclarkson)
- Update warning for alias overlap in executors/docker/services.go [!6742](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6742)
- Expand variables in image_name log fields [!6809](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6809)
- Fix flaky test [!6786](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6786)

###### Maintenance

- Product Docs AI Translation: GITTECHA-704 #1 [!6785](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_re

_[Truncated at 4000 characters — full notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.1.0]_

### v19.0.1

- Date: 2026-05-29
- Version: v19.0.1
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.0.1
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.0.1

Version v19.0.1

- **fixed** — Update to Go 1.26.3

###### Bug fixes

- Update to go 1.26.3 [backport to 19.0] [!6788](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6788)

### v19.0.0

- Date: 2026-05-22
- Version: v19.0.0
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.0.0
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v19.0.0

Version v19.0.0

- **added** — Add OpenTelemetry tracing for CI job execution
- **added** — Add LTSC2025 and LTSC2025-arm64 based gitlab-runner-helper images for windows
- **added** — Use Pipeline ID from job payload for logging
- **added** — Allow configuring parallelism and chunk sizes for cache uploads
- **added** — Add mount propagation option to emptyDir volumes
- **added** — Add StepRunnerStream writer that detects pre-stamped lines
- **added** — Add mode label to failed_jobs_total and job_duration_seconds metrics
- **added** — Add support for nfs mounts
- **added** — Add suspend/resume support for instance autoscaler executor
- **added** — Add prepare_timeout config field
- **added** — Add variable with network name when using FF_NETWORK_PER_BUILD
- **added** — Add support for specifying seccomp profile path in Docker executor
- **changed** — Enforce prepare_timeout config field
- **changed** — Treat span id as required
- **changed** — Cache: list valid types and accept any case for cache Type
- **changed** — Normalize Windows exit codes from unsigned to signed 32-bit
- **changed** — Update the parallels executor to work with Windows guests
- **fixed** — Recover helper argv when image entrypoint drops CMD
- **fixed** — Adaptive request concurrency: do not treat retried requests as capacity
- **fixed** — Fix proxy-exec and step-runner hangs when scripts spawn background processes
- **security** — Resolve CVE-2026-32285 in github.com/invopop/jsonschema dependency

###### New features

- Document prepare_timeout setting [!6731](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6731)
- Add OpenTelemetry tracing for CI job execution [!6518](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6518)
- Add LTSC2025 and LTSC2025-arm64 based gitlab-runner-helper images for windows [!6033](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6033) (Shanush Prema Thasarathan @shanushpt)
- Use Pipeline ID form job payload for logging and similar [!6631](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6631)
- Allow configuring parallelism and chunk sizes for cache uploads and... [!6401](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6401) (Rafael Fonseca @rafael.fonseca1)
- Dispatch run: through concrete via a nested step-runner job [!6703](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6703)
- Add mount propagation option to emptyDir volumes [!6553](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6553) (Rafael Fonseca @rafael.fonseca1)
- Add StepRunnerStream writer that detects pre-stamped lines [!6710](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6710)
- Enforce prepare_timeout config field [!6708](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6708)
- Add mode label to failed_jobs_total and job_duration_seconds metrics [!6620](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6620)
- User Job Cancellation Calls Cancel API [!6681](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6681)
- Treat span id as required [!6692](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6692)
- Map step-runner errors to job failure reasons [!6597](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6597)
- Add support for nfs mounts [!6544](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6544) (Julian Rettelbach @rettelbachj)
- Cache: list valid types and accept any case for cache Type [!6736](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6736)
- Add suspend/resume support for instance autoscaler executor [!6570](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6570)
- Add prepare_timeout config field [!6653](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6653)
- Add variable with network name when using FF_NETWORK_PER_BUILD [!6632](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6632) (Pishel @pishel65)

###### Bug fixes

- Merge branch 'sh-fix-role-arn-injection' into 'main' [!6714](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6714)
- Update Kubernetes executor service container naming documentation [!6730](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6730)
- Recover helper argv when image entrypoint drops CMD [!6725](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6725)
- Adaptive request concurrency: do not treat retried requests as capacity [!6677](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6677)
- Restore timeout-warning trace parity with legacy in concrete mode [!6704](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6704)
- Go Dependency update: github.com/invopop/jsonschema to resolve CVE-2026-32285 [!6696](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6696)
- Merge branch 'security-fix-k8s-uid-gid-root-bypass' into 'main' [!6643](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6643)
- Add support for specifying seccomp profile path in Docker executor [!6602](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6602) (Felix Geyer @debfx)
- Fix proxy-exec and step-runner hangs when scripts spawn background processes [!6707](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6707)
- Fix per secret overrides for role_arn and role_session_name AWS Secrets Manager integration [!6067](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6067) (derikwang @derik01)
- P

_[Truncated at 4000 characters — full notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v19.0.0]_

### v18.11.3

- Date: 2026-05-11
- Version: v18.11.3
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v18.11.3
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v18.11.3

Version v18.11.3

- **fixed** — Fix role ARN injection vulnerability

###### Bug fixes

- Merge branch 'sh-fix-role-arn-injection' into '18-11-stable' [!6715](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6715)

### v18.11.2

- Date: 2026-05-02
- Version: v18.11.2
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v18.11.2
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v18.11.2

Version v18.11.2

- **fixed** — Add HEAD method support to S3v2 presign URL
- **fixed** — Fix S3 cache broken on third-party providers by SDK checksum defaults

###### Bug fixes

- Add HEAD method support to S3v2 presign URL [!6682](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6682) (Sepehr Heydari @sepehrheydari72)
- Fix S3 cache broken on third-party providers by SDK checksum defaults [!6691](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6691)

### v18.11.1

- Date: 2026-04-20
- Version: v18.11.1
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v18.11.1
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v18.11.1

Version v18.11.1

- **security** — Fix Kubernetes UID/GID root bypass vulnerability

###### Bug fixes

- Merge branch 'security-fix-k8s-uid-gid-root-bypass' into 'main' [!6643](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6643)

### v18.11.0

- Date: 2026-04-16
- Version: v18.11.0
- Original notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v18.11.0
- Permalink: https://whatsnew.fyi/product/gitlab-runner/releases/v18.11.0

Version v18.11.0

- **added** — Consolidate the HTTP Status Code field
- **changed** — Change the concrete helper image to use shell-form CMD
- **added** — Cache AssumeRole credentials to reduce STS requests
- **added** — Implement Concrete CI Function
- **added** — Add logging field validator CI job
- **fixed** — Fix default artifacts upload timeout values
- **added** — Add k8s nodename to pod phase output
- **added** — Add native steps job counter metric
- **added** — Bundle git and CA certificates for concrete runner
- **changed** — Update builtins to use step-runner BuiltinContext interface
- **added** — Add seccomp and AppArmor profile support to Kubernetes executor security context
- **added** — Kubernetes: add PodDisruptionBudget support for job pods
- **added** — Pass socket path from step-runner serve to proxy command
- **added** — Kubernetes: autoscaler for idle capacity via pause pods
- **fixed** — Rate-limit and instrument S3 AssumeRole calls
- **fixed** — Cache S3 client to reduce IMDS requests
- **fixed** — PowerShell/Pwsh environment variables can't process special characters in their names
- **fixed** — Fix proxy-mask credential store file permissions on Unix
- **fixed** — Fix disable_cache disabling all volumes instead of only cache
- **fixed** — Restore fixed runner command path

###### New features

- Consolidate the HTTP Status Code field [!6492](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6492)
- Change the concrete helper image to use shell-form CMD [!6591](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6591)
- Cache AssumeRole credentials to reduce STS requests [!6549](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6549)
- Implement Concrete CI Function [!6410](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6410)
- Add logging field validator CI job [!6580](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6580)
- Fix default artifacts upload timeout values [!6584](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6584)
- Add k8s nodename to pod phase output [!6311](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6311) (Thorsten Banhart @banhartt)
- Add native steps job counter metric [!6369](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6369)
- Bundle git and CA certificates for concrete runner [!6504](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6504)
- Update builtins to use step-runner BuiltinContext interface [!6616](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6616)
- Add seccomp and AppArmor profile support to Kubernetes executor security context [!6512](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6512) (Marc Ullman @MarcUllman)
- Kubernetes: add PodDisruptionBudget support for job pods [!6331](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6331)
- Pass socket path from step-runner serve to proxy command [!6507](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6507)
- Resolve "Windows Runners: Document "session 0" restrictions (screen resolution statically set to 1024x768)" [!4994](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/4994)
- Kubernetes: autoscaler for idle capacity via pause pods [!6334](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6334)

###### Bug fixes

- Update FF_SCRIPT_SECTIONS documentation to reflect current behavior [!6519](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6519) (Pishel65 @pishel65)
- Rate-limit and instrument S3 AssumeRole calls [!6528](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6528)
- Cache/s3v2: cache S3 client to reduce IMDS requests [!6530](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6530)
- PowerShell/Pwsh environment variables can't process special characters in their names. [!6502](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6502) (Pishel65 @pishel65)
- Fix proxy-mask credential store file permissions on Unix [!6510](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6510)
- Fix disable_cache disabling all volumes instead of only cache [!6552](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6552) (Aaron Döppner @aarondpn-sp)
- Restore fixed runner command path [!6529](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6529)
- Use custom endpoint in detectBucketLocation [!6532](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6532)
- Log warning when DOCKER_AUTH_CONFIG credentials resolution fails [!6578](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6578)
- Properly escape ANSI color codes in shell scripts [!6527](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6527)
- Improve step_script to bring it on part with Runner legacy path [!6596](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6596)
- Revert "Remove GPG signing color" [!6554](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6554)

###### Maintenance

- No global executors [!6508](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6508)
- Patch(cache): ensure cache exists before uploading [!6569](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6569)
- Highlight actively developed executors [!6585

_[Truncated at 4000 characters — full notes: https://gitlab.com/gitlab-org/gitlab-runner/-/tags/v18.11.0]_