Today we are releasing versions 8.10.6, 8.9.7, and 8.8.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).
Version 8.10.6 contains a security fix for GitLab, plus fixes for minor regressions. All versions include a security update for Rails. We recommend that all GitLab installations be upgraded to one of these versions.
Please read on for more details.
Due to incorrect attribute whitelisting, it was possible for a project export to contain the full User attributes of project members, including their API tokens. See the issue for more details.
Update (2016-08-17 22:00 UTC): We have temporarily made importing a GitLab project export require administrator access while we further audit the security of the import/export feature as a whole.
Rails recently released version 18.104.22.168 to address two security vulnerabilities, so we've updated the version included in GitLab.
These versions do not include any migrations, and should not require any downtime.
Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a
To update, check out our update page.
Want to be alerted to new security patches as soon as they're available? Sign up for our Security Newsletter.
Interested in GitLab Enterprise Edition? Check out the features exclusive to EE.
Access to GitLab Enterprise Edition is included with a subscription. No time to upgrade GitLab yourself? Subscribers receive upgrade and installation services.