GoKawiil
Tech News
As KDE nears its 30th anniversary, contributor Kevin Ottens published community data showing developer participation has climbed back to around 140 people on average, up from a low of about 110 in 2017. Commit activity has also surged, with 2023 setting an all-time weekly record, and the KDE Plasma desktop project nearly doubling its average team size following the 2020 move to GitLab.
GitLab is overhauling how it throttles requests on GitLab.com, moving from flat limits to caps tied to each subscription plan, applied per user and per top-level group. Free accounts and unauthenticated traffic hit the new limits on October 19, 2026, with two brownout previews on October 7 and 14; Premium and Ultimate users follow in January 2027. Unauthenticated requests, including automation hitting the API without credentials, will be capped at 60 requests per hour per IP regardless of account tier.
A maximum-severity flaw in GitLab's Community and Enterprise editions, patched September 10, is being actively exploited to pull arbitrary files from self-hosted GitLab servers without authentication. WatchTowr researchers say attackers have moved from probing to full exploitation, extracting configuration files, secrets, and SSH settings from compromised systems. CISA has added the bug to its Known Exploited Vulnerabilities list, ordering federal agencies to patch or take affected instances offline.
CISA has added a maximum-severity GitLab vulnerability, CVE-2026-85706, to its known exploited vulnerabilities catalog after security firm watchTowr detected attackers scanning the internet for unpatched servers. The flaw allows unauthenticated attackers to read credentials and sensitive files from GitLab instances via a single crafted HTTP request to the repository commits API. GitLab patched the issue in versions 19.3.2, 19.2.6, and 19.1, but federal agencies now have just three days to remediate under a binding directive.
GitLab issued emergency patches for CVE-2026-85706, a maximum-severity path traversal flaw in its repository commits API that lets unauthenticated attackers read arbitrary files on vulnerable servers. The company also fixed a second critical bug, CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer that could let authenticated Duo Chat users steal credentials and Advanced Search configurations. Both flaws are addressed in versions 19.3.2, 19.2.6, and 19.1.
Dutch developer Peter Ullrich is building Pushin.eu, a Git hosting platform designed to keep code and data entirely within Europe. The service is currently in invite-only beta, with general availability planned for early 2027, and will eventually charge subscription fees comparable to GitHub and GitLab.
Maiao, a command-line tool that recreates Gerrit's stacked-commit review workflow on modern git hosts, has been picked up by community maintainers under runetes/maiao after Adevinta's original team stopped maintaining it. The tool's 'git review' command turns each commit in a branch into its own linked pull or merge request, automatically managing parent-child dependencies and rebasing the stack as changes get merged. It now supports GitHub, GitLab, Gitea, Forgejo/Codeberg, Bitbucket Cloud, and the beta Cursor Origin platform, auto-detecting the provider from the repository's remote URL.