Update gitlab/gitlab-runner Docker tag to v19

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
gitlab/gitlab-runner (changelog)	major	v18.11.4 → v19.2.0	v19.2.1

---

Release Notes

gitlab-org/gitlab-runner (gitlab/gitlab-runner)

v19.2.0

Compare Source

New features

• Add Snowplow writer for usage-based billing !5886
• Add nanoserver:ltsc2025 and nanoserver:ltsc2025-arm64 helper images !6717 (Shanush Prema Thasarathan @​shanushpt)
• Add native steps support to the instance executor !6807
• Add ability to push image indexes with pusher !5316 (Anthony Juckel @​ajuckel)
• Make git credential helper visible to user-authored commands !6729
• Improve error message for wrong-architecture container images (closes #​38824) !6907 (Ashmit Sharma @​4shm1td06)
• Add circuit breaker for runner fallback to Rails on Relay failures !6839
• Add feature_qualified_name to Snowplow billing metadata !6898
• Add runner-side Job Router metrics !6841
• Eliminate duplicate ContainerInspect calls in resume flow (closes #​39458) !6790 (Ashmit Sharma @​4shm1td06)
• Auto-select arm64 Windows helper image on ARM64 hosts !6854 (Shanush Prema Thasarathan @​shanushpt)
• Add concrete-mode pod assembly for the Kubernetes executor !6817
• Allow multiple/alternative filter flags in clear-docker-cache script (closes #​39234) !6912 (Ashmit Sharma @​4shm1td06)
• Run a synthetic job at startup before reporting Ready !6756
• Read sentry_dsn from SENTRY_DSN environment variable !6899
• Enable metrics for Snowplow writer for usage logging !6649

Security fixes

• Bump golang.org/x/net to v0.56.0 to resolve CVEs !6856
• Bump go-jose/go-jose/v4 to v4.1.4 to resolve CVE-2026-34986 !6857

Bug fixes

• Point default helper image tag at latest Alpine base !6897
• Remove Docker stop-kill timeout and add duration logging !6951
• Bump github.com/moby/spdystream to v0.5.1 !6885
• Reclassify benign WaitDelay outcome in script_legacy step !6848
• Update labkit/v2 to 2.26.1 !6914
• Fix powershell generate save script !6713 (Sean Fausett @​gitfool)
• Stage concrete scratch under the build mount, not os.TempDir() !6832
• Use Runner UUID as subject in snowplow billing event !6903
• Fix disconnectNetwork container ID matching !6872 (Pishel @​pishel65)
• Fix autoscaler pruning active instances on token rotation !6810
• Docker+machine: Fix VM leak when shutdown races a machine create or remove !6754
• Increase Docker stop timeout to 2m and improve error messaging !6868
• Add --docker-pull-policy flag to register command (closes #​39304) !6930 (Ashmit Sharma @​4shm1td06)
• Classify invalid docker DNS/MAC address as ConfigurationError !6942
• Retry transient docker image pull failures !6873
• Update module github.com/go-git/go-git/v5 to 5.19.1 !6884
• Classify secret-resolution failures by cause !6904

Maintenance

• 202606 - Fix broken external links !6843
• Product Docs AI Translation: GITTECHA-835 #​1 !6866
• Enable minmax modernizer in golangci-lint !6875
• Migrate from .tool-versions to mise.toml !6880
• Classify invalid docker container-create requests as ConfigurationError !6958
• Install splitic from its canonical module path !6935
• Add FreeBSD supported versions statement !6908
• Update grpc to v1.81.1 in runner_wrapper (CVE-2026-33186) !6940
• [FixPipeline] https://gitlab.com/gitlab-org/gitlab-runner/-/pipelines/2637656030 !6894
• Wrap plain errors in image-pull paths with BuildError !6844
• Add TLS, DNS, and many-exposed-ports integration tests for moby v29 !6925
• Bump base-images to 0.0.45 !6845
• Wrap remaining plain errors in Kubernetes Prepare() with BuildError !6881
• Fix nonexistent timeout key names in Custom executor !6938
• Update RUNNER_IMAGES_VERSION to 0.0.47 to resolve ubi-fips CVEs !6950
• Adds GITTECHC to use for CI Translations !6909
• Product Docs AI Translation: GITTECHA-703 #​1 !6783
• Stop pinning exact digest in helper image config test !6944
• Fix UBI image trigger artifact ref for merge train and detached pipelines !6877
• (docsi18n) - Monthly maintenance - fix markdown lint errors in docs-locale !6959
• Update the version or the logging field validator !6956
• Retry jobs interrupted by external termination !6921
• Remove dead code from CI pipeline definitions !6826
• Update docker Docker tag to v27.5.1 !6461
• Pass git clean args as separate args in submodule foreach !6949
• Product Docs AI Translation: GITTECHA-834 #​1 !6865
• Add AGENTS.md and CLAUDE.md files for documentation !6860
• Improve Go build caching strategy in CI !6906
• Add RHEL-family libvirt base image, fix --os-variant !6937
• Document dns and mac_address validation behavior !6947
• Migrate Docker SDK to moby/moby v29 to fix docker/* CVEs !6902
• Use per-branch Go build cache with main fallback !6915
• Rootless Podman resource limits (cgroups v2) and socket safety !6936
• Builtin functions implement BuiltinFunction interface !6874
• Product Docs AI Translation: GITTECHA-836 #​1 !6867
• Classify image-pull access-denied errors as ConfigurationError !6850

v19.1.2

Compare Source

v19.1.1

Compare Source

Bug fixes

• Increase Docker stop timeout to 2m and improve error messaging !6868

v19.1.0

Compare Source

New features

• feat(kubernetes): add MatchLabelKeys & MismatchLabelKeys for PodAffinityTerm !6711 (Tobias Germer @​germert)
• Fall back to direct polling when the Job Router is disabled !6811
• Add native windows/arm64 helper binary build target !6697 (Shanush Prema Thasarathan @​shanushpt)
• Add suspend/resume support to the Docker Autoscaler executor !6719
• Skip job request and warn when runner token is empty !6821
• Use fresh context in StopKillWait when build ctx is cancelled !6636
• Retry secrets retrieval !6072 (Syed Saif Ali Alvi @​syedsaifalialvi)
• Bundle native arm64 helper binary in windows-servercore-ltsc2025-arm64 image !6716 (Shanush Prema Thasarathan @​shanushpt)
• docker+machine: Add discovered placement labels to autoscaling metrics !6740
• Kubernetes executor: add imagePullSecrets support for pause pods !6672 (Ashmit Sharma @​4shm1td06)
• Docker: support PidMode for setting PID namespace !6694 (Diego Becciolini @​itizir)
• Send environment key as part of job status update !6813
• Add get_sources timeout to runner config !6822
• Introduce gitlab_runner_process_state_info metric !6793

Bug fixes

• Fix jobs stuck in canceling due to missing final update !6770
• clear-docker-cache: fall back to podman when docker is absent !6755
• Fix concrete execution divergences from abstract shell !6801
• Silence exec-cleanup warning under Podman !6773
• Fix Bash script body leak on job cancellation !6784
• clear-docker-cache: drop unsupported -a from podman volume prune !6808
• Update to Go 1.26.3 !6760
• Forward job variables to concrete's nested run: dispatch !6825
• Scope http.proactiveAuth to remote host !6798
• docker+machine: cap finalizeRemoval retries !6791
• Remove need for grep to enable pipefail !6739 (Matt Clarkson @​mattyclarkson)
• Update warning for alias overlap in executors/docker/services.go !6742
• Expand variables in image_name log fields !6809
• Fix flaky test !6786

Maintenance

• Product Docs AI Translation: GITTECHA-704 #​1 !6785
• Product Docs AI Translation: GITTECHA-707 #​1 !6796
• Add artifact timeout options !6761
• Refactor prepare_timeout !6778
• Update docker-machine version to the latest one !6775
• Update redirecting links to resolved URLs !6831
• Docs - May 2026 maintenance - fix links !6803
• Add french and korean seed content !6751
• Update FF_USE_ADAPTIVE_REQUEST_CONCURRENCY section for accuracy !6820
• docs(docker): document dind MTU inheritance gap and workaround !6737
• Manage golangci-lint via mise !6824
• Honor FF_TIMESTAMPS and reclassify benign exec outcomes in concrete !6769
• Explicitly tell to move away from the Fargate driver !6667
• Clarify FIPS Runner support across distributions !6812
• go: Update module k8s.io/apimachinery to v0.35.2 !6482
• Set explicit FailureReason on BuildError constructions across executors !6724
• Update base images version to pick up CVE fixes !6765
• Product Docs AI Translation: GITTECHA-708 #​1 !6797
• Argo Translations from GITTECHA-647 #​1 !6777
• Add missing appsec labels !5680
• Docs Follow-Up: Supported shells !6718 (Pishel @​pishel65)
• Restore ShellWriter CommandWithStdin !6608 (Guillaume Chauvel @​guillaume.chauvel)
• Fix cidr typo !6676 (Paul Gear @​paulgear)
• Disable TestKubernetesBuildPodResources !6827
• Product Docs AI Translation: GITTECHA-702 #​1 !6789
• Product Docs AI Translation: GITTECHA-706 #​1 !6795
• Update docker-machine version !6800
• Add a few more flaky tests to .flaky-tests !6780

v19.0.3

Compare Source

v19.0.2

Compare Source

Bug fixes

• Fix Bash script body leak on job cancellation !6870

Maintenance

• Disable TestKubernetesBuildPodResources !6879

v19.0.1

Compare Source

Bug fixes

• Update to go 1.26.3 [backport to 19.0] !6788

v19.0.0

Compare Source

New features

• Document prepare_timeout setting !6731
• Add OpenTelemetry tracing for CI job execution !6518
• Add LTSC2025 and LTSC2025-arm64 based gitlab-runner-helper images for windows !6033 (Shanush Prema Thasarathan @​shanushpt)
• Use Pipeline ID form job payload for logging and similar !6631
• Allow configuring parallelism and chunk sizes for cache uploads and... !6401 (Rafael Fonseca @​rafael.fonseca1)
• Dispatch run: through concrete via a nested step-runner job !6703
• Add mount propagation option to emptyDir volumes !6553 (Rafael Fonseca @​rafael.fonseca1)
• Add StepRunnerStream writer that detects pre-stamped lines !6710
• Enforce prepare_timeout config field !6708
• Add mode label to failed_jobs_total and job_duration_seconds metrics !6620
• User Job Cancellation Calls Cancel API !6681
• Treat span id as required !6692
• Map step-runner errors to job failure reasons !6597
• Add support for nfs mounts !6544 (Julian Rettelbach @​rettelbachj)
• Cache: list valid types and accept any case for cache Type !6736
• Add suspend/resume support for instance autoscaler executor !6570
• Add prepare_timeout config field !6653
• Add variable with network name when using FF_NETWORK_PER_BUILD !6632 (Pishel @​pishel65)

Bug fixes

• Merge branch 'sh-fix-role-arn-injection' into 'main' !6714
• Update Kubernetes executor service container naming documentation !6730
• Recover helper argv when image entrypoint drops CMD !6725
• Adaptive request concurrency: do not treat retried requests as capacity !6677
• Restore timeout-warning trace parity with legacy in concrete mode !6704
• Go Dependency update: github.com/invopop/jsonschema to resolve CVE-2026-32285 !6696
• Merge branch 'security-fix-k8s-uid-gid-root-bypass' into 'main' !6643
• Add support for specifying seccomp profile path in Docker executor !6602 (Felix Geyer @​debfx)
• Fix proxy-exec and step-runner hangs when scripts spawn background processes !6707
• Fix per secret overrides for role_arn and role_session_name AWS Secrets Manager integration !6067 (derikwang @​derik01)
• Pass proactiveAuth to git checkout for partial-clone lazy fetches !6695
• Normalize Windows exit codes from unsigned to signed 32-bit !6587
• Scope CONFIG_FILE default to manager command structs !6741
• Update the parallels executor to work with Windows guests !105 (Chris Rose @​cdrx)
• Fix S3 cache broken on third-party providers by SDK checksum defaults !6691
• Fix dependencies on UBI downstream pipeline trigger job !6684
• Expose service variables in custom executor CUSTOM_ENV_CI_JOB_SERVICES !6556 (Sepehr Heydari @​sepehrheydari72)
• Fix the randomize shell selection in Windows shell executor !6644 (Pishel @​pishel65)
• Fix slice size !6732
• Fix gaps in the abstract shell to concrete migration !6688
• Add HEAD method support to S3v2 presign URL !6682 (Sepehr Heydari @​sepehrheydari72)
• Escape $ as $$ in Kubernetes env var values to prevent $(VAR) expansion !6640
• Fix home environment variable !101

Maintenance

• Fix typo: simlar → similar in troubleshooting docs !6654 (Bob Singh @​bobsingh.dev)
• Fix typos and grammar in templates !6658 (Bob Singh @​bobsingh.dev)
• Simplify CI job architecture for Go linting !6752
• Add Node.js to dev tools !6750
• Add French and Korean to Argo !6612
• Cache: select newer remote artifact when FF_HASH_CACHE_KEYS is toggled !6574
• Add shellcheck for shell script linting !6625
• Timestamper improvements (perf, potential bug fix) !6698
• Set explicit FailureReason on BuildError constructions across executors !6683
• Update base images version to pick up CVE fixes (19.0 backport) !6776
• Resolve shell script issues flagged by shellcheck !6734
• Fix missing 'to' in sentence !6656 (Bob Singh @​bobsingh.dev)
• Followup MR for MR 6663 !6673
• Fix race in TestPodWatcher on Windows: listen before Create !6623
• Common: make executor retry sleep interruptible by context cancellation !6610 (Bob Singh @​bobsingh.dev)
• Clarify gitlab com version !6720
• Reference kuberenetes executor service account permissions required for certain feature flags !6668
• Docker machine version 46 !6693
• Fix RPM package architecture names in download docs !6634
• Fix grammar in feature flag rollout template !6661 (Bob Singh @​bobsingh.dev)
• Fix grammar in bug issue template !6664 (Bob Singh @​bobsingh.dev)
• Remove erroneous entry from changelog !6728
• Fix hyphenation in Cross-Functional Programs heading !6660 (Bob Singh @​bobsingh.dev)
• Reorder executor tables to surface actively developed executors first !6638
• Fix grammar in documentation issue template !6663 (Bob Singh @​bobsingh.dev)
• Fix goroutine variable capture in shutdownUsedExecutorProviders !6606 (Bob Singh @​bobsingh.dev)
• Fix typos and grammar in security template !6659 (Bob Singh @​bobsingh.dev)
• Automatically retry flaky tests !6687
• Reorganize TestCredSetup !6607 (Guillaume Chauvel @​guillaume.chauvel)
• Update file docker.md !6627
• Update RUNNER_IMAGES_VERSION to 0.0.42 to resolve ubi-fips CVEs !6733
• Docs(docker-machine): update docs !6689
• Update shell support in docs !6647 (Pishel @​pishel65)
• Remove EOL spaces in doc files - 2026-04-28 !6686
• Fix context propagation in Kubernetes executor !6364 (Emmanuel 326 @​Emmanuel326)
• Clarify documention on default shell in windows !6645 (Pishel @​pishel65)
• Clean up Podman with Kubernetes examples !6626
• Update file docker.md !6738
• Update linting tools and linting container image for documentation !6706
• Add overview descriptions to executor pages !6702
• Fix grammar in feature flag cleanup template !6662 (Bob Singh @​bobsingh.dev)
• Add hadolint for Dockerfile linting !6635
• Go: Update module github.com/jedib0t/go-pretty/v6 to v6.7.9 !6671
• Creates a gitlab_runner_cache_s3_assume_role_failures_total metric !6655
• Cache: shard S3 object paths by first two chars of hash when FF_HASH_CACHE_KEYS is enabled !6628
• Fix duplicate word typos in various source file comments !6586 (Igor Eccard @​iseccard)
• Fix autoscaler failure reason mis-attribution on context cancellation !6670
• Update check interval documentation on strcit_check_interval !6633 (Pishel @​pishel65)
• Update Go to 1.26.1 and golangci-lint to v2.11.4 !6614
• Add translation Merge Request Template for localization - Runner !6637

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.