v3.3.0

Changelog

✨ Features

• 1311b41: feat(search): pass num_context_lines and regex through code search (#1409) (@jmrplens)

🐛 Bug Fixes

• 680ce00: fix(audit_1to1): hold always-sent findings to the package's methods (#1381) (@jmrplens)

📚 Documentation

• b0db605: docs(upstream-bugs): record entry 132 as in review upstream (#1412) (@jmrplens)
• b0fb129: docs(upstream-bugs): record rows 16 and 124 as settled upstream (#1449) (@jmrplens)
• 993740e: docs(upstream-bugs): record the state of 2026-10-16 (#1397) (@jmrplens)
• 51c3bb4: docs(upstream-bugs): record the state of 2026-10-19 (#1429) (@jmrplens)
• ef4d835: docs: declare docs.jmrp.io/gitlab-mcp-server as the documentation address (#1379) (@jmrplens)

🚧 Maintenance

• 1743e18: Answer a GraphQL write GitLab ran without its object as probably committed, and leave null list items out (#1277) (@jmrplens)
• e194b79: Answer each retry-later refusal with the code of what it says, and a tier-removed action with the tier it needs (#1346) (@jmrplens)
• 69e9e34: Answer the stdio frames the SDK rejects, send each session a copy of a resource update, and bring the register to 2026-10-13 (#1373) (@jmrplens)
• 28615b6: Bring the upstream register to its state on 2026-10-10 (#1281) (@jmrplens)
• 63b2110: Bring the upstream register to its state on 2026-10-12 (#1345) (@jmrplens)
• 1895639: Bring the upstream register to its state on 2026-10-12, evening (#1357) (@jmrplens)
• b25caca: Bump client-go from v3.15.0 to v3.29.0 (#1435) (@jmrplens)
• b970327: Cancel an auto-merge through cancel_auto_merge on GitLab 19.5 or later (#1422) (@jmrplens)
• f17c87c: Compare hosts by ASCII case alone, so a lookalike of the instance is another host (#1268) (@jmrplens)
• e5bdf76: Count prompt reports the way GitLab counts, and complete what a caller types (#1366) (@jmrplens)
• 30a94fd: Detect the GitLab.com tier from the top-level groups a token is a member of (#1273) (@jmrplens)
• 9cf6aaa: Filter group packages by version, list topics without projects, and edit an award's message (#1439) (@jmrplens)
• d95b1a5: Give the wait poll tests a deadline no first poll can miss (#1450) (@jmrplens)
• be51b4c: Hold client-go's GraphQL decoders to their documents, and record what they leave out (#1348) (@jmrplens)
• 8f741a9: Hold each driven request to the instant it was due (#1378) (@jmrplens)
• 6d38185: Hold epic note writes and child moves to the epic named, report the GraphQL nulls GitLab explains, and render each note, discussion and schema as its own (#1371) (@jmrplens)
• 6fa76d9: Hold every uses: to a pin, find a mutation wherever it starts, and move latest only for the newest release (#1364) (@jmrplens)
• 382f9e9: Hold the Spanish code blocks to the English ones outside comments and prose, and fail the lint when they drift (#1386) (@jmrplens)
• 491fbd5: Judge outbound hops by the address they spell, keep token verification on the instance, and fix the client address, probe, listing and CLI edges (#1365) (@jmrplens)
• 996d829: Keep a retried request's failed body out of the mirror's answers (#1361) (@jmrplens)
• 3cf8bc8: Keep find's alternative params apart from its required ones and offer examples their schema accepts (#1275) (@jmrplens)
• 7782965: List trigger jobs through trigger_jobs on GitLab 19.2 or later (#1441) (@jmrplens)
• 2da8136: Move the icons page from MCP Capabilities to Reference (#1385) (@jmrplens)
• 9b6a11c: Name the published release on the site through a token the build replaces (#1267) (@jmrplens)
• 22b48c2: Name what the serving surface can call in meta schemas, annotations and next steps, and the real cause in refusals (#1372) (@jmrplens)
• 39055e3: Post the Orbit fixture resources to their own collection and stop when GitLab creates nothing (#1430) (@jmrplens)
• 37fed5e: Promote a project milestone, read its burndown, and read the job holding a resource group's lock (#1442) (@jmrplens)
• 647187a: Publish each column's limit_metric on every project board answer (#1347) (@jmrplens)
• 9f687f5: Publish the blob id in code search results and hold search answers to the entity each scope selects (#1408) (@jmrplens)
• 0b65e1c: Publish the next link of a keyset page as next_page_token and follow it back on the lists GitLab pages by keyset (#1349) (@jmrplens)
• 3e8b590: Quote GitLab's reason when a transfer fails in the background (#1423) (@jmrplens)
• d5f5f69: Re-pin the GraphQL schema to gitlab.com 19.6.0-pre and answer what it moved (#1416) (@jmrplens)
• 0a100ba: Re-record the REST live record on GitLab 19.5.0 and answer what it moved (#1405) (@jmrplens)
• 4a9e785: Read a launcher test process reaped during the stat read as gone (#1398) (@jmrplens)
• bca6e27: Read every page of a GitLab release's links in the mirror (#1360) (@jmrplens)
• cd3dd0e: Read file paths as GitLab names them, resolve remotes and submodules to the project they name, and bound every download without corrupting it (#1367) (@jmrplens)
• d69ca60: Read the latest pipeline as pipeline.latest does in its resource and prompts, and name what some calls also need in the fine-grained table (#1350) (@jmrplens)
• 91de6af: Refuse a date that does not parse, and let work items and epics clear what GitLab clears (#1369) (@jmrplens)
• 120123c: Regenerate the O1a artifacts and keep the audit command's exit status in the e2e gates (#1382) (@jmrplens)
• b4282ef: Regenerate the artifacts the 19.5.0 record moves (#1406) (@jmrplens)
• 22f6902: Regenerate the committed artifacts at the top of the D1 stack (#1387) (@jmrplens)
• f644e1d: Regenerate the committed artifacts at the top of the Orbit GQL stack (#1419) (@jmrplens)
• 64fa164: Regenerate the committed artifacts at the top of the batch B1 stack (#1278) (@jmrplens)
• f993342: Regenerate the committed artifacts at the top of the batch B2 stack (#1351) (@jmrplens)
• 4acd073: Regenerate the committed artifacts at the top of the batch B3 stack (#1374) (@jmrplens)
• f2d15b3: Regenerate the committed artifacts at the top of the cancel and transfer stack (#1424) (@jmrplens)
• f087cda: Regenerate the committed artifacts at the top of the client-go v3.29.0 stack (#1444) (@jmrplens)
• 3beaf53: Regenerate the committed artifacts at the top of the search stack (#1410) (@jmrplens)
• ca23248: Render client-go's GraphQL shells, and compare its documents in the re-pin drift report (#1274) (@jmrplens)
• d0fee5b: Report only what GitLab answered: search totals, absent values, empty maps, no-op writes, Terraform pages and job notifications (#1368) (@jmrplens)
• 4ec96b4: Require on every surface the parameters GitLab requires, and hold each schema to the live record (#1276) (@jmrplens)
• bb27c41: Reset a runner token with itself and discover the Job Router (#1443) (@jmrplens)
• dcd1406: Retire the captures client-go v3.29.0 makes unnecessary, and send include_descendants as GitLab spells it (#1436) (@jmrplens)
• 6430bcd: Send Orbit queries as GQL and read the query language from the query command (#1418) (@jmrplens)
• ead4266: Send the values a caller set on an update, empty ones included, and nothing it did not set (#1370) (@jmrplens)
• 6789875: Show each code search snippet in the Markdown result (#1394) (@jmrplens)
• 15438aa: Spell the Spanish path in every link the Spanish tool reference writes (#1384) (@jmrplens)
• ba6782c: Stop an end-to-end run against a GitLab newer than the fine-grained table (#1380) (@jmrplens)
• 41a762d: Stop offering job_title on user create and modify, a param GitLab ignores (#1440) (@jmrplens)
• f88cb0c: Take a milestone title, severity, start date, merge time and blocking IID on issue and merge request writes (#1437) (@jmrplens)
• 5378d29: Take merge_train_enforcement on project update, and offer project create only what POST /projects declares (#1438) (@jmrplens)
• 065b75b: chore(deps): bump SonarSource/sonarqube-scan-action from 8.2.2 to 8.3.0 in the actions-all group (#1376) (@dependabot[bot])
• e160755: chore(deps): bump the go-minor-patch group with 3 updates (#1362) (@dependabot[bot])
• 4fb1c88: chore(deps): bump the npm-minor-patch group in /site with 6 updates (#1363) (@dependabot[bot])
• 3c70634: chore(deps): dependency sweep of 17 October (#1413) (@jmrplens)
• f881319: chore(release): move VERSION to 3.3.0 (#1451) (@jmrplens)
• 34effd7: chore: update manifests for v3.2.0 (@jmrplens)
• b7b2551: test(bench_resources): run the spread schedule on synctest's fake clock (#1389) (@jmrplens)
• b4bbbcd: test(jobs): hold the trace allocation bound only outside a race build (#1415) (@jmrplens)

---

Full changelog: v3.2.0...v3.3.0

Verify the assets

All binaries are listed in checksums.txt, signed keylessly with cosign:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/jmrplens/gitlab-mcp-server/.github/workflows/release.yml@refs/tags/v3.3.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum --check --ignore-missing checksums.txt