Regression: `v13.3.1` now failing Gitlab Authentication with Group Access Token

[kevinneufeld]

Hello,
Today, we are experiencing an issue with the latest release of the Gitlab plugin: it is failing to authenticate with either a Group Access Token or my Personal Access Token.

Details:

• node vv25.6.1
• semantic-release v25.0.3
• @semantic-release/gitlab v13.3.1 fails v13.3.0 works

Version @semantic-release/gitlab v13.3.1:

► npx semantic-release --dry-run
[10:07:51 AM] [semantic-release] › ℹ  Running semantic-release version 25.0.3
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/changelog"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/git"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/gitlab"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "analyzeCommits" from "@semantic-release/commit-analyzer"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "analyzeCommits" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "verifyRelease" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "generateNotes" from "@semantic-release/release-notes-generator"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "generateNotes" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/changelog"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/git"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/gitlab"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "addChannel" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "success" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "success" from "@semantic-release/gitlab"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "fail" from "@semantic-release/exec"
[10:07:52 AM] [semantic-release] › ✔  Loaded plugin "fail" from "@semantic-release/gitlab"
[10:07:58 AM] [semantic-release] › ⚠  Run automated release from branch master on repository git@gitlab.com:{{MASKED}}/terraform-modules/pbp-aws-relational-data-storage.git in dry-run mode
[10:07:59 AM] [semantic-release] › ✔  Allowed to push to the Git repository
[10:07:59 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/changelog"
[10:07:59 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/changelog"
[10:07:59 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/exec"
[10:07:59 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/exec"
[10:07:59 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/git"
[10:07:59 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/git"
[10:07:59 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/gitlab"
[10:07:59 AM] [semantic-release] [@semantic-release/gitlab] › ℹ  Verify GitLab authentication (https://gitlab.com/api/v4)
[10:07:59 AM] [semantic-release] › ✘  Failed step "verifyConditions" of plugin "@semantic-release/gitlab"
[10:07:59 AM] [semantic-release] › ⚠  Skip step "fail" of plugin "@semantic-release/exec" in dry-run mode
[10:07:59 AM] [semantic-release] › ⚠  Skip step "fail" of plugin "@semantic-release/gitlab" in dry-run mode
[10:07:59 AM] [semantic-release] › ✘  EMISSINGREPO The repository {{MASKED}}/terraform-modules/pbp-aws-relational-data-storage doesn't exist.
The semantic-release repositoryUrl option must refer to your GitLab repository. The repository must be accessible with the GitLab API.

By default the repositoryUrl option is retrieved from the repository property of your package.json or the git origin url of the repository cloned by your CI environment.

If you are using GitLab Enterprise Edition please make sure to configure the gitlabUrl and gitlabApiPathPrefix options.

AggregateError: 
    SemanticReleaseError: The repository {{MASKED}}//terraform-modules/pbp-aws-relational-data-storage doesn't exist.
        at default (file:///opt/homebrew/lib/node_modules/@semantic-release/gitlab/lib/get-error.js:6:10)
        at default (file:///opt/homebrew/lib/node_modules/@semantic-release/gitlab/lib/verify.js:94:21)
        at async verifyConditions (file:///opt/homebrew/lib/node_modules/@semantic-release/gitlab/index.js:11:3)
        at async validator (file:///opt/homebrew/lib/node_modules/semantic-release/lib/plugins/normalize.js:36:24)
        at async file:///opt/homebrew/lib/node_modules/semantic-release/lib/plugins/pipeline.js:38:36
        at async file:///opt/homebrew/lib/node_modules/semantic-release/lib/plugins/pipeline.js:32:5
        at async pluginsConfigAccumulator.<computed> [as verifyConditions] (file:///opt/homebrew/lib/node_modules/semantic-release/lib/plugins/index.js:87:11)
        at async run (file:///opt/homebrew/lib/node_modules/semantic-release/index.js:106:3)
        at async Module.default (file:///opt/homebrew/lib/node_modules/semantic-release/index.js:278:22)
    at file:///opt/homebrew/lib/node_modules/semantic-release/lib/plugins/pipeline.js:55:13
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
    at async pluginsConfigAccumulator.<computed> [as verifyConditions] (file:///opt/homebrew/lib/node_modules/semantic-release/lib/plugins/index.js:87:11)
    at async run (file:///opt/homebrew/lib/node_modules/semantic-release/index.js:106:3)
    at async Module.default (file:///opt/homebrew/lib/node_modules/semantic-release/index.js:278:22)

VERSION @semantic-release/gitlab v13.3.0:

► npx semantic-release --dry-run
[10:12:09 AM] [semantic-release] › ℹ  Running semantic-release version 25.0.3
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/changelog"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/git"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/gitlab"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "analyzeCommits" from "@semantic-release/commit-analyzer"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "analyzeCommits" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "verifyRelease" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "generateNotes" from "@semantic-release/release-notes-generator"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "generateNotes" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/changelog"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/git"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/gitlab"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "addChannel" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "success" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "success" from "@semantic-release/gitlab"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "fail" from "@semantic-release/exec"
[10:12:10 AM] [semantic-release] › ✔  Loaded plugin "fail" from "@semantic-release/gitlab"
[10:12:20 AM] [semantic-release] › ⚠  Run automated release from branch master on repository git@gitlab.com:{{MASKED}}/terraform-modules/pbp-aws-relational-data-storage.git in dry-run mode
[10:12:21 AM] [semantic-release] › ✔  Allowed to push to the Git repository
[10:12:21 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/changelog"
[10:12:21 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/changelog"
[10:12:21 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/exec"
[10:12:21 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/exec"
[10:12:21 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/git"
[10:12:21 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/git"
[10:12:21 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/gitlab"
[10:12:21 AM] [semantic-release] [@semantic-release/gitlab] › ℹ  Verify GitLab authentication (https://gitlab.com/api/v4)
[10:12:22 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/gitlab"
[10:12:22 AM] [semantic-release] › ℹ  Found git tag v4.3.1 associated with version 4.3.1 on branch master
[10:12:22 AM] [semantic-release] › ℹ  Found 2 commits since last release
[10:12:22 AM] [semantic-release] › ℹ  Start step "analyzeCommits" of plugin "@semantic-release/commit-analyzer"
[10:12:22 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: Merge branch 'CLOUD-XXXX-fix-aurora-module' into 'master'

fix: set mutually exclusive master password arguments in RDS cluster

See merge request {{MASKED}}/terraform-modules/pbp-aws-relational-data-storage!27
[10:12:22 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[10:12:22 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: fix: set mutually exclusive master password arguments in RDS cluster
[10:12:22 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The release type for the commit is patch
[10:12:22 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analysis of 2 commits complete: patch release
[10:12:22 AM] [semantic-release] › ✔  Completed step "analyzeCommits" of plugin "@semantic-release/commit-analyzer"
[10:12:22 AM] [semantic-release] › ℹ  Start step "analyzeCommits" of plugin "@semantic-release/exec"
[10:12:22 AM] [semantic-release] › ✔  Completed step "analyzeCommits" of plugin "@semantic-release/exec"
[10:12:22 AM] [semantic-release] › ℹ  The next release version is 4.3.2
[10:12:22 AM] [semantic-release] › ℹ  Start step "verifyRelease" of plugin "@semantic-release/exec"
[10:12:22 AM] [semantic-release] › ✔  Completed step "verifyRelease" of plugin "@semantic-release/exec"
[10:12:22 AM] [semantic-release] › ℹ  Start step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[10:12:22 AM] [semantic-release] › ✔  Completed step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[10:12:22 AM] [semantic-release] › ℹ  Start step "generateNotes" of plugin "@semantic-release/exec"
[10:12:22 AM] [semantic-release] › ✔  Completed step "generateNotes" of plugin "@semantic-release/exec"
[10:12:22 AM] [semantic-release] › ⚠  Skip step "prepare" of plugin "@semantic-release/changelog" in dry-run mode
[10:12:22 AM] [semantic-release] › ⚠  Skip step "prepare" of plugin "@semantic-release/exec" in dry-run mode
[10:12:22 AM] [semantic-release] › ⚠  Skip step "prepare" of plugin "@semantic-release/git" in dry-run mode
[10:12:22 AM] [semantic-release] › ⚠  Skip v4.3.2 tag creation in dry-run mode
[10:12:22 AM] [semantic-release] › ⚠  Skip step "publish" of plugin "@semantic-release/exec" in dry-run mode
[10:12:22 AM] [semantic-release] › ⚠  Skip step "publish" of plugin "@semantic-release/gitlab" in dry-run mode
[10:12:22 AM] [semantic-release] › ⚠  Skip step "success" of plugin "@semantic-release/exec" in dry-run mode
[10:12:22 AM] [semantic-release] › ⚠  Skip step "success" of plugin "@semantic-release/gitlab" in dry-run mode
[10:12:22 AM] [semantic-release] › ✔  Published release 4.3.2 on default channel
[10:12:22 AM] [semantic-release] › ℹ  Release note for version 4.3.2:
## 4.3.2 (2026-02-24)

[rewdy]

Seeing the same. Here's Claude's summary if helpful:

Summary

The 13.3.1 fix commit (146c351) introduced a new regression in lib/verify.js. The computed property bracket notation was accidentally dropped when constructing the got request headers, causing the authentication token to be sent under the wrong header name.

The diff (in lib/verify.js):

// v13.3.0 — correct
headers: { [tokenHeader]: gitlabToken }

// v13.3.1 — broken
headers: { tokenHeader: gitlabToken }

Without the brackets, JavaScript treats tokenHeader as a literal string key. The request sends { "tokenHeader": "<token>" } instead of
{ "PRIVATE-TOKEN": "<token>" }. The GitLab API receives an unauthenticated request.

Observed error

EMISSINGREPO The repository <path> doesn't exist.

GitLab returns 404 for unauthenticated requests to private projects (security by obscurity), which the plugin maps to EMISSINGREPO.
The actual cause is that the token is never transmitted — not that the repo is missing.

The same broken pattern appears in both the useJobToken and standard token code paths.

Workaround

Pin to 13.3.0.

[kg4afy]

Confirmed. The issue is in PR #953 — { [tokenHeader]: gitlabToken } was changed to { tokenHeader: gitlabToken }, sending the token under the literal header name "tokenHeader" instead of "PRIVATE-TOKEN". Self-hosted GitLab returns 404 for unauthenticated requests to private repos, which the plugin catches as EMISSINGREPO. Pinning to v13.3.0 resolves it.

[ddowbnac]

Same problem here

In case any is using the pipeline https://gitlab.com/to-be-continuous/semantic-release and need a hotfix, add the var of type FILE SEMREL_REQUIRED_PLUGINS_FILE with the following content

@semantic-release/gitlab@13.3.0
conventional-changelog-conventionalcommits

[gaspo53]

Same problem here, it started a few hours ago because of this. Using 13.3.0 fixes the issue

[NeckBeardPrince]

My day is ruined.

[ddbtrmatic]

Confirmed. The issue is in PR #953 — { [tokenHeader]: gitlabToken } was changed to { tokenHeader: gitlabToken }, sending the token under the literal header name "tokenHeader" instead of "PRIVATE-TOKEN". Self-hosted GitLab returns 404 for unauthenticated requests to private repos, which the plugin catches as EMISSINGREPO. Pinning to v13.3.0 resolves it.

It looks like the original PR author mistook javascript computed property name syntax for array syntax. If this fix did solve some type error, I would guess the value of tokenHeader was an array, but that array error was mistaken as being caused by the computed property syntax. In any case, this PR should be fully reverted, as it is plainly incorrect.

[gterras]

It looks like the original PR author mistook javascript computed property name syntax for array syntax

It's actually scary this went merged.

[fgreinacher]

Sorry folks, I have not reviewed this deeply enough!

Revert PR is up at #957 and will be merged asap.

[gaspo53]

Thanks @fgreinacher ! Do you have an ETA for v13.3.2 ?