GitLab.com caps unauthenticated traffic at 60/hour per IP Oct 19
Free and anonymous requests get throttled first, breaking pollers and tokenless agents; Duo's open-weight swap promises 4x more actions per credit.
Copy markdown
60 requests/hour, and tokenless jobs hit the wall first
GitLab.com begins enforcing a 60-requests-per-hour-per-IP cap on all unauthenticated traffic on October 19 — API calls, web requests, and anonymous Git-over-HTTPS all count against it. Free-tier and anonymous workloads feel it first; Premium and Ultimate move to plan-specific per-user, per-group limits in January 2027.
What breaks: pollers, scanners, and any agent without a key
The cap targets polling integrations, repo scanners, bots, and AI agents that hit GitLab.com without credentials. Before Oct 19: authenticate every machine request with a PAT, OAuth, or CI job token, add HTTP 429 backoff, and swap polling for webhooks or caching. Two dry-run windows let you test first — Oct 7 and Oct 14, 15:00–19:00 UTC.
Duo swaps to open weights for up to 4x more actions per credit
GitLab 19.4 (Sept 17) routes Duo agents through hosted open-weight models — Kimi K3, MiniMax M3, GLM 5.3 — for up to 4x more calls per GitLab Credit than comparable frontier models. New per-user caps and per-event usage exports show who spent what before the invoice lands; Premium seats get 12 included credits a month, Ultimate 24, with email alerts at 50%, 80%, and 100%.
Microsoft binds every MCP session to the caller
Agent Framework 1.19.0 ships a breaking change that scopes provider-backed MCP sessions per invocation, tying each tool request to the calling identity instead of a shared session. If you expose MCP tools to more than one user, a call now runs with the requester's own permissions — a tighter blast radius, but retest your multi-user setups before upgrading.