2026.10 - Required

Version	Release Date
2026.10.0	October 20, 2026

System Requirements Update

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.30	1.36
PostgreSQL	15	17
Redis	6	7
ggscout	0.32.0	Latest

Kubernetes 1.36 is now supported. The chart ships ggscout 0.33.0, the version that sends Azure Key Vault, GitLab CI and Akeyless tags for environment classification; upgrade any ggscout you run outside the cluster to get them.

Helm & Upgrade Considerations

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

⚠️ Important: This is a required release and cannot be skipped.

⏳ Background migrations: recent releases run data migrations in the background after the upgrade, and an upgrade is refused with Not all required migrations have been applied while the ones it depends on are still running. Wait for them to finish, then retry. This can apply to the upgrade to 2026.10, and some must finish on 2026.10 before you can upgrade to 2026.11.

Upgrading to 2026.10

Legacy analytics are removed. If in-app analytics are disabled on your instance, enable them before upgrading to keep your analytics dashboards. See the customer notice.

Feature highlights

• Wiz integration: your active secret incidents from version control sources sync to Wiz every day as native secret findings, with their detection context and a link back to GitGuardian, but never the secret value. Your instance needs outbound HTTPS access to your Wiz tenant. Learn more.
• Source status: every source now shows whether it is Monitored, Unmonitored, Unreachable, Archived or Deleted at the provider. Filter on the status from the perimeter page and the incident list, and save it as a view, for example to set aside incidents from archived or deleted repositories. Learn more.
• Unreachable integrations pause, then resume once reconnected: when an integration can no longer reach its instance, for example after a token expires or during a provider outage, GitGuardian pauses real-time ingestion and historical scans on its sources, shows the step to fix it, and resumes them on its own once the connection is back. This now covers GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Confluence, Slack and Microsoft Teams on Self-Hosted. Learn more.
• Richer vault metadata, environments classified per secret: ggscout 0.33.0 now collects Azure Key Vault secret tags, GitLab CI environment scopes and Akeyless item tags. NHI Governance uses them, with the secret path, to infer the environment of each secret, and falls back to the source-level env of your ggscout configuration only when nothing resolves. The classified environment feeds the exploration map, the cross-environment secrets policy and the risk criticality. Learn more.
• AI Hooks keep leaked tool output away from the model: on Claude Code, Codex and Mistral Vibe, a tool output that contains a secret is withheld from the assistant. AI Hooks and the AI agents and MCP inventory now also cover Amazon Kiro and Junie CLI. Requires ggshield 1.55.0 or later. Learn more.

Secrets Detection Engine

• v2.172: 10 new detectors (Brightcove OAuth Credentials, Infor ION API Credentials, Generic Sanctum Token, Telnyx API Key, Bifrost Virtual Key, Bitbucket HTTP Access Token with Prefix, Jira Data Center Personal Access Token, MetaApi Cloud Token, Appwrite Encryption Key, APIclub API Key), 10 improved detectors (Salesforce OAuth2 Keys and Splunk Authentication Token now capture the instance host, Scaleway Token, Username Password in Spanish, Portuguese, French and Turkish, Google API Key, Generic Database Assignment, Generic High Entropy Secret, Generic Encryption Key), 2 new checkers (Splunk Authentication Token, Artifactory Reference Token, both with custom host support), 8 new analyzers (AWS Cognito, Alibaba Cloud, Databricks, PyPI, Contentful, three DigitalOcean token types), 1 analyzer update (Figma Personal Access Token).
• v2.173: 9 new detectors (Ory API Key, Kong Konnect Personal Access Token, AppSignal API Key, PostHog OAuth Access and Refresh Tokens, Datadog Service Access Token, NinzaSMS API Key, TypeSafe AI API Key, Mistral AI prefixed API Key), 5 improved detectors (Azure Cache for Redis Access Key, Databricks Authentication Token With Hostname, Okta Token with Host and Mistral AI checkers, Base64 Basic Authentication), 1 new analyzer (Cohere API Key).

Enhancements

• The API timeout of ggshield can be configured, GitLab system hooks integrations with a non-admin token monitor personal namespaces and project-only groups, two new team perimeter settings keep unmonitored sources in teams or remove archived ones, audit log CSV exports detail the secrets exported, and the public API adds author attribution for custom sources and covers Public Monitoring secrets in the secret value and validity endpoints. Learn more.
• Developers can reply to a GitHub check run from the pull request with @gitguardian, the source status filter gains an is all of operator, the public API can trigger a presence check, Confluence Data Center occurrences carry the stable user key, and table row selections survive navigation. Learn more.
• The public API can find the GitHub check runs that reported an incident and skip a blocking one, so your own approval flow can unblock a pull request. Learn more.
• Self-Hosted:
  • The license expiration banner now shows only to workspace owners, managers and Admin Area users, the people who can renew the license, instead of every member.
  • The task scheduler exposes Prometheus metrics like the workers do, on a port set with beat.metricsPort. When ServiceMonitors are enabled, the chart creates one for it.
  • New embedded cluster installs deploy ClickHouse by default, like PostgreSQL and Redis, so analytics work out of the box.
  • The embedded cluster preflight checks now expect at least 12 CPU cores and 48 GiB of memory, up from 8 and 30. A smaller VM fails the check without blocking the upgrade: size it to the system requirements.

Fixes

• Historical scan summary emails are no longer sent many times, a user can no longer add their own organization to a private GitHub integration on self-hosted instances that use a public GitHub app, and a OneDrive installation missing Graph permissions is now marked unhealthy instead of silently stopping. Learn more.
• Self-Hosted:
  • A ClickHouse schema migration interrupted partway now completes when it runs again, instead of failing on the tables and columns it had already created.
  • The ClickHouse schema migration now works when the ClickHouse user, password or database name contains special characters such as @, % or /.
  • Pod labels, annotations, node selectors, tolerations, priority class and environment variables set under global.* now reach the chart's pods that ignored them: the migration jobs, the upgrade path check, the remote preflight checks and the nginx CRL jobs. global.podLabels also reaches ClickHouse and Keeper, so a label required on every pod, such as the Google Cloud Marketplace usage label, no longer goes missing. The bundled replicated, loki and loki-minio subcharts read only some of them: the Helm values reference lists the keys to set on them instead.