2026.7 - Required
| Version |  Release Date |
|---|---|
| 2026.7.0 | July 24, 2026 |
System Requirements Update
Ensure your infrastructure meets the latest requirements for optimal performance and security:
| Component | Minimum Version | Recommended Version |
|---|---|---|
| KOTS | 1.117.3 | Latest |
| Kubernetes | 1.30 | 1.35 |
| PostgreSQL | 15 | 17 |
| Redis | 6 | 7 |
| ggscout | 0.19.0 | Latest |
Helm & Upgrade Considerations
To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.
⚠️ Important: This is a required release and cannot be skipped.
Upgrading to 2026.7
Helm installations: logCollector.collectMigrationLogs is enabled by default and injects a native sidecar to collect logs from the pre-deploy and post-deploy hook Jobs. This requires Kubernetes 1.29 or later. On older clusters, set logCollector.collectMigrationLogs: false.
Known issue: Endpoint Protection
Developer Endpoint Protection is not functional on self-hosted instances in this release. If you rely on Endpoints, hold off on upgrading or reach out to your GitGuardian contact before deploying 2026.7.0.
Feature highlights
- Public Monitoring on Self-Hosted — Public Monitoring is now available on self-hosted instances (license-gated). Monitor your public perimeter for secret leaks, and route public secret incidents through the full alerting and ticketing stack: custom webhook, Slack, and Microsoft Teams notifications, ServiceNow ticketing, plus email alerting filtered by public incident severity. Enable the optional
celeryWorkers.public-monitoringworker to process the Public Monitoring queues. Learn more. - Gerrit secret scanning — native Gerrit VCS source with full historical scanning, real-time detection via the webhook plugin, and read-replica support for cloning. Learn more.
- Smart Notifiers — filter alerts and tickets by incident criteria — define per-channel rules so an alert, ticket, or email is only created for the incidents that matter, filtering by severity, validity, secret type, or GitGuardian tag, across internal and public monitoring. Learn more.
- GitHub check runs — mitigate API rate limits — oversized pull requests are now scanned by cloning the repository branch instead of calling the GitHub API commit by commit, and check runs can skip merge commits, protecting your shared GitHub API rate limit. The check run size thresholds and rate-limit behavior are customizable from the admin area GitHub preferences. Learn more.
- Gateway API routing & autoscaling — route external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, and scale webapps with Kubernetes HPA or KEDA autoscaling. Learn more.
Secrets Detection Engine
- v2.166 — 9 new detectors (Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services: Maps, Mixed Reality, Service Bus, Quantum, Bot Direct Line), 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token), 3 detector improvements (LiteLLM API Key, GitLab runner authentication token, Artifactory Token With Host), 2 analyzer updates (Google Cloud Keys, GitLab Token).
Enhancements
- Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template. Learn more.
- Custom Sources (BYOS) option to scan with validated detectors only. Learn more.
- Self-Hosted:
- The daily analytics job can now write its Spark scratch data to a dedicated ephemeral volume instead of the node's local disk, preventing job failures from node ephemeral-storage limits on large workspaces. Learn more.
- New opt-in
mcpServerdeployment (Helm only) to run the GitGuardian MCP server in your cluster. Disabled by default (currently in beta); setmcpServer.enabled: trueto deploy it.
Fixes
- Security fix preventing a Service Account Token from revoking itself through the public API; incident assignment now auto-grants access to the assignee; privacy-mode line misalignment in incident details; clearer error for unreachable custom webhook URLs; auto-grant developer access playbook corrections; JFrog Container Registry now discovers all repositories; GitLab health check no longer marks a reachable instance unavailable on a 4xx response. Learn more.
- Discord webhook alerts now trigger correctly; False Positive tag display and filtering in the incidents dashboard; Team Perimeter tree/list selection state; NHI Inventory "files requiring code fix" count consistency between UI and API. Learn more.
- Self-Hosted:
- Enabling observability (CloudWatch) on AWS EKS no longer breaks the readiness and liveness probes.
- Fixed a database compatibility issue that could cause the daily in-app analytics job to fail, so your analytics dashboards stay up to date.
