Time to Bail · Boarding pass
Act. You can stay.
The legacy token setting goes away in GitLab 20.0, planned for May 20, 2027. Fix scripts for JWT tokens first.[1]
Act means: change a setting or plan before the date. You can stay.
GitLab legacy CI/CD job token format ends in 20.0 (May 20, 2027)
Since GitLab 19.0, CI/CD job tokens use the JWT format by default. A top-level group can still switch back to the legacy format, but only until the GitLab 20.0 release, planned for May 20, 2027. The longer JWT tokens break scripts that pipe the token to base64 without -w0.
One email with the first steps. Nothing else.
Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar
Tick steps as you go. Your progress stays in this browser.
In the top-level group, open Settings > CI/CD > General pipelines. See if JWT format is off.
Change base64 to base64 -w0 wherever a script encodes CI_JOB_TOKEN.
Use version 0.5.1 or later of the AWS Fargate custom executor.
Turn the setting back on and run your pipelines before GitLab 20.0.
One email with the first steps. Nothing else.
Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar
| GitLab 20.0 release (planned) | May 20, 2027[2] |
|---|---|
| JWT format by default since | GitLab 19.0[3] |
| Legacy format setting | Turn off Enable JWT format for CI/CD job tokens in the top-level group; only until the GitLab 20.0 release[3] |
| Known issue: base64 | base64 wraps the long token and makes it invalid; use base64 -w0[3] |
| Error you may see | invalid character '\n' in string literal[3] |
| Known issue: AWS Fargate | The Fargate custom executor 0.5.0 and earlier fails; upgrade to 0.5.1 or later[1] |
| Groups on the legacy format | Move to JWT tokens with GitLab 20.0[3] |
Jobs get the longer JWT token. A script that runs echo $CI_JOB_TOKEN | base64 breaks the token, and the job fails.
invalid character '\n' in string literalecho $CI_JOB_TOKEN | base64 -w0 to stop line wrapping.0.5.1 or later.Source: [3] GitLab CI/CD job token (GitLab) · [1] Deprecations and removals by version (GitLab)
Check it yourself. Every fact above links here.
Time to bail on GitLab groups that still use legacy job tokens? Act. You can stay. The legacy token setting goes away in GitLab 20.0, planned for May 20, 2027. Fix scripts for JWT tokens first.
On our scale this is Act: change a setting or plan before the date. You can stay.
Since GitLab 19.0, CI/CD job tokens use the JWT format by default. A top-level group can still switch back to the legacy format, but only until the GitLab 20.0 release, planned for May 20, 2027. The longer JWT tokens break scripts that pipe the token to base64 without -w0.
Here are the facts we checked:
You can stay on GitLab. You have to change a setting or plan before the date.
Leaving is a choice here, not a must.
GitLab is the main source for this page. GitLab has not said more than what is listed here. If a fact is not on this page, we do not know it yet.
Groups on the legacy format: Move to JWT tokens with GitLab 20.0.
The date to remember is May 20, 2027. Make the change before then.
A few tips:
If the change affects your members or team, send one short email. Say what changes for them and when. Put the most important line first.
If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.
Listed for convenience. Not ranked. Not paid. These names come up in threads and reviews; that does not show where people moved.
Before you pay, check the price page of each tool yourself. Prices change, and we only list what our sources say.
No questions collected yet.
Thanks.
Run SaaS spend at work? Get these changes before the invoice
Arrivals · for builders
People on GitLab groups that still use legacy job tokens can stay if they make the change. Some would rather leave. Get the playbook for this change, and list your product here.
Listing is free. An editor checks it. Not ranked. Not paid.
One email when we publish a checked change in the category you pick. No account needed.
One email on Mondays: the gates in the next 14 days, with the first step for each.