Every unauthenticated curl I’ve ever left running against a public repo just became a liability. Anonymous requests get 60 per hour per IP starting October 19 — and that cap applies even when the automation is hitting a paid account without credentials. Cron jobs, status checks, that Astro build step pulling a changelog at deploy time. None of it knows it’s anonymous until it gets a 429.
The fix is boring, which is the good news: a personal access token, an OAuth token, or the CI/CD job token moves the request onto plan limits. I’m using the two preview windows — October 7 and 14, 15:00–19:00 UTC — as a free failure test, and watching RateLimit-Remaining on responses meanwhile. Anything that retries instantly instead of reading Retry-After gets fixed now.
The story — GitLab announced that starting October 19, 2026, GitLab.com rate limits will align with subscription tier, applied per user and per top-level group. Free accounts and unauthenticated requests change first; Premium and Ultimate follow in January 2027. Unauthenticated requests are capped at 60 per hour per IP. Two preview windows run October 7 and 14. Self-Managed and Dedicated are unaffected. (Source)