Issues

• GHSA-fcj2-hj27-hj26 is missing from the GitHub Advisory Database and OSV, and its CVE is unassigned

  security
  jmrplens/gitlab-mcp-server#1549 · Filter by author jmrplens opened on Oct 27, 2026

• Gold needs a second person: co-maintainer, unassociated contributor, two-person review

  help wanted
  jmrplens/gitlab-mcp-server#1548 · Filter by author jmrplens opened on Oct 27, 2026

• Localize the texts the server shows a person

  enhancementmcp
  jmrplens/gitlab-mcp-server#1547 · Filter by author jmrplens opened on Oct 27, 2026

• Carry a copyright line and an SPDX license identifier in every source file

  toolingv3.4.0
  jmrplens/gitlab-mcp-server#1546 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Adopt the Developer Certificate of Origin

  citoolingv3.4.0
  jmrplens/gitlab-mcp-server#1545 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Refuse a plaintext HTTP listener off loopback unless TLS or an explicit opt-in is given

  securitytransportv3.4.0
  jmrplens/gitlab-mcp-server#1544 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Record a security review, and send CSP and X-Frame-Options from the documentation site

  documentationsecuritysitev3.4.0
  jmrplens/gitlab-mcp-server#1543 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Fuzz on a schedule, measure branch coverage over the whole tree, and state the linter count as measured

  citoolingv3.4.0
  jmrplens/gitlab-mcp-server#1542 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Show that release binaries rebuild bit for bit, and honor DESTDIR in install.sh

  cidistributiontoolingv3.4.0
  jmrplens/gitlab-mcp-server#1541 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Write down governance, roles, continuity, code review and a roadmap

  documentationsitev3.4.0
  jmrplens/gitlab-mcp-server#1540 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Make the security policy describe what happens, and publish an assurance case

  documentationsecuritysitev3.4.0
  jmrplens/gitlab-mcp-server#1539 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Open every release with a written summary, and refuse a tag without one

  cidistributiondocumentationv3.4.0
  jmrplens/gitlab-mcp-server#1538 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• Take Alpine 3.24.3 in the image: zlib CVE-2026-85091 and musl CVE-2026-107891

  dockersecurityv3.4.0
  jmrplens/gitlab-mcp-server#1537 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• OpenSSF Best Practices: reach passing and silver, and record what gold needs

  documentationsecurityv3.4.0
  jmrplens/gitlab-mcp-server#1536 · Filter by author jmrplens opened on Oct 27, 2026 · 3.4.0

• The Orbit make targets ignore the fixture settings a .env sets, though the Makefile says they read them

  buge2etoolingv3.4.0
  jmrplens/gitlab-mcp-server#1535 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0

• make orbit-wait-indexer spends its whole timeout when the fixtures are already indexed

  buge2etoolingv3.4.0
  jmrplens/gitlab-mcp-server#1534 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0

• setup-orbit-fixtures.sh never brings an existing fixture project into line: its LICENSE, its visibility, its fixture tree

  buge2etoolingv3.4.0
  jmrplens/gitlab-mcp-server#1533 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0

• The inline comment pre-check judges image and file positions as text lines

  bugtoolsv3.4.0
  jmrplens/gitlab-mcp-server#1531 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0

• mr_review.changes_get accepts order_by, sort, pagination and page_token, which its route ignores

  bugtoolsv3.4.0
  jmrplens/gitlab-mcp-server#1530 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0

• GitLab.com refuses a shortest path that names no relationship type, which a live Orbit subtest sends and the site page allows

  bugtoolsv3.4.0
  jmrplens/gitlab-mcp-server#1528 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0

• orbit.query teaches PAGE and AFTER, which GitLab.com refuses since Orbit replaced cursor pagination with SKIP and LIMIT

  bugtoolsv3.4.0
  jmrplens/gitlab-mcp-server#1527 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0

• Orbit GA on GitLab.com: the live Orbit tests lose access on 2026-10-29, and REST graph_status goes away

  e2ehigh-prioritytoolsv3.4.0
  jmrplens/gitlab-mcp-server#1516 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0
  1

• The macOS condition coverage step fails when the runner cannot resolve proxy.golang.org

  bugciv3.4.0
  jmrplens/gitlab-mcp-server#1515 · Filter by author jmrplens opened on Oct 26, 2026 · 3.4.0
  1

• Gemini parameters refuses non-string and empty enums in served input schemas

  bugmcptoolsv3.4.0
  jmrplens/gitlab-mcp-server#1508 · Filter by author jmrplens opened on Oct 25, 2026 · 3.4.0

• Re-pin the REST live record, the fine-grained table and the GraphQL schema on GitLab 19.6.0 when it ships

  e2etoolingv3.4.0
  jmrplens/gitlab-mcp-server#1492 · Filter by author jmrplens opened on Oct 22, 2026 · 3.4.0