Removed: the Resource Owner Password Credentials (ROPC) OAuth grant — the flow that posts a user’s username and password to /oauth/token. Client authentication was required from 8 April 2025; the grant itself went in GitLab 19.0.
Outcome: “ROPC will be completely removed in 19.0 and cannot be used even with client credentials after that point.” Integrations that still used it had to move to Authorization Code before the upgrade.
GitLab.com required client authentication for ROPC after the OAuth working group omitted it from RFC 2.1, then removed the grant entirely in 19.0 (21 May 2026). Tightening a password-collecting endpoint is the weaker fix; deleting it leaves nothing to tighten.
Sources:
- GitLab, Improving OAuth ROPC security on GitLab.com (8 April 2025)
- GitLab Docs, Resource Owner Password Credentials grant is deprecated (21 May 2026)