Rate limits on GitLab.com are changing

If you are using LLMs to interact with sites like GitLab and GitHub, and you have the option to use a GraphQL API, you should jump on it immediately.

GraphQL is absolutely terrible for human developers to interact with, but it's like Facebook could see into the future back in 2012. I cannot imagine a more perfect API surface for agents. With the REST API on GitHub, you can consume maybe 10 issue JSON blobs before your context window is blown out. With GraphQL constraining the results you can easily read hundreds in the same token budget.

Additionally, the # of requests your agents need to make can be reduced in many cases since GraphQL can join across types whereas REST APIs cannot. You essentially get savings in two dimensions here. Quota and raw token volume per logical response.

Important buried context: 60/hour unauthenticated, but 5,000/hour on the free plan.

60/hour sucks. 5000/hour (a little more than one per second) is totally fine.

I'm chalking this up alongside Docker's decision to restrict unauthenticated pulls. Unauthenticated anything went the way of the dodo some time ago. If you want unauthenticated access, go run your own mirror.

Providing kickbacks to the repos being scraped would be a good way to help fund open source projects and pay creators like streaming services do. Seems like they're headed in this direction - it would be a massive product differentiator over GH

Damn, we’re even having Claude write important press releases now

429 gang represent

> A request that arrives with no credentials gets 60 requests per hour per IP address.

One request per minute.

I assume this is because of LLM scraping.

60 requests per hour per IP if you haven't signed in... well that's unfortunately low.

does this rate limit also apply to the images which they hosted on registry.gitlab.com? They do have a couple of scanners that we use and we pull it without any authentication

Github would hit four nines if they followed suit. no clue why the dont try

Is this going to apply just to `https://gitlab.com/api/v4/:rest_of_the_url` endpoints, or also to the API-ish endpoints like `https://gitlab.com/:org/:repo/raw/HEAD/:path`?

I think it's because people are building agentic flows, reducing the amount of developer seats needed. It's the first step towards usage based pricing.

60 requests an hour per IP seems low for a school or office network. A few people browsing issues and source files could use that up quite fast.

I would spend thousands of dollars for gitlab in terms of: 1) better UX for admin panel, I'm not sure what I've enabled and what not. Several buttons do not disable the rest of the settings, leaving me with some doubts (e.g. if I disabled grafana, why is there a setting that talks about where/how I store?) 2) a minimal version of gitlab without all the AI

I forgot a superfluous free tier proof of concept pipeline and it ran every 6 hours for three months before I remembered to shut it off, sorry.

I expect to not be the only one, it certainly drives usage KPIs up and lead to this kind of decisions.

CI needs to be decentralized, and the agents should run the test and verify the proof. This avoids all those API calls.

Walk back in 10...9...

I am honestly surprised they aren't going lower at this point.

Gitlab must pay a fortune to bot traffic, most of which is malicious or garbage at best.

I understand why they're doing this, but the anticausative title kinda rubs me the wrong way.

im self hosted so im somewhat safe i guess

Worst case, this could be the start of a paywall to learn from, contribute to, or host open source projects.

Hopefully they find some kind of carve out for OSS projects while still blocking the egregious offenders.

This is why I moved my code to self hosted forgejo instance. Private and guarded behind self hosted OIDC instance.

No more worrying about "rate limiting," subscription hell, or random extended outages (ie, github).

If LLM wants access, might implement payment layer and use 402 http status code and redirect them to payment page ;). Wonder how many people just give agents carte blanche physical (credit card) and virtual access

> You get 429 Too Many Requests with RateLimit-* headers and a Retry-After. Wait the interval it gives you, then retry.

Is there a test endpoint where one can validate the behavior of their ratelimit detection? Basically I do not want to cause excessive load on your servers just to test my implementation.

> The requested URL was not found on this server.

Getting that so I do not know exactly what they are doing. From the title I am guessing they are restricting or throttling if downloads exceeds some value.

I mean, with a completely new C-suite gutting the company, that sure isn't the only thing that's changing.

I noticed that recently Github.com has some kind of weird bot detection on public repos. I have a browser extension for switching User Agents for a specific legacy site, sometimes i forget to turn it off and Github will require me to login to view public repos.

All of this is most likely due to mass scraping by LLMs. Welcome to the total shitification of the web.

Congrats on making the world worse with AI. All this performative data scraping and uploading and no progress at all.

To anybody saying this is brought on due to AI scraping - It isn't, they are just doing this at a time that can be seen as a valid excuse. Countering AI scraping is a solved problem. This has been rolled out to bring in more subscriptions and more dollars.