Why GitLab access tokens now have lifetime limits

This post details the implementation of lifetime limits for personal, group, and project access tokens in GitLab. It explains the security rationale behind this change, which is to mitigate risks associated with long-lived, static credentials. The post outlines the enforcement of expiration dates for new tokens (within 365 days) and the automatic assignment of a one-year expiration to previously non-expiring tokens. It also discusses the impact on automation, the introduction of a token rotation API with automatic reuse detection, and the recommendation of service accounts for automation use cases. The post also mentions the ability for administrators to set custom allowable expiration limits in Ultimate tiers.