GitLab

GitLab 19.5 release notes

On October 15, 2026, GitLab 19.5 was released with the following features. We are excited to recognize Dhairya, a Level 3 contributor, as this month’s Notable Contributor! Dhairya contributed to offline transfer and Organizations support for import, so that groups, projects, and their memberships can move between GitLab instances. Primary features GitLab MCP server is generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, MCP clients could reach only a limited set of GitLab tools. Now the GitLab MCP server is generally available. With the MCP server, any MCP-compatible agent, such as Claude Code or Cursor, gets direct access to the expanded GitLab catalog of tools and GitLab Duo Agent Platform agents and flows. Your agents can work across more of your GitLab workflow and run Agent Platform agents and flows without leaving your preferred tool. GitLab Secrets Manager is generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Add-ons: GitLab Secrets Manager Links: Documentation · Related Issue Without a centralized secrets store, credentials can become scattered across over-scoped CI/CD variables, local config files, and standalone vaults. This makes them harder to manage, protect, and audit. GitLab Secrets Manager is now generally available on GitLab.com and GitLab Self-Managed. Built on OpenBao, it uses your existing group and project permissions, so there’s no separate access model to maintain. Each CI secret is scoped to the job that needs it, based on environment, branch, and branch protection rules. Audit logs are generated for every create, read, update, and delete. GitLab Secrets Manager consumes GitLab Credits. Start a free 30-day trial or enable it for your group or instance. Connect Externally Connected Agents (ECAs) to AI Governance Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, the AI Governance Dashboard showed activity only from GitLab Duo Agent Platform agents. This provided you total visibility into all of your Agent Platform agents, including the sessions they were running, including tool calls, MCPs used, and the prompt input and output from the user and agent respectively. With the GitLab 19.5 release, after a one-time glab govern setup, you can now extend governance visibility past just GitLab Duo Agent Platform agents, and connect Externally Connected Agents (ECAs) like Claude Code, Cursor, and Codex to GitLab AI Governance by using the GitLab CLI (glab). When Allow external agents and Store AI audit events are enabled, security and compliance teams get visibility into ECAs that run outside GitLab, alongside your GitLab Duo Agent Platform agents. Every qualifying agent session is captured, including who ran it, which agent, which project, and when, with sessions and tool calls appearing in the AI Governance Dashboard and the AI audit events report. Audit events also flow to your SIEM through audit event streaming. Tool output is not sent, except for short error messages from failed tool calls. This feature is in beta. Share your feedback in issue 633489. Non-default branch tracking generally available Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Non-default branch tracking is now generally available. You can track vulnerabilities on branches other than the default branch. For the best results, target a small number of long-lived release branches, such as branches for specific environments (project-qa, project-prod) or deployment platforms (project-iOS, project-android). This release includes the following capabilities: Track three additional branches or tags on the security configuration page. This is in addition to the default tracked branch. Filter by tracked ref on the vulnerability report. Filter by branch on the project-level security dashboard. Update vulnerability status on tracked branches. Vulnerability management policies evaluate each tracked branch separately and update only the vulnerabilities on that branch. Restrict GitLab Duo access by subgroup membership Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators can now select any subgroup, not just top-level groups, in the Restrict access based on group membership setting for GitLab Duo. You can scope GitLab Duo Agent Platform access to a specific team or pilot group without restructuring your group hierarchy. Previously, this setting accepted only top-level groups. Organizations with a single top-level group for all users had no supported way to limit GitLab Duo Agent Platform access to a subset of users. Now, when you select a subgroup, direct members of that subgroup get access. This makes it easier to run a GitLab Duo Agent Platform pilot or roll out access one division at a time on GitLab Self-Managed and GitLab Dedicated. Agentic Core `/goal` command in GitLab Duo CLI is generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The /goal slash command in GitLab Duo CLI is now generally available in GitLab Duo CLI 9.27.0. Describe an open-ended goal, and GitLab Duo delegates it to a governed, goal-driven flow that runs locally and handles both implementation and verification. To start, run /goal . For example: /goal Fix the failing tests in spec/models/user_spec.rbIn GitLab 19.5 (GitLab Duo CLI 9.24.0), the Run suggested prompts as /goal sessions setting in /settings runs suggested prompts as /goal sessions instead of chat messages. /goal requires GitLab 19.3 and later, and GitLab Duo CLI 9.17.0 and later. Auto mode in GitLab Duo CLI Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI has a new auto mode. In auto mode, GitLab Duo uses tools without asking for approval first, so longer tasks run without stopping for each shell command, git operation, or MCP tool call. Auto mode respects your organization’s controls: Auto mode is off by default. Administrators, Owners, and Maintainers can turn the setting on for instances, groups, and projects. Administrators and group Owners can also lock it to Always off for the entire instance or group. Agent tool governance still applies. Tools set to Always Deny stay blocked. To use auto mode, you need GitLab Duo CLI 9.22.0 or later. Press Tab until the mode under the > prompt shows auto. Use auto mode only in repositories you trust and on branches you can discard. Configure GitLab Duo CLI with settings files Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now configure GitLab Duo CLI with settings files, for yourself or for your whole organization. The settings file stores the choices you make in the /settings panel. You can also edit the file directly, or create it in advance, for example in a container image. System administrators can deploy a managed settings file to each machine with a mobile device management tool or group policy. Settings in the managed file take precedence over the settings file, command-line options, and environment variables, and users can’t change them. Settings not in the managed file remain under user control. The settings file requires GitLab Duo CLI 9.26.0 or later, and the managed settings file requires GitLab Duo CLI 9.27.0 or later. Follow-up reviews in Code Review Flow Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, when you asked GitLab Duo to review a merge request again, it treated the review as a first pass. It could repeat findings from its earlier threads, even ones you had already addressed. Now, Code Review Flow uses comment threads from earlier GitLab Duo reviews, including your replies, to evaluate new changes. GitLab Duo focuses on lines added after its last review, does not repeat points it already raised, and lists outstanding findings in its summary. If you reply on a thread to explain why the code is correct, GitLab Duo does not raise the point again. To start a follow-up review, ask GitLab Duo to review the merge request again. With Start a new review on push turned on, GitLab Duo automatically starts a follow-up review when you push changes. IAM roles for Amazon Bedrock self-hosted models Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, you could not control which AWS credentials the AI Gateway used for your Amazon Bedrock models. A single AWS identity needed access to all these models. With this release, you can specify an IAM role for each model, and the AI Gateway assumes that role when calling the model. This way, each model gets only the AWS access it needs, even when the role is in another AWS account. Image context in GitLab Duo CLI Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, GitLab Duo CLI could read text files but could not use screenshots or diagrams as context. Now, when you run the CLI locally in interactive or headless mode, it can read images from your repository and attachments on issues, merge requests, and comments in the same project. Image context requires GitLab Duo CLI 9.27.0 or later and a GitLab-managed model. Improved first-run experience in GitLab Duo CLI Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI now helps new users get started without leaving the terminal: On first run, an onboarding card helps you connect MCP servers and install GitLab plugins. Each new session opens with prompts suggested from your open merge requests and issues. For a merge request prompt, GitLab Duo checks out the source branch first if it exists. The status bar shows your branch, project, merge request, /goal progress, and MCP status. The setup screen links to token creation and validates your token before saving. Tips in the prompt and the /whatsnew command point you to new features. To get the full experience, update to GitLab Duo CLI 9.28.0 or later. MCP server CI/CD artifact tool Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, if you needed an agent to check something inside a CI/CD job’s build artifacts, it had to download and unzip the whole archive just to read one file. Now the get_artifact_file MCP tool lets your agent read a single file directly from a job’s artifacts, whether it’s a log, a generated report, or a test fixture. MCP server GitLab Duo agent and flow tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue New GitLab Duo agent and flow tools let you invoke and track GitLab Duo agents and flows from any MCP client: start_duo_session starts a session. get_duo_session reads a session’s current state. list_duo_sessions pages through your session history. list_duo_agents_and_flows lists the GitLab Duo agents and flows enabled in a project. MCP server groups tool Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, an agent connecting to GitLab over MCP had no way to discover which groups and subgroups you have access to without you hardcoding IDs or paths. The new list_groups tool lets your agent browse your organization’s group hierarchy on its own, so it can find the right group before acting instead of guessing at identifiers. MCP server toolset selection Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now choose which toolsets the GitLab MCP server exposes. Every additional tool that isn’t required wastes space in the LLM’s context window, and runs the risk of confusing the LLM, especially if you are using multiple MCP servers at once. New Agentic Chat UI generally available in IDEs Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The redesigned GitLab Duo Agentic Chat UI in VS Code and JetBrains IDEs, introduced as a beta in GitLab 19.3, is now generally available and is the default layout. You no longer need to turn on beta and experimental features to use it. The new layout has no tabs. You start conversations, view your chat history, and select an agent and model in the same view. The new layout is the default in: GitLab for VS Code 7.2.0 and later GitLab Duo plugin for JetBrains IDEs 3.50.0 and later To use the Software Development Flow or view the flows you have run, switch to the classic layout from the panel. New rate limits for GitLab MCP server Tier: Free, Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue If you connect an agent to GitLab over MCP today, nothing stops it from reconnecting or retrying faster than your workflow actually needs, and on GitLab.com that carries a cost. Starting October 15, the GitLab MCP server on GitLab.com limits each user to 60 requests a minute on the Free tier and 600 on Premium and Ultimate. Every reconnect and retry counts toward your limit. If your agent starts getting rate-limited (HTTP 429) errors, check its reconnect and retry settings before upgrading to a higher tier. Recommend reviewers with GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had to check each approval rule and guess who had time to review your merge request. Or you assigned a whole group and hoped someone picked it up. Now you can use the Recommend Reviewers Flow to suggest reviewers instead. The flow is generally available. For each approval rule, it recommends the minimum number of reviewers needed, based on availability, workload, time zone, and recent activity. Recommendations appear in the Recommended section of the merge request sidebar. Hover over a user to see why they were recommended. To get started, turn on the flow for your top-level group. It runs when a merge request is created, or you can create a trigger to run it when a draft is marked ready. To get new recommendations, select Refresh. Software Development Flow requires updated IDE extensions Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The Software Development Flow now runs on the GitLab Duo Agent Platform flow registry, the same foundation as other flows. The flow works the same way in your IDE, and new fixes and improvements go to this version. To keep using the Software Development Flow, update your editor extension to one of these versions or later: GitLab for VS Code 6.85.0 GitLab Duo plugin for JetBrains IDEs 3.40.0 GitLab for Visual Studio 0.79.0 Trigger flows with a generally available API Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, the API endpoint you use to trigger GitLab Duo Agent Platform flows from CI/CD pipelines, scripts, and other automation was an experiment, so it was hard to know whether you could rely on it in production. Now the trigger a flow endpoint of the Flows API is generally available, so you can build production automation on it knowing it follows the GitLab REST API breaking changes policy. Unified DevOps and Security Child pipelines can depend on parent jobs optionally Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Many development teams split large CI/CD setups into parent and child pipelines so each part is easier to manage. Until now, a child pipeline job couldn’t safely depend on a parent job that only runs under certain conditions, such as tests that run only when certain files change. If that parent job was skipped, the child job broke, so teams had to work around it with duplicate jobs or brittle scripts. Now you can mark these dependencies as optional. If the parent job runs, the child waits for it as usual. If it doesn’t run, the child job goes ahead without it. Pipelines stay fast and reliable without the workarounds, and a failure in a job that does run still stops the pipeline, so quality checks aren’t weakened. Thank you to Jimmy Spagnola for this contribution! Customize security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now customize Secret Detection and SAST profiles in the UI. Set scan options like excluded paths, custom analyzer images, and full Git history scans once for a group, and apply them to all its projects. Previously, a security configuration profile enabled a scanner with its default settings. Anything beyond the defaults required edits to .gitlab-ci.yml in each project. Now the profile includes those settings too. Currently, customization of Dependency Scanning profiles is only available through the GraphQL API. UI customization is planned in a future release. Embed code from a repository in Markdown Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, permalinks to a file’s lines rendered as plain URLs, so you had to leave the merge request, issue, or wiki page to view the referenced code. Now, permalinks render as a syntax-highlighted snippet with the file path and commit, so you can read the code without leaving the page. You can only view embedded snippets if you have read access to the repository. GitLab Observability is now in beta Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, Observability was an experiment. Now it’s in beta on GitLab.com and GitLab Self-Managed. With GitLab Observability, you can send traces, metrics, and logs with OpenTelemetry, then explore them next to your code, merge requests, and CI/CD pipelines. On GitLab.com, each group or personal namespace opts in by selecting Enable Observability. On GitLab Self-Managed, you host the Observability backend and connect it to a group or personal namespace. Observability is available at no cost during the beta. Sort Markdown tables by column Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, to find information in a large Markdown table, you had to scan every row or copy the table into a spreadsheet. Now you can sort rendered Markdown tables by any column, in both view mode and preview. In a column header, select the sort button to sort rows in ascending or descending order, then reset to restore the original order. You can also sort with a keyboard. Sticky headers for Markdown tables Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, when you scrolled through a long table, the header row scrolled out of view, so it was hard to tell what each column contained. Now, table headers stay visible at the top of the table as you scroll, in view mode, preview, and the rich text editor. Sticky headers are always on, so you don’t need to change any settings. Accurate merge request security report comparisons Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, if a scan had more than 25 findings of one severity, the security report compared only 25 of them from each pipeline. Unchanged findings could appear as new or fixed. Now, the report compares up to 1,000 findings per severity, so the new and fixed lists are more accurate. AI flows supported on non-default branches Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you could run the SAST False Positive Detection, SAST Vulnerability Resolution, and Secret False Positive Detection flows only on vulnerabilities in the default branch. Now, you can also run these flows on vulnerabilities in other tracked branches from the vulnerability report to analyze and resolve them before you merge. Business Logic Security Analyzer (closed beta) Tier: Ultimate Offering: GitLab.com Links: Documentation · Related Issue Business Logic Security Analyzer is a GitLab Duo Agent Platform foundational flow that reasons about what your code is meant to enforce. It finds vulnerabilities that pattern-based scanners often miss: broken object-level authorization, missing authorization checks, and mass assignment. Start a whole-repository scan from GitLab Duo Chat or the API. To scan merge requests automatically, attach the Business Logic scan profile to a project. Findings appear in the vulnerability report and the merge request security widget. Business Logic Security Analyzer is in closed beta for GitLab Ultimate customers on GitLab.com. To request access, contact your account team. Each scan consumes GitLab Credits. For prerequisites and setup, see Business logic scanning. GitLab Relay (KAS) connections default to gRPC Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Relay (KAS) now uses gRPC by default. GitLab.com advertised grpcs://kas.gitlab.com in GitLab 19.4. In GitLab 19.5, new Linux package and Helm chart installations advertise grpcs:// too. New agent installations connect over grpcs:// instead of gRPC wrapped in WebSocket, which means one protocol to route and troubleshoot, and less overhead for each connection. Agents that already connect over wss:// work, but you should move them. On GitLab.com, set the agent address to grpcs://kas.gitlab.com. For example, use --set config.kasAddress=grpcs://kas.gitlab.com when you upgrade the gitlab-agent Helm chart. On GitLab Self-Managed, use the address shown in the agent installation command after you upgrade. Share filtered views of the security inventory Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now share a filtered view of the security inventory with a link. Filter by tool coverage, vulnerability count, or project name, then copy the URL and send it. Whoever opens the link sees the same view. Previously, only the project name search was saved in the URL, so a shared link lost the other filters. Now the full filter state is preserved, so you can bookmark a view or hand it to the team that owns those projects. Scale and Deployments Start a custom flow in GitLab Duo Agentic Chat Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now start a custom flow directly from GitLab Duo Agentic Chat, without needing to configure a trigger first. Previously, running a custom flow required setting up a trigger event — a mention, an assignment, or similar — which made flows difficult to test and iterate on. Now, you can launch any AI Catalog flow enabled in your project by sending a message in GitLab Duo Agentic Chat. Your message becomes the goal for the flow. If you send no goal, the flow falls back to its own description. Chat links to the resulting agent session so you can follow along. See your own GitLab Credits usage Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue If you used GitLab Credits, you had no way to check your own usage. Only group Owners and administrators could open the GitLab Credits dashboard, so you had to ask someone with access. You can now see your own usage in User settings > GitLab Credits. The page shows your total usage, daily average, and peak day, and you can filter by product or select a date range. If you belong to more than one group with GitLab Credits, you can switch between them. Co-created contributions Resync an LDAP-blocked user on demand Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators can now resync a single LDAP-blocked user from the Admin area Users page. The new Resync with LDAP action runs an LDAP access check and unblocks the user when LDAP allows access, or leaves the user blocked when it does not. If the user has no LDAP identity, the action declines with a message. In previous versions of GitLab, an LDAP-blocked account stayed blocked until the daily user sync ran or the user signed in, which service accounts cannot do. Thank you to Sergey Pechenko for this contribution (MR)! Cancel auto-merge from the REST API Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now cancel an active auto-merge with the cancel_auto_merge API endpoint. If the merge request is on a merge train, the call also removes it from the train. The older cancel_merge_when_pipeline_succeeds endpoint is now deprecated. Separately, git push -o merge_request.auto_merge is now rejected with a remote message when you cannot merge to the target branch. In previous versions of GitLab, the auto-merge was recorded and left the merge request unmergeable until canceled. Thank you to the following users for these contributions! José M. Requena Plens (MR 1 MR 2) Bobby Nandigam (MR) Configure job log update frequency Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators can now set how often job logs update, under Admin area > Settings > CI/CD or through the Settings API. You can select between 3 to 3600 seconds. In previous versions of GitLab, these intervals were constants, so you could not shorten the initial live-log delay for short jobs without patching the instance. Thank you to Aleksandr Kotlyar for this contribution (MR)! Repository tags and Terraform states in GraphQL Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GraphQL now exposes Repository.tags, with forward pagination, search, and a TagSort enum for name, updated, and version order, at up to 100 tags per page. Repository.tags is an experiment in GitLab 19.5. TerraformState.versions lists a state’s versions, newest first. The merge requests REST API now returns author.bot on single and list responses, so a client can tell bot and service account authors apart without a second call to the Users API. Thank you to the following users for these contributions! Jeston Singh (MR 1 MR 2) Ivane Gkomarteli (MR) Commit count variable in commit templates Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use %{commits_count} in merge commit and squash commit message templates, and in new merge request description templates. For example, %{title} (%{commits_count} commits) renders as Bugfix (3 commits). Thank you to Jeston Singh for this contribution (MR)! Submit a review to become a reviewer Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When you submit a review on a merge request you are not yet a reviewer of, with Comment, Approve, or Request changes, GitLab now adds you to the Reviewers list. The review drawer tells you beforehand: “You will be added as a reviewer.” The Reviewers list and the people who took part in the review no longer drift apart. This behavior has been available since GitLab 19.4, when its feature flag was removed. Thank you to Michael Fischer for this contribution (MR)! Revoked GPG identities no longer verify commits Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab now ignores user IDs that GPG reports as revoked. A revoked identity no longer appears under Access > GPG keys in user settings and no longer counts as a verified email for the Verified badge on signed commits. Commits signed under a revoked identity move to “same user, different email” or “other user”, and a key whose every identity is revoked verifies nothing. Signatures already verified under a key that stays in place are not re-derived. Thank you to José M. Requena Plens for this contribution (MR)! Other improvements Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Other improvements in this release include: GitLab MCP server: rate-limited tool results name the limit and retry delay, add_branch returns the branch web_url, tool aliases in the enabled-tools header resolve, mismatched URL and project ID inputs are rejected, and ai_workflows tokens can read blobs in batch. Administrators in admin mode can set a cluster agent on an environment without joining the project. CI_JOB_TAGS and CI_RUNNER_TAGS JSON-encode each tag. Duplicate variable keys in push options are rejected. Advanced SAST (Ultimate): C and C++ files up to 20 levels deep are scanned, and the report follows your artifact retention. Plain-text token and SSH key emails link to the right page, and ?scopes= links prefill the token form. Thank you to the following users for these contributions! otutukingsley (MR) Jeston Singh (MR 1 MR 2 MR 3 MR 4 MR 5 MR 6) ryo-whaletech (MR 1 MR 2 MR 3) Mohamed Elsayed (MR) Gerardo Navarro (MR) Torben Buck (MR 1 MR 2 MR 3) Other additions to the interface Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Other additions to the interface in this release include: Changing Approvals required in merge request settings shows a toast on success and an alert on failure. A compliance framework whose requirement already has 5 controls can be edited again. A failed protected environment update shows the API message. In the Create branch dialog, the submit button stays disabled until the branch name is validated. Archived labels show an Archived tooltip in issue and merge request lists, and cannot be newly assigned. SCIM tokens cannot be generated while the group’s SAML provider is disabled. .4dm files are syntax highlighted. Right-aligned Markdown table columns use fixed-width numerals. Approval rules, compliance frameworks, and protected environments require Premium or Ultimate. Thank you to the following users for these contributions! Sahil Bhatt (MR 1 MR 2) Jeston Singh (MR) Vladislav Petrov (MR) Nicholas Wittstruck (MR) ryo-whaletech (MR) Sergey Pechenko (MR) Logan Swartzendruber (MR) Steve Mokris (MR)

GitLab 19.4 release notes

On September 17, 2026, GitLab 19.4 was released with the following features. We are excited to recognize Jimmy, a Level 4 contributor, as this month’s Notable Contributor! Jimmy contributed across the GitLab codebase, client-go, and the Terraform provider to ensure that tokens, service accounts, and push mirrors can be managed end to end through infrastructure as code. Primary features Governance for GitLab MCP server tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, you could only apply AI agent tool governance rules to internal GitLab Duo Agent Platform tools. Tools available to both GitLab Duo Agent Platform and third-party agents through the GitLab MCP server followed fixed rules that could not be changed. You can now govern GitLab MCP server tools from the same place as internal GitLab Duo Agent Platform tools. They appear alongside internal tools in your group and project GitLab Duo settings, where you can set a mode for each tool: Read-only tools default to Always Allow, so routine lookups run without interrupting your team. Write and delete tools default to Always Ask, giving reviewers a checkpoint before an agent changes anything. Restrict access to MCP servers (beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now restrict access to MCP (Model Context Protocol) servers by allowing or denying access to: An entire external MCP server. Individual tools on an MCP server. This feature gives you assurance that AI agents within Duo Agent Platform are operating within governed boundaries and can only access MCP tools that are within their scope to perform their activities, sessions, and tasks. These controls apply consistently wherever AI agents run, including: Agentic Chat. Flows. IDE and CLI environments. This feature is currently in beta and we welcome your feedback in issue #628378. Vulnerability Context Flow Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Use the Vulnerability Context Flow to produce context to triage vulnerabilities more efficiently and intelligently. The flow produces context in the following three categories: Authentication: Yes or No. Indicates whether the vulnerable code requires authentication to exploit. Authorization: Elevated or Standard. Indicates whether exploiting the component requires elevated privileges. Sensitive data: Yes or No. Indicates whether the vulnerable code handles sensitive data, such as personal information, credentials, tokens, payment data, or health data. Advanced SAST includes Kotlin, Dart, and Scala language support Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Advanced SAST now scans Kotlin, Dart, and Scala codebases with the same deep taint analysis that covers Java, Python, and other supported languages, all delivered through the Software Factory architecture with per-language front-ends and framework-aware rule gating. Kotlin detection targets Android APIs for SQL injection, unsafe WebView usage, OS command injection, hardcoded credentials, and weak cryptography. Dart detection includes a Flutter and Dio framework detector covering SSRF, path traversal, command injection, and cleartext HTTP. Scala detection covers Play, Slick, and Akka frameworks for SQL injection, SSRF, open redirect, path traversal, command injection, and XSS. All three additions are verified using deliberately vulnerable real-code repositories, with findings reported as code flows from source to sink. SPDX license expression support in dependency and license scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab license data now carries SPDX license expressions, including compound declarations such as MIT OR Apache-2.0 or GPL-2.0-only WITH Classpath-exception-2.0. Previously these were reported as unknown in the dependency list and were invisible to license approval policies. Composite licenses now appear in the dependency list with their operator (AND, OR, WITH), and license approval policies can allow or deny them the same way they handle single-license dependencies. Expressions declared in a CycloneDX SBOM have been supported since GitLab 19.3. This release adds them to the license data GitLab synchronizes. Offline instances receive expressions only after downloading the v3 license data. Agentic Core /goal command in GitLab Duo CLI Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI now includes a /goal slash command that delegates open-ended objectives to a governed, goal-driven flow that runs locally. You describe a goal and GitLab Duo handles implementation and verification, using an independent judge to decide when you have achieved your goal or reached the iteration limit. You stay in control the whole time: pause, update the goal, or redirect the agent at any time. The /goal slash command requires GitLab 19.3 and later, and GitLab Duo CLI 9.17.0 and later. To get started, run /goal . For example: /goal Fix the failing tests in spec/models/user_spec.rb GitLab Duo Slack integration (Experimental) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now invoke GitLab Duo agent flows directly from Slack, without switching to the GitLab UI. With the GitLab Duo Slack integration, you can mention GitLab with @GitLab in any Slack channel or thread. Mention GitLab to trigger agent flows, get answers from your codebase, and create GitLab issues from conversations. GitLab Duo streams its progress back into the Slack thread in real time, and includes thumbs-up and thumbs-down feedback buttons so you can rate responses without leaving Slack. This integration is available as an experiment. To share your feedback, add a comment to issue 624364. GitLab flow builder for custom flows (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Build custom flows for your GitLab projects with the GitLab flow builder, a new visual editor for AI-native workflows in the GitLab for VS Code extension. Compose a flow visually from components (Agent, Custom tool, and AI task), or edit the underlying YAML directly. To start, open your flow’s YAML file in VS Code and select Open GitLab Flow Builder. Test your flow with the Run button, which opens an execution console. When your flow is ready, select Publish to publish it to the AI Catalog. The flow builder is available as a beta feature in GitLab for VS Code 6.87.0 and later. To get started, enable the gitlab.featureFlags.flowBuilder setting in VS Code. MCP server CI/CD tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue New CI/CD tools let agents trigger, inspect, and control CI/CD from any MCP client: save_pipeline runs, retries, or cancels a pipeline without switching tools. get_job returns job metadata together with the job trace, so an agent can read the log of a failed build and diagnose the problem on its own. Previously, agents had no way to trigger or inspect pipelines through MCP. MCP server merge request tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Merge request tools let agents run the full merge request loop through the GitLab MCP server: save_merge_request opens and updates an MR. get_merge_request inspects an MR in depth, with new diffs, conflicts, and approvals facets. save_merge_request_review leaves line-level review comments, with batched diff comments and a summary in a single call. accept_merge_request merges an MR once checks pass, and can also approve or unapprove it. MCP server project and user tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue New project and user tools give agents the context they need to target work correctly through the GitLab MCP server: list_projects finds and reads project details. get_user looks up user details for assignment and mentions. Previously, agents had no way to discover project or user information through the GitLab MCP server. MCP server repository tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue New repository tools let agents browse a project’s structure, read its commit history, and propose changes through the GitLab MCP server: list_repository_tree explores the file tree. list_tags enumerates refs. list_releases inspects published releases. get_commit retrieves a commit’s metadata, diff, or notes. list_commits pages through a branch’s history. add_commit commits one or more file actions in a single call, optionally to a new branch from a specific starting ref or source project. fork_repository forks a project, so an agent can go from exploring an upstream repository to proposing changes without leaving its client. MCP server semantic search tool Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue semantic_code_search is now semantic_search. The tool finds code by meaning rather than by exact symbol or filename, which is unchanged from earlier releases. The rename adds a scope parameter so that additional indexed content types can fold into the same tool in future releases. Today scope accepts code only. Thank you to arun kumar for this contribution! MCP server work item tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab MCP server now exposes work item tools, so agents and MCP clients can search, read, create, and update issues, epics, tasks, incidents, objectives, and key results. Use get_work_item to read a single item in depth, list_work_items to search across a group or project, and save_work_item to create or update any work item type. Because issues and epics are work item types, get_work_item and save_work_item cover what get_issue and create_issue do today. save_note lets an agent comment on a work item or merge request and reply inside an existing discussion thread. The introduction of this tool renames existing create_merge_request_note and create_workitem_note. Merge request created event trigger Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, the Merge request trigger event type only supported the Approved, Marked ready, and Merge conflict actions. You had no way to run a flow or external agent the moment someone opened a merge request without using a tool outside GitLab. You can now select Created as a trigger action. When someone opens a merge request in draft or ready state, and GitLab generates the diff, your flow or external agent runs. Use this for a first-pass review, or to add context from related issues. To configure this trigger, go to AI > Triggers in your project, or select it when you enable a flow. Redesigned session details panel for the GitLab Duo Agent Platform Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Finding the details that matter about an agent session used to mean hunting through a cluttered panel. Now, the session details panel surfaces what you need at a glance: status, timestamps, and the triggering user appear in an overview bar, while the right rail organizes identity, execution, and supplemental details into clearly labeled groups. A new Linked items section separates what started the session from what it produced, including merge requests, work items, jobs, and comments. In the GitLab Duo side panel, session details now live in a collapsible bar pinned to the bottom, so they stay accessible without getting in your way. Model selection for the Developer Flow Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab Duo Agent Platform now supports independent model selection for the Developer Flow. As an administrator, you can select a specific AI model for the Developer Flow separately from other GitLab Duo Agent Platform features, giving teams greater control over model selection. Support for GLM 5.3, Kimi K3, and MiniMax M3 in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab Duo Agent Platform now supports three open-weight models: GLM 5.3, Kimi K3, and MiniMax M3. In GitLab Duo Agentic Chat, you can select any of these models for your own conversations. Users with the Owner role for a group and administrators can also set them as the default for Agentic Chat and for other agents, flows, and features. Turn flow triggers off without deletion Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, the only way to stop a trigger from automatically starting a flow was to delete it entirely. Deleting a trigger meant losing any complex filter configuration you had set up. Now you can turn a flow trigger off and retain its configuration. Use the new toggle to turn it back on at any time. To manage triggers, go to AI > Triggers. Unified DevOps and Security Automated Triage and Remediation profile (GraphQL API) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you turned on SAST false positive detection, GitLab Duo Vulnerability Resolution, secret detection false positive detection, and dependency scanning auto-remediation for each project individually. Now you can apply an Automated Triage and Remediation profile to a group or project, setting severities and run modes in one action. Start with a preset, or configure each flow yourself: Conservative: on demand, high severity. Standard: automatic, medium severity and above. Proactive: automatic, every severity. Profiles are available only with the GraphQL API, and require GitLab Duo Agent Platform with foundational flows turned on for the top-level group. Most flows consume GitLab Credits. See who locked a file or directory Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When a file is locked, you now see who locked it and what your options are, without leaving the blob viewer. Previously, only a Locked label appeared, with no way to tell who locked the file or whether you could unlock it yourself. Now, a popover next to the label shows who locked it. If you have permission to unlock the file, the popover includes an unlock action. If you don’t, it explains why. For locked directories, the popover links you directly to the specific file that’s blocking your changes. Vulnerability Due Date API Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Security teams can use the bulkSetVulnerabilityFindingsDueDates GraphQL mutation to assign, update, or remove due dates for vulnerability findings in bulk. Each request supports up to 1,000 finding UUIDs and returns counts for assigned, removed, and skipped updates, along with structured errors. Teams can use this information to connect vulnerability remediation timelines with existing service-level agreement (SLA) and workflow automation. Aggregated scanner coverage in security inventory Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now view scanner coverage for an entire group hierarchy from one page. In previous versions of GitLab, the Security Inventory showed coverage per subgroup, but no total for the entire group. A coverage widget now aggregates scanner coverage across every project in the group and its subgroups, and shows the percentage and number of projects where each scanner is enabled, not enabled, failing, or stale. To focus on one scanner, such as SAST or Dependency Scanning, use the scanner dropdown list. Then select a status to filter the project list, and turn on scanners for the projects that aren’t covered. The Security Inventory also now lets you control which columns are shown. To show or hide the Vulnerabilities, Tool coverage, and Security attributes columns, select Display. Automatic revocation for routable personal access tokens Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When secret detection finds a leaked GitLab personal access token in a public project, automatic response revokes it. In GitLab versions earlier than 19.4, revocation used only one detection rule and revoked only the legacy token format. Tokens created on GitLab 18.3 and later use the routable or versioned routable format. GitLab detected and reported these tokens without revoking them. In GitLab 19.4 and later, revocation recognizes all three GitLab personal access token detection rules: gitlab_personal_access_token gitlab_personal_access_token_routable gitlab_personal_access_token_routable_versioned Revocation also covers findings from GitLab Secret Scanning for Source Code and the Gitleaks-based analyzer. You do not need to change any configuration. Instances with automatic response enabled get this wider coverage immediately. GitLab Runner 19.4 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.4 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Fastzip is now the default archiver for caches and artifacts Add runner and system_id labels to gitlab_runner_job_router_get_job_duration_seconds Add a dedicated SLI, SLO, and alerting integration for the Job Router Add suspend and resume support for the Kubernetes executor Emit the environment key on job-complete PUT request Option to suppress the cache upload and download URL in job logs Add services_cap_add and services_cap_drop options to the Docker executor configuration Bug Fixes Job router 409 responses disable runner managers for an hour The logrotate usage writer can panic the runner by mutating shared runner labels Windows service console restore failure force-kills a job that is stopping gracefully Unbounded cardinality for the job_id and runner_controller_id attributes in a histogram Config validation warns got null for nil-able fields that have a TOML tag but no JSON tag Intermittent silent failure in get_sources caused by SIGPIPE in the Git version check Spurious Request bottleneck warning when FF_USE_ADAPTIVE_REQUEST_CONCURRENCY is enabled Secret-resolution failures for AWS, GCP, Azure, and GitLab Secrets Manager are now classified by cause Kubernetes pause pods fail to start when the runner short ID begins with - Canceling a job always results in a process kill when running as a Windows service The list of all changes is in the GitLab Runner CHANGELOG. Improved table pasting in rich text editor Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, pasting a copied table into a table cell always merged the copied cells into the existing table, which made it difficult to create a nested table. Now you can choose how a pasted table behaves: Select Paste into cell to insert the copied table as a nested table inside the cell. Select Paste and merge into table to distribute the copied cells across the existing table, which remains the default behavior. You can also use a keyboard shortcut to paste a table into a cell as a nested table: Command+Option+V on macOS, or Control+Alt+V on Windows and Linux. Standard paste with Control+V or Command+V works as it did before. Malicious package detection in Dependency Scanning (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, Dependency Scanning only surfaced packages with known CVEs. Malicious packages, those crafted to harm through typosquatting, compromised maintainer accounts, or embedded malware, produced no findings. GitLab 19.4 introduces malicious package detection in beta. Dependency Scanning now checks your dependencies against GitLab malware advisories, so threats can surface before they are widely known. Findings appear in your Dependency List and Vulnerability Report with a red Malware badge, always Critical severity, identified by a GLAM- ID, not a CVE. You can also block malicious packages before they merge, using the malware rule in merge request approval policies. You don’t need any additional setup. Coverage applies to the supported package types: npm, PyPI, Maven, Go, NuGet, Cargo, and RubyGems. The same advisories power continuous vulnerability scanning, and offline instances download them manually. Share feedback on issue 606036. Organization security dashboards (Beta) Tier: Ultimate Offering: GitLab.com Links: Documentation · Related Issue Security dashboards are now available at the organization level. Users can see the following data across all top-level groups in an organization: Vulnerability severity panels Vulnerabilities over time Top 10 CWEs Risk score Vulnerabilities by age Vulnerability tools added to the GitLab MCP server Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In GitLab 19.4, the GitLab MCP server provides the following new tools for vulnerability management: list_vulnerabilities, which lists security vulnerabilities in a GitLab project with optional filtering by severity and report type, with cursor pagination. get_vulnerability, which fetches full details for a single vulnerability by numeric ID, converting it to the gid://gitlab/Vulnerability/ global ID format. save_vulnerability, which covers five write operations on GitLab vulnerabilities in a single consolidated tool: Mark a vulnerability as dismissed, with optional comment and dismissal reason. Mark a vulnerability as confirmed. Revert a vulnerability’s state back to detected. Override the severity with a required comment. Create a new issue linked to the vulnerability. These new vulnerability management tools allow AI agents to run vulnerability triage and remediation actions through the GitLab MCP server. Scale and Deployments Early warnings for GitLab Flex spend caps Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab 19.3 introduced email notifications for reservation thresholds and for the moment a capped capability is cut off. The spend cap itself had no early warning, so the first email about a cap arrived when usage had already stopped. GitLab now emails billing account managers when a capability’s on-demand usage reaches 50% or 80% of its monthly spend cap, naming the capability and the cap in credits. Only the highest threshold crossed is sent, at most once per capability per billing period. Caps of less than $10 are skipped, so a small cap does not generate noise. Geo SSH proxying enabled by default Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Geo SSH proxying enabled by default The following feature flags are enabled by default in GitLab 19.4: geo_proxy_fetch_ssh_to_primary geo_proxy_push_ssh_to_primary Geo SSH proxying provides a more reliable path for SSH fetches and pushes to a Geo secondary site when the operation is proxied to the primary site. It also resolves long-standing bugs where proxied operations failed, such as pushes with push options and fetches from large repositories. Action required for Cloud Native GitLab deployments Cloud Native GitLab deployments using the bundled NGINX Ingress must either: upgrade to use the Gateway API with Envoy Gateway before this rollout, or disable both feature flags after the rollout. Otherwise, SSH fetches and pushes through Geo secondaries may hang or time out. See the Geo troubleshooting documentation for SSH proxying for more information. Included credits are used before evaluation credits Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When a subscription had temporary evaluation credits, all usage drew from that shared pool first. Every user’s included monthly credits sat idle until the evaluation pool ran out, and then reset at the end of the month. GitLab now consumes each user’s included credits first, and draws from the shared pool of temporary evaluation credits only after a user has used their included amount. The Monthly Commitment Pool, One-Time Charge credits, and On-Demand credits are consumed in the same order as before, so your bill is unaffected. Per-event detail in the credit usage export Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The credit usage export gave you one row per day, which told you how much a subscription spent but not what it spent on. Attributing credits to a team, a project, or a single automation meant guesswork. The export now returns a ZIP file with two CSV files: the daily summary you already had, and a per-event file with one row for each billable event. Each row includes the product, flow type, session, user, namespace, project, credits used, and token counts. Exports run in the background, and GitLab emails you a download link when the file is ready. Set credit caps without the GraphQL API Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue Credit caps limit how many GitLab Credits each user can consume, but until now you could only configure them through the GraphQL API. Setting a different cap for a handful of users meant writing mutations by hand. The new Credit caps page lets you set the flat cap that applies to every user by default, and add per-user overrides for individual users through a searchable picker. This page is available in GitLab Credits for group Owners on GitLab.com and administrators on GitLab Self-Managed. The GraphQL mutations still work if you prefer to script cap changes. Co-created contributions Diagnose LDAP group sync failures Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue When an LDAP group sync fails, the reason now reaches you. The failure is recorded against the group, the members that caused it are named (up to five), and a danger alert appears on the group members page, so a sync blocked by an email-domain restriction is diagnosable from the UI. A new group_filter setting lets you narrow which LDAP entries count as groups. The audit log also distinguishes causes that previously shared one entry: LDAP group links created and removed, and users blocked by LDAP sync, each now get their own audit event type. Thank you to Sergey Pechenko for these contributions (MR 1 MR 2 MR 3 MR 4)! Merge request widget is now more specific Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue While GitLab checks a merge request, the widget now tells you. Merge conflicts must be resolved becomes Checking for merge conflicts until the check finishes. When a rebase is refused, you see the specific reason, such as Source branch is protected from force push, instead of a generic retry prompt. You can act on the current state of the merge request. The sticky title bar that stays visible while scrolling a merge request now also updates immediately when you mark it draft or ready, instead of requiring a page refresh. Thank you to the following users for these contributions! Amartya Mishra (MR 1 MR 2) Gerardo Navarro (MR) Mahaveer A (MR) GitLab MCP server tools from the community Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Community contributors added new tools for the GitLab MCP server. Agents can now use get_project and list_project_members to read project metadata and members, list_branches to list a repository’s branches, and list_merge_requests to list merge requests across a whole group. get_duo_session fetches a GitLab Duo session so you can see what an earlier run did. These tools ship alongside the other new GitLab MCP server tools in 19.4 and run under the same tool governance, so an agent using them follows the rules your team already set. Thank you to the following users for these contributions! Dhairya Majmudar (MR 1 MR 2) Giannis Kepas (MR 1 MR 2) Mahaveer A (MR) Preview a new file before commit Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The new file page now has Write and Preview tabs, the same pair the edit page has had for years, so you can see how a Markdown or AsciiDoc file renders before its first commit exists. Preview keeps up with your edits: rename a file from .txt to .md mid-edit and the preview switches renderer; rename it away from Markdown and the live preview stops. Snippets also gained Markdown live preview, available from the editor’s right-click menu. Thank you to skkzsh for this contribution! Additional feature enhancements Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Other improvements in this release include: Fetch a specific report artifact from the API, restricted to downloadable types and gated by a per-artifact authorization check. For example, use GET /projects/:id/jobs/:job_id/artifacts?file_type=junit for a JUnit file. Administrators can let clients choose between a direct 302 redirect and a proxied transfer for job artifact and package downloads. The pipeline editor now validates CI/CD keywords the backend already supported. An email with an empty subject line now opens a Service Desk ticket instead of bouncing. Raise dependency resolution limits yourself with two new timeout inputs on the Dependency-Scanning.v2 template. Administrators can set achievements to appear on profiles without each person accepting an emailed link. Thank you to the following users for these contributions! Andreas Kunze (MR) André Düwel (MR) Paweł Farys (MR) Praveen Arimbrathodiyil (MR) Niklas van Schrick (MR) BoxBoxJason (MR) Other additions to the interface Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Other additions to the interface in this release include: Filtering the issue list by created, closed, due, and updated date is now generally available for everyone. Starting a merge request from a cherry-picked commit now has a checkbox to copy the source merge request’s description instead of the project template. /internal_note marks a comment internal as you create it, so internal notes can live inside comment templates and saved replies. /type Epic promotes an issue to an epic, the same as /promote_to Epic. Links in Mermaid flowcharts now open, and diagrams render without clipping in Chrome on iOS. Thank you to the following users for these contributions! Radek Antoniuk (MR) Viktor Chekryzhov (MR) Priyansh Garg (MR) Aryann Dwivedi (MR) skkzsh (MR) Jordan Labrosse (MR)

GitLab 19.3 release notes

On August 20, 2026, GitLab 19.3 was released with the following features. We are excited to recognize gkepas as this month’s Notable Contributor! Giannis has made sustained contributions across the GitLab codebase, the contributor platform, client-go, the Terraform provider, and GitLab Orbit. He is also an active translator and a member of the GitLab Community Discord. Primary features Flow Creator foundational agent Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use the Flow Creator, a purpose-built foundational agent in the AI Catalog, to create custom flows for the GitLab Duo Agent Platform through a plain-language conversation. With the Flow Creator, you describe what you want the flow to do, and the agent produces a complete, runnable flow YAML you can register and use immediately. The agent can also help you debug existing flows and explain framework concepts. GitLab Secrets Manager now available on GitLab.com Tier: Premium, Ultimate Offering: GitLab.com Add-ons: GitLab Secrets Manager Links: Documentation · Related Issue Credential leaks often start the same way: a developer needs a secret, has no good place to put it, and drops it into an over-scoped CI/CD variable or a committed config file. GitLab Secrets Manager, now in Limited Availability on GitLab.com, makes credentials more secure and keeps them in the same platform that runs your pipelines. Each secret is scoped to the job that needs it, based on environment, branch, and branch protection, so a compromised credential can’t reach more than it’s authorized to. Secrets Manager uses your existing group and project permissions, so there’s no separate access model to maintain. Every create, update, and read is logged to your audit trail, so a leak investigation doesn’t mean stitching together logs from multiple systems. GitLab Secrets Manager is an add-on billed through GitLab Credits. Start a free 30-day trial to explore all features. Learn more about billing and trials in the billing documentation. Agentic Core Resolve merge conflicts with GitLab Duo is generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases. Now you can ask GitLab Duo to resolve conflicts for you. Start conflict resolution from the merge widget or the Resolve conflicts page. GitLab Duo analyzes the conflicts, edits the files and commits the resolution to the source branch, and then posts a summary comment on the merge request describing what changed. Resolve review discussions with GitLab Duo is generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, to resolve a code review comment, you had to switch to your editor, implement the fix, commit and push the change, and then manually close the thread. Now you can select Resolve with GitLab Duo and GitLab Duo will address the review discussion for you. GitLab Duo reads the comment and the surrounding code, makes the requested change on the source branch, replies to the discussion with a summary of what changed, and then resolves the thread. If the change does not address the comment correctly, you or the reviewer can reopen the thread. GitLab Duo CLI plugins and marketplaces (Experiment) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI now supports plugins and plugin marketplaces as an experiment, introduced in GitLab Duo CLI 9.10.0. A plugin bundles Agent Skills, custom slash commands, and Model Context Protocol (MCP) servers into a single directory. A marketplace is a catalog of available plugins, hosted in a Git repository or a local directory. GitLab Duo CLI automatically registers the official gitlab-duo-plugins marketplace the first time you use plugins. The marketplace includes three skills for common GitLab workflows: mr-review: Reviews a merge request and posts comments. stack-changes: Splits a large local change into a stacked merge request chain. create-issue: Drafts a GitLab issue from a natural-language description. To install one of the skills, run glab duo cli plugin install @gitlab-duo-plugins or duo plugin install @gitlab-duo-plugins, based on your setup. For compatibility with the existing community plugin ecosystem, GitLab Duo CLI also reads .claude-plugin/marketplace.json files, so existing Claude Code plugin marketplaces work with GitLab Duo CLI without modification. New Agentic Chat UI in VS Code and JetBrains IDEs (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab Duo Agentic Chat interface in the GitLab for VS Code extension and the GitLab Duo plugin for JetBrains IDEs has a redesigned UI, now available as a beta. The new interface is a rebuilt version of the existing Agentic Chat panel, with the same underlying capabilities: AI models, agents, slash commands, and tool approvals. The redesigned UI is available in GitLab 19.3 with: GitLab for VS Code 6.88.1 and later GitLab Duo plugin for JetBrains IDEs 3.45.2 and later To use the new UI, turn on beta and experimental features for your top-level group or instance, then reload the extension. You can switch between the new and classic UI at any time from the panel. New MCP tools for reading and searching merge requests Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now use get_merge_request to retrieve a merge request along with its diffs, commits, notes, pipelines, or discussions in a single call, so your AI agent no longer has to chain multiple requests to get the full picture of an MR. You can also use the new list_merge_requests tool to search and filter merge requests by author, assignee, reviewer, state, labels, or free-text query, making it easy to find exactly the MRs you care about without leaving your workflow. Pre-register MCP OAuth applications Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, the mcp scope was hidden from the OAuth applications form in the Admin area, so you couldn’t pre-register an OAuth application for your MCP clients without using Dynamic Client Registration (DCR). Now you can create a shared OAuth application with the mcp scope directly from the Admin area, giving your users a stable client ID to reuse and helping you avoid DCR rate limits on shared networks. See which user authorized each MCP OAuth application Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, when MCP clients connected to GitLab using OAuth Dynamic Client Registration (DCR), all dynamically-registered OAuth applications appeared in the Admin Area with only a generic client name, making it impossible to tell which user authorized a given application. Now, when you approve an MCP OAuth connection, your username is automatically appended to the application name — for example, [Unverified Dynamic Application] kiro — authorized by @username. You can quickly identify which user is behind each dynamic OAuth application directly from the Admin Area, without any additional configuration. View agent task plan in session detail sidebar Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, when you opened a session detail page, you had to manually expand individual activity log entries to find the agent’s current task list. Now, the session detail sidebar shows the agent’s latest plan automatically. You can view each task and its status, and a progress summary like “2 of 5 completed.” You can track what the agent is working on and how far along it is without digging through the activity log. Devstral 2 deprecated for GitLab Duo Agent Platform Self-Hosted Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Mistral has deprecated the Devstral 2 model, and GitLab has deprecated Devstral 2 for GitLab Duo Agent Platform Self-Hosted. Mistral Medium 3.5 is a supported alternative available from Mistral. Support for Amazon Bedrock Mantle (Beta) Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue If you use GitLab Self-Managed with self-hosted models, you can now use Amazon Bedrock Mantle as a supported provider. Mantle is an OpenAI-compatible inference engine for Amazon Bedrock, so you can use familiar OpenAI SDKs and integrations with Bedrock models. This feature is in beta. Unified DevOps and Security Enforce merge trains Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, you couldn’t stop merges from bypassing the train. Both the option to merge immediately and the REST API could skip merge train protections without restriction. For teams running high-velocity monorepos, a single merge that skips the train can cancel and restart every in-progress pipeline, multiplying CI costs and straining infrastructure. Now you can enforce merge train usage across the UI and API with a single project-level setting, preventing bypasses that cancel and restart in-progress pipelines. Owners and Administrators can still override the setting when needed. GitLab Secret Scanning for Source Code (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue GitLab Secret Scanning for Source Code is now in beta, powered by a new GitLab-built scan engine. Unlike the default analyzer, which detects only known secret patterns, this analyzer also detects passwords and other unstructured secrets that fall outside standard ruleset coverage. It also uses multiple heuristic techniques to reduce false positives. The new analyzer replaces the default analyzer in the same secret_detection job, matching existing vulnerability findings instead of creating duplicates. To get started, see turn on the analyzer. During beta, only high-confidence findings are reported. We welcome any feedback you have in issue 609578. Secret detection scans commit history on default branch pushes Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Secret detection on the default branch now scans all commit diffs in a push when a prior commit reference is available, rather than scanning only the latest directory contents. This change closes a gap where secrets introduced and removed within the same push went undetected. The behavior now aligns with how secret detection works on merge requests and feature branches. This scanning catches secrets that briefly existed in your repository history even if removed before the pipeline completes. Security teams can now identify secrets that were ever committed, not just those present at HEAD. For more information, see pipeline secret detection coverage. Disable OAuth Dynamic Client Registration for MCP Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, MCP clients and AI tools could automatically register OAuth applications on your instance through Dynamic Client Registration (DCR), which you couldn’t turn off. This made it difficult for administrators on GitLab Self-Managed and GitLab Dedicated instances to control which OAuth clients could connect. Now you can disable DCR entirely using the application settings API, giving you full control over which OAuth clients can access your instance. When DCR is disabled, clients must use a pre-registered OAuth application instead of registering automatically. SPDX license expressions in CycloneDX SBOMs brought to GitLab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab 19.3 adds support for Software Package Data Exchange (SPDX) license expressions in CycloneDX Software Bill of Materials (SBOM) files you bring to GitLab. Previously, components with composite or custom licenses defined using SPDX expression syntax would appear as unknown. Now GitLab reads and stores the expression field from CycloneDX license entries, including complex expressions like MIT AND Apache-2.0 and custom license references using the LicenseRef-[NAME] syntax. SPDX expression support is especially useful for organizations that generate their own SBOMs and have components with complex or custom license expressions, giving you an accurate view of your license exposure without requiring GitLab-generated scans. For more information, see Bring your own CycloneDX SBOM. Audit events for secret push protection fail-open scenarios Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In earlier versions of GitLab, when secret push protection couldn’t complete a scan and allowed a push through unscanned, GitLab provided no customer-visible audit trail. Security and compliance teams had no way to monitor when secret push protection silently allowed a push to their repositories. GitLab 19.3 and later generates audit events for all fail-open scenarios, including ruleset errors, exceeded file and line limits, scan timeouts, and unexpected errors. Teams can now forward these events to external monitoring and alerting tools to maintain visibility into their security posture. Dependency scanning support for Bun Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, projects using the Bun JavaScript runtime and package manager had no dependency scanning coverage. Now, GitLab dependency scanning analyzes Bun projects by parsing bun.lock files (the text-based JSONC format introduced in Bun 1.2). Because Bun packages are sourced from the npm registry, the GitLab advisory database already covers these dependencies with no additional configuration required. Teams using Bun as an alternative to npm, yarn, or pnpm can now scan their projects for known vulnerabilities as part of their standard CI/CD pipelines. Eligible findings are also supported by dependency scanning auto-remediation. Execute SAST false positive and vulnerability resolution flows in bulk Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In the Vulnerability Report, you can now select multiple vulnerabilities and run SAST Vulnerability Resolution and SAST False Positive Analysis flows on all of them at once. GitLab Runner 19.3 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.3 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Document Job Router version compatibility matrix Verify Workhorse is in the KAS to Rails request path for Job Router Bug Fixes clear-docker-cache prunes all unused images when IMAGE_FILTER_FLAGS is empty Concrete-mode dispatch skips steps where When is unset PrintPodWarningEvents doesn’t work Custom executor fails when the .git folder is corrupt The list of all changes is in the GitLab Runner CHANGELOG. Kubernetes 1.36 support Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab now fully supports Kubernetes version 1.36. To deploy your applications to Kubernetes and access all features, upgrade your connected clusters to the most recent version. For more information, see supported Kubernetes versions for GitLab features. Redesigned vulnerability details page Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The vulnerability details page has been refreshed with an updated design that makes reviewing and triaging vulnerabilities easier and more efficient. SAST triage and remediation funnel Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The Security Dashboard now includes a SAST triage and remediation funnel. This funnel shows how critical and high SAST vulnerabilities move through triage and remediation over a 30-, 60-, or 90-day window. The funnel traces each stage: detected vulnerabilities, true positives confirmed by SAST false positive detection, vulnerabilities with merge requests created by Agentic SAST Vulnerability Resolution, and vulnerabilities fixed by merged merge requests. These stages show how much of your workflow AI powers and which stages you can scale further. Scale and Deployments PostgreSQL 18.4 option available for fresh installs using the Linux package Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue You can now opt-in to using PostgreSQL 18.4 when performing a fresh install using the Linux packages. Upgrades to PostgreSQL 18.4 for existing installations is not yet supported. For more information, refer to the relevant documentation. Restricted visibility for custom agents and flows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now set custom agents and custom flows to Restricted visibility for every group, subgroup, and project in your top-level group. Previously, you could only set a custom flow or agent to Private (one project only) or Public (visible to everyone on GitLab.com). When you set the visibility to Restricted, the flow or agent is visible to only groups, subgroup, and projects in your top-level group. This ensures that internal logic about your custom agents and flows are not shared outside your company or organization. Advanced SAST for iOS in beta Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Advanced SAST now supports Objective-C and Swift, bringing the same interprocedural taint analysis it delivers for other languages to iOS development. The beta is available for all GitLab Ultimate customers starting in GitLab 19.3. The beta detects key OWASP Mobile Top 10 vulnerability classes, including insecure data storage, broken cryptography, insecure communication, and authentication and authorization flaws. When a vulnerability begins in one language and reaches a sink in the other, Advanced SAST detects the complete taint path, including paths that cross the Swift and Objective-C language boundary. To enable, set GITLAB_ADVANCED_SAST_ENABLED: 'true' in your pipeline. If your project contains Objective-C or Swift files, the gitlab-advanced-sast-ext job runs automatically. For full setup instructions, see the Advanced SAST documentation. Share feedback in the beta feedback issue. Email notifications for GitLab Flex usage Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had no warning when your Flex usage approached a limit. GitLab now sends billing account managers an email notification when a product reaches 50%, 80%, or 100% of its monthly reservation, and when a capped product reaches its spend cap and is cut off for the rest of the billing period. Each threshold triggers at most one email per product per billing period, so you can act on overage early without getting repeat emails for the same threshold. GitLab Credits usage caps are generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue On-demand usage can run up overage charges you didn’t plan for. Usage caps for GitLab Credits are now generally available: set a subscription-level cap on on-demand credits in Customers Portal, and set a default per-user cap or per-user overrides with the GraphQL API. When consumption reaches a cap, features that consume GitLab Credits, like GitLab Duo Agent Platform, are suspended until the next billing period begins or an administrator adjusts the cap. Usage caps were introduced in GitLab 18.11 behind the budget_caps_graphql_api feature flag. In GitLab 19.3, the feature flag is removed. Per-capability spend caps for GitLab Flex Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue With GitLab Flex, overage from one capability draws down the same commitment every other capability depends on. You can now set a spend cap for each capability when you adjust your Flex reservation in the Customers Portal: Restricted (no overage past the reservation), Usage cap (a bounded amount of overage), or Unlimited (unlimited overage past the reservation). When a capped capability reaches its cap, its usage stops for the rest of the billing period, and capabilities without a cap keep running. Co-created contributions Branch names can carry the name of whoever created the branch Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can include the creator in branch name templates with a new %{branch_creator} variable, so a branch created from an issue can identify who created it rather than falling back to a generic name. Thank you to Radek Antoniuk for this contribution! LDAP group sync can now manage the Auditor role Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue You can now use LDAP group sync for GitLab Self-Managed instances to grant and revoke the Auditor role automatically. A new audit_group setting maps an LDAP group to Auditor, working the same way admin_group already did for administrators, so auditor access follows directory membership instead of being maintained by hand. Thank you to Sergey Pechenko for this contribution! More ways to filter and manage through the API Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Six improvements are now available across the REST and GraphQL APIs: Groups queries accept visibilityLevel and includeSubgroups, and can filter for groups scheduled for deletion with aimed_for_deletion. The merge requests REST API accepts merged_after and merged_before. Achievement award messages can be edited after being granted, rather than only set at award time. Administrators can reset SCIM tokens through the admin token API. CI_JOB_TOKEN can now fetch repository archives, which unblocks private Composer package downloads that broke when source fallback was deprecated. Thank you to the following users for these contributions! Colin Jacob Boby (MR) nagraj raikar (MR 1 MR 2) Niklas van Schrick (MR) Nicholas Wittstruck (MR) Alessandro Lai (MR) Other additions to the interface Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Improvements to the interface in this release include: You can press Esc to cancel a list item drag in an issue, work item, or epic description, instead of being stuck completing the move. Pipeline test report summary columns are now sortable, defaulting to most failures first. And archived labels say Archived in their tooltip, so you can tell at a glance why one looks different. Thank you to the following users for these contributions! Radek Antoniuk Saurav Kumar Nicholas Wittstruck Two new CI/CD variables: retry count and job tags Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Your pipeline scripts can now tell whether they are running for the first time. CI_JOB_RETRY_COUNT holds how many times the current job has been retried and is 0 on the first run, so retry-aware logic no longer needs you to track state yourself. Separately, CI_JOB_TAGS exposes the job’s own configured tags, where previously only the runner’s tags were visible through CI_RUNNER_TAGS. Both are available with no configuration. Thank you to Giannis Kepas and Dwight Blake for these contributions! Webhooks for merge request reviews and deployment approvals Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can use webhooks for merge request reviews and deployment approvals. When you submit a merge request review as Request changes or Reviewed, GitLab fires a merge_request webhook carrying a changes.reviewers entry, so external tools can react to review activity instead of just approvals. The deployment webhook gains blocked, approved, and rejected statuses with top-level approver and approval fields, letting you follow a deployment through its full approval lifecycle. The blocked status is available in all tiers. The approved and rejected statuses are available in Premium and Ultimate only, and approver.email is redacted. Thank you to Messias Tayllan (MR) and Anvita Gupta (MR) for these contributions!

GitLab 19.2 release notes

On July 16, 2026, GitLab 19.2 was released with the following features. We are excited to recognize vivekshukl007 as this month’s Notable Contributor! Vivek is a Senior Data Engineer at Emirates who made a high-impact contribution to add Scala language support to GitLab Orbit. This change improves the code graph capabilities for developers who work in Scala codebases. Primary features GitLab Duo CLI is now generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI brings the GitLab Duo Agent Platform directly to your terminal. Use the CLI to ask complex questions about your codebase and to autonomously perform actions on your behalf. Unlike external tools, the CLI has context about your GitLab project, pipelines, and agent configurations. Key features include: Two modes: interactive chat mode and headless mode for CI/CD Administrator on/off control for GitLab Self-Managed and GitLab Dedicated Model selection and shared sessions Tool approvals Model Context Protocol (MCP) connections Slash commands, including commands for context usage and context compaction Support for skills and AGENTS.md customization files Install the GitLab Duo CLI through the GitLab CLI (glab) or as a standalone tool. GitLab Duo custom flows are now generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Custom flows are AI-powered workflows you create and configure to automate complex, multi-step tasks across your GitLab projects. They let teams define workflow steps, components, and triggers so repetitive development and operational work can run automatically in response to GitLab events. In the GitLab UI, flows run directly in GitLab CI/CD, helping teams automate common tasks without leaving GitLab. Key features include: YAML-defined, reusable workflows for team-specific automation Multi-agent orchestration for complex, multi-step tasks User-defined human-in-the-loop (HITL) checkpoints for approval or feedback at sensitive steps Native GitLab triggers, including mentions, assignments, pipeline events, and merge request lifecycle events Flow creation and management from projects or the AI Catalog Public and private visibility controls Secure execution using service accounts and composite identity YAML validation to catch configuration issues before runtime Scheduled pipeline execution policies are GA Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Scheduled pipeline execution policies are now generally available. Define a schedule once in a security policy project and enforce it across every project in scope, without editing each project’s .gitlab-ci.yml. If requirements change, update the policy in one place instead of coordinating changes across many CI/CD configuration files. Use scheduled policies to run compliance scripts, security scans, or other custom CI/CD jobs on a daily, weekly, or monthly cadence, independent of commit activity. This is useful for repositories without regular code changes, such as running dependency scans to detect newly discovered vulnerabilities. Each policy runs as a separate pipeline, with time zone support, time window distribution, and branch targeting. Start foundational flows from Agentic Chat Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you started foundational flows from specific UI actions, mentions, or assignments. Now you can start them from Agentic Chat in the GitLab UI as part of your conversation. When your request matches a specialist workflow, Agentic Chat hands off to one of these flows: Developer Flow: Implements changes or opens a merge request Code Review Flow: Reviews a merge request Fix CI/CD Pipeline Flow: Diagnoses and repairs a failed pipeline You approve the handoff in chat, then follow progress in the conversation or from AI > Sessions. Dependency scanning auto-remediation (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab 19.2 introduces Dependency scanning auto-remediation in Beta. The feature brings automated vulnerability remediation directly into your dependency scanning workflow, with two capabilities: Automated dependency version bumps, available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Agentic Breaking Change Resolution, available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated, and consumes GitLab Credits. Automated dependency version bumps automatically opens merge requests to update vulnerable dependencies to their safe versions. Once turned on, GitLab monitors your projects for vulnerable dependencies and opens remediation MRs without manual intervention. By default, updates target patch and minor versions. Agentic Breaking Change Resolution extends the remediation flow to handle complex updates. When a merge request that bumps dependency versions has a pipeline fails on a breaking change, GitLab Duo analyzes the pipeline errors, the dependency’s changelog, and how your code uses the dependency. GitLab Duo commits fixes to the same MR and re-runs the pipeline until the pipeline passes. When you enable Agentic Breaking Change Resolution, version bumps extend to include major versions. Together, the two capabilities form a complete remediation loop: GitLab opens the MR, and when the update is complex, GitLab Duo resolves it. For setup instructions, see Dependency scanning auto-remediation. Share feedback in the beta feedback issue. Non default branch tracking (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now track vulnerabilities on branches other than the default branch. For the best results, target a small number of long-lived release branches, such as branches for specific environments (project-qa, project-prod) or deployment platforms (project-iOS, project-android). This beta includes the following capabilities: Add tracked branches on the security configuration page, up to twice the number of projects in the namespace. Filter by branch on the vulnerability report. Filter by branch on the project-level security dashboard. Track all vulnerability types on tracked branches, including CVEs, which were previously out of scope. Keep vulnerability status metadata consistent when a branch merges into the default branch. Update vulnerability status on tracked branches. Selective GitLab Duo availability for subgroups Tier: Ultimate Offering: GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Administrators of GitLab Dedicated instances can make GitLab Duo and GitLab Duo Agent Platform unavailable for selected subgroups while other subgroups still have the option to turn them on. Previously, you could either disable GitLab Duo and Agent Platform for an entire instance, or make them potentially available for all. Now you can enforce a default-deny, per-subgroup allowlist. Mark specific subgroups as Always off (locked) so their descendant groups and projects can never enable GitLab Duo and Agent Platform, while leaving other subgroups up to the discretion of users with the Owner role. Only administrators can apply or remove the lock, and affected Owners see clear messaging that GitLab Duo is locked by a parent group. This feature helps compliance and platform governance teams meet strict data-classification requirements. AI audit event report (beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue AI audit event reports are now available in beta, giving security and compliance teams a unified, downloadable record of GitLab Duo agent activity. Previously, agent activity was scattered across pipeline jobs and event histories, making it difficult to reconstruct a session for: Incident investigation. Compliance review. AI governance reporting. Now, each agent session produces a comprehensive audit artifact capturing: Inputs. Model and configuration context. The chronological event timeline. Outputs. You can browse AI audit events from the Governance page, filter by agent and session details, drill into individual events, and download the underlying session artifact. Security Review Flow (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Security Review Flow detects business logic vulnerabilities directly in merge requests. Unlike static analysis tools that scan for known patterns, Security Review Flow reasons about the intent of your code and identifies authorization bypasses, data exposure, and logic errors that pattern-based scanners routinely miss. To request a review, assign the Duo Security Review service account as a reviewer on your merge request. The flow analyzes the diff and posts findings as threaded comments at the exact lines where vulnerabilities occur, each with a Common Weakness Enumeration (CWE) classification, severity rating, and where possible, an inline suggested fix you can apply without leaving the merge request. Each review consumes GitLab Credits based on the complexity of the merge request diff. Agentic Core Bulk AI Catalog items enablement Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue When enabling public custom and external agents and public custom flows in the AI Catalog, you can now select up to 100 projects in a single action, instead of selecting individual projects one at a time. Configure ID tokens in flows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Use ID tokens to authenticate with third-party OpenID Connect (OIDC) services without storing long-lived credentials. For example, use ID tokens for keyless signing of binaries and commits, or to retrieve secrets from a secrets manager. To use this feature, update your agent configuration to include the id_tokens keyword, then configure the service to trust tokens issued by GitLab Duo Agent Platform. Custom Agent validation Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, you could save a custom agent in AI Catalog whose prompt would fail when run. For example, prompts that tripped security rules caused the agent to silently do nothing when being used. Now, when you create or update a custom agent, GitLab validates the prompt configuration, and tells you about any errors before you save that agent. Turn on MCP server independently from the Agent Platform Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue To give you finer control over how external tools connect to your GitLab instance or group, you can now turn the GitLab MCP server on or off independently from Agent Platform settings. Previously, the GitLab MCP server and Agent Platform shared the same on and off setting, so you could not turn the MCP server on without also turning on Agent Platform features. Now you can let other tools access GitLab as an MCP server without turning on the Agent Platform, or keep the GitLab MCP server turned off while you use Agent Platform features. Automatic rebase before merge Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, if your project used the semi-linear or fast-forward merge method, you had to complete an additional step when the source branch fell behind the target branch. To merge, you had to select Rebase, wait for it to complete, then return to the merge request to select Merge. That two-step handoff added friction to every merge. You can now select Enable automatic rebase prior to merge in your project’s merge request settings. When the setting is on, GitLab rebases the source branch onto the target branch at merge time and you can merge with a single action. If it’s important to preserve GPG signatures on individual commits, you can leave the setting off. Code Review Flow for GitLab Duo Enterprise seats Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, when users with GitLab Duo Enterprise seats requested a code review from GitLab Duo, GitLab Duo Code Review would complete the review. This would occur even if Code Review Flow was turned on for the group. There was no way to turn on the agentic flow for all users. Now, top-level group Owners can change this default and configure all code reviews to use Code Review Flow instead, regardless of the user’s seat. All reviews will consume GitLab Credits. This change gives users with GitLab Duo Enterprise seats the same repository-wide context awareness, multi-step reasoning, and review sessions as everyone else. Exclude merge requests from automatic code reviews (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, when automatic reviews were turned on for a project or group, GitLab Duo reviewed every eligible merge request. This included bot-authored dependency updates, feature branches, and experimental work, not just changes the team actually wanted feedback on. You can now exclude specific merge requests from automatic reviews using exclusion rules. Define a .gitlab/duo/mr-review-automated-rules.yaml file for a project or group, with exclusion rules based on the author, source branch, or target branch. Rules support glob patterns like dependabot/* or *-bot. You can still request a review manually for any excluded merge request. This feature is in beta and is gated behind the duo_code_review_automated_rules feature flag, enabled by default. GitLab MCP server is now available for Free users Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use the GitLab MCP server without a paid subscription, making it easier than ever to connect your AI tools and agents to GitLab regardless of your plan. This means you get seamless, AI-powered automation and integration capabilities right out of the box, with no subscription upgrade required. Instance-level custom review instructions Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you could only define custom review instructions for GitLab Duo at the project or group level. Administrators who wanted consistent review guidance across an entire instance, such as security rules or internal coding standards, had to duplicate the same instructions in every project. Now you can configure custom review instructions for an entire instance. As an administrator, select a project in your instance to use as a template. When GitLab Duo performs a code review, it combines the instructions from the instance-level .gitlab/duo/mr-review-instructions.yaml file with any group-level and project-level instructions. This gives organizations a single source of truth for instance-wide review standards. Both Code Review Flow and GitLab Duo Code Review support instance-level custom instructions. Resolve review discussions with GitLab Duo (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, to resolve a code review comment, you had to switch to your editor, implement the fix, commit and push the change, and then manually close the thread. You had to repeat the cycle for every unresolved discussion, and the context-switch overhead would add up across a busy review. You can now select Resolve with GitLab Duo on any review discussion. GitLab Duo reads the review comment and the code around it, implements the change the reviewer described, and commits it to your branch. GitLab Duo then replies to the discussion with a short summary of what changed and why, and resolves the thread for you. You can review the changes and reopen the thread if the fix doesn’t address the comment correctly. Usage billing checks for GitLab Duo Agent Platform Self-Hosted Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated for Government Links: Documentation · Related Issue For GitLab Self-Managed customers using self-hosted models with an online license, the GitLab Duo Health now checks that the GitLab instance can reach the following endpoints: Customers Portal The AI Gateway Duo Workflow Service Connection to these endpoints is necessary for usage billing. Previously, if a firewall blocked any of these components, administrators had no indication of connectivity issues until users were unable to use a feature. Administrators can now use this new validation check to diagnose issues and review their firewall allowlist before any disruption to users. Unified DevOps and Security CI Expert Agent is now generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The CI Expert Agent is now generally available. This AI-powered assistant helps you create, debug, and optimize GitLab CI/CD pipelines. It analyzes your repository and provides guidance through your pipeline configuration. The generally available (GA) release builds on the Beta and design-partner program, and brings the agent to production use with real customer workloads to reduce the barrier to CI/CD adoption in your projects. The agent integrates with Orbit: when Orbit and its Knowledge Graph are enabled, the agent draws on graph-based code intelligence for more contextual pipeline recommendations. Orbit and the Knowledge Graph are in Beta. Fix CI/CD Pipeline Flow suggests targeted fixes Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab Duo’s Fix CI/CD Pipeline Flow now gives you two core improvements: When relevant files are already in your merge request diff, you get fixes as code suggestions directly on that merge request. The flow classifies pipeline failures before acting, so you get a more targeted diagnosis. The flow also analyzes child pipeline failures across the full pipeline hierarchy, lets you customize its behavior for your project with an AGENTS.md file, and collapses AI reasoning by default to keep your merge request comments clean. Share your feedback in the feedback issue. Disable built-in project templates Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When organizations rely on custom project templates, built-in vendor templates can add noise to the template selection experience and, in some cases, bypass server-side hooks or other repository controls. Administrators can now disable built-in project templates globally from the Admin area, or at the group level for subgroups. The setting cascades automatically so you do not need to configure it for every group individually. Administrators can enforce the value of the setting to ensure groups or subgroups cannot override it. Both the instance and group settings are also manageable with the REST and GraphQL APIs. On GitLab.com, only the group-level setting is available. Fine-grained PAT permissions generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Fine-grained personal access tokens (PATs) are now generally available. Unlike legacy PATs, which grant access to every project and group you belong to, fine-grained PATs allow you to limit each token to specific resources and actions. This makes it easier to apply the principle of least privilege to automation and integrations, which helps reduce the potential impact of a leaked or compromised token. To make setup easier, use the Add permissions with Duo feature to choose the correct permissions during token creation. Your existing legacy PATs continue to work as before. For new tokens, GitLab recommends fine-grained PATs so each token is scoped only to the resources and actions it needs. With the GA release, fine-grained PATs now have complete coverage for REST API endpoints, and coverage for the most commonly used GraphQL types and mutations. GitLab Flavored Markdown references in personal snippets Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now use GitLab Flavored Markdown (GFM) references with personal snippets in two ways: GitLab processes GFM references inside personal snippet descriptions and comments, just like in project snippets and other areas of GitLab. You can reference a personal snippet from anywhere GFM is supported, such as comments and issue or merge request descriptions, using the $ syntax that already works for project snippets. Because snippet IDs are unique across personal and project snippets, each ID resolves to a single snippet. Recognize contributors with GitLab Achievements Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously GitLab had no built-in way to formally recognize team members, customers, and contributors for their work. Efforts often went unacknowledged, and communities lacked a consistent way to celebrate the people who make their projects successful. You can now create custom achievements at the group level and award them to users for their contributions. Each achievement includes a name, description, and avatar. Awarded users can choose which achievements to display on their profile. Achievements give maintainers a visible way to reward participation and help build stronger, more motivated communities. Thank you to Niklas van Schrick for your contributions to this feature! Security manager can configure agentic flows Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Users with the Security Manager role can now configure SAST VR, SAST FP, Secrets FP, and Dependency Scanning VR for projects. GitLab Runner 19.2 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.2 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New GitLab Runner now emits the environment key during the job-complete PUT request GitLab Runner now includes a circuit breaker that automatically falls back to Rails when KAS job requests fail consecutively Bug Fixes Secret resolution failures are misclassified as runner_system_failure Jobs fail with context deadline exceeded when you update GitLab Runner to 19.1.0 Jobs fail intermittently with context deadline exceeded in the Docker executor Artifact downloads fail when FF_CONCRETE is enabled KAS Job Router GetJob latency histogram doesn’t show any data in staging Automatic runner token rotation causes Docker Autoscaler executor to prune active instances and fail running jobs The list of all changes is in the GitLab Runner CHANGELOG. Scale and Deployments GitLab Duo reads and responds to reviews in merge requests Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now use GitLab Duo and MCP-based agents to read merge request review conversations. This gives your AI assistant the full context of reviewer feedback, unresolved threads, and discussion history. You can ask your agent to summarize review comments, draft responses to feedback, and post replies directly to merge request discussions without ever leaving your workflow. Hosted runners for GitLab Dedicated are generally available Tier: Ultimate Offering: GitLab Dedicated Links: Documentation · Related Issue Hosted runners for GitLab Dedicated are now generally available. GitLab provisions, patches, and scales runners for you, within the same security and compliance boundary as your GitLab Dedicated instance. Key capabilities include: AWS EC2 instances in the same region as your GitLab Dedicated instance, running in single-tenant, ephemeral VMs destroyed after each job Secure outbound PrivateLink connection to your GitLab instance Linux x86-64 and Arm64 runners in five sizes, from small to 2X-large 99.9% uptime SLA, calculated separately from your GitLab Dedicated instance SLA, to ensure your workflows remain stable, resilient, and online You create and manage hosted runners yourself in Switchboard, and pay only for what you use, with usage tracked on the GitLab Credits dashboard. To get started, contact your customer success manager or account representative. AI Gateway for GitLab Dedicated Tier: Ultimate Offering: GitLab Dedicated Links: Documentation · Related Issue The AI Gateway for GitLab Dedicated runs in your AWS environment, in the same region as your GitLab Dedicated instance. Inference requests, including code inputs, prompts, and model responses, stay within your network and region. All GitLab Duo Agent Platform inference requests stay in the same audit scope as your GitLab Dedicated instance. The AI Gateway for GitLab Dedicated is enabled by default, with no setup required. Optionally, you can use Bring Your Own Model (BYOM) to connect to your own cloud-hosted models. You can power GitLab Duo Agent Platform capabilities with the models you choose, in your region, under your access controls.

GitLab 19.1 release notes

On June 18, 2026, GitLab 19.1 was released with the following features. We’d also like to announce this month’s Notable Contributor: Pishel65! We are excited to recognize Pishel65, a Level 3 contributor with 19 merged MRs and 9 more open since joining in October 2025. Primary features Secret false positive detection with GitLab Duo Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Secret false positive detection with the GitLab Duo Agent Platform is now generally available. Security teams spend significant time investigating secret detection findings that are incorrectly flagged as actual secrets. These false positives create alert fatigue, erode trust in scan results, and divert attention from genuine security risks. When a security scan runs, GitLab Duo automatically analyzes each critical and high severity secret detection vulnerability to determine if it is a false positive. The AI assessment appears in the vulnerability report, so you have immediate context for faster and more confident triage decisions. Key features include: Automatic analysis: Runs after each security scan without manual trigger. Manual trigger: Trigger false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Analyze only critical and high severity vulnerabilities to maximize signal-to-noise improvement. Contextual AI reasoning: Each assessment includes an explanation of why the finding is likely a true positive, based on code context and vulnerability characteristics. Confidence scoring: Each detection includes a confidence score to help teams prioritize review based on the model’s certainty. Seamless workflow integration: Results appear directly in the vulnerability report alongside existing severity, status, and remediation information. We welcome your feedback in issue 592861. Always on availability mode for GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Administrators can now set GitLab Duo to be always on for all projects in an entire instance or top-level group. When GitLab Duo is set to always on, group, subgroup, and project owners cannot turn off GitLab Duo, giving enterprises centralized AI governance for compliance and regulated environments. This new setting is symmetrical to the existing always off setting, closing a gap where GitLab Duo could be locked off but could not be locked on. This new setting is especially valuable for organizations with autonomous divisions or subsidiaries that need to guarantee consistent AI tooling across the business. To set GitLab Duo to be always on, go the instance or top-level group GitLab Duo settings and set GitLab Duo availability to Always on. Automatically assign Code Owners as reviewers Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, you needed to select reviewers for each merge request manually, even when a CODEOWNERS file already defined who should review each file. You can now configure a project to assign Code Owners as reviewers automatically. GitLab assigns every Code Owner that matches the changed files. This happens when a merge request is created in a ready state, or when a draft is marked ready. If you already assigned a reviewer, GitLab skips automatic assignment and keeps your choice. To turn on automatic reviewer assignment, go to Settings > Merge requests > Automatic reviewer assignment and select Automatically assign all code owners as reviewers. Compliance framework templates (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now create compliance frameworks from predefined templates. Previously, building a compliance framework required defining every requirement and control by hand, a repetitive process when a framework had dozens of controls. Now, when you create a new framework in the Compliance center, you can: Select Create from template to start from a preconfigured framework with requirements and controls already in place. Preview each template, customize the name, description, and color, and then apply it to your group in a single step. 19 templates are available, including ISO 27001:2022, SOC 2, FedRAMP, NIST, CIS, TISAX, and more. Improved secret detection coverage for feature branch pipelines Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In GitLab versions earlier than 19.1, you couldn’t trust a feature branch pipeline to surface every secret in your branch. A new branch scanned only the latest commit. An existing branch scanned only your most recent push. A credential leaked in an earlier commit could sit undetected, reaching shared branches or production before being flagged. Now you can catch those secrets where they’re cheapest to fix. In GitLab 19.1, secret detection scans every commit from the branch’s divergence point with the default branch to the latest commit. That means fewer secrets slip through to later stages, less time rotating exposed credentials after the fact, and consistent, predictable coverage across your branches. Tool approval guardrails for GitLab Duo agents (beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Administrators can now configure tool-level approval policies for GitLab Duo agents, gating sensitive actions with human approval at the moment of execution. Previously, after an AI agent was approved for a project, it could invoke any of its tools without further review, including write and destructive operations. Now, you can define rules for groups and projects that map each tool to one of three modes: Allow (execute silently). Ask (require human approval). Deny (block entirely). When an AI agent calls a tool in “ask” mode, the user is prompted with an inline approval card before execution proceeds. This beta release includes Agentic Chat, IDE, and flows, and emits audit events for every approval decision. Agentic Core Custom and external AI feature controls Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators and top-level group Owners can now control which AI agents and flows are available within their organization. They can: Prevent users from creating or enabling custom agents and flows. This ensures only centrally-approved AI automation is in use. Restrict users from enabling agents and flows owned by projects outside the group hierarchy. This limits exposure to unapproved external content. Custom flows YAML validation Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The AI Catalog now validates your custom flow configuration before saving or triggering it. Previously, syntax errors and misconfigured parameters in a custom flow (for example, missing inputs or unknown tool parameters) only surfaced at runtime, after a CI job had already started. This made debugging slow and difficult. Now, when you save or update a custom flow in the AI Catalog, GitLab checks the configuration upfront and surfaces any errors directly in the UI. Valid flows are unaffected and continue to save and trigger as usual. Pattern-based tool approval for Agentic Chat Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue This feature was removed on July 10, 2026. Previously, when Agentic Chat asked you to approve a tool invocation, you could approve it once or approve the tool call with these arguments for the remainder of the session. Different arguments would require additional approval. Workflows that repeated similar commands, such as a series of git operations, forced you through a stream of nearly identical prompts. You can now choose a third approval option, Approve all uses of this tool for session. This option approves invocations of the tool for the remainder of the session whenever the arguments match the approved pattern. Pattern-based approvals are available for Agentic Chat in the GitLab UI, GitLab Duo CLI, GitLab for VS Code, and the GitLab Duo plugin for JetBrains IDEs. Automatic code review for new GitLab customers Tier: Free, Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue Automatic reviews in Code Review Flow are now turned on by default for new GitLab Duo trial customers on GitLab.com, so you can start getting AI-powered feedback on your merge requests from day one — without any manual setup. With a new flat pricing model, you get immediate value from smarter, faster code reviews right out of the box. If needed, you can opt out in your group settings. Foundational flows readiness checks Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab Duo health checks now include foundational flows readiness checks, which verify: The instance-level flow execution setting is enabled. The instance-level foundational flows setting is enabled. At least one active instance runner with the gitlab--duo tag is registered and connected, and uses a Docker-compatible executor. GPT models for Code Review Flow Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, Code Review Flow supported only Anthropic Claude models. Teams that could not use Anthropic models due to contractual, policy, or procurement constraints had no way to run Code Review Flow. You can now select GPT-5.2 or GPT-5.3 Codex as the model for Code Review Flow. Top-level group Owners can switch the model for Agentic Code Review in Settings > GitLab Duo > Configure features, under GitLab Duo Agent Platform. The GPT models are hosted through the GitLab AI Gateway, so no additional configuration is required. Both models passed benchmark evaluation against the GitLab Duo code review dataset, with review quality comparable to the default Claude Sonnet 4.6 Vertex model. See the code review benchmark for results. Model selection allowlist Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue For GitLab Duo Agentic Chat, you can now configure an allowlist of approved models, and set an organization-wide default, if you are: On GitLab.com, a top-level group Owner. On GitLab Self-Managed, an instance administrator. This gives organizations control over which models users can select when using Agentic Chat. New event triggers for flows and external agents Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you could only run flows and external agents when the service account was mentioned, assigned, or added as a reviewer. Coordinating automation around the rest of the merge request lifecycle, or around work item creation, required external glue. You can now configure triggers for four additional events: Merge request ready: A user marks a draft merge request as ready for review. Previously released behind a feature flag, this event trigger is now generally available. Merge request code conflict: A merge request can no longer be merged because of a code conflict. Merge request approved: A merge request receives all its required approvals. Work item created: A user creates a work item in the project. To configure a trigger, go to AI > Triggers in your project, or select one when you enable a flow. Unified DevOps and Security Close coverage gaps with the Scanner Enablement Wizard Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use the Scanner Enablement Wizard to close scanner coverage gaps across your projects without manually identifying which projects need attention. Security configuration profiles define which scanners run and how. Security inventory shows scanner coverage across your projects and lets you bulk-apply profiles to selected projects or subgroups. The wizard adds a goal-driven workflow on top: you set the goal, and it finds the projects missing coverage and closes only those gaps. Custom lifetime for OAuth access tokens Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue By default, OAuth access tokens in GitLab expire after two hours. In GitLab 19.1, instance administrators on GitLab Self-Managed and GitLab Dedicated can set a custom lifetime for new OAuth access tokens. You can configure any value from 300 to 7200 seconds. This helps you enforce shorter-lived tokens for security-sensitive OAuth integrations, including MCP clients, without changing the behavior of existing tokens. Emoji reactions on wiki pages Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now add emoji reactions directly to wiki pages in both project and group wikis. Use the GitLab emoji picker to react to page content. Each page shows reaction counts and who reacted. Reactions persist across page edits and versions. Scheduled pipeline execution policies (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Scheduled pipeline execution policies are now available as a beta feature and no longer require an experiment flag to enable. You can enforce custom CI/CD jobs on a daily, weekly, or monthly cadence across your projects, independent of commit activity. Use scheduled policies to run compliance scripts, security scans, or dependency checks on repositories that may not have regular code changes. Scheduled policies now enforce variable precedence consistently with regular pipeline execution policies. Each security policy project supports up to five scheduled policies, and GitLab automatically cancels running pipelines when a policy is disabled or deleted. Configure schedules in YAML or the UI, with time zone support, time window distribution, branch targeting, and snooze functionality. Security Manager role generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The Security Manager role is now generally available, providing comprehensive access to security features including vulnerability management, security dashboards, policy configuration, and compliance tools. Security teams no longer need the Developer role or the Maintainer role to access security features, eliminating over-privileging concerns while maintaining separation of duties. Users with the Security Manager role have the following access: Vulnerability management: View, triage, and manage vulnerabilities across groups and projects. Security policies: View and manage security policies at the group level, and contribute to policy YAML at the project level. Security inventory: View scanner coverage across all projects in a group. Security configuration profiles: View security configuration profiles for groups and projects. Compliance tools: View and manage audit events, compliance center, compliance frameworks, compliance status reports, and dependency lists at both group and project levels. Secret push protection: Enable secret push protection for a group and project. On-demand DAST: Create and run on-demand DAST scans for a project. Runner visibility: View runners for a group and project. To get started, go to a group and select Manage > Members to invite and assign members to the Security Manager role. Use third-party scanner results with GitLab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use security findings from any SARIF 2.1.0-compliant scanner with GitLab vulnerability management. Define a CI/CD job that runs your scanner and outputs a SARIF artifact. GitLab parses, validates, and imports those findings into your security workflows. Results appear alongside GitLab native scanner output in the pipeline security tab, the vulnerability report, the security dashboard, the merge request security widget, and security policies. This feature gives security teams a single, consolidated view of vulnerabilities regardless of which tool produced them. GitLab assigns each finding a report type based on its identifiers, mapping results into categories such as SAST, dependency scanning, and secret detection. Supported scanners include Semgrep and Checkmarx for SAST, Trivy and Snyk for dependency and container scanning, and Gitleaks for secret detection. Wiki pages in recently viewed items Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Wiki pages now appear in your recently viewed items, so you can return to pages you visit often. On the GitLab homepage, the Quick access widget lists recently viewed project and group wiki pages, alongside issues, merge requests, and epics. GitLab automatically removes pages that are deleted or that you can no longer access. CI/CD analytics now shows accurate pipeline rates Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, the failure rate and success rate metrics on the CI/CD analytics page (/-/pipelines/charts) included canceled and skipped pipelines in their calculations. This caused both rates to appear lower than expected. For example, on gitlab-org/gitlab the two rates summed to only 98% instead of approximately 100%. Now, GitLab calculates the failure rate and success rate using only completed pipelines, so the results accurately reflect your pipeline health. Clearer, security industry-standard labels in vulnerability details Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In GitLab 19.1, the vulnerability results details page uses consistent, descriptive, and security industry-standard terminology for scan results: Scanner is now Detected by EPSS is now Exploit Probability (EPSS) Has Known Exploit (KEV) is now Known Exploited (CISA KEV) Reachable is now Reachability Image is now Container Image (Container Scanning) Location is now Affected Location URL is now Affected Endpoint (DAST, API fuzzing) Method is now HTTP Method (DAST, API fuzzing) Solution is now Remediation Guidance Links is now References Git operation audit events for all actor types Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In GitLab 18.10, audit logs began capturing the specific Git operation performed (clone, pull, fetch, or push) for human users. In GitLab 19.1, this extended to all actor types, including runners using deploy tokens and SSH certificate users. Audit logs now reflect a complete picture of all Git activity across your repositories, regardless of who or what initiated it. GitLab Runner 19.1 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.1 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Add configurable get_sources timeout to runner configuration Bug Fixes Concrete execution (FF_CONCRETE) diverges from abstract shell in multiple behavior areas Bundle URI downloads fail with insufficient capabilities when FF_USE_GIT_PROACTIVE_AUTH and FF_USE_GIT_BUNDLE_URIS are enabled Prevent script dump on job cancellation through UI due to race condition The list of all changes is in the GitLab Runner CHANGELOG. Inline blame in the blob viewer Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, viewing blame information required navigating to a separate page, breaking your flow when reviewing code. You can now toggle blame information directly in the file view. Each line shows who last modified it, and you can hover for a commit popover with additional details. Select View blame prior to this change to trace history further, or select Ignore specific revisions to exclude specific commits from the blame view. Redesigned repository commit list Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, the repository commit list had limited filtering, making it harder to find specific commits in long histories. The redesigned commit list includes: Filter and search commits by author, commit message, or date range. Filter the list by Git revision, such as a branch, tag, or commit SHA. Commits grouped by day for easier scanning. Improved performance and pagination for large repositories. Stacked merge requests in the UI Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, when you split a large change into smaller merge requests that build on each other, the UI gave no signal that they were related. Authors and reviewers had to track the sequence manually. GitLab now detects stacked merge requests automatically and shows them in the merge request header. A merge request joins a stack when it targets another open merge request’s source branch, or when another open merge request targets its source branch. The stack control next to the source branch shows the current position (for example, 1 of 2) and lets you jump to any other merge request in the stack. To create stacked merge requests from the command line, use stacked diffs in the GitLab CLI. Stream AI audit events to external destinations (beta) Tier: Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now stream AI audit events to external destinations through the GitLab audit event streaming infrastructure, giving security and compliance teams real-time visibility into LLM and AI interactions. With AI audit event streaming enabled, GitLab forwards these events to any active instance streaming destination, including your SIEM (Security Information and Event Management), alongside other audit events.

GitLab 19.0 release notes

On May 21, 2026, GitLab 19.0 was released with the following features. We’d also like to announce this month’s Notable Contributor: Norman Debald! We are excited to recognize Norman, a Level 3 contributor with more than 40 merged improvements across GitLab since joining in May 2022. Primary features Group-level custom review instructions for GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: GitLab Duo Enterprise Links: Documentation · Related Issue In previous versions of GitLab, you could only define custom review instructions for GitLab Duo at the project level. Teams working across many projects in the same group had to duplicate the same instructions in every project. Now you can configure shared custom review instructions for an entire group and its subgroups. Select a project in your group to use as a template. When GitLab Duo performs a code review, it combines the group-level .gitlab/duo/mr-review-instructions.yaml file with any instructions defined in the individual project. Both Code Review Flow and GitLab Duo Code Review support group-level custom instructions. Configure work item types Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, work item types could be either an Issue or a Task. You can now configure custom work item types in a project to match the way your team plans and tracks work. You can create or rename types to User Story, Bug, or Maintenance. Each work item displays with its type name and a unique icon. The new types support custom fields and status lifecycles, and appear in your saved views and issue boards. Type configuration in the top-level group (GitLab.com) or organization (GitLab Self-Managed) cascades down to all projects. You can also control which types are available for each project. Enable or disable a type across all projects at once, or let individual projects manage their own type visibility. When you disable a type in a project, existing work items are not affected. GitLab Secrets Manager now available in open beta Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the GitLab Secrets Manager was available only to a closed beta cohort. Most teams relied on external services such as HashiCorp Vault or AWS Secrets Manager. The GitLab Secrets Manager is now available in open beta for Premium and Ultimate customers on GitLab.com and GitLab Self-Managed. When the GitLab Secrets Manager is enabled, project and group Owners can store, retrieve, and reference CI/CD secrets in GitLab. Secrets are scoped to a project or group and are accessible to only pipeline jobs that explicitly request them. During open beta, GitLab Secrets Manager follows the beta support policy and might not be ready for production use. To share feedback, see issue 598100. GitLab Duo Developer enhancements for merge request workflows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo Developer now supports multiple trigger methods: assign it to an issue, select Generate MR, or @mention it in any issue or MR discussion thread to turn feedback, To-do items, and design questions into code changes, follow-up MRs, or research summaries. With AGENTS.md and agent-config.yml configured, GitLab Duo Developer runs your tests and checks before committing. After a top-level group or instance administrator enables the Developer Flow, GitLab automatically adds mention and assign triggers to eligible projects. Dependency scanning by using SBOM generally available Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab SBOM-based dependency scanner is now generally available. Maven, Gradle, and Python projects now have complete visibility into vulnerabilities across their full dependency tree, including vulnerable packages introduced transitively, not just those declared directly. The analyzer now includes automatic dependency resolution for Maven, Gradle, and Python projects. When a lockfile or resolved dependency graph is not present, the analyzer automatically invokes tooling to resolve the full transitive dependency graph before scanning. Dependency resolution is enabled by default and requires little-to-no additional configuration beyond including the v2 Dependency Scanning template. For projects where dependency resolution is not possible, the analyzer falls back to manifest scanning. It parses pom.xml, requirements.txt, build.gradle, and build.gradle.kts to identify direct dependencies. Manifest scanning ensures teams always get a starting point for vulnerability coverage, even for projects without lock or build files. Manifest scanning is enabled by default and returns direct dependencies only. For full transitive coverage, enable dependency resolution or provide a dependency lockfile or graph export manually. Agentic Core GitLab Duo Core moves to usage-based billing Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Starting in GitLab 19.0, GitLab Duo Core moves to usage-based billing. Code Suggestions in the Web IDE and desktop IDEs now consume GitLab Credits. GitLab Duo Chat is also changing. For GitLab Duo Core users, Chat is now agentic and runs on GitLab Duo Agent Platform. To use GitLab Duo Chat in the GitLab UI or desktop IDEs, enable GitLab Duo Agent Platform for your instance or top-level group. Filter exact code search results by repository Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now filter exact code search results by repository. With the repo: syntax, you can directly scope your search query to specific repositories or repository patterns without having to go to individual projects. For example, searching for def authenticate repo:my-group/my-project returns results only from that repository. You can also use partial paths or patterns to match multiple repositories. Merge request ready event trigger Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now configure flows and external agents to run on the Merge request ready event. When a draft merge request is marked as ready for review, GitLab Duo automatically runs the flow or external agent. To configure a trigger, go to AI > Triggers in your project. This feature is behind the merge_request_ready_flow_trigger feature flag, disabled by default. Claude Opus 4.7 now available in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Claude Opus 4.7 is now available in GitLab Duo Agent Platform. Opus 4.7 delivers meaningful improvements to complex, multistep tasks that require sustained reasoning, precise instruction following, and self-verification before surfacing results. This includes flows supporting CI/CD pipelines, code review, vulnerability resolution, and more. Support for self-hosted Gemini models Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform Self-Hosted is now compatible with Gemini models. Gemini models support multiple flows, including the Code Review Flow, SAST Vulnerability Resolution Flow, Fix CI/CD Pipeline Flow, and more. Expanded open source model support in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform now supports additional open source models for self-hosted deployments, including Devstral 2 123B, GLM-5.1-FP8, and others. This helps customers power agentic workflows across a variety of environments, including offline and network-restricted deployments. Per-session tool approvals with admin controls Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Before GitLab Duo Agentic Chat can use a tool on your behalf, it requires your approval. Each tool invocation requires a separate approval. Now, you can approve a trusted tool once for an entire session and streamline your workflows. Administrators control whether tool approval for sessions is available. The following settings cascade from instance to group to project: On by default Off by default Always off Groups and subgroups can modify the setting unless an administrator sets it to Always off. The default setting is Off by default, ensuring each tool invocation requires explicit approval unless an administrator changes it. Resolve merge conflicts with GitLab Duo (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases. Now GitLab Duo can autonomously analyze merge conflicts, edit the conflicting files, create a commit, and push to the source branch. Trigger conflict resolution from the Resolve conflicts page or directly from the merge request widget. When complete, GitLab Duo posts a summary comment so reviewers can see what changed. GitLab Duo respects branch protection rules and does not force-push to protected branches. This feature is in beta and is gated behind the mr_ai_resolve_conflicts feature flag, enabled by default. Confine the AI Catalog to a group hierarchy Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Top-level group Owners can now confine the AI Catalog to show only agents and flows owned by projects within their group hierarchy. This blocks agents, external agents, or flows not in this hierarchy from being visible or enabled by any user in that group. Purchase credits on the Free tier on GitLab Self-Managed Tier: Free Offering: GitLab Self-Managed Links: Documentation · Related Issue Free tier users on GitLab Self-Managed can now unlock the full power of GitLab Duo Agent Platform, no Premium or Ultimate subscription required. Choose your monthly credit amount, commit to an annual term, and get instant access to AI-powered development tools. Credits refresh automatically each month, so your team always has what it needs to build faster and smarter. Admin-defined network access controls for Agent Platform remote flows Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators can now define centralized network policies for GitLab Duo Agent Platform remote flows directly in Settings. Top-level group administrators on GitLab.com, and instance administrators on GitLab Self-Managed and Dedicated, can configure organization-wide domain denylists and allowlists that projects inherit automatically. An additional setting controls whether projects can extend the approved domain list with custom entries. Policies are enforced at runtime across all remote flows, giving security and platform teams a consistent governance layer for agent network egress. Unified DevOps and Security Auto remediation for vulnerable dependencies (Experiment) Tier: Ultimate Offering: GitLab.com Links: Documentation · Related Issue Auto remediation for dependencies is now available as an experiment in GitLab 19.0. When dependency scanning detects a vulnerable Ruby dependency with a known fix, GitLab automatically opens a merge request to update it to a safe version without human input. Only Ruby projects are supported in the experiment. After each pipeline, GitLab identifies the highest-severity vulnerability with an available patch or minor version upgrade. GitLab generates the manifest file change and opens a merge request through a service account. The merge request then goes through your project’s standard review and approval workflow. During the experiment, up to three auto-remediation merge requests can be open per project at a time. To share feedback or request to try out the experiment make a comment on epic 600511. To enable the experiment on your project, a GitLab team member must enable the dependency_management_auto_remediation feature flag for your project. Dependency scanning in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab 18.11 introduced security configuration profiles for SAST and secret detection. Now, dependency scanning is also available with the Dependency Scanning - Default profile. This profile gives you a unified control surface to apply standardized SCA coverage across all of your projects without editing a single CI/CD configuration file. The profile activates two scan triggers: Merge Request Pipelines: Automatically runs a dependency scanning scan each time new commits are pushed to a branch with an open merge request. Results include only new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s dependency posture. Dependency resolution for Gradle SBOM scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab dependency scanning using SBOM now automatically generates a dependency graph (gradle.graph.txt) for Gradle projects. Previously, Gradle dependency scanning required you to generate a dependency graph manually as part of your build. Now, when a graph file is not available, the analyzer generates one automatically, removing this manual step for Java and Kotlin projects using Gradle. Remediation guidance for API security testing findings Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue API security vulnerability reports now include remediation guidance for each finding. Previously, API security testing identified vulnerabilities but provided no guidance on how to fix them. Developers had to research remediation steps independently. Now, each finding includes vulnerability-specific remediation steps and references to relevant OWASP and CWE identifiers directly in the vulnerability report. Remediation guidance is now included for the following checks: Application information Cleartext authentication CORS DNS rebinding Framework debug mode Heartbleed OpenSSL vulnerability HTML injection Insecure HTTP methods JSON hijacking JSON injection Open redirect OS command injection Path traversal Sensitive file Sensitive information Session cookie Shellshock SQL injection TLS configuration Authentication token XML injection Security data in merge request Reports tab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Merge requests include a new Reports tab that shows all findings from security scans, license compliance results, and code quality reports for the pipeline. GitLab bot comments in the activity feed are still available to view any policy violations that prevent the merge request from being merged. Improved array support for CI/CD inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue CI/CD inputs now have improved support for working with arrays. Use the array index operator [] to access specific elements within array inputs. This enhancement provides more flexible and powerful input interpolation capabilities in your pipeline configurations, enabling you to reference individual array items directly without additional processing steps. Select multiple values for pipeline inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, you could only select a single value when selecting input options in the UI, limiting flexibility for pipelines with more complex options. Now when you run a pipeline with inputs from the UI, you can select multiple values from a dropdown list and the selected values are combined into an array, for example ["option1","option2"]. This makes it easy to restart services on multiple instances, build multiple Docker images, run tests with multiple tag combinations, or perform any operation across multiple targets in a single pipeline run. Detailed CI/CD Catalog component usage analytics Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When you manage a CI/CD component in the GitLab Catalog, usage details are critical for managing upgrades, enforcing compliance, and communicating breaking changes. You need to know which projects use your components, and which versions they are using. Previously, this information was not available, making it difficult to notify the right maintainers, plan deprecations safely, or ensure projects stay current with the latest security patches. The component usage details view in the catalog resource page now shows exactly which projects use each component, the version they are running, and whether they are on the latest version or an outdated one. Projects using older versions are surfaced at the top, so you can prioritize outreach, drive adoption of security fixes, and ensure a smooth upgrade path across your organization. Configure parallel pipeline limits for merge trains Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you couldn’t change the maximum of 20 parallel pipelines in a merge train, which forced you to either overwhelm your runners or skip merge trains entirely. Now you can configure the parallel pipeline limit per merge train to balance runner load and merge throughput. You can set the limit per project or instance-wide. Setting the limit to 1 means each merge request runs one at a time, against a clean target branch. Thanks to Norman Debald (@Modjo85) for this community contribution. Customize default merge request titles Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the default title for a new merge request came from the source branch or first commit, and you couldn’t enforce a consistent naming convention across your project. Now you can configure a default merge request title template per project. Templates support variables for the source branch, target branch, first commit subject, linked issue ID, issue title, and a human-readable version of the source branch name. For example, the template Resolve %{issue_id} "%{issue_title}" produces titles like Resolve 123 "Fix login bug". You can still edit the title before creating the merge request. Secure webhooks with HMAC signing tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The existing X-Gitlab-Token header sends a static secret in plain text, making webhooks susceptible to interception and replay attacks. You can now add a signing token to any webhook. GitLab uses the signing token to compute an HMAC-SHA256 signature over: The unique webhook ID. The request timestamp. The webhook payload. GitLab then sends the result in the webhook-signature header alongside webhook-id and webhook-timestamp headers, following the Standard Webhooks specification. You can recompute the signature to confirm requests genuinely came from GitLab and that the payload has not been modified. By also validating the timestamp, you can reject replayed requests. Thanks to Van Anderson and Norman Debald for their community contributions! Cross-project pushes using CI/CD job tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, you could only use a CI/CD job token (CI_JOB_TOKEN) to push to the same repository where the pipeline runs. Cross-project pushes required a personal access token or deploy token. You can now use a job token to push to another project when: The target project opts in. The user who starts the pipeline has at least the Developer role in the target project. This feature is behind the allow_push_to_allowlisted_projects feature flag, disabled by default in GitLab 19.0. Ask your administrator to enable it. Mermaid diagram rendering upgraded to version 11 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab now uses Mermaid version 11 for rendering diagrams in Markdown. Previously, GitLab supported Mermaid version 10. With this upgrade, you get access to all the new diagram types, syntax improvements, and bug fixes introduced in Mermaid 11, including enhanced rendering for flowcharts, sequence diagrams, and more. Rapid Diffs for merge request reviews (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, you would have to wait for the Changes tab to load all files before you could begin reviewing, which slowed down large reviews. Now you can use Rapid Diffs to review merge requests with faster initial load, smoother scrolling, and more responsive interactions across files. Rapid Diffs uses the same technology that already powers the commits page. Rapid Diffs is in beta. Some features from the classic diff experience aren’t yet available. You can switch back at any time. Watch the overview video and share your experience in the feedback issue. GitLab Runner 19.0 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.0 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Runner instrumentation: Feature negotiation, OTLP export client, and first job_execution span Add configurable prepare stage timeout to runner configuration Bug Fixes Comprehensive fixes for FF_SCRIPTS_TO_STEPS feature flag implementation SignatureDoesNotMatch error when downloading S3 cache Runtime error when GitLab Runner runs in AWS with S3 cache Broken RPM S3 download links for amd64, arm64, arm, and armhf in GitLab Runner 18.9.0 and later Negative exit codes are reported incorrectly on Windows Incorrect Kubernetes executor service container naming documentation The list of all changes is in the GitLab Runner CHANGELOG. Scale and Deployments PostgreSQL 17 minimum requirement Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The minimum supported version of PostgreSQL is now version 17. If you use the packaged PostgreSQL 16, upgrade the packaged PostgreSQL server before installing GitLab 19.0. Linux package support for Ubuntu 20.04 discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Ubuntu 20.04 reached end of standard support in May 2025. From GitLab 19.0, Linux packages are no longer provided for Ubuntu 20.04. GitLab 18.11 is the last release with packages for this distribution. Before upgrading to GitLab 19.0, migrate to Ubuntu 22.04 or another supported operating system. Redis 6 support removed Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Support for Redis 6 is removed in GitLab 19.0. If you use an external Redis 6 deployment, migrate to Redis 7.2 or Valkey 7.2 before upgrading. The bundled Redis included with the Linux package has used Redis 7 since GitLab 16.2 and is not affected. Mattermost removed from the Linux package Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Bundled Mattermost is removed from the Linux package in GitLab 19.0. If you currently use the bundled Mattermost, refer to Migrating from the Linux package to Mattermost Standalone for migration instructions. Customers not using the bundled Mattermost are not impacted. Linux package support for SUSE distributions discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Linux package support for SUSE distributions ends in GitLab 19.0, which affects openSUSE Leap 15.6, SUSE Linux Enterprise Server 12.5, and SUSE Linux Enterprise Server 15.6. GitLab 18.11 is the last version with Linux packages for these distributions. To continue to use SUSE distributions, migrate to a Docker deployment of GitLab. Spamcheck removed from Linux package and GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Spamcheck is removed from the Linux package and GitLab Helm chart in GitLab 19.0. Customers not currently using Spamcheck are not impacted. If you use the bundled Spamcheck, you can deploy it separately using Docker. No data migration is required. NGINX Ingress replaced by Gateway API with Envoy Gateway Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Gateway API with Envoy Gateway becomes the default networking configuration in the GitLab Helm chart in GitLab 19.0, replacing NGINX Ingress which reached end-of-life in March 2026. If migration to Envoy Gateway is not immediately feasible, you can explicitly re-enable the bundled NGINX Ingress, which remains available until its planned removal in GitLab 20.0. This change does not impact the NGINX used in the Linux package, or Helm chart instances using an externally managed Ingress or Gateway API controller. Bundled PostgreSQL, Redis, and MinIO removed from GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The bundled Bitnami PostgreSQL, Bitnami Redis, and MinIO charts are removed from the GitLab Helm chart and GitLab Operator in GitLab 19.0 with no replacement. These components were intended only for proof-of-concept and test environments and are not recommended for production use. If you run an instance with any of these bundled services, follow the migration guide to configure external services before upgrading to GitLab 19.0. Reliable SCIM user deprovisioning for large groups Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue For organizations managing large numbers of users through SCIM, deprovisioning group members could time out and return 500 errors. SCIM DELETE and PATCH requests now return a success response immediately. Membership removal is handled asynchronously, so identity providers and SCIM clients receive consistent success responses. Filter Credits dashboard by product and date (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue The in-product GitLab Credits dashboard now supports product filtering, date range selection, and Secrets Manager usage visibility. You can filter usage by product (including GitLab Duo and Secrets Manager) and date range, see a daily usage chart across selected products, and review per-user attribution with a Usage control status column. The dashboard also includes usage from service accounts so automated activity is reflected in per-user attribution, and surfaces non-billable and beta events such as Secrets Manager Open Beta activity. This gives you a complete view of credit consumption in your organization. Review prior months of Credits usage (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the Credits dashboard showed only the current billing month, so you couldn’t compare trends, audit a usage spike after the fact, or build a budget conversation around prior consumption. Now you can navigate to prior billing months in the Credits dashboard.

GitLab 19.0リリースノート

2026年5月21日、GitLab 19.0が以下の機能とともにリリースされました。 今月のNotable Contributorは、Norman Debaldさんです！ Normanさんは、レベル3のコントリビューターで、2022年5月の参加以来、GitLab全体で40件以上のマージされた改善に貢献しています。 主要な機能 GitLab Duoのグループレベルのカスタムレビュー指示 プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated アドオン: Duo Enterprise リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、GitLab Duoのカスタムレビュー指示はプロジェクトレベルでのみ定義できました。同じグループ内の多くのプロジェクトにまたがって作業するチームは、すべてのプロジェクトで同じ指示を複製する必要がありました。 今回のリリースで、グループ全体とそのサブグループに対して共有カスタムレビュー指示を設定できるようになりました。 グループ内のプロジェクトをテンプレートとして選択します。GitLab Duoがコードレビューを実行すると、グループレベルの.gitlab/duo/mr-review-instructions.yamlファイルと個々のプロジェクトで定義された指示が組み合わされます。 コードレビューフローとGitLab Duoコードレビューの両方が、グループレベルのカスタム指示をサポートしています。 作業アイテムタイプの設定 プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連エピック これまで、作業アイテムタイプはイシューまたはタスクのいずれかに限られていましたが、プロジェクト内でカスタムの作業アイテムタイプを設定して、チームの計画・追跡方法に合わせられるようになりました。 タイプをユーザーストーリー、バグ、またはメンテナンスとして作成または名前変更できます。各作業アイテムはそのタイプ名と固有のアイコンで表示されます。新しいタイプはカスタムフィールドとステータスライフサイクルをサポートし、保存済みビューやイシューボードに表示されます。トップレベルグループ（GitLab.com）または組織（GitLab Self-Managed）でのタイプ設定は、すべてのプロジェクトに継承されます。 また、各プロジェクトで利用可能なタイプを制御することもできます。すべてのプロジェクトで一度にタイプを有効または無効にするか、個々のプロジェクトが独自のタイプの表示設定を管理できるようにします。プロジェクトでタイプを無効にしても、既存の作業アイテムには影響しません。 GitLab Secrets Managerがオープンベータで利用可能に プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連エピック 以前のバージョンのGitLabでは、GitLab Secrets Managerはクローズドベータに限定されていました。ほとんどのチームはHashiCorp VaultやAWS Secrets Managerなどの外部サービスに依存していました。 今回のリリースでGitLab Secrets Managerが、GitLab.comおよびGitLab Self-ManagedのPremiumおよびUltimateのお客様向けにオープンベータで利用可能になりました。GitLab Secrets Managerが有効な場合、プロジェクトおよびグループのオーナーはGitLab内でCI/CDシークレットを保存、取得、参照できます。シークレットはプロジェクトまたはグループにスコープされ、明示的にリクエストしたパイプラインジョブのみがアクセスできます。 オープンベータ期間中、GitLab Secrets Managerはベータサポートポリシーに従い、本番環境での使用に対応していない場合があります。 フィードバックを共有するには、イシュー598100をご覧ください。 マージリクエストワークフローのためのGitLab Duo Developerの機能強化 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLab Duo Developerは複数のトリガー方法をサポートするようになりました。イシューに割り当てる、MRを生成を選択する、またはイシューやMRのディスカッションスレッドで@mentionすることで、フィードバック、To-Doアイテム、設計上の質問をコード変更、フォローアップMR、またはリサーチサマリーに変換できます。 AGENTS.mdとagent-config.ymlを設定することで、GitLab Duo Developerはコミット前にテストとチェックを実行します。トップレベルグループまたはインスタンス管理者がデベロッパーフローを有効にすると、GitLabは対象プロジェクトにメンションと割り当てトリガーを自動的に追加します。 SBOMを使用した依存関係スキャンが一般提供に プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連エピック GitLabのSBOMベースの依存関係スキャナーが一般提供開始になりました。Maven、Gradle、Pythonプロジェクトで、直接宣言されたものだけでなく、推移的に導入された脆弱なパッケージを含む、完全な依存関係ツリー全体の脆弱性を可視化できるようになりました。 アナライザーには、Maven、Gradle、Pythonプロジェクトの自動依存関係解決が含まれるようになりました。ロックファイルまたは解決済みの依存関係グラフが存在しない場合、アナライザーはスキャン前に完全な推移的依存関係グラフを解決するためのツールを自動的に実行します。依存関係解決はデフォルトで有効になっており、v2 Dependency Scanningテンプレートを含める以外に追加の設定はほとんど必要ありません。 依存関係解決が不可能なプロジェクトの場合、アナライザーはマニフェストスキャンにフォールバックします。pom.xml、requirements.txt、build.gradle、build.gradle.ktsを解析して直接依存関係を特定します。マニフェストスキャンにより、ロックファイルやビルドファイルのないプロジェクトでも、チームは常に脆弱性カバレッジの出発点を得られます。 マニフェストスキャンはデフォルトで有効になっており、直接依存関係のみを返します。完全な推移的カバレッジを得るには、依存関係解決を有効にするか、依存関係ロックファイルまたはグラフエクスポートを手動で提供してください。 Agent Platformの中核機能 GitLab Duo Coreが使用量ベースの課金に移行 プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLab 19.0から、GitLab Duo Coreは使用量ベースの課金に移行します。Web IDEおよびデスクトップIDEのコード提案は、GitLabクレジットを消費するようになります。 GitLab Duo Chatも変更されます。GitLab Duo Coreユーザーの場合、Chatはエージェント型になりGitLab Duo Agent Platformで動作します。GitLab UIまたはデスクトップIDEでGitLab Duo Chatを使用するには、インスタンスまたはトップレベルグループでGitLab Duo Agent Platformを有効にしてください。 完全一致コードの検索結果をリポジトリでフィルタリング プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー 完全一致コードの検索結果をリポジトリでフィルタリングできるようになりました。repo:構文を使用すると、個々のプロジェクトに移動することなく、検索クエリを特定のリポジトリまたはリポジトリパターンに直接スコープできます。 例えば、def authenticate repo:my-group/my-projectを検索すると、そのリポジトリからの結果のみが返されます。また、部分的なパスやパターンを使用して、複数のリポジトリを照合することもできます。 マージリクエスト準備完了イベントトリガー プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー フローと外部エージェントをマージリクエスト準備完了イベントで実行するように設定できるようになりました。 ドラフトのマージリクエストがレビュー準備完了としてマークされると、GitLab Duoはフローまたは外部エージェントを自動的に実行します。 トリガーを設定するには、プロジェクトのAI > トリガーに移動します。 この機能はmerge_request_ready_flow_trigger機能フラグで制御されており、デフォルトでは無効になっています。 GitLab Duo Agent PlatformでClaude Opus 4.7が利用可能に プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー Claude Opus 4.7がGitLab Duo Agent Platformで利用可能になりました。Opus 4.7は、継続的な推論、指示への正確な準拠、結果を出力する前の自己検証を必要とする複雑なマルチステップタスクに対して、意味のある改善をもたらします。これには、CI/CDパイプライン、コードレビュー、脆弱性解決などをサポートするフローが含まれます。 セルフホスト型Geminiモデルのサポート プラン: Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab Duo Agent Platform Self-HostedがGeminiモデルと互換性を持つようになりました。Geminiモデルはコードレビューフロー、SAST脆弱性修正フロー、CI/CDパイプライン修正フローなど、複数のフローをサポートしています。 GitLab Duo Agent Platformでのオープンソースモデルサポートの拡張 プラン: Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab Duo Agent Platformは、セルフホストデプロイ向けに追加のオープンソースモデルをサポートするようになりました。Devstral 2 123B、GLM-5.1-FP8などが含まれます。これにより、オフラインやネットワーク制限のある環境を含む、さまざまな環境でエージェント型ワークフローを実現できます。 管理者コントロール付きのセッションごとのツール承認 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLab Duo Agentic Chatがツールを使用するには、その都度ユーザーの承認が必要でした。 今回のリリースで、信頼できるツールをセッション内で一度だけ承認すれば、同じセッション中は再承認なしで使用できるようになりました。 管理者は、セッションのツール承認が利用可能かどうかを制御します。以下の設定はインスタンスからグループ、プロジェクトへと継承されます: デフォルトでオン デフォルトでオフ 常にオフ 管理者が常にオフに設定しない限り、グループとサブグループは設定を変更できます。 デフォルト設定はデフォルトでオフであり、管理者が変更しない限り、各ツールの実行には明示的な承認が必要です。 GitLab Duoでマージコンフリクトを解決（ベータ版） プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、単純なケースであっても、GitLab UIまたはコマンドラインでマージコンフリクトを手動で解決する必要がありました。 今回のリリースで、GitLab Duoがマージコンフリクトを自律的に分析し、該当ファイルの編集からコミット作成、ソースブランチへのプッシュまでを自動で行えるようになりました。コンフリクトを解決ページまたはマージリクエストウィジェットから直接コンフリクト解決をトリガーできます。完了すると、GitLab Duoがサマリーコメントを投稿するため、レビュアーは変更内容をすぐに確認できます。 GitLab Duoはブランチ保護ルールを尊重し、保護ブランチへの強制プッシュは行いません。 この機能はベータ版であり、mr_ai_resolve_conflicts機能フラグで制御されており、デフォルトでは有効になっています。 AIカタログをグループ階層に制限する プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー トップレベルグループのオーナーは、AIカタログをグループ階層内のプロジェクトが所有するエージェントとフローのみを表示するように制限できるようになりました。これにより、この階層に含まれないエージェント、外部エージェント、またはフローが、そのグループのユーザーに表示されたり有効化されたりすることをブロックします。 GitLab Self-ManagedのFreeプランでクレジットを購入 プラン: Free 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab Self-ManagedのFreeプランユーザーは、PremiumまたはUltimateのサブスクリプションなしで、GitLab Duo Agent Platformのフル機能を利用できるようになりました。月次クレジット量を選択し、年間契約にすることで、AIを活用した開発ツールに即座にアクセスできます。クレジットは毎月自動的に更新されるため、チームは常に必要なものを手に入れ、より速く、よりスマートに構築できます。 Agent Platformリモートフローの管理者定義ネットワークアクセス制御 プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー 管理者は、設定から直接GitLab Duo Agent Platformリモートフローの集中ネットワークポリシーを定義できるようになりました。GitLab.comのトップレベルグループ管理者、およびGitLab Self-ManagedとDedicatedのインスタンス管理者は、プロジェクトが自動的に継承する組織全体のドメイン拒否リストと許可リストを設定できます。追加の設定により、プロジェクトがカスタムエントリで承認済みドメインリストを拡張できるかどうかを制御します。ポリシーはすべてのリモートフローにわたってランタイムで適用され、セキュリティおよびプラットフォームチームにエージェントのネットワーク外部通信に対する一貫したガバナンス層を提供します。 スケールとデプロイ PostgreSQL 17の最小要件 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー PostgreSQLの最小サポートバージョンはバージョン17になりました。パッケージ版PostgreSQL 16を使用している場合は、GitLab 19.0をインストールする前にパッケージ版PostgreSQLサーバーをアップグレードしてください。 Ubuntu 20.04向けLinuxパッケージサポートの終了 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー Ubuntu 20.04は2025年5月に標準サポートが終了しました。GitLab 19.0から、Ubuntu 20.04向けのLinuxパッケージは提供されなくなります。GitLab 18.11がこのディストリビューション向けのパッケージを含む最後のリリースです。GitLab 19.0にアップグレードする前に、Ubuntu 22.04または他のサポートされているオペレーティングシステムに移行してください。 Redis 6サポートの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab 19.0でRedis 6のサポートが削除されます。外部のRedis 6デプロイを使用している場合は、アップグレード前にRedis 7.2またはValkey 7.2に移行してください。Linuxパッケージに含まれるバンドル版RedisはGitLab 16.2からRedis 7を使用しており、影響を受けません。 LinuxパッケージからのMattermostの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab 19.0でバンドル版MattermostがLinuxパッケージから削除されます。現在バンドル版Mattermostを使用している場合は、移行手順についてLinuxパッケージからMattermost Standaloneへの移行を参照してください。バンドル版Mattermostを使用していないお客様には影響はありません。 SUSEディストリビューション向けLinuxパッケージサポートの終了 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー SUSEディストリビューション向けのLinuxパッケージサポートはGitLab 19.0で終了します。これはopenSUSE Leap 15.6、SUSE Linux Enterprise Server 12.5、およびSUSE Linux Enterprise Server 15.6に影響します。GitLab 18.11がこれらのディストリビューション向けのLinuxパッケージを含む最後のバージョンです。SUSEディストリビューションを引き続き使用するには、GitLabのDockerデプロイに移行してください。 LinuxパッケージとGitLab HelmチャートからのSpamcheckの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー SpamcheckはGitLab 19.0でLinuxパッケージとGitLab Helmチャートから削除されます。現在Spamcheckを使用していないお客様には影響はありません。バンドル版Spamcheckを使用している場合は、Dockerを使用して個別にデプロイできます。データ移行は不要です。 NGINX IngressがEnvoy GatewayによるGateway APIに置き換えられる プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab 19.0では、Envoy GatewayによるGateway APIがGitLab Helmチャートのデフォルトネットワーク設定になり、2026年3月に提供終了となったNGINX Ingressを置き換えます。Envoy Gatewayへの移行がすぐに実現できない場合は、バンドル版NGINX Ingressを明示的に再有効化できます。これはGitLab 20.0での計画的な削除まで利用可能です。この変更は、Linuxパッケージで使用されるNGINX、または外部管理のIngressまたはGateway APIコントローラーを使用するHelmチャートインスタンスには影響しません。 GitLab HelmチャートからバンドルされたPostgreSQL、Redis、MinIOの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー バンドルされたBitnami PostgreSQL、Bitnami Redis、MinIOチャートは、GitLab 19.0でGitLab HelmチャートとGitLab Operatorから代替なしで削除されます。これらのコンポーネントは概念実証およびテスト環境のみを対象としており、本番環境での使用は推奨されていません。これらのバンドルサービスのいずれかを使用してインスタンスを実行している場合は、GitLab 19.0にアップグレードする前に移行ガイドに従って外部サービスを設定してください。 大規模グループでのSCIMユーザーデプロビジョニングの信頼性向上 プラン: Premium、Ultimate 提供形態: GitLab.com リンク: ドキュメント、関連イシュー SCIMを通じて多数のユーザーを管理している組織では、グループメンバーのデプロビジョニングがタイムアウトして500エラーが返されることがありました。SCIMのDELETEおよびPATCHリクエストは即座に成功レスポンスを返すようになりました。メンバーシップの削除は非同期で処理されるため、IDプロバイダーとSCIMクライアントは一貫した成功レスポンスを受け取ります。 統合DevOpsとセキュリティ 脆弱な依存関係の自動修正（実験的機能） プラン: Ultimate 提供形態: GitLab.com リンク: ドキュメント、関連エピック GitLab 19.0で、依存関係の自動修正が実験的機能として利用可能になりました。依存関係スキャンで既知の修正が存在する脆弱なRuby依存関係が検出されると、GitLabは人手を介さずに安全なバージョンへの更新マージリクエストを自動的に作成します。実験的機能でサポートされるのはRubyプロジェクトのみです。 各パイプライン実行後、GitLabは利用可能なパッチまたはマイナーバージョンアップグレードがある最も重大度の高い脆弱性を特定します。GitLabがマニフェストファイルの変更を生成し、サービスアカウントを通じてマージリクエストを作成します。その後、マージリクエストはプロジェクトの標準的なレビューおよび承認ワークフローに従います。 実験的機能の期間中、プロジェクトあたり同時にオープンできる自動修正マージリクエストは最大3件です。 フィードバックの共有や実験的機能への参加を希望する場合は、エピック600511にコメントしてください。 プロジェクトで実験的機能を有効にするには、GitLabチームメンバーがプロジェクトのdependency_management_auto_remediation機能フラグを有効にする必要があります。 セキュリティ設定プロファイルでの依存関係スキャン プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー GitLab 18.11では、SASTとシークレット検出のセキュリティ設定プロファイルが導入されました。 これで、依存関係スキャンも 依存関係スキャン - デフォルト プロファイルで利用可能になりました。 このプロファイルにより、単一のCI/CD設定ファイルを編集することなく、すべてのプロジェクトに標準化されたSCAカバレッジを適用するための統一された操作画面が提供されます。 このプロファイルは2つのスキャントリガーを有効にします: マージリクエストパイプライン: オープンなマージリクエストがあるブランチに新しいコミットがプッシュされるたびに、依存関係スキャンを自動的に実行します。結果にはマージリクエストによって導入された新しい脆弱性のみが含まれます。 ブランチパイプライン（デフォルトのみ）: 変更がデフォルトブランチにマージまたはプッシュされたときに自動的に実行され、デフォルトブランチの依存関係の状態の完全なビューを提供します。 Gradle SBOMスキャンの依存関係解決 プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント | 関連エピック SBOMを使用したGitLabの依存関係スキャンが、Gradleプロジェクトの依存関係グラフ (gradle.graph.txt)を自動的に生成するようになりました。以前は、Gradleの依存関係スキャンではビルドの一部として依存関係グラフを手動で生成する必要がありました。グラフファイルが存在しない場合、アナライザーが自動的に生成するようになり、GradleベースのJavaおよびKotlinプロジェクトでこの手動ステップが不要になりました。 APIセキュリティテストの検出結果に対する修正ガイダンス プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー APIセキュリティの脆弱性レポートに、各検出結果に対する修正ガイダンスが含まれるようになりました。以前は、APIセキュリティテストで脆弱性が特定されても、修正方法に関するガイダンスは提供されていませんでした。デベロッパーは修正手順を独自に調査する必要がありました。今後は、各検出結果に脆弱性固有の修正手順と、関連するOWASPおよびCWE識別子への参照が脆弱性レポートに直接含まれます。 現在、以下のチェックに修正ガイダンスが含まれています: アプリケーション情報 平文認証 CORS DNSリバインディング フレームワークデバッグモード Heartbleed OpenSSL脆弱性 HTMLインジェクション 脆弱なHTTPメソッド JSONハイジャッキング JSONインジェクション オープンリダイレクト OSコマンドインジェクション パストラバーサル 機密ファイル 機密情報 セッションCookie Shellshock SQLインジェクション TLS設定 認証トークン XMLインジェクション CI/CDインプットの配列サポートの改善 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー CI/CDインプットは、配列を扱うためのサポートが改善されました。配列入力内の特定の要素にアクセスするには、配列インデックス演算子[]を使用します。この機能強化により、パイプラインの設定において、より柔軟で強力な入力補間機能が提供され、追加の処理ステップなしで個々の配列項目を直接参照できるようになります。 パイプライン入力に複数の値を選択 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー 以前は、UIで入力オプションを選択する際に単一の値しか選択できず、より複雑なオプションを持つパイプラインの柔軟性が制限されていました。 今回のリリースから、UIから入力を含むパイプラインを実行する際、ドロップダウンリストから複数の値を選択でき、選択された値は例えば["option1","option2"]のように配列に結合されます。これにより、複数のインスタンスでサービスを再起動したり、複数のDockerイメージをビルドしたり、複数のタグの組み合わせでテストを実行したり、単一のパイプライン実行で複数のターゲットにわたるあらゆる操作を簡単に実行できます。 CI/CDカタログコンポーネントの詳細な使用状況分析 プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLabカタログでCI/CDコンポーネントを管理する場合、使用状況の詳細はアップグレードの管理、コンプライアンスの適用、破壊的な変更の伝達に不可欠です。どのプロジェクトがコンポーネントを使用しているか、どのバージョンを使用しているかを把握する必要があります。以前はこの情報が利用できなかったため、適切なメンテナーへの通知、安全な廃止計画、またはプロジェクトが最新のセキュリティパッチに追従していることの確認が困難でした。 カタログリソースページのコンポーネント使用状況詳細ビューには、各コンポーネントを使用しているプロジェクト、実行中のバージョン、最新バージョンか古いバージョンかが正確に表示されるようになりました。古いバージョンを使用しているプロジェクトは上部に表示されるため、アウトリーチを優先し、セキュリティ修正の採用を促進し、組織全体でスムーズなアップグレードパスを確保できます。 マージトレインの並列パイプライン制限の設定 プラン: Premium、Ultimate 提供形態: GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、マージトレインの最大20並列パイプラインを変更できなかったため、Runnerに過負荷をかけるか、マージトレインを完全にスキップするかの二択を迫られていました。これで、マージトレインごとの並列パイプライン制限を設定して、Runnerの負荷とマージスループットのバランスを取ることができます。制限はプロジェクトごとまたはインスタンス全体で設定できます。制限を1に設定すると、各マージリクエストはクリーンなターゲットブランチに対して1つずつ実行されます。 このコミュニティへのコントリビュートに感謝します Norman Debald (@Modjo85)。 デフォルトのマージリクエストタイトルのカスタマイズ プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、新しいマージリクエストのデフォルトタイトルはソースブランチまたは最初のコミットから取得されており、プロジェクト全体で一貫した命名規則を適用することができませんでした。 これで、プロジェクトごとにデフォルトのマージリクエストタイトルテンプレートを設定できます。テンプレートはソースブランチ、ターゲットブランチ、最初のコミットの件名、リンクされたイシューID、イシュータイトル、ソースブランチ名を読みやすく整形した変数をサポートしています。例えば、テンプレートResolve %{issue_id} "%{issue_title}"はResolve 123 "Fix login bug"のようなタイトルを生成します。マージリクエストを作成する前にタイトルを編集することもできます。 HMAC署名トークンでWebhookを保護する プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー 既存のX-Gitlab-Tokenヘッダーは静的なシークレットを平文で送信するため、Webhookは傍受やリプレイ攻撃に対して脆弱です。 これで、任意のWebhookに署名トークンを追加できます。GitLabは、署名トークンを使用して以下のHMAC-SHA256署名を算出します: 一意のWebhook ID。 リクエストのタイムスタンプ。 Webhookペイロード。 GitLabは、Standard Webhooks仕様に従い、webhook-idおよびwebhook-timestampヘッダーとともに、結果をwebhook-signatureヘッダーで送信します。 署名を再計算することで、リクエストがGitLabから真正に送信されたものであり、ペイロードが変更されていないことを確認できます。タイムスタンプも検証することで、リプレイされたリクエストを拒否できます。 Van AndersonとNorman Debaldのコミュニティへのコントリビュートに感謝します！ CI/CDジョブトークンを使用したクロスプロジェクトプッシュ プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、CI/CDジョブトークン（CI_JOB_TOKEN）を使用してパイプラインが実行される同じリポジトリにのみプッシュできました。クロスプロジェクトプッシュにはパーソナルアクセストークンまたはデプロイトークンが必要でした。 以下の条件を満たす場合、ジョブトークンを使用して別のプロジェクトにプッシュできるようになりました: ターゲットプロジェクトがオプトインしている。 パイプラインを開始するユーザーがターゲットプロジェクトで少なくともデベロッパーロールを持っている。 この機能はallow_push_to_allowlisted_projects機能フラグで制御されており、GitLab 19.0ではデフォルトで無効になっています。管理者に有効化を依頼してください。 Mermaidダイアグラムのレンダリングをバージョン11にアップグレード プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLabのMarkdownにおけるダイアグラムのレンダリングにMermaidバージョン11が使用されるようになりました。 以前はMermaidバージョン10がサポートされていました。このアップグレードにより、フローチャートやシーケンスダイアグラムのレンダリング改善をはじめ、Mermaid 11で導入されたすべての新しいダイアグラムタイプ、構文の改善、バグ修正を利用できます。 マージリクエストレビューのRapid Diffs（ベータ版） プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、レビューを開始する前に変更タブがすべてのファイルを読み込むのを待つ必要があり、大規模なレビューが遅くなっていました。 これからは、Rapid Diffsを使用して、より速い初期読み込み、スムーズなスクロール、ファイル間のより応答性の高いインタラクションでマージリクエストをレビューできます。Rapid Diffsは、コミットページで既に使用されているのと同じ技術を使用しています。 Rapid Diffsはベータ版です。クラシックdiffエクスペリエンスの一部の機能はまだ利用できません。いつでも切り替えることができます。 概要ビデオを視聴して、フィードバックイシューで感想を共有してください。 GitLab Runner 19.0 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント 本日、GitLab Runner 19.0もリリースします！GitLab Runnerは、CI/CDジョブを実行し、結果をGitLabインスタンスに返送する高いスケーラビリティを備えたビルドエージェントです。GitLab Runnerは、GitLabに含まれるオープンソースの継続的インテグレーションサービスであるGitLab CI/CDと連携して動作します。 新機能 Runnerインストルメンテーション: 機能ネゴシエーション、OTLPエクスポートクライアント、最初のjob_executionスパン Runner設定に設定可能なprepareステージタイムアウトを追加 バグ修正 FF_SCRIPTS_TO_STEPS機能フラグ実装の包括的な修正 S3キャッシュのダウンロード時のSignatureDoesNotMatchエラー GitLab RunnerがS3キャッシュを使用してAWSで実行される際のランタイムエラー GitLab Runner 18.9.0以降のamd64、arm64、arm、armhf向けRPM S3ダウンロードリンクの破損 Windowsで負の終了コードが正しく報告されない Kubernetesエグゼキューターサービスコンテナの命名に関するドキュメントの誤り すべての変更のリストはGitLab RunnerのCHANGELOGにあります。 Primary features Group-level custom review instructions for GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: GitLab Duo Enterprise Links: Documentation · Related Issue In previous versions of GitLab, you could only define custom review instructions for GitLab Duo at the project level. Teams working across many projects in the same group had to duplicate the same instructions in every project. Now you can configure shared custom review instructions for an entire group and its subgroups. Select a project in your group to use as a template. When GitLab Duo performs a code review, it combines the group-level .gitlab/duo/mr-review-instructions.yaml file with any instructions defined in the individual project. Both Code Review Flow and GitLab Duo Code Review support group-level custom instructions. Configure work item types Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, work item types could be either an Issue or a Task. You can now configure custom work item types in a project to match the way your team plans and tracks work. You can create or rename types to User Story, Bug, or Maintenance. Each work item displays with its type name and a unique icon. The new types support custom fields and status lifecycles, and appear in your saved views and issue boards. Type configuration in the top-level group (GitLab.com) or organization (GitLab Self-Managed) cascades down to all projects. You can also control which types are available for each project. Enable or disable a type across all projects at once, or let individual projects manage their own type visibility. When you disable a type in a project, existing work items are not affected. GitLab Secrets Manager now available in open beta Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the GitLab Secrets Manager was available only to a closed beta cohort. Most teams relied on external services such as HashiCorp Vault or AWS Secrets Manager. The GitLab Secrets Manager is now available in open beta for Premium and Ultimate customers on GitLab.com and GitLab Self-Managed. When the GitLab Secrets Manager is enabled, project and group Owners can store, retrieve, and reference CI/CD secrets in GitLab. Secrets are scoped to a project or group and are accessible to only pipeline jobs that explicitly request them. During open beta, GitLab Secrets Manager follows the beta support policy and might not be ready for production use. To share feedback, see issue 598100. GitLab Duo Developer enhancements for merge request workflows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo Developer now supports multiple trigger methods: assign it to an issue, select Generate MR, or @mention it in any issue or MR discussion thread to turn feedback, To-do items, and design questions into code changes, follow-up MRs, or research summaries. With AGENTS.md and agent-config.yml configured, GitLab Duo Developer runs your tests and checks before committing. After a top-level group or instance administrator enables the Developer Flow, GitLab automatically adds mention and assign triggers to eligible projects. Dependency scanning by using SBOM generally available Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab SBOM-based dependency scanner is now generally available. Maven, Gradle, and Python projects now have complete visibility into vulnerabilities across their full dependency tree, including vulnerable packages introduced transitively, not just those declared directly. The analyzer now includes automatic dependency resolution for Maven, Gradle, and Python projects. When a lockfile or resolved dependency graph is not present, the analyzer automatically invokes tooling to resolve the full transitive dependency graph before scanning. Dependency resolution is enabled by default and requires little-to-no additional configuration beyond including the v2 Dependency Scanning template. For projects where dependency resolution is not possible, the analyzer falls back to manifest scanning. It parses pom.xml, requirements.txt, build.gradle, and build.gradle.kts to identify direct dependencies. Manifest scanning ensures teams always get a starting point for vulnerability coverage, even for projects without lock or build files. Manifest scanning is enabled by default and returns direct dependencies only. For full transitive coverage, enable dependency resolution or provide a dependency lockfile or graph export manually. Agentic Core GitLab Duo Core moves to usage-based billing Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Starting in GitLab 19.0, GitLab Duo Core moves to usage-based billing. Code Suggestions in the Web IDE and desktop IDEs now consume GitLab Credits. GitLab Duo Chat is also changing. For GitLab Duo Core users, Chat is now agentic and runs on GitLab Duo Agent Platform. To use GitLab Duo Chat in the GitLab UI or desktop IDEs, enable GitLab Duo Agent Platform for your instance or top-level group. Filter exact code search results by repository Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now filter exact code search results by repository. With the repo: syntax, you can directly scope your search query to specific repositories or repository patterns without having to go to individual projects. For example, searching for def authenticate repo:my-group/my-project returns results only from that repository. You can also use partial paths or patterns to match multiple repositories. Merge request ready event trigger Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now configure flows and external agents to run on the Merge request ready event. When a draft merge request is marked as ready for review, GitLab Duo automatically runs the flow or external agent. To configure a trigger, go to AI > Triggers in your project. This feature is behind the merge_request_ready_flow_trigger feature flag, disabled by default. Claude Opus 4.7 now available in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Claude Opus 4.7 is now available in GitLab Duo Agent Platform. Opus 4.7 delivers meaningful improvements to complex, multistep tasks that require sustained reasoning, precise instruction following, and self-verification before surfacing results. This includes flows supporting CI/CD pipelines, code review, vulnerability resolution, and more. Support for self-hosted Gemini models Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform Self-Hosted is now compatible with Gemini models. Gemini models support multiple flows, including the Code Review Flow, SAST Vulnerability Resolution Flow, Fix CI/CD Pipeline Flow, and more. Expanded open source model support in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform now supports additional open source models for self-hosted deployments, including Devstral 2 123B, GLM-5.1-FP8, and others. This helps customers power agentic workflows across a variety of environments, including offline and network-restricted deployments. Per-session tool approvals with admin controls Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Before GitLab Duo Agentic Chat can use a tool on your behalf, it requires your approval. Each tool invocation requires a separate approval. Now, you can approve a trusted tool once for an entire session and streamline your workflows. Administrators control whether tool approval for sessions is available. The following settings cascade from instance to group to project: On by default Off by default Always off Groups and subgroups can modify the setting unless an administrator sets it to Always off. The default setting is Off by default, ensuring each tool invocation requires explicit approval unless an administrator changes it. Resolve merge conflicts with GitLab Duo (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases. Now GitLab Duo can autonomously analyze merge conflicts, edit the conflicting files, create a commit, and push to the source branch. Trigger conflict resolution from the Resolve conflicts page or directly from the merge request widget. When complete, GitLab Duo posts a summary comment so reviewers can see what changed. GitLab Duo respects branch protection rules and does not force-push to protected branches. This feature is in beta and is gated behind the mr_ai_resolve_conflicts feature flag, enabled by default. Restrict the AI Catalog to a group hierarchy Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Top-level group Owners can now restrict the AI Catalog to show only agents and flows owned by projects within their group hierarchy. This blocks agents, external agents, or flows not in this hierarchy from being visible or enabled by any user in that group. Purchase credits on the Free tier on GitLab Self-Managed Tier: Free Offering: GitLab Self-Managed Links: Documentation · Related Issue Free tier users on GitLab Self-Managed can now unlock the full power of GitLab Duo Agent Platform, no Premium or Ultimate subscription required. Choose your monthly credit amount, commit to an annual term, and get instant access to AI-powered development tools. Credits refresh automatically each month, so your team always has what it needs to build faster and smarter. Admin-defined network access controls for Agent Platform remote flows Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators can now define centralized network policies for GitLab Duo Agent Platform remote flows directly in Settings. Top-level group administrators on GitLab.com, and instance administrators on GitLab Self-Managed and Dedicated, can configure organization-wide domain denylists and allowlists that projects inherit automatically. An additional setting controls whether projects can extend the approved domain list with custom entries. Policies are enforced at runtime across all remote flows, giving security and platform teams a consistent governance layer for agent network egress. Unified DevOps and Security Auto remediation for vulnerable dependencies (Experiment) Tier: Ultimate Offering: GitLab.com Links: Documentation · Related Issue Auto remediation for dependencies is now available as an experiment in GitLab 19.0. When dependency scanning detects a vulnerable Ruby dependency with a known fix, GitLab automatically opens a merge request to update it to a safe version without human input. Only Ruby projects are supported in the experiment. After each pipeline, GitLab identifies the highest-severity vulnerability with an available patch or minor version upgrade. GitLab generates the manifest file change and opens a merge request through a service account. The merge request then goes through your project’s standard review and approval workflow. During the experiment, up to three auto-remediation merge requests can be open per project at a time. To share feedback or request to try out the experiment make a comment on epic 600511. To enable the experiment on your project, a GitLab team member must enable the dependency_management_auto_remediation feature flag for your project. Dependency scanning in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab 18.11 introduced security configuration profiles for SAST and secret detection. Now, dependency scanning is also available with the Dependency Scanning - Default profile. This profile gives you a unified control surface to apply standardized SCA coverage across all of your projects without editing a single CI/CD configuration file. The profile activates two scan triggers: Merge Request Pipelines: Automatically runs a dependency scanning scan each time new commits are pushed to a branch with an open merge request. Results include only new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s dependency posture. Dependency resolution for Gradle SBOM scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab dependency scanning using SBOM now automatically generates a dependency graph (gradle.graph.txt) for Gradle projects. Previously, Gradle dependency scanning required you to generate a dependency graph manually as part of your build. Now, when a graph file is not available, the analyzer generates one automatically, removing this manual step for Java and Kotlin projects using Gradle. Remediation guidance for API security testing findings Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue API security vulnerability reports now include remediation guidance for each finding. Previously, API security testing identified vulnerabilities but provided no guidance on how to fix them. Developers had to research remediation steps independently. Now, each finding includes vulnerability-specific remediation steps and references to relevant OWASP and CWE identifiers directly in the vulnerability report. Remediation guidance is now included for the following checks: Application information Cleartext authentication CORS DNS rebinding Framework debug mode Heartbleed OpenSSL vulnerability HTML injection Insecure HTTP methods JSON hijacking JSON injection Open redirect OS command injection Path traversal Sensitive file Sensitive information Session cookie Shellshock SQL injection TLS configuration Authentication token XML injection Security data in merge request Reports tab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Merge requests include a new Reports tab that shows all findings from security scans, license compliance results, and code quality reports for the pipeline. GitLab bot comments in the activity feed are still available to view any policy violations that prevent the merge request from being merged. Improved array support for CI/CD inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue CI/CD inputs now have improved support for working with arrays. Use the array index operator [] to access specific elements within array inputs. This enhancement provides more flexible and powerful input interpolation capabilities in your pipeline configurations, enabling you to reference individual array items directly without additional processing steps. Select multiple values for pipeline inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, you could only select a single value when selecting input options in the UI, limiting flexibility for pipelines with more complex options. Now when you run a pipeline with inputs from the UI, you can select multiple values from a dropdown list and the selected values are combined into an array, for example ["option1","option2"]. This makes it easy to restart services on multiple instances, build multiple Docker images, run tests with multiple tag combinations, or perform any operation across multiple targets in a single pipeline run. Detailed CI/CD Catalog component usage analytics Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When you manage a CI/CD component in the GitLab Catalog, usage details are critical for managing upgrades, enforcing compliance, and communicating breaking changes. You need to know which projects use your components, and which versions they are using. Previously, this information was not available, making it difficult to notify the right maintainers, plan deprecations safely, or ensure projects stay current with the latest security patches. The component usage details view in the catalog resource page now shows exactly which projects use each component, the version they are running, and whether they are on the latest version or an outdated one. Projects using older versions are surfaced at the top, so you can prioritize outreach, drive adoption of security fixes, and ensure a smooth upgrade path across your organization. Configure parallel pipeline limits for merge trains Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you couldn’t change the maximum of 20 parallel pipelines in a merge train, which forced you to either overwhelm your runners or skip merge trains entirely. Now you can configure the parallel pipeline limit per merge train to balance runner load and merge throughput. You can set the limit per project or instance-wide. Setting the limit to 1 means each merge request runs one at a time, against a clean target branch. Thanks to Norman Debald (@Modjo85) for this community contribution. Customize default merge request titles Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the default title for a new merge request came from the source branch or first commit, and you couldn’t enforce a consistent naming convention across your project. Now you can configure a default merge request title template per project. Templates support variables for the source branch, target branch, first commit subject, linked issue ID, issue title, and a human-readable version of the source branch name. For example, the template Resolve %{issue_id} "%{issue_title}" produces titles like Resolve 123 "Fix login bug". You can still edit the title before creating the merge request. Secure webhooks with HMAC signing tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The existing X-Gitlab-Token header sends a static secret in plain text, making webhooks susceptible to interception and replay attacks. You can now add a signing token to any webhook. GitLab uses the signing token to compute an HMAC-SHA256 signature over: The unique webhook ID. The request timestamp. The webhook payload. GitLab then sends the result in the webhook-signature header alongside webhook-id and webhook-timestamp headers, following the Standard Webhooks specification. You can recompute the signature to confirm requests genuinely came from GitLab and that the payload has not been modified. By also validating the timestamp, you can reject replayed requests. Thanks to Van Anderson and Norman Debald for their community contributions! Cross-project pushes using CI/CD job tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, you could only use a CI/CD job token (CI_JOB_TOKEN) to push to the same repository where the pipeline runs. Cross-project pushes required a personal access token or deploy token. You can now use a job token to push to another project when: The target project opts in. The user who starts the pipeline has at least the Developer role in the target project. This feature is behind the allow_push_to_allowlisted_projects feature flag, disabled by default in GitLab 19.0. Ask your administrator to enable it. Mermaid diagram rendering upgraded to version 11 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab now uses Mermaid version 11 for rendering diagrams in Markdown. Previously, GitLab supported Mermaid version 10. With this upgrade, you get access to all the new diagram types, syntax improvements, and bug fixes introduced in Mermaid 11, including enhanced rendering for flowcharts, sequence diagrams, and more. Rapid Diffs for merge request reviews (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, you would have to wait for the Changes tab to load all files before you could begin reviewing, which slowed down large reviews. Now you can use Rapid Diffs to review merge requests with faster initial load, smoother scrolling, and more responsive interactions across files. Rapid Diffs uses the same technology that already powers the commits page. Rapid Diffs is in beta. Some features from the classic diff experience aren’t yet available. You can switch back at any time. Watch the overview video and share your experience in the feedback issue. GitLab Runner 19.0 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.0 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Runner instrumentation: Feature negotiation, OTLP export client, and first job_execution span Add configurable prepare stage timeout to runner configuration Bug Fixes Comprehensive fixes for FF_SCRIPTS_TO_STEPS feature flag implementation SignatureDoesNotMatch error when downloading S3 cache Runtime error when GitLab Runner runs in AWS with S3 cache Broken RPM S3 download links for amd64, arm64, arm, and armhf in GitLab Runner 18.9.0 and later Negative exit codes are reported incorrectly on Windows Incorrect Kubernetes executor service container naming documentation The list of all changes is in the GitLab Runner CHANGELOG. Scale and Deployments PostgreSQL 17 minimum requirement Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The minimum supported version of PostgreSQL is now version 17. If you use the packaged PostgreSQL 16, upgrade the packaged PostgreSQL server before installing GitLab 19.0. Linux package support for Ubuntu 20.04 discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Ubuntu 20.04 reached end of standard support in May 2025. From GitLab 19.0, Linux packages are no longer provided for Ubuntu 20.04. GitLab 18.11 is the last release with packages for this distribution. Before upgrading to GitLab 19.0, migrate to Ubuntu 22.04 or another supported operating system. Redis 6 support removed Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Support for Redis 6 is removed in GitLab 19.0. If you use an external Redis 6 deployment, migrate to Redis 7.2 or Valkey 7.2 before upgrading. The bundled Redis included with the Linux package has used Redis 7 since GitLab 16.2 and is not affected. Mattermost removed from the Linux package Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Bundled Mattermost is removed from the Linux package in GitLab 19.0. If you currently use the bundled Mattermost, refer to Migrating from the Linux package to Mattermost Standalone for migration instructions. Customers not using the bundled Mattermost are not impacted. Linux package support for SUSE distributions discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Linux package support for SUSE distributions ends in GitLab 19.0, which affects openSUSE Leap 15.6, SUSE Linux Enterprise Server 12.5, and SUSE Linux Enterprise Server 15.6. GitLab 18.11 is the last version with Linux packages for these distributions. To continue to use SUSE distributions, migrate to a Docker deployment of GitLab. Spamcheck removed from Linux package and GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Spamcheck is removed from the Linux package and GitLab Helm chart in GitLab 19.0. Customers not currently using Spamcheck are not impacted. If you use the bundled Spamcheck, you can deploy it separately using Docker. No data migration is required. NGINX Ingress replaced by Gateway API with Envoy Gateway Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Gateway API with Envoy Gateway becomes the default networking configuration in the GitLab Helm chart in GitLab 19.0, replacing NGINX Ingress which reached end-of-life in March 2026. If migration to Envoy Gateway is not immediately feasible, you can explicitly re-enable the bundled NGINX Ingress, which remains available until its planned removal in GitLab 20.0. This change does not impact the NGINX used in the Linux package, or Helm chart instances using an externally managed Ingress or Gateway API controller. Bundled PostgreSQL, Redis, and MinIO removed from GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The bundled Bitnami PostgreSQL, Bitnami Redis, and MinIO charts are removed from the GitLab Helm chart and GitLab Operator in GitLab 19.0 with no replacement. These components were intended only for proof-of-concept and test environments and are not recommended for production use. If you run an instance with any of these bundled services, follow the migration guide to configure external services before upgrading to GitLab 19.0. Reliable SCIM user deprovisioning for large groups Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue For organizations managing large numbers of users through SCIM, deprovisioning group members could time out and return 500 errors. SCIM DELETE and PATCH requests now return a success response immediately. Membership removal is handled asynchronously, so identity providers and SCIM clients receive consistent success responses. Filter Credits dashboard by product and date (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue The in-product GitLab Credits dashboard now supports product filtering, date range selection, and Secrets Manager usage visibility. You can filter usage by product (including GitLab Duo and Secrets Manager) and date range, see a daily usage chart across selected products, and review per-user attribution with a Usage control status column. The dashboard also includes usage from service accounts so automated activity is reflected in per-user attribution, and surfaces non-billable and beta events such as Secrets Manager Open Beta activity. This gives you a complete view of credit consumption in your organization. Review prior months of Credits usage (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the Credits dashboard showed only the current billing month, so you couldn’t compare trends, audit a usage spike after the fact, or build a budget conversation around prior consumption. Now you can navigate to prior billing months in the Credits dashboard.

GitLab 18.11 release notes

On April 16, 2026, GitLab 18.11 was released with the following features. In addition, we want to thank all of our contributors, including this month’s notable contributor. This month’s Notable Contributor: Rinku C We are excited to recognize Rinku C, a Level 4 contributor with over 80 merged improvements across GitLab since joining in September 2025. Nominated by Arianna Haradon, Senior Fullstack Engineer on the Developer Relations team, this award celebrates his sustained and meaningful impact over time. Rinku has strengthened security-sensitive flows by requiring scopes on project and group access token creation forms, and improved everyday GitLab experience with numerous updates like next/previous navigation in job logs, excluding empty searches from recent, and reducing file tree clutter through thoughtful UI refinements that make common workflows clearer and easier to navigate. Rinku tackles the work that often goes unclaimed, keeping the codebase healthy and compounding to meaningful, lasting value. Thank you for your contributions! Primary features Vulnerability resolution generally available on GitLab Duo Agent Platform Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue Agentic SAST Vulnerability Resolution is now generally available in GitLab 18.11 on the GitLab Duo Agent Platform. It runs as part of your SAST scan, after SAST false positive detection runs, or when manually triggered for individual SAST vulnerabilities. Agentic SAST Vulnerability Resolution: Autonomously analyzes the finding and reasons through the surrounding code context. Automatically creates a ready-to-review merge request with proposed code fixes for critical and high severity SAST vulnerabilities. Provides quality assessments so reviewers can quickly gauge confidence in the proposed remediation. Allows you to apply resolutions directly from vulnerability details pages. We welcome your feedback in issue 585626. GitLab Data Analyst Foundational Agent now generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related epic The Data Analyst Agent is a specialized AI chat assistant that helps you query, visualize, and surface data across the GitLab platform. Backed by the GitLab Query Language (GLQL), the Data Analyst can retrieve and analyze data about each of the supported data sources, and provide clear, actionable insights about your software development health and engineering efficiency. These insights can be visualized directly in the agent output and embedded directly into issues and epics for further evaluation. CI Expert Agent launches in beta Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The AI-powered CI Expert Agent is now available in beta. This agent helps teams get from GitLab code to a first working pipeline without starting from a blank .gitlab-ci.yml. Using GitLab Duo Agent Platform, the agent inspects your repository, asks a few guided questions about your build and test process, and generates a ready-to-run pipeline you can review, edit, and commit. This turns pipeline creation into a conversational, context-aware experience, while still letting you take full control of the YAML after you’re ready to evolve and optimize your configuration. Automated vulnerability severity overrides Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Default vulnerability severities don’t always reflect your organization’s actual risk. A critical CVE in an internal-only service might not warrant the same urgency as one in a public-facing application, yet teams spend significant time triaging findings that don’t match their risk model. Vulnerability management policies can now automatically adjust the severity of vulnerabilities based on conditions like CVE ID, CWE ID, file path, and directory. When applied, the policy updates the severity of any vulnerability that matches the criteria on the default branch. Manual overrides still take precedence, and all changes are logged in the vulnerability’s history and audit events. This reduces triage work and ensures developers focus on the findings that matter most to your business. Create Service Account in subgroups and projects Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Teams can now create service accounts in subgroups and projects. Instead of broad, top-level group bots, you can attach a dedicated service account to a single subgroup or project and manage its access like any other member of that namespace. Group and subgroup service accounts can be invited to the group where they were created or to any descendant subgroups and projects. Project service accounts are limited to their own project. Service Accounts available on GitLab Free Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Service accounts are now available on GitLab.com in all tiers. Previously limited to Premium and Ultimate, service accounts let you perform automated actions, access data, or run scheduled processes without tying credentials to individual team members. They’re commonly used in pipelines and third-party integrations where credentials must stay stable regardless of team changes. On GitLab Free, you can create up to 100 service accounts per top-level group, including those created in subgroups or projects. Fine-grained permissions for personal access tokens now available (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Fine-grained personal access tokens (PATs) are now available in beta. Unlike legacy PATs, which grant access to every project and group you belong to, fine-grained PATs let you limit each token to specific resources and actions. This reduces the potential impact of a leaked or compromised token. Your existing PATs continue to work as before, and you can still create legacy PATs without fine-grained permissions. This beta release covers approximately 75% of the GitLab REST API. Full REST API coverage, GraphQL enforcement, and administrator policy controls are planned for the GA release. To share feedback, see epic 18555. Top CWE chart in security dashboards Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic The top CWE chart is now available on the new security dashboards. Identify the most common CWEs across your project or instance to identify opportunities for training, improvement, or program optimization. Users can group the dashboard data by severity and filter the dashboard by severity, project, and report type. Deploy Gitaly on Kubernetes Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now deploy Gitaly on Kubernetes as a fully supported deployment method. This gives you greater flexibility in managing your GitLab infrastructure by using Kubernetes orchestration capabilities for scaling, high availability, and resource management. Previously, Kubernetes deployments required custom configurations and weren’t officially supported, making it difficult to maintain reliable Gitaly deployments in containerized environments. Reconfigure inputs when manually running MR pipelines Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue A powerful aspect of CI/CD inputs is that you can manually run new pipelines with new values for runtime customization. This was not available in merge request (MR) pipelines before, but in this release you can now customize inputs in MR pipelines too. After you configure inputs for MR pipelines, you can optionally modify those inputs and change the pipeline behavior any time you run a new pipeline for a merge request. Agentic Core Default model for GitLab Duo Agentic Chat updated from Haiku 4.5 to Sonnet 4.6 Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue We’ve made an update to improve your Agentic Chat experience in GitLab. The default model for Agentic Chat was upgraded from Claude Haiku 4.5 to Claude Sonnet 4.6, hosted on Vertex AI. Claude Sonnet 4.6 offers improved reasoning and response quality but uses a higher GitLab Credit multiplier than Haiku 4.5. You can select an alternative model, including Haiku, using the model selection setting. If you’ve already selected a specific model, your choice is preserved. This update only affects the default and will not override any existing selections. For information about credit multipliers by model, see the GitLab Credits documentation. Configure tools in custom flow definitions Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now configure tool options and parameter values directly in your custom flow definitions to supersede the LLM default values. This gives you more precise, consistent control over how tools behave within a custom flow, making it easier to enforce guardrails and specific parameter values across that flow. Mistral AI now supported as a self-hosted model in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue GitLab Duo Agent Platform now supports Mistral AI as an LLM platform for self-hosted model deployments. GitLab Self-Managed customers can configure Mistral AI alongside existing supported platforms, including AWS Bedrock, Google Vertex AI, Azure OpenAI, Anthropic, and OpenAI. This gives teams more choice in how they run AI-powered features. Scale and Deployments View historical months in GitLab Credits dashboard Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The GitLab Credits dashboard in Customers Portal now supports historical month navigation. Billing managers can browse past billing months to review daily usage trends, compare consumption patterns across periods, and reconcile usage with invoices. Previously, the dashboard only displayed the current billing month. With this improvement, administrators can make more informed decisions about credit allocation and forecast future needs based on historical data. Set subscription-level usage cap for GitLab Credits Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation Administrators can now set a monthly usage cap for On-Demand Credits at the subscription level. When total on-demand credit consumption reaches the configured cap, GitLab Duo Agent Platform access is automatically suspended for all users on that subscription until the next billing period begins or the admin adjusts the cap. This setting gives organizations a hard guardrail against unexpected overage bills, removing a key barrier to broader Agent Platform rollout. Caps reset automatically each billing period, and administrators receive an email notification when the cap is reached. Set per-user GitLab Credits cap Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation Administrators can now set an optional per-user usage cap for GitLab Credits per billing period. When an individual user’s total credit consumption reaches the configured limit, GitLab Duo Agent Platform access is suspended only for that user, while other users continue unaffected. This prevents any single user from consuming a disproportionate share of the organization’s credit pool, and gives administrators fine-grained control over usage distribution. Per-user usage caps work alongside subscription-level usage caps, by applying the cap that is reached first. Linux package improvements Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue In GitLab 19.0, the minimum-supported version of PostgreSQL will be version 17. To prepare for this change, on instances that don’t use PostgreSQL Cluster, upgrades to GitLab 18.11 will attempt to automatically upgrade PostgreSQL to version 17. If you use PostgreSQL Cluster or opt out of this automated upgrade, you must manually upgrade to PostgreSQL 17 to be able to upgrade to GitLab 19.0. Backup and Restore Support for Container Registry Metadata Database Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue The GitLab backup Rake task for Linux package installations and the [backup-utility](https://docs.gitlab.com/charts/backup-restore/) for Cloud Native (Helm) installations now support the container registry metadata database. You can now back up references to blobs, manifests, tags, and other data stored in the metadata database, enabling recovery in the event of malicious or accidental data corruption. New navigation experience for groups in Explore Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic We’re excited to announce improvements to the groups list in Explore, making it easier to discover groups across your GitLab instance. The redesigned interface introduces a tabbed layout with two views: Active tab: Browse all accessible groups, helping you discover relevant communities and projects. Inactive tab: View archived groups and groups pending deletion for visibility into group lifecycle status. These changes streamline group discovery and provide clearer visibility into which groups are available to join. Asynchronous transfer of projects Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic In previous versions of GitLab, transfers of large groups and projects could timeout. As we move groups and projects to use a unified state model for operations such as transfer, archive, and deletion, you get more consistent behavior, better visibility into state history and audit details, and fewer timeouts, specifically, for long running transfer operations through asynchronous processing. Unified DevOps and Security ClickHouse is generally available for Self-Managed deployments Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue For GitLab Self-Managed instances, we now have improved recommendations and configuration guidance for the GitLab ClickHouse integration. Customers have options to bring their own cluster, or use the ClickHouse Cloud (recommended) setup option. This integration powers multiple dashboards and unlocks access to various API endpoints within the analytics space. This scalable, high-performance database is part of the larger architectural improvements planned for the GitLab analytics infrastructure. Enhanced GitLab Duo Agent Platform analytics on Duo and SDLC trends dashboard Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: Duo Pro, Duo Enterprise Links: Documentation | Related epic The GitLab Duo and SDLC trends dashboard delivers improved analytics capabilities to measure the impact of GitLab Duo on software delivery. The dashboard now includes new single stat panels for monthly Agent Platform unique users and Agentic Chat sessions. Additionally, metrics previously displayed as a % usage compared to seat assignments have been updated to strictly report usage counts. This change resolves the issue where counts were missing Agent Platform usage controlled under the new usage billing model. GLQL now has access to projects, pipelines, and jobs data sources Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation The GitLab Query Language (GLQL) now has access to three new data sources: projects, pipelines, and jobs. These new data sources are also available as embedded views, letting teams surface pipeline results, job statuses, and project overviews directly in wikis, issue and merge request descriptions, and repository Markdown files. GLQL also powers the Data Analyst Agent. With these new types, the agent can inspect CI/CD job results, debug failures, and provide detailed overviews of pipeline execution, as well as provide an accurate overview of projects in a namespace. Dependency resolution for Maven and Python SBOM scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic GitLab dependency scanning using SBOM now supports generating a dependency graph automatically for Maven and Python projects. Previously, dependency scanning required users to provide a lock file or a graph file to get an accurate dependency analysis. Now, when a lock file or graph file is not available, the analyzer automatically attempts to generate one. This improvement makes it easier for Maven and Python projects to enable dependency scanning without requiring a lock file. Incremental scanning for Advanced SAST Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can now perform incremental scans that analyze only changed parts of the codebase with GitLab Advanced SAST, significantly reducing scan times compared to full repository scans. This feature is a further iteration of diff-based scanning, because it produces full results for codebases. By scanning just the code that has changed rather than the entire codebase, your teams can integrate security testing more seamlessly into their development workflow without sacrificing speed or adding friction. Unverified vulnerabilities (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Advanced SAST can now surface unverified vulnerabilities (findings that cannot be fully traced from source to sink) directly in the vulnerability report. Enable this feature if you have a higher tolerance for false positives over false negatives. This feature is in beta status. Provide feedback in issue 596512. Kubernetes 1.35 support Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue GitLab now fully supports Kubernetes version 1.35. If you want to deploy your applications to Kubernetes and access all features, upgrade your connected clusters to the most recent version. For more information, see supported Kubernetes versions for GitLab features. Prefer mode for the container registry metadata database Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue You can now set the container registry metadata database to prefer mode, a new configuration option alongside the existing true and false values. In prefer mode, the registry automatically detects whether it should use the metadata database or fall back to legacy storage based on the current state of your installation. If your registry has existing filesystem metadata that has not been imported to the database, the registry continues to use legacy storage until you complete a metadata import. If the database is already in use, or on a fresh installation, the registry uses the database directly. In a later release, prefer mode will become the default for new Linux package installations. Existing installations will not be affected. For more information, see issue 595480. Package protection rules now support Terraform modules Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Teams publishing Terraform modules through the built-in GitLab Terraform module registry had no way to restrict who could push new module versions. Package protection rules supported several package formats but did not include terraform_module, leaving infrastructure teams without a project-level push control. You can now create package protection rules scoped to terraform_module, restricting push access based on minimum role. Support is available in the UI package type dropdown, the REST API, the GraphQL API, and the GitLab Terraform provider resource. Release evidence now includes packages Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue When creating a GitLab Release, packages published to the package registry were not automatically associated with it. Teams had to manually construct package URLs and attach them as release links through the API or pipeline scripts, adding friction and risk of incomplete release records. GitLab now automatically includes packages in release evidence when the package version matches the release tag. This creates a verifiable, auditable link between your release and its associated packages without any manual steps, keeping source code, artifacts, and packages together in one complete release snapshot. Wiki sidebar toggle repositioned for easier access Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The wiki sidebar toggle is now positioned on the left side, directly next to the sidebar it controls. When the sidebar is collapsed, the toggle remains visible as a floating control so you can reopen it without scrolling back to the top of the page. Sticky action bar on wiki pages Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The action bar on wiki pages is now sticky, so it remains visible as you scroll through a page. Previously, you had to scroll back to the top to access actions like editing, viewing page history, or managing templates. Now the page title and key actions, including Edit, New page, Templates, Page history, and more, stay within reach no matter how far down the page you are. Epic weights Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Epics now support weights, making it easier to estimate and prioritize large-scale initiatives during planning. Before breaking down an epic into child issues, you can assign a preliminary weight to represent your initial estimate. As you decompose the epic, the weight automatically updates to reflect the rolled-up total from all child issues. This is consistent with how weight rollup works for issues and tasks. On the epic detail page, you can see both the preliminary weight and the rolled-up weight from child issues, giving you the insight needed to refine estimates over time. Block merge requests with high exploitability risk Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Previously, merge request (MR) approval policies could block MRs based on vulnerability severity, but not all vulnerabilities carry the same risk. CVSS severity alone doesn’t tell you whether a CVE is being exploited or how likely exploitation is. This leads to noisy approval policies and wasted time for developers and security teams. You can now configure MR approval policies using Known Exploited Vulnerability (KEV) and Exploit Prediction Scoring System (EPSS) data. Block or require approval when a finding is in the KEV catalog (actively exploited in the wild), or when its EPSS score is above a threshold. Policy violations in the MR include KEV and EPSS context so developers understand why the security gate was triggered. This gives security teams precise control over which findings block or warn, reduces alert fatigue, and keeps enforcement aligned with the current threat landscape. Assign CVSS 4.0 scores to vulnerabilities Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic CVSS 4.0 is the latest version of the industry standard used to assess and rate the severity of a vulnerability. You can now view and access CVSS 4.0 score in the UI, including the vulnerability details page and the vulnerability report. You can also query the score using the API. Improved row interaction in the vulnerability report Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Previously, you had to select the row description to navigate to a vulnerability details page from the vulnerability report. You can now select anywhere in the row to go directly to its details. Link styling for the vulnerability description and file location only appears when you hover over each link, and keyboard navigation has been improved. These changes make the vulnerability report more intuitive and accessible. Export a security dashboard as a PDF Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can export the security dashboard as a PDF for use in reports and presentations. The export captures the current state of all of the charts and panels in the dashboard, including any active filters. SAST scanning in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic In GitLab 18.9, we introduced security configuration profiles with the Secret Detection - Default profile. In GitLab 18.11, profiles now extend to SAST with the Static Application Security Testing (SAST) - Default profile, giving you a unified control surface to apply standardized static analysis coverage across all your projects without touching a single CI/CD configuration file. The profile activates two scan triggers: Merge Request Pipelines: Automatically runs a SAST scan each time new commits are pushed to a branch with an open merge request. Results only include new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s SAST posture. Security attribute filters in group security dashboards Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can now filter the results in a group security dashboard based on the security attributes that you have applied to the projects in that group. The available security attributes include the following: Business impact Application Business unit Internet exposure Location Security Manager role (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation The Security Manager role is now available as a beta feature, providing a new default set of permissions designed specifically for security professionals. Security teams no longer need Developer or Maintainer roles to access security features, eliminating over-privileging concerns while maintaining separation of duties. Users with the Security Manager role have the following access: Vulnerability management: View, triage, and manage vulnerabilities across groups and projects, including vulnerability reports and security dashboards. Security inventory: View a group’s security inventory to understand scanner coverage across all projects. Security configuration profiles: View security configuration profiles for a group. Compliance tools: View audit events, compliance center, compliance frameworks, and dependency lists for a group or project. Secret push protection: Enable secret push protection for a group. On-demand DAST: Create and run on-demand DAST scans for a group. To get started, go to a group and select Manage > Members to invite and assign members to the Security Manager role. Identifier list popover in the vulnerability report Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The vulnerability report now shows the primary CVE identifier as a clickable link in each row. When multiple identifiers exist, a "+N more" popover lists all of the identifiers. Each identifier in the list links to its external reference (for example, in the CVE, CWE, or WASC databases) so you can quickly access more details without leaving the report. GitLab Runner 18.11 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation We’re also releasing GitLab Runner 18.11 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Create concrete helper image with bundled dependencies Read the job router feature flag from the runner configuration instead of an environment variable Bug Fixes Incorrect runner binary path after refactoring Pipeline hangs on cache operations The docker-machine binary in GitLab Runner 18.9.0 references CVE-2025-68121 Runner silently falls back to job payload credentials when credential helper binary is missing from DOCKER_AUTH_CONFIG CONCURRENT_PROJECT_ID not unique in different jobs, which causes a conflict in the builds directory Artifact upload fails with timeout awaiting response headers User-defined after_script executes after failed pre_build_script and bypasses post_build_script The list of all changes is in the GitLab Runner CHANGELOG. Related topics Bug fixes Performance improvements UI improvements Deprecations and removals Upgrade notes

GitLab 18.11 released with automated remediation & new foundational agents

GitLab 18.10 release notes

On March 19, 2026, GitLab 18.10 was released with the following features. In addition, we want to thank all of our contributors, including this month’s notable contributor. This month’s Notable Contributor: Harshith Sudar Harshith is currently a Level 3 Contributor who has made impactful contributions improving community tooling and analytics, from triage automation and contributor recognition to GitLab Duo usage insights. Harshith’s contributions were first recognized by Lee Tickett, Fullstack Engineer in DevRel Engineering at GitLab, who nominated him. His work has strengthened how we support contributors behind the scenes through improvements to our automation and contributor-facing experiences. For example, he expanded our triage automation by updating the IssueSummary processor in triage-ops to work with multiple projects, including contributors.gitlab.com, making it easier for us to keep more community projects consistently summarized and visible. He also helped recognize community-created content through the new “Add content” button and flow, which lets contributors log blog posts, videos, and other content directly from their profile and get rewarded. Harshith has also contributed to our analytics and GitLab Duo usage insights. Highlights include refining how GitLab Duo usage is calculated, improving how AI impact over time can be explored by removing the 180-day default, and consolidating DORA metric date range constants, as well as enhancing analytics at scale with improvements like adding infinite scroll for the Value Stream Analytics custom stage label picker. Together, these changes help teams better understand how GitLab is used in real projects. In his own words: “One thing I’ve really enjoyed while contributing is how thoughtfully ideas are discussed within the community. It’s encouraging to see suggestions explored collaboratively, like in the discussion around MR !1288, which turned into a great learning experience. I’m really happy to be part of this community and look forward to making many more contributions in the future.” Thank you, Harshith, for your ongoing work to improve the GitLab codebase and contributor experience! Want to connect with Harshith and learn more about his contributions? Visit Harshith’s GitLab profile and his LinkedIn profile. Primary features SAST false positive detection with GitLab Duo Agent Platform Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: Duo Core, Duo Pro, Duo Enterprise Links: Documentation | Related epic SAST false positive detection, which was first introduced as a beta in GitLab 18.7, is now generally available in GitLab 18.10. When a security scan runs, GitLab Duo Agent Platform analyzes each critical and high severity SAST vulnerability and determines the likelihood that it’s a false positive. The assessment appears directly in the vulnerability report, giving teams the context they need to triage with confidence rather than uncertainty. Key capabilities include: Automatic analysis: False positive detection runs automatically after each security scan with no manual intervention required. Manual option: Users can manually run false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Limiting the analysis to critical and high severity SAST vulnerabilities cuts through the noise where it matters most. Contextual AI reasoning: Each assessment explains why a finding may or may not be a false positive, factoring in code context, data flow, and vulnerability characteristics specific to static analysis. Seamless workflow integration: Results surface directly in the vulnerability report alongside existing severity, status, and remediation information — no changes to existing workflows required. This feature is available for Ultimate customers with GitLab Duo Agent Platform. The feature must be enabled in your group or project settings. We welcome your feedback in issue 583697. Purchase GitLab Credits on the Free tier on GitLab.com Tier: Free Offering: GitLab.com Add-ons: GitLab Credits Links: Documentation | Related epic Free tier group Owners on GitLab.com can now unlock AI with GitLab Credits. Purchase a monthly credit amount, commit to an annual term, and get access to GitLab Duo Agent Platform agents and flows. Credits refresh automatically each month, so your team always has what it needs to build faster and smarter. Key highlights: Usage-based pricing: Purchase a monthly credit commitment without needing a base plan subscription. Self-service purchasing: Buy credits through the GitLab purchase flow. Seamless upgrade path: Your credit commitment transfers if you later upgrade to Premium or Ultimate. Consumption tracking: Monitor your credit usage through the GitLab Credits dashboard. This purchase option is currently only available for free GitLab.com top-level groups. Sign in securely with passkeys Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic GitLab now supports passkeys for passwordless sign-in and as a phishing-resistant two-factor authentication (2FA) method. Passkeys use public-key cryptography and biometric authentication (fingerprint, face recognition) or your device PIN to securely access your account. Passkeys offer the following benefits: Passwordless convenience: Sign in with your device’s biometrics or PIN instead of remembering a password. Multi-device support: Use passkeys on desktop browsers, mobile devices (iOS 16 or later, Android 9 or later), and FIDO2/WebAuthn-compatible hardware security keys. Phishing-resistant security: Your private key never leaves your device. GitLab only stores the public key, protecting your account even if GitLab servers are compromised. Automatic 2FA integration: For accounts with 2FA enabled, passkeys become available as your default 2FA method. To get started, add a passkey in your account settings. We welcome your questions and feedback in issue 366758. Introducing the work items list and saved views Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic The GitLab planning experience is getting a significant upgrade with the work items list and saved views, bringing together two long-requested capabilities: The work items list combines epics, issues, and other work items into a single unified list, eliminating the need to switch between separate pages for different work item types. This makes it easier to understand relationships across your planning objects. Saved views allow you to create and save customized list configurations, including filters, sort order, and display options. This makes routine checks more efficient, and supports standardized ways of viewing work across your team. This is the next step in the GitLab work items journey, a unified architecture designed to deliver consistency and unlock new capabilities across GitLab planning tools. Share your thoughts and feedback in issue 590689. Custom agents can use MCP to access external data Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation | Related issue You can now connect custom agents in the AI Catalog to external data sources and tools through the Model Context Protocol (MCP), without leaving GitLab. This feature is an experiment. Share your feedback in issue 593219. Enforce merge request title naming conventions with regex Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Maintaining consistent merge request titles is important for teams that rely on structured naming conventions. Whether that’s following the Conventional Commits format, or linking to an internal tracking system. Teams previously needed external tooling or custom CI/CD pipeline jobs to enforce these conventions, but this approach had a critical gap. If someone changed the merge request title after the pipeline ran, there was no re-validation, and the MR could still be merged with a non-compliant title. You can now configure a required title regex for merge requests in your project settings. When configured, GitLab evaluates the merge request title against the pattern as a mergeability check — blocking the merge until the title is updated to comply, regardless of when the title was last changed. To set this up, go to your project’s Settings > Merge requests and enter a regex pattern in the Merge request title must match regex field. Your existing merge request workflows continue to work as before. This check only applies to projects where you explicitly configure a title regex. Secret false positive detection with AI (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: Duo Core, Duo Pro, Duo Enterprise Links: Documentation | Related epic Security teams spend significant time investigating secret detection findings that turn out to be false positives. For example, test credentials, example values, and placeholder tokens that are incorrectly flagged as actual secrets. False positives create alert fatigue, erode trust in scan results, and divert attention from genuine security risks. GitLab 18.10 introduces AI-powered secret false positive detection (beta) to focus on the secrets that actually matter. When a security scan runs, GitLab Duo automatically analyzes each Critical and High severity secret detection vulnerability to determine if it’s a false positive. The AI assessment appears directly in the vulnerability report, giving security engineers immediate context to make faster and confident triage decisions. Key capabilities include: Automatic analysis: False positive detection runs automatically after each security scan without manual trigger. Manual trigger option: You can manually trigger false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Scoped for Critical and High severity vulnerabilities to maximize signal-to-noise improvement. Contextual AI reasoning: Each assessment includes an explanation of why the finding may or may not be a true positive, based on code context and vulnerability characteristics. Confidence scoring: Each detection includes a confidence score to help teams prioritize review based on the model’s certainty. Seamless workflow integration: Results surface directly in the vulnerability report alongside existing severity, status, and remediation information. This feature is available as a free beta for Ultimate customers and must be enabled in your group or project settings. Share feedback in issue 592861. Use runtime inputs with CI/CD jobs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Using CI/CD variables for dynamic job configuration can be challenging. Variables follow a complex override hierarchy that’s difficult to manage, and they can’t be used for a variety of use cases. Now you can use inputs to define explicit, typed inputs at the job level. Use job inputs to define and control the values that a job accepts at runtime. With job inputs, you get: Type safety (string, number, boolean, array). Default values that can be static or reference existing variables. The option to define a strict list of possible values to use. Regex support for validating input values. Job inputs can use the default values without any user interaction, but you can modify the values when retrying a job or running a manual job. Agentic Core GitLab Blob Search for group and instance code search Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The [gitlab_blob_search](../../user/duo_agent_platform/agents/tools.md) tool now enables GitLab AI agents to search your code: Across all projects in a group. Across all accessible projects on an instance. Previously, blob search was limited to a single project, or required specifying explicit project IDs. This change makes it easier for AI-powered workflows to discover and reuse code that’s spread across multiple related projects. GitLab MCP server tool for pipeline management Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now manage your CI/CD pipelines in a GitLab project with the new manage_pipeline tool. This GitLab MCP server tool lets AI agents create, cancel, retry, delete, and update pipeline metadata in a single call. With this tool, you no longer have to piece together multiple steps to automate your pipeline workflows. If you want to see other GitLab MCP sever tools, let us know in the feedback issue. Project Maintainers can enable custom agents and flows Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Previously, enabling AI agents and flows from the AI Catalog required top-level group permissions. Now, when browsing the AI Catalog at the explore level or project level, project Maintainers can enable agents and flows directly in their projects. Configure network access control for remote flows in projects Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now configure network access controls for flows using GitLab runners in projects. This provides secure external integrations, while maintaining control over network destinations. This also gives project maintainers the flexibility to allow necessary API connections, MCP servers, and third-party services while enforcing security boundaries. Configure network access controls in the network_policy section of agent-config.yml. The agent-config.yml is protected by branch protection rules and MR approval workflows. Self-hosted Vertex AI for GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue Vertex AI is now a supported LLM platform within GitLab Duo Agent Platform Self-Hosted. Customers can now configure Anthropic models hosted on Vertex AI for use with GitLab Duo Agent Platform features. Users can enable agents and flows directly from projects Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Maintainers and Owners can now enable agents and flows directly from their project or the explore page, without navigating away from their current context. Top-level group Owners can also select their group, and the specific projects where they want to activate agents and flows, streamlining their workflow setup. Support for Agent Skills in IDEs and CI/CD pipelines Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue GitLab Duo Agent Platform now supports the Agent Skills specification, an emerging standard for giving AI agents new capabilities and expertise. You can define Agent Skills at the workspace level for your project to give agents specialized knowledge and workflows for specific tasks, like writing tests in a specific framework. Agents automatically discover and load relevant skills as they encounter matching tasks. You can also trigger skills manually by name, file path, or custom slash commands. Agent Skills are accessible for flows and Agentic Chat in your IDE, and for flows run in CI/CD pipelines. They also work with any other AI tool that supports the specification. Scale and Deployments Download credit usage data as CSV Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Billing managers can now download credit usage data as a CSV file directly from the GitLab Credits dashboard in Customers Portal. The export provides a daily, per-action breakdown of credit consumption for the current billing month, including commitment, waiver, trial, on-demand, and included credits used. Finance and operations teams can use this data to perform cost allocation, chargeback reporting, and usage analysis in Excel, Google Sheets, or BI tools without manual data gathering or support requests. Link credit usage to GitLab Duo Agent Platform sessions Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The GitLab Credits dashboard now links credit consumption directly to the GitLab Duo Agent Platform session that generated it. In the per-user drill-down view, the Action column for Agent Platform usage rows (such as Agentic Chat or Foundational Agents) is now a clickable hyperlink that navigates to the corresponding session details. This link provides a direct audit trail from billing to AI session behavior, so administrators can investigate credit usage, support escalations, and compliance reviews without manually correlating timestamps across separate systems. Sort users in the GitLab Credits dashboard Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Enterprise administrators can now sort the Usage by User table in the GitLab Credits dashboard by total credits used or by username. The default sort order is by total credits consumed (highest first), so the top consumers are immediately visible without scrolling. With this view, administrators managing thousands of GitLab Duo users can quickly identify high-usage individuals for cost allocation, chargeback reporting, and license utilization audits. New navigation experience for projects in Explore Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic We’ve streamlined the projects page in Explore to reduce clutter and remove redundant options that accumulated over time. The simplified interface now focuses on two core views: Active tab: Discover projects with recent activity and ongoing development. Inactive tab: Access archived projects and those scheduled for deletion. We’ve removed several redundant tabs: Most starred projects can be found by sorting Active or Inactive tabs by star count. All projects are available by viewing both Active and Inactive tabs. Trending tab will be fully removed in GitLab 19.0 due to limited functionality and low usage. The cleaner design aligns with other project lists for visual consistency. You can still access all the same content through more logical organization and flexible sorting options. Unified DevOps and Security Dependency Scanning with SBOM support for Java Gradle build files Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue GitLab dependency scanning by using SBOM now supports scanning Java build.gradle and build.gradle.kts build files. Previously, dependency scanning for Java projects using Gradle required a lock file to be present. Now, when a lock file is not available, the analyzer automatically falls back to scanning build.gradle and build.gradle.kts files, extracting and reporting only direct dependencies for vulnerability analysis. This improvement makes it easier for Java projects using Gradle to enable dependency scanning without requiring a lock file. To enable manifest fallback, set the DS_ENABLE_MANIFEST_FALLBACK CI/CD variable to "true". Dependency scanning SBOM-based scanning extended to self-managed Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation | Related issue In GitLab 18.10, we’re extending limited availability status to self-managed instances for the new SBOM-based dependency scanning feature. This feature was initially released in GitLab 18.5 with limited availability for GitLab.com only, behind the feature flag dependency_scanning_sbom_scan_api and disabled by default. With additional improvements and fixes, we now have confidence to reliably use the new SBOM scanning internal API and enable this feature flag by default. This internal API allows the dependency scanning analyzer to generate a dependency scanning report containing all component vulnerabilities. Unlike the previous behavior (Beta) that processed SBOM reports after CI/CD pipeline completion, this improved process generates scan results immediately during the CI/CD job, giving users instant access to vulnerability data for custom workflows. Self-managed customers who encounter issues can disable the dependency_scanning_sbom_scan_api feature flag. The analyzer will then fall back to the previous behavior. To use this feature, import the v2 dependency scanning template Jobs/Dependency-Scanning.v2.gitlab-ci.yml. We welcome feedback on this feature. If you have questions, comments, or would like to engage with our team, please reach out in this feedback issue. License scanning support for Dart/Flutter projects using Pub package manager Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic GitLab now supports license scanning for Dart and Flutter projects that use the pub package manager. Previously, teams building with Dart or Flutter were unable to identify the licenses of their open source dependencies directly within GitLab, creating compliance blind spots for organizations with license policy requirements. License data is sourced directly from pub.dev, the official Dart package repository, and results are surfaced alongside other supported ecosystems. Dart/Flutter dependency scanning and vulnerability detection were already supported. Conan 2.0 package registry support (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue C and C++ development teams using Conan as their package manager have long requested registry support in GitLab. Previously, the Conan package registry was experimental and only supported Conan 1.x clients, limiting adoption for teams that have migrated to the modern Conan 2.0 toolchain. The Conan package registry now supports Conan 2.0 and has been promoted from Experimental to Beta. This release includes full v2 API compatibility, recipe revision support, improved search capabilities, and proper handling of upload policies including the --force flag. Teams can publish and install Conan 2.0 packages directly from GitLab using standard Conan client workflows, reducing the need for external artifact management solutions like JFrog Artifactory. With this update, platform engineering teams managing C and C++ dependencies can consolidate their package management within GitLab alongside their source code, CI/CD pipelines, and security scanning. The Conan registry supports both project-level and instance-level endpoints, and works with personal access tokens, deploy tokens, and CI/CD job tokens for authentication. We welcome feedback as we work toward general availability. Please share your experience in the epic. Manage container virtual registries with a dedicated UI (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic When the container virtual registry launched in beta last milestone, platform engineers could aggregate multiple upstream container registries — Docker Hub, Harbor, Quay, and others — behind a single pull endpoint. However, all configuration required direct API calls, meaning teams had to maintain scripts or manual curl commands to create and manage their registries, configure upstreams, and handle changes over time. This added operational overhead and made the feature inaccessible to users who weren’t comfortable working directly with the API. Container virtual registries can now be created and managed directly from the GitLab UI. From the group-level container registry page, you can create new virtual registries, configure upstream sources with authentication credentials, edit existing configurations, and delete registries you no longer need — all without leaving GitLab or writing a single API call. The UI integrates seamlessly with the existing container registry experience, making virtual registries a first-class part of your group’s artifact management workflow. This feature is in beta. To share feedback, please comment in the feedback issue. GitLab Helm Chart registry generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Teams using Helm to manage Kubernetes application deployments can now rely on the GitLab Helm Chart registry for production workloads. Previously in beta, the registry is now generally available following the resolution of key architectural and reliability concerns. The path to GA included resolving a hard limit that prevented the index.yaml endpoint from returning more than 1,000 charts, fixing a background indexing bug that caused newly published chart versions to be missing from the index, completing a full AppSec security review, and adding Geo replication support for Helm metadata cache, ensuring high availability for self-managed customers running GitLab Geo. Platform and DevOps teams can publish and install Helm charts directly from GitLab using standard Helm client workflows, with support for project-level endpoints and authentication using personal access tokens, deploy tokens, and CI/CD job tokens. Now you can keep charts alongside the source code, pipelines, and security scanning that depend on them. Task item support in Markdown tables Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now use task item checkbox syntax directly in Markdown table cells. Previously, achieving this required a combination of raw HTML and Markdown, which was cumbersome and difficult to maintain. This improvement makes it easier to track task completion directly within structured table layouts in issues, epics, and other content. Pipeline secret detection in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation In GitLab 18.9, we introduced security configuration profiles with the Secret Detection - Default profile, starting with push protection. You use the profile to apply standardized secret scanning across hundreds of projects without touching a single CI/CD configuration file. The Secret Detection - Default profile now also covers pipeline-based scanning, providing a unified control surface for secret detection across your entire development workflow. The profile activates three scan triggers: Push Protection: Scans all Git push events and blocks pushes where secrets are detected, preventing secrets from ever entering your codebase. Merge Request Pipelines: Automatically runs a scan each time new commits are pushed to a branch with an open merge request. Results only include new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s secret detection posture. Applying the profile requires no YAML configuration. The profile can be applied to a group to propagate coverage across all projects in the group, or to individual projects for more granular control. macOS Tahoe 26 and Xcode 26 job image Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation | Related epic You can now create, test, and deploy applications for the newest generations of Apple devices using macOS Tahoe 26 and Xcode 26. With hosted runners on macOS, your development teams can build and deploy macOS applications faster in a secure, on-demand build environment integrated with GitLab CI/CD. Try it out today by using the macos-26-xcode-26 image in your .gitlab-ci.yml file. GitLab Runner 18.10 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation We’re also releasing GitLab Runner 18.10 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Allow k8s runner to define Pod Level Resources for build pod Add automation to update Go versions and packages for all Runner projects Bug Fixes S3 cache with RoleARN returns 403 instead of 404 for non-existent cache Using helper image gitlab-runner-helper:x86_64-v16.11.1-nanoserver21H2 results in init-permissions error MacOS: LaunchAgent - Service could not initialize on M1 architecture The list of all changes is in the GitLab Runner CHANGELOG. Related topics Bug fixes Performance improvements UI improvements Deprecations and removals Upgrade notes