GitLab

GitLab 19.3 release notes

On August 20, 2026, GitLab 19.3 was released with the following features. We are excited to recognize gkepas as this month’s Notable Contributor! Giannis has made sustained contributions across the GitLab codebase, the contributor platform, client-go, the Terraform provider, and GitLab Orbit. He is also an active translator and a member of the GitLab Community Discord. Primary features Flow Creator foundational agent Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use the Flow Creator, a purpose-built foundational agent in the AI Catalog, to create custom flows for the GitLab Duo Agent Platform through a plain-language conversation. With the Flow Creator, you describe what you want the flow to do, and the agent produces a complete, runnable flow YAML you can register and use immediately. The agent can also help you debug existing flows and explain framework concepts. GitLab Secrets Manager now available on GitLab.com Tier: Premium, Ultimate Offering: GitLab.com Add-ons: GitLab Secrets Manager Links: Documentation · Related Issue Credential leaks often start the same way: a developer needs a secret, has no good place to put it, and drops it into an over-scoped CI/CD variable or a committed config file. GitLab Secrets Manager, now in Limited Availability on GitLab.com, makes credentials more secure and keeps them in the same platform that runs your pipelines. Each secret is scoped to the job that needs it, based on environment, branch, and branch protection, so a compromised credential can’t reach more than it’s authorized to. Secrets Manager uses your existing group and project permissions, so there’s no separate access model to maintain. Every create, update, and read is logged to your audit trail, so a leak investigation doesn’t mean stitching together logs from multiple systems. GitLab Secrets Manager is an add-on billed through GitLab Credits. Start a free 30-day trial to explore all features. Learn more about billing and trials in the billing documentation. Agentic Core Resolve merge conflicts with GitLab Duo is generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases. Now you can ask GitLab Duo to resolve conflicts for you. Start conflict resolution from the merge widget or the Resolve conflicts page. GitLab Duo analyzes the conflicts, edits the files and commits the resolution to the source branch, and then posts a summary comment on the merge request describing what changed. Resolve review discussions with GitLab Duo is generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, to resolve a code review comment, you had to switch to your editor, implement the fix, commit and push the change, and then manually close the thread. Now you can select Resolve with GitLab Duo and GitLab Duo will address the review discussion for you. GitLab Duo reads the comment and the surrounding code, makes the requested change on the source branch, replies to the discussion with a summary of what changed, and then resolves the thread. If the change does not address the comment correctly, you or the reviewer can reopen the thread. GitLab Duo CLI plugins and marketplaces (Experiment) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI now supports plugins and plugin marketplaces as an experiment, introduced in GitLab Duo CLI 9.10.0. A plugin bundles Agent Skills, custom slash commands, and Model Context Protocol (MCP) servers into a single directory. A marketplace is a catalog of available plugins, hosted in a Git repository or a local directory. GitLab Duo CLI automatically registers the official gitlab-duo-plugins marketplace the first time you use plugins. The marketplace includes three skills for common GitLab workflows: mr-review: Reviews a merge request and posts comments. stack-changes: Splits a large local change into a stacked merge request chain. create-issue: Drafts a GitLab issue from a natural-language description. To install one of the skills, run glab duo cli plugin install @gitlab-duo-plugins or duo plugin install @gitlab-duo-plugins, based on your setup. For compatibility with the existing community plugin ecosystem, GitLab Duo CLI also reads .claude-plugin/marketplace.json files, so existing Claude Code plugin marketplaces work with GitLab Duo CLI without modification. New Agentic Chat UI in VS Code and JetBrains IDEs (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab Duo Agentic Chat interface in the GitLab for VS Code extension and the GitLab Duo plugin for JetBrains IDEs has a redesigned UI, now available as a beta. The new interface is a rebuilt version of the existing Agentic Chat panel, with the same underlying capabilities: AI models, agents, slash commands, and tool approvals. The redesigned UI is available in GitLab 19.3 with: GitLab for VS Code 6.88.1 and later GitLab Duo plugin for JetBrains IDEs 3.45.2 and later To use the new UI, turn on beta and experimental features for your top-level group or instance, then reload the extension. You can switch between the new and classic UI at any time from the panel. New MCP tools for reading and searching merge requests Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now use get_merge_request to retrieve a merge request along with its diffs, commits, notes, pipelines, or discussions in a single call, so your AI agent no longer has to chain multiple requests to get the full picture of an MR. You can also use the new list_merge_requests tool to search and filter merge requests by author, assignee, reviewer, state, labels, or free-text query, making it easy to find exactly the MRs you care about without leaving your workflow. Pre-register MCP OAuth applications Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, the mcp scope was hidden from the OAuth applications form in the Admin area, so you couldn’t pre-register an OAuth application for your MCP clients without using Dynamic Client Registration (DCR). Now you can create a shared OAuth application with the mcp scope directly from the Admin area, giving your users a stable client ID to reuse and helping you avoid DCR rate limits on shared networks. See which user authorized each MCP OAuth application Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, when MCP clients connected to GitLab using OAuth Dynamic Client Registration (DCR), all dynamically-registered OAuth applications appeared in the Admin Area with only a generic client name, making it impossible to tell which user authorized a given application. Now, when you approve an MCP OAuth connection, your username is automatically appended to the application name — for example, [Unverified Dynamic Application] kiro — authorized by @username. You can quickly identify which user is behind each dynamic OAuth application directly from the Admin Area, without any additional configuration. View agent task plan in session detail sidebar Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, when you opened a session detail page, you had to manually expand individual activity log entries to find the agent’s current task list. Now, the session detail sidebar shows the agent’s latest plan automatically. You can view each task and its status, and a progress summary like “2 of 5 completed.” You can track what the agent is working on and how far along it is without digging through the activity log. Devstral 2 deprecated for GitLab Duo Agent Platform Self-Hosted Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Mistral has deprecated the Devstral 2 model, and GitLab has deprecated Devstral 2 for GitLab Duo Agent Platform Self-Hosted. Mistral Medium 3.5 is a supported alternative available from Mistral. Support for Amazon Bedrock Mantle (Beta) Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue If you use GitLab Self-Managed with self-hosted models, you can now use Amazon Bedrock Mantle as a supported provider. Mantle is an OpenAI-compatible inference engine for Amazon Bedrock, so you can use familiar OpenAI SDKs and integrations with Bedrock models. This feature is in beta. Unified DevOps and Security Enforce merge trains Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, you couldn’t stop merges from bypassing the train. Both the option to merge immediately and the REST API could skip merge train protections without restriction. For teams running high-velocity monorepos, a single merge that skips the train can cancel and restart every in-progress pipeline, multiplying CI costs and straining infrastructure. Now you can enforce merge train usage across the UI and API with a single project-level setting, preventing bypasses that cancel and restart in-progress pipelines. Owners and Administrators can still override the setting when needed. GitLab Secret Scanning for Source Code (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue GitLab Secret Scanning for Source Code is now in beta, powered by a new GitLab-built scan engine. Unlike the default analyzer, which detects only known secret patterns, this analyzer also detects passwords and other unstructured secrets that fall outside standard ruleset coverage. It also uses multiple heuristic techniques to reduce false positives. The new analyzer replaces the default analyzer in the same secret_detection job, matching existing vulnerability findings instead of creating duplicates. To get started, see turn on the analyzer. During beta, only high-confidence findings are reported. We welcome any feedback you have in issue 609578. Secret detection scans commit history on default branch pushes Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Secret detection on the default branch now scans all commit diffs in a push when a prior commit reference is available, rather than scanning only the latest directory contents. This change closes a gap where secrets introduced and removed within the same push went undetected. The behavior now aligns with how secret detection works on merge requests and feature branches. This scanning catches secrets that briefly existed in your repository history even if removed before the pipeline completes. Security teams can now identify secrets that were ever committed, not just those present at HEAD. For more information, see pipeline secret detection coverage. Disable OAuth Dynamic Client Registration for MCP Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, MCP clients and AI tools could automatically register OAuth applications on your instance through Dynamic Client Registration (DCR), which you couldn’t turn off. This made it difficult for administrators on GitLab Self-Managed and GitLab Dedicated instances to control which OAuth clients could connect. Now you can disable DCR entirely using the application settings API, giving you full control over which OAuth clients can access your instance. When DCR is disabled, clients must use a pre-registered OAuth application instead of registering automatically. SPDX license expressions in CycloneDX SBOMs brought to GitLab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab 19.3 adds support for Software Package Data Exchange (SPDX) license expressions in CycloneDX Software Bill of Materials (SBOM) files you bring to GitLab. Previously, components with composite or custom licenses defined using SPDX expression syntax would appear as unknown. Now GitLab reads and stores the expression field from CycloneDX license entries, including complex expressions like MIT AND Apache-2.0 and custom license references using the LicenseRef-[NAME] syntax. SPDX expression support is especially useful for organizations that generate their own SBOMs and have components with complex or custom license expressions, giving you an accurate view of your license exposure without requiring GitLab-generated scans. For more information, see Bring your own CycloneDX SBOM. Audit events for secret push protection fail-open scenarios Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In earlier versions of GitLab, when secret push protection couldn’t complete a scan and allowed a push through unscanned, GitLab provided no customer-visible audit trail. Security and compliance teams had no way to monitor when secret push protection silently allowed a push to their repositories. GitLab 19.3 and later generates audit events for all fail-open scenarios, including ruleset errors, exceeded file and line limits, scan timeouts, and unexpected errors. Teams can now forward these events to external monitoring and alerting tools to maintain visibility into their security posture. Dependency scanning support for Bun Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, projects using the Bun JavaScript runtime and package manager had no dependency scanning coverage. Now, GitLab dependency scanning analyzes Bun projects by parsing bun.lock files (the text-based JSONC format introduced in Bun 1.2). Because Bun packages are sourced from the npm registry, the GitLab advisory database already covers these dependencies with no additional configuration required. Teams using Bun as an alternative to npm, yarn, or pnpm can now scan their projects for known vulnerabilities as part of their standard CI/CD pipelines. Eligible findings are also supported by dependency scanning auto-remediation. Execute SAST false positive and vulnerability resolution flows in bulk Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In the Vulnerability Report, you can now select multiple vulnerabilities and run SAST Vulnerability Resolution and SAST False Positive Analysis flows on all of them at once. GitLab Runner 19.3 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.3 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Document Job Router version compatibility matrix Verify Workhorse is in the KAS to Rails request path for Job Router Bug Fixes clear-docker-cache prunes all unused images when IMAGE_FILTER_FLAGS is empty Concrete-mode dispatch skips steps where When is unset PrintPodWarningEvents doesn’t work Custom executor fails when the .git folder is corrupt The list of all changes is in the GitLab Runner CHANGELOG. Kubernetes 1.36 support Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab now fully supports Kubernetes version 1.36. To deploy your applications to Kubernetes and access all features, upgrade your connected clusters to the most recent version. For more information, see supported Kubernetes versions for GitLab features. Redesigned vulnerability details page Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The vulnerability details page has been refreshed with an updated design that makes reviewing and triaging vulnerabilities easier and more efficient. SAST triage and remediation funnel Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The Security Dashboard now includes a SAST triage and remediation funnel. This funnel shows how critical and high SAST vulnerabilities move through triage and remediation over a 30-, 60-, or 90-day window. The funnel traces each stage: detected vulnerabilities, true positives confirmed by SAST false positive detection, vulnerabilities with merge requests created by Agentic SAST Vulnerability Resolution, and vulnerabilities fixed by merged merge requests. These stages show how much of your workflow AI powers and which stages you can scale further. Scale and Deployments PostgreSQL 18.4 option available for fresh installs using the Linux package Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue You can now opt-in to using PostgreSQL 18.4 when performing a fresh install using the Linux packages. Upgrades to PostgreSQL 18.4 for existing installations is not yet supported. For more information, refer to the relevant documentation. Restricted visibility for custom agents and flows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now set custom agents and custom flows to Restricted visibility for every group, subgroup, and project in your top-level group. Previously, you could only set a custom flow or agent to Private (one project only) or Public (visible to everyone on GitLab.com). When you set the visibility to Restricted, the flow or agent is visible to only groups, subgroup, and projects in your top-level group. This ensures that internal logic about your custom agents and flows are not shared outside your company or organization. Advanced SAST for iOS in beta Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Advanced SAST now supports Objective-C and Swift, bringing the same interprocedural taint analysis it delivers for other languages to iOS development. The beta is available for all GitLab Ultimate customers starting in GitLab 19.3. The beta detects key OWASP Mobile Top 10 vulnerability classes, including insecure data storage, broken cryptography, insecure communication, and authentication and authorization flaws. When a vulnerability begins in one language and reaches a sink in the other, Advanced SAST detects the complete taint path, including paths that cross the Swift and Objective-C language boundary. To enable, set GITLAB_ADVANCED_SAST_ENABLED: 'true' in your pipeline. If your project contains Objective-C or Swift files, the gitlab-advanced-sast-ext job runs automatically. For full setup instructions, see the Advanced SAST documentation. Share feedback in the beta feedback issue. Email notifications for GitLab Flex usage Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had no warning when your Flex usage approached a limit. GitLab now sends billing account managers an email notification when a product reaches 50%, 80%, or 100% of its monthly reservation, and when a capped product reaches its spend cap and is cut off for the rest of the billing period. Each threshold triggers at most one email per product per billing period, so you can act on overage early without getting repeat emails for the same threshold. GitLab Credits usage caps are generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue On-demand usage can run up overage charges you didn’t plan for. Usage caps for GitLab Credits are now generally available: set a subscription-level cap on on-demand credits in Customers Portal, and set a default per-user cap or per-user overrides with the GraphQL API. When consumption reaches a cap, features that consume GitLab Credits, like GitLab Duo Agent Platform, are suspended until the next billing period begins or an administrator adjusts the cap. Usage caps were introduced in GitLab 18.11 behind the budget_caps_graphql_api feature flag. In GitLab 19.3, the feature flag is removed. Per-capability spend caps for GitLab Flex Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue With GitLab Flex, overage from one capability draws down the same commitment every other capability depends on. You can now set a spend cap for each capability when you adjust your Flex reservation in the Customers Portal: Restricted (no overage past the reservation), Usage cap (a bounded amount of overage), or Unlimited (unlimited overage past the reservation). When a capped capability reaches its cap, its usage stops for the rest of the billing period, and capabilities without a cap keep running. Co-created contributions Branch names can carry the name of whoever created the branch Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can include the creator in branch name templates with a new %{branch_creator} variable, so a branch created from an issue can identify who created it rather than falling back to a generic name. Thank you to Radek Antoniuk for this contribution! LDAP group sync can now manage the Auditor role Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue You can now use LDAP group sync for GitLab Self-Managed instances to grant and revoke the Auditor role automatically. A new audit_group setting maps an LDAP group to Auditor, working the same way admin_group already did for administrators, so auditor access follows directory membership instead of being maintained by hand. Thank you to Sergey Pechenko for this contribution! More ways to filter and manage through the API Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Six improvements are now available across the REST and GraphQL APIs: Groups queries accept visibilityLevel and includeSubgroups, and can filter for groups scheduled for deletion with aimed_for_deletion. The merge requests REST API accepts merged_after and merged_before. Achievement award messages can be edited after being granted, rather than only set at award time. Administrators can reset SCIM tokens through the admin token API. CI_JOB_TOKEN can now fetch repository archives, which unblocks private Composer package downloads that broke when source fallback was deprecated. Thank you to the following users for these contributions! Colin Jacob Boby (MR) nagraj raikar (MR 1 MR 2) Niklas van Schrick (MR) Nicholas Wittstruck (MR) Alessandro Lai (MR) Other additions to the interface Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Improvements to the interface in this release include: You can press Esc to cancel a list item drag in an issue, work item, or epic description, instead of being stuck completing the move. Pipeline test report summary columns are now sortable, defaulting to most failures first. And archived labels say Archived in their tooltip, so you can tell at a glance why one looks different. Thank you to the following users for these contributions! Radek Antoniuk Saurav Kumar Nicholas Wittstruck Two new CI/CD variables: retry count and job tags Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Your pipeline scripts can now tell whether they are running for the first time. CI_JOB_RETRY_COUNT holds how many times the current job has been retried and is 0 on the first run, so retry-aware logic no longer needs you to track state yourself. Separately, CI_JOB_TAGS exposes the job’s own configured tags, where previously only the runner’s tags were visible through CI_RUNNER_TAGS. Both are available with no configuration. Thank you to Giannis Kepas and Dwight Blake for these contributions! Webhooks for merge request reviews and deployment approvals Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can use webhooks for merge request reviews and deployment approvals. When you submit a merge request review as Request changes or Reviewed, GitLab fires a merge_request webhook carrying a changes.reviewers entry, so external tools can react to review activity instead of just approvals. The deployment webhook gains blocked, approved, and rejected statuses with top-level approver and approval fields, letting you follow a deployment through its full approval lifecycle. The blocked status is available in all tiers. The approved and rejected statuses are available in Premium and Ultimate only, and approver.email is redacted. Thank you to Messias Tayllan (MR) and Anvita Gupta (MR) for these contributions!

GitLab 19.2 release notes

On July 16, 2026, GitLab 19.2 was released with the following features. We are excited to recognize vivekshukl007 as this month’s Notable Contributor! Vivek is a Senior Data Engineer at Emirates who made a high-impact contribution to add Scala language support to GitLab Orbit. This change improves the code graph capabilities for developers who work in Scala codebases. Primary features GitLab Duo CLI is now generally available Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI brings the GitLab Duo Agent Platform directly to your terminal. Use the CLI to ask complex questions about your codebase and to autonomously perform actions on your behalf. Unlike external tools, the CLI has context about your GitLab project, pipelines, and agent configurations. Key features include: Two modes: interactive chat mode and headless mode for CI/CD Administrator on/off control for GitLab Self-Managed and GitLab Dedicated Model selection and shared sessions Tool approvals Model Context Protocol (MCP) connections Slash commands, including commands for context usage and context compaction Support for skills and AGENTS.md customization files Install the GitLab Duo CLI through the GitLab CLI (glab) or as a standalone tool. GitLab Duo custom flows are now generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Custom flows are AI-powered workflows you create and configure to automate complex, multi-step tasks across your GitLab projects. They let teams define workflow steps, components, and triggers so repetitive development and operational work can run automatically in response to GitLab events. In the GitLab UI, flows run directly in GitLab CI/CD, helping teams automate common tasks without leaving GitLab. Key features include: YAML-defined, reusable workflows for team-specific automation Multi-agent orchestration for complex, multi-step tasks User-defined human-in-the-loop (HITL) checkpoints for approval or feedback at sensitive steps Native GitLab triggers, including mentions, assignments, pipeline events, and merge request lifecycle events Flow creation and management from projects or the AI Catalog Public and private visibility controls Secure execution using service accounts and composite identity YAML validation to catch configuration issues before runtime Scheduled pipeline execution policies are GA Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Scheduled pipeline execution policies are now generally available. Define a schedule once in a security policy project and enforce it across every project in scope, without editing each project’s .gitlab-ci.yml. If requirements change, update the policy in one place instead of coordinating changes across many CI/CD configuration files. Use scheduled policies to run compliance scripts, security scans, or other custom CI/CD jobs on a daily, weekly, or monthly cadence, independent of commit activity. This is useful for repositories without regular code changes, such as running dependency scans to detect newly discovered vulnerabilities. Each policy runs as a separate pipeline, with time zone support, time window distribution, and branch targeting. Start foundational flows from Agentic Chat Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you started foundational flows from specific UI actions, mentions, or assignments. Now you can start them from Agentic Chat in the GitLab UI as part of your conversation. When your request matches a specialist workflow, Agentic Chat hands off to one of these flows: Developer Flow: Implements changes or opens a merge request Code Review Flow: Reviews a merge request Fix CI/CD Pipeline Flow: Diagnoses and repairs a failed pipeline You approve the handoff in chat, then follow progress in the conversation or from AI > Sessions. Dependency scanning auto-remediation (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab 19.2 introduces Dependency scanning auto-remediation in Beta. The feature brings automated vulnerability remediation directly into your dependency scanning workflow, with two capabilities: Automated dependency version bumps, available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Agentic Breaking Change Resolution, available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated, and consumes GitLab Credits. Automated dependency version bumps automatically opens merge requests to update vulnerable dependencies to their safe versions. Once turned on, GitLab monitors your projects for vulnerable dependencies and opens remediation MRs without manual intervention. By default, updates target patch and minor versions. Agentic Breaking Change Resolution extends the remediation flow to handle complex updates. When a merge request that bumps dependency versions has a pipeline fails on a breaking change, GitLab Duo analyzes the pipeline errors, the dependency’s changelog, and how your code uses the dependency. GitLab Duo commits fixes to the same MR and re-runs the pipeline until the pipeline passes. When you enable Agentic Breaking Change Resolution, version bumps extend to include major versions. Together, the two capabilities form a complete remediation loop: GitLab opens the MR, and when the update is complex, GitLab Duo resolves it. For setup instructions, see Dependency scanning auto-remediation. Share feedback in the beta feedback issue. Non default branch tracking (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now track vulnerabilities on branches other than the default branch. For the best results, target a small number of long-lived release branches, such as branches for specific environments (project-qa, project-prod) or deployment platforms (project-iOS, project-android). This beta includes the following capabilities: Add tracked branches on the security configuration page, up to twice the number of projects in the namespace. Filter by branch on the vulnerability report. Filter by branch on the project-level security dashboard. Track all vulnerability types on tracked branches, including CVEs, which were previously out of scope. Keep vulnerability status metadata consistent when a branch merges into the default branch. Update vulnerability status on tracked branches. Selective GitLab Duo availability for subgroups Tier: Ultimate Offering: GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Administrators of GitLab Dedicated instances can make GitLab Duo and GitLab Duo Agent Platform unavailable for selected subgroups while other subgroups still have the option to turn them on. Previously, you could either disable GitLab Duo and Agent Platform for an entire instance, or make them potentially available for all. Now you can enforce a default-deny, per-subgroup allowlist. Mark specific subgroups as Always off (locked) so their descendant groups and projects can never enable GitLab Duo and Agent Platform, while leaving other subgroups up to the discretion of users with the Owner role. Only administrators can apply or remove the lock, and affected Owners see clear messaging that GitLab Duo is locked by a parent group. This feature helps compliance and platform governance teams meet strict data-classification requirements. AI audit event report (beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue AI audit event reports are now available in beta, giving security and compliance teams a unified, downloadable record of GitLab Duo agent activity. Previously, agent activity was scattered across pipeline jobs and event histories, making it difficult to reconstruct a session for: Incident investigation. Compliance review. AI governance reporting. Now, each agent session produces a comprehensive audit artifact capturing: Inputs. Model and configuration context. The chronological event timeline. Outputs. You can browse AI audit events from the Governance page, filter by agent and session details, drill into individual events, and download the underlying session artifact. Security Review Flow (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Security Review Flow detects business logic vulnerabilities directly in merge requests. Unlike static analysis tools that scan for known patterns, Security Review Flow reasons about the intent of your code and identifies authorization bypasses, data exposure, and logic errors that pattern-based scanners routinely miss. To request a review, assign the Duo Security Review service account as a reviewer on your merge request. The flow analyzes the diff and posts findings as threaded comments at the exact lines where vulnerabilities occur, each with a Common Weakness Enumeration (CWE) classification, severity rating, and where possible, an inline suggested fix you can apply without leaving the merge request. Each review consumes GitLab Credits based on the complexity of the merge request diff. Agentic Core Bulk AI Catalog items enablement Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue When enabling public custom and external agents and public custom flows in the AI Catalog, you can now select up to 100 projects in a single action, instead of selecting individual projects one at a time. Configure ID tokens in flows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Use ID tokens to authenticate with third-party OpenID Connect (OIDC) services without storing long-lived credentials. For example, use ID tokens for keyless signing of binaries and commits, or to retrieve secrets from a secrets manager. To use this feature, update your agent configuration to include the id_tokens keyword, then configure the service to trust tokens issued by GitLab Duo Agent Platform. Custom Agent validation Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, you could save a custom agent in AI Catalog whose prompt would fail when run. For example, prompts that tripped security rules caused the agent to silently do nothing when being used. Now, when you create or update a custom agent, GitLab validates the prompt configuration, and tells you about any errors before you save that agent. Turn on MCP server independently from the Agent Platform Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue To give you finer control over how external tools connect to your GitLab instance or group, you can now turn the GitLab MCP server on or off independently from Agent Platform settings. Previously, the GitLab MCP server and Agent Platform shared the same on and off setting, so you could not turn the MCP server on without also turning on Agent Platform features. Now you can let other tools access GitLab as an MCP server without turning on the Agent Platform, or keep the GitLab MCP server turned off while you use Agent Platform features. Automatic rebase before merge Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, if your project used the semi-linear or fast-forward merge method, you had to complete an additional step when the source branch fell behind the target branch. To merge, you had to select Rebase, wait for it to complete, then return to the merge request to select Merge. That two-step handoff added friction to every merge. You can now select Enable automatic rebase prior to merge in your project’s merge request settings. When the setting is on, GitLab rebases the source branch onto the target branch at merge time and you can merge with a single action. If it’s important to preserve GPG signatures on individual commits, you can leave the setting off. Code Review Flow for GitLab Duo Enterprise seats Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, when users with GitLab Duo Enterprise seats requested a code review from GitLab Duo, GitLab Duo Code Review would complete the review. This would occur even if Code Review Flow was turned on for the group. There was no way to turn on the agentic flow for all users. Now, top-level group Owners can change this default and configure all code reviews to use Code Review Flow instead, regardless of the user’s seat. All reviews will consume GitLab Credits. This change gives users with GitLab Duo Enterprise seats the same repository-wide context awareness, multi-step reasoning, and review sessions as everyone else. Exclude merge requests from automatic code reviews (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, when automatic reviews were turned on for a project or group, GitLab Duo reviewed every eligible merge request. This included bot-authored dependency updates, feature branches, and experimental work, not just changes the team actually wanted feedback on. You can now exclude specific merge requests from automatic reviews using exclusion rules. Define a .gitlab/duo/mr-review-automated-rules.yaml file for a project or group, with exclusion rules based on the author, source branch, or target branch. Rules support glob patterns like dependabot/* or *-bot. You can still request a review manually for any excluded merge request. This feature is in beta and is gated behind the duo_code_review_automated_rules feature flag, enabled by default. GitLab MCP server is now available for Free users Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use the GitLab MCP server without a paid subscription, making it easier than ever to connect your AI tools and agents to GitLab regardless of your plan. This means you get seamless, AI-powered automation and integration capabilities right out of the box, with no subscription upgrade required. Instance-level custom review instructions Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you could only define custom review instructions for GitLab Duo at the project or group level. Administrators who wanted consistent review guidance across an entire instance, such as security rules or internal coding standards, had to duplicate the same instructions in every project. Now you can configure custom review instructions for an entire instance. As an administrator, select a project in your instance to use as a template. When GitLab Duo performs a code review, it combines the instructions from the instance-level .gitlab/duo/mr-review-instructions.yaml file with any group-level and project-level instructions. This gives organizations a single source of truth for instance-wide review standards. Both Code Review Flow and GitLab Duo Code Review support instance-level custom instructions. Resolve review discussions with GitLab Duo (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, to resolve a code review comment, you had to switch to your editor, implement the fix, commit and push the change, and then manually close the thread. You had to repeat the cycle for every unresolved discussion, and the context-switch overhead would add up across a busy review. You can now select Resolve with GitLab Duo on any review discussion. GitLab Duo reads the review comment and the code around it, implements the change the reviewer described, and commits it to your branch. GitLab Duo then replies to the discussion with a short summary of what changed and why, and resolves the thread for you. You can review the changes and reopen the thread if the fix doesn’t address the comment correctly. Usage billing checks for GitLab Duo Agent Platform Self-Hosted Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated for Government Links: Documentation · Related Issue For GitLab Self-Managed customers using self-hosted models with an online license, the GitLab Duo Health now checks that the GitLab instance can reach the following endpoints: Customers Portal The AI Gateway Duo Workflow Service Connection to these endpoints is necessary for usage billing. Previously, if a firewall blocked any of these components, administrators had no indication of connectivity issues until users were unable to use a feature. Administrators can now use this new validation check to diagnose issues and review their firewall allowlist before any disruption to users. Unified DevOps and Security CI Expert Agent is now generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The CI Expert Agent is now generally available. This AI-powered assistant helps you create, debug, and optimize GitLab CI/CD pipelines. It analyzes your repository and provides guidance through your pipeline configuration. The generally available (GA) release builds on the Beta and design-partner program, and brings the agent to production use with real customer workloads to reduce the barrier to CI/CD adoption in your projects. The agent integrates with Orbit: when Orbit and its Knowledge Graph are enabled, the agent draws on graph-based code intelligence for more contextual pipeline recommendations. Orbit and the Knowledge Graph are in Beta. Fix CI/CD Pipeline Flow suggests targeted fixes Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab Duo’s Fix CI/CD Pipeline Flow now gives you two core improvements: When relevant files are already in your merge request diff, you get fixes as code suggestions directly on that merge request. The flow classifies pipeline failures before acting, so you get a more targeted diagnosis. The flow also analyzes child pipeline failures across the full pipeline hierarchy, lets you customize its behavior for your project with an AGENTS.md file, and collapses AI reasoning by default to keep your merge request comments clean. Share your feedback in the feedback issue. Disable built-in project templates Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When organizations rely on custom project templates, built-in vendor templates can add noise to the template selection experience and, in some cases, bypass server-side hooks or other repository controls. Administrators can now disable built-in project templates globally from the Admin area, or at the group level for subgroups. The setting cascades automatically so you do not need to configure it for every group individually. Administrators can enforce the value of the setting to ensure groups or subgroups cannot override it. Both the instance and group settings are also manageable with the REST and GraphQL APIs. On GitLab.com, only the group-level setting is available. Fine-grained PAT permissions generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Fine-grained personal access tokens (PATs) are now generally available. Unlike legacy PATs, which grant access to every project and group you belong to, fine-grained PATs allow you to limit each token to specific resources and actions. This makes it easier to apply the principle of least privilege to automation and integrations, which helps reduce the potential impact of a leaked or compromised token. To make setup easier, use the Add permissions with Duo feature to choose the correct permissions during token creation. Your existing legacy PATs continue to work as before. For new tokens, GitLab recommends fine-grained PATs so each token is scoped only to the resources and actions it needs. With the GA release, fine-grained PATs now have complete coverage for REST API endpoints, and coverage for the most commonly used GraphQL types and mutations. GitLab Flavored Markdown references in personal snippets Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now use GitLab Flavored Markdown (GFM) references with personal snippets in two ways: GitLab processes GFM references inside personal snippet descriptions and comments, just like in project snippets and other areas of GitLab. You can reference a personal snippet from anywhere GFM is supported, such as comments and issue or merge request descriptions, using the $ syntax that already works for project snippets. Because snippet IDs are unique across personal and project snippets, each ID resolves to a single snippet. Recognize contributors with GitLab Achievements Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously GitLab had no built-in way to formally recognize team members, customers, and contributors for their work. Efforts often went unacknowledged, and communities lacked a consistent way to celebrate the people who make their projects successful. You can now create custom achievements at the group level and award them to users for their contributions. Each achievement includes a name, description, and avatar. Awarded users can choose which achievements to display on their profile. Achievements give maintainers a visible way to reward participation and help build stronger, more motivated communities. Thank you to Niklas van Schrick for your contributions to this feature! Security manager can configure agentic flows Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Users with the Security Manager role can now configure SAST VR, SAST FP, Secrets FP, and Dependency Scanning VR for projects. Vulnerability report exports correctly apply filters Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue When exporting a vulnerability report with filters applied, the exported CSV file only includes the filtered data. GitLab Runner 19.2 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.2 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New GitLab Runner now emits the environment key during the job-complete PUT request GitLab Runner now includes a circuit breaker that automatically falls back to Rails when KAS job requests fail consecutively Bug Fixes Secret resolution failures are misclassified as runner_system_failure Jobs fail with context deadline exceeded when you update GitLab Runner to 19.1.0 Jobs fail intermittently with context deadline exceeded in the Docker executor Artifact downloads fail when FF_CONCRETE is enabled KAS Job Router GetJob latency histogram doesn’t show any data in staging Automatic runner token rotation causes Docker Autoscaler executor to prune active instances and fail running jobs The list of all changes is in the GitLab Runner CHANGELOG. Scale and Deployments GitLab Duo reads and responds to reviews in merge requests Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now use GitLab Duo and MCP-based agents to read merge request review conversations. This gives your AI assistant the full context of reviewer feedback, unresolved threads, and discussion history. You can ask your agent to summarize review comments, draft responses to feedback, and post replies directly to merge request discussions without ever leaving your workflow. Hosted runners for GitLab Dedicated are generally available Tier: Ultimate Offering: GitLab Dedicated Links: Documentation · Related Issue Hosted runners for GitLab Dedicated are now generally available. GitLab provisions, patches, and scales runners for you, within the same security and compliance boundary as your GitLab Dedicated instance. Key capabilities include: AWS EC2 instances in the same region as your GitLab Dedicated instance, running in single-tenant, ephemeral VMs destroyed after each job Secure outbound PrivateLink connection to your GitLab instance Linux x86-64 and Arm64 runners in five sizes, from small to 2X-large 99.9% uptime SLA, calculated separately from your GitLab Dedicated instance SLA, to ensure your workflows remain stable, resilient, and online You create and manage hosted runners yourself in Switchboard, and pay only for what you use, with usage tracked on the GitLab Credits dashboard. To get started, contact your customer success manager or account representative. AI Gateway for GitLab Dedicated Tier: Ultimate Offering: GitLab Dedicated Links: Documentation · Related Issue The AI Gateway for GitLab Dedicated runs in your AWS environment, in the same region as your GitLab Dedicated instance. Inference requests, including code inputs, prompts, and model responses, stay within your network and region. All GitLab Duo Agent Platform inference requests stay in the same audit scope as your GitLab Dedicated instance. The AI Gateway for GitLab Dedicated is enabled by default, with no setup required. Optionally, you can use Bring Your Own Model (BYOM) to connect to your own cloud-hosted models. You can power GitLab Duo Agent Platform capabilities with the models you choose, in your region, under your access controls.

GitLab 19.1 release notes

On June 18, 2026, GitLab 19.1 was released with the following features. We’d also like to announce this month’s Notable Contributor: Pishel65! We are excited to recognize Pishel65, a Level 3 contributor with 19 merged MRs and 9 more open since joining in October 2025. Primary features Secret false positive detection with GitLab Duo Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Secret false positive detection with the GitLab Duo Agent Platform is now generally available. Security teams spend significant time investigating secret detection findings that are incorrectly flagged as actual secrets. These false positives create alert fatigue, erode trust in scan results, and divert attention from genuine security risks. When a security scan runs, GitLab Duo automatically analyzes each critical and high severity secret detection vulnerability to determine if it is a false positive. The AI assessment appears in the vulnerability report, so you have immediate context for faster and more confident triage decisions. Key features include: Automatic analysis: Runs after each security scan without manual trigger. Manual trigger: Trigger false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Analyze only critical and high severity vulnerabilities to maximize signal-to-noise improvement. Contextual AI reasoning: Each assessment includes an explanation of why the finding is likely a true positive, based on code context and vulnerability characteristics. Confidence scoring: Each detection includes a confidence score to help teams prioritize review based on the model’s certainty. Seamless workflow integration: Results appear directly in the vulnerability report alongside existing severity, status, and remediation information. We welcome your feedback in issue 592861. Always on availability mode for GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Administrators can now set GitLab Duo to be always on for all projects in an entire instance or top-level group. When GitLab Duo is set to always on, group, subgroup, and project owners cannot turn off GitLab Duo, giving enterprises centralized AI governance for compliance and regulated environments. This new setting is symmetrical to the existing always off setting, closing a gap where GitLab Duo could be locked off but could not be locked on. This new setting is especially valuable for organizations with autonomous divisions or subsidiaries that need to guarantee consistent AI tooling across the business. To set GitLab Duo to be always on, go the instance or top-level group GitLab Duo settings and set GitLab Duo availability to Always on. Automatically assign Code Owners as reviewers Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, you needed to select reviewers for each merge request manually, even when a CODEOWNERS file already defined who should review each file. You can now configure a project to assign Code Owners as reviewers automatically. GitLab assigns every Code Owner that matches the changed files. This happens when a merge request is created in a ready state, or when a draft is marked ready. If you already assigned a reviewer, GitLab skips automatic assignment and keeps your choice. To turn on automatic reviewer assignment, go to Settings > Merge requests > Automatic reviewer assignment and select Automatically assign all code owners as reviewers. Compliance framework templates (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now create compliance frameworks from predefined templates. Previously, building a compliance framework required defining every requirement and control by hand, a repetitive process when a framework had dozens of controls. Now, when you create a new framework in the Compliance center, you can: Select Create from template to start from a preconfigured framework with requirements and controls already in place. Preview each template, customize the name, description, and color, and then apply it to your group in a single step. 19 templates are available, including ISO 27001:2022, SOC 2, FedRAMP, NIST, CIS, TISAX, and more. Improved secret detection coverage for feature branch pipelines Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In GitLab versions earlier than 19.1, you couldn’t trust a feature branch pipeline to surface every secret in your branch. A new branch scanned only the latest commit. An existing branch scanned only your most recent push. A credential leaked in an earlier commit could sit undetected, reaching shared branches or production before being flagged. Now you can catch those secrets where they’re cheapest to fix. In GitLab 19.1, secret detection scans every commit from the branch’s divergence point with the default branch to the latest commit. That means fewer secrets slip through to later stages, less time rotating exposed credentials after the fact, and consistent, predictable coverage across your branches. Tool approval guardrails for GitLab Duo agents (beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Administrators can now configure tool-level approval policies for GitLab Duo agents, gating sensitive actions with human approval at the moment of execution. Previously, after an AI agent was approved for a project, it could invoke any of its tools without further review, including write and destructive operations. Now, you can define rules for groups and projects that map each tool to one of three modes: Allow (execute silently). Ask (require human approval). Deny (block entirely). When an AI agent calls a tool in “ask” mode, the user is prompted with an inline approval card before execution proceeds. This beta release includes Agentic Chat, IDE, and flows, and emits audit events for every approval decision. Agentic Core Custom and external AI feature controls Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators and top-level group Owners can now control which AI agents and flows are available within their organization. They can: Prevent users from creating or enabling custom agents and flows. This ensures only centrally-approved AI automation is in use. Restrict users from enabling agents and flows owned by projects outside the group hierarchy. This limits exposure to unapproved external content. Custom flows YAML validation Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The AI Catalog now validates your custom flow configuration before saving or triggering it. Previously, syntax errors and misconfigured parameters in a custom flow (for example, missing inputs or unknown tool parameters) only surfaced at runtime, after a CI job had already started. This made debugging slow and difficult. Now, when you save or update a custom flow in the AI Catalog, GitLab checks the configuration upfront and surfaces any errors directly in the UI. Valid flows are unaffected and continue to save and trigger as usual. Pattern-based tool approval for Agentic Chat Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue This feature was removed on July 10, 2026. Previously, when Agentic Chat asked you to approve a tool invocation, you could approve it once or approve the tool call with these arguments for the remainder of the session. Different arguments would require additional approval. Workflows that repeated similar commands, such as a series of git operations, forced you through a stream of nearly identical prompts. You can now choose a third approval option, Approve all uses of this tool for session. This option approves invocations of the tool for the remainder of the session whenever the arguments match the approved pattern. Pattern-based approvals are available for Agentic Chat in the GitLab UI, GitLab Duo CLI, GitLab for VS Code, and the GitLab Duo plugin for JetBrains IDEs. Automatic code review for new GitLab customers Tier: Free, Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue Automatic reviews in Code Review Flow are now turned on by default for new GitLab Duo trial customers on GitLab.com, so you can start getting AI-powered feedback on your merge requests from day one — without any manual setup. With a new flat pricing model, you get immediate value from smarter, faster code reviews right out of the box. If needed, you can opt out in your group settings. Foundational flows readiness checks Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab Duo health checks now include foundational flows readiness checks, which verify: The instance-level flow execution setting is enabled. The instance-level foundational flows setting is enabled. At least one active instance runner with the gitlab--duo tag is registered and connected, and uses a Docker-compatible executor. GPT models for Code Review Flow Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, Code Review Flow supported only Anthropic Claude models. Teams that could not use Anthropic models due to contractual, policy, or procurement constraints had no way to run Code Review Flow. You can now select GPT-5.2 or GPT-5.3 Codex as the model for Code Review Flow. Top-level group Owners can switch the model for Agentic Code Review in Settings > GitLab Duo > Configure features, under GitLab Duo Agent Platform. The GPT models are hosted through the GitLab AI Gateway, so no additional configuration is required. Both models passed benchmark evaluation against the GitLab Duo code review dataset, with review quality comparable to the default Claude Sonnet 4.6 Vertex model. See the code review benchmark for results. Model selection allowlist Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue For GitLab Duo Agentic Chat, you can now configure an allowlist of approved models, and set an organization-wide default, if you are: On GitLab.com, a top-level group Owner. On GitLab Self-Managed, an instance administrator. This gives organizations control over which models users can select when using Agentic Chat. New event triggers for flows and external agents Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you could only run flows and external agents when the service account was mentioned, assigned, or added as a reviewer. Coordinating automation around the rest of the merge request lifecycle, or around work item creation, required external glue. You can now configure triggers for four additional events: Merge request ready: A user marks a draft merge request as ready for review. Previously released behind a feature flag, this event trigger is now generally available. Merge request code conflict: A merge request can no longer be merged because of a code conflict. Merge request approved: A merge request receives all its required approvals. Work item created: A user creates a work item in the project. To configure a trigger, go to AI > Triggers in your project, or select one when you enable a flow. Unified DevOps and Security Close coverage gaps with the Scanner Enablement Wizard Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use the Scanner Enablement Wizard to close scanner coverage gaps across your projects without manually identifying which projects need attention. Security configuration profiles define which scanners run and how. Security inventory shows scanner coverage across your projects and lets you bulk-apply profiles to selected projects or subgroups. The wizard adds a goal-driven workflow on top: you set the goal, and it finds the projects missing coverage and closes only those gaps. Custom lifetime for OAuth access tokens Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue By default, OAuth access tokens in GitLab expire after two hours. In GitLab 19.1, instance administrators on GitLab Self-Managed and GitLab Dedicated can set a custom lifetime for new OAuth access tokens. You can configure any value from 300 to 7200 seconds. This helps you enforce shorter-lived tokens for security-sensitive OAuth integrations, including MCP clients, without changing the behavior of existing tokens. Emoji reactions on wiki pages Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now add emoji reactions directly to wiki pages in both project and group wikis. Use the GitLab emoji picker to react to page content. Each page shows reaction counts and who reacted. Reactions persist across page edits and versions. Scheduled pipeline execution policies (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Scheduled pipeline execution policies are now available as a beta feature and no longer require an experiment flag to enable. You can enforce custom CI/CD jobs on a daily, weekly, or monthly cadence across your projects, independent of commit activity. Use scheduled policies to run compliance scripts, security scans, or dependency checks on repositories that may not have regular code changes. Scheduled policies now enforce variable precedence consistently with regular pipeline execution policies. Each security policy project supports up to five scheduled policies, and GitLab automatically cancels running pipelines when a policy is disabled or deleted. Configure schedules in YAML or the UI, with time zone support, time window distribution, branch targeting, and snooze functionality. Security Manager role generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The Security Manager role is now generally available, providing comprehensive access to security features including vulnerability management, security dashboards, policy configuration, and compliance tools. Security teams no longer need the Developer role or the Maintainer role to access security features, eliminating over-privileging concerns while maintaining separation of duties. Users with the Security Manager role have the following access: Vulnerability management: View, triage, and manage vulnerabilities across groups and projects. Security policies: View and manage security policies at the group level, and contribute to policy YAML at the project level. Security inventory: View scanner coverage across all projects in a group. Security configuration profiles: View security configuration profiles for groups and projects. Compliance tools: View and manage audit events, compliance center, compliance frameworks, compliance status reports, and dependency lists at both group and project levels. Secret push protection: Enable secret push protection for a group and project. On-demand DAST: Create and run on-demand DAST scans for a project. Runner visibility: View runners for a group and project. To get started, go to a group and select Manage > Members to invite and assign members to the Security Manager role. Use third-party scanner results with GitLab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now use security findings from any SARIF 2.1.0-compliant scanner with GitLab vulnerability management. Define a CI/CD job that runs your scanner and outputs a SARIF artifact. GitLab parses, validates, and imports those findings into your security workflows. Results appear alongside GitLab native scanner output in the pipeline security tab, the vulnerability report, the security dashboard, the merge request security widget, and security policies. This feature gives security teams a single, consolidated view of vulnerabilities regardless of which tool produced them. GitLab assigns each finding a report type based on its identifiers, mapping results into categories such as SAST, dependency scanning, and secret detection. Supported scanners include Semgrep and Checkmarx for SAST, Trivy and Snyk for dependency and container scanning, and Gitleaks for secret detection. Wiki pages in recently viewed items Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Wiki pages now appear in your recently viewed items, so you can return to pages you visit often. On the GitLab homepage, the Quick access widget lists recently viewed project and group wiki pages, alongside issues, merge requests, and epics. GitLab automatically removes pages that are deleted or that you can no longer access. CI/CD analytics now shows accurate pipeline rates Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, the failure rate and success rate metrics on the CI/CD analytics page (/-/pipelines/charts) included canceled and skipped pipelines in their calculations. This caused both rates to appear lower than expected. For example, on gitlab-org/gitlab the two rates summed to only 98% instead of approximately 100%. Now, GitLab calculates the failure rate and success rate using only completed pipelines, so the results accurately reflect your pipeline health. Clearer, security industry-standard labels in vulnerability details Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In GitLab 19.1, the vulnerability results details page uses consistent, descriptive, and security industry-standard terminology for scan results: Scanner is now Detected by EPSS is now Exploit Probability (EPSS) Has Known Exploit (KEV) is now Known Exploited (CISA KEV) Reachable is now Reachability Image is now Container Image (Container Scanning) Location is now Affected Location URL is now Affected Endpoint (DAST, API fuzzing) Method is now HTTP Method (DAST, API fuzzing) Solution is now Remediation Guidance Links is now References Git operation audit events for all actor types Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In GitLab 18.10, audit logs began capturing the specific Git operation performed (clone, pull, fetch, or push) for human users. In GitLab 19.1, this extended to all actor types, including runners using deploy tokens and SSH certificate users. Audit logs now reflect a complete picture of all Git activity across your repositories, regardless of who or what initiated it. GitLab Runner 19.1 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.1 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Add configurable get_sources timeout to runner configuration Bug Fixes Concrete execution (FF_CONCRETE) diverges from abstract shell in multiple behavior areas Bundle URI downloads fail with insufficient capabilities when FF_USE_GIT_PROACTIVE_AUTH and FF_USE_GIT_BUNDLE_URIS are enabled Prevent script dump on job cancellation through UI due to race condition The list of all changes is in the GitLab Runner CHANGELOG. Inline blame in the blob viewer Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, viewing blame information required navigating to a separate page, breaking your flow when reviewing code. You can now toggle blame information directly in the file view. Each line shows who last modified it, and you can hover for a commit popover with additional details. Select View blame prior to this change to trace history further, or select Ignore specific revisions to exclude specific commits from the blame view. Redesigned repository commit list Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, the repository commit list had limited filtering, making it harder to find specific commits in long histories. The redesigned commit list includes: Filter and search commits by author, commit message, or date range. Filter the list by Git revision, such as a branch, tag, or commit SHA. Commits grouped by day for easier scanning. Improved performance and pagination for large repositories. Stacked merge requests in the UI Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, when you split a large change into smaller merge requests that build on each other, the UI gave no signal that they were related. Authors and reviewers had to track the sequence manually. GitLab now detects stacked merge requests automatically and shows them in the merge request header. A merge request joins a stack when it targets another open merge request’s source branch, or when another open merge request targets its source branch. The stack control next to the source branch shows the current position (for example, 1 of 2) and lets you jump to any other merge request in the stack. To create stacked merge requests from the command line, use stacked diffs in the GitLab CLI. Stream AI audit events to external destinations (beta) Tier: Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue You can now stream AI audit events to external destinations through the GitLab audit event streaming infrastructure, giving security and compliance teams real-time visibility into LLM and AI interactions. With AI audit event streaming enabled, GitLab forwards these events to any active instance streaming destination, including your SIEM (Security Information and Event Management), alongside other audit events.

GitLab 19.0 release notes

On May 21, 2026, GitLab 19.0 was released with the following features. We’d also like to announce this month’s Notable Contributor: Norman Debald! We are excited to recognize Norman, a Level 3 contributor with more than 40 merged improvements across GitLab since joining in May 2022. Primary features Group-level custom review instructions for GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: GitLab Duo Enterprise Links: Documentation · Related Issue In previous versions of GitLab, you could only define custom review instructions for GitLab Duo at the project level. Teams working across many projects in the same group had to duplicate the same instructions in every project. Now you can configure shared custom review instructions for an entire group and its subgroups. Select a project in your group to use as a template. When GitLab Duo performs a code review, it combines the group-level .gitlab/duo/mr-review-instructions.yaml file with any instructions defined in the individual project. Both Code Review Flow and GitLab Duo Code Review support group-level custom instructions. Configure work item types Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, work item types could be either an Issue or a Task. You can now configure custom work item types in a project to match the way your team plans and tracks work. You can create or rename types to User Story, Bug, or Maintenance. Each work item displays with its type name and a unique icon. The new types support custom fields and status lifecycles, and appear in your saved views and issue boards. Type configuration in the top-level group (GitLab.com) or organization (GitLab Self-Managed) cascades down to all projects. You can also control which types are available for each project. Enable or disable a type across all projects at once, or let individual projects manage their own type visibility. When you disable a type in a project, existing work items are not affected. GitLab Secrets Manager now available in open beta Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the GitLab Secrets Manager was available only to a closed beta cohort. Most teams relied on external services such as HashiCorp Vault or AWS Secrets Manager. The GitLab Secrets Manager is now available in open beta for Premium and Ultimate customers on GitLab.com and GitLab Self-Managed. When the GitLab Secrets Manager is enabled, project and group Owners can store, retrieve, and reference CI/CD secrets in GitLab. Secrets are scoped to a project or group and are accessible to only pipeline jobs that explicitly request them. During open beta, GitLab Secrets Manager follows the beta support policy and might not be ready for production use. To share feedback, see issue 598100. GitLab Duo Developer enhancements for merge request workflows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo Developer now supports multiple trigger methods: assign it to an issue, select Generate MR, or @mention it in any issue or MR discussion thread to turn feedback, To-do items, and design questions into code changes, follow-up MRs, or research summaries. With AGENTS.md and agent-config.yml configured, GitLab Duo Developer runs your tests and checks before committing. After a top-level group or instance administrator enables the Developer Flow, GitLab automatically adds mention and assign triggers to eligible projects. Dependency scanning by using SBOM generally available Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab SBOM-based dependency scanner is now generally available. Maven, Gradle, and Python projects now have complete visibility into vulnerabilities across their full dependency tree, including vulnerable packages introduced transitively, not just those declared directly. The analyzer now includes automatic dependency resolution for Maven, Gradle, and Python projects. When a lockfile or resolved dependency graph is not present, the analyzer automatically invokes tooling to resolve the full transitive dependency graph before scanning. Dependency resolution is enabled by default and requires little-to-no additional configuration beyond including the v2 Dependency Scanning template. For projects where dependency resolution is not possible, the analyzer falls back to manifest scanning. It parses pom.xml, requirements.txt, build.gradle, and build.gradle.kts to identify direct dependencies. Manifest scanning ensures teams always get a starting point for vulnerability coverage, even for projects without lock or build files. Manifest scanning is enabled by default and returns direct dependencies only. For full transitive coverage, enable dependency resolution or provide a dependency lockfile or graph export manually. Agentic Core GitLab Duo Core moves to usage-based billing Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Starting in GitLab 19.0, GitLab Duo Core moves to usage-based billing. Code Suggestions in the Web IDE and desktop IDEs now consume GitLab Credits. GitLab Duo Chat is also changing. For GitLab Duo Core users, Chat is now agentic and runs on GitLab Duo Agent Platform. To use GitLab Duo Chat in the GitLab UI or desktop IDEs, enable GitLab Duo Agent Platform for your instance or top-level group. Filter exact code search results by repository Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now filter exact code search results by repository. With the repo: syntax, you can directly scope your search query to specific repositories or repository patterns without having to go to individual projects. For example, searching for def authenticate repo:my-group/my-project returns results only from that repository. You can also use partial paths or patterns to match multiple repositories. Merge request ready event trigger Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now configure flows and external agents to run on the Merge request ready event. When a draft merge request is marked as ready for review, GitLab Duo automatically runs the flow or external agent. To configure a trigger, go to AI > Triggers in your project. This feature is behind the merge_request_ready_flow_trigger feature flag, disabled by default. Claude Opus 4.7 now available in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Claude Opus 4.7 is now available in GitLab Duo Agent Platform. Opus 4.7 delivers meaningful improvements to complex, multistep tasks that require sustained reasoning, precise instruction following, and self-verification before surfacing results. This includes flows supporting CI/CD pipelines, code review, vulnerability resolution, and more. Support for self-hosted Gemini models Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform Self-Hosted is now compatible with Gemini models. Gemini models support multiple flows, including the Code Review Flow, SAST Vulnerability Resolution Flow, Fix CI/CD Pipeline Flow, and more. Expanded open source model support in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform now supports additional open source models for self-hosted deployments, including Devstral 2 123B, GLM-5.1-FP8, and others. This helps customers power agentic workflows across a variety of environments, including offline and network-restricted deployments. Per-session tool approvals with admin controls Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Before GitLab Duo Agentic Chat can use a tool on your behalf, it requires your approval. Each tool invocation requires a separate approval. Now, you can approve a trusted tool once for an entire session and streamline your workflows. Administrators control whether tool approval for sessions is available. The following settings cascade from instance to group to project: On by default Off by default Always off Groups and subgroups can modify the setting unless an administrator sets it to Always off. The default setting is Off by default, ensuring each tool invocation requires explicit approval unless an administrator changes it. Resolve merge conflicts with GitLab Duo (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases. Now GitLab Duo can autonomously analyze merge conflicts, edit the conflicting files, create a commit, and push to the source branch. Trigger conflict resolution from the Resolve conflicts page or directly from the merge request widget. When complete, GitLab Duo posts a summary comment so reviewers can see what changed. GitLab Duo respects branch protection rules and does not force-push to protected branches. This feature is in beta and is gated behind the mr_ai_resolve_conflicts feature flag, enabled by default. Restrict the AI Catalog to a group hierarchy Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Top-level group Owners can now restrict the AI Catalog to show only agents and flows owned by projects within their group hierarchy. This blocks agents, external agents, or flows not in this hierarchy from being visible or enabled by any user in that group. Purchase credits on the Free tier on GitLab Self-Managed Tier: Free Offering: GitLab Self-Managed Links: Documentation · Related Issue Free tier users on GitLab Self-Managed can now unlock the full power of GitLab Duo Agent Platform, no Premium or Ultimate subscription required. Choose your monthly credit amount, commit to an annual term, and get instant access to AI-powered development tools. Credits refresh automatically each month, so your team always has what it needs to build faster and smarter. Admin-defined network access controls for Agent Platform remote flows Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators can now define centralized network policies for GitLab Duo Agent Platform remote flows directly in Settings. Top-level group administrators on GitLab.com, and instance administrators on GitLab Self-Managed and Dedicated, can configure organization-wide domain denylists and allowlists that projects inherit automatically. An additional setting controls whether projects can extend the approved domain list with custom entries. Policies are enforced at runtime across all remote flows, giving security and platform teams a consistent governance layer for agent network egress. Unified DevOps and Security Auto remediation for vulnerable dependencies (Experiment) Tier: Ultimate Offering: GitLab.com Links: Documentation · Related Issue Auto remediation for dependencies is now available as an experiment in GitLab 19.0. When dependency scanning detects a vulnerable Ruby dependency with a known fix, GitLab automatically opens a merge request to update it to a safe version without human input. Only Ruby projects are supported in the experiment. After each pipeline, GitLab identifies the highest-severity vulnerability with an available patch or minor version upgrade. GitLab generates the manifest file change and opens a merge request through a service account. The merge request then goes through your project’s standard review and approval workflow. During the experiment, up to three auto-remediation merge requests can be open per project at a time. To share feedback or request to try out the experiment make a comment on epic 600511. To enable the experiment on your project, a GitLab team member must enable the dependency_management_auto_remediation feature flag for your project. Dependency scanning in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab 18.11 introduced security configuration profiles for SAST and secret detection. Now, dependency scanning is also available with the Dependency Scanning - Default profile. This profile gives you a unified control surface to apply standardized SCA coverage across all of your projects without editing a single CI/CD configuration file. The profile activates two scan triggers: Merge Request Pipelines: Automatically runs a dependency scanning scan each time new commits are pushed to a branch with an open merge request. Results include only new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s dependency posture. Dependency resolution for Gradle SBOM scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab dependency scanning using SBOM now automatically generates a dependency graph (gradle.graph.txt) for Gradle projects. Previously, Gradle dependency scanning required you to generate a dependency graph manually as part of your build. Now, when a graph file is not available, the analyzer generates one automatically, removing this manual step for Java and Kotlin projects using Gradle. Remediation guidance for API security testing findings Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue API security vulnerability reports now include remediation guidance for each finding. Previously, API security testing identified vulnerabilities but provided no guidance on how to fix them. Developers had to research remediation steps independently. Now, each finding includes vulnerability-specific remediation steps and references to relevant OWASP and CWE identifiers directly in the vulnerability report. Remediation guidance is now included for the following checks: Application information Cleartext authentication CORS DNS rebinding Framework debug mode Heartbleed OpenSSL vulnerability HTML injection Insecure HTTP methods JSON hijacking JSON injection Open redirect OS command injection Path traversal Sensitive file Sensitive information Session cookie Shellshock SQL injection TLS configuration Authentication token XML injection Security data in merge request Reports tab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Merge requests include a new Reports tab that shows all findings from security scans, license compliance results, and code quality reports for the pipeline. GitLab bot comments in the activity feed are still available to view any policy violations that prevent the merge request from being merged. Improved array support for CI/CD inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue CI/CD inputs now have improved support for working with arrays. Use the array index operator [] to access specific elements within array inputs. This enhancement provides more flexible and powerful input interpolation capabilities in your pipeline configurations, enabling you to reference individual array items directly without additional processing steps. Select multiple values for pipeline inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, you could only select a single value when selecting input options in the UI, limiting flexibility for pipelines with more complex options. Now when you run a pipeline with inputs from the UI, you can select multiple values from a dropdown list and the selected values are combined into an array, for example ["option1","option2"]. This makes it easy to restart services on multiple instances, build multiple Docker images, run tests with multiple tag combinations, or perform any operation across multiple targets in a single pipeline run. Detailed CI/CD Catalog component usage analytics Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When you manage a CI/CD component in the GitLab Catalog, usage details are critical for managing upgrades, enforcing compliance, and communicating breaking changes. You need to know which projects use your components, and which versions they are using. Previously, this information was not available, making it difficult to notify the right maintainers, plan deprecations safely, or ensure projects stay current with the latest security patches. The component usage details view in the catalog resource page now shows exactly which projects use each component, the version they are running, and whether they are on the latest version or an outdated one. Projects using older versions are surfaced at the top, so you can prioritize outreach, drive adoption of security fixes, and ensure a smooth upgrade path across your organization. Configure parallel pipeline limits for merge trains Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you couldn’t change the maximum of 20 parallel pipelines in a merge train, which forced you to either overwhelm your runners or skip merge trains entirely. Now you can configure the parallel pipeline limit per merge train to balance runner load and merge throughput. You can set the limit per project or instance-wide. Setting the limit to 1 means each merge request runs one at a time, against a clean target branch. Thanks to Norman Debald (@Modjo85) for this community contribution. Customize default merge request titles Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the default title for a new merge request came from the source branch or first commit, and you couldn’t enforce a consistent naming convention across your project. Now you can configure a default merge request title template per project. Templates support variables for the source branch, target branch, first commit subject, linked issue ID, issue title, and a human-readable version of the source branch name. For example, the template Resolve %{issue_id} "%{issue_title}" produces titles like Resolve 123 "Fix login bug". You can still edit the title before creating the merge request. Secure webhooks with HMAC signing tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The existing X-Gitlab-Token header sends a static secret in plain text, making webhooks susceptible to interception and replay attacks. You can now add a signing token to any webhook. GitLab uses the signing token to compute an HMAC-SHA256 signature over: The unique webhook ID. The request timestamp. The webhook payload. GitLab then sends the result in the webhook-signature header alongside webhook-id and webhook-timestamp headers, following the Standard Webhooks specification. You can recompute the signature to confirm requests genuinely came from GitLab and that the payload has not been modified. By also validating the timestamp, you can reject replayed requests. Thanks to Van Anderson and Norman Debald for their community contributions! Cross-project pushes using CI/CD job tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, you could only use a CI/CD job token (CI_JOB_TOKEN) to push to the same repository where the pipeline runs. Cross-project pushes required a personal access token or deploy token. You can now use a job token to push to another project when: The target project opts in. The user who starts the pipeline has at least the Developer role in the target project. This feature is behind the allow_push_to_allowlisted_projects feature flag, disabled by default in GitLab 19.0. Ask your administrator to enable it. Mermaid diagram rendering upgraded to version 11 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab now uses Mermaid version 11 for rendering diagrams in Markdown. Previously, GitLab supported Mermaid version 10. With this upgrade, you get access to all the new diagram types, syntax improvements, and bug fixes introduced in Mermaid 11, including enhanced rendering for flowcharts, sequence diagrams, and more. Rapid Diffs for merge request reviews (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, you would have to wait for the Changes tab to load all files before you could begin reviewing, which slowed down large reviews. Now you can use Rapid Diffs to review merge requests with faster initial load, smoother scrolling, and more responsive interactions across files. Rapid Diffs uses the same technology that already powers the commits page. Rapid Diffs is in beta. Some features from the classic diff experience aren’t yet available. You can switch back at any time. Watch the overview video and share your experience in the feedback issue. GitLab Runner 19.0 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.0 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Runner instrumentation: Feature negotiation, OTLP export client, and first job_execution span Add configurable prepare stage timeout to runner configuration Bug Fixes Comprehensive fixes for FF_SCRIPTS_TO_STEPS feature flag implementation SignatureDoesNotMatch error when downloading S3 cache Runtime error when GitLab Runner runs in AWS with S3 cache Broken RPM S3 download links for amd64, arm64, arm, and armhf in GitLab Runner 18.9.0 and later Negative exit codes are reported incorrectly on Windows Incorrect Kubernetes executor service container naming documentation The list of all changes is in the GitLab Runner CHANGELOG. Scale and Deployments PostgreSQL 17 minimum requirement Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The minimum supported version of PostgreSQL is now version 17. If you use the packaged PostgreSQL 16, upgrade the packaged PostgreSQL server before installing GitLab 19.0. Linux package support for Ubuntu 20.04 discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Ubuntu 20.04 reached end of standard support in May 2025. From GitLab 19.0, Linux packages are no longer provided for Ubuntu 20.04. GitLab 18.11 is the last release with packages for this distribution. Before upgrading to GitLab 19.0, migrate to Ubuntu 22.04 or another supported operating system. Redis 6 support removed Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Support for Redis 6 is removed in GitLab 19.0. If you use an external Redis 6 deployment, migrate to Redis 7.2 or Valkey 7.2 before upgrading. The bundled Redis included with the Linux package has used Redis 7 since GitLab 16.2 and is not affected. Mattermost removed from the Linux package Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Bundled Mattermost is removed from the Linux package in GitLab 19.0. If you currently use the bundled Mattermost, refer to Migrating from the Linux package to Mattermost Standalone for migration instructions. Customers not using the bundled Mattermost are not impacted. Linux package support for SUSE distributions discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Linux package support for SUSE distributions ends in GitLab 19.0, which affects openSUSE Leap 15.6, SUSE Linux Enterprise Server 12.5, and SUSE Linux Enterprise Server 15.6. GitLab 18.11 is the last version with Linux packages for these distributions. To continue to use SUSE distributions, migrate to a Docker deployment of GitLab. Spamcheck removed from Linux package and GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Spamcheck is removed from the Linux package and GitLab Helm chart in GitLab 19.0. Customers not currently using Spamcheck are not impacted. If you use the bundled Spamcheck, you can deploy it separately using Docker. No data migration is required. NGINX Ingress replaced by Gateway API with Envoy Gateway Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Gateway API with Envoy Gateway becomes the default networking configuration in the GitLab Helm chart in GitLab 19.0, replacing NGINX Ingress which reached end-of-life in March 2026. If migration to Envoy Gateway is not immediately feasible, you can explicitly re-enable the bundled NGINX Ingress, which remains available until its planned removal in GitLab 20.0. This change does not impact the NGINX used in the Linux package, or Helm chart instances using an externally managed Ingress or Gateway API controller. Bundled PostgreSQL, Redis, and MinIO removed from GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The bundled Bitnami PostgreSQL, Bitnami Redis, and MinIO charts are removed from the GitLab Helm chart and GitLab Operator in GitLab 19.0 with no replacement. These components were intended only for proof-of-concept and test environments and are not recommended for production use. If you run an instance with any of these bundled services, follow the migration guide to configure external services before upgrading to GitLab 19.0. Reliable SCIM user deprovisioning for large groups Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue For organizations managing large numbers of users through SCIM, deprovisioning group members could time out and return 500 errors. SCIM DELETE and PATCH requests now return a success response immediately. Membership removal is handled asynchronously, so identity providers and SCIM clients receive consistent success responses. Filter Credits dashboard by product and date (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue The in-product GitLab Credits dashboard now supports product filtering, date range selection, and Secrets Manager usage visibility. You can filter usage by product (including GitLab Duo and Secrets Manager) and date range, see a daily usage chart across selected products, and review per-user attribution with a Usage control status column. The dashboard also includes usage from service accounts so automated activity is reflected in per-user attribution, and surfaces non-billable and beta events such as Secrets Manager Open Beta activity. This gives you a complete view of credit consumption in your organization. Review prior months of Credits usage (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the Credits dashboard showed only the current billing month, so you couldn’t compare trends, audit a usage spike after the fact, or build a budget conversation around prior consumption. Now you can navigate to prior billing months in the Credits dashboard.

GitLab 19.0リリースノート

2026年5月21日、GitLab 19.0が以下の機能とともにリリースされました。 今月のNotable Contributorは、Norman Debaldさんです！ Normanさんは、レベル3のコントリビューターで、2022年5月の参加以来、GitLab全体で40件以上のマージされた改善に貢献しています。 主要な機能 GitLab Duoのグループレベルのカスタムレビュー指示 プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated アドオン: Duo Enterprise リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、GitLab Duoのカスタムレビュー指示はプロジェクトレベルでのみ定義できました。同じグループ内の多くのプロジェクトにまたがって作業するチームは、すべてのプロジェクトで同じ指示を複製する必要がありました。 今回のリリースで、グループ全体とそのサブグループに対して共有カスタムレビュー指示を設定できるようになりました。 グループ内のプロジェクトをテンプレートとして選択します。GitLab Duoがコードレビューを実行すると、グループレベルの.gitlab/duo/mr-review-instructions.yamlファイルと個々のプロジェクトで定義された指示が組み合わされます。 コードレビューフローとGitLab Duoコードレビューの両方が、グループレベルのカスタム指示をサポートしています。 作業アイテムタイプの設定 プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連エピック これまで、作業アイテムタイプはイシューまたはタスクのいずれかに限られていましたが、プロジェクト内でカスタムの作業アイテムタイプを設定して、チームの計画・追跡方法に合わせられるようになりました。 タイプをユーザーストーリー、バグ、またはメンテナンスとして作成または名前変更できます。各作業アイテムはそのタイプ名と固有のアイコンで表示されます。新しいタイプはカスタムフィールドとステータスライフサイクルをサポートし、保存済みビューやイシューボードに表示されます。トップレベルグループ（GitLab.com）または組織（GitLab Self-Managed）でのタイプ設定は、すべてのプロジェクトに継承されます。 また、各プロジェクトで利用可能なタイプを制御することもできます。すべてのプロジェクトで一度にタイプを有効または無効にするか、個々のプロジェクトが独自のタイプの表示設定を管理できるようにします。プロジェクトでタイプを無効にしても、既存の作業アイテムには影響しません。 GitLab Secrets Managerがオープンベータで利用可能に プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連エピック 以前のバージョンのGitLabでは、GitLab Secrets Managerはクローズドベータに限定されていました。ほとんどのチームはHashiCorp VaultやAWS Secrets Managerなどの外部サービスに依存していました。 今回のリリースでGitLab Secrets Managerが、GitLab.comおよびGitLab Self-ManagedのPremiumおよびUltimateのお客様向けにオープンベータで利用可能になりました。GitLab Secrets Managerが有効な場合、プロジェクトおよびグループのオーナーはGitLab内でCI/CDシークレットを保存、取得、参照できます。シークレットはプロジェクトまたはグループにスコープされ、明示的にリクエストしたパイプラインジョブのみがアクセスできます。 オープンベータ期間中、GitLab Secrets Managerはベータサポートポリシーに従い、本番環境での使用に対応していない場合があります。 フィードバックを共有するには、イシュー598100をご覧ください。 マージリクエストワークフローのためのGitLab Duo Developerの機能強化 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLab Duo Developerは複数のトリガー方法をサポートするようになりました。イシューに割り当てる、MRを生成を選択する、またはイシューやMRのディスカッションスレッドで@mentionすることで、フィードバック、To-Doアイテム、設計上の質問をコード変更、フォローアップMR、またはリサーチサマリーに変換できます。 AGENTS.mdとagent-config.ymlを設定することで、GitLab Duo Developerはコミット前にテストとチェックを実行します。トップレベルグループまたはインスタンス管理者がデベロッパーフローを有効にすると、GitLabは対象プロジェクトにメンションと割り当てトリガーを自動的に追加します。 SBOMを使用した依存関係スキャンが一般提供に プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連エピック GitLabのSBOMベースの依存関係スキャナーが一般提供開始になりました。Maven、Gradle、Pythonプロジェクトで、直接宣言されたものだけでなく、推移的に導入された脆弱なパッケージを含む、完全な依存関係ツリー全体の脆弱性を可視化できるようになりました。 アナライザーには、Maven、Gradle、Pythonプロジェクトの自動依存関係解決が含まれるようになりました。ロックファイルまたは解決済みの依存関係グラフが存在しない場合、アナライザーはスキャン前に完全な推移的依存関係グラフを解決するためのツールを自動的に実行します。依存関係解決はデフォルトで有効になっており、v2 Dependency Scanningテンプレートを含める以外に追加の設定はほとんど必要ありません。 依存関係解決が不可能なプロジェクトの場合、アナライザーはマニフェストスキャンにフォールバックします。pom.xml、requirements.txt、build.gradle、build.gradle.ktsを解析して直接依存関係を特定します。マニフェストスキャンにより、ロックファイルやビルドファイルのないプロジェクトでも、チームは常に脆弱性カバレッジの出発点を得られます。 マニフェストスキャンはデフォルトで有効になっており、直接依存関係のみを返します。完全な推移的カバレッジを得るには、依存関係解決を有効にするか、依存関係ロックファイルまたはグラフエクスポートを手動で提供してください。 Agent Platformの中核機能 GitLab Duo Coreが使用量ベースの課金に移行 プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLab 19.0から、GitLab Duo Coreは使用量ベースの課金に移行します。Web IDEおよびデスクトップIDEのコード提案は、GitLabクレジットを消費するようになります。 GitLab Duo Chatも変更されます。GitLab Duo Coreユーザーの場合、Chatはエージェント型になりGitLab Duo Agent Platformで動作します。GitLab UIまたはデスクトップIDEでGitLab Duo Chatを使用するには、インスタンスまたはトップレベルグループでGitLab Duo Agent Platformを有効にしてください。 完全一致コードの検索結果をリポジトリでフィルタリング プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー 完全一致コードの検索結果をリポジトリでフィルタリングできるようになりました。repo:構文を使用すると、個々のプロジェクトに移動することなく、検索クエリを特定のリポジトリまたはリポジトリパターンに直接スコープできます。 例えば、def authenticate repo:my-group/my-projectを検索すると、そのリポジトリからの結果のみが返されます。また、部分的なパスやパターンを使用して、複数のリポジトリを照合することもできます。 マージリクエスト準備完了イベントトリガー プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー フローと外部エージェントをマージリクエスト準備完了イベントで実行するように設定できるようになりました。 ドラフトのマージリクエストがレビュー準備完了としてマークされると、GitLab Duoはフローまたは外部エージェントを自動的に実行します。 トリガーを設定するには、プロジェクトのAI > トリガーに移動します。 この機能はmerge_request_ready_flow_trigger機能フラグで制御されており、デフォルトでは無効になっています。 GitLab Duo Agent PlatformでClaude Opus 4.7が利用可能に プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー Claude Opus 4.7がGitLab Duo Agent Platformで利用可能になりました。Opus 4.7は、継続的な推論、指示への正確な準拠、結果を出力する前の自己検証を必要とする複雑なマルチステップタスクに対して、意味のある改善をもたらします。これには、CI/CDパイプライン、コードレビュー、脆弱性解決などをサポートするフローが含まれます。 セルフホスト型Geminiモデルのサポート プラン: Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab Duo Agent Platform Self-HostedがGeminiモデルと互換性を持つようになりました。Geminiモデルはコードレビューフロー、SAST脆弱性修正フロー、CI/CDパイプライン修正フローなど、複数のフローをサポートしています。 GitLab Duo Agent Platformでのオープンソースモデルサポートの拡張 プラン: Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab Duo Agent Platformは、セルフホストデプロイ向けに追加のオープンソースモデルをサポートするようになりました。Devstral 2 123B、GLM-5.1-FP8などが含まれます。これにより、オフラインやネットワーク制限のある環境を含む、さまざまな環境でエージェント型ワークフローを実現できます。 管理者コントロール付きのセッションごとのツール承認 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLab Duo Agentic Chatがツールを使用するには、その都度ユーザーの承認が必要でした。 今回のリリースで、信頼できるツールをセッション内で一度だけ承認すれば、同じセッション中は再承認なしで使用できるようになりました。 管理者は、セッションのツール承認が利用可能かどうかを制御します。以下の設定はインスタンスからグループ、プロジェクトへと継承されます: デフォルトでオン デフォルトでオフ 常にオフ 管理者が常にオフに設定しない限り、グループとサブグループは設定を変更できます。 デフォルト設定はデフォルトでオフであり、管理者が変更しない限り、各ツールの実行には明示的な承認が必要です。 GitLab Duoでマージコンフリクトを解決（ベータ版） プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、単純なケースであっても、GitLab UIまたはコマンドラインでマージコンフリクトを手動で解決する必要がありました。 今回のリリースで、GitLab Duoがマージコンフリクトを自律的に分析し、該当ファイルの編集からコミット作成、ソースブランチへのプッシュまでを自動で行えるようになりました。コンフリクトを解決ページまたはマージリクエストウィジェットから直接コンフリクト解決をトリガーできます。完了すると、GitLab Duoがサマリーコメントを投稿するため、レビュアーは変更内容をすぐに確認できます。 GitLab Duoはブランチ保護ルールを尊重し、保護ブランチへの強制プッシュは行いません。 この機能はベータ版であり、mr_ai_resolve_conflicts機能フラグで制御されており、デフォルトでは有効になっています。 AIカタログをグループ階層に制限する プラン: Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー トップレベルグループのオーナーは、AIカタログをグループ階層内のプロジェクトが所有するエージェントとフローのみを表示するように制限できるようになりました。これにより、この階層に含まれないエージェント、外部エージェント、またはフローが、そのグループのユーザーに表示されたり有効化されたりすることをブロックします。 GitLab Self-ManagedのFreeプランでクレジットを購入 プラン: Free 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab Self-ManagedのFreeプランユーザーは、PremiumまたはUltimateのサブスクリプションなしで、GitLab Duo Agent Platformのフル機能を利用できるようになりました。月次クレジット量を選択し、年間契約にすることで、AIを活用した開発ツールに即座にアクセスできます。クレジットは毎月自動的に更新されるため、チームは常に必要なものを手に入れ、より速く、よりスマートに構築できます。 Agent Platformリモートフローの管理者定義ネットワークアクセス制御 プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー 管理者は、設定から直接GitLab Duo Agent Platformリモートフローの集中ネットワークポリシーを定義できるようになりました。GitLab.comのトップレベルグループ管理者、およびGitLab Self-ManagedとDedicatedのインスタンス管理者は、プロジェクトが自動的に継承する組織全体のドメイン拒否リストと許可リストを設定できます。追加の設定により、プロジェクトがカスタムエントリで承認済みドメインリストを拡張できるかどうかを制御します。ポリシーはすべてのリモートフローにわたってランタイムで適用され、セキュリティおよびプラットフォームチームにエージェントのネットワーク外部通信に対する一貫したガバナンス層を提供します。 スケールとデプロイ PostgreSQL 17の最小要件 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー PostgreSQLの最小サポートバージョンはバージョン17になりました。パッケージ版PostgreSQL 16を使用している場合は、GitLab 19.0をインストールする前にパッケージ版PostgreSQLサーバーをアップグレードしてください。 Ubuntu 20.04向けLinuxパッケージサポートの終了 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー Ubuntu 20.04は2025年5月に標準サポートが終了しました。GitLab 19.0から、Ubuntu 20.04向けのLinuxパッケージは提供されなくなります。GitLab 18.11がこのディストリビューション向けのパッケージを含む最後のリリースです。GitLab 19.0にアップグレードする前に、Ubuntu 22.04または他のサポートされているオペレーティングシステムに移行してください。 Redis 6サポートの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab 19.0でRedis 6のサポートが削除されます。外部のRedis 6デプロイを使用している場合は、アップグレード前にRedis 7.2またはValkey 7.2に移行してください。Linuxパッケージに含まれるバンドル版RedisはGitLab 16.2からRedis 7を使用しており、影響を受けません。 LinuxパッケージからのMattermostの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab 19.0でバンドル版MattermostがLinuxパッケージから削除されます。現在バンドル版Mattermostを使用している場合は、移行手順についてLinuxパッケージからMattermost Standaloneへの移行を参照してください。バンドル版Mattermostを使用していないお客様には影響はありません。 SUSEディストリビューション向けLinuxパッケージサポートの終了 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー SUSEディストリビューション向けのLinuxパッケージサポートはGitLab 19.0で終了します。これはopenSUSE Leap 15.6、SUSE Linux Enterprise Server 12.5、およびSUSE Linux Enterprise Server 15.6に影響します。GitLab 18.11がこれらのディストリビューション向けのLinuxパッケージを含む最後のバージョンです。SUSEディストリビューションを引き続き使用するには、GitLabのDockerデプロイに移行してください。 LinuxパッケージとGitLab HelmチャートからのSpamcheckの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー SpamcheckはGitLab 19.0でLinuxパッケージとGitLab Helmチャートから削除されます。現在Spamcheckを使用していないお客様には影響はありません。バンドル版Spamcheckを使用している場合は、Dockerを使用して個別にデプロイできます。データ移行は不要です。 NGINX IngressがEnvoy GatewayによるGateway APIに置き換えられる プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー GitLab 19.0では、Envoy GatewayによるGateway APIがGitLab Helmチャートのデフォルトネットワーク設定になり、2026年3月に提供終了となったNGINX Ingressを置き換えます。Envoy Gatewayへの移行がすぐに実現できない場合は、バンドル版NGINX Ingressを明示的に再有効化できます。これはGitLab 20.0での計画的な削除まで利用可能です。この変更は、Linuxパッケージで使用されるNGINX、または外部管理のIngressまたはGateway APIコントローラーを使用するHelmチャートインスタンスには影響しません。 GitLab HelmチャートからバンドルされたPostgreSQL、Redis、MinIOの削除 プラン: Free、Premium、Ultimate 提供形態: GitLab Self-Managed リンク: ドキュメント、関連イシュー バンドルされたBitnami PostgreSQL、Bitnami Redis、MinIOチャートは、GitLab 19.0でGitLab HelmチャートとGitLab Operatorから代替なしで削除されます。これらのコンポーネントは概念実証およびテスト環境のみを対象としており、本番環境での使用は推奨されていません。これらのバンドルサービスのいずれかを使用してインスタンスを実行している場合は、GitLab 19.0にアップグレードする前に移行ガイドに従って外部サービスを設定してください。 大規模グループでのSCIMユーザーデプロビジョニングの信頼性向上 プラン: Premium、Ultimate 提供形態: GitLab.com リンク: ドキュメント、関連イシュー SCIMを通じて多数のユーザーを管理している組織では、グループメンバーのデプロビジョニングがタイムアウトして500エラーが返されることがありました。SCIMのDELETEおよびPATCHリクエストは即座に成功レスポンスを返すようになりました。メンバーシップの削除は非同期で処理されるため、IDプロバイダーとSCIMクライアントは一貫した成功レスポンスを受け取ります。 統合DevOpsとセキュリティ 脆弱な依存関係の自動修正（実験的機能） プラン: Ultimate 提供形態: GitLab.com リンク: ドキュメント、関連エピック GitLab 19.0で、依存関係の自動修正が実験的機能として利用可能になりました。依存関係スキャンで既知の修正が存在する脆弱なRuby依存関係が検出されると、GitLabは人手を介さずに安全なバージョンへの更新マージリクエストを自動的に作成します。実験的機能でサポートされるのはRubyプロジェクトのみです。 各パイプライン実行後、GitLabは利用可能なパッチまたはマイナーバージョンアップグレードがある最も重大度の高い脆弱性を特定します。GitLabがマニフェストファイルの変更を生成し、サービスアカウントを通じてマージリクエストを作成します。その後、マージリクエストはプロジェクトの標準的なレビューおよび承認ワークフローに従います。 実験的機能の期間中、プロジェクトあたり同時にオープンできる自動修正マージリクエストは最大3件です。 フィードバックの共有や実験的機能への参加を希望する場合は、エピック600511にコメントしてください。 プロジェクトで実験的機能を有効にするには、GitLabチームメンバーがプロジェクトのdependency_management_auto_remediation機能フラグを有効にする必要があります。 セキュリティ設定プロファイルでの依存関係スキャン プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー GitLab 18.11では、SASTとシークレット検出のセキュリティ設定プロファイルが導入されました。 これで、依存関係スキャンも 依存関係スキャン - デフォルト プロファイルで利用可能になりました。 このプロファイルにより、単一のCI/CD設定ファイルを編集することなく、すべてのプロジェクトに標準化されたSCAカバレッジを適用するための統一された操作画面が提供されます。 このプロファイルは2つのスキャントリガーを有効にします: マージリクエストパイプライン: オープンなマージリクエストがあるブランチに新しいコミットがプッシュされるたびに、依存関係スキャンを自動的に実行します。結果にはマージリクエストによって導入された新しい脆弱性のみが含まれます。 ブランチパイプライン（デフォルトのみ）: 変更がデフォルトブランチにマージまたはプッシュされたときに自動的に実行され、デフォルトブランチの依存関係の状態の完全なビューを提供します。 Gradle SBOMスキャンの依存関係解決 プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント | 関連エピック SBOMを使用したGitLabの依存関係スキャンが、Gradleプロジェクトの依存関係グラフ (gradle.graph.txt)を自動的に生成するようになりました。以前は、Gradleの依存関係スキャンではビルドの一部として依存関係グラフを手動で生成する必要がありました。グラフファイルが存在しない場合、アナライザーが自動的に生成するようになり、GradleベースのJavaおよびKotlinプロジェクトでこの手動ステップが不要になりました。 APIセキュリティテストの検出結果に対する修正ガイダンス プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー APIセキュリティの脆弱性レポートに、各検出結果に対する修正ガイダンスが含まれるようになりました。以前は、APIセキュリティテストで脆弱性が特定されても、修正方法に関するガイダンスは提供されていませんでした。デベロッパーは修正手順を独自に調査する必要がありました。今後は、各検出結果に脆弱性固有の修正手順と、関連するOWASPおよびCWE識別子への参照が脆弱性レポートに直接含まれます。 現在、以下のチェックに修正ガイダンスが含まれています: アプリケーション情報 平文認証 CORS DNSリバインディング フレームワークデバッグモード Heartbleed OpenSSL脆弱性 HTMLインジェクション 脆弱なHTTPメソッド JSONハイジャッキング JSONインジェクション オープンリダイレクト OSコマンドインジェクション パストラバーサル 機密ファイル 機密情報 セッションCookie Shellshock SQLインジェクション TLS設定 認証トークン XMLインジェクション CI/CDインプットの配列サポートの改善 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー CI/CDインプットは、配列を扱うためのサポートが改善されました。配列入力内の特定の要素にアクセスするには、配列インデックス演算子[]を使用します。この機能強化により、パイプラインの設定において、より柔軟で強力な入力補間機能が提供され、追加の処理ステップなしで個々の配列項目を直接参照できるようになります。 パイプライン入力に複数の値を選択 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー 以前は、UIで入力オプションを選択する際に単一の値しか選択できず、より複雑なオプションを持つパイプラインの柔軟性が制限されていました。 今回のリリースから、UIから入力を含むパイプラインを実行する際、ドロップダウンリストから複数の値を選択でき、選択された値は例えば["option1","option2"]のように配列に結合されます。これにより、複数のインスタンスでサービスを再起動したり、複数のDockerイメージをビルドしたり、複数のタグの組み合わせでテストを実行したり、単一のパイプライン実行で複数のターゲットにわたるあらゆる操作を簡単に実行できます。 CI/CDカタログコンポーネントの詳細な使用状況分析 プラン: Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLabカタログでCI/CDコンポーネントを管理する場合、使用状況の詳細はアップグレードの管理、コンプライアンスの適用、破壊的な変更の伝達に不可欠です。どのプロジェクトがコンポーネントを使用しているか、どのバージョンを使用しているかを把握する必要があります。以前はこの情報が利用できなかったため、適切なメンテナーへの通知、安全な廃止計画、またはプロジェクトが最新のセキュリティパッチに追従していることの確認が困難でした。 カタログリソースページのコンポーネント使用状況詳細ビューには、各コンポーネントを使用しているプロジェクト、実行中のバージョン、最新バージョンか古いバージョンかが正確に表示されるようになりました。古いバージョンを使用しているプロジェクトは上部に表示されるため、アウトリーチを優先し、セキュリティ修正の採用を促進し、組織全体でスムーズなアップグレードパスを確保できます。 マージトレインの並列パイプライン制限の設定 プラン: Premium、Ultimate 提供形態: GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、マージトレインの最大20並列パイプラインを変更できなかったため、Runnerに過負荷をかけるか、マージトレインを完全にスキップするかの二択を迫られていました。これで、マージトレインごとの並列パイプライン制限を設定して、Runnerの負荷とマージスループットのバランスを取ることができます。制限はプロジェクトごとまたはインスタンス全体で設定できます。制限を1に設定すると、各マージリクエストはクリーンなターゲットブランチに対して1つずつ実行されます。 このコミュニティへのコントリビュートに感謝します Norman Debald (@Modjo85)。 デフォルトのマージリクエストタイトルのカスタマイズ プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、新しいマージリクエストのデフォルトタイトルはソースブランチまたは最初のコミットから取得されており、プロジェクト全体で一貫した命名規則を適用することができませんでした。 これで、プロジェクトごとにデフォルトのマージリクエストタイトルテンプレートを設定できます。テンプレートはソースブランチ、ターゲットブランチ、最初のコミットの件名、リンクされたイシューID、イシュータイトル、ソースブランチ名を読みやすく整形した変数をサポートしています。例えば、テンプレートResolve %{issue_id} "%{issue_title}"はResolve 123 "Fix login bug"のようなタイトルを生成します。マージリクエストを作成する前にタイトルを編集することもできます。 HMAC署名トークンでWebhookを保護する プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー 既存のX-Gitlab-Tokenヘッダーは静的なシークレットを平文で送信するため、Webhookは傍受やリプレイ攻撃に対して脆弱です。 これで、任意のWebhookに署名トークンを追加できます。GitLabは、署名トークンを使用して以下のHMAC-SHA256署名を算出します: 一意のWebhook ID。 リクエストのタイムスタンプ。 Webhookペイロード。 GitLabは、Standard Webhooks仕様に従い、webhook-idおよびwebhook-timestampヘッダーとともに、結果をwebhook-signatureヘッダーで送信します。 署名を再計算することで、リクエストがGitLabから真正に送信されたものであり、ペイロードが変更されていないことを確認できます。タイムスタンプも検証することで、リプレイされたリクエストを拒否できます。 Van AndersonとNorman Debaldのコミュニティへのコントリビュートに感謝します！ CI/CDジョブトークンを使用したクロスプロジェクトプッシュ プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、CI/CDジョブトークン（CI_JOB_TOKEN）を使用してパイプラインが実行される同じリポジトリにのみプッシュできました。クロスプロジェクトプッシュにはパーソナルアクセストークンまたはデプロイトークンが必要でした。 以下の条件を満たす場合、ジョブトークンを使用して別のプロジェクトにプッシュできるようになりました: ターゲットプロジェクトがオプトインしている。 パイプラインを開始するユーザーがターゲットプロジェクトで少なくともデベロッパーロールを持っている。 この機能はallow_push_to_allowlisted_projects機能フラグで制御されており、GitLab 19.0ではデフォルトで無効になっています。管理者に有効化を依頼してください。 Mermaidダイアグラムのレンダリングをバージョン11にアップグレード プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated リンク: ドキュメント、関連イシュー GitLabのMarkdownにおけるダイアグラムのレンダリングにMermaidバージョン11が使用されるようになりました。 以前はMermaidバージョン10がサポートされていました。このアップグレードにより、フローチャートやシーケンスダイアグラムのレンダリング改善をはじめ、Mermaid 11で導入されたすべての新しいダイアグラムタイプ、構文の改善、バグ修正を利用できます。 マージリクエストレビューのRapid Diffs（ベータ版） プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed リンク: ドキュメント、関連イシュー 以前のバージョンのGitLabでは、レビューを開始する前に変更タブがすべてのファイルを読み込むのを待つ必要があり、大規模なレビューが遅くなっていました。 これからは、Rapid Diffsを使用して、より速い初期読み込み、スムーズなスクロール、ファイル間のより応答性の高いインタラクションでマージリクエストをレビューできます。Rapid Diffsは、コミットページで既に使用されているのと同じ技術を使用しています。 Rapid Diffsはベータ版です。クラシックdiffエクスペリエンスの一部の機能はまだ利用できません。いつでも切り替えることができます。 概要ビデオを視聴して、フィードバックイシューで感想を共有してください。 GitLab Runner 19.0 プラン: Free、Premium、Ultimate 提供形態: GitLab.com、GitLab Self-Managed、GitLab Dedicated、GitLab Dedicated for Government リンク: ドキュメント 本日、GitLab Runner 19.0もリリースします！GitLab Runnerは、CI/CDジョブを実行し、結果をGitLabインスタンスに返送する高いスケーラビリティを備えたビルドエージェントです。GitLab Runnerは、GitLabに含まれるオープンソースの継続的インテグレーションサービスであるGitLab CI/CDと連携して動作します。 新機能 Runnerインストルメンテーション: 機能ネゴシエーション、OTLPエクスポートクライアント、最初のjob_executionスパン Runner設定に設定可能なprepareステージタイムアウトを追加 バグ修正 FF_SCRIPTS_TO_STEPS機能フラグ実装の包括的な修正 S3キャッシュのダウンロード時のSignatureDoesNotMatchエラー GitLab RunnerがS3キャッシュを使用してAWSで実行される際のランタイムエラー GitLab Runner 18.9.0以降のamd64、arm64、arm、armhf向けRPM S3ダウンロードリンクの破損 Windowsで負の終了コードが正しく報告されない Kubernetesエグゼキューターサービスコンテナの命名に関するドキュメントの誤り すべての変更のリストはGitLab RunnerのCHANGELOGにあります。 Primary features Group-level custom review instructions for GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: GitLab Duo Enterprise Links: Documentation · Related Issue In previous versions of GitLab, you could only define custom review instructions for GitLab Duo at the project level. Teams working across many projects in the same group had to duplicate the same instructions in every project. Now you can configure shared custom review instructions for an entire group and its subgroups. Select a project in your group to use as a template. When GitLab Duo performs a code review, it combines the group-level .gitlab/duo/mr-review-instructions.yaml file with any instructions defined in the individual project. Both Code Review Flow and GitLab Duo Code Review support group-level custom instructions. Configure work item types Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, work item types could be either an Issue or a Task. You can now configure custom work item types in a project to match the way your team plans and tracks work. You can create or rename types to User Story, Bug, or Maintenance. Each work item displays with its type name and a unique icon. The new types support custom fields and status lifecycles, and appear in your saved views and issue boards. Type configuration in the top-level group (GitLab.com) or organization (GitLab Self-Managed) cascades down to all projects. You can also control which types are available for each project. Enable or disable a type across all projects at once, or let individual projects manage their own type visibility. When you disable a type in a project, existing work items are not affected. GitLab Secrets Manager now available in open beta Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the GitLab Secrets Manager was available only to a closed beta cohort. Most teams relied on external services such as HashiCorp Vault or AWS Secrets Manager. The GitLab Secrets Manager is now available in open beta for Premium and Ultimate customers on GitLab.com and GitLab Self-Managed. When the GitLab Secrets Manager is enabled, project and group Owners can store, retrieve, and reference CI/CD secrets in GitLab. Secrets are scoped to a project or group and are accessible to only pipeline jobs that explicitly request them. During open beta, GitLab Secrets Manager follows the beta support policy and might not be ready for production use. To share feedback, see issue 598100. GitLab Duo Developer enhancements for merge request workflows Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo Developer now supports multiple trigger methods: assign it to an issue, select Generate MR, or @mention it in any issue or MR discussion thread to turn feedback, To-do items, and design questions into code changes, follow-up MRs, or research summaries. With AGENTS.md and agent-config.yml configured, GitLab Duo Developer runs your tests and checks before committing. After a top-level group or instance administrator enables the Developer Flow, GitLab automatically adds mention and assign triggers to eligible projects. Dependency scanning by using SBOM generally available Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue The GitLab SBOM-based dependency scanner is now generally available. Maven, Gradle, and Python projects now have complete visibility into vulnerabilities across their full dependency tree, including vulnerable packages introduced transitively, not just those declared directly. The analyzer now includes automatic dependency resolution for Maven, Gradle, and Python projects. When a lockfile or resolved dependency graph is not present, the analyzer automatically invokes tooling to resolve the full transitive dependency graph before scanning. Dependency resolution is enabled by default and requires little-to-no additional configuration beyond including the v2 Dependency Scanning template. For projects where dependency resolution is not possible, the analyzer falls back to manifest scanning. It parses pom.xml, requirements.txt, build.gradle, and build.gradle.kts to identify direct dependencies. Manifest scanning ensures teams always get a starting point for vulnerability coverage, even for projects without lock or build files. Manifest scanning is enabled by default and returns direct dependencies only. For full transitive coverage, enable dependency resolution or provide a dependency lockfile or graph export manually. Agentic Core GitLab Duo Core moves to usage-based billing Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Starting in GitLab 19.0, GitLab Duo Core moves to usage-based billing. Code Suggestions in the Web IDE and desktop IDEs now consume GitLab Credits. GitLab Duo Chat is also changing. For GitLab Duo Core users, Chat is now agentic and runs on GitLab Duo Agent Platform. To use GitLab Duo Chat in the GitLab UI or desktop IDEs, enable GitLab Duo Agent Platform for your instance or top-level group. Filter exact code search results by repository Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now filter exact code search results by repository. With the repo: syntax, you can directly scope your search query to specific repositories or repository patterns without having to go to individual projects. For example, searching for def authenticate repo:my-group/my-project returns results only from that repository. You can also use partial paths or patterns to match multiple repositories. Merge request ready event trigger Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue You can now configure flows and external agents to run on the Merge request ready event. When a draft merge request is marked as ready for review, GitLab Duo automatically runs the flow or external agent. To configure a trigger, go to AI > Triggers in your project. This feature is behind the merge_request_ready_flow_trigger feature flag, disabled by default. Claude Opus 4.7 now available in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Claude Opus 4.7 is now available in GitLab Duo Agent Platform. Opus 4.7 delivers meaningful improvements to complex, multistep tasks that require sustained reasoning, precise instruction following, and self-verification before surfacing results. This includes flows supporting CI/CD pipelines, code review, vulnerability resolution, and more. Support for self-hosted Gemini models Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform Self-Hosted is now compatible with Gemini models. Gemini models support multiple flows, including the Code Review Flow, SAST Vulnerability Resolution Flow, Fix CI/CD Pipeline Flow, and more. Expanded open source model support in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue GitLab Duo Agent Platform now supports additional open source models for self-hosted deployments, including Devstral 2 123B, GLM-5.1-FP8, and others. This helps customers power agentic workflows across a variety of environments, including offline and network-restricted deployments. Per-session tool approvals with admin controls Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Before GitLab Duo Agentic Chat can use a tool on your behalf, it requires your approval. Each tool invocation requires a separate approval. Now, you can approve a trusted tool once for an entire session and streamline your workflows. Administrators control whether tool approval for sessions is available. The following settings cascade from instance to group to project: On by default Off by default Always off Groups and subgroups can modify the setting unless an administrator sets it to Always off. The default setting is Off by default, ensuring each tool invocation requires explicit approval unless an administrator changes it. Resolve merge conflicts with GitLab Duo (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases. Now GitLab Duo can autonomously analyze merge conflicts, edit the conflicting files, create a commit, and push to the source branch. Trigger conflict resolution from the Resolve conflicts page or directly from the merge request widget. When complete, GitLab Duo posts a summary comment so reviewers can see what changed. GitLab Duo respects branch protection rules and does not force-push to protected branches. This feature is in beta and is gated behind the mr_ai_resolve_conflicts feature flag, enabled by default. Restrict the AI Catalog to a group hierarchy Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Top-level group Owners can now restrict the AI Catalog to show only agents and flows owned by projects within their group hierarchy. This blocks agents, external agents, or flows not in this hierarchy from being visible or enabled by any user in that group. Purchase credits on the Free tier on GitLab Self-Managed Tier: Free Offering: GitLab Self-Managed Links: Documentation · Related Issue Free tier users on GitLab Self-Managed can now unlock the full power of GitLab Duo Agent Platform, no Premium or Ultimate subscription required. Choose your monthly credit amount, commit to an annual term, and get instant access to AI-powered development tools. Credits refresh automatically each month, so your team always has what it needs to build faster and smarter. Admin-defined network access controls for Agent Platform remote flows Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Administrators can now define centralized network policies for GitLab Duo Agent Platform remote flows directly in Settings. Top-level group administrators on GitLab.com, and instance administrators on GitLab Self-Managed and Dedicated, can configure organization-wide domain denylists and allowlists that projects inherit automatically. An additional setting controls whether projects can extend the approved domain list with custom entries. Policies are enforced at runtime across all remote flows, giving security and platform teams a consistent governance layer for agent network egress. Unified DevOps and Security Auto remediation for vulnerable dependencies (Experiment) Tier: Ultimate Offering: GitLab.com Links: Documentation · Related Issue Auto remediation for dependencies is now available as an experiment in GitLab 19.0. When dependency scanning detects a vulnerable Ruby dependency with a known fix, GitLab automatically opens a merge request to update it to a safe version without human input. Only Ruby projects are supported in the experiment. After each pipeline, GitLab identifies the highest-severity vulnerability with an available patch or minor version upgrade. GitLab generates the manifest file change and opens a merge request through a service account. The merge request then goes through your project’s standard review and approval workflow. During the experiment, up to three auto-remediation merge requests can be open per project at a time. To share feedback or request to try out the experiment make a comment on epic 600511. To enable the experiment on your project, a GitLab team member must enable the dependency_management_auto_remediation feature flag for your project. Dependency scanning in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab 18.11 introduced security configuration profiles for SAST and secret detection. Now, dependency scanning is also available with the Dependency Scanning - Default profile. This profile gives you a unified control surface to apply standardized SCA coverage across all of your projects without editing a single CI/CD configuration file. The profile activates two scan triggers: Merge Request Pipelines: Automatically runs a dependency scanning scan each time new commits are pushed to a branch with an open merge request. Results include only new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s dependency posture. Dependency resolution for Gradle SBOM scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue GitLab dependency scanning using SBOM now automatically generates a dependency graph (gradle.graph.txt) for Gradle projects. Previously, Gradle dependency scanning required you to generate a dependency graph manually as part of your build. Now, when a graph file is not available, the analyzer generates one automatically, removing this manual step for Java and Kotlin projects using Gradle. Remediation guidance for API security testing findings Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue API security vulnerability reports now include remediation guidance for each finding. Previously, API security testing identified vulnerabilities but provided no guidance on how to fix them. Developers had to research remediation steps independently. Now, each finding includes vulnerability-specific remediation steps and references to relevant OWASP and CWE identifiers directly in the vulnerability report. Remediation guidance is now included for the following checks: Application information Cleartext authentication CORS DNS rebinding Framework debug mode Heartbleed OpenSSL vulnerability HTML injection Insecure HTTP methods JSON hijacking JSON injection Open redirect OS command injection Path traversal Sensitive file Sensitive information Session cookie Shellshock SQL injection TLS configuration Authentication token XML injection Security data in merge request Reports tab Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Merge requests include a new Reports tab that shows all findings from security scans, license compliance results, and code quality reports for the pipeline. GitLab bot comments in the activity feed are still available to view any policy violations that prevent the merge request from being merged. Improved array support for CI/CD inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue CI/CD inputs now have improved support for working with arrays. Use the array index operator [] to access specific elements within array inputs. This enhancement provides more flexible and powerful input interpolation capabilities in your pipeline configurations, enabling you to reference individual array items directly without additional processing steps. Select multiple values for pipeline inputs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, you could only select a single value when selecting input options in the UI, limiting flexibility for pipelines with more complex options. Now when you run a pipeline with inputs from the UI, you can select multiple values from a dropdown list and the selected values are combined into an array, for example ["option1","option2"]. This makes it easy to restart services on multiple instances, build multiple Docker images, run tests with multiple tag combinations, or perform any operation across multiple targets in a single pipeline run. Detailed CI/CD Catalog component usage analytics Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue When you manage a CI/CD component in the GitLab Catalog, usage details are critical for managing upgrades, enforcing compliance, and communicating breaking changes. You need to know which projects use your components, and which versions they are using. Previously, this information was not available, making it difficult to notify the right maintainers, plan deprecations safely, or ensure projects stay current with the latest security patches. The component usage details view in the catalog resource page now shows exactly which projects use each component, the version they are running, and whether they are on the latest version or an outdated one. Projects using older versions are surfaced at the top, so you can prioritize outreach, drive adoption of security fixes, and ensure a smooth upgrade path across your organization. Configure parallel pipeline limits for merge trains Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue In previous versions of GitLab, you couldn’t change the maximum of 20 parallel pipelines in a merge train, which forced you to either overwhelm your runners or skip merge trains entirely. Now you can configure the parallel pipeline limit per merge train to balance runner load and merge throughput. You can set the limit per project or instance-wide. Setting the limit to 1 means each merge request runs one at a time, against a clean target branch. Thanks to Norman Debald (@Modjo85) for this community contribution. Customize default merge request titles Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the default title for a new merge request came from the source branch or first commit, and you couldn’t enforce a consistent naming convention across your project. Now you can configure a default merge request title template per project. Templates support variables for the source branch, target branch, first commit subject, linked issue ID, issue title, and a human-readable version of the source branch name. For example, the template Resolve %{issue_id} "%{issue_title}" produces titles like Resolve 123 "Fix login bug". You can still edit the title before creating the merge request. Secure webhooks with HMAC signing tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue The existing X-Gitlab-Token header sends a static secret in plain text, making webhooks susceptible to interception and replay attacks. You can now add a signing token to any webhook. GitLab uses the signing token to compute an HMAC-SHA256 signature over: The unique webhook ID. The request timestamp. The webhook payload. GitLab then sends the result in the webhook-signature header alongside webhook-id and webhook-timestamp headers, following the Standard Webhooks specification. You can recompute the signature to confirm requests genuinely came from GitLab and that the payload has not been modified. By also validating the timestamp, you can reject replayed requests. Thanks to Van Anderson and Norman Debald for their community contributions! Cross-project pushes using CI/CD job tokens Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In previous versions of GitLab, you could only use a CI/CD job token (CI_JOB_TOKEN) to push to the same repository where the pipeline runs. Cross-project pushes required a personal access token or deploy token. You can now use a job token to push to another project when: The target project opts in. The user who starts the pipeline has at least the Developer role in the target project. This feature is behind the allow_push_to_allowlisted_projects feature flag, disabled by default in GitLab 19.0. Ask your administrator to enable it. Mermaid diagram rendering upgraded to version 11 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab now uses Mermaid version 11 for rendering diagrams in Markdown. Previously, GitLab supported Mermaid version 10. With this upgrade, you get access to all the new diagram types, syntax improvements, and bug fixes introduced in Mermaid 11, including enhanced rendering for flowcharts, sequence diagrams, and more. Rapid Diffs for merge request reviews (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, you would have to wait for the Changes tab to load all files before you could begin reviewing, which slowed down large reviews. Now you can use Rapid Diffs to review merge requests with faster initial load, smoother scrolling, and more responsive interactions across files. Rapid Diffs uses the same technology that already powers the commits page. Rapid Diffs is in beta. Some features from the classic diff experience aren’t yet available. You can switch back at any time. Watch the overview video and share your experience in the feedback issue. GitLab Runner 19.0 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue We’re also releasing GitLab Runner 19.0 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Runner instrumentation: Feature negotiation, OTLP export client, and first job_execution span Add configurable prepare stage timeout to runner configuration Bug Fixes Comprehensive fixes for FF_SCRIPTS_TO_STEPS feature flag implementation SignatureDoesNotMatch error when downloading S3 cache Runtime error when GitLab Runner runs in AWS with S3 cache Broken RPM S3 download links for amd64, arm64, arm, and armhf in GitLab Runner 18.9.0 and later Negative exit codes are reported incorrectly on Windows Incorrect Kubernetes executor service container naming documentation The list of all changes is in the GitLab Runner CHANGELOG. Scale and Deployments PostgreSQL 17 minimum requirement Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The minimum supported version of PostgreSQL is now version 17. If you use the packaged PostgreSQL 16, upgrade the packaged PostgreSQL server before installing GitLab 19.0. Linux package support for Ubuntu 20.04 discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Ubuntu 20.04 reached end of standard support in May 2025. From GitLab 19.0, Linux packages are no longer provided for Ubuntu 20.04. GitLab 18.11 is the last release with packages for this distribution. Before upgrading to GitLab 19.0, migrate to Ubuntu 22.04 or another supported operating system. Redis 6 support removed Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Support for Redis 6 is removed in GitLab 19.0. If you use an external Redis 6 deployment, migrate to Redis 7.2 or Valkey 7.2 before upgrading. The bundled Redis included with the Linux package has used Redis 7 since GitLab 16.2 and is not affected. Mattermost removed from the Linux package Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Bundled Mattermost is removed from the Linux package in GitLab 19.0. If you currently use the bundled Mattermost, refer to Migrating from the Linux package to Mattermost Standalone for migration instructions. Customers not using the bundled Mattermost are not impacted. Linux package support for SUSE distributions discontinued Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Linux package support for SUSE distributions ends in GitLab 19.0, which affects openSUSE Leap 15.6, SUSE Linux Enterprise Server 12.5, and SUSE Linux Enterprise Server 15.6. GitLab 18.11 is the last version with Linux packages for these distributions. To continue to use SUSE distributions, migrate to a Docker deployment of GitLab. Spamcheck removed from Linux package and GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Spamcheck is removed from the Linux package and GitLab Helm chart in GitLab 19.0. Customers not currently using Spamcheck are not impacted. If you use the bundled Spamcheck, you can deploy it separately using Docker. No data migration is required. NGINX Ingress replaced by Gateway API with Envoy Gateway Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue Gateway API with Envoy Gateway becomes the default networking configuration in the GitLab Helm chart in GitLab 19.0, replacing NGINX Ingress which reached end-of-life in March 2026. If migration to Envoy Gateway is not immediately feasible, you can explicitly re-enable the bundled NGINX Ingress, which remains available until its planned removal in GitLab 20.0. This change does not impact the NGINX used in the Linux package, or Helm chart instances using an externally managed Ingress or Gateway API controller. Bundled PostgreSQL, Redis, and MinIO removed from GitLab Helm chart Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation · Related Issue The bundled Bitnami PostgreSQL, Bitnami Redis, and MinIO charts are removed from the GitLab Helm chart and GitLab Operator in GitLab 19.0 with no replacement. These components were intended only for proof-of-concept and test environments and are not recommended for production use. If you run an instance with any of these bundled services, follow the migration guide to configure external services before upgrading to GitLab 19.0. Reliable SCIM user deprovisioning for large groups Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation · Related Issue For organizations managing large numbers of users through SCIM, deprovisioning group members could time out and return 500 errors. SCIM DELETE and PATCH requests now return a success response immediately. Membership removal is handled asynchronously, so identity providers and SCIM clients receive consistent success responses. Filter Credits dashboard by product and date (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue The in-product GitLab Credits dashboard now supports product filtering, date range selection, and Secrets Manager usage visibility. You can filter usage by product (including GitLab Duo and Secrets Manager) and date range, see a daily usage chart across selected products, and review per-user attribution with a Usage control status column. The dashboard also includes usage from service accounts so automated activity is reflected in per-user attribution, and surfaces non-billable and beta events such as Secrets Manager Open Beta activity. This gives you a complete view of credit consumption in your organization. Review prior months of Credits usage (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation · Related Issue In previous versions of GitLab, the Credits dashboard showed only the current billing month, so you couldn’t compare trends, audit a usage spike after the fact, or build a budget conversation around prior consumption. Now you can navigate to prior billing months in the Credits dashboard.

GitLab 18.11 release notes

On April 16, 2026, GitLab 18.11 was released with the following features. In addition, we want to thank all of our contributors, including this month’s notable contributor. This month’s Notable Contributor: Rinku C We are excited to recognize Rinku C, a Level 4 contributor with over 80 merged improvements across GitLab since joining in September 2025. Nominated by Arianna Haradon, Senior Fullstack Engineer on the Developer Relations team, this award celebrates his sustained and meaningful impact over time. Rinku has strengthened security-sensitive flows by requiring scopes on project and group access token creation forms, and improved everyday GitLab experience with numerous updates like next/previous navigation in job logs, excluding empty searches from recent, and reducing file tree clutter through thoughtful UI refinements that make common workflows clearer and easier to navigate. Rinku tackles the work that often goes unclaimed, keeping the codebase healthy and compounding to meaningful, lasting value. Thank you for your contributions! Primary features Vulnerability resolution generally available on GitLab Duo Agent Platform Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue Agentic SAST Vulnerability Resolution is now generally available in GitLab 18.11 on the GitLab Duo Agent Platform. It runs as part of your SAST scan, after SAST false positive detection runs, or when manually triggered for individual SAST vulnerabilities. Agentic SAST Vulnerability Resolution: Autonomously analyzes the finding and reasons through the surrounding code context. Automatically creates a ready-to-review merge request with proposed code fixes for critical and high severity SAST vulnerabilities. Provides quality assessments so reviewers can quickly gauge confidence in the proposed remediation. Allows you to apply resolutions directly from vulnerability details pages. We welcome your feedback in issue 585626. GitLab Data Analyst Foundational Agent now generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related epic The Data Analyst Agent is a specialized AI chat assistant that helps you query, visualize, and surface data across the GitLab platform. Backed by the GitLab Query Language (GLQL), the Data Analyst can retrieve and analyze data about each of the supported data sources, and provide clear, actionable insights about your software development health and engineering efficiency. These insights can be visualized directly in the agent output and embedded directly into issues and epics for further evaluation. CI Expert Agent launches in beta Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The AI-powered CI Expert Agent is now available in beta. This agent helps teams get from GitLab code to a first working pipeline without starting from a blank .gitlab-ci.yml. Using GitLab Duo Agent Platform, the agent inspects your repository, asks a few guided questions about your build and test process, and generates a ready-to-run pipeline you can review, edit, and commit. This turns pipeline creation into a conversational, context-aware experience, while still letting you take full control of the YAML after you’re ready to evolve and optimize your configuration. Automated vulnerability severity overrides Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Default vulnerability severities don’t always reflect your organization’s actual risk. A critical CVE in an internal-only service might not warrant the same urgency as one in a public-facing application, yet teams spend significant time triaging findings that don’t match their risk model. Vulnerability management policies can now automatically adjust the severity of vulnerabilities based on conditions like CVE ID, CWE ID, file path, and directory. When applied, the policy updates the severity of any vulnerability that matches the criteria on the default branch. Manual overrides still take precedence, and all changes are logged in the vulnerability’s history and audit events. This reduces triage work and ensures developers focus on the findings that matter most to your business. Create Service Account in subgroups and projects Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Teams can now create service accounts in subgroups and projects. Instead of broad, top-level group bots, you can attach a dedicated service account to a single subgroup or project and manage its access like any other member of that namespace. Group and subgroup service accounts can be invited to the group where they were created or to any descendant subgroups and projects. Project service accounts are limited to their own project. Service Accounts available on GitLab Free Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Service accounts are now available on GitLab.com in all tiers. Previously limited to Premium and Ultimate, service accounts let you perform automated actions, access data, or run scheduled processes without tying credentials to individual team members. They’re commonly used in pipelines and third-party integrations where credentials must stay stable regardless of team changes. On GitLab Free, you can create up to 100 service accounts per top-level group, including those created in subgroups or projects. Fine-grained permissions for personal access tokens now available (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Fine-grained personal access tokens (PATs) are now available in beta. Unlike legacy PATs, which grant access to every project and group you belong to, fine-grained PATs let you limit each token to specific resources and actions. This reduces the potential impact of a leaked or compromised token. Your existing PATs continue to work as before, and you can still create legacy PATs without fine-grained permissions. This beta release covers approximately 75% of the GitLab REST API. Full REST API coverage, GraphQL enforcement, and administrator policy controls are planned for the GA release. To share feedback, see epic 18555. Top CWE chart in security dashboards Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic The top CWE chart is now available on the new security dashboards. Identify the most common CWEs across your project or instance to identify opportunities for training, improvement, or program optimization. Users can group the dashboard data by severity and filter the dashboard by severity, project, and report type. Deploy Gitaly on Kubernetes Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now deploy Gitaly on Kubernetes as a fully supported deployment method. This gives you greater flexibility in managing your GitLab infrastructure by using Kubernetes orchestration capabilities for scaling, high availability, and resource management. Previously, Kubernetes deployments required custom configurations and weren’t officially supported, making it difficult to maintain reliable Gitaly deployments in containerized environments. Reconfigure inputs when manually running MR pipelines Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue A powerful aspect of CI/CD inputs is that you can manually run new pipelines with new values for runtime customization. This was not available in merge request (MR) pipelines before, but in this release you can now customize inputs in MR pipelines too. After you configure inputs for MR pipelines, you can optionally modify those inputs and change the pipeline behavior any time you run a new pipeline for a merge request. Agentic Core Default model for GitLab Duo Agentic Chat updated from Haiku 4.5 to Sonnet 4.6 Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue We’ve made an update to improve your Agentic Chat experience in GitLab. The default model for Agentic Chat was upgraded from Claude Haiku 4.5 to Claude Sonnet 4.6, hosted on Vertex AI. Claude Sonnet 4.6 offers improved reasoning and response quality but uses a higher GitLab Credit multiplier than Haiku 4.5. You can select an alternative model, including Haiku, using the model selection setting. If you’ve already selected a specific model, your choice is preserved. This update only affects the default and will not override any existing selections. For information about credit multipliers by model, see the GitLab Credits documentation. Configure tools in custom flow definitions Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now configure tool options and parameter values directly in your custom flow definitions to supersede the LLM default values. This gives you more precise, consistent control over how tools behave within a custom flow, making it easier to enforce guardrails and specific parameter values across that flow. Mistral AI now supported as a self-hosted model in GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue GitLab Duo Agent Platform now supports Mistral AI as an LLM platform for self-hosted model deployments. GitLab Self-Managed customers can configure Mistral AI alongside existing supported platforms, including AWS Bedrock, Google Vertex AI, Azure OpenAI, Anthropic, and OpenAI. This gives teams more choice in how they run AI-powered features. Scale and Deployments View historical months in GitLab Credits dashboard Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The GitLab Credits dashboard in Customers Portal now supports historical month navigation. Billing managers can browse past billing months to review daily usage trends, compare consumption patterns across periods, and reconcile usage with invoices. Previously, the dashboard only displayed the current billing month. With this improvement, administrators can make more informed decisions about credit allocation and forecast future needs based on historical data. Set subscription-level usage cap for GitLab Credits Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation Administrators can now set a monthly usage cap for On-Demand Credits at the subscription level. When total on-demand credit consumption reaches the configured cap, GitLab Duo Agent Platform access is automatically suspended for all users on that subscription until the next billing period begins or the admin adjusts the cap. This setting gives organizations a hard guardrail against unexpected overage bills, removing a key barrier to broader Agent Platform rollout. Caps reset automatically each billing period, and administrators receive an email notification when the cap is reached. Set per-user GitLab Credits cap Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation Administrators can now set an optional per-user usage cap for GitLab Credits per billing period. When an individual user’s total credit consumption reaches the configured limit, GitLab Duo Agent Platform access is suspended only for that user, while other users continue unaffected. This prevents any single user from consuming a disproportionate share of the organization’s credit pool, and gives administrators fine-grained control over usage distribution. Per-user usage caps work alongside subscription-level usage caps, by applying the cap that is reached first. Linux package improvements Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue In GitLab 19.0, the minimum-supported version of PostgreSQL will be version 17. To prepare for this change, on instances that don’t use PostgreSQL Cluster, upgrades to GitLab 18.11 will attempt to automatically upgrade PostgreSQL to version 17. If you use PostgreSQL Cluster or opt out of this automated upgrade, you must manually upgrade to PostgreSQL 17 to be able to upgrade to GitLab 19.0. Backup and Restore Support for Container Registry Metadata Database Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue The GitLab backup Rake task for Linux package installations and the [backup-utility](https://docs.gitlab.com/charts/backup-restore/) for Cloud Native (Helm) installations now support the container registry metadata database. You can now back up references to blobs, manifests, tags, and other data stored in the metadata database, enabling recovery in the event of malicious or accidental data corruption. New navigation experience for groups in Explore Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic We’re excited to announce improvements to the groups list in Explore, making it easier to discover groups across your GitLab instance. The redesigned interface introduces a tabbed layout with two views: Active tab: Browse all accessible groups, helping you discover relevant communities and projects. Inactive tab: View archived groups and groups pending deletion for visibility into group lifecycle status. These changes streamline group discovery and provide clearer visibility into which groups are available to join. Asynchronous transfer of projects Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic In previous versions of GitLab, transfers of large groups and projects could timeout. As we move groups and projects to use a unified state model for operations such as transfer, archive, and deletion, you get more consistent behavior, better visibility into state history and audit details, and fewer timeouts, specifically, for long running transfer operations through asynchronous processing. Unified DevOps and Security ClickHouse is generally available for Self-Managed deployments Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue For GitLab Self-Managed instances, we now have improved recommendations and configuration guidance for the GitLab ClickHouse integration. Customers have options to bring their own cluster, or use the ClickHouse Cloud (recommended) setup option. This integration powers multiple dashboards and unlocks access to various API endpoints within the analytics space. This scalable, high-performance database is part of the larger architectural improvements planned for the GitLab analytics infrastructure. Enhanced GitLab Duo Agent Platform analytics on Duo and SDLC trends dashboard Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: Duo Pro, Duo Enterprise Links: Documentation | Related epic The GitLab Duo and SDLC trends dashboard delivers improved analytics capabilities to measure the impact of GitLab Duo on software delivery. The dashboard now includes new single stat panels for monthly Agent Platform unique users and Agentic Chat sessions. Additionally, metrics previously displayed as a % usage compared to seat assignments have been updated to strictly report usage counts. This change resolves the issue where counts were missing Agent Platform usage controlled under the new usage billing model. GLQL now has access to projects, pipelines, and jobs data sources Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation The GitLab Query Language (GLQL) now has access to three new data sources: projects, pipelines, and jobs. These new data sources are also available as embedded views, letting teams surface pipeline results, job statuses, and project overviews directly in wikis, issue and merge request descriptions, and repository Markdown files. GLQL also powers the Data Analyst Agent. With these new types, the agent can inspect CI/CD job results, debug failures, and provide detailed overviews of pipeline execution, as well as provide an accurate overview of projects in a namespace. Dependency resolution for Maven and Python SBOM scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic GitLab dependency scanning using SBOM now supports generating a dependency graph automatically for Maven and Python projects. Previously, dependency scanning required users to provide a lock file or a graph file to get an accurate dependency analysis. Now, when a lock file or graph file is not available, the analyzer automatically attempts to generate one. This improvement makes it easier for Maven and Python projects to enable dependency scanning without requiring a lock file. Incremental scanning for Advanced SAST Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can now perform incremental scans that analyze only changed parts of the codebase with GitLab Advanced SAST, significantly reducing scan times compared to full repository scans. This feature is a further iteration of diff-based scanning, because it produces full results for codebases. By scanning just the code that has changed rather than the entire codebase, your teams can integrate security testing more seamlessly into their development workflow without sacrificing speed or adding friction. Unverified vulnerabilities (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Advanced SAST can now surface unverified vulnerabilities (findings that cannot be fully traced from source to sink) directly in the vulnerability report. Enable this feature if you have a higher tolerance for false positives over false negatives. This feature is in beta status. Provide feedback in issue 596512. Kubernetes 1.35 support Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue GitLab now fully supports Kubernetes version 1.35. If you want to deploy your applications to Kubernetes and access all features, upgrade your connected clusters to the most recent version. For more information, see supported Kubernetes versions for GitLab features. Prefer mode for the container registry metadata database Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue You can now set the container registry metadata database to prefer mode, a new configuration option alongside the existing true and false values. In prefer mode, the registry automatically detects whether it should use the metadata database or fall back to legacy storage based on the current state of your installation. If your registry has existing filesystem metadata that has not been imported to the database, the registry continues to use legacy storage until you complete a metadata import. If the database is already in use, or on a fresh installation, the registry uses the database directly. In a later release, prefer mode will become the default for new Linux package installations. Existing installations will not be affected. For more information, see issue 595480. Package protection rules now support Terraform modules Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Teams publishing Terraform modules through the built-in GitLab Terraform module registry had no way to restrict who could push new module versions. Package protection rules supported several package formats but did not include terraform_module, leaving infrastructure teams without a project-level push control. You can now create package protection rules scoped to terraform_module, restricting push access based on minimum role. Support is available in the UI package type dropdown, the REST API, the GraphQL API, and the GitLab Terraform provider resource. Release evidence now includes packages Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue When creating a GitLab Release, packages published to the package registry were not automatically associated with it. Teams had to manually construct package URLs and attach them as release links through the API or pipeline scripts, adding friction and risk of incomplete release records. GitLab now automatically includes packages in release evidence when the package version matches the release tag. This creates a verifiable, auditable link between your release and its associated packages without any manual steps, keeping source code, artifacts, and packages together in one complete release snapshot. Wiki sidebar toggle repositioned for easier access Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The wiki sidebar toggle is now positioned on the left side, directly next to the sidebar it controls. When the sidebar is collapsed, the toggle remains visible as a floating control so you can reopen it without scrolling back to the top of the page. Sticky action bar on wiki pages Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The action bar on wiki pages is now sticky, so it remains visible as you scroll through a page. Previously, you had to scroll back to the top to access actions like editing, viewing page history, or managing templates. Now the page title and key actions, including Edit, New page, Templates, Page history, and more, stay within reach no matter how far down the page you are. Epic weights Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Epics now support weights, making it easier to estimate and prioritize large-scale initiatives during planning. Before breaking down an epic into child issues, you can assign a preliminary weight to represent your initial estimate. As you decompose the epic, the weight automatically updates to reflect the rolled-up total from all child issues. This is consistent with how weight rollup works for issues and tasks. On the epic detail page, you can see both the preliminary weight and the rolled-up weight from child issues, giving you the insight needed to refine estimates over time. Block merge requests with high exploitability risk Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Previously, merge request (MR) approval policies could block MRs based on vulnerability severity, but not all vulnerabilities carry the same risk. CVSS severity alone doesn’t tell you whether a CVE is being exploited or how likely exploitation is. This leads to noisy approval policies and wasted time for developers and security teams. You can now configure MR approval policies using Known Exploited Vulnerability (KEV) and Exploit Prediction Scoring System (EPSS) data. Block or require approval when a finding is in the KEV catalog (actively exploited in the wild), or when its EPSS score is above a threshold. Policy violations in the MR include KEV and EPSS context so developers understand why the security gate was triggered. This gives security teams precise control over which findings block or warn, reduces alert fatigue, and keeps enforcement aligned with the current threat landscape. Assign CVSS 4.0 scores to vulnerabilities Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic CVSS 4.0 is the latest version of the industry standard used to assess and rate the severity of a vulnerability. You can now view and access CVSS 4.0 score in the UI, including the vulnerability details page and the vulnerability report. You can also query the score using the API. Improved row interaction in the vulnerability report Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Previously, you had to select the row description to navigate to a vulnerability details page from the vulnerability report. You can now select anywhere in the row to go directly to its details. Link styling for the vulnerability description and file location only appears when you hover over each link, and keyboard navigation has been improved. These changes make the vulnerability report more intuitive and accessible. Export a security dashboard as a PDF Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can export the security dashboard as a PDF for use in reports and presentations. The export captures the current state of all of the charts and panels in the dashboard, including any active filters. SAST scanning in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic In GitLab 18.9, we introduced security configuration profiles with the Secret Detection - Default profile. In GitLab 18.11, profiles now extend to SAST with the Static Application Security Testing (SAST) - Default profile, giving you a unified control surface to apply standardized static analysis coverage across all your projects without touching a single CI/CD configuration file. The profile activates two scan triggers: Merge Request Pipelines: Automatically runs a SAST scan each time new commits are pushed to a branch with an open merge request. Results only include new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s SAST posture. Security attribute filters in group security dashboards Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can now filter the results in a group security dashboard based on the security attributes that you have applied to the projects in that group. The available security attributes include the following: Business impact Application Business unit Internet exposure Location Security Manager role (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation The Security Manager role is now available as a beta feature, providing a new default set of permissions designed specifically for security professionals. Security teams no longer need Developer or Maintainer roles to access security features, eliminating over-privileging concerns while maintaining separation of duties. Users with the Security Manager role have the following access: Vulnerability management: View, triage, and manage vulnerabilities across groups and projects, including vulnerability reports and security dashboards. Security inventory: View a group’s security inventory to understand scanner coverage across all projects. Security configuration profiles: View security configuration profiles for a group. Compliance tools: View audit events, compliance center, compliance frameworks, and dependency lists for a group or project. Secret push protection: Enable secret push protection for a group. On-demand DAST: Create and run on-demand DAST scans for a group. To get started, go to a group and select Manage > Members to invite and assign members to the Security Manager role. Identifier list popover in the vulnerability report Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The vulnerability report now shows the primary CVE identifier as a clickable link in each row. When multiple identifiers exist, a "+N more" popover lists all of the identifiers. Each identifier in the list links to its external reference (for example, in the CVE, CWE, or WASC databases) so you can quickly access more details without leaving the report. GitLab Runner 18.11 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation We’re also releasing GitLab Runner 18.11 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Create concrete helper image with bundled dependencies Read the job router feature flag from the runner configuration instead of an environment variable Bug Fixes Incorrect runner binary path after refactoring Pipeline hangs on cache operations The docker-machine binary in GitLab Runner 18.9.0 references CVE-2025-68121 Runner silently falls back to job payload credentials when credential helper binary is missing from DOCKER_AUTH_CONFIG CONCURRENT_PROJECT_ID not unique in different jobs, which causes a conflict in the builds directory Artifact upload fails with timeout awaiting response headers User-defined after_script executes after failed pre_build_script and bypasses post_build_script The list of all changes is in the GitLab Runner CHANGELOG. Related topics Bug fixes Performance improvements UI improvements Deprecations and removals Upgrade notes

GitLab 18.11 released with automated remediation & new foundational agents

GitLab 18.10 release notes

On March 19, 2026, GitLab 18.10 was released with the following features. In addition, we want to thank all of our contributors, including this month’s notable contributor. This month’s Notable Contributor: Harshith Sudar Harshith is currently a Level 3 Contributor who has made impactful contributions improving community tooling and analytics, from triage automation and contributor recognition to GitLab Duo usage insights. Harshith’s contributions were first recognized by Lee Tickett, Fullstack Engineer in DevRel Engineering at GitLab, who nominated him. His work has strengthened how we support contributors behind the scenes through improvements to our automation and contributor-facing experiences. For example, he expanded our triage automation by updating the IssueSummary processor in triage-ops to work with multiple projects, including contributors.gitlab.com, making it easier for us to keep more community projects consistently summarized and visible. He also helped recognize community-created content through the new “Add content” button and flow, which lets contributors log blog posts, videos, and other content directly from their profile and get rewarded. Harshith has also contributed to our analytics and GitLab Duo usage insights. Highlights include refining how GitLab Duo usage is calculated, improving how AI impact over time can be explored by removing the 180-day default, and consolidating DORA metric date range constants, as well as enhancing analytics at scale with improvements like adding infinite scroll for the Value Stream Analytics custom stage label picker. Together, these changes help teams better understand how GitLab is used in real projects. In his own words: “One thing I’ve really enjoyed while contributing is how thoughtfully ideas are discussed within the community. It’s encouraging to see suggestions explored collaboratively, like in the discussion around MR !1288, which turned into a great learning experience. I’m really happy to be part of this community and look forward to making many more contributions in the future.” Thank you, Harshith, for your ongoing work to improve the GitLab codebase and contributor experience! Want to connect with Harshith and learn more about his contributions? Visit Harshith’s GitLab profile and his LinkedIn profile. Primary features SAST false positive detection with GitLab Duo Agent Platform Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: Duo Core, Duo Pro, Duo Enterprise Links: Documentation | Related epic SAST false positive detection, which was first introduced as a beta in GitLab 18.7, is now generally available in GitLab 18.10. When a security scan runs, GitLab Duo Agent Platform analyzes each critical and high severity SAST vulnerability and determines the likelihood that it’s a false positive. The assessment appears directly in the vulnerability report, giving teams the context they need to triage with confidence rather than uncertainty. Key capabilities include: Automatic analysis: False positive detection runs automatically after each security scan with no manual intervention required. Manual option: Users can manually run false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Limiting the analysis to critical and high severity SAST vulnerabilities cuts through the noise where it matters most. Contextual AI reasoning: Each assessment explains why a finding may or may not be a false positive, factoring in code context, data flow, and vulnerability characteristics specific to static analysis. Seamless workflow integration: Results surface directly in the vulnerability report alongside existing severity, status, and remediation information — no changes to existing workflows required. This feature is available for Ultimate customers with GitLab Duo Agent Platform. The feature must be enabled in your group or project settings. We welcome your feedback in issue 583697. Purchase GitLab Credits on the Free tier on GitLab.com Tier: Free Offering: GitLab.com Add-ons: GitLab Credits Links: Documentation | Related epic Free tier group Owners on GitLab.com can now unlock AI with GitLab Credits. Purchase a monthly credit amount, commit to an annual term, and get access to GitLab Duo Agent Platform agents and flows. Credits refresh automatically each month, so your team always has what it needs to build faster and smarter. Key highlights: Usage-based pricing: Purchase a monthly credit commitment without needing a base plan subscription. Self-service purchasing: Buy credits through the GitLab purchase flow. Seamless upgrade path: Your credit commitment transfers if you later upgrade to Premium or Ultimate. Consumption tracking: Monitor your credit usage through the GitLab Credits dashboard. This purchase option is currently only available for free GitLab.com top-level groups. Sign in securely with passkeys Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic GitLab now supports passkeys for passwordless sign-in and as a phishing-resistant two-factor authentication (2FA) method. Passkeys use public-key cryptography and biometric authentication (fingerprint, face recognition) or your device PIN to securely access your account. Passkeys offer the following benefits: Passwordless convenience: Sign in with your device’s biometrics or PIN instead of remembering a password. Multi-device support: Use passkeys on desktop browsers, mobile devices (iOS 16 or later, Android 9 or later), and FIDO2/WebAuthn-compatible hardware security keys. Phishing-resistant security: Your private key never leaves your device. GitLab only stores the public key, protecting your account even if GitLab servers are compromised. Automatic 2FA integration: For accounts with 2FA enabled, passkeys become available as your default 2FA method. To get started, add a passkey in your account settings. We welcome your questions and feedback in issue 366758. Introducing the work items list and saved views Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic The GitLab planning experience is getting a significant upgrade with the work items list and saved views, bringing together two long-requested capabilities: The work items list combines epics, issues, and other work items into a single unified list, eliminating the need to switch between separate pages for different work item types. This makes it easier to understand relationships across your planning objects. Saved views allow you to create and save customized list configurations, including filters, sort order, and display options. This makes routine checks more efficient, and supports standardized ways of viewing work across your team. This is the next step in the GitLab work items journey, a unified architecture designed to deliver consistency and unlock new capabilities across GitLab planning tools. Share your thoughts and feedback in issue 590689. Custom agents can use MCP to access external data Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation | Related issue You can now connect custom agents in the AI Catalog to external data sources and tools through the Model Context Protocol (MCP), without leaving GitLab. This feature is an experiment. Share your feedback in issue 593219. Enforce merge request title naming conventions with regex Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Maintaining consistent merge request titles is important for teams that rely on structured naming conventions. Whether that’s following the Conventional Commits format, or linking to an internal tracking system. Teams previously needed external tooling or custom CI/CD pipeline jobs to enforce these conventions, but this approach had a critical gap. If someone changed the merge request title after the pipeline ran, there was no re-validation, and the MR could still be merged with a non-compliant title. You can now configure a required title regex for merge requests in your project settings. When configured, GitLab evaluates the merge request title against the pattern as a mergeability check — blocking the merge until the title is updated to comply, regardless of when the title was last changed. To set this up, go to your project’s Settings > Merge requests and enter a regex pattern in the Merge request title must match regex field. Your existing merge request workflows continue to work as before. This check only applies to projects where you explicitly configure a title regex. Secret false positive detection with AI (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Add-ons: Duo Core, Duo Pro, Duo Enterprise Links: Documentation | Related epic Security teams spend significant time investigating secret detection findings that turn out to be false positives. For example, test credentials, example values, and placeholder tokens that are incorrectly flagged as actual secrets. False positives create alert fatigue, erode trust in scan results, and divert attention from genuine security risks. GitLab 18.10 introduces AI-powered secret false positive detection (beta) to focus on the secrets that actually matter. When a security scan runs, GitLab Duo automatically analyzes each Critical and High severity secret detection vulnerability to determine if it’s a false positive. The AI assessment appears directly in the vulnerability report, giving security engineers immediate context to make faster and confident triage decisions. Key capabilities include: Automatic analysis: False positive detection runs automatically after each security scan without manual trigger. Manual trigger option: You can manually trigger false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Scoped for Critical and High severity vulnerabilities to maximize signal-to-noise improvement. Contextual AI reasoning: Each assessment includes an explanation of why the finding may or may not be a true positive, based on code context and vulnerability characteristics. Confidence scoring: Each detection includes a confidence score to help teams prioritize review based on the model’s certainty. Seamless workflow integration: Results surface directly in the vulnerability report alongside existing severity, status, and remediation information. This feature is available as a free beta for Ultimate customers and must be enabled in your group or project settings. Share feedback in issue 592861. Use runtime inputs with CI/CD jobs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Using CI/CD variables for dynamic job configuration can be challenging. Variables follow a complex override hierarchy that’s difficult to manage, and they can’t be used for a variety of use cases. Now you can use inputs to define explicit, typed inputs at the job level. Use job inputs to define and control the values that a job accepts at runtime. With job inputs, you get: Type safety (string, number, boolean, array). Default values that can be static or reference existing variables. The option to define a strict list of possible values to use. Regex support for validating input values. Job inputs can use the default values without any user interaction, but you can modify the values when retrying a job or running a manual job. Agentic Core GitLab Blob Search for group and instance code search Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The [gitlab_blob_search](../../user/duo_agent_platform/agents/tools.md) tool now enables GitLab AI agents to search your code: Across all projects in a group. Across all accessible projects on an instance. Previously, blob search was limited to a single project, or required specifying explicit project IDs. This change makes it easier for AI-powered workflows to discover and reuse code that’s spread across multiple related projects. GitLab MCP server tool for pipeline management Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now manage your CI/CD pipelines in a GitLab project with the new manage_pipeline tool. This GitLab MCP server tool lets AI agents create, cancel, retry, delete, and update pipeline metadata in a single call. With this tool, you no longer have to piece together multiple steps to automate your pipeline workflows. If you want to see other GitLab MCP sever tools, let us know in the feedback issue. Project Maintainers can enable custom agents and flows Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Previously, enabling AI agents and flows from the AI Catalog required top-level group permissions. Now, when browsing the AI Catalog at the explore level or project level, project Maintainers can enable agents and flows directly in their projects. Configure network access control for remote flows in projects Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now configure network access controls for flows using GitLab runners in projects. This provides secure external integrations, while maintaining control over network destinations. This also gives project maintainers the flexibility to allow necessary API connections, MCP servers, and third-party services while enforcing security boundaries. Configure network access controls in the network_policy section of agent-config.yml. The agent-config.yml is protected by branch protection rules and MR approval workflows. Self-hosted Vertex AI for GitLab Duo Agent Platform Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related issue Vertex AI is now a supported LLM platform within GitLab Duo Agent Platform Self-Hosted. Customers can now configure Anthropic models hosted on Vertex AI for use with GitLab Duo Agent Platform features. Users can enable agents and flows directly from projects Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Maintainers and Owners can now enable agents and flows directly from their project or the explore page, without navigating away from their current context. Top-level group Owners can also select their group, and the specific projects where they want to activate agents and flows, streamlining their workflow setup. Support for Agent Skills in IDEs and CI/CD pipelines Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related issue GitLab Duo Agent Platform now supports the Agent Skills specification, an emerging standard for giving AI agents new capabilities and expertise. You can define Agent Skills at the workspace level for your project to give agents specialized knowledge and workflows for specific tasks, like writing tests in a specific framework. Agents automatically discover and load relevant skills as they encounter matching tasks. You can also trigger skills manually by name, file path, or custom slash commands. Agent Skills are accessible for flows and Agentic Chat in your IDE, and for flows run in CI/CD pipelines. They also work with any other AI tool that supports the specification. Scale and Deployments Download credit usage data as CSV Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Billing managers can now download credit usage data as a CSV file directly from the GitLab Credits dashboard in Customers Portal. The export provides a daily, per-action breakdown of credit consumption for the current billing month, including commitment, waiver, trial, on-demand, and included credits used. Finance and operations teams can use this data to perform cost allocation, chargeback reporting, and usage analysis in Excel, Google Sheets, or BI tools without manual data gathering or support requests. Link credit usage to GitLab Duo Agent Platform sessions Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue The GitLab Credits dashboard now links credit consumption directly to the GitLab Duo Agent Platform session that generated it. In the per-user drill-down view, the Action column for Agent Platform usage rows (such as Agentic Chat or Foundational Agents) is now a clickable hyperlink that navigates to the corresponding session details. This link provides a direct audit trail from billing to AI session behavior, so administrators can investigate credit usage, support escalations, and compliance reviews without manually correlating timestamps across separate systems. Sort users in the GitLab Credits dashboard Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Enterprise administrators can now sort the Usage by User table in the GitLab Credits dashboard by total credits used or by username. The default sort order is by total credits consumed (highest first), so the top consumers are immediately visible without scrolling. With this view, administrators managing thousands of GitLab Duo users can quickly identify high-usage individuals for cost allocation, chargeback reporting, and license utilization audits. New navigation experience for projects in Explore Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic We’ve streamlined the projects page in Explore to reduce clutter and remove redundant options that accumulated over time. The simplified interface now focuses on two core views: Active tab: Discover projects with recent activity and ongoing development. Inactive tab: Access archived projects and those scheduled for deletion. We’ve removed several redundant tabs: Most starred projects can be found by sorting Active or Inactive tabs by star count. All projects are available by viewing both Active and Inactive tabs. Trending tab will be fully removed in GitLab 19.0 due to limited functionality and low usage. The cleaner design aligns with other project lists for visual consistency. You can still access all the same content through more logical organization and flexible sorting options. Unified DevOps and Security Dependency Scanning with SBOM support for Java Gradle build files Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue GitLab dependency scanning by using SBOM now supports scanning Java build.gradle and build.gradle.kts build files. Previously, dependency scanning for Java projects using Gradle required a lock file to be present. Now, when a lock file is not available, the analyzer automatically falls back to scanning build.gradle and build.gradle.kts files, extracting and reporting only direct dependencies for vulnerability analysis. This improvement makes it easier for Java projects using Gradle to enable dependency scanning without requiring a lock file. To enable manifest fallback, set the DS_ENABLE_MANIFEST_FALLBACK CI/CD variable to "true". Dependency scanning SBOM-based scanning extended to self-managed Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation | Related issue In GitLab 18.10, we’re extending limited availability status to self-managed instances for the new SBOM-based dependency scanning feature. This feature was initially released in GitLab 18.5 with limited availability for GitLab.com only, behind the feature flag dependency_scanning_sbom_scan_api and disabled by default. With additional improvements and fixes, we now have confidence to reliably use the new SBOM scanning internal API and enable this feature flag by default. This internal API allows the dependency scanning analyzer to generate a dependency scanning report containing all component vulnerabilities. Unlike the previous behavior (Beta) that processed SBOM reports after CI/CD pipeline completion, this improved process generates scan results immediately during the CI/CD job, giving users instant access to vulnerability data for custom workflows. Self-managed customers who encounter issues can disable the dependency_scanning_sbom_scan_api feature flag. The analyzer will then fall back to the previous behavior. To use this feature, import the v2 dependency scanning template Jobs/Dependency-Scanning.v2.gitlab-ci.yml. We welcome feedback on this feature. If you have questions, comments, or would like to engage with our team, please reach out in this feedback issue. License scanning support for Dart/Flutter projects using Pub package manager Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic GitLab now supports license scanning for Dart and Flutter projects that use the pub package manager. Previously, teams building with Dart or Flutter were unable to identify the licenses of their open source dependencies directly within GitLab, creating compliance blind spots for organizations with license policy requirements. License data is sourced directly from pub.dev, the official Dart package repository, and results are surfaced alongside other supported ecosystems. Dart/Flutter dependency scanning and vulnerability detection were already supported. Conan 2.0 package registry support (Beta) Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue C and C++ development teams using Conan as their package manager have long requested registry support in GitLab. Previously, the Conan package registry was experimental and only supported Conan 1.x clients, limiting adoption for teams that have migrated to the modern Conan 2.0 toolchain. The Conan package registry now supports Conan 2.0 and has been promoted from Experimental to Beta. This release includes full v2 API compatibility, recipe revision support, improved search capabilities, and proper handling of upload policies including the --force flag. Teams can publish and install Conan 2.0 packages directly from GitLab using standard Conan client workflows, reducing the need for external artifact management solutions like JFrog Artifactory. With this update, platform engineering teams managing C and C++ dependencies can consolidate their package management within GitLab alongside their source code, CI/CD pipelines, and security scanning. The Conan registry supports both project-level and instance-level endpoints, and works with personal access tokens, deploy tokens, and CI/CD job tokens for authentication. We welcome feedback as we work toward general availability. Please share your experience in the epic. Manage container virtual registries with a dedicated UI (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic When the container virtual registry launched in beta last milestone, platform engineers could aggregate multiple upstream container registries — Docker Hub, Harbor, Quay, and others — behind a single pull endpoint. However, all configuration required direct API calls, meaning teams had to maintain scripts or manual curl commands to create and manage their registries, configure upstreams, and handle changes over time. This added operational overhead and made the feature inaccessible to users who weren’t comfortable working directly with the API. Container virtual registries can now be created and managed directly from the GitLab UI. From the group-level container registry page, you can create new virtual registries, configure upstream sources with authentication credentials, edit existing configurations, and delete registries you no longer need — all without leaving GitLab or writing a single API call. The UI integrates seamlessly with the existing container registry experience, making virtual registries a first-class part of your group’s artifact management workflow. This feature is in beta. To share feedback, please comment in the feedback issue. GitLab Helm Chart registry generally available Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Teams using Helm to manage Kubernetes application deployments can now rely on the GitLab Helm Chart registry for production workloads. Previously in beta, the registry is now generally available following the resolution of key architectural and reliability concerns. The path to GA included resolving a hard limit that prevented the index.yaml endpoint from returning more than 1,000 charts, fixing a background indexing bug that caused newly published chart versions to be missing from the index, completing a full AppSec security review, and adding Geo replication support for Helm metadata cache, ensuring high availability for self-managed customers running GitLab Geo. Platform and DevOps teams can publish and install Helm charts directly from GitLab using standard Helm client workflows, with support for project-level endpoints and authentication using personal access tokens, deploy tokens, and CI/CD job tokens. Now you can keep charts alongside the source code, pipelines, and security scanning that depend on them. Task item support in Markdown tables Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now use task item checkbox syntax directly in Markdown table cells. Previously, achieving this required a combination of raw HTML and Markdown, which was cumbersome and difficult to maintain. This improvement makes it easier to track task completion directly within structured table layouts in issues, epics, and other content. Pipeline secret detection in security configuration profiles Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation In GitLab 18.9, we introduced security configuration profiles with the Secret Detection - Default profile, starting with push protection. You use the profile to apply standardized secret scanning across hundreds of projects without touching a single CI/CD configuration file. The Secret Detection - Default profile now also covers pipeline-based scanning, providing a unified control surface for secret detection across your entire development workflow. The profile activates three scan triggers: Push Protection: Scans all Git push events and blocks pushes where secrets are detected, preventing secrets from ever entering your codebase. Merge Request Pipelines: Automatically runs a scan each time new commits are pushed to a branch with an open merge request. Results only include new vulnerabilities introduced by the merge request. Branch Pipelines (default only): Runs automatically when changes are merged or pushed to the default branch, providing a complete view of your default branch’s secret detection posture. Applying the profile requires no YAML configuration. The profile can be applied to a group to propagate coverage across all projects in the group, or to individual projects for more granular control. macOS Tahoe 26 and Xcode 26 job image Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation | Related epic You can now create, test, and deploy applications for the newest generations of Apple devices using macOS Tahoe 26 and Xcode 26. With hosted runners on macOS, your development teams can build and deploy macOS applications faster in a secure, on-demand build environment integrated with GitLab CI/CD. Try it out today by using the macos-26-xcode-26 image in your .gitlab-ci.yml file. GitLab Runner 18.10 Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation We’re also releasing GitLab Runner 18.10 today! GitLab Runner is the highly-scalable build agent that runs your CI/CD jobs and sends the results back to a GitLab instance. GitLab Runner works in conjunction with GitLab CI/CD, the open-source continuous integration service included with GitLab. What’s New Allow k8s runner to define Pod Level Resources for build pod Add automation to update Go versions and packages for all Runner projects Bug Fixes S3 cache with RoleARN returns 403 instead of 404 for non-existent cache Using helper image gitlab-runner-helper:x86_64-v16.11.1-nanoserver21H2 results in init-permissions error MacOS: LaunchAgent - Service could not initialize on M1 architecture The list of all changes is in the GitLab Runner CHANGELOG. Related topics Bug fixes Performance improvements UI improvements Deprecations and removals Upgrade notes

GitLab 18.10 released with agentic SAST FP detection and free-tier credits

Today, we are excited to announce the release of GitLab 18.10 with SAST false positive detection with GitLab Duo Agent Platform, credits for free tier users, passwordless sign-in with passkeys, work items list and saved views, and much more! These are just a few highlights from the 60+ improvements in this release. Read on to check out all of the great updates below. To the wider GitLab community, thank you for the 212 contributions you provided to GitLab 18.10! At GitLab, everyone can contribute and we couldn't have done it without you! To preview what's coming in next month’s release, check out our What's new page.

GitLab 18.9 release notes

On February 19, 2026, GitLab 18.9 was released with the following features. In addition, we want to thank all of our contributors, including this month’s notable contributor. This month’s Notable Contributor: Pooja Ghanghas Pooja has made significant contributions to ongoing efforts at GitLab to migrate legacy dropdown components to our modern dropdown architecture. These migrations require careful attention to detail and an understanding of both the old and new component systems. Pooja has consistently delivered high-quality work across multiple migrations, including updates to the diff file header, code block bubble menu, oncall schedules rotation assignee component, and the new resource dropdown. Peter Hegman, Staff Frontend Engineer on Tenant Scale::Organizations at GitLab, nominated Pooja for this recognition, noting: “These migrations can be pretty tricky and she has completed a number of them. Thanks for your contributions!” Beyond these migration efforts, Pooja has also contributed to feature development, including adding statuses to milestones and iterations, a feature she put significant effort into getting merged. Marc Saleiko, Staff Fullstack Engineer on Plan:Project Management at GitLab, recognised her work: “This is a valuable contribution and you did a great job delivering this functionality!” Reflecting on her experience, Pooja shared: “I’m proud of how it turned out and it was a great learning experience for me.” She has also contributed numerous bug fixes and maintenance improvements across the GitLab codebase. Pooja’s work directly improves the maintainability and consistency of the GitLab user interface, making it easier for both contributors and team members to build and maintain features, and helping move the GitLab frontend architecture forward. Thank you, Pooja, for your continued contributions to improving the GitLab codebase and for being such a reliable member of our contributor community! Want to learn more about Pooja’s contributions? Check out her GitLab profile. Primary features GitLab Duo Agent Platform Self-Hosted models now available for cloud licenses Tier: Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation | Related epic GitLab Duo Agent Platform is now generally available for GitLab Self-Managed customers with a cloud license. Billing for this feature is usage-based. Administrators can configure compatible models for use with GitLab Duo Agent Platform. Administrators using AWS Bedrock or Azure OpenAI can also configure Anthropic Claude or OpenAI GPT models. Not yet on Ultimate? Start a free trial with Duo Agent Platform included. Vulnerability resolution with GitLab Duo Agent Platform (Beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Triaging and remediating SAST vulnerabilities is one of the most time-consuming tasks in application security. After identifying a real vulnerability, developers need to understand the finding, locate the affected code, and write an appropriate fix. All of which take time and specialized knowledge. In GitLab 18.9, we’re introducing Agentic SAST Vulnerability Resolution. When you trigger resolution for a SAST vulnerability, GitLab Duo autonomously analyzes the finding, reasons through the surrounding code context, generates a context-aware fix, and creates a merge request without any manual intervention. Key capabilities include: Agentic multi-step resolution: Rather than producing a single code suggestion, the GitLab Duo Agent Platform reasons through the vulnerability, evaluates the codebase, and produces a well-informed fix. Automatic merge request creation: Generates a ready-to-review merge request with the proposed code fix for critical and high severity SAST vulnerabilities. Quality scoring: Each generated fix includes a quality assessment so reviewers can quickly gauge confidence in the proposed remediation. SAST vulnerability resolution is available from the vulnerability report and the individual vulnerability details pages. You can trigger a resolution directly from the individual vulnerability details page. This feature is available as a free beta for Ultimate customers. We welcome your feedback in issue 585626. Navigate repositories with collapsible file tree Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can now browse repository files with a collapsible file tree. The tree provides a comprehensive view of your project structure, so you can expand and collapse directories inline, jump between files in different parts of your repository, and maintain context while you work. The file tree appears as a resizable sidebar when you view repository files or directories. You can toggle visibility with keyboard shortcuts, filter files by name or extension, and navigate through complex project hierarchies. The tree synchronizes with your current location, so when you select a file in the main content area, the tree updates to show that file. Your existing repository structure and file organization remain unchanged. With fewer page loads required to move between files, this feature scales from small projects to large codebases with thousands of files. Include CI/CD inputs from a file Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Previously, pipeline inputs could only be defined directly within a pipeline’s spec section. This limitation made it challenging to reuse input configuration across multiple projects. In this release you can now include input definitions from external files using the familiar include keyword. Being able to maintain a list of inputs in a separate place helps you have a manageable solution across many projects or pipelines. You can maintain centralized input configurations and even dynamically manage input values from external sources. Web-based commit signing on GitLab.com Tier: Free, Premium, Ultimate Offering: GitLab.com Links: Documentation | Related epic Ensuring commits are cryptographically signed is essential for code integrity and meeting compliance requirements. Previously, web-based commit signing was only available for GitLab Self-Managed. GitLab.com now supports web-based commit signing. When enabled for a group or project, commits created through the GitLab web interface are automatically signed with the GitLab signing key and are displayed with a Verified badge, providing cryptographic proof of authenticity for your repositories. Key details: Enable in group or project settings based on your requirements. All web-based commits (Web IDE edits, merges, API operations) are automatically signed when enabled. This brings the GitLab.com security capabilities in line with GitLab Self-Managed and provides the foundation for comprehensive commit signing policies across your organization. Container virtual registry now available (Beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation | Related epic Modern container-based development requires accessing images from multiple registries including Docker Hub, Harbor, Quay, and private registries. Without a container virtual registry, platform engineers must configure each project and CI/CD pipeline to authenticate with and pull from multiple registries individually. This creates configuration complexity, slows pulls with sequential registry queries, and makes it difficult to implement consistent security policies across container sources. The container virtual registry addresses these challenges by aggregating multiple upstream container registries behind a single endpoint. Platform engineers can configure Docker Hub, Harbor, Quay, and other registries with long-lived token authentication through one URL. Intelligent caching improves pull performance while integrating with the GitLab authentication systems for centralized access control and audit logging. The container virtual registry API is currently available in beta for GitLab Premium and Ultimate customers. Beta participants can use the GitLab API to create container virtual registries, configure multiple upstream sources with shareable configurations, and pull container images through the virtual registry. Please note the beta does not support registries that require IAM authentication. Support for cloud provider registries requiring IAM authentication is tracked in this epic. On GitLab.com, this feature is behind a feature flag. To request access or share feedback, please comment in the feedback issue. New security dashboard chart: Vulnerabilities by age Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic The new Vulnerabilities by age chart helps you understand how long vulnerabilities have been open in your environment. The chart shows the distribution of unresolved vulnerabilities based on the amount of time since they were first detected. You can group vulnerabilities by severity or by report type, helping you identify where remediation activities may be needed. Agentic Core OAuth support in JetBrains IDEs for Self-Managed and Dedicated Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Add-ons: Duo Core, Duo Pro, Duo Enterprise Links: Documentation | Related issue The GitLab Duo plugin for JetBrains IDEs now supports OAuth authentication for GitLab Self-Managed and GitLab Dedicated. This means all JetBrains users can now enjoy a faster, more secure sign-in experience. No personal access token required. Scale and Deployments Non-billable Minimal Access users Tier: Premium Offering: GitLab Self-Managed Links: Documentation | Related issue Previously, organizations that used identity providers to automate user provisioning on GitLab Self-Managed Premium might run into a potential problem. When identity provider syncs attempt to add users beyond the licensed seat limit, administrators must either purchase extra seats for users who don’t need active access, or manually intervene to prevent failures. Now, users with the Minimal Access role on GitLab Self-Managed Premium subscriptions no longer count as billable seats, bringing them in line with how minimal access works on GitLab.com Premium, GitLab.com Ultimate, and GitLab Self-Managed Ultimate. This change unlocks the restricted access feature, which automatically assigns the Minimal Access role to users who would otherwise exceed the seat limit during identity provider syncs. This change keeps syncs running smoothly without unexpected billing overages or manual intervention. Geo data management view on primary site Tier: Premium, Ultimate Offering: GitLab Self-Managed, GitLab Dedicated Links: Documentation You can now troubleshoot and verify data integrity directly from the primary site, thanks to the new data management view that brings detailed verification status information to the primary Geo site. This enhancement eliminates the need to access secondary sites for basic verification and troubleshooting tasks. Previously, this verification status was only accessible through the secondary site UI. Now, with the data management view on the primary site, you can: View detailed verification status for all replicable data types on the primary site Perform data sanitization and troubleshooting tasks directly from the primary UI Set up and verify your Geo configuration on the primary site before adding secondary sites This enhancement is the first step toward comprehensive self-serve troubleshooting with the UI, reducing the need to access multiple sites for routine maintenance and issue resolution. GitLab Duo Agent Platform available in Ultimate trials Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed Links: Documentation | Related epic Teams evaluating GitLab can now test agentic AI capabilities that automate complex development workflows and reduce manual tasks. Sign up for a GitLab Ultimate trial and get access to Duo Agent Platform with 24 evaluation credits per user, enabling hands-on experience with autonomous task execution and multi-step workflow orchestration during a 30-day evaluation. Evaluation credits are available for 30 days from the provision date, so consider your team’s readiness before starting. Start your free trial. Current paid customers can access evaluation credits through their account team. Contact Sales to learn more. Zero Downtime Upgrades now supported for Cloud Native Hybrid deployments Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation Zero Downtime Upgrades are now officially supported for Cloud Native Hybrid deployments. Enterprise customers require their DevSecOps platform to be available at all times, making upgrade-related downtime a significant operational concern. Until now, Zero Downtime Upgrades were only supported for Linux package-based high availability deployments, which drove many customers toward VM-based architectures even when cloud-native Kubernetes deployments would have better suited their infrastructure strategy. We’ve been upgrading our own Cloud Native Hybrid SaaS instances with zero downtime for years. With this release, we’re bringing that same operational experience to self-managed customers running GitLab on Kubernetes. The upgrade procedure has been comprehensively tested and is now fully documented, giving you the confidence to maintain availability during version upgrades. Archive a group and its content Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Managing completed initiatives and abandoned projects is now easier. You can now archive entire groups, including all subgroups and projects, in one action, eliminating the need to manually archive each project individually. When you archive a group: All nested subgroups and projects are automatically archived. Archived content moves to the Inactive tab with clear status badges. Group data remains fully accessible in read-only mode for reference or restoration. Write permissions are disabled across the archived group and its content. Beyond the Settings page, you can archive groups and projects directly from the actions menu in list views. No more navigating through multiple screens for simple administrative tasks. This highly requested feature dramatically reduces administrative overhead while keeping your workspace organized with clear separation between active and inactive work. Share your feedback in epic 18616. Valkey as replacement option for Redis (Beta) Tier: Free, Premium, Ultimate Offering: GitLab Self-Managed Links: Documentation Starting with GitLab 18.9, Valkey is bundled as an opt-in replacement for Redis in the Linux package. Redis changed their license to AGPLv3, which is not suitable for open source customers. To guarantee security and maintainability for our GitLab Self-Managed customers, we are transitioning from Redis to Valkey, a community-driven fork that maintains the permissive BSD license. Transition timeline: GitLab 18.9 (this release): Valkey is bundled as an opt-in replacement (beta). You can switch from Redis to Valkey at your convenience. Valkey Sentinel support is included. GitLab 19.0 (May 2026): Valkey becomes the default and Redis binaries are removed from the Linux package. Existing Redis configuration settings remain functional and are honored for backwards compatibility. This transition only affects the bundled Redis in Linux packages. Customers on scaled architectures using external Redis deployments can continue to use Redis. We are monitoring the potential feature divergence between Redis and Valkey and will provide guidance as the ecosystem evolves. Unified DevOps and Security Dependency Scanning with SBOM support for Java pom.xml manifest files Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue GitLab dependency scanning by using SBOM now supports scanning Java pom.xml manifest files. Previously, dependency scanning for Java projects using Maven required a graph file to be present. Now, when a graph file is not available, the analyzer automatically falls back to scanning pom.xml files, extracting and reporting only direct dependencies for vulnerability analysis. This improvement makes it easier for Java projects to enable dependency scanning without requiring a graph file. To enable manifest fallback, set the DS_ENABLE_MANIFEST_FALLBACK CI/CD variable to "true". Dependency Scanning with SBOM support for Python requirements.txt manifest files Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue GitLab dependency scanning by using SBOM now supports scanning Python requirements.txt manifest files. Previously, dependency scanning for Python projects required a lock file to be present. Now, when a lock file is not available, the analyzer automatically falls back to scanning requirements.txt files, extracting and reporting only direct dependencies for vulnerability analysis. This improvement makes it easier for Python projects to enable dependency scanning without requiring a lock file. To enable manifest fallback, set the DS_ENABLE_MANIFEST_FALLBACK CI/CD variable to "true". Restrict personal snippets for enterprise users Tier: Premium, Ultimate Offering: GitLab.com Links: Documentation Organizations using GitLab.com need to ensure that enterprise users don’t accidentally expose sensitive code through personal snippets. Previously, there was no way to prevent users from creating snippets in their personal namespace, which can pose a security risk if snippets are inadvertently set to public. Group Owners can now restrict personal snippet creation for enterprise users, helping maintain tighter control over where code is shared. When restricted, enterprise users cannot create snippets in their personal namespace. Rapid Diffs improves performance for commit changes Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic Reviewing commits with many changed files or substantial modifications can be slow. Rapid Diffs technology now powers the commits page (/-/commits/), delivering faster loading times, smoother scrolling, and more responsive interactions. With Rapid Diffs, you’ll notice: A pagination-free experience. Faster initial load, so you can start working with code sooner. A refreshed interface with a new file browser for quicker navigation between files. Responsive interactions, even with large numbers of changed files. All existing functionality is preserved. As Rapid Diffs expands to other areas of GitLab, the same performance benefits will follow. Support for Bitbucket Cloud API tokens in import API Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation The GitLab import API now supports Bitbucket Cloud API tokens, providing a more secure way to import repositories from Bitbucket Cloud. Atlassian has deprecated app passwords in favor of API tokens, and we’re planning to remove support for app passwords in 19.0. Importing from Bitbucket Cloud through the GitLab UI is not affected by this change. Centralized security governance and configuration Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation Manage and visualize security scanner coverage across your organization. This release introduces security configuration profiles, starting with the secret detection profile. Security teams now have a more powerful command center to secure your organization at scale. Profile-based security configuration Instead of manually editing YAML files for each project, you can now use preconfigured security configuration profiles that provide several advantages: Standardized governance: Preconfigured profiles apply appropriate boundaries without interrupting productivity. You can apply standardized security best practices, without requiring custom role configurations. Scalable management: Apply the same profile across hundreds or thousands of projects with a single action. The secret detection profile is the first security configuration profile available. It provides the following advantages: Actively identifies and blocks secrets from being committed to your repositories. One profile manages secret detection across your entire development workflow. No need to manage separate configurations for different trigger types. Enhanced security inventory The security inventory has been upgraded to act as your primary dashboard to assess each group’s security posture: Group and project hierarchies: Easily distinguish between subgroups and projects in the inventory with clear iconography. Bulk actions: A new Bulk Action menu allows you to apply or disable security scanner profiles across all selected projects and subgroups simultaneously. Visual coverage status: Quickly identify gaps with color-coded status bars (Enabled, Not Enabled, or Failed) with tooltips for details. Profile status indicators: See which trigger types are available in the profile details. Security attributes Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation Security attributes, introduced as a beta in GitLab 18.6, are now generally available. Security attributes allow security teams to apply business context to their projects, including business impact, application, business unit, internet exposure, and location. You can also create custom attribute categories to match your organization’s taxonomy. By applying these attributes, you can filter and prioritize the items in your security inventory based on risk posture and organizational context. Security dashboards: Vulnerabilities over time chart improvements Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic The Vulnerabilities over time chart is updated to provide a more accurate view of your vulnerability inventory. The chart previously included vulnerabilities that were no longer detected, leading to inflated numbers that did not accurately represent the state of active vulnerabilities. We are aware of two additional issues that may slightly alter counts in some cases. Follow issue 590022 and issue 590018 for updates. View CI/CD job metrics for projects (limited availability) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation | Related epic GitLab CI/CD analytics now combines CI/CD pipeline and CI/CD job performance trends, which enables developers to identify inefficient or problematic CI/CD jobs quickly. These capabilities are included directly in the GitLab UI, so developers have the tools they need in context to identify and fix CI/CD performance problems that can significantly impact development teams’ velocity and overall productivity. For platform administrators, the CI/CD jobs data in this view also reduces the need to rely on external or custom-built CI/CD observability solutions when you operate GitLab at an enterprise scale. Add timestamps to CI job logs Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue You can now view timestamps on each CI job log line to identify performance bottlenecks and debug long-running jobs. Timestamps are displayed in UTC format. Use timestamps to troubleshoot performance issues, identify bottlenecks, and measure the duration of specific build steps. Requires GitLab Runner 18.7 or later for GitLab Self-Managed. CI/CD Catalog component analytics Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related issue Previously, teams lacked visibility into how CI/CD Catalog component projects were being used across their organization. Now you can view usage counts and adoption patterns at a high level, helping you understand which component projects are most valuable and optimize your catalog investments. View security reports from child pipelines in merge requests Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation | Related epic You can now view security and compliance reports from child pipelines directly in merge request widgets. Previously, you had to manually navigate through multiple pipelines to identify security issues, creating inefficient workflows especially with monorepos and complex testing setups. With this enhancement, the merge request widget displays reports from child pipelines directly alongside parent pipeline results, with each child pipeline’s reports presented individually and artifacts available for download. This provides a unified view of all security checks, significantly reducing time spent investigating failures and enables faster merge request reviews when using parent-child pipelines. Related topics Bug fixes Performance improvements UI improvements Deprecations and removals Upgrade notes