gitlab·Jul 16, 2026·3 min readCurated summary

GitLab 19.2 release notes | GitLab Docs

GitLab 19.2, released July 16, 2026, focuses heavily on AI-assisted development, workflow automation, and centralized security controls. Major additions include the generally available GitLab Duo CLI and custom flows, scheduled pipeline execution policies, and Agentic Chat integrations. Several security features remain in beta, including automated dependency remediation and vulnerability tracking on non-default branches. ## AI-Assisted Development - **GitLab Duo CLI is generally available** for Premium and Ultimate users across GitLab.com, Self-Managed, and Dedicated. - Provides interactive chat and headless CI/CD modes. - Understands GitLab projects, pipelines, and agent configurations. - Supports model selection, shared sessions, tool approvals, MCP connections, slash commands, skills, and `AGENTS.md`. - Can be installed through `glab` or as a standalone tool. - **Custom flows are generally available** across all tiers. - Define reusable, YAML-based workflows for complex multi-step tasks. - Support multi-agent orchestration and human approval checkpoints. - Trigger from mentions, assignments, pipelines, and merge request events. - Offer project or AI Catalog management, visibility controls, secure service-account execution, and YAML validation. - **Foundational flows can now start from Agentic Chat.** - Developer Flow can implement changes or open merge requests. - Code Review Flow can review merge requests. - Fix CI/CD Pipeline Flow can diagnose and repair failed pipelines. - Users approve the handoff and monitor progress in chat or under AI sessions. ## Centralized Pipeline Automation - **Scheduled pipeline execution policies are generally available for Ultimate.** - Define schedules centrally in a security policy project. - Apply them across projects without modifying each project’s `.gitlab-ci.yml`. - Run compliance scripts, security scans, and other jobs independently of commit activity. - Support daily, weekly, or monthly schedules, time zones, time windows, and branch targeting. - Each policy creates a separate pipeline. ## Dependency and Vulnerability Management - **Dependency scanning auto-remediation is in beta.** - Automatically opens merge requests for vulnerable dependency upgrades. - Defaults to patch and minor version updates. - Agentic Breaking Change Resolution can address failed pipelines caused by complex or major upgrades. - GitLab Duo analyzes errors, changelogs, and code usage, commits fixes to the same merge request, and reruns the pipeline. - The feature creates an end-to-end remediation loop, from vulnerability detection through upgrade and repair. - **Non-default branch vulnerability tracking is in beta.** - Supports long-lived branches such as `project-qa`, `project-prod`, `project-iOS`, and `project-android`. - Allows branch-specific filtering in vulnerability reports and dashboards. - Tracks all vulnerability types, including CVEs. - Preserves vulnerability metadata when branches merge into the default branch. - Allows up to twice as many tracked branches as projects in the namespace. ## Governance and Administration - **Selective GitLab Duo availability is available for GitLab Dedicated and Dedicated for Government.** - Administrators can lock selected subgroups and descendants into an “Always off” state. - Other subgroups can retain the option to enable Duo according to their permissions. - The model provides a per-subgroup allowlist rather than disabling AI for the entire instance. - Owners receive clear messaging when a parent group has disabled the features. ## Contributor Recognition - GitLab recognized **vivekshukl007** as the month’s Notable Contributor. - Their contribution added Scala language support to GitLab Orbit, improving code graph capabilities for Scala projects. GitLab 19.2 is especially valuable for teams adopting AI-driven development and centralized security automation. Organizations should evaluate Duo CLI and custom flows for productivity gains, while testing the dependency remediation and non-default branch features carefully because they remain in beta.

Read original(opens in new tab)

GitlabModel Context ProtocolVulnerability ManagementYaml+4

gitlab·Jul 16, 2026·2 min readCurated summary

Bring GitLab Duo Agent Platform to your terminal

GitLab Duo CLI, generally available in GitLab 19.2, brings GitLab Duo Agentic Chat into the terminal. It combines code assistance with project, pipeline, permissions, and agent context from GitLab, helping developers handle failures and multi-step delivery work without leaving the shell. It supports both interactive development and headless automation in CI jobs and scripts. ## Why Terminal AI Needs GitLab Context - Many delivery problems occur after coding: failed pipelines, broken tests, vulnerabilities, dependency issues, and CI configuration problems. - Generic coding agents lack access to GitLab project context, pipeline data, permissions, and organization-wide agent configuration. - Duo CLI connects terminal work to the broader GitLab software lifecycle and provides centralized administration and identity management. ## Capabilities of Duo CLI - Investigate codebases, refactor, troubleshoot pipelines, improve CI/CD, and complete multi-step tasks from the terminal. - Share conversations across Duo CLI, the GitLab web UI, and editor extensions. - Use **Plan mode** to inspect and prepare changes, then **Build mode** to apply them. - Run `/doctor` to diagnose setup issues and `/mcp` to inspect MCP configuration. - Available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated, with instance-level controls for administrators. ## Interactive and Headless Operation - Launch through the GitLab CLI with `glab duo cli`, which handles authentication, or use the standalone `duo` command with a personal access token. - Interactive mode allows users to chat, review proposed actions, and approve tools before execution. - Headless mode supports automation through commands such as: - `glab duo cli run --goal` - `duo run --goal` - A pipeline failure can be investigated directly from the shell, with Duo CLI analyzing the issue and proposing changes for review. ## Customization and Adoption - Duo CLI follows project instructions in files such as `chat-rules.md`, `AGENTS.md`, and `SKILL.md`. - Custom slash commands can extend interactive workflows. - Users can install and authenticate through the Duo CLI documentation, or begin with `glab duo cli`. - GitLab offers Duo Agent Platform trials and includes credits for eligible Premium and Ultimate subscriptions. Duo CLI is positioned as a way to extend AI assistance beyond code editing into the operational parts of software delivery. Teams can start with interactive troubleshooting and gradually use headless mode for repeatable CI and scripting workflows.

Read original(opens in new tab)

AI AgentsCI/CDModel Context ProtocolDevSecOps+2

gitlab·Jul 16, 2026·2 min readCurated summary

GitLab Duo Security Review spots logic flaws scanners miss

GitLab’s Duo Security Review uses AI-driven reasoning to identify authorization gaps, data exposure, business-logic errors, and race conditions that pattern-based scanners often miss. It reviews merge requests in context, validates findings to reduce false positives, and reports issues before they reach production. The feature complements—not replaces—automated scanners and human security review. ## Where Traditional Scanners Fall Short - Static scanners detect recognizable patterns such as unsanitized inputs, secrets, and unsafe deserialization. - Logic flaws depend on application-specific context, including: - Broken object- or function-level authorization - Sensitive data exposed through otherwise normal serialization - Incorrect workflow order, manipulated prices, checkout bypasses, and race conditions - Manual reviews, penetration tests, and bug bounties are difficult to scale or may happen too late. ## AI-Powered Review for Merge Requests - Security Review Flow analyzes the diff alongside original files, related code, and MR discussion. - It can detect missing authorization, information disclosure, mass assignment, business-logic flaws, and stateful workflow races. - An independent validation pass reviews findings to filter likely false positives. - GitLab’s application security team has used it on internal merge requests. ## Findings and Review Workflow - Findings appear as diff threads and an internal summary; public projects keep security details in the internal note. - Each finding includes: - Vulnerability type and CWE reference - Severity from critical to low - Tier: exploitable, logic flaw, or design issue - Explanation and suggested remediation - Critical and high findings request changes; medium and low findings generate comments. - The tool never approves an MR, leaving the final decision to a human. - Developers can discuss findings, apply suggested fixes, dismiss false positives, accept risks, and request another review after changes. ## Availability and Cost - The feature is in public beta for GitLab Ultimate customers on GitLab.com, Self-Managed, and Dedicated. - Access is available through a Duo Agent Platform trial or included GitLab Credits. - Pricing depends on diff complexity and model selection, so GitLab recommends testing it on a limited number of MRs first. Organizations should use Security Review Flow as an additional layer alongside scanners and expert review, applying it early in the merge-request process when security fixes are least expensive.

Read original(opens in new tab)

DevSecOpsAi SecurityGitlab DuoStatic Analysis+4

gitlab·Jul 16, 2026·3 min readCurated summary

When a version bump breaks your build, GitLab fixes it

GitLab’s Dependency Scanning Auto-Remediation aims to reduce security backlogs by automatically upgrading vulnerable dependencies and repairing code when those upgrades break builds. Its AI agent analyzes pipeline errors, changelogs, and code usage, then commits fixes within the same merge request. All changes remain subject to existing reviews, approval gates, and audit controls. ## Why Dependency Backlogs Grow - Transitive dependencies account for a large share of vulnerabilities; one 2025 Maven study found vulnerabilities in about 63% of latest releases through transitive dependencies, compared with 31% through direct dependencies. - Dependency remediation competes with feature work, causing high-severity issues to remain unresolved beyond PCI-DSS and FedRAMP’s 30-day expectations. - Approximately one in eight dependency updates introduces a breaking change, and even “backward-compatible” updates can break builds. - AI-assisted exploit development is also speeding up vulnerability disclosure and weaponization. ## Automated Dependency Upgrades - When SBOM-based dependency scanning identifies a vulnerable package with an available fix, GitLab automatically opens a merge request. - The upgrade targets the nearest fixed version. - If no eligible fix exists, the vulnerability remains in the report until a safe upgrade becomes available. - Each merge request is attributed to a dedicated service account for traceability. - Developers can also start remediation manually for individual findings. ## AI-Powered Breaking-Change Resolution - If the dependency upgrade causes a pipeline failure, GitLab Duo Agent Platform investigates the failure. - It considers: - Pipeline error messages - The dependency’s changelog - How the project uses the dependency - The agent commits necessary application-code changes to the same merge request. - If it cannot restore a passing pipeline, it stops and documents its findings for developers. - Supported ecosystems include Bundler, Maven, Gradle, and major Python and JavaScript/TypeScript package managers; Rust and Go support is planned. ## Safeguards and Governance - Auto-remediation never merges changes automatically. - Merge requests explain the vulnerability, target version, and AI-generated code changes. - Cooldown periods prevent repeated remediation activity from overwhelming projects. - Closed merge requests are not recreated unless a newer fix is available. - Teams can select vulnerability severities and limit upgrades to patch, minor, or major versions. - Remediation runs through the organization’s existing pipelines, access controls, approval gates, and audit trails. - Configuration can be managed at the project or group level through API-based profiles during the beta. ## Availability and Pricing - Dependency Scanning Auto-Remediation is in public beta on GitLab.com, with rollout planned for Self-Managed and Dedicated installations. - Automated version bumping is included with GitLab Ultimate. - Agentic breaking-change resolution is available through a GitLab Duo Agent Platform trial or included GitLab Credits for eligible Ultimate subscribers. GitLab recommends using the feature to turn vulnerable dependencies into reviewable, pipeline-validated merge requests, reducing manual remediation effort without sacrificing developer approval or compliance oversight.

Read original(opens in new tab)

AICI/CDGitlabPython+4

gitlab·Jul 16, 2026·2 min readCurated summary

Turn multi-step software delivery into agentic flows you can trust

GitLab Duo Agent Platform’s Custom Flows are now generally available, enabling teams to automate multi-step software delivery rather than relying on chat responses, scripts, or manual runbooks. Flows can start from GitLab events or Agentic Chat, execute tasks across projects, and include human approval checkpoints. The goal is dependable, repeatable automation for work such as implementing issues, repairing pipelines, and reviewing merge requests. ## Why Software Delivery Remains Manual - Real development tasks involve multiple steps: gathering context, changing code, opening a merge request, waiting for CI, and responding to reviews. - Without workflows, people must manually coordinate each handoff and remember undocumented team practices. - Teams previously hesitated to formalize these processes because Custom Flows lacked production readiness and sufficient event coverage. ## What Agentic Flows Provide - Automate trusted sequences triggered by events such as: - Mentions and assignments - Pipeline activity - Merge request lifecycle changes - Work item updates - Run under a composite identity, keeping permissions bounded and actions attributable. - Launch specialist workflows from Agentic Chat, including: - Developer Flow for implementing changes - Code Review Flow for reviewing merge requests - Fix CI/CD Pipeline Flow for diagnosing and repairing failures - Require user approval before handing work from chat to a flow, while displaying progress inline. - Use review exclusions to avoid automatically reviewing bot-authored or branch-pattern merge requests. - Apply custom review instructions so automated reviews match team standards. ## Custom Flow Configuration - Create flows from a project or the AI Catalog. - Set visibility, enable flows for selected projects, and attach GitLab event triggers. - Add human-in-the-loop checkpoints for sensitive operations. - GitLab 19.2 adds: - A “work item status changed” trigger - Bulk enablement of public flows across up to 100 projects - A future Flow Creation Agent is planned to generate runnable flow definitions from plain-language descriptions. ## Costs and Adoption - Event-driven flows consume GitLab credits according to the work they perform. - GitLab recommends testing flows in a small number of projects before broad deployment. - Access is available through a GitLab Duo Agent Platform trial or through included credits for Premium and Ultimate subscribers. Teams should begin by encoding a few well-understood delivery processes as Custom Flows, adding approval gates where necessary, and expanding gradually while monitoring credit usage and automation quality.

Read original(opens in new tab)

AI AgentsCI/CDGitlab Duo Agent PlatformAgentic Workflows+3

gitlab·Jul 9, 2026·3 min readCurated summary

Green DevOps: Why carbon measurement belongs in your CI/CD pipeline

CI/CD pipelines consume energy and generate emissions that standard pipeline metrics do not reveal. The post argues that measuring this impact is the first step toward reducing it, recommending Eco CI for job-level measurements and Carmen for infrastructure and application-level analysis. Both tools integrate with GitLab pipelines with minimal effort and can improve sustainability, performance, and cloud costs. ## Why CI/CD Carbon Measurement Matters - Modern teams run hundreds of jobs daily, including increasingly resource-intensive AI-assisted testing and automation. - Each job has an energy and carbon cost that is usually absent from pipeline logs and architecture diagrams. - Green DevOps involves measuring emissions per pipeline, service, and Kubernetes workload to guide engineering decisions. ## Measuring Emissions at Different Layers ### Pipeline-level measurement with Eco CI - Eco CI measures energy consumption and carbon emissions for individual CI/CD jobs. - It runs as lightweight Bash scripts without additional servers or databases. - Teams can identify expensive jobs, track emissions over time, and add a carbon badge to a project README. - Because it works within existing pipelines, it is a practical starting point. ### Infrastructure and application measurement with Carmen - Carmen, the Carbon Measurement Engine, uses the Green Software Foundation Impact Framework. - It measures emissions from virtual machines, Kubernetes pods, and application workloads. - Reports are provided per component in CSV format and distinguish: - Operational carbon from energy consumption - Embodied carbon from hardware manufacturing and disposal - Outputs such as `EnergykWh` and `TotalCarbonGramsCO2eq` can be imported into Grafana, FinOps dashboards, or custom tools. - Carmen helps teams compare emissions across services, such as an API gateway versus a data-processing layer. ## Adding Carbon Reports to GitLab - Both tools can be integrated through `.gitlab-ci.yml`. - A Carmen job can: - Use a Python 3.12 image - Install Node.js, npm, Git, and the Impact Framework toolchain - Clone and install the Carmen project - Run `carbon-daemon` - Store generated reports as GitLab artifacts - Carmen can run as a separate, non-blocking job, keeping carbon measurement outside the critical delivery path. ## Turning Visibility into Engineering Improvements - Eco CI may reveal that integration tests produce unusually high emissions because dependencies are reinstalled on every run. - Adding dependency caching can reduce runtime, emissions, and CI costs without architectural changes. - Carmen can expose idle infrastructure, such as deprecated services still running in a staging Kubernetes cluster. - Decommissioning unused workloads eliminates both their operational and embodied carbon costs. ## Business and Regulatory Benefits - Emissions data creates a baseline for future reporting requirements, even when a company’s absolute footprint is relatively small. - Carbon-efficient systems are often faster and cheaper because they use fewer compute resources. - Caching, right-sizing runners, and removing idle services support both sustainability and FinOps goals. - Regulations such as the EU’s CSRD, along with enterprise procurement requirements, are increasing pressure for supply-chain and cloud-emissions reporting. Teams can start with Eco CI on one GitLab pipeline, then add Carmen for infrastructure-level visibility. Measuring carbon alongside runtime and cost makes sustainability a practical part of everyday engineering rather than a separate initiative.

Read original(opens in new tab)

KubernetesCI/CDGitlabDevOps+4

gitlab·Jul 8, 2026·3 min readCurated summary

GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7 | GitLab Docs

GitLab released patch versions 19.1.2, 19.0.4, and 18.11.7 on July 8, 2026, addressing multiple security vulnerabilities and bugs in CE and EE. GitLab strongly recommends that all affected self-managed installations upgrade immediately; GitLab.com is already patched, while GitLab Dedicated customers need no action. The release includes fixes ranging from cross-site scripting and HTML injection to authorization and credential-access issues. ## Release Scope and Upgrade Guidance - Applies to GitLab Community Edition and Enterprise Edition. - Patch releases address security vulnerabilities and important bugs. - Scheduled patch releases occur twice monthly, on the second and fourth Wednesdays. - Vulnerability details are generally made public 90 days after the fixing release. - All self-managed deployments—including Omnibus, source, and Helm installations—should upgrade to the latest supported patch version. ## High-Severity Browser Script Injection Fixes - **CVE-2026-6896 — CVSS 8.7** - Affected the vulnerability evidence table renderer in GitLab EE. - An authenticated developer could potentially execute scripts in another user’s browser through unsanitized input. - **CVE-2026-13320 — CVSS 7.3** - Affected wiki markup rendering in GitLab CE and EE. - Improper sanitization could allow an authenticated user to execute scripts in another user’s browser. ## Authorization and Information Disclosure Fixes - **CVE-2026-11827 — CVSS 4.9** - Affected repository mirroring in GitLab EE. - Maintainers could potentially access credentials stored for another user because of inadequate authorization checks. - **CVE-2026-8472 — CVSS 4.3** - Affected work items in GitLab EE. - Users with minimal access could read metadata from work items in private projects. - **CVE-2026-7492 — CVSS 4.3** - Affected commit discussion display in GitLab CE and EE. - Unauthenticated users could determine whether a private project existed through cross-project references. ## Repository and Configuration Security Fixes - **CVE-2025-12506 — CVSS 3.5** - Addressed ambiguous Git tag or branch references. - A repository could display content in the web interface that differed from the content available for download. - **CVE-2026-13151 — CVSS 2.7** - Fixed incorrect authorization in GitLab EE group-level settings. - Some authenticated users could modify settings beyond their intended permissions. - **CVE-2026-6352 — CVSS 2.7** - Fixed authorization flaws in compliance violation management. - Auditor-level users could modify compliance records through certain GraphQL operations. ## Bug Fixes in GitLab 19.1.2 - Set and backfilled `organization_id` for OAuth applications before constraint validation. - Upgraded Go to version 1.25.11. - Fixed multi-architecture tags on the legacy container registry path. - Improved external agent flows by using commit author and committer identities. - Fixed ClickHouse 23.x compatibility for `ci_finished_builds`. - Added cursor pagination and checkpoint limits to Duo workflow event retrieval. - Reverted a problematic merge request and removed an obsolete active-user cron schedule. - Fixed approval-rule regressions affecting Developer-authored merge requests. - Resolved a memory leak on the commits page caused by eager description loading. - Updated the builder image revision to `5.60.1`. ## Additional Fixes in GitLab 19.0.4 - Backported the OAuth `organization_id` fixes. - Added Skopeo registry authentication through `CI_JOB_TOKEN`. - The release also contains further backported fixes, though the provided release notes are truncated before listing them. Self-managed GitLab administrators should upgrade to 19.1.2, 19.0.4, or 18.11.7 according to their supported release line, prioritizing the update because of the two high-severity script-injection vulnerabilities.

Read original(opens in new tab)

GitlabGraphQLOauthCross Site Scripting+4

gitlab·Jul 8, 2026·4 min readCurated summary

How we used AI agents to migrate GitLab rate limiting

GitLab used a three-person engineering pod and AI agents to migrate 121 application-level rate-limit keys into a shared `labkit-ruby` implementation. The migration succeeded because humans retained ownership of architecture, scope, rollout decisions, and final review while agents handled mechanical coding, tests, and reviews. The main lesson was that disciplined workflows and meaningful observability mattered more than the agents themselves. ## Migration Setup - GitLab was consolidating two production rate-limiting systems: - `Gitlab::ApplicationRateLimiter`, with 121 keys - A separate Rack-level implementation - The target was a single observable, testable, and consistently operated implementation in `labkit-ruby`. - A three-person pod divided responsibilities across the monolith, the gem, architecture, and project scope. - AI agents: - Read project context - Drafted specifications - Implemented bounded changes - Wrote tests - Pre-reviewed merge requests - Humans controlled scope, architecture, rollout strategy, and final approvals. ## The Specification and Review Loop - The team followed a repeatable process: - Read the epic - Write a specification - Conduct adversarial review - Implement only after blockers were resolved - Verify with explicit evidence - Review the merge request adversarially - Escalate to human review - Merge - Adversarial review was limited to two resolution rounds before requiring human involvement. - The project produced 14 numbered specifications and more than 30 merge requests. - This structured loop made agents useful on legacy code without allowing them to make high-impact decisions independently. ## Successful Rollouts - The first cohort covered five heavily used keys, including: - `pipelines_create` - `notes_create` - `user_sign_in` - Rollout progressed from 1% to 10%, 50%, and finally 100% over two days. - Engineers compared the old and new implementations during rollout and deliberately generated traffic to test behavior above the configured limits. - The second cohort consolidated 95 call sites: - 83 in the monolith - 12 in Enterprise Edition - Agents were especially effective at this repetitive, large-scale codebase work, avoiding roughly 95 individual feature-flag changes and 190 YAML edits. ## Observability and Shadow-Mode Failure - During Cohort 2, an adapter dropped an identifier on an unauthenticated path by incorrectly packing three strings into two primitive slots. - Some users briefly received generic failures when enforcement began. - Shadow comparison had detected divergence, but the dashboards did not distinguish structural identifier collisions from ordinary disagreements. - The team disabled enforcement immediately and shipped a short-term fix two days later. - The deeper cleanup will replace array-based scopes with named characteristics when calling `ApplicationLimiter`. - The incident showed that having observability is insufficient if it cannot identify the failure modes that require action. ## Missed Rate Limits and Infrastructure Constraints - An audit revealed that the original five-cohort plan had missed 17 of the 121 keys. - The omissions included: - Enterprise-only limits - Registry entries - Webhook keys - `partner_*` sub-second limits - Orphaned adapter rows - The team had not maintained a complete inventory count, making it possible for keys to become effectively invisible. - A sixth cohort was added to cover the missed cases. - Redis capacity also became a constraint: - The rate-limiting service used a four-shard cluster. - `maxclients` was increased incrementally. - Rollout stopped at 75,000 connections rather than 100,000 because primary CPU usage approached saturation. - Redis command execution was limited by one core per primary, leaving no simple vertical scaling solution. ## How AI Changed the Work - Agents made code generation faster, shifting the bottleneck to: - Human review capacity - Rollout judgment - Operational monitoring - Reviewer and operator attention - Agent collaboration was not always efficient; engineers sometimes spent longer guiding agents than they would have spent coding directly. - Engineers also had to develop new skills for specifying, reviewing, and correcting agent-generated work. - Agents could execute a request mechanically—such as creating dozens of feature flags—but could not decide whether that design was appropriate. - Human judgment remained essential for simplifying the rollout and avoiding unnecessary per-key flags. ## Outcome - By mid-June, all six cohorts had reached 100%. - All 121 application rate-limit keys were running through the new framework. - The migration demonstrated that AI agents can safely support complex legacy-system changes when paired with bounded tasks, adversarial review, gradual rollouts, complete inventories, and failure-specific observability. A practical recommendation is to use agents for repetitive implementation and verification, but keep architecture, risk assessment, rollout control, and operational decisions firmly with experienced humans.

Read original(opens in new tab)

AI AgentsObservabilityGitlab Duo Agent PlatformRedis+4

gitlab·Jul 6, 2026·3 min readCurated summary

Keep your GitLab seats in check with restricted access

GitLab’s restricted access feature helps organizations prevent unexpected seat overages by blocking new billable users once all purchased seats are occupied. Recent improvements make it work more reliably with SAML, SCIM, LDAP, OIDC, and SSO provisioning, while providing clearer warnings and audit information. The feature is forward-looking: it prevents future growth but does not automatically resolve existing overages. ## How restricted access controls seats - Available on GitLab.com and Self-Managed. - When all licensed seats are used, new billable users cannot be added. - Users who only need authentication can receive the non-billable Minimal Access role. - Existing billable members are not downgraded or removed when restricted access is enabled. - Organizations must resolve current overages by removing users or purchasing more seats. ## Identity provider integration - Users provisioned through SAML, SCIM, or LDAP are assigned Minimal Access when no paid seats are available. - Automated synchronization can continue without immediately creating billable overages. - OIDC-only users can be assigned Minimal Access at the top-level group and authenticate without consuming seats. ## Dormant user reactivation - GitLab can deactivate inactive users to free seats. - Previously, SSO or OIDC sign-ins could silently reactivate dormant users as billable members. - With restricted access enabled and no seats available, reactivated users enter a pending approval state. - Their existing group and project memberships are preserved until an administrator approves them. ## Improved operational visibility - Configuration warnings now appear for LDAP, SAML group links, and SCIM. - GitLab distinguishes between approaching and reaching the seat limit. - Group owners and instance administrators can receive email notifications when users fall back to Minimal Access. - Audit logs show Minimal Access fallback events. ## Self-Managed settings cache Self-Managed installations cache application settings for 60 seconds by default. Changes between restricted access and user cap may therefore take up to a minute to appear consistently. Administrators can adjust the cache interval if necessary. ## Restricted access versus user cap - **Restricted access:** Controls additions based on available licensed seats. - **User cap:** Sends new users into an administrator approval workflow regardless of seat availability. - The two features cannot be enabled simultaneously; enabling restricted access automatically disables user cap. ## Enabling the feature - **GitLab.com:** Settings > General > Permissions and group features > Seat control > Restricted access. - **Self-Managed:** Admin > Settings > General > New user account restrictions > Seat control > Restricted access. - GitLab.com does not support restricted access when the top-level group is shared with an external group. Restricted access is recommended for organizations seeking predictable licensing costs while retaining automated identity provisioning and controlled user reactivation.

Read original(opens in new tab)

GitlabIdentity ProviderSamlSingle Sign On+4

gitlab·Jul 1, 2026·1 min readCurated summary

GitLab Patch Release: 18.8.11 | GitLab Docs

GitLab 18.8.11 is an out-of-band patch release for Community and Enterprise Editions, released July 1, 2026. It fixes a regression introduced by the Rails 7.2 upgrade that could cause database connections to leak when database load balancing is enabled. The release contains no security fixes or new migrations. ## Database Connection Leak Fix - Resolves database connection leaks affecting installations that use database load balancing. - Intended to improve stability for customers upgrading to the required GitLab 18.8 stop. ## Upgrade Considerations - No new database migrations are included. - Multi-node deployments should not require downtime. - Omnibus packages normally stop GitLab, run migrations, and restart during upgrades, regardless of upgrade size. - Administrators can disable this automatic reconfiguration for upgrades by creating: ```text /etc/gitlab/skip-auto-reconfigure ``` ## Updating and Subscriptions - Administrators should follow GitLab’s update instructions to install 18.8.11. - Premium and Ultimate features require a paid subscription, while GitLab.com provides access to GitLab-hosted infrastructure. Upgrade to 18.8.11 particularly if database load balancing is enabled, as it addresses a stability-related connection leak without introducing migration or downtime requirements.

Read original(opens in new tab)

GitlabDatabase MigrationsRuby On RailsDatabase Load Balancing+2

gitlab·Jun 30, 2026·2 min readCurated summary

Claude Sonnet 5 on GitLab: More reliable, more efficient

Claude Sonnet 5 is now available on GitLab Duo Agent Platform through GitLab’s AI Gateway across all tiers and deployment models. GitLab reports that it is the first model to complete every task in its evaluation suite, compared with 93.8% for Sonnet 4.6, while resolving 8.8% more issues. The result is intended to make software-engineering agents more reliable, efficient, and suitable for production-scale workflows. ## More Reliable Agent Runs - Sonnet 5 is designed for multi-step development tasks, code generation, and automated workflows. - Completing every benchmark task reduces failures that require diagnosis, reprompting, and verification. - GitLab highlights applications including: - Multi-file refactoring - Test generation - Security investigations across repository history - Pipeline-failure analysis - Higher completion rates allow developers to review agent output instead of repeatedly restarting incomplete runs. ## Lower Cost Through Efficiency - Reliability and resource efficiency reduce the effective cost of completed agent tasks. - Models on GitLab Duo consume GitLab Credits at different rates. - Teams can control spending by using a model whose cost and performance fit routine development work. - GitLab directs users to its Credits documentation for model-specific consumption rates. ## Selecting the Right Model - Sonnet 5 is positioned as a dependable default for everyday software-development tasks. - Sonnet-class models aim to balance quality, speed, and cost. - Claude Opus 4.8 remains available for complex, long-running tasks requiring greater reasoning depth. - Teams can select models per task through model selection in their GitLab instance. ## Availability - Claude Sonnet 5 is available immediately on GitLab Duo Agent Platform through the AI Gateway. - It runs on GitLab Credits and is offered across all tiers and deployment models. - New users can start through a Duo Agent Platform trial or GitLab Free, while Premium and Ultimate subscribers can use included credits. Overall, GitLab presents Claude Sonnet 5 as a more reliable and economical choice for routine agent-assisted development, with more powerful models available when tasks require deeper reasoning.

Read original(opens in new tab)

AI AgentsDevSecOpsGitlab Duo Agent PlatformAi Gateway+2

gitlab·Jun 29, 2026·2 min readCurated summary

What's new in Git 2.55.0?

Git 2.55.0 introduces improvements focused on stacked-branch workflows, large repositories, multi-remote setups, and clearer history visualization. Highlights include `git history fixup`, a built-in Linux filesystem monitor, remote-group pushing, and a configurable width limit for `git log --graph`. The release also continues Git’s Rust adoption and improves performance for partial clones. ## `git history fixup` - Adds `git history fixup <commit-id>`. - Takes staged changes and amends them directly into an existing commit. - Avoids creating a separate fixup commit and running an interactive autosquash rebase. - Automatically updates other local branches containing the amended commit, making it useful for stacked branches. ## Built-in fsmonitor support for Linux - Git’s filesystem monitor speeds up `git status` by tracking changed files instead of scanning the entire worktree. - Git 2.55 extends the built-in `core.fsmonitor=true` daemon from Windows and macOS to GNU/Linux. - Linux support uses `inotify`, avoiding the elevated privileges required by `fanotify`. - The daemon needs a watcher for every repository directory, so large repositories may require increasing `fs.inotify.max_user_watches`. ## Pushing to remote groups - Remote groups were previously supported by `git fetch` but not `git push`. - Configure a group, for example: ```bash git config set remotes.forks "origin upstream" ``` - Push to every remote in the group with: ```bash git push forks main ``` - Each remote is handled independently and follows its own `remote.<name>.push` mappings and mirror settings. ## Limiting `git log --graph` width - `git log --graph` can become difficult to read in repositories with many parallel branches. - Git 2.55 adds a way to limit the graph’s lane width, preventing the ASCII history from expanding indefinitely. - This is particularly useful for large projects such as Git itself, where the graph can become many lanes wide after only a few commits. ## Rust adoption and partial-clone performance - The release continues the gradual evolution of Rust within Git’s codebase. - `git grep` and `git cherry` receive performance improvements when operating in partial clones. Git 2.55 is especially useful for developers working in large monorepos or stacked-branch workflows. Enabling the Linux fsmonitor, using `git history fixup`, and configuring remote groups can provide immediate productivity benefits, while graph-width limits make complex histories easier to inspect.

Read original(opens in new tab)

RustGitLinuxVersion Control+2

gitlab·Jun 25, 2026·3 min readCurated summary

Google Antigravity agents get full context with GitLab Orbit

Google Antigravity agents can now access GitLab’s broader software lifecycle context through GitLab Orbit, available in the Antigravity MCP Store. Orbit builds a knowledge graph connecting code, projects, dependencies, merge requests, pipelines, users, and vulnerabilities, allowing agents to answer questions that would otherwise require manual research across GitLab. GitLab reports that internally tested agents using Orbit were up to 11 times faster, used 4.5 times fewer tokens, and hallucinated up to 45 times less. ## GitLab Orbit Adds Lifecycle Context - Antigravity agents can normally access files and terminals but lack information about: - Service dependencies - Related vulnerabilities - Merge request history - Code ownership and reviewers - Pipeline performance - Orbit indexes GitLab and exposes its knowledge graph through: - `query_graph` for structured lifecycle queries - `get_graph_schema` for available node types, properties, and relationships - Agents receive typed results through GitLab Orbit’s JSON query DSL. ## Practical Development Use Cases ### Blast radius analysis - Engineers can identify which projects depend on a module before refactoring it. - Agents can also find open merge requests affecting those files and identify their owners. - This reveals conflicts and stakeholders before changes are made. ### Onboarding and codebase exploration - Agents can explain a service’s dependencies, entry points, and recently opened merge requests. - Results can be captured in a persistent Walkthrough Artifact rather than disappearing in chat. - Orbit reindexes changes within minutes, keeping documentation more current than static wikis. ### Live architecture diagrams - Agents can query service dependencies and render them as diagrams using Nano Banana Pro. - Diagrams can be filtered, such as showing only services with unresolved security findings. - Access controls apply to every query, making generated diagrams safe to share. - GitLab is developing similar functionality through its Software Architecture Map. ## Installation Through the MCP Store - Open Antigravity settings and go to the customization tab. - Find the MCP section and select **Add MCP**. - Choose GitLab Orbit and authenticate with GitLab. - No configuration files or terminal commands are required. ## Availability and Technical Details - Orbit uses the same context engine as GitLab Duo Agent Platform. - It supports code indexing for Ruby, Java, Kotlin, Python, TypeScript, JavaScript, Rust, and C#. - Code is indexed from the default branch and refreshed within minutes. - MCP queries consume GitLab Credits, while `get_graph_schema` calls are free. - The feature is available to GitLab Premium and Ultimate customers on GitLab.com. For teams already using GitLab and Google Antigravity, GitLab Orbit provides a governed, current context layer that can make agents more accurate and useful. Teams should enable Orbit for a top-level group and install it through the Antigravity MCP Store, while accounting for GitLab tier requirements and credit usage.

Read original(opens in new tab)

Model Context ProtocolDevSecOpsGitlab Duo Agent PlatformGitlab Orbit+3

gitlab·Jun 24, 2026·3 min readCurated summary

GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6 | GitLab Docs

GitLab released patch versions **19.1.1, 19.0.3, and 18.11.6** on June 24, 2026, addressing important bugs and security vulnerabilities in CE and EE. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. The release fixes issues ranging from cross-site scripting and information disclosure to authorization bypasses and improper access controls. ## Release Guidance - The patches apply to GitLab Community Edition and Enterprise Edition. - GitLab recommends upgrading all affected self-managed installations to the latest supported patch release. - GitLab publishes scheduled patch releases twice monthly, with additional critical releases when necessary. - Vulnerability details are generally made public 30 days after the fixing release. - Unless otherwise specified, all deployment types—including Omnibus, source installations, and Helm charts—are affected. ## High-Severity Cross-Site Scripting Vulnerabilities - **CVE-2026-10086 — Analytics Dashboard** - A developer-level authenticated user could execute arbitrary client-side code in another user’s session through insufficient input sanitization. - Affects GitLab EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 8.7** - **CVE-2026-10712 — Web IDE Workbench Asset Handler** - Improper path validation could allow an unauthenticated attacker to execute JavaScript in a victim’s browser session. - Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 8.0** ## Information Disclosure and Authorization Issues - **CVE-2026-12053 — Duo Workflows** - Insufficient output filtering could expose sensitive information previously committed to a project. - Affects GitLab EE 19.1 versions before 19.1.1. - **CVSS: 7.7** - **CVE-2026-5309 — Virtual Registry Cleanup Policy API** - Authenticated users could read or modify another group’s cleanup policy settings. - Affects EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.4** - **CVE-2026-2238 — Rapid Diffs** - Unauthenticated users could view confidential issue references on public projects. - Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.3** - **CVE-2026-11379 — DAST Site Profile Management** - Developer-level users could potentially extract DAST site profile secrets due to incorrect authorization. - Affects EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.3** ## Additional Security Fixes - **CVE-2026-8330 — CI/CD API** - Sensitive data could be written to application logs because of insufficient filtering. - **CVSS: 4.4** - **CVE-2026-1606 — Snippets** - Authenticated users could conceal content within snippets through improper input validation. - **CVSS: 4.3** - **CVE-2026-5952 — Maven Package Registry** - Developers could bypass package protection rules and overwrite protected Maven package metadata. - **CVSS: 4.3** - **CVE-2026-5796 — Group Packages API** - Reporters could view package metadata from projects where the Package Registry was disabled. - **CVSS: 4.3** ## Recommended Action Administrators of affected self-managed GitLab instances should upgrade to **18.11.6, 19.0.3, or 19.1.1**, depending on their supported release branch, as soon as possible. Updating promptly is particularly important because several vulnerabilities permit code execution, sensitive-data exposure, or unauthorized access.

Read original(opens in new tab)

CI/CDGitlabApi SecurityCross Site Scripting+4

gitlab·Jun 18, 2026·2 min readCurated summary

AI Catalog updates for governance and operations

GitLab 19.1 expands the AI Catalog from a manually triggered tool into a governed automation platform. New event-driven Duo Flow triggers, configuration validation, agent restrictions, and model allowlists help enterprises run AI workflows continuously while maintaining security and operational control. The release is designed to make agentic automation safer and more reliable at production scale. ## Event-Driven Duo Flow Automation - Four new triggers let flows respond automatically to GitLab events: - Merge request code conflicts - Draft merge requests becoming ready for review - Merge request approvals - New work item creation - These triggers enable automated conflict summaries, compliance checks, deployment readiness checks, notifications, triage, labeling, and routing. - Pipeline triggers can now filter for specific states: failure, success, or cancellation. - Conflict-detected and draft-to-ready triggers are enabled by default. - A beta pattern-based approval tier lets developers approve repeated tool uses for an entire session instead of approving each invocation individually. ## Governance for Agents and Flows - Instance administrators and top-level group owners gain controls over which AI content users can run. - **Disable custom agents and flows** prevents users from creating or enabling custom-built content. - **Restrict the AI Catalog to your group hierarchy** blocks AI Catalog items from outside the organization’s namespace, including community and third-party contributions. - These controls help prevent unapproved agents and workflows from entering regulated or production environments. ## Pre-Save Flow Configuration Validation - GitLab now validates AI Catalog flow configurations against the Duo Workflow Service before saving them. - Errors such as missing inputs or invalid tool parameters appear directly in the UI. - This moves troubleshooting to configuration time, reducing the risk of broken or overly active flows running in production. ## Approved AI Model Controls - A public beta lets administrators define an allowlist of approved AI models. - Organizations can also set an organization-wide default model. - Teams retain flexibility within approved boundaries while meeting provider, compliance, or data-residency requirements. - The first version applies to GitLab Duo Agentic Chat, with broader coverage planned. Overall, GitLab 19.1 recommends treating AI workflows like production automation: trigger them from real events, validate them before deployment, and govern both the agents and models they use. Enterprises adopting the AI Catalog should configure the new restrictions and model policies before enabling widespread automated flows.

Read original(opens in new tab)

AI AgentsCI/CDGitlabDevSecOps+3