techlist.io
KR EN
gitlab

GitLab 19.2 release notes | GitLab Docs (opens in new tab)

gitlabmodel-context-protocolvulnerability-managementyamlgitlab-duodependency-scanninggitlab-ci-cdgitlab-cli

GitLab 19.2, released July 16, 2026, focuses heavily on AI-assisted development, workflow automation, and centralized security controls. Major additions include the generally available GitLab Duo CLI and custom flows, scheduled pipeline execution policies, and Agentic Chat integrations. Several security features remain in beta, including automated dependency remediation and vulnerability tracking on non-default branches.

AI-Assisted Development

  • GitLab Duo CLI is generally available for Premium and Ultimate users across GitLab.com, Self-Managed, and Dedicated.

    • Provides interactive chat and headless CI/CD modes.
    • Understands GitLab projects, pipelines, and agent configurations.
    • Supports model selection, shared sessions, tool approvals, MCP connections, slash commands, skills, and AGENTS.md.
    • Can be installed through glab or as a standalone tool.

  • Custom flows are generally available across all tiers.

    • Define reusable, YAML-based workflows for complex multi-step tasks.
    • Support multi-agent orchestration and human approval checkpoints.
    • Trigger from mentions, assignments, pipelines, and merge request events.
    • Offer project or AI Catalog management, visibility controls, secure service-account execution, and YAML validation.

  • Foundational flows can now start from Agentic Chat.

    • Developer Flow can implement changes or open merge requests.
    • Code Review Flow can review merge requests.
    • Fix CI/CD Pipeline Flow can diagnose and repair failed pipelines.
    • Users approve the handoff and monitor progress in chat or under AI sessions.

Centralized Pipeline Automation

  • Scheduled pipeline execution policies are generally available for Ultimate.
    • Define schedules centrally in a security policy project.
    • Apply them across projects without modifying each project’s .gitlab-ci.yml.
    • Run compliance scripts, security scans, and other jobs independently of commit activity.
    • Support daily, weekly, or monthly schedules, time zones, time windows, and branch targeting.
    • Each policy creates a separate pipeline.

Dependency and Vulnerability Management

  • Dependency scanning auto-remediation is in beta.

    • Automatically opens merge requests for vulnerable dependency upgrades.
    • Defaults to patch and minor version updates.
    • Agentic Breaking Change Resolution can address failed pipelines caused by complex or major upgrades.
    • GitLab Duo analyzes errors, changelogs, and code usage, commits fixes to the same merge request, and reruns the pipeline.
    • The feature creates an end-to-end remediation loop, from vulnerability detection through upgrade and repair.

  • Non-default branch vulnerability tracking is in beta.

    • Supports long-lived branches such as project-qa, project-prod, project-iOS, and project-android.
    • Allows branch-specific filtering in vulnerability reports and dashboards.
    • Tracks all vulnerability types, including CVEs.
    • Preserves vulnerability metadata when branches merge into the default branch.
    • Allows up to twice as many tracked branches as projects in the namespace.

Governance and Administration

  • Selective GitLab Duo availability is available for GitLab Dedicated and Dedicated for Government.
    • Administrators can lock selected subgroups and descendants into an “Always off” state.
    • Other subgroups can retain the option to enable Duo according to their permissions.
    • The model provides a per-subgroup allowlist rather than disabling AI for the entire instance.
    • Owners receive clear messaging when a parent group has disabled the features.

Contributor Recognition

  • GitLab recognized vivekshukl007 as the month’s Notable Contributor.
  • Their contribution added Scala language support to GitLab Orbit, improving code graph capabilities for Scala projects.

GitLab 19.2 is especially valuable for teams adopting AI-driven development and centralized security automation. Organizations should evaluate Duo CLI and custom flows for productivity gains, while testing the dependency remediation and non-default branch features carefully because they remain in beta.