Gitlab

98 posts

gitlabApr 28, 20262 min readCurated summary

GitLab and Anthropic: Governed AI for enterprise development

GitLab is expanding its integration with Anthropic Claude to provide enterprise teams with more capable AI inside a governed software development platform. Claude supports GitLab Duo Agent Platform features such as code generation, review, agentic chat, and vulnerability resolution. The central argument is that organizations should not have to trade advanced AI capabilities for security, compliance, and auditability. ## Governed AI across the SDLC - Claude-generated changes follow GitLab’s existing merge request process, approval rules, security scans, and audit trails. - AI agents do not bypass controls; their actions remain attributable, reviewable, and subject to policy enforcement. - This governance becomes increasingly important as agents autonomously plan, code, test, secure, and deploy software. - GitLab positions built-in governance as a core architectural differentiator rather than an added feature. ## Flexible enterprise deployment - Claude is available in GitLab through: - Google Cloud Vertex AI - Amazon Bedrock - Organizations can use existing cloud contracts, governance frameworks, and data-residency arrangements. - GitLab’s availability in the Claude Marketplace lets customers purchase GitLab Credits and apply them toward Anthropic spending commitments. - These options simplify procurement and consolidate AI spending. ## Supporting an agentic development model - GitLab is selecting model partners based on reasoning ability, reliability, and safety. - The platform is designed to maintain visibility into what AI agents do, when they act, and how their changes are tracked. - As agents take on more complex engineering tasks, GitLab argues that strong models must be paired with equally strong governance. ## Implications for customers - Existing GitLab Duo users gain deeper Claude-powered assistance without changing their established governance processes. - Organizations evaluating AI development platforms can access advanced models while retaining enterprise control. - GitLab presents the integration as a way to accelerate development without compromising compliance or oversight. The practical recommendation is to evaluate AI platforms not only by model capability, but also by how well they integrate governance, auditability, cloud deployment options, and existing enterprise workflows.

Gitlab Machine Learning DevSecOps Software Development+4

gitlabApr 24, 20262 min readCurated summary

curl removed from Omnibus-GitLab FIPS packages in 19.0

GitLab will remove its bundled curl from Omnibus-GitLab FIPS packages beginning with version 19.0 and use the customer’s Linux distribution package instead. The change is driven by curl 8.18.0 dropping support for OpenSSL 1.x and extends GitLab’s existing approach of relying on distribution-provided cryptographic libraries. GitLab instances should continue working normally, but customers will become responsible for keeping curl updated. ## Change to FIPS Packages - Starting with Omnibus-GitLab 19.0, FIPS packages will no longer include a GitLab-built curl. - The package will use curl supplied by the customer’s Linux distribution. - The change applies to all FIPS customers and will also be included in patch releases for existing supported versions. - GitLab 19.0 is scheduled for May 21, 2026. ## Why GitLab Is Making the Change - curl 8.18.0 deprecated compilation against OpenSSL 1.x. - This prevents GitLab’s previous curl-building approach on: - Amazon Linux 2 - AlmaLinux 8 - RHEL 8 environments - FIPS packages already use distribution-provided OpenSSL rather than bundled cryptographic libraries. - GitLab is extending that model to curl for maintainability and security, including on systems using OpenSSL 3.0 or newer. ## Customer Responsibilities - No immediate configuration or migration action is required. - Customers must keep their operating system’s curl package updated to receive security fixes. - Security scanners will report the host OS curl version instead of a GitLab-bundled version. - GitLab will no longer ship curl-specific security updates for FIPS packages. Customers experiencing problems should report them in the Omnibus-GitLab issue tracker.

Gitlab DevSecOps Linux Curl+3

gitlabApr 22, 20263 min readCurated summary

GitLab AI Hackathon 2026: Meet the winners

Nearly 7,000 developers participated in GitLab’s 2026 AI Hackathon, creating more than 600 agents and workflows for the GitLab Duo Agent Platform. The winning projects focused on practical software delivery challenges—including organizational knowledge loss, security, compliance, migrations, and sustainability—rather than simple chatbot interactions. The results suggest that agentic AI is becoming most valuable when integrated directly into development workflows and given richer project context. ## Hackathon Scope and Evaluation - The hackathon ran from February 9 to March 25, 2026, on Devpost. - Google Cloud and Anthropic co-sponsored the event, contributing judges, prizes, and cloud resources. - Nineteen judges evaluated projects on: - Technical execution - Design - Potential impact - Quality of the idea - Total prizes reached $65,000. ## Grand Prize: LORE - LORE, or Living Organizational Record Engine, addresses the loss of institutional knowledge when engineers leave. - It combines: - Eight specialized agents - A router that directs questions to the appropriate agent - Protections against circular loops in its knowledge graph - A visual dashboard - Carbon tracking - Its command-line tool includes 43 tests, leading judges to describe it as a polished product rather than a typical hackathon prototype. ## Google Cloud and Anthropic Winners - **Gitdefender**, the Google Cloud Grand Prize winner, detects security issues during code review, writes fixes, and opens the review automatically. - **Aegis**, the Google Cloud Runner Up, explains the reasoning behind its AI decisions and is deployed on Google Cloud. - **GraphDev**, the Anthropic Grand Prize winner, maps code relationships and shows how systems evolve, helping developers understand the impact of changes. - **DocSync**, the Anthropic Runner Up, uses Detector, Writer, and Reviewer agents to update documentation. It opens a review when confident and creates an issue for human review when uncertain. ## Category Winners - **Time-Traveler**, winner for technical achievement, creates a safe copy of a production environment and runs database migrations against it using five connected agents, PostgreSQL, real data, and Google Cloud deployment. - **RedAgent**, the most impactful project, verifies AI-generated security findings before developers act on them, addressing distrust in automated reports. - **Launch Control**, recognized for ease of use, combined polished user experience, strong infrastructure, and sustainability considerations. ## Sustainability-Focused Projects - Five projects received sustainability prizes or bonuses as the organizers highlighted the growing energy cost of CI/CD systems and large language models. - **GreenPipe** analyzes CI/CD pipelines and generates carbon-footprint reports. - Sustainable Design bonuses recognized projects including: - **BugFlow**, which generated 10 fixes from one bug report in 20 minutes - **DELTA Cyber Reasoning**, an automated fuzz-testing tool - **CarbonLint**, which applies code analysis to energy consumption - **TFGuardian**, which includes carbon-footprint analysis - One project reduced monthly costs from $556 to $18, representing a reported 96% carbon reduction. ## Honorable Mentions - **SecurityMonkey** tests security scanners by injecting known vulnerabilities. - **stregent** enables CI/CD investigation and fixes through WhatsApp. - **Compliance Sentinel** evaluates merge requests for compliance risk and blocks critical violations. - **Carbon Tracker** measures the carbon footprint of individual pipeline jobs and suggests improvements. - **RepoWarden** captures the rationale behind code, not only its behavior. - **MR Compliance Auditor** maps merge-request evidence to SOC 2 controls and displays compliance scores in real time. ## What Comes Next The projects operated within a single GitLab project, but many teams supplemented their agents with local knowledge graphs to understand code relationships and dependencies. GitLab plans to build on this approach in future hackathons by providing agents with richer context. GitLab’s hackathon demonstrates that the strongest AI agents are workflow-integrated tools that can investigate, make decisions, execute changes, and involve humans when needed. Developers can explore the 600-plus projects in the gallery or build their own agents on the GitLab Duo Agent Platform.

Gitlab Database Design Machine Learning CI/CD+4

gitlabApr 22, 20263 min readCurated summary

GitLab Patch Release: 18.11.1, 18.10.4, 18.9.6 | GitLab Docs

GitLab released patch versions 18.11.1, 18.10.4, and 18.9.6 on April 22, 2026, addressing multiple security vulnerabilities and bugs in CE and EE. Self-managed installations should upgrade immediately, while GitLab.com is already patched and GitLab Dedicated customers need no action. The fixes include unauthenticated GraphQL and browser-based attacks, several denial-of-service flaws, and access-control weaknesses. ## Release Scope and Upgrade Guidance - Applies to GitLab Community Edition and Enterprise Edition. - Affects all deployment types unless otherwise specified, including Omnibus, source installations, and Helm charts. - Recommended fixed versions: - 18.11.1 - 18.10.4 - 18.9.6 - GitLab issues detailing security vulnerabilities are made public 30 days after the relevant patch release. - GitLab publishes both scheduled patch releases, issued on the second and fourth Wednesdays, and ad-hoc critical patches for high-severity vulnerabilities. ## High-Severity Vulnerabilities - **CVE-2026-4922 — GraphQL CSRF** - CVSS 8.1. - An unauthenticated attacker could execute GraphQL mutations on behalf of an authenticated user because of insufficient CSRF protection. - Affects versions before 18.9.6, 18.10.4, and 18.11.1. - **CVE-2026-5816 — Web IDE path validation** - CVSS 8.0. - Under certain conditions, improper path validation could allow unauthenticated attackers to execute arbitrary JavaScript in a user’s browser session. - Affects the 18.10 and 18.11 release lines before the listed patches. - **CVE-2026-5262 — Storybook cross-site scripting** - CVSS 8.0. - Improper input validation could allow unauthenticated access to tokens in the Storybook development environment. - Affects versions from 16.1 through the unpatched 18.9, 18.10, and 18.11 releases. ## Denial-of-Service Fixes - **CVE-2025-0186:** Crafted requests to the discussions endpoint could exhaust server resources. - **CVE-2026-1660:** Improper input validation during Jira issue imports could enable resource exhaustion. - **CVE-2025-6016:** Insufficient limits when retrieving notes could cause service disruption. - **CVE-2025-3922:** Resource-allocation weaknesses in the GraphQL API could allow authenticated users to overwhelm the system. - Each issue carries a CVSS score of 6.5 and generally requires authentication. ## Access-Control and Session Fixes - **CVE-2026-6515 — Virtual registry credentials** - CVSS 5.4. - Invalidated or incorrectly scoped credentials could continue accessing Virtual Registries. - **CVE-2026-5377 — Confidential issue titles** - CVSS 4.3. - Authenticated users could potentially view titles of confidential or private issues in public projects. - **CVE-2026-3254 — Mermaid sandbox** - CVSS 3.5. - Improper validation could allow authenticated users to load unauthorized content into another user’s browser. - The release also lists **CVE-2025-9957**, involving improper access control in the project fork relationship API; the provided text does not include its full impact or severity details. Self-managed GitLab administrators should apply the appropriate patch release as soon as possible, especially because several vulnerabilities permit unauthenticated browser or API attacks.

Gitlab GraphQL Vulnerability Management Cross Site Scripting+4

gitlabApr 21, 20263 min readCurated summary

GitLab + Amazon: Platform orchestration on a trusted AI foundation

GitLab Duo Agent Platform and Amazon Bedrock combine GitLab’s software-lifecycle orchestration with AWS’s governed foundation-model infrastructure. Duo coordinates agents across planning, development, security, pipelines, and remediation, while Bedrock provides secure inference within AWS boundaries. The pairing aims to reduce shadow AI, fragmented tooling, unclear data flows, and unplanned cloud spending. ## The Enterprise AI Governance Problem - Teams often adopt unapproved AI tools, creating unknown prompt and code-data paths. - AI tooling and model choices become fragmented across developers and departments. - Security teams may lack control over logs, data residency, and access policies. - Existing AWS and Amazon Bedrock investments can be underused when teams rely on external point solutions. - The proposed division of responsibility is: - GitLab Duo Agent Platform: workflow and agent orchestration. - Amazon Bedrock: approved models and inference. - The organization: IAM, VPC, regional, security, and policy controls. ## GitLab Duo Agent Platform as the Control Plane - Duo provides specialized agents and flows that operate asynchronously across the software lifecycle. - Agents use shared GitLab context, including: - Issues - Merge requests - Pipelines - Security findings - It extends beyond a single conversational assistant by coordinating multiple agents across continuous workflows. - Potential tasks include planning, code development, merge-pipeline work, security scanning, and vulnerability remediation. ## Amazon Bedrock as the AI Foundation - Bedrock is a managed, serverless foundation-model layer operating within AWS. - Customer inputs and outputs are encrypted, not shared with model providers, and not used to train base models. - It supports compliance requirements including GDPR, HIPAA, and FedRAMP High. - Organizations can use native Bedrock models or import fine-tuned models through Custom Model Import. - Bedrock Guardrails can provide content filtering, hallucination detection, and sensitive-data protection. ## Deployment Options The core Duo capabilities remain consistent, but control and infrastructure ownership vary across three patterns: - **Self-hosted models with Amazon Bedrock** - Intended for GitLab Self-Managed deployments. - Uses a self-hosted AI Gateway. - Keeps inference traffic, prompts, logs, and lifecycle data within the organization’s AWS environment. - **GitLab-operated Bedrock models with GitLab-owned keys** - Intended for GitLab Self-Managed deployments. - Uses GitLab’s hosted AI Gateway. - GitLab operates the model layer while the deployment remains self-managed. - **GitLab.com with GitLab-operated Bedrock models** - Uses GitLab’s hosted AI Gateway and GitLab-owned keys. - Suits organizations that prefer the SaaS GitLab experience while using Bedrock-backed models. ## Practical Enterprise Uses - Platform teams can standardize models for code suggestions, security analysis, and pipeline remediation. - Centralized guardrails and logging reduce independent, unmanaged AI adoption. - Security agents can propose and validate fixes directly within GitLab. - Routing AI workloads through Bedrock helps organizations align usage with existing AWS agreements and spending commitments. The recommended approach is to treat GitLab Duo Agent Platform as the orchestration layer and Amazon Bedrock as the governed inference foundation, selecting the deployment model that matches the organization’s compliance, hosting, and control requirements.

Gitlab Machine Learning DevSecOps Amazon Bedrock+4

cloudflareApr 20, 20263 min readCurated summary

Orchestrating AI Code Review at scale

Cloudflare built a CI-native AI code review system to reduce review bottlenecks without overwhelming engineers with noisy or generic model feedback. Instead of using one large prompt, it orchestrates up to seven specialized agents for areas such as security, performance, compliance, and documentation, then uses a coordinator to deduplicate and assess findings. The system now reviews tens of thousands of merge requests, approving clean changes and blocking serious bugs or vulnerabilities. ## Why Naive AI Review Wasn’t Enough - Traditional code review can leave merge requests waiting for hours and creates repeated context switching. - Commercial AI review tools provided useful functionality but lacked the flexibility and customization required across Cloudflare’s organization. - A basic “send the Git diff to an LLM” approach produced: - Vague recommendations - Hallucinated syntax errors - Repetitive advice such as adding error handling where it already existed - Complex codebases required specialized analysis rather than generic summarization. ## Specialized Agents and Coordination - The system launches up to seven focused reviewers covering: - Security - Performance - Code quality - Documentation - Release management - Internal Engineering Codex compliance - A coordinator agent: - Deduplicates overlapping findings - Evaluates the actual severity of issues - Produces one structured review comment - The system can actively block merges when it detects serious defects or security vulnerabilities. ## Plugin-Based Architecture - The platform uses composable plugins so it can support different: - Version-control systems - AI providers - Internal standards - Repository-specific requirements - Each plugin implements a `ReviewPlugin` interface with three lifecycle phases: - `bootstrap`: Runs concurrently and is non-fatal. - `configure`: Runs sequentially and is fatal if essential configuration fails. - `postConfigure`: Handles asynchronous work after configuration assembly. - Through `ConfigureContext`, plugins can: - Register agents and AI providers - Set environment variables - Inject prompt sections - Configure agent permissions - Plugins contribute through the context API rather than accessing the final configuration directly. - The core assembler combines these contributions into `opencode.json`. - This separation prevents unrelated components from becoming tightly coupled; for example, GitLab logic does not need to understand Cloudflare AI Gateway settings. ## Plugin Responsibilities - `@opencode-reviewer/gitlab` - Provides GitLab merge request data and a comment server. - `@opencode-reviewer/cloudflare` - Configures AI Gateway model tiers and fallback chains. - `@opencode-reviewer/codex` - Checks compliance with internal engineering RFCs. - `@opencode-reviewer/braintrust` - Adds distributed tracing and observability. - `@opencode-reviewer/agents-md` - Verifies that repository `AGENTS.md` instructions are current. - `@opencode-reviewer/reviewer-config` - Retrieves remote model overrides for individual reviewers. - `@opencode-reviewer/telemetry` - Tracks reviews asynchronously. ## Why OpenCode - Cloudflare already used OpenCode extensively and understood its behavior. - Its open-source implementation allows engineers to: - Investigate problems directly - Contribute fixes upstream - Extend the system through its SDK - Cloudflare engineers had contributed more than 45 upstream pull requests at the time of writing. - Its server-first design was especially important: - Review sessions can be created programmatically. - Prompts can be sent through an SDK. - Multiple concurrent sessions can be managed without scraping or wrapping a CLI interface. ## Coordinator Process - The coordinator runs OpenCode as a child process using `Bun.spawn`. - Its prompt is passed through `stdin` rather than a command-line argument. - This avoids Linux’s `ARG_MAX` limit, which previously caused `E2BIG` failures for unusually large merge requests containing extensive descriptions or logs. - OpenCode runs with `--format json`, emitting JSONL events through standard output. - This event-based interface allows the orchestration layer to collect and process results from concurrent reviewer sessions. A practical takeaway is to treat AI review as an orchestrated CI system rather than a single LLM prompt. Specialized agents, strict plugin boundaries, structured outputs, and observability are essential for making automated review reliable enough to influence merge decisions at organizational scale.

Gitlab Database Design Large Language Models CI/CD+4

gitlabApr 20, 20263 min readCurated summary

GitHub Copilot's policy for AI training: A governance wake-up call

GitHub’s April 2026 policy change will make Copilot Free, Pro, and Pro+ interaction data—including code, prompts, outputs, and context—available for AI training by default unless users opt out. The change highlights governance risks for regulated organizations, especially when protections vary by subscription tier or can be altered through policy updates. The post presents GitLab’s no-training commitment, contractual safeguards, and transparency documentation as a stronger model for enterprise AI governance. ## What the GitHub Policy Change Means - Beginning April 24, 2026, GitHub may use Copilot Free, Pro, and Pro+ data for model training by default. - Covered data includes: - User inputs and outputs - Code snippets - Associated context - Interaction data - Users must actively opt out. - Copilot Business and Enterprise customers remain exempt under existing contracts. - Data may also be shared with GitHub affiliates, including Microsoft, for AI development. - Organizations must review license tiers, settings, contracts, and internal AI governance controls. ## Why This Matters in Regulated Industries - Source code can expose: - Proprietary business logic - Internal system architecture - Sensitive data flows - Financial algorithms and risk models - Financial institutions may face intellectual-property and model-risk concerns involving trading strategies, underwriting rules, fraud detection, and credit models. - Frameworks such as Federal Reserve SR 11-7 and DORA require documented oversight of third-party technology and material changes in vendor practices. - Public-sector environments governed by NIST 800-53 and FISMA may require sensitive code to remain within controlled boundaries. - Healthcare organizations must consider HIPAA obligations when development tools interact with clinical or patient-adjacent systems. - Default opt-in training, individual opt-out requirements, and tier-dependent protections create compliance risks. ## Requirements for Enterprise AI Vendors - **Contractual certainty:** Vendors should clearly and unconditionally define how customer data is handled. - **Auditability:** Organizations need documentation about models, training data, subprocessors, retention, and compliance status. - **Independence from vendor incentives:** Customer code should not become training data for systems that may benefit competitors. - **Operational flexibility:** Regulated customers may require self-hosting, controlled processing boundaries, or clear procedures for vendor changes. ## GitLab’s AI Governance Position - GitLab states that it does not train AI models on customer code at any pricing tier. - Its AI vendors are contractually prohibited from using GitLab customer inputs or outputs for their own purposes. - The GitLab AI Transparency Center documents: - Models powering its features - Data handling practices - Subprocessors - Retention periods - Feature compliance status - GitLab emphasizes cloud and model neutrality, supports self-hosted deployments, and addresses vendor changes through its AI Continuity Plan. - The post argues that these policies reduce vendor-concentration, compliance, and intellectual-property risks. ## Closing the Governance Gap Organizations should ask every AI vendor: - Is customer data used for model training? - Who are the model subprocessors? - What happens if data practices change? - Can AI processing remain inside the organization’s infrastructure? - What indemnification applies to AI-generated output? The post’s recommendation is to favor vendors that provide durable, contractual, and auditable answers rather than relying on defaults, temporary opt-outs, or policies that can change with short notice.

Gitlab Machine Learning Github Copilot Data Privacy+3

gitlabApr 16, 20262 min readCurated summary

CI Expert and Data Analyst AI agents target development gaps

GitLab 18.11 introduces two Duo Agent Platform agents aimed at development gaps left by faster AI-generated coding. CI Expert Agent helps teams create working pipelines, while Data Analyst Agent answers software delivery questions using GitLab data. Both benefit from being embedded in GitLab, where they can use current repository, pipeline, issue, and merge request context. ## CI Expert Agent: Faster Pipeline Setup - Now available in beta. - Inspects a repository to identify its language, framework, and testing setup. - Generates runnable build and test configurations without requiring developers to write YAML manually. - Explains each pipeline step in plain language through Agentic Chat. - Uses native GitLab CI semantics. - Addresses the common problem of delaying CI because `.gitlab-ci.yml` is difficult to create or validate. - Helps reduce regressions, oversized changes, and dependence on undocumented team knowledge. - Available on GitLab.com, Self-Managed, and Dedicated across Free, Premium, and Ultimate editions with Duo Agent Platform enabled. ## Data Analyst Agent: Natural-Language SDLC Queries - Generally available in GitLab 18.11. - Lets users ask questions about development performance in plain language and receive visualizations in Agentic Chat. - Covers merge requests, issues, projects, pipelines, and jobs. - Supports questions about: - MR cycle time and review bottlenecks - Project throughput and contribution patterns - Flaky tests and pipeline performance - Runner utilization and deployment frequency - Cross-portfolio lead times and project health - Eliminates the need to learn GitLab Query Language, request custom dashboards, or rely on separate analytics tools. - Generated GLQL queries can be copied into GitLab Flavored Markdown. - Exporting results to work items and dashboards is planned. - Available across GitLab.com, Self-Managed, and Dedicated Free, Premium, and Ultimate editions with Duo Agent Platform enabled. ## The Advantage of Platform-Native Context - Both agents operate within GitLab and can access existing code, pipelines, issues, and merge requests. - Their recommendations and answers are based on current operational data rather than generic examples or disconnected tools. - The agents are designed to support the full lifecycle: understanding code, configuring CI, shipping changes, and evaluating delivery performance. Together, these agents make GitLab Duo more useful beyond code generation. Teams should consider trying CI Expert Agent for faster initial pipeline setup and Data Analyst Agent for immediate, self-service insight into delivery performance.

Gitlab Machine Learning DevOps Yaml+4

gitlabApr 16, 20262 min readCurated summary

Claude Opus 4.7 is now available in GitLab Duo Agent Platform

GitLab Duo Agent Platform now supports Anthropic’s Claude Opus 4.7 across Agentic Chat and agent-powered software delivery workflows. The model is designed to improve long-running, multistep tasks through stronger reasoning, instruction following, and self-verification. GitLab says this should make agents more reliable across development, security, CI/CD, and deployment. ## Improved Reasoning and Instruction Following - Internal evaluations reportedly show Opus 4.7 outperforming Sonnet 4.6 and Opus 4.6. - It handles complex, conditional instructions more precisely. - Agents can complete multistep tasks with fewer errors and more predictable, auditable results. - Self-verification helps agents check generated code and tests before presenting them. ## Support Across the Software Lifecycle - **Development:** Faster code generation and test creation with less developer back-and-forth. - **Security:** More reliable vulnerability remediation through complete, correctly scoped sequences. - **CI/CD:** Better continuity when investigating pipeline failures, analyzing logs, and proposing fixes. - **Cross-stage workflows:** The model supports coordination across planning, coding, security, and deployment. ## Availability and Pricing - Claude Opus 4.7 is available now through model selection in GitLab Duo Agent Platform. - Model credit consumption details are provided in GitLab’s documentation. - New users can start a free trial. - GitLab Premium and Ultimate subscribers can enable Duo Agent Platform and use included GitLab Credits. Teams using GitLab’s agent workflows can adopt Opus 4.7 to improve reliability on complex, multi-tool tasks spanning the full software delivery lifecycle.

Gitlab Machine Learning CI/CD Code Review+3

gitlabApr 16, 20263 min readCurated summary

GitLab 18.11: Budget guardrails for GitLab Credits

GitLab 18.11 introduces spending controls for GitLab Credits used by the Duo Agent Platform. Organizations can set subscription-wide monthly caps, limit individual users, and monitor enforcement, making AI costs more predictable as adoption grows. The goal is to combine usage-based pricing with the budget certainty traditionally associated with seat-based licensing. ## Subscription-Level Spending Caps - Billing account managers can set a hard monthly ceiling in the Customers Portal. - When usage reaches the cap, Duo Agent Platform access pauses for all users until the next billing period. - Managers can raise or disable the cap mid-month to restore access. - Caps reset monthly and remain in effect until changed. - Because usage data is synchronized periodically, limited usage may occur after the cap is technically reached. ## Per-User Credit Limits - A flat per-user limit can be applied uniformly through the GitLab GraphQL API. - Custom overrides allow organizations to give higher allocations to selected users, such as staff engineers. - Limits apply to a user’s total consumption across all credit sources. - Reaching an individual limit pauses only that user’s Duo Agent Platform usage; their GitLab access remains intact. - Other users continue working until they reach their own limits or the subscription cap. ## Visibility and Notifications - Billing account managers receive email notifications when the subscription cap is reached. - Group owners on GitLab.com and instance administrators on Self-Managed installations can see users blocked by per-user caps. - Administrators can restore access by changing limits through the GraphQL API. - Per-user usage data supports monitoring, chargeback, and future budget planning. ## Benefits for Scaling AI Adoption - Hard caps make AI spending easier to forecast, approve, and include in quarterly budgets. - Per-user limits help distribute credits fairly across teams and cost centers. - Organizations can expand from small pilots to hundreds or thousands of developers without risking uncontrolled invoices. - Usage data helps platform teams understand consumption patterns and adjust allocations. ## Usage-Based Pricing with Guardrails GitLab contrasts its approach with seat-based AI tools, where organizations pay a fixed amount per user regardless of usage. GitLab Credits instead charge based on actual consumption while adding enforced spending limits, combining flexibility with predictable budgeting. ## Example Deployments - A 200-person engineering organization can set a subscription cap matching its approved monthly budget. - If usage approaches the limit, finance or billing managers can either increase the cap or wait for the next period. - A 2,000-person enterprise can apply standard limits to most developers while allocating higher caps to engineers handling complex work. ## Availability and Setup - The controls are available for GitLab.com and Self-Managed customers running GitLab 18.11. - Subscription-level caps are configured by billing account managers in the Customers Portal. - Flat and custom per-user caps are configured through the GitLab GraphQL API by namespace owners or instance administrators. Organizations adopting GitLab Duo Agent Platform should establish a subscription cap, define fair per-user allocations, and monitor usage regularly. These controls provide a safer foundation for expanding AI usage without sacrificing financial oversight.

Gitlab Machine Learning Software Development Saas+4

gitlabApr 16, 20261 min readCurated summary

GitLab 18.11 release notes | GitLab Docs

Agentic SAST Vulnerability Resolution is now generally available in GitLab 18.11 through the GitLab Duo Agent Platform. It autonomously analyzes critical and high-severity SAST findings, proposes code fixes, and creates ready-to-review merge requests. The feature is designed to accelerate remediation while giving reviewers confidence assessments and the option to apply fixes directly from vulnerability details. ## Availability and Integration - Available with GitLab Ultimate. - Supported on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. - Runs: - As part of a SAST scan - After SAST false-positive detection - Manually for individual SAST vulnerabilities ## Automated Vulnerability Analysis - Examines each finding and reasons through the surrounding code context. - Generates proposed fixes for critical and high-severity SAST vulnerabilities. - Automatically opens a merge request containing the remediation for review. ## Review and Remediation Workflow - Provides quality assessments to help reviewers evaluate the likely reliability of each proposed fix. - Lets users apply resolutions directly from vulnerability details pages. - Feedback is welcomed through GitLab issue 585626. ## Practical Recommendation Teams using GitLab Ultimate can enable the feature to streamline SAST remediation, while still reviewing agent-generated merge requests before merging changes.

Gitlab Code Quality DevOps Sast+3

gitlabApr 15, 20263 min readCurated summary

A guide to the breaking changes in GitLab 19.0

GitLab 19.0 is expected to introduce 15 breaking changes, primarily by removing deprecated components and outdated platform support. The most significant effects involve Helm chart networking and bundled services, OAuth authentication, PostgreSQL, Redis, and supported operating systems. Administrators should audit their deployments and complete migrations before upgrading. ## Release and Deployment Windows - **GitLab.com:** Primary breaking-change window is May 4–6, 2026, with a fallback window on May 11–13. - **GitLab Self-Managed:** GitLab 19.0 becomes available May 21, 2026. - **GitLab Dedicated:** Upgrades occur during assigned maintenance windows, with GitLab 19.0 scheduled for the week of June 22, 2026. - Additional changes may roll out outside these windows in exceptional circumstances. ## High-Impact Changes ### NGINX Ingress Replaced by Gateway API - The GitLab Helm chart will use **Gateway API with Envoy Gateway** as its default networking configuration. - Bundled NGINX Ingress reached end-of-life in March 2026. - Existing deployments can explicitly continue using bundled NGINX Ingress until its planned removal in GitLab 20.0. - The change does not affect: - NGINX used by the Linux package. - Deployments using externally managed Ingress or Gateway API controllers. - Administrators should plan migration to Envoy Gateway or another externally managed controller. ### Bundled PostgreSQL, Redis, and MinIO Removed - The GitLab Helm chart and GitLab Operator will no longer bundle Bitnami PostgreSQL, Bitnami Redis, or the forked MinIO chart. - These components were intended for proof-of-concept and test environments, not production. - Deployments using them must migrate to external services before upgrading. - PostgreSQL and Redis bundled with the Linux package are unaffected. ### OAuth ROPC Grant Removed - The Resource Owner Password Credentials OAuth flow will be removed across GitLab.com, Self-Managed, and Dedicated. - ROPC is being eliminated because of security limitations and its removal from OAuth 2.1. - Applications using ROPC must migrate to a supported flow, such as Authorization Code. - After upgrading, ROPC will not work even when client credentials are provided. ### PostgreSQL 17 Becomes Required - PostgreSQL 16 will no longer be supported; PostgreSQL 17 becomes the minimum version. - Single PostgreSQL instances installed through the Linux package may be upgraded automatically during GitLab 18.11. - Cluster deployments and installations that opt out of automatic upgrades require a manual migration. - Administrators should verify sufficient disk space and complete the upgrade before GitLab 19.0. ## Medium-Impact Changes ### Ubuntu 20.04 Packages Discontinued - GitLab will stop publishing Linux packages for Ubuntu 20.04. - GitLab 18.11 is the final release supporting that distribution. - Affected installations must upgrade to Ubuntu 22.04 or another supported operating system first. ### Redis 6 Support Removed - External Redis 6 deployments must migrate to Redis 7.2 or Valkey 7.2. - The Linux package’s bundled Redis is unaffected because it has used Redis 7 since GitLab 16.2. - Migration options vary by provider: - AWS ElastiCache and GCP Memorystore: Redis 7.2 or Valkey 7.2. - Azure: self-host Redis or Valkey on VMs or AKS until managed support is available. - Self-hosted installations: upgrade directly to Redis 7.2 or Valkey 7.2. ### Auto DevOps Builder Image Updated - The CNB builder image used by Auto DevOps changes from `heroku/builder:22` to `heroku/builder:24`. - Pipelines relying on the older image may need testing or configuration updates. GitLab administrators should review the deprecations and upgrade documentation, identify whether their deployment uses any affected components, and complete required migrations before GitLab 19.0.

Gitlab Database Design PostgreSQL DevOps+4

gitlabApr 14, 20262 min readCurated summary

GitLab and Vertex AI on Google Cloud: Advancing agentic development

GitLab is partnering with Google Cloud to combine the GitLab Duo Agent Platform’s lifecycle-wide orchestration with Vertex AI’s managed foundation models and enterprise controls. The integration gives development teams context-aware agents for planning, coding, security, and delivery while keeping workflows within GitLab’s governed system of record. Customers gain model flexibility, stronger governance, and reduced complexity compared with managing disconnected AI tools. ## Agents Across the Software Development Lifecycle - GitLab Duo Agent Platform coordinates specialized agents across planning, development, code review, security, and delivery. - Unlike standalone coding assistants, GitLab agents can access issues, merge requests, pipelines, vulnerabilities, and codebases. - GitLab Duo Planner Agent can analyze backlogs, divide epics into tasks, and support prioritization. - Security Analyst Agent can triage vulnerabilities, explain risks, and recommend remediation priorities. - Built-in flows connect agents into end-to-end processes, reducing manual handoffs. - Agentic Chat provides natural-language access to project context and multi-step reasoning within GitLab. ## Vertex AI as the Model and Infrastructure Layer - Vertex AI supplies the foundation models and related services used by GitLab agents. - Newer models improve reasoning, tool use, and long-context understanding, supporting workloads such as backlog analysis and monorepo security reviews. - Vertex AI Model Garden offers Gemini, third-party, and open-source models, allowing customers to balance performance, cost, and regulatory requirements. - GitLab supports Bring Your Own Model configurations, enabling organizations to use approved providers and gateways. - Vertex AI abstracts LLM hosting, including infrastructure management, security, governance, and model-version delivery. ## Enterprise Governance and Operational Benefits - GitLab’s AI Gateway mediates model access, helping administrators track connections and maintain governance. - Developers remain in GitLab while inference follows existing Google Cloud security and policy controls. - Platform teams can standardize which models support recommendations, analysis, and remediation. - Security teams can manage findings and proposed fixes in the same environment, reducing context switching and unmanaged workflows. - Using Vertex AI through GitLab can align AI usage with existing Google Cloud contracts, controls, and procurement policies. - The approach helps reduce duplicate spending and fragmented “shadow AI” toolchains. ## Practical Outcome for Google Cloud Customers The integration is intended to increase developer productivity without requiring teams to evaluate, host, or manage individual language models. GitLab provides the governed DevSecOps control plane, while Vertex AI supplies scalable, flexible model infrastructure, enabling organizations to adopt more capable agentic workflows while maintaining enterprise security and control.

Gitlab Database Design DevSecOps Software Development Lifecycle+4

gitlabApr 13, 20263 min readCurated summary

GitLab named a 2026 Omdia Universe Leader

GitLab was named a Leader in Omdia’s 2026 Universe for AI-assisted Software Development, IDE-based Tools, ranking among 19 vendors. Its strongest results came from covering the entire software lifecycle—not just code generation—including planning, security, testing, deployment, and operations. The report suggests that AI delivers the greatest productivity gains when automation extends beyond coding into coordinated, governed delivery. ## Omdia’s Broader Evaluation - Omdia expanded its criteria to assess full software lifecycle capabilities. - The report emphasized that faster coding alone can create downstream bottlenecks in: - Code review - Security remediation - Testing - Deployment coordination - Agentic AI was evaluated as a current capability, including: - Autonomous task coordination - Handoffs between specialized agents - Support for teams at different stages of AI adoption - Omdia categorizes vendors as Leaders, Challengers, or Prospects based on capability and strategy/execution. ## GitLab’s Top Scores - **Solution Breadth: 100%** - Covers planning, requirements, development, security, deployment, and issue management in one platform. - Planner Agent and Security Analyst Agent extend AI into sprint planning, vulnerability triage, and remediation guidance. - **Strategy and Innovation: 88%** - Uses end-to-end orchestration and a privacy-first architecture that does not train on private customer data. - Supports multiple models through partnerships with Anthropic, Google, and AWS. - Provides shared context across issues, merge requests, pipelines, and security findings. - **Core Features: 82%** - Offers context-aware code generation, unit and integration testing, security testing, and review prioritization. - Automates CI/CD, GitOps, and pipeline-failure root cause analysis. - The AI Impact Dashboard tracks cycle time, deployment frequency, and productivity effects. - GitLab also received top-tier scores for Extended Features (80%) and Vendor Execution (88%). ## Developers and AI Agents - Teams are increasingly structured around engineers supervising AI agents. - Human responsibilities are shifting toward: - Defining requirements and guardrails - Supervising quality and security - Designing autonomous production pipelines - Connecting business objectives with agentic systems - Automating only code generation provides limited benefit if review, testing, and deployment remain manual. ## Enterprise Readiness - Omdia treated compliance, privacy, and deployment flexibility as baseline requirements for Leader-tier platforms. - GitLab highlights: - SOC 2 and ISO 27001 certification - No training on private customer data for agentic AI - Self-managed, cloud, on-premises, and air-gapped deployment - Support for self-hosted AI models - GitLab Dedicated, including FedRAMP Moderate authorization for government - These capabilities target regulated industries requiring strong data residency, auditability, and governance. GitLab’s central argument is that AI coding speed matters only when the rest of the software delivery lifecycle can keep pace. Engineering teams should evaluate AI platforms by their ability to deliver secure, governed, production-ready software—not merely by how much code they can generate.

Gitlab Database Design AI Agents CI/CD+4

gitlabApr 8, 20262 min readCurated summary

GitLab Patch Release: 18.10.3, 18.9.5, 18.8.9 | GitLab Docs

GitLab released patch versions 18.10.3, 18.9.5, and 18.8.9 on April 8, 2026, addressing important security and bug fixes. Self-managed CE and EE installations should upgrade immediately, while GitLab.com is already patched and GitLab Dedicated customers need no action. The fixes cover unauthorized access, denial-of-service vulnerabilities, code injection, XSS, and information disclosure. ## Release Scope and Upgrade Guidance - The patches apply to GitLab Community Edition and Enterprise Edition. - Administrators should upgrade installations affected by the listed vulnerabilities to the latest supported patch release. - GitLab issues describing security vulnerabilities will become public 30 days after the release in which they were fixed. - Patch releases are generally issued on the second and fourth Wednesdays, with urgent ad-hoc releases for critical vulnerabilities. ## Authentication and Authorization Fixes - **CVE-2026-5173 (CVSS 8.5):** Authenticated users could invoke unintended server-side methods through WebSocket connections. - **CVE-2026-2619 (CVSS 4.3):** Auditor users could modify vulnerability flag data in private projects through the AI detection API. - **CVE-2026-1752 (CVSS 4.3):** Developers could modify protected environment settings through authorization flaws in the Environments API. - **CVE-2026-2104:** CSV exports could expose confidential issues assigned to other users because of insufficient authorization checks. ## Denial-of-Service Vulnerabilities - **CVE-2026-1092 (CVSS 7.5):** Unauthenticated attackers could crash or disrupt services through malformed JSON sent to the Terraform state lock API. - **CVE-2025-12664 (CVSS 7.5):** Repeated unauthenticated GraphQL queries could cause denial of service. - **CVE-2026-1403 (CVSS 6.5):** Authenticated users could disrupt Sidekiq workers by importing malformed CSV files. - **CVE-2026-1101 (CVSS 6.5):** Authenticated users could overload GitLab through improperly validated GraphQL SBOM queries. ## Code Execution and Cross-Site Scripting - **CVE-2026-1516 (CVSS 5.7):** Crafted Code Quality report content could leak the IP addresses of users viewing the report. - **CVE-2026-4332 (CVSS 5.4):** Authenticated users could execute arbitrary JavaScript in other users’ browsers through customizable analytics dashboards. ## Information Disclosure - **CVE-2025-9484 (CVSS 4.3):** Certain GraphQL queries could reveal other users’ email addresses to authenticated users. - The release also fixes CSV export authorization issues that could expose confidential issue data. Administrators of self-managed GitLab CE or EE instances should apply 18.10.3, 18.9.5, or 18.8.9 as soon as possible, depending on their supported release branch.

Gitlab API GraphQL Cve+4