What's new in GitLab

Monthly releases, developer resources, and the latest from the GitLab team.

Monthly releases

Latest release

August 20, 2026

Scale agentic AI across trusted software delivery workflows

With 19.3, access your secrets at build-time, write agentic workflows in plain language and remediate your vulnerability backlog in bulk.

Read the release notes

Blog

Gain governed access to your secrets at build-time

After its public beta with GitLab 19.0, GitLab Secret Manager is now available for GitLab.com customers as a paid add-on via GitLab Credits. It is designed to keep credentials in the same platform that runs your code and pipelines, and it is governed by the same access controls you already use for code.

Blog

Build custom flows in minutes with the Flow Creator Agent

Describe the automation you want in plain English, and get back a complete, runnable flow definition ready to register from the AI Catalog. The people who understand a workflow best are not always the people who know the Flow Registry schema, and 19.3 removes that requirement. Your team turns process knowledge into automation without having to learn YAML.

Blog

When your backlog outgrows your team, GitLab scales triage and remediation

Spend less time confirming false positives and more time shipping fixes that reduce real risk. Bulk-select multiple findings and run false positive detection and vulnerability resolution against the whole selection, so years of accumulated risk is clear in a single action instead of one vulnerability at a time. Run automated triage and remediation, no matter the scanner origin or severity.

This month's Notable Contributor: @gkepas

We recognize Giannis for sustained contributions across the GitLab codebase, the contributor platform, client-go, the Terraform provider, and GitLab Orbit. He is also an active translator and a member of the GitLab Community Discord.

Read the press release

Secure

Build

Secrets Manager via GitLab Credits (Limited Availability)

Efficiently inject pipeline secrets, each scoped for the job that needs it, to reduce the blast radius of leaked credentials. Secrets work outside CI too — in Kubernetes, infrastructure as code, or through the API. Because credentials live in the same platform that runs your code and pipelines, your team will not need to maintain a separate integration or permission model. Start using it in GitLab.com as a paid add-on billed through GitLab Credits.

Manage

GitLab Credits usage caps (GA)

Cap your on-demand credit spend so you don’t need to worry about overages. Set a subscription-level cap in the Customers Portal, and a default per-user cap or per-user overrides through the GraphQL API. When consumption reaches a cap, features that consume GitLab Credits are suspended until the next billing period or until an administrator raises the cap.

Code

Resolve more merge conflicts with GitLab Duo (GA)

Stop resolving straightforward conflicts by hand in the UI or from the command line. Scale conflict resolution past what one developer can hand-merge. GitLab Duo analyzes the conflict, commits the resolution to your source branch, and posts a summary comment describing what changed.

Manage

Restricted visibility for custom agents and flows

Roll one agent out to every project in your top-level group without publishing it to the world. Restricted visibility sits between Private, which covers a single project, and Public, which exposes the item to everyone on GitLab.com.

Code

Access to plugins and marketplaces in GitLab Duo CLI (Experiment)

Give your whole team the same CLI setup from one install instead of everyone wiring up their own. A plugin bundles Agent Skills, custom slash commands, and Model Context Protocol servers together, and your team can host its own catalog of them in a Git repository. GitLab Duo CLI also reads .claude-plugin/marketplace.json files, so a marketplace your team already maintains works without modification.

Code

Resolve review discussions with GitLab Duo (GA)

Close review threads faster so you can move onto the next task. Select resolve with GitLab Duo on any discussion, and it reads the comment and the surrounding code, makes the requested change on the source branch, replies with a summary, and resolves the thread. You or the reviewer can reopen the thread if it doesn’t address the comment.

Code

New MCP tools for reading and searching merge requests

Ask your agent about a merge request and get an answer without the back and forth. A single get_merge_request call returns the diffs, commits, notes, pipelines, and discussions together, so the agent stops chaining requests to assemble the full picture. A new list_merge_requests tool searches and filters by author, assignee, reviewer, state, labels, or free text, so you can point the agent at the right merge requests without leaving your workflow.

Code

New GitLab Duo Agentic Chat UI in VS Code (Beta)

Try a rebuilt Agentic Chat panel in the GitLab for VS Code extension without committing to it. The models, agents, slash commands, and tool approvals underneath are unchanged, and a toggle in the panel returns you to the classic UI at any time. Turn on beta and experimental features for your top-level group or instance to see it.

Verify

Enforce merge trains for better governance

Keep every in-progress pipeline running when someone merges. One project-level setting applies merge train rules across the UI and the REST API, so an immediate merge won’t cancel or restart pipelines in flight. High-velocity monorepo teams keep CI costs predictable. Owners and Administrators can still make an exception when they need to.

View agent task plan in session detail sidebar

See what an agent is working on in a glance without expanding activity log entries one by one. The session detail sidebar shows the agent’s latest plan automatically, with each task, its status, and a progress summary such as 2 of 5 completed.

Secure

Analyze

Optimize SAST triage and remediation funnel

See how much of your SAST workflow AI already handles, so you can show what the automation is returning and target the stage that still needs oversight. The Security Dashboard traces critical and high vulnerabilities through detection, true positives confirmed by false positive detection, merge requests created by Agentic SAST Vulnerability Resolution, and fixes merged, over a 30-, 60-, or 90-day window.

Manage

Support for Amazon Bedrock Mantle (Beta)

Serve the GPT OSS 120B open-weight model from Amazon Bedrock Mantle in GitLab Duo Self-Hosted. Add it with your Mantle endpoint and API key, using the same OpenAI-compatible setup you already use for other platforms.

Secure

Dependency scanning support for Bun

Now you can scan Bun projects for known vulnerabilities as part of your standard pipelines. GitLab parses bun.lock files, and because Bun packages come from the npm registry, the GitLab advisory database already covers those dependencies with no extra configuration. Eligible findings also support dependency scanning auto-remediation.

Manage

Secure

Disable OAuth DCR for more enterprise control over MCP

Control which OAuth clients reach your instance. Administrators on GitLab Self-Managed and GitLab Dedicated can turn off Dynamic Client Registration (DCR) entirely through the application settings API. When it is off, clients must use a pre-registered OAuth application instead of registering themselves.

Secure

Advanced SAST for iOS (Beta)

Bring interprocedural taint analysis to iOS development. Advanced SAST now supports Objective-C and Swift, detects key OWASP Mobile Top 10 vulnerability classes, and traces the complete taint path even when it crosses the Swift and Objective-C boundary.

Read the press release

@tnt4brain

LDAP group sync can now manage the Auditor role

You can now use LDAP group sync for self-managed instances to grant and revoke the Auditor role automatically. A new audit_group setting maps an LDAP group to Auditor, working the same way admin_group already did for administrators, so auditor access follows directory membership instead of being maintained by hand. Available in Enterprise Edition.

@gkepas and @lunivilen

Two new CI/CD variables: retry count and job tags

Your pipeline scripts can now tell whether they are running for the first time. CI_JOB_RETRY_COUNT holds how many times the current job has been retried and is 0 on the first run, so retry-aware logic no longer needs you to track state yourself. Separately, CI_JOB_TAGS exposes the job's own configured tags, where previously only the runner's tags were visible through CI_RUNNER_TAGS. Both are available with no configuration.

@tayllanr and @arcesium-guptaanv

Webhooks for MR reviews and approvals

You can use webhooks for merge request reviews and deployment approvals. When you submit a merge request review as Request changes or Reviewed fires a merge_request webhook carrying a changes.reviewers entry, so external tools can react to review activity instead of just approvals. The deployment webhook gains blocked, approved, and rejected statuses with top-level approver and approval fields, letting you follow a deployment through its full approval lifecycle. The blocked status is available in Community and Enterprise Edition; approved and rejected are Enterprise Edition only, and approver.email is redacted.

@kiran-4444 (Portkey.ai)

Publish Rust crates to the GitLab package registry

With cargo publish, you can now authorize the endpoint it needs to upload crates to the GitLab package registry, the third step in bringing Cargo support to parity with the other package formats. Administrators can set the maximum crate size through the cargo_max_file_size plan limit in the Plan Limits API.

@rantoniuk

Branch names can carry the name of whoever created the branch

You can include the creator with branch name templates, a new %{branch_creator} variable, so a branch created from an issue can identify who created it rather than falling back to a generic name.

@Taucher2003 (Bildungsinnovator), @nwittstruck (Siemens), @jcb960, @nraj0408, and @Alessandro.Lai (facile.it)

More ways to filter and manage through the API

Six additions are now available across REST and GraphQL. Groups queries accept visibilityLevel and includeSubgroups, and can filter for groups scheduled for deletion with aimed_for_deletion. The merge requests REST API accepts merged_after and merged_before. Achievement award messages can be edited after being granted rather than only set at award time. Administrators can reset SCIM tokens through the admin token API. And CI_JOB_TOKEN can now fetch repository archives, which unblocks private Composer package downloads that broke when source fallback was deprecated.

@nwittstruck (Siemens), @rantoniuk, and @arcesium-kumsaura

Other additions to the interface

You can press Esc to cancel a list item drag in an issue, work item, or epic description instead of being stuck completing the move. Pipeline test report summary columns are now sortable, defaulting to most failures first. And archived labels say Archived in their tooltip, so you can tell at a glance why one looks different.

Read the press release