Which vulnerability findings in my backlog are actually worth a developer's time?

scans surrounding code for each flagged finding and returns a confidence score with an explanation of whether it is a real risk or a false positive, run across many findings at once instead of one at a time

Can I clear a large SAST backlog without opening every finding by hand?

a bulk-select action in the vulnerability report runs false-positive detection and agentic remediation against a batch of findings, with progress tracking and cancellation, capped by concurrency limits so it doesn't crowd out pipeline builds

Do findings from my other scanners get the same triage treatment as native ones?

imports third-party results in SARIF format into the same vulnerability report, so bulk false-positive detection and remediation apply to findings regardless of which scanner produced them

Will a new Critical or High finding already be triaged by the time I look at it?

pipelines can run false-positive detection and agentic resolution automatically on new Critical and High severity findings, so a confidence score and a fix merge request can exist before a developer opens the finding

Can I keep model inference inside my own cloud boundary instead of sending code to a shared endpoint?

the AI Gateway can run inside a single-tenant deployment against Amazon Bedrock, a Microsoft Foundry endpoint in your Azure tenant, or a model you bring yourself, with per-feature model assignment instead of one global model

GitLab release history — The Cyber Toolchain

GitLab Orbit is GA: Higher agent accuracy, lower token cost (2026-10-29) Oct 29, 2026 · issue 125

GitLab adds Orbit, a live context graph of the full software lifecycle, now GA for Premium and Ultimate customers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Wire up an MCP-compatible agent such as Claude Code or Cursor to Orbit so it can query live codebase context instead of crawling files.

$ glab auth login
glab orbit setup

Connect MCP-compatible agents (Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Antigravity) to the Orbit context graph using glab auth login then glab orbit setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Connect custom agents and internal tooling to Orbit through REST.
GitLab adds Orbit, a live queryable graph that connects code, merge requests, pipelines, vulnerabilities, work items, and ownership across all projects in a group, now generally available for Premium and Ultimate customers on GitLab.com.
Agents on Duo Agent Platform query Orbit natively with nothing to configure.
Engineers query the Orbit graph through the Data Explorer.

+2 more show less

Orbit indexes every push, merge, and deploy in real time — at GitLab scale, more than 1.5 million projects and 8 TB of graph data in under 2 hours — so agents reason from current lifecycle state.
Orbit is available as query packs (shared pool per org), priced at $30 in GitLab Credits per user per month for 1,000 queries, with overages billed at 33 queries per GitLab Credit (~$0.03 per query).

7 details in Everything

GitLab Orbit: Find vulnerability blast radius without the manual hunt (2026-10-29) Oct 29, 2026 · issue 125

GitLab adds Orbit, a graph that connects CVEs to affected projects, pipelines, owners, and environments without manual correlation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Map every project in a group that uses PHP, grouped by subgroup with owners named, during a vulnerability triage.

📍In GitLab Duo Agentic Chat, type: Use Orbit to map the blast radius of PHP in this group. List every project that contains PHP code, grouped by subgroup, with owners.

Find all Dockerfiles that pull a PHP base image across the entire top-level group using exact regex search alongside Orbit.

$ lang:Dockerfile ^FROM.*php

Collect every container scanning finding for a specific CVE across the group via Agentic Chat (requires Ultimate and Security Manager role).

📍In GitLab Duo Agentic Chat, type: Collect every container scanning finding for CVE-2026-109618 and CVE-2026-109619 across the group from the vulnerability report.

Enable Orbit on a top-level group to index projects, merge requests, pipelines, work items, security findings, and source code into one relationship graph queryable in plain language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Query blast radius in plain language via GitLab Duo Agentic Chat — for example, ask it to 'Use Orbit to map the blast radius of PHP in this group. List every project that contains PHP code, grouped by subgroup, with owners.'
Use exact code search at the top-level group with regular expression mode to find container base images by running lang:Dockerfile ^FROM.*php or file:composer\.json$ alongside Orbit graph queries.
External agents such as Claude Code and Codex now reach the Orbit graph over MCP.
GitLab's built-in Security Analyst Agent now uses Orbit directly to traverse the graph and answer blast-radius questions from indexed project data.

+2 more show less

Orbit access follows existing GitLab roles, so people and agents see only what they are permitted to see; graph queries behind each answer can be audited.
Orbit is now generally available for Premium and Ultimate customers on GitLab.com, with Self-Managed and GitLab Dedicated support coming in the following weeks, and a free 30-day trial available through account teams.

Enable Orbit on a top-level group to index projects, merge requests, pipelines, work items, security findings, and source code into one relationship graph queryable in plain language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Query blast radius in plain language via GitLab Duo Agentic Chat — for example, ask it to 'Use Orbit to map the blast radius of PHP in this group. List every project that contains PHP code, grouped by subgroup, with owners.'
Use exact code search at the top-level group with regular expression mode to find container base images by running lang:Dockerfile ^FROM.*php or file:composer\.json$ alongside Orbit graph queries.
External agents such as Claude Code and Codex now reach the Orbit graph over MCP.
Orbit access follows existing GitLab roles, so people and agents see only what they are permitted to see; graph queries behind each answer can be audited.

+1 more show less

Orbit is now generally available for Premium and Ultimate customers on GitLab.com, with Self-Managed and GitLab Dedicated support coming in the following weeks, and a free 30-day trial available through account teams.

1 more in Everything

What happens when vulnerabilities are discovered faster than you can fix them? (2026-10-28) Oct 28, 2026 · issue 124

GitLab adds Orbit context graph, Secrets Manager per-job credential scoping, and agentic remediation via Duo Agent Platform with sandboxed agent identities.

GitLab adds Orbit, a live context graph of the software lifecycle that connects findings to the changes that introduced them, the pipelines that shipped them, and the teams who own the fix, enabling exposure questions like reachability and blast radius to be answered across thousands of repositories.
GitLab adds Secrets Manager, which limits each pipeline job to only the credentials it explicitly requests and is authorized to use, so a compromised dependency can reach only the secrets of the job it runs in.
GitLab Duo Agent Platform now gives each agent a composite identity limited to the permissions it shares with the requesting user, a sandbox destroyed when the task ends, and a full action record, with agents earning more autonomy only as controls at each stage are proven under the GitLab Security Standard.
GitLab Duo Agent Platform now investigates findings in application context, filters likely false positives, prioritizes by exploitability and reachability, writes a fix, runs it through the pipeline for regression and security scan checks, and surfaces the change, explanation, and pipeline results in a single merge request for developer review.
GitLab's Dependency Firewall now blocks policy-violating packages before they enter the build, preventing vulnerable or malicious open-source dependencies from reaching production.

5 details in Everything

New detection Business Logic Security Analyzer

Extend GitLab Duo Agent Platform into your business systems (2026-10-27) Oct 27, 2026 · issue 123

GitLab Duo Agent Platform's Flows API (GA in 19.5) lets any external system trigger AI triage flows that open GitLab issues automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Trigger a custom Duo Agent flow from any external system to auto-triage an error and open a GitLab issue — no human required.

$ curl --request POST https://gitlab.com/api/v4/ai/duo_workflows/workflows \
  --header 'PRIVATE-TOKEN: <your_project_access_token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "project_id": 12345,
    "ai_catalog_item_consumer_id": 67,
    "goal": "Class: OpportunityDiscountService\nException: System.NullPointerException\nMessage: Attempt to de-reference a null object\nStack trace: ...\n",
    "start_workflow": true,
    "allow_agent_to_request_user": false,
    "agent_privileges": [1, 2, 3],
    "pre_approved_agent_privileges": [1, 2, 3]
  }'

Define a custom AI triage agent flow that reads repository files and creates a GitLab issue, using flow registry v1 YAML syntax.

yaml

version: "v1"
environment:
  ambient
components:
  - name: "sf_error_triage"
    type: AgentComponent
    prompt_id: "sf_error_triage_prompt"
    inputs:
      - from: "context:project_id"
        as: "project_id"
      - from: "context:goal"
        as: "error_report"
    toolset:
      - "find_files"
      - "grep"
      - "read_file"
      - "list_commits"
      - "create_issue"
prompts:
  - prompt_id: "sf_error_triage_prompt"
    prompt_template:
      system: |
        You triage errors for a team. Find the source file, read the code,
        list recent commits, and create one issue with root-cause analysis.
      user: |
        Project ID: {{project_id}}
        Error report: {{error_report}}
      placeholder: history
routers:
  - from: "sf_error_triage"
    to: "end"
flow:
  entry_point: "sf_error_triage"

Enable a custom flow and retrieve its ai_catalog_item_consumer_id for use in API calls, then navigate to AI > Flows in your project.

📍1. In your GitLab project, go to AI › Flows. 2. Open the Managed tab and select your flow. 3. Select Enable and choose the project that holds your source code. 4. Run the GraphQL query from the docs to retrieve the gid://gitlab/AiCatalogItemConsumer/<number> and note the numeric ID as your ai_catalog_item_consumer_id. 5. Create a project access token with the api scope and at least the Developer role for use in the PRIVATE-TOKEN header.

Introduces the POST /api/v4/ai/duo_workflows/workflows Flows API endpoint (generally available from GitLab 19.5) to trigger custom AI agent flows from any external system via HTTP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports allow_agent_to_request_user, agent_privileges, and pre_approved_agent_privileges request body fields to control autonomous flow execution and tool permissions without human intervention.
Custom flows are defined as a single YAML file in flow registry v1 syntax, specifying AgentComponent agents, toolsets (find_files, grep, read_file, list_commits, create_issue), and prompt templates.
Flows API response includes a web_url field linking to the agent session, enabling inspection of each step the flow took.
Enables lookup of a flow's ai_catalog_item_consumer_id via GraphQL query, required to invoke a specific custom flow through the Flows API.

+2 more show less

Supports creating and testing custom flows in VS Code with the GitLab flow builder.
New AI > Flows > New flow UI path in a GitLab project allows creating, enabling, and managing custom agent flows, including an Enable action scoped to a specific project under the Managed tab.

7 details in Everything

PHP2Shell: GitLab helps find and remediate critical PHP flaws (2026-10-22) Oct 22, 2026 · issue 2026/10

Updated vulnerability check Container scanning detection for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

PHP2Shell: GitLab helps find and remediate critical PHP flaws (2026-10-22) Oct 22, 2026 · issue 117

Updated vulnerability check Container scanning detection for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

PHP2Shell: GitLab helps find and remediate critical PHP flaws (2026-10-22) Oct 22, 2026 · issue 017

Updated vulnerability check Container scanning detection for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

docs update Oct 20, 2026 · issue 114

GitLab Runner 19.5 adds CPU model logging at job start and clearer Kubernetes OOM-kill error messages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Logs the CPU model of the job execution environment at job start for better observability of runner hardware.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Surfaces a clearer Kubernetes executor error message when the helper container is OOM-killed.

Logs the CPU model of the job execution environment at job start for better observability of runner hardware.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Uncover the business logic vulnerabilities SAST scanners miss (2026-10-20) Oct 20, 2026 · issue 2026/10

GitLab debuts Business Logic Security Analyzer in early access, catching BOLA, missing auth, and mass assignment flaws SAST misses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Business Logic Security Analyzer to GitLab Duo Agent Platform, enabling whole-repository SAST scans targeting broken object-level authorization (CWE-639), missing or improper authorization, and mass assignment — vulnerability classes that pattern-based scanners cannot detect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports triggering whole-repository scans via GitLab Duo Chat or through the API, and attaching a Business Logic scan profile to a project for automatic merge-request scanning after pipelines pass.
Reports findings — including CWE ID, severity (e.g. Critical), and file location — as first-class SAST results in the Vulnerability Report and the merge request security widget.
Backs the analyzer with Anthropic's Claude Mythos 5.1 (a first for any GitLab capability), plus Claude Opus 5.5, Sonnet 5.5, Sonnet 5, and Sonnet 4.6, all running as GitLab-managed models through GitLab's AI gateway.
Available in early access for GitLab Ultimate customers on GitLab.com; each scan consumes GitLab Credits scaled to the size of the application's attack surface.

5 details in Everything

AI Governance: One view of agent activity (2026-10-20) Oct 20, 2026 · issue 2026/10

GitLab launches AI Governance Dashboard (beta) to audit agent activity across GitLab Duo and external agents like Claude Code, Cursor, and Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Capture Claude Code, Cursor, and Codex sessions so all external agent activity shows up in the AI Governance Dashboard.

$ glab govern setup --agents codex,cursor

Confirm that agent-capture hooks are installed and sending sessions correctly before handing the dashboard to an auditor.

$ glab govern doctor

Enable AI audit event storage so agent actions start being recorded — without this, the dashboard shows no history.

📍In your top-level group, go to Settings › GitLab Duo, select Change configuration, then enable Store AI audit events under Data and privacy. Requires Owner or Security Manager role.

Adds glab govern setup subcommand (requires glab CLI 1.122.0+) to install Claude Code hooks and capture sessions for the AI Governance Dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds glab govern setup --agents codex,cursor to capture Cursor and Codex sessions via a background job that sends sessions every 30 minutes.
Adds glab govern doctor subcommand to verify that agent-capture setup is working correctly.
Adds read_agent_artifacts custom role ability to grant dashboard access without requiring Owner role on a top-level group.
Introduces the AI Governance Dashboard (beta), accessible at AI > Governance > Dashboard tab in a top-level group, giving a unified view of GitLab Duo Agent Platform agents and externally connected agents (Claude Code, Cursor, Codex).

+2 more show less

Adds Store AI audit events toggle (in Settings > GitLab Duo > Change configuration > Data and privacy) to enable persistent recording of every agent action as an audit event.
Enables streaming of agent audit events to a SIEM system and downloading an immutable session copy as evidence from any GitLab Duo Agent Platform session.

7 details in Everything

AI Governance: One view of agent activity (2026-10-20) Oct 20, 2026 · issue 115

GitLab launches AI Governance Dashboard (beta) to audit agent activity across GitLab Duo and external agents like Claude Code, Cursor, and Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Capture Claude Code, Cursor, and Codex sessions so all external agent activity shows up in the AI Governance Dashboard.

$ glab govern setup --agents codex,cursor

Confirm that agent-capture hooks are installed and sending sessions correctly before handing the dashboard to an auditor.

$ glab govern doctor

Enable AI audit event storage so agent actions start being recorded — without this, the dashboard shows no history.

📍In your top-level group, go to Settings › GitLab Duo, select Change configuration, then enable Store AI audit events under Data and privacy. Requires Owner or Security Manager role.

Adds glab govern setup subcommand (requires glab CLI 1.122.0+) to install Claude Code hooks and capture sessions for the AI Governance Dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds glab govern setup --agents codex,cursor to capture Cursor and Codex sessions via a background job that sends sessions every 30 minutes.
Adds glab govern doctor subcommand to verify that agent-capture setup is working correctly.
Adds read_agent_artifacts custom role ability to grant dashboard access without requiring Owner role on a top-level group.
Introduces the AI Governance Dashboard (beta), accessible at AI > Governance > Dashboard tab in a top-level group, giving a unified view of GitLab Duo Agent Platform agents and externally connected agents (Claude Code, Cursor, Codex).

+2 more show less

Adds Store AI audit events toggle (in Settings > GitLab Duo > Change configuration > Data and privacy) to enable persistent recording of every agent action as an audit event.
Enables streaming of agent audit events to a SIEM system and downloading an immutable session copy as evidence from any GitLab Duo Agent Platform session.

7 details in Everything

Uncover the business logic vulnerabilities SAST scanners miss (2026-10-20) Oct 20, 2026 · issue 115

GitLab debuts Business Logic Security Analyzer in early access, catching BOLA, missing auth, and mass assignment flaws SAST misses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Business Logic Security Analyzer to GitLab Duo Agent Platform, enabling whole-repository SAST scans targeting broken object-level authorization (CWE-639), missing or improper authorization, and mass assignment — vulnerability classes that pattern-based scanners cannot detect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports triggering whole-repository scans via GitLab Duo Chat or through the API, and attaching a Business Logic scan profile to a project for automatic merge-request scanning after pipelines pass.
Reports findings — including CWE ID, severity (e.g. Critical), and file location — as first-class SAST results in the Vulnerability Report and the merge request security widget.
Backs the analyzer with Anthropic's Claude Mythos 5.1 (a first for any GitLab capability), plus Claude Opus 5.5, Sonnet 5.5, Sonnet 5, and Sonnet 4.6, all running as GitLab-managed models through GitLab's AI gateway.
Available in early access for GitLab Ultimate customers on GitLab.com; each scan consumes GitLab Credits scaled to the size of the application's attack surface.

5 details in Everything

Uncover the business logic vulnerabilities SAST scanners miss (2026-10-20) Oct 20, 2026 · issue 017

GitLab debuts Business Logic Security Analyzer in early access, catching BOLA, missing auth, and mass assignment flaws SAST misses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Business Logic Security Analyzer to GitLab Duo Agent Platform, enabling whole-repository SAST scans targeting broken object-level authorization (CWE-639), missing or improper authorization, and mass assignment — vulnerability classes that pattern-based scanners cannot detect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports triggering whole-repository scans via GitLab Duo Chat or through the API, and attaching a Business Logic scan profile to a project for automatic merge-request scanning after pipelines pass.
Reports findings — including CWE ID, severity (e.g. Critical), and file location — as first-class SAST results in the Vulnerability Report and the merge request security widget.
Backs the analyzer with Anthropic's Claude Mythos 5.1 (a first for any GitLab capability), plus Claude Opus 5.5, Sonnet 5.5, Sonnet 5, and Sonnet 4.6, all running as GitLab-managed models through GitLab's AI gateway.
Available in early access for GitLab Ultimate customers on GitLab.com; each scan consumes GitLab Credits scaled to the size of the application's attack surface.

5 details in Everything

AI Governance: One view of agent activity (2026-10-20) Oct 20, 2026 · issue 017

GitLab launches AI Governance Dashboard (beta) to audit agent activity across GitLab Duo and external agents like Claude Code, Cursor, and Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Capture Claude Code, Cursor, and Codex sessions so all external agent activity shows up in the AI Governance Dashboard.

$ glab govern setup --agents codex,cursor

Confirm that agent-capture hooks are installed and sending sessions correctly before handing the dashboard to an auditor.

$ glab govern doctor

Enable AI audit event storage so agent actions start being recorded — without this, the dashboard shows no history.

📍In your top-level group, go to Settings › GitLab Duo, select Change configuration, then enable Store AI audit events under Data and privacy. Requires Owner or Security Manager role.

Adds glab govern setup subcommand (requires glab CLI 1.122.0+) to install Claude Code hooks and capture sessions for the AI Governance Dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds glab govern setup --agents codex,cursor to capture Cursor and Codex sessions via a background job that sends sessions every 30 minutes.
Adds glab govern doctor subcommand to verify that agent-capture setup is working correctly.
Adds read_agent_artifacts custom role ability to grant dashboard access without requiring Owner role on a top-level group.
Introduces the AI Governance Dashboard (beta), accessible at AI > Governance > Dashboard tab in a top-level group, giving a unified view of GitLab Duo Agent Platform agents and externally connected agents (Claude Code, Cursor, Codex).

+2 more show less

Adds Store AI audit events toggle (in Settings > GitLab Duo > Change configuration > Data and privacy) to enable persistent recording of every agent action as an audit event.
Enables streaming of agent audit events to a SIEM system and downloading an immutable session copy as evidence from any GitLab Duo Agent Platform session.

7 details in Everything

Three developer tasks worth handing to an agent (2026-10-19) Oct 19, 2026 · issue 2026/10

GitLab Duo Agent Platform launches Code Review Flow, Fix CI/CD Pipeline Flow, and Agentic Chat for free-tier groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Trigger an automated first-pass code review on an open merge request without leaving the comment box.

$ /assign_reviewer @GitLabDuo

Send a failing pipeline to the agent for diagnosis and a proposed fix when the pipeline is not attached to a merge request.

📍In the GitLab UI: Build › Pipelines › [select failing pipeline] › Fix pipeline with Duo

Activate the Duo Agent Platform flows for your group so Code Review Flow and Fix CI/CD Pipeline Flow are available to all members.

📍Settings › GitLab Duo › Change configuration › Flow execution: enable Allow flow execution and Allow foundational flows › select Code Review and Fix CI/CD Pipeline › Save changes

Enables Allow flow execution and Allow foundational flows under Settings > GitLab Duo > Change configuration > Flow execution to activate the GitLab Duo Agent Platform for a group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Code Review Flow: assign @GitLabDuo as a reviewer or comment /assign_reviewer @GitLabDuo on a merge request to get automated diff, description, and related-file review comments posted inline.
Adds an automatic reviews option for Code Review Flow so every new merge request receives a first-pass review without manual assignment.
Adds Fix CI/CD Pipeline Flow: select Fix pipeline with Duo from a merge request's Overview or Pipelines tab to have an agent read pipeline logs and propose inline code suggestions, open a new merge request with a fix, or post next-step comments.
Adds Fix pipeline with Duo for pipelines not tied to a merge request via Build > Pipelines, producing a new merge request with the proposed fix.

+3 more show less

Adds Agentic Chat via GitLab Duo sidebar > Add new chat, letting practitioners query merge requests, issues, and pipeline data in natural language; available in the GitLab UI, VS Code, JetBrains IDEs, and Visual Studio with the Agentic toggle enabled.
Adds an AI Resource Library of ready-made prompts (e.g. Summarize Recent Changes to MR/Issue, Debug Failing Pipeline) for use with Agentic Chat.
Adds AI > Sessions view to follow agent reasoning in real time while Fix CI/CD Pipeline Flow or Agentic Chat runs.

8 details in Everything

Three developer tasks worth handing to an agent (2026-10-19) Oct 19, 2026 · issue 114

GitLab Duo Agent Platform launches Code Review Flow, Fix CI/CD Pipeline Flow, and Agentic Chat for free-tier groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Trigger an automated first-pass code review on an open merge request without leaving the comment box.

$ /assign_reviewer @GitLabDuo

Send a failing pipeline to the agent for diagnosis and a proposed fix when the pipeline is not attached to a merge request.

📍In the GitLab UI: Build › Pipelines › [select failing pipeline] › Fix pipeline with Duo

Activate the Duo Agent Platform flows for your group so Code Review Flow and Fix CI/CD Pipeline Flow are available to all members.

📍Settings › GitLab Duo › Change configuration › Flow execution: enable Allow flow execution and Allow foundational flows › select Code Review and Fix CI/CD Pipeline › Save changes

Enables Allow flow execution and Allow foundational flows under Settings > GitLab Duo > Change configuration > Flow execution to activate the GitLab Duo Agent Platform for a group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Code Review Flow: assign @GitLabDuo as a reviewer or comment /assign_reviewer @GitLabDuo on a merge request to get automated diff, description, and related-file review comments posted inline.
Adds an automatic reviews option for Code Review Flow so every new merge request receives a first-pass review without manual assignment.
Adds Fix CI/CD Pipeline Flow: select Fix pipeline with Duo from a merge request's Overview or Pipelines tab to have an agent read pipeline logs and propose inline code suggestions, open a new merge request with a fix, or post next-step comments.
Adds Fix pipeline with Duo for pipelines not tied to a merge request via Build > Pipelines, producing a new merge request with the proposed fix.

+3 more show less

Adds Agentic Chat via GitLab Duo sidebar > Add new chat, letting practitioners query merge requests, issues, and pipeline data in natural language; available in the GitLab UI, VS Code, JetBrains IDEs, and Visual Studio with the Agentic toggle enabled.
Adds an AI Resource Library of ready-made prompts (e.g. Summarize Recent Changes to MR/Issue, Debug Failing Pipeline) for use with Agentic Chat.
Adds AI > Sessions view to follow agent reasoning in real time while Fix CI/CD Pipeline Flow or Agentic Chat runs.

8 details in Everything

Three developer tasks worth handing to an agent (2026-10-19) Oct 19, 2026 · issue 017

GitLab Duo Agent Platform launches Code Review Flow, Fix CI/CD Pipeline Flow, and Agentic Chat for free-tier groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Trigger an automated first-pass code review on an open merge request without leaving the comment box.

$ /assign_reviewer @GitLabDuo

Send a failing pipeline to the agent for diagnosis and a proposed fix when the pipeline is not attached to a merge request.

📍In the GitLab UI: Build › Pipelines › [select failing pipeline] › Fix pipeline with Duo

Activate the Duo Agent Platform flows for your group so Code Review Flow and Fix CI/CD Pipeline Flow are available to all members.

📍Settings › GitLab Duo › Change configuration › Flow execution: enable Allow flow execution and Allow foundational flows › select Code Review and Fix CI/CD Pipeline › Save changes

Enables Allow flow execution and Allow foundational flows under Settings > GitLab Duo > Change configuration > Flow execution to activate the GitLab Duo Agent Platform for a group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Code Review Flow: assign @GitLabDuo as a reviewer or comment /assign_reviewer @GitLabDuo on a merge request to get automated diff, description, and related-file review comments posted inline.
Adds an automatic reviews option for Code Review Flow so every new merge request receives a first-pass review without manual assignment.
Adds Fix CI/CD Pipeline Flow: select Fix pipeline with Duo from a merge request's Overview or Pipelines tab to have an agent read pipeline logs and propose inline code suggestions, open a new merge request with a fix, or post next-step comments.
Adds Fix pipeline with Duo for pipelines not tied to a merge request via Build > Pipelines, producing a new merge request with the proposed fix.

+3 more show less

Adds Agentic Chat via GitLab Duo sidebar > Add new chat, letting practitioners query merge requests, issues, and pipeline data in natural language; available in the GitLab UI, VS Code, JetBrains IDEs, and Visual Studio with the Agentic toggle enabled.
Adds an AI Resource Library of ready-made prompts (e.g. Summarize Recent Changes to MR/Issue, Debug Failing Pipeline) for use with Agentic Chat.
Adds AI > Sessions view to follow agent reasoning in real time while Fix CI/CD Pipeline Flow or Agentic Chat runs.

8 details in Everything

GitLab Secrets Manager: Govern secrets like your code (2026-10-15) Oct 15, 2026 · issue 2026/10

GitLab Secrets Manager (GA, 19.5) scopes build-time secrets per job via the secrets: keyword in .gitlab-ci.yml, encrypts at rest with AES-256-GCM via OpenBao, streams full CRUD audit events with pipeline/job IDs, and inherits group-level secrets through existing project membership.

Declares secrets in .gitlab-ci.yml using the secrets: keyword, injecting values only into jobs that declare them and fall within scope (branch, protected-branch flag, production/* environment wildcards).
Streams every secret create, read, update, and delete event — including pipeline and job IDs — to audit event destinations and the GitLab audit trail.
Writes secret values to a temporary file inside the job and exposes only the file path, limiting exposure in subprocesses, crash dumps, and telemetry.
New integrationEncrypts secrets at rest with AES-256-GCM via OpenBao, keeping plaintext out of the GitLab application layer.
Issues short-lived tokens bound to each job's identity so jobs fetch values directly from OpenBao.

+5 more show less

Prompts users to set a rotation reminder at secret creation time; dynamic (ephemeral) credentials are coming soon.
Includes a secret audit tool for CI/CD variables that flags variables likely to hold credentials, enabling targeted migration.
Projects inherit secrets defined in parent groups, allowing a shared credential to be defined once and accessed via existing project membership.
Adds Secure > Secrets Manager navigation in top-level group settings on GitLab.com, with a 30-day / 500-credit free trial via Start 30-day trial.
New supported platformGenerally available for GitLab Premium and Ultimate on GitLab.com and GitLab Self-Managed (19.5), billed at 1 credit per secret per month and 1 credit per 2,500 reads.

10 details in Everything

New integration External Secrets Operator (Kubernetes) integration
New integration Terraform and OpenTofu data source integration

Unblock agentic software delivery with governed code review (2026-10-15) Oct 15, 2026 · issue 2026/10

GitLab Code Review Flow brings governed agentic code review to every merge request via CI/CD, with automatic reviewer suggestions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Enables automatic Code Review Flow at the project, group, or instance level so every merge request is reviewed without manual assignment, with settings that cascade down the hierarchy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Runs Code Review Flow as a CI/CD job on GitLab-hosted or self-managed runners, integrating agentic review into the same pipeline environment as the rest of delivery.
Supports custom review instructions — covering language conventions, security practices, and path-specific rules — pointing Code Review Flow at a template project so standards travel with the work across a group.
Adds Recommend Reviewers Flow, which suggests the smallest set of human reviewers who can satisfy code-owner and approval rules, factoring in expertise, workload, availability, and timezone.
Supports self-hosted models as the foundation for agentic code review, keeping inference under customer control for air-gapped or regulated environments.

+2 more show less

Adds follow-up review that rechecks prior findings from GitLab Duo Agent Platform, verifies fixes, and carries context forward from the earlier pass.
Works across GitLab.com, GitLab Dedicated, and GitLab Self-Managed deployments at a unit cost of $0.25 per review.

7 details in Everything

Get every merge request in front of the right reviewer, faster (2026-10-15) Oct 15, 2026 · issue 2026/10

GitLab 19.5 adds Recommend Reviewers Flow to automatically suggest the best reviewer by workload, time zone, and expertise at merge request creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Triggers reviewer suggestions automatically when a merge request is created, whether in draft or ready state, surfacing recommendations in a dedicated panel with one-click assignment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Explains the reasoning behind each reviewer recommendation so authors can approve or override suggestions with full context.
Adds Security Review Flow to check merge request changes for business logic vulnerabilities before they merge.
Adds Fix CI/CD Pipeline Flow to diagnose and repair failed CI/CD jobs directly from the merge request.
Supports Custom Flows to compose Recommend Reviewers Flow alongside other agentic workflows your team already runs.

5 details in Everything

Connect your agents to your software lifecycle with the GitLab MCP server (2026-10-15) Oct 15, 2026 · issue 2026/10

GitLab MCP server is now GA in 19.5, adding tools for branches, semantic code search, pipeline inspection, artifact access, group browsing, wiki lookup, and full Duo Agent Platform session control — all enforced under existing GitLab permissions.

New integrationNew supported platformAdds add_branch tool to the GitLab MCP server to start a feature branch from an agent.
Adds get_repository_file tool to read a file at any ref without extra API calls.
Adds semantic_search tool to find code by meaning, answering 'where is this implemented?' without knowing the file or symbol name.
Adds get_pipeline tool that returns a pipeline's status, jobs, downstream pipelines, and artifacts on request.
Adds list_pipelines tool to surface patterns across recent pipeline runs.

+9 more show less

Adds get_artifact_file tool to read a single file from a job's artifacts (log, report, or test fixture) without downloading the whole archive.
Adds list_groups tool so agents can browse the group hierarchy to find the right group instead of guessing at identifiers.
Adds list_wiki_pages as an opt-in tool to surface runbooks and docs before an agent answers a how-to question.
Adds list_duo_agents_and_flows tool so an agent can discover the Duo Agent Platform flows available in a project.
Adds start_duo_session tool to start a GitLab Duo Agent Platform flow from plain-language goals without leaving the MCP client.
Adds get_duo_session and list_duo_sessions tools to check the progress of running Duo Agent Platform sessions.
Adds send_duo_session_input tool to approve, reject, or answer an agent's proposed action mid-session, keeping humans in the loop.
Introduces toolsets so teams can configure which groups of tools the MCP server returns, with code security and wikis available as opt-in groups and most groups on by default.
Consolidates get_merge_request to return commits, diffs, pipelines, conflicts, or notes in a single call, and folds get_pipeline_jobs into get_pipeline.

14 details in Everything

Connect your agents to your software lifecycle with the GitLab MCP server (2026-10-15) Oct 15, 2026 · issue 110

GitLab MCP server is now GA in 19.5, adding tools for branches, semantic code search, pipeline inspection, artifact access, group browsing, wiki lookup, and full Duo Agent Platform session control — all enforced under existing GitLab permissions.

New integrationNew supported platformAdds add_branch tool to the GitLab MCP server to start a feature branch from an agent.
Adds get_repository_file tool to read a file at any ref without extra API calls.
Adds semantic_search tool to find code by meaning, answering 'where is this implemented?' without knowing the file or symbol name.
Adds get_pipeline tool that returns a pipeline's status, jobs, downstream pipelines, and artifacts on request.
Adds list_pipelines tool to surface patterns across recent pipeline runs.

+9 more show less

Adds get_artifact_file tool to read a single file from a job's artifacts (log, report, or test fixture) without downloading the whole archive.
Adds list_groups tool so agents can browse the group hierarchy to find the right group instead of guessing at identifiers.
Adds list_wiki_pages as an opt-in tool to surface runbooks and docs before an agent answers a how-to question.
Adds list_duo_agents_and_flows tool so an agent can discover the Duo Agent Platform flows available in a project.
Adds start_duo_session tool to start a GitLab Duo Agent Platform flow from plain-language goals without leaving the MCP client.
Adds get_duo_session and list_duo_sessions tools to check the progress of running Duo Agent Platform sessions.
Adds send_duo_session_input tool to approve, reject, or answer an agent's proposed action mid-session, keeping humans in the loop.
Introduces toolsets so teams can configure which groups of tools the MCP server returns, with code security and wikis available as opt-in groups and most groups on by default.
Consolidates get_merge_request to return commits, diffs, pipelines, conflicts, or notes in a single call, and folds get_pipeline_jobs into get_pipeline.

14 details in Everything

Get every merge request in front of the right reviewer, faster (2026-10-15) Oct 15, 2026 · issue 110

GitLab 19.5 adds Recommend Reviewers Flow to automatically suggest the best reviewer by workload, time zone, and expertise at merge request creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Triggers reviewer suggestions automatically when a merge request is created, whether in draft or ready state, surfacing recommendations in a dedicated panel with one-click assignment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Explains the reasoning behind each reviewer recommendation so authors can approve or override suggestions with full context.
Adds Security Review Flow to check merge request changes for business logic vulnerabilities before they merge.
Adds Fix CI/CD Pipeline Flow to diagnose and repair failed CI/CD jobs directly from the merge request.
Supports Custom Flows to compose Recommend Reviewers Flow alongside other agentic workflows your team already runs.

5 details in Everything

GitLab Secrets Manager: Govern secrets like your code (2026-10-15) Oct 15, 2026 · issue 110

GitLab Secrets Manager (GA, 19.5) scopes build-time secrets per job via the secrets: keyword in .gitlab-ci.yml, encrypts at rest with AES-256-GCM via OpenBao, streams full CRUD audit events with pipeline/job IDs, and inherits group-level secrets through existing project membership.

Declares secrets in .gitlab-ci.yml using the secrets: keyword, injecting values only into jobs that declare them and fall within scope (branch, protected-branch flag, production/* environment wildcards).
Streams every secret create, read, update, and delete event — including pipeline and job IDs — to audit event destinations and the GitLab audit trail.
Writes secret values to a temporary file inside the job and exposes only the file path, limiting exposure in subprocesses, crash dumps, and telemetry.
New integrationEncrypts secrets at rest with AES-256-GCM via OpenBao, keeping plaintext out of the GitLab application layer.
Issues short-lived tokens bound to each job's identity so jobs fetch values directly from OpenBao.

+5 more show less

Prompts users to set a rotation reminder at secret creation time; dynamic (ephemeral) credentials are coming soon.
Includes a secret audit tool for CI/CD variables that flags variables likely to hold credentials, enabling targeted migration.
Projects inherit secrets defined in parent groups, allowing a shared credential to be defined once and accessed via existing project membership.
Adds Secure > Secrets Manager navigation in top-level group settings on GitLab.com, with a 30-day / 500-credit free trial via Start 30-day trial.
New supported platformGenerally available for GitLab Premium and Ultimate on GitLab.com and GitLab Self-Managed (19.5), billed at 1 credit per secret per month and 1 credit per 2,500 reads.

10 details in Everything

New integration External Secrets Operator (Kubernetes) integration
New integration Terraform and OpenTofu data source integration

Unblock agentic software delivery with governed code review (2026-10-15) Oct 15, 2026 · issue 110

GitLab Code Review Flow brings governed agentic code review to every merge request via CI/CD, with automatic reviewer suggestions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Enables automatic Code Review Flow at the project, group, or instance level so every merge request is reviewed without manual assignment, with settings that cascade down the hierarchy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Runs Code Review Flow as a CI/CD job on GitLab-hosted or self-managed runners, integrating agentic review into the same pipeline environment as the rest of delivery.
Supports custom review instructions — covering language conventions, security practices, and path-specific rules — pointing Code Review Flow at a template project so standards travel with the work across a group.
Adds Recommend Reviewers Flow, which suggests the smallest set of human reviewers who can satisfy code-owner and approval rules, factoring in expertise, workload, availability, and timezone.
Supports self-hosted models as the foundation for agentic code review, keeping inference under customer control for air-gapped or regulated environments.

+2 more show less

Adds follow-up review that rechecks prior findings from GitLab Duo Agent Platform, verifies fixes, and carries context forward from the earlier pass.
Works across GitLab.com, GitLab Dedicated, and GitLab Self-Managed deployments at a unit cost of $0.25 per review.

7 details in Everything

GitLab Secrets Manager: Govern secrets like your code (2026-10-15) Oct 15, 2026 · issue 017

GitLab Secrets Manager (GA, 19.5) scopes build-time secrets per job via the secrets: keyword in .gitlab-ci.yml, encrypts at rest with AES-256-GCM via OpenBao, streams full CRUD audit events with pipeline/job IDs, and inherits group-level secrets through existing project membership.

Declares secrets in .gitlab-ci.yml using the secrets: keyword, injecting values only into jobs that declare them and fall within scope (branch, protected-branch flag, production/* environment wildcards).
Streams every secret create, read, update, and delete event — including pipeline and job IDs — to audit event destinations and the GitLab audit trail.
Writes secret values to a temporary file inside the job and exposes only the file path, limiting exposure in subprocesses, crash dumps, and telemetry.
New integrationEncrypts secrets at rest with AES-256-GCM via OpenBao, keeping plaintext out of the GitLab application layer.
Issues short-lived tokens bound to each job's identity so jobs fetch values directly from OpenBao.

+5 more show less

Prompts users to set a rotation reminder at secret creation time; dynamic (ephemeral) credentials are coming soon.
Includes a secret audit tool for CI/CD variables that flags variables likely to hold credentials, enabling targeted migration.
Projects inherit secrets defined in parent groups, allowing a shared credential to be defined once and accessed via existing project membership.
Adds Secure > Secrets Manager navigation in top-level group settings on GitLab.com, with a 30-day / 500-credit free trial via Start 30-day trial.
New supported platformGenerally available for GitLab Premium and Ultimate on GitLab.com and GitLab Self-Managed (19.5), billed at 1 credit per secret per month and 1 credit per 2,500 reads.

10 details in Everything

New integration External Secrets Operator (Kubernetes) integration
New integration Terraform and OpenTofu data source integration

Unblock agentic software delivery with governed code review (2026-10-15) Oct 15, 2026 · issue 017

GitLab Code Review Flow brings governed agentic code review to every merge request via CI/CD, with automatic reviewer suggestions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Enables automatic Code Review Flow at the project, group, or instance level so every merge request is reviewed without manual assignment, with settings that cascade down the hierarchy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Runs Code Review Flow as a CI/CD job on GitLab-hosted or self-managed runners, integrating agentic review into the same pipeline environment as the rest of delivery.
Supports custom review instructions — covering language conventions, security practices, and path-specific rules — pointing Code Review Flow at a template project so standards travel with the work across a group.
Adds Recommend Reviewers Flow, which suggests the smallest set of human reviewers who can satisfy code-owner and approval rules, factoring in expertise, workload, availability, and timezone.
Supports self-hosted models as the foundation for agentic code review, keeping inference under customer control for air-gapped or regulated environments.

+2 more show less

Adds follow-up review that rechecks prior findings from GitLab Duo Agent Platform, verifies fixes, and carries context forward from the earlier pass.
Works across GitLab.com, GitLab Dedicated, and GitLab Self-Managed deployments at a unit cost of $0.25 per review.

7 details in Everything

Get every merge request in front of the right reviewer, faster (2026-10-15) Oct 15, 2026 · issue 017

GitLab 19.5 adds Recommend Reviewers Flow to automatically suggest the best reviewer by workload, time zone, and expertise at merge request creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Triggers reviewer suggestions automatically when a merge request is created, whether in draft or ready state, surfacing recommendations in a dedicated panel with one-click assignment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Explains the reasoning behind each reviewer recommendation so authors can approve or override suggestions with full context.
Adds Security Review Flow to check merge request changes for business logic vulnerabilities before they merge.
Adds Fix CI/CD Pipeline Flow to diagnose and repair failed CI/CD jobs directly from the merge request.
Supports Custom Flows to compose Recommend Reviewers Flow alongside other agentic workflows your team already runs.

5 details in Everything

Connect your agents to your software lifecycle with the GitLab MCP server (2026-10-15) Oct 15, 2026 · issue 017

GitLab MCP server is now GA in 19.5, adding tools for branches, semantic code search, pipeline inspection, artifact access, group browsing, wiki lookup, and full Duo Agent Platform session control — all enforced under existing GitLab permissions.

New integrationNew supported platformAdds add_branch tool to the GitLab MCP server to start a feature branch from an agent.
Adds get_repository_file tool to read a file at any ref without extra API calls.
Adds semantic_search tool to find code by meaning, answering 'where is this implemented?' without knowing the file or symbol name.
Adds get_pipeline tool that returns a pipeline's status, jobs, downstream pipelines, and artifacts on request.
Adds list_pipelines tool to surface patterns across recent pipeline runs.

+9 more show less

Adds get_artifact_file tool to read a single file from a job's artifacts (log, report, or test fixture) without downloading the whole archive.
Adds list_groups tool so agents can browse the group hierarchy to find the right group instead of guessing at identifiers.
Adds list_wiki_pages as an opt-in tool to surface runbooks and docs before an agent answers a how-to question.
Adds list_duo_agents_and_flows tool so an agent can discover the Duo Agent Platform flows available in a project.
Adds start_duo_session tool to start a GitLab Duo Agent Platform flow from plain-language goals without leaving the MCP client.
Adds get_duo_session and list_duo_sessions tools to check the progress of running Duo Agent Platform sessions.
Adds send_duo_session_input tool to approve, reject, or answer an agent's proposed action mid-session, keeping humans in the loop.
Introduces toolsets so teams can configure which groups of tools the MCP server returns, with code security and wikis available as opt-in groups and most groups on by default.
Consolidates get_merge_request to return commits, diffs, pipelines, conflicts, or notes in a single call, and folds get_pipeline_jobs into get_pipeline.

14 details in Everything

docs update Oct 14, 2026 · issue 108

GitLab 19.4 adds MCP server governance, Slack integration, /goal CLI command, and broad MCP tooling for CI/CD, MRs, repos, and work items.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Delegate an open-ended coding task to GitLab Duo CLI without writing step-by-step instructions — the agent implements and verifies the result autonomously.

$ /goal Fix the failing tests in spec/models/user_spec.rb

Enable the GitLab flow builder beta in VS Code so you can visually compose, test, and publish custom AI-native flows to the AI Catalog.

.vscode/settings.json

{
  "gitlab.featureFlags.flowBuilder": true
}

Configure a merge-request-created trigger so your flow runs a first-pass review the moment a contributor opens a new MR.

📍In your project, go to AI › Triggers, click Add trigger, choose event type Merge request, and select the Created action. Attach your flow or external agent, then save.

Adds /goal <task> slash command to GitLab Duo CLI (requires GitLab 19.3+ and GitLab Duo CLI 9.17.0+) to delegate open-ended objectives to a governed, goal-driven local flow with pause, update, and redirect controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds new MCP server tools across several areas: save_pipeline and get_job for CI/CD (trigger, retry, cancel pipelines and retrieve job metadata with trace logs); save_merge_request, get_merge_request, save_merge_request_review, and accept_merge_request for the full merge request loop (diff/conflict/approval inspection and line-level review comments); list_projects and get_user for project discovery and user lookup for assignment and mentions; list_repository_tree, list_tags, list_releases, get_commit, list_commits, add_commit, and fork_repository for browsing repositories, reading history, and proposing changes; and get_work_item, list_work_items, save_work_item, and save_note for issues, epics, tasks, incidents, objectives, and key results, including commenting and replying in discussion threads.
Renames semantic_code_search MCP tool to semantic_search and adds a scope parameter (currently accepts code only) for future content-type expansion.
Enables governance of GitLab MCP server tools from the same group and project GitLab Duo settings as internal Duo Agent Platform tools, with per-tool modes (Always Allow / Always Ask) for read-only vs write/delete tools.
Adds beta MCP server access restriction controls to allow or deny access to entire external MCP servers or individual tools, enforced across Agentic Chat, Flows, and IDE/CLI environments.

+5 more show less

Introduces the Vulnerability Context Flow (Ultimate) that produces authentication, authorization, and sensitive-data context to assist in vulnerability triage.
Extends Advanced SAST to scan Kotlin (Android APIs), Dart (Flutter/Dio framework), and Scala (Play, Slick, Akka) with deep taint analysis and source-to-sink code flows.
Adds SPDX compound license expression support (e.g. MIT OR Apache-2.0, GPL-2.0-only WITH Classpath-exception-2.0) to dependency and license scanning, making composite licenses visible in the dependency list and actionable in license approval policies.
Adds GitLab Duo Slack integration (Experimental) allowing @GitLab mentions in any Slack channel or thread to trigger agent flows, query the codebase, and create GitLab issues from conversations with real-time streamed responses.
Adds GitLab flow builder (Beta) visual editor in GitLab for VS Code 6.87.0+, enabled via the gitlab.featureFlags.flowBuilder VS Code setting, for composing, testing, and publishing custom AI-native flows to the AI Catalog.

Adds /goal <task> slash command to GitLab Duo CLI (requires GitLab 19.3+ and GitLab Duo CLI 9.17.0+) to delegate open-ended objectives to a governed, goal-driven local flow with pause, update, and redirect controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds new MCP server tools across several areas: save_pipeline and get_job for CI/CD (trigger, retry, cancel pipelines and retrieve job metadata with trace logs); save_merge_request, get_merge_request, save_merge_request_review, and accept_merge_request for the full merge request loop (diff/conflict/approval inspection and line-level review comments); list_projects and get_user for project discovery and user lookup for assignment and mentions; list_repository_tree, list_tags, list_releases, get_commit, list_commits, add_commit, and fork_repository for browsing repositories, reading history, and proposing changes; and get_work_item, list_work_items, save_work_item, and save_note for issues, epics, tasks, incidents, objectives, and key results, including commenting and replying in discussion threads.
Adds beta MCP server access restriction controls to allow or deny access to entire external MCP servers or individual tools, enforced across Agentic Chat, Flows, and IDE/CLI environments.
Introduces the Vulnerability Context Flow (Ultimate) that produces authentication, authorization, and sensitive-data context to assist in vulnerability triage.
Adds GitLab Duo Slack integration (Experimental) allowing @GitLab mentions in any Slack channel or thread to trigger agent flows, query the codebase, and create GitLab issues from conversations with real-time streamed responses.

+1 more show less

Adds GitLab flow builder (Beta) visual editor in GitLab for VS Code 6.87.0+, enabled via the gitlab.featureFlags.flowBuilder VS Code setting, for composing, testing, and publishing custom AI-native flows to the AI Catalog.

4 more in Everything

└──▷ BREAKING ON UPGRADE

!The semantic_code_search MCP tool is renamed to semantic_search; any MCP client or agent referencing the old tool name must be updated.

Gemini 4 Argon on GitLab: Built for long-running agentic work (2026-10-14) Oct 14, 2026 · issue 109

Gemini 4 Argon joins GitLab Duo Agent Platform for long-horizon agentic tasks, selectable today via model selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Switch a Duo Agent Platform workflow to Gemini 4 Argon when a task is complex and multi-step — such as an open-ended refactor — where finishing correctly matters more than finishing fast.

📍In GitLab Duo Agent Platform, open model selection and choose Gemini 4 Argon before delegating your agentic task.

Adds Gemini 4 Argon as a selectable model on GitLab Duo Agent Platform, optimized for long-running, multi-step agentic tasks across the software lifecycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables model selection between Gemini 4 Argon and Flash models on GitLab Duo Agent Platform, letting teams match each workload to cost and performance needs.
Agent output from Argon-powered runs lands in a merge request for team review with full change context.
Argon is available at promotional pricing of 2.86 calls per credit through November 30, 2026, reverting to standard pricing of 1.33 calls per credit on December 1.

Adds Gemini 4 Argon as a selectable model on GitLab Duo Agent Platform, optimized for long-running, multi-step agentic tasks across the software lifecycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Argon is available at promotional pricing of 2.86 calls per credit through November 30, 2026, reverting to standard pricing of 1.33 calls per credit on December 1.

2 more in Everything

GitLab's agent orchestration eliminates the wait between development stages (2026-10-13) Oct 13, 2026 · issue 108

GitLab adds goal-driven flows, Custom Flows, and Slack-triggered agent orchestration to Duo Agent Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Start a goal-driven flow from the CLI to fix a bug and keep working until CI is green — no manual handoffs between steps.

$ duo run --goal "Fix the checkout timeout. Continue until tests pass and CI is green."

Trigger a GitLab flow to fix a failing pipeline without leaving the Slack thread where the incident was reported.

📍@GitLab fix the failing pipeline on the checkout service

Adds /goal slash command in Duo CLI and duo run --goal in headless mode to start goal-driven flows that run review, tests, security scans, and approvals as one connected sequence until a defined objective is met.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds @GitLab mention support in Slack channels and threads via GitLab for Slack, letting teams trigger flows (e.g. fix a failing pipeline, create an issue) directly from a conversation.
Adds Custom Flows to chain agents into multi-step sequences triggered by GitLab events (mention, assignment, or pipeline) and run them in CI/CD pipelines, including human-in-the-loop checkpoints.

3 details in Everything

Make every AI credit count: See, cap, and reduce agent spend (2026-10-13) Oct 13, 2026 · issue 108

GitLab adds open-weight model hosting, Orbit context graph, Impact Analytics, and per-user credit caps to Duo Agent Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Pin a cheaper open-weight model to a high-frequency routine workload to avoid defaulting every agent run to an expensive frontier model.

📍In your top-level group, go to Settings › GitLab Duo › Model Selection › Manage Models, then pin Kimi K3 to Agentic Chat and MiniMax M3 to agents and flows.

Cap per-user credit spend to prevent runaway agent loops, while giving power users room to experiment without a full escalation.

📍In your top-level group credit and usage controls, set a flat cap of 1,000 credits per user per month, then apply a 500-credit individual override for engineers running experimental agent sessions.

Adds Model Selection > Manage Models admin setting in top-level group GitLab Duo settings to pin a specific model (e.g., GLM 5.3, Kimi K3, MiniMax M3) to each Duo feature, controlling which models team members can use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces three GitLab-managed open-weight models — GLM 5.3, Kimi K3, and MiniMax M3 — hosted in Duo Agent Platform as lower-cost alternatives to frontier models.
Introduces GitLab Orbit, a lifecycle context graph mapping code, work items, merge requests, pipelines, deployments, and security findings into a single queryable graph to reduce agent retries and token consumption.
External agents (e.g., Claude Code, Codex) can connect to GitLab Orbit through Model Context Protocol (MCP); custom tooling connects through the REST API.
Introduces Duo Agent Platform Impact Analytics, showing credit consumption broken down by team, task, and model for a chosen date range, with open-weight vs. frontier model cost comparison.

+2 more show less

Introduces the GitLab Credits dashboard, tracing credit usage to the individual user and session level below the team level.
Adds credit and usage controls supporting caps at the subscription, group, or user level, with alerts at 50%, 80%, and 100% of spend and automatic pause at the cap; supports per-user flat caps (e.g., 1,000 credits/user/month) and individual overrides (e.g., 500 additional credits).

7 details in Everything

Scaling Git for the agentic software factory (2026-10-13) Oct 13, 2026 · issue 108

GitLab next-gen SCM (private beta) delivers agent-native Git interfaces with up to 50x faster workloads and 1,000x less network traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Introduces next-gen SCM architecture with agent-native interfaces that let agents request specific files and history without cloning entire repositories, reducing per-invocation data transfer from 5–10 GB to a fraction of that.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Delivers stateless compute scaling horizontally against shared object storage, supporting thousands of concurrent agents working against large monorepos.
Supports deployment on GitLab.com and on S3-compatible storage in customer-controlled infrastructure, including air-gapped data centers, preserving data sovereignty.
Enables isolated agent sessions where unsuccessful experiments can be discarded without disrupting shared code, with successful changes flowing into existing merge requests, pipelines, security checks, and governance controls.
Introduces GitLab Orbit, a context graph of the entire software lifecycle, currently in development.

+2 more show less

Advances GitLab Duo Agent Platform to orchestrate agent work across software development lifecycle stages.
Adds attribution and authorization of agent actions, preservation of instructions and decisions behind code changes, and reviewer context to focus human judgment.

Introduces next-gen SCM architecture with agent-native interfaces that let agents request specific files and history without cloning entire repositories, reducing per-invocation data transfer from 5–10 GB to a fraction of that.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Delivers stateless compute scaling horizontally against shared object storage, supporting thousands of concurrent agents working against large monorepos.
Supports deployment on GitLab.com and on S3-compatible storage in customer-controlled infrastructure, including air-gapped data centers, preserving data sovereignty.
Enables isolated agent sessions where unsuccessful experiments can be discarded without disrupting shared code, with successful changes flowing into existing merge requests, pipelines, security checks, and governance controls.
Introduces GitLab Orbit, a context graph of the entire software lifecycle, currently in development.

+1 more show less

Adds attribution and authorization of agent actions, preservation of instructions and decisions behind code changes, and reviewer context to focus human judgment.

1 more in Everything

Dependency Firewall: Block risky packages before the build (2026-10-06) Oct 6, 2026 · issue 2026/10

GitLab Dependency Firewall (early access) blocks malicious, vulnerable, and non-compliant packages before they enter a build.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds warn and block enforcement modes to Dependency Firewall: warn logs every policy match as an audit event and CI summary line without stopping the build; block halts the pipeline and records the reason.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds policy dimensions for malicious status (GitLab malware advisory database), vulnerability severity (critical, high, medium, low) with a configurable finding count, license type (allow/deny by full name, plus handling for undetermined licenses), and package age (minimum age before a version may enter a build).
Adds a logged bypass mechanism that lets a designated user or token push an approved package through Dependency Firewall on the record.
Adds a GitLab CLI command to check whether a package will pass or be blocked by policy before adding the dependency, covering npm, pip, Poetry, Maven, Gradle, and Bundler.
Adds a Dependency Firewall dashboard showing allow, warn, and block activity and outcomes across all projects in scope, with an immutable audit event per decision.

+3 more show less

Stores Dependency Firewall rules as code in a security policy project, reviewed and merged like any configuration change, with inheritance from top-level group down to each project and strictest-rule precedence on overlap.
Supports GitLab Artifact Central and external registries from Sonatype Nexus Repository and JFrog Artifactory without requiring a separate tool deployment.
New GitLab Dependency Firewall capability is available in early access for GitLab.com and GitLab Self-Managed customers on Premium or Ultimate tiers.

8 details in Everything

Every artifact your teams ship, assembled right the first time (2026-10-06) Oct 6, 2026 · issue 2026/10

GitLab Artifact Central launches in beta: one org-level registry for Maven, npm, Docker, and OCI with built-in build provenance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Add an existing external registry as a Remote repository behind a Virtual repo to start a gradual, zero-downtime migration without bulk-copying data.

📍In Artifact Central, go to your organization › Artifact Central › Repositories › New Repository, select Remote, enter your existing registry URL, then create a Virtual repository that includes the new remote. Update your pipeline to point at the virtual repository URL.

Introduces CI_JOB_TOKEN as the authentication mechanism for publishing and pulling artifacts through Artifact Central, eliminating the need for separate service accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces GitLab Artifact Central, an organization-level registry replacing per-project package and container registries, with centralized retention rules, storage quotas, and access policies.
Supports three repository types — Hosted (private packages your teams publish), Remote (proxy with caching for external sources like Docker Hub or Maven Central), and Virtual (single endpoint combining hosted and remote, with automatic fallback and cache).
Introduces four dedicated artifact roles — Admin, Manager, Contributor, and Viewer — kept separate from existing GitLab project roles so artifact access never affects project privileges.
Supports Maven, npm, Docker, and OCI artifact formats during the beta period.

+2 more show less

Automatically attaches build provenance (pipeline, branch, commit, triggering user) to every artifact published through Artifact Central.
Enables gradual, zero-bulk-copy migration by adding existing registries as remote repositories behind a virtual repo, converting to hosted when ready.

7 details in Everything

Dependency Firewall: Block risky packages before the build (2026-10-06) Oct 6, 2026 · issue 096

GitLab Dependency Firewall (early access) blocks malicious, vulnerable, and non-compliant packages before they enter a build.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds warn and block enforcement modes to Dependency Firewall: warn logs every policy match as an audit event and CI summary line without stopping the build; block halts the pipeline and records the reason.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds policy dimensions for malicious status (GitLab malware advisory database), vulnerability severity (critical, high, medium, low) with a configurable finding count, license type (allow/deny by full name, plus handling for undetermined licenses), and package age (minimum age before a version may enter a build).
Adds a logged bypass mechanism that lets a designated user or token push an approved package through Dependency Firewall on the record.
Adds a GitLab CLI command to check whether a package will pass or be blocked by policy before adding the dependency, covering npm, pip, Poetry, Maven, Gradle, and Bundler.
Adds a Dependency Firewall dashboard showing allow, warn, and block activity and outcomes across all projects in scope, with an immutable audit event per decision.

+3 more show less

Stores Dependency Firewall rules as code in a security policy project, reviewed and merged like any configuration change, with inheritance from top-level group down to each project and strictest-rule precedence on overlap.
Supports GitLab Artifact Central and external registries from Sonatype Nexus Repository and JFrog Artifactory without requiring a separate tool deployment.
New GitLab Dependency Firewall capability is available in early access for GitLab.com and GitLab Self-Managed customers on Premium or Ultimate tiers.

8 details in Everything

Every artifact your teams ship, assembled right the first time (2026-10-06) Oct 6, 2026 · issue 096

GitLab Artifact Central launches in beta: one org-level registry for Maven, npm, Docker, and OCI with built-in build provenance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Add an existing external registry as a Remote repository behind a Virtual repo to start a gradual, zero-downtime migration without bulk-copying data.

📍In Artifact Central, go to your organization › Artifact Central › Repositories › New Repository, select Remote, enter your existing registry URL, then create a Virtual repository that includes the new remote. Update your pipeline to point at the virtual repository URL.

Introduces CI_JOB_TOKEN as the authentication mechanism for publishing and pulling artifacts through Artifact Central, eliminating the need for separate service accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces GitLab Artifact Central, an organization-level registry replacing per-project package and container registries, with centralized retention rules, storage quotas, and access policies.
Supports three repository types — Hosted (private packages your teams publish), Remote (proxy with caching for external sources like Docker Hub or Maven Central), and Virtual (single endpoint combining hosted and remote, with automatic fallback and cache).
Introduces four dedicated artifact roles — Admin, Manager, Contributor, and Viewer — kept separate from existing GitLab project roles so artifact access never affects project privileges.
Supports Maven, npm, Docker, and OCI artifact formats during the beta period.

+2 more show less

Automatically attaches build provenance (pipeline, branch, commit, triggering user) to every artifact published through Artifact Central.
Enables gradual, zero-bulk-copy migration by adding existing registries as remote repositories behind a virtual repo, converting to hosted when ready.

7 details in Everything

Dependency Firewall: Block risky packages before the build (2026-10-06) Oct 6, 2026 · issue 015

GitLab Dependency Firewall (early access) blocks malicious, vulnerable, and non-compliant packages before they enter a build.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds warn and block enforcement modes to Dependency Firewall: warn logs every policy match as an audit event and CI summary line without stopping the build; block halts the pipeline and records the reason.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds policy dimensions for malicious status (GitLab malware advisory database), vulnerability severity (critical, high, medium, low) with a configurable finding count, license type (allow/deny by full name, plus handling for undetermined licenses), and package age (minimum age before a version may enter a build).
Adds a logged bypass mechanism that lets a designated user or token push an approved package through Dependency Firewall on the record.
Adds a GitLab CLI command to check whether a package will pass or be blocked by policy before adding the dependency, covering npm, pip, Poetry, Maven, Gradle, and Bundler.
Adds a Dependency Firewall dashboard showing allow, warn, and block activity and outcomes across all projects in scope, with an immutable audit event per decision.

+3 more show less

Stores Dependency Firewall rules as code in a security policy project, reviewed and merged like any configuration change, with inheritance from top-level group down to each project and strictest-rule precedence on overlap.
Supports GitLab Artifact Central and external registries from Sonatype Nexus Repository and JFrog Artifactory without requiring a separate tool deployment.
New GitLab Dependency Firewall capability is available in early access for GitLab.com and GitLab Self-Managed customers on Premium or Ultimate tiers.

8 details in Everything

Every artifact your teams ship, assembled right the first time (2026-10-06) Oct 6, 2026 · issue 015

GitLab Artifact Central launches in beta: one org-level registry for Maven, npm, Docker, and OCI with built-in build provenance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Add an existing external registry as a Remote repository behind a Virtual repo to start a gradual, zero-downtime migration without bulk-copying data.

📍In Artifact Central, go to your organization › Artifact Central › Repositories › New Repository, select Remote, enter your existing registry URL, then create a Virtual repository that includes the new remote. Update your pipeline to point at the virtual repository URL.

Introduces CI_JOB_TOKEN as the authentication mechanism for publishing and pulling artifacts through Artifact Central, eliminating the need for separate service accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces GitLab Artifact Central, an organization-level registry replacing per-project package and container registries, with centralized retention rules, storage quotas, and access policies.
Supports three repository types — Hosted (private packages your teams publish), Remote (proxy with caching for external sources like Docker Hub or Maven Central), and Virtual (single endpoint combining hosted and remote, with automatic fallback and cache).
Introduces four dedicated artifact roles — Admin, Manager, Contributor, and Viewer — kept separate from existing GitLab project roles so artifact access never affects project privileges.
Supports Maven, npm, Docker, and OCI artifact formats during the beta period.

+2 more show less

Automatically attaches build provenance (pipeline, branch, commit, triggering user) to every artifact published through Artifact Central.
Enables gradual, zero-bulk-copy migration by adding existing registries as remote repositories behind a virtual repo, converting to hosted when ready.

7 details in Everything

docs update Oct 3, 2026 · issue 093

GitLab CI cache key files limit raised to 10 entries in GitLab 19.5⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Raises the cache:key:files array limit from its previous cap to 10 file paths or glob patterns, controlled by the increase_ci_cache_key_files_limit feature flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

docs update Sep 30, 2026 · issue 090

GitLab personal access token creation URLs now support prefilled name, description, and scope parameters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

GitLab and Claude Code: Fast, compliant AI (2026-09-29) Sep 29, 2026 · issue 090

GitLab Duo Agent Platform now supports AI Gateway deployment inside single-tenant Government Dedicated environments, with Amazon Bedrock connectivity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Enables GitLab Duo Agent Platform Self-Hosted deployment on agency-controlled infrastructure, supporting air-gapped networks, data residency mandates, and policies barring code transmission to third-party APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
GitLab Dedicated for Government customers can deploy the AI Gateway for Duo Agent Platform inside their own single-tenant environment and connect the model provider of their choice, including Amazon Bedrock, with inference staying in the chosen region under existing SLA, encryption, and change-control policies.
Supports running AI models on GPU-enabled virtual machines in a private cloud for self-managed inference without dedicated hardware costs.
Provides a governed merge request gate that enforces review, scans, and approvals on every change regardless of which AI model or coding tool generated it.
Allows agencies to authorize, restrict, or swap the AI model used for code generation without rebuilding the surrounding governed workflow.

Enables GitLab Duo Agent Platform Self-Hosted deployment on agency-controlled infrastructure, supporting air-gapped networks, data residency mandates, and policies barring code transmission to third-party APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
GitLab Dedicated for Government customers can deploy the AI Gateway for Duo Agent Platform inside their own single-tenant environment and connect the model provider of their choice, including Amazon Bedrock, with inference staying in the chosen region under existing SLA, encryption, and change-control policies.
Supports running AI models on GPU-enabled virtual machines in a private cloud for self-managed inference without dedicated hardware costs.
Provides a governed merge request gate that enforces review, scans, and approvals on every change regardless of which AI model or coding tool generated it.

1 more in Everything

What's new in Git 2.56.0? (2026-09-28) Sep 28, 2026 · issue 089

Git 2.56 adds git history drop, git branch --delete-merged, git refs create/update/rename/delete, git repack --drop-filtered, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Drop a specific commit from history and automatically rebase its descendants — no interactive rebase editor needed.

$ git history drop <commit>

Clean up all local feature branches that have already been merged into origin/main, including branches forked from it rather than merged locally.

$ git branch --delete-merged origin

Recover disk space in a blobless partial clone by evicting large cached blobs so Git re-fetches them lazily only when needed.

$ git repack -a -d --filter=blob:limit=1k --drop-filtered

Adds drop subcommand to git-history(1) to remove a commit and rebase its descendants in a single command: git history drop <commit>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --delete-merged flag to git-branch(1) to delete all local branches whose tips are reachable from their configured upstream, removing merged feature branches in one step.
Adds --forked flag to git-branch(1) as a listing filter to show branches whose configured upstream matches a provided ref, remote name, or branch.
Adds create, update, rename, and delete subcommands to git-refs(1), with update and delete accepting an optional expected old value for validation.
Adds remote-object-info command to git-cat-file(1)'s --batch-command mode to fetch object metadata (size, type) over Git protocol v2 without transferring the full object.

+3 more show less

Adds --drop-filtered option to git-repack(1) to remove locally cached promisor blobs above the given filter threshold, recovering disk space in partial clones.
Extends git repo info subcommand with path.gitdir and path.commondir fields, each available in both absolute and relative forms.
Adds --linearize flag to git-replay(1) to enable rebasing commit ranges that contain merge commits by flattening the history.

Adds drop subcommand to git-history(1) to remove a commit and rebase its descendants in a single command: git history drop <commit>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds remote-object-info command to git-cat-file(1)'s --batch-command mode to fetch object metadata (size, type) over Git protocol v2 without transferring the full object.
Adds --drop-filtered option to git-repack(1) to remove locally cached promisor blobs above the given filter threshold, recovering disk space in partial clones.

5 more in Everything

docs update Sep 26, 2026 · issue 086

GitLab: Adds retry:when reason for jobs stuck in pending state despite matching runners being available, enabling targeted retry on scheduling delays.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Pin an included config file to a specific branch without risk of resolving to a same-named tag.

.gitlab-ci.yml

include:
  - project: my-group/my-config
    ref: refs/heads/main
    file: /templates/base.yml

Adds retry:when reason for jobs stuck in pending state because no runners match the job's requirements (tags, protected status, etc.).
Adds retry:when reason for jobs in running state with no activity for an extended period (hung script or lost runner connectivity).
Adds retry:when reason for jobs stuck in canceling state with no activity for an extended period.
Adds retry:when reason for running jobs that exceed maximum execution time and are dropped by server-side timeout enforcement.
Adds retry:when reason for canceling jobs that exceed maximum execution time and are dropped during cancellation.

+1 more show less

Supports fully qualified refs (refs/heads/<branch>, refs/tags/<tag>) in include: to avoid ambiguous lookups when a branch and tag share the same short name.

6 more in Everything

└──▷ BREAKING ON UPGRADE

!The retry:when value stuck_or_timeout_failure is deprecated in GitLab 19.1; in GitLab 19.0+ it covers historical data only — new jobs will not match it, so pipelines relying on it must be updated to use the new specific reasons.

docs update Sep 25, 2026 · issue 085

GitLab CI adds granular retry:when reasons for stuck, pending, hung, and timed-out jobs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Deprecates the stuck_or_timeout_failure value for retry:when in GitLab 19.1; existing jobs retain it for historical data only and new jobs must use the more specific reasons.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The stuck_or_timeout_failure value for retry:when is deprecated in GitLab 19.1 and preserved for historical data only; new jobs will not trigger retries on this reason unless the more specific replacement reasons are also configured.

How GitLab reduced code-per-agentic-flow ratio by 45% (2026-09-22) Sep 22, 2026 · release notes

GitLab introduces Flow Registry, a declarative YAML framework for building and orchestrating agentic flows with reusable components and routers.

└──▷ USE IT

Define an agent that reads files and creates merge requests using the new AgentComponent primitive.

yaml

type: AgentComponent
name: "developer_agent"
prompt_id: "developer_agent_prompt"
inputs:
  - from: "context:goal" as: "goal"
  - from: "context:project_id" as: "project_id"
toolset:
  - "read_file"
  - "find_files"
  - "edit_file"
  - "run_command"
  - "create_merge_request"

Route flow execution to different branches based on a judge agent's decision using the new Routers feature.

yaml

routers:
  - from: "fix_pipeline_context"
    condition:
      input: "context:fix_pipeline_context.final_answer.decision"
    routes:
      "add_comment": "fix_pipeline_add_comment"
      "create_plan": "fix_pipeline_checkout_existing_branch"
      "direct_code_suggestions": "fix_pipeline_code_suggestions"
      "no_action": "end"
      "default_route": "end"

Introduces Flow Registry, a declarative configuration framework that compiles YAML into LangGraph flows, allowing agent builders to use reusable components instead of ad-hoc Python.
Adds AgentComponent as a declarative primitive for defining agents, prompts, inputs, and toolsets in YAML configuration files.
Adds Routers as a mechanism to orchestrate multiple specialized agents into complex flows based on conditional logic defined in YAML.
Introduces a shared state structure with a context attribute acting as a nested key-value store, accessible via dot-notation declarative access.

4 details in Everything

New MCP tools help platform teams scale automation (2026-09-17) Sep 17, 2026 · issue 085

GitLab 19.4 adds CI/CD, merge request, vulnerability, and project MCP server tools plus a new merge-request-created trigger for agentic flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable a first-pass agent review the moment a merge request is opened by wiring the Created trigger in your project.

📍In your project, go to AI › Triggers, select Merge request as the event, choose Created as the action, and save the flow.

Adds save_pipeline MCP tool to run, retry, cancel, or rename a CI/CD pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds get_job MCP tool that returns a job by default; passing include: ['log'] streams the job trace paginated via byte_offset and byte_limit (512 KB per page) so an agent can fetch and diagnose a failed build log directly.
Adds save_merge_request MCP tool to open and update merge requests.
Adds get_merge_request MCP tool that returns diffs, conflicts, or approvals via the include param, with diffs defaulting to stats-level detail unless detail: full_patch is passed for full patch text.
Adds list_merge_requests MCP tool scoped to group level.

+10 more show less

Adds save_merge_request_review MCP tool covering the full review flow: posting line-level or summary comments, replying in or resolving discussions, submitting a full review, triggering a Duo review, and approving or unapproving.
Adds accept_merge_request MCP tool that merges immediately by default, or waits for checks when passed strategy: merge_when_checks_pass, or adds to a merge train with add_to_merge_train_when_checks_pass.
Adds list_repository_tree, list_branches, list_tags, list_releases, list_commits, get_commit, add_commit, and fork_repository MCP tools for repository exploration and direct interaction with history.
Adds get_project, list_projects, list_project_members, and get_user MCP tools for reading project details, member roles, and user information for assignment and mentions.
Adds get_work_item, list_work_items, and save_work_item MCP tools covering single-item reads, group/project-scoped search, and create-or-update for any supported work item type (superseding get_issue and create_issue).
Adds save_note MCP tool to comment on a work item or merge request and reply in an existing thread (supersedes create_merge_request_note and create_workitem_note).
Adds list_vulnerabilities MCP tool (Ultimate) to list project vulnerabilities filterable by severity and report type with cursor pagination.
Adds get_vulnerability MCP tool (Ultimate) to return full details for a single vulnerability by ID.
Adds save_vulnerability MCP tool (Ultimate) consolidating dismiss, confirm, revert to detected, update severity, and create a linked issue into one tool.
Adds Created as a new trigger action for merge requests, configurable under AI > Triggers in a project, firing when someone opens an MR once GitLab generates the diff (requires Premium or Ultimate with Duo Agent Platform enabled).

15 details in Everything

GitLab Duo CLI takes a task from goal to done (2026-09-17) Sep 17, 2026 · issue 078

GitLab Duo CLI adds /goal slash command for autonomous, goal-driven task completion without turn-by-turn prompting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Delegate an open-ended fix to the agent and walk away — it iterates until all tests pass and CI is green, rather than waiting for you to re-prompt each step.

$ /goal Fix the failing tests in spec/models/user_spec.rb. Continue until all tests pass locally and CI is green.

Hand off a broader clean-up task with an explicit done-condition and a human-review gate, so the agent stops only when the stated criteria are satisfied.

$ /goal Fix the failing tests. Ensure CI is fully green and the fix is reviewed by Duo Developer.

Adds the /goal slash command to GitLab Duo CLI, letting developers describe an outcome and a done-condition in a single prompt; the agent iterates locally until the goal is met or the configured iteration limit is reached, with no turn-by-turn supervision required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports stopping a /goal run at any point and issuing a new goal mid-session, giving developers a clear intervention point without abandoning the entire workflow.
Announces a forthcoming GitLab Duo Slack agent that will let developers mention @GitLab in any channel or thread to ask questions, trigger agent flows, or create GitLab issues conversationally, with progress streamed back into the thread in real time.

3 details in Everything

New MCP tools help platform teams scale automation safely (2026-09-17) Sep 17, 2026 · issue 078

GitLab 19.4 adds extensive MCP server tools for CI/CD, MRs, vulnerabilities, and unified agent governance⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Pull a failed CI job log in 512 KB pages so an agent can diagnose the build failure without fetching the full log at once.

json

Call the `get_job` MCP tool with:
{
  "job_id": 987654,
  "include": ["log"],
  "byte_offset": 0,
  "byte_limit": 524288
}

Merge an MR only after all CI checks pass, rather than immediately, to give an agent a safe merge strategy in automated pipelines.

json

Call the `accept_merge_request` MCP tool with:
{
  "merge_request_iid": 42,
  "project_id": 123,
  "strategy": "merge_when_checks_pass"
}

Trigger an automated first-pass review flow the moment a contributor opens a merge request, by enabling the new Created trigger in your project.

📍In your project, go to AI › Triggers and add the Created trigger action for merge requests, then enable your flow to run on that event.

Adds save_pipeline MCP tool to run, retry, cancel, or rename a CI/CD pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds get_job MCP tool that returns a job by default, and with include: ["log"] streams the job trace paginated via byte_offset and byte_limit (512 KB per page).
Adds save_merge_request MCP tool to open and update merge requests.
Adds get_merge_request MCP tool that returns diffs, conflicts, or approvals via the include param, with diffs defaulting to stats-level detail unless detail: full_patch is passed.
Adds list_merge_requests MCP tool supporting group-scope queries.

+10 more show less

Adds save_merge_request_review MCP tool covering the full review flow: line-level or summary comments, thread replies, discussion resolution, full review submission, Duo review trigger, and approve/unapprove.
Adds accept_merge_request MCP tool that merges immediately by default, waits for checks with strategy: merge_when_checks_pass, or joins a merge train with add_to_merge_train_when_checks_pass.
Adds list_repository_tree, list_branches, list_tags, list_releases, list_commits, get_commit, add_commit, and fork_repository MCP tools for full repository interaction.
Adds get_project, list_projects, list_project_members, and get_user MCP tools for project and user lookups.
Adds get_work_item, list_work_items, and save_work_item MCP tools covering issues, epics, and all supported work item types, superseding get_issue and create_issue.
Adds save_note MCP tool to comment on a work item or merge request and reply inside an existing thread, superseding create_merge_request_note and create_workitem_note.
Adds list_vulnerabilities MCP tool (Ultimate only) filterable by severity and report type with cursor pagination, and get_vulnerability for full single-vulnerability detail.
Adds save_vulnerability MCP tool (Ultimate only) consolidating dismiss, confirm, revert to detected, update severity, and create a linked issue into a single tool.
Adds a Created trigger action for merge requests in GitLab Duo Agent Platform, configurable under AI > Triggers in project settings, so flows or external agents run the moment an MR is opened and diffed.
Extends MCP server tool governance to GitLab MCP server tools alongside GitLab Duo Agent Platform tools in the same group and project settings, with a per-tool mode: read-only tools default to Always allow, write/delete tools default to Always ask.

15 details in Everything

Optimize your team's price-performance with hosted open weight models (2026-09-17) Sep 17, 2026 · issue 078

GitLab Duo Agent Platform adds three hosted open weight models — Kimi K3, GLM 5.3, and MiniMax M3 — offering up to 4x more calls per GitLab Credit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Kimi K3 (Moonshot AI) as a selectable hosted open weight model in GitLab Duo Agent Platform, at 1.82 calls per credit, optimized for large codebases and long-running agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GLM 5.3 (Z.ai) as a selectable hosted open weight model in GitLab Duo Agent Platform, at 5 calls per credit, tuned for long-horizon coding tasks with extended context accuracy.
Adds MiniMax M3 (MiniMax) as a selectable hosted open weight model in GitLab Duo Agent Platform, at 8 calls per credit, designed for high-volume, multi-step agentic work at scale.
Top-level group owners can now set a per-feature default model and curate which models teams can select from, with settings applying consistently across all child groups and projects.
All three new open weight models are served through Fireworks AI under a zero data retention policy, with model input and output discarded immediately after each response.

Adds Kimi K3 (Moonshot AI) as a selectable hosted open weight model in GitLab Duo Agent Platform, at 1.82 calls per credit, optimized for large codebases and long-running agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GLM 5.3 (Z.ai) as a selectable hosted open weight model in GitLab Duo Agent Platform, at 5 calls per credit, tuned for long-horizon coding tasks with extended context accuracy.
Adds MiniMax M3 (MiniMax) as a selectable hosted open weight model in GitLab Duo Agent Platform, at 8 calls per credit, designed for high-volume, multi-step agentic work at scale.
All three new open weight models are served through Fireworks AI under a zero data retention policy, with model input and output discarded immediately after each response.

1 more in Everything

See who spent your AI credits and set fair caps per team (2026-09-17) Sep 17, 2026 · issue 078

GitLab 19.4 adds per-user AI credit caps, per-event usage exports, and a developer self-service consumption view⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Set a default credit cap for all users and carve out a higher limit for engineers running agentic workloads — without opening the full budget to everyone.

📍Group Owners: go to Settings › GitLab Credits › Credit caps for your top-level group. 1. Under Flat user cap, enter the credit limit (e.g. 50) and enable enforcement. 2. Select Add override, search for the engineers doing agentic work, set their individual cap (e.g. 500), and save. 3. To revert an engineer to the flat cap, switch their override's enabled toggle off and save.

Pull a per-event export to identify which user and session drove last week's credit spike, then map namespaces to finance cost centers for automatic chargeback.

📍From the GitLab Credits dashboard (or GitLab Flex month overview), select Export usage data. Choose a date range up to 31 days. The export arrives by email with a secure download link containing three files: a daily summary, a per-event file, and a manifest. In the per-event file, filter rows by User ID and date to isolate the session behind the spike, or group by Namespace ID to produce a department-level showback line.

Let a developer check their own AI credit consumption without needing admin access.

📍As any member of the top-level group, navigate to User settings › GitLab Credits. Use the product filter and date range controls to view your daily consumption chart scoped to your own events.

Adds the Credit caps page (at Settings > GitLab Credits > Credit caps for group Owners, or Admin > GitLab Credits > Credit caps on Self-Managed) to set a flat per-user GitLab Credits cap for all users in a billing period, with per-user overrides that can go above or below the flat cap, and a master toggle that controls whether overrides apply.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Export usage data from the GitLab Credits dashboard or GitLab Flex month overview, delivering a background-generated export by email with a secure download link — up to 31 days, three files per export: a daily summary, a new per-event file, and a manifest.
The new per-event export file surfaces Event ID, timestamp, event type, product and flow type, session identifier, User ID, Namespace ID, Project ID, credits consumed (quantity and unit), LLM call count, token totals, models used, Flex capability, and subscription name — enabling per-team showback and session-level spike investigation.
Adds a per-developer GitLab Credits view under User settings showing a daily consumption chart with product filter and date range controls, scoped to the individual user's own events.
Adds email notifications to admins from the GitLab Credits dashboard at 50%, 80%, and 100% of credit usage, and again when the subscription cap is reached.

+3 more show less

Adds GitLab Flex capability-level controls letting admins mark each capability Restricted, Usage cap, or Unlimited against the shared reservation, so one capability's overage cannot drain credits needed by other capabilities.
Changes the included promotional credit draw-down order: per-user included promotional credits (12 per Premium seat, 24 per Ultimate seat per month) are now applied before any shared evaluation credits are consumed.
Enables a one-time namespace-to-cost-center mapping so that monthly per-event exports automatically reflect finance cost structure without manual reconciliation.

Adds the Credit caps page (at Settings > GitLab Credits > Credit caps for group Owners, or Admin > GitLab Credits > Credit caps on Self-Managed) to set a flat per-user GitLab Credits cap for all users in a billing period, with per-user overrides that can go above or below the flat cap, and a master toggle that controls whether overrides apply.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Export usage data from the GitLab Credits dashboard or GitLab Flex month overview, delivering a background-generated export by email with a secure download link — up to 31 days, three files per export: a daily summary, a new per-event file, and a manifest.
The new per-event export file surfaces Event ID, timestamp, event type, product and flow type, session identifier, User ID, Namespace ID, Project ID, credits consumed (quantity and unit), LLM call count, token totals, models used, Flex capability, and subscription name — enabling per-team showback and session-level spike investigation.
Adds a per-developer GitLab Credits view under User settings showing a daily consumption chart with product filter and date range controls, scoped to the individual user's own events.
Adds email notifications to admins from the GitLab Credits dashboard at 50%, 80%, and 100% of credit usage, and again when the subscription cap is reached.

+2 more show less

Adds GitLab Flex capability-level controls letting admins mark each capability Restricted, Usage cap, or Unlimited against the shared reservation, so one capability's overage cannot drain credits needed by other capabilities.
Enables a one-time namespace-to-cost-center mapping so that monthly per-event exports automatically reflect finance cost structure without manual reconciliation.

1 more in Everything

19.4 Sep 17, 2026 · release notes

GitLab 19.4 adds MCP tools for CI/CD and vulnerabilities, GraphQL bulk due dates, per-event credit exports, and Kotlin/Dart/Scala SAST.

└──▷ TRY IT

Run the new goal-driven flow from the CLI to automate a task.

$ /goal Fix the failing tests in spec/models/user_spec.rb

Adds save_pipeline, get_job MCP server tools to trigger, inspect, and control CI/CD via agents
Adds list_vulnerabilities, get_vulnerability, save_vulnerability MCP server tools for vulnerability management
Adds bulkSetVulnerabilityFindingsDueDates GraphQL mutation to assign or remove due dates for up to 1,000 findings in bulk
Adds /goal slash command in GitLab Duo CLI to delegate open-ended objectives to a governed local flow
Adds malware rule to merge request approval policies to block malicious packages

+11 more show less

Enables Kotlin, Dart, and Scala language support in Advanced SAST with deep taint analysis
Supports SPDX license expressions (e.g., MIT OR Apache-2.0) in dependency and license scanning data
Adds per-event detail to credit usage export as a ZIP file containing a CSV with one row per billable event
Adds a Credit caps UI page for group Owners/admins to set default and per-user credit caps without GraphQL API
Adds gitlab.featureFlags.flowBuilder setting in VS Code to enable the GitLab flow builder beta
Enables Geo SSH proxying by default via geo_proxy_fetch_ssh_to_primary and geo_proxy_push_ssh_to_primary feature flags
Adds Created trigger action for Merge requests in AI > Triggers
Adds list_projects, get_user, list_repository_tree, add_commit, fork_repository and other project/repository MCP tools
Adds save_work_item, list_work_items, get_work_item, save_note MCP server tools for work item management
Renames semantic_code_search tool to semantic_search with a new scope parameter
Adds malicious package detection in beta for Dependency Scanning with GLAM- IDs

16 details in Everything

└──▷ BREAKING ON UPGRADE

!Geo SSH proxying is enabled by default; Cloud Native GitLab deployments using the bundled NGINX Ingress must upgrade to Gateway API with Envoy Gateway or disable geo_proxy_fetch_ssh_to_primary and geo_proxy_push_ssh_to_primary feature flags to prevent SSH hangs.

Co-Create: Building GitLab with our users (2026-09-10) Sep 10, 2026 · issue 070

GitLab gains a User Applications REST API, W3C Trace Context CI variables, SCIM token inspection, Scala code-graph support, and instance-wide Secret Push Protection enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Correlate a CI/CD job's trace with upstream telemetry in a distributed system by forwarding the W3C Trace Context variables to an external observability endpoint.

$ curl -X POST https://otel-collector.example.com/v1/traces \
  -H "traceparent: $CI_TRACEPARENT" \
  -H "tracestate: $CI_TRACESTATE" \
  -d '{"job": "'$CI_JOB_ID'"}'

Adds the User Applications REST API to programmatically create, view, update, and delete user-owned OAuth applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds SCIM token support to the Token Information API, enabling identity and access management systems to inspect SCIM tokens alongside other GitLab tokens.
Introduces CI_TRACEPARENT and CI_TRACESTATE predefined CI/CD variables bringing W3C Trace Context into jobs for cross-pipeline and distributed-system trace correlation.
Adds an instance-level enforcement setting for Secret Push Protection, letting administrators mandate the control across all projects on a GitLab instance.
Adds configurable merge train pipeline limits so high-throughput teams can set limits that match their plan and capacity.

+4 more show less

Completes the REST API for Terraform state protection rules, supporting retrieve, create, update, and delete operations programmatically.
Adds Scala language support to GitLab Orbit, enabling code-graph definitions for classes, traits, objects, functions, and values in Scala repositories.
Adds supported-platform details (operating system and architecture) to container image indexes in the container registry.
Adds a PDF export option for Markdown files.

Adds the User Applications REST API to programmatically create, view, update, and delete user-owned OAuth applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces CI_TRACEPARENT and CI_TRACESTATE predefined CI/CD variables bringing W3C Trace Context into jobs for cross-pipeline and distributed-system trace correlation.
Adds a PDF export option for Markdown files.

6 more in Everything

docs update Sep 9, 2026 · issue 069

GitLab CI adds ci_spec_include_own_context flag so included files resolve include locations against their own repository and ref.

Bring your own model to GitLab Duo Self-Hosted with Microsoft Foundry (2026-09-08) Sep 8, 2026 · issue 069

GitLab Duo Self-Hosted can now use models deployed on Microsoft Foundry, with per-feature model assignment across GPT, Claude, Llama, and Mistral families.

└──▷ HOW TO FIND IT

Register a Microsoft Foundry model deployment for GitLab Duo Agentic Chat, pointing GitLab at the Foundry endpoint with the azure/ identifier prefix.

📍Admin › GitLab Duo › Configure models for GitLab Duo › Add self-hosted model Deployment name: Agentic Chat on Microsoft Foundry Model family: GPT Endpoint: https://<your-foundry-endpoint>.openai.azure.com/ API key: <your-api-key> Model identifier: azure/duo-chat

Point the GitLab instance at a locally running AI Gateway so that self-hosted model requests are routed through infrastructure you control.

📍Admin › GitLab Duo › Change configuration Local AI Gateway URL: https://ai-gateway.example.com:5052 Select Save changes

Adds azure/<deployment-name> as the model identifier format when registering a Microsoft Foundry deployment in GitLab Duo Self-Hosted, allowing GPT, Claude, Llama, and Mistral models to back individual Duo features.
Supports per-feature model assignment in GitLab Duo Self-Hosted — a different model deployment (e.g., duo-chat, duo-code-gen, duo-code-completion) can be assigned to each Duo feature rather than applying one model globally.
Adds Microsoft Foundry as a supported backend for the AI Gateway, enabling organizations to serve GitLab Duo inference through Azure-hosted endpoints while keeping inference data within their own Azure tenant.
Supports Microsoft Entra identity, Azure RBAC, network isolation, and Azure Policy on Foundry model deployments used with GitLab Duo Self-Hosted.

Adds azure/<deployment-name> as the model identifier format when registering a Microsoft Foundry deployment in GitLab Duo Self-Hosted, allowing GPT, Claude, Llama, and Mistral models to back individual Duo features.
Adds Microsoft Foundry as a supported backend for the AI Gateway, enabling organizations to serve GitLab Duo inference through Azure-hosted endpoints while keeping inference data within their own Azure tenant.
Supports Microsoft Entra identity, Azure RBAC, network isolation, and Azure Policy on Foundry model deployments used with GitLab Duo Self-Hosted.

1 more in Everything

GPT-6 Astra on GitLab: Faster runs, fewer tokens used (2026-09-08) Sep 8, 2026 · issue 069

GPT-6 Astra is now available on GitLab Duo Agent Platform, running 43% faster and using 43% fewer tokens than GPT-5.6 Sol.

Adds GPT-6 Astra as a selectable model on GitLab Duo Agent Platform, with admins able to assign it per feature via model selection settings.

1 detail in Everything

Scale software delivery pipelines in isolation without owning the runner fleet (2026-08-25) Aug 25, 2026 · issue 056

GitLab Dedicated gains fully managed, single-tenant Hosted Runners with AWS PrivateLink, autoscaling, and GitLab Credits billing.

└──▷ USE IT

Target a specific hosted runner size in a GitLab Dedicated pipeline job instead of self-managed runner tags.

.gitlab-ci.yml

build:
  tags:
    - linux-large-amd64
  script:
    - make build

Use the default small hosted runner when no size preference is specified — the linux-small-amd64 tag is applied automatically.

.gitlab-ci.yml

test:
  tags:
    - linux-small-amd64
  script:
    - make test

Introduces Hosted Runners for GitLab Dedicated: a fully managed, single-tenant CI runner fleet isolated per customer, eliminating the need to provision or maintain your own runners.
Supports machine sizes linux-small-amd64 (default, 2 vCPU / 8 GB), linux-medium-amd64 (4 vCPU / 16 GB), linux-large-amd64 (8 vCPU / 32 GB), linux-xlarge-amd64 (16 vCPU / 64 GB), and linux-2xlarge-amd64 (32 vCPU / 128 GB) on Linux x86-64 and Linux Arm64.
Provides consumption-based pricing via GitLab Credits, with usage visible in the GitLab Credits Dashboard.
Enables secure connectivity to internal artifact registries, secret managers, and deploy targets via AWS PrivateLink.
Each CI job runs in a newly provisioned, short-lived VM deleted after completion, enforcing job-level process isolation.

+2 more show less

Runner fleet creation and management is self-serviceable through Switchboard, the GitLab Dedicated management console.
Backs the offering with a 99.9% uptime SLA and highly available, autoscaling runner architecture to handle bursty CI workloads.

7 details in Everything

Build custom flows in minutes with the Flow Creator agent (2026-08-20) Aug 20, 2026 · issue 052

GitLab 19.3 introduces the Flow Creator agent, letting anyone describe automation in plain language to generate runnable Custom Flow definitions.

└──▷ HOW TO FIND IT

Use Flow Creator in Agentic Chat to instantly generate a triage automation without writing any YAML schema.

📍Steps: 1. Open GitLab Duo Agentic Chat in your GitLab 19.3 instance. 2. Invoke Flow Creator and enter: 'When a work item is created with the label security-triage, check it against our known false-positive patterns, find the affected dependency and its owner, and post a severity assessment as a comment.' 3. Respond to any clarifying questions (e.g., target project, whether a human-approval step is needed). 4. Copy the generated flow definition YAML. 5. Go to your project › AI Catalog › Create Flow, paste the YAML into the configuration editor, set visibility (private / restricted / public), and add the desired triggers.

Adds the Flow Creator agent to GitLab Duo Agent Platform (accessible via Agentic Chat), which converts plain-language descriptions into complete, runnable Flow Registry definitions — no YAML schema knowledge required.
Flow Creator reads current Flow Registry documentation before every response, applies rules encoding known failure patterns, and runs a pre-output checklist before generating any YAML to catch issues like missing project_id, broken human-in-the-loop gates, wrong sends_response_to targets, and missing stopping instructions.
Generated flow definitions can be pasted directly into the configuration editor when creating a flow from a project or from the AI Catalog, with visibility options of private, restricted, or public.
Enabling a generated flow still requires the Maintainer role or higher; Group Owners and instance administrators can disable Custom Flows entirely. Every flow runs under a scoped service account with composite identity, bounded to the top-level group.

4 details in Everything

Run agentic software delivery inside the boundaries you already trust (2026-08-20) Aug 20, 2026 · issue 052

GitLab Dedicated now hosts the AI Gateway for the Duo Agent Platform inside each customer's single-tenant AWS environment.

Deploys the AI Gateway for the GitLab Duo Agent Platform inside the GitLab Dedicated single-tenant environment, keeping AI inference within the customer's AWS region and data residency boundary.
Supports Amazon Bedrock as a model backend for the AI Gateway on GitLab Dedicated, so inference stays in the customer's chosen AWS region.
Enables bring-your-own-model configuration, letting customers connect preferred model providers under their own data classification rules and existing commitments.
Unlocks all Duo Agent Platform capabilities — including automated custom code reviews, fixing failed pipelines, and security analysis — against customer-selected models on Dedicated deployments.

4 details in Everything

When your backlog outgrows your team, GitLab scales remediation (2026-08-20) Aug 20, 2026 · issue 052

GitLab 19.3 adds bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution against existing vulnerability backlogs.

└──▷ HOW TO FIND IT

Triage and remediate your entire SAST backlog at once instead of opening each finding individually.

📍In the GitLab vulnerability report, select all SAST findings using the bulk-select checkbox, then choose Run SAST False Positive Detection followed by Run Agentic SAST Vulnerability Resolution from the bulk-action menu. A progress indicator tracks the job; click Cancel to stop it at any point.

Adds bulk-select UI in the vulnerability report to run SAST False Positive Detection and Agentic SAST Vulnerability Resolution against multiple existing vulnerabilities at once, replacing one-at-a-time manual triage.
SAST False Positive Detection analyzes surrounding code and returns a confidence score and explanation indicating whether a finding is a real risk or a false positive.
Supports importing third-party scanner findings in SARIF format into the unified vulnerability report, making bulk agentic flows available to findings from any external scanner.
Enables pipelines to run SAST False Positive Detection and Agentic SAST Vulnerability Resolution automatically on Critical and High severity new findings, so triage and fix MR creation happen before a developer opens the finding.
Adds a progress indicator and cancellation control to bulk agentic jobs, with concurrency limits to prevent bulk runs from competing with pipeline build capacity.

5 details in Everything

When your backlog outgrows your team, GitLab scales remediation (2026-08-20) Aug 20, 2026 · issue 008

GitLab 19.3 adds bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution against existing vulnerability backlogs.

└──▷ HOW TO FIND IT

Triage and remediate your entire SAST backlog at once instead of opening each finding individually.

📍In the GitLab vulnerability report, select all SAST findings using the bulk-select checkbox, then choose Run SAST False Positive Detection followed by Run Agentic SAST Vulnerability Resolution from the bulk-action menu. A progress indicator tracks the job; click Cancel to stop it at any point.

Adds bulk-select UI in the vulnerability report to run SAST False Positive Detection and Agentic SAST Vulnerability Resolution against multiple existing vulnerabilities at once, replacing one-at-a-time manual triage.
SAST False Positive Detection analyzes surrounding code and returns a confidence score and explanation indicating whether a finding is a real risk or a false positive.
Supports importing third-party scanner findings in SARIF format into the unified vulnerability report, making bulk agentic flows available to findings from any external scanner.
Enables pipelines to run SAST False Positive Detection and Agentic SAST Vulnerability Resolution automatically on Critical and High severity new findings, so triage and fix MR creation happen before a developer opens the finding.
Adds a progress indicator and cancellation control to bulk agentic jobs, with concurrency limits to prevent bulk runs from competing with pipeline build capacity.

5 details in Everything

Build custom flows in minutes with the Flow Creator agent (2026-08-20) Aug 20, 2026 · issue 008

GitLab 19.3 introduces the Flow Creator agent, letting anyone describe automation in plain language to generate runnable Custom Flow definitions.

└──▷ HOW TO FIND IT

Use Flow Creator in Agentic Chat to instantly generate a triage automation without writing any YAML schema.

📍Steps: 1. Open GitLab Duo Agentic Chat in your GitLab 19.3 instance. 2. Invoke Flow Creator and enter: 'When a work item is created with the label security-triage, check it against our known false-positive patterns, find the affected dependency and its owner, and post a severity assessment as a comment.' 3. Respond to any clarifying questions (e.g., target project, whether a human-approval step is needed). 4. Copy the generated flow definition YAML. 5. Go to your project › AI Catalog › Create Flow, paste the YAML into the configuration editor, set visibility (private / restricted / public), and add the desired triggers.

Adds the Flow Creator agent to GitLab Duo Agent Platform (accessible via Agentic Chat), which converts plain-language descriptions into complete, runnable Flow Registry definitions — no YAML schema knowledge required.
Flow Creator reads current Flow Registry documentation before every response, applies rules encoding known failure patterns, and runs a pre-output checklist before generating any YAML to catch issues like missing project_id, broken human-in-the-loop gates, wrong sends_response_to targets, and missing stopping instructions.
Generated flow definitions can be pasted directly into the configuration editor when creating a flow from a project or from the AI Catalog, with visibility options of private, restricted, or public.
Enabling a generated flow still requires the Maintainer role or higher; Group Owners and instance administrators can disable Custom Flows entirely. Every flow runs under a scoped service account with composite identity, bounded to the top-level group.

4 details in Everything

Run agentic software delivery inside the boundaries you already trust (2026-08-20) Aug 20, 2026 · issue 008

GitLab Dedicated now hosts the AI Gateway for the Duo Agent Platform inside each customer's single-tenant AWS environment.

Deploys the AI Gateway for the GitLab Duo Agent Platform inside the GitLab Dedicated single-tenant environment, keeping AI inference within the customer's AWS region and data residency boundary.
Supports Amazon Bedrock as a model backend for the AI Gateway on GitLab Dedicated, so inference stays in the customer's chosen AWS region.
Enables bring-your-own-model configuration, letting customers connect preferred model providers under their own data classification rules and existing commitments.
Unlocks all Duo Agent Platform capabilities — including automated custom code reviews, fixing failed pipelines, and security analysis — against customer-selected models on Dedicated deployments.

4 details in Everything

19.3 Aug 20, 2026 · release notes

GitLab 19.3 adds Secrets Manager, Enforce Merge Trains, bulk SAST flows, Bun scanning, and more agentic capabilities.

Adds GITLAB_ADVANCED_SAST_ENABLED: 'true' environment variable to enable iOS Advanced SAST in beta
Adds support for Amazon Bedrock Mantle as a self-hosted model provider for GitLab Duo Agent Platform
Introduces new MCP tools get_merge_request and list_merge_requests for AI agents
Adds expression field support for CycloneDX SBOM license entries, including SPDX syntax like MIT AND Apache-2.0 and LicenseRef-[NAME]
Generates audit events for fail-open scenarios in Secret Push Protection (ruleset errors, timeouts, etc.)

+12 more show less

Adds dependency scanning coverage for Bun projects by parsing bun.lock files
Enables bulk execution of SAST Vulnerability Resolution and False Positive Analysis flows in the Vulnerability Report
Adds support for Kubernetes 1.36
Introduces PostgreSQL 18.4 option for fresh installs using Linux packages on GitLab Self-Managed
Allows setting Restricted visibility for custom agents and flows in groups, subgroups, and projects
Adds GraphQL API support for setting usage caps on GitLab Credits per-user or subscription-level
Adds new CI/CD variables CI_JOB_RETRY_COUNT and CI_JOB_TAGS
Supports LDAP group sync configuration of the Auditor role via audit_group setting
Extends REST API with aimed_for_deletion filter for groups and merged_after/merged_before for merge requests
Enables Webhooks for merge request reviews (merge_request webhook with changes.reviewers) and deployment approvals (status events)
Adds mcp scope support to OAuth applications via the Admin area API
Adds support for disabling Dynamic Client Registration (DCR) for MCP clients via the application settings API

17 details in Everything

└──▷ BREAKING ON UPGRADE

!Removes budget_caps_graphql_api feature flag for usage caps (now GA)
!Deprecated Devstral 2 model for GitLab Duo Agent Platform Self-Hosted

docs update Aug 19, 2026 · issue 050

GitLab Personal Access Tokens now expose last-five connection IPs and per-scope usage timestamps in token detail view.

Token detail view now surfaces usage dates alongside scopes, assigned roles, and expiration dates — usage times refresh every 10 minutes via API.

1 detail in Everything

Avoid the massive end-to-end tax of default full history clones (2026-08-18) Aug 18, 2026 · issue 050

GitLab introduces Git Clone Override Policy: a Go binary + .afullhistorycloneoverridepolicy.toml that auto-enforces optimized clones.

└──▷ USE IT

Commit a policy file to a monorepo so every bare clone — by developers, CI jobs, or AI agents — automatically gets a shallow partial clone that skips binaries, without anyone remembering the flags.

.afullhistorycloneoverridepolicy.toml

# .afullhistorycloneoverridepolicy.toml at repo root
schema_version = 2

[policyinfo]
description = "Optimized clone for CI and AI agents"
OptimalForAIAgents = true

[git_config]
"core.compression" = 0
"http.postBuffer" = "1024M"
"pack.threads" = 4

[fetch]
flags = ["--depth=1", "--filter=blob:none"]

[sparse_checkout]
enabled = true
conemode = "auto"
includes = ["/*"]
exclude_extensions = [
  "png", "jpg", "gif", "svg", "pdf",
  "zip", "tar", "gz", "mp4", "exe",
  "dll", "woff", "woff2", "ttf", "psd"
]
case_variants = "both"

Run the override binary in place of git clone so the policy is enforced for a one-off zero-footprint clone without any global git config changes.

$ ./git-clone-override-policy https://example.com/group/my-repo.git

Adds .afullhistorycloneoverridepolicy.toml (TOML, schema_version = 2) stored in the repository root to declaratively configure clone optimization policy, including [git_config], [fetch], [sparse_checkout], exclude_extensions, conemode, includes, excludes, and case_variants fields.
Adds a self-contained Go binary (git-clone-override-policy) that intercepts bare git clone <URL> calls and automatically executes a fixed 13-step shallow-and-partial-clone sequence, applying the repo's policy file before any source hits disk.
Supports [fetch] flags such as --depth=1 and --filter=blob:none in policy config to defer blob content and limit history depth on initial clone.
Supports [sparse_checkout] with conemode = 'auto' (resolved to cone or no-cone at runtime), includes, excludes, and exclude_extensions listing over 30 binary file types (images, archives, media, fonts, compiled binaries, design files) to skip non-source content.
Supports [git_config] block to scope large-transfer tuning (core.compression, http.postBuffer, http.lowSpeedLimit, http.lowSpeedTime, pack.windowMemory, pack.packSizeLimit, pack.threads) to the cloned repo without affecting global git config.

+3 more show less

Binary runs on Linux, macOS, and Windows for both amd64 and arm64 with no runtime dependency beyond a git binary on PATH, covering CMD, PowerShell, Git Bash, and WSL.
Policy intercept is bypass-safe: any clone that already carries an option (--depth, --filter, or any flag) passes through untouched; repos without a policy file also pass through with no behavioral change.
New [policyinfo] section supports metadata fields such as description and OptimalForAIAgents for auditability and tooling-driven policy generation.

8 details in Everything

Avoid the massive end-to-end tax of default full history clones (2026-08-18) Aug 18, 2026 · issue 008

GitLab introduces Git Clone Override Policy: a Go binary + .afullhistorycloneoverridepolicy.toml that auto-enforces optimized clones.

└──▷ USE IT

Commit a policy file to a monorepo so every bare clone — by developers, CI jobs, or AI agents — automatically gets a shallow partial clone that skips binaries, without anyone remembering the flags.

.afullhistorycloneoverridepolicy.toml

# .afullhistorycloneoverridepolicy.toml at repo root
schema_version = 2

[policyinfo]
description = "Optimized clone for CI and AI agents"
OptimalForAIAgents = true

[git_config]
"core.compression" = 0
"http.postBuffer" = "1024M"
"pack.threads" = 4

[fetch]
flags = ["--depth=1", "--filter=blob:none"]

[sparse_checkout]
enabled = true
conemode = "auto"
includes = ["/*"]
exclude_extensions = [
  "png", "jpg", "gif", "svg", "pdf",
  "zip", "tar", "gz", "mp4", "exe",
  "dll", "woff", "woff2", "ttf", "psd"
]
case_variants = "both"

Run the override binary in place of git clone so the policy is enforced for a one-off zero-footprint clone without any global git config changes.

$ ./git-clone-override-policy https://example.com/group/my-repo.git

Adds .afullhistorycloneoverridepolicy.toml (TOML, schema_version = 2) stored in the repository root to declaratively configure clone optimization policy, including [git_config], [fetch], [sparse_checkout], exclude_extensions, conemode, includes, excludes, and case_variants fields.
Adds a self-contained Go binary (git-clone-override-policy) that intercepts bare git clone <URL> calls and automatically executes a fixed 13-step shallow-and-partial-clone sequence, applying the repo's policy file before any source hits disk.
Supports [fetch] flags such as --depth=1 and --filter=blob:none in policy config to defer blob content and limit history depth on initial clone.
Supports [sparse_checkout] with conemode = 'auto' (resolved to cone or no-cone at runtime), includes, excludes, and exclude_extensions listing over 30 binary file types (images, archives, media, fonts, compiled binaries, design files) to skip non-source content.
Supports [git_config] block to scope large-transfer tuning (core.compression, http.postBuffer, http.lowSpeedLimit, http.lowSpeedTime, pack.windowMemory, pack.packSizeLimit, pack.threads) to the cloned repo without affecting global git config.

+3 more show less

Binary runs on Linux, macOS, and Windows for both amd64 and arm64 with no runtime dependency beyond a git binary on PATH, covering CMD, PowerShell, Git Bash, and WSL.
Policy intercept is bypass-safe: any clone that already carries an option (--depth, --filter, or any flag) passes through untouched; repos without a policy file also pass through with no behavioral change.
New [policyinfo] section supports metadata fields such as description and OptimalForAIAgents for auditability and tooling-driven policy generation.

8 details in Everything

19.2 Jul 16, 2026 · release notes

GitLab 19.2 introduces GitLab Duo CLI GA, Security Review Flow, Dependency Scanning auto-remediation, and Configurable Custom Flows

Adds gitlab-duo CLI with interactive chat, headless CI/CD mode, and Model Context Protocol (MCP) connections support
Adds the Security Review Flow feature to detect business logic vulnerabilities in merge requests via the Duo Security Review service account
Adds Dependency scanning auto-remediation (Beta) for automated dependency version bumps and Agentic Breaking Change Resolution
Adds id_tokens keyword to custom agent configurations for authenticating with third-party OIDC services
Adds support for toggling the GitLab MCP server independently from Agent Platform settings

+3 more show less

Enables duo_code_review_automated_rules feature flag to exclude specific merge requests from automatic code reviews using a .gitlab/duo/mr-review-automated-rules.yaml file
Adds instance-level custom review instructions via a new .gitlab/duo/mr-review-instructions.yaml file for GitLab Dedicated and Self-Managed instances
Adds usage billing validation checks in GitLab Duo Health to diagnose connectivity issues with the AI Gateway and Duo Workflow Service endpoints

8 details in Everything

19.1 Jun 18, 2026 · release notes

GitLab 19.1 adds secret FP detection via Duo, SARIF 2.1.0 import, custom OAuth token lifetimes, and Security Manager role.

Adds Always on availability mode for GitLab Duo to lock AI features centrally.
Allows automatic assignment of Code Owners as reviewers in Merge Requests.
Adds 19 compliance framework templates (ISO 27001:2022, SOC 2, etc.) for the Compliance center.
Enables full branch secret detection scanning from divergence point to latest commit.
Adds tool-level approval policies (Allow, Ask, Deny) for GitLab Duo agents.

+9 more show less

Introduces allowlist controls and organization-wide default models for Agentic Chat.
Supports GPT-5.2 and GPT-5.3 Codex models for Code Review Flow.
Adds four new event triggers for flows: Merge request ready, code conflict, approved, and Work item created.
Provides a Scanner Enablement Wizard to bulk-apply security profiles and close coverage gaps.
Allows instance administrators to set custom OAuth access token lifetimes (300–7200 seconds).
Enables importing findings from any SARIF 2.1.0-compliant scanner into GitLab vulnerability management.
Generally available the Security Manager role for granular security feature access.
Extends git operation audit events to all actor types including runners and SSH certificate users.
Adds beta scheduled pipeline execution policies with time zone and snooze support.

14 details in Everything

GitLab Patch Release: 19.0.2, 18.11.5, 18.10.8 Jun 10, 2026 · release notes

GitLab patch adds configurable CI cache limit and Praefect health check timeout

Adds praefect.health_check_ping_timeout configuration option to control Praefect health check intervals.
Makes the CI cache limit per job configurable by admins instead of using a hard-coded default.

2 details in Everything

19.0 May 21, 2026 · release notes

GitLab 19.0 adds group-level Duo review instructions, Secrets Manager beta, SBOM dep scanning, and webhook HMAC signing.

gitlab/duo/mr-review-instructions.yaml supports group-level custom review instructions for GitLab Duo
GitLab Secrets Manager is now available in open beta for Premium/Ultimate on GitLab.com and Self-Managed
Dependency scanning by using SBOM is generally available with automatic dependency resolution for Maven, Gradle, and Python
repo: syntax filters exact code search results by repository without visiting individual projects
Expanded open source model support includes Devstral 2 123B and GLM-5.1-FP8 in GitLab Duo Agent Platform

+14 more show less

Per-session tool approvals allows approving trusted tools once for an entire session, controlled by admin settings cascading from instance to group
AI Catalog can be confined to a group hierarchy to block external agents not owned by the group
Free tier users on GitLab Self-Managed can purchase credits for GitLab Duo Agent Platform
Admin-defined network access controls allow domain denylists/allowlists for Agent Platform remote flows in Settings
Dependency scanning is available in security configuration profiles with the Dependency Scanning - Default profile
Dependency resolution for Gradle SBOM scanning automatically generates gradle.graph.txt if not present
API security testing findings include remediation guidance for checks like SQL injection, CORS, and HTML injection
Merge requests now have a Reports tab showing all findings from security scans, license compliance, and code quality
CI/CD inputs support array index operator [] to access specific elements within array inputs
Pipeline inputs in the UI allow selecting multiple values which are combined into an array (e.g., ["option1","option2"])
Component usage analytics in CI/CD Catalog shows exactly which projects use each component and their versions
Parallel pipeline limits for merge trains can be configured per project or instance-wide via settings
Default merge request title templates can be customized using variables like %{issue_id} and %{issue_title}
Secure webhooks with HMAC signing tokens uses webhook-signature header alongside webhook-id and webhook-timestamp

19 details in Everything

└──▷ BREAKING ON UPGRADE

!Minimum supported PostgreSQL version is now 17; upgrade before installing GitLab 19.0
!Linux packages for Ubuntu 20.04 are no longer provided; migrate to Ubuntu 22.04 or another supported OS
!Support for Redis 6 is removed in GitLab 19.0; migrate to Redis 7.2 or Valkey 7.2
!Bundled Mattermost is removed from the Linux package in GitLab 19.0; refer to migration instructions if used
!Linux package support for SUSE distributions ends in GitLab 19.0; migrate to Docker deployment
!Spamcheck is removed from the Linux package and GitLab Helm chart in GitLab 19.0; deploy separately using Docker if needed
!Gateway API with Envoy Gateway replaces NGINX Ingress as the default networking configuration in the Helm chart until removal in GitLab 20.0
!Bundled Bitnami PostgreSQL, Bitnami Redis, and MinIO charts are removed from the Helm chart and Operator; configure external services before upgrading

18.11 Apr 16, 2026 · release notes

GitLab 18.11 adds agentic SAST resolution, GLQL project/pipeline data sources, and per-user credit caps.

Adds agentic vulnerability resolution for SAST findings via the Duo Agent Platform (Ultimate)
Extends GitLab Query Language (GLQL) to query projects, pipelines, and jobs data sources
Adds automatic dependency graph generation for Maven and Python SBOM scanning when lock files are missing
Enables incremental scanning for Advanced SAST to analyze only changed code parts
Surfaces unverified vulnerabilities (source-to-sink tracing failures) in Advanced SAST reports (Beta)

+12 more show less

Adds support for Kubernetes 1.35
Sets subscription-level and per-user usage caps for GitLab Credits
Allows configuring tool options and parameters directly in custom flow definitions
Supports Mistral AI as a self-hosted LLM platform in the Duo Agent Platform
Adds terraform_module to package protection rules
Automatically includes packages in release evidence when package version matches release tag
Configures MR approval policies using Known Exploited Vulnerability (KEV) and EPSS data
Displays CVSS 4.0 scores in the UI, vulnerability reports, and API queries
Exports security dashboards as PDFs
Integrates SAST into security configuration profiles with Static Application Security Testing (SAST) - Default
Filters group security dashboards by security attributes like Business impact and Internet exposure
Betas the Security Manager role for focused vulnerability management and compliance access

17 details in Everything

18.10 Mar 19, 2026 · release notes

GitLab 18.10 adds SAST/Secret false positive AI detection, passkeys, MCP integration, and SBOM Gradle support

SAST false positive detection is generally available with GitLab Duo Agent Platform, analyzing critical/high vulnerabilities automatically or manually via the vulnerability details page.
Introduces AI-powered secret false positive detection (beta) for Critical and High severity secrets, providing contextual reasoning and confidence scores in the vulnerability report.
Allows configuring a required merge request title regex pattern to enforce naming conventions as a mergeability check at Settings > Merge requests.
Enables custom agents in the AI Catalog to access external data sources via the Model Context Protocol (MCP).
Extends GitLab Blob Search for group and instance code search, allowing AI agents to search across all projects in a group or on an instance.

+14 more show less

Adds the manage_pipeline MCP server tool for creating, canceling, retrying, deleting, and updating pipeline metadata via AI agents.
Allows project Maintainers to enable custom agents and flows directly from the project level without top-level group permissions.
Configures network access controls for remote flows using GitLab runners via the network_policy section in agent-config.yml.
Supports the Agent Skills specification, allowing agents to load specialized workflows triggered by name, file path, or slash commands.
Downloads credit usage data as a CSV file directly from the GitLab Credits dashboard in Customers Portal.
Links credit usage rows in the Usage by User table to specific GitLab Duo Agent Platform sessions via clickable hyperlinks in the Action column.
Supports Dependency Scanning SBOM for Java Gradle build.gradle and build.gradle.kts files with manifest fallback using the DS_ENABLE_MANIFEST_FALLBACK CI/CD variable.
Enables SBOM-based dependency scanning on self-managed instances by default via the dependency_scanning_sbom_scan_api feature flag.
Adds license scanning support for Dart/Flutter projects using the pub package manager, sourcing data from pub.dev.
Promotes Conan 2.0 registry support to Beta with full v2 API compatibility and recipe revision support.
Provides a dedicated group-level UI to create and manage container virtual registries without API calls.
Makes GitLab Helm Chart registry generally available with Geo replication support for Helm metadata cache.
Adds macos-26-xcode-26 host runner image for building applications on macOS Tahoe 26 and Xcode 26.
Enables Kubernetes runners to define Pod level resources for build pods.

19 details in Everything

18.9 Feb 19, 2026 · release notes

GitLab 18.9 adds Agentic SAST resolution, Container Virtual Registry API, Valkey opt-in, and new Security Profiles UI.

Adds Agentic SAST Vulnerability Resolution (Beta) to autonomously analyze and fix critical/high SAST findings via merge requests
Adds container_virtual_registries beta API for creating a unified endpoint to pull from multiple upstream container registries
Adds opt-in support for Valkey as a replacement for Redis in the Linux package binary distribution
Enables centralized security_configuration_profiles with bulk actions to apply scanner settings across groups/projects
Adds Vulnerabilities by age chart to the Ultimate security dashboard for analyzing unresolved vulnerability duration

+14 more show less

Adds support for requirements.txt manifest fallback in Dependency Scanning via the DS_ENABLE_MANIFEST_FALLBACK CI/CD variable
Adds support for pom.xml manifest fallback in Dependency Scanning via the DS_ENABLE_MANIFEST_FALLBACK CI/CD variable
Enables web-based commit signing on GitLab.com, available in group or project settings with a Verified badge
Adds OAuth authentication support for GitLab Duo plugin in JetBrains IDEs (Self-Managed/Dedicated)
Adds Minimal Access role users to no longer count against billable seat limits on Self-Managed Premium
Adds a new data management view on the primary Geo site for troubleshooting and verification status
Adds the ability to archive an entire group and all its subgroups/projects in one action
Adds Zero Downtime Upgrades support for Cloud Native Hybrid deployments on Kubernetes
Enables import of repositories from Bitbucket Cloud using API tokens via the GitLab import API
Restricts personal snippet creation for enterprise users on GitLab.com, managed by Group Owners
Adds CI job log timestamps (UTC) to identify bottlenecks, requiring GitLab Runner 18.7+
Updates Vulnerabilities over time chart to exclude vulnerabilities that are no longer detected
Adds UI for viewing CI/CD job metrics and analytics for projects in the UI
Displays security reports from child pipelines directly in merge request widgets

19 details in Everything

└──▷ BREAKING ON UPGRADE

!Atlassian app passwords for Bitbucket Cloud import are deprecated and will be removed in version 19.0; use API tokens instead.
!In version 19.0, Redis binaries are removed from the Linux package; existing Redis configuration settings remain functional but must be migrated to Valkey.

18.8 Jan 15, 2026 · release notes

GitLab 18.8 adds Agent Platform GA, C/C++ Advanced SAST, multi-container scanning, auto-dismiss policies, Credentials API, and SSH key disablement.

GitLab Duo Agent Platform is generally available with a central AI Catalog for managing agents and flows.
GitLab Duo Planner Agent is generally available to analyze backlogs and apply planning frameworks like RICE or MoSCoW.
GitLab Duo Security Analyst Agent is generally available to triage vulnerabilities via natural language in Agentic Chat.
Adds vulnerability management policies to auto-dismiss irrelevant vulnerabilities based on file path, directory, or identifier (CVE, CWE, OWASP).
Enables turning on or off the GitLab Duo Agent Platform and individual components for a top-level group or instance.

+6 more show less

Introduces group access control rules to define who can use GitLab Duo features within a group.
GitLab Duo Agent Platform for Self-Hosted (offline licensing) is generally available, supporting compatible models and AWS Bedrock/Azure OpenAI configurations.
C/C++ support in Advanced SAST is generally available with cross-file, cross-function scanning.
Multiple Container Scanning allows passing an array of images to be scanned in CI jobs.
Provides the Credentials Inventory API for group owners to programmatically manage Personal Access Tokens, Group Access Tokens, Project Access Tokens, SSH Keys, and GPG Keys.
Group Owners can disable SSH keys for all enterprise users in their group.

11 details in Everything

18.7 Dec 18, 2025 · release notes

GitLab 18.7 adds secret validity checks, AI SAST false positive detection, CI/CD dynamic inputs, and more.

Adds report filtering by validity status to the Vulnerability Report for rapid triage of leaked secrets
Adds a group-level API to turn on secret validity checks across all projects in a group with a single call
Integrates secret validity checks with Google Cloud, AWS, and Postman vendor integrations
Enables separate model selection for Agentic Chat versus other agents for top-level groups or instances
Adds an endpoint for instance-level AI usage to extract all Duo data from Postgres or ClickHouse

+27 more show less

Provides 6-month trend analysis across GitLab Duo feature adoption, pipeline performance, and development metrics
Enables code generation volumes and IDE/language trends tracking in the GitLab Duo and SDLC trends dashboard
Introduces create and edit features for the Planner Agent in beta
Adds dynamic input options in CI/CD pipelines to enable cascading dropdowns in the web interface
Introduces AI-powered SAST False Positive Detection (Beta) for Critical and High severity vulnerabilities
Enables manual trigger option for false positive detection on individual vulnerability details pages
Adds a new security dashboard enabled by default on GitLab Dedicated and GitLab Self-Managed
Adds a risk score module to the new security dashboards that calculates estimated risk based on a GitLab algorithm
Adds an instance setting to control publishing of components to the CI/CD Catalog via an allowlist of authorized projects
Expands Advanced Search to return matching results from both merge request descriptions and comments
Adds support for the AGENTS.md specification in GitLab Duo Chat (Agentic) in IDEs
Pins AI agents and flows from the AI Catalog to a specific version when enabled in a project
Adds an AI gateway timeout setting configurable from 60 to 600 seconds for self-hosted models
Allows reporting of agents and flows to instance administrators via an abuse report mechanism
Enables configuring foundational agent availability by turning them on/off or toggling individual agents
Enhances active trial experience for Self-Managed users with status, remaining days, and expiration notifications in the left sidebar
Adds grouping data by OWASP 2021 categories to the vulnerability report
Adds filtering by vulnerability identifier, reachability value, and policy violation bypass reason to the vulnerability report
Introduces a Data Analyst foundational agent powered by GLQL in beta
Adds filtering by status, project, and control to compliance violations reports, plus collaboration via comments
Changes compliance framework controls to show scan success/failure based solely on scan completion rather than overall pipeline status
Adds warn mode to merge request approval policies allowing non-blocking bot comments during policy rollout
Enables using the API to query a filtered list of policy violations on the default branch in a project
Makes service accounts available during trials on GitLab.com for Silver and Gold tiers
Configures task scaler reservation throttling in GitLab Runner 18.7
Enables FF_TIMESTAMPS by default in GitLab Runner 18.7
Adds Windows 11 2025 (25H2) support in GitLab Runner 18.7

32 details in Everything

└──▷ BREAKING ON UPGRADE

!Compliance framework controls now show scan success/failure based solely on scan completion, which may differ from the previous reliance on overall pipeline status.

18.6 Nov 20, 2025 · release notes

GitLab 18.6 adds exact code search (Zoekt), dynamic needs:matrix expressions, GitLab MCP server beta, and warn mode for approval policies.

Adds exact code search capability built on the open-source Zoekt engine, supporting exact match and regular expression modes across instances, groups, or projects
Introduces the $[[matrix.VARIABLE]] expression in Beta to create dynamic dependencies within needs:[parallel:matrix] configurations
Makes the GitLab Security Analyst Agent available by default as a foundational agent in GitLab Duo Agentic Chat
Adds the ability to select AI models (Claude, GPT, etc.) from a dropdown in the GitLab Duo Chat panel for VS Code and JetBrains IDEs
Unveils spec:component keyword allowing CI/CD components to reference their own metadata like version numbers or commit SHAs

+6 more show less

Brings the GitLab MCP server into Beta, enabling AI assistants to interact with projects, issues, MRs, and pipelines via MCP protocol
Adds a warn enforcement option in merge request approval policies (Beta) to generate bot comments without blocking merges
Introduces system and system_action fields in webhook payloads for merge requests to distinguish system-initiated approval resets from manual actions
Adds re_requested attribute in reviewer data within MR webhook payloads to identify which specific reviewer was re-requested
Eliminates the 1,000 chart limit in the Helm chart registry by pre-computing metadata responses stored in object storage
Allows Code Owners configurations to recognize groups with inherited access from parent group membership as valid approvers

11 details in Everything

18.5 Oct 16, 2025 · release notes

GitLab 18.5 adds Maven virtual registry UI, instance-wide security policy groups, C/C++ Advanced SAST, and GPT-5 support

security_report_time_window parameter allows specifying a time window for merge request approval policies to use older baseline security reports
Ping enabled setting on external controls disables automatic status updates from external systems
Instance-wide compliance and security policy groups enable centralized management of frameworks and policies across all top-level groups on Self-Managed/Dedicated instances
Maven virtual registry management now available via a web-based interface in beta, replacing API-only access for routine maintenance
C/C++ support added to Advanced SAST as a beta feature for cross-file and cross-function scanning

+9 more show less

secret.validity_checks feature in beta displays the active status of detected GitLab secrets to aid triage
GPT-5 is available as a model option for GitLab Duo Agentic Chat, configurable by Owners/Admins
Customizable detection logic for Advanced SAST allows creating custom security rules tailored to organization requirements
Advanced SAST diff-based scanning in merge requests analyzes only code changes to reduce scan times
Dependency scanning template Jobs/Dependency-Scanning.v2.gitlab-ci.yml is released for generating component vulnerability reports
environment:deployment_tier field now supports CI/CD variable expansion for dynamic configuration
Status lifecycles can be configured independently for issues and tasks, allowing distinct workflows per work item type
GitLab Duo Agent Platform is available in beta for Self-Hosted instances, supporting Anthropic Claude, OpenAI GPT, and compatible models
Mistral Codestral is supported for GitLab Duo Chat (Classic) on Self-Managed instances

14 details in Everything

18.4 Sep 18, 2025 · release notes

GitLab 18.4 adds CI/CD job token push auth, OCS severity thresholds, OpenTofu OCI templates, and agentic Duo controls.

[ci_push_repository_for_job_token_allowed] API parameter enables CI/CD job tokens to authenticate Git push requests
severity_threshold config key in Operational Container Scanning filters vulnerability reports by severity level
provider-release and module-release CI/CD templates with type: oci support for publishing OpenTofu modules/providers to the container registry
Group/Application settings allow automatic Duo Code Review for multiple projects simultaneously
GitLab Knowledge Graph beta CLI parses local repositories into an MCP-connected embeddable graph database

5 details in Everything

18.3 Aug 21, 2025 · release notes

GitLab 18.3 adds Duo Agent Platform in VS, GLQL embedded views, direct transfer migration, fine-grained job tokens, custom MR review instructions, AWS Secrets Manager integra

└──▷ TRY IT

List all OpenTofu state versions managed by GitLab for a specific project.

$ glab opentofu state list

glab opentofu state list subcommand added to GitLab CLI for managing managed state backends
glab opentofu state download subcommand added to GitLab CLI for downloading specific state versions
glab opentofu state delete subcommand added to GitLab CLI for deleting entire or versioned state
glab opentofu state lock subcommand added to GitLab CLI for locking managed state
glab opentofu state unlock subcommand added to GitLab CLI for unlocking managed state

+10 more show less

New .GitLab/duo/mr-review-instructions.YAML file format allows custom instructions for Duo Code Review
DS_FF_LINK_COMPONENTS_TO_GIT_FILES=true environment variable enables linking dependency scanning results to source files
DAST_FF_DIAGNOSTIC_JOB_OUTPUT: "true" config key overrides concise DAST job output with detailed diagnostics
GitLab REST API spp_repository_pipeline_access field added to PUT requests for enabling/disabling pipeline execution policies via API
SessionNotOnOrAfter SAML attribute support allows GitLab to automatically expire sessions based on IdP settings
New UI setting in Admin area allows administrators to set path-based URLs as the default for new GitLab Pages sites instead of unique domain URLs
Instance-level compliance frameworks and security policies can now be created in a top-level group and enforced across all other groups (Beta)
Scan execution policy templates (Merge request, Scheduled, Release) added to accelerate creation of security scan policies
New audit event types security_policy_create, security_policy_delete, security_policy_update, etc. provide comprehensive auditing for security policies
Service accounts and access tokens can now be designated as exceptions in approval policies to bypass merge request approval requirements

15 details in Everything

18.2 Jul 17, 2025 · release notes

GitLab 18.2 adds AWS Secrets Manager/SSM in CI, Duo Agent IDE platform, immutable container tags, Security Inventory beta, and GLQL sorting

Adds aws_secrets_manager and aws_ssm_parameter_store support as new secret sources in GitLab CI/CD configuration to enable native AWS secret retrieval without third-party tools
Introduces the Duo Agent Platform beta for VS Code and JetBrains IDEs, bringing agentic chat and agent flows directly into the editor with Model Context Protocol (MCP) support
Enables immutable container tags (Beta) in the next-generation container registry to protect critical image tags from modification after creation using up to 5 RE2 regex protection rules per project
Adds Security Inventory beta for Ultimate tier users to provide a centralized view of security posture, coverage gaps, and configuration status across all projects and groups
Adds TRIVY_PLATFORM environment variable support in Container Scanning to allow scanning multi-architecture container images on Linux Arm64 runners without emulation

+11 more show less

Enables TOTP MFA support in DAST scans for comprehensive security testing of applications requiring time-based one-time passwords
Allows administrators to toggle audit streams as active or inactive via the UI to temporarily deactivate streaming to destinations like AWS and GCP
Adds filter functionality for all audit streaming destinations including by event type, groups, and projects through the UI
Adds new GLQL sorting and pagination capabilities for views, allowing sort by due dates, health status, and popularity with a Load more system
Introduces [work_item:<id>] syntax in GitLab Flavored Markdown for unified referencing of issues, epics, and work items including cross-project references
Adds initialDetectedPipeline and latestDetectedPipeline fields to the Vulnerability GraphQL API to retrieve commit information when vulnerabilities were introduced and last detected
Enables pattern-based branch exceptions in merge request approval policies (configurable via UI or policy.yml) to bypass requirements for specific source-target branch combinations like release/* to main
Shows dependency paths in vulnerability details and project/group dependency lists to distinguish between direct and transitive library imports
Adds service account tokens to the credentials inventory for better visibility into authentication methods across the software supply chain
Allows Mistral Small model usage on GitLab Duo Self-Hosted as the first fully compatible open source model for Duo Chat and Code Suggestions
Introduces custom admin roles in beta for GitLab Self-Managed instances to grant granular permissions in the Admin Area without full root access

16 details in Everything

18.1 Jun 19, 2025 · release notes

GitLab 18.1 introduces Maven virtual registry beta, new GraphQL filter, SLSA compliance components, and PHP SAST support.

Adds Maven virtual registry in beta for aggregating upstream repositories behind a single endpoint
Adds accessLevels argument to projectMembers field in GraphQL API
Enables SLSA Level 1 compliance via new CI/CD components wrapping Sigstore Cosign
Adds PHP support to Advanced SAST
Adds variables_override configuration option for pipeline execution policies

5 details in Everything

18.0 May 15, 2025 · release notes

GitLab 18.0 adds Duo AI features, MR pipeline AST control, granular job token permissions, GLQL operators, and shared Kubernetes workspaces.

└──▷ USE IT

Force security scanners to run only in MR pipelines for Stable template users who want real-time feedback.

text

AST_ENABLE_MR_PIPELINES: "true"

AST_ENABLE_MR_PIPELINES CI/CD variable controls whether Security scanners run in merge request pipelines instead of branch pipelines
active REST API parameter for Groups and Projects endpoints filters by archived status (true for active, false for archived)
shared_namespace agent config field enables GitLab Workspaces to use a shared Kubernetes namespace
Granular permissions for job tokens beta allows fine-grained resource access control in CI/CD workflows
GitLab Query Language views add >=, <= operators for date types and support for view actions like Reload

+1 more show less

License approval policies now support package exceptions using PURL format (e.g., pkg:npm/@angular/animation@12.3.1)

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Support for PostgreSQL 14 and 15 has been removed; upgrade to PostgreSQL 16 before upgrading GitLab chart 9.0
!Bundled Prometheus chart updated from 15.3 to 27.11 and Prometheus version from 2.38 to 3.0; manual migration steps required for Alertmanager, Node Exporter, or Pushgateway
!Default NGINX controller image updated from 1.3.1 to 1.11.2; custom NGINX RBAC rules must be updated to match new defaults

17.11 Apr 17, 2025 · release notes

GitLab 17.11 adds protected container/Maven tags, static reachability for Python, CycloneDX SBOM exports, and new Duo AI models/features.

└──▷ USE IT

Configure DAST to exclude reflected XSS checks if they generate too many false positives.

config

DAST_FF_XSS_ATTACK: false

Introduces protected container tags feature with up to five protection rules using RE2 regex patterns (e.g., latest, v1.0.0) to restrict push/delete operations to Maintainer/Owner/Administrator roles.
Adds support for protected Maven packages via protection rules that restrict who can push new versions of a package, preventing accidental overwrites.
Enables static reachability in beta for Python projects, enriching SCA results by scanning source code to identify which open-source dependencies are actually used.
Introduces DAST check for CWE-79 (reflected XSS) which is enabled by default; can be disabled by setting DAST_FF_XSS_ATTACK: false in configuration.
Allows exporting the project dependency list as a CycloneDX SBOM via the UI (Export > Export as CycloneDX (JSON)).

+24 more show less

Replaces the single tool filter in vulnerability reports with separate scanner and report type filters for more granular search results.
Enables storing and filtering CI/CD jobs by a new source value (scan execution policy, pipeline execution policy, or regular pipeline) accessible via UI, Jobs API, or ID token claims (job_source, job_policy_ref_uri, job_policy_ref_sha).
Adds GLQL field lastComment to display the last comment on an issue or merge request as a column in views.
Introduces CI/CD pipeline inputs as a safer alternative to pipeline variables for injecting dynamic content at runtime; allows disabling pipeline variable access.
Provides UI navigation steps to create and manage service accounts via a dedicated Service Accounts UI section, previously API-only.
Makes GitLab Eclipse plugin available in beta via the Eclipse Marketplace for Duo Chat and AI-powered code suggestions.
Expands GitLab Duo Self-Hosted with Root Cause Analysis, Vulnerability Explanation/Resolution, AI Impact Dashboard, and other features in beta.
Launches extension marketplace for Web IDE on self-managed instances, using Open VSX registry by default or configurable to a custom registry via settings.
Makes GitLab Duo with Amazon Q generally available, integrating autonomous AI agents for code generation (/q dev), Java modernization (/q transform), reviews (/q review), and testing (/q test).
Adds support for Anthropic Claude Sonnet 3.7 as the base model for GitLab Duo Chat, replacing Claude 3.5 Sonnet.
Allows selecting and configuring individual supported AI models for each GitLab Duo feature on Self-Hosted instances.
Makes Llama 3 models generally available for GitLab Duo Chat and Code Suggestions on Self-Hosted instances.
Enables managing multiple conversations in GitLab Duo Chat on Self-Managed web UI, with 30-day auto-delete policy and admin-configurable retention.
Adds inputs support to modify pipeline behavior safely, replacing risky injection of pipeline variables.
Expands custom compliance framework capabilities with requirements and over 50 out-of-the-box compliance controls mapped to standards like SOC2, NIST, ISO 27001.
Allows mapping custom framework requirements to external controls outside GitLab for single-source truth monitoring.
Enables assigning multiple projects to a new compliance framework during creation in the UI.
Adds support for Kubernetes version 1.32.
Adds Docker Hub authentication UI configuration for the Dependency Proxy in group settings, replacing prior GraphQL-only setup.
Allows setting Work in Progress (WIP) limits by weight in addition to issue count on boards.
Enhances access token management with sorting options by expiration date and last used date (ascending/descending).
Adds a statistics dashboard to Service Account token management showing active, expiring, revoked, and expired token counts.
Allows automatic Duo Pro/Enterprise seat assignment for users synced via SAML Group Sync.
Introduces new issue look with drawer view, start date support, quick action commands (/set_parent, /remove_parent, /add_child, /remove_child), and unified development items list.

29 details in Everything

17.10 Mar 20, 2025 · release notes

GitLab 17.10 adds Duo Code Review beta, GLQL views, vulnerability severity changes, and new APIs for token management.

└──▷ HOW TO FIND IT

Trigger AI-powered code review on a merge request using the new beta capability.

📍@GitLabDuo

@GitLabDuo mentioned as a reviewer or in comments to trigger Duo Code Review beta on merge requests (Ultimate tier)
Create GLQL views by embedding live data queries in Markdown code blocks across Wiki pages, epics, and issues
Manually change vulnerability severity (Critical/High/Medium/Low/Info/Unknown) for individual or bulk occurrences in the vulnerability report
id_token_expiration config attribute to configure duration of ID tokens when GitLab acts as an OIDC provider
Webhook triggers 60 and 30 days before access token expiry via extended webhook settings

+5 more show less

/api/v4/token-information API endpoint for unified identification and revocation of all token types by administrators
Set a default compliance framework from the dropdown list on the Frameworks page in the compliance center for top-level groups
Toggle blame view to show or hide revisions listed in .git-blame-ignore-revs via the Blame preferences dropdown
Configure path exclusions in CODEOWNERS files to ignore specific paths requiring Code Owner approval
Configurable squash settings for each protected branch through branch rules

10 details in Everything

└──▷ BREAKING ON UPGRADE

!The Default project creation protection dropdown is renamed to Minimum role required for project creation
!The Developers + Maintainers dropdown option for project creation permissions is renamed to Developers

17.9 Feb 20, 2025 · release notes

GitLab 17.9 adds self-hosted Duo models, parallel Pages sites, DAST UI config, composite identity, and multiple security filters.

Adds self-hosted Large Language Model support for GitLab Duo Code Suggestions and Chat via the Duo Enterprise add-on
Enables parallel deployments for GitLab Pages sites with unique prefix-based URLs and customizable expiry
Allows configuring DAST scans through the UI with granular crawl, auth, and timeout controls instead of pipeline-only config
Introduces composite identity tokens allowing AI agents to authenticate as both a service account and the initiating user simultaneously
Enables project-level application and removal of compliance frameworks via the project's compliance center

+19 more show less

Adds FluxCD CI/CD component support for packaging Kubernetes manifests into OCI images
Introduces inject_policy strategy for pipeline execution policies to enforce custom stages with DAG merging
Adds self_rotate scope for access tokens allowing rotation without a separate request for new token generation
Adds project-level Dependency Scanning using SBOM analyzer for Cargo, Conda, Cocoapods, and Swift projects via Dependency-Scanning.latest.gitlab-ci.yml
Enables multi-core Advanced SAST scanning by setting SAST_SCANNER_ALLOWED_CLI_OPTS to --multi-core N
Adds EPSS, KEV, and CVSS data fields to Vulnerability Report and Vulnerability Details for risk prioritization
Adds ability to block deletion of active security policy projects linked to groups or projects
Extends Merge Request Approval Policies to allow custom roles as approvers
Adds search and filter capabilities to the Credentials Inventory, including expiration windows
Generates User authorized an OAuth application audit events when users authorize OAuth applications
Allows viewing inactive project and group access tokens for 30 days post-expiry/revocation
Displays up to the last seven IP addresses used by personal access tokens in the UI
Adds ability to restrict GitLab Pages access at the group level via a single setting
Extends Work Items GraphQL API with filters for created/updated/closed/due dates, health status, and weight
Allows changing work item type in place and keeping the child creation form open after submission
Adds custom expiration date (expires_at) support when rotating service account tokens
Supports CI_MERGE_REQUEST_SOURCE_BRANCH_SHA, CI_MERGE_REQUEST_TARGET_BRANCH_SHA, and CI_MERGE_REQUEST_DIFF_BASE_SHA in pipeline execution policies
Adds Read compliance dashboard permission for custom roles
Allows filtering project Vulnerability Report by vulnerability identifier (CVE/CWE) with a 20,000 record limit

24 details in Everything

└──▷ BREAKING ON UPGRADE

!The inject_ci mode for pipeline execution policies is deprecated; inject_policy replaces it as the new strategy
!GitLab Composer (Gemnasium) analyzer will reach end of support in GitLab 18.0 and be removed after GitLab 19.0

17.7 Dec 19, 2024 · release notes

GitLab 17.7 adds Planner role, KEV support in Advanced SAST, new access token rotation UI, and group-level secret push protection via API.

Introduces the Planner user role for Agile planning tools like epics, roadmaps, and Kanban boards
Adds an instance-wide integration allowlist controlled by administrators to restrict which integrations can be enabled
New Vulnerability Management policy type with an Auto-resolve option for vulnerabilities no longer detected in scans
Enables rotation of personal, project, and group access tokens directly in the UI instead of requiring the API
Adds a GraphQL query to track CI/CD component usage across projects within pipelines

+14 more show less

Provides small hosted runners on Linux Arm for all tiers on GitLab.com
Adds support for the Known Exploited Vulnerabilities (KEV) Catalog in composition analysis via GraphQL
Expands the Advanced SAST code flow view to be available in the Vulnerability Report, Merge request security widget, Pipeline security report, and Merge request changes view
Adds /help command in GitLab Duo Chat to explore features
Resets auto_stop_in timer for environment.action: prepare and environment.action: access jobs starting in 18.0 (via prevent_blocking_non_deployment_jobs feature flag)
Adds full support for Kubernetes version 1.31
Allows setting namespace and Flux resource path directly from CI/CD job using environment.kubernetes.namespace and environment.kubernetes.flux_resource_path attributes
Includes group and project access tokens in the credentials inventory on GitLab.com
Sends token expiration email notifications 30 and 60 days before expiry (in addition to the existing 7-day notification)
Adds Unicode 15.1 emoji support
Allows setting a default text editor (rich text, plain text, or none) in user settings
Adds an optional description field for personal, project, group, and impersonation access tokens
Enables enabling secret push protection on all projects in a group via REST API and GraphQL API
Adds a new API endpoint to list enterprise users for Group Owners

19 details in Everything

17.6 Nov 21, 2024 · release notes

GitLab 17.6 adds scheduled merges, self-hosted AI models, agent selection in CI, and EPSS scoring.

Adds merge_after date field to merge requests to schedule future merges
Adds --helm-release-values and --helm-release-values-from flags to glab cluster agent bootstrap for custom Helm values
Adds environment.kubernetes.agent syntax to select a GitLab agent in CI/CD jobs
Enables self-hosted large language models as the source for GitLab Duo Chat and Code Suggestions on self-managed instances
Adds support for private container registries in workspaces via image pull secrets

+30 more show less

Makes the extension marketplace available in workplaces (disabled by default)
Displays release notes on deployment details page for tag-triggered pipelines
Adds admin setting to enforce CI/CD job token allowlist on self-managed instances
Adds authentication log for tracking CI/CD job token authentications, downloadable as CSV
Adds vulnerability report grouping in Ultimate tier
Makes Model registry generally available with MLflow client integration and GitLab API support
Adds Switchboard capabilities for outbound private links and private hosted zones for GitLab Dedicated tenants
Adds adherence checks for SAST and DAST in the Compliance Centre
Adds project events to group webhooks for creation and deletion events
Adds filtering by assigned seat on GitLab Duo seat assignment page
Adds duo_seat_assignment_email_for_sm feature flag to disable Duo seat assignment emails
Adds EPSS support for prioritizing vulnerabilities via GraphQL in Ultimate tier
Updates application settings REST API to enable Secret Push Protection programmatically
Adds audit events for secret push protection exclusions
Automates Repository X-Ray background jobs on default branch commits
Adds advanced proxy authentication for corporate network support in GitLab Duo plugins
Adds merge_request_merged audit event type with detailed merge information
Allows disabling OTP and WebAuthn devices independently
Adds new token information API endpoint for admin retrieval of token data
Adds city and country location info to sign-in emails from new locations
Adds approval_settings.block_group_branch_modification property to prevent group branch modification overrides
Adds optional setting for top-level group Owners to create service accounts
Adds badge to service accounts in users list
Allows using pages attribute in any CI/CD job instead of naming a job pages
Adds aiMetrics GraphQL API for GitLab Duo Pro Impact Analytics
Adds toggle to hide closed items in linked/child item lists
Adds GraphQL API for per-user Duo Enterprise usage metrics
Adds support for license data from CycloneDX SBOMs in License Scanner
Adds macos-15-xcode-16 job image for macOS Sequoia 15 and Xcode 16
Makes JaCoCo test coverage visualization generally available in merge request diff view

35 details in Everything

17.5 Oct 17, 2024 · release notes

GitLab 17.5 adds Duo Quick Chat, self-hosted LLM for code suggestions, GraphQL export of AI events, enhanced branch rules, and more.

Adds Duo Quick Chat, an in-editor AI chat interface that provides real-time assistance on the lines being edited without leaving the code context.
Enables self-hosted large language models for GitLab Duo Code Suggestions by configuring models hosted on-premise or in a private cloud, currently supporting open-source Mistral models on vLLM or AWS Bedrock.
Adds export of raw code suggestion usage events via the GraphQL API to allow deeper analysis of acceptance rates by dimensions such as suggestion size, language, and user.
Enables conversation with GitLab Duo Chat about a specific merge request directly from the MR interface for reviewers and authors.
Adds direct editing of branch rules (protections, approval rules, status checks) in the consolidated branch settings view.

+19 more show less

Introduces Tenant Overview page in Switchboard for GitLab Dedicated instances to view instance version, URL, and maintenance windows.
Makes Secret Push Protection generally available for Ultimate customers, with diff-only scanning for CLI pushes and experimental support for excluding paths or values to reduce false positives.
Brings Credentials Inventory to top-level group Owners on GitLab.com for viewing and revoking personal access tokens and SSH keys across the group.
Adds a component filter to the Dependency List view to quickly isolate specific dependency components and assess open risks.
Introduces glab cluster agent bootstrap CLI command to simplify installing the Kubernetes agent on top of an existing Flux installation.
Allows GitLab to initiate the connection to the Kubernetes cluster for the agent, enabling use behind firewalled GitLab installations where the cluster cannot reach GitLab directly.
Enables streaming of real-time Kubernetes resource events in the dashboard instead of static listing.
Adds ability to suspend or resume Flux reconciliation directly from the GitLab UI dashboard.
Provides an improved user management summary for administrators showing pending approvals, users without 2FA, and administrators.
Extends security policy scope to include groups/subgroups for targeted enforcement.
Allows Group Owners on GitLab.com to disable password authentication for enterprise users, enforcing SAML or token-based auth.
Brings Access compliance center view-only capabilities to projects, not just top-level groups.
Adds a guided migration workflow and warning banner to help move from deprecated compliance pipelines to pipeline execution policies.
Allows viewing group, subgroup, and project associations for a token via the API.
Implements selective SAML single sign-on enforcement, allowing non-SAML identities to access groups with SSO enabled unless explicitly enforced.
Adds keyset pagination to the Container Registry tags endpoint /id/registry/repositories/:repository_id/tags for self-managed instances.
Introduces support for protected npm packages in GitLab.com Package Registry to prevent accidental modification or deletion by specified users.
Adds Ruby support to GitLab Advanced SAST for cross-file, cross-function scanning.
Updates Advanced SAST detection rules to identify additional Java path traversal, Java command injection, and JavaScript path traversal vulnerabilities.

24 details in Everything

└──▷ BREAKING ON UPGRADE

!GitLab chart includes nginx-controller v1.11.2 which requires an RBAC rule to access endpointslices.

17.4 Sep 19, 2024 · release notes

GitLab 17.4 adds Advanced SAST, JaCoCo coverage, CycloneDX 1.6 SBOM support, and new API endpoints for groups/projects members and webhook management.

Introduces Advanced SAST scanning engine powered by Oxeye technology with a new code-flow view for tracing vulnerabilities across files and functions
Adds ability to search projects by multiple compliance frameworks simultaneously in the UI
Adds JaCoCo coverage report visualization for merge requests as a beta feature
Adds detection of Anthropic API keys in both pipeline and client-side Secret Detection
Adds allowed_email_domains_list attribute to the Groups API to restrict group access by domain programmatically

+12 more show less

Adds new endpoints to the Groups API and Projects API to retrieve groups invited to a group or project
Adds suffix configuration option to policy.yml for pipeline execution policies to handle job name collisions (on_conflict or never)
Adds Grant access to this repository for projects linked to it as the security policy project source for security policies toggle in Settings > General > Visibility, project features, permissions
Adds new Masked and hidden visibility option for CI/CD variables to permanently mask values in the UI
Adds support for triggering a Flux reconciliation directly from the Kubernetes dashboard using the Flux status badge
Adds optional token expiration enforcement for personal, project, and group access tokens via administrator settings
Adds Idempotency-Key header support for webhook requests to allow clients to detect retries
Adds API endpoints to resend failed project and group webhook requests programmatically
Adds an official Code intelligence CI/CD component supporting Go 1.21+, TypeScript, and JavaScript
Adds the ability to trigger auto-merge for merge requests when all required checks pass via the UI
Enables GitLab Duo Code Suggestions to use content from open editor tabs for context-aware recommendations
Adds an extension marketplace in the Web IDE on GitLab.com, enabled via user preferences > Integrations

17 details in Everything

17.3 Aug 15, 2024 · release notes

GitLab 17.3 adds root cause analysis for failed jobs, multiple compliance frameworks, and new Kubernetes and security capabilities

Adds general availability of root cause analysis for troubleshooting failed CI/CD jobs using AI-powered log analysis.
Adds ability to run a health check for GitLab Duo setup in the Admin area's GitLab Duo page as a beta feature.
Adds Delete pod action directly from the Kubernetes dashboard UI within GitLab.
Adds connect command generation via the Kubernetes dashboard or agent list for terminal access to clusters.
Enables resolving SAST vulnerabilities with AI code suggestions and opening a merge request directly from the CWE support list.

+30 more show less

Allows applying multiple compliance frameworks to a single project, removing the previous one-framework limit.
Adds Code Suggestions acceptance rate and GitLab Duo seats assigned and used metrics to the Value Streams Dashboard AI Impact analytics.
Supports Raspberry Pi OS 12 packages for GitLab Self-Managed installations.
Adds Index the instance setting in advanced search configuration to perform full initial indexing or re-indexing with functional parity to the gitlab:elastic:index rake task.
Adds use_inherited_settings parameter to the REST API of all integrations to toggle inheritance via API.
Exposes group and project webhook event history (past 7 days) via the REST API.
Enables searching for group settings via the command palette using > mode on a group page.
Adds granular control to enable or disable code suggestions for specific programming languages in VS Code.
Allows configuring custom HTTP agent options, including client certificates and CAs, directly in JetBrains IDE settings.
Adds repository maintenance option in project settings to remove blobs by object ID list and redact text (replaced with ***REMOVED***).
Introduces audit events: cluster_agent_created, cluster_agent_create_failed, cluster_agent_deleted, and cluster_agent_delete_failed.
Adds full support for Kubernetes version 1.30.
Allows configuring HMAC authentication with SHA256 signature in the X-Gitlab-Signature header for merge request external status checks.
Enables filtering the Member list by role in group or project settings.
Allows viewing custom role permissions in the right drawer of the Members page for any user.
Extends LDAP group link support to custom roles for permission mapping.
Adds Read Runners permission type available for creating custom roles.
Adds ability to disable or re-enable instance personal access tokens via the Admin UI.
Supports adding Bluesky did:plc identifier to user profiles.
Preserves subdomain cookies on sign out, preventing cross-service sign-outs on sibling subdomains.
Enhances AI Impact analytics with sparklines trend visualization in data tables.
Allows connecting merge requests to tasks using closing patterns and auto-closing the task upon MR merge.
Enables setting parent items for OKRs and tasks directly from child records.
Adds report abuse functionality for tasks, objectives, and key results via the Actions menu.
Allows resolving threads in tasks, objectives, and key results.
Adds MR first reviewer assigned stage event to Value Stream Analytics for Cycle Time Reduction tracking.
Adds Rust support for Dependency and License Scanning via Cargo.lock file type and cargo CI/CD template.
Displays SBOM ingestion validation errors in the project-level Vulnerability Report, Dependency List, and Pipeline Security tabs.
Adds SECURE_ENABLE_LOCAL_CONFIGURATION CI/CD variable (default true) to enforce shared rulesets by disabling local configuration preference in SAST, IaC, and Secret Detection.
Adds filtering jobs by job name in the pipeline view.

35 details in Everything

16.4.6 Jul 23, 2024 · release notes

GitLab 16.4.6 adds a Rake task to display personal access token expiration info and removes nil constraints from the PAT table.

16.0.9 Jul 23, 2024 · release notes

GitLab 16.0.9 adds a Rake task and UI banner for Personal Access Token expiration monitoring.

Adds gitlab:tokens:show_expiration Rake task to display token expiration info directly in the command line interface
Adds a new UI banner that appears in the console to inform users about expiring tokens

2 details in Everything

16.1.7 Jul 23, 2024 · release notes

Adds a Rake task to display Personal Access Token expiration details and a UI banner for expiry warnings.

Adds the gitlab:tokens:expiry Rake task to show token expiration info
Adds a UI banner that informs users about their Personal Access Token (PAT) expiration

2 details in Everything

16.10.9 Jul 23, 2024 · release notes

GitLab 16.10.9 adds a Rake task to show token expiration info

16.11.7 Jul 23, 2024 · release notes

GitLab 16.11.7 adds a Rake task to display token expiration details

16.3.8 Jul 23, 2024 · release notes

New Rake task to inspect token expiration info and a UI banner for expiry awareness.

Adds the gitlab:auth:show_token_expiration Rake task to display token expiration details
Adds a UI banner that informs users about upcoming personal access token (PAT) expiration

2 details in Everything

16.5.9 Jul 23, 2024 · release notes

GitLab 16.5.9 adds a Rake task to show Personal Access Token expiration info and a UI banner for expiry warnings.

Adds gitlab:tokens:expirations Rake task to query token expiration details
Adds a banner in the user interface to inform users about Personal Access Token (PAT) expiration

2 details in Everything

16.6.9 Jul 23, 2024 · release notes

GitLab 16.6.9 adds a Rake task to display personal access token expiration details.

16.7.9 Jul 23, 2024 · release notes

GitLab 16.7.9 adds a Rake task to inspect Personal Access Token expiration details

16.9.10 Jul 23, 2024 · release notes

GitLab 16.9.10 adds a new Rake task to inspect Personal Access Token expiration details.

Adds gitlab-tokens:expire Rake task to display token expiration information

1 detail in Everything

17.2 Jul 18, 2024 · release notes

GitLab 17.2 adds log streaming for K8s pods, pipeline execution policies, DAST checks, and more

Log streaming for Kubernetes pods allows viewing pod/container logs directly in the GitLab UI.
Vulnerability Explanation is now generally available in GitLab Duo Chat for SAST vulnerabilities.

2 details in Everything

17.1 Jun 20, 2024 · release notes

GitLab 17.1 introduces Secret Push Protection beta, Model Registry beta, CI/CD custom role permissions, and API Security/Fuzz Testing env vars.

Adds Secret Push Protection in beta to block commits containing detected secrets on GitLab.com and Dedicated instances.
Adds Model registry in beta as a first-class concept for storing, versioning, and discovering machine learning models via UI or MLflow.
Adds Runner fleet dashboard for groups in Ultimate tier to observe runner health and CI/CD job queue metrics.
Adds new custom role permissions: Manage merge request settings, Manage integrations, Manage deploy tokens, and Read CRM Contacts.
Adds support for configuring manual jobs to require confirmation using the manual_confirmation keyword with when: manual in CI/CD YAML.

+18 more show less

Adds markedForDeletionOn argument to GraphQL API for groups and projects to filter entities marked for deletion.
Adds User.contributedProjects field to GraphQL API to list projects a user has contributed to.
Allows adding members by username via the Members API in addition to user ID.
Adds marked_for_deletion_on filter parameter to Groups API and Projects API.
Adds ability to cancel a running direct transfer migration via REST API.
Adds ability to test group hooks via REST API, with web_hook_test_api_endpoint_rate_limit feature flag to disable rate limits.
Adds API endpoint to re-import a named relation (issues, merge requests, pipelines, milestones) from project export archives.
Allows setting custom webhook headers using the GitLab REST API.
Adds next-generation container registry in beta for self-managed instances to associate signed images with signatures and show accurate last_published_at timestamps.
Adds new placeholders %{project_namespace}, %{group_name}, %{gitlab_server}, %{gitlab_pages_domain}, and %{latest_tag} for badge links and image URLs.
Adds gitlab-backup support for backing up external merge request diffs stored on local disk.
Adds settings to disable diff previews in code review emails under groups and projects.
Enables administrators to search users by partial email address in the Admin Area User overview.
Adds Pages support for mutual TLS allowing GitLab Pages to use client certificates for API calls.
Configures API Security Testing with new environment variables: APISEC_SUCCESS_STATUS_CODES, APISEC_TARGET_CHECK_DISABLED, and APISEC_TARGET_CHECK_STATUS_CODE.
Adds Container Scanning for Registry in Ultimate tier to automatically scan container images pushed to the registry upon tag detection.
Configures Fuzz Testing with new environment variables: FUZZAPI_SUCCESS_STATUS_CODES, FUZZAPI_TARGET_CHECK_SKIP, and FUZZAPI_TARGET_CHECK_STATUS_CODE.
Adds ci_pipeline_variables_minimum_role project setting to control who can override user-defined variables in CI/CD.

23 details in Everything

17.0 May 16, 2024 · release notes

GitLab 17.0 adds custom webhook headers, Android dependency scanning, FIPS Kubernetes agent support, and instance-level custom roles.

custom_webhook_headers allows specifying custom HTTP headers for webhook payloads
Dependency Scanning now supports Android projects via the CI/CD Catalog component or template
GitLab agent for Kubernetes can be installed in FIPS mode alongside Kubernetes components
Custom roles can be created and managed at the self-managed instance level, not just group level
rules:exists CI/CD keyword accepts project and ref subkeys to control search context

+3 more show less

gitlab-ctl new command supports upgrading single-database instances to decomposed two-database mode
Value Streams Dashboard displays a new median time to merge metric
Jira integration allows entering up to 100 comma-separated Jira project keys and enables viewing via REST API

8 details in Everything

└──▷ BREAKING ON UPGRADE

!The deprecated queue selector and negate options are removed from the Sidekiq chart.
!Support for gitlab.kas.privateApi.tls.enabled and gitlab.kas.privateApi.tls.secretName is removed; use global.kas.tls.enabled and global.kas.tls.secretName instead.
!Support for a fallback to BusyBox images when you specify custom BusyBox values (global.busybox) is removed.

16.11 Apr 18, 2024 · release notes

GitLab 16.11 adds Duo Chat GA, policy scopes, custom webhook headers, exit code retries, and more

GitLab Duo Chat is now generally available for Premium and Ultimate tiers.
Adds retry:exit_codes configuration to CI/CD jobs for automatic retries based on script exit codes.
Allows up to 20 custom headers to be added to webhooks for external service authentication.
Enables security policy enforcement scoping to specific compliance frameworks or project sets.
Makes GitLab Duo Chat available in JetBrains IDEs alongside UI, Web IDE, and VS Code.

+11 more show less

Adds the artifacts:access keyword to control who can download CI/CD job artifacts.
Provides Product Analytics custom visualization designer for building dashboards via plain text or manual design.
Exposes Applications API endpoint to renew application secrets programmatically.
Configures the maximum number of import jobs (GitHub, Bitbucket) via application settings instead of hard-coded limits.
Adds webhook events for expiring group and project access tokens.
Enables testing of project hooks via the REST API instead of requiring UI interaction.
Allows the GitLab for Slack app to be configured for groups or instances rather than individual projects.
Supports workload identity federation for Google Cloud authentication without service account keys.
Adds Google Artifact Registry management feature to push and view container images from GitLab projects.
Integrates dependency scanning SBOM (CycloneDX) data into the dependency graph.
Enables dependency scanning for Yarn v4 lockfiles.

16 details in Everything

└──▷ BREAKING ON UPGRADE

!Auto DevOps build step upgrades from heroku/buildpacks:20 to heroku/builder:20, which may break pipelines relying on the deprecated image.

16.10 Mar 21, 2024 · release notes

GitLab 16.10 introduces custom webhook payloads, offloading CI traffic to Geo secondaries, and granular Duo access governance via API.

Offload CI runner traffic to Geo secondary sites for self-managed instances.
Set a custom payload template in the webhook configuration instead of using only specific JSON payloads.
Disable or enable GitLab Duo AI features for a project, group, or instance via the API.
Configure webhooks to support mutual TLS by specifying a client certificate in PEM format.
Filter group members by Enterprise users using the GraphQL API.

+3 more show less

Filter groups by visibility in the Groups REST API.
Create Service Desk tickets from the UI or API using the /convert_to_ticket quick action on an issue.
List repository tags with the new container registry API for improved performance and accurate timestamps.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Support for installing GitLab on Kubernetes 1.24 and older is removed.
!Alertmanager is upgraded to version 0.27, which removes API v1.

16.9 Feb 15, 2024 · release notes

GitLab 16.9 adds GitLab Duo Chat to Premium, auto_cancel:on_new_commit CI keyword, SSH commit signing, and REST API access to usage data.

Makes GitLab Duo Chat Beta available for Premium tier users to explain issues, generate code, and answer DevSecOps questions.
Adds the auto_cancel:on_new_commit keyword to pipeline jobs for granular control over redundant pipeline cancellation, supplementing the legacy interruptible flag.
Enables authentication and commit signing via SSH certificates on GitLab.com (Silver/Gold tiers).
Allows self-managed users to access Service Ping usage data via a new REST API endpoint instead of file downloads.
Adds REST API support to retrieve, update, or disable the GitLab for Slack app integration settings at the project level.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The Environment auto_stop_in functionality now uses the last finished pipeline instead of the last successful pipeline; this behavior is currently behind a feature flag and becomes default in 17.0.

16.8 Jan 18, 2024 · release notes

GitLab 16.8 adds static analysis in MR diffs, Google Cloud Secret Manager integration, Workspaces GA, admin 2FA enforcement, Maven proxy, and instance-level S3 audit streamin

Adds Static Analysis Findings display in the Merge request changes view drawer
Adds Google Cloud Secret Manager support for retrieving secrets in CI/CD jobs
Marks Workspaces as generally available with error handling, private project, and SSH support
Adds setting to enforce 2FA for GitLab administrators on self-managed instances
Adds Maven dependency proxy for external Java repositories in GitLab Self-Managed

+19 more show less

Adds Issue Analytics report visualization for closed issues over time
Adds DORA Performers score panel to the Value Streams Dashboard
Adds gitlab.rb command generation for GitLab Kubernetes Agent Server, Workhorse, and Exporter passwords
Enables smarter approval resets in merge requests using git-patch-id alignment
Adds file blame information view directly on the file page
Adds ability to set CPU and memory usage per workspace at the GitLab agent level
Adds full support for Kubernetes version 1.28
Adds five new custom role abilities: manage project/group access tokens, manage group members, archive project, delete project
Allows assigning a custom role as the default SAML SSO provisioned role
Adds filtering of streaming audit events by sub-group or project at the group level
Adds Instance-level audit event streaming destination to AWS S3
Adds Prevent branch modification setting to scan result policies
Adds SAML Group Sync support for mapping custom roles in SAML SSO
Enables SAML SSO authentication for merge request approval instead of password-based auth
Introduces group-level landing page for Analytics Dashboards with Value Streams Dashboard
Adds ability to view ancestor hierarchy for Tasks and Objectives/Key Results
Adds CSV export of compute minutes used by instance runners in the Runner Fleet Dashboard
Tweaks CI_MERGE_REQUEST_DESCRIPTION predefined variable to truncate at 2700 characters and adds CI_MERGE_REQUEST_DESCRIPTION_IS_TRUNCATED variable
Adds Windows 2022 support for SaaS runners using saas-windows-medium-amd64 tag

24 details in Everything

16.1.6 Jan 11, 2024 · release notes

User password reset now accepts multiple email addresses in GitLab 16.1.6.

16.3.7 Jan 11, 2024 · release notes

GitLab 16.3.7 allows password reset for multiple email addresses linked to one user account.

16.4.5 Jan 11, 2024 · release notes

GitLab 16.4.5 now accepts multiple email addresses for password resets.

16.7 Dec 21, 2023 · release notes

GitLab 16.7 adds CI/CD catalog beta, SLSA 1.0 provenance, OpenTofu support, and DAST multi-step login.

Adds artifacts:public keyword for CI/CD configuration files to control job artifact accessibility
Enables Beta release of the CI/CD catalog for searching and sharing CI/CD components in self-managed instances
Allows setting SLSA 1.0 provenance via the SLSA_PROVENANCE_SCHEMA_VERSION=v1 variable in .gitlab-ci.yml
Adds preliminary support for OpenTofu in the gitlab-terraform helper image
Enables the DAST_AFTER_LOGIN_ACTIONS variable to support multi-step login forms in DAST scans

+3 more show less

Adds a new registry list repository tags API endpoint to replace the Docker/OCI listing API on GitLab.com
Permits configuring a custom expiry date via the expires_at parameter when rotating access tokens
Enables defining network policies with egress rules in the GitLab agent for Kubernetes Workspaces

8 details in Everything

16.6 Nov 16, 2023 · release notes

GitLab 16.6 introduces Duo Chat, Runner Fleet metrics, Switchboard portal, minimal forks, and silent mode.

Adds GitLab Duo Chat in Beta for Gold tier to summarize issues, generate code, and answer DevSecOps questions within the UI
Enables Automatic claims of enterprise users when a GitLab.com user's primary email matches a verified domain
Adds Minimal forking option to create forks containing only the default branch, reducing storage and complexity
Allows Ultimate users to enforce MR approvals via scan results policies targeting Any merge request paired with role-based approvers
Makes Switchboard portal generally available for GitLab Dedicated to self-service onboarding and configuration

+22 more show less

Releases CI/CD components in Beta with an improved folder structure and integration with the experimental CI/CD catalog
Updates UI for CI/CD variable management with a new drawer supporting real-time masking validation
Introduces Runner Fleet Dashboard - Admin View (Beta) to provide metrics on runner errors, queue performance, and usage
Filters out archived projects from search results by default, with an Include archived toggle available
Masks private group names as Private for users who are not members of the shared group or project
Replaces import failure details button with a See failures link showing type, error, correlation ID, and URL for failed imports
Removes the option to fall back to the old navigation experience, enforcing the new consistent navigation for all users
Adds GitLab Silent Mode to block outbound notifications, webhooks, and mirroring for safe testing environments
Upgrades cluster UI to use Kubernetes watch API for near real-time environment and pod status updates
Extends GitLab CLI to list agent connections and generate temporary tokens for Kubernetes cluster authentication
Adds Prevent pushing and force pushing setting to scan result policies to block direct commits to protected branches
Allows exporting group-level audit events directly to AWS S3 without custom HTTP headers
Groups vulnerability report tool filter by analyzer instead of static tool types and dynamic custom scanners
Adds optional expiry dates for service account tokens, configurable via GitLab API or UI
Allows group owners to deny duplicate NuGet package uploads in the Package Registry
Enables basic HTTP authentication for uploading Maven packages to the Package Registry
Adds option in Container Scanning to exclude findings that the vendor has evaluated as not fixable
Includes CVSS Vectors in the vulnerability report export data
Adds support for SBT projects using Java 21 in Dependency and License Scanning
Enables new DAST browser-based checks (94.1-94.3, 74.1) by default, replacing previous ZAP checks
Supports macos-14-xcode-15 image for SaaS runners on macOS 14 and Xcode 15
Releases GitLab Runner 16.6 with Beta GCP Compute Engine fleeting plugin, graceful Docker shutdown, Kubernetes PVC creation, and image.entrypoint override

27 details in Everything

└──▷ BREAKING ON UPGRADE

!Removes the option to fall back to the old navigation experience for all users

16.5 Oct 22, 2023 · release notes

GitLab 16.5 adds configurable job API rate limits, DAST active checks, bulk Geo ops, instance-level audit streaming to GCP Logging, and compliance report exports.

project/:id/jobs API endpoint rate limit is now configurable via max_jobs_per_minute_per_user setting.
Instance-level audit event streaming to Google Cloud Logging destinations for Ultimate tier Self-Managed.
Bulk resync and reverify buttons added to Geo admin UI for all managed data components, removing the need for Rails console access.
DAST now enables four new active browser-based checks by default: Check 78.1 (command injection), Check 611.1 (XXE), Check 94.4 (NodeJS code injection), and Check 113.1 (CRLF injection).
/user/personal_access_tokens API endpoint added to create personal access tokens for the currently authenticated user with k8s_proxy scope.

+7 more show less

Compliance violations report can now be exported in CSV format via the UI.
Custom roles framework now supports managing group members and project access tokens permissions.
Group Owners can programmatically delete SAML or SCIM identities using new API endpoints.
Audit events now capture deployment approval and approval rule changes for protected environments.
Repository backups in cloud environments now support object storage backends (S3, GCS, Azure, MinIO) directly.
Instance administrators can configure locked user policy including unsuccessful sign-in attempt thresholds and lock duration.
Audit event streaming destinations in the UI now support toggling HTTP headers on/off individually via an Active checkbox.

12 details in Everything

└──▷ BREAKING ON UPGRADE

!Omnibus .deb packages switch from gzip to xz compression, which may result in slower unpacking times during installation.
!Mattermost deprecated Insights feature is removed and Mattermost Boards/plugins have transitioned to community support.
!GitLab SELinux policy module moves from /opt/gitlab/embedded/selinux/rhel/7/ to /opt/gitlab/embedded/selinux.

16.4 Sep 22, 2023 · release notes

GitLab 16.4 adds custom roles via API, global id_token defaults, emoji webhooks, and private registry OCS support.

Set id_tokens as a global default in .gitlab-ci.yml to apply OIDC token configuration to all jobs automatically
Enable fast_forward_merge_trains_support feature flag for fast-forward merge support in merge trains

2 details in Everything

16.3 Aug 22, 2023 · release notes

GitLab 16.3 adds SSH to Workspaces, Azure Key Vault secrets, CODEOWNERS validation, and new security scan filters

Adds new_needs_triage status filter to Security scan result policies to isolate vulnerabilities needing triage
Adds support for connecting to Workspaces via SSH from VS Code or the command line
Adds Azure Key Vault secrets manager integration for CI/CD jobs
Adds CODEOWNERS file syntax and format validation in the UI
Adds maximum decompressed file size application setting to configure import archive limits

+10 more show less

Adds color theme selection for the new navigation
Adds new_needs_triage, Age, Fix Available, and False Positive filters for security scan results
Adds security findings display in VS Code via GitLab Workflow extension
Adds needs keyword support for parallel matrix jobs in CI/CD pipelines
Adds xlarge and 2xlarge SaaS runners on Linux
Adds filtering by audit event type to instance-level audit event streams
Adds naming capability for audit event streaming destinations
Adds automatic response integration for leaked Postman API keys in Secret Detection
Exposes pipeline name via $CI_PIPELINE_NAME predefined variable
Adds UI-based configuration of on-demand DAST scans using runner tags

15 details in Everything

GitLab Security Release: 16.2.2, 16.1.3, and 16.0.8 Aug 1, 2023 · release notes

GitLab 16.2.2 enables descendant_security_scans by default and provides API endpoints to address specific vulnerabilities.

16.2 Jul 22, 2023 · release notes

GitLab 16.2 adds Keyless Signing via Cosign, PyPI import, Group-level dep lists, and audit stream filters

Adds SKIP_REPOSITORIES_PATHS environment variable to the backup Rake task for skipping specific groups or projects during backup or restore.
Enables keyless code signing with Sigstore Cosign using a short-lived OIDC token from the GitLab CI/CD pipeline.
Adds the PyPI Package Importer tool to import packages from any PyPI-compliant registry into GitLab.
Introduces Group/Sub-Group Level Dependency List feature, accessible via the group_level_dependencies feature flag.
Allows targeting Default or Protected branches in security policies using the new branch_type field.

+8 more show less

Enables Google Cloud Logging as a destination for audit event streams with project ID, client email, log ID, and private key configuration.
Adds instance-level streaming audit events capability for instance administrators to stream events from the instance level.
Adds Streaming audit event filtering UI to filter audit event types by area of GitLab without using the GraphQL API.
Allows when: never on conditional includes in CI/CD pipelines using the include keyword with rules.
Supports NuGet v2 lock files in Dependency and License Scanning alongside existing NuGet v1 support.
Makes Medium SaaS runners on Linux (4 vCPUs, 16 GB RAM) available to all tiers for faster CI/CD execution.
Adds initial push to protected branches capability with the Fully protected after initial push setting.
Adds ability to auto-delete unconfirmed users after a specified number of days via configuration.

13 details in Everything

16.1 Jun 22, 2023 · release notes

GitLab 16.1 adds service account API, project-skipping backup env var, REST job token scope endpoint, and Google Cloud secret auto-response.

Introduces the GET /service_accounts and related endpoints to manage non-human users via API-only service accounts
Adds SKIP_REPOSITORIES_PATHS environment variable to the built-in backup/restore tool to skip specific group or project paths
Adds a new REST API endpoint to configure the CI/CD job token (CI_JOB_TOKEN) scope programmatically, removing the need for GraphQL or UI only
Enables automatic response to leaked Google Cloud secrets (Service account keys, API keys, OAuth client secrets) in public projects by integrating with Google Cloud
Adds glab changelog generate command in GitLab CLI v1.30.0 to create changelogs from the shell

+2 more show less

Adds support for installing npm packages from group or subgroup sources in addition to individual project Package Registries
Adds filtering by replication status (In progress, Failed, Synced) to all components managed by the self-service framework in Geo

7 details in Everything

└──▷ BREAKING ON UPGRADE

!The default CI/CD job token (CI_JOB_TOKEN) scope changed for all new projects starting in GitLab 16.0, requiring automation to explicitly configure the scope

16.0 May 22, 2023 · release notes

GitLab 16.0 adds token rotation API, OAST in DAST, CI/CD components, Scala scanning, and more.

Adds :rotate API endpoint to programatically rotate personal, group, and project access tokens
Enables out-of-band Application Security Testing (OAST) by extending the browser-based DAST analyzer configuration to enable callback attacks
Introduces CI/CD components as an experimental feature for reusable pipeline building blocks
Adds Semgrep-based Scala scanning in SAST, replacing SpotBugs for faster coverage
Allows per-cache fallback cache keys in CI/CD pipelines, supporting up to 5 keys per job

+13 more show less

Adds GitHub repository collaborators as an importable item during migration
Enables filtering GitHub repositories to import by Owner, Collaborator, or Organization tabs
Supports downloading Maven packages using Scala (sbt) from the Package Registry
Adds BAS.latest.GitLab-ci.yml template for Breach and Attack Simulation CI/CD jobs
Allows creating instance runners, group runners, and project runners in the UI as a user
Adds POST /user/runners REST API endpoint to automate runner creation
Extends Value Stream Analytics with issue first assigned and 'merge request first assigned' stage events
Enables adding or removing compliance frameworks directly from the report table row
Adds a filter by target branch name in the compliance violations report using the Search target branch field
Supports role-based approval actions for scan result policies (Owners, Maintainers, Developers)
Allows users to opt-in to the new navigation experience via the New navigation toggle in avatar settings
Disables older telemetry endpoints for Consul and updates to newer versions
Adds packages for Red Hat Enterprise Linux (RHEL) 9 in Omnibus GitLab

18 details in Everything

└──▷ BREAKING ON UPGRADE

!PostgreSQL 12 is no longer supported; the minimum required version is PostgreSQL 13
!Bundled Grafana chart has been removed; users must switch to a newer chart version from Grafana Labs or a Grafana Operator
!Minimum supported Helm version is now 3.5.2

15.11.0 Apr 21, 2023 · release notes

GitLab 15.11 introduces Secret Detection in issue descriptions and replies, SNOWPAUL integration, PNPM support, and new GraphQL mutations for AI and work items.

Add support for PNPM in the Dependency API and package registry
Expose unified approvals via GraphQL with role_approvers field

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Deprecated Project.ci_config_variables sha arg in favor of ref arg
!Removed PipelinesController#config_variables endpoint

15.10.0 Mar 21, 2023 · release notes

GitLab 15.10 adds Squash TM integration, GitHub repo counts API, and block-all-requests capability.

github_repo_counts endpoint returns repository counts for GitHub imports
Squash TM integration allows linking GitLab with Squash TM test management tool
Duo authentication support enables Duo 2FA for user login workflows

3 details in Everything

15.9.0 Feb 21, 2023 · release notes

GitLab 15.9 adds groups GraphQL query, deploy_key_id to protected tags, and automated PAT revocation.

PUT /[groups|projects]/:id/members/:user_id with member_role_id

1 detail in Everything

15.8.3 Feb 15, 2023 · release notes

GitLab 15.8.3 adds proper API support for Upgrade Alert notifications

15.8.0 Jan 20, 2023 · release notes

GitLab 15.8 adds instance-level SCIM management, GraphQL user email exposure, migrate_projects bulk import flag, and GitLab Shell IP/user rate limiting.

Adds GET endpoints for instance-level SCIM (/api/v4/scim) to list users and groups
Adds POST/PUT/DELETE endpoints for instance-level SCIM to create, update, and remove users and groups
Exposes user emails via GraphQL using the userEmails field on CurrentUser type
Adds migrate_projects boolean flag to bulk import configurations to control whether projects are migrated during group imports
Enables rate limiting by IP address on GitLab shell operations

+1 more show less

Enables rate limiting by user identity on GitLab shell operations

6 details in Everything

└──▷ BREAKING ON UPGRADE

!The openSUSE 15.3 package support is deprecated and planned for removal
!The projects API field operations_access_level is now marked as deprecated
!The GraphQL fields approvers and approval_group are deprecated
!Security report schema versions 14.*.* are deprecated

15.7.0 Dec 21, 2022 · release notes

GitLab 15.7 adds id_tokens CI keyword, token sub-keyword, semgrep for Scala, DAST GraphQL support, and CI_PROJECT_NAMESPACE_ID.

Adds the id_tokens CI/CD keyword to enable OIDC identity tokens in job environments
Adds the token sub-keyword inside CI/CD rules config for token-based matching
Adds support for the Semgrep static analysis engine on Scala codebases
Enables GraphQL as a supported scan method for DAST site profiles (DastSiteProfile)
Adds the CI_PROJECT_NAMESPACE_ID predefined variable to CI/CD job environments

5 details in Everything

15.6.2 Dec 5, 2022 · release notes

GitLab 15.6.2 finalizes group member namespace ID migration.

15.6.0 Nov 21, 2022 · release notes

GitLab 15.6 adds Group-level Scan Result Policies, Pull Mirror API, DAST exclusions, and bulk runner deletion

Add Merge trains GET API (GET /api/v4/merge_trains/:project_id) to GitLab Enterprise Edition for querying merge train status.
Enable DAST_API_EXCLUDE_URLS environment variable to exclude specific URLs from DAST API scans.
Add API_REQUEST_HEADERS environment variable to inject custom headers into DAST API scan requests.

3 details in Everything

15.5.0 Oct 21, 2022 · release notes

GitLab 15.5 adds new DAST pre-scan verification status and CI_JOB_NAME_SLUG variable

add_pre_scan_verification_status mutation allows admins to set a new pre-scan state for DAST site profiles before execution begins
CiJob GraphQL field browseArtifactsPath returns the artifact browsing URL directly without requiring separate API calls
New predefined CI variable CI_JOB_NAME_SLUG exposes the sanitized job name for use in pipeline scripts and configuration
REST API endpoint GET /personal_access_tokens/self retrieves details of the authenticating user's current token
reject_non_dco_commits boolean can be set in push_rules to enforce Developer Certificate of Origin signoff requirements

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed WorkItemUpdateWidgets mutation from the GraphQL API schema

15.4.0 Sep 21, 2022 · release notes

GitLab 15.4 adds RPM package support, MLflow integration endpoints, Harbor registry list/tags pages, and DORA data models.

Adds REST API endpoints for the MLFlow client Run entity to integrate MLflow with GitLab CI/CD
Adds a harbor registry list page to browse available Harbor registries
Adds a harbor registry tags page to view and manage tags within Harbor registries
Adds support for delivering emails using the Microsoft Graph API as an alternative SMTP backend
Adds basic DORA data models to track DevOps metrics

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The GraphQL field RunnerMembershipFilter is deprecated

15.3.0 Aug 19, 2022 · release notes

GitLab 15.3 adds Fortify on Demand SAST, CycloneDX SBOM support, OWASP training, and bulk deployment/package deletion via API.

Fortify on Demand SAST template available in project_sast_settings
Add cyclonedx report type for Software Bill of Materials (SBOM) generation
New CI_TEMPLATE_REGISTRY_HOST predefined CI variable
Allow access to project-level packages API with CI_JOB_TOKEN
bulkRunnerDelete GraphQL mutation for bulk deletion of runners

+2 more show less

Ability to delete deployments via the API (DELETE /api/v4/projects/:id/deployments/:deployment_id)
Bulk delete package files endpoint

7 details in Everything

15.2.0 Jul 21, 2022 · release notes

GitLab 15.2 adds package cleanup policies, SBoM tables, /metadata REST endpoint, and Terraform module version API endpoints.

package_cleanup_policy project setting for automated artifact retention
GET /api/v4/packages/terraform/modules/latest and GET /api/v4/packages/terraform/modules/:id/:name/:provider/:version endpoints for Terraform module versions
New SBoM database tables (sbom_occurrences, sbom_sources) and models backing Software Bill of Materials tracking
/metadata REST API endpoint to retrieve instance-level operational metadata
has_vulnerabilities argument added to the clusterAgents field in the ClusterAgent GraphQL API

5 details in Everything

15.1.0 Jun 21, 2022 · release notes

GitLab 15.1 adds GraphQL resource links and Jira OAuth IDs, self-managed SAML Group Sync, TLS for metrics endpoints, and Dingtalk integration.

Add gitlab_internal table prefix for Rails and PostgreSQL tables to support internal service isolation
Add TLS support for metrics endpoints (pprof, prometheus) to secure operational data collection
Introduce self-managed SAML Group Sync to automatically map remote SAML groups to local GitLab groups
Add feature: dingtalk integration for chat notifications and updates

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The compliance_framework_setting field is removed from the project edit API; callers must use the compliance frameworks API instead

15.0.2 Jun 6, 2022 · release notes

Adds event type in audit event streaming for GitLab EE

14.10.3 May 20, 2022 · release notes

GitLab 14.10.3 adds option to disable separated caches

15.0.0 May 20, 2022 · release notes

GitLab 15.0 introduces SAML Group Links, Container Scanning on Free tier, and new GraphQL/REST APIs for security policies and agent tokens.

self_managed_saml_group_links adds SAML Group Links and Membership Updater support for self-managed GitLab
mutation NamespaceCiCdSettingsUpdate allows updating namespace CI/CD settings via GraphQL
group_inheritance_type field added to deploy access level and approval rule APIs
scan_finding_rules in project settings configures scan finding rules for security policies
PREVIOUS_BACKUP option added to backup.rake command for previous backup restoration

+1 more show less

REPOSITORIES_STORAGES option allows specifying repository storages during backup

6 details in Everything

└──▷ BREAKING ON UPGRADE

!oauth2_implicit_grant_flow support has been removed, OAuth 2.0 Implicit grant flow is no longer supported

14.9.4 Apr 29, 2022 · release notes

GitLab 14.9.4 security hardening: rate limiting for deploy tokens and enhanced cache isolation via suffixes.

Add validation to pypi file sha256 values to ensure integrity of PyPI artifacts during import/export.
Cache names now include a generated suffix to add process isolation, preventing cross-process cache collisions.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Maintainers can no longer edit PipelineSchedule objects; this action is now restricted.

14.10.0 Apr 21, 2022 · release notes

GitLab 14.10 adds agents REST API, DAST submit field config, FIPS image support, and iOS platform detection.

DAST_SUBMIT_FIELD environment variable to override the default submission input field name in DAST site profiles.
DS_IMAGE_SUFFIX environment variable and ci_gitlab_fips_mode CI/CD variable to enable Gemnasium FIPS mode for SAST/DAST templates.
Implement first iteration of the agents REST API for managing GitLab Agents.
detect_projects_built_for_apple_ios_platform capability to identify iOS-built projects in security scans.

4 details in Everything

14.9.0 Mar 21, 2022 · release notes

GitLab 14.9 adds Harbor integration, DORA Time to Restore metric, Vault EE namespaces, and GraphQL support for project tokens

Adds Harbor as a supported container registry integration type
Adds the time_to_restore_service metric in compliance with DORA standards
Enables token creation directly from the GitLab UI instead of requiring the API
Adds restrict_gitlab_migration enforcement via the RestrictGitlabSchema class
Supports Vault Enterprise Edition namespaces for secret management integration

+3 more show less

Adds GET API endpoints for managing Deploy Tokens
Supports GraphQL authentication using Project-level access tokens
Exposes security_scan_status in the GraphQL API for security reports

8 details in Everything

14.8.4 Mar 16, 2022 · release notes

Enables resuming artifact removal on self-managed GitLab via feature flags.

14.8.0 Feb 21, 2022 · release notes

GitLab 14.8 adds custom Datadog tags, user banning in Admin, GEMNASIUM_LIBRARY_SCAN_ENABLED env var, and GraphQL incident timeline mutations.

custom_tags can now be specified for the Datadog integration to segment monitoring data
Admin Area includes a new capability to ban users
Service Ping payload can now be downloaded via the admin area for offline analysis
DAST site profiles gain a new scan method to trigger on-demand scans programmatically
Corpus management is enabled for self-managed installs to handle vulnerability data lifecycle

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The position column from the security_findings table is dropped

14.7.2 Feb 8, 2022 · release notes

GitLab 14.7.2 allows self-hosted instances to embed same-origin iframes in external links

Allow self-hosted instances to render same-origin Iframe

1 detail in Everything

14.7.0 Jan 21, 2022 · release notes

GitLab 14.7 adds Group Access Token API, Secure Files uploader, and runner_token_expiration_interval config.

Adds runner_token_expiration_interval field to the ApplicationSetting GraphQL schema to control CI runner token lifetimes
Adds a set of Group Access Token API endpoints for programmatic creation and management of group-level access tokens
Introduces the Secure Files data model and a dedicated file uploader UI component within the Group settings interface
Adds support for default issue and merge request templates via .gitlab/ folders in the repository root
Enables filtering of CI runner tokens by their current status (active, revoked) in the admin UI

+4 more show less

Adds draft argument to the GraphQL MergeRequestsResolver to filter merge requests by draft state
Adds merge_user field to the REST API response for Merge Requests to identify who initiated the merge
Adds support for backing up and restoring Package artifacts during GitLab migrations or backups
Allows configuration of the application log level via an environment variable GITLAB_LOG_LEVEL in self-managed deployments

9 details in Everything

14.6.0 Dec 21, 2021 · release notes

GitLab 14.6 adds on-demand scan controls, bulk tag deletion, GraphQL runner filters, and more

Adds ability to retry scans from the on-demand scans list
Enables bulk delete for tags in the GitLab UI
Adds active filter support to the GraphQL API for runners
Exposes iid field in pipeline responses via the REST API

4 details in Everything

14.5.0 Nov 19, 2021 · release notes

GitLab 14.5 adds DingTalk OmniAuth support, ZenTao integration, and CI variable expansion for services.

Add tencent_serverless_framework to built-in project templates
Feature: Let OmniAuth support DingTalk
Add integration with ZenTao
Enabled variables for CI services

4 details in Everything

14.3.0 Sep 21, 2021 · release notes

GitLab 14.3 adds GraphQL mutations for organizations and vulnerability creation, plus project namespace support.

Add organizations to the GraphQL schema with updates via mutation and group contacts query.
Add VulnerabilityCreate GraphQL mutation for Enterprise Edition.
Introduce ProjectNamespace model to decouple project namespacing from users/groups.
Add throttle_unauthenticated_api_* columns to application settings to configure unauthenticated API throttling.
Add hidden field to the GraphQL Issue type.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The scanner_type argument is removed from the GraphQL mutation for DAST profiles (renamed to tool in other contexts, but specifically dropped here).
!The name parameter is removed from the pipeline finder API endpoint.

14.2.0 Aug 20, 2021 · release notes

GitLab 14.2 adds instance-level CI overrides, DAST site validation, and GraphQL security scanner exposure.

Enable instance-level overrides feature to configure CI/CD settings across the entire GitLab instance.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The GraphQL sort field for vulnerabilities by title is deprecated and will be removed.

14.1.1 Jul 28, 2021 · release notes

GitLab 14.1.1 adds RackAttack rate limiting for basic auth attempts

Extends RackAttack to detect and rate-limit basic authentication attempts

1 detail in Everything

14.1.0 Jul 21, 2021 · release notes

GitLab 14.1 adds GraphQL mutations for Dependency Scanning and Policy types, plus bulk import viewing

Add graphql mutation to enable dependency scanning to gitlab-org/gitlab!64710 GitLab Enterprise Edition
Add scan execution policies to the policy list to gitlab-org/gitlab!64783 GitLab Enterprise Edition
Add Bulk Imports API to view user initiated imports to gitlab-org/gitlab!64335

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Drop support for Safari 13.0

14.0.4 Jul 7, 2021 · release notes

A security patch disabling risky premailer strategies.

Disables the file and network premailer strategies in GitLab's mail processing pipeline to mitigate potential remote code execution or information leakage via crafted emails.

1 detail in Everything

13.11.6 Jul 1, 2021 · release notes

GitLab 13.11.6 adds omniauth_user check for user cap verification

13.12.6 Jul 1, 2021 · release notes

GitLab EE v13.12.6 adds omniauth_user check for user capacity verification

13.12.3 Jun 7, 2021 · release notes

Adds description_html to Release API

13.12.0 May 22, 2021 · release notes

GitLab 13.12 adds semgrep to SAST/Secure-Binaries, bulk import for groups, and new GraphQL mutations for issues/MRs

Make semgrep generally available in the Security section (SAST and Secure-Binaries)
Add ConfigureSecretDetection GraphQL mutation
Implement wildcard support for pipeline include file paths
Add Group relations export API and bulk import for groups

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Deprecates Project.tag_list GraphQL field (replace with Project.topics)
!Deprecates SetWip GraphQL mutation (replace with SetDraft mutation)

13.11.0 Apr 22, 2021 · release notes

GitLab 13.11 adds Prometheus cluster integration, semgrep JS/TS support, GraphQL CI pipeline/job fields, and Pages zip storage

Adds local_store to .gitlab.yml (Pages settings) for on-premises GitLab Pages deployments.
Exposes new GraphQL fields: Ci::JobType.id, Ci::JobType.short_sha, Ci::JobType.tags, and PipelineType.schedulingType.
Enables the multiple_cache_per_job feature flag by default, allowing per-job caching overrides in CI pipelines.
Adds support for JavaScript, TypeScript, and React analysis via the Semgrep analyzer in SAST jobs.
Introduces a new database table clusters_integrations_prometheus and model to support adding Prometheus as a cluster integration.

5 details in Everything

13.10.0 Mar 22, 2021 · release notes

GitLab 13.10 adds container_registry project feature, API Fuzzing scanner, DAST branch names, and more API/graphql endpoints

Adds the container_registry project feature (EE) to expose container registry access levels.
Adds the info column to the security_scans table for storing detailed vulnerability information.
Adds API Fuzzing to the Security Configuration page as a new scanner option.
Adds branch_name field to DAST profiles for branch-specific scanning configuration.
Exposes container_registry_image_prefix in the Project API for registry configuration.

+10 more show less

Adds API endpoint /application/plan_limits to retrieve package file size limits based on plan.
Adds API endpoint for fetching a single job by CI_JOB_TOKEN for authenticated access.
Adds GraphQL mutation acceptMergeRequest to accept merge requests programmatically.
Adds GraphQL mutation to create release asset links and update existing ones.
Adds dast_profiles table support with new branch_name field.
Adds environment deployment tier support via tier column in the environments table.
Adds DORA daily metrics modeling capability for DevOps benchmarking.
Implements needs:job:optional for CI pipelines to allow flexible job dependencies.
Adds support for matrix jobs in pipeline trigger configurations.
Adds CI_JOB_STARTED_AT and CI_PIPELINE_CREATED_AT variables for pipeline timing.

15 details in Everything

└──▷ BREAKING ON UPGRADE

!The startDate and endDate arguments are deprecated in the GraphQL schema for Project.milestones, Group.milestones, Project.iterations, Project.milestones, Group.epic, Group.epics, Group.iterations, Group.milestones, BoardEpic.children, and Epic.children.
!The deprecation of instanceStatisticsMeasurements is finalized in favor of usageTrendsMeasurements GraphQL field.

13.8.5 Mar 4, 2021 · release notes

GitLab 13.8.5 adds owner-only management for group variables and improves session security.

Allow only owners to manage group variables restricts the scope of users who can modify group-level variables
Do not store marshalled sessions ids in Redis changes how session data is persisted, preventing serialization vulnerabilities

2 details in Everything

13.9.2 Mar 4, 2021 · release notes

GitLab 13.9.2 hardens security with stricter group variable access and session handling fixes.

Enforces that only group owners can manage group variables, closing a privilege escalation path.

1 detail in Everything

13.9.0 Feb 22, 2021 · release notes

GitLab 13.9 adds semgrep SAST, DAST profiles table, project access token API, Jira sync, and OpenSearch

Add semgrep as a new SAST analyzer.
Add dast_profiles database table for storing DAST scan configurations.
Add REST API endpoints for Project Access Token management (POST /api/v4/projects/:id/project_access_tokens, GET ..., PUT ..., DELETE ...).
Sync pipeline builds to Jira via new webhook events.
Send deployment information to Jira via new webhook events.

+5 more show less

Add OpenSearch support for search functionality.
Allow opening projects with VS Code using the vscode:// URI scheme.
Add patch_hard_limit_bytes_hit metric to monitor diff patch size limit hits.
Enable/disable additional diagram formats on Kroki via configuration.
Track CI minutes for namespaces and projects monthly.

10 details in Everything

13.8.0 Jan 22, 2021 · release notes

GitLab 13.8 adds CI Pipeline Editor, Debian Group/Project distributions, On-call rotations API, and more.

Enables the CI_PIPELINE_EDITOR feature flag to allow editing GitLab CI/CD configuration via a visual editor
Add group-level NuGet endpoints for managing packages at the namespace level
Add Debian Group and Project Distributions support including metadata and architecture tracking
Add GraphQL mutation onCallRotation and table for tracking on-call shifts to manage rotations programmatically
Add API command POST /groups/:id/members/invitations/:invitation_id to remove pending member invitations

+3 more show less

Add skipped status to deployments and expose it in the API
Expose hide_backlog_list and hide_closed_list fields in project and group boards REST API
Add support for specifying allowed authentication mechanisms for REST API endpoints via a new Ruby API

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Remove deprecated generic alert integration in favor of HTTP Integrations
!Drop group_id column from compliance_management_frameworks table

13.5.7 Jan 13, 2021 · release notes

GitLab 13.5.7 applies a security configuration change denying OAuth2 implicit flows for confidential apps.

└──▷ BREAKING ON UPGRADE

!Confidential apps can no longer use the OAuth2 implicit flow.

13.6.5 Jan 13, 2021 · release notes

GitLab 13.6.5 denies implicit flow for confidential apps

13.7.4 Jan 13, 2021 · release notes

GitLab 13.7.4 denies implicit OAuth flow for confidential applications

implicit grant type is now denied for confidential apps in the OAuth/OIDC flow.

1 detail in Everything

13.7.0 Dec 22, 2020 · release notes

GitLab 13.7 adds Kroki diagram support, configurable PAT prefixes, and incident management oncall schedules.

Adds CI_OPEN_MERGE_REQUESTS environment variable to CI jobs.
Adds Configurable personal access token prefix setting for user accounts.
Adds Kroki integration to render diagrams in AsciiDoc and Markdown.
Adds /clone quick-action to clone an Issue directly from the UI.
Adds /clone_with_notes quick-action to clone an Issue along with all its comments.

+3 more show less

Adds oncall rotations and participants tables for incident management scheduling.
Adds support for filtering group members by 2FA status in the GraphQL API.
Adds ability to filter alerts by monitoring tool in the Alert list.

8 details in Everything

13.5.0 Oct 22, 2020 · release notes

GitLab 13.5 adds Static Site Editor, Go package support, Terraform state APIs, and DAST AJAX spider scan options.

Adds .gitlab/static-site-editor.yml config file with static_site_generator, image_upload_path, and mounts entries to enable the Static Site Editor feature
Adds Go(lang) language support to Packages via the existing Package Registry UI
Adds /api/v4/projects/:id/terraform_states/:path REST API endpoints to manage individual Terraform state versions
Adds GraphQL mutation createIssue to create issues programmatically
Adds on-demand DAST scan options scanType, showDebugMessages, and useAjaxSpider via the REST API

+2 more show less

Adds support for Generic packages in the Package Registry
Adds /api/v4/groups/:id/descendants REST endpoint to list a group's descendant groups

7 details in Everything

13.4.0 Sep 22, 2020 · release notes

GitLab 13.4 adds WebAuthn support, GraphQL pipeline mutations, and direct HTTP auth for API Fuzzing.

Add deduplicated column to security_findings table along with the compound index on scan_id and deduplicated and remove the index on scan_id.

1 detail in Everything

13.2.8 Sep 2, 2020 · release notes

GitLab 13.2.8 adds brute-force protection for OAuth endpoints

Protects OAuth endpoints from brute force and password stuffing attacks

1 detail in Everything

13.3.0 Aug 22, 2020 · release notes

GitLab 13.3 adds core SAST engines, incidents management, Azure Blob Storage support and new GraphQL/REST APIs.

Bring SAST to Core: bandit, Flawfinder, Gitleaks, Gosec, Kubesec, NodeJsScan, phpcs-security-audit, PMD, Security Code Scan, Sobelow, SpotBugs are now core detections
Add SECRET_DETECTION_EXCLUDED_PATHS environment variable to exclude files from secret scanning
Add Azure Blob Storage support for object storage
Add runbook_url support in PrometheusAlert integration and display runbooks in metric chart dropdown and alert details
Add Webhooks for deployments event type

+7 more show less

Add CI Lint API support to simulate pipeline creation and validate configuration beyond syntax checks
Add GraphQL mutations to reorder designs, update board list position/collapsed state, and move issues within board lists
Add GraphQL query for a single milestone and include_subgroup parameter to Issues GraphQL queries
Expose id in Event object returned from the public API
Add support for specifying AWS S3 Server Side Encryption (AWS-KMS)
Add NuGet lock files support to Dependency Scanning CI template
Enable Monaco Editor by default via monaco_blobs feature flag

12 details in Everything

└──▷ BREAKING ON UPGRADE

!Deprecate additions and deletions attributes in Repositories API
!Deprecate blob field on GraphQL SnippetType
!Deprecation of ECS template

13.0.12 Aug 5, 2020 · release notes

GitLab 13.0.12 adds archive size validation on import and enforces 2FA on Doorkeeper controllers.

Adds decompressed archive size validation when importing projects or groups to prevent oversized uploads
Enforces Two-Factor Authentication (2FA) for all requests to Doorkeeper controllers
Refreshes project authorizations during group transfers to ensure consistent permissions
Verifies confirmed email addresses for OAuth Authorize POST endpoint requests
Revokes OAuth grants immediately when a user revokes an application

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Doorkeeper controller requests now require Two-Factor Authentication (2FA), blocking unauthenticated or 2FA-less access
!Branch creation is blocked if the branch name is exactly 40 characters of hexadecimal digits

13.2.0 Jul 22, 2020 · release notes

GitLab 13.2 adds dark theme, native code intelligence, SAST to Core, and instance-level Kubernetes clusters.

Adds Add environment_scope filter to ci-variables API to allow filtering CI variables by scope via the API
Introduces Multiple Kubernetes clusters now available in GitLab core enabling management of multiple K8s clusters from the main UI without EE-only restrictions
Brings SAST (Secure Application Security Testing) to Core with new analyzers including eslint and brakeman, previously EE-only
Adds Add DAG visualization MVC to visualize pipeline dependencies using Directed Acyclic Graphs in the CI interface
Adds support for creating and updating snippets with multiple files via GraphQL mutations (files argument)

+3 more show less

Introduces Open source cluster health dashboard and make it available to all users for monitoring Kubernetes cluster status
Adds Expose gitlab managed apps logs inside log explorer to view logs for GitLab-managed applications like Helm charts
Adds Add default_branch_name to application_settings to set a custom default branch name (e.g., main) at the instance level

8 details in Everything

13.0.7 Jun 25, 2020 · release notes

GitLab 13.0.7 adds __range variable for Prometheus queries and periodic authorization recomputation.

Provides __range variable for Prometheus queries
Periodically recompute project authorizations

2 details in Everything

13.1.0 Jun 22, 2020 · release notes

GitLab 13.1 adds secret detection to Auto DevOps, native code intelligence, and GraphQL mutations for commit creation.

Adds secret_detection template to Auto DevOps pipelines
Introduces Add a GraphQL endpoint to fetch Jira projects through its REST API.
Adds Allow generic endpoint to receive alerts from external Prometheus. for Alert Management
Adds container expiration policy objects and attributes via the GraphQL API
Exposes release_links.type via the API

+3 more show less

Adds ability to filter self monitoring resource usage charts by instance name
Add API to schedule project repository storage moves
Allow CI_JOB_TOKEN for authenticating to the Terraform state API

8 details in Everything

13.0.0 May 22, 2020 · release notes

GitLab 13 introduces Alert Management, CI/CD rules syntax for templates, and GraphQL support for snippets and issue prioritization.

Migrate CI templates (SAST, DAST, Dependency-Scanning, etc.) to rules syntax for conditional execution
Alert Management table and GraphQL API endpoint alerts track and query security alerts
web_url field added to branch API response
GraphQL API adds priority sorting for issue queries via sort: :priority
Snippet support includes versioning via git, WebIDE dark theme, and Monaco editor by default

+2 more show less

Deploy tokens gain read/write_package_registry scope and work with Maven/NuGet/PyPI/NPM registries via Basic Auth
Metrics dashboard annotations feature allows marking events on charts via GraphQL or API

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Docker-in-Docker is disabled by default for Dependency Scanning templates
!Docker-in-Docker is disabled by default for SAST templates
!Deprecated project routes removed (previously deprecated before 12.1)
!License-Management CI template support dropped
!license_management artifact support dropped

12.10.1 Apr 24, 2020 · release notes

GitLab 12.10.1: Group Deploy Tokens moved to new settings location; dismissal-to-vulnerability migration.

Group Deploy Tokens are now managed in the new Group-scoped Repository settings section.
Automatic migration of previously dismissed alerts to the vulnerabilities model.

2 details in Everything

12.10.0 Apr 22, 2020 · release notes

GitLab 12.10 adds Terraform State API with locking, new package filtering, and GraphQL integration endpoints

Implements Implement Terraform State API with locking to manage state files directly via the tool
Adds Add API endpoint to list runners for a group to the GraphQL/REST interface for runner management
Enables filtering packages by type in the New package list is enabled which includes filtering by type view
Adds Add cluster apps support for Knative and Fluentd as new managed application types in CI/CD
Introduces Expose created_at property in Groups API to expose timestamp metadata on group entities

+2 more show less

Allows Allow to start Jira import through graphql mutation for programmatic trigger of imports
Adds Add metrics dashboard annotations to GraphQL API to annotate charts with data points

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Revert LDAP readonly attributes feature. !28541

12.9.0 Mar 22, 2020 · release notes

GitLab 12.9 introduces group-level deploy tokens, remote mirrors API, instance-level integrations, and dynamic child pipelines.

GET /deploy_tokens endpoint for project deploy tokens
GET /groups/:id/deploy_tokens endpoint for group deploy tokens
POST /groups/:id/deploy_tokens to create group deploy tokens
POST /deploy_tokens to create project deploy tokens
New remote_mirrors API endpoints (GET, POST, DELETE) and remote_mirrors table columns (keep_divergent_refs)

+4 more show less

Instance-level integration CRUD (add/edit/delete) via API and Admin UI
GET /merge_trains public API endpoint to list merge train entries
Dynamic child pipeline creation from CI/CD artifact content via feature.dynamic_child_pipeline flag
Access /version API endpoint with read_user scope

9 details in Everything

└──▷ BREAKING ON UPGRADE

!The state column is removed from issues and merge_requests tables.

12.0.0 Jun 22, 2019 · release notes

GitLab 12.0 adds GraphQL API support, CI expression logic, and Kubernetes cluster management UI.

Add Namespace and ProjectStatistics to GraphQL API
Expose notes and discussions in GraphQL
Make task completion status available via GraphQL
Expose wiki_size on GraphQL API
Add ref querystring parameter to project search API to allow searching on branches/tags other than the default

+10 more show less

Add support for && and || to CI Pipeline Expressions
Add allow_failure attribute to Job API
API: Allow to get and set masked attribute for variables
Get and edit ci_default_git_depth via project API
Implement borderless discussion design with new reply field
Add task count and completed count to responses of Issue and MR
Add support for multiple job parents in GitLab CI YAML
Add LFS oid to GraphQL blob type
Adds pagination component for graphql api
Support multiplex GraphQL queries

15 details in Everything

11.11.0 May 22, 2019 · release notes

GitLab 11.11 adds write_repository token scope, CI file variables, instance K8 clusters, OpenID Connect/OAuth strategies, and API exposure for environments/variables.

Adds write_repository personal access token scope to grant write-only repository access
Introduces new CI_COMMIT_REF_PROTECTED CI variable
Enables CI variables of type file in .gitlab-ci.yml
Supports private Helm repositories by providing credentials and custom repository names
Adds instance-level Kubernetes clusters management

+4 more show less

Exposes pipeline variables via the API
Allows passing Sentry client-side DSN configuration in gitlab.yml
Allows passing Sentry server-side configuration in gitlab.yml
Adds OmniAuth OpenID Connect strategy for authentication

9 details in Everything

11.10.0 Apr 22, 2019 · release notes

GitLab 11.10 introduces group-level Auto DevOps controls, Web IDE capabilities for creating files via URL and multi-line suggestions, and CI support for setting MR merge conditions via git push options.

11.7.10 Mar 28, 2019 · release notes

GitLab 11.7.10 adds EXIF removal rake task and tightens guest access to Releases.

Restricts guest users from accessing the Releases feature

1 detail in Everything

11.9.0 Mar 22, 2019 · release notes

GitLab 11.9 adds encrypted runner tokens, masked CI variables, YouTrack integration, and API support for GPG signatures.

Add support for masking all CI/CD TOKEN and PASSWORD environment variables automatically
Add YouTrack integration service for issue tracking
Add project template for go-micro in the project creation wizard

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed HipChat integration from GitLab; use !22223 migration path or external alternatives.
!Removed undigested token column from personal_access_tokens table; ensure no custom scripts query this column directly.

11.7.1 Jan 28, 2019 · release notes

GitLab 11.7.1 enhances security visibility and access controls for links, LFS, CI/CD triggers, and group guests.

Makes potentially malicious links more visible in the UI
Scrubs RTLO (Right-To-Left Override) characters from links
Adds subresources removal during member destroy operations
Adds additional LFS validations to prevent forgery
Uses RubyZip for GitLab Pages extraction

+3 more show less

Restricts project import visibility based on its parent group
Ensures CI/CD trigger tokens are exposed only to the trigger owner
Groups guests can no longer see merge requests they lack access to at the group level

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Disables git v2 protocol temporarily

11.7.0 Jan 22, 2019 · release notes

GitLab 11.7 adds Releases API, frontend app, and new CI/CD capabilities including template inclusion and protected variables

Adds GET /projects/:id/releases and POST /projects/:id/releases endpoints to manage release assets via API
Adds a dedicated frontend application for viewing project Releases in the UI
Adds support for including templates in .gitlab-ci.yml via include: directives
Adds ability to include files from other projects in .gitlab-ci.yml using cross-project references
Adds new predefined CI variable CI_API_V4_URL for constructing API URLs within pipelines

+8 more show less

Adds option to make CI/CD variables protected by default via project settings
Supports TLS communication between GitLab and Gitaly storage nodes
Displays Sentry issues directly within the GitLab UI for linked applications
Adds import of issues from CSV files via the project interface
Adds new pipeline variable CI_COMMIT_SHORT_SHA available in CI/CD jobs
Creates system notes when labels, milestones, or due dates are set on issues or merge requests
Adds Knative metrics export to Prometheus for Auto DevOps deployments
Enables auto-inclusion of secrets from prefixed CI variables in Auto DevOps applications

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Remove deprecated GitLab Upgrader calls and related migration paths

11.6.0 Dec 22, 2018 · release notes

GitLab 11.6 adds group clusters, Knative serverless support, merge request pipelines, and several new API endpoints.

Adds ability to create group level clusters and install gitlab managed applications
Introduces Knative and Serverless Components for deployment targets
Merges pipeline execution into the Merge Request context as Merge request pipelines
Adds new endpoint /projects/:id/pipelines/:pipeline_id to delete a pipeline via API
Adds new endpoint /projects/:id/repository/branches/:branch/rebase for merge request rebasing

+2 more show less

Adds new endpoint /projects/:id/artifacts/download to download single artifact file for a ref
Introduces /create_merge_request quickaction for creating MRs via slash commands

7 details in Everything

11.5.0 Nov 22, 2018 · release notes

GitLab 11.5 adds Knative support, parallel CI jobs, and new API endpoints for apps, submodules, and issues.

Introduces Knative support for deploying applications via the GitLab Auto DevOps pipeline.
Adds the parallel keyword to .gitlab-ci.yml to run jobs in parallel within a single stage.
Adds API endpoints for listing (GET /applications) and deleting (DELETE /applications/:id) user applications.
Adds endpoint to update a git submodule reference via PUT /projects/:id/submodules/:path.
Adds API endpoint to list issue related merge requests via GET /projects/:id/issues/:issue_iid/related_merge_requests.

+1 more show less

Adds None and Any options for the assignee_id parameter in Issues and Merge Requests API index endpoints.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!The scheduled label/badge of delayed jobs is renamed to delayed.
!Legacy unencrypted webhook columns are removed from the database.
!The allow_overflow option in TimeHelper.duration_in_numbers is dropped.

11.4.0 Oct 22, 2018 · release notes

GitLab 11.4 adds pipeline scheduling, WIP MR search, access control for Pages, and new API parameters.

Allow pipelines to schedule delayed job runs
Allows to filter issues by Any milestone in the API
Adds the user's public_email attribute to the API
Add support for setting the public email through the api
Add a filter bar to the admin runners view and add a state filter.

+7 more show less

Add a type filter to the admin runners view
Allows to chmod file with commits API
Adds Web IDE commits to usage ping
Add subscribe filter to group and project labels pages
Support db migration and initialization for Auto DevOps
Add access control to GitLab pages and make it possible to enable/disable it in project settings
Add support for setting the public email through the api

12 details in Everything

11.3.0 Sep 22, 2018 · release notes

GitLab 11.3 adds branch-filtered webhooks, Protected Tags API, shared project expiration dates, and suppressible SSH warnings.

Add branch filter to project webhooks
API: Add expiration date for shared projects to the project entity
Diverged commits count field added to merge request API response

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Events API now requires the read_user or api scope

11.2.0 Aug 22, 2018 · release notes

GitLab 11.2 adds GraphQL mutations for MRs, SSH cert auth, Hangouts Chat integration, and more.

Adds first GraphQL mutations for merge requests
Add support for SSH certificate authentication
Add /-/health basic health check endpoint
Add filter for minimal access level in groups and projects API
Show repository languages for projects

+1 more show less

Allow cloning LFS repositories through DeployTokens

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Rack attack is now disabled by default.

11.0.0 Jun 22, 2018 · release notes

GitLab 11.0 adds g k/g e shortcuts, GraphQL project queries, JupyterHub cluster app, and Markdown API.

Adds keyboard shortcut g k for Kubernetes on Project pages
Adds keyboard shortcut g e for Environments on Project pages
Setup graphql with initial project & merge request query
Adds JupyterHub to cluster applications
Add API endpoint to render markdown text

+2 more show less

Add Avatar API
Add variables to POST api/v4/projects/:id/pipeline

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed API v3 from the codebase
!Removes outdated g t shortcut for TODO in favor of Shift+T
!Rename issue scope created-by-me to created_by_me, and assigned-to-me to assigned_to_me

10.8.0 May 22, 2018 · release notes

GitLab 10.8 adds push mirrors to CE, deploy token vars, and CI commit message variables

Adds push mirrors support in GitLab Community Edition (Added push mirrors to GitLab Community Edition).
Exposes Deploy Token data as environment variables on CI/CD jobs (Expose Deploy Token data as environment varialbes on CI/CD jobs).
Adds new predefined CI variables CI_COMMIT_MESSAGE, CI_COMMIT_TITLE, and CI_COMMIT_DESCRIPTION (Add CI_COMMIT_MESSAGE, CI_COMMIT_TITLE and CI_COMMIT_DESCRIPTION predefined variables).
Adds SHA filter to pipelines list API (Add sha filter to pipelines list API).
Adds 2FA filter to users API for admins only (Add 2FA filter to users API for admins only).

+3 more show less

Adds GET /projects/:id/languages API endpoint to show project languages (API: add languages of project GET /projects/:id/languages).
Enables admins to enforce accepting Terms of Service on an instance (Allow admins to enforce accepting Terms of Service on an instance).
Adds discussion API for merge requests and commits (Add discussion API for merge requests and commits).

8 details in Everything

10.7.1 Apr 23, 2018 · release notes

GitLab 10.7.1 adds an API endpoint for downloading git repository snapshots.

10.7.0 Apr 22, 2018 · release notes

GitLab 10.7 adds deploy tokens, object storage for artifacts/LFS, per-runner timeouts, and OmniAuth JWT support.

Introduces Create Deploy Tokens to allow permanent access to repository and registry without user credentials
Add object storage support for LFS objects, CI artifacts, and uploads, configurable via the uploads config key in GitLab's configuration
Add support for pipeline variables expressions in only/except rules using ${VAR} syntax in .gitlab-ci.yml
Adds support for OmniAuth JWT provider for authentication integrations
Introduce simpler env vars REPLICAS and CANARY_REPLICAS for Auto Deploy applications

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Remove support for legacy tar.gz pages artifacts

10.6.0 Mar 22, 2018 · release notes

GitLab 10.6 adds project export/import APIs, Kubernetes cluster setup buttons, external plugins for system hooks, and branch filtering.

Add GET /projects/:id/export API endpoint to initiate project exports
Add support for external plugins as an alternative to system hooks
Add search parameter to the Branches API (GET /projects/:id/repository/branches) for filtering branches by name
Add source and target branch filtering to the Merge Requests API (GET /projects/:id/merge_requests)
Add updated_at filter to Issues and Merge Requests API endpoints

+9 more show less

Expose metrics in the Merge Requests API (more fields exposed)
Add badge API endpoints for retrieving project/repository badges
Add Kubernetes cluster setup button on project settings page to enable Auto DevOps
Display ingress IP address in the Kubernetes page UI
Allow installation of GitLab Runner with a single click from the UI
Enable privileged mode configuration for GitLab Runner via API/UI
Expose GITLAB_FEATURES as a CI/CD variable available to pipelines
Add overview of branches and filter for active/stale branches in the new branches view
Add CommonMark markdown engine (experimental) for rendering Markdown

14 details in Everything

10.5.0 Feb 22, 2018 · release notes

GitLab 10.5 adds pipelines API endpoint to merge requests, LFS file locking API, and Gitaly health checks.

Adds GET /projects/:id/merge_requests/:merge_request_iid/pipelines API endpoint to list pipelines for a merge request
Backports the LFS File Locking API for managing locked files in Large File Storage
Adds sorting options to the /users API (admin only) with new query parameters
Adds sorting support to the Deployments API for filtering deployment history
Adds Gitaly Servers section to the admin dashboard to monitor gRPC backend servers

+2 more show less

Enables Project Milestone Deletion via the API, allowing DELETE /projects/:id/milestones/:milestone_iid
Supports PostgreSQL 10 as a supported database platform

7 details in Everything

10.4.2 Jan 30, 2018 · release notes

GitLab 10.4.2 vendors the Auto DevOps template with DAST security checks enabled by default.

10.4.0 Jan 22, 2018 · release notes

GitLab 10.4 adds pause/resume runners, Kubernetes Prometheus integration, and multi-file editor beta

Support new chat notifications parameters in the Services API (/api/v4/services/chatops).
Expose project_id on /api/v4/pages/domains.
Add pause/resume button to project runners.
Add Prometheus to available Cluster applications for Kubernetes monitoring.
Enable ordering of groups and their children by name in API responses.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Migrate existing data from KubernetesService to Clusters::Platforms::Kubernetes.

10.3.0 Dec 22, 2017 · release notes

GitLab 10.3 adds Mermaid diagrams, email-based MR creation, and several new API endpoints.

Add support of Mermaid (generation of diagrams and flowcharts from text)
Allow creation of merge request from email
Add the option to automatically run a pipeline after updating AutoDevOps settings
Add /groups/:id/subgroups endpoint to API
New API endpoint - list jobs for a specified runner

+2 more show less

Add new API endpoint - get a namespace by ID
Limit autocomplete menu to applied labels

7 details in Everything

10.2.0 Nov 22, 2017 · release notes

GitLab 10.2 adds Packagist service, Pages Domain APIs, hashed storage for attachments, Prometheus metrics parity and sudo scope for OAuth/PATs.

Add Packagist project service integration to push package metadata automatically.
Add API endpoints for managing Pages Domains on GitLab Pages instances.
Introduce Hashed Storage support for file attachments in projects.
Expose Prometheus metrics with full parity to the existing InfluxDB metrics set.
Add sudo scope for OAuth and Personal Access Tokens to allow admin impersonation via the API.

+2 more show less

Support show-all-refs protocol extension for git over HTTP.
Introduce automatic configuration settings page for simplified initial setup.

7 details in Everything

10.1.0 Oct 22, 2017 · release notes

GitLab 10.1 adds GPG subkey support, discussion locking, online HTML artifacts, and API enhancements for commits and issues.

Add support for GPG subkeys in signature verification
Add implements to the default issue closing message regex
Add tabs to dashboard/projects to easily switch to personal projects
Commenting on image diffs
Hide close MR button after merge without reloading page

+8 more show less

Display whether branch has been merged when deleting protected branch
Allow creating merge requests across a fork network
Add view replaced file link for image diffs
Move Custom merge methods from EE to CE
Exposes last pipeline details in API response when getting a single commit
Adds closed_at attribute to Issues API
Expose avatar_url when requesting list of projects from API with simple=true
Add an API endpoint to determine the forks of a project

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Remove the ability to visit the issue edit form directly

10.0.0 Sep 22, 2017 · release notes

GitLab 10.0 adds protected runners, CI/CD job variables, GPG key API, and branch existence check.

GET /users/:id now includes the is_admin field when the requesting user is an admin
New Protected runners capability limits pipeline execution to specific runners
CI/CD job predefined variables GITLAB_USER_NAME and GITLAB_USER_LOGIN are now available in jobs
New API endpoints for GPG key management (/user/gpg_keys)
HEAD /projects/:id/repository/branches/:branch_name returns 200 if the branch exists, enabling existence checks

+4 more show less

Pipeline schedules support setting variable values via the API
Download single job artifacts using GET /projects/:id/jobs/:job_id/artifacts/:file_path
CI_PIPELINE_SOURCE predefined variable indicates the source of a pipeline trigger
Search bar supports filtering issues and merge requests by my_reaction_emoji param via /issues and /merge_requests API

9 details in Everything

└──▷ BREAKING ON UPGRADE

!GPG signature verification semantics changed: the committer must match the signer for a valid signature
!Default LDAP config verify_certificates is now true, requiring valid certs for connections

9.3.11 Sep 6, 2017 · release notes

GitLab 9.3.11 adds external issue reference support and personal snippet storage improvements

Improve support for external issue references.
Use uploads/system directory for personal snippets.

2 details in Everything

9.5.3 Sep 3, 2017 · release notes

GitLab 9.5.3 is a patch release improving log security by filtering additional secrets in Rails logs, while addressing various bugs related to usernames, issues, pipelines, and UI elements.

9.5.0 Aug 22, 2017 · release notes

GitLab 9.5.0 adds GPG commit verification, CI job retries, protected branch wildcards, and several API endpoints.

gpg_signed_commits integration to verify developer signatures on commits
allow_manual_retry config for CI/CD jobs to enable automatic retry of failures
GET /api/v4/projects/:id/repository/archive.{ext} URL format for downloading project archives with the selected file extension
Wildcard matching in protected branches API (!12756) for no access restrictions on protected refs
/shrug and /tableflip quick action commands for issue/merge request comments

+2 more show less

GET /api/v4/issues endpoint accepting author_id and assignee_id parameters
Prometheus metrics exporter added to Sidekiq workers via enable_prometheus_metrics feature flag/setting context

7 details in Everything

9.4.0 Jul 22, 2017 · release notes

GitLab 9.4.0 adds CI/CD pipeline scheduling variables, Web UI file/directory creation with spaces, and group secret variables

Add variables support to pipeline schedules in the .gitlab-ci.yml configuration file, allowing scheduled runs to use variable overrides.
Accept image for avatar in project API via the /projects/:id/avatars endpoint and user API via /user/avatars endpoints.
Add created_after and created_before params to the /api/v3/issuable endpoint to filter issues and merge requests by creation time.
Enable creation of files and directories with spaces through the Web UI file browser interface.

4 details in Everything

9.2.8 Jul 19, 2017 · release notes

GitLab 9.2.8 improves external issue references and fixes project authorizations

9.3.7 Jul 18, 2017 · release notes

GitLab v9.3.7 adds the is_admin field to user API responses and improves application settings data integrity.

Adds is_admin attribute to the GET /user endpoint response for admins

1 detail in Everything

9.3.0 Jun 22, 2017 · release notes

GitLab 9.3 adds Events API, pipeline schedule API, Aliyun OSS backup, protected variables, and optimistic locking.

Introduce an Events API to retrieve project events.
Add API support for creating, updating, and deleting pipeline schedules.
Add tag_list param to the Projects API.
Expose import_status in the Projects API.
Add Aliyun OSS as a backup storage provider via configuration.

+8 more show less

Add support for protected variables that only pass to protected branches or tags.
Allow manual bypass of auto_sign_in_with_provider with a new parameter.
Introduce optimistic locking support via optional parameter last_commit_sha on File Update API.
Add $CI_ENVIRONMENT_URL to predefined CI/CD variables.
Allow numeric values in .gitlab-ci.yml configuration files.
Add feature toggles and API endpoints for admin management of feature flags.
Enable cancelling non-HEAD pending pipelines by default.
Implement web hook logging for debugging webhook deliveries.

13 details in Everything

9.2.7 Jun 21, 2017 · release notes

Reinstates the is_admin flag in the users API for authenticated admins

9.0.8 May 31, 2017 · release notes

GitLab 9.0.8 restricts API X-Frame-Options and changes upload path.

Moves file uploads from public/uploads to public/uploads/system to separate system-generated assets.

1 detail in Everything

9.2.0 May 22, 2017 · release notes

GitLab 9.2 adds milestone/label MR filtering, pipeline build failure summary, configurable git timeouts, OAuth code push, sudo for blocked users, and new issue API endpoints.

Add milestone and labels filter parameters to the merge requests API endpoint
Add build failures summary page for pipelines
Add configurable timeout setting for git fetch and clone operations
Allow OAuth clients to push code
Add ability to sudo to blocked users via the Admin API

+2 more show less

Add issues/:iid/closed_by API endpoint to list merge requests that close an issue
Expose project statistics on single requests via the API

7 details in Everything

9.1.0 Apr 22, 2017 · release notes

GitLab 9.1.0 introduces Microsoft Teams webhooks, scheduled pipelines UI, and readiness endpoints

Integrates Microsoft Teams webhooks with GitLab for CI/CD notifications.
Adds UI and backend support for running CI/CD pipelines on a schedule (polling_interval_multiplier app setting).
Enables per-group 2FA requirement.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Replaces builds_enabled with jobs_enabled in projects API v4.
!Drops support for correctly processing legacy pipelines.

9.0.5 Apr 10, 2017 · release notes

GitLab 9.0.5 adds MR/issue shortcuts and counters to the navbar

9.0.3 Apr 5, 2017 · release notes

GitLab 9.0.3 adds GitHub import support for subgroups and API noteable iid support.

Allow users to import GitHub projects to subgroups
API: Make the /notes endpoint work with noteable iid instead of id

2 details in Everything

9.0.1 Mar 28, 2017 · release notes

GitLab 9.0.1 adds milestone filtering and sorting capabilities alongside search simplifications.

Allow filtering by all started milestones
Allow sorting by due date and priority for milestones
Simplify search queries for projects and merge requests

3 details in Everything

9.0.0 Mar 22, 2017 · release notes

GitLab 9.0 introduces OpenID Connect IDP, nested groups via API/UI, pipeline trigger API, and numerous API v4 changes

Implement OpenID Connect identity provider. !8018 (Markus Koller)
Allow creating nested groups via UI. !8786
Add nested groups to the API. !9034
Expose pipelines as PipelineBasic api/v3/projects/:id/pipelines. !8875
Add pipeline trigger API with user permissions. !9277

+8 more show less

Manage user personal access tokens through api and add impersonation tokens. !9099 (Simon Vocella)
Add Runner's registration/deletion v4 API. !9246
Add Runner's jobs v4 API. !9273
Add GET /projects/:id/pipelines/:pipeline_id/jobs endpoint. !9727
Add user & build links in Slack Notifications. !8641 (Poornima M)
Bypass email domain validation when a user is created by an admin. !8575 (Reza Mohammadi @remohammadi)
Introduce /award slash command; Allow posting of just an emoji in comment. !9382 (mhasbini)
Add the oauth2_generic OmniAuth strategy. !9048 (Joe Marty)

13 details in Everything

└──▷ BREAKING ON UPGRADE

!API: Remove public param for projects. !8736
!V3 deprecated templates endpoints removal. !8853
!Standardize branch name params as branch on V4 API. !8936
!Move /projects/fork/:id to /projects/:id/fork. !8940
!API: Consolidate /projects endpoint. !8962
!Rename builds to job for the v4 API. !9463
!API: Remove DELETE projects/:id/deploy_keys/:key_id/disable. !9365 (Robert Schilling)
!API: Return 204 for all delete endpoints. !9397 (Robert Schilling)
!API: Use POST requests to mark todos as done. !9410 (Robert Schilling)
!API: Remove /groups/owned endpoint. !9505 (Robert Schilling)

8.16.8 Mar 19, 2017 · release notes

GitLab 8.16.8 restricts project import URLs to prevent SSRF attacks

Restricts project import URLs to localhost or the server IP only for the assigned instance URL and port.
Prohibits imports from ports below 1024 except 22, 80, and 443.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Project imports to localhost or the server IP (other than the assigned instance URL/port) are now prohibited.
!Project imports from ports below 1024 (except 22, 80, and 443) are now prohibited.

8.17.4 Mar 19, 2017 · release notes

GitLab 8.17.4 adds SSRF protections on project imports by restricting allowed URLs and ports.

Adds strict URL validation for project imports to block Server-side Request Forgery attacks against localhost or the server IP.
Blocks project imports from ports below 1024, with exceptions for ports 22, 80, and 443.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Project import URLs targeting localhost or the server IP are now prohibited (except for the assigned instance URL and port).

8.17.0 Feb 22, 2017 · release notes

GitLab 8.17 adds copy backup strategy, project-to-group label promotion, GitLab Pages in CE, and new API endpoints

Add copy backup strategy to combat file changed errors.
Project labels can now be promoted to group labels.
Added GitLab Pages to CE.
Add ability to define a coverage regex in the .gitlab-ci.yml.
Adds service trigger events to api.

+4 more show less

Add read-only full_path and full_name attributes to Group API.
Support unauthenticated LFS object downloads for public projects.
Force new password after password reset via API.
Add ability to export project inherited group members to Import/Export.

9 details in Everything

8.16.0 Jan 22, 2017 · release notes

GitLab 8.16 adds LDAP provider renaming, slash commands, Gitaly support, and Time Tracking API endpoints

Add Rake task rename_ldap_provider to rename an existing LDAP provider configuration
Allow deploy keys with write-access for repository interactions
Add slash command /merge to merge a merge request directly via chat or issue comments
Enable ENV variable expansion in Redis configuration fields
Add new API endpoints for Time Tracking on issues and merge requests

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The gray color theme name has been renamed to black in CSS/theme definitions
!The project settings UI now combines project members and groups into a single members setting option
!Award emoji display moved out of the discussion tab for merge requests, altering previous comment/thread layouts

8.15.4 Jan 9, 2017 · release notes

Re-added Google Cloud Storage as a backup strategy in GitLab 8.15.4.

8.15.0 Dec 22, 2016 · release notes

GitLab 8.15 adds Mattermost service, Kubernetes online terminal, API endpoints for personal snippets and project unsharing, and OAuth provider support.

Add gitlab:workhorse:install rake task to install GitLab-Workhorse
API: Endpoint to expose personal snippets as /snippets
Introduce online terminal support for Kubernetes
Create Mattermost service integration
API: Add ability to unshare a project from a group

+4 more show less

Add support for Dockerfile templates
Add sorting functionality for group/project members
Add issue search slash command
API: Expose committer details for commits

9 details in Everything

└──▷ BREAKING ON UPGRADE

!Stop supporting Google and Azure as backup strategies.
!Rename Merge When Build Succeeds to Merge When Pipeline Succeeds.

8.12.12 Dec 8, 2016 · release notes

RESTores /user API response with private-token for admin/sudo requests

GET /user endpoint now returns the private_token field when called by an admin using sudo

1 detail in Everything

8.13.9 Dec 8, 2016 · release notes

GitLab 8.13.9 restores the sudo parameter on the /user API endpoint for admin contexts.

Reenables the /user API request to return private-token if user is admin and request is made with sudo.
Replace MR access checks with use of MergeRequestsFinder.

2 details in Everything

8.14.4 Dec 8, 2016 · release notes

GitLab 8.14.4 restores admin private-token API access and strengthens account deletion security.

Re-enables the /user API endpoint to return the private_token for admin users using the sudo parameter.
Ensures that deleting a user's own account immediately destroys their active session.

2 details in Everything

8.13.6 Nov 17, 2016 · release notes

GitLab 8.13.6 adds LDAP DN fallback for auto-linking and commits to a project visibility defaults fix.

Omniauth auto link LDAP user falls back to find by DN when user cannot be found by UID
Limit labels returned for a specific project as an administrator
Allow commit note to be visible if repo is visible

3 details in Everything

8.13.5 Nov 8, 2016 · release notes

GitLab 8.13.5 restores public container registry access and adds round-robin project creation support.

Introduce round-robin project creation to spread load over multiple shards

1 detail in Everything

8.13.0 Oct 22, 2016 · release notes

GitLab 8.13 introduces group-level labels, a new WIP toggle slash command, and several API endpoints for issues, builds, and user events.

└──▷ TRY IT

Toggle the Work In Progress status of a merge request via CLI to hide it from review boards.

$ /wip

Adds group level labels to allow managing labels across all projects in a group.
Adds /wip slash command to toggle the Work In Progress status of a merge request.
Adds /projects/visible API endpoint to retrieve visible projects.
Creates a new /templates namespace containing /licenses, /gitignores and /gitlab_ci_ymls API endpoints.
Adds Issue Board API support to manage boards programmatically.

+3 more show less

Exposes pipeline data in the builds API via the pipeline_data field.
Adds new /users/:id/events endpoint to retrieve user activity.
Enables GitLab Import/Export for non-admin users.

8 details in Everything

8.12.0 Sep 22, 2016 · release notes

GitLab 8.12 adds Pipelines for Commit, Cycle Analytics, LFS over SSH, and new API endpoints.

Adds web_url field to issue, merge request, and snippet API objects
Add two-factor recovery endpoint to internal API
Add BroadcastMessage API
Add notification_settings API calls
API for Ci Lint

+12 more show less

Expose sha and merge_commit_sha in merge request API
Allow to set request_access_enabled for groups and projects
API: Expose issue confidentiality flag.
Added ability to use predefined CI variables for environment name
Added ability to specify URL in environment configuration in gitlab-ci.yml
Add pipeline email service
Add wiki_page_events to project hook APIs
Ability to manage project issues, snippets, wiki, merge requests and builds access level
Added only_allow_merge_if_build_succeeds project setting in the API.
Add author param when making commits via API
Add LFS support to SSH
Cycle analytics (first iteration)

17 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed Gitorious import

8.11.0 Aug 22, 2016 · release notes

GitLab 8.11 adds Issues Board, protected branch options, new API endpoints for deploy keys/pipelines/environments/deployments, and pipeline UI improvements.

Adds Issues Board view for Kanban-style issue management
Adds No one can push option for protected branches to restrict write access
Adds API endpoints for enabling/disabling deploy keys
Adds API endpoints for listing, requesting, approving, and denying project/group access requests
Adds API endpoints for pipelines (create, list, etc.)

+17 more show less

Adds Play endpoint on Builds to trigger build actions via API
Allows specifying branches for Pivotal Tracker integration
Adds Koding (online IDE) integration
Adds test coverage report badge using the latest successful pipeline value
Allows resolving merge conflicts directly in the web UI
Allows users to import cross-repository pull requests from GitHub into GitLab
Adds support for using RequestStore within Sidekiq tasks via the SIDEKIQ_REQUEST_STORE environment variable
Adds support for relative links starting with ./ or / in Markdown via RelativeLinkFilter
Adds auto-completion in pipeline configuration editor
Adds pipeline visualization/graph on the pipeline page
Adds pipelines tab to merge requests view
Adds environment.url field linking to external environments from deployments
Allows naming U2F devices for 2FA management
Shows deployment status on merge requests linked to external URLs
Supports slash commands in issue and merge request descriptions and comments
Adds build event color in HipChat integration messages
Pre-creates all builds for a Pipeline when the new Pipeline is created, enabling parallel execution of initial stages

22 details in Everything

└──▷ BREAKING ON UPGRADE

!Enforces 2FA restrictions on API authentication endpoints; if a user has 2FA enabled but hasn't configured an app password or token specifically allowed, they may be blocked from API access unless PersonalAccessTokens are used as the password field value.

8.10.0 Jul 22, 2016 · release notes

GitLab 8.10.0 adds deploy key API, Bugzilla integration, domain-blocked signups, and manual pipeline actions.

Add API endpoint projects/:id/deploy_keys for admins to get all deploy keys
Allow to pull code with deploy key from public projects
Add API deploy_keys for admins to get all deploy keys
Add Bugzilla integration. !4930
Added the ability to block sign ups using a domain blacklist.

+2 more show less

Allow to define manual actions/builds on Pipelines and Environments
Expose {should,force}_remove_source_branch

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Deprecate APIs "projects/:id/keys/...". Use "projects/:id/deploy_keys/..." instead

8.9.0 Jun 22, 2016 · release notes

GitLab 8.9 introduces Environments/Deployments, U2F auth, CI artifacts filtering, and multiple API endpoints for Sidekiq and MR merging.

Add Environments and Deployments features to track application deployment states
Add support for using Yubikeys (U2F) for two-factor authentication
Add artifacts:when option to .gitlab-ci.yml to control artifact retention based on job status
Add API endpoint for Sidekiq Metrics via /api/v4/sidekiq/queue_stats and related paths (detailed in #4653)
Add sha parameter to MR merge API endpoint to ensure only reviewed changes are merged

+2 more show less

Allow enabling wiki page events from Webhook management UI
Implement fair usage of shared runners for CI resource allocation

7 details in Everything

8.8.0 May 22, 2016 · release notes

GitLab 8.8 adds Container Registry auth service, /health_check endpoint, label API, inline diffs, and snippets

Added InlineDiffFilter to the markdown parser.
Added /health_check endpoint for checking service status.
Added authentication service for Container Registry.
Added l shortcut to open Label dropdown on issuables and i to create new issue on a project.
Added support for suppressing text diffs using .gitattributes on the default branch.

+4 more show less

Added API endpoints for un/subscribing from/to a label.
Added snippets tab under user profile.
Added since and until operators to commit requests via API.
Expose Issue#user_notes_count via API.

9 details in Everything

8.7.0 Apr 22, 2016 · release notes

GitLab 8.7 adds project archival endpoints, job-level CI env vars, due dates for issues, and new dashboard views.

Add POST /projects/:id/archive and DELETE /projects/:id/archive API endpoints to archive or unarchive a project
Add support for environment variables on a job level in CI configuration file
Add ability set due date to issues, sort and filter issues by due date
Implement Groups View as an option for dashboard preferences
Implement TODOs View as an option for dashboard preferences

5 details in Everything

8.6.0 Mar 22, 2016 · release notes

GitLab 8.6 adds confidential issues, cross-project labels, hidden CI jobs, and external users

Adds confidential flag to issues, hiding them from non-members.
Supports . prefix in .gitlab-ci.yml jobs to hide builds from project settings.
Allows defining build dependencies in .gitlab-ci.yml via dependencies key.
Enables custom artifact archive names in .gitlab-ci.yml using name field under artifacts.
Supports YAML anchors in .gitlab-ci.yml configuration files.

+5 more show less

Adds last_sign_in_at and confirmed_at fields to GET /users/* API endpoints for admins.
Returns empty array instead of 404 from commit status API when commit has no statuses.
Allows defining label descriptions via tooltip UI for issue index and sidebar.
Adds ability to subscribe to labels for notifications on related issues/MRs.
Introduces external users excluded from internal/private projects unless explicitly granted access.

10 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed default password from initial admin account; setup now requires providing a password or creating one on first visit.

8.5.0 Feb 22, 2016 · release notes

GitLab 8.5.0 adds visibility flag to project API, SAML account linking, build artifact download API, and runner management endpoints

Add visibility flag to GET /projects API endpoint
Add API support for managing runners and project's runners
Added API to download build artifacts
Allow existing users to auto link their SAML credentials by logging in via SAML

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The ssh_url key is deprecated in push, issue, merge-request and note webhooks data; use git_ssh_url instead.
!The http_url key is deprecated in push, issue, merge-request and note webhooks data; use git_http_url instead.
!The repository key is deprecated in push, issue, merge-request and note webhooks data; use project instead.
!The API endpoint merge_request/:merge_request_id/comments is deprecated; use merge_requests/:merge_request_id/notes instead.
!The API endpoint pattern merge_request/:merge_request_id/... is deprecated; use merge_requests/:merge_request_id/... instead.

8.4.0 Jan 22, 2016 · release notes

GitLab 8.4 adds GitHub PR/wiki import, CAS auth, Two-Factor enforcement, build artifacts browser, and CI lint integration.

Adds GitHub Pull Request import feature to allow importing pull requests into GitLab
Adds GitHub Wiki import feature to allow importing wikis into GitLab
Adds CAS authentication provider support for LDAP-style login flows
Enables forcing Two-factor authentication sitewide, with optional grace period via application settings
Adds build artifacts browser to CI builds page for browsing and downloading build artifacts

+2 more show less

Adds API support for looking up a user by username (GET/POST to /api/v3/user) and managing project's builds, build triggers, and build variables
Adds cache:key configuration key to .gitlab-ci.yml to allow fine-tuning cache keys in CI pipelines

7 details in Everything

8.3.0 Dec 22, 2015 · release notes

GitLab 8.3 adds auto-merge button, merge request API endpoints, events API with comments, and Git repository rake tasks.

Add button to automatically merge a merge request when the build succeeds
Add API endpoint to fetch merge request commits list
Expose events API with comment information and author info
Add open_issues_count to project API
Add rake tasks for git repository maintenance

5 details in Everything

8.2.0 Nov 22, 2015 · release notes

GitLab 8.2.0 adds build artifacts, Release notes support via git tags, group milestones, Sherlock profiler, and CI cache config.

Adds ability to remove the forked relationship from project settings screen
Add allow_failure field to commit status API
Add ability to create milestone in group projects from single form
Ability to add release notes (markdown text and attachments) to git tags (aka Releases)
Expose build artifacts path as config option

+4 more show less

Allow to define cache in .gitlab-ci.yml
Added build artifacts
Added a GitLab specific profiling tool called Sherlock
Add Award Emoji to issue and merge request pages

9 details in Everything

└──▷ BREAKING ON UPGRADE

!Since GitLab CI is enabled by default, removing enabling it by pushing .gitlab-ci.yml

8.1.0 Oct 22, 2015 · release notes

GitLab 8.1.0 introduces Builds View, Commit Status API, automatic CI enablement via .gitlab-ci.yml, and Web Editor directory creation.

Adds the Builds View to visualize CI pipeline history within a project.
Adds the Commit Status API for querying build statuses programmatically.
Automatically enables CI when a .gitlab-ci.yml file is pushed to the repository.
Adds ability to create directories using the web editor or Files page.
Adds when keyword support in .gitlab-ci.yml for conditional pipeline execution.

+1 more show less

Adds new CI environment variables CI_BUILD_TAG, _STAGE, _NAME, and _TRIGGERED.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Removes Continuous Integration page from the dashboard in favor of integrated project views.

8.0.0 Sep 22, 2015 · release notes

GitLab 8.0.0 introduces first-class CI integration with Drone, custom project importers, global labels, and several API additions.

Adds Added Drone CI integration (Kirill Zaitsev) to allow users to trigger builds via the GitLab UI
Adds Ability to fetch merge requests from refs/merge-requests/:id for programmatic access to MR data
Adds Allow configuration of import sources for new projects to support FogBugz and other external imports
Adds Global Labels that are available to all projects for cross-project issue organization
Adds Ability to get user information by ID of an SSH key via the API endpoint

+4 more show less

Adds Added service API endpoint to retrieve service parameters for programmatic configuration inspection
Adds Allow displaying of archived projects in the admin interface for administrative oversight
Adds Add pg_schema to backup config key for database schema specification in backups
Adds Add ability to add custom text to the help page content

9 details in Everything

└──▷ BREAKING ON UPGRADE

!Restrict users API endpoints to use integer IDs, potentially breaking clients passing string IDs for users

GitLab

Summary

How GitLab helps

Languages

Features

What GitLab offers you

release 10 total

release 7 total

release

example

release

release

release

release

example

release

release 8 total

example

release

release

release

example

release 7 total

release 38 total

docs

release 25 total

example

release 20 total

example

release 22 total

release 20 total

docs

example

release 21 total

example

release 19 total

example

release 17 total

example

release 15 total

example

release 17 total

example

release 13 total

example

release 14 total

example

release 17 total

release 14 total

release 14 total

release 12 total

example

release 10 total

example

release 11 total

release 9 total

example

release 10 total

release 9 total

example

release 10 total

release 9 total

release 9 total

release 8 total

example

release 9 total

release 9 total

release 8 total

release 8 total

release 8 total

release 8 total

release 8 total

release 8 total

release

example

release 7 total

release 7 total

release

example

release