Your developers want AI coding agents. Your source code is regulated IP that can't be sent to a third-party AI service, and your compliance team has said so in writing. The usual escape hatch, standing up your own GPU cluster and running the models yourself, means buying scarce hardware, hiring a team to operate it, and still trailing the frontier models by months. So you do nothing, and your team…
Today, you might maintain separate secret stores for CI/CD, Kubernetes, and Terraform. However, that leaves multiple tools to manage, access models to keep in sync, and audit trails to correlate when something goes wrong.GitLab Secrets Manager now supports External Secrets Operator (ESO) and Terraform, extending secure secret retrieval beyond CI/CD pipelines. Powered by OpenBao, GitLab Secrets Man…
Agentic coding is moving faster than many enterprise governance programs can keep up with. Coding assistants, like the Claude security guidance plugin and Claude Security, can flag and fix common vulnerabilities in code as it's written, in the same session. This is valuable for writing more secure code, but security doesn't stop there. A commit is one stage in the path to production: Merges, depen…
AI code completion built human review into the process by design. A developer types, a suggestion appears, and a human decides whether to accept it. A person looked at every line before it shipped.Agentic AI breaks that review loop. An agent can open a merge request, call a tool, modify a CI/CD configuration, and push a change, sometimes without a person reviewing each individual step. Add in the…
This week GitLab signed the Open Weights and American AI Leadership letter, joining a long list of other technology companies that support a strong, open AI ecosystem.The letter argues that open weights spur innovation, give customers greater control, and provide an important path to AI safety and security. In addition to being a policy position we share, it’s core to how we think about agentic en…
A mistake on a routine task can cost you a minute. A mistake on a large refactor or a debugging trail spanning months of commit history can cost far more, as it compounds silently over hundreds of exchanges. By the time you catch it, every step built on top of it needs unwinding, too. That's the difference between work that rewards speed and high-complexity work that requires getting it right the…
"Modernize Java 8 to Java 21" sounds like one task. It is not. It touches the build, the runtime, dependencies, APIs, concurrency, tests, containers, and production behavior, often all at once. Ask an agent to do all of that in one prompt, and you get one enormous merge request that nobody can safely review.Cursor, an AI coding agent, is good at the focused part of that problem. Give it one failin…
A new, event-driven trigger in GitLab Duo Agent Platform lets flows fire the moment a work item is created, turning triage and assignment from a manual, all-day chore into automation that runs in seconds. This comprehensive guide shows you how to use the "Work item created" trigger and follow along with this video demonstration:See the flow fire, route, and assign in real time — and imagine what c…
We gave a few thousand developers GitLab Orbit. Then we got out of the way. The community responded with creative solutions to real production problems slowing down their teams. The same problems you hit every week: What does this change break, which tests actually matter, and what will this migration really cost.GitLab Orbit is a live, queryable graph of your code, merge requests, pipelines, depl…
AI is writing more code and pulling in more dependencies, increasing application risk. Most of that exposure isn't from code your team actively chose. A 2025 study of the Maven ecosystem found vulnerabilities reaching roughly 63% of latest releases through transitive dependencies, versus 31% through direct ones.Dependency Scanning Auto-Remediation, now in beta, closes the loop for security. When d…
Most of the work for software delivery doesn’t happen only in the editor. Pipelines fail. Tests break. Vulnerabilities show up. And a lot of that work starts and ends at the command line.Agentic AI in the terminal that only understands code can’t help with any of that. A standalone assistant doesn’t know your agents across the entire software lifecycle, your permissions across many projects in you…
Static scanners excel at catching vulnerabilities that fit a known pattern, like unsanitized query inputs, hardcoded secrets, and unsafe deserialization. They struggle against flaws in your application’s logic, where there is no pattern to match — only valid code doing the wrong thing for your domain. Undetected, these flaws surface late and cost more to fix.Security Review Flow, now in public bet…
Knowing what to do next in software development is rarely the hard part. Doing it again in the exact same steps — implement an issue, fix a pipeline, review a merge request — is. Chat that only provides answers still leaves every handoff to you. Homegrown scripts don’t inherit changes in access controls, new triggers, or updated review gates. In both cases, the multi-step paths teams rely on conti…
A new Forrester Consulting Total Economic Impact™ study found that organizations using GitLab Duo Agent Platform achieve a 400% return on investment and $7.5 million in net present value over three years — with payback in under six months.Agentic coding makes developers faster. The harder problem is how enterprises turn speed into return. Faster commits are only part of the equation when it comes…
A typical software team runs hundreds of CI/CD jobs a day. Each one runs on compute and burns energy that doesn't show up in your pipeline logs, including its carbon impact. That invisibility is exactly the problem.You can't reduce what you don't measure.Eco CI and Carmen are third-party integrations that add a carbon lens to the pipelines you're already running in GitLab. Both are open source too…
A small team at GitLab spent the past few weeks running an experiment: Could we use AI agents to migrate part of our legacy rate-limiting system without dropping the safety bar?Short answer: yes. AI agents do work. They can also expose weaknesses in how you usually work. The pod, the loop, and the observability mattered more than the agents. What follows is how we structured the work using GitLab,…
GitLab restricted access for instance admins, group owners, and billing managers enables predictable seat costs with less manual gatekeeping. The feature has been significantly improved and is now more complete for the workflows that commonly affect seat usage. This update closes the gaps around identity provider provisioning, dormant user reactivation, and sign-in flows so organizations can use r…
Anthropic’s Claude Sonnet 5 is now available on GitLab Duo Agent Platform across all tiers and deployment models through GitLab's AI Gateway. Claude Sonnet 5 is built for work that agents assist software teams with every day: multi-step tasks, generating code that holds up under review, and conducting workflows affordably at scale. It’s also the first model in GitLab's evaluation suite to complete…
The Git project recently released Git 2.55.0. Let's look at a few notable highlights from this release, which includes contributions from the Git team at GitLab.What's covered:git-history(1) learns fixupfsmonitor daemon for Linuxgit push to a remote groupLimiting git log --graph lane widthEvolution of Rust in the Git codebaseFaster git-grep(1) and git-cherry(1) in partial clonesgit-history(1) lear…
Developers working in Google Antigravity can now install our lifecycle context graph, GitLab Orbit, directly from the Antigravity MCP Store and give their agents structured access to projects, pipelines, merge requests, vulnerabilities, and source code across their GitLab instance.The Orbit integration is a new addition to a family of purpose-built GitLab integrations already in the Google Cloud e…
Enterprise AI adoption often stalls not because the technology isn't ready, but because admins can't answer the question their security team is asking: What's actually running in our environment, and who put it there?GitLab 19.1 ships event-driven triggers for Duo Flows alongside the governance controls and config validation that make running them safely possible. Together, they give enterprise te…
Most enterprises use a handful of different security scanners, each configured and enforced, project by project. With no single view of what scanners run where, policies drift, blind spots go undetected, and important projects could silently go unprotected. With GitLab 19.1, you can now integrate the security scanners you already use, giving a single view of your scanner coverage. GitLab enforces…
The GitLab Partner Program continues to cultivate a thriving ecosystem of DevSecOps professionals committed to helping customers modernize their software development, from foundational DevSecOps practices to the latest AI-powered capabilities. Across Europe, the Middle East, and Africa (EMEA), our partners have once again demonstrated what's possible when deep technical expertise meets a shared co…
We're excited to share that GitLab and Capgemini have signed a global alliance partnership agreement. As a GitLab Select Partner, Capgemini will leverage the GitLab portfolio for clients globally, including GitLab Duo Agent Platform, which orchestrates AI across the entire software development lifecycle, along with specialized implementation services.For customers, that means a shorter path from p…