What's new in GitLab

Monthly releases, developer resources, and the latest from the GitLab team.

Monthly releases

Latest release

September 17, 2026

Expand agentic automation and governance to the surfaces your developers work in

With GitLab 19.4, the guardrails follow your agents wherever they run. You delegate whole objectives, decide what each job costs, and see security posture across every project in your organization on one dashboard.

Read the release notes

Blog

GitLab Duo CLI takes a task from goal to done

Automate an open-ended objective instead of prompting step by step. Describe your outcome and let GitLab Duo CLI drive the work while you stay in control. The /goal slash command runs locally in interactive mode on GitLab Premium and Ultimate, verifying your progress against your standards for delivery.

Blog

Optimize your team's price-performance with hosted open weight models

As an administrator, choose the model for each job instead of standardizing on one. Send high-volume, routine agentic work to a lower-cost model and save frontier models for complex tasks. Kimi K3, GLM 5.3, and MiniMax M3 are now selectable for agents, flows, and agentic chat. Your current default keeps running until you say otherwise.

Blog

New MCP tools help platform teams scale automation safely

Extend your team's automation across new CI/CD, merge request, work item, vulnerability, and project tools, governed by the same controls covering their agents. Available in beta.

Blog

See who spent your AI credits and set fair caps per team

See what your agentic automation costs and who spent it. Set a default limit for everyone on the GitLab Credits usage caps page, then override it per user. Export usage per billable event to report spend and show each department what it consumed against what it committed.

Docs

GitLab Duo Slack Agent (Experimental)

Automate work where it starts by mentioning @GitLab in a Slack channel or thread to ask about a codebase, trigger a flow, or create an issue from the conversation. GitLab Duo streams its progress back into the thread so you know what happened.

This month's Notable Contributor: @jspagnola

Jimmy is a Level 4 contributor recognized for work spanning the GitLab codebase, client-go, and the Terraform provider, covering end-to-end management of tokens, service accounts, and push mirrors through infrastructure as code.

Secure

Analyze

Organization security dashboards (Beta)

See security posture across all top-level groups in an organization from one page, instead of stitching group reports together by hand. Users can see vulnerability counts, vulnerabilities over time, top CWEs, risk score, and vulnerabilities by age. Available in Beta on GitLab.com. To view the dashboard, you must have the Owner role for the organization, plus Advanced search and advanced vulnerability management.

Secure

Malicious package detection in Dependency Scanning (Beta)

Dependency Scanning now checks your dependencies against GitLab malware advisories, so typosquatted packages and compromised maintainer accounts surface before they are widely known. Findings carry a Critical severity and a Malware badge, plus the malware rule in your approval policies blocks them at the merge request.

Secure

Advanced SAST includes Kotlin, Dart, and Scala language support

Scan your Kotlin, Dart, and Scala code with the same taint analysis you already get on Java and Python. Findings report as code flows from source to sink across Android APIs, Flutter and Dio, Play, Slick, and Akka.

Secure

Vulnerability tools added to the GitLab MCP server

Now you can triage your security findings from your agent instead of the Vulnerability Report. Agents list and inspect results, then dismiss, confirm, revert to detected, override severity, or create a linked issue, and ask before each change by default.

Secure

SPDX license expression support in dependency and license scanning

Write license policies that understand compound declarations. Expressions such as MIT OR Apache-2.0 previously read as unknown and could slip past approval, but composite licenses now appear in your dependency list and your approval policies allow or deny them like a single-license dependency.

Secure

Automated triage and remediation profile

Set your automated security posture once for a group instead of project by project. One profile applies false positive detection, vulnerability resolutions, and auto-remediation across SAST, secret detection, and dependency scanning, through the GraphQL API.

Secure

Analyze

Aggregated scanner coverage in security inventory

See scanner coverage for your whole group hierarchy on one page, then close the gaps without leaving it. A coverage widget totals every project across the group and its subgroups and shows the percentage and count where each scanner is turned on, not turned on, failing, or stale. Filter to one scanner, select a status, and turn scanners on for the projects that are not covered.

Plan

Code

Build

MCP server tools

Hand your agent a full loop task. Have it search, read, create, and update issues, epics, tasks, incidents, objectives, and key results, and comment or reply inside a discussion thread for you. It can carry a merge request from open to merge without leaving your IDE: open and update the MR, inspect diffs, conflicts, and approvals, batch line-level review comments into one call, and merge once checks pass. And when a build fails, save_pipeline runs, retries, or cancels the pipeline from any MCP client while get_job returns the job trace, so the agent reads the log and tells you why.

Manage

Rate limits on GitLab.com will align to your subscription

To keep GitLab.com fast for everyone on it, we're updating rate limits to align with your subscription tier starting October 19, 2026. Free accounts and unauthenticated requests will change first, followed by Premium and Ultimate in January 2027. Keep your automation running on your plan's full allowance by authenticating its requests.

Manage

Model selection for the Developer Flow

Control what the Developer Flow costs you separately from the rest of GitLab Duo Agent Platform. As an administrator, you select the Developer Flow's model independently, so you make cost and capability decisions per flow.

Redesigned session details panel

See what triggered an agent session and what it produced at a glance. An overview bar carries status, timestamps, and the triggering user, as well as a Linked items section to separate what started the session from the merge requests, work items, jobs, and comments it produced.

Code

Merge request created event trigger

Get a first-pass review waiting before anyone picks the merge request up. The merge request trigger previously fired only on Approved, Marked ready, and Merge conflict. Select Created and your flow or external agent runs as soon as the merge request opens in draft or ready state and GitLab generates the diff. Configure it under AI > Triggers in your project.

Code

See who locked a file or directory

Check who locked a file, and unlock it yourself. A locked file previously showed only a Locked label, with no way to tell who locked it or whether you could unlock it yourself. A popover beside the label now names the person, and gives you an unlock action if you have permission or an explanation if you do not. For a locked directory, it links you straight to the file blocking your changes.

@DhairyaMajmudar, @gkepas, @arunsdev, and @Mahaveer1013

New tools for GitLab's MCP server

Community contributors added tools that let an agent read project metadata and members, list a repository's branches, list merge requests across a whole group, and fetch a GitLab Duo session to see what an earlier run did. Semantic search was consolidated into one aggregated tool. These ship alongside the new GitLab MCP server tools in 19.4 and run under the same tool governance, so an agent using them follows the rules your team already set.

@Gamezordd, @gerardo-navarro, and @Mahaveer1013

The merge request widget is now more specific

While GitLab is still checking a merge request, the widget now says so. "Merge conflicts must be resolved" becomes "Checking for merge conflicts" until the check returns. When a rebase is refused you see the reason, such as "Source branch is protected from force push", instead of a generic retry prompt. You act on the current state of the merge request.

@skkzsh

Preview a new file before you commit it

The new file page now has Write and Preview tabs, the same pair the edit page has had for years, so you can see how a Markdown or AsciiDoc file will render before its first commit ever exists. Preview keeps up with you — rename a file mid-edit from .txt to .md and the preview switches renderer, rename it away from Markdown and the live preview stops. Snippets gained Markdown live preview too, reached from the editor's right-click menu.

@and2345, @duewel1982, @vertisan, @Taucher2003 (Bildungsinnovator), @BoxBoxJason, and @pravi (Debian GNU/Linux)

Additional feature enhancements

You can fetch a specific report artifact straight from the API, restricted to downloadable types and gated by a per-artifact authorization check — for example, for a JUnit file, using GET /projects/:id/jobs/:job_id/artifacts?file_type=junit. Administrators can let clients choose between a direct 302 redirect and a proxied transfer for job artifact and package downloads. The pipeline editor now validates CI/CD keywords the backend already supported. An email with an empty subject line now opens a Service Desk ticket instead of bouncing. You can raise dependency resolution limits yourself with two new timeout inputs on the Dependency-Scanning.v2 template. Administrators can set achievements to appear on profiles without each person accepting an emailed link.

@rantoniuk, @Vchekryzhov1, @priyansh3133, @aryanndwivedi2403, @skkzsh, and @Jorgagu

Other additions to the interface

Filtering the issue list by created, closed, due, and updated date is now generally available, with the flag removed and the capability on for everyone. When you cherry-pick a commit and start a merge request from it, a new checkbox copies the source merge request's description instead of applying the project template. /internal_note marks a comment internal as you create it, which means internal notes can now live inside comment templates and saved replies. Separately, /type Epic on an issue promotes it to an epic, the same as /promote_to Epic. Links in Mermaid flowcharts open, and diagrams render without clipping in Chrome on iOS.

@tnt4brain

Diagnose LDAP group sync issues from the group page

When an LDAP group sync fails, the reason now reaches you. The failure is recorded against the group, the specific members that caused it are named (up to five), and a danger alert appears on the group members page, so a sync blocked by an email-domain restriction is diagnosable from the UI. You can also narrow which LDAP entries count as groups with a new group_filter setting. The audit log also now distinguishes causes that previously shared one entry — LDAP group links created and removed, and users blocked by LDAP sync, each get their own audit event type. Available in Enterprise Edition.