Tag

#gitlab

Tagged “gitlab”

17 articles

GitLab's Co-Create recap lands W3C trace context and merge-train limits in CI/CD

GitLab's half-year Co-Create program recap flags three shipped CI/CD changes: new W3C Trace Context variables in pipeline jobs, configurable merge-train pipeline limits, and a REST API for Terraform state protection rules.

Sep 13, 2026 · Maya Okonkwo Security & supply chain

GitLab's critical patch: unauth file read from the commits API

GitLab 19.3.2, 19.2.6 and 19.1.8 ship eighteen CVEs' worth of fixes, including a Critical unauthenticated arbitrary-file read on the repository commits API. Self-managed operators have a downtime problem stacked on top of a rotate-your-CI-variables problem.

Sep 11, 2026 · Tomás Vega Runners & infrastructure

GitLab Dedicated stops asking you to run the runners

GitLab Dedicated now ships with hosted runners, so single-tenant customers no longer have to build and patch their own fleet. Every other hosted CI splits the same problem differently, and each split has a rough edge.

Sep 7, 2026 · Priya Nair CI performance

GitLab wants to end the default full-history clone in CI

A GitLab engineering post argues that defaulting to a full-history git clone imposes a real, cumulative tax on end-to-end pipeline time, and floats a clone override policy to bring the cost down.

Aug 25, 2026 · Priya Nair Security & supply chain

GitLab's mid-month patch train fixes a CI/CD pipeline authorization bypass

GitLab shipped 19.2.2, 19.1.4 and 19.0.6 with 13 CVEs, including an authorization bypass that let developer-role users run CI pipelines against protected branches. Self-managed operators should upgrade immediately.

Aug 13, 2026 · Maya Okonkwo Security & supply chain

GitLab wires Anthropic's Claude security tooling into its pipeline via MCP

GitLab has published its take on how Anthropic's Claude security tooling hands work off to the GitLab pipeline through the GitLab MCP server. The division of labour is tidy on a slide and messier the moment you draw the trust boundary.

Aug 8, 2026 · Tomás Vega Security & supply chain

GitLab Secrets Manager reaches beyond CI jobs to ESO, Terraform, and an API

GitLab has pushed its Secrets Manager into public beta with three new consumers beyond CI jobs: External Secrets Operator for Kubernetes, a Terraform/OpenTofu data source, and a Vault-compatible API. OpenBao powers it under the hood.

Aug 6, 2026 · Tomás Vega Developer experience

GitLab Duo CLI hits GA: the Duo Agent Platform lands in the terminal

GitLab Duo CLI reached general availability with GitLab 19.2, bringing Duo Agentic Chat into the shell with interactive and headless modes and sessions shared across the UI and editor extensions.

Jul 18, 2026 · Priya Nair Supply chain security

GitLab tries to auto-fix the transitive-dep problem it keeps quantifying

GitLab has moved Dependency Scanning Auto-Remediation into beta, aimed squarely at the transitive supply-chain risk it just spent a research cycle measuring. The interesting question is not whether the fix ships, but whether anyone downstream trusts the bot enough to merge it.

Jul 17, 2026 · Tomás Vega Platform engineering

GitLab packages Duo Agent Flows so multi-step runs share the platform's controls

GitLab is naming a shape for multi-step agent work, Duo Agent Flows, that inherits the same access controls, triggers and review gates as any other pipeline object. The pitch is a middle ground between chat that only answers and homegrown scripts that go stale the moment the platform changes.

Jul 17, 2026 · Maya Okonkwo Code quality & testing

GitLab Duo Security Review Flow goes after the logic bugs SAST leaves on the floor

GitLab moved Security Review Flow into public beta on the Duo Agent Platform. You add it to a merge request like a human reviewer, and it focuses on authorization and business-logic bugs that pattern-based scanners typically miss.

Jul 17, 2026 · Priya Nair AI in CI/CD

GitLab shipped a real migration with AI agents and wrote up what actually broke

GitLab's engineering post walks through using its Duo agents to unify two rate-limiting paths across 121 keys and 95 call sites, wrapped in a spec-and-review loop with one honest shadow-mode incident along the way. Here is what a DX-minded reader can lift from it.

Jul 10, 2026 · Priya Nair Developer experience

Anthropic's newer Sonnet lands on GitLab Duo, routed through the AI Gateway

GitLab has added Anthropic's Claude Sonnet 5 to its Duo Agent Platform across every tier and deployment model, delivered through the platform's AI Gateway. Here's what that gateway hop actually changes for the engineer waiting on the pipeline.

Jul 4, 2026 · Priya Nair Platform engineering

Cursor unveils Origin, an agent-first Git host; GitLab and Zed take other paths

Graphite co-founder Tomas Reimers unveiled Origin, a Git-compatible code host built from the ground up for AI agents, at an invite-only Cursor conference. GitLab and Zed are pursuing different rebuilds of the same model.

Jun 22, 2026 · Maya Okonkwo Platform engineering

GitLab 19.1 makes the AI Catalog event-driven and gives admins the off switch

Duo Flows in the AI Catalog can now fire on merge-request and pipeline events instead of waiting for a human click, and the same release ships admin controls to disable custom agents, scope the catalog to a group hierarchy, and validate flow config at save time.

Jun 20, 2026 · Maya Okonkwo Security & supply chain

GitLab 19.1 makes AI secret triage GA, and lets admins lock Duo on across an instance

GitLab 19.1 ships with two changes platform teams have to plan a rollout around: a generally available AI pass that scores secret-detection findings, and an always-on availability mode that lets administrators force Duo on for an entire instance or top-level group.

Jun 19, 2026 · Maya Okonkwo Security & supply chain

GitLab 19.1 pulls third-party scanners into one vulnerability view, SARIF and all

GitLab 19.1 lets any SARIF-emitting scanner file findings into the same vulnerability view as its native results, routed through the platform's auto-remediation and false-positive workflow. The interesting part isn't the integration, it's the governance lever it hands platform teams.

Jun 19, 2026 · Tomás Vega