Surprisingly Useful AI Article Enhancements
GitLab has released version 19.2 of its DevSecOps platform, introducing a suite of agentic automation features designed to address a growing problem in software development: as AI generates more code, the downstream burden on security reviews and dependency management has become harder for human teams to manage.
The release centres on using AI agents to fix vulnerable dependencies automatically, catch logic flaws that traditional scanners cannot detect and allow teams to build custom agentic workflows that operate under existing organisational controls.
A Forrester Consulting study commissioned by GitLab found that organisations using the GitLab Duo Agent Platform can achieve a 400 per cent return on investment with payback in under six months.
The bottleneck has moved downstream
The central argument behind GitLab 19.2 is that AI-assisted coding tools have shifted where pressure builds in the software development lifecycle. Writing code has become faster, but reviewing it, securing it and managing its dependencies has not kept pace.
Manav Khurana, Chief Product and Marketing Officer at GitLab, framed the release in those terms.
“Coding agents made it possible to generate far more code and moved the bottleneck downstream to reviews and security,” Khurana remarked. “GitLab 19.2 puts agents to work on that bottleneck: fixing vulnerable dependencies, catching the flaws scanners miss, and automating the steps in between with a person still approving what ships.”
The release includes four headline features: Dependency Scanning Auto-Remediation, Security Review Flow, GitLab Duo CLI and Custom Flows. Each targets a different part of the problem.
Automated fixes for vulnerable dependencies
Dependency Scanning Auto-Remediation, now in public beta, is designed to reduce the security backlog created by vulnerable third-party packages without requiring developers to manually upgrade each one.
The feature targets a specific and growing risk. A study of the Maven ecosystem cited by GitLab found that vulnerabilities reach roughly 63 per cent of latest releases through transitive dependencies, meaning packages that a project relies on indirectly rather than by deliberate choice. Roughly one in eight dependency updates introduces a breaking change, which adds further complexity when teams attempt manual upgrades.
When GitLab’s dependency scanner identifies a vulnerable package, the system automatically opens a merge request with a suggested fix. If the upgrade breaks the build, AI agents iterate on the problem within the same merge request, attempting to resolve breaking changes without human intervention.
Critically, every automated change still passes through existing approval gates and leaves a full audit trail. Teams can configure severity thresholds and version scope to control which vulnerabilities trigger automated remediation.
The feature has two components. Automated dependency version bumps handle straightforward upgrades, while Agentic Breaking Change Resolution tackles more complex updates where a simple version bump causes pipeline failures. The latter analyses pipeline errors, the dependency’s changelog and how the codebase uses the dependency before committing fixes.
Catching the flaws scanners miss
Security Review Flow, also now in public beta, addresses a class of vulnerabilities that pattern-based static analysis tools cannot structurally detect.
Traditional scanners work by matching code against known vulnerability patterns. They are effective at identifying common issues but struggle with application-logic flaws such as broken authorisation, race conditions and business logic errors. These types of vulnerabilities have historically required manual security review or penetration testing, both of which are difficult to scale.
Security Review Flow takes a different approach. Rather than pattern matching, it reasons about what code is intended to do and looks for discrepancies between that intent and the actual implementation. It can detect broken object-level and function-level authorisation, missing authorisation on state-changing operations, information disclosure, mass assignment, business logic errors and race conditions.
Related: Best Business Laptops for work & school
Related: Best Gaming Laptops
Related: Best Portable Laptop
Findings are posted as threaded comments at the exact lines where vulnerabilities occur within merge requests, each with a Common Weakness Enumeration (CWE) classification, severity rating and, where possible, a suggested fix that can be applied without leaving the merge request.
The system does not approve code on its own. A human reviewer always makes the final call on whether changes ship.
Agents in every developer’s terminal
GitLab Duo CLI has moved to general availability across GitLab.com, Self-Managed and Dedicated deployments. The tool brings the GitLab Duo Agent Platform’s agents directly into the terminal, where developers do much of their daily work.
Unlike standalone AI coding assistants, GitLab Duo CLI has context about a developer’s GitLab projects, pipelines and agent configurations. This project-aware context is designed to produce more relevant responses than generic tools that lack visibility into the specific environment a developer is working in.
The CLI supports two modes: interactive chat for ad-hoc queries and headless mode for CI/CD integration. It includes administrator controls for organisation-wide rollout, model selection, tool approvals, Model Context Protocol (MCP) connections and support for customisation files.
Administrators can control rollout across their organisation, turning the feature on or off for self-managed and dedicated deployments.
Custom agentic workflows go GA
Custom Flows, which allow teams to build their own agentic automation sequences, have also reached general availability. The feature lets teams define workflow steps, components and triggers so that repetitive development and operational work runs automatically in response to GitLab events.
Flows are defined in YAML and can be triggered by mentions, assignments, pipeline events and merge request lifecycle events. They support multi-agent orchestration for complex tasks and user-defined human-in-the-loop checkpoints for approval at sensitive steps.
A notable addition in 19.2 is the ability for Custom Flows to authenticate to external services using short-lived, job-scoped tokens. This means automation that reaches cloud providers or internal APIs uses the same keyless pattern that GitLab CI/CD pipelines already trust, rather than requiring long-lived credentials.
GitLab is also working on a Flow Creation Agent that can turn a natural-language description into a custom flow, though this is listed as upcoming rather than available in the current release.
Improved CI/CD pipeline repair
The Fix CI/CD Pipeline Flow, one of GitLab’s foundational flows that ships ready to use, has been improved in 19.2. It now classifies pipeline failures before acting, which GitLab argues produces more targeted diagnoses and fixes.
When relevant files are already in a merge request diff, fixes are delivered as code suggestions directly on that merge request. The flow also analyses child pipeline failures across the full pipeline hierarchy and supports customisation through AGENTS.md files.
GitLab Duo’s Agentic Chat can now delegate multi-step work to agents and start foundational flows from within the chat interface. When a request matches a specialist workflow, Agentic Chat hands off to the appropriate flow, whether that is implementing changes, reviewing a merge request or diagnosing a failed pipeline.
Audit and governance controls
GitLab 19.2 introduces several features aimed at making agentic automation auditable and governable at scale.
The AI Audit Event Report, now in beta, records AI-assisted actions as dedicated audit events. Each agent session produces an audit artifact that captures inputs, model and configuration context, a chronological event timeline and outputs. Security and compliance teams can browse these events, filter by agent and session details and download the underlying session artifacts.
Group-level custom instructions for GitLab Duo Code Review allow administrators to set review behaviour across projects at once, rather than configuring each project individually. Instance-level custom review instructions are also now available for self-managed and dedicated deployments, giving organisations a single source of truth for review standards.
New MCP access controls govern which agents can run and what they can reach, while selective GitLab Duo availability for subgroups lets administrators enforce a default-deny, per-subgroup allowlist on dedicated instances. This means compliance teams can lock specific subgroups out of GitLab Duo entirely while leaving others available.
Fine-grained access tokens and other security additions
Fine-grained personal access tokens have reached general availability. Unlike legacy tokens that grant access to every project and group a user belongs to, fine-grained tokens can be limited to specific resources and actions. The feature now has complete coverage for REST API endpoints and coverage for commonly used GraphQL types and mutations.
Non-default branch tracking, now in beta, allows teams to track vulnerabilities on branches other than the default branch. This is aimed at teams that maintain long-lived release branches for specific environments or deployment platforms.
Vulnerability report exports now correctly apply filters, so exported CSV files only contain filtered data. Security managers can also now configure agentic flows including SAST vulnerability resolution, SAST false positive detection, Secrets false positive detection and Dependency Scanning vulnerability resolution for projects.
Additional platform changes
The release includes a number of broader platform updates. Scheduled pipeline execution policies have reached general availability, allowing teams to define security scan and compliance script schedules in a security policy project and enforce them across all projects in scope.
GitLab Duo can now read and respond to reviews in merge requests, giving AI assistants full context of reviewer feedback and discussion history. A new “Resolve with GitLab Duo” option lets developers resolve code review comments directly, with the AI implementing the requested change and committing it to the branch.
Automatic rebase before merge removes a two-step process that previously required developers using semi-linear or fast-forward merge methods to manually rebase before merging.
The CI Expert Agent has reached general availability, providing AI-powered assistance for creating, debugging and optimising GitLab CI/CD pipelines. It integrates with Orbit, GitLab’s knowledge graph feature currently in beta, for more contextual pipeline recommendations.
Custom Agent validation now checks prompt configurations when creating or updating custom agents, preventing silent failures that previously occurred when prompts tripped security rules.
GitLab Runner 19.2 ships alongside the platform release, adding a circuit breaker that falls back to Rails when KAS job requests fail consecutively and fixing several bugs including secret resolution misclassification and context deadline errors.
Last Updated on July 18, 2026 by Nick Ross
