What's new

Handle review feedback, merge conflicts, and implementation through a steerable agentic loop rather than manual steps between issue and merge.

Trigger from issue and MR discussions, matching how teams actually work rather than requiring a dedicated button.

Enforce team standards through AGENTS.md and configuration files so agent output is verifiable against conventions, tests, and environment expectations.

Run with full GitLab-native context across issues, MRs, and repositories.

Expand beyond build and test pipelines to cover deployment configuration, caching, parallelization, and CI Catalog composition.

Support iterative refinement as the agent learns from pipeline execution history and failure patterns.

Reduce the gap between writing code and getting it into a running, production-ready pipeline.

Analyze conflicting changes in context and propose resolutions that respect both sides of the conflict.

Reduce the time developers spend on manual conflict resolution, particularly in active repositories with frequent concurrent changes.

Work within the existing merge request workflow without requiring external tooling.

Set review standards, coding conventions, and focus areas at the group level.

Apply consistently across all projects within a group without per-project configuration.

Give teams confidence that AI-assisted reviews follow the same standards as human reviewers.

Surface per-component and per-version usage data so platform teams can identify outdated or vulnerable versions in production pipelines.

Provide cross-project visibility for deprecation planning, security fixes, and upgrade rollouts.

Support enterprise governance of shared CI at scale with native analytics tied to GitLab's component model.

Allow developers to set input parameters at the time of triggering an MR pipeline.

Support dynamic inputs based on earlier job outputs or external conditions.

Reduce deployment errors from parameter mismatches and simplify CI/CD tool consolidation.

Bring Maven to production readiness with allow/deny filtering, lifecycle policies, Geo support, and analytics.

Extend the virtual registry architecture to npm for JavaScript/Node.js teams, targeting GA after beta.

Move Docker Virtual Registry from experiment to GA, completing the container image solution.

Reduce reliance on multiple external artifact management tools by consolidating package types within GitLab.

Support enterprise-scale artifact governance alongside existing CI/CD and security workflows.

Build on the virtual registry foundation to provide a broader artifact management solution.

Automatically assign reviewers based on CODEOWNERS patterns matched against MR changed files.

Support both group and individual user assignments.

Preserve manual override with audit trail for automatic vs. manual assignments.

Lay the foundation for DAP-powered intelligent reviewer selection that considers expertise and availability.

Be available at the project level for Premium tier.

Support roadmap, board, and view availability within project context.

Remove the need for subgroup workarounds to group issues within a project.

Address the needs of customers wanting to migrate, by providing project-scoped planning.

Scope authentication to a specific organization for clearer access boundaries.

Support enterprise requirements for tenant isolation and identity management.

Build toward a fully organization-aware GitLab experience.

Support secret creation with expiration and environment/branch scoping.

Provide rotation reminders for proactive credential management.

Offer granular CRUD permissions at project and group level.

Reduce reliance on third-party secrets managers for CI workflows.

Provide more accurate and comprehensive dependency detection through SBOM ingestion.

Support Maven and Python with additional language ecosystems following.

Reduce false negatives from analyzer gaps by grounding detection in the actual software bill of materials.

Configuration of which branches are tracked for vulnerability management beyond the default branch.

Local scoping of vulnerability state changes to each branch with an option for global changes.

Branch-aware filtering on the vulnerability report for release-specific security posture views.

Vulnerability management activity on tracked non-default branches as on default.

Enforce scheduled security scans via policy without requiring developer pipeline configuration.

Provide continuous compliance coverage for security-critical scan types.

Ensure organizations maintain scanning cadence regardless of development activity.

Build on test-run validation capabilities for confidence before production rollout.

Connecting security policies to business-context attributes like business impact, application, and business unit.

Supporting targeted policy enforcement scoped to specific asset classifications.

Validating policy-attribute combinations through initial testing.

Scan historical repositories for previously committed secrets.

Cover pipeline artifacts for exposed credentials.

Provide complementary coverage alongside secret push protection.

Support staggered rollout to help prevent infrastructure overload.

Dependency scanning across projects through Security Inventory.

Keeping the same zero-YAML, profile-based enablement approach as secret detection and SAST profiles.

Reducing configuration overhead for teams adopting comprehensive security scanning.

Allow organizations to define custom secret patterns for proprietary credential formats.

Enforce custom rules alongside built-in detection rules automatically.

Catch organization-specific leaks that generic pattern-based rules miss.

Extend secret detection coverage to match organizational security requirements.

Targets for configurable severity levels from LOW through CRITICAL.

Supporting version target selection (MAJOR, MINOR, PATCH).

Offering grouped or individual MR options for dependency bumps.

Including UI indicators highlighting auto-remediated vulnerabilities.

Provide attestations API for consumer lookup and verification.

Integrate UI linking attestations to builds with project-level views.

Support container image signing and verification for supply chain integrity.

Offer GitLab CLI (glab) attestation verification for command-line workflows.