[{"data":1,"prerenderedAt":1026},["ShallowReactive",2],{"/blog/dependency-scanning-auto-remediation":3,"navigation-en-us":252,"banner-en-us":674,"footer-en-us":682,"blog-post-authors-en-us-Mark Settle":927,"blog-related-posts-en-us-dependency-scanning-auto-remediation":942,"blog-promotions-en-us":964,"next-steps-en-us":1016},{"id":4,"title":5,"authors":6,"body":8,"category":231,"date":232,"description":233,"extension":234,"externalUrl":235,"featured":236,"heroImage":237,"meta":238,"navigation":239,"path":240,"seo":241,"slug":244,"stem":245,"tags":246,"template":250,"updatedDate":235,"__hash__":251},"blogPosts/en-us/blog/dependency-scanning-auto-remediation.md","When a version bump breaks your build, GitLab fixes it",[7],"Mark Settle",{"type":9,"value":10,"toc":222},"minimark",[11,22,36,39,44,59,68,72,75,104,108,111,117,135,138,142,145,148,151,154,157,166,170,174,183,191,194,214],[12,13,14,15,21],"p",{},"AI is writing more code and pulling in more dependencies, increasing application risk. Most of that exposure isn't from code your team actively chose. A 2025 ",[16,17,20],"a",{"href":18,"rel":19},"https://arxiv.org/abs/2503.22134",[],"study of the Maven ecosystem"," found vulnerabilities reaching roughly 63% of latest releases through transitive dependencies, versus 31% through direct ones.",[12,23,24,29,30,35],{},[16,25,28],{"href":26,"rel":27},"https://docs.gitlab.com/user/application_security/remediate/dependency_scanning_auto_remediation/",[],"Dependency Scanning Auto-Remediation",", now in beta, closes the loop for security. When ",[16,31,34],{"href":32,"rel":33},"https://about.gitlab.com/blog/sbom-based-dependency-scanning/",[],"dependency scanning"," finds a vulnerable package, GitLab opens a merge request to update it, uses AI to fix any build-breaking changes, and iterates until your pipeline passes — with every change governed by your existing gates and audit trail.",[12,37,38],{},"As a result, security backlogs shrink without diverting developers, high-severity vulnerabilities get fixed within compliance deadlines, and breaking upgrades arrive as merge requests ready for approval.",[40,41,43],"h2",{"id":42},"why-the-dependency-backlog-keeps-growing","Why the dependency backlog keeps growing",[12,45,46,47,52,53,58],{},"Vulnerable and outdated components are a longstanding ",[16,48,51],{"href":49,"rel":50},"https://about.gitlab.com/blog/2025-owasp-top-10-whats-changed-and-why-it-matters/",[],"OWASP Top 10"," risk and a leading source of remediation backlogs. Clearing findings is slow, manual work that competes with feature delivery, leaving high-severity vulnerabilities unresolved beyond the 30-day deadlines of PCI-DSS and ",[16,54,57],{"href":55,"rel":56},"https://about.gitlab.com/blog/gitlab-dedicated-for-government-now-fedramp-authorized/",[],"FedRAMP",". Meanwhile, even in established libraries, AI-assisted exploit engineering is accelerating disclosure and weaponization.",[12,60,61,62,67],{},"Roughly one in eight ",[16,63,66],{"href":64,"rel":65},"https://link.springer.com/article/10.1007/s10664-024-10563-4",[],"dependency updates introduce a breaking change",", and many labeled backward-compatible still break the build. Teams tend to defer complex changes, and the longer those vulnerabilities sit, the more serious they become.",[40,69,71],{"id":70},"from-backlog-to-fix-without-diverting-developers","From backlog to fix, without diverting developers",[12,73,74],{},"Dependency Scanning Auto-Remediation turns vulnerable dependencies into reviewed, ready-to-merge fixes, so your team clears findings faster and spends less time resolving breaking changes. Teams see benefits in speed, effort, and control:",[76,77,78,86,98],"ul",{},[79,80,81,85],"li",{},[82,83,84],"strong",{},"Shrink the dependency backlog."," Vulnerable dependencies get upgraded as they're found, so findings don't pile up and high-severity issues stay within compliance deadlines.",[79,87,88,91,92,97],{},[82,89,90],{},"Reclaim time lost to breaking-change rewrites."," When a bump breaks the build, ",[16,93,96],{"href":94,"rel":95},"https://about.gitlab.com/gitlab-duo-agent-platform/",[],"GitLab Duo Agent Platform"," commits a fix, so developers review a working change instead of authoring one from scratch.",[79,99,100,103],{},[82,101,102],{},"Keep every change governed."," Auto-remediation drafts the change, but nothing merges until a reviewer signs off, and every MR leaves an audit trail of what changed and who approved it.",[40,105,107],{"id":106},"quickly-close-vulnerabilities-even-when-they-require-code-changes","Quickly close vulnerabilities, even when they require code changes",[12,109,110],{},"Dependency Scanning Auto-Remediation bumps vulnerabilities and fixes breaking changes in two stages:",[12,112,113,116],{},[82,114,115],{},"Automated dependency version bumping"," runs automatically when scanning detects a vulnerable dependency, opening a merge request to upgrade it to the nearest fixed version. When no eligible fix exists, the finding stays in your vulnerability report until a safe upgrade path becomes available. Every MR is attributed to a dedicated service account, making each change traceable to a distinct identity.",[12,118,119,122,123,128,129,134],{},[82,120,121],{},"Agentic breaking change resolution"," handles the tough cases when a version bump introduces breaking changes. When a remediation MR's pipeline fails because the new version breaks your project, GitLab Duo Agent Platform automatically analyzes the pipeline errors, the dependency's changelog, and how your code uses the dependency. Then, within the same MR, it commits fixes to your code so your project works with the updated version. If it can't get the pipeline passing, it stops and posts what it found to the MR so you can take it from there. Supported ecosystems include Bundler, Maven, Gradle, and major Python and JavaScript/TypeScript package managers, with ",[16,124,127],{"href":125,"rel":126},"https://gitlab.com/gitlab-org/gitlab/-/work_items/604602",[],"Rust"," and ",[16,130,133],{"href":131,"rel":132},"https://gitlab.com/gitlab-org/gitlab/-/work_items/604601",[],"Go"," planned in the months ahead.",[12,136,137],{},"Auto-remediation never merges on its own. To speed up review, each MR spells out the vulnerability it addresses, the version it moves to, and the code GitLab Duo Agent Platform suggested to keep the build passing, so approvers don't have to reverse-engineer the change.",[40,139,141],{"id":140},"how-dependency-scanning-auto-remediation-works","How Dependency Scanning Auto-Remediation works",[12,143,144],{},"Auto-remediation runs automatically when SBOM-based dependency scanning detects a vulnerable dependency with an available fix. Practitioners can also initiate it for an individual finding from the vulnerability report. GitLab then opens a remediation MR that flows through your normal review and merge process; when agentic breaking-change resolution is enabled and the version bump breaks the pipeline, GitLab Duo Agent Platform attempts to fix the resulting code changes in that same merge request.",[12,146,147],{},"Built-in safeguards keep remediation automation from becoming noise. Cooldown periods stop busy projects from triggering remediation on every pipeline, and GitLab won’t re-create a closed MR unless a newer fix is available.",[12,149,150],{},"Configure remediation to match your risk tolerance. You can target vulnerabilities of any severity from low to critical, cap how far version bumps are allowed to go (patch, minor, or major), and store settings in project- or group-level configuration profiles (via API during beta).",[12,152,153],{},"Remediation runs through your organization's own pipeline, so it inherits your existing access controls and approval gates. You also get a complete, auditable record of what changed, who approved it, and why.",[12,155,156],{},"See Dependency Scanning Auto-Remediation in action:",[158,159],"iframe",{"src":160,"frameBorder":161,"allow":162,"referrerPolicy":163,"style":164,"title":165},"https://player.vimeo.com/video/1210291456?badge=0&autopause=0&player_id=0&app_id=58479","0","autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share","strict-origin-when-cross-origin","position:absolute;top:0;left:0;width:100%;height:100%;","Dependency Scanning Auto Remediation",[167,168],"script",{"src":169},"https://player.vimeo.com/api/player.js",[40,171,173],{"id":172},"start-clearing-your-dependency-backlog-today","Start clearing your dependency backlog today",[12,175,176,177,182],{},"Dependency Scanning Auto-Remediation is in public beta. It is available on ",[16,178,181],{"href":179,"rel":180},"http://GitLab.com",[],"GitLab.com"," and rolling out to GitLab Self-Managed and GitLab Dedicated.",[12,184,185,186,190],{},"Ready to try it? Check out the ",[16,187,189],{"href":26,"rel":188},[],"Dependency Scanning Auto-Remediation documentation",".",[12,192,193],{},"Automated dependency version bumping is included with GitLab Ultimate at no additional cost.",[12,195,196,197,202,203,208,209,190],{},"You can get access to agentic breaking-change resolution with a ",[16,198,201],{"href":199,"rel":200},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/gitlab-duo-agent-platform/",[],"free trial of GitLab Duo Agent Platform",". Already a GitLab Ultimate subscriber? ",[16,204,207],{"href":205,"rel":206},"https://docs.gitlab.com/user/duo_agent_platform/turn_on_off/",[],"Turn on Duo Agent Platform"," and use the ",[16,210,213],{"href":211,"rel":212},"https://docs.gitlab.com/subscriptions/gitlab_credits/#included-credits",[],"GitLab Credits included with your subscription",[12,215,216,217,190],{},"Have feedback? Share it in the ",[16,218,221],{"href":219,"rel":220},"https://gitlab.com/gitlab-org/gitlab/-/work_items/600511",[],"feature feedback epic",{"title":223,"searchDepth":224,"depth":224,"links":225},"",2,[226,227,228,229,230],{"id":42,"depth":224,"text":43},{"id":70,"depth":224,"text":71},{"id":106,"depth":224,"text":107},{"id":140,"depth":224,"text":141},{"id":172,"depth":224,"text":173},"security","2026-07-16","Automatically upgrade dependencies, adapt code for breaking changes, and route changes for approval — only GitLab does it natively, with full context.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1783980535/t3gez0gpayfndrhncunf.png",{},true,"/en-us/blog/dependency-scanning-auto-remediation",{"config":242,"description":243,"title":5},{"noIndex":236},"Dependency Scanning Auto-Remediation automatically upgrades dependencies, adapts code for breaking changes, and routes changes for approval.","dependency-scanning-auto-remediation","en-us/blog/dependency-scanning-auto-remediation",[231,247,248,249],"AI","product","features","BlogPost","qec4m1dTPWUt6Mg64DZVW12Lzxo3p1TlwXVRcjfheUk",{"logo":253,"freeTrial":258,"sales":263,"login":268,"items":273,"search":594,"minimal":625,"duo":644,"switchNav":653,"pricingDeployment":664},{"config":254},{"href":255,"dataGaName":256,"dataGaLocation":257},"/","gitlab logo","header",{"text":259,"config":260},"Get free trial",{"href":261,"dataGaName":262,"dataGaLocation":257},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":264,"config":265},"Request a demo",{"href":266,"dataGaName":267,"dataGaLocation":257},"/sales/?contact-topic=request-demo","sales",{"text":269,"config":270},"Sign in",{"href":271,"dataGaName":272,"dataGaLocation":257},"https://gitlab.com/users/sign_in/","sign in",[274,302,402,407,516,572],{"text":275,"config":276,"menu":278},"Platform",{"dataNavLevelOne":277},"platform",{"type":279,"columns":280},"cards",[281,287,294],{"title":275,"description":282,"link":283},"The intelligent orchestration platform for DevSecOps",{"text":284,"config":285},"Explore our Platform",{"href":286,"dataGaName":277,"dataGaLocation":257},"/platform/",{"title":96,"description":288,"link":289},"Agentic AI for the entire software lifecycle",{"text":290,"config":291},"Meet GitLab Duo",{"href":292,"dataGaName":293,"dataGaLocation":257},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":295,"description":296,"link":297},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":298,"config":299},"Learn more",{"href":300,"dataGaName":301,"dataGaLocation":257},"/why-gitlab/","why gitlab",{"text":303,"left":239,"config":304,"menu":306},"Product",{"dataNavLevelOne":305},"solutions",{"type":307,"link":308,"columns":312,"feature":381},"lists",{"text":309,"config":310},"View all Solutions",{"href":311,"dataGaName":305,"dataGaLocation":257},"/solutions/",[313,337,360],{"title":314,"description":315,"link":316,"items":321},"Automation","CI/CD and automation to accelerate deployment",{"config":317},{"icon":318,"href":319,"dataGaName":320,"dataGaLocation":257},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[322,326,329,333],{"text":323,"config":324},"CI/CD",{"href":325,"dataGaLocation":257,"dataGaName":323},"/solutions/continuous-integration/",{"text":96,"config":327},{"href":292,"dataGaLocation":257,"dataGaName":328},"gitlab duo agent platform - product menu",{"text":330,"config":331},"Source Code Management",{"href":332,"dataGaLocation":257,"dataGaName":330},"/solutions/source-code-management/",{"text":334,"config":335},"Automated Software Delivery",{"href":319,"dataGaLocation":257,"dataGaName":336},"Automated software delivery",{"title":338,"description":339,"link":340,"items":345},"Security","Deliver code faster without compromising security",{"config":341},{"href":342,"dataGaName":343,"dataGaLocation":257,"icon":344},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[346,350,355],{"text":347,"config":348},"Application Security Testing",{"href":342,"dataGaName":349,"dataGaLocation":257},"Application security testing",{"text":351,"config":352},"Software Supply Chain Security",{"href":353,"dataGaLocation":257,"dataGaName":354},"/solutions/supply-chain/","Software supply chain security",{"text":356,"config":357},"Software Compliance",{"href":358,"dataGaName":359,"dataGaLocation":257},"/solutions/software-compliance/","software compliance",{"title":361,"link":362,"items":367},"Measurement",{"config":363},{"icon":364,"href":365,"dataGaName":366,"dataGaLocation":257},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[368,372,376],{"text":369,"config":370},"Visibility & Measurement",{"href":365,"dataGaLocation":257,"dataGaName":371},"Visibility and Measurement",{"text":373,"config":374},"Value Stream Management",{"href":375,"dataGaLocation":257,"dataGaName":373},"/solutions/value-stream-management/",{"text":377,"config":378},"Analytics & Insights",{"href":379,"dataGaLocation":257,"dataGaName":380},"/solutions/analytics-and-insights/","Analytics and insights",{"title":382,"type":307,"items":383},"GitLab for",[384,390,396],{"text":385,"config":386},"Enterprise",{"icon":387,"href":388,"dataGaLocation":257,"dataGaName":389},"Building","/enterprise/","enterprise",{"text":391,"config":392},"Small Business",{"icon":393,"href":394,"dataGaLocation":257,"dataGaName":395},"Work","/small-business/","small business",{"text":397,"config":398},"Public Sector",{"icon":399,"href":400,"dataGaLocation":257,"dataGaName":401},"Organization","/solutions/public-sector/","public sector",{"text":403,"config":404},"Pricing",{"href":405,"dataGaName":406,"dataGaLocation":257,"dataNavLevelOne":406},"/pricing/","pricing",{"text":408,"config":409,"menu":411},"Resources",{"dataNavLevelOne":410},"resources",{"type":307,"link":412,"columns":416,"feature":505},{"text":413,"config":414},"View all resources",{"href":415,"dataGaName":410,"dataGaLocation":257},"/resources/",[417,450,472],{"title":418,"items":419},"Getting started",[420,425,430,435,440,445],{"text":421,"config":422},"Install",{"href":423,"dataGaName":424,"dataGaLocation":257},"/install/","install",{"text":426,"config":427},"Quick start guides",{"href":428,"dataGaName":429,"dataGaLocation":257},"/get-started/","quick setup checklists",{"text":431,"config":432},"Learn",{"href":433,"dataGaLocation":257,"dataGaName":434},"https://university.gitlab.com/","learn",{"text":436,"config":437},"Product documentation",{"href":438,"dataGaName":439,"dataGaLocation":257},"https://docs.gitlab.com/","product documentation",{"text":441,"config":442},"Best practice videos",{"href":443,"dataGaName":444,"dataGaLocation":257},"/getting-started-videos/","best practice videos",{"text":446,"config":447},"Integrations",{"href":448,"dataGaName":449,"dataGaLocation":257},"/integrations/","integrations",{"title":451,"items":452},"Discover",[453,458,463,467],{"text":454,"config":455},"Customer success stories",{"href":456,"dataGaName":457,"dataGaLocation":257},"/customers/","customer success stories",{"text":459,"config":460},"Blog",{"href":461,"dataGaName":462,"dataGaLocation":257},"/blog/","blog",{"text":464,"config":465},"The Source",{"href":466,"dataGaName":462,"dataGaLocation":257},"/the-source/",{"text":468,"config":469},"Remote",{"href":470,"dataGaName":471,"dataGaLocation":257},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":473,"items":474},"Connect",[475,480,485,490,495,500],{"text":476,"config":477},"GitLab Services",{"href":478,"dataGaName":479,"dataGaLocation":257},"/services/","services",{"text":481,"config":482},"Contribute",{"href":483,"dataGaName":484,"dataGaLocation":257},"https://contributors.gitlab.com","contribute",{"text":486,"config":487},"Community",{"href":488,"dataGaName":489,"dataGaLocation":257},"/community/","community",{"text":491,"config":492},"Forum",{"href":493,"dataGaName":494,"dataGaLocation":257},"https://forum.gitlab.com/","forum",{"text":496,"config":497},"Events",{"href":498,"dataGaName":499,"dataGaLocation":257},"/events/","events",{"text":501,"config":502},"Partners",{"href":503,"dataGaName":504,"dataGaLocation":257},"/partners/","partners",{"config":506,"title":509,"text":510,"link":511},{"background":507,"textColor":508},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":512,"config":513},"Read the latest",{"href":514,"dataGaName":515,"dataGaLocation":257},"/whats-new/","whats new",{"text":517,"config":518,"menu":520},"Company",{"dataNavLevelOne":519},"company",{"type":307,"columns":521},[522],{"items":523},[524,529,535,537,542,547,552,557,562,567],{"text":525,"config":526},"About",{"href":527,"dataGaName":528,"dataGaLocation":257},"/company/","about",{"text":530,"config":531,"footerGa":534},"Jobs",{"href":532,"dataGaName":533,"dataGaLocation":257},"/jobs/","jobs",{"dataGaName":533},{"text":496,"config":536},{"href":498,"dataGaName":499,"dataGaLocation":257},{"text":538,"config":539},"Leadership",{"href":540,"dataGaName":541,"dataGaLocation":257},"/company/team/e-group/","leadership",{"text":543,"config":544},"Handbook",{"href":545,"dataGaName":546,"dataGaLocation":257},"https://handbook.gitlab.com/","handbook",{"text":548,"config":549},"Investor relations",{"href":550,"dataGaName":551,"dataGaLocation":257},"https://ir.gitlab.com/","investor relations",{"text":553,"config":554},"Trust Center",{"href":555,"dataGaName":556,"dataGaLocation":257},"/security/","trust center",{"text":558,"config":559},"AI Transparency Center",{"href":560,"dataGaName":561,"dataGaLocation":257},"/ai-transparency-center/","ai transparency center",{"text":563,"config":564},"Newsletter",{"href":565,"dataGaName":566,"dataGaLocation":257},"/company/contact/#contact-forms","newsletter",{"text":568,"config":569},"Press",{"href":570,"dataGaName":571,"dataGaLocation":257},"/press/","press",{"text":573,"config":574,"menu":575},"Contact us",{"dataNavLevelOne":519},{"type":307,"columns":576},[577],{"items":578},[579,584,589],{"text":580,"config":581},"Talk to sales",{"href":582,"dataGaName":583,"dataGaLocation":257},"/sales/","talk to sales",{"text":585,"config":586},"Support portal",{"href":587,"dataGaName":588,"dataGaLocation":257},"https://support.gitlab.com","support portal",{"text":590,"config":591},"Customer portal",{"href":592,"dataGaName":593,"dataGaLocation":257},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":595,"login":596,"suggestions":603},"Close",{"text":597,"link":598},"To search repositories and projects, login to",{"text":599,"config":600},"gitlab.com",{"href":271,"dataGaName":601,"dataGaLocation":602},"search login","search",{"text":604,"default":605},"Suggestions",[606,608,612,614,618,622],{"text":96,"config":607},{"href":292,"dataGaName":96,"dataGaLocation":602},{"text":609,"config":610},"Code Suggestions (AI)",{"href":611,"dataGaName":609,"dataGaLocation":602},"/solutions/code-suggestions/",{"text":323,"config":613},{"href":325,"dataGaName":323,"dataGaLocation":602},{"text":615,"config":616},"GitLab on AWS",{"href":617,"dataGaName":615,"dataGaLocation":602},"/partners/technology-partners/aws/",{"text":619,"config":620},"GitLab on Google Cloud",{"href":621,"dataGaName":619,"dataGaLocation":602},"/partners/technology-partners/google-cloud-platform/",{"text":623,"config":624},"Why GitLab?",{"href":300,"dataGaName":623,"dataGaLocation":602},{"freeTrial":626,"mobileIcon":631,"desktopIcon":636,"secondaryButton":639},{"text":627,"config":628},"Start free trial",{"href":629,"dataGaName":262,"dataGaLocation":630},"https://gitlab.com/-/trials/new/","nav",{"altText":632,"config":633},"Gitlab Icon",{"src":634,"dataGaName":635,"dataGaLocation":630},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":632,"config":637},{"src":638,"dataGaName":635,"dataGaLocation":630},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":640,"config":641},"Get Started",{"href":642,"dataGaName":643,"dataGaLocation":630},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":645,"mobileIcon":649,"desktopIcon":651},{"text":646,"config":647},"Learn more about GitLab Duo",{"href":292,"dataGaName":648,"dataGaLocation":630},"gitlab duo",{"altText":632,"config":650},{"src":634,"dataGaName":635,"dataGaLocation":630},{"altText":632,"config":652},{"src":638,"dataGaName":635,"dataGaLocation":630},{"button":654,"mobileIcon":659,"desktopIcon":661},{"text":655,"config":656},"/switch",{"href":657,"dataGaName":658,"dataGaLocation":630},"#contact","switch",{"altText":632,"config":660},{"src":634,"dataGaName":635,"dataGaLocation":630},{"altText":632,"config":662},{"src":663,"dataGaName":635,"dataGaLocation":630},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":665,"mobileIcon":670,"desktopIcon":672},{"text":666,"config":667},"Back to pricing",{"href":405,"dataGaName":668,"dataGaLocation":630,"icon":669},"back to pricing","GoBack",{"altText":632,"config":671},{"src":634,"dataGaName":635,"dataGaLocation":630},{"altText":632,"config":673},{"src":638,"dataGaName":635,"dataGaLocation":630},{"title":675,"button":676,"config":680},"GitLab Orbit is here: The context layer for AI agents.",{"text":298,"config":677},{"href":678,"dataGaName":679,"dataGaLocation":257},"/gitlab-orbit/","orbit",{"layout":681,"disabled":236},"release",{"data":683},{"text":684,"source":685,"edit":691,"contribute":696,"config":701,"items":706,"minimal":916},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":686,"config":687},"View page source",{"href":688,"dataGaName":689,"dataGaLocation":690},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":692,"config":693},"Edit this page",{"href":694,"dataGaName":695,"dataGaLocation":690},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":697,"config":698},"Please contribute",{"href":699,"dataGaName":700,"dataGaLocation":690},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":702,"facebook":703,"youtube":704,"linkedin":705},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[707,754,808,852,884],{"title":403,"links":708,"subMenu":723},[709,713,718],{"text":710,"config":711},"View plans",{"href":405,"dataGaName":712,"dataGaLocation":690},"view plans",{"text":714,"config":715},"Why Premium?",{"href":716,"dataGaName":717,"dataGaLocation":690},"/pricing/premium/","why premium",{"text":719,"config":720},"Why Ultimate?",{"href":721,"dataGaName":722,"dataGaLocation":690},"/pricing/ultimate/","why ultimate",[724],{"title":725,"links":726},"Contact Us",[727,730,732,734,739,744,749],{"text":728,"config":729},"Contact sales",{"href":582,"dataGaName":267,"dataGaLocation":690},{"text":585,"config":731},{"href":587,"dataGaName":588,"dataGaLocation":690},{"text":590,"config":733},{"href":592,"dataGaName":593,"dataGaLocation":690},{"text":735,"config":736},"Status",{"href":737,"dataGaName":738,"dataGaLocation":690},"https://status.gitlab.com/","status",{"text":740,"config":741},"Terms of use",{"href":742,"dataGaName":743,"dataGaLocation":690},"/terms/","terms of use",{"text":745,"config":746},"Privacy statement",{"href":747,"dataGaName":748,"dataGaLocation":690},"/privacy/","privacy statement",{"text":750,"config":751},"Cookie preferences",{"dataGaName":752,"dataGaLocation":690,"id":753,"isOneTrustButton":239},"cookie preferences","ot-sdk-btn",{"title":303,"links":755,"subMenu":764},[756,760],{"text":757,"config":758},"DevSecOps platform",{"href":286,"dataGaName":759,"dataGaLocation":690},"devsecops platform",{"text":761,"config":762},"AI-Assisted Development",{"href":292,"dataGaName":763,"dataGaLocation":690},"ai-assisted development",[765],{"title":766,"links":767},"Topics",[768,773,778,783,788,793,798,803],{"text":769,"config":770},"CICD",{"href":771,"dataGaName":772,"dataGaLocation":690},"/topics/ci-cd/","cicd",{"text":774,"config":775},"GitOps",{"href":776,"dataGaName":777,"dataGaLocation":690},"/topics/gitops/","gitops",{"text":779,"config":780},"DevOps",{"href":781,"dataGaName":782,"dataGaLocation":690},"/topics/devops/","devops",{"text":784,"config":785},"Version Control",{"href":786,"dataGaName":787,"dataGaLocation":690},"/topics/version-control/","version control",{"text":789,"config":790},"DevSecOps",{"href":791,"dataGaName":792,"dataGaLocation":690},"/topics/devsecops/","devsecops",{"text":794,"config":795},"Cloud Native",{"href":796,"dataGaName":797,"dataGaLocation":690},"/topics/cloud-native/","cloud native",{"text":799,"config":800},"AI for Coding",{"href":801,"dataGaName":802,"dataGaLocation":690},"/topics/devops/ai-for-coding/","ai for coding",{"text":804,"config":805},"Agentic AI",{"href":806,"dataGaName":807,"dataGaLocation":690},"/topics/agentic-ai/","agentic ai",{"title":809,"links":810},"Solutions",[811,813,815,820,824,827,831,834,836,839,842,847],{"text":347,"config":812},{"href":342,"dataGaName":347,"dataGaLocation":690},{"text":336,"config":814},{"href":319,"dataGaName":320,"dataGaLocation":690},{"text":816,"config":817},"Agile development",{"href":818,"dataGaName":819,"dataGaLocation":690},"/solutions/agile-delivery/","agile delivery",{"text":821,"config":822},"SCM",{"href":332,"dataGaName":823,"dataGaLocation":690},"source code management",{"text":769,"config":825},{"href":325,"dataGaName":826,"dataGaLocation":690},"continuous integration & delivery",{"text":828,"config":829},"Value stream management",{"href":375,"dataGaName":830,"dataGaLocation":690},"value stream management",{"text":774,"config":832},{"href":833,"dataGaName":777,"dataGaLocation":690},"/solutions/gitops/",{"text":385,"config":835},{"href":388,"dataGaName":389,"dataGaLocation":690},{"text":837,"config":838},"Small business",{"href":394,"dataGaName":395,"dataGaLocation":690},{"text":840,"config":841},"Public sector",{"href":400,"dataGaName":401,"dataGaLocation":690},{"text":843,"config":844},"Education",{"href":845,"dataGaName":846,"dataGaLocation":690},"/solutions/education/","education",{"text":848,"config":849},"Financial services",{"href":850,"dataGaName":851,"dataGaLocation":690},"/solutions/finance/","financial services",{"title":408,"links":853},[854,856,858,860,863,865,868,870,872,874,876,878,880,882],{"text":421,"config":855},{"href":423,"dataGaName":424,"dataGaLocation":690},{"text":426,"config":857},{"href":428,"dataGaName":429,"dataGaLocation":690},{"text":431,"config":859},{"href":433,"dataGaName":434,"dataGaLocation":690},{"text":436,"config":861},{"href":438,"dataGaName":862,"dataGaLocation":690},"docs",{"text":459,"config":864},{"href":461,"dataGaName":462,"dataGaLocation":690},{"text":866,"config":867},"What's new",{"href":514,"dataGaName":515,"dataGaLocation":690},{"text":454,"config":869},{"href":456,"dataGaName":457,"dataGaLocation":690},{"text":468,"config":871},{"href":470,"dataGaName":471,"dataGaLocation":690},{"text":476,"config":873},{"href":478,"dataGaName":479,"dataGaLocation":690},{"text":481,"config":875},{"href":483,"dataGaName":484,"dataGaLocation":690},{"text":486,"config":877},{"href":488,"dataGaName":489,"dataGaLocation":690},{"text":491,"config":879},{"href":493,"dataGaName":494,"dataGaLocation":690},{"text":496,"config":881},{"href":498,"dataGaName":499,"dataGaLocation":690},{"text":501,"config":883},{"href":503,"dataGaName":504,"dataGaLocation":690},{"title":517,"links":885},[886,888,890,892,894,896,900,905,907,909,911],{"text":525,"config":887},{"href":527,"dataGaName":519,"dataGaLocation":690},{"text":530,"config":889},{"href":532,"dataGaName":533,"dataGaLocation":690},{"text":538,"config":891},{"href":540,"dataGaName":541,"dataGaLocation":690},{"text":543,"config":893},{"href":545,"dataGaName":546,"dataGaLocation":690},{"text":548,"config":895},{"href":550,"dataGaName":551,"dataGaLocation":690},{"text":897,"config":898},"Sustainability",{"href":899,"dataGaName":897,"dataGaLocation":690},"/sustainability/",{"text":901,"config":902},"Diversity, inclusion and belonging (DIB)",{"href":903,"dataGaName":904,"dataGaLocation":690},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":553,"config":906},{"href":555,"dataGaName":556,"dataGaLocation":690},{"text":563,"config":908},{"href":565,"dataGaName":566,"dataGaLocation":690},{"text":568,"config":910},{"href":570,"dataGaName":571,"dataGaLocation":690},{"text":912,"config":913},"Modern Slavery Transparency Statement",{"href":914,"dataGaName":915,"dataGaLocation":690},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":917},[918,921,924],{"text":919,"config":920},"Terms",{"href":742,"dataGaName":743,"dataGaLocation":690},{"text":922,"config":923},"Cookies",{"dataGaName":752,"dataGaLocation":690,"id":753,"isOneTrustButton":239},{"text":925,"config":926},"Privacy",{"href":747,"dataGaName":748,"dataGaLocation":690},[928],{"id":929,"title":7,"body":235,"config":930,"content":932,"description":235,"extension":936,"meta":937,"navigation":239,"path":938,"seo":939,"stem":940,"__hash__":941},"blogAuthors/en-us/blog/authors/mark-settle.yml",{"template":931},"BlogAuthor",{"name":7,"config":933},{"headshot":934,"ctfId":935},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1779215794/fw131xublkzdvjdadd4q.png","marksettle","yml",{},"/en-us/blog/authors/mark-settle",{},"en-us/blog/authors/mark-settle","aur3jcqDyhashUtyXhd1W7N3ZrN09waCQv135AABEt4",[943,948,956],{"title":944,"description":945,"heroImage":237,"category":231,"date":232,"authors":946,"slug":947,"externalUrl":235},"GitLab Duo Security Review spots logic flaws scanners miss","Use AI-driven security reasoning to detect authorization gaps, business-logic errors, and race conditions while code is still under review.",[7],"gitlab-duo-security-review-flow",{"title":949,"description":950,"heroImage":951,"category":231,"date":952,"authors":953,"slug":955,"externalUrl":235},"One vulnerability view: From scanner coverage to AI governance","As AI writes more code, security must keep pace. GitLab is one platform for all scanner coverage, detection, and remediation, with AI governance over agents.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1781621337/mtjqzed2cqtef0frmor2.png","2026-06-18",[954],"Alisa Ho","one-vulnerability-view",{"title":957,"description":958,"heroImage":959,"category":231,"date":960,"authors":961,"slug":963,"externalUrl":235},"Full security scanner coverage of your codebase in minutes","Security configuration profiles lead to faster scanner rollouts. Learn how this new capability in GitLab 19.0 covers thousands of projects in minutes, no gaps.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1779189265/iqzyhhiwagxzwywvjzow.png","2026-05-26",[962],"Michael Omokoh","security-configuration-profiles",{"promotions":965},[966,980,991,1002],{"id":967,"categories":968,"header":970,"text":971,"button":972,"image":977},"ai-modernization",[969],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":973,"config":974},"Get your AI maturity score",{"href":975,"dataGaName":976,"dataGaLocation":462},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":978},{"src":979},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":981,"categories":982,"header":983,"text":971,"button":984,"image":988},"devops-modernization",[248,792],"Are you just managing tools or shipping innovation?",{"text":985,"config":986},"Get your DevOps maturity score",{"href":987,"dataGaName":976,"dataGaLocation":462},"/assessments/devops-modernization-assessment/",{"config":989},{"src":990},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":992,"categories":993,"header":994,"text":971,"button":995,"image":999},"security-modernization",[231],"Are you trading speed for security?",{"text":996,"config":997},"Get your security maturity score",{"href":998,"dataGaName":976,"dataGaLocation":462},"/assessments/security-modernization-assessment/",{"config":1000},{"src":1001},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1003,"paths":1004,"header":1007,"text":1008,"button":1009,"image":1014},"github-azure-migration",[1005,1006],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1010,"config":1011},"See how GitLab compares to GitHub",{"href":1012,"dataGaName":1013,"dataGaLocation":462},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1015},{"src":990},{"header":1017,"blurb":1018,"button":1019,"secondaryButton":1024},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1020,"config":1021},"Get your free trial",{"href":1022,"dataGaName":262,"dataGaLocation":1023},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":728,"config":1025},{"href":582,"dataGaName":267,"dataGaLocation":1023},1784318777581]