What's new

Developers cannot set parameters for individual manual jobs within pipelines, forcing expensive full pipeline re-runs for simple parameter changes. Some input parameters are unknown until earlier jobs complete, requiring real-time decisions based on pipeline context. Job-level inputs enable dynamic parameter setting when parameters change during execution. Here’s what we’re working on:

Container image management across multiple upstream registries creates complexity and inconsistency. The Docker virtual registry aggregates images from multiple sources — including Docker Hub, Harbor, and Quay — through a single interface with intelligent caching and management capabilities. Here’s what we have planned:

JavaScript/Node.js teams managing dependencies across multiple npm sources face inconsistent resolution and configuration overhead. The npm virtual registry provides a single source of truth for package dependencies — critical functionality for organizations migrating from JFrog Artifactory to GitLab. We’re looking at including:

Wiki discussions happen away from relevant content, reducing effectiveness and increasing context switching. Inline contextual commenting enables threaded discussions tied directly to highlighted text — keeping conversations connected to the content they reference. We’re working on:

Supply chain attacks through malicious packages pose immediate risk — unlike CVEs that may exist dormant for months, a malicious package causes harm the moment it is ingested. GitLab now surfaces malicious packages directly in dependency scanning results, enabling teams to identify and respond to active threats before they compromise production systems. Planned for the pipeline:

Security managers need to deploy secret push protection at scale without manual project-by-project configuration. Scan configuration profiles will introduce bulk enablement through Security Inventory protecting projects without requiring YAML changes or developer intervention. We are currently building:

While secret push protection blocks commits in real-time, pipeline scanning provides complementary coverage by detecting secrets in repository history and pipeline artifacts. This profile will let security managers enable broad secret detection across projects through the same profile-based approach — creating defense-in-depth without configuration overhead. Features in progress:

SAST remains foundational to application security, but CI/CD configuration requirements create adoption barriers. The SAST scan profile will let security managers deploy static analysis across projects through Security Inventory — with automatic language detection and Advanced SAST enablement for supported languages on Ultimate tier. Planned for upcoming releases:

Security teams currently perform regular checks to help ensure secret push protection is enabled for new projects — a manual process that creates coverage gaps. When we’re done, new private Ultimate projects will have secret push protection enabled by default, with opt-out available during project creation for teams with specific requirements. Here’s what we’re working on:

Teams experiencing false positives in secret detection need the ability to exclude specific paths and values without disabling protection entirely. Configuration profiles will support exclusions — allowing teams to tune detection while maintaining broad coverage. Currently in the works:

Default vulnerability severities don't always reflect organizational risk priorities. Security teams can automate severity overrides based on rules including KEV/EPSS, CVSS, reachability, CVE, CWE, and scan type — mapping risk to business needs while automating triage processes that previously required manual intervention. Planned for upcoming releases:

Pattern-based secret detection misses generic passwords like admin_password=Password123! that lack recognizable formats. Context-aware detection identifies generic passwords by analyzing surrounding code patterns and variable naming conventions — closing a significant gap in secret detection coverage. Currently in the pipeline:

Broad PAT scopes like read_api and api create excessive blast radius if tokens are compromised. Fine-grained permissions enable tokens with specific access to only required resources and operations — restricted to specific projects and groups with precise combinations of read and write for different resource types. Here’s a look at what’s ahead:

Teams using CI variables for secrets lack proper lifecycle management, rotation reminders, and granular access control. GitLab Secrets Manager provides purpose-built secrets storage with expiration management, environment/branch scoping, and role-based permissions — reducing reliance on third-party secrets managers for CI workflows. Features in progress:

Organizations producing SLSA attestations need distribution and verification capabilities. Attestation APIs, UI integration, and glab verification support enable consumers to verify artifacts — completing the supply chain security workflow from attestation generation through verification. We’re looking at including:

Organizations lack visibility segmented by business context — application, business unit, or development team. Security attribute filtering enables vulnerability and dependency filtering by business-logical entities, with URL support for bookmarking filtered views and dashboard click-through support. Currently planned:

Expanding from LOW severity vulnerabilities, auto-remediation now supports configurable severity levels and version targets. Users can choose grouped or individual MRs for dependency bumps, with UI indicators highlighting auto-remediated vulnerabilities. Planned for upcoming releases:

Dart/Flutter license information currently displays as UNKNOWN, forcing teams to external data sources. License scanning support for pub package manager enables accurate license visibility for Dart and Flutter dependencies.We’re looking at including:

Advanced SAST analysis in large repositories can exceed pipeline job time limits. Incremental scanning caches results from previous scans, only analyzing changed code — significantly reducing scan time while producing accurate results. We’re looking at including:

Security dashboards need exportable formats for stakeholder communication and compliance documentation. PDF export replicates dashboard panels with applied filters and group-by configurations for offline sharing and archival. Features in progress:

Enhanced vulnerability intelligence through additional data signals including exploit availability, threat actor activity, and CVSS enhancements — increasing the value proposition of the advisory database as a premium solution. Here’s a look at what’s next:

Security teams spend significant time triaging secret detection findings that turn out to be test credentials or dummy values. AI-powered false positive detection analyzes findings before developers see them, identifying test credentials, example values, and placeholder secrets with clear explanations and confidence scores — dramatically improving the signal-to-noise ratio. Here’s what we’re working on:

When the same vulnerability pattern appears across a codebase, creating individual merge requests for each instance creates review fatigue and slows remediation. GitLab Duo intelligently groups related SAST findings by shared root causes and generates single merge requests that address related vulnerabilities — transforming scattered fixes into coordinated remediation. We’re planning to include:

Automated dependency bumps often fail in CI/CD pipelines due to breaking changes, requiring manual intervention that delays security remediation. When dependency bump MRs fail, AI analyzes pipeline errors and dependency changelogs to automatically generate code fixes that resolve compatibility issues — significantly reducing the manual effort to remediate vulnerabilities. Here’s what we’re building: