What's new in GitLab

Monthly releases, developer resources, and the latest from the GitLab team.

Monthly releases

Latest release

October 29, 2026

GitLab Orbit is GA: Get more accurate agent responses and lower token cost

Give every agent and engineer one connected context view of your software lifecycle, with your permissions intact. Agents on GitLab Duo Agent Platform query Orbit natively, and Claude Code, Codex, Cursor, and other MCP-compatible agents connect through MCP or the GitLab CLI. In GitLab testing, agents on Orbit made up to 45x fewer retries, so they get the answer right the first time and burn fewer tokens.

Read the blog

Blog

GitLab Orbit: Find vulnerability blast radius without the manual hunt

Map every project, owner, and pipeline a critical CVE touches with a single query, so remediation keeps up with machine-speed exploitation. Orbit connects code, merge requests, pipelines, security findings, and ownership in one graph, so your security team starts from a scoped, prioritized list instead of a manual hunt.

Blog

Connect your agents to your software lifecycle with GitLab MCP server (GA)

Call GitLab from the coding harnesses teams already use, under the same identity and policy. External agents reach GitLab tools, context, and flows directly: they can read and change code, merge requests, work items, and pipelines, pull in only the details a task needs, and hand work to GitLab Duo Agent Platform flows.

Blog

Govern secrets like your code with GitLab Secrets Manager (GA)

Secure build-time secrets with unified permissions and full audit trails. Each secret is scoped to the job that needs it, and limited by branch, environment, and protection status. Built on OpenBao, it stores pipeline and runtime secrets inside GitLab and governs access with your existing permissions. When someone is offboarded from a project, they lose access to its secrets automatically.

Blog

Get every merge request in front of the right reviewer, faster (GA)

With the new Recommend Reviewer flow, route every merge request to the right reviewer, so reviews start sooner and review load spreads across every qualified engineer. When you create a merge request, GitLab recommends the best individual reviewer based on workload, time zone, availability, and expertise defined by approval rules and CODEOWNERS. The flow explains why it chose the suggested reviewers and lets you assign them in one click.

Blog

See agent activity in one place with the AI Governance Dashboard

Security and compliance teams can trace which agents ran, who used them, and which projects they touched, across GitLab Duo Agent Platform and external agents.

Blog

Find flaws that pattern scanners miss with the Business Logic Security Analyzer

Identify missing authorization checks and other business logic gaps as part of your vulnerability report. Supports Anthropic's Claude Mythos 5.1 for customers in approved environments.

This month's Notable Contributor: @DhairyaMajmudar

Dhairya is a Level 3 contributor who contributed to offline transfer and Organizations support for import, so that groups, projects, and their memberships can move between GitLab instances.

Read the release notes

One context graph for every agent you run with GitLab Orbit (GA)

Increase agent accuracy and lower token cost by giving every agent and engineer one connected view of your software lifecycle, with code, merge requests, work items, pipelines, and vulnerabilities continuously updated as you ship. Agents on GitLab Duo Agent Platform query Orbit natively. Claude Code, Codex, Cursor, and other MCP-compatible agents connect through MCP or the GitLab CLI, and custom tools connect through REST. Orbit mirrors your groups, roles, and security-domain access. GitLab Orbit is generally available for Premium and Ultimate. To try it free for 30 days, contact your account team.

Secure

Catch the business logic flaws scanners often miss

Business Logic Security Analyzer detects logic flaws that pattern-based scanners often miss, including broken object-level authorization, missing authorization checks, and mass assignment. Run a full-repository scan from GitLab Duo Chat or the API, or attach the Business Logic scan profile to check each merge request. Findings appear in the vulnerability report and the merge request security widget, alongside results from your other analyzers. Business Logic Security Analyzer is in early access for GitLab Ultimate customers on GitLab.com. To request access, contact your account team.

Manage

Track your own GitLab Credits usage and set caps in bulk

Users can now see their own GitLab Credits usage, including total usage, daily average, and peak day, in User settings > GitLab Credits. Previously, only group Owners and administrators could see this. For Owners managing per-user credit caps, you can now set cap overrides for many users at once by pasting a list of usernames and cap values. New entries merge with your existing overrides, and if any row has an error, no changes are saved.

Code

GitLab Duo CLI /goal command GA and auto mode

GitLab Duo CLI command /goal is now generally available. Tell it your goal by running a /goal <task>, and step back. The agent delegates it to a governed, goal-driven flow that handles both implementation and verification. Let longer tasks run without stopping for every approval. You can also try it with the new auto mode, where the agent uses tools without asking for approval. Auto mode is off by default and it will not override agent tool governance.

Secure

Monitor external coding agent activity with AI Governance Dashboard (Beta)

Keep every agent session in one view, including coding agents that run outside GitLab. Connect Claude Code, Cursor, and Codex to GitLab AI Governance, so security and compliance teams see agent activity in one view: who ran each session, which agent, which project, and when. Sessions and tool calls appear in the AI Governance Dashboard and the AI audit events report, and stream to your SIEM through audit event streaming.

Build

Trigger flows with the Flows API (GA)

Automate handoffs to GitLab Duo Agent Platform flows, to get work started without needing to manually trigger them. Flows can be triggered from CI/CD pipelines, scripts, and other automation with the Flows API trigger endpoint. The endpoint now follows the GitLab REST API breaking changes policy, so you can rely on it in production.

Secure

Customize security configuration profiles

Set scan options like excluded paths, custom analyzer images, and full Git history scans once for a group, and apply them to all its projects. You can now customize Secret Detection and SAST profiles in the UI instead of editing .gitlab-ci.yml in each project. Dependency Scanning profiles are customizable through the GraphQL API, with UI customization planned in a future release.

Provide images as context for Developer Flow and Agentic Chat

Add a screenshot or design diagram to a bug report issue, and GitLab Duo can use it to start the fix, so you don't spend time describing the problem in words. Developer Flow and Agentic Chat can read images in your repository and attachments on issues, merge requests, and comments, and use them as context for the fix. In your prompt, name the image by its file path or upload reference as it appears in the Markdown.

Secure

Share filtered views of the security inventory

Send the team that owns a set of projects the exact view they need. Filter the security inventory by tool coverage, vulnerability count, or project name, then copy the URL. Whoever opens the link sees the same view, and you can bookmark it for later.

Manage

Run GitLab Duo agentic work from any MCP client

Hand work to GitLab Duo agents and flows from your MCP client and follow it to the result. Find what a project offers with list_duo_agents_and_flows, then start a session with start_duo_session. Track it with get_duo_session and list_duo_sessions, and when a session pauses for you, use send_duo_session_input to approve, reject, or answer the agent. GitLab MCP server is now GA.

Secure

Build

Secure build-time secrets where your code and pipelines live

Cut off a leaked credential in one click. Scope each secret to the job that needs it, limited by branch, environment, and protection status, with one audit trail for every secret and every access. Secrets work outside CI too, in Kubernetes, infrastructure as code, or through the API. GitLab Secrets Manager is GA.

Code

Follow-up reviews in Code Review Flow

Ask GitLab Duo to review again, and it skips findings you've already addressed. Code Review Flow now uses comment threads from its earlier reviews, including your replies, to focus on lines added since its last review, and lists outstanding findings in its summary. If you reply to explain why the code is correct, GitLab Duo doesn't raise the point again. Turn on "Start a new review on push" to run a follow-up review automatically when you push changes.

Read the release notes

@aleksandr-kotlyar