GitLab 18.11 release notes | GitLab Docs

Agentic SAST Vulnerability Resolution is now generally available in GitLab 18.11 through the GitLab Duo Agent Platform. It autonomously analyzes critical and high-severity SAST findings, proposes code fixes, and creates ready-to-review merge requests. The feature is designed to accelerate remediation while giving reviewers confidence assessments and the option to apply fixes directly from vulnerability details.

Availability and Integration

• Available with GitLab Ultimate.
• Supported on GitLab.com, GitLab Self-Managed, and GitLab Dedicated.
• Runs:
  • As part of a SAST scan
  • After SAST false-positive detection
  • Manually for individual SAST vulnerabilities

Automated Vulnerability Analysis

• Examines each finding and reasons through the surrounding code context.
• Generates proposed fixes for critical and high-severity SAST vulnerabilities.
• Automatically opens a merge request containing the remediation for review.

Review and Remediation Workflow

• Provides quality assessments to help reviewers evaluate the likely reliability of each proposed fix.
• Lets users apply resolutions directly from vulnerability details pages.
• Feedback is welcomed through GitLab issue 585626.

Practical Recommendation

Teams using GitLab Ultimate can enable the feature to streamline SAST remediation, while still reviewing agent-generated merge requests before merging changes.