techlist.io
KR EN
gitlab

GitLab 19.0 | GitLab Docs (opens in new tab)

gitlabci-cdpythongitlab-duodependency-scanningmavengradlesbom

GitLab 19.0, released May 21, 2026, expands AI-assisted development, work-item customization, secrets management, and dependency security. Major changes include group-level Duo review instructions, configurable work-item types, open beta access to GitLab Secrets Manager, and generally available SBOM-based dependency scanning. GitLab also introduces usage-based billing for Duo Core and adds new agent, search, model, and workflow capabilities.

Customization and Project Management

Group-level custom review instructions for GitLab Duo

  • Premium and Ultimate feature for GitLab.com, Self-Managed, and Dedicated.
  • Groups and subgroups can share review guidance through:
    .gitlab/duo/mr-review-instructions.yaml
  • A project in the group serves as the template.
  • Group instructions are combined with project-specific instructions.
  • Supported by both Code Review Flow and GitLab Duo Code Review.

Configurable work item types

  • Projects can define custom types such as User Story, Bug, or Maintenance instead of using only Issues and Tasks.
  • Each type has its own name and icon.
  • Types support custom fields, status lifecycles, saved views, and issue boards.
  • Configuration at the top-level group or organization cascades to projects.
  • Administrators can enable or disable types globally or allow project-level control.
  • Disabling a type does not affect existing work items.

Security and Dependency Management

GitLab Secrets Manager enters open beta

  • Available to Premium and Ultimate customers on GitLab.com and GitLab Self-Managed.
  • Project and group Owners can store and reference CI/CD secrets in GitLab.
  • Secrets are scoped to projects or groups and available only to jobs that explicitly request them.
  • The feature remains subject to beta support policies and may not be production-ready.

SBOM-based dependency scanning becomes generally available

  • Available for Ultimate customers across GitLab offerings.
  • Maven, Gradle, and Python projects receive visibility into transitive dependencies and their vulnerabilities.
  • Automatic dependency resolution runs when no lockfile or dependency graph is available.
  • If resolution is unavailable, manifest scanning examines direct dependencies in files such as:
    • pom.xml
    • requirements.txt
    • build.gradle
    • build.gradle.kts
  • Manifest scanning is enabled by default, while full transitive coverage requires dependency resolution, a lockfile, or a manually supplied dependency graph.

GitLab Duo and Agentic Development

Duo Developer enhancements

  • GitLab Duo Developer can be triggered by:
    • Assigning it to an issue
    • Selecting Generate MR
    • Mentioning it with @mention in an issue or merge request discussion
  • It can turn feedback, to-do items, and design questions into code changes, follow-up merge requests, or research summaries.
  • With AGENTS.md and agent-config.yml, it can run tests and checks before committing.
  • Administrators can enable mention and assignment triggers for eligible projects.

Duo Core adopts usage-based billing

  • Code Suggestions in the Web IDE and desktop IDEs now consume GitLab Credits.
  • Duo Chat becomes agentic for Duo Core users and runs on the GitLab Duo Agent Platform.
  • Administrators must enable the Agent Platform for the instance or top-level group to use Chat in GitLab or desktop IDEs.

New agent and search capabilities

  • Exact code search supports repository filtering with the repo: syntax:
    def authenticate repo:my-group/my-project
  • Flows and external agents can trigger when a draft merge request is marked ready for review.
  • The merge request ready trigger is controlled by the merge_request_ready_flow_trigger feature flag and is disabled by default.
  • Claude Opus 4.7 is available in the Duo Agent Platform for complex, multistep tasks involving code review, CI/CD, and vulnerability resolution.
  • GitLab Duo Agent Platform Self-Hosted adds compatibility with Gemini models and supports multiple flows, including Code Review Flow and SAST vulnerability workflows.

GitLab 19.0 is particularly significant for teams adopting AI agents and centralized development governance. Organizations should review Duo’s new billing model, test Secrets Manager carefully during its beta period, and enable dependency resolution to obtain comprehensive vulnerability coverage.