gitlabAug 12, 2026

How GitLab tracks vulnerabilities through refactors and reformatting (opens in new tab)

GitLab improved vulnerability tracking to prevent duplicate findings after harmless code changes such as added comments, blank lines, or reformatting. Its normalized Scope+Offset fingerprint ignores non-functional lines while still identifying vulnerabilities by their enclosing scope and relative location. In testing, the method eliminated duplicates in a worst-case benchmark and is now available as `scope_offset_compressed`. ## The Problem with Line-Based Tracking - Vulnerabilities can appear to be new when developers: - Add comments or blank lines - Reformat files - Move functions or other code - Duplicate findings force security teams to repeat triage and reduce confidence in scan results. - GitLab’s 2022 Scope+Offset method improved on line-based tracking by using: - The narrowest enclosing scope, such as a module, class, or function - The finding’s line offset within that scope - This reduced unnecessary re-auditing by about 30%, but comments and blank lines could still change the offset. ## Normalized Scope+Offset Fingerprinting - The improved method ignores comments and blank lines when calculating a vulnerability’s fingerprint. - Because these lines do not change program behavior, they no longer change the vulnerability’s identity. - The approach preserves the previous method’s precision and reuses the scanner’s existing parse tree, so scan times are unaffected. - It does not require changes to the security report format and works with heterogeneous SAST toolchains. ## Benchmark Results - Researchers tested 439 source files across: - C/C++, C#, Go, Java, JavaScript, Python, and Ruby - They generated 2,247 commits, each adding a comment or blank line immediately before a known vulnerability. - The original method produced 1,361 duplicate fingerprints, representing a 77% increase over baseline. - The normalized method produced zero duplicates and reduced unique fingerprints by 43%. ## GitLab Availability - The algorithm is available in GitLab as: - `scope_offset_compressed` - It supports C#, C/C++, Go, Java, JavaScript, Python, Ruby, and PHP. - The accompanying research paper, *Vulnerability Tracking using Normalized Scope+Offset*, is scheduled for presentation at the ASE 2026 Industry Showcase. For teams using GitLab security scanning, `scope_offset_compressed` provides more stable vulnerability tracking without slowing scans or changing existing report integrations.

devsecopsgitlabsaststatic-analysis+3

gitlabJul 31, 2026

How to govern agentic AI, MCPs, and AI code assistants (opens in new tab)

Agentic AI changes software governance because agents can independently modify code, call tools, alter CI/CD configurations, and deploy without line-by-line human review. The central control model must therefore focus on agent identity, permissions, data handling, human approval points, and auditable activity. Organizations should treat agents like privileged users, with consistent policies governing what they can access, which models they may use, and when humans must intervene. ## Why Agentic AI Requires New Governance - Traditional code assistants keep humans involved in accepting or rejecting each suggestion. - Agentic systems can perform multi-step actions autonomously across the software delivery lifecycle. - Governance must answer: - What can the agent access? - What is it authorized to do? - What actions did it take, and can those actions be proven later? - Major organizational concerns include: - Distinguishing AI-generated code from human-written code. - Linking generated code to the business requirement or intent behind it. - Maintaining documentation as AI-generated code scales. - The article cites research showing widespread concern about maintainability, technical debt, and governance challenges. ## Controlling Agents, MCPs, and Tools Permissioning becomes especially important when agents use the Model Context Protocol (MCP) to connect to external tools and data. - A governance model should define: - Which agents and workflows are approved. - Where those agents may operate. - Which models they may use. - Recommended controls include: - **Central agent catalog:** Administrators publish and manage approved agents and flows. - **Composite identity:** Actions should be linked both to the agent and the human who initiated it. - **Tool approval guardrails:** Tools can run autonomously, require human approval, or be blocked. - **Prompt guardrails:** Systems should detect attempts to manipulate agents through untrusted webpages, files, or issue comments. - The objective is a role-based, auditable control plane for agents that is as consistent as existing human access management. ## Data Privacy and Self-Hosted AI Because source code is highly sensitive, organizations should establish clear data-handling policies before broad AI adoption. - Key questions include: - Whether the vendor trains models on company code. - Who owns prompts, inputs, and outputs. - Where subprocessors are located and how changes are communicated. - Self-hosted AI can keep agents and data within infrastructure controlled by the organization, which is particularly important for regulated industries. - Bring-your-own-model capabilities allow administrators to: - Use internally validated models. - Assign different models to specific agent workflows. - Reserve trusted models for sensitive operations while using managed models for lower-risk tasks. ## Defining Human Review Boundaries Governance should not eliminate autonomy; it should deliberately establish where autonomy ends. - **Interactive workflows:** Developers review and approve suggestions directly. - **Headless workflows:** Agents operate in CI/CD or other automated environments, requiring approval before sensitive actions or inspection afterward through audit trails. - Organizations should define approval requirements for: - Code review. - Testing and validation. - Deployment. - Enforcement mechanisms can include: - Merge request approval policies that apply equally to human- and agent-created changes. - Tool-level approval settings. - Scanner and pipeline controls that block changes failing security or quality checks. - An organization-wide AI governance policy is preferable to informal team-by-team practices because it promotes consistency and simplifies auditing. ## Practical Recommendation Treat agentic AI as a privileged software participant: give every agent a controlled identity, least-privilege permissions, approved model and tool access, strong privacy protections, and complete auditability. Keep human approval at security-sensitive decision points, while allowing lower-risk actions to proceed autonomously under enforced policies.

devsecopsci-cdmodel-context-protocolagentic-ai+4

gitlabJul 29, 2026

Why GitLab signed the Open Weights and American AI Leadership letter (opens in new tab)

GitLab signed the Open Weights and American AI Leadership letter to support an open, competitive AI ecosystem. The company argues that open-weight models improve innovation, customer control, security, and flexibility while reducing dependence on a single cloud or model provider. This aligns with GitLab’s goal of enabling agentic software engineering through cloud-neutral and AI-model-neutral tooling. ## Customer Choice and Model Flexibility - Organizations increasingly need governed access to both proprietary foundation models and open-weight models. - Foundation models may offer stronger general-purpose capabilities, while open-weight models can provide: - Greater cost control - Flexible deployment options - Data-residency advantages - Operation in air-gapped environments - GitLab supports combining different models across development workflows rather than locking teams into one provider. ## Security, Privacy, and Independence - Companies must protect source code, intellectual property, and strategic data from security, privacy, and competitive risks. - GitLab argues that model and cloud neutrality are essential to avoiding dependence on a single vendor. - Open weights allow teams to decide where models run while retaining control over their code and data. ## GitLab’s Policy Position - GitLab supports policies that allow open-weight models to be developed, distributed, and used. - It favors focused, risk-based safeguards aimed at genuine misuse rather than broad restrictions. - A mix of open and proprietary providers can compete on capability, security, and value, benefiting innovation and customer choice. GitLab’s recommendation is to preserve an open AI model market with targeted safeguards. This gives organizations the flexibility to choose models based on capability, cost, privacy, deployment requirements, and security.

devsecopsaifoundation-modelsdata-privacy+3

gitlabJul 16, 2026

Forrester Consulting: GitLab Duo Agent Platform delivers 400% ROI (opens in new tab)

GitLab-commissioned Forrester research found that organizations using GitLab Duo Agent Platform could achieve a 400% three-year ROI, $7.5 million in net present value, and payback in under six months. The study argues that agentic coding creates the greatest business value when integrated across the software lifecycle—not merely used to generate code. Benefits included faster onboarding, shorter migrations, quicker security remediation, and more developer time for feature work. ## Study Scope and Financial Model - Forrester interviewed four organizations across financial services, software, entertainment, and insurance. - Their experiences were modeled as a composite global company with: - $3 billion in annual revenue - 3,000 employees - GitLab Duo Agent Platform adoption growing from 150 to 250 users - Three-year risk-adjusted costs totaled approximately $1.9 million: - $1.3 million in consumption credits - $589,000 for implementation, training, support, and internal labor - Quantified benefits reached $9.4 million, producing: - 400% ROI - $7.5 million net present value - Payback in less than six months ## Problems Before Adoption - Manual processes and ad-hoc knowledge sharing slowed development. - New developers depended heavily on senior engineers for context and troubleshooting. - Security fixes waited in queues for specialists with the necessary expertise. - Code review was often a larger bottleneck than writing code. - Senior engineers were repeatedly interrupted to unblock other team members. ## Quantified Benefits - **80% faster developer onboarding** - Agentic chat in IDEs and repositories helped new hires understand unfamiliar codebases independently. - Estimated savings: $582,000. - **75% shorter migration timeline** - A migration from on-premises GitLab to GitLab SaaS finished in two months instead of eight. - Agents helped diagnose pipeline failures and resolve issues during the migration. - Estimated labor savings: $157,000. - **40% more time for security and QA engineers** - Contextual explanations and suggested fixes reduced remediation effort and reliance on senior staff. - Estimated three-year savings: $1.3 million. - **20% more developer capacity for feature work** - Agents supported code review, testing, and troubleshooting. - Estimated combined benefit: $7.4 million. - Additional unquantified benefits included reduced need for overlapping AI tools, improved developer satisfaction, and stronger knowledge sharing. ## Broader Impact on Software Delivery The study found that organizations shipped features in days rather than weeks, resolved vulnerabilities more quickly, onboarded staff faster, and compressed major infrastructure work. Its central conclusion is that AI productivity gains compound when agentic coding is connected to infrastructure supporting the entire software delivery lifecycle. The findings are based on interviewed organizations and a composite financial model, so actual results will vary. Companies evaluating agentic development should use the study as a framework for estimating benefits across productivity, security, onboarding, and operational efficiency—not as a guaranteed ROI.

devsecopsai-agentcode-reviewcontinuous-integration+3

gitlabJul 16, 2026

Bring GitLab Duo Agent Platform to your terminal (opens in new tab)

GitLab Duo CLI, generally available in GitLab 19.2, brings GitLab Duo Agentic Chat into the terminal. It combines code assistance with project, pipeline, permissions, and agent context from GitLab, helping developers handle failures and multi-step delivery work without leaving the shell. It supports both interactive development and headless automation in CI jobs and scripts. ## Why Terminal AI Needs GitLab Context - Many delivery problems occur after coding: failed pipelines, broken tests, vulnerabilities, dependency issues, and CI configuration problems. - Generic coding agents lack access to GitLab project context, pipeline data, permissions, and organization-wide agent configuration. - Duo CLI connects terminal work to the broader GitLab software lifecycle and provides centralized administration and identity management. ## Capabilities of Duo CLI - Investigate codebases, refactor, troubleshoot pipelines, improve CI/CD, and complete multi-step tasks from the terminal. - Share conversations across Duo CLI, the GitLab web UI, and editor extensions. - Use **Plan mode** to inspect and prepare changes, then **Build mode** to apply them. - Run `/doctor` to diagnose setup issues and `/mcp` to inspect MCP configuration. - Available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated, with instance-level controls for administrators. ## Interactive and Headless Operation - Launch through the GitLab CLI with `glab duo cli`, which handles authentication, or use the standalone `duo` command with a personal access token. - Interactive mode allows users to chat, review proposed actions, and approve tools before execution. - Headless mode supports automation through commands such as: - `glab duo cli run --goal` - `duo run --goal` - A pipeline failure can be investigated directly from the shell, with Duo CLI analyzing the issue and proposing changes for review. ## Customization and Adoption - Duo CLI follows project instructions in files such as `chat-rules.md`, `AGENTS.md`, and `SKILL.md`. - Custom slash commands can extend interactive workflows. - Users can install and authenticate through the Duo CLI documentation, or begin with `glab duo cli`. - GitLab offers Duo Agent Platform trials and includes credits for eligible Premium and Ultimate subscriptions. Duo CLI is positioned as a way to extend AI assistance beyond code editing into the operational parts of software delivery. Teams can start with interactive troubleshooting and gradually use headless mode for repeatable CI and scripting workflows.

devsecopsci-cdagentic-aimcp+2

gitlabJul 16, 2026

GitLab Duo Security Review spots logic flaws scanners miss (opens in new tab)

GitLab’s Duo Security Review uses AI-driven reasoning to identify authorization gaps, data exposure, business-logic errors, and race conditions that pattern-based scanners often miss. It reviews merge requests in context, validates findings to reduce false positives, and reports issues before they reach production. The feature complements—not replaces—automated scanners and human security review. ## Where Traditional Scanners Fall Short - Static scanners detect recognizable patterns such as unsanitized inputs, secrets, and unsafe deserialization. - Logic flaws depend on application-specific context, including: - Broken object- or function-level authorization - Sensitive data exposed through otherwise normal serialization - Incorrect workflow order, manipulated prices, checkout bypasses, and race conditions - Manual reviews, penetration tests, and bug bounties are difficult to scale or may happen too late. ## AI-Powered Review for Merge Requests - Security Review Flow analyzes the diff alongside original files, related code, and MR discussion. - It can detect missing authorization, information disclosure, mass assignment, business-logic flaws, and stateful workflow races. - An independent validation pass reviews findings to filter likely false positives. - GitLab’s application security team has used it on internal merge requests. ## Findings and Review Workflow - Findings appear as diff threads and an internal summary; public projects keep security details in the internal note. - Each finding includes: - Vulnerability type and CWE reference - Severity from critical to low - Tier: exploitable, logic flaw, or design issue - Explanation and suggested remediation - Critical and high findings request changes; medium and low findings generate comments. - The tool never approves an MR, leaving the final decision to a human. - Developers can discuss findings, apply suggested fixes, dismiss false positives, accept risks, and request another review after changes. ## Availability and Cost - The feature is in public beta for GitLab Ultimate customers on GitLab.com, Self-Managed, and Dedicated. - Access is available through a Duo Agent Platform trial or included GitLab Credits. - Pricing depends on diff complexity and model selection, so GitLab recommends testing it on a limited number of MRs first. Organizations should use Security Review Flow as an additional layer alongside scanners and expert review, applying it early in the merge-request process when security fixes are least expensive.

devsecopsai-securitygitlab-duostatic-analysis+4

gitlabJun 30, 2026

Claude Sonnet 5 on GitLab: More reliable, more efficient (opens in new tab)

Claude Sonnet 5 is now available on GitLab Duo Agent Platform through GitLab’s AI Gateway across all tiers and deployment models. GitLab reports that it is the first model to complete every task in its evaluation suite, compared with 93.8% for Sonnet 4.6, while resolving 8.8% more issues. The result is intended to make software-engineering agents more reliable, efficient, and suitable for production-scale workflows. ## More Reliable Agent Runs - Sonnet 5 is designed for multi-step development tasks, code generation, and automated workflows. - Completing every benchmark task reduces failures that require diagnosis, reprompting, and verification. - GitLab highlights applications including: - Multi-file refactoring - Test generation - Security investigations across repository history - Pipeline-failure analysis - Higher completion rates allow developers to review agent output instead of repeatedly restarting incomplete runs. ## Lower Cost Through Efficiency - Reliability and resource efficiency reduce the effective cost of completed agent tasks. - Models on GitLab Duo consume GitLab Credits at different rates. - Teams can control spending by using a model whose cost and performance fit routine development work. - GitLab directs users to its Credits documentation for model-specific consumption rates. ## Selecting the Right Model - Sonnet 5 is positioned as a dependable default for everyday software-development tasks. - Sonnet-class models aim to balance quality, speed, and cost. - Claude Opus 4.8 remains available for complex, long-running tasks requiring greater reasoning depth. - Teams can select models per task through model selection in their GitLab instance. ## Availability - Claude Sonnet 5 is available immediately on GitLab Duo Agent Platform through the AI Gateway. - It runs on GitLab Credits and is offered across all tiers and deployment models. - New users can start through a Duo Agent Platform trial or GitLab Free, while Premium and Ultimate subscribers can use included credits. Overall, GitLab presents Claude Sonnet 5 as a more reliable and economical choice for routine agent-assisted development, with more powerful models available when tasks require deeper reasoning.

devsecopsai-agentgitlab-duo-agent-platformai-gateway+2

gitlabJun 25, 2026

Google Antigravity agents get full context with GitLab Orbit (opens in new tab)

Google Antigravity agents can now access GitLab’s broader software lifecycle context through GitLab Orbit, available in the Antigravity MCP Store. Orbit builds a knowledge graph connecting code, projects, dependencies, merge requests, pipelines, users, and vulnerabilities, allowing agents to answer questions that would otherwise require manual research across GitLab. GitLab reports that internally tested agents using Orbit were up to 11 times faster, used 4.5 times fewer tokens, and hallucinated up to 45 times less. ## GitLab Orbit Adds Lifecycle Context - Antigravity agents can normally access files and terminals but lack information about: - Service dependencies - Related vulnerabilities - Merge request history - Code ownership and reviewers - Pipeline performance - Orbit indexes GitLab and exposes its knowledge graph through: - `query_graph` for structured lifecycle queries - `get_graph_schema` for available node types, properties, and relationships - Agents receive typed results through GitLab Orbit’s JSON query DSL. ## Practical Development Use Cases ### Blast radius analysis - Engineers can identify which projects depend on a module before refactoring it. - Agents can also find open merge requests affecting those files and identify their owners. - This reveals conflicts and stakeholders before changes are made. ### Onboarding and codebase exploration - Agents can explain a service’s dependencies, entry points, and recently opened merge requests. - Results can be captured in a persistent Walkthrough Artifact rather than disappearing in chat. - Orbit reindexes changes within minutes, keeping documentation more current than static wikis. ### Live architecture diagrams - Agents can query service dependencies and render them as diagrams using Nano Banana Pro. - Diagrams can be filtered, such as showing only services with unresolved security findings. - Access controls apply to every query, making generated diagrams safe to share. - GitLab is developing similar functionality through its Software Architecture Map. ## Installation Through the MCP Store - Open Antigravity settings and go to the customization tab. - Find the MCP section and select **Add MCP**. - Choose GitLab Orbit and authenticate with GitLab. - No configuration files or terminal commands are required. ## Availability and Technical Details - Orbit uses the same context engine as GitLab Duo Agent Platform. - It supports code indexing for Ruby, Java, Kotlin, Python, TypeScript, JavaScript, Rust, and C#. - Code is indexed from the default branch and refreshed within minutes. - MCP queries consume GitLab Credits, while `get_graph_schema` calls are free. - The feature is available to GitLab Premium and Ultimate customers on GitLab.com. For teams already using GitLab and Google Antigravity, GitLab Orbit provides a governed, current context layer that can make agents more accurate and useful. Teams should enable Orbit for a top-level group and install it through the Antigravity MCP Store, while accounting for GitLab tier requirements and credit usage.

devsecopsmodel-context-protocolgitlab-duo-agent-platformgitlab-orbit+3

gitlabJun 18, 2026

AI Catalog updates for governance and operations (opens in new tab)

GitLab 19.1 expands the AI Catalog from a manually triggered tool into a governed automation platform. New event-driven Duo Flow triggers, configuration validation, agent restrictions, and model allowlists help enterprises run AI workflows continuously while maintaining security and operational control. The release is designed to make agentic automation safer and more reliable at production scale. ## Event-Driven Duo Flow Automation - Four new triggers let flows respond automatically to GitLab events: - Merge request code conflicts - Draft merge requests becoming ready for review - Merge request approvals - New work item creation - These triggers enable automated conflict summaries, compliance checks, deployment readiness checks, notifications, triage, labeling, and routing. - Pipeline triggers can now filter for specific states: failure, success, or cancellation. - Conflict-detected and draft-to-ready triggers are enabled by default. - A beta pattern-based approval tier lets developers approve repeated tool uses for an entire session instead of approving each invocation individually. ## Governance for Agents and Flows - Instance administrators and top-level group owners gain controls over which AI content users can run. - **Disable custom agents and flows** prevents users from creating or enabling custom-built content. - **Restrict the AI Catalog to your group hierarchy** blocks AI Catalog items from outside the organization’s namespace, including community and third-party contributions. - These controls help prevent unapproved agents and workflows from entering regulated or production environments. ## Pre-Save Flow Configuration Validation - GitLab now validates AI Catalog flow configurations against the Duo Workflow Service before saving them. - Errors such as missing inputs or invalid tool parameters appear directly in the UI. - This moves troubleshooting to configuration time, reducing the risk of broken or overly active flows running in production. ## Approved AI Model Controls - A public beta lets administrators define an allowlist of approved AI models. - Organizations can also set an organization-wide default model. - Teams retain flexibility within approved boundaries while meeting provider, compliance, or data-residency requirements. - The first version applies to GitLab Duo Agentic Chat, with broader coverage planned. Overall, GitLab 19.1 recommends treating AI workflows like production automation: trigger them from real events, validate them before deployment, and govern both the agents and models they use. Enterprises adopting the AI Catalog should configure the new restrictions and model policies before enabling widespread automated flows.

devsecopsai-agentgitlabci-cd+3

gitlabJun 18, 2026

One vulnerability view: From scanner coverage to AI governance (opens in new tab)

GitLab 19.1 presents a unified approach to application security and AI governance. It lets organizations enforce third-party SARIF-compatible scanners across every project, centralize findings, and automate remediation. At the same time, new AI governance features record agent activity and require approval for sensitive actions, enabling faster development without sacrificing accountability. ## Enforcing Complete Scanner Coverage - Security scanners are often configured separately for each project, creating coverage gaps and policy drift. - GitLab 19.1 allows administrators to enforce third-party scanners across all projects. - SARIF-compatible scanner results flow into GitLab’s unified vulnerability view. - Findings use the same governance and remediation workflows as GitLab-native results. - GitLab Duo Agent Platform can: - Triage findings with SAST False Positive Detection. - Generate merge requests through Agentic SAST Vulnerability Resolution. - Automatically remediate third-party scanner findings before production. ## Improving Secret Detection - Secret detection now scans every commit on a newly created branch, rather than only the latest commit. - This helps identify credentials introduced in earlier commits. - Secret False Positive Detection, now generally available, provides: - A confidence score for each finding. - An explanation displayed in the vulnerability report. - Developers can focus on genuine exposures instead of test credentials, placeholders, and example tokens. ## Governing AI Agent Actions - AI coding agents can create merge requests, invoke tools, commit code, and modify projects. - GitLab’s AI audit event streaming beta records every agent action and sends it to existing audit log destinations. - Agent tool approval guardrails let administrators configure each tool to: - Run automatically. - Require human approval. - Remain blocked. - Sensitive operations, such as writing files or deleting resources, can therefore require explicit review. - Approval decisions are also recorded, creating an auditable history for incident response and compliance. ## Governed Autonomy GitLab’s overall goal is to combine autonomous development with enforceable controls. Organizations can prove scanner coverage, automate vulnerability remediation, restrict risky agent behavior, and review a complete audit trail of what agents did. The practical recommendation is to centralize scanner governance and configure approval requirements for high-impact AI actions, allowing agents to work quickly while keeping security and accountability under human control.

devsecopsgitlabvulnerability-managementsast+4

gitlabJun 17, 2026

GitLab named a Leader in the 2026 Gartner® Magic Quadrant™ for DevSecOps Platforms (opens in new tab)

GitLab says Gartner named it a Leader in the 2026 Magic Quadrant for DevSecOps Platforms for the fourth consecutive year. The company argues that AI agents have accelerated coding but shifted bottlenecks to pipelines, security, deployments, governance, and costs. GitLab positions its unified platform as the control layer that turns agent-generated code into secure, compliant, production-ready software. ## AI Requires a Control Layer - Enterprises increasingly use multiple coding agents, but often lack centralized governance over: - Which agents can run - What data they can access - Which actions they can take - How their activity is audited - GitLab combines source control, CI/CD, security, deployment, policies, and planning in one platform. - Changes made by developers or agents can be evaluated against existing code, pipelines, and organizational policies before reaching production. ## Enterprise-Scale DevSecOps - GitLab highlights customer examples: - Ericsson reportedly cut deployment time in half. - Southwest uses GitLab for mission-critical airline operations. - Barclays and other regulated organizations use it while maintaining security and compliance requirements. - The platform supports multi-tenant SaaS, single-tenant SaaS, self-managed, and air-gapped environments. - Customers can use self-hosted AI models and integrate existing tools and AI services while maintaining a unified governance boundary. ## Reliability and Availability - Gartner recognized GitLab’s strengthened service-level agreements. - GitLab offers Ultimate customers on GitLab.com and GitLab Dedicated a 99.9% monthly availability commitment. - Eligible customers can receive service credits when availability falls below that threshold. ## New Capabilities for Speed and Governance GitLab announced five innovations intended to coordinate developers, agents, and software delivery: - **Next-generation source code management:** Claimed testing showed up to 50× faster performance and up to 1,000× less network data transfer. - **GitLab Orbit:** A context graph connecting code, work items, pipelines, deployments, and production signals. With Claude Code, GitLab reports tasks running up to 11× faster, using up to 4.5× fewer tokens and producing up to 45× fewer hallucinations. - **Security and governance agents:** Designed to address security and compliance gaps as agent usage expands. - **Agentic triggers:** Automate handoffs between developers and agents without requiring manual coordination. - **GitLab Flex agreements:** Allow customers to adjust spending across GitLab products and capabilities without changing contracts. GitLab’s central recommendation is to standardize development and AI-assisted delivery on one platform, context graph, and governance boundary. The Gartner recognition supports that positioning, although Gartner notes that its Magic Quadrant reflects analyst opinions and should not be interpreted as an endorsement or a recommendation to select the highest-rated vendor.

devsecopsaigitlabci-cd+4

gitlabJun 17, 2026

Introducing the 2026 EMEA GitLab Partner Award winners (opens in new tab)

GitLab announced its 2026 EMEA Partner Award winners, recognizing organizations that drove customer success, technical innovation, certification, business growth, and joint marketing. The awards highlight partners helping enterprises adopt DevSecOps, cloud-native platforms, managed services, and AI-enabled software development across the region. ## Regional Partners of the Year - **Central Europe: cc cloud GmbH** — Combines infrastructure and DevOps expertise to manage cloud applications, platforms, and IT operations. - **Northern Europe: Eficode** — Supports more than 1,600 customers through consulting, managed services, toolchain implementation, and AI-augmented development. - **Southern Europe: Kiratech** — Helps enterprises modernize infrastructure using cloud-native, DevOps, and PlatformOps practices. - **Eastern Europe and Israel: Bynet** — An established systems integrator supporting enterprise IT, cloud, cybersecurity, modernization, DevSecOps, and AI adoption. ## Technical and Enablement Awards - **Best Technical Solution/Project: Capgemini | Sogeti** — Recognized for impactful, complex technical solutions using AI-driven quality engineering, data, and cloud capabilities. - **Most Certified and Enabled Partner: Devoteam** — Awarded for having the largest number of GitLab-certified professionals. - **Rookie of the Year: ITDOTCOM** — A Uzbekistan-based technology distributor that achieved rapid success supporting software, infrastructure, cybersecurity, and business automation across Central Asia. ## Growth and Collaboration Awards - **First Order Master: Linux Polska** — Recognized for winning new customers and business through open-source consulting, DevOps, automation, containerization, and data analytics. - **Co-marketing Partner of the Year: Conoa, a PROACT Company** — Honored for joint marketing efforts and expertise in Kubernetes, cloud-native technologies, container platforms, and managed operations. The awards demonstrate the breadth of GitLab’s EMEA partner ecosystem, from regional systems integrators and cloud specialists to technical consultants and Kubernetes providers. Together, these partners are helping customers modernize delivery practices and adopt DevSecOps and AI capabilities.

devsecopsaik8sgitlab+4

gitlabJun 17, 2026

GitLab and Capgemini accelerate DevSecOps transformation (opens in new tab)

GitLab and Capgemini have formed a global alliance to help organizations modernize software delivery and adopt secure, AI-assisted development practices. Capgemini will provide GitLab’s DevSecOps platform, including GitLab Duo Agent Platform, alongside implementation and transformation services. The partnership aims to shorten the journey from platform adoption to measurable business results. ## Partnership and Client Benefits - Capgemini becomes a GitLab Select Partner serving clients globally. - Customers receive expert guidance on tools, processes, and transformation methodologies. - GitLab Duo Agent Platform will help orchestrate AI across the software development lifecycle. - The combined offering is designed to accelerate delivery while improving software supply-chain security. ## Initial Areas of Focus - **Cloud-native development and application modernization:** Moving legacy workloads to modern architectures. - **Sovereign solution design and delivery:** Addressing regulatory, regional, and data-residency requirements. - **Value stream modernization:** Improving the path from initial idea through production release. - **Generative and agentic AI:** Integrating GitLab Duo Agent Platform into development workflows to help teams ship faster. Organizations interested in the alliance’s services can contact GitLab or Capgemini representatives.

devsecopsgen-aigitlabgitlab-duo-agent-platform+3

gitlabJun 10, 2026

GitLab Flex: Commit once, reshape your seats and AI spend (opens in new tab)

GitLab Flex addresses the unpredictability introduced by agentic software development, where seat counts, AI consumption, and desired capabilities can change throughout the year. Instead of fixing these needs in a traditional annual contract, Flex provides one annual spending commitment that can be reallocated monthly. GitLab’s conclusion is that organizations can adopt new capabilities and adjust usage without renegotiation or re-procurement. ## Fixed Contracts, Moving Needs - Agentic development creates uncertainty around: - The number of platform seats required as teams and contractor mixes change. - The amount of AI usage driven by evolving use cases and technology. - Which new capabilities organizations will adopt during the contract term. - Traditional contracts require customers to estimate all three in advance. - Overestimating leads to unused seats and capacity, while underestimating can delay adoption through additional procurement cycles. ## One Annual Commitment, Adjusted Monthly - GitLab Flex uses a single annual dollar commitment based on a published rate card. - Customers can allocate that commitment across: - Premium and Ultimate platform seats. - GitLab Credits for services such as Duo Agent Platform, hosted runners, and artifact management. - Eligible usage-based capabilities introduced after signing. - It applies across GitLab.com, Self-Managed, air-gapped, and Dedicated deployments. - Customers can shift unused seat reservations toward other seats or AI usage without amending the agreement. - Usage above the annual commitment is billed on demand at $1 per credit or the negotiated per-seat rate. ## Combined Seats, Credits, and Deployment Types - A single agreement can combine platform seats and credit-metered services. - Larger commitments provide volume discounts across the rate card. - Organizations can change their mix of seats, credits, and deployment models during the term. - Unlike models that separate licenses and usage credits, Flex allows budget to move between them. ## Pricing and Spending Controls - Reserved capacity is priced below unplanned usage. - Subscription-level and per-user caps help control spending. - Project- and group-level administrative controls provide additional oversight. - Unreserved seats use the same effective negotiated rate as reserved seats. - Cloud-connected customers are billed automatically; air-gapped customers are invoiced twice yearly. ## Existing Contracts and Availability - GitLab Premium and Ultimate remain available through direct seat pricing. - Existing customers may keep their current plans through renewal. - Flex does not change the capabilities included in those tiers. - Customers approaching renewal can compare Flex with their current contract using projected seat and AI usage. - Flex orders are available now, with fulfillment rolling out throughout the quarter. GitLab Flex is best suited to organizations that expect their workforce, AI consumption, or deployment requirements to change frequently. Its main benefit is financial and operational flexibility: one agreement lets customers rebalance spending monthly instead of waiting for renewal or reopening procurement.

devsecopsaigitlabgitlab-duo-agent-platform+4

gitlabJun 10, 2026

GitLab on Google Cloud: Fully managed, compliant, and AI-ready (opens in new tab)

GitLab is introducing a fully managed deployment on Google Cloud through certified managed service providers such as Beyond and Digital Future. The offering combines data residency and compliance controls with access to Google’s Gemini and Gemma models through GitLab Duo Agent Platform. Organizations can also purchase the platform through Google Cloud Marketplace, applying existing cloud commitments to GitLab, AI inference, and infrastructure costs. ## Fully Managed GitLab on Google Cloud - Certified MSPs operate GitLab on Google Cloud under service-level agreements, removing infrastructure-management responsibilities from customer teams. - Organizations retain control over where code, pipelines, and security data are stored, supporting sovereignty and data-residency requirements. - GitLab’s audit and policy controls provide visibility into agent actions, merge requests, and security findings. ## AI Model Choice for Different Workloads - Gemini models, including Gemini 3.5 Flash, are available in Duo Agent Platform through Google’s Gemini Enterprise Agent Platform. - GitLab’s participation in Google’s early-access program is intended to bring new Gemini models to Duo as they become available. - Regulated or self-hosted teams can use Gemma 4 with GitLab Duo Self-Hosted. - With self-hosted models, the AI Gateway and all requests and responses remain within an organization’s on-premises or private-cloud environment. ## Using Existing Google Cloud Commitments - GitLab and Duo Agent Platform can be purchased through Google Cloud Marketplace. - Existing Google Cloud commitments can fund GitLab subscriptions, model inference, and related infrastructure without starting a new procurement cycle. - Consolidated Google Cloud billing reduces reconciliation across vendors. - GitLab retains its own cost-management features, including usage dashboards, model policies, and GitLab Credits for more predictable AI spending. ## One Governed DevSecOps Platform - GitLab Duo Agent Platform provides software-delivery context that standalone coding assistants lack, including merge requests, pipelines, and deployment targets. - This context helps agents perform multi-step work and supports code review at monorepo scale. - Combining GitLab’s governance and lifecycle data with Google’s models keeps deployment, model selection, compliance, and spending aligned in one platform rather than fragmented across multiple tools. Organizations can start with a Duo Agent Platform trial, enable it through the free GitLab tier, or use included GitLab Credits with Premium and Ultimate subscriptions. Overall, the offering is aimed at teams that want managed GitLab operations, flexible AI model access, and strong control over data location and costs on Google Cloud.

devsecopsgitlabgeminigitlab-duo-agent-platform+4