# GitLab GitLab Blog RSS feed This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Rate limits on GitLab.com are changing DevFeed: [Rate limits on GitLab.com are changing]() Original publisher: [Read original article]() Author: Sam Wiskow Published: 2026-09-17T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [GitLab](), [Automation](), [Users](), [account]() Tags: [2026](), [automation](), [credentials](), [gitlab](), [limits](), [platform](), [product](), [user](), [users]() ### AI overview GitLab.com will align rate limits with subscription tiers beginning October 19, 2026. Free accounts and unauthenticated requests change first, while Premium and Ultimate limits change in January 2027. Unauthenticated requests are limited to 60 requests per hour per IP address, with preview windows scheduled for October 7 and 14. ### Source excerpt GitLab.com hosts millions of projects for teams of every size that need a platform they can rely on. Demand is climbing quickly, and we expect platform load to grow several times over this year. Predictable limits are what keep GitLab.com fast for everyone on it, including the automation and agent workloads teams are building on the platform. To hold that as we scale, we're updating how rate limits work. Starting October 19, 2026, rate limits on GitLab.com will align with your subscription tier. Free accounts and unauthenticated requests happen first, on October 19. Premium and Ultimate move in January 2027. What is changing Limits align with your subscription. Free, Premium, and Ultimate subscription plans get their own limits, applied per user and per top-level group. Free takes effect October 19; Premium and Ultimate in January 2027. Signing in gets you the full limit. An authenticated request is governed by your subscription plan below. A request that arrives with no credentials gets 60 requests per hour per IP address. The per-plan limits are published in the rate limits documentation. What happens on October 19 There will be two preview windows for Free and unauthenticated traffic, on October 7 and October 14 from 15:00 to 19:00 UTC. Signed-in Premium and Ultimate requests are not affected, since those limits do not change until January. Unauthenticated requests are capped no matter where they come from, including automation running against a paid account without credentials. A preview window (engineers call these brownouts) is a short, planned window where we switch the new limits on and then switch them back off. Nothing else about the service changes while it runs. The point is to give you a real look at how your own workloads behave under the new limits, weeks before they apply for good. On October 19 the new limits take effect. We set these limits by looking at how GitLab.com is actually used. Almost all users are already inside the new limits and won't n ## When to use SAST versus an LLM security scanner DevFeed: [When to use SAST versus an LLM security scanner]() Original publisher: [Read original article]() Author: Chris Widstrom Published: 2026-09-16T00:00:00Z Content type: comparison Language: en Sources: [GitLab]() Topics: [Security](), [LLM security](), [Large Language Model](), [Application Security](), [Testing](), [Frontier Model](), [audit trail](), [business logic]() Tags: [application-security](), [audit-trail](), [features](), [frontier-model](), [llm](), [llm-security](), [product](), [sast](), [security](), [vulnerabilities]() ### AI overview This comparison explains when to use static application security testing (SAST) and when to use LLM-based security review. SAST provides predictable, repeatable, low-cost scanning across commits, while LLMs can reason about context and identify some intent-based or novel issues. The article recommends using both according to the task and scan scope. ### Source excerpt You're probably running some version of this experiment already: Point a frontier model at a merge request and ask it to double as a vulnerability scanner. On a single merge request, it often works well. The model reads the code, reasons about what it's supposed to do, and catches real issues, sometimes ones a pattern-based scanner misses entirely. So the next thought is reasonable: If a model reviews one merge request this well, why not let it replace the scanner across your whole pipeline? That's where it breaks down. Running a frontier model as your primary scanner on every commit across an enterprise codebase costs more and behaves less predictably, than asking it to review one merge request. If you run application security for a platform or product team, the decision was never mutually exclusive: static application security testing (SAST) or LLM scanners. It's which one runs where. Get that split right and you keep deterministic coverage on every commit, add reasoning where it earns its place, and avoid both an unpredictable inference bill and gaps in your audit trail. Here's how the two compare: Deterministic scanner (SAST)AI-based review (LLM)CostBetter Fractions of a cent per scan, fixed and predictable. A paid inference call per scan; cost scales with code volume and is hard to forecast.ConsistencyBetter Flags the same vulnerabilities, every time. Can flag or miss different vulnerabilities on the same code, run to run.Audit evidenceBetter Reproducible: same fixed method every time, mapped to a CWE Output can vary between runs, harder to use as standalone audit evidence.Vulnerability typesDepends on the vulnerability type Pattern-based, traceable flaws (injection)Depends on the vulnerability type Intent-based and novel flaws: missing auth checks, broken ownership logic, and issues not yet mapped to a CVE or CWE. Could reason about business logic using context from issues, epics, and docs.Validating a finding Flags potential vulnerabilities; can't confirm whe ## GitLab Dedicated: Compliance for a new regulatory era DevFeed: [GitLab Dedicated: Compliance for a new regulatory era]() Original publisher: [Read original article]() Author: Aathira Nair Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Software as a service](), [Amazon Web Services](), [Cybersecurity](), [Security](), [Resilience](), [Deployment](), [Testing](), [Multitenancy]() Tags: [amazon-web-services-aws](), [aws](), [compliance](), [deployment](), [gdpr](), [gitlab](), [infrastructure-as-code](), [nis2](), [product](), [regulatory](), [resilience](), [saas](), [security](), [testing]() ### AI overview The article presents GitLab Dedicated as a fully isolated, single-tenant SaaS platform hosted and managed by GitLab in a preferred Amazon Web Services region. It explains how the service is intended to help European enterprises address compliance, data sovereignty, audit readiness, security, resilience, and operational responsibilities related to DORA, NIS2, and GDPR. ### Source excerpt Enforcements such as NIS2 are no longer a future planning consideration. The European Union Agency for Cybersecurity's (ENISA) NIS360 report confirms that supervisory authorities are actively assessing cybersecurity maturity across critical sectors. The agency is moving from guidance and consultation into active oversight, scrutiny, and accountability. This is the regulatory environment European enterprises now operate in. Multi-tenant cloud platforms remove operational overhead but place source code and pipelines on shared infrastructure regulators now scrutinize. Self-managed solutions provide isolation but transfer responsibility for upgrade cycles, security patches, and disaster recovery (DR) tests to an already stretched platform team. Both deployment options leave gaps in risk management, data sovereignty, and furnishing audit evidence. In this article, you'll discover how GitLab Dedicated, a fully isolated, single-tenant SaaS solution deployed in your preferred Amazon Web Services (AWS) region and hosted and managed by GitLab, addresses these challenges and helps you keep pace with evolving compliance requirements. "NatWest Group is adopting GitLab Dedicated SaaS to enable our engineers to use a common cloud engineering platform; delivering new customer and colleague outcomes rapidly, frequently, and securely with high quality, automated testing, on-demand infrastructure, and straight-through deployment." -- Adam Leggett, Platform Lead for Engineering Platforms, NatWest Group Regulations are driving change In the European Union, key regulations are driving the need for a different platform approach. These regulations converge on a decision most enterprises made before they existed: a platform their developers build on. That decision now carries audit consequences it didn't before. Digital Operational Resilience Act (DORA), which came into force across EU financial services in January 2025, requires financial institutions to keep critical technology resilient, ## How to calculate DevOps platform total cost of ownership DevFeed: [How to calculate DevOps platform total cost of ownership]() Original publisher: [Read original article]() Author: GitLab Published: 2026-09-11T00:00:00Z Content type: tutorial Language: en Sources: [GitLab]() Topics: [CI/CD]() Tags: [ai](), [ci-cd](), [complexity](), [compute](), [cost](), [devops](), [devsecops](), [devsecops-platform](), [drivers](), [how-to](), [infrastructure](), [integration](), [model](), [platform](), [reduce](), [software-delivery](), [tools]() ### AI overview A guide to modeling the total cost of ownership of a DevOps platform, including subscriptions, CI/CD compute, AI usage, infrastructure, tools, and internal labor. ### Source excerpt There's nothing like budget pressure to put your DevOps platform under a microscope. But subscription fees and license costs only tell one part of the story. The total cost of ownership (TCO) for a DevOps platform also includes variable costs like CI/CD compute and AI usage, along with the infrastructure, tools, and employee time required to keep software delivery moving. That wider view matters when you're tasked with defending platform spend or comparing options with a head of finance. Designing a useful TCO model can: Make those costs transparent for stakeholders Shine a light on the reasoning (or lack thereof) behind each cost Identify areas to reduce spend without negatively impacting software delivery What total cost of ownership really includes The core challenge of calculating TCO is that DevOps platforms package and price capabilities differently. For example, one platform may bundle CI/CD or AI capabilities into a per-seat subscription, while another could price usage separately. A third may appear less expensive upfront but require additional tools and ongoing integration work. That's why list prices or pricing tiers alone won't give you a useful comparison. Start with the capabilities and workloads your organization actually needs, then calculate what it takes to support them on each platform. Use the same scope and time period for every option -- often one year -- and define which teams, applications, environments, and delivery stages are included. Separate recurring costs from one-time expenses and external spend from internal labor, so finance can audit the assumptions and forecast future years. A useful TCO model, therefore, answers two questions: What does it cost to meet our requirements today? Which variables will cause that cost to rise or fall as our usage changes? The cost categories that drive your bill Most DevOps platform costs fit into the following categories: Cost categoryWhat it includesMain cost driverPlatform accessPaid seats, role-based ## GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 DevFeed: [GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8]() Original publisher: [Read original article]() Author: Katherine Wu Published: 2026-09-11T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [GitLab](), [releases](), [Vulnerabilities](), [Deployment](), [Bug Bounty]() Tags: [api](), [release](), [security](), [vulnerabilities]() ### AI overview GitLab released critical patches 19.3.2, 19.2.6, and 19.1.8 with bug and security fixes. Self-managed installations should upgrade promptly. ### Source excerpt Learn more about GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). ## Prepare for the Cyber Resilience Act's 24-hour reporting deadline DevFeed: [Prepare for the Cyber Resilience Act's 24-hour reporting deadline]() Original publisher: [Read original article]() Author: Amit Shalem Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [Vulnerabilities](), [open-source-security](), [Incident response]() Tags: [compliance](), [cybersecurity](), [europe](), [features](), [sbom](), [security](), [supply-chain](), [supply-chain-security](), [vulnerabilities]() ### AI overview The article explains the Cyber Resilience Act requirement for manufacturers to report actively exploited product vulnerabilities within 24 hours of becoming aware of them. It presents continuous software supply-chain detection, dependency scanning, SBOM monitoring, KEV status, EPSS scores, and container scanning as ways GitLab can help organizations identify and prioritize reportable risks. ### Source excerpt Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively exploited. This is a new requirement under the Cyber Resilience Act (CRA), the EU law that sets cybersecurity requirements for products with digital elements sold in Europe, put in place to ensure those products are secure by design and supported against new threats. The most stringent requirements under the CRA apply to the manufacturers that make those products, from large software vendors to companies shipping connected hardware. The challenge a business faces to stay compliant is not the filing itself. It is finding out fast enough that a vulnerability in something you shipped is being actively exploited in your software supply chain. The 24-hour clock starts the moment you become aware, this is why detection is so important. Continuous detection is an engineering solution rather than a one-off compliance one. GitLab's software supply chain security capabilities are built to help you find active exploitation in what you shipped, automatically and continuously. This article walks through four questions you should ask yourself about your own pipeline's continuous detection solution today. Reporting requirement starts in September 2026 Beginning September 11, 2026, manufacturers have to report an actively exploited vulnerability within 24 hours of becoming aware of it. The reporting runs in three stages each submitted simultaneously to the European Union Agency for Cybersecurity (ENISA) and to the Computer Security Incident Response Team (CSIRT) designated as coordinator. Early warning, within 24 hours of becoming aware of the actively exploited vulnerability. A short first alert that exploitation is happening. You are not expected to know the full scope of impact or the fix yet. Notification, within 72 hours. A fuller account, covering what is affect ## Co-Create: Building GitLab with our users DevFeed: [Co-Create: Building GitLab with our users]() Original publisher: [Read original article]() Author: Isa Huerga Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [CI/CD](), [Scala](), [Claude](), [Application Security](), [Cloud APIs]() Tags: [api](), [ci-cd](), [co-created](), [community](), [contributors](), [duo](), [engineering](), [open-source](), [rest-api](), [scala](), [security]() ### AI overview GitLab users collaborated through the Co-Create program on product improvements delivered in the first half of 2026, including API extensions, CI/CD capabilities, Scala support for AI-powered code understanding, security controls, and integration flexibility. ### Source excerpt GitLab users bring firsthand experience of the workflows they want to improve. Through our Co-Create program, they collaborate directly with us to design, build, and deliver product improvements that benefit more teams. In the first half of 2026, our users helped us extend APIs, add CI/CD capabilities, expand language support for AI-powered code understanding, strengthen security controls, increase the flexibility of integrations, and make GitLab easier to use and understand. Co-Create gives customers a direct path from a real-world challenge to a product improvement. Customers collaborate with us on the problem and solution, and help deliver the change. Unlike a feedback-only model, this puts real workflow context into the product development process. It creates a shorter path from need to value while helping us validate improvements in real conditions and extend their benefits to more GitLab users. "Over ten years ago, we set out to build code.siemens.com, our internal coding platform based on GitLab, which today serves close to 100,000 people. We've run and scaled the platform with a tiny team, guided by a 'for developers, from developers' philosophy. We co-created hundreds of features such as x509/gpg signed commits, protected container/packages, and project and social features such as follow users, allowing us to strengthen the security and collaboration culture at the scale of Siemens." -- Roger Meier, Distinguished Engineer, Siemens From a specific need to a shared improvement Some of the best product improvements start with a specific, real-world need. GitLab contributors helped us address the following needs: Making Scala codebases understandable to Orbit and GitLab Duo Giving security administrators a way to enforce Secret Push Protection across an entire instance Letting high-throughput teams configure merge train pipeline limits Showing the platforms supported by multi-architecture images Providing screen reader users with more context on documentation pa ## Bring your own model to GitLab Duo Self-Hosted with Microsoft Foundry DevFeed: [Bring your own model to GitLab Duo Self-Hosted with Microsoft Foundry]() Original publisher: [Read original article]() Author: Evgeny Rudinsky Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [GitLab]() Topics: [AI Chat]() Tags: [agentic-ai](), [ai](), [infrastructure](), [models](), [openai](), [platform](), [tutorial]() ### AI overview A tutorial on connecting GitLab Duo Self-Hosted to GPT, Claude, Llama, and Mistral deployments in Microsoft Foundry. It explains model-per-feature selection and emphasizes control over hosting, region, network path, and credentials. ### Source excerpt For many organizations, the question about AI coding tools isn't whether they help, but where the code goes. Teams under data sovereignty, residency, or regulatory constraints need to know which network handles their source code before they can adopt anything. GitLab Duo Self-Hosted answers that by letting administrators connect GitLab Duo features to models running on infrastructure they choose, with control over hosting, region, network path, and credentials. In this tutorial, we'll connect GitLab Duo Self-Hosted to models hosted in Microsoft Foundry. Foundry is worth treating as a general-purpose serving platform rather than an OpenAI endpoint: Its catalog spans OpenAI GPT, Anthropic Claude, Meta Llama, and Mistral, and the families GitLab supports overlap heavily with what Foundry offers. That matters because GitLab lets you assign a model per feature. You can run one family for agentic work, a code-specialized model for Code Suggestions, and a smaller model where request volume dominates, all deployed and billed through one Azure subscription. The setup steps are the same regardless of family. Only the model you deploy, the deployment name you reference, and the Model family you select in GitLab change. Microsoft's catalog moves quickly and will contain releases newer than GitLab's supported-model matrix. Catalog availability alone does not establish GitLab Duo support, so always check both vendors' documentation before choosing a model. Why GitLab Duo Self-Hosted? GitLab Duo Self-Hosted lets you connect GitLab Duo to models deployed on-premises or through a supported cloud provider. Microsoft Foundry is useful when your organization already operates in Azure and wants to manage model deployments, access, networking, and consumption there. Key benefits include: Deployment choice: Select the Azure region and deployment type that meet your availability and data-residency requirements. Multiple model families, one platform: Deploy GPT, Claude, Llama, or Mistral mo ## GPT-6 Astra on GitLab: Faster runs, fewer tokens used DevFeed: [GPT-6 Astra on GitLab: Faster runs, fewer tokens used]() Original publisher: [Read original article]() Author: Brittany Lutz Published: 2026-09-08T00:00:00Z Content type: news Language: en Sources: [GitLab]() Topics: [GitLab]() Tags: [agent](), [agentic](), [ai](), [benchmark](), [evaluation](), [features](), [frontier-model](), [gpt](), [model](), [openai](), [platform](), [product](), [review](), [testing](), [updates]() ### AI overview GitLab Duo Agent Platform adds GPT-6 Astra. GitLab reports faster typical and slow-tail runs plus lower token use than GPT-5.6 Sol, while noting Sol had a higher benchmark task-resolution rate. ### Source excerpt OpenAI's newest frontier model GPT-6 Astra is now on GitLab Duo Agent Platform, delivering faster runs and lower token usage. In GitLab's internal evaluation, GPT-6 Astra finished a typical run 43.4% faster than GPT-5.6 Sol and used 42.7% fewer tokens per run, while completing every task in the benchmark. For your team, that means agentic tasks such as dependency updates, build fixes, and small multi-file changes come back faster, and stretch your token budget across more of your team's backlog. Faster agentic work, even on your slowest runs Wait time factors into how your team uses an agent. A run that comes back in a few minutes is one you stay engaged with. A longer run is one you let work in the background while you move to another task. When it finishes, you switch context from the work you're in, reread what you asked the agent for, and review a diff you last thought about 30 minutes ago. The longer runs that result in context switching are the ones GPT-6 Astra shortened most in GitLab's internal testing. At the 95th percentile, the slower tail of its runs, GPT-6 Astra finished 49.2% faster than GPT-5.6 Sol, and 43.4% faster on a typical run. Astra's slowest runs finish in roughly the time Sol needed for an average one. With GPT-6 Astra, your team waits less on high volume, routine work. Every task finished, at a lower token usage per run In GitLab's internal testing, GPT-6 Astra completed 100% of benchmark tasks. No run stalled, timed out, or came back empty, so your team isn't left waiting on runs that finish with nothing to review. Astra resolved 63.3% of those tasks, returning a change that passed the benchmark's tests, compared to a 76.7% resolution rate for GPT-5.6 Sol. Misses return as patches to correct rather than runs that produced nothing. Astra reached its completion rate using 42.7% fewer tokens per run than Sol, measured across the same set of tasks. That savings compounds across a backlog, so your token budget covers more of the work your team d ## GitLab's internal playbook to foster AI-fluent technical teams DevFeed: [GitLab's internal playbook to foster AI-fluent technical teams]() Original publisher: [Read original article]() Author: Rob Allen Published: 2026-09-02T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [AI Strategy](), [GitLab]() Tags: [ai](), [ai-adoption](), [ai-strategy](), [collaboration](), [compliance](), [enablement](), [engineering](), [workflows]() ### AI overview GitLab shares an internal playbook for building AI fluency in technical teams. It describes a federated governance model that centrally manages foundational AI tools while allowing local experimentation and functional strategy. ### Source excerpt Give two engineering teams the same AI tool and you can end up with two very different outcomes. One team ships faster with fewer bugs, while the other gets burned by an agent that confidently generates the wrong output. At GitLab, our team had AI tools at their fingertips and some found real value fast, working faster and catching issues earlier. Meanwhile, others hadn't quite found an entry point yet to develop effective AI-native workflows. We learned that building AI fluency -- how our team members know what to delegate to AI, how to build the right AI-native processes, and how to judge what comes back -- was just as important as AI tool adoption and access. Building that fluency across GitLab was both an operational and technical challenge requiring close partnership between our Enterprise Technology and Talent Development teams. We're sharing our internal playbook so other technical leaders gain another perspective on how to encourage the right kinds of AI adoption across their own organizations. An AI strategy built for the pace of our work Part of building the right paths for our technical teams was predicated on establishing smart foundational infrastructure. Enterprise Technology considered a few different structures to our governance. The first was a fully centralized team, but we worried that with the speed of AI technology, shipping approvals from one group could end up as a bottleneck. As a result, team members could become impatient and try to circumvent governance infrastructure to experiment with AI. The second was a fully decentralized approach, but that could fragment efforts across the company, which adds complexity and makes guardrail consistency challenging. We landed on a hybrid model, building governance and enablement into a model that used the best aspects of centralized and decentralized strategies: Enterprise AI acts as a central governance and technology hub: Based out of our Enterprise Technology team, Enterprise AI operates as the platfo ## Critical remote code execution in vm2, a widely used Node.js sandbox library DevFeed: [Critical remote code execution in vm2, a widely used Node.js sandbox library]() Original publisher: [Read original article]() Author: Daniel Abeles Published: 2026-09-02T00:00:00Z Content type: news Language: en Sources: [GitLab]() Topics: [vulnerability](), [Node.js](), [configuration](), [Threat Research]() Tags: [ai](), [containers](), [node-js](), [processes](), [sandbox](), [security](), [security-labs](), [threat-research](), [update](), [vulnerability]() ### AI overview GitLab reports a critical vm2 sandbox escape that can enable remote code execution. Version 3.11.7 blocks the reported attack, but the article advises hardening require.root and context settings and avoiding vm2 for truly untrusted code. ### Source excerpt GitLab's Threat Research Group found a critical sandbox escape vulnerability in vm2, one of the most widely adopted Node.js sandboxing libraries. The vulnerability uses a configuration copied straight from vm2's own README. We found the flaw, rated CVSS 3.1: 10.0, critical, using our own AI automated tools. Anyone running vm2 Version 3.11.6 or earlier with require.external turned on should treat this as directly exploitable. Once we found the vulnerability, we verified GitLab does not use vm2. We also reported it privately to vm2 and the maintainer fixed it fast, in vm2 Version 3.11.7. When we tested that fix again, it blocked the exact attack we reported. For anyone relying on vm2, it's worth flagging that there's a broader configuration risk here that goes beyond this one patch, based on the maintainer's own description of the fix. TL;DR Critical vulnerability: GitLab's Threat Research Group discovered a critical sandbox escape (CVSS 3.1: 10.0) in vm2, a widely used Node.js sandboxing library, which allows for remote code execution. The root cause: The vulnerability stems from default configurations found in the library's own "Quick Examples" README, where the sandbox fails to properly isolate itself from the host system, allowing malicious code to gain unrestricted access. Fix limitations: While updating to Version 3.11.7 blocks the specific attack reported, it does not fully resolve the underlying configuration risk; developers remain vulnerable if they continue to use require.external with overly broad require.root settings. Immediate recommendations: Users should update to Version 3.11.7, but must also manually harden their configurations by restricting require.root to only necessary files and setting context: 'sandbox' instead of relying on the default 'host' setting. Long-term advice: Due to vm2's history of recurring sandbox escape bugs, it is recommended to avoid using it for isolating truly untrusted code and instead opt for more robust methods like conta ## GitLab compliance frameworks: Adhere to SOC 2 in minutes DevFeed: [GitLab compliance frameworks: Adhere to SOC 2 in minutes]() Original publisher: [Read original article]() Author: Fernando Diaz Published: 2026-08-27T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Template](), [configuration](), [Security](), [Software]() Tags: [application-security](), [article](), [compliance](), [devsecops](), [framework](), [how-to](), [platform](), [security](), [soc](), [software](), [software-delivery](), [tutorial]() ### AI overview This article explains how GitLab custom compliance framework templates help teams define controls, continuously monitor adherence, and prepare for audits. It uses SOC 2 as a central example and covers templates, policies, compliance requirements, and automated checks across GitLab deployment options. ### Source excerpt Compliance is the part of software delivery that everyone agrees is important, yet nobody enjoys. It often lives in spreadsheets, screenshots, and the quiet dread of an upcoming audit. GitLab's custom compliance frameworks work differently. Instead of documenting what should be true about your projects, you define the controls once and let the platform continuously verify what is true. In this article, you'll learn why compliance adherence matters, how to stand up a SOC 2 framework in minutes using a template, how to monitor adherence on an ongoing basis, how to enforce compliance with policies, and which standards already ship as ready-to-use templates. You'll also get a look at where AI-specific compliance templates are heading. You can watch the video below to see it in action: Tier note: Compliance frameworks are available in Premium and Ultimate. Framework requirements and controls, the checks that power adherence reporting and the compliance status report, require Ultimate. Everything here applies to GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Why compliance adherence matters and how custom frameworks help Regulatory and contractual obligations like SOC 2, ISO 27001, PCI DSS, and FedRAMP exist because customers, partners, and regulators need assurance that your software is built and shipped responsibly. Falling short isn't just a paperwork problem. It can block deals, trigger fines, delay product launches, and erode trust. Compliance also isn't a one-time event. A project that was compliant at audit time can drift the moment someone disables a scanner, removes branch protection, or merges without the required approvals. Custom compliance frameworks are designed to close that gap. A compliance framework in GitLab is a label you create on a top-level group to identify projects that carry specific compliance obligations or need extra oversight. On its own that label provides organization and visibility. In Ultimate, a framework can also carry requireme ## How to recognize your team with GitLab Achievements DevFeed: [How to recognize your team with GitLab Achievements]() Original publisher: [Read original article]() Author: Lee Tickett Published: 2026-08-27T00:00:00Z Content type: tutorial Language: en Sources: [GitLab]() Topics: [GitLab](), [Open Source](), [Template](), [Markdown]() Tags: [collaboration](), [community](), [company](), [feature](), [how-to](), [markdown](), [open-source](), [product](), [profile](), [retention]() ### AI overview GitLab Achievements lets teams create reusable custom badges and award them for contributions, milestones, certifications, or other behaviors. Awards appear on recipients' profiles after they accept them, and optional personal messages support GitLab Flavored Markdown. The feature is presented as a way to reinforce recognition, retention, motivation, and belonging across companies, open source projects, and communities. ### Source excerpt Every team runs on people who go above and beyond. The engineer who fixes the flaky test nobody else will touch. The reviewer who turns your merge request around in an hour. The teammate who finishes their certification. Or the community member who shows up release after release. Whether your team is a company, an open source project, or a community, GitLab had no built-in way to say "we see you." GitLab Achievements changes that. What are GitLab Achievements? An achievement is a custom badge you create once and award to people for their behavior. That might be a contribution, a milestone, or simply getting the most out of GitLab. Each one has a name, a description, and an avatar. Think "First merged MR", "Certified", or "Contributor of the month". Awarded achievements appear on the recipient's profile, alongside their contribution history. There are two halves to the achievement. The achievement itself is a reusable template you define at the group level. Awarding that achievement to someone is a separate action, and it can carry an optional personal message. That message supports GitLab Flavored Markdown, so you can link straight to the merge request, issue, or event that earned it. The same "Contributor of the month" badge can then tell a different story every time you award it. Recipients stay in control. An award doesn't appear on anyone's profile until they accept it using a link from an email notification. Recognition is offered, never forced onto someone's profile. Achievements are generally available as of GitLab 19.2, across Free, Premium, and Ultimate, on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Why recognition matters Recognition is one of the least expensive, most effective tools you have for retention, motivation, and belonging. A visible badge on a profile costs you a minute to award and gives the recipient something lasting. And "team" is broad: It might be your company, your open source project, or your wider community. The value depen ## GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7 DevFeed: [GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7]() Original publisher: [Read original article]() Author: Katherine Wu Published: 2026-08-26T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [releases](), [Vulnerabilities](), [ci](), [AI Bots]() Tags: [ai-agent](), [ci](), [claude](), [community](), [enterprise](), [release](), [security](), [vulnerabilities]() ### AI overview GitLab released patch versions 19.3.1, 19.2.5, and 19.1.7 for CE and EE, with bug and security fixes. Self-managed installations should upgrade promptly; the release includes a fix for a Duo Claude AI agent vulnerability affecting CI command execution. ### Source excerpt Learn more about GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). ## Making room for what's next in the GitLab UI DevFeed: [Making room for what's next in the GitLab UI]() Original publisher: [Read original article]() Author: Jeremy Elder Published: 2026-08-26T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [User interface design](), [Dark Mode]() Tags: [ai](), [chrome](), [dark-mode](), [design](), [duo](), [enterprise](), [product](), [themes](), [ui](), [ux]() ### AI overview GitLab describes a UI reduction effort using neutral controls, reduced color, and design tokens to improve clarity and make room for self-surfacing interactions. ### Source excerpt Throughout this year, the product interface has been in a season of reduction. On the heels of dark mode, the tide has been moving out with a quieter application chrome, overall color reduction, and neutral controls. It can feel like loss, low tide always does. But low tide is also when you can see the shape of the shoreline clearly enough to build something new on it. What's coming in is a user interface built for a different kind of work where you don't search for the right button, it surfaces at the moment you need it. This is a conceptual shift that needs room to breathe, and we're clearing the way for it. Tech goes through cycles like this. Touchscreens replacing physical buttons felt like a loss at first, until gestures, voice, and haptics enabled a deeper kind of interaction and expression. Cords gave way to wireless and each generational change introduced real friction for a time. The tide going out isn't the point, it's the possibility of what comes in with it. Here's what's changed in the GitLab UI: Neutralized actions and controls (buttons, form controls, toggles, tabs) with increased contrast Enhanced instance theming addressing more surface area Neutral palette update and tinted neutrals for themes New bloom-style glow visual element draws attention to GitLab Duo interaction and moments requiring user input The journey to the new design Our version of that cycle started years ago when we removed many of the old Bootstrap variants and continued as we moved to design tokens. Instead of sharing a crowded palette, we scoped categories like actions, feedback, and controls more narrowly. Color in the product had a real problem of trying to do too many jobs at once and resulted in some screens feeling "lit up like a Christmas tree." Generally speaking, enterprise software limits color so that when it shows up it means something. That's the direction we've been iterating on for years. Changes like this are rarely perfect on the first pass. Something looks fine ## Git was built for humans -- agents need an upgrade DevFeed: [Git was built for humans -- agents need an upgrade]() Original publisher: [Read original article]() Author: Jessica Taylor Published: 2026-08-26T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [AI-assisted coding](), [Amazon S3]() Tags: [agents](), [api](), [architecture](), [backend](), [concurrency](), [engineering](), [features](), [git](), [product](), [s3](), [scm]() ### AI overview GitLab describes next-generation source code management designed for large numbers of agents. Its proposed design preserves Git-protocol compatibility while replacing full repository clones with targeted server-side queries and purpose-built read/write APIs. ### Source excerpt The industry is now racing to rebuild source code management for agents. We showed our answer at GitLab Transcend, but let's reiterate why rebuilding the Git backend is only half the problem. Three things break when agents become the primary users of a Git server. Every developer running hundreds of agents hits the same wall, regardless of tools: The clone tax. An agent clones an entire repository to read a single file, then does it again for the next agent, and the next retry, transferring far more data than the task requires and burning context on a local grep or blame it shouldn't have needed to run. One agent invocation today can mean 5GB to 10GB transferred and 30+ seconds of setup, just to answer a single question. Concurrency collapse. Thousands of sessions hit a backend that was originally designed for human scale, producing bottlenecks and unpredictable availability. No isolation. Agents share accounts and one branch space, so they overwhelm the repository, leave no clean way to discard abandoned work, and keep no record of which agent did what. Our platform data shows how fast the pressure is building. Over the past year, our customers created 40% more CI/CD pipelines, and code pushes to GitLab.com were up 50%. While the secure repositories grew by 60%, codebase sizes have also grown by up to 500%. When we announced next-generation source code management (next-gen SCM) at GitLab Transcend in June, we walked through how Git, as an operational model, was not designed for the load agents placed on it. A few weeks later, new entrants, including Git hosts built specifically for agent-scale concurrency, are validating that claim independently. That convergence sharpens why rebuilding the Git backend is necessary, but on its own, it's still not enough. What we're building for agent scale Next-gen SCM runs on the Git protocol for backward compatibility, with a redesigned backend and interfaces built for agents. Instead of cloning a full working tree, agents query ## Scale software delivery pipelines in isolation without owning the runner fleet DevFeed: [Scale software delivery pipelines in isolation without owning the runner fleet]() Original publisher: [Read original article]() Author: Kyurim Rhee Published: 2026-08-25T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [ci](), [GitLab](), [Software as a service](), [Security](), [cloud-infrastructure](), [Provisioning]() Tags: [agentic](), [ci](), [compliance](), [cost](), [developers](), [devsecops-platform](), [infrastructure](), [operations](), [platform](), [product](), [saas](), [scale](), [security](), [software-delivery](), [workflows]() ### AI overview GitLab presents Hosted Runners for GitLab Dedicated, a fully managed CI execution SaaS offering with isolated runner infrastructure. Each job runs in a newly provisioned VM that is deleted after completion, helping enterprises address security, compliance, scalability, reliability, and runner-operations demands without owning the runner fleet. ### Source excerpt Many enterprises choose GitLab Dedicated for a clear reason: a secure and compliant, single-tenant GitLab instance, managed by GitLab. As agentic workflows drive more pipeline volume, full data isolation and runner infrastructure operational burden become a challenge. This leads to the question, "Does owning the runner fleet still make sense?" With GitLab Dedicated, there is no more need to provision, patch, build, and scale your own runner fleet. Hosted Runners for GitLab Dedicated handles the heavy lifting and delivers a seamless experience across the entire software development lifecycle so your team can focus on shipping. Hosted Runners for GitLab Dedicated provides a runner fleet isolated from other customers. To support job-level security, each job runs in a newly provisioned, isolated VM that is deleted after the job completes. We provide a scalable and highly reliable runner fleet to support your bursty CI demands and resiliency needs. Creating and managing runners is self-serviceable through Switchboard (GitLab Dedicated management console). The runner ownership trade-off: Cost vs. user experience Pipeline load can be unpredictable. To account for this, runner infrastructure can be over-provisioned to give developers the best experience and maintain low wait times. But this drives up the infrastructure cost. Conversely, under-provisioning can save on infrastructure cost, but your developers will waste time waiting for their CI jobs to be picked up. Efforts to fine-tune this balance can monopolize your platform team's time. Shift runner operations to GitLab while maintaining control Hosted Runners for GitLab Dedicated is a fully managed CI execution SaaS offering. It's backed by a high-performing and reliable runner infrastructure. Key benefits include: Supports compliance: Full isolation/single-tenant runners with same data residency as GitLab Dedicated. Job level security: "One runner for one job" -- hosted runners run every job in a standalone, short-lived ## When code is abundant DevFeed: [When code is abundant]() Original publisher: [Read original article]() Author: Bill Staples Published: 2026-08-24T00:00:00Z Content type: opinion Language: en Sources: [GitLab]() Topics: [AI Development](), [Vibe coding](), [Software Engineering](), [GitLab](), [sdlc](), [anthropic](), [Concurrency](), [Graphs]() Tags: [ai](), [ai-agents](), [architecture](), [code](), [concurrency](), [devsecops-platform](), [enterprise](), [news](), [policy](), [software-development](), [workflow]() ### AI overview This opinion argues that AI agents and large language models are making code production cheaper and faster, shifting the main challenge for enterprise software development toward context, verification, governance, identity, policy, approval, and audit. It discusses how the software development lifecycle and its underlying architecture must adapt to machine-scale concurrency and automated workflows. ### Source excerpt I returned from the holiday break in January convinced that something fundamental had changed. Large language models had reached the point where they could produce useful code reliably enough, and cheaply enough, to change the economics of software development. Engineers everywhere seemed to be experimenting with the same thing: not just asking an AI assistant for suggestions, but giving agents real work and seeing how far they could take it. I started thinking about what happens if that continues. What changes when producing code is no longer the primary constraint in building software? I wrote those thoughts down in a board memo in January. In May, I published part of that thesis in GitLab's Act 2: the cost and time of producing software was collapsing, machines would increasingly build software under human direction, and the architecture underneath software development would have to change with it. In June, at GitLab Transcend, we showed the first pieces of that architecture: source control rebuilt for machine-scale concurrency, GitLab Orbit as a context graph spanning the software lifecycle, and governance around agent identity, policy, approval and audit. Then, on August 21, Anthropic published The AI-Native SDLC Playbook. It opens with a simple statement: "Code is no longer the bottleneck." I agree. Anthropic's playbook is a practical description of how the development lifecycle changes when agents can move implementation dramatically faster: planning becomes machine-readable, handoffs become automated, verification moves into the loop, and human judgment concentrates at the gates. What interests me is what happens one level beyond the workflow. If code is no longer the primary constraint, what becomes scarce? What architecture does an enterprise need when people, agents and multiple models are all acting across the software lifecycle at machine speed? And where does durable value move when generating the code itself becomes increasingly abundant? Over the pas ## GitLab 19.3 released DevFeed: [GitLab 19.3 released]() Original publisher: [Read original article]() Author: GitLab Published: 2026-08-20T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [GitLab](), [Release notes](), [Artificial Intelligence](), [CI/CD](), [YAML](), [audit trail](), [Authorization](), [Command-line interface]() Tags: [agent](), [ai](), [audit-trail](), [ci-cd](), [command-line](), [release](), [release-notes](), [secrets]() ### AI overview GitLab 19.3 release notes describe the Flow Creator foundational agent, which generates runnable flow YAML through plain-language conversation and can help debug flows and explain framework concepts. The release also introduces GitLab Secrets Manager in Limited Availability on GitLab.com, with scoped credentials, existing permission integration, and audit-trail logging. ### Source excerpt GitLab 19.3 released with Flow Creator foundational agent ## Run agentic software delivery inside the boundaries you already trust DevFeed: [Run agentic software delivery inside the boundaries you already trust]() Original publisher: [Read original article]() Author: Ozer Dondurmacioglu Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitHub](), [Amazon Bedrock](), [Cloud](), [Amazon Web Services](), [Inference](), [Software as a service](), [AI Development](), [Critical Infrastructure]() Tags: [agentic](), [ai](), [amazon-bedrock](), [aws](), [cloud](), [critical-infrastructure](), [inference](), [product](), [software](), [software-delivery](), [software-development]() ### AI overview GitLab introduces AI Gateway for GitLab Dedicated, enabling customers to run AI processing within their single-tenant environment and selected AWS region. The gateway supports Amazon Bedrock and other preferred model providers, while GitLab maintains the managed infrastructure, availability, and disaster recovery. GitLab Duo Agent Platform capabilities such as code review automation, failed-pipeline fixes, and security analysis can use customer-selected models. ### Source excerpt Many enterprises choose GitLab Dedicated for a clear reason: a single-tenant instance, managed by GitLab, in a cloud region they select. That isolation already covers source code, project data, and the software development lifecycle they run on GitLab. GitLab Dedicated customers can now deploy the AI Gateway for the GitLab Duo Agent Platform inside their single-tenant SaaS infrastructure, so AI-processed data stays in their environment and chosen region. GitLab Dedicated as the critical infrastructure for software delivery GitLab Dedicated is deployed in your preferred AWS region, and hosted and maintained by GitLab. You can bring your own encryption keys. No private cloud installation required. GitLab operates the instance, including high availability and disaster recovery, and maintains 99.9% monthly availability for core services. Updates to GitLab Dedicated follow a stability-first cadence, with instances on the previous minor version (N-1) relative to the current GitLab release. That is the infrastructure organizations already trust when they scale software delivery under audit: guardrails you can take to a regulator, SaaS operations you do not staff, and an availability target that holds when the platform is in the critical path. Trust should travel with every agent Agentic workflows demand more from your software development lifecycle beyond the AI coding: increased pipeline volume, greater risk for vulnerabilities introduced, context that needs to travel with every agent and flow, among others. The isolation, residency, and service-level requirements that already apply to GitLab Dedicated should apply to that inference path too, especially with growing adoption of agentic software development. Adopt AI while staying compliant Here is what's new with the introduction of AI Gateway for GitLab Dedicated: Keep AI processing in the tenancy. The AI Gateway runs in the Dedicated single-tenant environment, aligned with data residency. Bring your own models. Connect ## When your backlog outgrows your team, GitLab scales remediation DevFeed: [When your backlog outgrows your team, GitLab scales remediation]() Original publisher: [Read original article]() Author: Alisa Ho Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Application Security](), [Vulnerabilities](), [Security](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [application-security](), [developer](), [features](), [product](), [security](), [vulnerabilities]() ### AI overview GitLab 19.3 introduces bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution for existing production vulnerability backlogs. The features assess findings, identify likely false positives, and generate ready-to-merge fixes for confirmed vulnerabilities, including findings imported from third-party SARIF scanners. ### Source excerpt Security teams have historically struggled to keep up with triage and remediation when development was happening at human speed. Today, that challenge is exacerbated by developers writing and shipping code at machine speed with AI. At the same time, AI is helping attackers find and exploit vulnerabilities faster in production. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation overtook credential abuse as the top breach entry point. Vulnerability exploitation accounts for 31% of breaches versus just 13% in previous years, and only 26% of known exploited vulnerabilities were remediated this year, down from 38%. That means more breaches are starting with a vulnerability that was already sitting in production, unpatched. In GitLab 19.3, teams can now run Static Application Security Testing (SAST) False Positive Detection and Agentic SAST Vulnerability Resolution, in bulk, on their existing vulnerability backlog. Dismiss false positives and remediate vulnerabilities in bulk Most teams have a known vulnerabilities backlog already running in production, far more than any team has time to open and triage one at a time. That used to be a workload problem. Now it's a timing problem too: The same AI accelerating development is accelerating exploitation, which means findings that sit in the backlog longer carry more risk than they used to. GitLab addresses this with two layers of automated triage and remediation. The first covers active vulnerabilities in production. With GitLab 19.3, teams can bulk-select multiple vulnerabilities to run agentic flows, SAST False Positive Detection and Agentic SAST Vulnerability Resolution, against the vulnerability backlog in production. SAST False Positive Detection analyzes a finding's surrounding code and returns a confidence score and explanation for whether it's a real risk or a false positive. Agentic SAST Vulnerability Resolution takes findings confirmed as real risk and opens a ready-to-merge fix that re ## Build custom flows in minutes with the Flow Creator agent DevFeed: [Build custom flows in minutes with the Flow Creator agent]() Original publisher: [Read original article]() Author: Rebecca Carter Published: 2026-08-20T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [AI Chat]() Tags: [agentic-ai](), [agents](), [ai](), [automation](), [features](), [identity](), [product](), [security]() ### AI overview GitLab 19.3 introduces the Flow Creator agent, which turns plain-language workflow descriptions into runnable Custom Flow definitions. It clarifies ambiguous requirements before building and keeps flow activation subject to role-based controls and scoped service-account permissions. ### Source excerpt Custom Flows already let teams turn manual, multi-step work into automation that runs on GitLab events. But writing one meant learning the Flow Registry schema first. That requirement is a real barrier. The people who understand a workflow best aren't always the same ones who know a YAML schema. In GitLab 19.3, the Flow Creator agent removes that requirement. Describe the flow you want in your own words, and it responds with a complete, runnable definition. When good automations stopped at the schema Consider two people who know exactly what should be automated, but not how to build it. The security analyst triages vulnerability reports every day and knows which patterns are false positives and who owns each affected dependency. None of that knowledge is captured in a schema they have never used. The planning lead knows what should happen next when a work item changes status. The automation is obvious to them. The Flow Registry syntax is not. Writing a flow meant learning that schema before any of this knowledge could become automation. That requirement limited who could author flows to people with schema familiarity, not people with process knowledge. The result is a gap between who understands the work and who can automate it. That gap effectively slows down automations across the entire software lifecycle especially where bottlenecks already lurk. Bring flow building to everyone who understands the work Flow Creator is a foundational agent within GitLab Duo Agent Platform, available via Agentic Chat. Invoke the agent, describe what you want the flow to do in plain language, and it produces a complete flow definition. For example, "When a work item is created with the label security-triage, check it against our known false-positive patterns, find the affected dependency and its owner, and post a severity assessment as a comment." This simple explanation gives the agent a trigger, steps, and an output target. You don't have to get the description perfect on the fir ## From chaos to context: Building an AI dev workflow DevFeed: [From chaos to context: Building an AI dev workflow]() Original publisher: [Read original article]() Author: Gregory Havenga Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [AI Chat](), [CI/CD]() Tags: [agentic-ai](), [agents](), [ai](), [engineering](), [large-language-models](), [llms](), [software-development]() ### AI overview The article describes an AI-assisted development workflow designed to retain context, prioritize engineering work, and coordinate coding agents. It argues that agentic tools can make and test code changes, but still require engineering judgment and clear direction. ### Source excerpt There's a particular kind of frustration that happens when prompting an AI assistant with the same correction multiple times in a single session. The marvels of modern large language models (LLMs) make it so you're working with the most enthusiastic apprentice you'll ever have. However, that apprentice also happens to be an amnesiac. "Yes, I really do want my commit messages formatted that way, we've had this conversation three times already." Or perhaps you've experienced the trouble of trying to orchestrate several parallel AI sessions, only to watch them independently start solving the same problems and deleting each other's work. These frustrations led me down a path of iteration. I worked on early renditions of two GitLab AI features: Explain this vulnerability and Resolve this vulnerability features. They felt naive at the time, and I wanted more from them. Agentic AI delivered that. Instead of one-shot suggestions I had to prompt for and paste back, an agent could read the codebase, make the change, and run the tests on its own. It was doing the work rather than just advising on it. From there, I moved through GitLab Duo Custom Agents, VS Code integrations, and eventually OpenCode, an open source agent that describes itself as helping you "write code in your terminal, IDE, or desktop." Along the way, I've distilled what's been working for me. AI coding assistants are genuinely transformative, but they need your engineering instincts to guide them. They amplify both good decisions and bad ones, so direction matters. The tools will keep changing, but here's what's helped my day-to-day engineering so far. An optimized AI workflow Before diving into the principles, it's worth showing what an optimized AI workflow actually looks like in practice. Priority comes to me. When I start a session, the AI loads my active sessions, unresolved blockers, standing directives, and recent decisions. It then fetches my GitLab todos, active MRs, and tracked epics, presenting the