# GitLab: what changed from 18 to 19

- Product: GitLab (https://whatsnew.fyi/product/gitlab)
- Vendor: GitLab
- Range: changelog entries numbered after 18.11 up to and including 19.3, stable releases only
- Entries below: 4 releases (newest first)
- Resolved: 18 is 18.11 and 19 is 19.3, the newest stable release of each major we track
- Carrying security changes: 0 · CVEs mentioned: 0 · Mentioning breaking changes: 1 · Removing or deprecating something: 0
- Page: https://whatsnew.fyi/product/gitlab/compare/18...19

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (31 changes, grouped by kind)

### Added

#### 19.3 (2026-08-20)

- Flow Creator foundational agent in the AI Catalog to create custom flows for the GitLab Duo Agent Platform through plain-language conversation
- GitLab Duo can now resolve merge conflicts by analyzing conflicts, editing files, committing resolution to source branch, and posting summary comment on merge request
- GitLab Duo can resolve review discussions by reading comments, making requested changes on source branch, replying with summary, and resolving threads
- GitLab Duo CLI plugins and plugin marketplaces as an experiment with support for Agent Skills, custom slash commands, and Model Context Protocol servers
- Official gitlab-duo-plugins marketplace with three skills: mr-review, stack-changes, and create-issue
- New GitLab Duo Agentic Chat UI in VS Code as beta with redesigned interface for AI models, agents, slash commands, and tool approvals
- New MCP tools get_merge_request and list_merge_requests to retrieve and search merge requests with filtering by author, assignee, reviewer, state, labels, or free-text query
- Pre-register MCP OAuth applications with mcp scope directly from the Admin area to avoid Dynamic Client Registration rate limits
- Ability to see which user authorized each MCP OAuth application

#### 19.2 (2026-07-16)

- GitLab Duo CLI is now generally available, enabling terminal access to the GitLab Duo Agent Platform with interactive chat mode, headless mode for CI/CD, model selection, tool approvals, Model Context Protocol connections, and slash commands
- GitLab Duo custom flows are now generally available, providing AI-powered YAML-defined workflows that automate multi-step tasks with multi-agent orchestration, human-in-the-loop checkpoints, and native GitLab triggers
- Scheduled pipeline execution policies are now generally available, allowing security policies to define and enforce CI/CD schedules across projects with support for daily, weekly, or monthly cadences and time zone support
- Start foundational flows from Agentic Chat, enabling Developer Flow, Code Review Flow, and Fix CI/CD Pipeline Flow to be initiated directly from chat conversations
- Dependency scanning auto-remediation in Beta, providing automated dependency version bumps and Agentic Breaking Change Resolution to handle complex updates and pipeline failures
- Scala language support added to GitLab Orbit for improved code graph capabilities in Scala codebases

#### 19.1 (2026-06-18)

- Secret false positive detection with GitLab Duo is now generally available, automatically analyzing critical and high severity secret detection vulnerabilities to determine if they are false positives
- Administrators can set GitLab Duo to be always on for all projects in an entire instance or top-level group, preventing group, subgroup, and project owners from turning it off
- Automatically assign Code Owners as reviewers to merge requests based on matching changed files
- Compliance framework templates in beta, including 19 predefined templates such as ISO 27001:2022, SOC 2, FedRAMP, NIST, CIS, and TISAX
- Tool approval guardrails for GitLab Duo agents in beta

#### 19.0 (2026-05-21)

- Add group-level custom review instructions for GitLab Duo that can be shared across a group and its subgroups
- Support configuring custom work item types in projects with options to create or rename types to User Story, Bug, or Maintenance
- Make GitLab Secrets Manager available in open beta for Premium and Ultimate customers
- Support multiple trigger methods for GitLab Duo Developer including assign to issue, select Generate MR, or @mention in discussion threads
- Enable GitLab Duo Developer to run tests and checks before committing when AGENTS.md and agent-config.yml are configured
- Make SBOM-based dependency scanner generally available with automatic dependency resolution for Maven, Gradle, and Python projects
- Add manifest scanning fallback for projects without lock or build files to identify direct dependencies
- Implement usage-based billing for GitLab Duo Core with Code Suggestions consuming GitLab Credits
- Add ability to filter exact code search results by repository

### Changed

#### 19.1 (2026-06-18)

- Secret detection now scans every commit from the branch's divergence point with the default branch to the latest commit for improved coverage in feature branch pipelines

#### 19.0 (2026-05-21)

- Modify GitLab Duo Chat to be agentic and run on GitLab Duo Agent Platform for Core users

## Release notes

### 19.3 — GitLab 19.3 release notes

- Date: 2026-08-20
- Version: 19.3
- Original notes: https://docs.gitlab.com/releases/19/gitlab-19-3-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/19.3

On August 20, 2026, GitLab 19.3 was released with the following features. We are excited to recognize gkepas as this month’s Notable Contributor ! Giannis has made sustained contributions across the G…

- **added** — Flow Creator foundational agent in the AI Catalog to create custom flows for the GitLab Duo Agent Platform through plain-language conversation
- **added** — GitLab Duo can now resolve merge conflicts by analyzing conflicts, editing files, committing resolution to source branch, and posting summary comment on merge request
- **added** — GitLab Duo can resolve review discussions by reading comments, making requested changes on source branch, replying with summary, and resolving threads
- **added** — GitLab Duo CLI plugins and plugin marketplaces as an experiment with support for Agent Skills, custom slash commands, and Model Context Protocol servers
- **added** — Official gitlab-duo-plugins marketplace with three skills: mr-review, stack-changes, and create-issue
- **added** — New GitLab Duo Agentic Chat UI in VS Code as beta with redesigned interface for AI models, agents, slash commands, and tool approvals
- **added** — New MCP tools get_merge_request and list_merge_requests to retrieve and search merge requests with filtering by author, assignee, reviewer, state, labels, or free-text query
- **added** — Pre-register MCP OAuth applications with mcp scope directly from the Admin area to avoid Dynamic Client Registration rate limits
- **added** — Ability to see which user authorized each MCP OAuth application

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab 19.3 release notes
On August 20, 2026, GitLab 19.3 was released with the following features.
We are excited to recognize gkepas as this month’s Notable Contributor!
Giannis has made sustained contributions across the GitLab codebase, the contributor platform, client-go, the Terraform provider, and GitLab Orbit. He is also an active translator and a member of the GitLab Community Discord.
##### Primary features
###### Flow Creator foundational agent
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
You can now use the Flow Creator, a purpose-built foundational agent in the AI Catalog, to create custom flows for the GitLab Duo Agent Platform through a plain-language conversation. With the Flow Creator, you describe what you want the flow to do, and the agent produces a complete, runnable flow YAML you can register and use immediately. The agent can also help you debug existing flows and explain framework concepts.
##### Agentic Core
###### Resolve merge conflicts with GitLab Duo is generally available
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases.
Now you can ask GitLab Duo to resolve conflicts for you.
Start conflict resolution from the merge widget or the Resolve conflicts page. GitLab Duo analyzes the conflicts, edits the files and commits the resolution to the source branch, and then posts a summary comment on the merge request describing what changed.
###### Resolve review discussions with GitLab Duo is generally available
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
In previous versions of GitLab, to resolve a code review comment, you had to switch to your editor, implement the fix, commit and push the change, and then manually close the thread.
Now you can select Resolve with GitLab Duo and GitLab Duo will address the review discussion for you.
GitLab Duo reads the comment and the surrounding code, makes the requested change on the source branch, replies to the discussion with a summary of what changed, and then resolves the thread. If the change does not address the comment correctly, you or the reviewer can reopen the thread.
###### GitLab Duo CLI plugins and marketplaces (Experiment)
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
GitLab Duo CLI now supports plugins and plugin marketplaces as an experiment, introduced in GitLab Duo CLI 9.10.0. A plugin bundles Agent Skills, custom slash commands, and Model Context Protocol (MCP) servers into a single directory. A marketplace is a catalog of available plugins, hosted in a Git repository or a local directory.
GitLab Duo CLI automatically registers the official gitlab-duo-plugins marketplace the first time you use plugins.
The marketplace includes three skills for common GitLab workflows:
- mr-review: Reviews a merge request and posts comments.
- stack-changes: Splits a large local change into a stacked merge request chain.
- create-issue: Drafts a GitLab issue from a natural-language description.
To install one of the skills, run glab duo cli plugin install <plugin>@gitlab-duo-plugins or duo plugin install <plugin>@gitlab-duo-plugins, based on your setup.
For compatibility with the existing community plugin ecosystem, GitLab Duo CLI also reads .claude-plugin/marketplace.json files, so existing Claude Code plugin marketplaces work with GitLab Duo CLI without modification.
###### New GitLab Duo Agentic Chat UI in VS Code (Beta)
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- L

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/19/gitlab-19-3-released/]_

### 19.2 — GitLab 19.2 release notes

- Date: 2026-07-16
- Version: 19.2
- Original notes: https://docs.gitlab.com/releases/19/gitlab-19-2-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/19.2

On July 16, 2026, GitLab 19.2 was released with the following features. We are excited to recognize vivekshukl007 as this month’s Notable Contributor ! Vivek is a Senior Data Engineer at Emirates who…

- **added** — GitLab Duo CLI is now generally available, enabling terminal access to the GitLab Duo Agent Platform with interactive chat mode, headless mode for CI/CD, model selection, tool approvals, Model Context Protocol connections, and slash commands
- **added** — GitLab Duo custom flows are now generally available, providing AI-powered YAML-defined workflows that automate multi-step tasks with multi-agent orchestration, human-in-the-loop checkpoints, and native GitLab triggers
- **added** — Scheduled pipeline execution policies are now generally available, allowing security policies to define and enforce CI/CD schedules across projects with support for daily, weekly, or monthly cadences and time zone support
- **added** — Start foundational flows from Agentic Chat, enabling Developer Flow, Code Review Flow, and Fix CI/CD Pipeline Flow to be initiated directly from chat conversations
- **added** — Dependency scanning auto-remediation in Beta, providing automated dependency version bumps and Agentic Breaking Change Resolution to handle complex updates and pipeline failures
- **added** — Scala language support added to GitLab Orbit for improved code graph capabilities in Scala codebases

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab 19.2 release notes
On July 16, 2026, GitLab 19.2 was released with the following features.
We are excited to recognize vivekshukl007 as this month’s Notable Contributor!
Vivek is a Senior Data Engineer at Emirates who made a high-impact contribution to add Scala language support to GitLab Orbit. This change improves the code graph capabilities for developers who work in Scala codebases.
##### Primary features
###### GitLab Duo CLI is now generally available
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
GitLab Duo CLI brings the GitLab Duo Agent Platform directly to your terminal.
Use the CLI to ask complex questions about your codebase and to autonomously perform actions on your behalf. Unlike external tools, the CLI has context about your GitLab project, pipelines, and agent configurations.
Key features include:
- Two modes: interactive chat mode and headless mode for CI/CD
- Administrator on/off control for GitLab Self-Managed and GitLab Dedicated
- Model selection and shared sessions
- Tool approvals
- Model Context Protocol (MCP) connections
- Slash commands, including commands for context usage and context compaction
- Support for skills and AGENTS.md customization files
Install the GitLab Duo CLI through the GitLab CLI (glab) or as a standalone tool.
###### GitLab Duo custom flows are now generally available
- Tier: Free, Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
Custom flows are AI-powered workflows you create and configure to automate complex, multi-step tasks across your GitLab projects. They let teams define workflow steps, components, and triggers so repetitive development and operational work can run automatically in response to GitLab events. In the GitLab UI, flows run directly in GitLab CI/CD, helping teams automate common tasks without leaving GitLab.
Key features include:
- YAML-defined, reusable workflows for team-specific automation
- Multi-agent orchestration for complex, multi-step tasks
- User-defined human-in-the-loop (HITL) checkpoints for approval or feedback at sensitive steps
- Native GitLab triggers, including mentions, assignments, pipeline events, and merge request lifecycle events
- Flow creation and management from projects or the AI Catalog
- Public and private visibility controls
- Secure execution using service accounts and composite identity
- YAML validation to catch configuration issues before runtime
###### Scheduled pipeline execution policies are GA
- Tier: Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
Scheduled pipeline execution policies are now generally available. Define a schedule once in a security policy project and enforce it across every project in scope, without editing each project’s .gitlab-ci.yml. If requirements change, update the policy in one place instead of coordinating changes across many CI/CD configuration files.
Use scheduled policies to run compliance scripts, security scans, or other custom CI/CD jobs on a daily, weekly, or monthly cadence, independent of commit activity. This is useful for repositories without regular code changes, such as running dependency scans to detect newly discovered vulnerabilities. Each policy runs as a separate pipeline, with time zone support, time window distribution, and branch targeting.
###### Start foundational flows from Agentic Chat
- Tier: Free, Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
In previous versions of GitLab, you started foundational flows from specific UI actions, mentions, or assignments. Now you can start them from Agentic Chat in the GitLab UI as part of your conversation.
When your request matches a specialist workflow, Agen

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/19/gitlab-19-2-released/]_

### 19.1 — GitLab 19.1 release notes

- Date: 2026-06-18
- Version: 19.1
- Original notes: https://docs.gitlab.com/releases/19/gitlab-19-1-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/19.1

On June 18, 2026, GitLab 19.1 was released with the following features. We’d also like to announce this month’s Notable Contributor : Pishel65! We are excited to recognize Pishel65 , a Level 3 contrib…

- **added** — Secret false positive detection with GitLab Duo is now generally available, automatically analyzing critical and high severity secret detection vulnerabilities to determine if they are false positives
- **added** — Administrators can set GitLab Duo to be always on for all projects in an entire instance or top-level group, preventing group, subgroup, and project owners from turning it off
- **added** — Automatically assign Code Owners as reviewers to merge requests based on matching changed files
- **added** — Compliance framework templates in beta, including 19 predefined templates such as ISO 27001:2022, SOC 2, FedRAMP, NIST, CIS, and TISAX
- **changed** — Secret detection now scans every commit from the branch's divergence point with the default branch to the latest commit for improved coverage in feature branch pipelines
- **added** — Tool approval guardrails for GitLab Duo agents in beta

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab 19.1 release notes
On June 18, 2026, GitLab 19.1 was released with the following features.
We’d also like to announce this month’s Notable Contributor: Pishel65!
We are excited to recognize Pishel65, a Level 3 contributor with 19 merged MRs and 9 more open since joining in October 2025.
##### Primary features
###### Secret false positive detection with GitLab Duo
- Tier: Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government
- Links: Documentation · Related Issue
Secret false positive detection with the GitLab Duo Agent Platform is now generally available.
Security teams spend significant time investigating secret detection findings that are incorrectly flagged as actual secrets. These false positives create alert fatigue, erode trust in scan results, and divert attention from genuine security risks.
When a security scan runs, GitLab Duo automatically analyzes each critical and high severity secret detection vulnerability to determine if it is a false positive. The AI assessment appears in the vulnerability report, so you have immediate context for faster and more confident triage decisions.
Key features include:
- Automatic analysis: Runs after each security scan without manual trigger.
- Manual trigger: Trigger false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis.
- Focus on high-impact findings: Analyze only critical and high severity vulnerabilities to maximize signal-to-noise improvement.
- Contextual AI reasoning: Each assessment includes an explanation of why the finding is likely a true positive, based on code context and vulnerability characteristics.
- Confidence scoring: Each detection includes a confidence score to help teams prioritize review based on the model’s certainty.
- Seamless workflow integration: Results appear directly in the vulnerability report alongside existing severity, status, and remediation information.
We welcome your feedback in issue 592861.
###### Always on availability mode for GitLab Duo
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government
- Links: Documentation · Related Issue
Administrators can now set GitLab Duo to be always on for all projects in an entire instance or top-level group. When GitLab Duo is set to always on, group, subgroup, and project owners cannot turn off GitLab Duo, giving enterprises centralized AI governance for compliance and regulated environments.
This new setting is symmetrical to the existing always off setting, closing a gap where GitLab Duo could be locked off but could not be locked on. This new setting is especially valuable for organizations with autonomous divisions or subsidiaries that need to guarantee consistent AI tooling across the business.
To set GitLab Duo to be always on, go the instance or top-level group GitLab Duo settings and set GitLab Duo availability to Always on.
###### Automatically assign Code Owners as reviewers
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
Previously, you needed to select reviewers for each merge request manually, even when a CODEOWNERS file already defined who should review each file.
You can now configure a project to assign Code Owners as reviewers automatically. GitLab assigns every Code Owner that matches the changed files. This happens when a merge request is created in a ready state, or when a draft is marked ready. If you already assigned a reviewer, GitLab skips automatic assignment and keeps your choice.
To turn on automatic reviewer assignment, go to Settings > Merge requests > Automatic reviewer assignment and select Automatically assign all code owners as reviewers.
###### Compliance framework templates (beta)
- Tier: Ultimate
- Offering: GitLab.com, GitLab

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/19/gitlab-19-1-released/]_

### 19.0 — GitLab 19.0 release notes

- Date: 2026-05-21
- Version: 19.0
- Original notes: https://docs.gitlab.com/releases/19/gitlab-19-0-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/19.0-bf71bebc

On May 21, 2026, GitLab 19.0 was released with the following features. We’d also like to announce this month’s Notable Contributor : Norman Debald! We are excited to recognize Norman , a Level 3 contr…

- **added** — Add group-level custom review instructions for GitLab Duo that can be shared across a group and its subgroups
- **added** — Support configuring custom work item types in projects with options to create or rename types to User Story, Bug, or Maintenance
- **added** — Make GitLab Secrets Manager available in open beta for Premium and Ultimate customers
- **added** — Support multiple trigger methods for GitLab Duo Developer including assign to issue, select Generate MR, or @mention in discussion threads
- **added** — Enable GitLab Duo Developer to run tests and checks before committing when AGENTS.md and agent-config.yml are configured
- **added** — Make SBOM-based dependency scanner generally available with automatic dependency resolution for Maven, Gradle, and Python projects
- **added** — Add manifest scanning fallback for projects without lock or build files to identify direct dependencies
- **added** — Implement usage-based billing for GitLab Duo Core with Code Suggestions consuming GitLab Credits
- **changed** — Modify GitLab Duo Chat to be agentic and run on GitLab Duo Agent Platform for Core users
- **added** — Add ability to filter exact code search results by repository

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab 19.0 release notes
On May 21, 2026, GitLab 19.0 was released with the following features.
We’d also like to announce this month’s Notable Contributor: Norman Debald!
We are excited to recognize Norman, a Level 3 contributor with more than 40 merged improvements across GitLab since joining in May 2022.
##### Primary features
###### Group-level custom review instructions for GitLab Duo
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Add-ons: GitLab Duo Enterprise
- Links: Documentation · Related Issue
In previous versions of GitLab, you could only define custom review instructions for GitLab Duo at the project level. Teams working across many projects in the same group had to duplicate the same instructions in every project.
Now you can configure shared custom review instructions for an entire group and its subgroups.
Select a project in your group to use as a template. When GitLab Duo performs a code review, it combines the group-level .gitlab/duo/mr-review-instructions.yaml file with any instructions defined in the individual project.
Both Code Review Flow and GitLab Duo Code Review support group-level custom instructions.
###### Configure work item types
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
Previously, work item types could be either an Issue or a Task. You can now configure custom work item types in a project to match the way your team plans and tracks work.
You can create or rename types to User Story, Bug, or Maintenance. Each work item displays with its type name and a unique icon. The new types support custom fields and status lifecycles, and appear in your saved views and issue boards. Type configuration in the top-level group (GitLab.com) or organization (GitLab Self-Managed) cascades down to all projects.
You can also control which types are available for each project. Enable or disable a type across all projects at once, or let individual projects manage their own type visibility. When you disable a type in a project, existing work items are not affected.
###### GitLab Secrets Manager now available in open beta
- Tier: Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed
- Links: Documentation · Related Issue
In previous versions of GitLab, the GitLab Secrets Manager was available only to a closed beta cohort. Most teams relied on external services such as HashiCorp Vault or AWS Secrets Manager.
The GitLab Secrets Manager is now available in open beta for Premium and Ultimate customers on GitLab.com and GitLab Self-Managed. When the GitLab Secrets Manager is enabled, project and group Owners can store, retrieve, and reference CI/CD secrets in GitLab. Secrets are scoped to a project or group and are accessible to only pipeline jobs that explicitly request them.
During open beta, GitLab Secrets Manager follows the beta support policy and might not be ready for production use.
To share feedback, see issue 598100.
###### GitLab Duo Developer enhancements for merge request workflows
- Tier: Free, Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Documentation · Related Issue
GitLab Duo Developer now supports multiple trigger methods: assign it to an issue, select Generate MR, or @mention it in any issue or MR discussion thread to turn feedback, To-do items, and design questions into code changes, follow-up MRs, or research summaries.
With AGENTS.md and agent-config.yml configured, GitLab Duo Developer runs your tests and checks before committing. After a top-level group or instance administrator enables the Developer Flow, GitLab automatically adds mention and assign triggers to eligible projects.
###### Dependency scanning by using SBOM generally available
- Tier: Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Links: Docume

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/19/gitlab-19-0-released/]_