GitLab 19.3

Help us learn about your current experience with the documentation. Take the survey.

On August 20, 2026, GitLab 19.3 was released with the following features. We are excited to recognize gkepas as this month’s Notable Contributor! Giannis has made sustained contributions across the GitLab codebase, the contributor platform, client-go, the Terraform provider, and GitLab Orbit. He is also an active translator and a member of the GitLab Community Discord.

Primary features

Flow Creator foundational agent

• Tier: Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue You can now use the Flow Creator, a purpose-built foundational agent in the AI Catalog, to create custom flows for the GitLab Duo Agent Platform through a plain-language conversation. With the Flow Creator, you describe what you want the flow to do, and the agent produces a complete, runnable flow YAML you can register and use immediately. The agent can also help you debug existing flows and explain framework concepts.

Agentic Core

Resolve merge conflicts with GitLab Duo is generally available

• Tier: Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue In previous versions of GitLab, you had to resolve merge conflicts manually in the GitLab UI or from the command line, even for straightforward cases. Now you can ask GitLab Duo to resolve conflicts for you. Start conflict resolution from the merge widget or the Resolve conflicts page. GitLab Duo analyzes the conflicts, edits the files and commits the resolution to the source branch, and then posts a summary comment on the merge request describing what changed.

Resolve review discussions with GitLab Duo is generally available

• Tier: Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue In previous versions of GitLab, to resolve a code review comment, you had to switch to your editor, implement the fix, commit and push the change, and then manually close the thread. Now you can select Resolve with GitLab Duo and GitLab Duo will address the review discussion for you. GitLab Duo reads the comment and the surrounding code, makes the requested change on the source branch, replies to the discussion with a summary of what changed, and then resolves the thread. If the change does not address the comment correctly, you or the reviewer can reopen the thread.

GitLab Duo CLI plugins and marketplaces (Experiment)

• Tier: Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue GitLab Duo CLI now supports plugins and plugin marketplaces as an experiment, introduced in GitLab Duo CLI 9.10.0. A plugin bundles Agent Skills, custom slash commands, and Model Context Protocol (MCP) servers into a single directory. A marketplace is a catalog of available plugins, hosted in a Git repository or a local directory. GitLab Duo CLI automatically registers the official gitlab-duo-plugins marketplace the first time you use plugins. The marketplace includes three skills for common GitLab workflows:
• mr-review: Reviews a merge request and posts comments.
• stack-changes: Splits a large local change into a stacked merge request chain.
• create-issue: Drafts a GitLab issue from a natural-language description. To install one of the skills, run glab duo cli plugin install @gitlab-duo-plugins or duo plugin install @gitlab-duo-plugins, based on your setup. For compatibility with the existing community plugin ecosystem, GitLab Duo CLI also reads .claude-plugin/marketplace.json files, so existing Claude Code plugin marketplaces work with GitLab Duo CLI without modification.

New GitLab Duo Agentic Chat UI in VS Code (Beta)

• Tier: Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue The GitLab Duo Agentic Chat interface in the GitLab for VS Code extension has a redesigned UI, now available as a beta. The new interface is a rebuilt version of the existing Agentic Chat panel, with the same underlying capabilities: AI models, agents, slash commands, and tool approvals. The redesigned UI is available in GitLab 19.3 with GitLab for VS Code extension 6.87.0 and later. To use the new UI, turn on beta and experimental features for your top-level group or instance, then reload the extension. You can switch between the new and classic UI at any time from the panel. The beta is available for VS Code only.

New MCP tools for reading and searching merge requests

• Tier: Free, Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government
• Links: Documentation · Related Issue You can now use get_merge_request to retrieve a merge request along with its diffs, commits, notes, pipelines, or discussions in a single call, so your AI agent no longer has to chain multiple requests to get the full picture of an MR. You can also use the new list_merge_requests tool to search and filter merge requests by author, assignee, reviewer, state, labels, or free-text query, making it easy to find exactly the MRs you care about without leaving your workflow.

Pre-register MCP OAuth applications

• Tier: Free, Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue Previously, the mcp scope was hidden from the OAuth applications form in the Admin area, so you couldn’t pre-register an OAuth application for your MCP clients without using Dynamic Client Registration (DCR). Now you can create a shared OAuth application with the mcp scope directly from the Admin area, giving your users a stable client ID to reuse and helping you avoid DCR rate limits on shared networks.

See which user authorized each MCP OAuth application

• Tier: Free, Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government
• Links: Documentation · Related Issue Previously, when MCP clients connected to GitLab using OAuth Dynamic Client Registration (DCR), all dynamically-registered OAuth applications appeared in the Admin Area with only a generic client name, making it impossible to tell which user authorized a given application. Now, when you approve an MCP OAuth connection, your username is automatically appended to the application name — for example, [Unverified Dynamic Application] kiro — authorized by @username. You can quickly identify which user is behind each dynamic OAuth application directly from the Admin Area, without any additional configuration.

View agent task plan in session detail sidebar

• Tier: Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue Previously, when you opened a session detail page, you had to manually expand individual activity log entries to find the agent’s current task list. Now, the session detail sidebar shows the agent’s latest plan automatically. You can view each task and its status, and a progress summary like “2 of 5 completed.” You can track what the agent is working on and how far along it is without digging through the activity log.

Devstral 2 deprecated for GitLab Duo Agent Platform Self-Hosted

• Tier: Premium, Ultimate
• Offering: GitLab Self-Managed
• Links: Documentation · Related Issue Mistral has deprecated the Devstral 2 model, and GitLab has deprecated Devstral 2 for GitLab Duo Agent Platform Self-Hosted. Mistral Medium 3.5 is a supported alternative available from Mistral.

Support for Amazon Bedrock Mantle (Beta)

• Tier: Premium, Ultimate
• Offering: GitLab Self-Managed
• Links: Documentation · Related Issue If you use GitLab Self-Managed with self-hosted models, you can now use Amazon Bedrock Mantle as a supported provider. Mantle is an OpenAI-compatible inference engine for Amazon Bedrock, so you can use familiar OpenAI SDKs and integrations with Bedrock models. This feature is in beta.

Unified DevOps and Security

Enforce merge trains

• Tier: Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government
• Links: Documentation · Related Issue In previous versions of GitLab, you couldn’t stop merges from bypassing the train. Both the option to merge immediately and the REST API could skip merge train protections without restriction. For teams running high-velocity monorepos, a single merge that skips the train can cancel and restart every in-progress pipeline, multiplying CI costs and straining infrastructure. Now you can enforce merge train usage across the UI and API with a single project-level setting, preventing bypasses that cancel and restart in-progress pipelines. Owners and Administrators can still override the setting when needed.

GitLab Secret Scanning for Source Code (Beta)

• Tier: Ultimate
• Offering: GitLab.com, GitLab Self-Managed
• Links: Documentation · Related Issue GitLab Secret Scanning for Source Code is now in beta, powered by a new GitLab-built scan engine. Unlike the default analyzer, which detects only known secret patterns, this analyzer also detects passwords and other unstructured secrets that fall outside standard ruleset coverage. It also uses multiple heuristic techniques to reduce false positives. The new analyzer replaces the default analyzer in the same secret_detection job, matching existing vulnerability findings instead of creating duplicates. To get started, see turn on the analyzer. During beta, only high-confidence findings are reported. We welcome any feedback you have in issue 609578.

Secret detection scans commit history on default branch pushes

• Tier: Free, Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government
• Links: Documentation · Related Issue Secret detection on the default branch now scans all commit diffs in a push when a prior commit reference is available, rather than scanning only the latest directory contents. This change closes a gap where secrets introduced and removed within the same push went undetected. The behavior now aligns with how secret detection works on merge requests and feature branches. This scanning catches secrets that briefly existed in your repository history even if removed before the pipeline completes. Security teams can now identify secrets that were ever committed, not just those present at HEAD. For more information, see pipeline secret detection coverage.

Disable OAuth Dynamic Client Registration for MCP

• Tier: Free, Premium, Ultimate
• Offering: GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue Previously, MCP clients and AI tools could automatically register OAuth applications on your instance through Dynamic Client Registration (DCR), which you couldn’t turn off. This made it difficult for administrators on GitLab Self-Managed and GitLab Dedicated instances to control which OAuth clients could connect. Now you can disable DCR entirely using the application settings API, giving you full control over which OAuth clients can access your instance. When DCR is disabled, clients must use a pre-registered OAuth application instead of registering automatically.

SPDX license expressions in CycloneDX SBOMs brought to GitLab

• Tier: Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
• Links: Documentation · Related Issue GitLab 19.3 adds support for Software Package Data Exchange (SPDX) license expressions in CycloneDX Software Bill of Materials (SBOM) files you bring to GitLab. Previously, components with composite or custom licenses defined using SPDX expression syntax would appear as unknown. …