GitLab has released version 19.2 of its DevSecOps platform, adding agentic automation aimed at the security and review work that has piled up as AI coding tools generate more code than developers can check by hand. The release, announced on 16 July 2026, brings four features out of beta or into public beta: Dependency Scanning Auto-Remediation, Security Review Flow, GitLab Duo CLI and Custom Flows.
The company frames the release as a response to what it has previously called the AI paradox, the idea that AI-assisted coding creates a faster stream of changes than security and review processes can absorb. In the announcement, Manav Khurana, GitLab's chief product and marketing officer, set out the thinking behind the release.
Coding agents made it possible to generate far more code and moved the bottleneck downstream to reviews and security.
Manav Khurana, GitLab
Dependency Scanning Auto-Remediation, now in public beta, opens a merge request when a scan finds a vulnerable dependency and proposes the safe version. If the update breaks the build, an agent iterates on the same merge request until the pipeline passes, a capability GitLab calls Agentic Breaking Change Resolution. According to the GitLab 19.2 release notes, a study of the Maven ecosystem found vulnerabilities reaching roughly 63 percent of latest releases through transitive dependencies that teams never chose directly, and roughly one in eight dependency updates introduces a breaking change of its own.
A GitLab developer advocate, Fernando Diaz, walked through the feature in a companion video demonstration. Diaz showed the setup running end to end on a sample project: dependency scanning flagged several vulnerable packages, five merge requests appeared automatically, and one that failed its pipeline was resolved by selecting a "resolve breaking changes with Duo" button on the merge request. He noted that a maintainer still has to review and approve every change before it merges, so the automation removes the manual patching work without removing the checkpoint.
Security Review Flow, also in public beta, looks for the kind of logic flaws that pattern-matching scanners tend to miss, including broken authorisation checks, mass assignment and race conditions. A team assigns a Duo Security Review service account as a reviewer, and the flow posts findings as threaded comments with a severity rating and, where possible, a suggested fix. GitLab is explicit that the flow never approves a merge request on its own; a person still makes the final call.
GitLab Duo CLI reached general availability in this release, bringing agents into the terminal with awareness of the project, its pipelines and its existing agent configuration. Custom Flows also reached general availability, letting teams build their own automations in YAML and trigger them from GitLab events rather than waiting for GitLab to ship a built-in flow. Developer advocate Daniel Helfand demonstrated this in a separate video, building a flow that answers open questions on a newly created work item and reports back with a confidence score for each answer, leaving anything unresolved for a human reviewer to pick up.
GitLab 19.2 puts agents to work on that bottleneck: fixing vulnerable dependencies, catching the flaws scanners miss, and automating the steps in between with a person still approving what ships.
Manav Khurana, GitLab
Alongside the new features, GitLab has added an AI Audit Event Report in beta, which records agent activity as dedicated audit events for compliance and incident review, and new MCP access controls that govern which agents can run and what systems they can reach. GitLab also cites a Forrester Consulting study it commissioned, which found that organisations using the Duo Agent Platform achieved a 400 percent return on investment with payback in under six months, according to the announcement.
InfoQ has covered GitLab's AI releases in the recent past; the Duo Agent Platform reached general availability in GitLab 18.8 in January 2026, after launching in public beta in August 2025. In GitLab 19.0, agentic AI moved into secrets management and merge request workflows, and GitLab 18.10 and 18.11 introduced flat rate pricing for automated code reviews. Version 19.2 extends that same trajectory further into security remediation.
Not everyone in the community is convinced that agentic tooling is worth the switch yet. Writing on Reddit, one user in the r/gitlab community compared Duo unfavourably to Claude Code, saying Duo "is legit" for its integration but that "the UI of Claude Code is better." Another user in a separate thread said their team planned to keep using agentic mode because it "seems to be getting much more reliable and faster", while flagging concern about the cost of scaling it across a team.
Industry commentator Alan Shimel raised a broader question about GitLab's direction in a LinkedIn post, referencing the company's "Act 2" shift toward agentic AI and asking whether GitLab can move to an AI native future "without losing the cultural infrastructure that made it special in the first place." That question of how much governance and transparency survives the shift to autonomous agents sits close to the centre of what GitLab is trying to demonstrate with the audit and approval controls built into 19.2.
GitLab 19.2 is available now.
0 Comments
Log in to join the conversation.No comments yet. Be the first to share your thoughts.