お知らせ • Jul 17
GitLab Inc. Releases Gitlab 19.2 with Governed Agentic Automation and New Features
GitLab Inc. released GitLab 19.2. Dependency Scanning Auto-Remediation, now in public beta, shrinks the security backlog without diverting developers to upgrade vulnerable dependencies and fixing breaking changes in new code. Security Review Flow, now in public beta, catches security flaws like business-logic errors and race conditions that pattern-based scanners cannot see. GitLab Duo CLI, now generally available, gives developers access to agents and multi-step agentic flows for all software lifecycle tasks right where they work. Custom Flows, now generally available, let teams replace manual multi-step workflows with agentic automations for software development, triggered by GitLab events. Dependency Scanning Auto-Remediation, now in public beta, closes that gap. Security developers can now clear vulnerable dependencies without adding work for developers. When a scan finds a vulnerable package, GitLab opens a merge request with the suggested fix. If an upgrade breaks the build, agents iterate to fix the issue in the same merge request. New configuration controls let developers set the severity thresholds and version scope that remediation applies to. Every change stops at existing approval gates and leaves a full audit trail. Security Review Flow, now in public beta, is a foundational flow in GitLab Duo Agent Platform. It reasons about what the code is meant to do rather than matching known patterns, and detects broken object-level and function-level authorization, missing authorization on state-changing operations, information disclosure, mass assignment, business logic errors, and race conditions. Findings include severity and a suggested fix where available. The flow never approves on its own; a person always makes the final call. GitLab Duo CLI, now generally available across GitLab.com, Self-Managed, and Dedicated deployments, brings GitLab Duo Agent Platform's agents to the terminal with full project context. A developer can get oriented in unfamiliar code, diagnose a failed pipeline, or propose a fix without leaving the command line. Administrators control rollout across the organization. GitLab Duo Agent Platform's agentic flows are sequences that chain agents to complete multi-step work, and in 19.2, they advance on two fronts. Custom Flows, the flows teams build themselves, are now generally available. Build a flow once and it runs automatically on GitLab events. Custom Flows now authenticate to external services with short-lived, job-scoped tokens, so automation reaching cloud providers or internal APIs uses the same keyless pattern GitLab CI/CD pipelines already trust. The upcoming Flow Creation Agent can turn a natural-language description into a custom flow. GitLab's foundational flows, the ones GitLab ships ready to use, also get more capable. The Fix CI/CD Pipeline Flow, now improved, classifies failures before acting and delivers targeted fixes as inline suggestions or a new merge request. GitLab Duo Agentic Chat can now delegate multi-step work to agents. GitLab 19.2 adds the controls that make that safe at scale. The AI Audit Event Report, now in beta, records AI-assisted actions as dedicated audit events, so compliance and security teams can include AI workflows in audit reporting, access reviews, and incident investigation. Group-level custom instructions for GitLab Duo Code Review let administrators set review behavior across projects at once, and new MCP access controls govern which agents can run and what they can reach.