What's new

Epics and issues sharing a unified work item architecture, brought together in a single consolidated view. Enables organizations to eliminate context-switching between separate epic and issue pages, and teams to manage both work item types in one place with full relationship visibility, helping turn sprawling backlogs into focused action items.

CI/CD job metrics that surface performance trends and failure patterns across pipelines helping developers pinpoint inefficient jobs in order to address them before their teams are blocked. Platform teams get the observability needed to optimize CI/CD at scale — without external tools.

Dynamic Input Selection helps eliminate the Jenkins instances and custom web interfaces that organizations maintain solely because non-developers can't navigate YAML pipelines. Cascading dropdown menus enable product managers, QA engineers, and operations teams to trigger complex deployments intuitively, where each selection intelligently determines the next available options. Organizations can consolidate pipeline execution onto a single platform, reducing infrastructure costs and support overhead while expanding GitLab's user base across the entire delivery organization.

Zero-downtime garbage collection significantly reduces storage costs, maintenance windows, and manual interventions. Built on a modern database architecture with enhanced performance and advanced security features like protected repositories and immutable tags. Enables platform teams to reduce operational complexity while helping developers manage artifacts quickly, creating a registry foundation designed to evolve with enterprise container strategies.

Security workflows that quickly understand organizational context. Enables security teams to reduce triage time by focusing on relevant threats, while developers see only the issues that actually affect their specific environment, helping to improve both response time and job satisfaction.

SAST results that earn developer trust through accuracy. Helping organizations achieve higher remediation rates through improved precision, while developers reclaim hours spent on manual validation, focusing instead on building features.

Distinguishing real active tokens from expired or test tokens quickly, giving security teams a better way to prioritize active threats effectively, while developers avoid unnecessary work interruptions from false alarms, maintaining their flow state.

Security education that happens through reasonable guidance rather than hard blocks. Enabling organizations to improve long-term compliance through gradual adoption, while developers learn security requirements without workflow disruption.

Catching vulnerabilities where they originate, not where they merge. Making it easier for teams to prevent security debt accumulation in main branches, while developers fix issues in their own feature branch without impacting others.

Security visibility that highlights what's important. Executives gain real-time risk understanding without lengthy reports, while developers quickly see how their changes impact overall security posture.

Focusing only on exploitable vulnerabilities helps organizations significantly reduce remediation costs, while developers remediate exploitable vulnerabilities first without wasting time on unreachable code paths.

Extensive protection extending to custom and proprietary secrets supports organizations maintaining security across diverse technology stacks, while developers innovate freely, knowing that even unique internal tokens are protected.

Vulnerability management tailored to specific risk profiles, empowers security teams to create views aligned with organizational risk tolerance, while developers see only issues relevant to their components, balancing comprehensive oversight with focused action.

Robust security testing that fits within normal development cycles. Enabling organizations to maintain thorough security coverage without delaying releases, while developers receive complete feedback before moving to their next task.

Intelligent protection that distinguishes test files from production code. Mitigating the risk of real secrets reaching repositories, while developers maintain their natural development patterns without security friction.

A default role giving security professionals accelerated productivity with appropriate boundaries. Enables day-one productivity with extensive vulnerability access without code modification rights, maintaining separation of duties so security teams can investigate without accidentally breaking production. Organizations gain standardized permissions without custom configuration, reducing permission delays during incident response.

Automated safeguards for actively exploited vulnerabilities. Enabling organizations to align with government guidance automatically, while developers understand when extra scrutiny is warranted for critical risks.

Real-time monitoring and governance for all connected MCP servers from a single interface. Provides organizations with clear visibility into which servers are active and whether connections remain healthy, enabling early detection of performance issues before they disrupt developer workflows. Security teams ensure AI integrations align with organizational policies, while platform engineers rapidly troubleshoot integration failures without time-consuming investigation across disconnected systems.

Enterprise governance controls to unlock MCP adoption for regulated industries where visibility and compliance aren't optional. Financial services, healthcare, and government organizations gain instance-level controls giving admins complete authority over external AI access. Audit logging that delivers audit trails aligned to SOC2, ISO, and HIPAA requirements, while reliable authentication to help reduce daily OAuth failures that currently block consistent usage.

Organizations bring their own AI runtimes and connect external services within GitLab's agent platform, removing adoption blockers for enterprises with compliance and security constraints. Teams select their preferred AI providers — Claude Code, OpenAI, or proprietary models — as runtimes while connecting critical business tools like Jira, Figma, and Slack via MCP servers. Enables organizations to leverage existing tool investments and meet regulatory requirements while building on GitLab's agent infrastructure, positioning GitLab as the orchestration layer.

Cloning foundational agents as templates reduces custom agent deployment time while lowering expertise requirements for organizations. Teams inherit GitLab's proven patterns and baseline capabilities, then customize with company-specific knowledge and internal standards without building from scratch. Enables organizations to deploy AI agents tailored to their workflows, accelerating time-to-value and expanding the addressable market beyond teams with deep AI engineering expertise.

Enables understanding of how agents and AI-driven workflows are being adopted across teams. Provides engineering leaders clear insight through trend reports and engagement patterns that surface measurable impact. These insights help organizations understand what's working, replicate best practices, and improve the effectiveness of their AI investments.

Full control over AI models and data residency without the operational overhead of managing infrastructure. Organizations using GitLab Dedicated can benefit from self-hosted AI capabilities aligned with compliance requirements through single-tenant isolation and granular governance in a fully managed environment. Enables enterprises to maintain data sovereignty while avoiding infrastructure complexity.