June 2025 Summaries

Software supply chain attacks, particularly through malicious dependencies, pose a major threat to modern software development, exacerbated by the widespread use of open-source components. GitLab's Vulnerability Research team has developed a proactive detection system to identify such threats, using techniques like automated typosquatting detection, semantic code analysis, and AI-assisted screening to monitor new dependencies. The system recently identified a typosquatting attack on a MongoDB Go module, which mimicked the popular legitimate module by using a similar name with a subtle spelling variation. The malicious module contained multi-layered obfuscated code that established remote access upon execution. Despite its removal, the threat actor re-deployed a similar attack shortly after, demonstrating the persistence of these threats. GitLab's approach stresses proactive monitoring to minimize exposure, addressing the ecosystem's reactive nature, where malicious packages are often removed only after being discovered and reported.

GitLab has introduced Duo Model Selection, a feature in the GitLab 18.1 release available in private beta for GitLab.com customers using Duo Enterprise, which allows organizations to control the large language models (LLMs) used within their teams. This capability addresses the challenges enterprise organizations face with governance, compliance, and security standards amid the rapid release of new AI models. Duo Model Selection enables organizations to accelerate innovation by selecting AI models from their pre-approved vendor list, rather than the GitLab default model, ensuring adherence to governance standards. It allows namespace owners to configure AI model preferences organization-wide and control models used for different GitLab Duo features, enhancing both compliance and flexibility. Customers interested in participating in the private beta or exploring new features, including agentic AI capabilities in GitLab 18, are encouraged to contact their GitLab account team or sign up for a GitLab Duo trial.

GitLab's Exact Code Search, powered by the open-source search engine Zoekt, revolutionizes the way developers and teams interact with large codebases by offering three transformative capabilities: exact match searches to eliminate false positives, powerful regular expression support for complex pattern matching, and multi-line context for comprehensive understanding. This new feature, currently in beta, is designed to handle massive scales, indexing over 48 TB of code data and delivering results in milliseconds, thanks to its innovative use of positional trigrams and a distributed system architecture. Exact Code Search seamlessly integrates with GitLab’s permission system, ensuring secure and relevant search results, and is engineered for enterprise-level performance with automatic node registration, dynamic shard assignment, and intelligent load balancing. The implementation of this feature addresses traditional code search challenges, significantly enhancing productivity in debugging, code exploration, refactoring, and security auditing by providing precise, context-rich search results that save time and improve code quality.

Gitaly is a crucial server component within the GitLab ecosystem, responsible for managing all Git operations such as pushes and pulls, and directly accessing the disk where repositories are stored. Under heavy load, Gitaly can slow down processes like CI/CD pipelines and repository browsing, especially for large monorepos. The introduction of the Bundle URI feature alleviates this pressure by pre-downloading a bundled repository from object storage, reducing the load on Gitaly servers during clones. This feature, which can be manually or automatically configured, requires setting up a cloud storage bucket and enabling specific feature flags. Bundle URI enhances performance by allowing Git clients to download bundles from a cloud server and request only the missing objects from Gitaly, thus easing the server's workload. Additionally, it differs from the Pack-objects cache by storing bundles externally, leading to reduced network and I/O load. GitLab users can try out the Bundle URI feature by upgrading to version 18.1 or exploring GitLab Ultimate.

GitLab Duo Agent Platform is an innovative extension of the Duo Workflow that empowers software development teams to enhance productivity by collaborating with multiple AI agents across the development lifecycle. The platform allows developers to delegate various tasks, such as research, bug fixing, code review, and security investigations, to specialized AI agents, freeing them to focus on strategic and creative work. It supports many-to-many collaboration between engineers and AI agents, is highly customizable, and integrates seamlessly with existing developer tools via the standard model context protocol and agent-to-agent framework. GitLab Duo agents are designed to handle a wide range of engineering challenges, from issue implementation and automated documentation to vulnerability resolution and incident research. The platform emphasizes context-rich interactions, where agents have a comprehensive understanding of project components, thus aiding in code improvements and compliance suggestions. Trust is built through an agent approval workflow that allows developers to review and approve the actions of AI agents before they make changes. GitLab encourages community contributions to the platform, enabling the creation of specialized agents that address specific engineering needs, fostering a collaborative and innovative environment. GitLab Duo Agent Platform is currently in beta testing, with plans for broader availability and new features in future releases.

GitLab and IBM have collaborated to address the challenges faced by mainframe developers by introducing GitLab Ultimate for IBM Z, a certified DevSecOps solution designed specifically for the mainframe environment. This offering enables mainframe developers to utilize modern tools and workflows akin to those used by cloud-native teams, thereby facilitating a seamless migration from outdated systems and reducing operational costs. The integration provides native support for CI/CD pipelines on IBM z/OS, eliminating the need for complex workarounds and enhancing security and scalability. By bridging the gap between legacy systems and cloud-native innovation, GitLab Ultimate for IBM Z allows for unified development across mainframe, cloud, and on-premises infrastructures, promoting collaborative and efficient work environments. This solution also integrates with IBM Developer for z/OS Enterprise Edition, offering faster software releases and comprehensive debugging tools, which help streamline development processes and attract modern developers. As hybrid cloud strategies become more prevalent, this partnership aims to modernize mainframe development incrementally, allowing organizations to adopt new practices without disrupting existing operations.

Building a scalable and secure development platform starts with establishing robust fundamentals, notably role-based access control (RBAC). GitLab has created the RBAC Accelerator, a modular program designed to help organizations define and scale access policies effectively. This serves as a foundation for further advancements, such as integrating compliance and security best practices into workflows through the Secure SDLC Accelerator. A practical example is provided by Lely, a Dutch manufacturer, which successfully migrated to GitLab Dedicated by automating user provisioning and enforcing least-privilege policies. The guide offers a detailed walkthrough of implementing GitLab with Keycloak and OpenID Connect in a Docker environment, highlighting the creation of a scalable group hierarchy and aligning access controls with organizational goals. The setup is intended for proof-of-concept purposes and emphasizes the importance of understanding the access landscape before implementing tools. GitLab's comprehensive DevSecOps platform supports secure, scalable access management with features like native OIDC support, granular role enforcement, and SCIM-based user provisioning, offering a seamless integration with identity providers like Keycloak. This integration automates onboarding, maintains least-privilege access, and supports regulatory and security objectives, making it an ideal solution for enterprise-grade software development.

Git Version 2.50.0 introduces significant updates and performance improvements, contributed by the Git team at GitLab and the wider Git community. Among the highlights is the new git-diff-pairs(1) command, which efficiently handles large diff computations by processing filepair information in smaller batches, addressing scalability challenges. The git-update-ref(1) command now supports the --batch-updates option, permitting bulk reference updates even if some fail, enhancing efficiency. Additionally, the git-cat-file(1) command includes a --filter option, enabling more efficient object searches by type, which dramatically speeds up processing in large repositories. Improvements to git-bundle(1) significantly reduce backup times by replacing inefficient nested loops with a map data structure, and the bundle URI mechanism now copies all refs/*, not just refs/heads/*, reducing the amount of data needed for clones and fetches, which in turn lightens the load on both client and server. These enhancements mark a collaborative effort to streamline processes and improve the performance of Git operations.

GitLab Duo with Amazon Q introduces an innovative AI-driven approach to handling code review feedback, integrating GitLab's DevSecOps platform with Amazon Q's advanced AI capabilities. This system automates the process of implementing reviewer comments on code, significantly reducing the time developers spend on addressing feedback manually. By using a simple command, the AI assistant analyzes feedback and executes the necessary code changes directly, allowing developers to focus on more complex tasks and the development of new features. The modifications are documented in the "Changes" tab of a merge request, providing transparency and accuracy verification. This automation not only accelerates the code review cycle but also enhances consistency and efficiency in addressing feedback, ultimately shortening deployment times and enabling faster feature shipping.

Educational institutions are increasingly adopting modern software development practices to enhance their teaching, research, and administrative functions, with GitLab Premium playing a pivotal role in addressing their unique challenges. GitLab Premium, enhanced with Duo AI capabilities, offers robust solutions for open source development, security, and remote collaboration, crucial for managing complex projects and safeguarding sensitive data like student records and research findings. The platform's features, such as vulnerability scanning, advanced data protection, and cloud-based development environments, support multidisciplinary collaboration and adherence to research integrity standards, while its open-source foundation aligns with educational values of transparency and community contribution. Institutions benefit from GitLab's professional support, which is critical for maintaining essential academic systems, and its AI tools, including real-time code suggestions and instant chat support, which boost productivity and reduce errors. Deakin University exemplifies how GitLab fosters innovation and collaboration by standardizing processes and enabling a community of practice, illustrating the platform's profound impact on higher education environments.

Over the past year, GitLab has made significant strides in enhancing security across its platform, aligning with CISA's Secure by Design Pledge, which emphasizes embedding security into products from the development stage. Key initiatives include increasing the adoption of multi-factor authentication (MFA) by planning a phased rollout that will require all customers to enable MFA, reducing the reliance on default passwords by using randomly generated root passwords, and improving secure coding practices through comprehensive guidelines and expanded SAST rule coverage. GitLab has also worked on increasing the installation of security patches by offering detailed upgrade plans and maintaining a strong bug bounty program. Furthermore, GitLab has enhanced transparency in vulnerability reporting by including Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields in its records, and has bolstered incident response capabilities by publishing guides and open-sourcing detection frameworks. These efforts reflect GitLab's ongoing commitment to providing a secure and trusted DevSecOps platform, with plans to continue innovating in this area.

Embedded systems software has evolved from a mere part number to a critical differentiator, leading to increased complexity, especially in industries like automotive and aerospace, where the lines of code have exponentially grown. Traditional development methods can't keep pace with these changes, causing inefficiencies such as hardware testing bottlenecks, inconsistent build environments, siloed development, and manual compliance processes. To address these issues, the GitLab AI-native DevSecOps platform offers solutions that include automated hardware allocation, standardized build automation, collaborative engineering, and automated compliance workflows. These methods transform embedded development from isolated tasks into collaborative practices that enhance productivity and innovation while maintaining safety and compliance standards. By integrating continuous integration/continuous delivery (CI/CD) and collaborative tools, GitLab aims to streamline development processes, reduce delays, and support the creation of software-defined smart systems.

Repository backups are essential for disaster recovery, but as repositories grow, backup creation becomes challenging due to time constraints and resource demands. GitLab faced this issue with a Rails repository taking 48 hours to back up, traced to a Git function with O(N²) complexity. By implementing an algorithmic improvement using a map data structure, GitLab reduced the backup time to just 41 minutes, enhancing scalability and efficiency. This change not only lowers costs and risks but also allows for comprehensive and frequent backup strategies without compromising system performance. The fix, contributed upstream to Git, benefits all Git users, providing GitLab customers with immediate advantages in disaster recovery planning, including reduced recovery point objectives and operational overhead. This improvement, part of GitLab's commitment to scalable infrastructure, highlights the importance of collaborative development in enhancing performance across the Git community.

As organizations increasingly migrate to cloud environments and adopt DevSecOps processes, they face challenges like tool proliferation and legacy systems not suited for modern development, leading to operational complexity and high maintenance costs. To address these issues, comprehensive DevSecOps platforms such as GitLab offer a unified approach to software development, consolidating stages from code management to security within a single interface. This integration enhances efficiency, improves developer experiences, and streamlines communication by centralizing workflows and minimizing disruptions. GitLab's platform includes features like integrated Agile project management, end-to-end security capabilities, compliance frameworks, and AI-driven assistance, all designed to support regulatory compliance and optimize development processes. By providing built-in security integration and AI-powered automation, GitLab helps organizations ensure security, transparency, and efficiency across all development stages, catering particularly to the needs of regulated industries.

GitLab has been recognized as a Leader in The Forrester Wave™: DevOps Platforms, Q2 2025, due to its comprehensive DevSecOps platform that integrates security, speed, and simplicity, addressing the needs of enterprises seeking a unified solution. The platform's high scores in areas such as AI infusion, AI risk mitigation, and pipeline security underscore its strength in integrating cutting-edge AI capabilities while maintaining robust security measures. With the release of GitLab 18.0, users benefit from AI-native features, including test generation, code suggestions, and AI-native vulnerability resolution, enhancing the software development process. GitLab's focus on a seamless, integrated developer experience that covers the entire software development lifecycle is reflected in its strong day zero experience, developer tooling, and build automation and CI, reducing the complexity of managing multiple tools. This recognition is not only a testament to the efforts of GitLab's team and community but also to their commitment to advancing software development with innovative solutions.

Code reviews, essential for finding bugs and maintaining coding standards, can often slow down the development process due to scheduling conflicts and lengthy discussions. GitLab Duo with Amazon Q addresses this issue by offering an AI-powered solution that performs swift, comprehensive code reviews, allowing developers to focus on building software efficiently. By entering a simple command, developers can activate the AI to analyze code updates, identify potential problems, and provide actionable feedback on bug detection, readability, syntax, and adherence to standards. This tool streamlines the review process, reducing deployment times and increasing team productivity without compromising review quality. GitLab Duo with Amazon Q provides an always-available, highly skilled virtual reviewer that optimizes the workflow by ensuring consistent coding standards and faster shipping of features, ultimately allowing teams to concentrate on creative problem-solving.