August 2025 Summaries

GitLab 18.3 introduces fine-grained permissions for CI/CD job tokens, enhancing software supply chain security by adhering to the principle of least privilege. Previously, job tokens inherited permissions from user accounts, posing security risks if compromised. This update allows maintainers to control job token access to specific API resources like Repositories, Deployments, and more, without any default permissions. The feature supports secure automation at scale, reduces reliance on long-lived tokens, and prepares for machine-based identity, thereby reducing the attack surface. Security teams and DevOps engineers are encouraged to gradually adopt this opt-in feature by auditing current permission requirements and configuring minimal access for critical projects, ensuring secure deployment workflows without disruption.

GitLab has introduced granular permissions for the Admin area in its Self-Managed and Dedicated instances, allowing organizations to implement custom admin roles that adhere to the principle of least privilege while maintaining operational efficiency. These custom admin roles provide fine-grained control over access to administrative functions, enabling organizations to create specific roles tailored to their needs, such as platform management, user support, and leadership oversight. This feature is part of GitLab's broader mission to enhance software supply chain security and is bolstered by support for LDAP integration, audit event tracking, and existing Admin modes. This update complements GitLab's earlier additions of custom roles for projects and groups, as well as granular permissions for CI/CD job tokens, with plans for additional permissions in future releases.

GitLab is evolving into an AI-native DevSecOps platform, emphasizing human and AI collaboration throughout the software lifecycle. The platform's transformation involves three key layers: a unified data platform, a software control plane, and an enhanced user experience. GitLab 18.3 introduces features such as expanded AI integrations, the Knowledge Graph for improved context-aware AI, and enhanced orchestration capabilities, enabling seamless collaboration between human developers and AI agents. The update provides tools for governance, compliance, and artifact management, ensuring security and continuity across software development workflows. Additionally, GitLab 18.3 enhances real-time visibility with embedded views, allowing users to access live project data directly within their workflows without context switching. The platform's extensibility and interoperability with external AI tools further position GitLab as a leader in integrating AI capabilities into development processes, offering users a more efficient and cohesive software engineering experience.

GitLab's embedded views, powered by the GitLab Query Language (GLQL), offer a streamlined way for teams to access real-time, relevant information within their workflow, eliminating the need for constant context switching and outdated reports. Released in version 18.3, these views enable users to insert live GLQL queries in Markdown code blocks across various parts of GitLab, such as wiki pages, epics, issues, and merge requests. The dynamic nature of these queries ensures that data is always up-to-date, with functions like currentUser() and today() providing context-specific information. Users can filter data by numerous fields and customize the display in formats like tables or lists. Embedded views are available across all GitLab tiers, although certain advanced functionalities are reserved for Premium and Ultimate users. This feature is already integral to GitLab's internal processes, aiding in tasks such as tracking merge requests and managing team onboarding, and it promises to enhance work tracking and collaboration for other teams as well.

GitLab's documentation site has undergone a comprehensive redesign, enhancing both its aesthetics and functionality. Key improvements include the much-anticipated addition of a dark mode for better readability and reduced eye strain, as well as brand alignment with GitLab's overall design language. The feedback process has been simplified, allowing users to give immediate feedback directly on documentation pages. Navigation has been revamped to reduce the overwhelming nature of accessing over 2,300 pages, with a more intuitive top navigation system. Additionally, numerous technical debt issues, such as typography and spacing inconsistencies, have been addressed to provide a more polished user experience. These changes were made possible by a critical replatforming project from Nanoc to Hugo, which improved performance significantly. The redesign reflects GitLab's iterative approach, with a focus on future enhancements guided by user feedback.

Git 2.51.0 introduces several enhancements and changes, notably improving the performance of git-push and git-fetch commands by implementing batched updates, which significantly optimizes the "reftable" backend over the traditional "files" backend. This update also marks progress towards Git 3.0, with "reftable" set as the default backend for newly created repositories and SHA-256 becoming the default hash function, replacing the less secure SHA-1. Additionally, git switch and git restore commands are now stable, moving away from their experimental status, and git for-each-ref has received pagination support to handle large repositories more efficiently. The release also includes the planned removal of the deprecated git-whatchanged command in favor of git log --raw, highlighting ongoing efforts to modernize and secure the Git ecosystem.

Within the complex and high-stakes environment of financial institutions, the shared infrastructure used in software-as-a-service (SaaS) platforms poses significant systemic risks, particularly through concentration risk and regulatory challenges. These risks are highlighted by the dependency on third-party providers, which can lead to industry-wide disruptions if a major provider is compromised. GitLab addresses these concerns with GitLab Dedicated, offering a solution that combines cloud-scale efficiency with enterprise-grade security by providing isolated infrastructure for development workflows, source code repositories, and CI/CD pipelines. This setup ensures full control over data sovereignty, compliance, and security, allowing financial institutions to manage encryption keys, choose data residency locations, and meet stringent regulatory requirements. The approach reduces operational overhead while maintaining high availability and performance, as evidenced by NatWest Group's adoption of GitLab Dedicated to enhance engineering capabilities. Ultimately, GitLab proposes that treating source code as a strategic asset in its own dedicated environment can mitigate the risks associated with shared infrastructure, aligning development practices with the critical nature of financial operations.

The deep-dive article explores transforming GitLab Duo into a tailored coding expert by creating custom rules to enforce development standards, minimizing the need for constant corrections of AI suggestions. It addresses various aspects such as version control, style enforcement, and DevSecOps automation, providing practical examples including maintaining Java 8 compliance, enforcing Python 3 environments, and adhering to VueJS design patterns. The guide emphasizes how to set up intelligent rules for managing specific version requirements, multi-platform support, and development environments, alongside promoting adherence to design patterns and DevSecOps workflows. It offers hands-on demonstrations with GitLab projects for forking and customization, demonstrating the use of markdown for structuring rules and integrating them into the GitLab Duo Agentic Chat. The document encourages user engagement to refine and iterate custom rules, highlighting the significance of feedback and adaptation based on team experiences, and provides insights into managing changes to custom rules with GitLab's collaborative features.

In May 2025, GitLab introduced GitLab Duo Agentic Chat, an experimental feature designed to enhance the AI chat capabilities of GitLab Duo Chat by enabling direct interactions with the GitLab API on users' behalf. Available to users with the Duo Pro or Enterprise add-on, this feature is accessible within various IDEs and the GitLab UI, helping streamline workflows by maintaining context and offering assistance across different projects and pages. Agentic Chat simplifies issue management by providing high-level summaries, detailed insights, and allowing users to take actions like adding labels or updating milestones through conversational prompts. It also supports CI/CD processes by analyzing failed pipelines, suggesting fixes, and adding them to merge requests, which facilitates debugging and enhances productivity. Moreover, Agentic Chat assists users in crafting more effective prompts for identifying and triaging bug reports, ensuring comprehensive coverage of potential issues. By using action-oriented language, users can instruct Agentic Chat to perform specific tasks, making it a powerful tool for refining and acting on project information iteratively. GitLab encourages users to explore Agentic Chat's capabilities through a free trial of GitLab Ultimate with Duo Enterprise, detailed further in their documentation.

GitLab Duo Self-Hosted is an AI-powered solution designed to enhance software development while ensuring data control and security, suitable for organizations with stringent data sovereignty demands. It enables the deployment of GitLab's AI capabilities within an organization's infrastructure, whether on-premises, in a private cloud, or a secure environment, allowing complete data privacy and control. The solution offers model flexibility, compliance adherence, customization, and deployment flexibility, utilizing models hosted on AWS Bedrock with potential alternatives for on-premises or other cloud providers. The architecture includes a self-managed GitLab instance, an AI Gateway for request routing, and an LLM backend, which can be AWS Bedrock or another platform. Implementation involves installing the AI Gateway, configuring GitLab to access it, accessing models from AWS Bedrock, configuring a self-hosted model, and assigning it to GitLab Duo features. The setup is verified through health checks, feature testing, and AI Gateway log reviews, ensuring the system meets security and compliance requirements while leveraging AI's advanced capabilities.

GitLab's Vulnerability Research team uncovered a cryptocurrency theft campaign targeting the Bittensor ecosystem by using typosquatted Python packages on PyPI to execute a sophisticated heist. The attack involved creating malicious versions of legitimate Bittensor packages that hijacked the staking functionality to divert cryptocurrency from unsuspecting users' wallets to the attackers' address. This exploit capitalized on the routine nature of staking operations, which require users to unlock their wallets and thus provided an opportunity for the malicious code to operate undetected. The funds were funneled through a multi-hop laundering network before reaching a final cash-out endpoint. The attackers used a typosquatting strategy by slightly altering the package names and versions to increase the likelihood of installation through developer errors. GitLab's proactive detection and swift response highlight the importance of comprehensive security measures to safeguard software supply chains and prevent future attacks.

GitLab's Duo Accelerator program offers a comprehensive analytics solution designed to help organizations measure and maximize their AI investments, focusing on GitLab Duo Enterprise. The GitLab Duo Analytics solution is an enablement tool that transforms raw usage data into actionable insights and ROI calculations, assisting organizations in understanding adoption patterns and optimizing AI license allocation. By leveraging a hybrid analytics approach that combines monthly data collection with real-time API integration, organizations can measure AI productivity gains and license utilization at an enterprise scale. The solution includes open-source tools that integrate with GitLab CI/CD pipelines, enabling automated data collection, metric aggregation, and dashboard updates. This approach supports strategic decision-making and resource optimization, providing a scalable foundation for data-driven AI adoption. GitLab's commitment to API-first design and its comprehensive DevSecOps platform further enhance the ability to centralize AI measurement across development processes, aligning with organizational metrics and reporting requirements. The Duo Accelerator program exemplifies the power of customer success partnerships in delivering immediate value and establishing long-term strategic advantages for AI-powered development.

The AI in Action Hackathon, held from May 6 to June 17, 2025, exemplified the transformative potential of artificial intelligence in software development, with participants competing for a $50,000 prize pool while leveraging tools from Google Cloud, MongoDB, and GitLab. This event fostered collaborative innovation by integrating Google Cloud's AI and cloud resources, MongoDB's data platform, and GitLab's DevSecOps capabilities to create AI-enabled applications. Notable projects like Pipeline Doctor, Agentic CICD, and Agent Anansi showcased significant advancements in CI/CD pipeline health monitoring, automated DevSecOps, and enhanced GitLab workflows, respectively, demonstrating AI's ability to improve productivity, security, and operational efficiency. The hackathon also highlighted the importance of strategic partnerships and community contributions in accelerating the development of AI-driven solutions, with GitLab's Duo Agent Platform playing a pivotal role in enabling developers to customize and integrate AI agents into their workflows. As the software development landscape increasingly embraces AI, this initiative underlined GitLab's commitment to fostering a more efficient and secure digital future through continuous innovation and community engagement.