November 2025 Summaries

GitLab's Vulnerability Research team has discovered a significant supply chain attack involving a variant of the Shai-Hulud malware spreading through the npm ecosystem, characterized by its worm-like propagation and a "dead man's switch" mechanism that threatens data destruction if its dissemination is disrupted. This sophisticated malware infiltrates through npm packages, harvesting credentials from platforms like GitHub, AWS, and Azure, and exfiltrates data to attacker-controlled repositories while automatically infecting other packages maintained by compromised developers. The malware employs a multi-stage loading process with an innocuous-looking setup script and heavily obfuscated malicious payloads, making detection challenging. Critically, if the malware's access to GitHub or npm is simultaneously severed, it triggers destructive actions on compromised systems, posing a massive risk if taken down en masse. GitLab has not been affected by this attack and is sharing its findings to aid the broader security community, recommending the use of its built-in security tools like Dependency Scanning to detect and mitigate such threats, while emphasizing the ongoing investigation to fully understand and counteract this evolving threat.

GitLab's Partner Program has cultivated a thriving ecosystem of DevSecOps professionals focused on advancing customer software development and achieving significant outcomes, with notable success from partners in Europe, the Middle East, and Africa (EMEA). A recent event celebrated these partners' achievements, strengthened their capabilities, and laid out future initiatives, honoring several for their outstanding contributions. The 2025 GitLab Partner Award Winners from the EMEA region were recognized in five categories, including Regional Partner of the Year Awards, which highlighted partners like cc cloud GmbH, Adaptavist, knowmad mood, Digital Future, and Cloudfresh for their exceptional performance and strategic collaboration. Additionally, D|OPS Digital was acknowledged for delivering the most innovative technical solution, Devoteam for having the most GitLab-certified professionals, Conoa as Rookie of the Year for early success, and Gantek for excelling in acquiring new customers and consistently winning new business.

GitLab 18.6 introduces enhancements aimed at integrating AI more deeply into software development workflows, offering teams greater choice, control, and adaptability across the software lifecycle. The update includes the introduction of GitLab Duo Planner and Security Analyst agents, which aid in planning, issue refinement, and security analysis, and are now available by default without setup requirements. The release also supports the deployment of the gpt-oss-120b model for self-hosted customers, providing a high-performance open-source alternative to proprietary models. New features allow self-managed instances to operate with a modern interface and extend AI functionalities into secure environments, including air-gapped deployments. The update bolsters platform security by enabling the application of custom context labels for risk-based insights, thus prioritizing remediation efforts. GitLab 18.6, currently in beta, is accessible to Premium and Ultimate users, with plans for a paid add-on option upon general availability. Regular upgrades are encouraged to benefit from the latest features and security updates, with GitLab's Managed Maintenance service offering a hands-off approach to maintaining self-managed instances.

Starting a new job at GitLab can be both exciting and overwhelming, especially due to the extensive onboarding process that involves numerous documents, videos, and training sessions. The author, who recently joined GitLab as a fullstack engineer, found the AI tool GitLab Duo to be invaluable in navigating this process by assisting in exploration, reviewing, and debugging tasks. GitLab Duo simplifies searching through GitLab's extensive documentation by allowing natural language queries, helps identify edge cases and dependencies before starting work on issues, and offers guidance in reviewing and debugging code efficiently. This tool aligns with GitLab's core values by enhancing collaboration, improving outcomes for customers, and increasing efficiency, while also supporting diversity and inclusion. However, the author remains cautious about over-relying on AI, ensuring that its outputs are validated to avoid automation bias and maintaining personal competence and understanding by using AI as a discussion partner. Overall, GitLab Duo significantly eased the onboarding experience by providing insights into GitLab's codebase, culture, and best practices.

Git 2.52 introduces several enhancements, returning to the standard 12-week cycle after a shorter 8-week period for version 2.51. Notable updates include the introduction of the git-last-modified(1) command, which efficiently retrieves the last commit for files in a single command, reducing operational load. Enhancements to git-fast-export(1) and git-fast-import(1) now support cryptographic signature handling, crucial for interoperability and history rewriting tools. The release also improves repository maintenance with a new "geometric" strategy in git-maintenance(1), optimizing object repacking for large monorepos. Additionally, a new "structure" subcommand in git-repo(1) provides insights into repository metrics, and contributions from the Google Summer of Code focused on reducing global variables, introducing a machine-readable repository info tool, and consolidating reference-related functionality. These updates aim to enhance Git's performance, customizability, and usability across various environments.

The U.S. Department of Defense's release of the Cybersecurity Maturity Model Certification (CMMC) Final Rule and new guidance on "FedRAMP equivalency" has significantly increased compliance costs for Defense Industrial Base (DIB) companies, requiring them to adhere to stringent security controls and undergo audits by Third-Party Assessment Organizations. These changes have complicated risk management for companies focused on supporting defense efforts. However, GitLab Dedicated for Government offers a solution by providing FedRAMP Moderate Authorization, allowing DIB companies to use the platform without additional audits, thus reducing compliance impact and cost. The Defense Federal Acquisition Regulation Supplement requires that any external cloud service provider used by a contractor must meet FedRAMP Moderate security requirements, and GitLab's platform meets these needs. Despite the reduced burden from FedRAMP authorization, DIB contractors still have responsibilities under a Shared Responsibility Matrix, which outlines which security controls are managed by GitLab and which are the contractor's responsibility, aiding in meeting CMMC Level 2 compliance while focusing on their core mission.

Deploying AI agents to Google Kubernetes Engine (GKE) using GitLab's native Google Cloud integration offers a seamless, secure, and efficient solution for production environments. The integration leverages GitLab's CI/CD pipelines with OIDC authentication, allowing development teams full control over cloud infrastructure while maintaining visibility and compliance. The process involves using Google's Agent Development Kit to build the application, with the infrastructure control, native integration, and production-grade scaling as key advantages. The deployment requires enabling certain Google Cloud APIs and setting up IAM and permissions in GitLab, followed by configuring Artifact Registry integration. A CI/CD pipeline with stages for building, testing, uploading, and deploying the AI agent is then created, ensuring a streamlined and reliable deployment process. The tutorial emphasizes the ease and security of deploying AI agents to GKE through GitLab, highlighting the enterprise reliability and enhanced developer experience provided by this integration.

GitLab is urging users to transition from using pipeline variables to pipeline inputs for enhanced security and better governance in CI/CD processes. Pipeline variables, which allow runtime customization of GitLab CI/CD pipelines, pose security risks due to their lack of validation and type checking. They also lack proper documentation, making maintenance and governance challenging. In contrast, pipeline inputs offer explicit declaration, type safety, automatic validation, and improved security by mitigating the risk of variable injection attacks. The transition involves setting restrictions on pipeline variables at both project and group levels and systematically migrating existing pipelines to use inputs. Although this shift requires initial effort, it results in more secure, maintainable, and self-documenting pipelines, aligning with broader security practices like protected branches and job token allowlists. GitLab provides tools to facilitate this migration, encouraging users to adopt pipeline inputs as a step toward a more secure CI/CD environment.