March 2026 Summaries

GitLab has been transitioning its package hosting system on packages.gitlab.com to a new infrastructure, maintaining the same domain but updating URL formats, GPG key locations, network requirements, and the package browsing UI. Existing configurations will remain functional until September 30, 2026, with URL rewrite rules supporting backward compatibility during the transition. After this period, only the new URL formats will be supported, necessitating updates to configuration settings for DEB and RPM repositories, GPG key references, firewall and proxy allowlists, and mirroring configurations. The old PackageCloud system will be phased out by March 31, 2026, and all traffic is already being served from the new system, minimizing disruption. Users are encouraged to update their configurations promptly and can find detailed instructions in the updated installation documentation. The package browsing interface has been revamped, and any feedback or issues during this transition can be reported for support.

Feature flags offer a robust solution to decouple deployment from release, allowing developers to safely manage new features in a production environment without immediate full-scale rollout. This tutorial guides users through integrating GitLab feature flags into a Python Flask application using the Unleash Python SDK, enabling them to push code to production and control feature visibility through GitLab's interface. It emphasizes the importance of setting up feature flags with strategies like "User IDs," "Percent rollout," and "All users" to manage feature exposure effectively and mitigate deployment risks. The tutorial also demonstrates how to set up a GitLab project, create feature flags, and integrate them into a Flask app, highlighting the use of environment variables for security and the ease of flag evaluation with the Unleash SDK. This approach allows for real-time toggling of application behavior without code redeployment, offering a valuable tool for managing application updates seamlessly.

Security scanners are crucial for identifying vulnerabilities, but they often generate noise by flagging non-critical issues in test code, vendored dependencies, and generated files, leading to wasted time and inefficiency for security teams. GitLab addresses this problem with auto-dismiss vulnerability policies that automate the triage process by allowing teams to define dismissal criteria based on file path, directory, or vulnerability identifier (such as CVE or CWE), and specify a reason for dismissal. These policies help eliminate unnecessary noise, enforce decisions at scale, and maintain transparency by documenting the reason for each auto-dismissed finding, while ensuring that dismissed vulnerabilities remain in reports for future review if conditions change. By implementing these policies, security teams can streamline their workflow, reduce alert fatigue, and improve collaboration with developers, ultimately enhancing the adoption of security scanning practices. GitLab provides a structured approach to creating and enabling these policies through their platform, allowing organizations to tackle specific scenarios such as dismissing test code vulnerabilities, managing vendored dependencies, and addressing known false positives, thereby optimizing the vulnerability management process.

GitLab is enhancing its Agile planning experience with the introduction of a unified work items list and saved views in version 18.10, which addresses long-standing user requests by consolidating epics, issues, and other work items into a single list. This development eliminates the need to switch between separate pages and facilitates hierarchy views for better visualization of relationships among work items. The shift from using the term "issues" to "work items" reflects a move towards greater flexibility, allowing users to fully configure these items to match their organization's planning hierarchy. Saved views enable users to store customized list configurations, promoting efficiency and consistency in team workflows. This change is part of a broader vision for a fluid planning experience that integrates various types of views, such as list, board, and table, while maintaining filter scopes. GitLab acknowledges that this transition may require adjustment but emphasizes that the new architecture is based on extensive feedback and aims to enhance long-term team productivity. Users are encouraged to provide feedback to further refine these capabilities.

GitLab 18.10 introduces a flexible payment model for small to midsize teams to access agentic AI capabilities without committing to a full platform subscription. By purchasing GitLab Credits, Free GitLab.com teams can now use the GitLab Duo Agent Platform, which includes AI agents for planning, code generation, automated code review, and pipeline diagnostics. This model allows teams to pay based on the AI's output rather than the number of users, with credits purchased through group billing settings. The new system provides a cost-effective entry point for teams to leverage AI, offering visibility into credit usage through a dedicated dashboard. Automated code reviews, a key feature, are priced at a flat rate of 0.25 credits per review, enabling predictable cost forecasting and significant time savings. For teams that find AI integral to their workflow, the GitLab Premium plan extends capabilities further, offering additional credits and advanced features.

Code review has become a significant bottleneck in software development due to increased code production facilitated by AI assistance, with review times jumping 91% on teams using AI coding tools. The industry has responded with AI-powered review tools, though many come with complex and costly pricing structures, leading teams to ration reviews and prolong queues. GitLab's Code Review Flow, part of the Duo Agent Platform, offers a solution with its flat-rate pricing of $0.25 per review, enabling teams to automate reviews across all projects without cost surprises. This system allows reviews to run in parallel, significantly reducing queue times and costs, and enables engineers to focus on more critical tasks like architecture and mentorship. The tool integrates seamlessly within GitLab, offering consistent standards at scale and flexibility with custom merge review instructions, thus transforming code review from a lengthy process into one that unblocks merge requests in minutes.

GitLab 18.10 introduces AI-powered security features aimed at enhancing the efficiency and accuracy of vulnerability management by reducing false positives and automating remediation. The update includes generally available Static Application Security Testing (SAST) false positive detection, which uses a large language model (LLM) to evaluate the likelihood of vulnerabilities being false positives, enabling teams to prioritize critical real threats. The beta release of Agentic SAST vulnerability resolution automatically generates merge requests with proposed fixes for verified vulnerabilities, reducing the need for deep security expertise. Additionally, secret false positive detection, also in beta, applies AI to differentiate between real and dummy secrets, helping teams focus on genuine risks. These new capabilities, available to GitLab Ultimate customers using the GitLab Duo Agent Platform, promise to streamline the remediation process by providing confidence scores, AI-generated explanations, and visual indicators in the Vulnerability Report, while still allowing developers to maintain control and audit the agent's reasoning.

GitLab's Container Virtual Registry addresses common challenges faced by platform engineers managing multiple container registries by providing a pull-through cache that consolidates image pulls into a single endpoint. This system caches images on the first pull, allowing subsequent requests to be served from GitLab's infrastructure, which reduces network latency and simplifies credential management by using a unified authentication flow. It is particularly useful for teams working with Docker Hardened Images, as it eases operational friction by eliminating the need for multiple CI/CD configuration changes and offers an audit trail for image usage. The virtual registry supports prioritization of upstream registries and configurable cache validity, enhancing efficiency and security for container image management.

GitLab addresses the challenge of detection gaps in incident response by using the GitLab Duo Agent Platform to automate gap analysis, thus improving the efficiency and consistency of their security operations. The platform allows security teams to use pre-built AI agents or create custom agents tailored to their specific environment and standards. The Security Analyst Agent provides immediate value by reviewing closed incident issues and identifying potential detection gaps, while the custom-built Detection Engineering Assistant offers more specific and actionable insights by integrating detailed system prompts that reflect the team's unique detection philosophy and technical context. This approach not only streamlines the initial analysis but also enhances incident documentation standards, acting as a force multiplier for skilled detection engineers without replacing their expertise.

GitLab 18.9 introduces a new file tree browser designed to enhance code navigation by providing a collapsible, resizable panel that displays the project's structure alongside file and directory views. This feature allows users to maintain context and streamline navigation, resembling the functionality of an IDE's file tree. Users can expand and collapse directories, filter files by name, and navigate using keyboard shortcuts, which is especially beneficial for screen reader users and those preferring keyboard use. The file tree browser is responsive across various devices, adapting its display to suit desktops, smaller viewports, and mobile screens, while employing pagination to manage large repositories efficiently. Available on GitLab.com and for GitLab Self-Managed and GitLab Dedicated users, the file tree browser is built with accessibility, performance, and cross-viewport consistency in mind, and GitLab encourages user feedback to guide future enhancements.

GitLab offers a comprehensive suite of container scanning tools designed to detect and manage vulnerabilities throughout the container lifecycle, crucial for maintaining application security. These tools include pipeline-based scanning to catch vulnerabilities before deployment, registry scanning for continuous monitoring of stored images, multi-container scanning for projects with multiple images, continuous vulnerability scanning to track newly published advisories, and operational scanning for runtime detection in Kubernetes clusters. By integrating these scanning methods within the CI/CD process, GitLab ensures a proactive security approach, enabling developers and security teams to address vulnerabilities efficiently before they reach production. The platform also provides detailed vulnerability reports, dependency lists, and security policies to maintain consistent security standards across development workflows, making container security an ongoing and systematic process.

GitLab Duo Agent Platform's integration with Jira via the Model Context Protocol (MCP) enhances software development by minimizing context switching and streamlining workflows within a developer's integrated development environment (IDE). This integration allows developers to query issues, update tickets, and synchronize their workflow using natural language directly from their IDE, eliminating the need to switch between multiple tools like Jira, GitLab, and an IDE. The setup involves configuring an OAuth application in Jira to securely connect with GitLab Duo Agent Platform, enabling seamless access to Jira data while maintaining security protocols. The platform leverages AI to facilitate efficient project and incident management by correlating Jira data with GitLab's project management features, thereby enhancing visibility and governance without compromising security. Through practical use cases, developers can experience improved productivity and focus by keeping their development and project management tasks within a single, cohesive environment.

AI-assisted coding tools are rapidly enhancing individual developer productivity, but software delivery remains bottlenecked by processes beyond coding, which constitutes only 20% of the lifecycle. The remaining 80%, including code reviews, security scanning, documentation, and planning, often lags due to manual processes and coordination challenges. AI can be leveraged across the entire software lifecycle to alleviate these bottlenecks, as demonstrated by GitLab Duo Agent Platform's extensive library of prompts designed to streamline tasks such as code review, security triage, documentation updates, test generation, and debugging. These AI prompts, categorized by complexity and use case, offer solutions ranging from automating routine review tasks and identifying critical security vulnerabilities to maintaining updated documentation and enhancing test coverage, ultimately transforming team processes for faster, safer, and higher-quality software delivery. As teams adopt these tools, they can shift from individual productivity gains to overall team acceleration in software development and deployment.

GitLab's Security Compliance team discovered that traditional security control frameworks lacked the necessary customization for their multi-product, cloud-native environment, leading them to create the GitLab Control Framework (GCF). Initially using the Secure Controls Framework and later NIST SP 800-53, GitLab found these frameworks insufficient due to their generality and over-restrictiveness, which led to unnecessary controls and operational inefficiencies. By designing the GCF, GitLab tailored security controls to fit its unique operational and product-specific needs, creating 18 custom control domains that align with their security program's organization and operation. This custom framework enhances GitLab's compliance program by providing a more efficient, scalable, and context-driven approach to security controls, reducing the number of controls and audit requests while supporting multiple certifications like SOC 2 and ISO 27001 simultaneously. The GCF allows GitLab to adapt quickly to new certifications and regulatory changes, maintaining a single, coherent system that offers significant qualitative and quantitative improvements in compliance management.