July 2026 Summaries

The text discusses the governance challenges and solutions associated with agentic AI in software development, contrasting it with traditional AI code completion. It highlights that agentic AI, which can autonomously execute tasks and modify code without human intervention, necessitates a different governance approach due to its ability to access tools and make changes independently. This shift raises critical questions about permissions, auditability, and accountability. The text emphasizes the importance of a governance framework that includes clear control points, such as identity linkage, tool approval guardrails, and audit trails, to ensure that AI actions align with organizational policies and regulatory requirements. It also stresses the need for comprehensive metrics to track AI rollout success and risk, advocating for a centralized AI governance policy to maintain consistency across teams. The GitLab Duo Agent Platform is presented as a solution that integrates these governance features directly into the workflow, facilitating both AI-enabled productivity and enterprise-level control.

GitLab has joined other technology companies in signing the Open Weights and American AI Leadership letter, advocating for an open AI ecosystem that encourages innovation, customer control, and safety. The company supports both foundation models for their general-purpose capabilities and open weight models for their advantages in cost, deployment, and data residency, allowing customers the flexibility to choose models that fit their needs. As a DevSecOps platform, GitLab emphasizes the importance of remaining cloud and AI model neutral, advocating for openness to ensure a competitive and secure AI ecosystem. GitLab aligns with policymakers in supporting policies that enable the development and use of open weight models with appropriate safeguards, aiming to maintain a market where multiple model providers can compete, thereby enhancing innovation, security, and customer choice.

Claude Opus 5, the latest AI model from Anthropic, is designed to handle complex and critical tasks that require precision and reliability, making it ideal for high-stakes work. Available on the GitLab Duo Agent Platform, Opus 5 has demonstrated a significant improvement over its predecessor, Opus 4.8, by achieving a 93.3% resolution rate in internal evaluations, compared to Opus 4.8's 73.0%. This model is particularly advantageous for tasks involving multi-file features and large refactors, as it offers deeper reasoning and precision in code review, reducing the need for diagnosing and re-prompting failed runs. Opus 5 also excels in coordinating multiple agents, minimizing conflicts and ensuring that tasks are completed efficiently and accurately. This model's enhanced capabilities make it a valuable tool for teams looking to delegate challenging work to AI, offering both speed and reliability, especially in long-running, complex scenarios. Users can integrate Opus 5 into their GitLab setup, utilizing GitLab Credits to manage costs, and can choose between different models based on the specific demands of their tasks.

The process of modernizing from Java 8 to Java 21 is complex and multifaceted, affecting build, runtime, dependencies, APIs, and more, necessitating careful management and review to ensure safety and reliability. The AI coding agent Cursor excels at addressing specific, bounded issues, such as identifying and fixing failing tests, but cannot independently determine the safety of a multi-step migration, which is where GitLab's Duo Agent Platform offers support by orchestrating AI workflows throughout the software lifecycle. By integrating the GitLab Model Context Protocol (MCP) server with Cursor, developers can bring project context into the IDE, enabling them to tackle modernization tasks while adhering to quality gates, CI/CD standards, and review protocols. This integration facilitates a structured progression through the modernization process, with Cursor handling implementation and GitLab providing the necessary proof and oversight, ensuring that every agent-created change is reviewed, tested, and traceable. The tutorial outlined three use cases for this approach: fixing a failing test, preparing for Java 21 modernization, and updating HTTP connection handling, demonstrating the importance of starting with small, reviewable changes and building upon them incrementally to ensure a safe and trustworthy migration process.

GitLab Orbit, a live, queryable graph of code, merge requests, pipelines, deployments, and ownership, was provided to thousands of developers, resulting in a hackathon where participants created innovative solutions to common production problems. With Orbit, developers can efficiently address issues like change impact analysis, test relevance, and migration costs by querying a single source of truth rather than navigating multiple tools. The hackathon showcased 265 projects built on GitLab Orbit, demonstrating its ability to transform complex, scattered processes into streamlined queries, with standout projects such as Sankofa's Radar and Shield, CrossCut, Carver, and Transcend highlighting the platform's potential. Contributions also improved Orbit itself, with developers adding language support, fixing bugs, and enhancing documentation. The community's creative use of Orbit underscored its capability to provide context-aware orchestration, emphasizing the importance of understanding integrated system dynamics beyond individual code segments.

GitLab Duo Agent Platform introduces an event-driven "Work item created" trigger that automates the process of assigning tasks instantly when a new work item is created, eliminating the need for manual intervention. This automation addresses the inefficiencies of manual task assignment, which can lead to delays and uneven workload distribution as volume increases. By using a two-agent flow powered by GitLab Orbit, the platform can assess each team member's current workload and availability, ensuring tasks are assigned to the most suitable person in seconds. This system allows teams to focus on tasks that require human judgment, improving triage speed and workload balance. The platform's potential enhancements include integrating with HR or calendar systems to further refine task assignments based on team members' availability and PTO dates.

GitLab's Dependency Scanning Auto-Remediation, currently in public beta, aims to streamline the process of managing vulnerable software dependencies by automating the detection and remediation of security issues. By leveraging AI, it identifies vulnerable packages through dependency scanning and initiates merge requests to update them, while also addressing any build-breaking changes. This tool helps reduce security backlogs and ensures compliance with deadlines, allowing developers to focus on feature delivery rather than manual remediation tasks. The system is designed with safeguards to prevent unnecessary changes and maintains an audit trail for every modification, requiring reviewer approval before merging. It supports various ecosystems like Bundler, Maven, Gradle, and major Python and JavaScript/TypeScript package managers, with plans to expand. GitLab offers this feature with its Ultimate subscription and provides a free trial for its advanced capabilities, encouraging user feedback to refine the service.

A Forrester Consulting Total Economic Impact study reveals that organizations utilizing the GitLab Duo Agent Platform experience a 400% return on investment and a net present value of $7.5 million over three years, with a payback period of less than six months. The study, based on interviews with decision-makers from various industries, presents a composite organization scenario, highlighting significant benefits such as 80% faster onboarding, a 75% reduction in migration timelines, and substantial savings in labor costs due to improved efficiency in onboarding, migration, and security remediation. The platform's agentic coding capabilities enhance developer productivity by automating code review and troubleshooting tasks, resulting in faster feature releases and reduced dependency on senior engineers. Additionally, the study underscores non-quantified benefits like improved developer satisfaction and better cross-team knowledge sharing. While the study is commissioned by GitLab, Forrester maintains editorial independence, underscoring the study's aim to provide a framework for organizations considering agentic infrastructure for software engineering, rather than serving as a competitive analysis.

Static scanners are effective at identifying vulnerabilities that follow known patterns but struggle with logic flaws that do not fit such patterns, leading to costly late detection. Security Review Flow, now in public beta on the GitLab Duo Agent Platform, aims to address this gap by evaluating code changes with a focus on their intended function, similar to how a security engineer would, thus identifying logic flaws before they reach production. This tool excels at uncovering issues like broken object level authorization, data exposure, business logic errors, and race conditions, which traditional scanners often miss. Security Review Flow complements pattern-based scanning and manual analysis by reviewing code at the point of change, making fixes more cost-effective. It integrates with GitLab to analyze merge requests by examining both the code diff and its context, providing precise findings categorized by severity and accompanied by plain-language explanations and suggested fixes. The tool remains in beta for GitLab Ultimate customers, offering a fresh approach to application security that promises to bridge the gap between rapid development and the application of security expertise.

GitLab 19.2 introduces Custom Flows, enhancing software development automation through AI-powered workflows that teams can define once and trigger from native GitLab events, streamlining complex multi-step tasks within CI/CD pipelines. This release aims to address the challenges of manual software delivery by allowing teams to encode and automate trusted sequences, such as self-healing pipelines, which were previously reliant on human intervention at every step. Custom Flows, now generally available, allow for event-driven automation that maintains bounded access and attribution, while Foundational Flows in Agentic Chat enable seamless initiation of specialist tasks with human approval, ensuring that multi-step processes can occur without constant manual input. Additionally, GitLab 19.2 enhances code review automation by introducing exclusion rules for certain merge requests and customizable review instructions, allowing teams to maintain intentional reviews without unnecessary resource expenditure. As the platform evolves, future enhancements, including a Flow Creation Agent, promise further simplification of creating and managing automated workflows.

GitLab 19.2 introduces the GitLab Duo CLI, integrating agentic AI capabilities directly into the terminal to enhance the software delivery process beyond mere code editing. This new feature provides developers with a seamless experience by enabling them to manage tasks such as pipeline failures, CI/CD configuration, and multi-step processes without leaving the command line. The Duo CLI is designed to work across GitLab's platforms, including GitLab.com, GitLab Self-Managed, and GitLab Dedicated, allowing developers to stay in the terminal and continue their work across different interfaces like the GitLab UI and editor extensions. It offers both interactive and headless modes, supporting tasks from exploring codebases to executing scripts, and adheres to custom instructions, allowing for greater flexibility and control within the software lifecycle. By maintaining context within GitLab, GitLab Duo CLI addresses previous limitations of generic CLI assistants and provides more comprehensive coverage of the delivery lifecycle.

Hundreds of CI/CD jobs are run daily by software teams, each contributing to energy consumption and carbon emissions, which often go unmeasured. Eco CI and Carmen are open-source tools that integrate with GitLab pipelines to provide visibility into the carbon footprint of these jobs, allowing teams to make informed decisions to reduce emissions. Eco CI operates at the pipeline level, offering per-job emission data, while Carmen provides detailed reporting on infrastructure and application layers, such as virtual machines and Kubernetes pods. These tools enable teams to identify and address inefficiencies without requiring new infrastructure, promoting a culture of sustainability. By incorporating carbon measurement into existing workflows, teams not only meet evolving emissions reporting expectations but also benefit from potential cost savings and improved efficiency, aligning with broader trends in carbon-aware engineering and regulatory requirements.

A small team at GitLab conducted an experiment to determine if AI agents could assist in migrating part of their legacy rate-limiting system without compromising safety. The experiment was successful, demonstrating that AI agents can be effective but also highlighting areas for improvement in existing workflows. The team used GitLab, the GitLab Duo Agent Platform, and other tools to unify two rate-limiting paths into a single implementation, focusing on observability, testability, and operational consistency. The process involved a structured loop with AI agents drafting specs, implementing changes, and reviewing merge requests, while humans retained control over scope, architecture, and final reviews. The project faced challenges such as a shadow-mode miss and infrastructure constraints, which underscored the importance of human oversight and judgment. By mid-June, the migration was successfully completed for all cohorts, with plans to address the higher-volume RackAttack layer next. The experiment illustrated the value of both AI agents and the human element in achieving a successful migration.

GitLab's restricted access feature is designed to help organizations manage seat costs predictably by blocking the addition of new billable users once all licensed seats are occupied. This feature, available on both GitLab.com and Self-Managed, ensures that seat usage aligns with purchased seats without reversing existing overages, allowing organizations to avoid unexpected seat growth before renewal. Recent improvements have enhanced the feature's integration with identity providers, allowing users provisioned through systems like SAML, SCIM, or LDAP to be assigned non-billable Minimal Access roles, thereby preventing immediate overages while maintaining centralized identity management. Dormant users who reactivate are now placed in a pending approval state rather than automatically consuming a seat, and clearer warnings and notifications have been implemented to assist administrators in managing seat limits effectively. Restricted access differs from the user cap feature, as it directly ties to the number of available seats, automatically disabling user cap when activated. It provides a more controlled and transparent operational model for managing user provisioning and reactivation while helping reduce billing surprises.