GitLab has released version 19.2. This release further expands the agent-based automation of the Duo Agent Platform. Developers can now automatically resolve vulnerable dependencies, detect security flaws that scanners miss, and invoke agents directly from their terminal.
In version 19.0, GitLab had already extensively integrated Duo agents throughout the entire software development lifecycle. With 19.2, it goes a step further, as AI now generates more code, dependencies, and changes than developers can keep up with.
The biggest new feature is Dependency Scanning Auto-Remediation, now in public beta. If a scan finds a vulnerable package, GitLab automatically opens a merge request with a suggested fix. If an upgrade breaks the build, agents continue to iterate within the same merge request. Each change goes through the existing approval gates and leaves a complete audit trail.
In addition, Security Review Flow is available in public beta. This flow reasons about what code should do rather than matching patterns. This allows it to detect issues such as broken authorization, information disclosure, and race conditions. The flow never approves anything on its own; a human always makes the final decision.
Agents in the terminal
GitLab Duo CLI is now generally available on GitLab.com, Self-Managed, and Dedicated. This gives developers access to the agents from the Duo Agent Platform right in their terminal, with full project context. This allows them to diagnose a failed pipeline or understand unfamiliar code without leaving the command line.
There are also more agent-based flows. Custom Flows are now generally available and authenticate using short-lived, job-scoped tokens. The upcoming Flow Creation Agent will be able to convert a natural language description into a custom flow.
Finally, new controls are being added. The AI Audit Event Report logs AI actions as separate audit events. New MCP access controls determine which agents are allowed to run and what they can access.