GitLab 19.1 Enhances AI Security and Developer Workflows

GitLab Duo now automatically analyzes secret detection findings to identify false positives, reducing alert fatigue and improving trust in scan results. This feature offers both automatic analysis after scans and manual triggering for on-demand assessment, focusing on critical and high-severity vulnerabilities.

Administrators can now enforce GitLab Duo to be always on for all projects within an instance or top-level group, enabling centralized AI governance for compliance. This setting prevents group owners from disabling GitLab Duo, ensuring consistent AI tooling across an organization.

Projects can now be configured to automatically assign Code Owners as reviewers for merge requests based on changed files. This automation occurs when a merge request is created or marked as ready, provided no reviewer has been manually assigned.

Users can now create compliance frameworks from predefined templates, including options for ISO 27001, SOC 2, and FedRAMP. This feature simplifies the process of building compliance frameworks by starting with pre-configured requirements and controls.

Administrators can configure tool-level approval policies for GitLab Duo agents, allowing them to gate sensitive actions with human approval. This offers modes like 'Allow,' 'Ask,' and 'Deny' for different tools, enhancing control over AI agent operations.

Secret detection in feature branch pipelines now scans every commit from the branch's divergence point with the default branch. This ensures that secrets leaked in earlier commits are detected before reaching shared branches or production.