GitLab 19.2: GA features for Duo CLI, custom flows, and scheduled pipelines

The GitLab Duo CLI is now generally available, bringing the GitLab Duo Agent Platform to the terminal. It allows users to query their codebase and perform actions autonomously, with context about GitLab projects, pipelines, and agent configurations. Features include interactive chat and headless modes, admin controls, model selection, tool approvals, and support for skills and AGENTS.md customization.

AI-powered custom flows for automating multi-step tasks across GitLab projects are now generally available. Teams can define workflow steps, components, and triggers for automated repetitive development and operational work. These flows run within GitLab CI/CD, supporting YAML-defined workflows, multi-agent orchestration, human-in-the-loop checkpoints, and native GitLab triggers.

Scheduled pipeline execution policies are now generally available, enabling the definition of schedules in a single security policy project to enforce them across all in-scope projects. This feature allows for centralized management of compliance scripts, security scans, or custom CI/CD jobs, independent of commit activity, and supports time zone support, time window distribution, and branch targeting.

Foundational flows can now be initiated from Agentic Chat within the GitLab UI, in addition to specific UI actions or mentions. When a request matches a specialist workflow like Developer Flow, Code Review Flow, or Fix CI/CD Pipeline Flow, Agentic Chat hands off the task, with user approval required to proceed.

GitLab 19.2 introduces a beta for dependency scanning auto-remediation, offering automated vulnerability remediation. This includes automated dependency version bumps that open merge requests for vulnerable dependencies and Agentic Breaking Change Resolution, which uses GitLab Duo to analyze and fix pipeline errors caused by breaking changes in updates.

A beta release allows tracking vulnerabilities on branches other than the default branch, with support for up to two tracked branches per namespace. Users can filter vulnerabilities by branch on the vulnerability report and project-level security dashboard, and track all vulnerability types, including CVEs, while maintaining vulnerability status consistency.