ReleaseBytes
gitlab GitLab Release Notes ·

GitLab 19.4 enhances AI agent governance, SAST, and developer workflows

aiawsazuregcppreviewengineergovernment
feature

GitLab 19.4 introduces new capabilities for governing AI agents, expanding SAST language support, and enhancing developer workflows. Users can now apply governance rules to GitLab Duo Agent Platform and third-party tools, with advanced SAST covering Kotlin, Dart, and Scala codebases. The release also adds SPDX license expression support, an Agentic Core `/goal` command in the Duo CLI, and experimental Slack integration for Duo agents. A beta visual flow builder for AI-native workflows is available in the VS Code extension, alongside expanded CI/CD, merge request, project, user, and repository tools for agents.

  • →Centralize governance for AI agent tools
  • →Add Kotlin, Dart, and Scala to Advanced SAST
  • →Support SPDX license expressions in dependency scanning
  • →Introduce goal-driven agent workflows in GitLab Duo CLI
  • →Expand GitLab Duo with Slack integration and custom flow builder
Features (5) ›
  • Centralize governance for AI agent tools

    GitLab 19.4 allows governing GitLab MCP server tools alongside internal GitLab Duo Agent Platform tools. Users can set "Always Allow" for read-only tools and "Always Ask" for write and delete actions, providing a checkpoint for agent-initiated changes.

  • Add Kotlin, Dart, and Scala to Advanced SAST

    Advanced SAST now includes deep taint analysis for Kotlin, Dart, and Scala codebases, identifying vulnerabilities like SQL injection, SSRF, and command injection. This support is delivered through the Software Factory architecture with framework-aware rule gating.

  • Support SPDX license expressions in dependency scanning

    GitLab license data now carries SPDX license expressions, including compound declarations like MIT OR Apache-2.0. These composite licenses appear in the dependency list and are subject to license approval policies, improving visibility and control for complex license declarations.

  • Introduce goal-driven agent workflows in GitLab Duo CLI

    The GitLab Duo CLI gains a new `/goal` slash command, enabling users to delegate open-ended objectives to a governed, goal-driven flow. This local process handles implementation and verification, with users maintaining control to pause, update, or redirect the agent.

  • Expand GitLab Duo with Slack integration and custom flow builder

    An experimental GitLab Duo Slack integration allows invoking agent flows and getting codebase answers directly from Slack. Additionally, a beta visual editor in the GitLab for VS Code extension enables building and publishing custom AI-native workflows.

Enhancements (1) ›
  • Enhance MCP server with comprehensive CI/CD, MR, project, and repo tools for agents

    Agents can now trigger, inspect, and control CI/CD pipelines, manage merge requests with diffs and reviews, and access project, user, and repository details. These new tools provide agents with broader context and the ability to propose changes through the GitLab MCP server.

Read the original announcement →

https://docs.gitlab.com/releases/19/gitlab-19-4-released/

Related releases