gitlab

Ruby's October 23 releases fix Onigmo regular expression bugs that GitLab found could lead to remote code execution; Ruby says it has not requested CVE identifiers for them.

GitLab's October 12 critical patch release fixes CVE-2026-97229, rated CVSS 10.0, which GitLab says could let an unauthenticated user run code via a crafted CI/CD regular expression.

GitLab fixed CVE-2026-90970, a CVSS 9.9 flaw that let authenticated Duo Agent Platform users escape a prompt template sandbox on self-hosted AI Gateways.

A critical Jinja2 template-injection bug let attacker-controlled repository files execute code in the Serena coding agent, bypassing its own trust gate.

GitLab's 19.2.1, 19.1.3, and 19.0.5 patch release fixes 13 vulnerabilities, including three high-severity flaws and a prompt-injection bug in Duo Code Review.

GitLab's next-generation source code management, shown at its Transcend event, keeps the Git protocol but rebuilds the backend so agents query repos server-side instead of cloning them.

GitLab disclosed a reduction in force on May 11, plans to shed up to 30% of its country footprint, remove up to three management layers, and reorganize R&D into roughly 60 teams by June 1.

GitLab's April 16 release graduates a security agent that opens ready-to-merge fixes for confirmed SAST findings, ships a beta CI pipeline agent and a generally available analytics agent, and gives administrators enforceable monthly caps on Duo Agent Platform credits.

GitLab's April release adds a CI Expert Agent that generates pipelines from repository analysis, moves Agentic SAST vulnerability resolution to GA, and delivers natural-language DevOps analytics.

Git 2.54, released April 20, introduces a new history-editing command inspired by Jujutsu, config-based hooks, geometric repacking by default, and a pluggable object database built over two years and roughly 400 commits.