GitLab 19.5 Release Adds Secrets Management and Enhanced AI Governance
GitLab 19.5 introduces generally available secrets management, expanded AI governance, and improved agentic workflows.
1GitLab 19.5 Platform Update
GitLab 19.5 launched on October 15, 2026, bringing significant updates to security and AI-driven development. The release features the general availability of the GitLab MCP server, allowing external agents like Claude Code and Cursor to interact directly with GitLab tools. These enhancements aim to streamline workflows across diverse development environments.
2Centralized Secrets Management
The new GitLab Secrets Manager, built on OpenBao, is now generally available for both GitLab.com and Self-Managed instances. It eliminates the need for scattered CI/CD variables by using existing group permissions. Every secret access is logged, and audit trails are generated for all create, read, update, and delete operations performed.
3Expanded AI Governance Visibility
Governance visibility now extends beyond the GitLab Duo Agent Platform to include Externally Connected Agents like Claude Code and Codex. By using the glab CLI, security teams can monitor agent sessions, tool calls, and prompt inputs. This integration ensures that compliance teams maintain oversight of AI activities running outside the platform.
4Enhanced Duo CLI Capabilities
The GitLab Duo CLI 9.27.0 introduces the generally available /goal command, enabling goal-driven flows that handle implementation and verification locally. Additionally, a new auto mode allows agents to execute tools without manual approval for every step. Users can now manage configurations via settings files for consistent organizational deployments.
5Intelligent Code Review Flow
Code Review Flow now utilizes comment threads from previous reviews to evaluate new changes. GitLab Duo focuses on lines added since the last review and avoids repeating previously addressed points. If a user explains why code is correct in a thread, the AI will not raise that specific point again.
6Granular AWS Model Access
Users can now specify unique IAM roles for individual Amazon Bedrock models within the AI Gateway. Previously, a single AWS identity required access to all models. This update allows for stricter security by ensuring each model only possesses the specific AWS permissions necessary for its intended tasks and operations.
7Improved Agentic Tooling
New tools like get_artifact_file allow agents to read specific files from CI/CD artifacts without downloading entire archives. Furthermore, the list_groups tool enables agents to browse organization hierarchies dynamically. These improvements reduce context window waste and help agents find the correct resources without requiring hardcoded identifiers or manual paths.
8Rate Limiting for MCP
To manage infrastructure costs, GitLab.com has implemented rate limits for the GitLab MCP server. Free tier users are limited to 60 requests per minute, while Premium and Ultimate users receive 600. Reconnects and retries count toward these limits, necessitating careful configuration of agent retry settings to avoid HTTP 429 errors.
9Automated Reviewer Recommendations
The Recommend Reviewers Flow is now generally available, suggesting reviewers based on availability, workload, time zone, and recent activity. Recommendations appear in the merge request sidebar, where users can hover to understand the rationale. This feature simplifies the process of assigning merge requests to the most appropriate team members.
10Pipeline and Security Profiles
Child pipelines can now mark parent job dependencies as optional, preventing failures when parent jobs are skipped. Additionally, security teams can customize SAST and Secret Detection profiles directly in the UI. These changes allow for more flexible CI/CD configurations and centralized management of security settings across multiple projects.
11Observability and UI Improvements
GitLab Observability is now in beta, allowing users to send traces, metrics, and logs via OpenTelemetry. The interface also received updates, including sticky headers for Markdown tables and the ability to sort columns. These UI enhancements make it easier to manage large datasets and documentation directly within the platform.
12Strategic Impact of Release
GitLab 19.5 marks a shift toward more autonomous, governed AI development. By integrating external agents into the governance dashboard and providing robust secrets management, the platform addresses critical enterprise needs. These updates reduce manual overhead for security teams while empowering developers to use their preferred tools within a secure framework.
Original article: GitLab — GitLab 19.5 Release Adds Secrets Management and Enhanced AI Governance