Nvdium169 published todayThis source uses summary mode. Nvdium provides a summary; read the full article on the original site.
Give two engineering teams the same AI tool and you can end up with two very different outcomes. One team ships faster with fewer bugs, while the other gets burned by an agent that confidently generates the wrong output. At GitLab, our team had AI tools at their fingertips and some found real value fast, working faster
GitLab's Threat Research Group found a critical sandbox escape vulnerability in vm2, one of the most widely adopted Node.js sandboxing libraries. The vulnerability uses a configuration copied straight from vm2's own README. We found the flaw, rated CVSS 3.1: 10.0, critical, using our own AI automated tools. Anyone runn
Every team runs on people who go above and beyond. The engineer who fixes the flaky test nobody else will touch. The reviewer who turns your merge request around in an hour. The teammate who finishes their certification. Or the community member who shows up release after release. Whether your team is a company, an open
Compliance is the part of software delivery that everyone agrees is important, yet nobody enjoys. It often lives in spreadsheets, screenshots, and the quiet dread of an upcoming audit. GitLab's custom compliance frameworks work differently. Instead of documenting what should be true about your projects, you define the
The industry is now racing to rebuild source code management for agents. We showed our answer at GitLab Transcend, but let’s reiterate why rebuilding the Git backend is only half the problem. Three things break when agents become the primary users of a Git server. Every developer running hundreds of agents hits the sam
Throughout this year, the product interface has been in a season of reduction. On the heels of dark mode, the tide has been moving out with a quieter application chrome, overall color reduction, and neutral controls. It can feel like loss, low tide always does. But low tide is also when you can see the shape of the sho
Many enterprises choose GitLab Dedicated for a clear reason: a secure and compliant, single-tenant GitLab instance, managed by GitLab. As agentic workflows drive more pipeline volume, full data isolation and runner infrastructure operational burden become a challenge. This leads to the question, “Does owning the runner
I returned from the holiday break in January convinced that something fundamental had changed. Large language models had reached the point where they could produce useful code reliably enough, and cheaply enough, to change the economics of software development. Engineers everywhere seemed to be experimenting with the s
Security teams have historically struggled to keep up with triage and remediation when development was happening at human speed. Today, that challenge is exacerbated by developers writing and shipping code at machine speed with AI. At the same time, AI is helping attackers find and exploit vulnerabilities faster in pro
Many enterprises choose GitLab Dedicated for a clear reason: a single-tenant instance, managed by GitLab, in a cloud region they select. That isolation already covers source code, project data, and the software development lifecycle they run on GitLab. GitLab Dedicated customers can now deploy the AI Gateway for the Gi
Custom Flows already let teams turn manual, multi-step work into automation that runs on GitLab events. But writing one meant learning the Flow Registry schema first. That requirement is a real barrier. The people who understand a workflow best aren’t always the same ones who know a YAML schema. In GitLab 19.3, the Flo
There's a particular kind of frustration that happens when prompting an AI assistant with the same correction multiple times in a single session. The marvels of modern large language models (LLMs) make it so you're working with the most enthusiastic apprentice you'll ever have. However, that apprentice also happens to
It's easy to think of git clone as a client-side operation, but the settings of this operation impact the server side and all networks in between. When you run a default full history clone, the server has to walk the entire history, build a pack file for it (that's what "counting objects" is actually doing), and ship i
Configuring cloud-based environments is complex, as it requires considering networking, subscriptions, services, and all the components that make up the underlying infrastructure. Manual setup is error-prone, inconsistent, and difficult to reproduce. This tutorial shows how to set up a fully automated cloud environment
Serena, one of the most widely used AI coding agents, ran attacker-supplied code the moment a developer opened a project. GitLab's Threat Research Group found a critical server-side template injection (GHSA-pp25-4cg4-qcr9, CVE pending) that executes arbitrary code in the Serena process. Anyone on serena-agent 1.6.1 or
A demo used to take me days to build — screenshots, narration, stitching it together in an external tool, chasing feedback — and every time the feature changed I'd have to start over. A few months ago, I handed most of that to an agent in GitLab Duo Agent Platform. GitLab Duo Agent Platform is built for intelligent orc