What's new in GitLab

Stay updated with our latest features and improvements.

What's new in GitLab 18.9

Feb 19, 2026
Past release

Self-hosted agentic AI with model choice, security insights that drive remediation, and developer experience improvements your teams have been asking for. GitLab 18.9 extends governed agentic AI to your infrastructure and model choice, and delivers security insights that drive remediation over detection.

GitLab Duo Agent Platform Self-Hosted for Online Cloud Licenses

AI

Manage

Organizations in regulated industries can now run GitLab Duo Agent Platform in production on online cloud licenses while using models hosted on their own infrastructure or approved cloud environments. Powered by a usage-based billing model through GitLab Credits, this deployment option:

  • Keeps inference traffic within your approved boundaries, helping organizations meet data residency and sovereignty requirements in financial services, government, and other regulated industries.

  • Provides granular cost transparency through per-request metering for accurate internal chargeback and regulatory reporting.

  • Removes a significant deployment blocker for enterprises where routing data through external AI vendors is not an option.

Bring Your Own Model (BYOM)

AI

Manage

Many customers in highly regulated industries have already invested in domain-tuned LLMs, in-region deployments, and closed-source internal models. BYOM extends GitLab Duo Agent Platform flexibility by allowing administrators to connect third-party or self-hosted models through the GitLab AI Gateway. This capability:

  • Surfaces custom models alongside GitLab-managed models within the AI control plane, treating them as enterprise-ready options for agents and flows.

  • Maps registered models to specific Duo Agent Platform flows or features for fine-grained control over which agents use which models.

  • Replaces a fragmented mix of point solutions and unmanaged AI tools with a single, governed control plane for agentic AI.

Repository file tree browser

Code

The repository file tree browser has been a highly requested feature that we’ve been working with the community on, and it’s now enabled on GitLab.com, GitLab Self-Managed, and GitLab Dedicated in 18.9. It is structured like a collapsible drawer that displays your repository's files and directories alongside the file list and file view. This feature:

  • Supports full keyboard navigation (Shift+F to toggle, F to search) with complete W3C ARIA treeview accessibility compliance.

  • Adapts responsively from side-by-side on desktop to drawer on smaller viewports, with pagination for large repositories (1000+ items).

  • Syncs tree state with the file list and persists your open/closed preference across sessions.

Security Dashboard: Track vulnerability remediation

Secure

Analyze

GitLab's updated Security Dashboard, generally available since 18.8, consolidates vulnerability data into a single view spanning projects, groups, and business units with risk scoring, remediation velocity, and vulnerability age distribution. In 18.9, the vulnerabilities over time chart now excludes no-longer-detected vulnerabilities. This change:

  • Reflects the number of detected vulnerabilities that require attention, removing stale findings that skew trend lines.

  • Applies automatically to vulnerabilities no longer detected in pipelines run from 18.9 onward, with a background migration handling earlier pipeline data.

  • Gives AppSec leaders cleaner trendlines for executive briefings, with open vulnerabilities decreasing, risk posture improving, and remediation velocity tracking real progress rather than noise.

Security attributes and context filtering

Secure

Analyze

Manage

Security teams need to identify the greatest risks to their business, not just the highest raw scan counts. Security attributes let teams tag groups and projects with business context and filter security inventory and security policies by those attributes. This capability:

  • Tags assets with pre-defined attributes including business impact (Mission Critical through Non-essential), application, business unit, internet exposure (true or false), and lifecycle stage such as Production or Development.

  • Filters vulnerability data by business context so security teams can prioritize by impact, application, or team rather than raw scan volume.

  • Pairs with the security dashboards to surface risk scoring and remediation tracking through a business-relevant lens.

Vulnerability resolution with GitLab Duo Agent Platform (Beta)

Secure

AI

Triaging and remediating SAST vulnerabilities is often one of the most time-consuming tasks in application security, but with Duo Agent Platform it doesn’t have to be. With the new SAST vulnerability resolution flow, GitLab Duo kicks in when you trigger a resolution and autonomously analyzes the finding, reasons through the surrounding code context, generates a context-aware fix, and creates a merge request. This flow:

  • Reasons through the vulnerability and evaluates the codebase through agentic multi-step resolution rather than producing a single code suggestion.

  • Generates a ready-to-review merge request with the proposed code fix for critical and high severity SAST vulnerabilities.

  • Includes quality scoring on each generated fix so reviewers can quickly gauge confidence in the proposed remediation.

Show security reports from child pipelines in merge requests

Secure

Teams using parent-child pipeline architectures previously could not see security and compliance reports from child pipelines in the merge request widget, forcing manual navigation through multiple pipelines to identify issues. Now the merge request widget displays security findings from child pipelines alongside parent pipeline results. This improvement:

  • Surfaces security scan results from child pipelines directly in the merge request, removing a manual navigation step for enterprise teams with complex CI/CD architectures.

  • Supports monorepo and compliance-driven setups where security scans run in sandboxed child pipelines for isolation and access control.

  • Closes a long-standing workflow gap for customers enforcing security policies across parent-child pipeline structures.

Container virtual registry (Beta)

Deploy

Operate

Organizations pulling container images from multiple registries have to deal with authentication management across providers and often excessive bandwidth costs from repeated pulls. The experimental container virtual registry creates a single GitLab endpoint with multiple upstream sources (Docker Hub, Harbor, Quay, and registries using long-lived token auth) and built-in pull-through caching. This registry:

  • Resolves image pulls automatically across upstream sources, eliminating per-provider authentication management.

  • Caches pulled images to reduce bandwidth costs and improve reliability for repeated pulls.

  • Gives teams evaluating GitLab as a container registry replacement a consolidated access layer that works alongside existing registries during transition.

  • Share your feedback to help shape this capability.

CI/CD job performance metrics (Limited-Availability Beta)

Build

Analyze

Previously there hasn’t been an easy way to figure out when a job's build time started trending up or which jobs are dragging down your pipeline. With CI/CD job performance metrics you can see P50 and P95 job duration, failure rate, and stage for each job directly in the CI/CD Analytics page, sortable and searchable by job name across the last 30 days. This view:

  • Surfaces job-level performance data where platform teams already work, without requiring external dashboards or tooling.

  • Helps identify slow or failing jobs faster to improve developer velocity and reduce pipeline troubleshooting time.

  • Supports stage grouping (coming next) to aggregate metrics across build, test, and deploy stages.

GitLab Duo Agent Platform included in free trials with GitLab Ultimate

AI

Manage

Ultimate trials on GitLab.com and self-managed now ship with GitLab Duo Agent Platform trial credits, so teams can evaluate agents and flows under the same usage model they'll use in production. This trial experience:

  • Provides 24 credits per user, valid for the full 30-day trial period, for trying DAP agents and flows with realistic usage patterns.

  • Demonstrates GitLab's cost controls and credit system during evaluation, so customers understand the billing model before committing.

  • Requires GitLab 18.9 or later for GitLab Self-Managed deployments with an internet connection, aligning the trial experience with the production usage-based pricing launched in 18.8.

99.9% uptime SLA for GitLab Ultimate

Manage

Operate

GitLab now commits to a 99.9% monthly uptime percentage for Ultimate customers who purchased or renewed on or after January 1, 2026. This platform commitment covers core experiences including issues and merge requests, Git operations, container registry, package registry, and API access. This SLA:

  • Provides a defined service credit schedule, including 5% of monthly fees for uptime between 99.5% and 99.9%, with a clear request process through support.gitlab.com.

  • Signals enterprise-grade reliability for teams with regulated and mission-critical workloads evaluating GitLab as their primary development platform.

  • Applies to Ultimate tier SaaS customers, reinforcing the value of the highest tier for organizations with strict availability requirements.

Zero downtime upgrades for cloud-native deployments

Operate

Deploy

Previously, organizations running GitLab on Kubernetes had no documented path for performing zero downtime upgrades with the GitLab Helm Chart. After validating the process against GitLab.com, GitLab Dedicated, and Operator v1 implementations, comprehensive documentation is now available for all Chart users. This documentation: