GitLab 19.0 Enhances AI Workflows, Secrets Management

GitLab has announced the release of GitLab 19.0, a major update focusing on integrating advanced AI capabilities, strengthening secrets management, and expanding support for self-hosted AI models. This release addresses the growing "AI Paradox" faced by engineering organizations, where the rapid pace of AI-driven code generation often outstrips the surrounding workflows for security, review, and governance. A central component of GitLab 19.0 is the expansion of secrets management, now in public beta for Premium and Ultimate users. This feature allows credentials to be stored within the GitLab platform itself, with access scoped precisely to authorized jobs and audit logging integrated into existing GitLab group and project structures. This eliminates the need for separate permission models and provides a clear audit trail for any compromised credentials, linking them directly to the originating pipeline. The update also introduces agentic merge request workflows, which extend across the entire merge request lifecycle. These workflows help address reviewer feedback, resolve conflicts, and manage oversized merge requests more efficiently. By reading project-specific standards from an `AGENTS.md` file, the system ensures that AI-generated outputs align with team context and guardrails, rather than generic defaults. New beta capabilities include a "Resolve with Duo" button for automated fix proposals and one-click rebase-and-merge options. For platform engineering teams, GitLab 19.0 enhances CI/CD Catalog visibility through "Components Analytics." This provides insights into which CI/CD Catalog components and versions are being used across the organization, all within GitLab's unified platform. Furthermore, the GitLab Duo Agent Platform Self-Hosted now supports additional open-source models, including Mistral Devstral 2 123B, GLM-5.1, Kimi-K2.6, and MiniMax-M2.7. This is particularly beneficial for teams operating in air-gapped or regulated environments that cannot send source code to external APIs, ensuring compliance and data sovereignty while leveraging AI.