analiza aiqbench
GitLab 19.4 introduces granular governance controls for third-party AI agents via the GitLab MCP server, allowing teams to distinguish between read-only and write-access tools within their Duo Agent Platform. Additionally, the release expands SAST capabilities to Kotlin, Dart, and Scala while adding a Vulnerability Context Flow to improve triage efficiency based on authentication, privilege levels, and data sensitivity. These updates represent significant strides in securing enterprise AI workflows and broadening static analysis coverage for diverse codebases.
GitLab 19.4 release notes
On September 17, 2026, GitLab 19.4 was released with the following features. We are excited to recognize Jimmy, a Level 4 contributor, as this month’s Notable Contributor! Jimmy contributed across the GitLab codebase, client-go, and the Terraform provider to ensure that tokens, service accounts, and push mirrors can be managed end to end through infrastructure as code. Primary features Governance for GitLab MCP server tools Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Previously, you could only apply AI agent tool governance rules to internal GitLab Duo Agent Platform tools. Tools available to both GitLab Duo Agent Platform and third-party agents through the GitLab MCP server followed fixed rules that could not be changed. You can now govern GitLab MCP server tools from the same place as internal GitLab Duo Agent Platform tools. They appear alongside internal tools in your group and project GitLab Duo settings, where you can set a mode for each tool: Read-only tools default to Always Allow, so routine lookups run without interrupting your team. Write and delete tools default to Always Ask, giving reviewers a checkpoint before an agent changes anything. Restrict access to MCP servers (beta) Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now restrict access to MCP (Model Context Protocol) servers by allowing or denying access to: An entire external MCP server. Individual tools on an MCP server. This feature gives you assurance that AI agents within Duo Agent Platform are operating within governed boundaries and can only access MCP tools that are within their scope to perform their activities, sessions, and tasks. These controls apply consistently wherever AI agents run, including: Agentic Chat. Flows. IDE and CLI environments. This feature is currently in beta and we welcome your feedback in issue #628378. Vulnerability Context Flow Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Use the Vulnerability Context Flow to produce context to triage vulnerabilities more efficiently and intelligently. The flow produces context in the following three categories: Authentication: Yes or No. Indicates whether the vulnerable code requires authentication to exploit. Authorization: Elevated or Standard. Indicates whether exploiting the component requires elevated privileges. Sensitive data: Yes or No. Indicates whether the vulnerable code handles sensitive data, such as personal information, credentials, tokens, payment data, or health data. Advanced SAST includes Kotlin, Dart, and Scala language support Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Advanced SAST now scans Kotlin, Dart, and Scala codebases with the same deep taint analysis that covers Java, Python, and other supported languages, all delivered through the Software Factory architecture with per-language front-ends and framework-aware rule gating. Kotlin detection targets Android APIs for SQL injection, unsafe WebView usage, OS command injection, hardcoded credentials, and weak cryptography. Dart detection includes a Flutter and Dio framework detector covering SSRF, path traversal, command injection, and cleartext HTTP. Scala detection covers Play, Slick, and Akka frameworks for SQL injection, SSRF, open redirect, path traversal, command injection, and XSS. All three additions are verified using deliberately vulnerable real-code repositories, with findings reported as code flows from source to sink. SPDX license expression support in dependency and license scanning Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab license data now carries SPDX license expressions, including compound declarations such as MIT OR Apache-2.0 or GPL-2.0-only WITH Classpath-exception-2.0. Previously these were reported as unknown in the dependency list and were invisible to license approval policies. Composite licenses now appear in the dependency list with their operator (AND, OR, WITH), and license approval policies can allow or deny them the same way they handle single-license dependencies. Expressions declared in a CycloneDX SBOM have been supported since GitLab 19.3. This release adds them to the license data GitLab synchronizes. Offline instances receive expressions only after downloading the v3 license data. Agentic Core /goal command in GitLab Duo CLI Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue GitLab Duo CLI now includes a /goal slash command that delegates open-ended objectives to a governed, goal-driven flow that runs loca
On September 17, 2026, GitLab 19.4 was released with the following features. Jimmy contributed across the GitLab codebase, client-go, and the Terraform provider to ensure that tokens, service accounts, and push mirrors can be managed end to end through infrastructure as code. Previously, you could only apply AI agent tool governance rules to internal GitLab Duo Agent Platform tools. Tools available to both GitLab Duo Agent Platform and third-party agents through the GitLab MCP server followed fixed rules that could not be changed. You can now govern GitLab MCP server tools from the same place as internal GitLab Duo Agent Platform tools. They appear alongside internal tools in your group and project GitLab Duo settings, where you can set a mode for each tool: Read-only tools default to Always Allow, so routine lookups run without interrupting your team. Write and delete tools default to Always Ask, giving reviewers a checkpoint before an agent changes anything. An entire external MCP server. Individual tools on an MCP server. This feature gives you assurance that AI agents within Duo Agent Platform are operating within governed boundaries and can only access MCP tools that are within their scope to perform their activities, sessions, and…
Extras afișat conform termenilor RSS ai publicației · 200 cuvinte · textul integral și figurile sunt pe site-ul publicației
