GitLab Inc. today released GitLab 19.2, introducing governed agentic automation to address the backlog of code, dependencies, and changes created by AI. The update allows developers to fix vulnerable dependencies automatically, catch logic flaws missed by scanners, and create custom agentic workflows while maintaining organizational controls. A Forrester Consulting study commissioned by GitLab found that organizations using the GitLab Duo Agent Platform can achieve a 400% return on investment with payback in under six months.

Dependency Scanning Auto-Remediation

Dependency Scanning Auto-Remediation is now available in public beta. This feature addresses security risks from transitive dependencies, which a study of the Maven ecosystem found reach roughly 63% of latest releases. When a scan identifies a vulnerable package, GitLab opens a merge request with a suggested fix. If an upgrade breaks the build, agents iterate to resolve the issue within the same merge request. New configuration controls allow developers to set severity thresholds and version scopes. All changes stop at existing approval gates and generate a full audit trail.

Security Review Flow

Security Review Flow, now in public beta, detects vulnerabilities that pattern-based scanners cannot identify, such as business logic errors and race conditions. The feature analyzes code intent rather than matching known patterns to find flaws like broken object-level authorization, missing authorization on state-changing operations, and information disclosure. Findings include severity ratings and suggested fixes where available. The flow does not approve changes automatically; a person must make the final decision.

GitLab Duo CLI and Custom Flows

GitLab Duo CLI is now generally available across GitLab.com, Self-Managed, and Dedicated deployments. This tool brings GitLab Duo Agent Platform's agents to the developer's terminal with full project context, allowing users to diagnose failed pipelines or propose fixes without leaving the command line. Custom Flows are also generally available, enabling teams to replace manual multi-step workflows with agentic automations triggered by GitLab events. These flows authenticate to external services using short-lived, job-scoped tokens.

Controls and Governance

GitLab 19.2 introduces controls to ensure automation remains trustworthy at scale. The AI Audit Event Report, now in beta, records AI-assisted actions as dedicated audit events for compliance and security teams. Group-level custom instructions for GitLab Duo Code Review allow administrators to set review behavior across projects simultaneously. New MCP access controls govern which agents can run and what resources they can access.

GitLab Inc. today released the results of a Total Economic Impact (TEI) study conducted by Forrester Consulting, which found that organizations using the GitLab Duo Agent Platform can achieve a 400% return on investment (ROI) and $7.5 million in net present value (NPV) over three years. The study indicates a payback period of under six months for the composite organization analyzed. These findings demonstrate the financial efficiency and productivity gains available to enterprises integrating AI agents into their software development lifecycle.

The study examined a composite organization modeled on interviews with four GitLab customers across financial services, software development, entertainment, and insurance sectors. This organization generates $3 billion in annual revenue and employs 3,000 people. It deployed the platform to 150 users in year one, expanding to 250 users by year three. Forrester found that the platform reduced manual effort and produced measurable gains in productivity, security remediation, and onboarding speed.

Key Financial and Operational Benefits

The TEI study quantified several areas where the platform delivered value, including labor savings and project acceleration. The following table summarizes the key financial impacts identified over the three-year period.

Operational Efficiencies

Beyond the direct financial returns, the study highlighted specific operational improvements driven by the platform. New team members used the GitLab Duo Agent Platform to explore codebases and development standards independently, which cut onboarding time significantly. Additionally, the platform helped diagnose pipeline failures and remediate issues during a legacy code migration, compressing an eight-month project into two months.

Quality assurance and security remediation engineers realized a 40% time savings as the platform provided contextual explanations and recommended fixes for security vulnerabilities. This reduced reliance on senior engineers and contributed to the substantial labor savings noted in the report. Individual developers also saw a 20% gain in productivity due to reduced time spent on planning, context discovery, code review, and troubleshooting.

Strategic Implications

Manav Khurana, chief product and marketing officer at GitLab, emphasized the importance of combining agentic coding with governed infrastructure. "Speed of agentic coding without control can turn into an expensive liability quickly," Khurana said. "This study shows that teams who pair agentic coding with governed agentic infrastructure get results they can measure and trust at scale."

Forrester also identified unquantified benefits, such as reduced spending on overlapping AI development tools, improved developer satisfaction, stronger cross-team collaboration, and higher-quality code output. The study was commissioned by GitLab and delivered by Forrester Consulting, with GitLab providing customer names but not participating in the interviews to ensure editorial independence.